aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
Diffstat (limited to 'net')
-rw-r--r--net/netfilter/Kconfig10
-rw-r--r--net/netfilter/Makefile1
-rw-r--r--net/netfilter/xt_rateest.c178
3 files changed, 189 insertions, 0 deletions
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 22d1f10e88b0..4182393186ae 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -631,6 +631,16 @@ config NETFILTER_XT_MATCH_QUOTA
631 If you want to compile it as a module, say M here and read 631 If you want to compile it as a module, say M here and read
632 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. 632 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
633 633
634config NETFILTER_XT_MATCH_RATEEST
635 tristate '"rateest" match support'
636 depends on NETFILTER_XTABLES
637 select NETFILTER_XT_TARGET_RATEEST
638 help
639 This option adds a `rateest' match, which allows to match on the
640 rate estimated by the RATEEST target.
641
642 To compile it as a module, choose M here. If unsure, say N.
643
634config NETFILTER_XT_MATCH_REALM 644config NETFILTER_XT_MATCH_REALM
635 tristate '"realm" match support' 645 tristate '"realm" match support'
636 depends on NETFILTER_XTABLES 646 depends on NETFILTER_XTABLES
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 413afaad361f..3b9ea8fb3a07 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -73,6 +73,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_PHYSDEV) += xt_physdev.o
73obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o 73obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o
74obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o 74obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o
75obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA) += xt_quota.o 75obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA) += xt_quota.o
76obj-$(CONFIG_NETFILTER_XT_MATCH_RATEEST) += xt_rateest.o
76obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o 77obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o
77obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o 78obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o
78obj-$(CONFIG_NETFILTER_XT_MATCH_STATE) += xt_state.o 79obj-$(CONFIG_NETFILTER_XT_MATCH_STATE) += xt_state.o
diff --git a/net/netfilter/xt_rateest.c b/net/netfilter/xt_rateest.c
new file mode 100644
index 000000000000..fdb86a515146
--- /dev/null
+++ b/net/netfilter/xt_rateest.c
@@ -0,0 +1,178 @@
1/*
2 * (C) 2007 Patrick McHardy <kaber@trash.net>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 */
8#include <linux/module.h>
9#include <linux/skbuff.h>
10#include <linux/gen_stats.h>
11
12#include <linux/netfilter/x_tables.h>
13#include <linux/netfilter/xt_rateest.h>
14#include <net/netfilter/xt_rateest.h>
15
16
17static bool xt_rateest_mt(const struct sk_buff *skb,
18 const struct net_device *in,
19 const struct net_device *out,
20 const struct xt_match *match,
21 const void *matchinfo,
22 int offset,
23 unsigned int protoff,
24 bool *hotdrop)
25{
26 const struct xt_rateest_match_info *info = matchinfo;
27 struct gnet_stats_rate_est *r;
28 u_int32_t bps1, bps2, pps1, pps2;
29 bool ret = true;
30
31 spin_lock_bh(&info->est1->lock);
32 r = &info->est1->rstats;
33 if (info->flags & XT_RATEEST_MATCH_DELTA) {
34 bps1 = info->bps1 >= r->bps ? info->bps1 - r->bps : 0;
35 pps1 = info->pps1 >= r->pps ? info->pps1 - r->pps : 0;
36 } else {
37 bps1 = r->bps;
38 pps1 = r->pps;
39 }
40 spin_unlock_bh(&info->est1->lock);
41
42 if (info->flags & XT_RATEEST_MATCH_ABS) {
43 bps2 = info->bps2;
44 pps2 = info->pps2;
45 } else {
46 spin_lock_bh(&info->est2->lock);
47 r = &info->est2->rstats;
48 if (info->flags & XT_RATEEST_MATCH_DELTA) {
49 bps2 = info->bps2 >= r->bps ? info->bps2 - r->bps : 0;
50 pps2 = info->pps2 >= r->pps ? info->pps2 - r->pps : 0;
51 } else {
52 bps2 = r->bps;
53 pps2 = r->pps;
54 }
55 spin_unlock_bh(&info->est2->lock);
56 }
57
58 switch (info->mode) {
59 case XT_RATEEST_MATCH_LT:
60 if (info->flags & XT_RATEEST_MATCH_BPS)
61 ret &= bps1 < bps2;
62 if (info->flags & XT_RATEEST_MATCH_PPS)
63 ret &= pps1 < pps2;
64 break;
65 case XT_RATEEST_MATCH_GT:
66 if (info->flags & XT_RATEEST_MATCH_BPS)
67 ret &= bps1 > bps2;
68 if (info->flags & XT_RATEEST_MATCH_PPS)
69 ret &= pps1 > pps2;
70 break;
71 case XT_RATEEST_MATCH_EQ:
72 if (info->flags & XT_RATEEST_MATCH_BPS)
73 ret &= bps1 == bps2;
74 if (info->flags & XT_RATEEST_MATCH_PPS)
75 ret &= pps2 == pps2;
76 break;
77 }
78
79 ret ^= info->flags & XT_RATEEST_MATCH_INVERT ? true : false;
80 return ret;
81}
82
83static bool xt_rateest_mt_checkentry(const char *tablename,
84 const void *ip,
85 const struct xt_match *match,
86 void *matchinfo,
87 unsigned int hook_mask)
88{
89 struct xt_rateest_match_info *info = (void *)matchinfo;
90 struct xt_rateest *est1, *est2;
91
92 if (hweight32(info->flags & (XT_RATEEST_MATCH_ABS |
93 XT_RATEEST_MATCH_REL)) != 1)
94 goto err1;
95
96 if (!(info->flags & (XT_RATEEST_MATCH_BPS | XT_RATEEST_MATCH_PPS)))
97 goto err1;
98
99 switch (info->mode) {
100 case XT_RATEEST_MATCH_EQ:
101 case XT_RATEEST_MATCH_LT:
102 case XT_RATEEST_MATCH_GT:
103 break;
104 default:
105 goto err1;
106 }
107
108 est1 = xt_rateest_lookup(info->name1);
109 if (!est1)
110 goto err1;
111
112 if (info->flags & XT_RATEEST_MATCH_REL) {
113 est2 = xt_rateest_lookup(info->name2);
114 if (!est2)
115 goto err2;
116 } else
117 est2 = NULL;
118
119
120 info->est1 = est1;
121 info->est2 = est2;
122 return true;
123
124err2:
125 xt_rateest_put(est1);
126err1:
127 return false;
128}
129
130static void xt_rateest_mt_destroy(const struct xt_match *match,
131 void *matchinfo)
132{
133 struct xt_rateest_match_info *info = (void *)matchinfo;
134
135 xt_rateest_put(info->est1);
136 if (info->est2)
137 xt_rateest_put(info->est2);
138}
139
140static struct xt_match xt_rateest_match[] __read_mostly = {
141 {
142 .family = AF_INET,
143 .name = "rateest",
144 .match = xt_rateest_mt,
145 .checkentry = xt_rateest_mt_checkentry,
146 .destroy = xt_rateest_mt_destroy,
147 .matchsize = sizeof(struct xt_rateest_match_info),
148 .me = THIS_MODULE,
149 },
150 {
151 .family = AF_INET6,
152 .name = "rateest",
153 .match = xt_rateest_mt,
154 .checkentry = xt_rateest_mt_checkentry,
155 .destroy = xt_rateest_mt_destroy,
156 .matchsize = sizeof(struct xt_rateest_match_info),
157 .me = THIS_MODULE,
158 },
159};
160
161static int __init xt_rateest_mt_init(void)
162{
163 return xt_register_matches(xt_rateest_match,
164 ARRAY_SIZE(xt_rateest_match));
165}
166
167static void __exit xt_rateest_mt_fini(void)
168{
169 xt_unregister_matches(xt_rateest_match, ARRAY_SIZE(xt_rateest_match));
170}
171
172MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
173MODULE_LICENSE("GPL");
174MODULE_DESCRIPTION("xtables rate estimator match");
175MODULE_ALIAS("ipt_rateest");
176MODULE_ALIAS("ip6t_rateest");
177module_init(xt_rateest_mt_init);
178module_exit(xt_rateest_mt_fini);
generated by cgit v1.2.2 (git 2.25.0) at 2024-11-28 22:43:26 -0500