1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * (C) 2011 Pablo Neira Ayuso <pablo@netfilter.org>
4 * (C) 2011 Intra2net AG <http://www.intra2net.com>
5 */
6 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
7
8 #include <linux/module.h>
9 #include <linux/skbuff.h>
10
11 #include <linux/netfilter/x_tables.h>
12 #include <linux/netfilter/nfnetlink_acct.h>
13 #include <linux/netfilter/xt_nfacct.h>
14
15 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
16 MODULE_DESCRIPTION("Xtables: match for the extended accounting infrastructure");
17 MODULE_LICENSE("GPL");
18 MODULE_ALIAS("ipt_nfacct");
19 MODULE_ALIAS("ip6t_nfacct");
20
nfacct_mt(const struct sk_buff * skb,struct xt_action_param * par)21 static bool nfacct_mt(const struct sk_buff *skb, struct xt_action_param *par)
22 {
23 int overquota;
24 const struct xt_nfacct_match_info *info = par->targinfo;
25
26 nfnl_acct_update(skb, info->nfacct);
27
28 overquota = nfnl_acct_overquota(xt_net(par), info->nfacct);
29
30 return overquota == NFACCT_UNDERQUOTA ? false : true;
31 }
32
33 static int
nfacct_mt_checkentry(const struct xt_mtchk_param * par)34 nfacct_mt_checkentry(const struct xt_mtchk_param *par)
35 {
36 struct xt_nfacct_match_info *info = par->matchinfo;
37 struct nf_acct *nfacct;
38
39 nfacct = nfnl_acct_find_get(par->net, info->name);
40 if (nfacct == NULL) {
41 pr_info_ratelimited("accounting object `%s' does not exists\n",
42 info->name);
43 return -ENOENT;
44 }
45 info->nfacct = nfacct;
46 return 0;
47 }
48
49 static void
nfacct_mt_destroy(const struct xt_mtdtor_param * par)50 nfacct_mt_destroy(const struct xt_mtdtor_param *par)
51 {
52 const struct xt_nfacct_match_info *info = par->matchinfo;
53
54 nfnl_acct_put(info->nfacct);
55 }
56
57 static struct xt_match nfacct_mt_reg[] __read_mostly = {
58 {
59 .name = "nfacct",
60 .revision = 0,
61 .family = NFPROTO_UNSPEC,
62 .checkentry = nfacct_mt_checkentry,
63 .match = nfacct_mt,
64 .destroy = nfacct_mt_destroy,
65 .matchsize = sizeof(struct xt_nfacct_match_info),
66 .usersize = offsetof(struct xt_nfacct_match_info, nfacct),
67 .me = THIS_MODULE,
68 },
69 {
70 .name = "nfacct",
71 .revision = 1,
72 .family = NFPROTO_UNSPEC,
73 .checkentry = nfacct_mt_checkentry,
74 .match = nfacct_mt,
75 .destroy = nfacct_mt_destroy,
76 .matchsize = sizeof(struct xt_nfacct_match_info_v1),
77 .usersize = offsetof(struct xt_nfacct_match_info_v1, nfacct),
78 .me = THIS_MODULE,
79 },
80 };
81
nfacct_mt_init(void)82 static int __init nfacct_mt_init(void)
83 {
84 return xt_register_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg));
85 }
86
nfacct_mt_exit(void)87 static void __exit nfacct_mt_exit(void)
88 {
89 xt_unregister_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg));
90 }
91
92 module_init(nfacct_mt_init);
93 module_exit(nfacct_mt_exit);
94