extensions: add nfacct match

This patch provides the user-space iptables support for the nfacct match.
This can be used as it follows:

 nfacct add http-traffic
 iptables -I INPUT -p tcp --sport 80 -m nfacct --nfacct-name http-traffic
 iptables -I OUTPUT -p tcp --dport 80 -m nfacct --nfacct-name http-traffic
 nfacct get http-traffic

See also man nfacct(8) for more information.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/extensions/libxt_nfacct.c b/extensions/libxt_nfacct.c
new file mode 100644 (file)
index 0000000..2ad59d5
--- /dev/null
+++ b/extensions/libxt_nfacct.c
@@ -0,0 +1,89 @@
+/*
+ * (C) 2011 by Pablo Neira Ayuso <pablo@netfilter.org>
+ * (C) 2011 by Intra2Net AG <http://www.intra2net.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 (or
+ * any later at your option) as published by the Free Software Foundation.
+ */
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <getopt.h>
+#include <xtables.h>
+
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_nfacct.h>
+
+enum {
+       O_NAME = 0,
+};
+
+#define s struct xt_nfacct_match_info
+static const struct xt_option_entry nfacct_opts[] = {
+       {.name = "nfacct-name", .id = O_NAME, .type = XTTYPE_STRING,
+        .min = 1, .flags = XTOPT_MAND|XTOPT_PUT, XTOPT_POINTER(s, name)},
+       XTOPT_TABLEEND,
+};
+#undef s
+
+static void nfacct_help(void)
+{
+       printf("nfacct match options:\n"
+              " --nfacct-name STRING           Name of accouting area\n");
+}
+
+static void nfacct_parse(struct xt_option_call *cb)
+{
+       xtables_option_parse(cb);
+       switch (cb->entry->id) {
+       case O_NAME:
+               if (strchr(cb->arg, '\n') != NULL)
+                       xtables_error(PARAMETER_PROBLEM,
+                                  "Newlines not allowed in --nfacct-name");
+               break;
+       }
+}
+
+static void
+nfacct_print_name(const struct xt_nfacct_match_info *info, char *name)
+{
+       printf(" %snfacct-name ", name);
+       xtables_save_string(info->name);
+}
+
+static void nfacct_print(const void *ip, const struct xt_entry_match *match,
+                        int numeric)
+{
+       const struct xt_nfacct_match_info *info =
+               (struct xt_nfacct_match_info *)match->data;
+
+       nfacct_print_name(info, "");
+}
+
+static void nfacct_save(const void *ip, const struct xt_entry_match *match)
+{
+       const struct xt_nfacct_match_info *info =
+               (struct xt_nfacct_match_info *)match->data;
+
+       nfacct_print_name(info, "--");
+}
+
+static struct xtables_match nfacct_match = {
+       .family         = NFPROTO_UNSPEC,
+       .name           = "nfacct",
+       .version        = XTABLES_VERSION,
+       .size           = XT_ALIGN(sizeof(struct xt_nfacct_match_info)),
+       .userspacesize  = offsetof(struct xt_nfacct_match_info, nfacct),
+       .help           = nfacct_help,
+       .x6_parse       = nfacct_parse,
+       .print          = nfacct_print,
+       .save           = nfacct_save,
+       .x6_options     = nfacct_opts,
+};
+
+void _init(void)
+{
+       xtables_register_match(&nfacct_match);
+}

diff --git a/extensions/libxt_nfacct.man b/extensions/libxt_nfacct.man
new file mode 100644 (file)
index 0000000..b755f97
--- /dev/null
+++ b/extensions/libxt_nfacct.man
@@ -0,0 +1,30 @@
+The nfacct match provides the extended accounting infrastructure for iptables.
+You have to use this match together with the standalone user-space utility
+.B nfacct(8)
+.PP
+The only option available for this match is the following:
+.TP
+\fB\-\-nfacct\-name\fP \fIname\fP
+This allows you to specify the existing object name that will be use for
+accounting the traffic that this rule-set is matching.
+.PP
+To use this extension, you have to create an accounting object:
+.IP
+nfacct add http\-traffic
+.PP
+Then, you have to attach it to the accounting object via iptables:
+.IP
+iptables \-I INPUT \-p tcp \-\-sport 80 \-m nfacct \-\-nfacct\-name http\-traffic
+.IP
+iptables \-I OUTPUT \-p tcp \-\-dport 80 \-m nfacct \-\-nfacct\-name http\-traffic
+.PP
+Then, you can check for the amount of traffic that the rules match:
+.IP
+nfacct get http\-traffic
+.IP
+{ pkts = 00000000000000000156, bytes = 00000000000000151786 } = http-traffic;
+.PP
+You can obtain
+.B nfacct(8)
+from http://www.netfilter.org or, alternatively, from the git.netfilter.org
+repository.

diff --git a/include/linux/netfilter/xt_nfacct.h b/include/linux/netfilter/xt_nfacct.h
new file mode 100644 (file)
index 0000000..59ab00d
--- /dev/null
+++ b/include/linux/netfilter/xt_nfacct.h
@@ -0,0 +1,17 @@
+#ifndef _XT_NFACCT_MATCH_H
+#define _XT_NFACCT_MATCH_H
+
+#include <linux/types.h>
+
+#ifndef NFACCT_NAME_MAX
+#define NFACCT_NAME_MAX 32
+#endif
+
+struct nf_acct;
+
+struct xt_nfacct_match_info {
+       char            name[NFACCT_NAME_MAX];
+       struct nf_acct  *nfacct;
+};
+
+#endif /* _XT_NFACCT_MATCH_H */