2 * (C) 2011 Pablo Neira Ayuso <pablo@netfilter.org>
3 * (C) 2011 Intra2net AG <http://www.intra2net.com>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation (or any later at your option).
9 #include <linux/init.h>
10 #include <linux/module.h>
11 #include <linux/kernel.h>
12 #include <linux/skbuff.h>
13 #include <linux/atomic.h>
14 #include <linux/netlink.h>
15 #include <linux/rculist.h>
16 #include <linux/slab.h>
17 #include <linux/types.h>
18 #include <linux/errno.h>
19 #include <net/netlink.h>
22 #include <linux/netfilter.h>
23 #include <linux/netfilter/nfnetlink.h>
24 #include <linux/netfilter/nfnetlink_acct.h>
26 MODULE_LICENSE("GPL");
27 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
28 MODULE_DESCRIPTION("nfacct: Extended Netfilter accounting infrastructure");
30 static LIST_HEAD(nfnl_acct_list
);
36 struct list_head head
;
38 char name
[NFACCT_NAME_MAX
];
39 struct rcu_head rcu_head
;
43 #define NFACCT_F_QUOTA (NFACCT_F_QUOTA_PKTS | NFACCT_F_QUOTA_BYTES)
44 #define NFACCT_OVERQUOTA_BIT 2 /* NFACCT_F_OVERQUOTA */
47 nfnl_acct_new(struct sock
*nfnl
, struct sk_buff
*skb
,
48 const struct nlmsghdr
*nlh
, const struct nlattr
* const tb
[])
50 struct nf_acct
*nfacct
, *matching
= NULL
;
52 unsigned int size
= 0;
58 acct_name
= nla_data(tb
[NFACCT_NAME
]);
59 if (strlen(acct_name
) == 0)
62 list_for_each_entry(nfacct
, &nfnl_acct_list
, head
) {
63 if (strncmp(nfacct
->name
, acct_name
, NFACCT_NAME_MAX
) != 0)
66 if (nlh
->nlmsg_flags
& NLM_F_EXCL
)
74 if (nlh
->nlmsg_flags
& NLM_F_REPLACE
) {
75 /* reset counters if you request a replacement. */
76 atomic64_set(&matching
->pkts
, 0);
77 atomic64_set(&matching
->bytes
, 0);
78 smp_mb__before_atomic();
79 /* reset overquota flag if quota is enabled. */
80 if ((matching
->flags
& NFACCT_F_QUOTA
))
81 clear_bit(NFACCT_OVERQUOTA_BIT
,
88 if (tb
[NFACCT_FLAGS
]) {
89 flags
= ntohl(nla_get_be32(tb
[NFACCT_FLAGS
]));
90 if (flags
& ~NFACCT_F_QUOTA
)
92 if ((flags
& NFACCT_F_QUOTA
) == NFACCT_F_QUOTA
)
94 if (flags
& NFACCT_F_OVERQUOTA
)
100 nfacct
= kzalloc(sizeof(struct nf_acct
) + size
, GFP_KERNEL
);
104 if (flags
& NFACCT_F_QUOTA
) {
105 u64
*quota
= (u64
*)nfacct
->data
;
107 *quota
= be64_to_cpu(nla_get_be64(tb
[NFACCT_QUOTA
]));
108 nfacct
->flags
= flags
;
111 strncpy(nfacct
->name
, nla_data(tb
[NFACCT_NAME
]), NFACCT_NAME_MAX
);
113 if (tb
[NFACCT_BYTES
]) {
114 atomic64_set(&nfacct
->bytes
,
115 be64_to_cpu(nla_get_be64(tb
[NFACCT_BYTES
])));
117 if (tb
[NFACCT_PKTS
]) {
118 atomic64_set(&nfacct
->pkts
,
119 be64_to_cpu(nla_get_be64(tb
[NFACCT_PKTS
])));
121 atomic_set(&nfacct
->refcnt
, 1);
122 list_add_tail_rcu(&nfacct
->head
, &nfnl_acct_list
);
127 nfnl_acct_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, u32 type
,
128 int event
, struct nf_acct
*acct
)
130 struct nlmsghdr
*nlh
;
131 struct nfgenmsg
*nfmsg
;
132 unsigned int flags
= portid
? NLM_F_MULTI
: 0;
136 event
|= NFNL_SUBSYS_ACCT
<< 8;
137 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(*nfmsg
), flags
);
141 nfmsg
= nlmsg_data(nlh
);
142 nfmsg
->nfgen_family
= AF_UNSPEC
;
143 nfmsg
->version
= NFNETLINK_V0
;
146 if (nla_put_string(skb
, NFACCT_NAME
, acct
->name
))
147 goto nla_put_failure
;
149 old_flags
= acct
->flags
;
150 if (type
== NFNL_MSG_ACCT_GET_CTRZERO
) {
151 pkts
= atomic64_xchg(&acct
->pkts
, 0);
152 bytes
= atomic64_xchg(&acct
->bytes
, 0);
153 smp_mb__before_atomic();
154 if (acct
->flags
& NFACCT_F_QUOTA
)
155 clear_bit(NFACCT_OVERQUOTA_BIT
, &acct
->flags
);
157 pkts
= atomic64_read(&acct
->pkts
);
158 bytes
= atomic64_read(&acct
->bytes
);
160 if (nla_put_be64(skb
, NFACCT_PKTS
, cpu_to_be64(pkts
)) ||
161 nla_put_be64(skb
, NFACCT_BYTES
, cpu_to_be64(bytes
)) ||
162 nla_put_be32(skb
, NFACCT_USE
, htonl(atomic_read(&acct
->refcnt
))))
163 goto nla_put_failure
;
164 if (acct
->flags
& NFACCT_F_QUOTA
) {
165 u64
*quota
= (u64
*)acct
->data
;
167 if (nla_put_be32(skb
, NFACCT_FLAGS
, htonl(old_flags
)) ||
168 nla_put_be64(skb
, NFACCT_QUOTA
, cpu_to_be64(*quota
)))
169 goto nla_put_failure
;
176 nlmsg_cancel(skb
, nlh
);
181 nfnl_acct_dump(struct sk_buff
*skb
, struct netlink_callback
*cb
)
183 struct nf_acct
*cur
, *last
;
188 last
= (struct nf_acct
*)cb
->args
[1];
193 list_for_each_entry_rcu(cur
, &nfnl_acct_list
, head
) {
200 if (nfnl_acct_fill_info(skb
, NETLINK_CB(cb
->skb
).portid
,
202 NFNL_MSG_TYPE(cb
->nlh
->nlmsg_type
),
203 NFNL_MSG_ACCT_NEW
, cur
) < 0) {
204 cb
->args
[1] = (unsigned long)cur
;
215 nfnl_acct_get(struct sock
*nfnl
, struct sk_buff
*skb
,
216 const struct nlmsghdr
*nlh
, const struct nlattr
* const tb
[])
222 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
223 struct netlink_dump_control c
= {
224 .dump
= nfnl_acct_dump
,
226 return netlink_dump_start(nfnl
, skb
, nlh
, &c
);
229 if (!tb
[NFACCT_NAME
])
231 acct_name
= nla_data(tb
[NFACCT_NAME
]);
233 list_for_each_entry(cur
, &nfnl_acct_list
, head
) {
234 struct sk_buff
*skb2
;
236 if (strncmp(cur
->name
, acct_name
, NFACCT_NAME_MAX
)!= 0)
239 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
245 ret
= nfnl_acct_fill_info(skb2
, NETLINK_CB(skb
).portid
,
247 NFNL_MSG_TYPE(nlh
->nlmsg_type
),
248 NFNL_MSG_ACCT_NEW
, cur
);
253 ret
= netlink_unicast(nfnl
, skb2
, NETLINK_CB(skb
).portid
,
258 /* this avoids a loop in nfnetlink. */
259 return ret
== -EAGAIN
? -ENOBUFS
: ret
;
264 /* try to delete object, fail if it is still in use. */
265 static int nfnl_acct_try_del(struct nf_acct
*cur
)
269 /* we want to avoid races with nfnl_acct_find_get. */
270 if (atomic_dec_and_test(&cur
->refcnt
)) {
271 /* We are protected by nfnl mutex. */
272 list_del_rcu(&cur
->head
);
273 kfree_rcu(cur
, rcu_head
);
275 /* still in use, restore reference counter. */
276 atomic_inc(&cur
->refcnt
);
283 nfnl_acct_del(struct sock
*nfnl
, struct sk_buff
*skb
,
284 const struct nlmsghdr
*nlh
, const struct nlattr
* const tb
[])
290 if (!tb
[NFACCT_NAME
]) {
291 list_for_each_entry(cur
, &nfnl_acct_list
, head
)
292 nfnl_acct_try_del(cur
);
296 acct_name
= nla_data(tb
[NFACCT_NAME
]);
298 list_for_each_entry(cur
, &nfnl_acct_list
, head
) {
299 if (strncmp(cur
->name
, acct_name
, NFACCT_NAME_MAX
) != 0)
302 ret
= nfnl_acct_try_del(cur
);
311 static const struct nla_policy nfnl_acct_policy
[NFACCT_MAX
+1] = {
312 [NFACCT_NAME
] = { .type
= NLA_NUL_STRING
, .len
= NFACCT_NAME_MAX
-1 },
313 [NFACCT_BYTES
] = { .type
= NLA_U64
},
314 [NFACCT_PKTS
] = { .type
= NLA_U64
},
315 [NFACCT_FLAGS
] = { .type
= NLA_U32
},
316 [NFACCT_QUOTA
] = { .type
= NLA_U64
},
319 static const struct nfnl_callback nfnl_acct_cb
[NFNL_MSG_ACCT_MAX
] = {
320 [NFNL_MSG_ACCT_NEW
] = { .call
= nfnl_acct_new
,
321 .attr_count
= NFACCT_MAX
,
322 .policy
= nfnl_acct_policy
},
323 [NFNL_MSG_ACCT_GET
] = { .call
= nfnl_acct_get
,
324 .attr_count
= NFACCT_MAX
,
325 .policy
= nfnl_acct_policy
},
326 [NFNL_MSG_ACCT_GET_CTRZERO
] = { .call
= nfnl_acct_get
,
327 .attr_count
= NFACCT_MAX
,
328 .policy
= nfnl_acct_policy
},
329 [NFNL_MSG_ACCT_DEL
] = { .call
= nfnl_acct_del
,
330 .attr_count
= NFACCT_MAX
,
331 .policy
= nfnl_acct_policy
},
334 static const struct nfnetlink_subsystem nfnl_acct_subsys
= {
336 .subsys_id
= NFNL_SUBSYS_ACCT
,
337 .cb_count
= NFNL_MSG_ACCT_MAX
,
341 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_ACCT
);
343 struct nf_acct
*nfnl_acct_find_get(const char *acct_name
)
345 struct nf_acct
*cur
, *acct
= NULL
;
348 list_for_each_entry_rcu(cur
, &nfnl_acct_list
, head
) {
349 if (strncmp(cur
->name
, acct_name
, NFACCT_NAME_MAX
)!= 0)
352 if (!try_module_get(THIS_MODULE
))
355 if (!atomic_inc_not_zero(&cur
->refcnt
)) {
356 module_put(THIS_MODULE
);
367 EXPORT_SYMBOL_GPL(nfnl_acct_find_get
);
369 void nfnl_acct_put(struct nf_acct
*acct
)
371 atomic_dec(&acct
->refcnt
);
372 module_put(THIS_MODULE
);
374 EXPORT_SYMBOL_GPL(nfnl_acct_put
);
376 void nfnl_acct_update(const struct sk_buff
*skb
, struct nf_acct
*nfacct
)
378 atomic64_inc(&nfacct
->pkts
);
379 atomic64_add(skb
->len
, &nfacct
->bytes
);
381 EXPORT_SYMBOL_GPL(nfnl_acct_update
);
383 static void nfnl_overquota_report(struct nf_acct
*nfacct
)
388 skb
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_ATOMIC
);
392 ret
= nfnl_acct_fill_info(skb
, 0, 0, NFNL_MSG_ACCT_OVERQUOTA
, 0,
398 netlink_broadcast(init_net
.nfnl
, skb
, 0, NFNLGRP_ACCT_QUOTA
,
402 int nfnl_acct_overquota(const struct sk_buff
*skb
, struct nf_acct
*nfacct
)
406 int ret
= NFACCT_UNDERQUOTA
;
408 /* no place here if we don't have a quota */
409 if (!(nfacct
->flags
& NFACCT_F_QUOTA
))
410 return NFACCT_NO_QUOTA
;
412 quota
= (u64
*)nfacct
->data
;
413 now
= (nfacct
->flags
& NFACCT_F_QUOTA_PKTS
) ?
414 atomic64_read(&nfacct
->pkts
) : atomic64_read(&nfacct
->bytes
);
419 !test_and_set_bit(NFACCT_OVERQUOTA_BIT
, &nfacct
->flags
)) {
420 nfnl_overquota_report(nfacct
);
425 EXPORT_SYMBOL_GPL(nfnl_acct_overquota
);
427 static int __init
nfnl_acct_init(void)
431 pr_info("nfnl_acct: registering with nfnetlink.\n");
432 ret
= nfnetlink_subsys_register(&nfnl_acct_subsys
);
434 pr_err("nfnl_acct_init: cannot register with nfnetlink.\n");
442 static void __exit
nfnl_acct_exit(void)
444 struct nf_acct
*cur
, *tmp
;
446 pr_info("nfnl_acct: unregistering from nfnetlink.\n");
447 nfnetlink_subsys_unregister(&nfnl_acct_subsys
);
449 list_for_each_entry_safe(cur
, tmp
, &nfnl_acct_list
, head
) {
450 list_del_rcu(&cur
->head
);
451 /* We are sure that our objects have no clients at this point,
452 * it's safe to release them all without checking refcnt. */
453 kfree_rcu(cur
, rcu_head
);
457 module_init(nfnl_acct_init
);
458 module_exit(nfnl_acct_exit
);