2 * (C) 2011 Pablo Neira Ayuso <pablo@netfilter.org>
3 * (C) 2011 Intra2net AG <http://www.intra2net.com>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation (or any later at your option).
9 #include <linux/init.h>
10 #include <linux/module.h>
11 #include <linux/kernel.h>
12 #include <linux/skbuff.h>
13 #include <linux/atomic.h>
14 #include <linux/netlink.h>
15 #include <linux/rculist.h>
16 #include <linux/slab.h>
17 #include <linux/types.h>
18 #include <linux/errno.h>
19 #include <net/netlink.h>
22 #include <linux/netfilter.h>
23 #include <linux/netfilter/nfnetlink.h>
24 #include <linux/netfilter/nfnetlink_acct.h>
26 MODULE_LICENSE("GPL");
27 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
28 MODULE_DESCRIPTION("nfacct: Extended Netfilter accounting infrastructure");
30 static LIST_HEAD(nfnl_acct_list
);
35 struct list_head head
;
37 char name
[NFACCT_NAME_MAX
];
38 struct rcu_head rcu_head
;
42 nfnl_acct_new(struct sock
*nfnl
, struct sk_buff
*skb
,
43 const struct nlmsghdr
*nlh
, const struct nlattr
* const tb
[])
45 struct nf_acct
*nfacct
, *matching
= NULL
;
51 acct_name
= nla_data(tb
[NFACCT_NAME
]);
52 if (strlen(acct_name
) == 0)
55 list_for_each_entry(nfacct
, &nfnl_acct_list
, head
) {
56 if (strncmp(nfacct
->name
, acct_name
, NFACCT_NAME_MAX
) != 0)
59 if (nlh
->nlmsg_flags
& NLM_F_EXCL
)
67 if (nlh
->nlmsg_flags
& NLM_F_REPLACE
) {
68 /* reset counters if you request a replacement. */
69 atomic64_set(&matching
->pkts
, 0);
70 atomic64_set(&matching
->bytes
, 0);
76 nfacct
= kzalloc(sizeof(struct nf_acct
), GFP_KERNEL
);
80 strncpy(nfacct
->name
, nla_data(tb
[NFACCT_NAME
]), NFACCT_NAME_MAX
);
82 if (tb
[NFACCT_BYTES
]) {
83 atomic64_set(&nfacct
->bytes
,
84 be64_to_cpu(nla_get_be64(tb
[NFACCT_BYTES
])));
86 if (tb
[NFACCT_PKTS
]) {
87 atomic64_set(&nfacct
->pkts
,
88 be64_to_cpu(nla_get_be64(tb
[NFACCT_PKTS
])));
90 atomic_set(&nfacct
->refcnt
, 1);
91 list_add_tail_rcu(&nfacct
->head
, &nfnl_acct_list
);
96 nfnl_acct_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, u32 type
,
97 int event
, struct nf_acct
*acct
)
100 struct nfgenmsg
*nfmsg
;
101 unsigned int flags
= portid
? NLM_F_MULTI
: 0;
104 event
|= NFNL_SUBSYS_ACCT
<< 8;
105 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(*nfmsg
), flags
);
109 nfmsg
= nlmsg_data(nlh
);
110 nfmsg
->nfgen_family
= AF_UNSPEC
;
111 nfmsg
->version
= NFNETLINK_V0
;
114 if (nla_put_string(skb
, NFACCT_NAME
, acct
->name
))
115 goto nla_put_failure
;
117 if (type
== NFNL_MSG_ACCT_GET_CTRZERO
) {
118 pkts
= atomic64_xchg(&acct
->pkts
, 0);
119 bytes
= atomic64_xchg(&acct
->bytes
, 0);
121 pkts
= atomic64_read(&acct
->pkts
);
122 bytes
= atomic64_read(&acct
->bytes
);
124 if (nla_put_be64(skb
, NFACCT_PKTS
, cpu_to_be64(pkts
)) ||
125 nla_put_be64(skb
, NFACCT_BYTES
, cpu_to_be64(bytes
)) ||
126 nla_put_be32(skb
, NFACCT_USE
, htonl(atomic_read(&acct
->refcnt
))))
127 goto nla_put_failure
;
134 nlmsg_cancel(skb
, nlh
);
139 nfnl_acct_dump(struct sk_buff
*skb
, struct netlink_callback
*cb
)
141 struct nf_acct
*cur
, *last
;
146 last
= (struct nf_acct
*)cb
->args
[1];
151 list_for_each_entry_rcu(cur
, &nfnl_acct_list
, head
) {
152 if (last
&& cur
!= last
)
155 if (nfnl_acct_fill_info(skb
, NETLINK_CB(cb
->skb
).portid
,
157 NFNL_MSG_TYPE(cb
->nlh
->nlmsg_type
),
158 NFNL_MSG_ACCT_NEW
, cur
) < 0) {
159 cb
->args
[1] = (unsigned long)cur
;
170 nfnl_acct_get(struct sock
*nfnl
, struct sk_buff
*skb
,
171 const struct nlmsghdr
*nlh
, const struct nlattr
* const tb
[])
177 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
178 struct netlink_dump_control c
= {
179 .dump
= nfnl_acct_dump
,
181 return netlink_dump_start(nfnl
, skb
, nlh
, &c
);
184 if (!tb
[NFACCT_NAME
])
186 acct_name
= nla_data(tb
[NFACCT_NAME
]);
188 list_for_each_entry(cur
, &nfnl_acct_list
, head
) {
189 struct sk_buff
*skb2
;
191 if (strncmp(cur
->name
, acct_name
, NFACCT_NAME_MAX
)!= 0)
194 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
200 ret
= nfnl_acct_fill_info(skb2
, NETLINK_CB(skb
).portid
,
202 NFNL_MSG_TYPE(nlh
->nlmsg_type
),
203 NFNL_MSG_ACCT_NEW
, cur
);
208 ret
= netlink_unicast(nfnl
, skb2
, NETLINK_CB(skb
).portid
,
213 /* this avoids a loop in nfnetlink. */
214 return ret
== -EAGAIN
? -ENOBUFS
: ret
;
219 /* try to delete object, fail if it is still in use. */
220 static int nfnl_acct_try_del(struct nf_acct
*cur
)
224 /* we want to avoid races with nfnl_acct_find_get. */
225 if (atomic_dec_and_test(&cur
->refcnt
)) {
226 /* We are protected by nfnl mutex. */
227 list_del_rcu(&cur
->head
);
228 kfree_rcu(cur
, rcu_head
);
230 /* still in use, restore reference counter. */
231 atomic_inc(&cur
->refcnt
);
238 nfnl_acct_del(struct sock
*nfnl
, struct sk_buff
*skb
,
239 const struct nlmsghdr
*nlh
, const struct nlattr
* const tb
[])
245 if (!tb
[NFACCT_NAME
]) {
246 list_for_each_entry(cur
, &nfnl_acct_list
, head
)
247 nfnl_acct_try_del(cur
);
251 acct_name
= nla_data(tb
[NFACCT_NAME
]);
253 list_for_each_entry(cur
, &nfnl_acct_list
, head
) {
254 if (strncmp(cur
->name
, acct_name
, NFACCT_NAME_MAX
) != 0)
257 ret
= nfnl_acct_try_del(cur
);
266 static const struct nla_policy nfnl_acct_policy
[NFACCT_MAX
+1] = {
267 [NFACCT_NAME
] = { .type
= NLA_NUL_STRING
, .len
= NFACCT_NAME_MAX
-1 },
268 [NFACCT_BYTES
] = { .type
= NLA_U64
},
269 [NFACCT_PKTS
] = { .type
= NLA_U64
},
272 static const struct nfnl_callback nfnl_acct_cb
[NFNL_MSG_ACCT_MAX
] = {
273 [NFNL_MSG_ACCT_NEW
] = { .call
= nfnl_acct_new
,
274 .attr_count
= NFACCT_MAX
,
275 .policy
= nfnl_acct_policy
},
276 [NFNL_MSG_ACCT_GET
] = { .call
= nfnl_acct_get
,
277 .attr_count
= NFACCT_MAX
,
278 .policy
= nfnl_acct_policy
},
279 [NFNL_MSG_ACCT_GET_CTRZERO
] = { .call
= nfnl_acct_get
,
280 .attr_count
= NFACCT_MAX
,
281 .policy
= nfnl_acct_policy
},
282 [NFNL_MSG_ACCT_DEL
] = { .call
= nfnl_acct_del
,
283 .attr_count
= NFACCT_MAX
,
284 .policy
= nfnl_acct_policy
},
287 static const struct nfnetlink_subsystem nfnl_acct_subsys
= {
289 .subsys_id
= NFNL_SUBSYS_ACCT
,
290 .cb_count
= NFNL_MSG_ACCT_MAX
,
294 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_ACCT
);
296 struct nf_acct
*nfnl_acct_find_get(const char *acct_name
)
298 struct nf_acct
*cur
, *acct
= NULL
;
301 list_for_each_entry_rcu(cur
, &nfnl_acct_list
, head
) {
302 if (strncmp(cur
->name
, acct_name
, NFACCT_NAME_MAX
)!= 0)
305 if (!try_module_get(THIS_MODULE
))
308 if (!atomic_inc_not_zero(&cur
->refcnt
)) {
309 module_put(THIS_MODULE
);
320 EXPORT_SYMBOL_GPL(nfnl_acct_find_get
);
322 void nfnl_acct_put(struct nf_acct
*acct
)
324 atomic_dec(&acct
->refcnt
);
325 module_put(THIS_MODULE
);
327 EXPORT_SYMBOL_GPL(nfnl_acct_put
);
329 void nfnl_acct_update(const struct sk_buff
*skb
, struct nf_acct
*nfacct
)
331 atomic64_inc(&nfacct
->pkts
);
332 atomic64_add(skb
->len
, &nfacct
->bytes
);
334 EXPORT_SYMBOL_GPL(nfnl_acct_update
);
336 static int __init
nfnl_acct_init(void)
340 pr_info("nfnl_acct: registering with nfnetlink.\n");
341 ret
= nfnetlink_subsys_register(&nfnl_acct_subsys
);
343 pr_err("nfnl_acct_init: cannot register with nfnetlink.\n");
351 static void __exit
nfnl_acct_exit(void)
353 struct nf_acct
*cur
, *tmp
;
355 pr_info("nfnl_acct: unregistering from nfnetlink.\n");
356 nfnetlink_subsys_unregister(&nfnl_acct_subsys
);
358 list_for_each_entry_safe(cur
, tmp
, &nfnl_acct_list
, head
) {
359 list_del_rcu(&cur
->head
);
360 /* We are sure that our objects have no clients at this point,
361 * it's safe to release them all without checking refcnt. */
362 kfree_rcu(cur
, rcu_head
);
366 module_init(nfnl_acct_init
);
367 module_exit(nfnl_acct_exit
);