2 * (C) 2011 Pablo Neira Ayuso <pablo@netfilter.org>
3 * (C) 2011 Intra2net AG <http://www.intra2net.com>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation (or any later at your option).
9 #include <linux/init.h>
10 #include <linux/module.h>
11 #include <linux/kernel.h>
12 #include <linux/skbuff.h>
13 #include <linux/atomic.h>
14 #include <linux/netlink.h>
15 #include <linux/rculist.h>
16 #include <linux/slab.h>
17 #include <linux/types.h>
18 #include <linux/errno.h>
19 #include <net/netlink.h>
22 #include <linux/netfilter.h>
23 #include <linux/netfilter/nfnetlink.h>
24 #include <linux/netfilter/nfnetlink_acct.h>
26 MODULE_LICENSE("GPL");
27 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
28 MODULE_DESCRIPTION("nfacct: Extended Netfilter accounting infrastructure");
34 struct list_head head
;
36 char name
[NFACCT_NAME_MAX
];
37 struct rcu_head rcu_head
;
41 struct nfacct_filter
{
46 #define NFACCT_F_QUOTA (NFACCT_F_QUOTA_PKTS | NFACCT_F_QUOTA_BYTES)
47 #define NFACCT_OVERQUOTA_BIT 2 /* NFACCT_F_OVERQUOTA */
49 static int nfnl_acct_new(struct net
*net
, struct sock
*nfnl
,
50 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
51 const struct nlattr
* const tb
[])
53 struct nf_acct
*nfacct
, *matching
= NULL
;
55 unsigned int size
= 0;
61 acct_name
= nla_data(tb
[NFACCT_NAME
]);
62 if (strlen(acct_name
) == 0)
65 list_for_each_entry(nfacct
, &net
->nfnl_acct_list
, head
) {
66 if (strncmp(nfacct
->name
, acct_name
, NFACCT_NAME_MAX
) != 0)
69 if (nlh
->nlmsg_flags
& NLM_F_EXCL
)
77 if (nlh
->nlmsg_flags
& NLM_F_REPLACE
) {
78 /* reset counters if you request a replacement. */
79 atomic64_set(&matching
->pkts
, 0);
80 atomic64_set(&matching
->bytes
, 0);
81 smp_mb__before_atomic();
82 /* reset overquota flag if quota is enabled. */
83 if ((matching
->flags
& NFACCT_F_QUOTA
))
84 clear_bit(NFACCT_OVERQUOTA_BIT
,
91 if (tb
[NFACCT_FLAGS
]) {
92 flags
= ntohl(nla_get_be32(tb
[NFACCT_FLAGS
]));
93 if (flags
& ~NFACCT_F_QUOTA
)
95 if ((flags
& NFACCT_F_QUOTA
) == NFACCT_F_QUOTA
)
97 if (flags
& NFACCT_F_OVERQUOTA
)
103 nfacct
= kzalloc(sizeof(struct nf_acct
) + size
, GFP_KERNEL
);
107 if (flags
& NFACCT_F_QUOTA
) {
108 u64
*quota
= (u64
*)nfacct
->data
;
110 *quota
= be64_to_cpu(nla_get_be64(tb
[NFACCT_QUOTA
]));
111 nfacct
->flags
= flags
;
114 strncpy(nfacct
->name
, nla_data(tb
[NFACCT_NAME
]), NFACCT_NAME_MAX
);
116 if (tb
[NFACCT_BYTES
]) {
117 atomic64_set(&nfacct
->bytes
,
118 be64_to_cpu(nla_get_be64(tb
[NFACCT_BYTES
])));
120 if (tb
[NFACCT_PKTS
]) {
121 atomic64_set(&nfacct
->pkts
,
122 be64_to_cpu(nla_get_be64(tb
[NFACCT_PKTS
])));
124 atomic_set(&nfacct
->refcnt
, 1);
125 list_add_tail_rcu(&nfacct
->head
, &net
->nfnl_acct_list
);
130 nfnl_acct_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, u32 type
,
131 int event
, struct nf_acct
*acct
)
133 struct nlmsghdr
*nlh
;
134 struct nfgenmsg
*nfmsg
;
135 unsigned int flags
= portid
? NLM_F_MULTI
: 0;
139 event
|= NFNL_SUBSYS_ACCT
<< 8;
140 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(*nfmsg
), flags
);
144 nfmsg
= nlmsg_data(nlh
);
145 nfmsg
->nfgen_family
= AF_UNSPEC
;
146 nfmsg
->version
= NFNETLINK_V0
;
149 if (nla_put_string(skb
, NFACCT_NAME
, acct
->name
))
150 goto nla_put_failure
;
152 old_flags
= acct
->flags
;
153 if (type
== NFNL_MSG_ACCT_GET_CTRZERO
) {
154 pkts
= atomic64_xchg(&acct
->pkts
, 0);
155 bytes
= atomic64_xchg(&acct
->bytes
, 0);
156 smp_mb__before_atomic();
157 if (acct
->flags
& NFACCT_F_QUOTA
)
158 clear_bit(NFACCT_OVERQUOTA_BIT
, &acct
->flags
);
160 pkts
= atomic64_read(&acct
->pkts
);
161 bytes
= atomic64_read(&acct
->bytes
);
163 if (nla_put_be64(skb
, NFACCT_PKTS
, cpu_to_be64(pkts
)) ||
164 nla_put_be64(skb
, NFACCT_BYTES
, cpu_to_be64(bytes
)) ||
165 nla_put_be32(skb
, NFACCT_USE
, htonl(atomic_read(&acct
->refcnt
))))
166 goto nla_put_failure
;
167 if (acct
->flags
& NFACCT_F_QUOTA
) {
168 u64
*quota
= (u64
*)acct
->data
;
170 if (nla_put_be32(skb
, NFACCT_FLAGS
, htonl(old_flags
)) ||
171 nla_put_be64(skb
, NFACCT_QUOTA
, cpu_to_be64(*quota
)))
172 goto nla_put_failure
;
179 nlmsg_cancel(skb
, nlh
);
184 nfnl_acct_dump(struct sk_buff
*skb
, struct netlink_callback
*cb
)
186 struct net
*net
= sock_net(skb
->sk
);
187 struct nf_acct
*cur
, *last
;
188 const struct nfacct_filter
*filter
= cb
->data
;
193 last
= (struct nf_acct
*)cb
->args
[1];
198 list_for_each_entry_rcu(cur
, &net
->nfnl_acct_list
, head
) {
206 if (filter
&& (cur
->flags
& filter
->mask
) != filter
->value
)
209 if (nfnl_acct_fill_info(skb
, NETLINK_CB(cb
->skb
).portid
,
211 NFNL_MSG_TYPE(cb
->nlh
->nlmsg_type
),
212 NFNL_MSG_ACCT_NEW
, cur
) < 0) {
213 cb
->args
[1] = (unsigned long)cur
;
223 static int nfnl_acct_done(struct netlink_callback
*cb
)
229 static const struct nla_policy filter_policy
[NFACCT_FILTER_MAX
+ 1] = {
230 [NFACCT_FILTER_MASK
] = { .type
= NLA_U32
},
231 [NFACCT_FILTER_VALUE
] = { .type
= NLA_U32
},
234 static struct nfacct_filter
*
235 nfacct_filter_alloc(const struct nlattr
* const attr
)
237 struct nfacct_filter
*filter
;
238 struct nlattr
*tb
[NFACCT_FILTER_MAX
+ 1];
241 err
= nla_parse_nested(tb
, NFACCT_FILTER_MAX
, attr
, filter_policy
);
245 if (!tb
[NFACCT_FILTER_MASK
] || !tb
[NFACCT_FILTER_VALUE
])
246 return ERR_PTR(-EINVAL
);
248 filter
= kzalloc(sizeof(struct nfacct_filter
), GFP_KERNEL
);
250 return ERR_PTR(-ENOMEM
);
252 filter
->mask
= ntohl(nla_get_be32(tb
[NFACCT_FILTER_MASK
]));
253 filter
->value
= ntohl(nla_get_be32(tb
[NFACCT_FILTER_VALUE
]));
258 static int nfnl_acct_get(struct net
*net
, struct sock
*nfnl
,
259 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
260 const struct nlattr
* const tb
[])
266 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
267 struct netlink_dump_control c
= {
268 .dump
= nfnl_acct_dump
,
269 .done
= nfnl_acct_done
,
272 if (tb
[NFACCT_FILTER
]) {
273 struct nfacct_filter
*filter
;
275 filter
= nfacct_filter_alloc(tb
[NFACCT_FILTER
]);
277 return PTR_ERR(filter
);
281 return netlink_dump_start(nfnl
, skb
, nlh
, &c
);
284 if (!tb
[NFACCT_NAME
])
286 acct_name
= nla_data(tb
[NFACCT_NAME
]);
288 list_for_each_entry(cur
, &net
->nfnl_acct_list
, head
) {
289 struct sk_buff
*skb2
;
291 if (strncmp(cur
->name
, acct_name
, NFACCT_NAME_MAX
)!= 0)
294 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
300 ret
= nfnl_acct_fill_info(skb2
, NETLINK_CB(skb
).portid
,
302 NFNL_MSG_TYPE(nlh
->nlmsg_type
),
303 NFNL_MSG_ACCT_NEW
, cur
);
308 ret
= netlink_unicast(nfnl
, skb2
, NETLINK_CB(skb
).portid
,
313 /* this avoids a loop in nfnetlink. */
314 return ret
== -EAGAIN
? -ENOBUFS
: ret
;
319 /* try to delete object, fail if it is still in use. */
320 static int nfnl_acct_try_del(struct nf_acct
*cur
)
324 /* we want to avoid races with nfnl_acct_find_get. */
325 if (atomic_dec_and_test(&cur
->refcnt
)) {
326 /* We are protected by nfnl mutex. */
327 list_del_rcu(&cur
->head
);
328 kfree_rcu(cur
, rcu_head
);
330 /* still in use, restore reference counter. */
331 atomic_inc(&cur
->refcnt
);
337 static int nfnl_acct_del(struct net
*net
, struct sock
*nfnl
,
338 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
339 const struct nlattr
* const tb
[])
345 if (!tb
[NFACCT_NAME
]) {
346 list_for_each_entry(cur
, &net
->nfnl_acct_list
, head
)
347 nfnl_acct_try_del(cur
);
351 acct_name
= nla_data(tb
[NFACCT_NAME
]);
353 list_for_each_entry(cur
, &net
->nfnl_acct_list
, head
) {
354 if (strncmp(cur
->name
, acct_name
, NFACCT_NAME_MAX
) != 0)
357 ret
= nfnl_acct_try_del(cur
);
366 static const struct nla_policy nfnl_acct_policy
[NFACCT_MAX
+1] = {
367 [NFACCT_NAME
] = { .type
= NLA_NUL_STRING
, .len
= NFACCT_NAME_MAX
-1 },
368 [NFACCT_BYTES
] = { .type
= NLA_U64
},
369 [NFACCT_PKTS
] = { .type
= NLA_U64
},
370 [NFACCT_FLAGS
] = { .type
= NLA_U32
},
371 [NFACCT_QUOTA
] = { .type
= NLA_U64
},
372 [NFACCT_FILTER
] = {.type
= NLA_NESTED
},
375 static const struct nfnl_callback nfnl_acct_cb
[NFNL_MSG_ACCT_MAX
] = {
376 [NFNL_MSG_ACCT_NEW
] = { .call
= nfnl_acct_new
,
377 .attr_count
= NFACCT_MAX
,
378 .policy
= nfnl_acct_policy
},
379 [NFNL_MSG_ACCT_GET
] = { .call
= nfnl_acct_get
,
380 .attr_count
= NFACCT_MAX
,
381 .policy
= nfnl_acct_policy
},
382 [NFNL_MSG_ACCT_GET_CTRZERO
] = { .call
= nfnl_acct_get
,
383 .attr_count
= NFACCT_MAX
,
384 .policy
= nfnl_acct_policy
},
385 [NFNL_MSG_ACCT_DEL
] = { .call
= nfnl_acct_del
,
386 .attr_count
= NFACCT_MAX
,
387 .policy
= nfnl_acct_policy
},
390 static const struct nfnetlink_subsystem nfnl_acct_subsys
= {
392 .subsys_id
= NFNL_SUBSYS_ACCT
,
393 .cb_count
= NFNL_MSG_ACCT_MAX
,
397 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_ACCT
);
399 struct nf_acct
*nfnl_acct_find_get(struct net
*net
, const char *acct_name
)
401 struct nf_acct
*cur
, *acct
= NULL
;
404 list_for_each_entry_rcu(cur
, &net
->nfnl_acct_list
, head
) {
405 if (strncmp(cur
->name
, acct_name
, NFACCT_NAME_MAX
)!= 0)
408 if (!try_module_get(THIS_MODULE
))
411 if (!atomic_inc_not_zero(&cur
->refcnt
)) {
412 module_put(THIS_MODULE
);
423 EXPORT_SYMBOL_GPL(nfnl_acct_find_get
);
425 void nfnl_acct_put(struct nf_acct
*acct
)
427 if (atomic_dec_and_test(&acct
->refcnt
))
428 kfree_rcu(acct
, rcu_head
);
430 module_put(THIS_MODULE
);
432 EXPORT_SYMBOL_GPL(nfnl_acct_put
);
434 void nfnl_acct_update(const struct sk_buff
*skb
, struct nf_acct
*nfacct
)
436 atomic64_inc(&nfacct
->pkts
);
437 atomic64_add(skb
->len
, &nfacct
->bytes
);
439 EXPORT_SYMBOL_GPL(nfnl_acct_update
);
441 static void nfnl_overquota_report(struct nf_acct
*nfacct
)
446 skb
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_ATOMIC
);
450 ret
= nfnl_acct_fill_info(skb
, 0, 0, NFNL_MSG_ACCT_OVERQUOTA
, 0,
456 netlink_broadcast(init_net
.nfnl
, skb
, 0, NFNLGRP_ACCT_QUOTA
,
460 int nfnl_acct_overquota(const struct sk_buff
*skb
, struct nf_acct
*nfacct
)
464 int ret
= NFACCT_UNDERQUOTA
;
466 /* no place here if we don't have a quota */
467 if (!(nfacct
->flags
& NFACCT_F_QUOTA
))
468 return NFACCT_NO_QUOTA
;
470 quota
= (u64
*)nfacct
->data
;
471 now
= (nfacct
->flags
& NFACCT_F_QUOTA_PKTS
) ?
472 atomic64_read(&nfacct
->pkts
) : atomic64_read(&nfacct
->bytes
);
477 !test_and_set_bit(NFACCT_OVERQUOTA_BIT
, &nfacct
->flags
)) {
478 nfnl_overquota_report(nfacct
);
483 EXPORT_SYMBOL_GPL(nfnl_acct_overquota
);
485 static int __net_init
nfnl_acct_net_init(struct net
*net
)
487 INIT_LIST_HEAD(&net
->nfnl_acct_list
);
492 static void __net_exit
nfnl_acct_net_exit(struct net
*net
)
494 struct nf_acct
*cur
, *tmp
;
496 list_for_each_entry_safe(cur
, tmp
, &net
->nfnl_acct_list
, head
) {
497 list_del_rcu(&cur
->head
);
499 if (atomic_dec_and_test(&cur
->refcnt
))
500 kfree_rcu(cur
, rcu_head
);
504 static struct pernet_operations nfnl_acct_ops
= {
505 .init
= nfnl_acct_net_init
,
506 .exit
= nfnl_acct_net_exit
,
509 static int __init
nfnl_acct_init(void)
513 ret
= register_pernet_subsys(&nfnl_acct_ops
);
515 pr_err("nfnl_acct_init: failed to register pernet ops\n");
519 pr_info("nfnl_acct: registering with nfnetlink.\n");
520 ret
= nfnetlink_subsys_register(&nfnl_acct_subsys
);
522 pr_err("nfnl_acct_init: cannot register with nfnetlink.\n");
528 unregister_pernet_subsys(&nfnl_acct_ops
);
533 static void __exit
nfnl_acct_exit(void)
535 pr_info("nfnl_acct: unregistering from nfnetlink.\n");
536 nfnetlink_subsys_unregister(&nfnl_acct_subsys
);
537 unregister_pernet_subsys(&nfnl_acct_ops
);
540 module_init(nfnl_acct_init
);
541 module_exit(nfnl_acct_exit
);