2 * (C) 2011 Pablo Neira Ayuso <pablo@netfilter.org>
3 * (C) 2011 Intra2net AG <http://www.intra2net.com>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation (or any later at your option).
9 #include <linux/init.h>
10 #include <linux/module.h>
11 #include <linux/kernel.h>
12 #include <linux/skbuff.h>
13 #include <linux/atomic.h>
14 #include <linux/netlink.h>
15 #include <linux/rculist.h>
16 #include <linux/slab.h>
17 #include <linux/types.h>
18 #include <linux/errno.h>
19 #include <net/netlink.h>
22 #include <linux/netfilter.h>
23 #include <linux/netfilter/nfnetlink.h>
24 #include <linux/netfilter/nfnetlink_acct.h>
26 MODULE_LICENSE("GPL");
27 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
28 MODULE_DESCRIPTION("nfacct: Extended Netfilter accounting infrastructure");
30 static LIST_HEAD(nfnl_acct_list
);
36 struct list_head head
;
38 char name
[NFACCT_NAME_MAX
];
39 struct rcu_head rcu_head
;
43 #define NFACCT_F_QUOTA (NFACCT_F_QUOTA_PKTS | NFACCT_F_QUOTA_BYTES)
46 nfnl_acct_new(struct sock
*nfnl
, struct sk_buff
*skb
,
47 const struct nlmsghdr
*nlh
, const struct nlattr
* const tb
[])
49 struct nf_acct
*nfacct
, *matching
= NULL
;
51 unsigned int size
= 0;
57 acct_name
= nla_data(tb
[NFACCT_NAME
]);
58 if (strlen(acct_name
) == 0)
61 list_for_each_entry(nfacct
, &nfnl_acct_list
, head
) {
62 if (strncmp(nfacct
->name
, acct_name
, NFACCT_NAME_MAX
) != 0)
65 if (nlh
->nlmsg_flags
& NLM_F_EXCL
)
73 if (nlh
->nlmsg_flags
& NLM_F_REPLACE
) {
74 /* reset counters if you request a replacement. */
75 atomic64_set(&matching
->pkts
, 0);
76 atomic64_set(&matching
->bytes
, 0);
77 smp_mb__before_atomic();
78 /* reset overquota flag if quota is enabled. */
79 if ((matching
->flags
& NFACCT_F_QUOTA
))
80 clear_bit(NFACCT_F_OVERQUOTA
, &matching
->flags
);
86 if (tb
[NFACCT_FLAGS
]) {
87 flags
= ntohl(nla_get_be32(tb
[NFACCT_FLAGS
]));
88 if (flags
& ~NFACCT_F_QUOTA
)
90 if ((flags
& NFACCT_F_QUOTA
) == NFACCT_F_QUOTA
)
92 if (flags
& NFACCT_F_OVERQUOTA
)
98 nfacct
= kzalloc(sizeof(struct nf_acct
) + size
, GFP_KERNEL
);
102 if (flags
& NFACCT_F_QUOTA
) {
103 u64
*quota
= (u64
*)nfacct
->data
;
105 *quota
= be64_to_cpu(nla_get_be64(tb
[NFACCT_QUOTA
]));
106 nfacct
->flags
= flags
;
109 strncpy(nfacct
->name
, nla_data(tb
[NFACCT_NAME
]), NFACCT_NAME_MAX
);
111 if (tb
[NFACCT_BYTES
]) {
112 atomic64_set(&nfacct
->bytes
,
113 be64_to_cpu(nla_get_be64(tb
[NFACCT_BYTES
])));
115 if (tb
[NFACCT_PKTS
]) {
116 atomic64_set(&nfacct
->pkts
,
117 be64_to_cpu(nla_get_be64(tb
[NFACCT_PKTS
])));
119 atomic_set(&nfacct
->refcnt
, 1);
120 list_add_tail_rcu(&nfacct
->head
, &nfnl_acct_list
);
125 nfnl_acct_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, u32 type
,
126 int event
, struct nf_acct
*acct
)
128 struct nlmsghdr
*nlh
;
129 struct nfgenmsg
*nfmsg
;
130 unsigned int flags
= portid
? NLM_F_MULTI
: 0;
134 event
|= NFNL_SUBSYS_ACCT
<< 8;
135 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(*nfmsg
), flags
);
139 nfmsg
= nlmsg_data(nlh
);
140 nfmsg
->nfgen_family
= AF_UNSPEC
;
141 nfmsg
->version
= NFNETLINK_V0
;
144 if (nla_put_string(skb
, NFACCT_NAME
, acct
->name
))
145 goto nla_put_failure
;
147 old_flags
= acct
->flags
;
148 if (type
== NFNL_MSG_ACCT_GET_CTRZERO
) {
149 pkts
= atomic64_xchg(&acct
->pkts
, 0);
150 bytes
= atomic64_xchg(&acct
->bytes
, 0);
151 smp_mb__before_atomic();
152 if (acct
->flags
& NFACCT_F_QUOTA
)
153 clear_bit(NFACCT_F_OVERQUOTA
, &acct
->flags
);
155 pkts
= atomic64_read(&acct
->pkts
);
156 bytes
= atomic64_read(&acct
->bytes
);
158 if (nla_put_be64(skb
, NFACCT_PKTS
, cpu_to_be64(pkts
)) ||
159 nla_put_be64(skb
, NFACCT_BYTES
, cpu_to_be64(bytes
)) ||
160 nla_put_be32(skb
, NFACCT_USE
, htonl(atomic_read(&acct
->refcnt
))))
161 goto nla_put_failure
;
162 if (acct
->flags
& NFACCT_F_QUOTA
) {
163 u64
*quota
= (u64
*)acct
->data
;
165 if (nla_put_be32(skb
, NFACCT_FLAGS
, htonl(old_flags
)) ||
166 nla_put_be64(skb
, NFACCT_QUOTA
, cpu_to_be64(*quota
)))
167 goto nla_put_failure
;
174 nlmsg_cancel(skb
, nlh
);
179 nfnl_acct_dump(struct sk_buff
*skb
, struct netlink_callback
*cb
)
181 struct nf_acct
*cur
, *last
;
186 last
= (struct nf_acct
*)cb
->args
[1];
191 list_for_each_entry_rcu(cur
, &nfnl_acct_list
, head
) {
198 if (nfnl_acct_fill_info(skb
, NETLINK_CB(cb
->skb
).portid
,
200 NFNL_MSG_TYPE(cb
->nlh
->nlmsg_type
),
201 NFNL_MSG_ACCT_NEW
, cur
) < 0) {
202 cb
->args
[1] = (unsigned long)cur
;
213 nfnl_acct_get(struct sock
*nfnl
, struct sk_buff
*skb
,
214 const struct nlmsghdr
*nlh
, const struct nlattr
* const tb
[])
220 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
221 struct netlink_dump_control c
= {
222 .dump
= nfnl_acct_dump
,
224 return netlink_dump_start(nfnl
, skb
, nlh
, &c
);
227 if (!tb
[NFACCT_NAME
])
229 acct_name
= nla_data(tb
[NFACCT_NAME
]);
231 list_for_each_entry(cur
, &nfnl_acct_list
, head
) {
232 struct sk_buff
*skb2
;
234 if (strncmp(cur
->name
, acct_name
, NFACCT_NAME_MAX
)!= 0)
237 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
243 ret
= nfnl_acct_fill_info(skb2
, NETLINK_CB(skb
).portid
,
245 NFNL_MSG_TYPE(nlh
->nlmsg_type
),
246 NFNL_MSG_ACCT_NEW
, cur
);
251 ret
= netlink_unicast(nfnl
, skb2
, NETLINK_CB(skb
).portid
,
256 /* this avoids a loop in nfnetlink. */
257 return ret
== -EAGAIN
? -ENOBUFS
: ret
;
262 /* try to delete object, fail if it is still in use. */
263 static int nfnl_acct_try_del(struct nf_acct
*cur
)
267 /* we want to avoid races with nfnl_acct_find_get. */
268 if (atomic_dec_and_test(&cur
->refcnt
)) {
269 /* We are protected by nfnl mutex. */
270 list_del_rcu(&cur
->head
);
271 kfree_rcu(cur
, rcu_head
);
273 /* still in use, restore reference counter. */
274 atomic_inc(&cur
->refcnt
);
281 nfnl_acct_del(struct sock
*nfnl
, struct sk_buff
*skb
,
282 const struct nlmsghdr
*nlh
, const struct nlattr
* const tb
[])
288 if (!tb
[NFACCT_NAME
]) {
289 list_for_each_entry(cur
, &nfnl_acct_list
, head
)
290 nfnl_acct_try_del(cur
);
294 acct_name
= nla_data(tb
[NFACCT_NAME
]);
296 list_for_each_entry(cur
, &nfnl_acct_list
, head
) {
297 if (strncmp(cur
->name
, acct_name
, NFACCT_NAME_MAX
) != 0)
300 ret
= nfnl_acct_try_del(cur
);
309 static const struct nla_policy nfnl_acct_policy
[NFACCT_MAX
+1] = {
310 [NFACCT_NAME
] = { .type
= NLA_NUL_STRING
, .len
= NFACCT_NAME_MAX
-1 },
311 [NFACCT_BYTES
] = { .type
= NLA_U64
},
312 [NFACCT_PKTS
] = { .type
= NLA_U64
},
313 [NFACCT_FLAGS
] = { .type
= NLA_U32
},
314 [NFACCT_QUOTA
] = { .type
= NLA_U64
},
317 static const struct nfnl_callback nfnl_acct_cb
[NFNL_MSG_ACCT_MAX
] = {
318 [NFNL_MSG_ACCT_NEW
] = { .call
= nfnl_acct_new
,
319 .attr_count
= NFACCT_MAX
,
320 .policy
= nfnl_acct_policy
},
321 [NFNL_MSG_ACCT_GET
] = { .call
= nfnl_acct_get
,
322 .attr_count
= NFACCT_MAX
,
323 .policy
= nfnl_acct_policy
},
324 [NFNL_MSG_ACCT_GET_CTRZERO
] = { .call
= nfnl_acct_get
,
325 .attr_count
= NFACCT_MAX
,
326 .policy
= nfnl_acct_policy
},
327 [NFNL_MSG_ACCT_DEL
] = { .call
= nfnl_acct_del
,
328 .attr_count
= NFACCT_MAX
,
329 .policy
= nfnl_acct_policy
},
332 static const struct nfnetlink_subsystem nfnl_acct_subsys
= {
334 .subsys_id
= NFNL_SUBSYS_ACCT
,
335 .cb_count
= NFNL_MSG_ACCT_MAX
,
339 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_ACCT
);
341 struct nf_acct
*nfnl_acct_find_get(const char *acct_name
)
343 struct nf_acct
*cur
, *acct
= NULL
;
346 list_for_each_entry_rcu(cur
, &nfnl_acct_list
, head
) {
347 if (strncmp(cur
->name
, acct_name
, NFACCT_NAME_MAX
)!= 0)
350 if (!try_module_get(THIS_MODULE
))
353 if (!atomic_inc_not_zero(&cur
->refcnt
)) {
354 module_put(THIS_MODULE
);
365 EXPORT_SYMBOL_GPL(nfnl_acct_find_get
);
367 void nfnl_acct_put(struct nf_acct
*acct
)
369 atomic_dec(&acct
->refcnt
);
370 module_put(THIS_MODULE
);
372 EXPORT_SYMBOL_GPL(nfnl_acct_put
);
374 void nfnl_acct_update(const struct sk_buff
*skb
, struct nf_acct
*nfacct
)
376 atomic64_inc(&nfacct
->pkts
);
377 atomic64_add(skb
->len
, &nfacct
->bytes
);
379 EXPORT_SYMBOL_GPL(nfnl_acct_update
);
381 static void nfnl_overquota_report(struct nf_acct
*nfacct
)
386 skb
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_ATOMIC
);
390 ret
= nfnl_acct_fill_info(skb
, 0, 0, NFNL_MSG_ACCT_OVERQUOTA
, 0,
396 netlink_broadcast(init_net
.nfnl
, skb
, 0, NFNLGRP_ACCT_QUOTA
,
400 int nfnl_acct_overquota(const struct sk_buff
*skb
, struct nf_acct
*nfacct
)
404 int ret
= NFACCT_UNDERQUOTA
;
406 /* no place here if we don't have a quota */
407 if (!(nfacct
->flags
& NFACCT_F_QUOTA
))
408 return NFACCT_NO_QUOTA
;
410 quota
= (u64
*)nfacct
->data
;
411 now
= (nfacct
->flags
& NFACCT_F_QUOTA_PKTS
) ?
412 atomic64_read(&nfacct
->pkts
) : atomic64_read(&nfacct
->bytes
);
417 !test_and_set_bit(NFACCT_F_OVERQUOTA
, &nfacct
->flags
)) {
418 nfnl_overquota_report(nfacct
);
423 EXPORT_SYMBOL_GPL(nfnl_acct_overquota
);
425 static int __init
nfnl_acct_init(void)
429 pr_info("nfnl_acct: registering with nfnetlink.\n");
430 ret
= nfnetlink_subsys_register(&nfnl_acct_subsys
);
432 pr_err("nfnl_acct_init: cannot register with nfnetlink.\n");
440 static void __exit
nfnl_acct_exit(void)
442 struct nf_acct
*cur
, *tmp
;
444 pr_info("nfnl_acct: unregistering from nfnetlink.\n");
445 nfnetlink_subsys_unregister(&nfnl_acct_subsys
);
447 list_for_each_entry_safe(cur
, tmp
, &nfnl_acct_list
, head
) {
448 list_del_rcu(&cur
->head
);
449 /* We are sure that our objects have no clients at this point,
450 * it's safe to release them all without checking refcnt. */
451 kfree_rcu(cur
, rcu_head
);
455 module_init(nfnl_acct_init
);
456 module_exit(nfnl_acct_exit
);