1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * (C) 2011 Pablo Neira Ayuso <pablo@netfilter.org>
4 * (C) 2011 Intra2net AG <https://www.intra2net.com>
6 #include <linux/init.h>
7 #include <linux/module.h>
8 #include <linux/kernel.h>
9 #include <linux/skbuff.h>
10 #include <linux/atomic.h>
11 #include <linux/refcount.h>
12 #include <linux/netlink.h>
13 #include <linux/rculist.h>
14 #include <linux/slab.h>
15 #include <linux/types.h>
16 #include <linux/errno.h>
17 #include <net/netlink.h>
19 #include <net/netns/generic.h>
21 #include <linux/netfilter.h>
22 #include <linux/netfilter/nfnetlink.h>
23 #include <linux/netfilter/nfnetlink_acct.h>
25 MODULE_LICENSE("GPL");
26 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
27 MODULE_DESCRIPTION("nfacct: Extended Netfilter accounting infrastructure");
33 struct list_head head
;
35 char name
[NFACCT_NAME_MAX
];
36 struct rcu_head rcu_head
;
40 struct nfacct_filter
{
45 struct nfnl_acct_net
{
46 struct list_head nfnl_acct_list
;
49 static unsigned int nfnl_acct_net_id __read_mostly
;
51 static inline struct nfnl_acct_net
*nfnl_acct_pernet(struct net
*net
)
53 return net_generic(net
, nfnl_acct_net_id
);
56 #define NFACCT_F_QUOTA (NFACCT_F_QUOTA_PKTS | NFACCT_F_QUOTA_BYTES)
57 #define NFACCT_OVERQUOTA_BIT 2 /* NFACCT_F_OVERQUOTA */
59 static int nfnl_acct_new(struct net
*net
, struct sock
*nfnl
,
60 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
61 const struct nlattr
* const tb
[],
62 struct netlink_ext_ack
*extack
)
64 struct nfnl_acct_net
*nfnl_acct_net
= nfnl_acct_pernet(net
);
65 struct nf_acct
*nfacct
, *matching
= NULL
;
67 unsigned int size
= 0;
73 acct_name
= nla_data(tb
[NFACCT_NAME
]);
74 if (strlen(acct_name
) == 0)
77 list_for_each_entry(nfacct
, &nfnl_acct_net
->nfnl_acct_list
, head
) {
78 if (strncmp(nfacct
->name
, acct_name
, NFACCT_NAME_MAX
) != 0)
81 if (nlh
->nlmsg_flags
& NLM_F_EXCL
)
89 if (nlh
->nlmsg_flags
& NLM_F_REPLACE
) {
90 /* reset counters if you request a replacement. */
91 atomic64_set(&matching
->pkts
, 0);
92 atomic64_set(&matching
->bytes
, 0);
93 smp_mb__before_atomic();
94 /* reset overquota flag if quota is enabled. */
95 if ((matching
->flags
& NFACCT_F_QUOTA
))
96 clear_bit(NFACCT_OVERQUOTA_BIT
,
103 if (tb
[NFACCT_FLAGS
]) {
104 flags
= ntohl(nla_get_be32(tb
[NFACCT_FLAGS
]));
105 if (flags
& ~NFACCT_F_QUOTA
)
107 if ((flags
& NFACCT_F_QUOTA
) == NFACCT_F_QUOTA
)
109 if (flags
& NFACCT_F_OVERQUOTA
)
111 if ((flags
& NFACCT_F_QUOTA
) && !tb
[NFACCT_QUOTA
])
117 nfacct
= kzalloc(sizeof(struct nf_acct
) + size
, GFP_KERNEL
);
121 if (flags
& NFACCT_F_QUOTA
) {
122 u64
*quota
= (u64
*)nfacct
->data
;
124 *quota
= be64_to_cpu(nla_get_be64(tb
[NFACCT_QUOTA
]));
125 nfacct
->flags
= flags
;
128 nla_strscpy(nfacct
->name
, tb
[NFACCT_NAME
], NFACCT_NAME_MAX
);
130 if (tb
[NFACCT_BYTES
]) {
131 atomic64_set(&nfacct
->bytes
,
132 be64_to_cpu(nla_get_be64(tb
[NFACCT_BYTES
])));
134 if (tb
[NFACCT_PKTS
]) {
135 atomic64_set(&nfacct
->pkts
,
136 be64_to_cpu(nla_get_be64(tb
[NFACCT_PKTS
])));
138 refcount_set(&nfacct
->refcnt
, 1);
139 list_add_tail_rcu(&nfacct
->head
, &nfnl_acct_net
->nfnl_acct_list
);
144 nfnl_acct_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, u32 type
,
145 int event
, struct nf_acct
*acct
)
147 struct nlmsghdr
*nlh
;
148 unsigned int flags
= portid
? NLM_F_MULTI
: 0;
152 event
= nfnl_msg_type(NFNL_SUBSYS_ACCT
, event
);
153 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, AF_UNSPEC
,
158 if (nla_put_string(skb
, NFACCT_NAME
, acct
->name
))
159 goto nla_put_failure
;
161 old_flags
= acct
->flags
;
162 if (type
== NFNL_MSG_ACCT_GET_CTRZERO
) {
163 pkts
= atomic64_xchg(&acct
->pkts
, 0);
164 bytes
= atomic64_xchg(&acct
->bytes
, 0);
165 smp_mb__before_atomic();
166 if (acct
->flags
& NFACCT_F_QUOTA
)
167 clear_bit(NFACCT_OVERQUOTA_BIT
, &acct
->flags
);
169 pkts
= atomic64_read(&acct
->pkts
);
170 bytes
= atomic64_read(&acct
->bytes
);
172 if (nla_put_be64(skb
, NFACCT_PKTS
, cpu_to_be64(pkts
),
174 nla_put_be64(skb
, NFACCT_BYTES
, cpu_to_be64(bytes
),
176 nla_put_be32(skb
, NFACCT_USE
, htonl(refcount_read(&acct
->refcnt
))))
177 goto nla_put_failure
;
178 if (acct
->flags
& NFACCT_F_QUOTA
) {
179 u64
*quota
= (u64
*)acct
->data
;
181 if (nla_put_be32(skb
, NFACCT_FLAGS
, htonl(old_flags
)) ||
182 nla_put_be64(skb
, NFACCT_QUOTA
, cpu_to_be64(*quota
),
184 goto nla_put_failure
;
191 nlmsg_cancel(skb
, nlh
);
196 nfnl_acct_dump(struct sk_buff
*skb
, struct netlink_callback
*cb
)
198 struct net
*net
= sock_net(skb
->sk
);
199 struct nfnl_acct_net
*nfnl_acct_net
= nfnl_acct_pernet(net
);
200 struct nf_acct
*cur
, *last
;
201 const struct nfacct_filter
*filter
= cb
->data
;
206 last
= (struct nf_acct
*)cb
->args
[1];
211 list_for_each_entry_rcu(cur
, &nfnl_acct_net
->nfnl_acct_list
, head
) {
219 if (filter
&& (cur
->flags
& filter
->mask
) != filter
->value
)
222 if (nfnl_acct_fill_info(skb
, NETLINK_CB(cb
->skb
).portid
,
224 NFNL_MSG_TYPE(cb
->nlh
->nlmsg_type
),
225 NFNL_MSG_ACCT_NEW
, cur
) < 0) {
226 cb
->args
[1] = (unsigned long)cur
;
236 static int nfnl_acct_done(struct netlink_callback
*cb
)
242 static const struct nla_policy filter_policy
[NFACCT_FILTER_MAX
+ 1] = {
243 [NFACCT_FILTER_MASK
] = { .type
= NLA_U32
},
244 [NFACCT_FILTER_VALUE
] = { .type
= NLA_U32
},
247 static int nfnl_acct_start(struct netlink_callback
*cb
)
249 const struct nlattr
*const attr
= cb
->data
;
250 struct nlattr
*tb
[NFACCT_FILTER_MAX
+ 1];
251 struct nfacct_filter
*filter
;
257 err
= nla_parse_nested_deprecated(tb
, NFACCT_FILTER_MAX
, attr
,
258 filter_policy
, NULL
);
262 if (!tb
[NFACCT_FILTER_MASK
] || !tb
[NFACCT_FILTER_VALUE
])
265 filter
= kzalloc(sizeof(struct nfacct_filter
), GFP_KERNEL
);
269 filter
->mask
= ntohl(nla_get_be32(tb
[NFACCT_FILTER_MASK
]));
270 filter
->value
= ntohl(nla_get_be32(tb
[NFACCT_FILTER_VALUE
]));
276 static int nfnl_acct_get(struct net
*net
, struct sock
*nfnl
,
277 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
278 const struct nlattr
* const tb
[],
279 struct netlink_ext_ack
*extack
)
281 struct nfnl_acct_net
*nfnl_acct_net
= nfnl_acct_pernet(net
);
286 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
287 struct netlink_dump_control c
= {
288 .dump
= nfnl_acct_dump
,
289 .start
= nfnl_acct_start
,
290 .done
= nfnl_acct_done
,
291 .data
= (void *)tb
[NFACCT_FILTER
],
294 return netlink_dump_start(nfnl
, skb
, nlh
, &c
);
297 if (!tb
[NFACCT_NAME
])
299 acct_name
= nla_data(tb
[NFACCT_NAME
]);
301 list_for_each_entry(cur
, &nfnl_acct_net
->nfnl_acct_list
, head
) {
302 struct sk_buff
*skb2
;
304 if (strncmp(cur
->name
, acct_name
, NFACCT_NAME_MAX
)!= 0)
307 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
313 ret
= nfnl_acct_fill_info(skb2
, NETLINK_CB(skb
).portid
,
315 NFNL_MSG_TYPE(nlh
->nlmsg_type
),
316 NFNL_MSG_ACCT_NEW
, cur
);
321 ret
= netlink_unicast(nfnl
, skb2
, NETLINK_CB(skb
).portid
,
326 /* this avoids a loop in nfnetlink. */
327 return ret
== -EAGAIN
? -ENOBUFS
: ret
;
332 /* try to delete object, fail if it is still in use. */
333 static int nfnl_acct_try_del(struct nf_acct
*cur
)
337 /* We want to avoid races with nfnl_acct_put. So only when the current
338 * refcnt is 1, we decrease it to 0.
340 if (refcount_dec_if_one(&cur
->refcnt
)) {
341 /* We are protected by nfnl mutex. */
342 list_del_rcu(&cur
->head
);
343 kfree_rcu(cur
, rcu_head
);
350 static int nfnl_acct_del(struct net
*net
, struct sock
*nfnl
,
351 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
352 const struct nlattr
* const tb
[],
353 struct netlink_ext_ack
*extack
)
355 struct nfnl_acct_net
*nfnl_acct_net
= nfnl_acct_pernet(net
);
356 struct nf_acct
*cur
, *tmp
;
360 if (!tb
[NFACCT_NAME
]) {
361 list_for_each_entry_safe(cur
, tmp
, &nfnl_acct_net
->nfnl_acct_list
, head
)
362 nfnl_acct_try_del(cur
);
366 acct_name
= nla_data(tb
[NFACCT_NAME
]);
368 list_for_each_entry(cur
, &nfnl_acct_net
->nfnl_acct_list
, head
) {
369 if (strncmp(cur
->name
, acct_name
, NFACCT_NAME_MAX
) != 0)
372 ret
= nfnl_acct_try_del(cur
);
381 static const struct nla_policy nfnl_acct_policy
[NFACCT_MAX
+1] = {
382 [NFACCT_NAME
] = { .type
= NLA_NUL_STRING
, .len
= NFACCT_NAME_MAX
-1 },
383 [NFACCT_BYTES
] = { .type
= NLA_U64
},
384 [NFACCT_PKTS
] = { .type
= NLA_U64
},
385 [NFACCT_FLAGS
] = { .type
= NLA_U32
},
386 [NFACCT_QUOTA
] = { .type
= NLA_U64
},
387 [NFACCT_FILTER
] = {.type
= NLA_NESTED
},
390 static const struct nfnl_callback nfnl_acct_cb
[NFNL_MSG_ACCT_MAX
] = {
391 [NFNL_MSG_ACCT_NEW
] = { .call
= nfnl_acct_new
,
392 .attr_count
= NFACCT_MAX
,
393 .policy
= nfnl_acct_policy
},
394 [NFNL_MSG_ACCT_GET
] = { .call
= nfnl_acct_get
,
395 .attr_count
= NFACCT_MAX
,
396 .policy
= nfnl_acct_policy
},
397 [NFNL_MSG_ACCT_GET_CTRZERO
] = { .call
= nfnl_acct_get
,
398 .attr_count
= NFACCT_MAX
,
399 .policy
= nfnl_acct_policy
},
400 [NFNL_MSG_ACCT_DEL
] = { .call
= nfnl_acct_del
,
401 .attr_count
= NFACCT_MAX
,
402 .policy
= nfnl_acct_policy
},
405 static const struct nfnetlink_subsystem nfnl_acct_subsys
= {
407 .subsys_id
= NFNL_SUBSYS_ACCT
,
408 .cb_count
= NFNL_MSG_ACCT_MAX
,
412 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_ACCT
);
414 struct nf_acct
*nfnl_acct_find_get(struct net
*net
, const char *acct_name
)
416 struct nfnl_acct_net
*nfnl_acct_net
= nfnl_acct_pernet(net
);
417 struct nf_acct
*cur
, *acct
= NULL
;
420 list_for_each_entry_rcu(cur
, &nfnl_acct_net
->nfnl_acct_list
, head
) {
421 if (strncmp(cur
->name
, acct_name
, NFACCT_NAME_MAX
)!= 0)
424 if (!try_module_get(THIS_MODULE
))
427 if (!refcount_inc_not_zero(&cur
->refcnt
)) {
428 module_put(THIS_MODULE
);
439 EXPORT_SYMBOL_GPL(nfnl_acct_find_get
);
441 void nfnl_acct_put(struct nf_acct
*acct
)
443 if (refcount_dec_and_test(&acct
->refcnt
))
444 kfree_rcu(acct
, rcu_head
);
446 module_put(THIS_MODULE
);
448 EXPORT_SYMBOL_GPL(nfnl_acct_put
);
450 void nfnl_acct_update(const struct sk_buff
*skb
, struct nf_acct
*nfacct
)
452 atomic64_inc(&nfacct
->pkts
);
453 atomic64_add(skb
->len
, &nfacct
->bytes
);
455 EXPORT_SYMBOL_GPL(nfnl_acct_update
);
457 static void nfnl_overquota_report(struct net
*net
, struct nf_acct
*nfacct
)
462 skb
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_ATOMIC
);
466 ret
= nfnl_acct_fill_info(skb
, 0, 0, NFNL_MSG_ACCT_OVERQUOTA
, 0,
472 netlink_broadcast(net
->nfnl
, skb
, 0, NFNLGRP_ACCT_QUOTA
,
476 int nfnl_acct_overquota(struct net
*net
, struct nf_acct
*nfacct
)
480 int ret
= NFACCT_UNDERQUOTA
;
482 /* no place here if we don't have a quota */
483 if (!(nfacct
->flags
& NFACCT_F_QUOTA
))
484 return NFACCT_NO_QUOTA
;
486 quota
= (u64
*)nfacct
->data
;
487 now
= (nfacct
->flags
& NFACCT_F_QUOTA_PKTS
) ?
488 atomic64_read(&nfacct
->pkts
) : atomic64_read(&nfacct
->bytes
);
493 !test_and_set_bit(NFACCT_OVERQUOTA_BIT
, &nfacct
->flags
)) {
494 nfnl_overquota_report(net
, nfacct
);
499 EXPORT_SYMBOL_GPL(nfnl_acct_overquota
);
501 static int __net_init
nfnl_acct_net_init(struct net
*net
)
503 INIT_LIST_HEAD(&nfnl_acct_pernet(net
)->nfnl_acct_list
);
508 static void __net_exit
nfnl_acct_net_exit(struct net
*net
)
510 struct nfnl_acct_net
*nfnl_acct_net
= nfnl_acct_pernet(net
);
511 struct nf_acct
*cur
, *tmp
;
513 list_for_each_entry_safe(cur
, tmp
, &nfnl_acct_net
->nfnl_acct_list
, head
) {
514 list_del_rcu(&cur
->head
);
516 if (refcount_dec_and_test(&cur
->refcnt
))
517 kfree_rcu(cur
, rcu_head
);
521 static struct pernet_operations nfnl_acct_ops
= {
522 .init
= nfnl_acct_net_init
,
523 .exit
= nfnl_acct_net_exit
,
524 .id
= &nfnl_acct_net_id
,
525 .size
= sizeof(struct nfnl_acct_net
),
528 static int __init
nfnl_acct_init(void)
532 ret
= register_pernet_subsys(&nfnl_acct_ops
);
534 pr_err("nfnl_acct_init: failed to register pernet ops\n");
538 ret
= nfnetlink_subsys_register(&nfnl_acct_subsys
);
540 pr_err("nfnl_acct_init: cannot register with nfnetlink.\n");
546 unregister_pernet_subsys(&nfnl_acct_ops
);
551 static void __exit
nfnl_acct_exit(void)
553 nfnetlink_subsys_unregister(&nfnl_acct_subsys
);
554 unregister_pernet_subsys(&nfnl_acct_ops
);
557 module_init(nfnl_acct_init
);
558 module_exit(nfnl_acct_exit
);