net/netfilter/nft_counter.c

   1 /*
   2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
   9  */
  10
  11 #include <linux/kernel.h>
  12 #include <linux/init.h>
  13 #include <linux/module.h>
  14 #include <linux/seqlock.h>
  15 #include <linux/netlink.h>
  16 #include <linux/netfilter.h>
  17 #include <linux/netfilter/nf_tables.h>
  18 #include <net/netfilter/nf_tables.h>
  19
  20 struct nft_counter {
  21         u64             bytes;
  22         u64             packets;
  23 };
  24
  25 struct nft_counter_percpu {
  26         struct nft_counter      counter;
  27         struct u64_stats_sync   syncp;
  28 };
  29
  30 struct nft_counter_percpu_priv {
  31         struct nft_counter_percpu __percpu *counter;
  32 };
  33
  34 static inline void nft_counter_do_eval(struct nft_counter_percpu_priv *priv,
  35                                        struct nft_regs *regs,
  36                                        const struct nft_pktinfo *pkt)
  37 {
  38         struct nft_counter_percpu *this_cpu;
  39
  40         local_bh_disable();
  41         this_cpu = this_cpu_ptr(priv->counter);
  42         u64_stats_update_begin(&this_cpu->syncp);
  43         this_cpu->counter.bytes += pkt->skb->len;
  44         this_cpu->counter.packets++;
  45         u64_stats_update_end(&this_cpu->syncp);
  46         local_bh_enable();
  47 }
  48
  49 static inline void nft_counter_obj_eval(struct nft_object *obj,
  50                                         struct nft_regs *regs,
  51                                         const struct nft_pktinfo *pkt)
  52 {
  53         struct nft_counter_percpu_priv *priv = nft_obj_data(obj);
  54
  55         nft_counter_do_eval(priv, regs, pkt);
  56 }
  57
  58 static int nft_counter_do_init(const struct nlattr * const tb[],
  59                                struct nft_counter_percpu_priv *priv)
  60 {
  61         struct nft_counter_percpu __percpu *cpu_stats;
  62         struct nft_counter_percpu *this_cpu;
  63
  64         cpu_stats = netdev_alloc_pcpu_stats(struct nft_counter_percpu);
  65         if (cpu_stats == NULL)
  66                 return -ENOMEM;
  67
  68         preempt_disable();
  69         this_cpu = this_cpu_ptr(cpu_stats);
  70         if (tb[NFTA_COUNTER_PACKETS]) {
  71                 this_cpu->counter.packets =
  72                         be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
  73         }
  74         if (tb[NFTA_COUNTER_BYTES]) {
  75                 this_cpu->counter.bytes =
  76                         be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
  77         }
  78         preempt_enable();
  79         priv->counter = cpu_stats;
  80         return 0;
  81 }
  82
  83 static int nft_counter_obj_init(const struct nlattr * const tb[],
  84                                 struct nft_object *obj)
  85 {
  86         struct nft_counter_percpu_priv *priv = nft_obj_data(obj);
  87
  88         return nft_counter_do_init(tb, priv);
  89 }
  90
  91 static void nft_counter_do_destroy(struct nft_counter_percpu_priv *priv)
  92 {
  93         free_percpu(priv->counter);
  94 }
  95
  96 static void nft_counter_obj_destroy(struct nft_object *obj)
  97 {
  98         struct nft_counter_percpu_priv *priv = nft_obj_data(obj);
  99
 100         nft_counter_do_destroy(priv);
 101 }
 102
 103 static void nft_counter_fetch(const struct nft_counter_percpu __percpu *counter,
 104                               struct nft_counter *total)
 105 {
 106         const struct nft_counter_percpu *cpu_stats;
 107         u64 bytes, packets;
 108         unsigned int seq;
 109         int cpu;
 110
 111         memset(total, 0, sizeof(*total));
 112         for_each_possible_cpu(cpu) {
 113                 cpu_stats = per_cpu_ptr(counter, cpu);
 114                 do {
 115                         seq     = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
 116                         bytes   = cpu_stats->counter.bytes;
 117                         packets = cpu_stats->counter.packets;
 118                 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
 119
 120                 total->packets += packets;
 121                 total->bytes += bytes;
 122         }
 123 }
 124
 125 static int nft_counter_do_dump(struct sk_buff *skb,
 126                                const struct nft_counter_percpu_priv *priv)
 127 {
 128         struct nft_counter total;
 129
 130         nft_counter_fetch(priv->counter, &total);
 131
 132         if (nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
 133                          NFTA_COUNTER_PAD) ||
 134             nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.packets),
 135                          NFTA_COUNTER_PAD))
 136                 goto nla_put_failure;
 137         return 0;
 138
 139 nla_put_failure:
 140         return -1;
 141 }
 142
 143 static int nft_counter_obj_dump(struct sk_buff *skb,
 144                                 const struct nft_object *obj)
 145 {
 146         const struct nft_counter_percpu_priv *priv = nft_obj_data(obj);
 147
 148         return nft_counter_do_dump(skb, priv);
 149 }
 150
 151 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
 152         [NFTA_COUNTER_PACKETS]  = { .type = NLA_U64 },
 153         [NFTA_COUNTER_BYTES]    = { .type = NLA_U64 },
 154 };
 155
 156 static struct nft_object_type nft_counter_obj __read_mostly = {
 157         .type           = NFT_OBJECT_COUNTER,
 158         .size           = sizeof(struct nft_counter_percpu_priv),
 159         .maxattr        = NFTA_COUNTER_MAX,
 160         .policy         = nft_counter_policy,
 161         .eval           = nft_counter_obj_eval,
 162         .init           = nft_counter_obj_init,
 163         .destroy        = nft_counter_obj_destroy,
 164         .dump           = nft_counter_obj_dump,
 165         .owner          = THIS_MODULE,
 166 };
 167
 168 static void nft_counter_eval(const struct nft_expr *expr,
 169                              struct nft_regs *regs,
 170                              const struct nft_pktinfo *pkt)
 171 {
 172         struct nft_counter_percpu_priv *priv = nft_expr_priv(expr);
 173
 174         nft_counter_do_eval(priv, regs, pkt);
 175 }
 176
 177 static int nft_counter_dump(struct sk_buff *skb, const struct nft_expr *expr)
 178 {
 179         const struct nft_counter_percpu_priv *priv = nft_expr_priv(expr);
 180
 181         return nft_counter_do_dump(skb, priv);
 182 }
 183
 184 static int nft_counter_init(const struct nft_ctx *ctx,
 185                             const struct nft_expr *expr,
 186                             const struct nlattr * const tb[])
 187 {
 188         struct nft_counter_percpu_priv *priv = nft_expr_priv(expr);
 189
 190         return nft_counter_do_init(tb, priv);
 191 }
 192
 193 static void nft_counter_destroy(const struct nft_ctx *ctx,
 194                                 const struct nft_expr *expr)
 195 {
 196         struct nft_counter_percpu_priv *priv = nft_expr_priv(expr);
 197
 198         nft_counter_do_destroy(priv);
 199 }
 200
 201 static int nft_counter_clone(struct nft_expr *dst, const struct nft_expr *src)
 202 {
 203         struct nft_counter_percpu_priv *priv = nft_expr_priv(src);
 204         struct nft_counter_percpu_priv *priv_clone = nft_expr_priv(dst);
 205         struct nft_counter_percpu __percpu *cpu_stats;
 206         struct nft_counter_percpu *this_cpu;
 207         struct nft_counter total;
 208
 209         nft_counter_fetch(priv->counter, &total);
 210
 211         cpu_stats = __netdev_alloc_pcpu_stats(struct nft_counter_percpu,
 212                                               GFP_ATOMIC);
 213         if (cpu_stats == NULL)
 214                 return -ENOMEM;
 215
 216         preempt_disable();
 217         this_cpu = this_cpu_ptr(cpu_stats);
 218         this_cpu->counter.packets = total.packets;
 219         this_cpu->counter.bytes = total.bytes;
 220         preempt_enable();
 221
 222         priv_clone->counter = cpu_stats;
 223         return 0;
 224 }
 225
 226 static struct nft_expr_type nft_counter_type;
 227 static const struct nft_expr_ops nft_counter_ops = {
 228         .type           = &nft_counter_type,
 229         .size           = NFT_EXPR_SIZE(sizeof(struct nft_counter_percpu_priv)),
 230         .eval           = nft_counter_eval,
 231         .init           = nft_counter_init,
 232         .destroy        = nft_counter_destroy,
 233         .dump           = nft_counter_dump,
 234         .clone          = nft_counter_clone,
 235 };
 236
 237 static struct nft_expr_type nft_counter_type __read_mostly = {
 238         .name           = "counter",
 239         .ops            = &nft_counter_ops,
 240         .policy         = nft_counter_policy,
 241         .maxattr        = NFTA_COUNTER_MAX,
 242         .flags          = NFT_EXPR_STATEFUL,
 243         .owner          = THIS_MODULE,
 244 };
 245
 246 static int __init nft_counter_module_init(void)
 247 {
 248         int err;
 249
 250         err = nft_register_obj(&nft_counter_obj);
 251         if (err < 0)
 252                 return err;
 253
 254         err = nft_register_expr(&nft_counter_type);
 255         if (err < 0)
 256                 goto err1;
 257
 258         return 0;
 259 err1:
 260         nft_unregister_obj(&nft_counter_obj);
 261         return err;
 262 }
 263
 264 static void __exit nft_counter_module_exit(void)
 265 {
 266         nft_unregister_expr(&nft_counter_type);
 267         nft_unregister_obj(&nft_counter_obj);
 268 }
 269
 270 module_init(nft_counter_module_init);
 271 module_exit(nft_counter_module_exit);
 272
 273 MODULE_LICENSE("GPL");
 274 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 275 MODULE_ALIAS_NFT_EXPR("counter");
 276 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_COUNTER);