blob: aace7292853060ce8d2c9edd40803a7eac4feaf8 [file] [log] [blame]
JP Abgralldc5ce6e2011-06-21 11:14:49 -07001/*
2 * xt_quota2 - enhanced xt_quota that can count upwards and in packets
3 * as a minimal accounting match.
4 * by Jan Engelhardt <jengelh@medozas.de>, 2008
5 *
6 * Originally based on xt_quota.c:
7 * netfilter module to enforce network quotas
8 * Sam Johnston <samj@samj.net>
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License; either
12 * version 2 of the License, as published by the Free Software Foundation.
13 */
14#include <linux/list.h>
JP Abgrall3fd82382011-07-12 12:02:59 -070015#include <linux/module.h>
JP Abgralldc5ce6e2011-06-21 11:14:49 -070016#include <linux/proc_fs.h>
17#include <linux/skbuff.h>
18#include <linux/spinlock.h>
19#include <asm/atomic.h>
JP Abgrall3fd82382011-07-12 12:02:59 -070020#include <net/netlink.h>
JP Abgralldc5ce6e2011-06-21 11:14:49 -070021
22#include <linux/netfilter/x_tables.h>
JP Abgrall3fd82382011-07-12 12:02:59 -070023#include <linux/netfilter/xt_quota2.h>
24#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
25#include <linux/netfilter_ipv4/ipt_ULOG.h>
26#endif
JP Abgralldc5ce6e2011-06-21 11:14:49 -070027
28/**
29 * @lock: lock to protect quota writers from each other
30 */
31struct xt_quota_counter {
32 u_int64_t quota;
33 spinlock_t lock;
34 struct list_head list;
35 atomic_t ref;
36 char name[sizeof(((struct xt_quota_mtinfo2 *)NULL)->name)];
37 struct proc_dir_entry *procfs_entry;
38};
39
JP Abgrall3fd82382011-07-12 12:02:59 -070040#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
41/* Harald's favorite number +1 :D From ipt_ULOG.C */
42static int qlog_nl_event = 112;
43module_param_named(event_num, qlog_nl_event, uint, S_IRUGO | S_IWUSR);
44MODULE_PARM_DESC(event_num,
45 "Event number for NETLINK_NFLOG message. 0 disables log."
46 "111 is what ipt_ULOG uses.");
47static struct sock *nflognl;
48#endif
49
JP Abgralldc5ce6e2011-06-21 11:14:49 -070050static LIST_HEAD(counter_list);
51static DEFINE_SPINLOCK(counter_list_lock);
52
53static struct proc_dir_entry *proc_xt_quota;
54static unsigned int quota_list_perms = S_IRUGO | S_IWUSR;
55static unsigned int quota_list_uid = 0;
56static unsigned int quota_list_gid = 0;
57module_param_named(perms, quota_list_perms, uint, S_IRUGO | S_IWUSR);
58module_param_named(uid, quota_list_uid, uint, S_IRUGO | S_IWUSR);
59module_param_named(gid, quota_list_gid, uint, S_IRUGO | S_IWUSR);
60
JP Abgrall3fd82382011-07-12 12:02:59 -070061
62#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
63static void quota2_log(unsigned int hooknum,
64 const struct sk_buff *skb,
65 const struct net_device *in,
66 const struct net_device *out,
67 const char *prefix)
68{
69 ulog_packet_msg_t *pm;
70 struct sk_buff *log_skb;
71 size_t size;
72 struct nlmsghdr *nlh;
73
74 if (!qlog_nl_event)
75 return;
76
77 size = NLMSG_SPACE(sizeof(*pm));
78 size = max(size, (size_t)NLMSG_GOODSIZE);
79 log_skb = alloc_skb(size, GFP_ATOMIC);
80 if (!log_skb) {
81 pr_err("xt_quota2: cannot alloc skb for logging\n");
82 return;
83 }
84
85 nlh = nlmsg_put(log_skb, /*pid*/0, /*seq*/0, qlog_nl_event,
86 sizeof(*pm), 0);
87 if (!nlh) {
88 pr_err("xt_quota2: nlmsg_put failed\n");
89 kfree_skb(log_skb);
90 return;
91 }
92 pm = nlmsg_data(nlh);
93 if (skb->tstamp.tv64 == 0)
94 __net_timestamp((struct sk_buff *)skb);
95 pm->data_len = 0;
96 pm->hook = hooknum;
97 if (prefix != NULL)
98 strlcpy(pm->prefix, prefix, sizeof(pm->prefix));
99 else
100 *(pm->prefix) = '\0';
101 if (in)
102 strlcpy(pm->indev_name, in->name, sizeof(pm->indev_name));
103 else
104 pm->indev_name[0] = '\0';
105
106 if (out)
107 strlcpy(pm->outdev_name, out->name, sizeof(pm->outdev_name));
108 else
109 pm->outdev_name[0] = '\0';
110
111 NETLINK_CB(log_skb).dst_group = 1;
112 pr_debug("throwing 1 packets to netlink group 1\n");
113 netlink_broadcast(nflognl, log_skb, 0, 1, GFP_ATOMIC);
114}
115#else
116static void quota2_log(unsigned int hooknum,
117 const struct sk_buff *skb,
118 const struct net_device *in,
119 const struct net_device *out,
120 const char *prefix)
121{
122}
123#endif /* if+else CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG */
124
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700125static int quota_proc_read(char *page, char **start, off_t offset,
126 int count, int *eof, void *data)
127{
128 struct xt_quota_counter *e = data;
129 int ret;
130
131 spin_lock_bh(&e->lock);
132 ret = snprintf(page, PAGE_SIZE, "%llu\n", e->quota);
133 spin_unlock_bh(&e->lock);
134 return ret;
135}
136
137static int quota_proc_write(struct file *file, const char __user *input,
138 unsigned long size, void *data)
139{
140 struct xt_quota_counter *e = data;
141 char buf[sizeof("18446744073709551616")];
142
143 if (size > sizeof(buf))
144 size = sizeof(buf);
145 if (copy_from_user(buf, input, size) != 0)
146 return -EFAULT;
147 buf[sizeof(buf)-1] = '\0';
148
149 spin_lock_bh(&e->lock);
150 e->quota = simple_strtoull(buf, NULL, 0);
151 spin_unlock_bh(&e->lock);
152 return size;
153}
154
155static struct xt_quota_counter *
156q2_new_counter(const struct xt_quota_mtinfo2 *q, bool anon)
157{
158 struct xt_quota_counter *e;
159 unsigned int size;
160
161 /* Do not need all the procfs things for anonymous counters. */
162 size = anon ? offsetof(typeof(*e), list) : sizeof(*e);
163 e = kmalloc(size, GFP_KERNEL);
164 if (e == NULL)
165 return NULL;
166
167 e->quota = q->quota;
168 spin_lock_init(&e->lock);
169 if (!anon) {
170 INIT_LIST_HEAD(&e->list);
171 atomic_set(&e->ref, 1);
JP Abgrall3fd82382011-07-12 12:02:59 -0700172 strlcpy(e->name, q->name, sizeof(e->name));
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700173 }
174 return e;
175}
176
177/**
178 * q2_get_counter - get ref to counter or create new
179 * @name: name of counter
180 */
181static struct xt_quota_counter *
182q2_get_counter(const struct xt_quota_mtinfo2 *q)
183{
184 struct proc_dir_entry *p;
JP Abgrall3fd82382011-07-12 12:02:59 -0700185 struct xt_quota_counter *e = NULL;
186 struct xt_quota_counter *new_e;
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700187
188 if (*q->name == '\0')
189 return q2_new_counter(q, true);
190
JP Abgrall3fd82382011-07-12 12:02:59 -0700191 /* No need to hold a lock while getting a new counter */
192 new_e = q2_new_counter(q, false);
193 if (new_e == NULL)
194 goto out;
195
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700196 spin_lock_bh(&counter_list_lock);
197 list_for_each_entry(e, &counter_list, list)
198 if (strcmp(e->name, q->name) == 0) {
199 atomic_inc(&e->ref);
200 spin_unlock_bh(&counter_list_lock);
JP Abgrall3fd82382011-07-12 12:02:59 -0700201 kfree(new_e);
202 pr_debug("xt_quota2: old counter name=%s", e->name);
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700203 return e;
204 }
JP Abgrall3fd82382011-07-12 12:02:59 -0700205 e = new_e;
206 pr_debug("xt_quota2: new_counter name=%s", e->name);
207 list_add_tail(&e->list, &counter_list);
208 /* The entry having a refcount of 1 is not directly destructible.
209 * This func has not yet returned the new entry, thus iptables
210 * has not references for destroying this entry.
211 * For another rule to try to destroy it, it would 1st need for this
212 * func* to be re-invoked, acquire a new ref for the same named quota.
213 * Nobody will access the e->procfs_entry either.
214 * So release the lock. */
215 spin_unlock_bh(&counter_list_lock);
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700216
JP Abgrall3fd82382011-07-12 12:02:59 -0700217 /* create_proc_entry() is not spin_lock happy */
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700218 p = e->procfs_entry = create_proc_entry(e->name, quota_list_perms,
219 proc_xt_quota);
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700220
JP Abgrall3fd82382011-07-12 12:02:59 -0700221 if (IS_ERR_OR_NULL(p)) {
222 spin_lock_bh(&counter_list_lock);
223 list_del(&e->list);
224 spin_unlock_bh(&counter_list_lock);
225 goto out;
226 }
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700227 p->data = e;
228 p->read_proc = quota_proc_read;
229 p->write_proc = quota_proc_write;
230 p->uid = quota_list_uid;
231 p->gid = quota_list_gid;
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700232 return e;
233
234 out:
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700235 kfree(e);
236 return NULL;
237}
238
239static int quota_mt2_check(const struct xt_mtchk_param *par)
240{
241 struct xt_quota_mtinfo2 *q = par->matchinfo;
242
JP Abgrall3fd82382011-07-12 12:02:59 -0700243 pr_debug("xt_quota2: check() flags=0x%04x", q->flags);
244
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700245 if (q->flags & ~XT_QUOTA_MASK)
246 return -EINVAL;
247
248 q->name[sizeof(q->name)-1] = '\0';
249 if (*q->name == '.' || strchr(q->name, '/') != NULL) {
250 printk(KERN_ERR "xt_quota.3: illegal name\n");
251 return -EINVAL;
252 }
253
254 q->master = q2_get_counter(q);
255 if (q->master == NULL) {
256 printk(KERN_ERR "xt_quota.3: memory alloc failure\n");
257 return -ENOMEM;
258 }
259
260 return 0;
261}
262
263static void quota_mt2_destroy(const struct xt_mtdtor_param *par)
264{
265 struct xt_quota_mtinfo2 *q = par->matchinfo;
266 struct xt_quota_counter *e = q->master;
267
268 if (*q->name == '\0') {
269 kfree(e);
270 return;
271 }
272
273 spin_lock_bh(&counter_list_lock);
274 if (!atomic_dec_and_test(&e->ref)) {
275 spin_unlock_bh(&counter_list_lock);
276 return;
277 }
278
279 list_del(&e->list);
280 remove_proc_entry(e->name, proc_xt_quota);
281 spin_unlock_bh(&counter_list_lock);
282 kfree(e);
283}
284
285static bool
286quota_mt2(const struct sk_buff *skb, struct xt_action_param *par)
287{
288 struct xt_quota_mtinfo2 *q = (void *)par->matchinfo;
289 struct xt_quota_counter *e = q->master;
290 bool ret = q->flags & XT_QUOTA_INVERT;
291
292 spin_lock_bh(&e->lock);
293 if (q->flags & XT_QUOTA_GROW) {
294 /*
295 * While no_change is pointless in "grow" mode, we will
296 * implement it here simply to have a consistent behavior.
297 */
298 if (!(q->flags & XT_QUOTA_NO_CHANGE)) {
299 e->quota += (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700300 }
301 ret = true;
302 } else {
303 if (e->quota >= skb->len) {
304 if (!(q->flags & XT_QUOTA_NO_CHANGE))
305 e->quota -= (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;
306 ret = !ret;
307 } else {
JP Abgrall3fd82382011-07-12 12:02:59 -0700308 /* We are transitioning, log that fact. */
309 if (e->quota) {
310 quota2_log(par->hooknum,
311 skb,
312 par->in,
313 par->out,
314 q->name);
315 }
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700316 /* we do not allow even small packets from now on */
317 e->quota = 0;
318 }
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700319 }
320 spin_unlock_bh(&e->lock);
321 return ret;
322}
323
324static struct xt_match quota_mt2_reg[] __read_mostly = {
325 {
326 .name = "quota2",
327 .revision = 3,
328 .family = NFPROTO_IPV4,
329 .checkentry = quota_mt2_check,
330 .match = quota_mt2,
JP Abgrall3fd82382011-07-12 12:02:59 -0700331 .destroy = quota_mt2_destroy,
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700332 .matchsize = sizeof(struct xt_quota_mtinfo2),
333 .me = THIS_MODULE,
334 },
335 {
336 .name = "quota2",
337 .revision = 3,
338 .family = NFPROTO_IPV6,
339 .checkentry = quota_mt2_check,
340 .match = quota_mt2,
JP Abgrall3fd82382011-07-12 12:02:59 -0700341 .destroy = quota_mt2_destroy,
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700342 .matchsize = sizeof(struct xt_quota_mtinfo2),
343 .me = THIS_MODULE,
344 },
345};
346
347static int __init quota_mt2_init(void)
348{
349 int ret;
JP Abgrall3fd82382011-07-12 12:02:59 -0700350 pr_debug("xt_quota2: init()");
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700351
JP Abgrall3fd82382011-07-12 12:02:59 -0700352#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
353 nflognl = netlink_kernel_create(&init_net, NETLINK_NFLOG, NULL);
354 if (!nflognl)
355 return -ENOMEM;
356#endif
357
358 proc_xt_quota = proc_mkdir("xt_quota", init_net.proc_net);
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700359 if (proc_xt_quota == NULL)
360 return -EACCES;
361
362 ret = xt_register_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
363 if (ret < 0)
JP Abgrall3fd82382011-07-12 12:02:59 -0700364 remove_proc_entry("xt_quota", init_net.proc_net);
365 pr_debug("xt_quota2: init() %d", ret);
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700366 return ret;
367}
368
369static void __exit quota_mt2_exit(void)
370{
371 xt_unregister_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
JP Abgrall3fd82382011-07-12 12:02:59 -0700372 remove_proc_entry("xt_quota", init_net.proc_net);
JP Abgralldc5ce6e2011-06-21 11:14:49 -0700373}
374
375module_init(quota_mt2_init);
376module_exit(quota_mt2_exit);
377MODULE_DESCRIPTION("Xtables: countdown quota match; up counter");
378MODULE_AUTHOR("Sam Johnston <samj@samj.net>");
379MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
380MODULE_LICENSE("GPL");
381MODULE_ALIAS("ipt_quota2");
382MODULE_ALIAS("ip6t_quota2");