/*
|
* xt_quota2 - enhanced xt_quota that can count upwards and in packets
|
* as a minimal accounting match.
|
* by Jan Engelhardt <jengelh@medozas.de>, 2008
|
*
|
* Originally based on xt_quota.c:
|
* netfilter module to enforce network quotas
|
* Sam Johnston <samj@samj.net>
|
*
|
* This program is free software; you can redistribute it and/or modify
|
* it under the terms of the GNU General Public License; either
|
* version 2 of the License, as published by the Free Software Foundation.
|
*/
|
#include <linux/list.h>
|
#include <linux/module.h>
|
#include <linux/proc_fs.h>
|
#include <linux/skbuff.h>
|
#include <linux/spinlock.h>
|
#include <asm/atomic.h>
|
#include <net/netlink.h>
|
|
#include <linux/netfilter/x_tables.h>
|
#include <linux/netfilter/xt_quota2.h>
|
|
#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
|
/* For compatibility, these definitions are copied from the
|
* deprecated header file <linux/netfilter_ipv4/ipt_ULOG.h> */
|
#define ULOG_MAC_LEN 80
|
#define ULOG_PREFIX_LEN 32
|
|
/* Format of the ULOG packets passed through netlink */
|
typedef struct ulog_packet_msg {
|
unsigned long mark;
|
long timestamp_sec;
|
long timestamp_usec;
|
unsigned int hook;
|
char indev_name[IFNAMSIZ];
|
char outdev_name[IFNAMSIZ];
|
size_t data_len;
|
char prefix[ULOG_PREFIX_LEN];
|
unsigned char mac_len;
|
unsigned char mac[ULOG_MAC_LEN];
|
unsigned char payload[0];
|
} ulog_packet_msg_t;
|
#endif
|
|
/**
|
* @lock: lock to protect quota writers from each other
|
*/
|
struct xt_quota_counter {
|
u_int64_t quota;
|
spinlock_t lock;
|
struct list_head list;
|
atomic_t ref;
|
char name[sizeof(((struct xt_quota_mtinfo2 *)NULL)->name)];
|
struct proc_dir_entry *procfs_entry;
|
};
|
|
#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
|
/* Harald's favorite number +1 :D From ipt_ULOG.C */
|
static int qlog_nl_event = 112;
|
module_param_named(event_num, qlog_nl_event, uint, S_IRUGO | S_IWUSR);
|
MODULE_PARM_DESC(event_num,
|
"Event number for NETLINK_NFLOG message. 0 disables log."
|
"111 is what ipt_ULOG uses.");
|
static struct sock *nflognl;
|
#endif
|
|
static LIST_HEAD(counter_list);
|
static DEFINE_SPINLOCK(counter_list_lock);
|
|
static struct proc_dir_entry *proc_xt_quota;
|
static unsigned int quota_list_perms = S_IRUGO | S_IWUSR;
|
static kuid_t quota_list_uid = KUIDT_INIT(0);
|
static kgid_t quota_list_gid = KGIDT_INIT(0);
|
module_param_named(perms, quota_list_perms, uint, S_IRUGO | S_IWUSR);
|
|
#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
|
static void quota2_log(unsigned int hooknum,
|
const struct sk_buff *skb,
|
const struct net_device *in,
|
const struct net_device *out,
|
const char *prefix)
|
{
|
ulog_packet_msg_t *pm;
|
struct sk_buff *log_skb;
|
size_t size;
|
struct nlmsghdr *nlh;
|
|
if (!qlog_nl_event)
|
return;
|
|
size = NLMSG_SPACE(sizeof(*pm));
|
size = max(size, (size_t)NLMSG_GOODSIZE);
|
log_skb = alloc_skb(size, GFP_ATOMIC);
|
if (!log_skb) {
|
pr_err("xt_quota2: cannot alloc skb for logging\n");
|
return;
|
}
|
|
nlh = nlmsg_put(log_skb, /*pid*/0, /*seq*/0, qlog_nl_event,
|
sizeof(*pm), 0);
|
if (!nlh) {
|
pr_err("xt_quota2: nlmsg_put failed\n");
|
kfree_skb(log_skb);
|
return;
|
}
|
pm = nlmsg_data(nlh);
|
memset(pm, 0, sizeof(*pm));
|
if (skb->tstamp == 0)
|
__net_timestamp((struct sk_buff *)skb);
|
pm->hook = hooknum;
|
if (prefix != NULL)
|
strlcpy(pm->prefix, prefix, sizeof(pm->prefix));
|
if (in)
|
strlcpy(pm->indev_name, in->name, sizeof(pm->indev_name));
|
if (out)
|
strlcpy(pm->outdev_name, out->name, sizeof(pm->outdev_name));
|
|
NETLINK_CB(log_skb).dst_group = 1;
|
pr_debug("throwing 1 packets to netlink group 1\n");
|
netlink_broadcast(nflognl, log_skb, 0, 1, GFP_ATOMIC);
|
}
|
#else
|
static void quota2_log(unsigned int hooknum,
|
const struct sk_buff *skb,
|
const struct net_device *in,
|
const struct net_device *out,
|
const char *prefix)
|
{
|
}
|
#endif /* if+else CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG */
|
|
static ssize_t quota_proc_read(struct file *file, char __user *buf,
|
size_t size, loff_t *ppos)
|
{
|
struct xt_quota_counter *e = PDE_DATA(file_inode(file));
|
char tmp[24];
|
size_t tmp_size;
|
|
spin_lock_bh(&e->lock);
|
tmp_size = scnprintf(tmp, sizeof(tmp), "%llu\n", e->quota);
|
spin_unlock_bh(&e->lock);
|
return simple_read_from_buffer(buf, size, ppos, tmp, tmp_size);
|
}
|
|
static ssize_t quota_proc_write(struct file *file, const char __user *input,
|
size_t size, loff_t *ppos)
|
{
|
struct xt_quota_counter *e = PDE_DATA(file_inode(file));
|
char buf[sizeof("18446744073709551616")];
|
|
if (size > sizeof(buf))
|
size = sizeof(buf);
|
if (copy_from_user(buf, input, size) != 0)
|
return -EFAULT;
|
buf[sizeof(buf)-1] = '\0';
|
if (size < sizeof(buf))
|
buf[size] = '\0';
|
|
spin_lock_bh(&e->lock);
|
e->quota = simple_strtoull(buf, NULL, 0);
|
spin_unlock_bh(&e->lock);
|
return size;
|
}
|
|
static const struct proc_ops q2_counter_fops = {
|
.proc_read = quota_proc_read,
|
.proc_write = quota_proc_write,
|
.proc_lseek = default_llseek,
|
};
|
|
static struct xt_quota_counter *
|
q2_new_counter(const struct xt_quota_mtinfo2 *q, bool anon)
|
{
|
struct xt_quota_counter *e;
|
unsigned int size;
|
|
/* Do not need all the procfs things for anonymous counters. */
|
size = anon ? offsetof(typeof(*e), list) : sizeof(*e);
|
e = kmalloc(size, GFP_KERNEL);
|
if (e == NULL)
|
return NULL;
|
|
e->quota = q->quota;
|
spin_lock_init(&e->lock);
|
if (!anon) {
|
INIT_LIST_HEAD(&e->list);
|
atomic_set(&e->ref, 1);
|
strlcpy(e->name, q->name, sizeof(e->name));
|
}
|
return e;
|
}
|
|
/**
|
* q2_get_counter - get ref to counter or create new
|
* @name: name of counter
|
*/
|
static struct xt_quota_counter *
|
q2_get_counter(const struct xt_quota_mtinfo2 *q)
|
{
|
struct proc_dir_entry *p;
|
struct xt_quota_counter *e = NULL;
|
struct xt_quota_counter *new_e;
|
|
if (*q->name == '\0')
|
return q2_new_counter(q, true);
|
|
/* No need to hold a lock while getting a new counter */
|
new_e = q2_new_counter(q, false);
|
if (new_e == NULL)
|
goto out;
|
|
spin_lock_bh(&counter_list_lock);
|
list_for_each_entry(e, &counter_list, list)
|
if (strcmp(e->name, q->name) == 0) {
|
atomic_inc(&e->ref);
|
spin_unlock_bh(&counter_list_lock);
|
kfree(new_e);
|
pr_debug("xt_quota2: old counter name=%s", e->name);
|
return e;
|
}
|
e = new_e;
|
pr_debug("xt_quota2: new_counter name=%s", e->name);
|
list_add_tail(&e->list, &counter_list);
|
/* The entry having a refcount of 1 is not directly destructible.
|
* This func has not yet returned the new entry, thus iptables
|
* has not references for destroying this entry.
|
* For another rule to try to destroy it, it would 1st need for this
|
* func* to be re-invoked, acquire a new ref for the same named quota.
|
* Nobody will access the e->procfs_entry either.
|
* So release the lock. */
|
spin_unlock_bh(&counter_list_lock);
|
|
/* create_proc_entry() is not spin_lock happy */
|
p = e->procfs_entry = proc_create_data(e->name, quota_list_perms,
|
proc_xt_quota, &q2_counter_fops, e);
|
|
if (IS_ERR_OR_NULL(p)) {
|
spin_lock_bh(&counter_list_lock);
|
list_del(&e->list);
|
spin_unlock_bh(&counter_list_lock);
|
goto out;
|
}
|
proc_set_user(p, quota_list_uid, quota_list_gid);
|
return e;
|
|
out:
|
kfree(e);
|
return NULL;
|
}
|
|
static int quota_mt2_check(const struct xt_mtchk_param *par)
|
{
|
struct xt_quota_mtinfo2 *q = par->matchinfo;
|
|
pr_debug("xt_quota2: check() flags=0x%04x", q->flags);
|
|
if (q->flags & ~XT_QUOTA_MASK)
|
return -EINVAL;
|
|
q->name[sizeof(q->name)-1] = '\0';
|
if (*q->name == '.' || strchr(q->name, '/') != NULL) {
|
printk(KERN_ERR "xt_quota.3: illegal name\n");
|
return -EINVAL;
|
}
|
|
q->master = q2_get_counter(q);
|
if (q->master == NULL) {
|
printk(KERN_ERR "xt_quota.3: memory alloc failure\n");
|
return -ENOMEM;
|
}
|
|
return 0;
|
}
|
|
static void quota_mt2_destroy(const struct xt_mtdtor_param *par)
|
{
|
struct xt_quota_mtinfo2 *q = par->matchinfo;
|
struct xt_quota_counter *e = q->master;
|
|
if (*q->name == '\0') {
|
kfree(e);
|
return;
|
}
|
|
spin_lock_bh(&counter_list_lock);
|
if (!atomic_dec_and_test(&e->ref)) {
|
spin_unlock_bh(&counter_list_lock);
|
return;
|
}
|
|
list_del(&e->list);
|
spin_unlock_bh(&counter_list_lock);
|
remove_proc_entry(e->name, proc_xt_quota);
|
kfree(e);
|
}
|
|
static bool
|
quota_mt2(const struct sk_buff *skb, struct xt_action_param *par)
|
{
|
struct xt_quota_mtinfo2 *q = (void *)par->matchinfo;
|
struct xt_quota_counter *e = q->master;
|
int charge = (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;
|
bool no_change = q->flags & XT_QUOTA_NO_CHANGE;
|
bool ret = q->flags & XT_QUOTA_INVERT;
|
|
spin_lock_bh(&e->lock);
|
if (q->flags & XT_QUOTA_GROW) {
|
/*
|
* While no_change is pointless in "grow" mode, we will
|
* implement it here simply to have a consistent behavior.
|
*/
|
if (!no_change)
|
e->quota += charge;
|
ret = true; /* note: does not respect inversion (bug??) */
|
} else {
|
if (e->quota > charge) {
|
if (!no_change)
|
e->quota -= charge;
|
ret = !ret;
|
} else if (e->quota) {
|
/* We are transitioning, log that fact. */
|
quota2_log(xt_hooknum(par),
|
skb,
|
xt_in(par),
|
xt_out(par),
|
q->name);
|
/* we do not allow even small packets from now on */
|
e->quota = 0;
|
}
|
}
|
spin_unlock_bh(&e->lock);
|
return ret;
|
}
|
|
static struct xt_match quota_mt2_reg[] __read_mostly = {
|
{
|
.name = "quota2",
|
.revision = 3,
|
.family = NFPROTO_IPV4,
|
.checkentry = quota_mt2_check,
|
.match = quota_mt2,
|
.destroy = quota_mt2_destroy,
|
.matchsize = sizeof(struct xt_quota_mtinfo2),
|
.usersize = offsetof(struct xt_quota_mtinfo2, master),
|
.me = THIS_MODULE,
|
},
|
{
|
.name = "quota2",
|
.revision = 3,
|
.family = NFPROTO_IPV6,
|
.checkentry = quota_mt2_check,
|
.match = quota_mt2,
|
.destroy = quota_mt2_destroy,
|
.matchsize = sizeof(struct xt_quota_mtinfo2),
|
.usersize = offsetof(struct xt_quota_mtinfo2, master),
|
.me = THIS_MODULE,
|
},
|
};
|
|
static int __init quota_mt2_init(void)
|
{
|
int ret;
|
pr_debug("xt_quota2: init()");
|
|
#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
|
nflognl = netlink_kernel_create(&init_net, NETLINK_NFLOG, NULL);
|
if (!nflognl)
|
return -ENOMEM;
|
#endif
|
|
proc_xt_quota = proc_mkdir("xt_quota", init_net.proc_net);
|
if (proc_xt_quota == NULL)
|
return -EACCES;
|
|
ret = xt_register_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
|
if (ret < 0)
|
remove_proc_entry("xt_quota", init_net.proc_net);
|
pr_debug("xt_quota2: init() %d", ret);
|
return ret;
|
}
|
|
static void __exit quota_mt2_exit(void)
|
{
|
xt_unregister_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
|
remove_proc_entry("xt_quota", init_net.proc_net);
|
}
|
|
module_init(quota_mt2_init);
|
module_exit(quota_mt2_exit);
|
MODULE_DESCRIPTION("Xtables: countdown quota match; up counter");
|
MODULE_AUTHOR("Sam Johnston <samj@samj.net>");
|
MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
|
MODULE_LICENSE("GPL");
|
MODULE_ALIAS("ipt_quota2");
|
MODULE_ALIAS("ip6t_quota2");
|
