net/netfilter/xt_qtaguid.c

   1 /*
   2  * Kernel iptables module to track stats for packets based on user tags.
   3  *
   4  * (C) 2011 Google, Inc
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  */
  10
  11 /*
  12  * There are run-time debug flags enabled via the debug_mask module param, or
  13  * via the DEFAULT_DEBUG_MASK. See xt_qtaguid_internal.h.
  14  */
  15 #define DEBUG
  16
  17 #include <linux/file.h>
  18 #include <linux/inetdevice.h>
  19 #include <linux/module.h>
  20 #include <linux/netfilter/x_tables.h>
  21 #include <linux/netfilter/xt_qtaguid.h>
  22 #include <linux/skbuff.h>
  23 #include <linux/workqueue.h>
  24 #include <net/addrconf.h>
  25 #include <net/sock.h>
  26 #include <net/tcp.h>
  27 #include <net/udp.h>
  28
  29 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
  30 #include <linux/netfilter_ipv6/ip6_tables.h>
  31 #endif
  32
  33 #include <linux/netfilter/xt_socket.h>
  34 #include "xt_qtaguid_internal.h"
  35 #include "xt_qtaguid_print.h"
  36
  37 /*
  38  * We only use the xt_socket funcs within a similar context to avoid unexpected
  39  * return values.
  40  */
  41 #define XT_SOCKET_SUPPORTED_HOOKS \
  42         ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_IN))
  43
  44
  45 static const char *module_procdirname = "xt_qtaguid";
  46 static struct proc_dir_entry *xt_qtaguid_procdir;
  47
  48 static unsigned int proc_iface_perms = S_IRUGO;
  49 module_param_named(iface_perms, proc_iface_perms, uint, S_IRUGO | S_IWUSR);
  50
  51 static struct proc_dir_entry *xt_qtaguid_stats_file;
  52 static unsigned int proc_stats_perms = S_IRUGO;
  53 module_param_named(stats_perms, proc_stats_perms, uint, S_IRUGO | S_IWUSR);
  54
  55 static struct proc_dir_entry *xt_qtaguid_ctrl_file;
  56
  57 /* Everybody can write. But proc_ctrl_write_limited is true by default which
  58  * limits what can be controlled. See the can_*() functions.
  59  */
  60 static unsigned int proc_ctrl_perms = S_IRUGO | S_IWUGO;
  61 module_param_named(ctrl_perms, proc_ctrl_perms, uint, S_IRUGO | S_IWUSR);
  62
  63 /* Limited by default, so the gid of the ctrl and stats proc entries
  64  * will limit what can be done. See the can_*() functions.
  65  */
  66 static bool proc_stats_readall_limited = true;
  67 static bool proc_ctrl_write_limited = true;
  68
  69 module_param_named(stats_readall_limited, proc_stats_readall_limited, bool,
  70                    S_IRUGO | S_IWUSR);
  71 module_param_named(ctrl_write_limited, proc_ctrl_write_limited, bool,
  72                    S_IRUGO | S_IWUSR);
  73
  74 /*
  75  * Limit the number of active tags (via socket tags) for a given UID.
  76  * Multiple processes could share the UID.
  77  */
  78 static int max_sock_tags = DEFAULT_MAX_SOCK_TAGS;
  79 module_param(max_sock_tags, int, S_IRUGO | S_IWUSR);
  80
  81 /*
  82  * After the kernel has initiallized this module, it is still possible
  83  * to make it passive.
  84  * Setting passive to Y:
  85  *  - the iface stats handling will not act on notifications.
  86  *  - iptables matches will never match.
  87  *  - ctrl commands silently succeed.
  88  *  - stats are always empty.
  89  * This is mostly usefull when a bug is suspected.
  90  */
  91 static bool module_passive;
  92 module_param_named(passive, module_passive, bool, S_IRUGO | S_IWUSR);
  93
  94 /*
  95  * Control how qtaguid data is tracked per proc/uid.
  96  * Setting tag_tracking_passive to Y:
  97  *  - don't create proc specific structs to track tags
  98  *  - don't check that active tag stats exceed some limits.
  99  *  - don't clean up socket tags on process exits.
 100  * This is mostly usefull when a bug is suspected.
 101  */
 102 static bool qtu_proc_handling_passive;
 103 module_param_named(tag_tracking_passive, qtu_proc_handling_passive, bool,
 104                    S_IRUGO | S_IWUSR);
 105
 106 #define QTU_DEV_NAME "xt_qtaguid"
 107
 108 uint qtaguid_debug_mask = DEFAULT_DEBUG_MASK;
 109 module_param_named(debug_mask, qtaguid_debug_mask, uint, S_IRUGO | S_IWUSR);
 110
 111 /*---------------------------------------------------------------------------*/
 112 static const char *iface_stat_procdirname = "iface_stat";
 113 static struct proc_dir_entry *iface_stat_procdir;
 114 /*
 115  * The iface_stat_all* will go away once userspace gets use to the new fields
 116  * that have a format line.
 117  */
 118 static const char *iface_stat_all_procfilename = "iface_stat_all";
 119 static struct proc_dir_entry *iface_stat_all_procfile;
 120 static const char *iface_stat_fmt_procfilename = "iface_stat_fmt";
 121 static struct proc_dir_entry *iface_stat_fmt_procfile;
 122
 123
 124 /*
 125  * Ordering of locks:
 126  *  outer locks:
 127  *    iface_stat_list_lock
 128  *    sock_tag_list_lock
 129  *  inner locks:
 130  *    uid_tag_data_tree_lock
 131  *    tag_counter_set_list_lock
 132  * Notice how sock_tag_list_lock is held sometimes when uid_tag_data_tree_lock
 133  * is acquired.
 134  *
 135  * Call tree with all lock holders as of 2012-04-27:
 136  *
 137  * iface_stat_fmt_proc_read()
 138  *   iface_stat_list_lock
 139  *     (struct iface_stat)
 140  *
 141  * qtaguid_ctrl_proc_read()
 142  *   sock_tag_list_lock
 143  *     (sock_tag_tree)
 144  *     (struct proc_qtu_data->sock_tag_list)
 145  *   prdebug_full_state()
 146  *     sock_tag_list_lock
 147  *       (sock_tag_tree)
 148  *     uid_tag_data_tree_lock
 149  *       (uid_tag_data_tree)
 150  *       (proc_qtu_data_tree)
 151  *     iface_stat_list_lock
 152  *
 153  * qtaguid_stats_proc_read()
 154  *   iface_stat_list_lock
 155  *     struct iface_stat->tag_stat_list_lock
 156  *
 157  * qtudev_open()
 158  *   uid_tag_data_tree_lock
 159  *
 160  * qtudev_release()
 161  *   sock_tag_data_list_lock
 162  *     uid_tag_data_tree_lock
 163  *   prdebug_full_state()
 164  *     sock_tag_list_lock
 165  *     uid_tag_data_tree_lock
 166  *     iface_stat_list_lock
 167  *
 168  * iface_netdev_event_handler()
 169  *   iface_stat_create()
 170  *     iface_stat_list_lock
 171  *   iface_stat_update()
 172  *     iface_stat_list_lock
 173  *
 174  * iface_inetaddr_event_handler()
 175  *   iface_stat_create()
 176  *     iface_stat_list_lock
 177  *   iface_stat_update()
 178  *     iface_stat_list_lock
 179  *
 180  * iface_inet6addr_event_handler()
 181  *   iface_stat_create_ipv6()
 182  *     iface_stat_list_lock
 183  *   iface_stat_update()
 184  *     iface_stat_list_lock
 185  *
 186  * qtaguid_mt()
 187  *   account_for_uid()
 188  *     if_tag_stat_update()
 189  *       get_sock_stat()
 190  *         sock_tag_list_lock
 191  *       struct iface_stat->tag_stat_list_lock
 192  *         tag_stat_update()
 193  *           get_active_counter_set()
 194  *             tag_counter_set_list_lock
 195  *         tag_stat_update()
 196  *           get_active_counter_set()
 197  *             tag_counter_set_list_lock
 198  *
 199  *
 200  * qtaguid_ctrl_parse()
 201  *   ctrl_cmd_delete()
 202  *     sock_tag_list_lock
 203  *     tag_counter_set_list_lock
 204  *     iface_stat_list_lock
 205  *       struct iface_stat->tag_stat_list_lock
 206  *     uid_tag_data_tree_lock
 207  *   ctrl_cmd_counter_set()
 208  *     tag_counter_set_list_lock
 209  *   ctrl_cmd_tag()
 210  *     sock_tag_list_lock
 211  *       (sock_tag_tree)
 212  *       get_tag_ref()
 213  *         uid_tag_data_tree_lock
 214  *           (uid_tag_data_tree)
 215  *       uid_tag_data_tree_lock
 216  *         (proc_qtu_data_tree)
 217  *   ctrl_cmd_untag()
 218  *     sock_tag_list_lock
 219  *     uid_tag_data_tree_lock
 220  *
 221  */
 222 static LIST_HEAD(iface_stat_list);
 223 static DEFINE_SPINLOCK(iface_stat_list_lock);
 224
 225 static struct rb_root sock_tag_tree = RB_ROOT;
 226 static DEFINE_SPINLOCK(sock_tag_list_lock);
 227
 228 static struct rb_root tag_counter_set_tree = RB_ROOT;
 229 static DEFINE_SPINLOCK(tag_counter_set_list_lock);
 230
 231 static struct rb_root uid_tag_data_tree = RB_ROOT;
 232 static DEFINE_SPINLOCK(uid_tag_data_tree_lock);
 233
 234 static struct rb_root proc_qtu_data_tree = RB_ROOT;
 235 /* No proc_qtu_data_tree_lock; use uid_tag_data_tree_lock */
 236
 237 static struct qtaguid_event_counts qtu_events;
 238 /*----------------------------------------------*/
 239 static bool can_manipulate_uids(void)
 240 {
 241         /* root pwnd */
 242         return in_egroup_p(xt_qtaguid_ctrl_file->gid)
 243                 || unlikely(!current_fsuid()) || unlikely(!proc_ctrl_write_limited)
 244                 || unlikely(current_fsuid() == xt_qtaguid_ctrl_file->uid);
 245 }
 246
 247 static bool can_impersonate_uid(uid_t uid)
 248 {
 249         return uid == current_fsuid() || can_manipulate_uids();
 250 }
 251
 252 static bool can_read_other_uid_stats(uid_t uid)
 253 {
 254         /* root pwnd */
 255         return in_egroup_p(xt_qtaguid_stats_file->gid)
 256                 || unlikely(!current_fsuid()) || uid == current_fsuid()
 257                 || unlikely(!proc_stats_readall_limited)
 258                 || unlikely(current_fsuid() == xt_qtaguid_ctrl_file->uid);
 259 }
 260
 261 static inline void dc_add_byte_packets(struct data_counters *counters, int set,
 262                                   enum ifs_tx_rx direction,
 263                                   enum ifs_proto ifs_proto,
 264                                   int bytes,
 265                                   int packets)
 266 {
 267         counters->bpc[set][direction][ifs_proto].bytes += bytes;
 268         counters->bpc[set][direction][ifs_proto].packets += packets;
 269 }
 270
 271 static inline uint64_t dc_sum_bytes(struct data_counters *counters,
 272                                     int set,
 273                                     enum ifs_tx_rx direction)
 274 {
 275         return counters->bpc[set][direction][IFS_TCP].bytes
 276                 + counters->bpc[set][direction][IFS_UDP].bytes
 277                 + counters->bpc[set][direction][IFS_PROTO_OTHER].bytes;
 278 }
 279
 280 static inline uint64_t dc_sum_packets(struct data_counters *counters,
 281                                       int set,
 282                                       enum ifs_tx_rx direction)
 283 {
 284         return counters->bpc[set][direction][IFS_TCP].packets
 285                 + counters->bpc[set][direction][IFS_UDP].packets
 286                 + counters->bpc[set][direction][IFS_PROTO_OTHER].packets;
 287 }
 288
 289 static struct tag_node *tag_node_tree_search(struct rb_root *root, tag_t tag)
 290 {
 291         struct rb_node *node = root->rb_node;
 292
 293         while (node) {
 294                 struct tag_node *data = rb_entry(node, struct tag_node, node);
 295                 int result;
 296                 RB_DEBUG("qtaguid: tag_node_tree_search(0x%llx): "
 297                          " node=%p data=%p\n", tag, node, data);
 298                 result = tag_compare(tag, data->tag);
 299                 RB_DEBUG("qtaguid: tag_node_tree_search(0x%llx): "
 300                          " data.tag=0x%llx (uid=%u) res=%d\n",
 301                          tag, data->tag, get_uid_from_tag(data->tag), result);
 302                 if (result < 0)
 303                         node = node->rb_left;
 304                 else if (result > 0)
 305                         node = node->rb_right;
 306                 else
 307                         return data;
 308         }
 309         return NULL;
 310 }
 311
 312 static void tag_node_tree_insert(struct tag_node *data, struct rb_root *root)
 313 {
 314         struct rb_node **new = &(root->rb_node), *parent = NULL;
 315
 316         /* Figure out where to put new node */
 317         while (*new) {
 318                 struct tag_node *this = rb_entry(*new, struct tag_node,
 319                                                  node);
 320                 int result = tag_compare(data->tag, this->tag);
 321                 RB_DEBUG("qtaguid: %s(): tag=0x%llx"
 322                          " (uid=%u)\n", __func__,
 323                          this->tag,
 324                          get_uid_from_tag(this->tag));
 325                 parent = *new;
 326                 if (result < 0)
 327                         new = &((*new)->rb_left);
 328                 else if (result > 0)
 329                         new = &((*new)->rb_right);
 330                 else
 331                         BUG();
 332         }
 333
 334         /* Add new node and rebalance tree. */
 335         rb_link_node(&data->node, parent, new);
 336         rb_insert_color(&data->node, root);
 337 }
 338
 339 static void tag_stat_tree_insert(struct tag_stat *data, struct rb_root *root)
 340 {
 341         tag_node_tree_insert(&data->tn, root);
 342 }
 343
 344 static struct tag_stat *tag_stat_tree_search(struct rb_root *root, tag_t tag)
 345 {
 346         struct tag_node *node = tag_node_tree_search(root, tag);
 347         if (!node)
 348                 return NULL;
 349         return rb_entry(&node->node, struct tag_stat, tn.node);
 350 }
 351
 352 static void tag_counter_set_tree_insert(struct tag_counter_set *data,
 353                                         struct rb_root *root)
 354 {
 355         tag_node_tree_insert(&data->tn, root);
 356 }
 357
 358 static struct tag_counter_set *tag_counter_set_tree_search(struct rb_root *root,
 359                                                            tag_t tag)
 360 {
 361         struct tag_node *node = tag_node_tree_search(root, tag);
 362         if (!node)
 363                 return NULL;
 364         return rb_entry(&node->node, struct tag_counter_set, tn.node);
 365
 366 }
 367
 368 static void tag_ref_tree_insert(struct tag_ref *data, struct rb_root *root)
 369 {
 370         tag_node_tree_insert(&data->tn, root);
 371 }
 372
 373 static struct tag_ref *tag_ref_tree_search(struct rb_root *root, tag_t tag)
 374 {
 375         struct tag_node *node = tag_node_tree_search(root, tag);
 376         if (!node)
 377                 return NULL;
 378         return rb_entry(&node->node, struct tag_ref, tn.node);
 379 }
 380
 381 static struct sock_tag *sock_tag_tree_search(struct rb_root *root,
 382                                              const struct sock *sk)
 383 {
 384         struct rb_node *node = root->rb_node;
 385
 386         while (node) {
 387                 struct sock_tag *data = rb_entry(node, struct sock_tag,
 388                                                  sock_node);
 389                 if (sk < data->sk)
 390                         node = node->rb_left;
 391                 else if (sk > data->sk)
 392                         node = node->rb_right;
 393                 else
 394                         return data;
 395         }
 396         return NULL;
 397 }
 398
 399 static void sock_tag_tree_insert(struct sock_tag *data, struct rb_root *root)
 400 {
 401         struct rb_node **new = &(root->rb_node), *parent = NULL;
 402
 403         /* Figure out where to put new node */
 404         while (*new) {
 405                 struct sock_tag *this = rb_entry(*new, struct sock_tag,
 406                                                  sock_node);
 407                 parent = *new;
 408                 if (data->sk < this->sk)
 409                         new = &((*new)->rb_left);
 410                 else if (data->sk > this->sk)
 411                         new = &((*new)->rb_right);
 412                 else
 413                         BUG();
 414         }
 415
 416         /* Add new node and rebalance tree. */
 417         rb_link_node(&data->sock_node, parent, new);
 418         rb_insert_color(&data->sock_node, root);
 419 }
 420
 421 static void sock_tag_tree_erase(struct rb_root *st_to_free_tree)
 422 {
 423         struct rb_node *node;
 424         struct sock_tag *st_entry;
 425
 426         node = rb_first(st_to_free_tree);
 427         while (node) {
 428                 st_entry = rb_entry(node, struct sock_tag, sock_node);
 429                 node = rb_next(node);
 430                 CT_DEBUG("qtaguid: %s(): "
 431                          "erase st: sk=%p tag=0x%llx (uid=%u)\n", __func__,
 432                          st_entry->sk,
 433                          st_entry->tag,
 434                          get_uid_from_tag(st_entry->tag));
 435                 rb_erase(&st_entry->sock_node, st_to_free_tree);
 436                 sockfd_put(st_entry->socket);
 437                 kfree(st_entry);
 438         }
 439 }
 440
 441 static struct proc_qtu_data *proc_qtu_data_tree_search(struct rb_root *root,
 442                                                        const pid_t pid)
 443 {
 444         struct rb_node *node = root->rb_node;
 445
 446         while (node) {
 447                 struct proc_qtu_data *data = rb_entry(node,
 448                                                       struct proc_qtu_data,
 449                                                       node);
 450                 if (pid < data->pid)
 451                         node = node->rb_left;
 452                 else if (pid > data->pid)
 453                         node = node->rb_right;
 454                 else
 455                         return data;
 456         }
 457         return NULL;
 458 }
 459
 460 static void proc_qtu_data_tree_insert(struct proc_qtu_data *data,
 461                                       struct rb_root *root)
 462 {
 463         struct rb_node **new = &(root->rb_node), *parent = NULL;
 464
 465         /* Figure out where to put new node */
 466         while (*new) {
 467                 struct proc_qtu_data *this = rb_entry(*new,
 468                                                       struct proc_qtu_data,
 469                                                       node);
 470                 parent = *new;
 471                 if (data->pid < this->pid)
 472                         new = &((*new)->rb_left);
 473                 else if (data->pid > this->pid)
 474                         new = &((*new)->rb_right);
 475                 else
 476                         BUG();
 477         }
 478
 479         /* Add new node and rebalance tree. */
 480         rb_link_node(&data->node, parent, new);
 481         rb_insert_color(&data->node, root);
 482 }
 483
 484 static void uid_tag_data_tree_insert(struct uid_tag_data *data,
 485                                      struct rb_root *root)
 486 {
 487         struct rb_node **new = &(root->rb_node), *parent = NULL;
 488
 489         /* Figure out where to put new node */
 490         while (*new) {
 491                 struct uid_tag_data *this = rb_entry(*new,
 492                                                      struct uid_tag_data,
 493                                                      node);
 494                 parent = *new;
 495                 if (data->uid < this->uid)
 496                         new = &((*new)->rb_left);
 497                 else if (data->uid > this->uid)
 498                         new = &((*new)->rb_right);
 499                 else
 500                         BUG();
 501         }
 502
 503         /* Add new node and rebalance tree. */
 504         rb_link_node(&data->node, parent, new);
 505         rb_insert_color(&data->node, root);
 506 }
 507
 508 static struct uid_tag_data *uid_tag_data_tree_search(struct rb_root *root,
 509                                                      uid_t uid)
 510 {
 511         struct rb_node *node = root->rb_node;
 512
 513         while (node) {
 514                 struct uid_tag_data *data = rb_entry(node,
 515                                                      struct uid_tag_data,
 516                                                      node);
 517                 if (uid < data->uid)
 518                         node = node->rb_left;
 519                 else if (uid > data->uid)
 520                         node = node->rb_right;
 521                 else
 522                         return data;
 523         }
 524         return NULL;
 525 }
 526
 527 /*
 528  * Allocates a new uid_tag_data struct if needed.
 529  * Returns a pointer to the found or allocated uid_tag_data.
 530  * Returns a PTR_ERR on failures, and lock is not held.
 531  * If found is not NULL:
 532  *   sets *found to true if not allocated.
 533  *   sets *found to false if allocated.
 534  */
 535 struct uid_tag_data *get_uid_data(uid_t uid, bool *found_res)
 536 {
 537         struct uid_tag_data *utd_entry;
 538
 539         /* Look for top level uid_tag_data for the UID */
 540         utd_entry = uid_tag_data_tree_search(&uid_tag_data_tree, uid);
 541         DR_DEBUG("qtaguid: get_uid_data(%u) utd=%p\n", uid, utd_entry);
 542
 543         if (found_res)
 544                 *found_res = utd_entry;
 545         if (utd_entry)
 546                 return utd_entry;
 547
 548         utd_entry = kzalloc(sizeof(*utd_entry), GFP_ATOMIC);
 549         if (!utd_entry) {
 550                 pr_err("qtaguid: get_uid_data(%u): "
 551                        "tag data alloc failed\n", uid);
 552                 return ERR_PTR(-ENOMEM);
 553         }
 554
 555         utd_entry->uid = uid;
 556         utd_entry->tag_ref_tree = RB_ROOT;
 557         uid_tag_data_tree_insert(utd_entry, &uid_tag_data_tree);
 558         DR_DEBUG("qtaguid: get_uid_data(%u) new utd=%p\n", uid, utd_entry);
 559         return utd_entry;
 560 }
 561
 562 /* Never returns NULL. Either PTR_ERR or a valid ptr. */
 563 static struct tag_ref *new_tag_ref(tag_t new_tag,
 564                                    struct uid_tag_data *utd_entry)
 565 {
 566         struct tag_ref *tr_entry;
 567         int res;
 568
 569         if (utd_entry->num_active_tags + 1 > max_sock_tags) {
 570                 pr_info("qtaguid: new_tag_ref(0x%llx): "
 571                         "tag ref alloc quota exceeded. max=%d\n",
 572                         new_tag, max_sock_tags);
 573                 res = -EMFILE;
 574                 goto err_res;
 575
 576         }
 577
 578         tr_entry = kzalloc(sizeof(*tr_entry), GFP_ATOMIC);
 579         if (!tr_entry) {
 580                 pr_err("qtaguid: new_tag_ref(0x%llx): "
 581                        "tag ref alloc failed\n",
 582                        new_tag);
 583                 res = -ENOMEM;
 584                 goto err_res;
 585         }
 586         tr_entry->tn.tag = new_tag;
 587         /* tr_entry->num_sock_tags  handled by caller */
 588         utd_entry->num_active_tags++;
 589         tag_ref_tree_insert(tr_entry, &utd_entry->tag_ref_tree);
 590         DR_DEBUG("qtaguid: new_tag_ref(0x%llx): "
 591                  " inserted new tag ref %p\n",
 592                  new_tag, tr_entry);
 593         return tr_entry;
 594
 595 err_res:
 596         return ERR_PTR(res);
 597 }
 598
 599 static struct tag_ref *lookup_tag_ref(tag_t full_tag,
 600                                       struct uid_tag_data **utd_res)
 601 {
 602         struct uid_tag_data *utd_entry;
 603         struct tag_ref *tr_entry;
 604         bool found_utd;
 605         uid_t uid = get_uid_from_tag(full_tag);
 606
 607         DR_DEBUG("qtaguid: lookup_tag_ref(tag=0x%llx (uid=%u))\n",
 608                  full_tag, uid);
 609
 610         utd_entry = get_uid_data(uid, &found_utd);
 611         if (IS_ERR_OR_NULL(utd_entry)) {
 612                 if (utd_res)
 613                         *utd_res = utd_entry;
 614                 return NULL;
 615         }
 616
 617         tr_entry = tag_ref_tree_search(&utd_entry->tag_ref_tree, full_tag);
 618         if (utd_res)
 619                 *utd_res = utd_entry;
 620         DR_DEBUG("qtaguid: lookup_tag_ref(0x%llx) utd_entry=%p tr_entry=%p\n",
 621                  full_tag, utd_entry, tr_entry);
 622         return tr_entry;
 623 }
 624
 625 /* Never returns NULL. Either PTR_ERR or a valid ptr. */
 626 static struct tag_ref *get_tag_ref(tag_t full_tag,
 627                                    struct uid_tag_data **utd_res)
 628 {
 629         struct uid_tag_data *utd_entry;
 630         struct tag_ref *tr_entry;
 631
 632         DR_DEBUG("qtaguid: get_tag_ref(0x%llx)\n",
 633                  full_tag);
 634         spin_lock_bh(&uid_tag_data_tree_lock);
 635         tr_entry = lookup_tag_ref(full_tag, &utd_entry);
 636         BUG_ON(IS_ERR_OR_NULL(utd_entry));
 637         if (!tr_entry)
 638                 tr_entry = new_tag_ref(full_tag, utd_entry);
 639
 640         spin_unlock_bh(&uid_tag_data_tree_lock);
 641         if (utd_res)
 642                 *utd_res = utd_entry;
 643         DR_DEBUG("qtaguid: get_tag_ref(0x%llx) utd=%p tr=%p\n",
 644                  full_tag, utd_entry, tr_entry);
 645         return tr_entry;
 646 }
 647
 648 /* Checks and maybe frees the UID Tag Data entry */
 649 static void put_utd_entry(struct uid_tag_data *utd_entry)
 650 {
 651         /* Are we done with the UID tag data entry? */
 652         if (RB_EMPTY_ROOT(&utd_entry->tag_ref_tree) &&
 653                 !utd_entry->num_pqd) {
 654                 DR_DEBUG("qtaguid: %s(): "
 655                          "erase utd_entry=%p uid=%u "
 656                          "by pid=%u tgid=%u uid=%u\n", __func__,
 657                          utd_entry, utd_entry->uid,
 658                          current->pid, current->tgid, current_fsuid());
 659                 BUG_ON(utd_entry->num_active_tags);
 660                 rb_erase(&utd_entry->node, &uid_tag_data_tree);
 661                 kfree(utd_entry);
 662         } else {
 663                 DR_DEBUG("qtaguid: %s(): "
 664                          "utd_entry=%p still has %d tags %d proc_qtu_data\n",
 665                          __func__, utd_entry, utd_entry->num_active_tags,
 666                          utd_entry->num_pqd);
 667                 BUG_ON(!(utd_entry->num_active_tags ||
 668                          utd_entry->num_pqd));
 669         }
 670 }
 671
 672 /*
 673  * If no sock_tags are using this tag_ref,
 674  * decrements refcount of utd_entry, removes tr_entry
 675  * from utd_entry->tag_ref_tree and frees.
 676  */
 677 static void free_tag_ref_from_utd_entry(struct tag_ref *tr_entry,
 678                                         struct uid_tag_data *utd_entry)
 679 {
 680         DR_DEBUG("qtaguid: %s(): %p tag=0x%llx (uid=%u)\n", __func__,
 681                  tr_entry, tr_entry->tn.tag,
 682                  get_uid_from_tag(tr_entry->tn.tag));
 683         if (!tr_entry->num_sock_tags) {
 684                 BUG_ON(!utd_entry->num_active_tags);
 685                 utd_entry->num_active_tags--;
 686                 rb_erase(&tr_entry->tn.node, &utd_entry->tag_ref_tree);
 687                 DR_DEBUG("qtaguid: %s(): erased %p\n", __func__, tr_entry);
 688                 kfree(tr_entry);
 689         }
 690 }
 691
 692 static void put_tag_ref_tree(tag_t full_tag, struct uid_tag_data *utd_entry)
 693 {
 694         struct rb_node *node;
 695         struct tag_ref *tr_entry;
 696         tag_t acct_tag;
 697
 698         DR_DEBUG("qtaguid: %s(tag=0x%llx (uid=%u))\n", __func__,
 699                  full_tag, get_uid_from_tag(full_tag));
 700         acct_tag = get_atag_from_tag(full_tag);
 701         node = rb_first(&utd_entry->tag_ref_tree);
 702         while (node) {
 703                 tr_entry = rb_entry(node, struct tag_ref, tn.node);
 704                 node = rb_next(node);
 705                 if (!acct_tag || tr_entry->tn.tag == full_tag)
 706                         free_tag_ref_from_utd_entry(tr_entry, utd_entry);
 707         }
 708 }
 709
 710 static int read_proc_u64(char *page, char **start, off_t off,
 711                         int count, int *eof, void *data)
 712 {
 713         int len;
 714         uint64_t value;
 715         char *p = page;
 716         uint64_t *iface_entry = data;
 717
 718         if (!data)
 719                 return 0;
 720
 721         value = *iface_entry;
 722         p += sprintf(p, "%llu\n", value);
 723         len = (p - page) - off;
 724         *eof = (len <= count) ? 1 : 0;
 725         *start = page + off;
 726         return len;
 727 }
 728
 729 static int read_proc_bool(char *page, char **start, off_t off,
 730                         int count, int *eof, void *data)
 731 {
 732         int len;
 733         bool value;
 734         char *p = page;
 735         bool *bool_entry = data;
 736
 737         if (!data)
 738                 return 0;
 739
 740         value = *bool_entry;
 741         p += sprintf(p, "%u\n", value);
 742         len = (p - page) - off;
 743         *eof = (len <= count) ? 1 : 0;
 744         *start = page + off;
 745         return len;
 746 }
 747
 748 static int get_active_counter_set(tag_t tag)
 749 {
 750         int active_set = 0;
 751         struct tag_counter_set *tcs;
 752
 753         MT_DEBUG("qtaguid: get_active_counter_set(tag=0x%llx)"
 754                  " (uid=%u)\n",
 755                  tag, get_uid_from_tag(tag));
 756         /* For now we only handle UID tags for active sets */
 757         tag = get_utag_from_tag(tag);
 758         spin_lock_bh(&tag_counter_set_list_lock);
 759         tcs = tag_counter_set_tree_search(&tag_counter_set_tree, tag);
 760         if (tcs)
 761                 active_set = tcs->active_set;
 762         spin_unlock_bh(&tag_counter_set_list_lock);
 763         return active_set;
 764 }
 765
 766 /*
 767  * Find the entry for tracking the specified interface.
 768  * Caller must hold iface_stat_list_lock
 769  */
 770 static struct iface_stat *get_iface_entry(const char *ifname)
 771 {
 772         struct iface_stat *iface_entry;
 773
 774         /* Find the entry for tracking the specified tag within the interface */
 775         if (ifname == NULL) {
 776                 pr_info("qtaguid: iface_stat: get() NULL device name\n");
 777                 return NULL;
 778         }
 779
 780         /* Iterate over interfaces */
 781         list_for_each_entry(iface_entry, &iface_stat_list, list) {
 782                 if (!strcmp(ifname, iface_entry->ifname))
 783                         goto done;
 784         }
 785         iface_entry = NULL;
 786 done:
 787         return iface_entry;
 788 }
 789
 790 static int iface_stat_fmt_proc_read(char *page, char **num_items_returned,
 791                                     off_t items_to_skip, int char_count,
 792                                     int *eof, void *data)
 793 {
 794         char *outp = page;
 795         int item_index = 0;
 796         int len;
 797         int fmt = (int)data; /* The data is just 1 (old) or 2 (uses fmt) */
 798         struct iface_stat *iface_entry;
 799         struct rtnl_link_stats64 dev_stats, *stats;
 800         struct rtnl_link_stats64 no_dev_stats = {0};
 801
 802         if (unlikely(module_passive)) {
 803                 *eof = 1;
 804                 return 0;
 805         }
 806
 807         CT_DEBUG("qtaguid:proc iface_stat_fmt "
 808                  "pid=%u tgid=%u uid=%u "
 809                  "page=%p *num_items_returned=%p off=%ld "
 810                  "char_count=%d *eof=%d\n",
 811                  current->pid, current->tgid, current_fsuid(),
 812                  page, *num_items_returned,
 813                  items_to_skip, char_count, *eof);
 814
 815         if (*eof)
 816                 return 0;
 817
 818         if (fmt == 2 && item_index++ >= items_to_skip) {
 819                 len = snprintf(outp, char_count,
 820                                "ifname "
 821                                "total_skb_rx_bytes total_skb_rx_packets "
 822                                "total_skb_tx_bytes total_skb_tx_packets\n"
 823                         );
 824                 if (len >= char_count) {
 825                         *outp = '\0';
 826                         return outp - page;
 827                 }
 828                 outp += len;
 829                 char_count -= len;
 830                 (*num_items_returned)++;
 831         }
 832
 833         /*
 834          * This lock will prevent iface_stat_update() from changing active,
 835          * and in turn prevent an interface from unregistering itself.
 836          */
 837         spin_lock_bh(&iface_stat_list_lock);
 838         list_for_each_entry(iface_entry, &iface_stat_list, list) {
 839                 if (item_index++ < items_to_skip)
 840                         continue;
 841
 842                 if (iface_entry->active) {
 843                         stats = dev_get_stats(iface_entry->net_dev,
 844                                               &dev_stats);
 845                 } else {
 846                         stats = &no_dev_stats;
 847                 }
 848                 /*
 849                  * If the meaning of the data changes, then update the fmtX
 850                  * string.
 851                  */
 852                 if (fmt == 1) {
 853                         len = snprintf(
 854                                 outp, char_count,
 855                                 "%s %d "
 856                                 "%llu %llu %llu %llu "
 857                                 "%llu %llu %llu %llu\n",
 858                                 iface_entry->ifname,
 859                                 iface_entry->active,
 860                                 iface_entry->totals_via_dev[IFS_RX].bytes,
 861                                 iface_entry->totals_via_dev[IFS_RX].packets,
 862                                 iface_entry->totals_via_dev[IFS_TX].bytes,
 863                                 iface_entry->totals_via_dev[IFS_TX].packets,
 864                                 stats->rx_bytes, stats->rx_packets,
 865                                 stats->tx_bytes, stats->tx_packets
 866                                 );
 867                 } else {
 868                         len = snprintf(
 869                                 outp, char_count,
 870                                 "%s "
 871                                 "%llu %llu %llu %llu\n",
 872                                 iface_entry->ifname,
 873                                 iface_entry->totals_via_skb[IFS_RX].bytes,
 874                                 iface_entry->totals_via_skb[IFS_RX].packets,
 875                                 iface_entry->totals_via_skb[IFS_TX].bytes,
 876                                 iface_entry->totals_via_skb[IFS_TX].packets
 877                                 );
 878                 }
 879                 if (len >= char_count) {
 880                         spin_unlock_bh(&iface_stat_list_lock);
 881                         *outp = '\0';
 882                         return outp - page;
 883                 }
 884                 outp += len;
 885                 char_count -= len;
 886                 (*num_items_returned)++;
 887         }
 888         spin_unlock_bh(&iface_stat_list_lock);
 889
 890         *eof = 1;
 891         return outp - page;
 892 }
 893
 894 static void iface_create_proc_worker(struct work_struct *work)
 895 {
 896         struct proc_dir_entry *proc_entry;
 897         struct iface_stat_work *isw = container_of(work, struct iface_stat_work,
 898                                                    iface_work);
 899         struct iface_stat *new_iface  = isw->iface_entry;
 900
 901         /* iface_entries are not deleted, so safe to manipulate. */
 902         proc_entry = proc_mkdir(new_iface->ifname, iface_stat_procdir);
 903         if (IS_ERR_OR_NULL(proc_entry)) {
 904                 pr_err("qtaguid: iface_stat: create_proc(): alloc failed.\n");
 905                 kfree(isw);
 906                 return;
 907         }
 908
 909         new_iface->proc_ptr = proc_entry;
 910
 911         create_proc_read_entry("tx_bytes", proc_iface_perms, proc_entry,
 912                                read_proc_u64,
 913                                &new_iface->totals_via_dev[IFS_TX].bytes);
 914         create_proc_read_entry("rx_bytes", proc_iface_perms, proc_entry,
 915                                read_proc_u64,
 916                                &new_iface->totals_via_dev[IFS_RX].bytes);
 917         create_proc_read_entry("tx_packets", proc_iface_perms, proc_entry,
 918                                read_proc_u64,
 919                                &new_iface->totals_via_dev[IFS_TX].packets);
 920         create_proc_read_entry("rx_packets", proc_iface_perms, proc_entry,
 921                                read_proc_u64,
 922                                &new_iface->totals_via_dev[IFS_RX].packets);
 923         create_proc_read_entry("active", proc_iface_perms, proc_entry,
 924                         read_proc_bool, &new_iface->active);
 925
 926         IF_DEBUG("qtaguid: iface_stat: create_proc(): done "
 927                  "entry=%p dev=%s\n", new_iface, new_iface->ifname);
 928         kfree(isw);
 929 }
 930
 931 /*
 932  * Will set the entry's active state, and
 933  * update the net_dev accordingly also.
 934  */
 935 static void _iface_stat_set_active(struct iface_stat *entry,
 936                                    struct net_device *net_dev,
 937                                    bool activate)
 938 {
 939         if (activate) {
 940                 entry->net_dev = net_dev;
 941                 entry->active = true;
 942                 IF_DEBUG("qtaguid: %s(%s): "
 943                          "enable tracking. rfcnt=%d\n", __func__,
 944                          entry->ifname,
 945                          __this_cpu_read(*net_dev->pcpu_refcnt));
 946         } else {
 947                 entry->active = false;
 948                 entry->net_dev = NULL;
 949                 IF_DEBUG("qtaguid: %s(%s): "
 950                          "disable tracking. rfcnt=%d\n", __func__,
 951                          entry->ifname,
 952                          __this_cpu_read(*net_dev->pcpu_refcnt));
 953
 954         }
 955 }
 956
 957 /* Caller must hold iface_stat_list_lock */
 958 static struct iface_stat *iface_alloc(struct net_device *net_dev)
 959 {
 960         struct iface_stat *new_iface;
 961         struct iface_stat_work *isw;
 962
 963         new_iface = kzalloc(sizeof(*new_iface), GFP_ATOMIC);
 964         if (new_iface == NULL) {
 965                 pr_err("qtaguid: iface_stat: create(%s): "
 966                        "iface_stat alloc failed\n", net_dev->name);
 967                 return NULL;
 968         }
 969         new_iface->ifname = kstrdup(net_dev->name, GFP_ATOMIC);
 970         if (new_iface->ifname == NULL) {
 971                 pr_err("qtaguid: iface_stat: create(%s): "
 972                        "ifname alloc failed\n", net_dev->name);
 973                 kfree(new_iface);
 974                 return NULL;
 975         }
 976         spin_lock_init(&new_iface->tag_stat_list_lock);
 977         new_iface->tag_stat_tree = RB_ROOT;
 978         _iface_stat_set_active(new_iface, net_dev, true);
 979
 980         /*
 981          * ipv6 notifier chains are atomic :(
 982          * No create_proc_read_entry() for you!
 983          */
 984         isw = kmalloc(sizeof(*isw), GFP_ATOMIC);
 985         if (!isw) {
 986                 pr_err("qtaguid: iface_stat: create(%s): "
 987                        "work alloc failed\n", new_iface->ifname);
 988                 _iface_stat_set_active(new_iface, net_dev, false);
 989                 kfree(new_iface->ifname);
 990                 kfree(new_iface);
 991                 return NULL;
 992         }
 993         isw->iface_entry = new_iface;
 994         INIT_WORK(&isw->iface_work, iface_create_proc_worker);
 995         schedule_work(&isw->iface_work);
 996         list_add(&new_iface->list, &iface_stat_list);
 997         return new_iface;
 998 }
 999
1000 static void iface_check_stats_reset_and_adjust(struct net_device *net_dev,
1001                                                struct iface_stat *iface)
1002 {
1003         struct rtnl_link_stats64 dev_stats, *stats;
1004         bool stats_rewound;
1005
1006         stats = dev_get_stats(net_dev, &dev_stats);
1007         /* No empty packets */
1008         stats_rewound =
1009                 (stats->rx_bytes < iface->last_known[IFS_RX].bytes)
1010                 || (stats->tx_bytes < iface->last_known[IFS_TX].bytes);
1011
1012         IF_DEBUG("qtaguid: %s(%s): iface=%p netdev=%p "
1013                  "bytes rx/tx=%llu/%llu "
1014                  "active=%d last_known=%d "
1015                  "stats_rewound=%d\n", __func__,
1016                  net_dev ? net_dev->name : "?",
1017                  iface, net_dev,
1018                  stats->rx_bytes, stats->tx_bytes,
1019                  iface->active, iface->last_known_valid, stats_rewound);
1020
1021         if (iface->active && iface->last_known_valid && stats_rewound) {
1022                 pr_warn_once("qtaguid: iface_stat: %s(%s): "
1023                              "iface reset its stats unexpectedly\n", __func__,
1024                              net_dev->name);
1025
1026                 iface->totals_via_dev[IFS_TX].bytes +=
1027                         iface->last_known[IFS_TX].bytes;
1028                 iface->totals_via_dev[IFS_TX].packets +=
1029                         iface->last_known[IFS_TX].packets;
1030                 iface->totals_via_dev[IFS_RX].bytes +=
1031                         iface->last_known[IFS_RX].bytes;
1032                 iface->totals_via_dev[IFS_RX].packets +=
1033                         iface->last_known[IFS_RX].packets;
1034                 iface->last_known_valid = false;
1035                 IF_DEBUG("qtaguid: %s(%s): iface=%p "
1036                          "used last known bytes rx/tx=%llu/%llu\n", __func__,
1037                          iface->ifname, iface, iface->last_known[IFS_RX].bytes,
1038                          iface->last_known[IFS_TX].bytes);
1039         }
1040 }
1041
1042 /*
1043  * Create a new entry for tracking the specified interface.
1044  * Do nothing if the entry already exists.
1045  * Called when an interface is configured with a valid IP address.
1046  */
1047 static void iface_stat_create(struct net_device *net_dev,
1048                               struct in_ifaddr *ifa)
1049 {
1050         struct in_device *in_dev = NULL;
1051         const char *ifname;
1052         struct iface_stat *entry;
1053         __be32 ipaddr = 0;
1054         struct iface_stat *new_iface;
1055
1056         IF_DEBUG("qtaguid: iface_stat: create(%s): ifa=%p netdev=%p\n",
1057                  net_dev ? net_dev->name : "?",
1058                  ifa, net_dev);
1059         if (!net_dev) {
1060                 pr_err("qtaguid: iface_stat: create(): no net dev\n");
1061                 return;
1062         }
1063
1064         ifname = net_dev->name;
1065         if (!ifa) {
1066                 in_dev = in_dev_get(net_dev);
1067                 if (!in_dev) {
1068                         pr_err("qtaguid: iface_stat: create(%s): no inet dev\n",
1069                                ifname);
1070                         return;
1071                 }
1072                 IF_DEBUG("qtaguid: iface_stat: create(%s): in_dev=%p\n",
1073                          ifname, in_dev);
1074                 for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
1075                         IF_DEBUG("qtaguid: iface_stat: create(%s): "
1076                                  "ifa=%p ifa_label=%s\n",
1077                                  ifname, ifa,
1078                                  ifa->ifa_label ? ifa->ifa_label : "(null)");
1079                         if (ifa->ifa_label && !strcmp(ifname, ifa->ifa_label))
1080                                 break;
1081                 }
1082         }
1083
1084         if (!ifa) {
1085                 IF_DEBUG("qtaguid: iface_stat: create(%s): no matching IP\n",
1086                          ifname);
1087                 goto done_put;
1088         }
1089         ipaddr = ifa->ifa_local;
1090
1091         spin_lock_bh(&iface_stat_list_lock);
1092         entry = get_iface_entry(ifname);
1093         if (entry != NULL) {
1094                 bool activate = !ipv4_is_loopback(ipaddr);
1095                 IF_DEBUG("qtaguid: iface_stat: create(%s): entry=%p\n",
1096                          ifname, entry);
1097                 iface_check_stats_reset_and_adjust(net_dev, entry);
1098                 _iface_stat_set_active(entry, net_dev, activate);
1099                 IF_DEBUG("qtaguid: %s(%s): "
1100                          "tracking now %d on ip=%pI4\n", __func__,
1101                          entry->ifname, activate, &ipaddr);
1102                 goto done_unlock_put;
1103         } else if (ipv4_is_loopback(ipaddr)) {
1104                 IF_DEBUG("qtaguid: iface_stat: create(%s): "
1105                          "ignore loopback dev. ip=%pI4\n", ifname, &ipaddr);
1106                 goto done_unlock_put;
1107         }
1108
1109         new_iface = iface_alloc(net_dev);
1110         IF_DEBUG("qtaguid: iface_stat: create(%s): done "
1111                  "entry=%p ip=%pI4\n", ifname, new_iface, &ipaddr);
1112 done_unlock_put:
1113         spin_unlock_bh(&iface_stat_list_lock);
1114 done_put:
1115         if (in_dev)
1116                 in_dev_put(in_dev);
1117 }
1118
1119 static void iface_stat_create_ipv6(struct net_device *net_dev,
1120                                    struct inet6_ifaddr *ifa)
1121 {
1122         struct in_device *in_dev;
1123         const char *ifname;
1124         struct iface_stat *entry;
1125         struct iface_stat *new_iface;
1126         int addr_type;
1127
1128         IF_DEBUG("qtaguid: iface_stat: create6(): ifa=%p netdev=%p->name=%s\n",
1129                  ifa, net_dev, net_dev ? net_dev->name : "");
1130         if (!net_dev) {
1131                 pr_err("qtaguid: iface_stat: create6(): no net dev!\n");
1132                 return;
1133         }
1134         ifname = net_dev->name;
1135
1136         in_dev = in_dev_get(net_dev);
1137         if (!in_dev) {
1138                 pr_err("qtaguid: iface_stat: create6(%s): no inet dev\n",
1139                        ifname);
1140                 return;
1141         }
1142
1143         IF_DEBUG("qtaguid: iface_stat: create6(%s): in_dev=%p\n",
1144                  ifname, in_dev);
1145
1146         if (!ifa) {
1147                 IF_DEBUG("qtaguid: iface_stat: create6(%s): no matching IP\n",
1148                          ifname);
1149                 goto done_put;
1150         }
1151         addr_type = ipv6_addr_type(&ifa->addr);
1152
1153         spin_lock_bh(&iface_stat_list_lock);
1154         entry = get_iface_entry(ifname);
1155         if (entry != NULL) {
1156                 bool activate = !(addr_type & IPV6_ADDR_LOOPBACK);
1157                 IF_DEBUG("qtaguid: %s(%s): entry=%p\n", __func__,
1158                          ifname, entry);
1159                 iface_check_stats_reset_and_adjust(net_dev, entry);
1160                 _iface_stat_set_active(entry, net_dev, activate);
1161                 IF_DEBUG("qtaguid: %s(%s): "
1162                          "tracking now %d on ip=%pI6c\n", __func__,
1163                          entry->ifname, activate, &ifa->addr);
1164                 goto done_unlock_put;
1165         } else if (addr_type & IPV6_ADDR_LOOPBACK) {
1166                 IF_DEBUG("qtaguid: %s(%s): "
1167                          "ignore loopback dev. ip=%pI6c\n", __func__,
1168                          ifname, &ifa->addr);
1169                 goto done_unlock_put;
1170         }
1171
1172         new_iface = iface_alloc(net_dev);
1173         IF_DEBUG("qtaguid: iface_stat: create6(%s): done "
1174                  "entry=%p ip=%pI6c\n", ifname, new_iface, &ifa->addr);
1175
1176 done_unlock_put:
1177         spin_unlock_bh(&iface_stat_list_lock);
1178 done_put:
1179         in_dev_put(in_dev);
1180 }
1181
1182 static struct sock_tag *get_sock_stat_nl(const struct sock *sk)
1183 {
1184         MT_DEBUG("qtaguid: get_sock_stat_nl(sk=%p)\n", sk);
1185         return sock_tag_tree_search(&sock_tag_tree, sk);
1186 }
1187
1188 static struct sock_tag *get_sock_stat(const struct sock *sk)
1189 {
1190         struct sock_tag *sock_tag_entry;
1191         MT_DEBUG("qtaguid: get_sock_stat(sk=%p)\n", sk);
1192         if (!sk)
1193                 return NULL;
1194         spin_lock_bh(&sock_tag_list_lock);
1195         sock_tag_entry = get_sock_stat_nl(sk);
1196         spin_unlock_bh(&sock_tag_list_lock);
1197         return sock_tag_entry;
1198 }
1199
1200 static int ipx_proto(const struct sk_buff *skb,
1201                      struct xt_action_param *par)
1202 {
1203         int thoff = 0, tproto;
1204
1205         switch (par->family) {
1206         case NFPROTO_IPV6:
1207                 tproto = ipv6_find_hdr(skb, &thoff, -1, NULL, NULL);
1208                 if (tproto < 0)
1209                         MT_DEBUG("%s(): transport header not found in ipv6"
1210                                  " skb=%p\n", __func__, skb);
1211                 break;
1212         case NFPROTO_IPV4:
1213                 tproto = ip_hdr(skb)->protocol;
1214                 break;
1215         default:
1216                 tproto = IPPROTO_RAW;
1217         }
1218         return tproto;
1219 }
1220
1221 static void
1222 data_counters_update(struct data_counters *dc, int set,
1223                      enum ifs_tx_rx direction, int proto, int bytes)
1224 {
1225         switch (proto) {
1226         case IPPROTO_TCP:
1227                 dc_add_byte_packets(dc, set, direction, IFS_TCP, bytes, 1);
1228                 break;
1229         case IPPROTO_UDP:
1230                 dc_add_byte_packets(dc, set, direction, IFS_UDP, bytes, 1);
1231                 break;
1232         case IPPROTO_IP:
1233         default:
1234                 dc_add_byte_packets(dc, set, direction, IFS_PROTO_OTHER, bytes,
1235                                     1);
1236                 break;
1237         }
1238 }
1239
1240 /*
1241  * Update stats for the specified interface. Do nothing if the entry
1242  * does not exist (when a device was never configured with an IP address).
1243  * Called when an device is being unregistered.
1244  */
1245 static void iface_stat_update(struct net_device *net_dev, bool stash_only)
1246 {
1247         struct rtnl_link_stats64 dev_stats, *stats;
1248         struct iface_stat *entry;
1249
1250         stats = dev_get_stats(net_dev, &dev_stats);
1251         spin_lock_bh(&iface_stat_list_lock);
1252         entry = get_iface_entry(net_dev->name);
1253         if (entry == NULL) {
1254                 IF_DEBUG("qtaguid: iface_stat: update(%s): not tracked\n",
1255                          net_dev->name);
1256                 spin_unlock_bh(&iface_stat_list_lock);
1257                 return;
1258         }
1259
1260         IF_DEBUG("qtaguid: %s(%s): entry=%p\n", __func__,
1261                  net_dev->name, entry);
1262         if (!entry->active) {
1263                 IF_DEBUG("qtaguid: %s(%s): already disabled\n", __func__,
1264                          net_dev->name);
1265                 spin_unlock_bh(&iface_stat_list_lock);
1266                 return;
1267         }
1268
1269         if (stash_only) {
1270                 entry->last_known[IFS_TX].bytes = stats->tx_bytes;
1271                 entry->last_known[IFS_TX].packets = stats->tx_packets;
1272                 entry->last_known[IFS_RX].bytes = stats->rx_bytes;
1273                 entry->last_known[IFS_RX].packets = stats->rx_packets;
1274                 entry->last_known_valid = true;
1275                 IF_DEBUG("qtaguid: %s(%s): "
1276                          "dev stats stashed rx/tx=%llu/%llu\n", __func__,
1277                          net_dev->name, stats->rx_bytes, stats->tx_bytes);
1278                 spin_unlock_bh(&iface_stat_list_lock);
1279                 return;
1280         }
1281         entry->totals_via_dev[IFS_TX].bytes += stats->tx_bytes;
1282         entry->totals_via_dev[IFS_TX].packets += stats->tx_packets;
1283         entry->totals_via_dev[IFS_RX].bytes += stats->rx_bytes;
1284         entry->totals_via_dev[IFS_RX].packets += stats->rx_packets;
1285         /* We don't need the last_known[] anymore */
1286         entry->last_known_valid = false;
1287         _iface_stat_set_active(entry, net_dev, false);
1288         IF_DEBUG("qtaguid: %s(%s): "
1289                  "disable tracking. rx/tx=%llu/%llu\n", __func__,
1290                  net_dev->name, stats->rx_bytes, stats->tx_bytes);
1291         spin_unlock_bh(&iface_stat_list_lock);
1292 }
1293
1294 /*
1295  * Update stats for the specified interface from the skb.
1296  * Do nothing if the entry
1297  * does not exist (when a device was never configured with an IP address).
1298  * Called on each sk.
1299  */
1300 static void iface_stat_update_from_skb(const struct sk_buff *skb,
1301                                        struct xt_action_param *par)
1302 {
1303         struct iface_stat *entry;
1304         const struct net_device *el_dev;
1305         enum ifs_tx_rx direction = par->in ? IFS_RX : IFS_TX;
1306         int bytes = skb->len;
1307
1308         if (!skb->dev) {
1309                 MT_DEBUG("qtaguid[%d]: no skb->dev\n", par->hooknum);
1310                 el_dev = par->in ? : par->out;
1311         } else {
1312                 const struct net_device *other_dev;
1313                 el_dev = skb->dev;
1314                 other_dev = par->in ? : par->out;
1315                 if (el_dev != other_dev) {
1316                         MT_DEBUG("qtaguid[%d]: skb->dev=%p %s vs "
1317                                  "par->(in/out)=%p %s\n",
1318                                  par->hooknum, el_dev, el_dev->name, other_dev,
1319                                  other_dev->name);
1320                 }
1321         }
1322
1323         if (unlikely(!el_dev)) {
1324                 pr_err("qtaguid[%d]: %s(): no par->in/out?!!\n",
1325                        par->hooknum, __func__);
1326                 BUG();
1327         } else if (unlikely(!el_dev->name)) {
1328                 pr_err("qtaguid[%d]: %s(): no dev->name?!!\n",
1329                        par->hooknum, __func__);
1330                 BUG();
1331         } else {
1332                 int proto = ipx_proto(skb, par);
1333                 MT_DEBUG("qtaguid[%d]: dev name=%s type=%d fam=%d proto=%d\n",
1334                          par->hooknum, el_dev->name, el_dev->type,
1335                          par->family, proto);
1336         }
1337
1338         spin_lock_bh(&iface_stat_list_lock);
1339         entry = get_iface_entry(el_dev->name);
1340         if (entry == NULL) {
1341                 IF_DEBUG("qtaguid: iface_stat: %s(%s): not tracked\n",
1342                          __func__, el_dev->name);
1343                 spin_unlock_bh(&iface_stat_list_lock);
1344                 return;
1345         }
1346
1347         IF_DEBUG("qtaguid: %s(%s): entry=%p\n", __func__,
1348                  el_dev->name, entry);
1349
1350         entry->totals_via_skb[direction].bytes += bytes;
1351         entry->totals_via_skb[direction].packets++;
1352         spin_unlock_bh(&iface_stat_list_lock);
1353 }
1354
1355 static void tag_stat_update(struct tag_stat *tag_entry,
1356                         enum ifs_tx_rx direction, int proto, int bytes)
1357 {
1358         int active_set;
1359         active_set = get_active_counter_set(tag_entry->tn.tag);
1360         MT_DEBUG("qtaguid: tag_stat_update(tag=0x%llx (uid=%u) set=%d "
1361                  "dir=%d proto=%d bytes=%d)\n",
1362                  tag_entry->tn.tag, get_uid_from_tag(tag_entry->tn.tag),
1363                  active_set, direction, proto, bytes);
1364         data_counters_update(&tag_entry->counters, active_set, direction,
1365                              proto, bytes);
1366         if (tag_entry->parent_counters)
1367                 data_counters_update(tag_entry->parent_counters, active_set,
1368                                      direction, proto, bytes);
1369 }
1370
1371 /*
1372  * Create a new entry for tracking the specified {acct_tag,uid_tag} within
1373  * the interface.
1374  * iface_entry->tag_stat_list_lock should be held.
1375  */
1376 static struct tag_stat *create_if_tag_stat(struct iface_stat *iface_entry,
1377                                            tag_t tag)
1378 {
1379         struct tag_stat *new_tag_stat_entry = NULL;
1380         IF_DEBUG("qtaguid: iface_stat: %s(): ife=%p tag=0x%llx"
1381                  " (uid=%u)\n", __func__,
1382                  iface_entry, tag, get_uid_from_tag(tag));
1383         new_tag_stat_entry = kzalloc(sizeof(*new_tag_stat_entry), GFP_ATOMIC);
1384         if (!new_tag_stat_entry) {
1385                 pr_err("qtaguid: iface_stat: tag stat alloc failed\n");
1386                 goto done;
1387         }
1388         new_tag_stat_entry->tn.tag = tag;
1389         tag_stat_tree_insert(new_tag_stat_entry, &iface_entry->tag_stat_tree);
1390 done:
1391         return new_tag_stat_entry;
1392 }
1393
1394 static void if_tag_stat_update(const char *ifname, uid_t uid,
1395                                const struct sock *sk, enum ifs_tx_rx direction,
1396                                int proto, int bytes)
1397 {
1398         struct tag_stat *tag_stat_entry;
1399         tag_t tag, acct_tag;
1400         tag_t uid_tag;
1401         struct data_counters *uid_tag_counters;
1402         struct sock_tag *sock_tag_entry;
1403         struct iface_stat *iface_entry;
1404         struct tag_stat *new_tag_stat = NULL;
1405         MT_DEBUG("qtaguid: if_tag_stat_update(ifname=%s "
1406                 "uid=%u sk=%p dir=%d proto=%d bytes=%d)\n",
1407                  ifname, uid, sk, direction, proto, bytes);
1408
1409
1410         iface_entry = get_iface_entry(ifname);
1411         if (!iface_entry) {
1412                 pr_err("qtaguid: iface_stat: stat_update() %s not found\n",
1413                        ifname);
1414                 return;
1415         }
1416         /* It is ok to process data when an iface_entry is inactive */
1417
1418         MT_DEBUG("qtaguid: iface_stat: stat_update() dev=%s entry=%p\n",
1419                  ifname, iface_entry);
1420
1421         /*
1422          * Look for a tagged sock.
1423          * It will have an acct_uid.
1424          */
1425         sock_tag_entry = get_sock_stat(sk);
1426         if (sock_tag_entry) {
1427                 tag = sock_tag_entry->tag;
1428                 acct_tag = get_atag_from_tag(tag);
1429                 uid_tag = get_utag_from_tag(tag);
1430         } else {
1431                 acct_tag = make_atag_from_value(0);
1432                 tag = combine_atag_with_uid(acct_tag, uid);
1433                 uid_tag = make_tag_from_uid(uid);
1434         }
1435         MT_DEBUG("qtaguid: iface_stat: stat_update(): "
1436                  " looking for tag=0x%llx (uid=%u) in ife=%p\n",
1437                  tag, get_uid_from_tag(tag), iface_entry);
1438         /* Loop over tag list under this interface for {acct_tag,uid_tag} */
1439         spin_lock_bh(&iface_entry->tag_stat_list_lock);
1440
1441         tag_stat_entry = tag_stat_tree_search(&iface_entry->tag_stat_tree,
1442                                               tag);
1443         if (tag_stat_entry) {
1444                 /*
1445                  * Updating the {acct_tag, uid_tag} entry handles both stats:
1446                  * {0, uid_tag} will also get updated.
1447                  */
1448                 tag_stat_update(tag_stat_entry, direction, proto, bytes);
1449                 spin_unlock_bh(&iface_entry->tag_stat_list_lock);
1450                 return;
1451         }
1452
1453         /* Loop over tag list under this interface for {0,uid_tag} */
1454         tag_stat_entry = tag_stat_tree_search(&iface_entry->tag_stat_tree,
1455                                               uid_tag);
1456         if (!tag_stat_entry) {
1457                 /* Here: the base uid_tag did not exist */
1458                 /*
1459                  * No parent counters. So
1460                  *  - No {0, uid_tag} stats and no {acc_tag, uid_tag} stats.
1461                  */
1462                 new_tag_stat = create_if_tag_stat(iface_entry, uid_tag);
1463                 if (!new_tag_stat)
1464                         goto unlock;
1465                 uid_tag_counters = &new_tag_stat->counters;
1466         } else {
1467                 uid_tag_counters = &tag_stat_entry->counters;
1468         }
1469
1470         if (acct_tag) {
1471                 /* Create the child {acct_tag, uid_tag} and hook up parent. */
1472                 new_tag_stat = create_if_tag_stat(iface_entry, tag);
1473                 if (!new_tag_stat)
1474                         goto unlock;
1475                 new_tag_stat->parent_counters = uid_tag_counters;
1476         } else {
1477                 /*
1478                  * For new_tag_stat to be still NULL here would require:
1479                  *  {0, uid_tag} exists
1480                  *  and {acct_tag, uid_tag} doesn't exist
1481                  *  AND acct_tag == 0.
1482                  * Impossible. This reassures us that new_tag_stat
1483                  * below will always be assigned.
1484                  */
1485                 BUG_ON(!new_tag_stat);
1486         }
1487         tag_stat_update(new_tag_stat, direction, proto, bytes);
1488 unlock:
1489         spin_unlock_bh(&iface_entry->tag_stat_list_lock);
1490 }
1491
1492 static int iface_netdev_event_handler(struct notifier_block *nb,
1493                                       unsigned long event, void *ptr) {
1494         struct net_device *dev = ptr;
1495
1496         if (unlikely(module_passive))
1497                 return NOTIFY_DONE;
1498
1499         IF_DEBUG("qtaguid: iface_stat: netdev_event(): "
1500                  "ev=0x%lx/%s netdev=%p->name=%s\n",
1501                  event, netdev_evt_str(event), dev, dev ? dev->name : "");
1502
1503         switch (event) {
1504         case NETDEV_UP:
1505                 iface_stat_create(dev, NULL);
1506                 atomic64_inc(&qtu_events.iface_events);
1507                 break;
1508         case NETDEV_DOWN:
1509         case NETDEV_UNREGISTER:
1510                 iface_stat_update(dev, event == NETDEV_DOWN);
1511                 atomic64_inc(&qtu_events.iface_events);
1512                 break;
1513         }
1514         return NOTIFY_DONE;
1515 }
1516
1517 static int iface_inet6addr_event_handler(struct notifier_block *nb,
1518                                          unsigned long event, void *ptr)
1519 {
1520         struct inet6_ifaddr *ifa = ptr;
1521         struct net_device *dev;
1522
1523         if (unlikely(module_passive))
1524                 return NOTIFY_DONE;
1525
1526         IF_DEBUG("qtaguid: iface_stat: inet6addr_event(): "
1527                  "ev=0x%lx/%s ifa=%p\n",
1528                  event, netdev_evt_str(event), ifa);
1529
1530         switch (event) {
1531         case NETDEV_UP:
1532                 BUG_ON(!ifa || !ifa->idev);
1533                 dev = (struct net_device *)ifa->idev->dev;
1534                 iface_stat_create_ipv6(dev, ifa);
1535                 atomic64_inc(&qtu_events.iface_events);
1536                 break;
1537         case NETDEV_DOWN:
1538         case NETDEV_UNREGISTER:
1539                 BUG_ON(!ifa || !ifa->idev);
1540                 dev = (struct net_device *)ifa->idev->dev;
1541                 iface_stat_update(dev, event == NETDEV_DOWN);
1542                 atomic64_inc(&qtu_events.iface_events);
1543                 break;
1544         }
1545         return NOTIFY_DONE;
1546 }
1547
1548 static int iface_inetaddr_event_handler(struct notifier_block *nb,
1549                                         unsigned long event, void *ptr)
1550 {
1551         struct in_ifaddr *ifa = ptr;
1552         struct net_device *dev;
1553
1554         if (unlikely(module_passive))
1555                 return NOTIFY_DONE;
1556
1557         IF_DEBUG("qtaguid: iface_stat: inetaddr_event(): "
1558                  "ev=0x%lx/%s ifa=%p\n",
1559                  event, netdev_evt_str(event), ifa);
1560
1561         switch (event) {
1562         case NETDEV_UP:
1563                 BUG_ON(!ifa || !ifa->ifa_dev);
1564                 dev = ifa->ifa_dev->dev;
1565                 iface_stat_create(dev, ifa);
1566                 atomic64_inc(&qtu_events.iface_events);
1567                 break;
1568         case NETDEV_DOWN:
1569         case NETDEV_UNREGISTER:
1570                 BUG_ON(!ifa || !ifa->ifa_dev);
1571                 dev = ifa->ifa_dev->dev;
1572                 iface_stat_update(dev, event == NETDEV_DOWN);
1573                 atomic64_inc(&qtu_events.iface_events);
1574                 break;
1575         }
1576         return NOTIFY_DONE;
1577 }
1578
1579 static struct notifier_block iface_netdev_notifier_blk = {
1580         .notifier_call = iface_netdev_event_handler,
1581 };
1582
1583 static struct notifier_block iface_inetaddr_notifier_blk = {
1584         .notifier_call = iface_inetaddr_event_handler,
1585 };
1586
1587 static struct notifier_block iface_inet6addr_notifier_blk = {
1588         .notifier_call = iface_inet6addr_event_handler,
1589 };
1590
1591 static int __init iface_stat_init(struct proc_dir_entry *parent_procdir)
1592 {
1593         int err;
1594
1595         iface_stat_procdir = proc_mkdir(iface_stat_procdirname, parent_procdir);
1596         if (!iface_stat_procdir) {
1597                 pr_err("qtaguid: iface_stat: init failed to create proc entry\n");
1598                 err = -1;
1599                 goto err;
1600         }
1601
1602         iface_stat_all_procfile = create_proc_entry(iface_stat_all_procfilename,
1603                                                     proc_iface_perms,
1604                                                     parent_procdir);
1605         if (!iface_stat_all_procfile) {
1606                 pr_err("qtaguid: iface_stat: init "
1607                        " failed to create stat_old proc entry\n");
1608                 err = -1;
1609                 goto err_zap_entry;
1610         }
1611         iface_stat_all_procfile->read_proc = iface_stat_fmt_proc_read;
1612         iface_stat_all_procfile->data = (void *)1; /* fmt1 */
1613
1614         iface_stat_fmt_procfile = create_proc_entry(iface_stat_fmt_procfilename,
1615                                                     proc_iface_perms,
1616                                                     parent_procdir);
1617         if (!iface_stat_fmt_procfile) {
1618                 pr_err("qtaguid: iface_stat: init "
1619                        " failed to create stat_all proc entry\n");
1620                 err = -1;
1621                 goto err_zap_all_stats_entry;
1622         }
1623         iface_stat_fmt_procfile->read_proc = iface_stat_fmt_proc_read;
1624         iface_stat_fmt_procfile->data = (void *)2; /* fmt2 */
1625
1626
1627         err = register_netdevice_notifier(&iface_netdev_notifier_blk);
1628         if (err) {
1629                 pr_err("qtaguid: iface_stat: init "
1630                        "failed to register dev event handler\n");
1631                 goto err_zap_all_stats_entries;
1632         }
1633         err = register_inetaddr_notifier(&iface_inetaddr_notifier_blk);
1634         if (err) {
1635                 pr_err("qtaguid: iface_stat: init "
1636                        "failed to register ipv4 dev event handler\n");
1637                 goto err_unreg_nd;
1638         }
1639
1640         err = register_inet6addr_notifier(&iface_inet6addr_notifier_blk);
1641         if (err) {
1642                 pr_err("qtaguid: iface_stat: init "
1643                        "failed to register ipv6 dev event handler\n");
1644                 goto err_unreg_ip4_addr;
1645         }
1646         return 0;
1647
1648 err_unreg_ip4_addr:
1649         unregister_inetaddr_notifier(&iface_inetaddr_notifier_blk);
1650 err_unreg_nd:
1651         unregister_netdevice_notifier(&iface_netdev_notifier_blk);
1652 err_zap_all_stats_entries:
1653         remove_proc_entry(iface_stat_fmt_procfilename, parent_procdir);
1654 err_zap_all_stats_entry:
1655         remove_proc_entry(iface_stat_all_procfilename, parent_procdir);
1656 err_zap_entry:
1657         remove_proc_entry(iface_stat_procdirname, parent_procdir);
1658 err:
1659         return err;
1660 }
1661
1662 static struct sock *qtaguid_find_sk(const struct sk_buff *skb,
1663                                     struct xt_action_param *par)
1664 {
1665         struct sock *sk;
1666         unsigned int hook_mask = (1 << par->hooknum);
1667
1668         MT_DEBUG("qtaguid: find_sk(skb=%p) hooknum=%d family=%d\n", skb,
1669                  par->hooknum, par->family);
1670
1671         /*
1672          * Let's not abuse the the xt_socket_get*_sk(), or else it will
1673          * return garbage SKs.
1674          */
1675         if (!(hook_mask & XT_SOCKET_SUPPORTED_HOOKS))
1676                 return NULL;
1677
1678         switch (par->family) {
1679         case NFPROTO_IPV6:
1680                 sk = xt_socket_get6_sk(skb, par);
1681                 break;
1682         case NFPROTO_IPV4:
1683                 sk = xt_socket_get4_sk(skb, par);
1684                 break;
1685         default:
1686                 return NULL;
1687         }
1688
1689         /*
1690          * Seems to be issues on the file ptr for TCP_TIME_WAIT SKs.
1691          * http://kerneltrap.org/mailarchive/linux-netdev/2010/10/21/6287959
1692          * Not fixed in 3.0-r3 :(
1693          */
1694         if (sk) {
1695                 MT_DEBUG("qtaguid: %p->sk_proto=%u "
1696                          "->sk_state=%d\n", sk, sk->sk_protocol, sk->sk_state);
1697                 if (sk->sk_state  == TCP_TIME_WAIT) {
1698                         xt_socket_put_sk(sk);
1699                         sk = NULL;
1700                 }
1701         }
1702         return sk;
1703 }
1704
1705 static void account_for_uid(const struct sk_buff *skb,
1706                             const struct sock *alternate_sk, uid_t uid,
1707                             struct xt_action_param *par)
1708 {
1709         const struct net_device *el_dev;
1710
1711         if (!skb->dev) {
1712                 MT_DEBUG("qtaguid[%d]: no skb->dev\n", par->hooknum);
1713                 el_dev = par->in ? : par->out;
1714         } else {
1715                 const struct net_device *other_dev;
1716                 el_dev = skb->dev;
1717                 other_dev = par->in ? : par->out;
1718                 if (el_dev != other_dev) {
1719                         MT_DEBUG("qtaguid[%d]: skb->dev=%p %s vs "
1720                                 "par->(in/out)=%p %s\n",
1721                                 par->hooknum, el_dev, el_dev->name, other_dev,
1722                                 other_dev->name);
1723                 }
1724         }
1725
1726         if (unlikely(!el_dev)) {
1727                 pr_info("qtaguid[%d]: no par->in/out?!!\n", par->hooknum);
1728         } else if (unlikely(!el_dev->name)) {
1729                 pr_info("qtaguid[%d]: no dev->name?!!\n", par->hooknum);
1730         } else {
1731                 int proto = ipx_proto(skb, par);
1732                 MT_DEBUG("qtaguid[%d]: dev name=%s type=%d fam=%d proto=%d\n",
1733                          par->hooknum, el_dev->name, el_dev->type,
1734                          par->family, proto);
1735
1736                 if_tag_stat_update(el_dev->name, uid,
1737                                 skb->sk ? skb->sk : alternate_sk,
1738                                 par->in ? IFS_RX : IFS_TX,
1739                                 proto, skb->len);
1740         }
1741 }
1742
1743 static bool qtaguid_mt(const struct sk_buff *skb, struct xt_action_param *par)
1744 {
1745         const struct xt_qtaguid_match_info *info = par->matchinfo;
1746         const struct file *filp;
1747         bool got_sock = false;
1748         struct sock *sk;
1749         uid_t sock_uid;
1750         bool res;
1751
1752         if (unlikely(module_passive))
1753                 return (info->match ^ info->invert) == 0;
1754
1755         MT_DEBUG("qtaguid[%d]: entered skb=%p par->in=%p/out=%p fam=%d\n",
1756                  par->hooknum, skb, par->in, par->out, par->family);
1757
1758         atomic64_inc(&qtu_events.match_calls);
1759         if (skb == NULL) {
1760                 res = (info->match ^ info->invert) == 0;
1761                 goto ret_res;
1762         }
1763
1764         switch (par->hooknum) {
1765         case NF_INET_PRE_ROUTING:
1766         case NF_INET_POST_ROUTING:
1767                 atomic64_inc(&qtu_events.match_calls_prepost);
1768                 iface_stat_update_from_skb(skb, par);
1769                 /*
1770                  * We are done in pre/post. The skb will get processed
1771                  * further alter.
1772                  */
1773                 res = (info->match ^ info->invert);
1774                 goto ret_res;
1775                 break;
1776         /* default: Fall through and do UID releated work */
1777         }
1778
1779         sk = skb->sk;
1780         if (sk == NULL) {
1781                 /*
1782                  * A missing sk->sk_socket happens when packets are in-flight
1783                  * and the matching socket is already closed and gone.
1784                  */
1785                 sk = qtaguid_find_sk(skb, par);
1786                 /*
1787                  * If we got the socket from the find_sk(), we will need to put
1788                  * it back, as nf_tproxy_get_sock_v4() got it.
1789                  */
1790                 got_sock = sk;
1791                 if (sk)
1792                         atomic64_inc(&qtu_events.match_found_sk_in_ct);
1793                 else
1794                         atomic64_inc(&qtu_events.match_found_no_sk_in_ct);
1795         } else {
1796                 atomic64_inc(&qtu_events.match_found_sk);
1797         }
1798         MT_DEBUG("qtaguid[%d]: sk=%p got_sock=%d fam=%d proto=%d\n",
1799                  par->hooknum, sk, got_sock, par->family, ipx_proto(skb, par));
1800         if (sk != NULL) {
1801                 MT_DEBUG("qtaguid[%d]: sk=%p->sk_socket=%p->file=%p\n",
1802                         par->hooknum, sk, sk->sk_socket,
1803                         sk->sk_socket ? sk->sk_socket->file : (void *)-1LL);
1804                 filp = sk->sk_socket ? sk->sk_socket->file : NULL;
1805                 MT_DEBUG("qtaguid[%d]: filp...uid=%u\n",
1806                         par->hooknum, filp ? filp->f_cred->fsuid : -1);
1807         }
1808
1809         if (sk == NULL || sk->sk_socket == NULL) {
1810                 /*
1811                  * Here, the qtaguid_find_sk() using connection tracking
1812                  * couldn't find the owner, so for now we just count them
1813                  * against the system.
1814                  */
1815                 /*
1816                  * TODO: unhack how to force just accounting.
1817                  * For now we only do iface stats when the uid-owner is not
1818                  * requested.
1819                  */
1820                 if (!(info->match & XT_QTAGUID_UID))
1821                         account_for_uid(skb, sk, 0, par);
1822                 MT_DEBUG("qtaguid[%d]: leaving (sk?sk->sk_socket)=%p\n",
1823                         par->hooknum,
1824                         sk ? sk->sk_socket : NULL);
1825                 res = (info->match ^ info->invert) == 0;
1826                 atomic64_inc(&qtu_events.match_no_sk);
1827                 goto put_sock_ret_res;
1828         } else if (info->match & info->invert & XT_QTAGUID_SOCKET) {
1829                 res = false;
1830                 goto put_sock_ret_res;
1831         }
1832         filp = sk->sk_socket->file;
1833         if (filp == NULL) {
1834                 MT_DEBUG("qtaguid[%d]: leaving filp=NULL\n", par->hooknum);
1835                 account_for_uid(skb, sk, 0, par);
1836                 res = ((info->match ^ info->invert) &
1837                         (XT_QTAGUID_UID | XT_QTAGUID_GID)) == 0;
1838                 atomic64_inc(&qtu_events.match_no_sk_file);
1839                 goto put_sock_ret_res;
1840         }
1841         sock_uid = filp->f_cred->fsuid;
1842         /*
1843          * TODO: unhack how to force just accounting.
1844          * For now we only do iface stats when the uid-owner is not requested
1845          */
1846         if (!(info->match & XT_QTAGUID_UID))
1847                 account_for_uid(skb, sk, sock_uid, par);
1848
1849         /*
1850          * The following two tests fail the match when:
1851          *    id not in range AND no inverted condition requested
1852          * or id     in range AND    inverted condition requested
1853          * Thus (!a && b) || (a && !b) == a ^ b
1854          */
1855         if (info->match & XT_QTAGUID_UID)
1856                 if ((filp->f_cred->fsuid >= info->uid_min &&
1857                      filp->f_cred->fsuid <= info->uid_max) ^
1858                     !(info->invert & XT_QTAGUID_UID)) {
1859                         MT_DEBUG("qtaguid[%d]: leaving uid not matching\n",
1860                                  par->hooknum);
1861                         res = false;
1862                         goto put_sock_ret_res;
1863                 }
1864         if (info->match & XT_QTAGUID_GID)
1865                 if ((filp->f_cred->fsgid >= info->gid_min &&
1866                                 filp->f_cred->fsgid <= info->gid_max) ^
1867                         !(info->invert & XT_QTAGUID_GID)) {
1868                         MT_DEBUG("qtaguid[%d]: leaving gid not matching\n",
1869                                 par->hooknum);
1870                         res = false;
1871                         goto put_sock_ret_res;
1872                 }
1873
1874         MT_DEBUG("qtaguid[%d]: leaving matched\n", par->hooknum);
1875         res = true;
1876
1877 put_sock_ret_res:
1878         if (got_sock)
1879                 xt_socket_put_sk(sk);
1880 ret_res:
1881         MT_DEBUG("qtaguid[%d]: left %d\n", par->hooknum, res);
1882         return res;
1883 }
1884
1885 #ifdef DDEBUG
1886 /* This function is not in xt_qtaguid_print.c because of locks visibility */
1887 static void prdebug_full_state(int indent_level, const char *fmt, ...)
1888 {
1889         va_list args;
1890         char *fmt_buff;
1891         char *buff;
1892
1893         if (!unlikely(qtaguid_debug_mask & DDEBUG_MASK))
1894                 return;
1895
1896         fmt_buff = kasprintf(GFP_ATOMIC,
1897                              "qtaguid: %s(): %s {\n", __func__, fmt);
1898         BUG_ON(!fmt_buff);
1899         va_start(args, fmt);
1900         buff = kvasprintf(GFP_ATOMIC,
1901                           fmt_buff, args);
1902         BUG_ON(!buff);
1903         pr_debug("%s", buff);
1904         kfree(fmt_buff);
1905         kfree(buff);
1906         va_end(args);
1907
1908         spin_lock_bh(&sock_tag_list_lock);
1909         prdebug_sock_tag_tree(indent_level, &sock_tag_tree);
1910         spin_unlock_bh(&sock_tag_list_lock);
1911
1912         spin_lock_bh(&sock_tag_list_lock);
1913         spin_lock_bh(&uid_tag_data_tree_lock);
1914         prdebug_uid_tag_data_tree(indent_level, &uid_tag_data_tree);
1915         prdebug_proc_qtu_data_tree(indent_level, &proc_qtu_data_tree);
1916         spin_unlock_bh(&uid_tag_data_tree_lock);
1917         spin_unlock_bh(&sock_tag_list_lock);
1918
1919         spin_lock_bh(&iface_stat_list_lock);
1920         prdebug_iface_stat_list(indent_level, &iface_stat_list);
1921         spin_unlock_bh(&iface_stat_list_lock);
1922
1923         pr_debug("qtaguid: %s(): }\n", __func__);
1924 }
1925 #else
1926 static void prdebug_full_state(int indent_level, const char *fmt, ...) {}
1927 #endif
1928
1929 /*
1930  * Procfs reader to get all active socket tags using style "1)" as described in
1931  * fs/proc/generic.c
1932  */
1933 static int qtaguid_ctrl_proc_read(char *page, char **num_items_returned,
1934                                   off_t items_to_skip, int char_count, int *eof,
1935                                   void *data)
1936 {
1937         char *outp = page;
1938         int len;
1939         uid_t uid;
1940         struct rb_node *node;
1941         struct sock_tag *sock_tag_entry;
1942         int item_index = 0;
1943         int indent_level = 0;
1944         long f_count;
1945
1946         if (unlikely(module_passive)) {
1947                 *eof = 1;
1948                 return 0;
1949         }
1950
1951         if (*eof)
1952                 return 0;
1953
1954         CT_DEBUG("qtaguid: proc ctrl pid=%u tgid=%u uid=%u "
1955                  "page=%p off=%ld char_count=%d *eof=%d\n",
1956                  current->pid, current->tgid, current_fsuid(),
1957                  page, items_to_skip, char_count, *eof);
1958
1959         spin_lock_bh(&sock_tag_list_lock);
1960         for (node = rb_first(&sock_tag_tree);
1961              node;
1962              node = rb_next(node)) {
1963                 if (item_index++ < items_to_skip)
1964                         continue;
1965                 sock_tag_entry = rb_entry(node, struct sock_tag, sock_node);
1966                 uid = get_uid_from_tag(sock_tag_entry->tag);
1967                 CT_DEBUG("qtaguid: proc_read(): sk=%p tag=0x%llx (uid=%u) "
1968                          "pid=%u\n",
1969                          sock_tag_entry->sk,
1970                          sock_tag_entry->tag,
1971                          uid,
1972                          sock_tag_entry->pid
1973                         );
1974                 f_count = atomic_long_read(
1975                         &sock_tag_entry->socket->file->f_count);
1976                 len = snprintf(outp, char_count,
1977                                "sock=%p tag=0x%llx (uid=%u) pid=%u "
1978                                "f_count=%lu\n",
1979                                sock_tag_entry->sk,
1980                                sock_tag_entry->tag, uid,
1981                                sock_tag_entry->pid, f_count);
1982                 if (len >= char_count) {
1983                         spin_unlock_bh(&sock_tag_list_lock);
1984                         *outp = '\0';
1985                         return outp - page;
1986                 }
1987                 outp += len;
1988                 char_count -= len;
1989                 (*num_items_returned)++;
1990         }
1991         spin_unlock_bh(&sock_tag_list_lock);
1992
1993         if (item_index++ >= items_to_skip) {
1994                 len = snprintf(outp, char_count,
1995                                "events: sockets_tagged=%llu "
1996                                "sockets_untagged=%llu "
1997                                "counter_set_changes=%llu "
1998                                "delete_cmds=%llu "
1999                                "iface_events=%llu "
2000                                "match_calls=%llu "
2001                                "match_calls_prepost=%llu "
2002                                "match_found_sk=%llu "
2003                                "match_found_sk_in_ct=%llu "
2004                                "match_found_no_sk_in_ct=%llu "
2005                                "match_no_sk=%llu "
2006                                "match_no_sk_file=%llu\n",
2007                                atomic64_read(&qtu_events.sockets_tagged),
2008                                atomic64_read(&qtu_events.sockets_untagged),
2009                                atomic64_read(&qtu_events.counter_set_changes),
2010                                atomic64_read(&qtu_events.delete_cmds),
2011                                atomic64_read(&qtu_events.iface_events),
2012                                atomic64_read(&qtu_events.match_calls),
2013                                atomic64_read(&qtu_events.match_calls_prepost),
2014                                atomic64_read(&qtu_events.match_found_sk),
2015                                atomic64_read(&qtu_events.match_found_sk_in_ct),
2016                                atomic64_read(
2017                                        &qtu_events.match_found_no_sk_in_ct),
2018                                atomic64_read(&qtu_events.match_no_sk),
2019                                atomic64_read(&qtu_events.match_no_sk_file));
2020                 if (len >= char_count) {
2021                         *outp = '\0';
2022                         return outp - page;
2023                 }
2024                 outp += len;
2025                 char_count -= len;
2026                 (*num_items_returned)++;
2027         }
2028
2029         /* Count the following as part of the last item_index */
2030         if (item_index > items_to_skip) {
2031                 prdebug_full_state(indent_level, "proc ctrl");
2032         }
2033
2034         *eof = 1;
2035         return outp - page;
2036 }
2037
2038 /*
2039  * Delete socket tags, and stat tags associated with a given
2040  * accouting tag and uid.
2041  */
2042 static int ctrl_cmd_delete(const char *input)
2043 {
2044         char cmd;
2045         uid_t uid;
2046         uid_t entry_uid;
2047         tag_t acct_tag;
2048         tag_t tag;
2049         int res, argc;
2050         struct iface_stat *iface_entry;
2051         struct rb_node *node;
2052         struct sock_tag *st_entry;
2053         struct rb_root st_to_free_tree = RB_ROOT;
2054         struct tag_stat *ts_entry;
2055         struct tag_counter_set *tcs_entry;
2056         struct tag_ref *tr_entry;
2057         struct uid_tag_data *utd_entry;
2058
2059         argc = sscanf(input, "%c %llu %u", &cmd, &acct_tag, &uid);
2060         CT_DEBUG("qtaguid: ctrl_delete(%s): argc=%d cmd=%c "
2061                  "user_tag=0x%llx uid=%u\n", input, argc, cmd,
2062                  acct_tag, uid);
2063         if (argc < 2) {
2064                 res = -EINVAL;
2065                 goto err;
2066         }
2067         if (!valid_atag(acct_tag)) {
2068                 pr_info("qtaguid: ctrl_delete(%s): invalid tag\n", input);
2069                 res = -EINVAL;
2070                 goto err;
2071         }
2072         if (argc < 3) {
2073                 uid = current_fsuid();
2074         } else if (!can_impersonate_uid(uid)) {
2075                 pr_info("qtaguid: ctrl_delete(%s): "
2076                         "insufficient priv from pid=%u tgid=%u uid=%u\n",
2077                         input, current->pid, current->tgid, current_fsuid());
2078                 res = -EPERM;
2079                 goto err;
2080         }
2081
2082         tag = combine_atag_with_uid(acct_tag, uid);
2083         CT_DEBUG("qtaguid: ctrl_delete(%s): "
2084                  "looking for tag=0x%llx (uid=%u)\n",
2085                  input, tag, uid);
2086
2087         /* Delete socket tags */
2088         spin_lock_bh(&sock_tag_list_lock);
2089         node = rb_first(&sock_tag_tree);
2090         while (node) {
2091                 st_entry = rb_entry(node, struct sock_tag, sock_node);
2092                 entry_uid = get_uid_from_tag(st_entry->tag);
2093                 node = rb_next(node);
2094                 if (entry_uid != uid)
2095                         continue;
2096
2097                 CT_DEBUG("qtaguid: ctrl_delete(%s): st tag=0x%llx (uid=%u)\n",
2098                          input, st_entry->tag, entry_uid);
2099
2100                 if (!acct_tag || st_entry->tag == tag) {
2101                         rb_erase(&st_entry->sock_node, &sock_tag_tree);
2102                         /* Can't sockfd_put() within spinlock, do it later. */
2103                         sock_tag_tree_insert(st_entry, &st_to_free_tree);
2104                         tr_entry = lookup_tag_ref(st_entry->tag, NULL);
2105                         BUG_ON(tr_entry->num_sock_tags <= 0);
2106                         tr_entry->num_sock_tags--;
2107                         /*
2108                          * TODO: remove if, and start failing.
2109                          * This is a hack to work around the fact that in some
2110                          * places we have "if (IS_ERR_OR_NULL(pqd_entry))"
2111                          * and are trying to work around apps
2112                          * that didn't open the /dev/xt_qtaguid.
2113                          */
2114                         if (st_entry->list.next && st_entry->list.prev)
2115                                 list_del(&st_entry->list);
2116                 }
2117         }
2118         spin_unlock_bh(&sock_tag_list_lock);
2119
2120         sock_tag_tree_erase(&st_to_free_tree);
2121
2122         /* Delete tag counter-sets */
2123         spin_lock_bh(&tag_counter_set_list_lock);
2124         /* Counter sets are only on the uid tag, not full tag */
2125         tcs_entry = tag_counter_set_tree_search(&tag_counter_set_tree, tag);
2126         if (tcs_entry) {
2127                 CT_DEBUG("qtaguid: ctrl_delete(%s): "
2128                          "erase tcs: tag=0x%llx (uid=%u) set=%d\n",
2129                          input,
2130                          tcs_entry->tn.tag,
2131                          get_uid_from_tag(tcs_entry->tn.tag),
2132                          tcs_entry->active_set);
2133                 rb_erase(&tcs_entry->tn.node, &tag_counter_set_tree);
2134                 kfree(tcs_entry);
2135         }
2136         spin_unlock_bh(&tag_counter_set_list_lock);
2137
2138         /*
2139          * If acct_tag is 0, then all entries belonging to uid are
2140          * erased.
2141          */
2142         spin_lock_bh(&iface_stat_list_lock);
2143         list_for_each_entry(iface_entry, &iface_stat_list, list) {
2144                 spin_lock_bh(&iface_entry->tag_stat_list_lock);
2145                 node = rb_first(&iface_entry->tag_stat_tree);
2146                 while (node) {
2147                         ts_entry = rb_entry(node, struct tag_stat, tn.node);
2148                         entry_uid = get_uid_from_tag(ts_entry->tn.tag);
2149                         node = rb_next(node);
2150
2151                         CT_DEBUG("qtaguid: ctrl_delete(%s): "
2152                                  "ts tag=0x%llx (uid=%u)\n",
2153                                  input, ts_entry->tn.tag, entry_uid);
2154
2155                         if (entry_uid != uid)
2156                                 continue;
2157                         if (!acct_tag || ts_entry->tn.tag == tag) {
2158                                 CT_DEBUG("qtaguid: ctrl_delete(%s): "
2159                                          "erase ts: %s 0x%llx %u\n",
2160                                          input, iface_entry->ifname,
2161                                          get_atag_from_tag(ts_entry->tn.tag),
2162                                          entry_uid);
2163                                 rb_erase(&ts_entry->tn.node,
2164                                          &iface_entry->tag_stat_tree);
2165                                 kfree(ts_entry);
2166                         }
2167                 }
2168                 spin_unlock_bh(&iface_entry->tag_stat_list_lock);
2169         }
2170         spin_unlock_bh(&iface_stat_list_lock);
2171
2172         /* Cleanup the uid_tag_data */
2173         spin_lock_bh(&uid_tag_data_tree_lock);
2174         node = rb_first(&uid_tag_data_tree);
2175         while (node) {
2176                 utd_entry = rb_entry(node, struct uid_tag_data, node);
2177                 entry_uid = utd_entry->uid;
2178                 node = rb_next(node);
2179
2180                 CT_DEBUG("qtaguid: ctrl_delete(%s): "
2181                          "utd uid=%u\n",
2182                          input, entry_uid);
2183
2184                 if (entry_uid != uid)
2185                         continue;
2186                 /*
2187                  * Go over the tag_refs, and those that don't have
2188                  * sock_tags using them are freed.
2189                  */
2190                 put_tag_ref_tree(tag, utd_entry);
2191                 put_utd_entry(utd_entry);
2192         }
2193         spin_unlock_bh(&uid_tag_data_tree_lock);
2194
2195         atomic64_inc(&qtu_events.delete_cmds);
2196         res = 0;
2197
2198 err:
2199         return res;
2200 }
2201
2202 static int ctrl_cmd_counter_set(const char *input)
2203 {
2204         char cmd;
2205         uid_t uid = 0;
2206         tag_t tag;
2207         int res, argc;
2208         struct tag_counter_set *tcs;
2209         int counter_set;
2210
2211         argc = sscanf(input, "%c %d %u", &cmd, &counter_set, &uid);
2212         CT_DEBUG("qtaguid: ctrl_counterset(%s): argc=%d cmd=%c "
2213                  "set=%d uid=%u\n", input, argc, cmd,
2214                  counter_set, uid);
2215         if (argc != 3) {
2216                 res = -EINVAL;
2217                 goto err;
2218         }
2219         if (counter_set < 0 || counter_set >= IFS_MAX_COUNTER_SETS) {
2220                 pr_info("qtaguid: ctrl_counterset(%s): invalid counter_set range\n",
2221                         input);
2222                 res = -EINVAL;
2223                 goto err;
2224         }
2225         if (!can_manipulate_uids()) {
2226                 pr_info("qtaguid: ctrl_counterset(%s): "
2227                         "insufficient priv from pid=%u tgid=%u uid=%u\n",
2228                         input, current->pid, current->tgid, current_fsuid());
2229                 res = -EPERM;
2230                 goto err;
2231         }
2232
2233         tag = make_tag_from_uid(uid);
2234         spin_lock_bh(&tag_counter_set_list_lock);
2235         tcs = tag_counter_set_tree_search(&tag_counter_set_tree, tag);
2236         if (!tcs) {
2237                 tcs = kzalloc(sizeof(*tcs), GFP_ATOMIC);
2238                 if (!tcs) {
2239                         spin_unlock_bh(&tag_counter_set_list_lock);
2240                         pr_err("qtaguid: ctrl_counterset(%s): "
2241                                "failed to alloc counter set\n",
2242                                input);
2243                         res = -ENOMEM;
2244                         goto err;
2245                 }
2246                 tcs->tn.tag = tag;
2247                 tag_counter_set_tree_insert(tcs, &tag_counter_set_tree);
2248                 CT_DEBUG("qtaguid: ctrl_counterset(%s): added tcs tag=0x%llx "
2249                          "(uid=%u) set=%d\n",
2250                          input, tag, get_uid_from_tag(tag), counter_set);
2251         }
2252         tcs->active_set = counter_set;
2253         spin_unlock_bh(&tag_counter_set_list_lock);
2254         atomic64_inc(&qtu_events.counter_set_changes);
2255         res = 0;
2256
2257 err:
2258         return res;
2259 }
2260
2261 static int ctrl_cmd_tag(const char *input)
2262 {
2263         char cmd;
2264         int sock_fd = 0;
2265         uid_t uid = 0;
2266         tag_t acct_tag = make_atag_from_value(0);
2267         tag_t full_tag;
2268         struct socket *el_socket;
2269         int res, argc;
2270         struct sock_tag *sock_tag_entry;
2271         struct tag_ref *tag_ref_entry;
2272         struct uid_tag_data *uid_tag_data_entry;
2273         struct proc_qtu_data *pqd_entry;
2274
2275         /* Unassigned args will get defaulted later. */
2276         argc = sscanf(input, "%c %d %llu %u", &cmd, &sock_fd, &acct_tag, &uid);
2277         CT_DEBUG("qtaguid: ctrl_tag(%s): argc=%d cmd=%c sock_fd=%d "
2278                  "acct_tag=0x%llx uid=%u\n", input, argc, cmd, sock_fd,
2279                  acct_tag, uid);
2280         if (argc < 2) {
2281                 res = -EINVAL;
2282                 goto err;
2283         }
2284         el_socket = sockfd_lookup(sock_fd, &res);  /* This locks the file */
2285         if (!el_socket) {
2286                 pr_info("qtaguid: ctrl_tag(%s): failed to lookup"
2287                         " sock_fd=%d err=%d pid=%u tgid=%u uid=%u\n",
2288                         input, sock_fd, res, current->pid, current->tgid,
2289                         current_fsuid());
2290                 goto err;
2291         }
2292         CT_DEBUG("qtaguid: ctrl_tag(%s): socket->...->f_count=%ld ->sk=%p\n",
2293                  input, atomic_long_read(&el_socket->file->f_count),
2294                  el_socket->sk);
2295         if (argc < 3) {
2296                 acct_tag = make_atag_from_value(0);
2297         } else if (!valid_atag(acct_tag)) {
2298                 pr_info("qtaguid: ctrl_tag(%s): invalid tag\n", input);
2299                 res = -EINVAL;
2300                 goto err_put;
2301         }
2302         CT_DEBUG("qtaguid: ctrl_tag(%s): "
2303                  "pid=%u tgid=%u uid=%u euid=%u fsuid=%u "
2304                  "ctrl.gid=%u in_group()=%d in_egroup()=%d\n",
2305                  input, current->pid, current->tgid, current_uid(),
2306                  current_euid(), current_fsuid(),
2307                  xt_qtaguid_ctrl_file->gid,
2308                  in_group_p(xt_qtaguid_ctrl_file->gid),
2309                  in_egroup_p(xt_qtaguid_ctrl_file->gid));
2310         if (argc < 4) {
2311                 uid = current_fsuid();
2312         } else if (!can_impersonate_uid(uid)) {
2313                 pr_info("qtaguid: ctrl_tag(%s): "
2314                         "insufficient priv from pid=%u tgid=%u uid=%u\n",
2315                         input, current->pid, current->tgid, current_fsuid());
2316                 res = -EPERM;
2317                 goto err_put;
2318         }
2319         full_tag = combine_atag_with_uid(acct_tag, uid);
2320
2321         spin_lock_bh(&sock_tag_list_lock);
2322         sock_tag_entry = get_sock_stat_nl(el_socket->sk);
2323         tag_ref_entry = get_tag_ref(full_tag, &uid_tag_data_entry);
2324         if (IS_ERR(tag_ref_entry)) {
2325                 res = PTR_ERR(tag_ref_entry);
2326                 spin_unlock_bh(&sock_tag_list_lock);
2327                 goto err_put;
2328         }
2329         tag_ref_entry->num_sock_tags++;
2330         if (sock_tag_entry) {
2331                 struct tag_ref *prev_tag_ref_entry;
2332
2333                 CT_DEBUG("qtaguid: ctrl_tag(%s): retag for sk=%p "
2334                          "st@%p ...->f_count=%ld\n",
2335                          input, el_socket->sk, sock_tag_entry,
2336                          atomic_long_read(&el_socket->file->f_count));
2337                 /*
2338                  * This is a re-tagging, so release the sock_fd that was
2339                  * locked at the time of the 1st tagging.
2340                  * There is still the ref from this call's sockfd_lookup() so
2341                  * it can be done within the spinlock.
2342                  */
2343                 sockfd_put(sock_tag_entry->socket);
2344                 prev_tag_ref_entry = lookup_tag_ref(sock_tag_entry->tag,
2345                                                     &uid_tag_data_entry);
2346                 BUG_ON(IS_ERR_OR_NULL(prev_tag_ref_entry));
2347                 BUG_ON(prev_tag_ref_entry->num_sock_tags <= 0);
2348                 prev_tag_ref_entry->num_sock_tags--;
2349                 sock_tag_entry->tag = full_tag;
2350         } else {
2351                 CT_DEBUG("qtaguid: ctrl_tag(%s): newtag for sk=%p\n",
2352                          input, el_socket->sk);
2353                 sock_tag_entry = kzalloc(sizeof(*sock_tag_entry),
2354                                          GFP_ATOMIC);
2355                 if (!sock_tag_entry) {
2356                         pr_err("qtaguid: ctrl_tag(%s): "
2357                                "socket tag alloc failed\n",
2358                                input);
2359                         spin_unlock_bh(&sock_tag_list_lock);
2360                         res = -ENOMEM;
2361                         goto err_tag_unref_put;
2362                 }
2363                 sock_tag_entry->sk = el_socket->sk;
2364                 sock_tag_entry->socket = el_socket;
2365                 sock_tag_entry->pid = current->tgid;
2366                 sock_tag_entry->tag = combine_atag_with_uid(acct_tag,
2367                                                             uid);
2368                 spin_lock_bh(&uid_tag_data_tree_lock);
2369                 pqd_entry = proc_qtu_data_tree_search(
2370                         &proc_qtu_data_tree, current->tgid);
2371                 /*
2372                  * TODO: remove if, and start failing.
2373                  * At first, we want to catch user-space code that is not
2374                  * opening the /dev/xt_qtaguid.
2375                  */
2376                 if (IS_ERR_OR_NULL(pqd_entry))
2377                         pr_warn_once(
2378                                 "qtaguid: %s(): "
2379                                 "User space forgot to open /dev/xt_qtaguid? "
2380                                 "pid=%u tgid=%u uid=%u\n", __func__,
2381                                 current->pid, current->tgid,
2382                                 current_fsuid());
2383                 else
2384                         list_add(&sock_tag_entry->list,
2385                                  &pqd_entry->sock_tag_list);
2386                 spin_unlock_bh(&uid_tag_data_tree_lock);
2387
2388                 sock_tag_tree_insert(sock_tag_entry, &sock_tag_tree);
2389                 atomic64_inc(&qtu_events.sockets_tagged);
2390         }
2391         spin_unlock_bh(&sock_tag_list_lock);
2392         /* We keep the ref to the socket (file) until it is untagged */
2393         CT_DEBUG("qtaguid: ctrl_tag(%s): done st@%p ...->f_count=%ld\n",
2394                  input, sock_tag_entry,
2395                  atomic_long_read(&el_socket->file->f_count));
2396         return 0;
2397
2398 err_tag_unref_put:
2399         BUG_ON(tag_ref_entry->num_sock_tags <= 0);
2400         tag_ref_entry->num_sock_tags--;
2401         free_tag_ref_from_utd_entry(tag_ref_entry, uid_tag_data_entry);
2402 err_put:
2403         CT_DEBUG("qtaguid: ctrl_tag(%s): done. ...->f_count=%ld\n",
2404                  input, atomic_long_read(&el_socket->file->f_count) - 1);
2405         /* Release the sock_fd that was grabbed by sockfd_lookup(). */
2406         sockfd_put(el_socket);
2407         return res;
2408
2409 err:
2410         CT_DEBUG("qtaguid: ctrl_tag(%s): done.\n", input);
2411         return res;
2412 }
2413
2414 static int ctrl_cmd_untag(const char *input)
2415 {
2416         char cmd;
2417         int sock_fd = 0;
2418         struct socket *el_socket;
2419         int res, argc;
2420         struct sock_tag *sock_tag_entry;
2421         struct tag_ref *tag_ref_entry;
2422         struct uid_tag_data *utd_entry;
2423         struct proc_qtu_data *pqd_entry;
2424
2425         argc = sscanf(input, "%c %d", &cmd, &sock_fd);
2426         CT_DEBUG("qtaguid: ctrl_untag(%s): argc=%d cmd=%c sock_fd=%d\n",
2427                  input, argc, cmd, sock_fd);
2428         if (argc < 2) {
2429                 res = -EINVAL;
2430                 goto err;
2431         }
2432         el_socket = sockfd_lookup(sock_fd, &res);  /* This locks the file */
2433         if (!el_socket) {
2434                 pr_info("qtaguid: ctrl_untag(%s): failed to lookup"
2435                         " sock_fd=%d err=%d pid=%u tgid=%u uid=%u\n",
2436                         input, sock_fd, res, current->pid, current->tgid,
2437                         current_fsuid());
2438                 goto err;
2439         }
2440         CT_DEBUG("qtaguid: ctrl_untag(%s): socket->...->f_count=%ld ->sk=%p\n",
2441                  input, atomic_long_read(&el_socket->file->f_count),
2442                  el_socket->sk);
2443         spin_lock_bh(&sock_tag_list_lock);
2444         sock_tag_entry = get_sock_stat_nl(el_socket->sk);
2445         if (!sock_tag_entry) {
2446                 spin_unlock_bh(&sock_tag_list_lock);
2447                 res = -EINVAL;
2448                 goto err_put;
2449         }
2450         /*
2451          * The socket already belongs to the current process
2452          * so it can do whatever it wants to it.
2453          */
2454         rb_erase(&sock_tag_entry->sock_node, &sock_tag_tree);
2455
2456         tag_ref_entry = lookup_tag_ref(sock_tag_entry->tag, &utd_entry);
2457         BUG_ON(!tag_ref_entry);
2458         BUG_ON(tag_ref_entry->num_sock_tags <= 0);
2459         spin_lock_bh(&uid_tag_data_tree_lock);
2460         pqd_entry = proc_qtu_data_tree_search(
2461                 &proc_qtu_data_tree, current->tgid);
2462         /*
2463          * TODO: remove if, and start failing.
2464          * At first, we want to catch user-space code that is not
2465          * opening the /dev/xt_qtaguid.
2466          */
2467         if (IS_ERR_OR_NULL(pqd_entry))
2468                 pr_warn_once("qtaguid: %s(): "
2469                              "User space forgot to open /dev/xt_qtaguid? "
2470                              "pid=%u tgid=%u uid=%u\n", __func__,
2471                              current->pid, current->tgid, current_fsuid());
2472         else
2473                 list_del(&sock_tag_entry->list);
2474         spin_unlock_bh(&uid_tag_data_tree_lock);
2475         /*
2476          * We don't free tag_ref from the utd_entry here,
2477          * only during a cmd_delete().
2478          */
2479         tag_ref_entry->num_sock_tags--;
2480         spin_unlock_bh(&sock_tag_list_lock);
2481         /*
2482          * Release the sock_fd that was grabbed at tag time,
2483          * and once more for the sockfd_lookup() here.
2484          */
2485         sockfd_put(sock_tag_entry->socket);
2486         CT_DEBUG("qtaguid: ctrl_untag(%s): done. st@%p ...->f_count=%ld\n",
2487                  input, sock_tag_entry,
2488                  atomic_long_read(&el_socket->file->f_count) - 1);
2489         sockfd_put(el_socket);
2490
2491         kfree(sock_tag_entry);
2492         atomic64_inc(&qtu_events.sockets_untagged);
2493
2494         return 0;
2495
2496 err_put:
2497         CT_DEBUG("qtaguid: ctrl_untag(%s): done. socket->...->f_count=%ld\n",
2498                  input, atomic_long_read(&el_socket->file->f_count) - 1);
2499         /* Release the sock_fd that was grabbed by sockfd_lookup(). */
2500         sockfd_put(el_socket);
2501         return res;
2502
2503 err:
2504         CT_DEBUG("qtaguid: ctrl_untag(%s): done.\n", input);
2505         return res;
2506 }
2507
2508 static int qtaguid_ctrl_parse(const char *input, int count)
2509 {
2510         char cmd;
2511         int res;
2512
2513         CT_DEBUG("qtaguid: ctrl(%s): pid=%u tgid=%u uid=%u\n",
2514                  input, current->pid, current->tgid, current_fsuid());
2515
2516         cmd = input[0];
2517         /* Collect params for commands */
2518         switch (cmd) {
2519         case 'd':
2520                 res = ctrl_cmd_delete(input);
2521                 break;
2522
2523         case 's':
2524                 res = ctrl_cmd_counter_set(input);
2525                 break;
2526
2527         case 't':
2528                 res = ctrl_cmd_tag(input);
2529                 break;
2530
2531         case 'u':
2532                 res = ctrl_cmd_untag(input);
2533                 break;
2534
2535         default:
2536                 res = -EINVAL;
2537                 goto err;
2538         }
2539         if (!res)
2540                 res = count;
2541 err:
2542         CT_DEBUG("qtaguid: ctrl(%s): res=%d\n", input, res);
2543         return res;
2544 }
2545
2546 #define MAX_QTAGUID_CTRL_INPUT_LEN 255
2547 static int qtaguid_ctrl_proc_write(struct file *file, const char __user *buffer,
2548                         unsigned long count, void *data)
2549 {
2550         char input_buf[MAX_QTAGUID_CTRL_INPUT_LEN];
2551
2552         if (unlikely(module_passive))
2553                 return count;
2554
2555         if (count >= MAX_QTAGUID_CTRL_INPUT_LEN)
2556                 return -EINVAL;
2557
2558         if (copy_from_user(input_buf, buffer, count))
2559                 return -EFAULT;
2560
2561         input_buf[count] = '\0';
2562         return qtaguid_ctrl_parse(input_buf, count);
2563 }
2564
2565 struct proc_print_info {
2566         char *outp;
2567         char **num_items_returned;
2568         struct iface_stat *iface_entry;
2569         struct tag_stat *ts_entry;
2570         int item_index;
2571         int items_to_skip;
2572         int char_count;
2573 };
2574
2575 static int pp_stats_line(struct proc_print_info *ppi, int cnt_set)
2576 {
2577         int len;
2578         struct data_counters *cnts;
2579
2580         if (!ppi->item_index) {
2581                 if (ppi->item_index++ < ppi->items_to_skip)
2582                         return 0;
2583                 len = snprintf(ppi->outp, ppi->char_count,
2584                                "idx iface acct_tag_hex uid_tag_int cnt_set "
2585                                "rx_bytes rx_packets "
2586                                "tx_bytes tx_packets "
2587                                "rx_tcp_bytes rx_tcp_packets "
2588                                "rx_udp_bytes rx_udp_packets "
2589                                "rx_other_bytes rx_other_packets "
2590                                "tx_tcp_bytes tx_tcp_packets "
2591                                "tx_udp_bytes tx_udp_packets "
2592                                "tx_other_bytes tx_other_packets\n");
2593         } else {
2594                 tag_t tag = ppi->ts_entry->tn.tag;
2595                 uid_t stat_uid = get_uid_from_tag(tag);
2596                 /* Detailed tags are not available to everybody */
2597                 if (get_atag_from_tag(tag)
2598                     && !can_read_other_uid_stats(stat_uid)) {
2599                         CT_DEBUG("qtaguid: stats line: "
2600                                  "%s 0x%llx %u: insufficient priv "
2601                                  "from pid=%u tgid=%u uid=%u stats.gid=%u\n",
2602                                  ppi->iface_entry->ifname,
2603                                  get_atag_from_tag(tag), stat_uid,
2604                                  current->pid, current->tgid, current_fsuid(),
2605                                  xt_qtaguid_stats_file->gid);
2606                         return 0;
2607                 }
2608                 if (ppi->item_index++ < ppi->items_to_skip)
2609                         return 0;
2610                 cnts = &ppi->ts_entry->counters;
2611                 len = snprintf(
2612                         ppi->outp, ppi->char_count,
2613                         "%d %s 0x%llx %u %u "
2614                         "%llu %llu "
2615                         "%llu %llu "
2616                         "%llu %llu "
2617                         "%llu %llu "
2618                         "%llu %llu "
2619                         "%llu %llu "
2620                         "%llu %llu "
2621                         "%llu %llu\n",
2622                         ppi->item_index,
2623                         ppi->iface_entry->ifname,
2624                         get_atag_from_tag(tag),
2625                         stat_uid,
2626                         cnt_set,
2627                         dc_sum_bytes(cnts, cnt_set, IFS_RX),
2628                         dc_sum_packets(cnts, cnt_set, IFS_RX),
2629                         dc_sum_bytes(cnts, cnt_set, IFS_TX),
2630                         dc_sum_packets(cnts, cnt_set, IFS_TX),
2631                         cnts->bpc[cnt_set][IFS_RX][IFS_TCP].bytes,
2632                         cnts->bpc[cnt_set][IFS_RX][IFS_TCP].packets,
2633                         cnts->bpc[cnt_set][IFS_RX][IFS_UDP].bytes,
2634                         cnts->bpc[cnt_set][IFS_RX][IFS_UDP].packets,
2635                         cnts->bpc[cnt_set][IFS_RX][IFS_PROTO_OTHER].bytes,
2636                         cnts->bpc[cnt_set][IFS_RX][IFS_PROTO_OTHER].packets,
2637                         cnts->bpc[cnt_set][IFS_TX][IFS_TCP].bytes,
2638                         cnts->bpc[cnt_set][IFS_TX][IFS_TCP].packets,
2639                         cnts->bpc[cnt_set][IFS_TX][IFS_UDP].bytes,
2640                         cnts->bpc[cnt_set][IFS_TX][IFS_UDP].packets,
2641                         cnts->bpc[cnt_set][IFS_TX][IFS_PROTO_OTHER].bytes,
2642                         cnts->bpc[cnt_set][IFS_TX][IFS_PROTO_OTHER].packets);
2643         }
2644         return len;
2645 }
2646
2647 static bool pp_sets(struct proc_print_info *ppi)
2648 {
2649         int len;
2650         int counter_set;
2651         for (counter_set = 0; counter_set < IFS_MAX_COUNTER_SETS;
2652              counter_set++) {
2653                 len = pp_stats_line(ppi, counter_set);
2654                 if (len >= ppi->char_count) {
2655                         *ppi->outp = '\0';
2656                         return false;
2657                 }
2658                 if (len) {
2659                         ppi->outp += len;
2660                         ppi->char_count -= len;
2661                         (*ppi->num_items_returned)++;
2662                 }
2663         }
2664         return true;
2665 }
2666
2667 /*
2668  * Procfs reader to get all tag stats using style "1)" as described in
2669  * fs/proc/generic.c
2670  * Groups all protocols tx/rx bytes.
2671  */
2672 static int qtaguid_stats_proc_read(char *page, char **num_items_returned,
2673                                 off_t items_to_skip, int char_count, int *eof,
2674                                 void *data)
2675 {
2676         struct proc_print_info ppi;
2677         int len;
2678
2679         ppi.outp = page;
2680         ppi.item_index = 0;
2681         ppi.char_count = char_count;
2682         ppi.num_items_returned = num_items_returned;
2683         ppi.items_to_skip = items_to_skip;
2684
2685         if (unlikely(module_passive)) {
2686                 len = pp_stats_line(&ppi, 0);
2687                 /* The header should always be shorter than the buffer. */
2688                 BUG_ON(len >= ppi.char_count);
2689                 (*num_items_returned)++;
2690                 *eof = 1;
2691                 return len;
2692         }
2693
2694         CT_DEBUG("qtaguid:proc stats pid=%u tgid=%u uid=%u "
2695                  "page=%p *num_items_returned=%p off=%ld "
2696                  "char_count=%d *eof=%d\n",
2697                  current->pid, current->tgid, current_fsuid(),
2698                  page, *num_items_returned,
2699                  items_to_skip, char_count, *eof);
2700
2701         if (*eof)
2702                 return 0;
2703
2704         /* The idx is there to help debug when things go belly up. */
2705         len = pp_stats_line(&ppi, 0);
2706         /* Don't advance the outp unless the whole line was printed */
2707         if (len >= ppi.char_count) {
2708                 *ppi.outp = '\0';
2709                 return ppi.outp - page;
2710         }
2711         if (len) {
2712                 ppi.outp += len;
2713                 ppi.char_count -= len;
2714                 (*num_items_returned)++;
2715         }
2716
2717         spin_lock_bh(&iface_stat_list_lock);
2718         list_for_each_entry(ppi.iface_entry, &iface_stat_list, list) {
2719                 struct rb_node *node;
2720                 spin_lock_bh(&ppi.iface_entry->tag_stat_list_lock);
2721                 for (node = rb_first(&ppi.iface_entry->tag_stat_tree);
2722                      node;
2723                      node = rb_next(node)) {
2724                         ppi.ts_entry = rb_entry(node, struct tag_stat, tn.node);
2725                         if (!pp_sets(&ppi)) {
2726                                 spin_unlock_bh(
2727                                         &ppi.iface_entry->tag_stat_list_lock);
2728                                 spin_unlock_bh(&iface_stat_list_lock);
2729                                 return ppi.outp - page;
2730                         }
2731                 }
2732                 spin_unlock_bh(&ppi.iface_entry->tag_stat_list_lock);
2733         }
2734         spin_unlock_bh(&iface_stat_list_lock);
2735
2736         *eof = 1;
2737         return ppi.outp - page;
2738 }
2739
2740 /*------------------------------------------*/
2741 static int qtudev_open(struct inode *inode, struct file *file)
2742 {
2743         struct uid_tag_data *utd_entry;
2744         struct proc_qtu_data  *pqd_entry;
2745         struct proc_qtu_data  *new_pqd_entry;
2746         int res;
2747         bool utd_entry_found;
2748
2749         if (unlikely(qtu_proc_handling_passive))
2750                 return 0;
2751
2752         DR_DEBUG("qtaguid: qtudev_open(): pid=%u tgid=%u uid=%u\n",
2753                  current->pid, current->tgid, current_fsuid());
2754
2755         spin_lock_bh(&uid_tag_data_tree_lock);
2756
2757         /* Look for existing uid data, or alloc one. */
2758         utd_entry = get_uid_data(current_fsuid(), &utd_entry_found);
2759         if (IS_ERR_OR_NULL(utd_entry)) {
2760                 res = PTR_ERR(utd_entry);
2761                 goto err_unlock;
2762         }
2763
2764         /* Look for existing PID based proc_data */
2765         pqd_entry = proc_qtu_data_tree_search(&proc_qtu_data_tree,
2766                                               current->tgid);
2767         if (pqd_entry) {
2768                 pr_err("qtaguid: qtudev_open(): %u/%u %u "
2769                        "%s already opened\n",
2770                        current->pid, current->tgid, current_fsuid(),
2771                        QTU_DEV_NAME);
2772                 res = -EBUSY;
2773                 goto err_unlock_free_utd;
2774         }
2775
2776         new_pqd_entry = kzalloc(sizeof(*new_pqd_entry), GFP_ATOMIC);
2777         if (!new_pqd_entry) {
2778                 pr_err("qtaguid: qtudev_open(): %u/%u %u: "
2779                        "proc data alloc failed\n",
2780                        current->pid, current->tgid, current_fsuid());
2781                 res = -ENOMEM;
2782                 goto err_unlock_free_utd;
2783         }
2784         new_pqd_entry->pid = current->tgid;
2785         INIT_LIST_HEAD(&new_pqd_entry->sock_tag_list);
2786         new_pqd_entry->parent_tag_data = utd_entry;
2787         utd_entry->num_pqd++;
2788
2789         proc_qtu_data_tree_insert(new_pqd_entry,
2790                                   &proc_qtu_data_tree);
2791
2792         spin_unlock_bh(&uid_tag_data_tree_lock);
2793         DR_DEBUG("qtaguid: tracking data for uid=%u in pqd=%p\n",
2794                  current_fsuid(), new_pqd_entry);
2795         file->private_data = new_pqd_entry;
2796         return 0;
2797
2798 err_unlock_free_utd:
2799         if (!utd_entry_found) {
2800                 rb_erase(&utd_entry->node, &uid_tag_data_tree);
2801                 kfree(utd_entry);
2802         }
2803 err_unlock:
2804         spin_unlock_bh(&uid_tag_data_tree_lock);
2805         return res;
2806 }
2807
2808 static int qtudev_release(struct inode *inode, struct file *file)
2809 {
2810         struct proc_qtu_data  *pqd_entry = file->private_data;
2811         struct uid_tag_data  *utd_entry = pqd_entry->parent_tag_data;
2812         struct sock_tag *st_entry;
2813         struct rb_root st_to_free_tree = RB_ROOT;
2814         struct list_head *entry, *next;
2815         struct tag_ref *tr;
2816
2817         if (unlikely(qtu_proc_handling_passive))
2818                 return 0;
2819
2820         /*
2821          * Do not trust the current->pid, it might just be a kworker cleaning
2822          * up after a dead proc.
2823          */
2824         DR_DEBUG("qtaguid: qtudev_release(): "
2825                  "pid=%u tgid=%u uid=%u "
2826                  "pqd_entry=%p->pid=%u utd_entry=%p->active_tags=%d\n",
2827                  current->pid, current->tgid, pqd_entry->parent_tag_data->uid,
2828                  pqd_entry, pqd_entry->pid, utd_entry,
2829                  utd_entry->num_active_tags);
2830
2831         spin_lock_bh(&sock_tag_list_lock);
2832         spin_lock_bh(&uid_tag_data_tree_lock);
2833
2834         list_for_each_safe(entry, next, &pqd_entry->sock_tag_list) {
2835                 st_entry = list_entry(entry, struct sock_tag, list);
2836                 DR_DEBUG("qtaguid: %s(): "
2837                          "erase sock_tag=%p->sk=%p pid=%u tgid=%u uid=%u\n",
2838                          __func__,
2839                          st_entry, st_entry->sk,
2840                          current->pid, current->tgid,
2841                          pqd_entry->parent_tag_data->uid);
2842
2843                 utd_entry = uid_tag_data_tree_search(
2844                         &uid_tag_data_tree,
2845                         get_uid_from_tag(st_entry->tag));
2846                 BUG_ON(IS_ERR_OR_NULL(utd_entry));
2847                 DR_DEBUG("qtaguid: %s(): "
2848                          "looking for tag=0x%llx in utd_entry=%p\n", __func__,
2849                          st_entry->tag, utd_entry);
2850                 tr = tag_ref_tree_search(&utd_entry->tag_ref_tree,
2851                                          st_entry->tag);
2852                 BUG_ON(!tr);
2853                 BUG_ON(tr->num_sock_tags <= 0);
2854                 tr->num_sock_tags--;
2855                 free_tag_ref_from_utd_entry(tr, utd_entry);
2856
2857                 rb_erase(&st_entry->sock_node, &sock_tag_tree);
2858                 list_del(&st_entry->list);
2859                 /* Can't sockfd_put() within spinlock, do it later. */
2860                 sock_tag_tree_insert(st_entry, &st_to_free_tree);
2861
2862                 /*
2863                  * Try to free the utd_entry if no other proc_qtu_data is
2864                  * using it (num_pqd is 0) and it doesn't have active tags
2865                  * (num_active_tags is 0).
2866                  */
2867                 put_utd_entry(utd_entry);
2868         }
2869
2870         rb_erase(&pqd_entry->node, &proc_qtu_data_tree);
2871         BUG_ON(pqd_entry->parent_tag_data->num_pqd < 1);
2872         pqd_entry->parent_tag_data->num_pqd--;
2873         put_utd_entry(pqd_entry->parent_tag_data);
2874         kfree(pqd_entry);
2875         file->private_data = NULL;
2876
2877         spin_unlock_bh(&uid_tag_data_tree_lock);
2878         spin_unlock_bh(&sock_tag_list_lock);
2879
2880
2881         sock_tag_tree_erase(&st_to_free_tree);
2882
2883         prdebug_full_state(0, "%s(): pid=%u tgid=%u", __func__,
2884                            current->pid, current->tgid);
2885         return 0;
2886 }
2887
2888 /*------------------------------------------*/
2889 static const struct file_operations qtudev_fops = {
2890         .owner = THIS_MODULE,
2891         .open = qtudev_open,
2892         .release = qtudev_release,
2893 };
2894
2895 static struct miscdevice qtu_device = {
2896         .minor = MISC_DYNAMIC_MINOR,
2897         .name = QTU_DEV_NAME,
2898         .fops = &qtudev_fops,
2899         /* How sad it doesn't allow for defaults: .mode = S_IRUGO | S_IWUSR */
2900 };
2901
2902 /*------------------------------------------*/
2903 static int __init qtaguid_proc_register(struct proc_dir_entry **res_procdir)
2904 {
2905         int ret;
2906         *res_procdir = proc_mkdir(module_procdirname, init_net.proc_net);
2907         if (!*res_procdir) {
2908                 pr_err("qtaguid: failed to create proc/.../xt_qtaguid\n");
2909                 ret = -ENOMEM;
2910                 goto no_dir;
2911         }
2912
2913         xt_qtaguid_ctrl_file = create_proc_entry("ctrl", proc_ctrl_perms,
2914                                                 *res_procdir);
2915         if (!xt_qtaguid_ctrl_file) {
2916                 pr_err("qtaguid: failed to create xt_qtaguid/ctrl "
2917                         " file\n");
2918                 ret = -ENOMEM;
2919                 goto no_ctrl_entry;
2920         }
2921         xt_qtaguid_ctrl_file->read_proc = qtaguid_ctrl_proc_read;
2922         xt_qtaguid_ctrl_file->write_proc = qtaguid_ctrl_proc_write;
2923
2924         xt_qtaguid_stats_file = create_proc_entry("stats", proc_stats_perms,
2925                                                 *res_procdir);
2926         if (!xt_qtaguid_stats_file) {
2927                 pr_err("qtaguid: failed to create xt_qtaguid/stats "
2928                         "file\n");
2929                 ret = -ENOMEM;
2930                 goto no_stats_entry;
2931         }
2932         xt_qtaguid_stats_file->read_proc = qtaguid_stats_proc_read;
2933         /*
2934          * TODO: add support counter hacking
2935          * xt_qtaguid_stats_file->write_proc = qtaguid_stats_proc_write;
2936          */
2937         return 0;
2938
2939 no_stats_entry:
2940         remove_proc_entry("ctrl", *res_procdir);
2941 no_ctrl_entry:
2942         remove_proc_entry("xt_qtaguid", NULL);
2943 no_dir:
2944         return ret;
2945 }
2946
2947 static struct xt_match qtaguid_mt_reg __read_mostly = {
2948         /*
2949          * This module masquerades as the "owner" module so that iptables
2950          * tools can deal with it.
2951          */
2952         .name       = "owner",
2953         .revision   = 1,
2954         .family     = NFPROTO_UNSPEC,
2955         .match      = qtaguid_mt,
2956         .matchsize  = sizeof(struct xt_qtaguid_match_info),
2957         .me         = THIS_MODULE,
2958 };
2959
2960 static int __init qtaguid_mt_init(void)
2961 {
2962         if (qtaguid_proc_register(&xt_qtaguid_procdir)
2963             || iface_stat_init(xt_qtaguid_procdir)
2964             || xt_register_match(&qtaguid_mt_reg)
2965             || misc_register(&qtu_device))
2966                 return -1;
2967         return 0;
2968 }
2969
2970 /*
2971  * TODO: allow unloading of the module.
2972  * For now stats are permanent.
2973  * Kconfig forces'y/n' and never an 'm'.
2974  */
2975
2976 module_init(qtaguid_mt_init);
2977 MODULE_AUTHOR("jpa <jpa@google.com>");
2978 MODULE_DESCRIPTION("Xtables: socket owner+tag matching and associated stats");
2979 MODULE_LICENSE("GPL");
2980 MODULE_ALIAS("ipt_owner");
2981 MODULE_ALIAS("ip6t_owner");
2982 MODULE_ALIAS("ipt_qtaguid");
2983 MODULE_ALIAS("ip6t_qtaguid");