net/netfilter/xt_quota2.c

   1 /*
   2  * xt_quota2 - enhanced xt_quota that can count upwards and in packets
   3  * as a minimal accounting match.
   4  * by Jan Engelhardt <jengelh@medozas.de>, 2008
   5  *
   6  * Originally based on xt_quota.c:
   7  *      netfilter module to enforce network quotas
   8  *      Sam Johnston <samj@samj.net>
   9  *
  10  *      This program is free software; you can redistribute it and/or modify
  11  *      it under the terms of the GNU General Public License; either
  12  *      version 2 of the License, as published by the Free Software Foundation.
  13  */
  14 #include <linux/list.h>
  15 #include <linux/module.h>
  16 #include <linux/proc_fs.h>
  17 #include <linux/skbuff.h>
  18 #include <linux/spinlock.h>
  19 #include <asm/atomic.h>
  20 #include <net/netlink.h>
  21
  22 #include <linux/netfilter/x_tables.h>
  23 #include <linux/netfilter/xt_quota2.h>
  24 #ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
  25 #include <linux/netfilter_ipv4/ipt_ULOG.h>
  26 #endif
  27
  28 /**
  29  * @lock:       lock to protect quota writers from each other
  30  */
  31 struct xt_quota_counter {
  32         u_int64_t quota;
  33         spinlock_t lock;
  34         struct list_head list;
  35         atomic_t ref;
  36         char name[sizeof(((struct xt_quota_mtinfo2 *)NULL)->name)];
  37         struct proc_dir_entry *procfs_entry;
  38 };
  39
  40 #ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
  41 /* Harald's favorite number +1 :D From ipt_ULOG.C */
  42 static int qlog_nl_event = 112;
  43 module_param_named(event_num, qlog_nl_event, uint, S_IRUGO | S_IWUSR);
  44 MODULE_PARM_DESC(event_num,
  45                  "Event number for NETLINK_NFLOG message. 0 disables log."
  46                  "111 is what ipt_ULOG uses.");
  47 static struct sock *nflognl;
  48 #endif
  49
  50 static LIST_HEAD(counter_list);
  51 static DEFINE_SPINLOCK(counter_list_lock);
  52
  53 static struct proc_dir_entry *proc_xt_quota;
  54 static unsigned int quota_list_perms = S_IRUGO | S_IWUSR;
  55 static kuid_t quota_list_uid = KUIDT_INIT(0);
  56 static kgid_t quota_list_gid = KGIDT_INIT(0);
  57 module_param_named(perms, quota_list_perms, uint, S_IRUGO | S_IWUSR);
  58
  59 #ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
  60 static void quota2_log(unsigned int hooknum,
  61                        const struct sk_buff *skb,
  62                        const struct net_device *in,
  63                        const struct net_device *out,
  64                        const char *prefix)
  65 {
  66         ulog_packet_msg_t *pm;
  67         struct sk_buff *log_skb;
  68         size_t size;
  69         struct nlmsghdr *nlh;
  70
  71         if (!qlog_nl_event)
  72                 return;
  73
  74         size = NLMSG_SPACE(sizeof(*pm));
  75         size = max(size, (size_t)NLMSG_GOODSIZE);
  76         log_skb = alloc_skb(size, GFP_ATOMIC);
  77         if (!log_skb) {
  78                 pr_err("xt_quota2: cannot alloc skb for logging\n");
  79                 return;
  80         }
  81
  82         nlh = nlmsg_put(log_skb, /*pid*/0, /*seq*/0, qlog_nl_event,
  83                         sizeof(*pm), 0);
  84         if (!nlh) {
  85                 pr_err("xt_quota2: nlmsg_put failed\n");
  86                 kfree_skb(log_skb);
  87                 return;
  88         }
  89         pm = nlmsg_data(nlh);
  90         if (skb->tstamp.tv64 == 0)
  91                 __net_timestamp((struct sk_buff *)skb);
  92         pm->data_len = 0;
  93         pm->hook = hooknum;
  94         if (prefix != NULL)
  95                 strlcpy(pm->prefix, prefix, sizeof(pm->prefix));
  96         else
  97                 *(pm->prefix) = '\0';
  98         if (in)
  99                 strlcpy(pm->indev_name, in->name, sizeof(pm->indev_name));
 100         else
 101                 pm->indev_name[0] = '\0';
 102
 103         if (out)
 104                 strlcpy(pm->outdev_name, out->name, sizeof(pm->outdev_name));
 105         else
 106                 pm->outdev_name[0] = '\0';
 107
 108         NETLINK_CB(log_skb).dst_group = 1;
 109         pr_debug("throwing 1 packets to netlink group 1\n");
 110         netlink_broadcast(nflognl, log_skb, 0, 1, GFP_ATOMIC);
 111 }
 112 #else
 113 static void quota2_log(unsigned int hooknum,
 114                        const struct sk_buff *skb,
 115                        const struct net_device *in,
 116                        const struct net_device *out,
 117                        const char *prefix)
 118 {
 119 }
 120 #endif  /* if+else CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG */
 121
 122 static ssize_t quota_proc_read(struct file *file, char __user *buf,
 123                            size_t size, loff_t *ppos)
 124 {
 125         struct xt_quota_counter *e = PDE_DATA(file_inode(file));
 126         char tmp[24];
 127         size_t tmp_size;
 128
 129         spin_lock_bh(&e->lock);
 130         tmp_size = scnprintf(tmp, sizeof(tmp), "%llu\n", e->quota);
 131         spin_unlock_bh(&e->lock);
 132         return simple_read_from_buffer(buf, size, ppos, tmp, tmp_size);
 133 }
 134
 135 static ssize_t quota_proc_write(struct file *file, const char __user *input,
 136                             size_t size, loff_t *ppos)
 137 {
 138         struct xt_quota_counter *e = PDE_DATA(file_inode(file));
 139         char buf[sizeof("18446744073709551616")];
 140
 141         if (size > sizeof(buf))
 142                 size = sizeof(buf);
 143         if (copy_from_user(buf, input, size) != 0)
 144                 return -EFAULT;
 145         buf[sizeof(buf)-1] = '\0';
 146
 147         spin_lock_bh(&e->lock);
 148         e->quota = simple_strtoull(buf, NULL, 0);
 149         spin_unlock_bh(&e->lock);
 150         return size;
 151 }
 152
 153 static const struct file_operations q2_counter_fops = {
 154         .read           = quota_proc_read,
 155         .write          = quota_proc_write,
 156         .llseek         = default_llseek,
 157 };
 158
 159 static struct xt_quota_counter *
 160 q2_new_counter(const struct xt_quota_mtinfo2 *q, bool anon)
 161 {
 162         struct xt_quota_counter *e;
 163         unsigned int size;
 164
 165         /* Do not need all the procfs things for anonymous counters. */
 166         size = anon ? offsetof(typeof(*e), list) : sizeof(*e);
 167         e = kmalloc(size, GFP_KERNEL);
 168         if (e == NULL)
 169                 return NULL;
 170
 171         e->quota = q->quota;
 172         spin_lock_init(&e->lock);
 173         if (!anon) {
 174                 INIT_LIST_HEAD(&e->list);
 175                 atomic_set(&e->ref, 1);
 176                 strlcpy(e->name, q->name, sizeof(e->name));
 177         }
 178         return e;
 179 }
 180
 181 /**
 182  * q2_get_counter - get ref to counter or create new
 183  * @name:       name of counter
 184  */
 185 static struct xt_quota_counter *
 186 q2_get_counter(const struct xt_quota_mtinfo2 *q)
 187 {
 188         struct proc_dir_entry *p;
 189         struct xt_quota_counter *e = NULL;
 190         struct xt_quota_counter *new_e;
 191
 192         if (*q->name == '\0')
 193                 return q2_new_counter(q, true);
 194
 195         /* No need to hold a lock while getting a new counter */
 196         new_e = q2_new_counter(q, false);
 197         if (new_e == NULL)
 198                 goto out;
 199
 200         spin_lock_bh(&counter_list_lock);
 201         list_for_each_entry(e, &counter_list, list)
 202                 if (strcmp(e->name, q->name) == 0) {
 203                         atomic_inc(&e->ref);
 204                         spin_unlock_bh(&counter_list_lock);
 205                         kfree(new_e);
 206                         pr_debug("xt_quota2: old counter name=%s", e->name);
 207                         return e;
 208                 }
 209         e = new_e;
 210         pr_debug("xt_quota2: new_counter name=%s", e->name);
 211         list_add_tail(&e->list, &counter_list);
 212         /* The entry having a refcount of 1 is not directly destructible.
 213          * This func has not yet returned the new entry, thus iptables
 214          * has not references for destroying this entry.
 215          * For another rule to try to destroy it, it would 1st need for this
 216          * func* to be re-invoked, acquire a new ref for the same named quota.
 217          * Nobody will access the e->procfs_entry either.
 218          * So release the lock. */
 219         spin_unlock_bh(&counter_list_lock);
 220
 221         /* create_proc_entry() is not spin_lock happy */
 222         p = e->procfs_entry = proc_create_data(e->name, quota_list_perms,
 223                               proc_xt_quota, &q2_counter_fops, e);
 224
 225         if (IS_ERR_OR_NULL(p)) {
 226                 spin_lock_bh(&counter_list_lock);
 227                 list_del(&e->list);
 228                 spin_unlock_bh(&counter_list_lock);
 229                 goto out;
 230         }
 231         proc_set_user(p, quota_list_uid, quota_list_gid);
 232         return e;
 233
 234  out:
 235         kfree(e);
 236         return NULL;
 237 }
 238
 239 static int quota_mt2_check(const struct xt_mtchk_param *par)
 240 {
 241         struct xt_quota_mtinfo2 *q = par->matchinfo;
 242
 243         pr_debug("xt_quota2: check() flags=0x%04x", q->flags);
 244
 245         if (q->flags & ~XT_QUOTA_MASK)
 246                 return -EINVAL;
 247
 248         q->name[sizeof(q->name)-1] = '\0';
 249         if (*q->name == '.' || strchr(q->name, '/') != NULL) {
 250                 printk(KERN_ERR "xt_quota.3: illegal name\n");
 251                 return -EINVAL;
 252         }
 253
 254         q->master = q2_get_counter(q);
 255         if (q->master == NULL) {
 256                 printk(KERN_ERR "xt_quota.3: memory alloc failure\n");
 257                 return -ENOMEM;
 258         }
 259
 260         return 0;
 261 }
 262
 263 static void quota_mt2_destroy(const struct xt_mtdtor_param *par)
 264 {
 265         struct xt_quota_mtinfo2 *q = par->matchinfo;
 266         struct xt_quota_counter *e = q->master;
 267
 268         if (*q->name == '\0') {
 269                 kfree(e);
 270                 return;
 271         }
 272
 273         spin_lock_bh(&counter_list_lock);
 274         if (!atomic_dec_and_test(&e->ref)) {
 275                 spin_unlock_bh(&counter_list_lock);
 276                 return;
 277         }
 278
 279         list_del(&e->list);
 280         remove_proc_entry(e->name, proc_xt_quota);
 281         spin_unlock_bh(&counter_list_lock);
 282         kfree(e);
 283 }
 284
 285 static bool
 286 quota_mt2(const struct sk_buff *skb, struct xt_action_param *par)
 287 {
 288         struct xt_quota_mtinfo2 *q = (void *)par->matchinfo;
 289         struct xt_quota_counter *e = q->master;
 290         bool ret = q->flags & XT_QUOTA_INVERT;
 291
 292         spin_lock_bh(&e->lock);
 293         if (q->flags & XT_QUOTA_GROW) {
 294                 /*
 295                  * While no_change is pointless in "grow" mode, we will
 296                  * implement it here simply to have a consistent behavior.
 297                  */
 298                 if (!(q->flags & XT_QUOTA_NO_CHANGE)) {
 299                         e->quota += (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;
 300                 }
 301                 ret = true;
 302         } else {
 303                 if (e->quota >= skb->len) {
 304                         if (!(q->flags & XT_QUOTA_NO_CHANGE))
 305                                 e->quota -= (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;
 306                         ret = !ret;
 307                 } else {
 308                         /* We are transitioning, log that fact. */
 309                         if (e->quota) {
 310                                 quota2_log(par->hooknum,
 311                                            skb,
 312                                            par->in,
 313                                            par->out,
 314                                            q->name);
 315                         }
 316                         /* we do not allow even small packets from now on */
 317                         e->quota = 0;
 318                 }
 319         }
 320         spin_unlock_bh(&e->lock);
 321         return ret;
 322 }
 323
 324 static struct xt_match quota_mt2_reg[] __read_mostly = {
 325         {
 326                 .name       = "quota2",
 327                 .revision   = 3,
 328                 .family     = NFPROTO_IPV4,
 329                 .checkentry = quota_mt2_check,
 330                 .match      = quota_mt2,
 331                 .destroy    = quota_mt2_destroy,
 332                 .matchsize  = sizeof(struct xt_quota_mtinfo2),
 333                 .me         = THIS_MODULE,
 334         },
 335         {
 336                 .name       = "quota2",
 337                 .revision   = 3,
 338                 .family     = NFPROTO_IPV6,
 339                 .checkentry = quota_mt2_check,
 340                 .match      = quota_mt2,
 341                 .destroy    = quota_mt2_destroy,
 342                 .matchsize  = sizeof(struct xt_quota_mtinfo2),
 343                 .me         = THIS_MODULE,
 344         },
 345 };
 346
 347 static int __init quota_mt2_init(void)
 348 {
 349         int ret;
 350         pr_debug("xt_quota2: init()");
 351
 352 #ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
 353         nflognl = netlink_kernel_create(&init_net, NETLINK_NFLOG, NULL);
 354         if (!nflognl)
 355                 return -ENOMEM;
 356 #endif
 357
 358         proc_xt_quota = proc_mkdir("xt_quota", init_net.proc_net);
 359         if (proc_xt_quota == NULL)
 360                 return -EACCES;
 361
 362         ret = xt_register_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
 363         if (ret < 0)
 364                 remove_proc_entry("xt_quota", init_net.proc_net);
 365         pr_debug("xt_quota2: init() %d", ret);
 366         return ret;
 367 }
 368
 369 static void __exit quota_mt2_exit(void)
 370 {
 371         xt_unregister_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
 372         remove_proc_entry("xt_quota", init_net.proc_net);
 373 }
 374
 375 module_init(quota_mt2_init);
 376 module_exit(quota_mt2_exit);
 377 MODULE_DESCRIPTION("Xtables: countdown quota match; up counter");
 378 MODULE_AUTHOR("Sam Johnston <samj@samj.net>");
 379 MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
 380 MODULE_LICENSE("GPL");
 381 MODULE_ALIAS("ipt_quota2");
 382 MODULE_ALIAS("ip6t_quota2");