1 /*
2 * xt_quota2 - enhanced xt_quota that can count upwards and in packets
3 * as a minimal accounting match.
4 * by Jan Engelhardt <jengelh@medozas.de>, 2008
5 *
6 * Originally based on xt_quota.c:
7 * netfilter module to enforce network quotas
8 * Sam Johnston <samj@samj.net>
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License; either
12 * version 2 of the License, as published by the Free Software Foundation.
13 */
14 #include <linux/list.h>
15 #include <linux/module.h>
16 #include <linux/proc_fs.h>
17 #include <linux/skbuff.h>
18 #include <linux/spinlock.h>
19 #include <asm/atomic.h>
20 #include <net/netlink.h>
21
22 #include <linux/netfilter/x_tables.h>
23 #include <linux/netfilter/xt_quota2.h>
24
25 #ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
26 /* For compatibility, these definitions are copied from the
27 * deprecated header file <linux/netfilter_ipv4/ipt_ULOG.h> */
28 #define ULOG_MAC_LEN 80
29 #define ULOG_PREFIX_LEN 32
30
31 /* Format of the ULOG packets passed through netlink */
32 typedef struct ulog_packet_msg {
33 unsigned long mark;
34 long timestamp_sec;
35 long timestamp_usec;
36 unsigned int hook;
37 char indev_name[IFNAMSIZ];
38 char outdev_name[IFNAMSIZ];
39 size_t data_len;
40 char prefix[ULOG_PREFIX_LEN];
41 unsigned char mac_len;
42 unsigned char mac[ULOG_MAC_LEN];
43 unsigned char payload[0];
44 } ulog_packet_msg_t;
45 #endif
46
47 /**
48 * @lock: lock to protect quota writers from each other
49 */
50 struct xt_quota_counter {
51 u_int64_t quota;
52 spinlock_t lock;
53 struct list_head list;
54 atomic_t ref;
55 char name[sizeof(((struct xt_quota_mtinfo2 *)NULL)->name)];
56 struct proc_dir_entry *procfs_entry;
57 };
58
59 #ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
60 /* Harald's favorite number +1 :D From ipt_ULOG.C */
61 static int qlog_nl_event = 112;
62 module_param_named(event_num, qlog_nl_event, uint, S_IRUGO | S_IWUSR);
63 MODULE_PARM_DESC(event_num,
64 "Event number for NETLINK_NFLOG message. 0 disables log."
65 "111 is what ipt_ULOG uses.");
66 static struct sock *nflognl;
67 #endif
68
69 static LIST_HEAD(counter_list);
70 static DEFINE_SPINLOCK(counter_list_lock);
71
72 static struct proc_dir_entry *proc_xt_quota;
73 static unsigned int quota_list_perms = S_IRUGO | S_IWUSR;
74 static kuid_t quota_list_uid = KUIDT_INIT(0);
75 static kgid_t quota_list_gid = KGIDT_INIT(0);
76 module_param_named(perms, quota_list_perms, uint, S_IRUGO | S_IWUSR);
77
78 #ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
quota2_log(unsigned int hooknum,const struct sk_buff * skb,const struct net_device * in,const struct net_device * out,const char * prefix)79 static void quota2_log(unsigned int hooknum,
80 const struct sk_buff *skb,
81 const struct net_device *in,
82 const struct net_device *out,
83 const char *prefix)
84 {
85 ulog_packet_msg_t *pm;
86 struct sk_buff *log_skb;
87 size_t size;
88 struct nlmsghdr *nlh;
89
90 if (!qlog_nl_event)
91 return;
92
93 size = NLMSG_SPACE(sizeof(*pm));
94 size = max(size, (size_t)NLMSG_GOODSIZE);
95 log_skb = alloc_skb(size, GFP_ATOMIC);
96 if (!log_skb) {
97 pr_err("xt_quota2: cannot alloc skb for logging\n");
98 return;
99 }
100
101 nlh = nlmsg_put(log_skb, /*pid*/0, /*seq*/0, qlog_nl_event,
102 sizeof(*pm), 0);
103 if (!nlh) {
104 pr_err("xt_quota2: nlmsg_put failed\n");
105 kfree_skb(log_skb);
106 return;
107 }
108 pm = nlmsg_data(nlh);
109 memset(pm, 0, sizeof(*pm));
110 if (skb->tstamp == 0)
111 __net_timestamp((struct sk_buff *)skb);
112 pm->hook = hooknum;
113 if (prefix != NULL)
114 strlcpy(pm->prefix, prefix, sizeof(pm->prefix));
115 if (in)
116 strlcpy(pm->indev_name, in->name, sizeof(pm->indev_name));
117 if (out)
118 strlcpy(pm->outdev_name, out->name, sizeof(pm->outdev_name));
119
120 NETLINK_CB(log_skb).dst_group = 1;
121 pr_debug("throwing 1 packets to netlink group 1\n");
122 netlink_broadcast(nflognl, log_skb, 0, 1, GFP_ATOMIC);
123 }
124 #else
quota2_log(unsigned int hooknum,const struct sk_buff * skb,const struct net_device * in,const struct net_device * out,const char * prefix)125 static void quota2_log(unsigned int hooknum,
126 const struct sk_buff *skb,
127 const struct net_device *in,
128 const struct net_device *out,
129 const char *prefix)
130 {
131 }
132 #endif /* if+else CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG */
133
quota_proc_read(struct file * file,char __user * buf,size_t size,loff_t * ppos)134 static ssize_t quota_proc_read(struct file *file, char __user *buf,
135 size_t size, loff_t *ppos)
136 {
137 struct xt_quota_counter *e = PDE_DATA(file_inode(file));
138 char tmp[24];
139 size_t tmp_size;
140
141 spin_lock_bh(&e->lock);
142 tmp_size = scnprintf(tmp, sizeof(tmp), "%llu\n", e->quota);
143 spin_unlock_bh(&e->lock);
144 return simple_read_from_buffer(buf, size, ppos, tmp, tmp_size);
145 }
146
quota_proc_write(struct file * file,const char __user * input,size_t size,loff_t * ppos)147 static ssize_t quota_proc_write(struct file *file, const char __user *input,
148 size_t size, loff_t *ppos)
149 {
150 struct xt_quota_counter *e = PDE_DATA(file_inode(file));
151 char buf[sizeof("18446744073709551616")];
152
153 if (size > sizeof(buf))
154 size = sizeof(buf);
155 if (copy_from_user(buf, input, size) != 0)
156 return -EFAULT;
157 buf[sizeof(buf)-1] = '\0';
158 if (size < sizeof(buf))
159 buf[size] = '\0';
160
161 spin_lock_bh(&e->lock);
162 e->quota = simple_strtoull(buf, NULL, 0);
163 spin_unlock_bh(&e->lock);
164 return size;
165 }
166
167 static const struct proc_ops q2_counter_fops = {
168 .proc_read = quota_proc_read,
169 .proc_write = quota_proc_write,
170 .proc_lseek = default_llseek,
171 };
172
173 static struct xt_quota_counter *
q2_new_counter(const struct xt_quota_mtinfo2 * q,bool anon)174 q2_new_counter(const struct xt_quota_mtinfo2 *q, bool anon)
175 {
176 struct xt_quota_counter *e;
177 unsigned int size;
178
179 /* Do not need all the procfs things for anonymous counters. */
180 size = anon ? offsetof(typeof(*e), list) : sizeof(*e);
181 e = kmalloc(size, GFP_KERNEL);
182 if (e == NULL)
183 return NULL;
184
185 e->quota = q->quota;
186 spin_lock_init(&e->lock);
187 if (!anon) {
188 INIT_LIST_HEAD(&e->list);
189 atomic_set(&e->ref, 1);
190 strlcpy(e->name, q->name, sizeof(e->name));
191 }
192 return e;
193 }
194
195 /**
196 * q2_get_counter - get ref to counter or create new
197 * @name: name of counter
198 */
199 static struct xt_quota_counter *
q2_get_counter(const struct xt_quota_mtinfo2 * q)200 q2_get_counter(const struct xt_quota_mtinfo2 *q)
201 {
202 struct proc_dir_entry *p;
203 struct xt_quota_counter *e = NULL;
204 struct xt_quota_counter *new_e;
205
206 if (*q->name == '\0')
207 return q2_new_counter(q, true);
208
209 /* No need to hold a lock while getting a new counter */
210 new_e = q2_new_counter(q, false);
211 if (new_e == NULL)
212 goto out;
213
214 spin_lock_bh(&counter_list_lock);
215 list_for_each_entry(e, &counter_list, list)
216 if (strcmp(e->name, q->name) == 0) {
217 atomic_inc(&e->ref);
218 spin_unlock_bh(&counter_list_lock);
219 kfree(new_e);
220 pr_debug("xt_quota2: old counter name=%s", e->name);
221 return e;
222 }
223 e = new_e;
224 pr_debug("xt_quota2: new_counter name=%s", e->name);
225 list_add_tail(&e->list, &counter_list);
226 /* The entry having a refcount of 1 is not directly destructible.
227 * This func has not yet returned the new entry, thus iptables
228 * has not references for destroying this entry.
229 * For another rule to try to destroy it, it would 1st need for this
230 * func* to be re-invoked, acquire a new ref for the same named quota.
231 * Nobody will access the e->procfs_entry either.
232 * So release the lock. */
233 spin_unlock_bh(&counter_list_lock);
234
235 /* create_proc_entry() is not spin_lock happy */
236 p = e->procfs_entry = proc_create_data(e->name, quota_list_perms,
237 proc_xt_quota, &q2_counter_fops, e);
238
239 if (IS_ERR_OR_NULL(p)) {
240 spin_lock_bh(&counter_list_lock);
241 list_del(&e->list);
242 spin_unlock_bh(&counter_list_lock);
243 goto out;
244 }
245 proc_set_user(p, quota_list_uid, quota_list_gid);
246 return e;
247
248 out:
249 kfree(e);
250 return NULL;
251 }
252
quota_mt2_check(const struct xt_mtchk_param * par)253 static int quota_mt2_check(const struct xt_mtchk_param *par)
254 {
255 struct xt_quota_mtinfo2 *q = par->matchinfo;
256
257 pr_debug("xt_quota2: check() flags=0x%04x", q->flags);
258
259 if (q->flags & ~XT_QUOTA_MASK)
260 return -EINVAL;
261
262 q->name[sizeof(q->name)-1] = '\0';
263 if (*q->name == '.' || strchr(q->name, '/') != NULL) {
264 printk(KERN_ERR "xt_quota.3: illegal name\n");
265 return -EINVAL;
266 }
267
268 q->master = q2_get_counter(q);
269 if (q->master == NULL) {
270 printk(KERN_ERR "xt_quota.3: memory alloc failure\n");
271 return -ENOMEM;
272 }
273
274 return 0;
275 }
276
quota_mt2_destroy(const struct xt_mtdtor_param * par)277 static void quota_mt2_destroy(const struct xt_mtdtor_param *par)
278 {
279 struct xt_quota_mtinfo2 *q = par->matchinfo;
280 struct xt_quota_counter *e = q->master;
281
282 if (*q->name == '\0') {
283 kfree(e);
284 return;
285 }
286
287 spin_lock_bh(&counter_list_lock);
288 if (!atomic_dec_and_test(&e->ref)) {
289 spin_unlock_bh(&counter_list_lock);
290 return;
291 }
292
293 list_del(&e->list);
294 spin_unlock_bh(&counter_list_lock);
295 remove_proc_entry(e->name, proc_xt_quota);
296 kfree(e);
297 }
298
299 static bool
quota_mt2(const struct sk_buff * skb,struct xt_action_param * par)300 quota_mt2(const struct sk_buff *skb, struct xt_action_param *par)
301 {
302 struct xt_quota_mtinfo2 *q = (void *)par->matchinfo;
303 struct xt_quota_counter *e = q->master;
304 int charge = (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;
305 bool no_change = q->flags & XT_QUOTA_NO_CHANGE;
306 bool ret = q->flags & XT_QUOTA_INVERT;
307
308 spin_lock_bh(&e->lock);
309 if (q->flags & XT_QUOTA_GROW) {
310 /*
311 * While no_change is pointless in "grow" mode, we will
312 * implement it here simply to have a consistent behavior.
313 */
314 if (!no_change)
315 e->quota += charge;
316 ret = true; /* note: does not respect inversion (bug??) */
317 } else {
318 if (e->quota > charge) {
319 if (!no_change)
320 e->quota -= charge;
321 ret = !ret;
322 } else if (e->quota) {
323 /* We are transitioning, log that fact. */
324 quota2_log(xt_hooknum(par),
325 skb,
326 xt_in(par),
327 xt_out(par),
328 q->name);
329 /* we do not allow even small packets from now on */
330 e->quota = 0;
331 }
332 }
333 spin_unlock_bh(&e->lock);
334 return ret;
335 }
336
337 static struct xt_match quota_mt2_reg[] __read_mostly = {
338 {
339 .name = "quota2",
340 .revision = 3,
341 .family = NFPROTO_IPV4,
342 .checkentry = quota_mt2_check,
343 .match = quota_mt2,
344 .destroy = quota_mt2_destroy,
345 .matchsize = sizeof(struct xt_quota_mtinfo2),
346 .usersize = offsetof(struct xt_quota_mtinfo2, master),
347 .me = THIS_MODULE,
348 },
349 {
350 .name = "quota2",
351 .revision = 3,
352 .family = NFPROTO_IPV6,
353 .checkentry = quota_mt2_check,
354 .match = quota_mt2,
355 .destroy = quota_mt2_destroy,
356 .matchsize = sizeof(struct xt_quota_mtinfo2),
357 .usersize = offsetof(struct xt_quota_mtinfo2, master),
358 .me = THIS_MODULE,
359 },
360 };
361
quota_mt2_init(void)362 static int __init quota_mt2_init(void)
363 {
364 int ret;
365 pr_debug("xt_quota2: init()");
366
367 #ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
368 nflognl = netlink_kernel_create(&init_net, NETLINK_NFLOG, NULL);
369 if (!nflognl)
370 return -ENOMEM;
371 #endif
372
373 proc_xt_quota = proc_mkdir("xt_quota", init_net.proc_net);
374 if (proc_xt_quota == NULL)
375 return -EACCES;
376
377 ret = xt_register_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
378 if (ret < 0)
379 remove_proc_entry("xt_quota", init_net.proc_net);
380 pr_debug("xt_quota2: init() %d", ret);
381 return ret;
382 }
383
quota_mt2_exit(void)384 static void __exit quota_mt2_exit(void)
385 {
386 xt_unregister_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
387 remove_proc_entry("xt_quota", init_net.proc_net);
388 }
389
390 module_init(quota_mt2_init);
391 module_exit(quota_mt2_exit);
392 MODULE_DESCRIPTION("Xtables: countdown quota match; up counter");
393 MODULE_AUTHOR("Sam Johnston <samj@samj.net>");
394 MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
395 MODULE_LICENSE("GPL");
396 MODULE_ALIAS("ipt_quota2");
397 MODULE_ALIAS("ip6t_quota2");
398