netfitler: fixup the quota2, and enable.

The xt_quota2 came from
  http://sourceforge.net/projects/xtables-addons/develop

It needed tweaking for it to compile within the kernel tree.
Fixed kmalloc() and create_proc_entry() invocations within
 a non-interruptible context.
Removed useless copying of current quota back to the iptable's
struct matchinfo:
  - those are per CPU: they will change randomly based on which
    cpu gets to update the value.
  - they prevent matching a rule: e.g.
      -A chain -m quota2 --name q1 --quota 123
     can't be followed by
      -D chain -m quota2 --name q1 --quota 123
    as the 123 will be compared to the struct matchinfo's quota member.

Change-Id: I021d3b743db3b22158cc49acb5c94d905b501492
Signed-off-by: JP Abgrall <jpa@google.com>

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index a704486d4ba79b3e6551813868bd370ce4d61680..ddb7bb507bd5fb7cc2a12fed1d7bb97110b5faae 100644 (file)
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -963,6 +963,18 @@ config NETFILTER_XT_MATCH_QUOTA
          If you want to compile it as a module, say M here and read
          <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 
+config NETFILTER_XT_MATCH_QUOTA2
+       tristate '"quota2" match support'
+       depends on NETFILTER_ADVANCED
+       help
+         This option adds a `quota2' match, which allows to match on a
+         byte counter correctly and not per CPU.
+         It allows naming the quotas.
+         This is based on http://xtables-addons.git.sourceforge.net
+
+         If you want to compile it as a module, say M here and read
+         <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
+
 config NETFILTER_XT_MATCH_RATEEST
        tristate '"rateest" match support'
        depends on NETFILTER_ADVANCED

diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 5c7b91e0adcbce1aa940b0be59ce197658d5e761..8b658ef785018a5efb5ae7e916b4681d181c67f1 100644 (file)
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -97,6 +97,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_QTAGUID) += xt_qtaguid.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA) += xt_quota.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA2) += xt_quota2.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_RATEEST) += xt_rateest.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_RECENT) += xt_recent.o

diff --git a/net/netfilter/xt_quota2.c b/net/netfilter/xt_quota2.c
index 4857008f1eb048bf30cfe922ec61523d2a737ba9..454ce10c8cdc806e0d1393e21622af896c5c730e 100644 (file)
--- a/net/netfilter/xt_quota2.c
+++ b/net/netfilter/xt_quota2.c
@@ -18,8 +18,7 @@
 #include <asm/atomic.h>
 
 #include <linux/netfilter/x_tables.h>
-#include "xt_quota2.h"
-#include "compat_xtables.h"
+#include <linux/netfilter/xt_quota2.h>
 
 /**
  * @lock:      lock to protect quota writers from each other
@@ -91,7 +90,7 @@ q2_new_counter(const struct xt_quota_mtinfo2 *q, bool anon)
        if (!anon) {
                INIT_LIST_HEAD(&e->list);
                atomic_set(&e->ref, 1);
-               strncpy(e->name, q->name, sizeof(e->name));
+               strlcpy(e->name, q->name, sizeof(e->name));
        }
        return e;
 }
@@ -104,42 +103,56 @@ static struct xt_quota_counter *
 q2_get_counter(const struct xt_quota_mtinfo2 *q)
 {
        struct proc_dir_entry *p;
-       struct xt_quota_counter *e;
+       struct xt_quota_counter *e = NULL;
+       struct xt_quota_counter *new_e;
 
        if (*q->name == '\0')
                return q2_new_counter(q, true);
 
+       /* No need to hold a lock while getting a new counter */
+       new_e = q2_new_counter(q, false);
+       if (new_e == NULL)
+               goto out;
+
        spin_lock_bh(&counter_list_lock);
        list_for_each_entry(e, &counter_list, list)
                if (strcmp(e->name, q->name) == 0) {
                        atomic_inc(&e->ref);
                        spin_unlock_bh(&counter_list_lock);
+                       kfree(new_e);
+                       pr_debug("xt_quota2: old counter name=%s", e->name);
                        return e;
                }
+       e = new_e;
+       pr_debug("xt_quota2: new_counter name=%s", e->name);
+       list_add_tail(&e->list, &counter_list);
+       /* The entry having a refcount of 1 is not directly destructible.
+        * This func has not yet returned the new entry, thus iptables
+        * has not references for destroying this entry.
+        * For another rule to try to destroy it, it would 1st need for this
+        * func* to be re-invoked, acquire a new ref for the same named quota.
+        * Nobody will access the e->procfs_entry either.
+        * So release the lock. */
+       spin_unlock_bh(&counter_list_lock);
 
-       e = q2_new_counter(q, false);
-       if (e == NULL)
-               goto out;
-
+       /* create_proc_entry() is not spin_lock happy */
        p = e->procfs_entry = create_proc_entry(e->name, quota_list_perms,
                              proc_xt_quota);
-       if (p == NULL || IS_ERR(p))
-               goto out;
 
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 29)
-       p->owner        = THIS_MODULE;
-#endif
+       if (IS_ERR_OR_NULL(p)) {
+               spin_lock_bh(&counter_list_lock);
+               list_del(&e->list);
+               spin_unlock_bh(&counter_list_lock);
+               goto out;
+       }
        p->data         = e;
        p->read_proc    = quota_proc_read;
        p->write_proc   = quota_proc_write;
        p->uid          = quota_list_uid;
        p->gid          = quota_list_gid;
-       list_add_tail(&e->list, &counter_list);
-       spin_unlock_bh(&counter_list_lock);
        return e;
 
  out:
-       spin_unlock_bh(&counter_list_lock);
        kfree(e);
        return NULL;
 }
@@ -148,6 +161,8 @@ static int quota_mt2_check(const struct xt_mtchk_param *par)
 {
        struct xt_quota_mtinfo2 *q = par->matchinfo;
 
+       pr_debug("xt_quota2: check() flags=0x%04x", q->flags);
+
        if (q->flags & ~XT_QUOTA_MASK)
                return -EINVAL;
 
@@ -203,7 +218,6 @@ quota_mt2(const struct sk_buff *skb, struct xt_action_param *par)
                 */
                if (!(q->flags & XT_QUOTA_NO_CHANGE)) {
                        e->quota += (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;
-                       q->quota = e->quota;
                }
                ret = true;
        } else {
@@ -215,7 +229,6 @@ quota_mt2(const struct sk_buff *skb, struct xt_action_param *par)
                        /* we do not allow even small packets from now on */
                        e->quota = 0;
                }
-               q->quota = e->quota;
        }
        spin_unlock_bh(&e->lock);
        return ret;
@@ -228,7 +241,7 @@ static struct xt_match quota_mt2_reg[] __read_mostly = {
                .family     = NFPROTO_IPV4,
                .checkentry = quota_mt2_check,
                .match      = quota_mt2,
-               .destroy    = quota_mt2_destroy,  
+               .destroy    = quota_mt2_destroy,
                .matchsize  = sizeof(struct xt_quota_mtinfo2),
                .me         = THIS_MODULE,
        },
@@ -238,7 +251,7 @@ static struct xt_match quota_mt2_reg[] __read_mostly = {
                .family     = NFPROTO_IPV6,
                .checkentry = quota_mt2_check,
                .match      = quota_mt2,
-               .destroy    = quota_mt2_destroy,  
+               .destroy    = quota_mt2_destroy,
                .matchsize  = sizeof(struct xt_quota_mtinfo2),
                .me         = THIS_MODULE,
        },
@@ -247,21 +260,23 @@ static struct xt_match quota_mt2_reg[] __read_mostly = {
 static int __init quota_mt2_init(void)
 {
        int ret;
+       pr_debug("xt_quota2: init()");
 
-       proc_xt_quota = proc_mkdir("xt_quota", init_net__proc_net);
+       proc_xt_quota = proc_mkdir("xt_quota", init_net.proc_net);
        if (proc_xt_quota == NULL)
                return -EACCES;
 
        ret = xt_register_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
        if (ret < 0)
-               remove_proc_entry("xt_quota", init_net__proc_net);
+               remove_proc_entry("xt_quota", init_net.proc_net);
+       pr_debug("xt_quota2: init() %d", ret);
        return ret;
 }
 
 static void __exit quota_mt2_exit(void)
 {
        xt_unregister_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
-       remove_proc_entry("xt_quota", init_net__proc_net);
+       remove_proc_entry("xt_quota", init_net.proc_net);
 }
 
 module_init(quota_mt2_init);