* version 2 of the License, as published by the Free Software Foundation.
*/
#include <linux/list.h>
+#include <linux/module.h>
#include <linux/proc_fs.h>
#include <linux/skbuff.h>
#include <linux/spinlock.h>
#include <asm/atomic.h>
+#include <net/netlink.h>
#include <linux/netfilter/x_tables.h>
-#include "xt_quota2.h"
-#include "compat_xtables.h"
+#include <linux/netfilter/xt_quota2.h>
+#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
+#include <linux/netfilter_ipv4/ipt_ULOG.h>
+#endif
/**
* @lock: lock to protect quota writers from each other
struct proc_dir_entry *procfs_entry;
};
+#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
+/* Harald's favorite number +1 :D From ipt_ULOG.C */
+static int qlog_nl_event = 112;
+module_param_named(event_num, qlog_nl_event, uint, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(event_num,
+ "Event number for NETLINK_NFLOG message. 0 disables log."
+ "111 is what ipt_ULOG uses.");
+static struct sock *nflognl;
+#endif
+
static LIST_HEAD(counter_list);
static DEFINE_SPINLOCK(counter_list_lock);
module_param_named(uid, quota_list_uid, uint, S_IRUGO | S_IWUSR);
module_param_named(gid, quota_list_gid, uint, S_IRUGO | S_IWUSR);
+
+#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
+static void quota2_log(unsigned int hooknum,
+ const struct sk_buff *skb,
+ const struct net_device *in,
+ const struct net_device *out,
+ const char *prefix)
+{
+ ulog_packet_msg_t *pm;
+ struct sk_buff *log_skb;
+ size_t size;
+ struct nlmsghdr *nlh;
+
+ if (!qlog_nl_event)
+ return;
+
+ size = NLMSG_SPACE(sizeof(*pm));
+ size = max(size, (size_t)NLMSG_GOODSIZE);
+ log_skb = alloc_skb(size, GFP_ATOMIC);
+ if (!log_skb) {
+ pr_err("xt_quota2: cannot alloc skb for logging\n");
+ return;
+ }
+
+ nlh = nlmsg_put(log_skb, /*pid*/0, /*seq*/0, qlog_nl_event,
+ sizeof(*pm), 0);
+ if (!nlh) {
+ pr_err("xt_quota2: nlmsg_put failed\n");
+ kfree_skb(log_skb);
+ return;
+ }
+ pm = nlmsg_data(nlh);
+ if (skb->tstamp.tv64 == 0)
+ __net_timestamp((struct sk_buff *)skb);
+ pm->data_len = 0;
+ pm->hook = hooknum;
+ if (prefix != NULL)
+ strlcpy(pm->prefix, prefix, sizeof(pm->prefix));
+ else
+ *(pm->prefix) = '\0';
+ if (in)
+ strlcpy(pm->indev_name, in->name, sizeof(pm->indev_name));
+ else
+ pm->indev_name[0] = '\0';
+
+ if (out)
+ strlcpy(pm->outdev_name, out->name, sizeof(pm->outdev_name));
+ else
+ pm->outdev_name[0] = '\0';
+
+ NETLINK_CB(log_skb).dst_group = 1;
+ pr_debug("throwing 1 packets to netlink group 1\n");
+ netlink_broadcast(nflognl, log_skb, 0, 1, GFP_ATOMIC);
+}
+#else
+static void quota2_log(unsigned int hooknum,
+ const struct sk_buff *skb,
+ const struct net_device *in,
+ const struct net_device *out,
+ const char *prefix)
+{
+}
+#endif /* if+else CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG */
+
static int quota_proc_read(char *page, char **start, off_t offset,
int count, int *eof, void *data)
{
if (!anon) {
INIT_LIST_HEAD(&e->list);
atomic_set(&e->ref, 1);
- strncpy(e->name, q->name, sizeof(e->name));
+ strlcpy(e->name, q->name, sizeof(e->name));
}
return e;
}
q2_get_counter(const struct xt_quota_mtinfo2 *q)
{
struct proc_dir_entry *p;
- struct xt_quota_counter *e;
+ struct xt_quota_counter *e = NULL;
+ struct xt_quota_counter *new_e;
if (*q->name == '\0')
return q2_new_counter(q, true);
+ /* No need to hold a lock while getting a new counter */
+ new_e = q2_new_counter(q, false);
+ if (new_e == NULL)
+ goto out;
+
spin_lock_bh(&counter_list_lock);
list_for_each_entry(e, &counter_list, list)
if (strcmp(e->name, q->name) == 0) {
atomic_inc(&e->ref);
spin_unlock_bh(&counter_list_lock);
+ kfree(new_e);
+ pr_debug("xt_quota2: old counter name=%s", e->name);
return e;
}
+ e = new_e;
+ pr_debug("xt_quota2: new_counter name=%s", e->name);
+ list_add_tail(&e->list, &counter_list);
+ /* The entry having a refcount of 1 is not directly destructible.
+ * This func has not yet returned the new entry, thus iptables
+ * has not references for destroying this entry.
+ * For another rule to try to destroy it, it would 1st need for this
+ * func* to be re-invoked, acquire a new ref for the same named quota.
+ * Nobody will access the e->procfs_entry either.
+ * So release the lock. */
+ spin_unlock_bh(&counter_list_lock);
- e = q2_new_counter(q, false);
- if (e == NULL)
- goto out;
-
+ /* create_proc_entry() is not spin_lock happy */
p = e->procfs_entry = create_proc_entry(e->name, quota_list_perms,
proc_xt_quota);
- if (p == NULL || IS_ERR(p))
- goto out;
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 29)
- p->owner = THIS_MODULE;
-#endif
+ if (IS_ERR_OR_NULL(p)) {
+ spin_lock_bh(&counter_list_lock);
+ list_del(&e->list);
+ spin_unlock_bh(&counter_list_lock);
+ goto out;
+ }
p->data = e;
p->read_proc = quota_proc_read;
p->write_proc = quota_proc_write;
p->uid = quota_list_uid;
p->gid = quota_list_gid;
- list_add_tail(&e->list, &counter_list);
- spin_unlock_bh(&counter_list_lock);
return e;
out:
- spin_unlock_bh(&counter_list_lock);
kfree(e);
return NULL;
}
{
struct xt_quota_mtinfo2 *q = par->matchinfo;
+ pr_debug("xt_quota2: check() flags=0x%04x", q->flags);
+
if (q->flags & ~XT_QUOTA_MASK)
return -EINVAL;
*/
if (!(q->flags & XT_QUOTA_NO_CHANGE)) {
e->quota += (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;
- q->quota = e->quota;
}
ret = true;
} else {
e->quota -= (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;
ret = !ret;
} else {
+ /* We are transitioning, log that fact. */
+ if (e->quota) {
+ quota2_log(par->hooknum,
+ skb,
+ par->in,
+ par->out,
+ q->name);
+ }
/* we do not allow even small packets from now on */
e->quota = 0;
}
- q->quota = e->quota;
}
spin_unlock_bh(&e->lock);
return ret;
.family = NFPROTO_IPV4,
.checkentry = quota_mt2_check,
.match = quota_mt2,
- .destroy = quota_mt2_destroy,
+ .destroy = quota_mt2_destroy,
.matchsize = sizeof(struct xt_quota_mtinfo2),
.me = THIS_MODULE,
},
.family = NFPROTO_IPV6,
.checkentry = quota_mt2_check,
.match = quota_mt2,
- .destroy = quota_mt2_destroy,
+ .destroy = quota_mt2_destroy,
.matchsize = sizeof(struct xt_quota_mtinfo2),
.me = THIS_MODULE,
},
static int __init quota_mt2_init(void)
{
int ret;
+ pr_debug("xt_quota2: init()");
+
+#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG
+ nflognl = netlink_kernel_create(&init_net, NETLINK_NFLOG, NULL);
+ if (!nflognl)
+ return -ENOMEM;
+#endif
- proc_xt_quota = proc_mkdir("xt_quota", init_net__proc_net);
+ proc_xt_quota = proc_mkdir("xt_quota", init_net.proc_net);
if (proc_xt_quota == NULL)
return -EACCES;
ret = xt_register_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
if (ret < 0)
- remove_proc_entry("xt_quota", init_net__proc_net);
+ remove_proc_entry("xt_quota", init_net.proc_net);
+ pr_debug("xt_quota2: init() %d", ret);
return ret;
}
static void __exit quota_mt2_exit(void)
{
xt_unregister_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
- remove_proc_entry("xt_quota", init_net__proc_net);
+ remove_proc_entry("xt_quota", init_net.proc_net);
}
module_init(quota_mt2_init);
projects / firefly-linux-kernel-4.4.55.git / commitdiff