Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3fd8238e authored by JP Abgrall's avatar JP Abgrall Committed by Amit Pundir
Browse files

netfilter: fixup the quota2, and enable. 

The xt_quota2 came from
  http://sourceforge.net/projects/xtables-addons/develop



It needed tweaking for it to compile within the kernel tree.
Fixed kmalloc() and create_proc_entry() invocations within
 a non-interruptible context.
Removed useless copying of current quota back to the iptable's
struct matchinfo:
  - those are per CPU: they will change randomly based on which
    cpu gets to update the value.
  - they prevent matching a rule: e.g.
      -A chain -m quota2 --name q1 --quota 123
     can't be followed by
      -D chain -m quota2 --name q1 --quota 123
    as the 123 will be compared to the struct matchinfo's quota member.
Use the NETLINK NETLINK_NFLOG family to log a single message
when the quota limit is reached.
It uses the same packet type as ipt_ULOG, but
 - never copies skb data,
 - uses 112 as the event number (ULOG's +1)
It doesn't log if the module param "event_num" is 0.

Change-Id: I021d3b743db3b22158cc49acb5c94d905b501492
Signed-off-by: default avatarJP Abgrall <jpa@google.com>
parent dc5ce6e3

net/netfilter/Kconfig

+24 −0
Original line number Diff line number Diff line
@@ -1359,6 +1359,30 @@ config NETFILTER_XT_MATCH_QUOTA 
	  If you want to compile it as a module, say M here and read

	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.



config NETFILTER_XT_MATCH_QUOTA2

	tristate '"quota2" match support'

	depends on NETFILTER_ADVANCED

	help

	  This option adds a `quota2' match, which allows to match on a

	  byte counter correctly and not per CPU.

	  It allows naming the quotas.

	  This is based on http://xtables-addons.git.sourceforge.net



	  If you want to compile it as a module, say M here and read

	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.



config NETFILTER_XT_MATCH_QUOTA2_LOG

	bool '"quota2" Netfilter LOG support'

	depends on NETFILTER_XT_MATCH_QUOTA2

	depends on IP_NF_TARGET_ULOG=n    # not yes, not module, just no

	default n

	help

	  This option allows `quota2' to log ONCE when a quota limit

	  is passed. It logs via NETLINK using the NETLINK_NFLOG family.

	  It logs similarly to how ipt_ULOG would without data.



	  If unsure, say `N'.



config NETFILTER_XT_MATCH_RATEEST

	tristate '"rateest" match support'

	depends on NETFILTER_ADVANCED

net/netfilter/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -165,6 +165,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o 
obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o

obj-$(CONFIG_NETFILTER_XT_MATCH_QTAGUID) += xt_qtaguid_print.o xt_qtaguid.o

obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA) += xt_quota.o

obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA2) += xt_quota2.o

obj-$(CONFIG_NETFILTER_XT_MATCH_RATEEST) += xt_rateest.o

obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o

obj-$(CONFIG_NETFILTER_XT_MATCH_RECENT) += xt_recent.o

net/netfilter/xt_quota2.c

+131 −23
Original line number Diff line number Diff line
@@ -12,14 +12,18 @@ 
 *	version 2 of the License, as published by the Free Software Foundation.

 */

#include <linux/list.h>

#include <linux/module.h>

#include <linux/proc_fs.h>

#include <linux/skbuff.h>

#include <linux/spinlock.h>

#include <asm/atomic.h>

#include <net/netlink.h>



#include <linux/netfilter/x_tables.h>

#include "xt_quota2.h"

#include "compat_xtables.h"

#include <linux/netfilter/xt_quota2.h>

#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG

#include <linux/netfilter_ipv4/ipt_ULOG.h>

#endif



/**

 * @lock:	lock to protect quota writers from each other
@@ -33,6 +37,16 @@ struct xt_quota_counter { 
	struct proc_dir_entry *procfs_entry;

};



#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG

/* Harald's favorite number +1 :D From ipt_ULOG.C */

static int qlog_nl_event = 112;

module_param_named(event_num, qlog_nl_event, uint, S_IRUGO | S_IWUSR);

MODULE_PARM_DESC(event_num,

		 "Event number for NETLINK_NFLOG message. 0 disables log."

		 "111 is what ipt_ULOG uses.");

static struct sock *nflognl;

#endif



static LIST_HEAD(counter_list);

static DEFINE_SPINLOCK(counter_list_lock);
@@ -44,6 +58,70 @@ module_param_named(perms, quota_list_perms, uint, S_IRUGO | S_IWUSR); 
module_param_named(uid, quota_list_uid, uint, S_IRUGO | S_IWUSR);

module_param_named(gid, quota_list_gid, uint, S_IRUGO | S_IWUSR);





#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG

static void quota2_log(unsigned int hooknum,

		       const struct sk_buff *skb,

		       const struct net_device *in,

		       const struct net_device *out,

		       const char *prefix)

{

	ulog_packet_msg_t *pm;

	struct sk_buff *log_skb;

	size_t size;

	struct nlmsghdr *nlh;



	if (!qlog_nl_event)

		return;



	size = NLMSG_SPACE(sizeof(*pm));

	size = max(size, (size_t)NLMSG_GOODSIZE);

	log_skb = alloc_skb(size, GFP_ATOMIC);

	if (!log_skb) {

		pr_err("xt_quota2: cannot alloc skb for logging\n");

		return;

	}



	nlh = nlmsg_put(log_skb, /*pid*/0, /*seq*/0, qlog_nl_event,

			sizeof(*pm), 0);

	if (!nlh) {

		pr_err("xt_quota2: nlmsg_put failed\n");

		kfree_skb(log_skb);

		return;

	}

	pm = nlmsg_data(nlh);

	if (skb->tstamp.tv64 == 0)

		__net_timestamp((struct sk_buff *)skb);

	pm->data_len = 0;

	pm->hook = hooknum;

	if (prefix != NULL)

		strlcpy(pm->prefix, prefix, sizeof(pm->prefix));

	else

		*(pm->prefix) = '\0';

	if (in)

		strlcpy(pm->indev_name, in->name, sizeof(pm->indev_name));

	else

		pm->indev_name[0] = '\0';



	if (out)

		strlcpy(pm->outdev_name, out->name, sizeof(pm->outdev_name));

	else

		pm->outdev_name[0] = '\0';



	NETLINK_CB(log_skb).dst_group = 1;

	pr_debug("throwing 1 packets to netlink group 1\n");

	netlink_broadcast(nflognl, log_skb, 0, 1, GFP_ATOMIC);

}

#else

static void quota2_log(unsigned int hooknum,

		       const struct sk_buff *skb,

		       const struct net_device *in,

		       const struct net_device *out,

		       const char *prefix)

{

}

#endif  /* if+else CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG */



static int quota_proc_read(char *page, char **start, off_t offset,

                           int count, int *eof, void *data)

{
@@ -91,7 +169,7 @@ q2_new_counter(const struct xt_quota_mtinfo2 *q, bool anon) 
	if (!anon) {

		INIT_LIST_HEAD(&e->list);

		atomic_set(&e->ref, 1);

		strncpy(e->name, q->name, sizeof(e->name));

		strlcpy(e->name, q->name, sizeof(e->name));

	}

	return e;

}
@@ -104,42 +182,56 @@ static struct xt_quota_counter * 
q2_get_counter(const struct xt_quota_mtinfo2 *q)

{

	struct proc_dir_entry *p;

	struct xt_quota_counter *e;

	struct xt_quota_counter *e = NULL;

	struct xt_quota_counter *new_e;



	if (*q->name == '\0')

		return q2_new_counter(q, true);



	/* No need to hold a lock while getting a new counter */

	new_e = q2_new_counter(q, false);

	if (new_e == NULL)

		goto out;



	spin_lock_bh(&counter_list_lock);

	list_for_each_entry(e, &counter_list, list)

		if (strcmp(e->name, q->name) == 0) {

			atomic_inc(&e->ref);

			spin_unlock_bh(&counter_list_lock);

			kfree(new_e);

			pr_debug("xt_quota2: old counter name=%s", e->name);

			return e;

		}

	e = new_e;

	pr_debug("xt_quota2: new_counter name=%s", e->name);

	list_add_tail(&e->list, &counter_list);

	/* The entry having a refcount of 1 is not directly destructible.

	 * This func has not yet returned the new entry, thus iptables

	 * has not references for destroying this entry.

	 * For another rule to try to destroy it, it would 1st need for this

	 * func* to be re-invoked, acquire a new ref for the same named quota.

	 * Nobody will access the e->procfs_entry either.

	 * So release the lock. */

	spin_unlock_bh(&counter_list_lock);



	e = q2_new_counter(q, false);

	if (e == NULL)

		goto out;



	/* create_proc_entry() is not spin_lock happy */

	p = e->procfs_entry = create_proc_entry(e->name, quota_list_perms,

	                      proc_xt_quota);

	if (p == NULL || IS_ERR(p))

		goto out;



#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 29)

	p->owner        = THIS_MODULE;

#endif

	if (IS_ERR_OR_NULL(p)) {

		spin_lock_bh(&counter_list_lock);

		list_del(&e->list);

		spin_unlock_bh(&counter_list_lock);

		goto out;

	}

	p->data         = e;

	p->read_proc    = quota_proc_read;

	p->write_proc   = quota_proc_write;

	p->uid          = quota_list_uid;

	p->gid          = quota_list_gid;

	list_add_tail(&e->list, &counter_list);

	spin_unlock_bh(&counter_list_lock);

	return e;



 out:

	spin_unlock_bh(&counter_list_lock);

	kfree(e);

	return NULL;

}
@@ -148,6 +240,8 @@ static int quota_mt2_check(const struct xt_mtchk_param *par) 
{

	struct xt_quota_mtinfo2 *q = par->matchinfo;



	pr_debug("xt_quota2: check() flags=0x%04x", q->flags);



	if (q->flags & ~XT_QUOTA_MASK)

		return -EINVAL;
@@ -203,7 +297,6 @@ quota_mt2(const struct sk_buff *skb, struct xt_action_param *par) 
		 */

		if (!(q->flags & XT_QUOTA_NO_CHANGE)) {

			e->quota += (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;

			q->quota = e->quota;

		}

		ret = true;

	} else {
@@ -212,10 +305,17 @@ quota_mt2(const struct sk_buff *skb, struct xt_action_param *par) 
				e->quota -= (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;

			ret = !ret;

		} else {

			/* We are transitioning, log that fact. */

			if (e->quota) {

				quota2_log(par->hooknum,

					   skb,

					   par->in,

					   par->out,

					   q->name);

			}

			/* we do not allow even small packets from now on */

			e->quota = 0;

		}

		q->quota = e->quota;

	}

	spin_unlock_bh(&e->lock);

	return ret;
@@ -247,21 +347,29 @@ static struct xt_match quota_mt2_reg[] __read_mostly = { 
static int __init quota_mt2_init(void)

{

	int ret;

	pr_debug("xt_quota2: init()");



#ifdef CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG

	nflognl = netlink_kernel_create(&init_net, NETLINK_NFLOG, NULL);

	if (!nflognl)

		return -ENOMEM;

#endif



	proc_xt_quota = proc_mkdir("xt_quota", init_net__proc_net);

	proc_xt_quota = proc_mkdir("xt_quota", init_net.proc_net);

	if (proc_xt_quota == NULL)

		return -EACCES;



	ret = xt_register_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));

	if (ret < 0)

		remove_proc_entry("xt_quota", init_net__proc_net);

		remove_proc_entry("xt_quota", init_net.proc_net);

	pr_debug("xt_quota2: init() %d", ret);

	return ret;

}



static void __exit quota_mt2_exit(void)

{

	xt_unregister_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));

	remove_proc_entry("xt_quota", init_net__proc_net);

	remove_proc_entry("xt_quota", init_net.proc_net);

}



module_init(quota_mt2_init);