nft_quota.c

  1// SPDX-License-Identifier: GPL-2.0-only
  2/*
  3 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
  4 */
  5
  6#include <linux/kernel.h>
  7#include <linux/init.h>
  8#include <linux/module.h>
  9#include <linux/atomic.h>
 10#include <linux/netlink.h>
 11#include <linux/netfilter.h>
 12#include <linux/netfilter/nf_tables.h>
 13#include <net/netfilter/nf_tables.h>
 14
 15struct nft_quota {
 16	atomic64_t	quota;
 17	unsigned long	flags;
 18	atomic64_t	*consumed;
 19};
 20
 21static inline bool nft_overquota(struct nft_quota *priv,
 22				 const struct sk_buff *skb,
 23				 bool *report)
 24{
 25	u64 consumed = atomic64_add_return(skb->len, priv->consumed);
 26	u64 quota = atomic64_read(&priv->quota);
 27
 28	if (report)
 29		*report = consumed >= quota;
 30
 31	return consumed > quota;
 32}
 33
 34static inline bool nft_quota_invert(struct nft_quota *priv)
 35{
 36	return priv->flags & NFT_QUOTA_F_INV;
 37}
 38
 39static inline void nft_quota_do_eval(struct nft_quota *priv,
 40				     struct nft_regs *regs,
 41				     const struct nft_pktinfo *pkt)
 42{
 43	if (nft_overquota(priv, pkt->skb, NULL) ^ nft_quota_invert(priv))
 44		regs->verdict.code = NFT_BREAK;
 45}
 46
 47static const struct nla_policy nft_quota_policy[NFTA_QUOTA_MAX + 1] = {
 48	[NFTA_QUOTA_BYTES]	= { .type = NLA_U64 },
 49	[NFTA_QUOTA_FLAGS]	= { .type = NLA_U32 },
 50	[NFTA_QUOTA_CONSUMED]	= { .type = NLA_U64 },
 51};
 52
 53#define NFT_QUOTA_DEPLETED_BIT	1	/* From NFT_QUOTA_F_DEPLETED. */
 54
 55static void nft_quota_obj_eval(struct nft_object *obj,
 56			       struct nft_regs *regs,
 57			       const struct nft_pktinfo *pkt)
 58{
 59	struct nft_quota *priv = nft_obj_data(obj);
 60	bool overquota, report;
 61
 62	overquota = nft_overquota(priv, pkt->skb, &report);
 63	if (overquota ^ nft_quota_invert(priv))
 64		regs->verdict.code = NFT_BREAK;
 65
 66	if (report &&
 67	    !test_and_set_bit(NFT_QUOTA_DEPLETED_BIT, &priv->flags))
 68		nft_obj_notify(nft_net(pkt), obj->key.table, obj, 0, 0,
 69			       NFT_MSG_NEWOBJ, 0, nft_pf(pkt), 0, GFP_ATOMIC);
 70}
 71
 72static int nft_quota_do_init(const struct nlattr * const tb[],
 73			     struct nft_quota *priv)
 74{
 75	unsigned long flags = 0;
 76	u64 quota, consumed = 0;
 77
 78	if (!tb[NFTA_QUOTA_BYTES])
 79		return -EINVAL;
 80
 81	quota = be64_to_cpu(nla_get_be64(tb[NFTA_QUOTA_BYTES]));
 82	if (quota > S64_MAX)
 83		return -EOVERFLOW;
 84
 85	if (tb[NFTA_QUOTA_CONSUMED]) {
 86		consumed = be64_to_cpu(nla_get_be64(tb[NFTA_QUOTA_CONSUMED]));
 87		if (consumed > quota)
 88			return -EINVAL;
 89	}
 90
 91	if (tb[NFTA_QUOTA_FLAGS]) {
 92		flags = ntohl(nla_get_be32(tb[NFTA_QUOTA_FLAGS]));
 93		if (flags & ~NFT_QUOTA_F_INV)
 94			return -EINVAL;
 95		if (flags & NFT_QUOTA_F_DEPLETED)
 96			return -EOPNOTSUPP;
 97	}
 98
 99	priv->consumed = kmalloc(sizeof(*priv->consumed), GFP_KERNEL_ACCOUNT);
100	if (!priv->consumed)
101		return -ENOMEM;
102
103	atomic64_set(&priv->quota, quota);
104	priv->flags = flags;
105	atomic64_set(priv->consumed, consumed);
106
107	return 0;
108}
109
110static void nft_quota_do_destroy(const struct nft_ctx *ctx,
111				 struct nft_quota *priv)
112{
113	kfree(priv->consumed);
114}
115
116static int nft_quota_obj_init(const struct nft_ctx *ctx,
117			      const struct nlattr * const tb[],
118			      struct nft_object *obj)
119{
120	struct nft_quota *priv = nft_obj_data(obj);
121
122	return nft_quota_do_init(tb, priv);
123}
124
125static void nft_quota_obj_update(struct nft_object *obj,
126				 struct nft_object *newobj)
127{
128	struct nft_quota *newpriv = nft_obj_data(newobj);
129	struct nft_quota *priv = nft_obj_data(obj);
130	u64 newquota;
131
132	newquota = atomic64_read(&newpriv->quota);
133	atomic64_set(&priv->quota, newquota);
134	priv->flags = newpriv->flags;
135}
136
137static int nft_quota_do_dump(struct sk_buff *skb, struct nft_quota *priv,
138			     bool reset)
139{
140	u64 consumed, consumed_cap, quota;
141	u32 flags = priv->flags;
142
143	/* Since we unconditionally increment consumed quota for each packet
144	 * that we see, don't go over the quota boundary in what we send to
145	 * userspace.
146	 */
147	if (reset) {
148		consumed = atomic64_xchg(priv->consumed, 0);
149		clear_bit(NFT_QUOTA_DEPLETED_BIT, &priv->flags);
150	} else {
151		consumed = atomic64_read(priv->consumed);
152	}
153	quota = atomic64_read(&priv->quota);
154	if (consumed >= quota) {
155		consumed_cap = quota;
156		flags |= NFT_QUOTA_F_DEPLETED;
157	} else {
158		consumed_cap = consumed;
159	}
160
161	if (nla_put_be64(skb, NFTA_QUOTA_BYTES, cpu_to_be64(quota),
162			 NFTA_QUOTA_PAD) ||
163	    nla_put_be64(skb, NFTA_QUOTA_CONSUMED, cpu_to_be64(consumed_cap),
164			 NFTA_QUOTA_PAD) ||
165	    nla_put_be32(skb, NFTA_QUOTA_FLAGS, htonl(flags)))
166		goto nla_put_failure;
167
168	return 0;
169
170nla_put_failure:
171	return -1;
172}
173
174static int nft_quota_obj_dump(struct sk_buff *skb, struct nft_object *obj,
175			      bool reset)
176{
177	struct nft_quota *priv = nft_obj_data(obj);
178
179	return nft_quota_do_dump(skb, priv, reset);
180}
181
182static void nft_quota_obj_destroy(const struct nft_ctx *ctx,
183				  struct nft_object *obj)
184{
185	struct nft_quota *priv = nft_obj_data(obj);
186
187	return nft_quota_do_destroy(ctx, priv);
188}
189
190static struct nft_object_type nft_quota_obj_type;
191static const struct nft_object_ops nft_quota_obj_ops = {
192	.type		= &nft_quota_obj_type,
193	.size		= sizeof(struct nft_quota),
194	.init		= nft_quota_obj_init,
195	.destroy	= nft_quota_obj_destroy,
196	.eval		= nft_quota_obj_eval,
197	.dump		= nft_quota_obj_dump,
198	.update		= nft_quota_obj_update,
199};
200
201static struct nft_object_type nft_quota_obj_type __read_mostly = {
202	.type		= NFT_OBJECT_QUOTA,
203	.ops		= &nft_quota_obj_ops,
204	.maxattr	= NFTA_QUOTA_MAX,
205	.policy		= nft_quota_policy,
206	.owner		= THIS_MODULE,
207};
208
209static void nft_quota_eval(const struct nft_expr *expr,
210			   struct nft_regs *regs,
211			   const struct nft_pktinfo *pkt)
212{
213	struct nft_quota *priv = nft_expr_priv(expr);
214
215	nft_quota_do_eval(priv, regs, pkt);
216}
217
218static int nft_quota_init(const struct nft_ctx *ctx,
219			  const struct nft_expr *expr,
220			  const struct nlattr * const tb[])
221{
222	struct nft_quota *priv = nft_expr_priv(expr);
223
224	return nft_quota_do_init(tb, priv);
225}
226
227static int nft_quota_dump(struct sk_buff *skb,
228			  const struct nft_expr *expr, bool reset)
229{
230	struct nft_quota *priv = nft_expr_priv(expr);
231
232	return nft_quota_do_dump(skb, priv, reset);
233}
234
235static void nft_quota_destroy(const struct nft_ctx *ctx,
236			      const struct nft_expr *expr)
237{
238	struct nft_quota *priv = nft_expr_priv(expr);
239
240	return nft_quota_do_destroy(ctx, priv);
241}
242
243static int nft_quota_clone(struct nft_expr *dst, const struct nft_expr *src, gfp_t gfp)
244{
245	struct nft_quota *priv_dst = nft_expr_priv(dst);
246	struct nft_quota *priv_src = nft_expr_priv(src);
247
248	priv_dst->quota = priv_src->quota;
249	priv_dst->flags = priv_src->flags;
250
251	priv_dst->consumed = kmalloc(sizeof(*priv_dst->consumed), gfp);
252	if (!priv_dst->consumed)
253		return -ENOMEM;
254
255	*priv_dst->consumed = *priv_src->consumed;
256
257	return 0;
258}
259
260static struct nft_expr_type nft_quota_type;
261static const struct nft_expr_ops nft_quota_ops = {
262	.type		= &nft_quota_type,
263	.size		= NFT_EXPR_SIZE(sizeof(struct nft_quota)),
264	.eval		= nft_quota_eval,
265	.init		= nft_quota_init,
266	.destroy	= nft_quota_destroy,
267	.clone		= nft_quota_clone,
268	.dump		= nft_quota_dump,
269	.reduce		= NFT_REDUCE_READONLY,
270};
271
272static struct nft_expr_type nft_quota_type __read_mostly = {
273	.name		= "quota",
274	.ops		= &nft_quota_ops,
275	.policy		= nft_quota_policy,
276	.maxattr	= NFTA_QUOTA_MAX,
277	.flags		= NFT_EXPR_STATEFUL,
278	.owner		= THIS_MODULE,
279};
280
281static int __init nft_quota_module_init(void)
282{
283	int err;
284
285	err = nft_register_obj(&nft_quota_obj_type);
286	if (err < 0)
287		return err;
288
289	err = nft_register_expr(&nft_quota_type);
290	if (err < 0)
291		goto err1;
292
293	return 0;
294err1:
295	nft_unregister_obj(&nft_quota_obj_type);
296	return err;
297}
298
299static void __exit nft_quota_module_exit(void)
300{
301	nft_unregister_expr(&nft_quota_type);
302	nft_unregister_obj(&nft_quota_obj_type);
303}
304
305module_init(nft_quota_module_init);
306module_exit(nft_quota_module_exit);
307
308MODULE_LICENSE("GPL");
309MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
310MODULE_ALIAS_NFT_EXPR("quota");
311MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_QUOTA);
312MODULE_DESCRIPTION("Netfilter nftables quota module");