[linux-block.git] / net / netfilter / nft_quota.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/atomic.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>

struct nft_quota {
	atomic64_t	quota;
	unsigned long	flags;
	atomic64_t	consumed;
};

static inline bool nft_overquota(struct nft_quota *priv,
				 const struct sk_buff *skb)
{
	return atomic64_add_return(skb->len, &priv->consumed) >=
	       atomic64_read(&priv->quota);
}

static inline bool nft_quota_invert(struct nft_quota *priv)
{
	return priv->flags & NFT_QUOTA_F_INV;
}

static inline void nft_quota_do_eval(struct nft_quota *priv,
				     struct nft_regs *regs,
				     const struct nft_pktinfo *pkt)
{
	if (nft_overquota(priv, pkt->skb) ^ nft_quota_invert(priv))
		regs->verdict.code = NFT_BREAK;
}

static const struct nla_policy nft_quota_policy[NFTA_QUOTA_MAX + 1] = {
	[NFTA_QUOTA_BYTES]	= { .type = NLA_U64 },
	[NFTA_QUOTA_FLAGS]	= { .type = NLA_U32 },
	[NFTA_QUOTA_CONSUMED]	= { .type = NLA_U64 },
};

#define NFT_QUOTA_DEPLETED_BIT	1	/* From NFT_QUOTA_F_DEPLETED. */

static void nft_quota_obj_eval(struct nft_object *obj,
			       struct nft_regs *regs,
			       const struct nft_pktinfo *pkt)
{
	struct nft_quota *priv = nft_obj_data(obj);
	bool overquota;

	overquota = nft_overquota(priv, pkt->skb);
	if (overquota ^ nft_quota_invert(priv))
		regs->verdict.code = NFT_BREAK;

	if (overquota &&
	    !test_and_set_bit(NFT_QUOTA_DEPLETED_BIT, &priv->flags))
		nft_obj_notify(nft_net(pkt), obj->key.table, obj, 0, 0,
			       NFT_MSG_NEWOBJ, nft_pf(pkt), 0, GFP_ATOMIC);
}

static int nft_quota_do_init(const struct nlattr * const tb[],
			     struct nft_quota *priv)
{
	unsigned long flags = 0;
	u64 quota, consumed = 0;

	if (!tb[NFTA_QUOTA_BYTES])
		return -EINVAL;

	quota = be64_to_cpu(nla_get_be64(tb[NFTA_QUOTA_BYTES]));
	if (quota > S64_MAX)
		return -EOVERFLOW;

	if (tb[NFTA_QUOTA_CONSUMED]) {
		consumed = be64_to_cpu(nla_get_be64(tb[NFTA_QUOTA_CONSUMED]));
		if (consumed > quota)
			return -EINVAL;
	}

	if (tb[NFTA_QUOTA_FLAGS]) {
		flags = ntohl(nla_get_be32(tb[NFTA_QUOTA_FLAGS]));
		if (flags & ~NFT_QUOTA_F_INV)
			return -EINVAL;
		if (flags & NFT_QUOTA_F_DEPLETED)
			return -EOPNOTSUPP;
	}

	atomic64_set(&priv->quota, quota);
	priv->flags = flags;
	atomic64_set(&priv->consumed, consumed);

	return 0;
}

static int nft_quota_obj_init(const struct nft_ctx *ctx,
			      const struct nlattr * const tb[],
			      struct nft_object *obj)
{
	struct nft_quota *priv = nft_obj_data(obj);

	return nft_quota_do_init(tb, priv);
}

static void nft_quota_obj_update(struct nft_object *obj,
				 struct nft_object *newobj)
{
	struct nft_quota *newpriv = nft_obj_data(newobj);
	struct nft_quota *priv = nft_obj_data(obj);
	u64 newquota;

	newquota = atomic64_read(&newpriv->quota);
	atomic64_set(&priv->quota, newquota);
	priv->flags = newpriv->flags;
}

static int nft_quota_do_dump(struct sk_buff *skb, struct nft_quota *priv,
			     bool reset)
{
	u64 consumed, consumed_cap, quota;
	u32 flags = priv->flags;

	/* Since we inconditionally increment consumed quota for each packet
	 * that we see, don't go over the quota boundary in what we send to
	 * userspace.
	 */
	consumed = atomic64_read(&priv->consumed);
	quota = atomic64_read(&priv->quota);
	if (consumed >= quota) {
		consumed_cap = quota;
		flags |= NFT_QUOTA_F_DEPLETED;
	} else {
		consumed_cap = consumed;
	}

	if (nla_put_be64(skb, NFTA_QUOTA_BYTES, cpu_to_be64(quota),
			 NFTA_QUOTA_PAD) ||
	    nla_put_be64(skb, NFTA_QUOTA_CONSUMED, cpu_to_be64(consumed_cap),
			 NFTA_QUOTA_PAD) ||
	    nla_put_be32(skb, NFTA_QUOTA_FLAGS, htonl(flags)))
		goto nla_put_failure;

	if (reset) {
		atomic64_sub(consumed, &priv->consumed);
		clear_bit(NFT_QUOTA_DEPLETED_BIT, &priv->flags);
	}
	return 0;

nla_put_failure:
	return -1;
}

static int nft_quota_obj_dump(struct sk_buff *skb, struct nft_object *obj,
			      bool reset)
{
	struct nft_quota *priv = nft_obj_data(obj);

	return nft_quota_do_dump(skb, priv, reset);
}

static struct nft_object_type nft_quota_obj_type;
static const struct nft_object_ops nft_quota_obj_ops = {
	.type		= &nft_quota_obj_type,
	.size		= sizeof(struct nft_quota),
	.init		= nft_quota_obj_init,
	.eval		= nft_quota_obj_eval,
	.dump		= nft_quota_obj_dump,
	.update		= nft_quota_obj_update,
};

static struct nft_object_type nft_quota_obj_type __read_mostly = {
	.type		= NFT_OBJECT_QUOTA,
	.ops		= &nft_quota_obj_ops,
	.maxattr	= NFTA_QUOTA_MAX,
	.policy		= nft_quota_policy,
	.owner		= THIS_MODULE,
};

static void nft_quota_eval(const struct nft_expr *expr,
			   struct nft_regs *regs,
			   const struct nft_pktinfo *pkt)
{
	struct nft_quota *priv = nft_expr_priv(expr);

	nft_quota_do_eval(priv, regs, pkt);
}

static int nft_quota_init(const struct nft_ctx *ctx,
			  const struct nft_expr *expr,
			  const struct nlattr * const tb[])
{
	struct nft_quota *priv = nft_expr_priv(expr);

	return nft_quota_do_init(tb, priv);
}

static int nft_quota_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	struct nft_quota *priv = nft_expr_priv(expr);

	return nft_quota_do_dump(skb, priv, false);
}

static struct nft_expr_type nft_quota_type;
static const struct nft_expr_ops nft_quota_ops = {
	.type		= &nft_quota_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_quota)),
	.eval		= nft_quota_eval,
	.init		= nft_quota_init,
	.dump		= nft_quota_dump,
};

static struct nft_expr_type nft_quota_type __read_mostly = {
	.name		= "quota",
	.ops		= &nft_quota_ops,
	.policy		= nft_quota_policy,
	.maxattr	= NFTA_QUOTA_MAX,
	.flags		= NFT_EXPR_STATEFUL,
	.owner		= THIS_MODULE,
};

static int __init nft_quota_module_init(void)
{
	int err;

	err = nft_register_obj(&nft_quota_obj_type);
	if (err < 0)
		return err;

	err = nft_register_expr(&nft_quota_type);
	if (err < 0)
		goto err1;

	return 0;
err1:
	nft_unregister_obj(&nft_quota_obj_type);
	return err;
}

static void __exit nft_quota_module_exit(void)
{
	nft_unregister_expr(&nft_quota_type);
	nft_unregister_obj(&nft_quota_obj_type);
}

module_init(nft_quota_module_init);
module_exit(nft_quota_module_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
MODULE_ALIAS_NFT_EXPR("quota");
MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_QUOTA);
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
3d2f30a1 PNA	2	/*
3d2f30a1 PNA	3	* Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
3d2f30a1 PNA	4	*/
	5
	6	#include <linux/kernel.h>
	7	#include <linux/init.h>
	8	#include <linux/module.h>
	9	#include <linux/atomic.h>
	10	#include <linux/netlink.h>
	11	#include <linux/netfilter.h>
	12	#include <linux/netfilter/nf_tables.h>
	13	#include <net/netfilter/nf_tables.h>
	14
	15	struct nft_quota {
85936e56	16	atomic64_t quota;
18965317	17	unsigned long flags;
795595f6	18	atomic64_t consumed;
3d2f30a1 PNA	19	};
3d2f30a1 PNA	20
22609b43	21	static inline bool nft_overquota(struct nft_quota *priv,
795595f6	22	const struct sk_buff *skb)
3d2f30a1	23	{
85936e56 FFM	24	return atomic64_add_return(skb->len, &priv->consumed) >=
85936e56 FFM	25	atomic64_read(&priv->quota);
3d2f30a1 PNA	26	}
3d2f30a1 PNA	27
18965317 PNA	28	static inline bool nft_quota_invert(struct nft_quota *priv)
	29	{
	30	return priv->flags & NFT_QUOTA_F_INV;
	31	}
	32
173705d9 PNA	33	static inline void nft_quota_do_eval(struct nft_quota *priv,
	34	struct nft_regs *regs,
	35	const struct nft_pktinfo *pkt)
3d2f30a1	36	{
18965317	37	if (nft_overquota(priv, pkt->skb) ^ nft_quota_invert(priv))
3d2f30a1 PNA	38	regs->verdict.code = NFT_BREAK;
	39	}
	40
	41	static const struct nla_policy nft_quota_policy[NFTA_QUOTA_MAX + 1] = {
	42	[NFTA_QUOTA_BYTES] = { .type = NLA_U64 },
	43	[NFTA_QUOTA_FLAGS] = { .type = NLA_U32 },
73c25fb1	44	[NFTA_QUOTA_CONSUMED] = { .type = NLA_U64 },
3d2f30a1 PNA	45	};
3d2f30a1 PNA	46
18965317 PNA	47	#define NFT_QUOTA_DEPLETED_BIT 1 /* From NFT_QUOTA_F_DEPLETED. */
18965317 PNA	48
173705d9 PNA	49	static void nft_quota_obj_eval(struct nft_object *obj,
	50	struct nft_regs *regs,
	51	const struct nft_pktinfo *pkt)
	52	{
	53	struct nft_quota *priv = nft_obj_data(obj);
18965317	54	bool overquota;
173705d9	55
18965317 PNA	56	overquota = nft_overquota(priv, pkt->skb);
	57	if (overquota ^ nft_quota_invert(priv))
	58	regs->verdict.code = NFT_BREAK;
	59
	60	if (overquota &&
	61	!test_and_set_bit(NFT_QUOTA_DEPLETED_BIT, &priv->flags))
d152159b	62	nft_obj_notify(nft_net(pkt), obj->key.table, obj, 0, 0,
18965317	63	NFT_MSG_NEWOBJ, nft_pf(pkt), 0, GFP_ATOMIC);
173705d9 PNA	64	}
	65
	66	static int nft_quota_do_init(const struct nlattr * const tb[],
	67	struct nft_quota *priv)
3d2f30a1	68	{
18965317	69	unsigned long flags = 0;
73c25fb1	70	u64 quota, consumed = 0;
3d2f30a1 PNA	71
	72	if (!tb[NFTA_QUOTA_BYTES])
	73	return -EINVAL;
	74
	75	quota = be64_to_cpu(nla_get_be64(tb[NFTA_QUOTA_BYTES]));
	76	if (quota > S64_MAX)
	77	return -EOVERFLOW;
	78
73c25fb1 PNA	79	if (tb[NFTA_QUOTA_CONSUMED]) {
	80	consumed = be64_to_cpu(nla_get_be64(tb[NFTA_QUOTA_CONSUMED]));
	81	if (consumed > quota)
	82	return -EINVAL;
	83	}
	84
3d2f30a1 PNA	85	if (tb[NFTA_QUOTA_FLAGS]) {
	86	flags = ntohl(nla_get_be32(tb[NFTA_QUOTA_FLAGS]));
	87	if (flags & ~NFT_QUOTA_F_INV)
	88	return -EINVAL;
18965317 PNA	89	if (flags & NFT_QUOTA_F_DEPLETED)
18965317 PNA	90	return -EOPNOTSUPP;
3d2f30a1 PNA	91	}
3d2f30a1 PNA	92
85936e56	93	atomic64_set(&priv->quota, quota);
18965317	94	priv->flags = flags;
73c25fb1	95	atomic64_set(&priv->consumed, consumed);
3d2f30a1 PNA	96
	97	return 0;
	98	}
	99
84fba055 FW	100	static int nft_quota_obj_init(const struct nft_ctx *ctx,
84fba055 FW	101	const struct nlattr * const tb[],
173705d9 PNA	102	struct nft_object *obj)
	103	{
	104	struct nft_quota *priv = nft_obj_data(obj);
	105
	106	return nft_quota_do_init(tb, priv);
	107	}
	108
85936e56 FFM	109	static void nft_quota_obj_update(struct nft_object *obj,
	110	struct nft_object *newobj)
	111	{
	112	struct nft_quota *newpriv = nft_obj_data(newobj);
	113	struct nft_quota *priv = nft_obj_data(obj);
	114	u64 newquota;
	115
	116	newquota = atomic64_read(&newpriv->quota);
	117	atomic64_set(&priv->quota, newquota);
	118	priv->flags = newpriv->flags;
	119	}
	120
43da04a5 PNA	121	static int nft_quota_do_dump(struct sk_buff skb, struct nft_quota priv,
43da04a5 PNA	122	bool reset)
3d2f30a1	123	{
85936e56	124	u64 consumed, consumed_cap, quota;
18965317	125	u32 flags = priv->flags;
43da04a5	126
795595f6 PNA	127	/* Since we inconditionally increment consumed quota for each packet
	128	* that we see, don't go over the quota boundary in what we send to
	129	* userspace.
	130	*/
8010d7fe	131	consumed = atomic64_read(&priv->consumed);
85936e56 FFM	132	quota = atomic64_read(&priv->quota);
	133	if (consumed >= quota) {
	134	consumed_cap = quota;
8010d7fe PNA	135	flags \|= NFT_QUOTA_F_DEPLETED;
	136	} else {
	137	consumed_cap = consumed;
	138	}
3d2f30a1	139
85936e56	140	if (nla_put_be64(skb, NFTA_QUOTA_BYTES, cpu_to_be64(quota),
3d2f30a1	141	NFTA_QUOTA_PAD) \|\|
8010d7fe	142	nla_put_be64(skb, NFTA_QUOTA_CONSUMED, cpu_to_be64(consumed_cap),
795595f6	143	NFTA_QUOTA_PAD) \|\|
3d2f30a1 PNA	144	nla_put_be32(skb, NFTA_QUOTA_FLAGS, htonl(flags)))
3d2f30a1 PNA	145	goto nla_put_failure;
8010d7fe PNA	146
	147	if (reset) {
	148	atomic64_sub(consumed, &priv->consumed);
	149	clear_bit(NFT_QUOTA_DEPLETED_BIT, &priv->flags);
	150	}
3d2f30a1 PNA	151	return 0;
	152
	153	nla_put_failure:
	154	return -1;
	155	}
	156
43da04a5 PNA	157	static int nft_quota_obj_dump(struct sk_buff skb, struct nft_object obj,
43da04a5 PNA	158	bool reset)
173705d9 PNA	159	{
	160	struct nft_quota *priv = nft_obj_data(obj);
	161
43da04a5	162	return nft_quota_do_dump(skb, priv, reset);
173705d9 PNA	163	}
173705d9 PNA	164
dfc46034 PBG	165	static struct nft_object_type nft_quota_obj_type;
	166	static const struct nft_object_ops nft_quota_obj_ops = {
	167	.type = &nft_quota_obj_type,
173705d9	168	.size = sizeof(struct nft_quota),
173705d9 PNA	169	.init = nft_quota_obj_init,
	170	.eval = nft_quota_obj_eval,
	171	.dump = nft_quota_obj_dump,
85936e56	172	.update = nft_quota_obj_update,
dfc46034 PBG	173	};
	174
	175	static struct nft_object_type nft_quota_obj_type __read_mostly = {
	176	.type = NFT_OBJECT_QUOTA,
	177	.ops = &nft_quota_obj_ops,
	178	.maxattr = NFTA_QUOTA_MAX,
	179	.policy = nft_quota_policy,
173705d9 PNA	180	.owner = THIS_MODULE,
	181	};
	182
	183	static void nft_quota_eval(const struct nft_expr *expr,
	184	struct nft_regs *regs,
	185	const struct nft_pktinfo *pkt)
	186	{
	187	struct nft_quota *priv = nft_expr_priv(expr);
	188
	189	nft_quota_do_eval(priv, regs, pkt);
	190	}
	191
	192	static int nft_quota_init(const struct nft_ctx *ctx,
	193	const struct nft_expr *expr,
	194	const struct nlattr * const tb[])
	195	{
	196	struct nft_quota *priv = nft_expr_priv(expr);
	197
	198	return nft_quota_do_init(tb, priv);
	199	}
	200
	201	static int nft_quota_dump(struct sk_buff skb, const struct nft_expr expr)
	202	{
43da04a5	203	struct nft_quota *priv = nft_expr_priv(expr);
173705d9	204
43da04a5	205	return nft_quota_do_dump(skb, priv, false);
173705d9 PNA	206	}
173705d9 PNA	207
3d2f30a1 PNA	208	static struct nft_expr_type nft_quota_type;
	209	static const struct nft_expr_ops nft_quota_ops = {
	210	.type = &nft_quota_type,
	211	.size = NFT_EXPR_SIZE(sizeof(struct nft_quota)),
	212	.eval = nft_quota_eval,
	213	.init = nft_quota_init,
	214	.dump = nft_quota_dump,
	215	};
	216
	217	static struct nft_expr_type nft_quota_type __read_mostly = {
	218	.name = "quota",
	219	.ops = &nft_quota_ops,
	220	.policy = nft_quota_policy,
	221	.maxattr = NFTA_QUOTA_MAX,
	222	.flags = NFT_EXPR_STATEFUL,
	223	.owner = THIS_MODULE,
	224	};
	225
	226	static int __init nft_quota_module_init(void)
	227	{
173705d9 PNA	228	int err;
173705d9 PNA	229
dfc46034	230	err = nft_register_obj(&nft_quota_obj_type);
173705d9 PNA	231	if (err < 0)
	232	return err;
	233
	234	err = nft_register_expr(&nft_quota_type);
	235	if (err < 0)
	236	goto err1;
	237
	238	return 0;
	239	err1:
dfc46034	240	nft_unregister_obj(&nft_quota_obj_type);
173705d9	241	return err;
3d2f30a1 PNA	242	}
	243
	244	static void __exit nft_quota_module_exit(void)
	245	{
173705d9	246	nft_unregister_expr(&nft_quota_type);
dfc46034	247	nft_unregister_obj(&nft_quota_obj_type);
3d2f30a1 PNA	248	}
	249
	250	module_init(nft_quota_module_init);
	251	module_exit(nft_quota_module_exit);
	252
	253	MODULE_LICENSE("GPL");
	254	MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
	255	MODULE_ALIAS_NFT_EXPR("quota");
173705d9	256	MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_QUOTA);