net/netfilter/nft_counter.c

   1 /*
   2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
   9  */
  10
  11 #include <linux/kernel.h>
  12 #include <linux/init.h>
  13 #include <linux/module.h>
  14 #include <linux/seqlock.h>
  15 #include <linux/netlink.h>
  16 #include <linux/netfilter.h>
  17 #include <linux/netfilter/nf_tables.h>
  18 #include <net/netfilter/nf_tables.h>
  19
  20 struct nft_counter {
  21         u64             bytes;
  22         u64             packets;
  23 };
  24
  25 struct nft_counter_percpu {
  26         struct nft_counter      counter;
  27         struct u64_stats_sync   syncp;
  28 };
  29
  30 struct nft_counter_percpu_priv {
  31         struct nft_counter_percpu __percpu *counter;
  32 };
  33
  34 static inline void nft_counter_do_eval(struct nft_counter_percpu_priv *priv,
  35                                        struct nft_regs *regs,
  36                                        const struct nft_pktinfo *pkt)
  37 {
  38         struct nft_counter_percpu *this_cpu;
  39
  40         local_bh_disable();
  41         this_cpu = this_cpu_ptr(priv->counter);
  42         u64_stats_update_begin(&this_cpu->syncp);
  43         this_cpu->counter.bytes += pkt->skb->len;
  44         this_cpu->counter.packets++;
  45         u64_stats_update_end(&this_cpu->syncp);
  46         local_bh_enable();
  47 }
  48
  49 static inline void nft_counter_obj_eval(struct nft_object *obj,
  50                                         struct nft_regs *regs,
  51                                         const struct nft_pktinfo *pkt)
  52 {
  53         struct nft_counter_percpu_priv *priv = nft_obj_data(obj);
  54
  55         nft_counter_do_eval(priv, regs, pkt);
  56 }
  57
  58 static int nft_counter_do_init(const struct nlattr * const tb[],
  59                                struct nft_counter_percpu_priv *priv)
  60 {
  61         struct nft_counter_percpu __percpu *cpu_stats;
  62         struct nft_counter_percpu *this_cpu;
  63
  64         cpu_stats = netdev_alloc_pcpu_stats(struct nft_counter_percpu);
  65         if (cpu_stats == NULL)
  66                 return -ENOMEM;
  67
  68         preempt_disable();
  69         this_cpu = this_cpu_ptr(cpu_stats);
  70         if (tb[NFTA_COUNTER_PACKETS]) {
  71                 this_cpu->counter.packets =
  72                         be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
  73         }
  74         if (tb[NFTA_COUNTER_BYTES]) {
  75                 this_cpu->counter.bytes =
  76                         be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
  77         }
  78         preempt_enable();
  79         priv->counter = cpu_stats;
  80         return 0;
  81 }
  82
  83 static int nft_counter_obj_init(const struct nlattr * const tb[],
  84                                 struct nft_object *obj)
  85 {
  86         struct nft_counter_percpu_priv *priv = nft_obj_data(obj);
  87
  88         return nft_counter_do_init(tb, priv);
  89 }
  90
  91 static void nft_counter_do_destroy(struct nft_counter_percpu_priv *priv)
  92 {
  93         free_percpu(priv->counter);
  94 }
  95
  96 static void nft_counter_obj_destroy(struct nft_object *obj)
  97 {
  98         struct nft_counter_percpu_priv *priv = nft_obj_data(obj);
  99
 100         nft_counter_do_destroy(priv);
 101 }
 102
 103 static void nft_counter_fetch(struct nft_counter_percpu __percpu *counter,
 104                               struct nft_counter *total)
 105 {
 106         struct nft_counter_percpu *cpu_stats;
 107         u64 bytes, packets;
 108         unsigned int seq;
 109         int cpu;
 110
 111         memset(total, 0, sizeof(*total));
 112         for_each_possible_cpu(cpu) {
 113                 cpu_stats = per_cpu_ptr(counter, cpu);
 114                 do {
 115                         seq     = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
 116                         bytes   = cpu_stats->counter.bytes;
 117                         packets = cpu_stats->counter.packets;
 118                 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
 119
 120                 total->packets += packets;
 121                 total->bytes += bytes;
 122         }
 123 }
 124
 125 static u64 __nft_counter_reset(u64 *counter)
 126 {
 127         u64 ret, old;
 128
 129         do {
 130                 old = *counter;
 131                 ret = cmpxchg64(counter, old, 0);
 132         } while (ret != old);
 133
 134         return ret;
 135 }
 136
 137 static void nft_counter_reset(struct nft_counter_percpu __percpu *counter,
 138                               struct nft_counter *total)
 139 {
 140         struct nft_counter_percpu *cpu_stats;
 141         u64 bytes, packets;
 142         unsigned int seq;
 143         int cpu;
 144
 145         memset(total, 0, sizeof(*total));
 146         for_each_possible_cpu(cpu) {
 147                 bytes = packets = 0;
 148
 149                 cpu_stats = per_cpu_ptr(counter, cpu);
 150                 do {
 151                         seq     = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
 152                         packets += __nft_counter_reset(&cpu_stats->counter.packets);
 153                         bytes   += __nft_counter_reset(&cpu_stats->counter.bytes);
 154                 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
 155
 156                 total->packets += packets;
 157                 total->bytes += bytes;
 158         }
 159 }
 160
 161 static int nft_counter_do_dump(struct sk_buff *skb,
 162                                const struct nft_counter_percpu_priv *priv,
 163                                bool reset)
 164 {
 165         struct nft_counter total;
 166
 167         if (reset)
 168                 nft_counter_reset(priv->counter, &total);
 169         else
 170                 nft_counter_fetch(priv->counter, &total);
 171
 172         if (nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
 173                          NFTA_COUNTER_PAD) ||
 174             nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.packets),
 175                          NFTA_COUNTER_PAD))
 176                 goto nla_put_failure;
 177         return 0;
 178
 179 nla_put_failure:
 180         return -1;
 181 }
 182
 183 static int nft_counter_obj_dump(struct sk_buff *skb,
 184                                 struct nft_object *obj, bool reset)
 185 {
 186         struct nft_counter_percpu_priv *priv = nft_obj_data(obj);
 187
 188         return nft_counter_do_dump(skb, priv, reset);
 189 }
 190
 191 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
 192         [NFTA_COUNTER_PACKETS]  = { .type = NLA_U64 },
 193         [NFTA_COUNTER_BYTES]    = { .type = NLA_U64 },
 194 };
 195
 196 static struct nft_object_type nft_counter_obj __read_mostly = {
 197         .type           = NFT_OBJECT_COUNTER,
 198         .size           = sizeof(struct nft_counter_percpu_priv),
 199         .maxattr        = NFTA_COUNTER_MAX,
 200         .policy         = nft_counter_policy,
 201         .eval           = nft_counter_obj_eval,
 202         .init           = nft_counter_obj_init,
 203         .destroy        = nft_counter_obj_destroy,
 204         .dump           = nft_counter_obj_dump,
 205         .owner          = THIS_MODULE,
 206 };
 207
 208 static void nft_counter_eval(const struct nft_expr *expr,
 209                              struct nft_regs *regs,
 210                              const struct nft_pktinfo *pkt)
 211 {
 212         struct nft_counter_percpu_priv *priv = nft_expr_priv(expr);
 213
 214         nft_counter_do_eval(priv, regs, pkt);
 215 }
 216
 217 static int nft_counter_dump(struct sk_buff *skb, const struct nft_expr *expr)
 218 {
 219         const struct nft_counter_percpu_priv *priv = nft_expr_priv(expr);
 220
 221         return nft_counter_do_dump(skb, priv, false);
 222 }
 223
 224 static int nft_counter_init(const struct nft_ctx *ctx,
 225                             const struct nft_expr *expr,
 226                             const struct nlattr * const tb[])
 227 {
 228         struct nft_counter_percpu_priv *priv = nft_expr_priv(expr);
 229
 230         return nft_counter_do_init(tb, priv);
 231 }
 232
 233 static void nft_counter_destroy(const struct nft_ctx *ctx,
 234                                 const struct nft_expr *expr)
 235 {
 236         struct nft_counter_percpu_priv *priv = nft_expr_priv(expr);
 237
 238         nft_counter_do_destroy(priv);
 239 }
 240
 241 static int nft_counter_clone(struct nft_expr *dst, const struct nft_expr *src)
 242 {
 243         struct nft_counter_percpu_priv *priv = nft_expr_priv(src);
 244         struct nft_counter_percpu_priv *priv_clone = nft_expr_priv(dst);
 245         struct nft_counter_percpu __percpu *cpu_stats;
 246         struct nft_counter_percpu *this_cpu;
 247         struct nft_counter total;
 248
 249         nft_counter_fetch(priv->counter, &total);
 250
 251         cpu_stats = __netdev_alloc_pcpu_stats(struct nft_counter_percpu,
 252                                               GFP_ATOMIC);
 253         if (cpu_stats == NULL)
 254                 return -ENOMEM;
 255
 256         preempt_disable();
 257         this_cpu = this_cpu_ptr(cpu_stats);
 258         this_cpu->counter.packets = total.packets;
 259         this_cpu->counter.bytes = total.bytes;
 260         preempt_enable();
 261
 262         priv_clone->counter = cpu_stats;
 263         return 0;
 264 }
 265
 266 static struct nft_expr_type nft_counter_type;
 267 static const struct nft_expr_ops nft_counter_ops = {
 268         .type           = &nft_counter_type,
 269         .size           = NFT_EXPR_SIZE(sizeof(struct nft_counter_percpu_priv)),
 270         .eval           = nft_counter_eval,
 271         .init           = nft_counter_init,
 272         .destroy        = nft_counter_destroy,
 273         .dump           = nft_counter_dump,
 274         .clone          = nft_counter_clone,
 275 };
 276
 277 static struct nft_expr_type nft_counter_type __read_mostly = {
 278         .name           = "counter",
 279         .ops            = &nft_counter_ops,
 280         .policy         = nft_counter_policy,
 281         .maxattr        = NFTA_COUNTER_MAX,
 282         .flags          = NFT_EXPR_STATEFUL,
 283         .owner          = THIS_MODULE,
 284 };
 285
 286 static int __init nft_counter_module_init(void)
 287 {
 288         int err;
 289
 290         err = nft_register_obj(&nft_counter_obj);
 291         if (err < 0)
 292                 return err;
 293
 294         err = nft_register_expr(&nft_counter_type);
 295         if (err < 0)
 296                 goto err1;
 297
 298         return 0;
 299 err1:
 300         nft_unregister_obj(&nft_counter_obj);
 301         return err;
 302 }
 303
 304 static void __exit nft_counter_module_exit(void)
 305 {
 306         nft_unregister_expr(&nft_counter_type);
 307         nft_unregister_obj(&nft_counter_obj);
 308 }
 309
 310 module_init(nft_counter_module_init);
 311 module_exit(nft_counter_module_exit);
 312
 313 MODULE_LICENSE("GPL");
 314 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 315 MODULE_ALIAS_NFT_EXPR("counter");
 316 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_COUNTER);