github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-08 22:52:35 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

netfitler: fixup the quota2, and enable.

Browse Source 
The xt_quota2 came from
  http://sourceforge.net/projects/xtables-addons/develop

It needed tweaking for it to compile within the kernel tree.
Fixed kmalloc() and create_proc_entry() invocations within
 a non-interruptible context.
Removed useless copying of current quota back to the iptable's
struct matchinfo:
  - those are per CPU: they will change randomly based on which
    cpu gets to update the value.
  - they prevent matching a rule: e.g.
      -A chain -m quota2 --name q1 --quota 123
     can't be followed by
      -D chain -m quota2 --name q1 --quota 123
    as the 123 will be compared to the struct matchinfo's quota member.

Change-Id: I021d3b743db3b22158cc49acb5c94d905b501492
Signed-off-by: JP Abgrall <jpa@google.com>
This commit is contained in:
JP Abgrall 2011-07-12 12:02:59 -07:00
parent 511b7e3208
commit b4294d618e
3 changed files with 51 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
net/netfilter/Kconfig
View File

@ -963,6 +963,18 @@ config NETFILTER_XT_MATCH_QUOTA
If you want to compile it as a module, say M here and read
<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
config NETFILTER_XT_MATCH_QUOTA2
tristate '"quota2" match support'
depends on NETFILTER_ADVANCED
help
This option adds a `quota2' match, which allows to match on a
byte counter correctly and not per CPU.
It allows naming the quotas.
This is based on http://xtables-addons.git.sourceforge.net
If you want to compile it as a module, say M here and read
<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
config NETFILTER_XT_MATCH_RATEEST
tristate '"rateest" match support'
depends on NETFILTER_ADVANCED

1
net/netfilter/Makefile
View File

@ -97,6 +97,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o
obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o
obj-$(CONFIG_NETFILTER_XT_MATCH_QTAGUID) += xt_qtaguid.o
obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA) += xt_quota.o
obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA2) += xt_quota2.o
obj-$(CONFIG_NETFILTER_XT_MATCH_RATEEST) += xt_rateest.o
obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o
obj-$(CONFIG_NETFILTER_XT_MATCH_RECENT) += xt_recent.o

61
net/netfilter/xt_quota2.c
View File

@ -18,8 +18,7 @@
#include <asm/atomic.h>
#include <linux/netfilter/x_tables.h>
#include "xt_quota2.h"
#include "compat_xtables.h"
#include <linux/netfilter/xt_quota2.h>
/**
* @lock: lock to protect quota writers from each other
@ -91,7 +90,7 @@ q2_new_counter(const struct xt_quota_mtinfo2 *q, bool anon)
if (!anon) {
INIT_LIST_HEAD(&e->list);
atomic_set(&e->ref, 1);
strncpy(e->name, q->name, sizeof(e->name));
strlcpy(e->name, q->name, sizeof(e->name));
}
return e;
}
@ -104,42 +103,56 @@ static struct xt_quota_counter *
q2_get_counter(const struct xt_quota_mtinfo2 *q)
{
struct proc_dir_entry *p;
struct xt_quota_counter *e;
struct xt_quota_counter *e = NULL;
struct xt_quota_counter *new_e;
if (*q->name == '\0')
return q2_new_counter(q, true);
/* No need to hold a lock while getting a new counter */
new_e = q2_new_counter(q, false);
if (new_e == NULL)
goto out;
spin_lock_bh(&counter_list_lock);
list_for_each_entry(e, &counter_list, list)
if (strcmp(e->name, q->name) == 0) {
atomic_inc(&e->ref);
spin_unlock_bh(&counter_list_lock);
kfree(new_e);
pr_debug("xt_quota2: old counter name=%s", e->name);
return e;
}
e = new_e;
pr_debug("xt_quota2: new_counter name=%s", e->name);
list_add_tail(&e->list, &counter_list);
/* The entry having a refcount of 1 is not directly destructible.
* This func has not yet returned the new entry, thus iptables
* has not references for destroying this entry.
* For another rule to try to destroy it, it would 1st need for this
* func* to be re-invoked, acquire a new ref for the same named quota.
* Nobody will access the e->procfs_entry either.
* So release the lock. */
spin_unlock_bh(&counter_list_lock);
e = q2_new_counter(q, false);
if (e == NULL)
goto out;
/* create_proc_entry() is not spin_lock happy */
p = e->procfs_entry = create_proc_entry(e->name, quota_list_perms,
proc_xt_quota);
if (p == NULL || IS_ERR(p))
goto out;
#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 29)
p->owner = THIS_MODULE;
#endif
if (IS_ERR_OR_NULL(p)) {
spin_lock_bh(&counter_list_lock);
list_del(&e->list);
spin_unlock_bh(&counter_list_lock);
goto out;
}
p->data = e;
p->read_proc = quota_proc_read;
p->write_proc = quota_proc_write;
p->uid = quota_list_uid;
p->gid = quota_list_gid;
list_add_tail(&e->list, &counter_list);
spin_unlock_bh(&counter_list_lock);
return e;
out:
spin_unlock_bh(&counter_list_lock);
kfree(e);
return NULL;
}
@ -148,6 +161,8 @@ static int quota_mt2_check(const struct xt_mtchk_param *par)
{
struct xt_quota_mtinfo2 *q = par->matchinfo;
pr_debug("xt_quota2: check() flags=0x%04x", q->flags);
if (q->flags & ~XT_QUOTA_MASK)
return -EINVAL;
@ -203,7 +218,6 @@ quota_mt2(const struct sk_buff *skb, struct xt_action_param *par)
*/
if (!(q->flags & XT_QUOTA_NO_CHANGE)) {
e->quota += (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;
q->quota = e->quota;
}
ret = true;
} else {
@ -215,7 +229,6 @@ quota_mt2(const struct sk_buff *skb, struct xt_action_param *par)
/* we do not allow even small packets from now on */
e->quota = 0;
}
q->quota = e->quota;
}
spin_unlock_bh(&e->lock);
return ret;
@ -228,7 +241,7 @@ static struct xt_match quota_mt2_reg[] __read_mostly = {
.family = NFPROTO_IPV4,
.checkentry = quota_mt2_check,
.match = quota_mt2,
.destroy = quota_mt2_destroy,
.destroy = quota_mt2_destroy,
.matchsize = sizeof(struct xt_quota_mtinfo2),
.me = THIS_MODULE,
},
@ -238,7 +251,7 @@ static struct xt_match quota_mt2_reg[] __read_mostly = {
.family = NFPROTO_IPV6,
.checkentry = quota_mt2_check,
.match = quota_mt2,
.destroy = quota_mt2_destroy,
.destroy = quota_mt2_destroy,
.matchsize = sizeof(struct xt_quota_mtinfo2),
.me = THIS_MODULE,
},
@ -247,21 +260,23 @@ static struct xt_match quota_mt2_reg[] __read_mostly = {
static int __init quota_mt2_init(void)
{
int ret;
pr_debug("xt_quota2: init()");
proc_xt_quota = proc_mkdir("xt_quota", init_net__proc_net);
proc_xt_quota = proc_mkdir("xt_quota", init_net.proc_net);
if (proc_xt_quota == NULL)
return -EACCES;
ret = xt_register_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
if (ret < 0)
remove_proc_entry("xt_quota", init_net__proc_net);
remove_proc_entry("xt_quota", init_net.proc_net);
pr_debug("xt_quota2: init() %d", ret);
return ret;
}
static void __exit quota_mt2_exit(void)
{
xt_unregister_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
remove_proc_entry("xt_quota", init_net__proc_net);
remove_proc_entry("xt_quota", init_net.proc_net);
}
module_init(quota_mt2_init);