1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> 4 * 5 * Development of this code funded by Astaro AG (http://www.astaro.com/) 6 */ 7 8 #include <linux/kernel.h> 9 #include <linux/init.h> 10 #include <linux/module.h> 11 #include <linux/seqlock.h> 12 #include <linux/netlink.h> 13 #include <linux/netfilter.h> 14 #include <linux/netfilter/nf_tables.h> 15 #include <net/netfilter/nf_tables.h> 16 #include <net/netfilter/nf_tables_offload.h> 17 18 struct nft_counter { 19 s64 bytes; 20 s64 packets; 21 }; 22 23 struct nft_counter_percpu_priv { 24 struct nft_counter __percpu *counter; 25 }; 26 27 static DEFINE_PER_CPU(seqcount_t, nft_counter_seq); 28 29 static inline void nft_counter_do_eval(struct nft_counter_percpu_priv *priv, 30 struct nft_regs *regs, 31 const struct nft_pktinfo *pkt) 32 { 33 struct nft_counter *this_cpu; 34 seqcount_t *myseq; 35 36 local_bh_disable(); 37 this_cpu = this_cpu_ptr(priv->counter); 38 myseq = this_cpu_ptr(&nft_counter_seq); 39 40 write_seqcount_begin(myseq); 41 42 this_cpu->bytes += pkt->skb->len; 43 this_cpu->packets++; 44 45 write_seqcount_end(myseq); 46 local_bh_enable(); 47 } 48 49 static inline void nft_counter_obj_eval(struct nft_object *obj, 50 struct nft_regs *regs, 51 const struct nft_pktinfo *pkt) 52 { 53 struct nft_counter_percpu_priv *priv = nft_obj_data(obj); 54 55 nft_counter_do_eval(priv, regs, pkt); 56 } 57 58 static int nft_counter_do_init(const struct nlattr * const tb[], 59 struct nft_counter_percpu_priv *priv) 60 { 61 struct nft_counter __percpu *cpu_stats; 62 struct nft_counter *this_cpu; 63 64 cpu_stats = alloc_percpu(struct nft_counter); 65 if (cpu_stats == NULL) 66 return -ENOMEM; 67 68 preempt_disable(); 69 this_cpu = this_cpu_ptr(cpu_stats); 70 if (tb[NFTA_COUNTER_PACKETS]) { 71 this_cpu->packets = 72 be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS])); 73 } 74 if (tb[NFTA_COUNTER_BYTES]) { 75 this_cpu->bytes = 76 be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES])); 77 } 78 preempt_enable(); 79 priv->counter = cpu_stats; 80 return 0; 81 } 82 83 static int nft_counter_obj_init(const struct nft_ctx *ctx, 84 const struct nlattr * const tb[], 85 struct nft_object *obj) 86 { 87 struct nft_counter_percpu_priv *priv = nft_obj_data(obj); 88 89 return nft_counter_do_init(tb, priv); 90 } 91 92 static void nft_counter_do_destroy(struct nft_counter_percpu_priv *priv) 93 { 94 free_percpu(priv->counter); 95 } 96 97 static void nft_counter_obj_destroy(const struct nft_ctx *ctx, 98 struct nft_object *obj) 99 { 100 struct nft_counter_percpu_priv *priv = nft_obj_data(obj); 101 102 nft_counter_do_destroy(priv); 103 } 104 105 static void nft_counter_reset(struct nft_counter_percpu_priv *priv, 106 struct nft_counter *total) 107 { 108 struct nft_counter *this_cpu; 109 110 local_bh_disable(); 111 this_cpu = this_cpu_ptr(priv->counter); 112 this_cpu->packets -= total->packets; 113 this_cpu->bytes -= total->bytes; 114 local_bh_enable(); 115 } 116 117 static void nft_counter_fetch(struct nft_counter_percpu_priv *priv, 118 struct nft_counter *total) 119 { 120 struct nft_counter *this_cpu; 121 const seqcount_t *myseq; 122 u64 bytes, packets; 123 unsigned int seq; 124 int cpu; 125 126 memset(total, 0, sizeof(*total)); 127 for_each_possible_cpu(cpu) { 128 myseq = per_cpu_ptr(&nft_counter_seq, cpu); 129 this_cpu = per_cpu_ptr(priv->counter, cpu); 130 do { 131 seq = read_seqcount_begin(myseq); 132 bytes = this_cpu->bytes; 133 packets = this_cpu->packets; 134 } while (read_seqcount_retry(myseq, seq)); 135 136 total->bytes += bytes; 137 total->packets += packets; 138 } 139 } 140 141 static int nft_counter_do_dump(struct sk_buff *skb, 142 struct nft_counter_percpu_priv *priv, 143 bool reset) 144 { 145 struct nft_counter total; 146 147 nft_counter_fetch(priv, &total); 148 149 if (nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes), 150 NFTA_COUNTER_PAD) || 151 nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.packets), 152 NFTA_COUNTER_PAD)) 153 goto nla_put_failure; 154 155 if (reset) 156 nft_counter_reset(priv, &total); 157 158 return 0; 159 160 nla_put_failure: 161 return -1; 162 } 163 164 static int nft_counter_obj_dump(struct sk_buff *skb, 165 struct nft_object *obj, bool reset) 166 { 167 struct nft_counter_percpu_priv *priv = nft_obj_data(obj); 168 169 return nft_counter_do_dump(skb, priv, reset); 170 } 171 172 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = { 173 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 }, 174 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 }, 175 }; 176 177 static struct nft_object_type nft_counter_obj_type; 178 static const struct nft_object_ops nft_counter_obj_ops = { 179 .type = &nft_counter_obj_type, 180 .size = sizeof(struct nft_counter_percpu_priv), 181 .eval = nft_counter_obj_eval, 182 .init = nft_counter_obj_init, 183 .destroy = nft_counter_obj_destroy, 184 .dump = nft_counter_obj_dump, 185 }; 186 187 static struct nft_object_type nft_counter_obj_type __read_mostly = { 188 .type = NFT_OBJECT_COUNTER, 189 .ops = &nft_counter_obj_ops, 190 .maxattr = NFTA_COUNTER_MAX, 191 .policy = nft_counter_policy, 192 .owner = THIS_MODULE, 193 }; 194 195 static void nft_counter_eval(const struct nft_expr *expr, 196 struct nft_regs *regs, 197 const struct nft_pktinfo *pkt) 198 { 199 struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); 200 201 nft_counter_do_eval(priv, regs, pkt); 202 } 203 204 static int nft_counter_dump(struct sk_buff *skb, const struct nft_expr *expr) 205 { 206 struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); 207 208 return nft_counter_do_dump(skb, priv, false); 209 } 210 211 static int nft_counter_init(const struct nft_ctx *ctx, 212 const struct nft_expr *expr, 213 const struct nlattr * const tb[]) 214 { 215 struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); 216 217 return nft_counter_do_init(tb, priv); 218 } 219 220 static void nft_counter_destroy(const struct nft_ctx *ctx, 221 const struct nft_expr *expr) 222 { 223 struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); 224 225 nft_counter_do_destroy(priv); 226 } 227 228 static int nft_counter_clone(struct nft_expr *dst, const struct nft_expr *src) 229 { 230 struct nft_counter_percpu_priv *priv = nft_expr_priv(src); 231 struct nft_counter_percpu_priv *priv_clone = nft_expr_priv(dst); 232 struct nft_counter __percpu *cpu_stats; 233 struct nft_counter *this_cpu; 234 struct nft_counter total; 235 236 nft_counter_fetch(priv, &total); 237 238 cpu_stats = alloc_percpu_gfp(struct nft_counter, GFP_ATOMIC); 239 if (cpu_stats == NULL) 240 return -ENOMEM; 241 242 preempt_disable(); 243 this_cpu = this_cpu_ptr(cpu_stats); 244 this_cpu->packets = total.packets; 245 this_cpu->bytes = total.bytes; 246 preempt_enable(); 247 248 priv_clone->counter = cpu_stats; 249 return 0; 250 } 251 252 static int nft_counter_offload(struct nft_offload_ctx *ctx, 253 struct nft_flow_rule *flow, 254 const struct nft_expr *expr) 255 { 256 /* No specific offload action is needed, but report success. */ 257 return 0; 258 } 259 260 static void nft_counter_offload_stats(struct nft_expr *expr, 261 const struct flow_stats *stats) 262 { 263 struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); 264 struct nft_counter *this_cpu; 265 seqcount_t *myseq; 266 267 preempt_disable(); 268 this_cpu = this_cpu_ptr(priv->counter); 269 myseq = this_cpu_ptr(&nft_counter_seq); 270 271 write_seqcount_begin(myseq); 272 this_cpu->packets += stats->pkts; 273 this_cpu->bytes += stats->bytes; 274 write_seqcount_end(myseq); 275 preempt_enable(); 276 } 277 278 static struct nft_expr_type nft_counter_type; 279 static const struct nft_expr_ops nft_counter_ops = { 280 .type = &nft_counter_type, 281 .size = NFT_EXPR_SIZE(sizeof(struct nft_counter_percpu_priv)), 282 .eval = nft_counter_eval, 283 .init = nft_counter_init, 284 .destroy = nft_counter_destroy, 285 .destroy_clone = nft_counter_destroy, 286 .dump = nft_counter_dump, 287 .clone = nft_counter_clone, 288 .offload = nft_counter_offload, 289 .offload_stats = nft_counter_offload_stats, 290 }; 291 292 static struct nft_expr_type nft_counter_type __read_mostly = { 293 .name = "counter", 294 .ops = &nft_counter_ops, 295 .policy = nft_counter_policy, 296 .maxattr = NFTA_COUNTER_MAX, 297 .flags = NFT_EXPR_STATEFUL, 298 .owner = THIS_MODULE, 299 }; 300 301 static int __init nft_counter_module_init(void) 302 { 303 int cpu, err; 304 305 for_each_possible_cpu(cpu) 306 seqcount_init(per_cpu_ptr(&nft_counter_seq, cpu)); 307 308 err = nft_register_obj(&nft_counter_obj_type); 309 if (err < 0) 310 return err; 311 312 err = nft_register_expr(&nft_counter_type); 313 if (err < 0) 314 goto err1; 315 316 return 0; 317 err1: 318 nft_unregister_obj(&nft_counter_obj_type); 319 return err; 320 } 321 322 static void __exit nft_counter_module_exit(void) 323 { 324 nft_unregister_expr(&nft_counter_type); 325 nft_unregister_obj(&nft_counter_obj_type); 326 } 327 328 module_init(nft_counter_module_init); 329 module_exit(nft_counter_module_exit); 330 331 MODULE_LICENSE("GPL"); 332 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 333 MODULE_ALIAS_NFT_EXPR("counter"); 334 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_COUNTER); 335 MODULE_DESCRIPTION("nftables counter rule support"); 336