iptables: (tomj) implemented code for userspace communication

diff --git a/linux/include/linux/netfilter_ipv4/ipt_ACCOUNT.h b/linux/include/linux/netfilter_ipv4/ipt_ACCOUNT.h
index d0976dc..3d59241 100644 (file)
--- a/linux/include/linux/netfilter_ipv4/ipt_ACCOUNT.h
+++ b/linux/include/linux/netfilter_ipv4/ipt_ACCOUNT.h
@@ -19,19 +19,27 @@ struct ipt_account_table
     char name[ACCOUNT_TABLE_NAME_LEN];        /* name of the table */
     unsigned int ip;                          /* base IP of network */
     unsigned int netmask;                     /* netmask of the network */
-    unsigned char depth;                      /* Size of network: 0: 8 bit, 1: 16bit, 2: 24 bit */
+    unsigned char depth;                      /* size of network: 0: 8 bit, 1: 16bit, 2: 24 bit */
     unsigned int refcount;                    /* refcount of this table. if zero, destroy it */
     unsigned int itemcount;                   /* number of IPs in this table */
     void *data;                               /* pointer to the actual data, depending on netmask */
 };
 
-/* Handle structure for communication with the userspace library */
+/* Internal handle structure */
 struct ipt_account_handle
 {
-    unsigned int ip;                          /* base IP of network */
-    unsigned char netmask;                    /* netmask of the network */
+    unsigned int ip;                          /* base IP of network. Used for caculating the final IP during get_data() */
+    unsigned char depth;                      /* size of network. See above for details */
     unsigned int itemcount;                   /* number of IPs in this table */
-    void *data;                               /* pointer to the actual data, depending on netmask */
+    void *data;                               /* pointer to the actual data, depending on size */
+};
+
+/* Handle structure for communication with the userspace library */
+struct ipt_account_handle_sockopt
+{
+    unsigned int handle_nr;                   /* Used for HANDLE_FREE */
+    char name[ACCOUNT_TABLE_NAME_LEN];        /* Used for HANDLE_PREPARE_READ/READ_FLUSH */
+    unsigned int itemcount;                   /* Used for HANDLE_PREPARE_READ/READ_FLUSH */
 };
 
 /* Used for every IP entry */

diff --git a/linux/net/ipv4/netfilter/ipt_ACCOUNT.c b/linux/net/ipv4/netfilter/ipt_ACCOUNT.c
index b9addf2..0497fd7 100644 (file)
--- a/linux/net/ipv4/netfilter/ipt_ACCOUNT.c
+++ b/linux/net/ipv4/netfilter/ipt_ACCOUNT.c
@@ -97,7 +97,7 @@ int ipt_account_table_insert(char *name, unsigned int ip, unsigned int netmask)
     // Look for existing table
     for (i = 0; i < ACCOUNT_MAX_TABLES; i++)
     {
-        if (strcmp(ipt_account_tables[i].name, name) == 0)
+        if (strncmp(ipt_account_tables[i].name, name, ACCOUNT_TABLE_NAME_LEN) == 0)
         {
             DEBUGP("ACCOUNT: Found existing slot: %d - %u.%u.%u.%u/%u.%u.%u.%u\n", i,
                    NIPQUAD(ipt_account_tables[i].ip), NIPQUAD(ipt_account_tables[i].netmask));
@@ -215,7 +215,7 @@ void ipt_account_deleteentry(void *targinfo, unsigned int targinfosize)
     // Look for table
     for (i = 0; i < ACCOUNT_MAX_TABLES; i++)
     {
-        if (strcmp(ipt_account_tables[i].name, info->table_name) == 0)
+        if (strncmp(ipt_account_tables[i].name, info->table_name, ACCOUNT_TABLE_NAME_LEN) == 0)
         {
             DEBUGP("ACCOUNT: Found table at slot: %d\n", i);
             
@@ -430,27 +430,486 @@ static unsigned int ipt_account_target(struct sk_buff **pskb,
     return IPT_CONTINUE;
 }
 
+/*
+    Functions dealing with "handles":
+    Handles are snapshots of a accounting state.
+    
+    read snapshots are only for debugging the code
+    and are very expensive concerning speed/memory
+    compared to read_and_flush.
+    
+    The functions aren't protected by spinlocks themselves
+    as this is done in the ioctl part of the code.
+*/
+
+/*
+    Find a free handle slot. Normally only one should be used,
+    but there could be two or more applications accessing the data
+    at the same time.
+*/
+int ipt_account_handle_find_slot(void)
+{
+    unsigned int i;
+    // Insert new table
+    for (i = 0; i < ACCOUNT_MAX_HANDLES; i++)
+    {
+        // Found free slot
+        if (ipt_account_handles[i].data == NULL)
+        {
+            // Don't "mark" data as used as we are protected by a spinlock by the calling function.
+            // handle_find_slot() is only a function to prevent code duplication.
+            return i;
+        }
+    }
+        
+    // No free slot found
+    printk("ACCOUNT: No free handle slot found (max: %u). Please increase ACCOUNT_MAX_HANDLES.\n", ACCOUNT_MAX_HANDLES);
+    return -1;
+}
+
+int ipt_account_handle_free(unsigned int handle)
+{
+    if (handle >= ACCOUNT_MAX_HANDLES)
+    {
+        printk("ACCOUNT: Invalid handle for ipt_account_handle_free() specified: %u\n", handle);
+        return -EINVAL;
+    }
+    
+    ipt_account_data_free(ipt_account_handles[handle].data, ipt_account_handles[handle].depth);
+    memset (&ipt_account_handles[handle], 0, sizeof (struct ipt_account_handle));
+    return 0;
+}
+
+/* Prepare data for read without flush. Use only for debugging!
+   Real applications should use read&flush as it's way more efficent */
+int ipt_account_handle_prepare_read(char *tablename, unsigned int *count)
+{
+    int handle, i, table_nr=-1;
+    
+    for (i = 0; i < ACCOUNT_MAX_TABLES; i++)
+        if (strncmp(ipt_account_tables[i].name, tablename, ACCOUNT_TABLE_NAME_LEN) == 0)
+        {
+            table_nr = i;
+            break;
+        }
+
+    if (table_nr == -1)
+    {
+        printk("ACCOUNT: ipt_account_handle_prepare_read(): Table %s not found\n", tablename);
+        return -1;
+    }
+            
+    // Can't find a free handle slot?
+    if ((handle = ipt_account_handle_find_slot()) == -1)
+        return -1;
+    
+    // Fill up handle structure
+    ipt_account_handles[handle].ip = ipt_account_tables[table_nr].ip;
+    ipt_account_handles[handle].depth = ipt_account_tables[table_nr].depth;
+    ipt_account_handles[handle].itemcount = ipt_account_tables[table_nr].itemcount;
+    
+    // allocate "root" table
+    if (!(ipt_account_handles[handle].data = (void*)get_zeroed_page(GFP_KERNEL)))
+    {
+        printk("ACCOUNT: out of memory for root table in ipt_account_handle_prepare_read()\n");
+        memset (&ipt_account_handles[handle], 0, sizeof(struct ipt_account_handle));
+        return -1;        
+    }
+    
+    // Recursive copy of complete data structure
+    unsigned int depth = ipt_account_handles[handle].depth;
+    if (depth == 0)
+    {
+        memcpy(ipt_account_handles[handle].data, ipt_account_tables[table_nr].data, sizeof(struct ipt_account_mask_24));
+    } else if (depth == 1) {
+        struct ipt_account_mask_16 *src_16 = (struct ipt_account_mask_16 *)ipt_account_tables[table_nr].data;
+        struct ipt_account_mask_16 *network_16 = (struct ipt_account_mask_16 *)ipt_account_handles[handle].data;
+        unsigned char b;
+        
+        for (b = 0; b < 255; b++)
+        {
+            if (src_16->mask_24[b])
+            {
+                if (!(network_16->mask_24[b] = (void*)get_zeroed_page(GFP_KERNEL)))
+                {
+                    printk("ACCOUNT: out of memory during copy of 16 bit network in ipt_account_handle_prepare_read()\n");
+                    ipt_account_data_free(ipt_account_handles[handle].data, depth);
+                    memset (&ipt_account_handles[handle], 0, sizeof(struct ipt_account_handle));
+                    return -1;                    
+                }
+                
+                memcpy(network_16->mask_24[b], src_16->mask_24[b], sizeof(struct ipt_account_mask_24));
+            }
+        }
+    } else if(depth == 2) {
+        struct ipt_account_mask_8 *src_8 = (struct ipt_account_mask_8 *)ipt_account_tables[table_nr].data;
+        struct ipt_account_mask_8 *network_8 = (struct ipt_account_mask_8 *)ipt_account_handles[handle].data;
+        unsigned char a;
+        
+        for (a = 0; a < 255; a++)
+        {
+            if (src_8->mask_16[a])
+            {
+                if (!(network_8->mask_16[a] = (void*)get_zeroed_page(GFP_KERNEL)))
+                {
+                    printk("ACCOUNT: out of memory during copy of 24 bit network in ipt_account_handle_prepare_read()\n");
+                    ipt_account_data_free(ipt_account_handles[handle].data, depth);
+                    memset (&ipt_account_handles[handle], 0, sizeof(struct ipt_account_handle));
+                    return -1;                    
+                }
+
+                memcpy(network_8->mask_16[a], src_8->mask_16[a], sizeof(struct ipt_account_mask_16));
+                    
+                struct ipt_account_mask_16 *src_16 = src_8->mask_16[a];
+                struct ipt_account_mask_16 *network_16 = network_8->mask_16[a];
+                unsigned char b;
+                
+                for (b = 0; b < 255; b++)
+                {
+                    if (src_16->mask_24[b])
+                    {
+                        if (!(network_16->mask_24[b] = (void*)get_zeroed_page(GFP_KERNEL)))
+                        {
+                            printk("ACCOUNT: out of memory during copy of 16 bit network in ipt_account_handle_prepare_read()\n");
+                            ipt_account_data_free(ipt_account_handles[handle].data, depth);
+                            memset (&ipt_account_handles[handle], 0, sizeof(struct ipt_account_handle));
+                            return -1;                    
+                        }
+                        
+                        memcpy(network_16->mask_24[b], src_16->mask_24[b], sizeof(struct ipt_account_mask_24));
+                    }
+                }
+            }
+        }
+    }
+
+    *count = ipt_account_tables[table_nr].itemcount;
+    return handle;
+}
+
+/* Prepare data for read and flush it */
+int ipt_account_handle_prepare_read_flush(char *tablename, unsigned int *count)
+{
+    int handle, i, table_nr=-1;
+    
+    for (i = 0; i < ACCOUNT_MAX_TABLES; i++)
+        if (strncmp(ipt_account_tables[i].name, tablename, ACCOUNT_TABLE_NAME_LEN) == 0)
+        {
+            table_nr = i;
+            break;
+        }
+
+    if (table_nr == -1)
+    {
+        printk("ACCOUNT: ipt_account_handle_prepare_read_flush(): Table %s not found\n", tablename);
+        return -1;
+    }
+            
+    // Can't find a free handle slot?
+    if ((handle = ipt_account_handle_find_slot()) == -1)
+        return -1;
+    
+    // Fill up handle structure
+    ipt_account_handles[handle].ip = ipt_account_tables[table_nr].ip;
+    ipt_account_handles[handle].depth = ipt_account_tables[table_nr].depth;
+    ipt_account_handles[handle].itemcount = ipt_account_tables[table_nr].itemcount;
+    ipt_account_handles[handle].data = ipt_account_tables[table_nr].data;
+    *count = ipt_account_tables[table_nr].itemcount;
+
+    // "Flush" table data
+    ipt_account_tables[table_nr].data = (void*)get_zeroed_page(GFP_KERNEL);
+    ipt_account_tables[table_nr].itemcount = 0;
+
+    return handle;
+}
+
+/* Copy the actual that into a prepared buffer.
+   We only copy entries != 0 to increase performance.
+   The memory gets freed again in ipt_account_handle_free().
+*/
+int ipt_account_handle_get_data(unsigned int handle, void *buffer)
+{
+    struct ipt_account_handle_ip handle_ip;    
+    unsigned int handle_ip_size = sizeof (struct ipt_account_handle_ip);
+    unsigned char i;
+
+    if (handle >= ACCOUNT_MAX_HANDLES)
+    {
+        printk("ACCOUNT: invalid handle for ipt_account_handle_get_data() specified: %u\n", handle);
+        return -1;
+    }
+    
+    if (ipt_account_handles[handle].data == NULL)
+    {
+        printk("ACCOUNT: handle %u is BROKEN: Contains no data\n", handle);
+        return -1;
+    }
+    
+    // Check if at least packet src/dst matches ip/netmask
+    unsigned int net_ip = ipt_account_handles[handle].ip;
+    unsigned int depth = ipt_account_handles[handle].depth;
+    
+    // 8 bit network
+    if (depth == 0)
+    {
+        struct ipt_account_mask_24 *network = (struct ipt_account_mask_24*)ipt_account_handles[handle].data;
+        for (i = 0; i < 255; i++)
+        {
+            if (network->ip[i].src_packets || network->ip[i].dst_packets)
+            {
+                handle_ip.ip = net_ip | (i<<24);
+                handle_ip.src_packets = network->ip[i].src_packets;
+                handle_ip.src_bytes = network->ip[i].src_bytes;
+                handle_ip.dst_packets = network->ip[i].dst_packets;
+                handle_ip.dst_bytes = network->ip[i].dst_bytes;
+
+                copy_to_user(buffer, &handle_ip, handle_ip_size);
+                buffer += handle_ip_size;
+            }
+        }
+        
+        return 0;
+    }
+    
+    // 16 bit network
+    if (depth == 1)
+    {
+        struct ipt_account_mask_16 *network_16 = (struct ipt_account_mask_16*)ipt_account_handles[handle].data;
+        unsigned char b;
+        for (b = 0; b < 255; b++)
+        {
+            if (network_16->mask_24[b])
+            {
+                struct ipt_account_mask_24 *network = (struct ipt_account_mask_24*)network_16->mask_24[b];
+                for (i = 0; i < 255; i++)
+                {
+                    if (network->ip[i].src_packets || network->ip[i].dst_packets)
+                    {
+                        handle_ip.ip = net_ip | (b << 16) | (i<<24);
+                        handle_ip.src_packets = network->ip[i].src_packets;
+                        handle_ip.src_bytes = network->ip[i].src_bytes;
+                        handle_ip.dst_packets = network->ip[i].dst_packets;
+                        handle_ip.dst_bytes = network->ip[i].dst_bytes;
+        
+                        copy_to_user(buffer, &handle_ip, handle_ip_size);
+                        buffer += handle_ip_size;
+                    }
+                }
+            }
+        }
+        
+        return 0;
+    }
+    
+    // 24 bit network
+    if (depth == 2)
+    {
+        struct ipt_account_mask_8 *network_8 = (struct ipt_account_mask_8*)ipt_account_handles[handle].data;
+        unsigned char a, b;
+        for (a = 0; a < 255; a++)
+        {
+            if (network_8->mask_16[a])
+            {
+                struct ipt_account_mask_16 *network_16 = (struct ipt_account_mask_16*)network_8->mask_16[a];
+                for (b = 0; b < 255; b++)
+                {
+                    if (network_16->mask_24[b])
+                    {
+                        struct ipt_account_mask_24 *network = (struct ipt_account_mask_24*)network_16->mask_24[b];
+                        for (i = 0; i < 255; i++)
+                        {
+                            if (network->ip[i].src_packets || network->ip[i].dst_packets)
+                            {
+                                handle_ip.ip = net_ip | (a << 8) | (b << 16) | (i<<24);
+                                handle_ip.src_packets = network->ip[i].src_packets;
+                                handle_ip.src_bytes = network->ip[i].src_bytes;
+                                handle_ip.dst_packets = network->ip[i].dst_packets;
+                                handle_ip.dst_bytes = network->ip[i].dst_bytes;
+                
+                                copy_to_user(buffer, &handle_ip, handle_ip_size);
+                                buffer += handle_ip_size;
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        
+        return 0;
+    }
+        
+    return -1;
+}
+
+static int ipt_account_set_ctl(struct sock *sk, int cmd, void *user, unsigned int len)
+{
+    struct ipt_account_handle_sockopt handle;
+    int ret = -EINVAL;
+
+    if (!capable(CAP_NET_ADMIN))
+            return -EPERM;
+            
+    switch (cmd)
+    {
+        case IPT_SO_SET_ACCOUNT_HANDLE_FREE:
+            if (len != sizeof(struct ipt_account_handle_sockopt))
+            {
+                printk("ACCOUNT: ipt_account_set_ctl: wrong data size (%u != %u) for IPT_SO_SET_HANDLE_FREE\n", len, sizeof(struct ipt_account_handle_sockopt));
+                break;
+            }   
+            
+            if (copy_from_user (&handle, user, len))
+            {
+                printk("ACCOUNT: ipt_account_set_ctl: copy_from_user failed for IPT_SO_SET_HANDLE_FREE\n");
+                break;
+            }
+            
+            spin_lock_bh(&ipt_account_lock);
+            ret = ipt_account_handle_free(handle.handle_nr);
+            spin_unlock_bh(&ipt_account_lock);
+            break;
+        default:
+            printk("ACCOUNT: ipt_account_set_ctl: unknown request %i\n", cmd);
+    }
+
+    return ret;
+}
+
+static int ipt_account_get_ctl(struct sock *sk, int cmd, void *user, int *len)
+{
+    struct ipt_account_handle_sockopt handle;
+    int ret = -EINVAL;
+
+    if (!capable(CAP_NET_ADMIN))
+            return -EPERM;
+
+    switch (cmd)
+    {
+        case IPT_SO_GET_ACCOUNT_PREPARE_READ_FLUSH:
+        case IPT_SO_GET_ACCOUNT_PREPARE_READ:
+            if (*len < sizeof(struct ipt_account_handle_sockopt))
+            {
+                printk("ACCOUNT: ipt_account_get_ctl: wrong data size (%u != %u) for IPT_SO_GET_ACCOUNT_PREPARE_READ/READ_FLUSH\n",
+                       *len, sizeof(struct ipt_account_handle_sockopt));
+                break;
+            }   
+            
+            if (copy_from_user (&handle, user, sizeof(struct ipt_account_handle_sockopt)))
+            {
+                printk("ACCOUNT: ipt_account_get_ctl: copy_from_user failed for IPT_SO_GET_ACCOUNT_PREPARE_READ/READ_FLUSH\n");
+                break;
+            }
+            
+            spin_lock_bh(&ipt_account_lock);
+            if (cmd == IPT_SO_GET_ACCOUNT_PREPARE_READ_FLUSH)
+                handle.handle_nr = ipt_account_handle_prepare_read_flush(handle.name, &handle.itemcount);
+            else
+                handle.handle_nr = ipt_account_handle_prepare_read(handle.name, &handle.itemcount);
+            spin_unlock_bh(&ipt_account_lock);
+                
+            if (handle.handle_nr == -1)
+            {
+                printk("ACCOUNT: ipt_account_get_ctl: ipt_account_handle_prepare_read failed\n");
+                break;
+            }
+            
+            if (copy_to_user(user, &handle, sizeof(struct ipt_account_handle_sockopt)))
+            {
+                printk("ACCOUNT: ipt_account_set_ctl: copy_to_user failed for IPT_SO_GET_ACCOUNT_PREPARE_READ/READ_FLUSH\n");
+                break;
+            }
+            ret = 0;
+            break;
+        case IPT_SO_GET_ACCOUNT_GET_DATA:
+            if (*len < sizeof(struct ipt_account_handle_sockopt))
+            {
+                printk("ACCOUNT: ipt_account_get_ctl: wrong data size (%u != %u) for IPT_SO_GET_ACCOUNT_PREPARE_READ/READ_FLUSH\n",
+                       *len, sizeof(struct ipt_account_handle_sockopt));
+                break;
+            }   
+            
+            if (copy_from_user (&handle, user, sizeof(struct ipt_account_handle_sockopt)))
+            {
+                printk("ACCOUNT: ipt_account_get_ctl: copy_from_user failed for IPT_SO_GET_ACCOUNT_PREPARE_READ/READ_FLUSH\n");
+                break;
+            }
+            
+            if (handle.handle_nr >= ACCOUNT_MAX_HANDLES)
+            {
+                printk("ACCOUNT: Invalid handle for IPT_SO_GET_ACCOUNT_GET_DATA: %u\n", handle.handle_nr);
+                break;
+            }
+            
+            if (*len < ipt_account_handles[handle.handle_nr].itemcount*sizeof(struct ipt_account_handle_ip))
+            {
+                printk("ACCOUNT: ipt_account_get_ctl: not enough space (%u < %u) to store data from IPT_SO_GET_ACCOUNT_GET_DATA\n",
+                       *len, ipt_account_handles[handle.handle_nr].itemcount*sizeof(struct ipt_account_handle_ip));
+                break;
+            }   
+            
+            spin_lock_bh(&ipt_account_lock);
+            ret = ipt_account_handle_get_data(handle.handle_nr, user);
+            spin_unlock_bh(&ipt_account_lock);
+            if (ret)
+            {
+                printk("ACCOUNT: ipt_account_get_ctl: ipt_account_handle_get_data failed for handle %u\n", handle.handle_nr);
+                break;
+            }
+            
+            ret = 0;
+            break;
+        
+        default:
+            printk("ACCOUNT: ipt_account_get_ctl: unknown request %i\n", cmd);
+    }
+
+    return ret;
+}
+
 static struct ipt_target ipt_account_reg
 = { { NULL, NULL }, "ACCOUNT", ipt_account_target, ipt_account_checkentry, ipt_account_deleteentry, 
     THIS_MODULE };
 
+static struct nf_sockopt_ops ipt_account_sockopts
+= { { NULL, NULL }, PF_INET, IPT_SO_SET_ACCOUNT_HANDLE_FREE, IPT_SO_SET_ACCOUNT_MAX+1, ipt_account_set_ctl,
+    IPT_SO_GET_ACCOUNT_PREPARE_READ, IPT_SO_GET_ACCOUNT_MAX+1, ipt_account_get_ctl, 0, NULL  };
+    
 static int __init init(void)
 {
+    if (PAGE_SIZE < 4096)
+    {
+        printk("ACCOUNT: Sorry we need at least a PAGE_SIZE of 4096. Found: %lu\n", PAGE_SIZE);
+        return -EINVAL;
+    }
+
     if (!(ipt_account_tables = kmalloc(ACCOUNT_MAX_TABLES*sizeof(struct ipt_account_table), GFP_KERNEL)))
     {
-            printk("ACCOUNT: Out of memory allocating account_tables structure");
-            return -EINVAL;
+        printk("ACCOUNT: Out of memory allocating account_tables structure");
+        return -EINVAL;
     }
     memset(ipt_account_tables, 0, ACCOUNT_MAX_TABLES*sizeof(struct ipt_account_table));
                             
     if (!(ipt_account_handles = kmalloc(ACCOUNT_MAX_HANDLES*sizeof(struct ipt_account_handle), GFP_KERNEL)))
     {
-            printk("ACCOUNT: Out of memory allocating account_handles structure");
-            kfree (ipt_account_tables);
-            ipt_account_tables = NULL;
-            return -EINVAL;
+        printk("ACCOUNT: Out of memory allocating account_handles structure");
+        kfree (ipt_account_tables);
+        ipt_account_tables = NULL;
+        return -EINVAL;
     }
     memset(ipt_account_handles, 0, ACCOUNT_MAX_HANDLES*sizeof(struct ipt_account_handle));
+
+    /* Register setsockopt */
+    if (nf_register_sockopt(&ipt_account_sockopts) < 0)
+    {
+        printk("ACCOUNT: Can't register sockopts. Aborting\n");
+        
+        kfree (ipt_account_tables);
+        ipt_account_tables = NULL;
+        kfree(ipt_account_handles);
+        ipt_account_handles = NULL;
+        
+        return -EINVAL;
+    }
     
     if (ipt_register_target(&ipt_account_reg))
             return -EINVAL;
@@ -462,6 +921,8 @@ static void __exit fini(void)
 {
     ipt_unregister_target(&ipt_account_reg);
 
+    nf_unregister_sockopt(&ipt_account_sockopts);
+    
     kfree(ipt_account_tables);
     ipt_account_tables = NULL;