netfilter: xt_qtaguid: add some tagging/matching stats
[linux-2.6.git] / net / netfilter / xt_qtaguid.c
1 /*
2  * Kernel iptables module to track stats for packets based on user tags.
3  *
4  * (C) 2011 Google, Inc
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License version 2 as
8  * published by the Free Software Foundation.
9  */
10
11 /* #define DEBUG */
12 /* #define IDEBUG */
13 /* #define MDEBUG */
14 /* #define RDEBUG */
15 /* #define CDEBUG */
16
17 /* Iface handling */
18 #ifdef IDEBUG
19 #define IF_DEBUG(...) pr_debug(__VA_ARGS__)
20 #else
21 #define IF_DEBUG(...) no_printk(__VA_ARGS__)
22 #endif
23 /* Iptable Matching */
24 #ifdef MDEBUG
25 #define MT_DEBUG(...) pr_debug(__VA_ARGS__)
26 #else
27 #define MT_DEBUG(...) no_printk(__VA_ARGS__)
28 #endif
29 /* Red-black tree handling */
30 #ifdef RDEBUG
31 #define RB_DEBUG(...) pr_debug(__VA_ARGS__)
32 #else
33 #define RB_DEBUG(...) no_printk(__VA_ARGS__)
34 #endif
35 /* procfs ctrl/stats handling */
36 #ifdef CDEBUG
37 #define CT_DEBUG(...) pr_debug(__VA_ARGS__)
38 #else
39 #define CT_DEBUG(...) no_printk(__VA_ARGS__)
40 #endif
41
42 #include <linux/file.h>
43 #include <linux/inetdevice.h>
44 #include <linux/module.h>
45 #include <linux/netfilter/x_tables.h>
46 #include <linux/netfilter/xt_qtaguid.h>
47 #include <linux/skbuff.h>
48 #include <linux/workqueue.h>
49 #include <net/addrconf.h>
50 #include <net/sock.h>
51 #include <net/tcp.h>
52 #include <net/udp.h>
53
54 #include <linux/netfilter/xt_socket.h>
55 /*
56  * We only use the xt_socket funcs within a similar context to avoid unexpected
57  * return values.
58  */
59 #define XT_SOCKET_SUPPORTED_HOOKS \
60         ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_IN))
61
62
63 static const char *module_procdirname = "xt_qtaguid";
64 static struct proc_dir_entry *xt_qtaguid_procdir;
65
66 static unsigned int proc_iface_perms = S_IRUGO;
67 module_param_named(iface_perms, proc_iface_perms, uint, S_IRUGO | S_IWUSR);
68
69 static struct proc_dir_entry *xt_qtaguid_stats_file;
70 static unsigned int proc_stats_perms = S_IRUGO;
71 module_param_named(stats_perms, proc_stats_perms, uint, S_IRUGO | S_IWUSR);
72
73 static struct proc_dir_entry *xt_qtaguid_ctrl_file;
74 #ifdef CONFIG_ANDROID_PARANOID_NETWORK
75 static unsigned int proc_ctrl_perms = S_IRUGO | S_IWUGO;
76 #else
77 static unsigned int proc_ctrl_perms = S_IRUGO | S_IWUSR;
78 #endif
79 module_param_named(ctrl_perms, proc_ctrl_perms, uint, S_IRUGO | S_IWUSR);
80
81 #ifdef CONFIG_ANDROID_PARANOID_NETWORK
82 #include <linux/android_aid.h>
83 static gid_t proc_stats_readall_gid = AID_NET_BW_STATS;
84 static gid_t proc_ctrl_write_gid = AID_NET_BW_ACCT;
85 #else
86 /* 0 means, don't limit anybody */
87 static gid_t proc_stats_readall_gid;
88 static gid_t proc_ctrl_write_gid;
89 #endif
90 module_param_named(stats_readall_gid, proc_stats_readall_gid, uint,
91                    S_IRUGO | S_IWUSR);
92 module_param_named(ctrl_write_gid, proc_ctrl_write_gid, uint,
93                    S_IRUGO | S_IWUSR);
94
95 /*
96  * After the kernel has initiallized this module, it is still possible
97  * to make it passive:
98  *  - do not register it via iptables.
99  *   the matching code will not be invoked.
100  *  - set passive to 0
101  *   the iface stats handling will not be act on notifications.
102  * This is mostly usefull when a bug is suspected.
103  */
104 static bool module_passive;
105 module_param_named(passive, module_passive, bool, S_IRUGO | S_IWUSR);
106
107 /*---------------------------------------------------------------------------*/
108 /*
109  * Tags:
110  *
111  * They represent what the data usage counters will be tracked against.
112  * By default a tag is just based on the UID.
113  * The UID is used as the base for policying, and can not be ignored.
114  * So a tag will always at least represent a UID (uid_tag).
115  *
116  * A tag can be augmented with an "accounting tag" which is associated
117  * with a UID.
118  * User space can set the acct_tag portion of the tag which is then used
119  * with sockets: all data belong to that socket will be counted against the
120  * tag. The policing is then based on the tag's uid_tag portion,
121  * and stats are collected for the acct_tag portion seperately.
122  *
123  * There could be
124  * a:  {acct_tag=1, uid_tag=10003}
125  * b:  {acct_tag=2, uid_tag=10003}
126  * c:  {acct_tag=3, uid_tag=10003}
127  * d:  {acct_tag=0, uid_tag=10003}
128  * (a, b, and c represent tags associated with specific sockets.
129  * d is for the totals for that uid, including all untagged traffic.
130  * Typically d is used with policing/quota rules.
131  *
132  * We want tag_t big enough to distinguish uid_t and acct_tag.
133  * It might become a struct if needed.
134  * Nothing should be using it as an int.
135  */
136 typedef uint64_t tag_t;  /* Only used via accessors */
137
138 static const char *iface_stat_procdirname = "iface_stat";
139 static struct proc_dir_entry *iface_stat_procdir;
140
141
142 /*
143  * For now we only track 2 sets of counters.
144  * The default set is 0.
145  * Userspace can activate another set for a given uid being tracked.
146  */
147 #define IFS_MAX_COUNTER_SETS 2
148
149 enum ifs_tx_rx {
150         IFS_TX,
151         IFS_RX,
152         IFS_MAX_DIRECTIONS
153 };
154
155 /* For now, TCP, UDP, the rest */
156 enum ifs_proto {
157         IFS_TCP,
158         IFS_UDP,
159         IFS_PROTO_OTHER,
160         IFS_MAX_PROTOS
161 };
162
163 struct byte_packet_counters {
164         uint64_t bytes;
165         uint64_t packets;
166 };
167
168 struct data_counters {
169         struct byte_packet_counters bpc[IFS_MAX_COUNTER_SETS][IFS_MAX_DIRECTIONS][IFS_MAX_PROTOS];
170 };
171
172 /* Generic tag based node used as a base for rb_tree ops. */
173 struct tag_node {
174         struct rb_node node;
175         tag_t tag;
176 };
177
178 struct tag_stat {
179         struct tag_node tn;
180         struct data_counters counters;
181         /*
182          * If this tag is acct_tag based, we need to count against the
183          * matching parent uid_tag.
184          */
185         struct data_counters *parent_counters;
186 };
187
188 struct iface_stat {
189         struct list_head list;
190         char *ifname;
191         uint64_t rx_bytes;
192         uint64_t rx_packets;
193         uint64_t tx_bytes;
194         uint64_t tx_packets;
195         bool active;
196         struct proc_dir_entry *proc_ptr;
197
198         struct rb_root tag_stat_tree;
199         spinlock_t tag_stat_list_lock;
200 };
201
202 static LIST_HEAD(iface_stat_list);
203 static DEFINE_SPINLOCK(iface_stat_list_lock);
204
205 /* This is needed to create proc_dir_entries from atomic context. */
206 struct iface_stat_work {
207         struct work_struct iface_work;
208         struct iface_stat *iface_entry;
209 };
210
211 /*
212  * Track tag that this socket is transferring data for, and not necessarily
213  * the uid that owns the socket.
214  * This is the tag against which tag_stat.counters will be billed.
215  */
216 struct sock_tag {
217         struct rb_node sock_node;
218         struct sock *sk;  /* Only used as a number, never dereferenced */
219         /* The socket is needed for sockfd_put() */
220         struct socket *socket;
221
222         tag_t tag;
223 };
224
225 struct qtaguid_event_counts {
226         /* Various successful events */
227         atomic64_t sockets_tagged;
228         atomic64_t sockets_untagged;
229         atomic64_t counter_set_changes;
230         atomic64_t delete_cmds;
231         atomic64_t iface_events;  /* Number of NETDEV_* events handled */
232         /*
233          * match_found_sk_*: numbers related to the netfilter matching
234          * function finding a sock for the sk_buff.
235          */
236         atomic64_t match_found_sk;   /* An sk was already in the sk_buff. */
237         /* The connection tracker had the sk. */
238         atomic64_t match_found_sk_in_ct;
239         /*
240          * No sk could be found. No apparent owner. Could happen with
241          * unsolicited traffic.
242          */
243         atomic64_t match_found_sk_none;
244 };
245 static struct qtaguid_event_counts qtu_events;
246
247 static struct rb_root sock_tag_tree = RB_ROOT;
248 static DEFINE_SPINLOCK(sock_tag_list_lock);
249
250 /* Track the set active_set for the given tag. */
251 struct tag_counter_set {
252         struct tag_node tn;
253         int active_set;
254 };
255
256 static struct rb_root tag_counter_set_tree = RB_ROOT;
257 static DEFINE_SPINLOCK(tag_counter_set_list_lock);
258
259 static bool qtaguid_mt(const struct sk_buff *skb, struct xt_action_param *par);
260
261 /*----------------------------------------------*/
262 static inline int tag_compare(tag_t t1, tag_t t2)
263 {
264         return t1 < t2 ? -1 : t1 == t2 ? 0 : 1;
265 }
266
267 static inline tag_t combine_atag_with_uid(tag_t acct_tag, uid_t uid)
268 {
269         return acct_tag | uid;
270 }
271 static inline tag_t make_tag_from_uid(uid_t uid)
272 {
273         return uid;
274 }
275 static inline uid_t get_uid_from_tag(tag_t tag)
276 {
277         return tag & 0xFFFFFFFFULL;
278 }
279 static inline tag_t get_utag_from_tag(tag_t tag)
280 {
281         return tag & 0xFFFFFFFFULL;
282 }
283 static inline tag_t get_atag_from_tag(tag_t tag)
284 {
285         return tag & ~0xFFFFFFFFULL;
286 }
287
288 static inline bool valid_atag(tag_t tag)
289 {
290         return !(tag & 0xFFFFFFFFULL);
291 }
292
293 static inline void dc_add_byte_packets(struct data_counters *counters, int set,
294                                   enum ifs_tx_rx direction,
295                                   enum ifs_proto ifs_proto,
296                                   int bytes,
297                                   int packets)
298 {
299         counters->bpc[set][direction][ifs_proto].bytes += bytes;
300         counters->bpc[set][direction][ifs_proto].packets += packets;
301 }
302
303 static inline uint64_t dc_sum_bytes(struct data_counters *counters,
304                                     int set,
305                                     enum ifs_tx_rx direction)
306 {
307         return counters->bpc[set][direction][IFS_TCP].bytes
308                 + counters->bpc[set][direction][IFS_UDP].bytes
309                 + counters->bpc[set][direction][IFS_PROTO_OTHER].bytes;
310 }
311
312 static inline uint64_t dc_sum_packets(struct data_counters *counters,
313                                       int set,
314                                       enum ifs_tx_rx direction)
315 {
316         return counters->bpc[set][direction][IFS_TCP].packets
317                 + counters->bpc[set][direction][IFS_UDP].packets
318                 + counters->bpc[set][direction][IFS_PROTO_OTHER].packets;
319 }
320
321 static struct tag_node *tag_node_tree_search(struct rb_root *root, tag_t tag)
322 {
323         struct rb_node *node = root->rb_node;
324
325         while (node) {
326                 struct tag_node *data = rb_entry(node, struct tag_node, node);
327                 int result = tag_compare(tag, data->tag);
328                 RB_DEBUG("qtaguid: tag_node_tree_search(): tag=0x%llx"
329                          " (uid=%d)\n",
330                          data->tag,
331                          get_uid_from_tag(data->tag));
332
333                 if (result < 0)
334                         node = node->rb_left;
335                 else if (result > 0)
336                         node = node->rb_right;
337                 else
338                         return data;
339         }
340         return NULL;
341 }
342
343 static void tag_node_tree_insert(struct tag_node *data, struct rb_root *root)
344 {
345         struct rb_node **new = &(root->rb_node), *parent = NULL;
346
347         /* Figure out where to put new node */
348         while (*new) {
349                 struct tag_node *this = rb_entry(*new, struct tag_node,
350                                                  node);
351                 int result = tag_compare(data->tag, this->tag);
352                 RB_DEBUG("qtaguid: tag_node_tree_insert(): tag=0x%llx"
353                          " (uid=%d)\n",
354                          this->tag,
355                          get_uid_from_tag(this->tag));
356                 parent = *new;
357                 if (result < 0)
358                         new = &((*new)->rb_left);
359                 else if (result > 0)
360                         new = &((*new)->rb_right);
361                 else
362                         BUG();
363         }
364
365         /* Add new node and rebalance tree. */
366         rb_link_node(&data->node, parent, new);
367         rb_insert_color(&data->node, root);
368 }
369
370 static void tag_stat_tree_insert(struct tag_stat *data, struct rb_root *root)
371 {
372         tag_node_tree_insert(&data->tn, root);
373 }
374
375 static struct tag_stat *tag_stat_tree_search(struct rb_root *root, tag_t tag)
376 {
377         struct tag_node *node = tag_node_tree_search(root, tag);
378         if (!node)
379                 return NULL;
380         return rb_entry(&node->node, struct tag_stat, tn.node);
381 }
382
383 static void tag_counter_set_tree_insert(struct tag_counter_set *data,
384                                         struct rb_root *root)
385 {
386         tag_node_tree_insert(&data->tn, root);
387 }
388
389 static struct tag_counter_set *tag_counter_set_tree_search(struct rb_root *root,
390                                                            tag_t tag)
391 {
392         struct tag_node *node = tag_node_tree_search(root, tag);
393         if (!node)
394                 return NULL;
395         return rb_entry(&node->node, struct tag_counter_set, tn.node);
396
397 }
398
399 static struct sock_tag *sock_tag_tree_search(struct rb_root *root,
400                                              const struct sock *sk)
401 {
402         struct rb_node *node = root->rb_node;
403
404         while (node) {
405                 struct sock_tag *data = rb_entry(node, struct sock_tag,
406                                                  sock_node);
407                 ptrdiff_t result = sk - data->sk;
408                 if (result < 0)
409                         node = node->rb_left;
410                 else if (result > 0)
411                         node = node->rb_right;
412                 else
413                         return data;
414         }
415         return NULL;
416 }
417
418 static void sock_tag_tree_insert(struct sock_tag *data, struct rb_root *root)
419 {
420         struct rb_node **new = &(root->rb_node), *parent = NULL;
421
422         /* Figure out where to put new node */
423         while (*new) {
424                 struct sock_tag *this = rb_entry(*new, struct sock_tag,
425                                                  sock_node);
426                 ptrdiff_t result = data->sk - this->sk;
427                 parent = *new;
428                 if (result < 0)
429                         new = &((*new)->rb_left);
430                 else if (result > 0)
431                         new = &((*new)->rb_right);
432                 else
433                         BUG();
434         }
435
436         /* Add new node and rebalance tree. */
437         rb_link_node(&data->sock_node, parent, new);
438         rb_insert_color(&data->sock_node, root);
439 }
440
441 static int read_proc_u64(char *page, char **start, off_t off,
442                         int count, int *eof, void *data)
443 {
444         int len;
445         uint64_t value;
446         char *p = page;
447         uint64_t *iface_entry = data;
448
449         if (!data)
450                 return 0;
451
452         value = *iface_entry;
453         p += sprintf(p, "%llu\n", value);
454         len = (p - page) - off;
455         *eof = (len <= count) ? 1 : 0;
456         *start = page + off;
457         return len;
458 }
459
460 static int read_proc_bool(char *page, char **start, off_t off,
461                         int count, int *eof, void *data)
462 {
463         int len;
464         bool value;
465         char *p = page;
466         bool *bool_entry = data;
467
468         if (!data)
469                 return 0;
470
471         value = *bool_entry;
472         p += sprintf(p, "%u\n", value);
473         len = (p - page) - off;
474         *eof = (len <= count) ? 1 : 0;
475         *start = page + off;
476         return len;
477 }
478
479 static int get_active_counter_set(tag_t tag)
480 {
481         int active_set = 0;
482         struct tag_counter_set *tcs;
483
484         MT_DEBUG("qtaguid: get_active_counter_set(tag=0x%llx)"
485                  " (uid=%u)\n",
486                  tag, get_uid_from_tag(tag));
487         /* For now we only handle UID tags for active sets */
488         tag = get_utag_from_tag(tag);
489         spin_lock_bh(&tag_counter_set_list_lock);
490         tcs = tag_counter_set_tree_search(&tag_counter_set_tree, tag);
491         if (tcs)
492                 active_set = tcs->active_set;
493         spin_unlock_bh(&tag_counter_set_list_lock);
494         return active_set;
495 }
496
497 /*
498  * Find the entry for tracking the specified interface.
499  * Caller must hold iface_stat_list_lock
500  */
501 static struct iface_stat *get_iface_entry(const char *ifname)
502 {
503         struct iface_stat *iface_entry;
504
505         /* Find the entry for tracking the specified tag within the interface */
506         if (ifname == NULL) {
507                 pr_info("qtaguid: iface_stat: get() NULL device name\n");
508                 return NULL;
509         }
510
511         /* Iterate over interfaces */
512         list_for_each_entry(iface_entry, &iface_stat_list, list) {
513                 if (!strcmp(ifname, iface_entry->ifname))
514                         goto done;
515         }
516         iface_entry = NULL;
517 done:
518         return iface_entry;
519 }
520
521 static void iface_create_proc_worker(struct work_struct *work)
522 {
523         struct proc_dir_entry *proc_entry;
524         struct iface_stat_work *isw = container_of(work, struct iface_stat_work,
525                                                    iface_work);
526         struct iface_stat *new_iface  = isw->iface_entry;
527
528         /* iface_entries are not deleted, so safe to manipulate. */
529         proc_entry = proc_mkdir(new_iface->ifname, iface_stat_procdir);
530         if (IS_ERR_OR_NULL(proc_entry)) {
531                 pr_err("qtaguid: iface_stat: create_proc(): alloc failed.\n");
532                 kfree(isw);
533                 return;
534         }
535
536         new_iface->proc_ptr = proc_entry;
537
538         create_proc_read_entry("tx_bytes", proc_iface_perms, proc_entry,
539                         read_proc_u64, &new_iface->tx_bytes);
540         create_proc_read_entry("rx_bytes", proc_iface_perms, proc_entry,
541                         read_proc_u64, &new_iface->rx_bytes);
542         create_proc_read_entry("tx_packets", proc_iface_perms, proc_entry,
543                         read_proc_u64, &new_iface->tx_packets);
544         create_proc_read_entry("rx_packets", proc_iface_perms, proc_entry,
545                         read_proc_u64, &new_iface->rx_packets);
546         create_proc_read_entry("active", proc_iface_perms, proc_entry,
547                         read_proc_bool, &new_iface->active);
548
549         IF_DEBUG("qtaguid: iface_stat: create_proc(): done "
550                  "entry=%p dev=%s\n", new_iface, new_iface->ifname);
551         kfree(isw);
552 }
553
554 /* Caller must hold iface_stat_list_lock */
555 static struct iface_stat *iface_alloc(const char *ifname)
556 {
557         struct iface_stat *new_iface;
558         struct iface_stat_work *isw;
559
560         new_iface = kzalloc(sizeof(*new_iface), GFP_ATOMIC);
561         if (new_iface == NULL) {
562                 pr_err("qtaguid: iface_stat: create(%s): "
563                        "iface_stat alloc failed\n", ifname);
564                 return NULL;
565         }
566         new_iface->ifname = kstrdup(ifname, GFP_ATOMIC);
567         if (new_iface->ifname == NULL) {
568                 pr_err("qtaguid: iface_stat: create(%s): "
569                        "ifname alloc failed\n", ifname);
570                 kfree(new_iface);
571                 return NULL;
572         }
573         spin_lock_init(&new_iface->tag_stat_list_lock);
574         new_iface->active = true;
575         new_iface->tag_stat_tree = RB_ROOT;
576
577         /*
578          * ipv6 notifier chains are atomic :(
579          * No create_proc_read_entry() for you!
580          */
581         isw = kmalloc(sizeof(*isw), GFP_ATOMIC);
582         if (!isw) {
583                 pr_err("qtaguid: iface_stat: create(%s): "
584                        "work alloc failed\n", new_iface->ifname);
585                 kfree(new_iface->ifname);
586                 kfree(new_iface);
587                 return NULL;
588         }
589         isw->iface_entry = new_iface;
590         INIT_WORK(&isw->iface_work, iface_create_proc_worker);
591         schedule_work(&isw->iface_work);
592         list_add(&new_iface->list, &iface_stat_list);
593         return new_iface;
594 }
595
596 /*
597  * Create a new entry for tracking the specified interface.
598  * Do nothing if the entry already exists.
599  * Called when an interface is configured with a valid IP address.
600  */
601 void iface_stat_create(const struct net_device *net_dev,
602                        struct in_ifaddr *ifa)
603 {
604         struct in_device *in_dev = NULL;
605         const char *ifname;
606         struct iface_stat *entry;
607         __be32 ipaddr = 0;
608         struct iface_stat *new_iface;
609
610         IF_DEBUG("qtaguid: iface_stat: create(%s): ifa=%p netdev=%p\n",
611                  net_dev ? net_dev->name : "?",
612                  ifa, net_dev);
613         if (!net_dev) {
614                 pr_err("qtaguid: iface_stat: create(): no net dev\n");
615                 return;
616         }
617
618         ifname = net_dev->name;
619         if (!ifa) {
620                 in_dev = in_dev_get(net_dev);
621                 if (!in_dev) {
622                         pr_err("qtaguid: iface_stat: create(%s): no inet dev\n",
623                                ifname);
624                         return;
625                 }
626                 IF_DEBUG("qtaguid: iface_stat: create(%s): in_dev=%p\n",
627                          ifname, in_dev);
628                 for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
629                         IF_DEBUG("qtaguid: iface_stat: create(%s): "
630                                  "ifa=%p ifa_label=%s\n",
631                                  ifname, ifa,
632                                  ifa->ifa_label ? ifa->ifa_label : "(null)");
633                         if (ifa->ifa_label && !strcmp(ifname, ifa->ifa_label))
634                                 break;
635                 }
636         }
637
638         if (!ifa) {
639                 IF_DEBUG("qtaguid: iface_stat: create(%s): no matching IP\n",
640                          ifname);
641                 goto done_put;
642         }
643         ipaddr = ifa->ifa_local;
644
645         spin_lock_bh(&iface_stat_list_lock);
646         entry = get_iface_entry(ifname);
647         if (entry != NULL) {
648                 IF_DEBUG("qtaguid: iface_stat: create(%s): entry=%p\n",
649                          ifname, entry);
650                 if (ipv4_is_loopback(ipaddr)) {
651                         entry->active = false;
652                         IF_DEBUG("qtaguid: iface_stat: create(%s): "
653                                  "disable tracking of loopback dev\n",
654                                  ifname);
655                 } else {
656                         entry->active = true;
657                         IF_DEBUG("qtaguid: iface_stat: create(%s): "
658                                  "enable tracking. ip=%pI4\n",
659                                  ifname, &ipaddr);
660                 }
661                 goto done_unlock_put;
662         } else if (ipv4_is_loopback(ipaddr)) {
663                 IF_DEBUG("qtaguid: iface_stat: create(%s): "
664                          "ignore loopback dev. ip=%pI4\n", ifname, &ipaddr);
665                 goto done_unlock_put;
666         }
667
668         new_iface = iface_alloc(ifname);
669         IF_DEBUG("qtaguid: iface_stat: create(%s): done "
670                  "entry=%p ip=%pI4\n", ifname, new_iface, &ipaddr);
671
672 done_unlock_put:
673         spin_unlock_bh(&iface_stat_list_lock);
674 done_put:
675         if (in_dev)
676                 in_dev_put(in_dev);
677 }
678
679 void iface_stat_create_ipv6(const struct net_device *net_dev,
680                             struct inet6_ifaddr *ifa)
681 {
682         struct in_device *in_dev;
683         const char *ifname;
684         struct iface_stat *entry;
685         struct iface_stat *new_iface;
686         int addr_type;
687
688         IF_DEBUG("qtaguid: iface_stat: create6(): ifa=%p netdev=%p->name=%s\n",
689                  ifa, net_dev, net_dev ? net_dev->name : "");
690         if (!net_dev) {
691                 pr_err("qtaguid: iface_stat: create6(): no net dev!\n");
692                 return;
693         }
694         ifname = net_dev->name;
695
696         in_dev = in_dev_get(net_dev);
697         if (!in_dev) {
698                 pr_err("qtaguid: iface_stat: create6(%s): no inet dev\n",
699                        ifname);
700                 return;
701         }
702
703         IF_DEBUG("qtaguid: iface_stat: create6(%s): in_dev=%p\n",
704                  ifname, in_dev);
705
706         if (!ifa) {
707                 IF_DEBUG("qtaguid: iface_stat: create6(%s): no matching IP\n",
708                          ifname);
709                 goto done_put;
710         }
711         addr_type = ipv6_addr_type(&ifa->addr);
712
713         spin_lock_bh(&iface_stat_list_lock);
714         entry = get_iface_entry(ifname);
715         if (entry != NULL) {
716                 IF_DEBUG("qtaguid: iface_stat: create6(%s): entry=%p\n",
717                          ifname, entry);
718                 if (addr_type & IPV6_ADDR_LOOPBACK) {
719                         entry->active = false;
720                         IF_DEBUG("qtaguid: iface_stat: create6(%s): "
721                                  "disable tracking of loopback dev\n",
722                                  ifname);
723                 } else {
724                         entry->active = true;
725                         IF_DEBUG("qtaguid: iface_stat: create6(%s): "
726                                  "enable tracking. ip=%pI6c\n",
727                                  ifname, &ifa->addr);
728                 }
729                 goto done_unlock_put;
730         } else if (addr_type & IPV6_ADDR_LOOPBACK) {
731                 IF_DEBUG("qtaguid: iface_stat: create6(%s): "
732                          "ignore loopback dev. ip=%pI6c\n",
733                          ifname, &ifa->addr);
734                 goto done_unlock_put;
735         }
736
737         new_iface = iface_alloc(ifname);
738         IF_DEBUG("qtaguid: iface_stat: create6(%s): done "
739                  "entry=%p ip=%pI6c\n", ifname, new_iface, &ifa->addr);
740
741 done_unlock_put:
742         spin_unlock_bh(&iface_stat_list_lock);
743 done_put:
744         in_dev_put(in_dev);
745 }
746
747 static struct sock_tag *get_sock_stat_nl(const struct sock *sk)
748 {
749         MT_DEBUG("qtaguid: get_sock_stat_nl(sk=%p)\n", sk);
750         return sock_tag_tree_search(&sock_tag_tree, sk);
751 }
752
753 static struct sock_tag *get_sock_stat(const struct sock *sk)
754 {
755         struct sock_tag *sock_tag_entry;
756         MT_DEBUG("qtaguid: get_sock_stat(sk=%p)\n", sk);
757         if (!sk)
758                 return NULL;
759         spin_lock_bh(&sock_tag_list_lock);
760         sock_tag_entry = get_sock_stat_nl(sk);
761         spin_unlock_bh(&sock_tag_list_lock);
762         return sock_tag_entry;
763 }
764
765 static void
766 data_counters_update(struct data_counters *dc, int set,
767                      enum ifs_tx_rx direction, int proto, int bytes)
768 {
769         switch (proto) {
770         case IPPROTO_TCP:
771                 dc_add_byte_packets(dc, set, direction, IFS_TCP, bytes, 1);
772                 break;
773         case IPPROTO_UDP:
774                 dc_add_byte_packets(dc, set, direction, IFS_UDP, bytes, 1);
775                 break;
776         case IPPROTO_IP:
777         default:
778                 dc_add_byte_packets(dc, set, direction, IFS_PROTO_OTHER, bytes,
779                                     1);
780                 break;
781         }
782 }
783
784 /*
785  * Update stats for the specified interface. Do nothing if the entry
786  * does not exist (when a device was never configured with an IP address).
787  * Called when an device is being unregistered.
788  */
789 static void iface_stat_update(struct net_device *dev)
790 {
791         struct rtnl_link_stats64 dev_stats, *stats;
792         struct iface_stat *entry;
793
794         stats = dev_get_stats(dev, &dev_stats);
795         spin_lock_bh(&iface_stat_list_lock);
796         entry = get_iface_entry(dev->name);
797         if (entry == NULL) {
798                 IF_DEBUG("qtaguid: iface_stat_update: dev=%s not tracked\n",
799                          dev->name);
800                 spin_unlock_bh(&iface_stat_list_lock);
801                 return;
802         }
803         IF_DEBUG("qtaguid: iface_stat_update: dev=%s entry=%p\n",
804                  dev->name, entry);
805         if (entry->active) {
806                 entry->tx_bytes += stats->tx_bytes;
807                 entry->tx_packets += stats->tx_packets;
808                 entry->rx_bytes += stats->rx_bytes;
809                 entry->rx_packets += stats->rx_packets;
810                 entry->active = false;
811         } else {
812                 IF_DEBUG("qtaguid: iface_stat_update: dev=%s inactive\n",
813                         dev->name);
814         }
815         spin_unlock_bh(&iface_stat_list_lock);
816 }
817
818 static void tag_stat_update(struct tag_stat *tag_entry,
819                         enum ifs_tx_rx direction, int proto, int bytes)
820 {
821         int active_set;
822         active_set = get_active_counter_set(tag_entry->tn.tag);
823         MT_DEBUG("qtaguid: tag_stat_update(tag=0x%llx (uid=%u) set=%d "
824                  "dir=%d proto=%d bytes=%d)\n",
825                  tag_entry->tn.tag, get_uid_from_tag(tag_entry->tn.tag),
826                  active_set, direction, proto, bytes);
827         data_counters_update(&tag_entry->counters, active_set, direction,
828                              proto, bytes);
829         if (tag_entry->parent_counters)
830                 data_counters_update(tag_entry->parent_counters, active_set,
831                                      direction, proto, bytes);
832 }
833
834 /*
835  * Create a new entry for tracking the specified {acct_tag,uid_tag} within
836  * the interface.
837  * iface_entry->tag_stat_list_lock should be held.
838  */
839 static struct tag_stat *create_if_tag_stat(struct iface_stat *iface_entry,
840                                            tag_t tag)
841 {
842         struct tag_stat *new_tag_stat_entry = NULL;
843         IF_DEBUG("qtaguid: iface_stat: create_if_tag_stat(): ife=%p tag=0x%llx"
844                  " (uid=%u)\n",
845                  iface_entry, tag, get_uid_from_tag(tag));
846         new_tag_stat_entry = kzalloc(sizeof(*new_tag_stat_entry), GFP_ATOMIC);
847         if (!new_tag_stat_entry) {
848                 pr_err("qtaguid: iface_stat: tag stat alloc failed\n");
849                 goto done;
850         }
851         new_tag_stat_entry->tn.tag = tag;
852         tag_stat_tree_insert(new_tag_stat_entry, &iface_entry->tag_stat_tree);
853 done:
854         return new_tag_stat_entry;
855 }
856
857 static void if_tag_stat_update(const char *ifname, uid_t uid,
858                                const struct sock *sk, enum ifs_tx_rx direction,
859                                int proto, int bytes)
860 {
861         struct tag_stat *tag_stat_entry;
862         tag_t tag, acct_tag;
863         tag_t uid_tag;
864         struct data_counters *uid_tag_counters;
865         struct sock_tag *sock_tag_entry;
866         struct iface_stat *iface_entry;
867         struct tag_stat *new_tag_stat;
868         MT_DEBUG("qtaguid: if_tag_stat_update(ifname=%s "
869                 "uid=%u sk=%p dir=%d proto=%d bytes=%d)\n",
870                  ifname, uid, sk, direction, proto, bytes);
871
872
873         iface_entry = get_iface_entry(ifname);
874         if (!iface_entry) {
875                 pr_err("qtaguid: iface_stat: stat_update() %s not found\n",
876                        ifname);
877                 return;
878         }
879         /* It is ok to process data when an iface_entry is inactive */
880
881         MT_DEBUG("qtaguid: iface_stat: stat_update() dev=%s entry=%p\n",
882                  ifname, iface_entry);
883
884         /*
885          * Look for a tagged sock.
886          * It will have an acct_uid.
887          */
888         sock_tag_entry = get_sock_stat(sk);
889         if (sock_tag_entry) {
890                 tag = sock_tag_entry->tag;
891                 acct_tag = get_atag_from_tag(tag);
892                 uid_tag = get_utag_from_tag(tag);
893         } else {
894                 uid_tag = make_tag_from_uid(uid);
895                 acct_tag = 0;
896                 tag = combine_atag_with_uid(acct_tag, uid);
897         }
898         MT_DEBUG("qtaguid: iface_stat: stat_update(): "
899                  " looking for tag=0x%llx (uid=%u) in ife=%p\n",
900                  tag, get_uid_from_tag(tag), iface_entry);
901         /* Loop over tag list under this interface for {acct_tag,uid_tag} */
902         spin_lock_bh(&iface_entry->tag_stat_list_lock);
903
904         tag_stat_entry = tag_stat_tree_search(&iface_entry->tag_stat_tree,
905                                               tag);
906         if (tag_stat_entry) {
907                 /*
908                  * Updating the {acct_tag, uid_tag} entry handles both stats:
909                  * {0, uid_tag} will also get updated.
910                  */
911                 tag_stat_update(tag_stat_entry, direction, proto, bytes);
912                 spin_unlock_bh(&iface_entry->tag_stat_list_lock);
913                 return;
914         }
915
916         /* Loop over tag list under this interface for {0,uid_tag} */
917         tag_stat_entry = tag_stat_tree_search(&iface_entry->tag_stat_tree,
918                                               uid_tag);
919         if (!tag_stat_entry) {
920                 /* Here: the base uid_tag did not exist */
921                 /*
922                  * No parent counters. So
923                  *  - No {0, uid_tag} stats and no {acc_tag, uid_tag} stats.
924                  */
925                 new_tag_stat = create_if_tag_stat(iface_entry, uid_tag);
926                 uid_tag_counters = &new_tag_stat->counters;
927         } else {
928                 uid_tag_counters = &tag_stat_entry->counters;
929         }
930
931         if (acct_tag) {
932                 new_tag_stat = create_if_tag_stat(iface_entry, tag);
933                 new_tag_stat->parent_counters = uid_tag_counters;
934         }
935         spin_unlock_bh(&iface_entry->tag_stat_list_lock);
936         tag_stat_update(new_tag_stat, direction, proto, bytes);
937 }
938
939 static int iface_netdev_event_handler(struct notifier_block *nb,
940                                       unsigned long event, void *ptr) {
941         struct net_device *dev = ptr;
942
943         if (unlikely(module_passive))
944                 return NOTIFY_DONE;
945
946         IF_DEBUG("qtaguid: iface_stat: netdev_event(): "
947                  "ev=0x%lx netdev=%p->name=%s\n",
948                  event, dev, dev ? dev->name : "");
949
950         switch (event) {
951         case NETDEV_UP:
952                 iface_stat_create(dev, NULL);
953                 break;
954         case NETDEV_UNREGISTER:
955                 iface_stat_update(dev);
956                 break;
957         }
958         return NOTIFY_DONE;
959 }
960
961 static int iface_inet6addr_event_handler(struct notifier_block *nb,
962                                          unsigned long event, void *ptr)
963 {
964         struct inet6_ifaddr *ifa = ptr;
965         struct net_device *dev;
966
967         if (unlikely(module_passive))
968                 return NOTIFY_DONE;
969
970         IF_DEBUG("qtaguid: iface_stat: inet6addr_event(): "
971                  "ev=0x%lx ifa=%p\n",
972                  event, ifa);
973
974         switch (event) {
975         case NETDEV_UP:
976                 BUG_ON(!ifa || !ifa->idev);
977                 dev = (struct net_device *)ifa->idev->dev;
978                 iface_stat_create_ipv6(dev, ifa);
979                 atomic64_inc(&qtu_events.iface_events);
980                 break;
981         }
982         return NOTIFY_DONE;
983 }
984
985 static int iface_inetaddr_event_handler(struct notifier_block *nb,
986                                         unsigned long event, void *ptr)
987 {
988         struct in_ifaddr *ifa = ptr;
989         struct net_device *dev;
990
991         if (unlikely(module_passive))
992                 return NOTIFY_DONE;
993
994         IF_DEBUG("qtaguid: iface_stat: inetaddr_event(): "
995                  "ev=0x%lx ifa=%p\n",
996                  event, ifa);
997
998         switch (event) {
999         case NETDEV_UP:
1000                 BUG_ON(!ifa || !ifa->ifa_dev);
1001                 dev = ifa->ifa_dev->dev;
1002                 iface_stat_create(dev, ifa);
1003                 atomic64_inc(&qtu_events.iface_events);
1004                 break;
1005         }
1006         return NOTIFY_DONE;
1007 }
1008
1009 static struct notifier_block iface_netdev_notifier_blk = {
1010         .notifier_call = iface_netdev_event_handler,
1011 };
1012
1013 static struct notifier_block iface_inetaddr_notifier_blk = {
1014         .notifier_call = iface_inetaddr_event_handler,
1015 };
1016
1017 static struct notifier_block iface_inet6addr_notifier_blk = {
1018         .notifier_call = iface_inet6addr_event_handler,
1019 };
1020
1021 static int __init iface_stat_init(struct proc_dir_entry *parent_procdir)
1022 {
1023         int err;
1024
1025         iface_stat_procdir = proc_mkdir(iface_stat_procdirname, parent_procdir);
1026         if (!iface_stat_procdir) {
1027                 pr_err("qtaguid: iface_stat: init failed to create proc entry\n");
1028                 err = -1;
1029                 goto err;
1030         }
1031         err = register_netdevice_notifier(&iface_netdev_notifier_blk);
1032         if (err) {
1033                 pr_err("qtaguid: iface_stat: init "
1034                        "failed to register dev event handler\n");
1035                 goto err_zap_entry;
1036         }
1037         err = register_inetaddr_notifier(&iface_inetaddr_notifier_blk);
1038         if (err) {
1039                 pr_err("qtaguid: iface_stat: init "
1040                        "failed to register ipv4 dev event handler\n");
1041                 goto err_unreg_nd;
1042         }
1043
1044         err = register_inet6addr_notifier(&iface_inet6addr_notifier_blk);
1045         if (err) {
1046                 pr_err("qtaguid: iface_stat: init "
1047                        "failed to register ipv6 dev event handler\n");
1048                 goto err_unreg_ip4_addr;
1049         }
1050         return 0;
1051
1052 err_unreg_ip4_addr:
1053         unregister_inetaddr_notifier(&iface_inetaddr_notifier_blk);
1054 err_unreg_nd:
1055         unregister_netdevice_notifier(&iface_netdev_notifier_blk);
1056 err_zap_entry:
1057         remove_proc_entry(iface_stat_procdirname, parent_procdir);
1058 err:
1059         return err;
1060 }
1061
1062 static struct sock *qtaguid_find_sk(const struct sk_buff *skb,
1063                                     struct xt_action_param *par)
1064 {
1065         struct sock *sk;
1066         unsigned int hook_mask = (1 << par->hooknum);
1067
1068         MT_DEBUG("qtaguid: find_sk(skb=%p) hooknum=%d family=%d\n", skb,
1069                  par->hooknum, par->family);
1070
1071         /*
1072          * Let's not abuse the the xt_socket_get*_sk(), or else it will
1073          * return garbage SKs.
1074          */
1075         if (!(hook_mask & XT_SOCKET_SUPPORTED_HOOKS))
1076                 return NULL;
1077
1078         switch (par->family) {
1079         case NFPROTO_IPV6:
1080                 sk = xt_socket_get6_sk(skb, par);
1081                 break;
1082         case NFPROTO_IPV4:
1083                 sk = xt_socket_get4_sk(skb, par);
1084                 break;
1085         default:
1086                 return NULL;
1087         }
1088
1089         /*
1090          * Seems to be issues on the file ptr for TCP_TIME_WAIT SKs.
1091          * http://kerneltrap.org/mailarchive/linux-netdev/2010/10/21/6287959
1092          * Not fixed in 3.0-r3 :(
1093          */
1094         if (sk) {
1095                 MT_DEBUG("qtaguid: %p->sk_proto=%u "
1096                          "->sk_state=%d\n", sk, sk->sk_protocol, sk->sk_state);
1097                 if (sk->sk_state  == TCP_TIME_WAIT) {
1098                         xt_socket_put_sk(sk);
1099                         sk = NULL;
1100                 }
1101         }
1102         return sk;
1103 }
1104
1105 static void account_for_uid(const struct sk_buff *skb,
1106                             const struct sock *alternate_sk, uid_t uid,
1107                             struct xt_action_param *par)
1108 {
1109         const struct net_device *el_dev;
1110
1111         if (!skb->dev) {
1112                 MT_DEBUG("qtaguid[%d]: no skb->dev\n", par->hooknum);
1113                 el_dev = par->in ? : par->out;
1114         } else {
1115                 const struct net_device *other_dev;
1116                 el_dev = skb->dev;
1117                 other_dev = par->in ? : par->out;
1118                 if (el_dev != other_dev) {
1119                         MT_DEBUG("qtaguid[%d]: skb->dev=%p %s vs "
1120                                 "par->(in/out)=%p %s\n",
1121                                 par->hooknum, el_dev, el_dev->name, other_dev,
1122                                 other_dev->name);
1123                 }
1124         }
1125
1126         if (unlikely(!el_dev)) {
1127                 pr_info("qtaguid[%d]: no par->in/out?!!\n", par->hooknum);
1128         } else if (unlikely(!el_dev->name)) {
1129                 pr_info("qtaguid[%d]: no dev->name?!!\n", par->hooknum);
1130         } else {
1131                 MT_DEBUG("qtaguid[%d]: dev name=%s type=%d\n",
1132                          par->hooknum,
1133                          el_dev->name,
1134                          el_dev->type);
1135
1136                 if_tag_stat_update(el_dev->name, uid,
1137                                 skb->sk ? skb->sk : alternate_sk,
1138                                 par->in ? IFS_RX : IFS_TX,
1139                                 ip_hdr(skb)->protocol, skb->len);
1140         }
1141 }
1142
1143 static bool qtaguid_mt(const struct sk_buff *skb, struct xt_action_param *par)
1144 {
1145         const struct xt_qtaguid_match_info *info = par->matchinfo;
1146         const struct file *filp;
1147         bool got_sock = false;
1148         struct sock *sk;
1149         uid_t sock_uid;
1150         bool res;
1151
1152         if (unlikely(module_passive))
1153                 return (info->match ^ info->invert) == 0;
1154
1155         MT_DEBUG("qtaguid[%d]: entered skb=%p par->in=%p/out=%p fam=%d\n",
1156                  par->hooknum, skb, par->in, par->out, par->family);
1157
1158         if (skb == NULL) {
1159                 res = (info->match ^ info->invert) == 0;
1160                 goto ret_res;
1161         }
1162
1163         sk = skb->sk;
1164
1165         if (sk == NULL) {
1166                 /*
1167                  * A missing sk->sk_socket happens when packets are in-flight
1168                  * and the matching socket is already closed and gone.
1169                  */
1170                 sk = qtaguid_find_sk(skb, par);
1171                 /*
1172                  * If we got the socket from the find_sk(), we will need to put
1173                  * it back, as nf_tproxy_get_sock_v4() got it.
1174                  */
1175                 got_sock = sk;
1176                 if (sk)
1177                         atomic64_inc(&qtu_events.match_found_sk_in_ct);
1178         } else {
1179                 atomic64_inc(&qtu_events.match_found_sk);
1180         }
1181         MT_DEBUG("qtaguid[%d]: sk=%p got_sock=%d proto=%d\n",
1182                 par->hooknum, sk, got_sock, ip_hdr(skb)->protocol);
1183         if (sk != NULL) {
1184                 MT_DEBUG("qtaguid[%d]: sk=%p->sk_socket=%p->file=%p\n",
1185                         par->hooknum, sk, sk->sk_socket,
1186                         sk->sk_socket ? sk->sk_socket->file : (void *)-1LL);
1187                 filp = sk->sk_socket ? sk->sk_socket->file : NULL;
1188                 MT_DEBUG("qtaguid[%d]: filp...uid=%u\n",
1189                         par->hooknum, filp ? filp->f_cred->fsuid : -1);
1190         }
1191
1192         if (sk == NULL || sk->sk_socket == NULL) {
1193                 /*
1194                  * Here, the qtaguid_find_sk() using connection tracking
1195                  * couldn't find the owner, so for now we just count them
1196                  * against the system.
1197                  */
1198                 /*
1199                  * TODO: unhack how to force just accounting.
1200                  * For now we only do iface stats when the uid-owner is not
1201                  * requested.
1202                  */
1203                 if (!(info->match & XT_QTAGUID_UID))
1204                         account_for_uid(skb, sk, 0, par);
1205                 MT_DEBUG("qtaguid[%d]: leaving (sk?sk->sk_socket)=%p\n",
1206                         par->hooknum,
1207                         sk ? sk->sk_socket : NULL);
1208                 res = (info->match ^ info->invert) == 0;
1209                 atomic64_inc(&qtu_events.match_found_sk_none);
1210                 goto put_sock_ret_res;
1211         } else if (info->match & info->invert & XT_QTAGUID_SOCKET) {
1212                 res = false;
1213                 goto put_sock_ret_res;
1214         }
1215         filp = sk->sk_socket->file;
1216         if (filp == NULL) {
1217                 MT_DEBUG("qtaguid[%d]: leaving filp=NULL\n", par->hooknum);
1218                 res = ((info->match ^ info->invert) &
1219                         (XT_QTAGUID_UID | XT_QTAGUID_GID)) == 0;
1220                 goto put_sock_ret_res;
1221         }
1222         sock_uid = filp->f_cred->fsuid;
1223         /*
1224          * TODO: unhack how to force just accounting.
1225          * For now we only do iface stats when the uid-owner is not requested
1226          */
1227         if (!(info->match & XT_QTAGUID_UID))
1228                 account_for_uid(skb, sk, sock_uid, par);
1229
1230         /*
1231          * The following two tests fail the match when:
1232          *    id not in range AND no inverted condition requested
1233          * or id     in range AND    inverted condition requested
1234          * Thus (!a && b) || (a && !b) == a ^ b
1235          */
1236         if (info->match & XT_QTAGUID_UID)
1237                 if ((filp->f_cred->fsuid >= info->uid_min &&
1238                      filp->f_cred->fsuid <= info->uid_max) ^
1239                     !(info->invert & XT_QTAGUID_UID)) {
1240                         MT_DEBUG("qtaguid[%d]: leaving uid not matching\n",
1241                                  par->hooknum);
1242                         res = false;
1243                         goto put_sock_ret_res;
1244                 }
1245         if (info->match & XT_QTAGUID_GID)
1246                 if ((filp->f_cred->fsgid >= info->gid_min &&
1247                                 filp->f_cred->fsgid <= info->gid_max) ^
1248                         !(info->invert & XT_QTAGUID_GID)) {
1249                         MT_DEBUG("qtaguid[%d]: leaving gid not matching\n",
1250                                 par->hooknum);
1251                         res = false;
1252                         goto put_sock_ret_res;
1253                 }
1254
1255         MT_DEBUG("qtaguid[%d]: leaving matched\n", par->hooknum);
1256         res = true;
1257
1258 put_sock_ret_res:
1259         if (got_sock)
1260                 xt_socket_put_sk(sk);
1261 ret_res:
1262         MT_DEBUG("qtaguid[%d]: left %d\n", par->hooknum, res);
1263         return res;
1264 }
1265
1266 /*
1267  * Procfs reader to get all active socket tags using style "1)" as described in
1268  * fs/proc/generic.c
1269  */
1270 static int qtaguid_ctrl_proc_read(char *page, char **num_items_returned,
1271                                   off_t items_to_skip, int char_count, int *eof,
1272                                   void *data)
1273 {
1274         char *outp = page;
1275         int len;
1276         uid_t uid;
1277         struct sock_tag *sock_tag_entry;
1278         struct rb_node *node;
1279         int item_index = 0;
1280
1281         if (unlikely(module_passive)) {
1282                 *eof = 1;
1283                 return 0;
1284         }
1285
1286         /* TODO: support skipping num_items_returned on entry. */
1287         CT_DEBUG("qtaguid: proc ctrl page=%p off=%ld char_count=%d *eof=%d\n",
1288                 page, items_to_skip, char_count, *eof);
1289
1290         if (*eof)
1291                 return 0;
1292
1293         spin_lock_bh(&sock_tag_list_lock);
1294         for (node = rb_first(&sock_tag_tree);
1295              node;
1296              node = rb_next(node)) {
1297                 if (item_index++ < items_to_skip)
1298                         continue;
1299                 sock_tag_entry = rb_entry(node, struct sock_tag, sock_node);
1300                 uid = get_uid_from_tag(sock_tag_entry->tag);
1301                 CT_DEBUG("qtaguid: proc_read(): sk=%p tag=0x%llx (uid=%u)\n",
1302                          sock_tag_entry->sk,
1303                          sock_tag_entry->tag,
1304                          uid
1305                         );
1306                 len = snprintf(outp, char_count,
1307                                "sock=%p tag=0x%llx (uid=%u)\n",
1308                                sock_tag_entry->sk, sock_tag_entry->tag, uid);
1309                 if (len >= char_count) {
1310                         spin_unlock_bh(&sock_tag_list_lock);
1311                         *outp = '\0';
1312                         return outp - page;
1313                 }
1314                 outp += len;
1315                 char_count -= len;
1316                 (*num_items_returned)++;
1317         }
1318         spin_unlock_bh(&sock_tag_list_lock);
1319
1320         if (item_index++ >= items_to_skip) {
1321                 len = snprintf(outp, char_count,
1322                                "events: sockets_tagged=%llu "
1323                                "sockets_untagged=%llu "
1324                                "counter_set_changes=%llu "
1325                                "delete_cmds=%llu "
1326                                "iface_events=%llu "
1327                                "match_found_sk=%llu "
1328                                "match_found_sk_in_ct=%llu "
1329                                "match_found_sk_none=%llu\n",
1330                                atomic64_read(&qtu_events.sockets_tagged),
1331                                atomic64_read(&qtu_events.sockets_untagged),
1332                                atomic64_read(&qtu_events.counter_set_changes),
1333                                atomic64_read(&qtu_events.delete_cmds),
1334                                atomic64_read(&qtu_events.iface_events),
1335                                atomic64_read(&qtu_events.match_found_sk),
1336                                atomic64_read(&qtu_events.match_found_sk_in_ct),
1337                                atomic64_read(&qtu_events.match_found_sk_none));
1338                 if (len >= char_count) {
1339                         *outp = '\0';
1340                         return outp - page;
1341                 }
1342                 outp += len;
1343                 char_count -= len;
1344                 (*num_items_returned)++;
1345         }
1346
1347         *eof = 1;
1348         return outp - page;
1349 }
1350
1351 static bool can_manipulate_uids(void)
1352 {
1353         /* root pwnd */
1354         return unlikely(!current_fsuid()) || unlikely(!proc_ctrl_write_gid)
1355                 || in_egroup_p(proc_ctrl_write_gid);
1356 }
1357
1358 static bool can_impersonate_uid(uid_t uid)
1359 {
1360         return uid == current_fsuid() || can_manipulate_uids();
1361 }
1362
1363 static bool can_read_other_uid_stats(uid_t uid)
1364 {
1365         /* root pwnd */
1366         return unlikely(!current_fsuid()) || uid == current_fsuid()
1367                 || unlikely(!proc_stats_readall_gid)
1368                 || in_egroup_p(proc_stats_readall_gid);
1369 }
1370
1371 /*
1372  * Delete socket tags, and stat tags associated with a given
1373  * accouting tag and uid.
1374  */
1375 static int ctrl_cmd_delete(const char *input)
1376 {
1377         char cmd;
1378         uid_t uid;
1379         uid_t entry_uid;
1380         tag_t acct_tag;
1381         tag_t tag;
1382         int res, argc;
1383         struct iface_stat *iface_entry;
1384         struct rb_node *node;
1385         struct sock_tag *st_entry;
1386         struct rb_root st_to_free_tree = RB_ROOT;
1387         struct tag_stat *ts_entry;
1388         struct tag_counter_set *tcs_entry;
1389
1390         argc = sscanf(input, "%c %llu %u", &cmd, &acct_tag, &uid);
1391         CT_DEBUG("qtaguid: ctrl_delete(%s): argc=%d cmd=%c "
1392                  "user_tag=0x%llx uid=%u\n", input, argc, cmd,
1393                  acct_tag, uid);
1394         if (argc < 2) {
1395                 res = -EINVAL;
1396                 goto err;
1397         }
1398         if (!valid_atag(acct_tag)) {
1399                 pr_info("qtaguid: ctrl_delete(%s): invalid tag\n", input);
1400                 res = -EINVAL;
1401                 goto err;
1402         }
1403         if (argc < 3) {
1404                 uid = current_fsuid();
1405         } else if (!can_impersonate_uid(uid)) {
1406                 pr_info("qtaguid: ctrl_delete(%s): "
1407                         "insufficient priv from pid=%u uid=%u\n",
1408                         input, current->pid, current_fsuid());
1409                 res = -EPERM;
1410                 goto err;
1411         }
1412
1413         /* Delete socket tags */
1414         spin_lock_bh(&sock_tag_list_lock);
1415         node = rb_first(&sock_tag_tree);
1416         while (node) {
1417                 st_entry = rb_entry(node, struct sock_tag, sock_node);
1418                 entry_uid = get_uid_from_tag(st_entry->tag);
1419                 node = rb_next(node);
1420                 if (entry_uid != uid)
1421                         continue;
1422
1423                 if (!acct_tag || st_entry->tag == tag) {
1424                         rb_erase(&st_entry->sock_node, &sock_tag_tree);
1425                         /* Can't sockfd_put() within spinlock, do it later. */
1426                         sock_tag_tree_insert(st_entry, &st_to_free_tree);
1427                 }
1428         }
1429         spin_unlock_bh(&sock_tag_list_lock);
1430
1431         node = rb_first(&st_to_free_tree);
1432         while (node) {
1433                 st_entry = rb_entry(node, struct sock_tag, sock_node);
1434                 node = rb_next(node);
1435                 CT_DEBUG("qtaguid: ctrl_delete(): "
1436                          "erase st: sk=%p tag=0x%llx (uid=%u)\n",
1437                          st_entry->sk,
1438                          st_entry->tag,
1439                          entry_uid);
1440                 rb_erase(&st_entry->sock_node, &st_to_free_tree);
1441                 sockfd_put(st_entry->socket);
1442                 kfree(st_entry);
1443         }
1444
1445         tag = combine_atag_with_uid(acct_tag, uid);
1446
1447         /* Delete tag counter-sets */
1448         spin_lock_bh(&tag_counter_set_list_lock);
1449         tcs_entry = tag_counter_set_tree_search(&tag_counter_set_tree, tag);
1450         if (tcs_entry) {
1451                 CT_DEBUG("qtaguid: ctrl_delete(): "
1452                          "erase tcs: tag=0x%llx (uid=%u) set=%d\n",
1453                          tcs_entry->tn.tag,
1454                          get_uid_from_tag(tcs_entry->tn.tag),
1455                          tcs_entry->active_set);
1456                 rb_erase(&tcs_entry->tn.node, &tag_counter_set_tree);
1457                 kfree(tcs_entry);
1458         }
1459         spin_unlock_bh(&tag_counter_set_list_lock);
1460
1461         /*
1462          * If acct_tag is 0, then all entries belonging to uid are
1463          * erased.
1464          */
1465         spin_lock_bh(&iface_stat_list_lock);
1466         list_for_each_entry(iface_entry, &iface_stat_list, list) {
1467                 spin_lock_bh(&iface_entry->tag_stat_list_lock);
1468                 node = rb_first(&iface_entry->tag_stat_tree);
1469                 while (node) {
1470                         ts_entry = rb_entry(node, struct tag_stat, tn.node);
1471                         entry_uid = get_uid_from_tag(ts_entry->tn.tag);
1472                         node = rb_next(node);
1473                         if (entry_uid != uid)
1474                                 continue;
1475                         if (!acct_tag || ts_entry->tn.tag == tag) {
1476                                 CT_DEBUG("qtaguid: ctrl_delete(): "
1477                                          "erase ts: %s 0x%llx %u\n",
1478                                          iface_entry->ifname,
1479                                          get_atag_from_tag(ts_entry->tn.tag),
1480                                          entry_uid);
1481                                 rb_erase(&ts_entry->tn.node,
1482                                          &iface_entry->tag_stat_tree);
1483                                 kfree(ts_entry);
1484                         }
1485                 }
1486                 spin_unlock_bh(&iface_entry->tag_stat_list_lock);
1487         }
1488         spin_unlock_bh(&iface_stat_list_lock);
1489         atomic64_inc(&qtu_events.delete_cmds);
1490         res = 0;
1491
1492 err:
1493         return res;
1494 }
1495
1496 static int ctrl_cmd_counter_set(const char *input)
1497 {
1498         char cmd;
1499         uid_t uid = 0;
1500         tag_t tag;
1501         int res, argc;
1502         struct tag_counter_set *tcs;
1503         int counter_set;
1504
1505         argc = sscanf(input, "%c %d %u", &cmd, &counter_set, &uid);
1506         CT_DEBUG("qtaguid: ctrl_counterset(%s): argc=%d cmd=%c "
1507                  "set=%d uid=%u\n", input, argc, cmd,
1508                  counter_set, uid);
1509         if (argc != 3) {
1510                 res = -EINVAL;
1511                 goto err;
1512         }
1513         if (counter_set < 0 || counter_set >= IFS_MAX_COUNTER_SETS) {
1514                 pr_info("qtaguid: ctrl_counterset(%s): invalid counter_set range\n",
1515                         input);
1516                 res = -EINVAL;
1517                 goto err;
1518         }
1519         if (!can_manipulate_uids()) {
1520                 pr_info("qtaguid: ctrl_counterset(%s): "
1521                         "insufficient priv from pid=%u uid=%u\n",
1522                         input, current->pid, current_fsuid());
1523                 res = -EPERM;
1524                 goto err;
1525         }
1526
1527         tag = make_tag_from_uid(uid);
1528         spin_lock_bh(&tag_counter_set_list_lock);
1529         tcs = tag_counter_set_tree_search(&tag_counter_set_tree, tag);
1530         if (!tcs) {
1531                 tcs = kzalloc(sizeof(*tcs), GFP_ATOMIC);
1532                 if (!tcs) {
1533                         spin_unlock_bh(&tag_counter_set_list_lock);
1534                         pr_err("qtaguid: ctrl_counterset(%s): "
1535                                "failed to alloc counter set\n",
1536                                input);
1537                         res = -ENOMEM;
1538                         goto err;
1539                 }
1540                 tcs->tn.tag = tag;
1541                 tag_counter_set_tree_insert(tcs, &tag_counter_set_tree);
1542                 CT_DEBUG("qtaguid: ctrl_counterset(%s): added tcs tag=0x%llx "
1543                          "(uid=%u) set=%d\n",
1544                          input, tag, get_uid_from_tag(tag), counter_set);
1545         }
1546         tcs->active_set = counter_set;
1547         spin_unlock_bh(&tag_counter_set_list_lock);
1548         atomic64_inc(&qtu_events.counter_set_changes);
1549         res = 0;
1550
1551 err:
1552         return res;
1553 }
1554
1555 static int ctrl_cmd_tag(const char *input)
1556 {
1557         char cmd;
1558         int sock_fd = 0;
1559         uid_t uid = 0;
1560         tag_t acct_tag = 0;
1561         struct socket *el_socket;
1562         int refcnt = -1;
1563         int res, argc;
1564         struct sock_tag *sock_tag_entry;
1565
1566         /* Unassigned args will get defaulted later. */
1567         argc = sscanf(input, "%c %d %llu %u", &cmd, &sock_fd, &acct_tag, &uid);
1568         CT_DEBUG("qtaguid: ctrl_tag(%s): argc=%d cmd=%c sock_fd=%d "
1569                  "acct_tag=0x%llx uid=%u\n", input, argc, cmd, sock_fd,
1570                  acct_tag, uid);
1571         if (argc < 2) {
1572                 res = -EINVAL;
1573                 goto err;
1574         }
1575         el_socket = sockfd_lookup(sock_fd, &res);  /* This locks the file */
1576         if (!el_socket) {
1577                 pr_info("qtaguid: ctrl_tag(%s): failed to lookup"
1578                         " sock_fd=%d err=%d\n", input, sock_fd, res);
1579                 goto err;
1580         }
1581         refcnt = atomic_read(&el_socket->file->f_count);
1582         CT_DEBUG("qtaguid: ctrl_tag(%s): socket->...->f_count=%d\n",
1583                  input, refcnt);
1584         if (argc < 3) {
1585                 acct_tag = 0;
1586         } else if (!valid_atag(acct_tag)) {
1587                 pr_info("qtaguid: ctrl_tag(%s): invalid tag\n", input);
1588                 res = -EINVAL;
1589                 goto err_put;
1590         }
1591         CT_DEBUG("qtaguid: ctrl_tag(%s): "
1592                  "uid=%u euid=%u fsuid=%u "
1593                  "in_group=%d in_egroup=%d\n",
1594                  input, current_uid(), current_euid(), current_fsuid(),
1595                  in_group_p(proc_stats_readall_gid),
1596                  in_egroup_p(proc_stats_readall_gid));
1597         if (argc < 4) {
1598                 uid = current_fsuid();
1599         } else if (!can_impersonate_uid(uid)) {
1600                 pr_info("qtaguid: ctrl_tag(%s): "
1601                         "insufficient priv from pid=%u uid=%u\n",
1602                         input, current->pid, current_fsuid());
1603                 res = -EPERM;
1604                 goto err_put;
1605         }
1606
1607         spin_lock_bh(&sock_tag_list_lock);
1608         sock_tag_entry = get_sock_stat_nl(el_socket->sk);
1609         if (sock_tag_entry) {
1610                 /*
1611                  * This is a re-tagging, so release the sock_fd that was
1612                  * locked at the time of the 1st tagging.
1613                  */
1614                 sockfd_put(sock_tag_entry->socket);
1615                 refcnt--;
1616                 sock_tag_entry->tag = combine_atag_with_uid(acct_tag,
1617                                                             uid);
1618         } else {
1619                 sock_tag_entry = kzalloc(sizeof(*sock_tag_entry),
1620                                          GFP_ATOMIC);
1621                 if (!sock_tag_entry) {
1622                         pr_err("qtaguid: ctrl_tag(%s): "
1623                                "socket tag alloc failed\n",
1624                                input);
1625                         spin_unlock_bh(&sock_tag_list_lock);
1626                         res = -ENOMEM;
1627                         goto err_put;
1628                 }
1629                 sock_tag_entry->sk = el_socket->sk;
1630                 sock_tag_entry->socket = el_socket;
1631                 sock_tag_entry->tag = combine_atag_with_uid(acct_tag,
1632                                                             uid);
1633                 sock_tag_tree_insert(sock_tag_entry, &sock_tag_tree);
1634                 atomic64_inc(&qtu_events.sockets_tagged);
1635         }
1636         spin_unlock_bh(&sock_tag_list_lock);
1637         /* We keep the ref to the socket (file) until it is untagged */
1638         CT_DEBUG("qtaguid: ctrl_tag(%s): done. socket->...->f_count=%d\n",
1639                  input,
1640                  el_socket ? atomic_read(&el_socket->file->f_count) : -1);
1641         return 0;
1642
1643 err_put:
1644         /* Release the sock_fd that was grabbed by sockfd_lookup(). */
1645         sockfd_put(el_socket);
1646         refcnt--;
1647 err:
1648         CT_DEBUG("qtaguid: ctrl_tag(%s): done. socket->...->f_count=%d\n",
1649                  input, refcnt);
1650         return res;
1651 }
1652
1653 static int ctrl_cmd_untag(const char *input)
1654 {
1655         char cmd;
1656         int sock_fd = 0;
1657         struct socket *el_socket;
1658         int refcnt = -1;
1659         int res, argc;
1660         struct sock_tag *sock_tag_entry;
1661
1662         argc = sscanf(input, "%c %d", &cmd, &sock_fd);
1663         CT_DEBUG("qtaguid: ctrl_untag(%s): argc=%d cmd=%c sock_fd=%d\n",
1664                  input, argc, cmd, sock_fd);
1665         if (argc < 2) {
1666                 res = -EINVAL;
1667                 goto err;
1668         }
1669         el_socket = sockfd_lookup(sock_fd, &res);  /* This locks the file */
1670         if (!el_socket) {
1671                 pr_info("qtaguid: ctrl_untag(%s): failed to lookup"
1672                         " sock_fd=%d err=%d\n", input, sock_fd, res);
1673                 goto err;
1674         }
1675         refcnt = atomic_read(&el_socket->file->f_count);
1676         CT_DEBUG("qtaguid: ctrl_untag(%s): socket->...->f_count=%d\n",
1677                  input, refcnt);
1678         spin_lock_bh(&sock_tag_list_lock);
1679         sock_tag_entry = get_sock_stat_nl(el_socket->sk);
1680         if (!sock_tag_entry) {
1681                 spin_unlock_bh(&sock_tag_list_lock);
1682                 res = -EINVAL;
1683                 goto err_put;
1684         }
1685         /*
1686          * The socket already belongs to the current process
1687          * so it can do whatever it wants to it.
1688          */
1689         rb_erase(&sock_tag_entry->sock_node, &sock_tag_tree);
1690
1691         /*
1692          * Release the sock_fd that was grabbed at tag time,
1693          * and once more for the sockfd_lookup() here.
1694          */
1695         sockfd_put(sock_tag_entry->socket);
1696         spin_unlock_bh(&sock_tag_list_lock);
1697         sockfd_put(el_socket);
1698         refcnt -= 2;
1699         kfree(sock_tag_entry);
1700         atomic64_inc(&qtu_events.sockets_untagged);
1701         CT_DEBUG("qtaguid: ctrl_untag(%s): done. socket->...->f_count=%d\n",
1702                  input, refcnt);
1703
1704         return 0;
1705
1706 err_put:
1707         /* Release the sock_fd that was grabbed by sockfd_lookup(). */
1708         sockfd_put(el_socket);
1709         refcnt--;
1710 err:
1711         CT_DEBUG("qtaguid: ctrl_untag(%s): done. socket->...->f_count=%d\n",
1712                  input, refcnt);
1713         return res;
1714 }
1715
1716 static int qtaguid_ctrl_parse(const char *input, int count)
1717 {
1718         char cmd;
1719         int res;
1720
1721         cmd = input[0];
1722         /* Collect params for commands */
1723         switch (cmd) {
1724         case 'd':
1725                 res = ctrl_cmd_delete(input);
1726                 break;
1727
1728         case 's':
1729                 res = ctrl_cmd_counter_set(input);
1730                 break;
1731
1732         case 't':
1733                 res = ctrl_cmd_tag(input);
1734                 break;
1735
1736         case 'u':
1737                 res = ctrl_cmd_untag(input);
1738                 break;
1739
1740         default:
1741                 res = -EINVAL;
1742                 goto err;
1743         }
1744         if (!res)
1745                 res = count;
1746 err:
1747         CT_DEBUG("qtaguid: ctrl(%s): res=%d\n", input, res);
1748         return res;
1749 }
1750
1751 #define MAX_QTAGUID_CTRL_INPUT_LEN 255
1752 static int qtaguid_ctrl_proc_write(struct file *file, const char __user *buffer,
1753                         unsigned long count, void *data)
1754 {
1755         char input_buf[MAX_QTAGUID_CTRL_INPUT_LEN];
1756
1757         if (unlikely(module_passive))
1758                 return count;
1759
1760         if (count >= MAX_QTAGUID_CTRL_INPUT_LEN)
1761                 return -EINVAL;
1762
1763         if (copy_from_user(input_buf, buffer, count))
1764                 return -EFAULT;
1765
1766         input_buf[count] = '\0';
1767         return qtaguid_ctrl_parse(input_buf, count);
1768 }
1769
1770 struct proc_print_info {
1771         char *outp;
1772         char **num_items_returned;
1773         struct iface_stat *iface_entry;
1774         struct tag_stat *ts_entry;
1775         int item_index;
1776         int char_count;
1777 };
1778
1779 static int pp_stats_line(struct proc_print_info *ppi, int cnt_set)
1780 {
1781         int len;
1782         struct data_counters *cnts;
1783         if (!ppi->item_index) {
1784                 len = snprintf(ppi->outp, ppi->char_count,
1785                                "idx iface acct_tag_hex uid_tag_int cnt_set "
1786                                "rx_bytes rx_packets "
1787                                "tx_bytes tx_packets "
1788                                "rx_tcp_packets rx_tcp_bytes "
1789                                "rx_udp_packets rx_udp_bytes "
1790                                "rx_other_packets rx_other_bytes "
1791                                "tx_tcp_packets tx_tcp_bytes "
1792                                "tx_udp_packets tx_udp_bytes "
1793                                "tx_other_packets tx_other_bytes\n");
1794         } else {
1795                 tag_t tag = ppi->ts_entry->tn.tag;
1796                 uid_t stat_uid = get_uid_from_tag(tag);
1797                 if (!can_read_other_uid_stats(stat_uid)) {
1798                         CT_DEBUG("qtaguid: stats line: "
1799                                  "%s 0x%llx %u: "
1800                                  "insufficient priv from pid=%u uid=%u\n",
1801                                  ppi->iface_entry->ifname,
1802                                  get_atag_from_tag(tag), stat_uid,
1803                                  current->pid, current_fsuid());
1804                         return 0;
1805                 }
1806                 cnts = &ppi->ts_entry->counters;
1807                 len = snprintf(
1808                         ppi->outp, ppi->char_count,
1809                         "%d %s 0x%llx %u %u "
1810                         "%llu %llu "
1811                         "%llu %llu "
1812                         "%llu %llu "
1813                         "%llu %llu "
1814                         "%llu %llu "
1815                         "%llu %llu "
1816                         "%llu %llu "
1817                         "%llu %llu\n",
1818                         ppi->item_index,
1819                         ppi->iface_entry->ifname,
1820                         get_atag_from_tag(tag),
1821                         stat_uid,
1822                         cnt_set,
1823                         dc_sum_bytes(cnts, cnt_set, IFS_RX),
1824                         dc_sum_packets(cnts, cnt_set, IFS_RX),
1825                         dc_sum_bytes(cnts, cnt_set, IFS_TX),
1826                         dc_sum_packets(cnts, cnt_set, IFS_TX),
1827                         cnts->bpc[cnt_set][IFS_RX][IFS_TCP].bytes,
1828                         cnts->bpc[cnt_set][IFS_RX][IFS_TCP].packets,
1829                         cnts->bpc[cnt_set][IFS_RX][IFS_UDP].bytes,
1830                         cnts->bpc[cnt_set][IFS_RX][IFS_UDP].packets,
1831                         cnts->bpc[cnt_set][IFS_RX][IFS_PROTO_OTHER].bytes,
1832                         cnts->bpc[cnt_set][IFS_RX][IFS_PROTO_OTHER].packets,
1833                         cnts->bpc[cnt_set][IFS_TX][IFS_TCP].bytes,
1834                         cnts->bpc[cnt_set][IFS_TX][IFS_TCP].packets,
1835                         cnts->bpc[cnt_set][IFS_TX][IFS_UDP].bytes,
1836                         cnts->bpc[cnt_set][IFS_TX][IFS_UDP].packets,
1837                         cnts->bpc[cnt_set][IFS_TX][IFS_PROTO_OTHER].bytes,
1838                         cnts->bpc[cnt_set][IFS_TX][IFS_PROTO_OTHER].packets);
1839         }
1840         return len;
1841 }
1842
1843 bool pp_sets(struct proc_print_info *ppi)
1844 {
1845         int len;
1846         int counter_set;
1847         for (counter_set = 0; counter_set < IFS_MAX_COUNTER_SETS;
1848              counter_set++) {
1849                 len = pp_stats_line(ppi, counter_set);
1850                 if (len >= ppi->char_count) {
1851                         *ppi->outp = '\0';
1852                         return false;
1853                 }
1854                 if (len) {
1855                         ppi->outp += len;
1856                         ppi->char_count -= len;
1857                         (*ppi->num_items_returned)++;
1858                 }
1859         }
1860         return true;
1861 }
1862
1863 /*
1864  * Procfs reader to get all tag stats using style "1)" as described in
1865  * fs/proc/generic.c
1866  * Groups all protocols tx/rx bytes.
1867  */
1868 static int qtaguid_stats_proc_read(char *page, char **num_items_returned,
1869                                 off_t items_to_skip, int char_count, int *eof,
1870                                 void *data)
1871 {
1872         struct proc_print_info ppi;
1873         int len;
1874
1875         ppi.outp = page;
1876         ppi.item_index = 0;
1877         ppi.char_count = char_count;
1878         ppi.num_items_returned = num_items_returned;
1879
1880         if (unlikely(module_passive)) {
1881                 len = pp_stats_line(&ppi, 0);
1882                 /* The header should always be shorter than the buffer. */
1883                 WARN_ON(len >= ppi.char_count);
1884                 *eof = 1;
1885                 return len;
1886         }
1887
1888         CT_DEBUG("qtaguid:proc stats page=%p *num_items_returned=%p off=%ld "
1889                 "char_count=%d *eof=%d\n", page, *num_items_returned,
1890                 items_to_skip, char_count, *eof);
1891
1892         if (*eof)
1893                 return 0;
1894
1895         if (!items_to_skip) {
1896                 /* The idx is there to help debug when things go belly up. */
1897                 len = pp_stats_line(&ppi, 0);
1898                 /* Don't advance the outp unless the whole line was printed */
1899                 if (len >= ppi.char_count) {
1900                         *ppi.outp = '\0';
1901                         return ppi.outp - page;
1902                 }
1903                 ppi.outp += len;
1904                 ppi.char_count -= len;
1905         }
1906
1907         spin_lock_bh(&iface_stat_list_lock);
1908         list_for_each_entry(ppi.iface_entry, &iface_stat_list, list) {
1909                 struct rb_node *node;
1910                 spin_lock_bh(&ppi.iface_entry->tag_stat_list_lock);
1911                 for (node = rb_first(&ppi.iface_entry->tag_stat_tree);
1912                      node;
1913                      node = rb_next(node)) {
1914                         ppi.ts_entry = rb_entry(node, struct tag_stat, tn.node);
1915                         if (ppi.item_index++ < items_to_skip)
1916                                 continue;
1917                         if (!pp_sets(&ppi)) {
1918                                 spin_unlock_bh(
1919                                         &ppi.iface_entry->tag_stat_list_lock);
1920                                 spin_unlock_bh(&iface_stat_list_lock);
1921                                 return ppi.outp - page;
1922                         }
1923                 }
1924                 spin_unlock_bh(&ppi.iface_entry->tag_stat_list_lock);
1925         }
1926         spin_unlock_bh(&iface_stat_list_lock);
1927
1928         *eof = 1;
1929         return ppi.outp - page;
1930 }
1931
1932 /*------------------------------------------*/
1933 static int __init qtaguid_proc_register(struct proc_dir_entry **res_procdir)
1934 {
1935         int ret;
1936         *res_procdir = proc_mkdir(module_procdirname, init_net.proc_net);
1937         if (!*res_procdir) {
1938                 pr_err("qtaguid: failed to create proc/.../xt_qtaguid\n");
1939                 ret = -ENOMEM;
1940                 goto no_dir;
1941         }
1942
1943         xt_qtaguid_ctrl_file = create_proc_entry("ctrl", proc_ctrl_perms,
1944                                                 *res_procdir);
1945         if (!xt_qtaguid_ctrl_file) {
1946                 pr_err("qtaguid: failed to create xt_qtaguid/ctrl "
1947                         " file\n");
1948                 ret = -ENOMEM;
1949                 goto no_ctrl_entry;
1950         }
1951         xt_qtaguid_ctrl_file->read_proc = qtaguid_ctrl_proc_read;
1952         xt_qtaguid_ctrl_file->write_proc = qtaguid_ctrl_proc_write;
1953
1954         xt_qtaguid_stats_file = create_proc_entry("stats", proc_stats_perms,
1955                                                 *res_procdir);
1956         if (!xt_qtaguid_stats_file) {
1957                 pr_err("qtaguid: failed to create xt_qtaguid/stats "
1958                         "file\n");
1959                 ret = -ENOMEM;
1960                 goto no_stats_entry;
1961         }
1962         xt_qtaguid_stats_file->read_proc = qtaguid_stats_proc_read;
1963         /*
1964          * TODO: add support counter hacking
1965          * xt_qtaguid_stats_file->write_proc = qtaguid_stats_proc_write;
1966          */
1967         return 0;
1968
1969 no_stats_entry:
1970         remove_proc_entry("ctrl", *res_procdir);
1971 no_ctrl_entry:
1972         remove_proc_entry("xt_qtaguid", NULL);
1973 no_dir:
1974         return ret;
1975 }
1976
1977 static struct xt_match qtaguid_mt_reg __read_mostly = {
1978         /*
1979          * This module masquerades as the "owner" module so that iptables
1980          * tools can deal with it.
1981          */
1982         .name       = "owner",
1983         .revision   = 1,
1984         .family     = NFPROTO_UNSPEC,
1985         .match      = qtaguid_mt,
1986         .matchsize  = sizeof(struct xt_qtaguid_match_info),
1987         .me         = THIS_MODULE,
1988 };
1989
1990 static int __init qtaguid_mt_init(void)
1991 {
1992         if (qtaguid_proc_register(&xt_qtaguid_procdir)
1993             || iface_stat_init(xt_qtaguid_procdir)
1994             || xt_register_match(&qtaguid_mt_reg))
1995                 return -1;
1996         return 0;
1997 }
1998
1999 /*
2000  * TODO: allow unloading of the module.
2001  * For now stats are permanent.
2002  * Kconfig forces'y/n' and never an 'm'.
2003  */
2004
2005 module_init(qtaguid_mt_init);
2006 MODULE_AUTHOR("jpa <jpa@google.com>");
2007 MODULE_DESCRIPTION("Xtables: socket owner+tag matching and associated stats");
2008 MODULE_LICENSE("GPL");
2009 MODULE_ALIAS("ipt_owner");
2010 MODULE_ALIAS("ip6t_owner");
2011 MODULE_ALIAS("ipt_qtaguid");
2012 MODULE_ALIAS("ip6t_qtaguid");