Re: [v3 nf] netfilter: add counters support

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Ana,

First off, I'd suggest "netfilter: add named counter support" as title
since we already have nameless counters.

More comments below:

On Sat, Jan 31, 2015 at 12:51:41PM +0100, Ana Rey Botello wrote:
> diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
> index 9eaaa78..c400f06 100644
> --- a/include/net/netfilter/nf_tables.h
> +++ b/include/net/netfilter/nf_tables.h
> @@ -408,6 +408,16 @@ struct nft_trans {
>  	char				data[0];
>  };
>  
> +struct nft_trans_counter {
> +	struct nft_named_ctr	*counter;
> +	u32			counter_id;
> +};
> +
> +#define nft_trans_counter(trans)	\
> +	(((struct nft_trans_counter *)trans->data)->counter)
> +#define nft_trans_counter_id(trans)	\
> +	(((struct nft_trans_counter *)trans->data)->counter_id)
> +
>  struct nft_trans_rule {
>  	struct nft_rule			*rule;
>  };
> @@ -572,6 +582,7 @@ unsigned int nft_do_chain(struct nft_pktinfo *pkt,
>   *	@list: used internally
>   *	@chains: chains in the table
>   *	@sets: sets in the table
> + *	@counters: counters in the table
>   *	@hgenerator: handle generator state
>   *	@use: number of chain references to this table
>   *	@flags: table flag (see enum nft_table_flags)
> @@ -581,6 +592,7 @@ struct nft_table {
>  	struct list_head		list;
>  	struct list_head		chains;
>  	struct list_head		sets;
> +	struct list_head		counters;
>  	u64				hgenerator;
>  	u32				use;
>  	u16				flags;
> @@ -639,6 +651,41 @@ void nft_unregister_chain_type(const struct nf_chain_type *);
>  int nft_register_expr(struct nft_expr_type *);
>  void nft_unregister_expr(struct nft_expr_type *);
>  
> +/**
> + * struct nft_counter - nf_tables counter_priv instance
> + *
> + * @pkts:  number of packets
> + * @bytes:  number of bytes
> + */
> +struct nft_counter {
> +	seqlock_t	lock;
> +	u64		bytes;
> +	u64		packets;
> +};
> +
> +/**
> + * struct nft_named_ctr - nf_tables counter instance
> + *
> + * @list: table counter list node
> + * @name: name of the counter
> + * @counter:  nft_priv_counter
> + * @bytes:  number of bytes
> + * @use: number of rule references to this counter
> + * @flags: counter flags
> + */
> +struct nft_named_ctr {
> +	struct list_head	list;
> +	char			name[NFT_CTR_MAXNAMELEN];
> +	struct nft_counter	counter;
> +	u32			use:31,
> +				flags:1;
> +};
> +
> +struct nft_named_ctr *nft_counter_lookup(const struct nft_ctx *ctx,
> +				       const char *counter_name);
> +void nft_counter_put(struct nft_named_ctr *counter);
> +int nft_counter_get(struct nft_named_ctr *counter);
> +
>  #define nft_dereference(p)					\
>  	nfnl_dereference(p, NFNL_SUBSYS_NFTABLES)
>  
> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> index 832bc46..127a8bd 100644
> --- a/include/uapi/linux/netfilter/nf_tables.h
> +++ b/include/uapi/linux/netfilter/nf_tables.h
> @@ -2,6 +2,7 @@
>  #define _LINUX_NF_TABLES_H
>  
>  #define NFT_CHAIN_MAXNAMELEN	32
> +#define NFT_CTR_MAXNAMELEN	16
>  #define NFT_USERDATA_MAXLEN	256
>  
>  enum nft_registers {
> @@ -53,6 +54,10 @@ enum nft_verdicts {
>   * @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes)
>   * @NFT_MSG_NEWGEN: announce a new generation, only for events (enum nft_gen_attributes)
>   * @NFT_MSG_GETGEN: get the rule-set generation (enum nft_gen_attributes)
> + * @NFT_MSG_NEWCOUNTER: create a new counter (enum nft_named_ctr_attributes)
> + * @NFT_MSG_GETCOUNTER: get a counter (enum nft_named_ctr_attributes)
> + * @NFT_MSG_GETCOUNTER_ZERO: get a reset counter (enum nft_named_ctr_attributes)
> + * @NFT_MSG_DELCOUNTER: delete a counter (enum nft_named_ctr_attributes)
>   */
>  enum nf_tables_msg_types {
>  	NFT_MSG_NEWTABLE,
> @@ -72,6 +77,10 @@ enum nf_tables_msg_types {
>  	NFT_MSG_DELSETELEM,
>  	NFT_MSG_NEWGEN,
>  	NFT_MSG_GETGEN,
> +	NFT_MSG_NEWCOUNTER,
> +	NFT_MSG_GETCOUNTER,
> +	NFT_MSG_GETCOUNTER_ZERO,
> +	NFT_MSG_DELCOUNTER,
>  	NFT_MSG_MAX,
>  };
>  
> @@ -695,16 +704,40 @@ enum nft_limit_attributes {
>   *
>   * @NFTA_COUNTER_BYTES: number of bytes (NLA_U64)
>   * @NFTA_COUNTER_PACKETS: number of packets (NLA_U64)
> + * @NFTA_COUNTER_NAME: name of the counter (NLA_STRING)
>   */
>  enum nft_counter_attributes {
>  	NFTA_COUNTER_UNSPEC,
>  	NFTA_COUNTER_BYTES,
>  	NFTA_COUNTER_PACKETS,
> +	NFTA_COUNTER_NAME,
>  	__NFTA_COUNTER_MAX
>  };
>  #define NFTA_COUNTER_MAX	(__NFTA_COUNTER_MAX - 1)
>  
>  /**
> + * enum nft_named_ctr_attributes - nf_tables named counter netlink attributes
> + *
> + * @NFTA_NAMED_CTR_NAME: named counter name (NLA_STRING)
> + * @NFTA_NAMED_CTR_TABLE: table name (NLA_STRING)
> + * @NFTA_NAMED_CTR_USE: number of references to this named counter (NLA_U32)
> + * @NFTA_NAMED_CTR_ID: uniquely identifies a named counter in a transaction (NLA_U32)
> + * @NFTA_NAMED_CTR_BYTES: number of bytes (NLA_U64)
> + * @NFTA_NAMED_CTR_PACKETS: number of packets (NLA_U64)
> + */
> +enum nft_named_ctr_attributes {
> +	NFTA_NAMED_CTR_UNSPEC,
> +	NFTA_NAMED_CTR_NAME,
> +	NFTA_NAMED_CTR_TABLE,
> +	NFTA_NAMED_CTR_USE,
> +	NFTA_NAMED_CTR_ID,

You can safely remove NFTA_NAMED_CTR_ID and any code that is related.

In sets, this makes sense because we have anonymous sets that have no
name yet assigned so the ID provides a way to link sets without named
to the rule that uses this for first time. Things are different with
named counters since they always have to come with a name.

> +	NFTA_NAMED_CTR_BYTES,
> +	NFTA_NAMED_CTR_PACKETS,
> +	__NFTA_NAMED_CTR_MAX
> +};
> +#define NFTA_NAMED_CTR_MAX	(__NFTA_NAMED_CTR_MAX - 1)
> +
> +/**
>   * enum nft_log_attributes - nf_tables log expression netlink attributes
>   *
>   * @NFTA_LOG_GROUP: netlink group to send messages to (NLA_U32)
> @@ -867,4 +900,5 @@ enum nft_gen_attributes {
>  };
>  #define NFTA_GEN_MAX		(__NFTA_GEN_MAX - 1)
>  
> +
>  #endif /* _LINUX_NF_TABLES_H */

Remove this new empty line.

> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index 7e68694..fde06ac 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -325,6 +325,43 @@ static int nft_delset(struct nft_ctx *ctx, struct nft_set *set)
>  	return err;
>  }
>  
> +#define NFT_NAMED_CTR_INACTIVE		(1 << 0)
> +
> +static int nft_trans_counter_add(struct nft_ctx *ctx, int msg_type,
> +				 struct nft_named_ctr *counter)
> +{
> +	struct nft_trans *trans;
> +
> +	trans = nft_trans_alloc(ctx, msg_type,
> +				sizeof(struct nft_trans_counter));
> +	if (!trans)
> +		return -ENOMEM;
> +
> +	if (msg_type == NFT_MSG_NEWCOUNTER && ctx->nla[NFTA_NAMED_CTR_ID]) {
> +		nft_trans_counter_id(trans) =
> +			ntohl(nla_get_be32(ctx->nla[NFTA_NAMED_CTR_ID]));
> +		counter->flags |= NFT_NAMED_CTR_INACTIVE;
> +	}
> +	nft_trans_counter(trans) = counter;
> +	list_add_tail(&trans->list, &ctx->net->nft.commit_list);
> +
> +	return 0;
> +}
> +
> +static int nft_delcounter(struct nft_ctx *ctx, struct nft_named_ctr *counter)
> +{
> +	int err;
> +
> +	err = nft_trans_counter_add(ctx, NFT_MSG_DELCOUNTER, counter);
> +	if (err < 0)
> +		return err;
> +
> +	list_del_rcu(&counter->list);
> +	ctx->table->use--;
> +
> +	return err;
> +}
> +
>  /*
>   * Tables
>   */
> @@ -694,6 +731,7 @@ static int nf_tables_newtable(struct sock *nlsk, struct sk_buff *skb,
>  	nla_strlcpy(table->name, name, nla_len(name));
>  	INIT_LIST_HEAD(&table->chains);
>  	INIT_LIST_HEAD(&table->sets);
> +	INIT_LIST_HEAD(&table->counters);
>  	table->flags = flags;
>  
>  	nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla);
> @@ -712,6 +750,7 @@ static int nft_flush_table(struct nft_ctx *ctx)
>  	int err;
>  	struct nft_chain *chain, *nc;
>  	struct nft_set *set, *ns;
> +	struct nft_named_ctr *counter, *na;
>  
>  	list_for_each_entry(chain, &ctx->table->chains, list) {
>  		ctx->chain = chain;
> @@ -730,7 +769,11 @@ static int nft_flush_table(struct nft_ctx *ctx)
>  		if (err < 0)
>  			goto out;
>  	}
> -
> +	list_for_each_entry_safe(counter, na, &ctx->table->counters, list) {
> +		err = nft_delcounter(ctx, counter);
> +		if (err < 0)
> +			goto out;
> +	}
>  	list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
>  		ctx->chain = chain;
>  
> @@ -3386,6 +3429,404 @@ err:
>  	return err;
>  }
>  
> +static const struct nla_policy nft_named_ctr_policy[NFTA_NAMED_CTR_MAX + 1] = {
> +	[NFTA_NAMED_CTR_NAME]		= { .type = NLA_NUL_STRING,
> +					    .len = NFT_CTR_MAXNAMELEN - 1 },
> +	[NFTA_NAMED_CTR_BYTES]		= { .type = NLA_U64 },
> +	[NFTA_NAMED_CTR_PACKETS]	= { .type = NLA_U64 },
> +	[NFTA_NAMED_CTR_ID]		= { .type = NLA_U32 },
> +};
> +
> +static struct
> +nft_named_ctr *nf_tables_counter_lookup(const struct nft_table *table,
> +					const struct nlattr *nla)
> +{
> +	struct nft_named_ctr *counter;
> +
> +	if (!nla)
> +		return ERR_PTR(-EINVAL);
> +	list_for_each_entry(counter, &table->counters, list) {
> +		if (!nla_strcmp(nla, counter->name))
> +			return counter;
> +	}
> +
> +	return ERR_PTR(-ENOENT);
> +}
> +
> +struct nft_named_ctr *nft_counter_lookup(const struct nft_ctx *ctx,
> +					 const char *counter_name)
> +{
> +	struct nft_named_ctr *cur, *counter = NULL;
> +	struct nft_table *table = ctx->table;
> +
> +	list_for_each_entry(cur, &table->counters, list) {
> +		if (strncmp(cur->name, counter_name, NFT_CTR_MAXNAMELEN) == 0)
> +			return cur;
> +	}
> +
> +	return counter;
> +}
> +EXPORT_SYMBOL_GPL(nft_counter_lookup);

You can remove this nft_counter_lookup(). Instead, you can export
nf_tables_counter_lookup() and use it from nft_counter.c, that change
should be easy.

> +static int nft_ctx_init_from_counter(struct nft_ctx *ctx,
> +				     const struct sk_buff *skb,
> +				     const struct nlmsghdr *nlh,
> +				     const struct nlattr * const nla[])
> +{
> +	struct net *net = sock_net(skb->sk);
> +	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
> +	struct nft_af_info *afi = NULL;
> +	struct nft_table *table = NULL;
> +
> +	if (nfmsg->nfgen_family != NFPROTO_UNSPEC) {
> +		afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
> +		if (IS_ERR(afi))
> +			return PTR_ERR(afi);
> +	}
> +
> +	if (nla[NFTA_NAMED_CTR_TABLE]) {
> +		if (!afi)
> +			return -EAFNOSUPPORT;
> +
> +		table = nf_tables_table_lookup(afi, nla[NFTA_NAMED_CTR_TABLE]);
> +		if (IS_ERR(table))
> +			return PTR_ERR(table);
> +		if (table->flags & NFT_TABLE_INACTIVE)
> +			return -ENOENT;
> +	}
> +
> +	nft_ctx_init(ctx, skb, nlh, afi, table, NULL, nla);
> +
> +	return 0;
> +}
> +
> +static int nf_tables_newcounter(struct sock *nlsk, struct sk_buff *skb,
> +				const struct nlmsghdr *nlh,
> +				const struct nlattr * const nla[])
> +{
> +	struct nft_ctx ctx;
> +	const struct nlattr *name;
> +	struct nft_named_ctr *counter, *matching;
> +	int err;
> +
> +	if (!nla[NFTA_NAMED_CTR_NAME] || !nla[NFTA_NAMED_CTR_TABLE])
> +		return -EINVAL;
> +
> +	err = nft_ctx_init_from_counter(&ctx, skb, nlh, nla);
> +	if (err < 0)
> +		return err;

You have to add here:

        if (table->use == UINT_MAX)
                return -EOVERFLOW;

> +	matching = nf_tables_counter_lookup(ctx.table,
> +					    nla[NFTA_NAMED_CTR_NAME]);
> +	if (!IS_ERR(matching)) {
> +		if (nlh->nlmsg_flags & NLM_F_EXCL)
> +			return -EEXIST;
> +		if (nlh->nlmsg_flags & NLM_F_REPLACE)
> +			return -EOPNOTSUPP;
> +		else
> +			return -EOPNOTSUPP;

You can simply return -EOPNOTSUPP, no need to check for the replace
flag.

> +	}
> +
> +	if (!(nlh->nlmsg_flags & NLM_F_CREATE))
> +		return -ENOENT;
> +
> +	counter = kzalloc(sizeof(*counter), GFP_KERNEL);
> +	if (!counter)
> +		return -ENOMEM;
> +
> +	name = nla[NFTA_NAMED_CTR_NAME];
> +	nla_strlcpy(counter->name, name, NFT_CTR_MAXNAMELEN);
> +
> +	if (nla[NFTA_NAMED_CTR_BYTES]) {
> +		counter->counter.bytes =
> +			be64_to_cpu(nla_get_be64(nla[NFTA_NAMED_CTR_BYTES]));
> +	}
> +
> +	if (nla[NFTA_NAMED_CTR_PACKETS]) {
> +		counter->counter.packets =
> +			be64_to_cpu(nla_get_be64(nla[NFTA_NAMED_CTR_PACKETS]));
> +	}
> +
> +	seqlock_init(&counter->counter.lock);
> +
> +	err = nft_trans_counter_add(&ctx, NFT_MSG_NEWCOUNTER, counter);
> +	if (err < 0)
> +		goto err;
> +
> +	list_add_tail_rcu(&counter->list, &ctx.table->counters);
> +	ctx.table->use++;
> +
> +	return 0;
> +err:
> +	kfree(counter);
> +	return err;
> +}
> +
> +static int nf_tables_fill_counter(struct sk_buff *skb,
> +				  const struct nft_ctx *ctx,
> +				  struct nft_named_ctr *counter,
> +				  u16 event, u16 flags, u32 type)
> +{
> +	struct nfgenmsg *nfmsg;
> +	struct nlmsghdr *nlh;
> +	u32 portid = ctx->portid;
> +	u32 seq = ctx->seq;
> +	u64 pkts, bytes;
> +
> +	event |= NFNL_SUBSYS_NFTABLES << 8;
> +	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
> +			flags);
> +	if (!nlh)
> +		goto nla_put_failure;
> +
> +	nfmsg = nlmsg_data(nlh);
> +	nfmsg->nfgen_family	= ctx->afi->family;
> +	nfmsg->version		= NFNETLINK_V0;
> +	nfmsg->res_id		= htons(ctx->net->nft.base_seq & 0xffff);
> +
> +	if (type == NFT_MSG_GETCOUNTER_ZERO) {
> +		write_seqlock_bh(&counter->counter.lock);

Add this missing code here:

                pkts = counter->counter.packets;
                bytes = counter->counter.bytes;

> +		counter->counter.bytes = 0;
> +		counter->counter.packets = 0;
> +		write_sequnlock_bh(&counter->counter.lock);
> +	} else {
> +		do {
> +			seq = read_seqbegin(&counter->counter.lock);
> +			bytes	= counter->counter.bytes;
> +			pkts	= counter->counter.packets;
> +		} while (read_seqretry(&counter->counter.lock, seq));
> +	}
> +
> +	if (nla_put_string(skb, NFTA_NAMED_CTR_TABLE, ctx->table->name) ||
> +	    nla_put_string(skb, NFTA_NAMED_CTR_NAME, counter->name) ||
> +	    nla_put_be64(skb, NFTA_NAMED_CTR_PACKETS, cpu_to_be64(pkts)) ||
> +	    nla_put_be64(skb, NFTA_NAMED_CTR_BYTES, cpu_to_be64(bytes)) ||
> +	    nla_put_be32(skb, NFTA_NAMED_CTR_USE, htonl(counter->use)))
> +		goto nla_put_failure;
> +
> +	return nlmsg_end(skb, nlh);
> +
> +nla_put_failure:
> +	nlmsg_trim(skb, nlh);
> +	return -1;
> +}
> +
> +static int nf_tables_counter_notify(const struct nft_ctx *ctx,
> +				    struct nft_named_ctr *counter,
> +				    int event, gfp_t gfp_flags)
> +{
> +	struct sk_buff *skb;
> +	u32 portid = ctx->portid;
> +	int err;
> +
> +	if (!ctx->report &&
> +	    !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
> +		return 0;
> +
> +	err = -ENOBUFS;
> +	skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
> +	if (!skb)
> +		goto err;
> +
> +	err = nf_tables_fill_counter(skb, ctx, counter, event, 0, 0);
> +	if (err < 0) {
> +		kfree_skb(skb);
> +		goto err;
> +	}
> +
> +	err = nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES,
> +			     ctx->report, gfp_flags);
> +err:
> +	if (err < 0)
> +		nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, err);
> +	return err;
> +}
> +
> +static int nf_tables_delcounter(struct sock *nlsk, struct sk_buff *skb,
> +				const struct nlmsghdr *nlh,
> +				const struct nlattr * const nla[])
> +{
> +	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
> +	struct nft_named_ctr *counter;
> +	struct nft_ctx ctx;
> +	int err;
> +
> +	if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
> +		return -EAFNOSUPPORT;
> +	if (!nla[NFTA_NAMED_CTR_TABLE])
> +		return -EINVAL;
> +
> +	err = nft_ctx_init_from_counter(&ctx, skb, nlh, nla);
> +	if (err < 0)
> +		return err;
> +
> +	counter = nf_tables_counter_lookup(ctx.table, nla[NFTA_NAMED_CTR_NAME]);
> +	if (IS_ERR(counter))
> +		return PTR_ERR(counter);
> +	if (counter->flags & NFT_NAMED_CTR_INACTIVE)
> +		return -ENOENT;
> +	if (counter->use > 0)
> +		return -EBUSY;
> +
> +	return nft_delcounter(&ctx, counter);
> +}
> +
> +static int nf_tables_dump_counter(struct sk_buff *skb,
> +				  struct netlink_callback *cb)
> +{
> +	struct nft_named_ctr *counter;
> +	unsigned int idx, s_idx = cb->args[0];
> +	struct nft_af_info *afi;
> +	struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
> +	struct net *net = sock_net(skb->sk);
> +	int cur_family = cb->args[3];
> +	struct nft_ctx *ctx = cb->data, ctx_counter;
> +
> +	if (cb->args[1])
> +		return skb->len;
> +
> +	rcu_read_lock();
> +	cb->seq = net->nft.base_seq;
> +	list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
> +		if (ctx->afi && ctx->afi != afi)
> +			continue;
> +
> +		if (cur_family) {
> +			if (afi->family != cur_family)
> +				continue;
> +
> +			cur_family = 0;
> +		}
> +		list_for_each_entry_rcu(table, &afi->tables, list) {
> +			if (ctx->table && ctx->table != table)
> +				continue;
> +
> +			if (cur_table) {
> +				if (cur_table != table)
> +					continue;
> +
> +				cur_table = NULL;
> +			}
> +			idx = 0;
> +			list_for_each_entry_rcu(counter, &table->counters,
> +						list) {
> +				if (idx < s_idx)
> +					goto cont;
> +
> +				ctx_counter = *ctx;
> +				ctx_counter.table = table;
> +				ctx_counter.afi = afi;
> +				if (nf_tables_fill_counter(skb, &ctx_counter,
> +							   counter,
> +							   NFT_MSG_NEWCOUNTER,
> +							   NLM_F_MULTI,
> +							   0) < 0) {
> +					cb->args[0] = idx;
> +					cb->args[2] = (unsigned long)table;
> +					cb->args[3] = afi->family;
> +					goto done;
> +				}
> +				nl_dump_check_consistent(cb, nlmsg_hdr(skb));
> +cont:
> +				idx++;
> +			}
> +			if (s_idx)
> +				s_idx = 0;
> +		}
> +	}
> +	cb->args[1] = 1;
> +done:
> +	rcu_read_unlock();
> +	return skb->len;
> +}
> +
> +static int nf_tables_dump_counter_done(struct netlink_callback *cb)
> +{
> +	kfree(cb->data);
> +
> +	return 0;
> +}
> +
> +static int nf_tables_getcounter(struct sock *nlsk, struct sk_buff *skb,
> +				const struct nlmsghdr *nlh,
> +				const struct nlattr * const nla[])
> +{
> +	struct nft_ctx ctx;
> +	struct sk_buff *skb2;
> +	int err, ret;
> +	struct nft_named_ctr *counter;
> +	const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
> +
> +	/* Verify existence before starting dump */
> +	err = nft_ctx_init_from_counter(&ctx, skb, nlh, nla);
> +	if (err < 0)
> +		return err;
> +
> +	if (nlh->nlmsg_flags & NLM_F_DUMP) {
> +		struct netlink_dump_control c = {
> +			.dump = nf_tables_dump_counter,
> +			.done = nf_tables_dump_counter_done,
> +		};
> +		struct nft_ctx *ctx_dump;
> +
> +		ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_KERNEL);
> +		if (!ctx_dump)
> +			return -ENOMEM;
> +
> +		*ctx_dump = ctx;
> +		c.data = ctx_dump;
> +
> +		return netlink_dump_start(nlsk, skb, nlh, &c);
> +	}
> +
> +	/* Only accept unspec with dump */
> +	if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
> +		return -EAFNOSUPPORT;
> +
> +	counter = nf_tables_counter_lookup(ctx.table, nla[NFTA_NAMED_CTR_NAME]);
> +	if (IS_ERR(counter))
> +		return PTR_ERR(counter);
> +
> +	if (counter->flags & NFT_NAMED_CTR_INACTIVE)
> +		return -ENOENT;
> +
> +	skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
> +	if (!skb2)
> +		return -ENOMEM;
> +
> +	err = nf_tables_fill_counter(skb2, &ctx, counter, NFT_MSG_NEWCOUNTER, 0,
> +				     NFNL_MSG_TYPE(nlh->nlmsg_type));
> +	if (err < 0)
> +		goto err;
> +
> +	ret = nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
> +
> +	/* this avoids a loop in nfnetlink. */
> +	return ret == -EAGAIN ? -ENOBUFS : ret;
> +
> +err:
> +	kfree_skb(skb2);
> +	return err;
> +}
> +
> +void nft_counter_put(struct nft_named_ctr *counter)
> +{
> +	counter->use--;
> +	module_put(THIS_MODULE);
> +}
> +EXPORT_SYMBOL_GPL(nft_counter_put);
> +
> +int nft_counter_get(struct nft_named_ctr *counter)
> +{
> +	if (!try_module_get(THIS_MODULE))
> +		return -ENOENT;
> +

Add here:

        if (counter->use == UINT_MAX)
                return -EOVERFLOW;

> +	counter->use++;
> +
> +	return 0;
> +}
> +EXPORT_SYMBOL_GPL(nft_counter_get);
>
>  static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
>  	[NFT_MSG_NEWTABLE] = {
>  		.call_batch	= nf_tables_newtable,
> @@ -3465,6 +3906,26 @@ static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
>  	[NFT_MSG_GETGEN] = {
>  		.call		= nf_tables_getgen,
>  	},
> +	[NFT_MSG_NEWCOUNTER] = {
> +		.call_batch	= nf_tables_newcounter,
> +		.attr_count	= NFTA_NAMED_CTR_MAX,
> +		.policy		= nft_named_ctr_policy,
> +	},
> +	[NFT_MSG_GETCOUNTER] = {
> +		.call		= nf_tables_getcounter,
> +		.attr_count	= NFTA_NAMED_CTR_MAX,
> +		.policy		= nft_named_ctr_policy,
> +	},
> +	[NFT_MSG_GETCOUNTER_ZERO] = {
> +		.call		= nf_tables_getcounter,
> +		.attr_count	= NFTA_NAMED_CTR_MAX,
> +		.policy		= nft_named_ctr_policy,
> +	},
> +	[NFT_MSG_DELCOUNTER] = {
> +		.call_batch	= nf_tables_delcounter,
> +		.attr_count	= NFTA_NAMED_CTR_MAX,
> +		.policy		= nft_named_ctr_policy,
> +	},
>  };
>  
>  static void nft_chain_commit_update(struct nft_trans *trans)
> @@ -3503,6 +3964,9 @@ static void nf_tables_commit_release(struct nft_trans *trans)
>  	case NFT_MSG_DELSET:
>  		nft_set_destroy(nft_trans_set(trans));
>  		break;
> +	case NFT_MSG_DELCOUNTER:
> +		kfree(nft_trans_counter(trans));
> +		break;
>  	}
>  	kfree(trans);
>  }
> @@ -3608,6 +4072,20 @@ static int nf_tables_commit(struct sk_buff *skb)
>  			}
>  			nft_trans_destroy(trans);
>  			break;
> +		case NFT_MSG_NEWCOUNTER:
> +			nft_trans_counter(trans)->flags &= ~NFT_NAMED_CTR_INACTIVE;
> +			nf_tables_counter_notify(&trans->ctx,
> +						 nft_trans_counter(trans),
> +						 NFT_MSG_NEWCOUNTER,
> +						 GFP_KERNEL);
> +			nft_trans_destroy(trans);
> +			break;
> +		case NFT_MSG_DELCOUNTER:
> +			nf_tables_counter_notify(&trans->ctx,
> +						 nft_trans_counter(trans),
> +						 NFT_MSG_DELCOUNTER,
> +						 GFP_KERNEL);
> +			break;
>  		}
>  	}
>  
> @@ -3638,6 +4116,9 @@ static void nf_tables_abort_release(struct nft_trans *trans)
>  	case NFT_MSG_NEWSET:
>  		nft_set_destroy(nft_trans_set(trans));
>  		break;
> +	case NFT_MSG_NEWCOUNTER:
> +		kfree(nft_trans_counter(trans));
> +		break;
>  	}
>  	kfree(trans);
>  }
> @@ -3716,6 +4197,16 @@ static int nf_tables_abort(struct sk_buff *skb)
>  			nft_trans_elem_set(trans)->nelems++;
>  			nft_trans_destroy(trans);
>  			break;
> +		case NFT_MSG_NEWCOUNTER:
> +			trans->ctx.table->use--;
> +			list_del_rcu(&nft_trans_counter(trans)->list);
> +			break;
> +		case NFT_MSG_DELCOUNTER:
> +			trans->ctx.table->use++;
> +			list_add_tail_rcu(&nft_trans_counter(trans)->list,
> +					  &trans->ctx.table->counters);
> +			nft_trans_destroy(trans);
> +			break;
>  		}
>  	}
>  
> diff --git a/net/netfilter/nft_counter.c b/net/netfilter/nft_counter.c
> index c89ee48..41a4cdf 100644
> --- a/net/netfilter/nft_counter.c
> +++ b/net/netfilter/nft_counter.c
> @@ -17,10 +17,8 @@
>  #include <linux/netfilter/nf_tables.h>
>  #include <net/netfilter/nf_tables.h>
>  
> -struct nft_counter {
> -	seqlock_t	lock;
> -	u64		bytes;
> -	u64		packets;
> +struct nft_named_ctr_expr {
> +	struct nft_named_ctr *counter;
>  };
>  
>  static void nft_counter_eval(const struct nft_expr *expr,
> @@ -35,6 +33,18 @@ static void nft_counter_eval(const struct nft_expr *expr,
>  	write_sequnlock_bh(&priv->lock);
>  }
>  
> +static void nft_named_ctr_eval(const struct nft_expr *expr,
> +			       struct nft_data data[NFT_REG_MAX + 1],
> +			       const struct nft_pktinfo *pkt)
> +{
> +	struct nft_named_ctr_expr *priv = nft_expr_priv(expr);
> +
> +	write_seqlock_bh(&priv->counter->counter.lock);
> +	priv->counter->counter.bytes += pkt->skb->len;
> +	priv->counter->counter.packets++;
> +	write_sequnlock_bh(&priv->counter->counter.lock);
> +}
> +
>  static int nft_counter_dump(struct sk_buff *skb, const struct nft_expr *expr)
>  {
>  	struct nft_counter *priv = nft_expr_priv(expr);
> @@ -58,11 +68,42 @@ nla_put_failure:
>  	return -1;
>  }
>  
> +static int nft_named_ctr_dump(struct sk_buff *skb, const struct nft_expr *expr)
> +{
> +	struct nft_named_ctr_expr *priv = nft_expr_priv(expr);
> +	unsigned int seq;
> +	u64 bytes;
> +	u64 packets;
> +
> +	if (nla_put_string(skb, NFTA_COUNTER_NAME, priv->counter->name))
> +		goto nla_put_failure;
> +
> +	do {
> +		seq = read_seqbegin(&priv->counter->counter.lock);
> +		bytes	= priv->counter->counter.bytes;
> +		packets	= priv->counter->counter.packets;
> +	} while (read_seqretry(&priv->counter->counter.lock, seq));
> +
> +	if (nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(bytes)))
> +		goto nla_put_failure;
> +	if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(packets)))
> +		goto nla_put_failure;
> +
> +	return 0;
> +
> +nla_put_failure:
> +	return -1;
> +}
> +
>  static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
>  	[NFTA_COUNTER_PACKETS]	= { .type = NLA_U64 },
>  	[NFTA_COUNTER_BYTES]	= { .type = NLA_U64 },
>  };
>  
> +static const struct nla_policy nft_named_ctr_policy[NFTA_COUNTER_MAX + 1] = {
> +	[NFTA_COUNTER_NAME]	= { .type = NLA_STRING },
> +};
> +
>  static int nft_counter_init(const struct nft_ctx *ctx,
>  			    const struct nft_expr *expr,
>  			    const struct nlattr * const tb[])
> @@ -78,6 +119,35 @@ static int nft_counter_init(const struct nft_ctx *ctx,
>  	return 0;
>  }
>  
> +static int nft_named_ctr_init(const struct nft_ctx *ctx,
> +			      const struct nft_expr *expr,
> +			      const struct nlattr * const tb[])
> +{
> +	struct nft_named_ctr_expr *priv = nft_expr_priv(expr);
> +	struct nft_named_ctr *counter;
> +
> +	if (!tb[NFTA_COUNTER_NAME])
> +		return -EINVAL;
> +
> +	counter = nft_counter_lookup(ctx, nla_data(tb[NFTA_COUNTER_NAME]));
> +	if (!counter)
> +		return -ENOENT;
> +
> +	priv->counter = counter;
> +
> +	nft_counter_get(priv->counter);
> +
> +	return 0;
> +}
> +
> +static void nft_named_ctr_destroy(const struct nft_ctx *ctx,
> +				  const struct nft_expr *expr)
> +{
> +	struct nft_named_ctr_expr *priv = nft_expr_priv(expr);
> +
> +	nft_counter_put(priv->counter);
> +}
> +
>  static struct nft_expr_type nft_counter_type;
>  static const struct nft_expr_ops nft_counter_ops = {
>  	.type		= &nft_counter_type,
> @@ -87,9 +157,28 @@ static const struct nft_expr_ops nft_counter_ops = {
>  	.dump		= nft_counter_dump,
>  };
>  
> +static const struct nft_expr_ops nft_named_ctr_ops = {
> +	.type		= &nft_counter_type,
> +	.size		= NFT_EXPR_SIZE(sizeof(struct nft_counter)),
> +	.eval		= nft_named_ctr_eval,
> +	.init		= nft_named_ctr_init,
> +	.dump		= nft_named_ctr_dump,
> +	.destroy	= nft_named_ctr_destroy,
> +};
> +
> +static const struct nft_expr_ops *
> +nft_counter_select_ops(const struct nft_ctx *ctx,
> +		       const struct nlattr * const tb[])
> +{
> +	if (tb[NFTA_COUNTER_NAME])
> +		return &nft_named_ctr_ops;
> +
> +	return &nft_counter_ops;
> +}
> +
>  static struct nft_expr_type nft_counter_type __read_mostly = {
>  	.name		= "counter",
> -	.ops		= &nft_counter_ops,
> +	.select_ops	= &nft_counter_select_ops,
>  	.policy		= nft_counter_policy,
>  	.maxattr	= NFTA_COUNTER_MAX,
>  	.owner		= THIS_MODULE,
> -- 
> 1.7.10.4
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html