libnetfilter_acct.c

/*
 * (C) 2011 by Pablo Neira Ayuso <pablo@netfilter.org>
 * (C) 2011 by Intra2net AG <http://www.intra2net.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the Lesser GNU General Public License as published
 * by the Free Software Foundation; either version 2.1 of the License, or
 * (at your option) any later version.
 */
#include "internal.h"

#include <time.h>
#include <endian.h>
#include <stdlib.h>
#include <string.h>
#include <inttypes.h>

#include <libmnl/libmnl.h>
#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_acct.h>

#include <libnetfilter_acct/libnetfilter_acct.h>

struct nfacct {
        char            name[NFACCT_NAME_MAX];
        uint64_t        pkts;
        uint64_t        bytes;
        uint32_t        bitset;
        uint32_t        flags;
        uint64_t        quota;
};

struct nfacct *nfacct_alloc(void)
{
        return calloc(1, sizeof(struct nfacct));
}
EXPORT_SYMBOL(nfacct_alloc);

void nfacct_free(struct nfacct *nfacct)
{
        free(nfacct);
}
EXPORT_SYMBOL(nfacct_free);

void
nfacct_attr_set(struct nfacct *nfacct, enum nfacct_attr_type type,
                const void *data)
{
        switch(type) {
        case NFACCT_ATTR_NAME:
                strncpy(nfacct->name, data, NFACCT_NAME_MAX);
                nfacct->name[NFACCT_NAME_MAX-1] = '\0';
                nfacct->bitset |= (1 << NFACCT_ATTR_NAME);
                break;
        case NFACCT_ATTR_PKTS:
                nfacct->pkts = *((uint64_t *) data);
                nfacct->bitset |= (1 << NFACCT_ATTR_PKTS);
                break;
        case NFACCT_ATTR_BYTES:
                nfacct->bytes = *((uint64_t *) data);
                nfacct->bitset |= (1 << NFACCT_ATTR_BYTES);
                break;
        case NFACCT_ATTR_FLAGS:
                nfacct->flags = *((uint32_t *) data);
                nfacct->bitset |= (1 << NFACCT_ATTR_FLAGS);
                break;
        case NFACCT_ATTR_QUOTA:
                nfacct->quota = *((uint64_t *) data);
                nfacct->bitset |= (1 << NFACCT_ATTR_QUOTA);
                break;
        }
}
EXPORT_SYMBOL(nfacct_attr_set);

void
nfacct_attr_set_str(struct nfacct *nfacct, enum nfacct_attr_type type,
                    const char *name)
{
        nfacct_attr_set(nfacct, type, name);
}
EXPORT_SYMBOL(nfacct_attr_set_str);

void
nfacct_attr_set_u64(struct nfacct *nfacct, enum nfacct_attr_type type,
                    uint64_t value)
{
        nfacct_attr_set(nfacct, type, &value);
}
EXPORT_SYMBOL(nfacct_attr_set_u64);

void
nfacct_attr_unset(struct nfacct *nfacct, enum nfacct_attr_type type)
{
        switch(type) {
        case NFACCT_ATTR_NAME:
                nfacct->bitset &= ~(1 << NFACCT_ATTR_NAME);
                break;
        case NFACCT_ATTR_PKTS:
                nfacct->bitset &= ~(1 << NFACCT_ATTR_PKTS);
                break;
        case NFACCT_ATTR_BYTES:
                nfacct->bitset &= ~(1 << NFACCT_ATTR_BYTES);
                break;
        case NFACCT_ATTR_FLAGS:
                nfacct->bitset &= ~(1 << NFACCT_ATTR_FLAGS);
                break;
        case NFACCT_ATTR_QUOTA:
                nfacct->bitset &= ~(1 << NFACCT_ATTR_QUOTA);
                break;
        }
}
EXPORT_SYMBOL(nfacct_attr_unset);

const void *nfacct_attr_get(struct nfacct *nfacct, enum nfacct_attr_type type)
{
        const void *ret = NULL;

        switch(type) {
        case NFACCT_ATTR_NAME:
                if (nfacct->bitset & (1 << NFACCT_ATTR_NAME))
                        ret = nfacct->name;
                break;
        case NFACCT_ATTR_PKTS:
                if (nfacct->bitset & (1 << NFACCT_ATTR_PKTS))
                        ret = &nfacct->pkts;
                break;
        case NFACCT_ATTR_BYTES:
                if (nfacct->bitset & (1 << NFACCT_ATTR_BYTES))
                        ret = &nfacct->bytes;
                break;
        case NFACCT_ATTR_FLAGS:
                if (nfacct->bitset & (1 << NFACCT_ATTR_FLAGS))
                        ret = &nfacct->flags;
                break;
        case NFACCT_ATTR_QUOTA:
                if (nfacct->bitset & (1 << NFACCT_ATTR_QUOTA))
                        ret = &nfacct->quota;
                break;
        }
        return ret;
}
EXPORT_SYMBOL(nfacct_attr_get);

const char *
nfacct_attr_get_str(struct nfacct *nfacct, enum nfacct_attr_type type)
{
        return nfacct_attr_get(nfacct, type);
}
EXPORT_SYMBOL(nfacct_attr_get_str);

uint64_t nfacct_attr_get_u64(struct nfacct *nfacct, enum nfacct_attr_type type)
{
        const void *ret = nfacct_attr_get(nfacct, type);
        return ret ? *((uint64_t *)ret) : 0;
}
EXPORT_SYMBOL(nfacct_attr_get_u64);

static int
nfacct_snprintf_plain(char *buf, size_t rem, struct nfacct *nfacct,
                      uint16_t flags)
{
        int ret, offset = 0, len = 0;

        if (flags & NFACCT_SNPRINTF_F_FULL) {
                ret = snprintf(buf, rem,
                        "{ pkts = %.20"PRIu64", bytes = %.20"PRIu64"",
                        nfacct_attr_get_u64(nfacct, NFACCT_ATTR_PKTS),
                        nfacct_attr_get_u64(nfacct, NFACCT_ATTR_BYTES));
                SNPRINTF_CHECK(ret, rem, offset, len);

                if (nfacct->flags) {
                        uint32_t mode;
                        char *mode_name;

                        mode = nfacct_attr_get_u64(nfacct, NFACCT_ATTR_FLAGS);
                        if (mode & NFACCT_F_QUOTA_PKTS)
                                mode_name = "packet";
                        else if (mode & NFACCT_F_QUOTA_BYTES)
                                mode_name = "byte";
                        else
                                mode_name = "unknown";

                        ret = snprintf(buf + offset, rem,
                                ", quota = %.20"PRIu64", mode = %s"\
                                ", overquota = %s",
                                nfacct_attr_get_u64(nfacct, NFACCT_ATTR_QUOTA),
                                mode_name,
                                mode & NFACCT_F_OVERQUOTA ? "yes" : "no");
                        SNPRINTF_CHECK(ret, rem, offset, len);
                }

                ret = snprintf(buf + offset, rem, " } = %s;",
                        nfacct_attr_get_str(nfacct, NFACCT_ATTR_NAME));
        } else {
                ret = snprintf(buf, rem, "%s\n",
                        nfacct_attr_get_str(nfacct, NFACCT_ATTR_NAME));
        }
        SNPRINTF_CHECK(ret, rem, offset, len);

        return len;
}

static int
nfacct_snprintf_json(char *buf, size_t rem, struct nfacct *nfacct,
                     uint16_t flags)
{
        int ret = 0, offset = 0, len = 0;

        if (flags & NFACCT_SNPRINTF_F_FULL) {
                ret = snprintf(buf, rem,
                        "  { \"pkts\" : %"PRIu64", \"bytes\" : %"PRIu64"",
                        nfacct_attr_get_u64(nfacct, NFACCT_ATTR_PKTS),
                        nfacct_attr_get_u64(nfacct, NFACCT_ATTR_BYTES));
                SNPRINTF_CHECK(ret, rem, offset, len);

                if (nfacct->flags) {
                        uint32_t mode;
                        char *mode_name;

                        mode = nfacct_attr_get_u64(nfacct, NFACCT_ATTR_FLAGS);
                        if (mode & NFACCT_F_QUOTA_PKTS)
                                mode_name = "packet";
                        else if (mode & NFACCT_F_QUOTA_BYTES)
                                mode_name = "byte";
                        else
                                mode_name = "unknown";

                        ret = snprintf(buf + offset, rem,
                                ", \"quota\" : %"PRIu64", \"mode\" = \"%s\""\
                                ", \"overquota\" = %u",
                                nfacct_attr_get_u64(nfacct, NFACCT_ATTR_QUOTA),
                                mode_name,
                                mode & NFACCT_F_OVERQUOTA ? 1 : 0);
                        SNPRINTF_CHECK(ret, rem, offset, len);
                }

                ret = snprintf(buf + offset, rem, ", \"name\" : \"%s\" }",
                        nfacct_attr_get_str(nfacct, NFACCT_ATTR_NAME));
        }
        /* non-F_FULL doesn't seem to make sense in JSON */
        SNPRINTF_CHECK(ret, rem, offset, len);

        return len;
}

#define BUFFER_SIZE(ret, size, rem, offset)             \
        size += ret;                                    \
        if (ret > rem)                                  \
                ret = rem;                              \
        offset += ret;                                  \
        rem -= ret;

static int
nfacct_snprintf_xml_localtime(char *buf, unsigned int rem, const struct tm *tm)
{
        int ret = 0;
        unsigned int size = 0, offset = 0;

        ret = snprintf(buf+offset, rem, "<hour>%d</hour>", tm->tm_hour);
        BUFFER_SIZE(ret, size, rem, offset);

        ret = snprintf(buf+offset, rem, "<min>%02d</min>", tm->tm_min);
        BUFFER_SIZE(ret, size, rem, offset);

        ret = snprintf(buf+offset, rem, "<sec>%02d</sec>", tm->tm_sec);
        BUFFER_SIZE(ret, size, rem, offset);

        ret = snprintf(buf+offset, rem, "<wday>%d</wday>", tm->tm_wday + 1);
        BUFFER_SIZE(ret, size, rem, offset);

        ret = snprintf(buf+offset, rem, "<day>%d</day>", tm->tm_mday);
        BUFFER_SIZE(ret, size, rem, offset);

        ret = snprintf(buf+offset, rem, "<month>%d</month>", tm->tm_mon + 1);
        BUFFER_SIZE(ret, size, rem, offset);

        ret = snprintf(buf+offset, rem, "<year>%d</year>", 1900 + tm->tm_year);
        BUFFER_SIZE(ret, size, rem, offset);

        return size;
}


static int
nfacct_snprintf_xml(char *buf, size_t rem, struct nfacct *nfacct,
                    uint16_t flags)
{
        int ret = 0;
        unsigned int size = 0, offset = 0;

        ret = snprintf(buf, rem,
                        "<obj><name>%s</name>"
                        "<pkts>%.20"PRIu64"</pkts>"
                        "<bytes>%.20"PRIu64"</bytes>",
                        nfacct_attr_get_str(nfacct, NFACCT_ATTR_NAME),
                        nfacct_attr_get_u64(nfacct, NFACCT_ATTR_PKTS),
                        nfacct_attr_get_u64(nfacct, NFACCT_ATTR_BYTES));
        BUFFER_SIZE(ret, size, rem, offset);

        if (flags & NFACCT_SNPRINTF_F_TIME) {
                time_t t;
                struct tm tm;

                t = time(NULL);
                if (localtime_r(&t, &tm) == NULL)
                        goto err;

                ret = nfacct_snprintf_xml_localtime(buf+offset, rem, &tm);
                BUFFER_SIZE(ret, size, rem, offset);
        }

        ret = snprintf(buf+offset, rem, "</obj>");
        BUFFER_SIZE(ret, size, rem, offset);

err:
        return ret;
}

int nfacct_snprintf(char *buf, size_t size, struct nfacct *nfacct,
                    uint16_t type, uint16_t flags)
{
        int ret = 0;

        switch(type) {
        case NFACCT_SNPRINTF_T_PLAIN:
                ret = nfacct_snprintf_plain(buf, size, nfacct, flags);
                break;
        case NFACCT_SNPRINTF_T_XML:
                ret = nfacct_snprintf_xml(buf, size, nfacct, flags);
                break;
        case NFACCT_SNPRINTF_T_JSON:
                ret = nfacct_snprintf_json(buf, size, nfacct, flags);
                break;
        default:
                ret = -1;
                break;
        }
        return ret;
}
EXPORT_SYMBOL(nfacct_snprintf);

struct nlmsghdr *
nfacct_nlmsg_build_hdr(char *buf, uint8_t cmd, uint16_t flags, uint32_t seq)
{
        struct nlmsghdr *nlh;
        struct nfgenmsg *nfh;

        nlh = mnl_nlmsg_put_header(buf);
        nlh->nlmsg_type = (NFNL_SUBSYS_ACCT << 8) | cmd;
        nlh->nlmsg_flags = NLM_F_REQUEST | flags;
        nlh->nlmsg_seq = seq;

        nfh = mnl_nlmsg_put_extra_header(nlh, sizeof(struct nfgenmsg));
        nfh->nfgen_family = AF_UNSPEC;
        nfh->version = NFNETLINK_V0;
        nfh->res_id = 0;

        return nlh;
}
EXPORT_SYMBOL(nfacct_nlmsg_build_hdr);

void nfacct_nlmsg_build_payload(struct nlmsghdr *nlh, struct nfacct *nfacct)
{
        if (nfacct->bitset & (1 << NFACCT_ATTR_NAME))
                mnl_attr_put_strz(nlh, NFACCT_NAME, nfacct->name);

        if (nfacct->bitset & (1 << NFACCT_ATTR_PKTS))
                mnl_attr_put_u64(nlh, NFACCT_PKTS, htobe64(nfacct->pkts));

        if (nfacct->bitset & (1 << NFACCT_ATTR_BYTES))
                mnl_attr_put_u64(nlh, NFACCT_BYTES, htobe64(nfacct->bytes));

        if (nfacct->bitset & (1 << NFACCT_ATTR_FLAGS))
                mnl_attr_put_u32(nlh, NFACCT_FLAGS, htobe32(nfacct->flags));

        if (nfacct->bitset & (1 << NFACCT_ATTR_QUOTA))
                mnl_attr_put_u64(nlh, NFACCT_QUOTA, htobe64(nfacct->quota));
}
EXPORT_SYMBOL(nfacct_nlmsg_build_payload);

static int nfacct_nlmsg_parse_attr_cb(const struct nlattr *attr, void *data)
{
        const struct nlattr **tb = data;
        int type = mnl_attr_get_type(attr);

        if (mnl_attr_type_valid(attr, NFACCT_MAX) < 0)
                return MNL_CB_OK;

        switch(type) {
        case NFACCT_NAME:
                if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0) {
                        perror("mnl_attr_validate");
                        return MNL_CB_ERROR;
                }
                break;
        case NFACCT_PKTS:
        case NFACCT_BYTES:
                if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0) {
                        perror("mnl_attr_validate");
                        return MNL_CB_ERROR;
                }
                break;
        }
        tb[type] = attr;
        return MNL_CB_OK;
}

int
nfacct_nlmsg_parse_payload(const struct nlmsghdr *nlh, struct nfacct *nfacct)
{
        struct nlattr *tb[NFACCT_MAX+1] = {};
        struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);

        mnl_attr_parse(nlh, sizeof(*nfg), nfacct_nlmsg_parse_attr_cb, tb);
        if (!tb[NFACCT_NAME] && !tb[NFACCT_PKTS] && !tb[NFACCT_BYTES])
                return -1;

        nfacct_attr_set_str(nfacct, NFACCT_ATTR_NAME,
                            mnl_attr_get_str(tb[NFACCT_NAME]));
        nfacct_attr_set_u64(nfacct, NFACCT_ATTR_PKTS,
                            be64toh(mnl_attr_get_u64(tb[NFACCT_PKTS])));
        nfacct_attr_set_u64(nfacct, NFACCT_ATTR_BYTES,
                            be64toh(mnl_attr_get_u64(tb[NFACCT_BYTES])));

        if (tb[NFACCT_FLAGS] && tb[NFACCT_QUOTA]) {
                uint32_t flags = be32toh(mnl_attr_get_u32(tb[NFACCT_FLAGS]));
                nfacct_attr_set(nfacct, NFACCT_ATTR_FLAGS, &flags);
                nfacct_attr_set_u64(nfacct, NFACCT_ATTR_QUOTA,
                            be64toh(mnl_attr_get_u64(tb[NFACCT_QUOTA])));
        }

        return 0;
}
EXPORT_SYMBOL(nfacct_nlmsg_parse_payload);