Fixed a svace for 212550
[platform/core/connectivity/stc-manager.git] / src / helper / helper-nfacct-rule.c
1 /*
2  * Copyright (c) 2016 Samsung Electronics Co., Ltd.
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16
17 #include <errno.h>
18 #include <inttypes.h>
19 #include <stdbool.h>
20 #include <stdlib.h>
21 #include <string.h>
22 #include <sys/types.h>
23 #include <sys/wait.h>
24 #include <unistd.h>
25 #include <arpa/inet.h>
26
27 #include "counter.h"
28 #include "helper-nfacct-rule.h"
29
30 #include "configure_stub.h"
31
32 #define IPTABLES "/usr/sbin/iptables"
33 #define IP6TABLES "/usr/sbin/ip6tables"
34 #define IPTABLES_CHECK "-C"
35 #define APPEND "-A"
36 #define DELETE "-D"
37 #define INSERT "-I"
38
39 #define NFACCT_NAME_MOD " -m nfacct --nfacct-name %s"
40 #define REJECT_RULE " -j REJECT"
41 #define ACCEPT_RULE " -j ACCEPT"
42 #define OUT_RULE "OUTPUT"
43 #define IN_RULE "INPUT"
44 #define FORWARD_RULE "FORWARD"
45
46 /* TODO idea to use the same rule both for BLOCK (REJECT) and WARNING (ACCEPT) */
47 #define RULE_APP_OUT "%s -w %s OUTPUT -o %s -m cgroup --cgroup %u %s %s"
48 #define RULE_APP_IN "%s -w %s INPUT -i %s -m cgroup --cgroup %u %s %s"
49
50
51 /* iptables -w [I/A/D] [OUTPUT/FORWARD/INPUT] -o/-i iface -m nfacct --nfacct-name name -j ACCEPT/REJECT */
52
53 #define RULE_IFACE_OUT "%s -w %s %s -o %s %s %s"
54 #define RULE_IFACE_IN "%s -w %s %s -i %s %s  %s"
55
56
57 #define NFNL_SUBSYS_ACCT                7
58 #define BUF_SIZE_FOR_ERR 100
59
60 static void prepare_netlink_msg(struct genl *req, int type, int flag)
61 {
62         int seq = time(NULL);
63         memset(req, 0, sizeof(struct genl));
64         req->n.nlmsg_len = NLMSG_LENGTH(GENL_HDRLEN);
65         req->n.nlmsg_type = (NFNL_SUBSYS_ACCT << 8) | type;
66         req->n.nlmsg_flags = NLM_F_REQUEST | flag;
67         req->n.nlmsg_seq = seq;
68 }
69
70 static void add_value_attr(struct genl *req, const void *data, int len,
71                            int type)
72 {
73         int payload;
74         /* get tail */
75         struct nlattr *na = (struct nlattr *)((char *)req +
76                                               NLMSG_ALIGN(req->n.nlmsg_len));
77
78         na->nla_type = type;
79         payload = len + NLA_HDRLEN;
80         na->nla_len = payload;
81         memcpy(NLA_DATA(na), data, len);
82         req->n.nlmsg_len += NLMSG_ALIGN(payload);
83 }
84
85 /*
86  * following 2 function should be used in combination.
87  * start_nest_attr returns nlattr structure, which should be completed by
88  * end_nest_attr,
89  * before these invocations any number of netlink arguments could be inserted
90  * */
91 static struct nlattr *start_nest_attr(struct genl *req, uint16_t type)
92 {
93         struct nlattr *start = (struct nlattr *)((char *)req +
94                                                  NLMSG_ALIGN(req->n.nlmsg_len));
95
96         start->nla_type = NLA_F_NESTED | type;
97         req->n.nlmsg_len += NLMSG_ALIGN(sizeof(struct nlattr));
98         return start;
99 }
100
101 static void end_nest_attr(struct genl *req, struct nlattr *start)
102 {
103         start->nla_len = (__u16)((char *)req +
104                                  NLMSG_ALIGN(req->n.nlmsg_len) - (char *)start);
105 }
106
107 static void add_string_attr(struct genl *req, const char *str, int type)
108 {
109         add_value_attr(req, str, strlen(str) + 1, type);
110 }
111
112 static void add_uint64_attr(struct genl *req, const uint64_t v, int type)
113 {
114         add_value_attr(req, &v, sizeof(v), type);
115 }
116
117 /* macros or templare, due uint64 and uint32 is the same functions */
118 static void add_uint32_attr(struct genl *req, const uint32_t v, int type)
119 {
120         add_value_attr(req, &v, sizeof(v), type);
121 }
122
123 static stc_error_e send_nfacct_request(int sock, struct genl *req)
124 {
125         struct sockaddr_nl nladdr = {.nl_family = AF_NETLINK};
126         int ret = sendto(sock, (char *)(&req->n), req->n.nlmsg_len, 0,
127                          (struct sockaddr *)&nladdr, sizeof(nladdr));
128         ret_value_msg_if(ret < 0, STC_ERROR_FAIL,
129                          "Failed to send command to get outgoing traffic");
130
131         return STC_ERROR_NONE;
132 }
133
134 static stc_error_e nfacct_send_new(nfacct_rule_s *counter)
135 {
136         struct genl req;
137
138         prepare_netlink_msg(&req, NFNL_MSG_ACCT_NEW, NLM_F_CREATE | NLM_F_ACK);
139         add_string_attr(&req, counter->name, NFACCT_NAME);
140
141         STC_LOGD("counter name %s", counter->name);
142
143         /* padding */
144         add_uint64_attr(&req, 0, NFACCT_PKTS);
145         add_uint64_attr(&req, 0, NFACCT_BYTES);
146         if (counter->quota) {
147                 STC_LOGD("quota bytes %"PRId64, counter->quota);
148
149                 add_uint32_attr(&req, htobe32(NFACCT_F_QUOTA_BYTES),
150                                 NFACCT_FLAGS);
151                 add_uint64_attr(&req, htobe64(counter->quota), NFACCT_QUOTA);
152         }
153
154         return send_nfacct_request(counter->carg->sock, &req);
155 }
156
157 stc_error_e nfacct_send_del(nfacct_rule_s *counter)
158 {
159         struct genl req;
160
161         STC_LOGD("send remove request for %s", counter->name);
162
163         prepare_netlink_msg(&req, NFNL_MSG_ACCT_DEL, NLM_F_ACK);
164         add_string_attr(&req, counter->name, NFACCT_NAME);
165         return send_nfacct_request(counter->carg->sock, &req);
166 }
167 #define NFACCT_F_QUOTAS (NFACCT_F_QUOTA_BYTES | NFACCT_F_QUOTA_PKTS)
168
169 static stc_error_e internal_nfacct_send_get(struct counter_arg *carg,
170                                             enum nfnl_acct_msg_types get_type,
171                                             const char *name,
172                                             int mask, int filter)
173 {
174         struct genl req;
175         struct nlattr *na;
176         int flag = !name ? NLM_F_DUMP : 0;
177         prepare_netlink_msg(&req, get_type,
178                             flag);
179         /* due we don't get counter with quota any where else,
180          * here we will request just counters by default */
181         if (name)
182                 add_string_attr(&req, name, NFACCT_NAME);
183
184         na = start_nest_attr(&req, NFACCT_FILTER);
185         add_uint32_attr(&req, htonl(mask),
186                         NFACCT_FILTER_ATTR_MASK);
187         add_uint32_attr(&req, htonl(filter), NFACCT_FILTER_ATTR_VALUE);
188         end_nest_attr(&req, na);
189         return send_nfacct_request(carg->sock, &req);
190 }
191
192 stc_error_e nfacct_send_get_counters(struct counter_arg *carg, const char *name)
193 {
194         /* get and reset countes value */
195         return internal_nfacct_send_get(carg, NFNL_MSG_ACCT_GET_CTRZERO, name,
196                                         NFACCT_F_QUOTAS, 0);
197 }
198
199 stc_error_e nfacct_send_get_quotas(struct counter_arg *carg, const char *name)
200 {
201         /* just get counters */
202         return internal_nfacct_send_get(carg, NFNL_MSG_ACCT_GET, name,
203                                         NFACCT_F_QUOTA_BYTES,
204                                         NFACCT_F_QUOTA_BYTES);
205 }
206
207 stc_error_e nfacct_send_get_all(struct counter_arg *carg)
208 {
209         /* get and reset everything, used when quiting */
210         return internal_nfacct_send_get(carg, NFNL_MSG_ACCT_GET_CTRZERO, NULL,
211                                         0, 0);
212 }
213
214 stc_error_e nfacct_send_get(nfacct_rule_s *rule)
215 {
216         if (rule->intend == NFACCT_BLOCK || rule->intend == NFACCT_WARN)
217                 return nfacct_send_get_quotas(rule->carg, rule->name);
218         else if (rule->intend == NFACCT_COUNTER)
219                 return nfacct_send_get_counters(rule->carg, rule->name);
220
221         return STC_ERROR_INVALID_PARAMETER;
222 }
223
224 static nfacct_rule_direction convert_to_iotype(int type)
225 {
226         return (type < NFACCT_COUNTER_LAST_ELEM &&
227                 type > NFACCT_COUNTER_UNKNOWN) ? type : NFACCT_COUNTER_UNKNOWN;
228 }
229
230 static stc_iface_type_e convert_to_iftype(int type)
231 {
232         return (type < STC_IFACE_LAST_ELEM &&
233                 type > STC_IFACE_UNKNOWN) ? type : STC_IFACE_UNKNOWN;
234 }
235
236 bool recreate_counter_by_name(char *cnt_name, nfacct_rule_s *cnt)
237 {
238         char *iftype_part;
239         char *classid_part;
240         char *io_part;
241         char *ifname_part;
242         char *save_ptr = NULL;
243         char name[NFACCT_NAME_MAX] = {0}; /* parse buffer to avoid cnt_name modification */
244
245         strncpy(name, cnt_name, sizeof(name) - 1);
246
247         switch (name[0]) {
248         case 'c':
249                 cnt->intend  = NFACCT_COUNTER;
250                 break;
251         case 'w':
252                 cnt->intend  = NFACCT_WARN;
253                 break;
254         case 'r':
255                 cnt->intend  = NFACCT_BLOCK;
256                 break;
257         case 't':
258                 cnt->intend  = NFACCT_TETH_COUNTER;
259                 break;
260         default:
261                 return false;
262         }
263
264         STRING_SAVE_COPY(cnt->name, cnt_name);
265
266         if (cnt->intend == NFACCT_TETH_COUNTER) {
267                 char ifname_buf[MAX_IFACE_LENGTH];
268                 int ifname_len;
269                 stc_iface_type_e iface;
270                 /* tbnep+:seth_w0; means comes by bt go away by mobile interface,
271                  * it's outgoing traffic, due all tethering is mobile databased */
272                 iftype_part = strchr(name, ':');
273                 ret_value_msg_if(iftype_part == NULL,
274                                  false, "Invalid format of the tethering counter %s", name);
275                 ifname_len = iftype_part - name - 1;
276                 strncpy(ifname_buf, name + 1, ifname_len); /* skip first t */
277                 ifname_buf[ifname_len] = '\0';
278                 iface = get_iftype_by_name(ifname_buf);
279                 /* check first part is it datacall */
280                 if (iface == STC_IFACE_DATACALL) {
281                         strncpy(cnt->ifname, ifname_buf, MAX_IFACE_LENGTH);
282                         cnt->iotype = NFACCT_COUNTER_IN;
283                 } else {
284                         /* +1, due : symbol and till the end of cnt_name */
285                         strncpy(ifname_buf, iftype_part + 1, MAX_IFACE_LENGTH);
286                         iface = get_iftype_by_name(ifname_buf);
287                         if (iface == STC_IFACE_DATACALL) {
288                                 cnt->iotype = NFACCT_COUNTER_OUT;
289                                 strncpy(cnt->ifname, ifname_buf, MAX_IFACE_LENGTH);
290                         }
291                 }
292
293                 if (cnt->iotype == NFACCT_COUNTER_UNKNOWN) {
294                         STC_LOGE("can't determine tethering direction %s", name);
295                         return false;
296                 }
297                 cnt->iftype = STC_IFACE_DATACALL;
298                 cnt->classid = STC_TETHERING_APP_CLASSID;
299                 return true;
300         }
301
302         io_part = strtok_r(name, "_", &save_ptr);
303         if (io_part != NULL)
304                 cnt->iotype = convert_to_iotype(atoi(io_part + 1));
305         else
306                 return false;
307
308         iftype_part = strtok_r(NULL, "_", &save_ptr);
309         if (iftype_part != NULL)
310                 cnt->iftype = convert_to_iftype(atoi(iftype_part));
311         else
312                 return false;
313
314         classid_part = strtok_r(NULL, "_", &save_ptr);
315         if (classid_part != NULL)
316                 cnt->classid = atoi(classid_part);
317         else {
318                 cnt->classid = STC_ALL_APP_CLASSID;
319                 return cnt->intend == NFACCT_BLOCK ? true : false;
320         }
321
322         ifname_part = strtok_r(NULL, "\0", &save_ptr);
323         if (ifname_part != NULL)
324                 STRING_SAVE_COPY(cnt->ifname, ifname_part);
325         else
326                 return false;
327
328         return true;
329 }
330
331 static void _process_answer(struct netlink_serialization_params *params)
332 {
333         struct rtattr *na;
334         struct rtattr *attr_list[__NFACCT_MAX] = {0};
335         struct counter_arg *carg = params->carg;
336         struct genl *ans = params->ans;;
337         struct nlmsghdr *nlhdr = &ans->n;
338         int len = GENLMSG_PAYLOAD(nlhdr);
339         int ans_len = carg->ans_len;
340
341         if (len == 0)
342                 return;
343
344         /* parse reply message */
345         na = (struct rtattr *)GENLMSG_DATA(ans);
346
347         while (NLMSG_OK(nlhdr, ans_len)) {
348                 fill_attribute_list(attr_list, NFACCT_MAX,
349                                     na, len);
350                 if (!attr_list[NFACCT_NAME] ||
351                     !attr_list[NFACCT_BYTES])
352                         goto next;
353                 params->eval_attr(attr_list, carg);
354
355 next:
356                 nlhdr = NLMSG_NEXT(nlhdr, ans_len);
357                 if (ans_len < 0)
358                         break;
359                 na = (struct rtattr *)GENLMSG_DATA(nlhdr);
360         }
361
362         if (params->post_eval_attr)
363                 params->post_eval_attr(carg);
364 }
365
366 netlink_serialization_command *
367 netlink_create_command(struct netlink_serialization_params *params)
368 {
369         static netlink_serialization_command command = {0,};
370         command.deserialize_answer = _process_answer;
371         command.params = *params;
372         return &command;
373 }
374
375 static unsigned int get_args_number(const char *cmd_buf)
376 {
377         char *str;
378         unsigned int count = 0;
379
380         for (str = (char *)cmd_buf; *str != '\0'; ++str) {
381                 if (*str == ' ')
382                         ++count;
383         }
384         return count;
385 }
386
387 static void wait_for_rule_cmd(pid_t pid)
388 {
389         int status;
390         pid_t ret_pid;
391         char buf[BUF_SIZE_FOR_ERR] = { 0 };
392
393         if (!pid) {
394                 STC_LOGD("no need to wait");
395                 return;
396         }
397         ret_pid = waitpid(pid, &status, 0);
398         if (ret_pid < 0)
399                 STC_LOGD("can't wait for a pid %d %d %s", pid, status,
400                          strerror_r(errno, buf, BUF_SIZE_FOR_ERR));
401 }
402
403 static char* get_cmd_pos(const char *cmd_buf)
404 {
405         char *cmd_pos = strstr(cmd_buf, APPEND);
406         if (!cmd_pos)
407                 cmd_pos = strstr(cmd_buf, INSERT);
408
409         return cmd_pos;
410 }
411
412 static bool is_rule_exists(const char *cmd_buf)
413 {
414         size_t buf_len;
415         char *exec_buf;
416         char *cmd_pos = get_cmd_pos(cmd_buf);
417         bool ret = false;
418         if (!cmd_pos)
419                 return false;
420
421         buf_len = strlen(cmd_buf) + 1;
422         exec_buf = (char *)malloc(buf_len);
423         if (!exec_buf)
424                 return false;
425
426         strncpy(exec_buf, cmd_buf, buf_len);
427         strncpy(exec_buf + (cmd_pos - cmd_buf), IPTABLES_CHECK,
428                 sizeof(IPTABLES_CHECK) - 1);
429
430         STC_LOGD("check rule %s", exec_buf);
431
432         ret = system(exec_buf) == 0;
433         free(exec_buf);
434         return ret;
435 }
436
437 stc_error_e exec_iptables_cmd(const char *cmd_buf, pid_t *cmd_pid)
438 {
439         pid_t pid = fork();
440
441         if (pid == 0) {
442                 char *cmd;
443                 unsigned int i;
444                 const size_t args_number = get_args_number(cmd_buf);
445                 char *args[args_number + 2];
446                 int ret;
447                 char *save_ptr = NULL;
448                 char buf[BUF_SIZE_FOR_ERR] = { 0 };
449
450                 STC_LOGD("executing iptables cmd %s in forked process",
451                          cmd_buf);
452
453                 ret_value_msg_if(args_number == 0, STC_ERROR_FAIL, "no arguments");
454
455                 if (is_rule_exists(cmd_buf)) {
456                         STC_LOGD("Rule %s already exists", cmd_buf);
457                         exit(0);
458                 }
459                 args[0] = "iptables";
460                 cmd = strtok_r((char *)cmd_buf, " ", &save_ptr);
461                 ret_value_msg_if(cmd == NULL, STC_ERROR_FAIL, "no arguments");
462                 for (i = 1; i <= args_number; ++i)
463                         args[i] = strtok_r(NULL, " ", &save_ptr);
464
465                 args[i] = NULL;
466
467                 ret = execv(cmd, args);
468                 if (ret)
469                         STC_LOGE("Can't execute %s: %s",
470                                  cmd_buf, strerror_r(errno, buf, BUF_SIZE_FOR_ERR));
471                 exit(ret);
472         }
473
474         *cmd_pid = pid;
475         return STC_ERROR_NONE;
476 }
477
478 stc_error_e exec_ip6tables_cmd(const char *cmd_buf, pid_t *cmd_pid)
479 {
480         pid_t pid = fork();
481
482         if (pid == 0) {
483                 char *cmd;
484                 unsigned int i;
485                 const size_t args_number = get_args_number(cmd_buf);
486                 char *args[args_number + 2];
487                 int ret;
488                 char *save_ptr = NULL;
489                 char buf[BUF_SIZE_FOR_ERR] = { 0 };
490
491                 STC_LOGD("executing ip6tables cmd %s in forked process",
492                          cmd_buf);
493
494                 ret_value_msg_if(args_number == 0, STC_ERROR_FAIL, "no arguments");
495
496                 if (is_rule_exists(cmd_buf)) {
497                         STC_LOGD("Rule %s already exists", cmd_buf);
498                         exit(0);
499                 }
500                 args[0] = "ip6tables";
501                 cmd = strtok_r((char *)cmd_buf, " ", &save_ptr);
502                 ret_value_msg_if(cmd == NULL, STC_ERROR_FAIL, "no arguments");
503                 for (i = 1; i <= args_number; ++i)
504                         args[i] = strtok_r(NULL, " ", &save_ptr);
505
506                 args[i] = NULL;
507
508                 ret = execv(cmd, args);
509                 if (ret)
510                         STC_LOGE("Can't execute %s: %s",
511                                  cmd_buf, strerror_r(errno, buf, BUF_SIZE_FOR_ERR));
512                 exit(ret);
513         }
514
515         *cmd_pid = pid;
516         return STC_ERROR_NONE;
517 }
518
519 static char *choose_iftype_name(nfacct_rule_s *rule)
520 {
521         return strlen(rule->ifname) != 0 ? rule->ifname :
522                 get_iftype_name(rule->iftype);
523 }
524
525 static stc_error_e exec_iface_cmd(const char *pattern, const char *cmd,
526                                   const char *chain, const char *nfacct,
527                                   const char *jump, char *iftype_name,
528                                   pid_t *pid)
529 {
530         char block_buf[MAX_PATH_LENGTH];
531         int ret;
532
533         ret_value_msg_if(iftype_name == NULL, STC_ERROR_FAIL,
534                          "Invalid network interface name argument");
535
536         /* iptables rule */
537         ret = snprintf(block_buf, sizeof(block_buf), pattern, IPTABLES, cmd, chain,
538                       iftype_name, nfacct, jump);
539         ret_value_msg_if(ret > sizeof(block_buf), STC_ERROR_FAIL,
540                          "Not enough buffer");
541         exec_iptables_cmd(block_buf, pid);
542
543         /* ip6tables rule */
544         ret = snprintf(block_buf, sizeof(block_buf), pattern, IP6TABLES, cmd, chain,
545                       iftype_name, nfacct, jump);
546         ret_value_msg_if(ret > sizeof(block_buf), STC_ERROR_FAIL,
547                          "Not enough buffer");
548         return exec_ip6tables_cmd(block_buf, pid);
549 }
550
551 static stc_error_e exec_app_cmd(const char *pattern, const char *cmd,
552                                 const char *nfacct, const char *jump,
553                                 const uint32_t classid, char *iftype_name,
554                                 pid_t *pid)
555 {
556         char block_buf[MAX_PATH_LENGTH];
557         int ret;
558         ret_value_msg_if(iftype_name == NULL, STC_ERROR_FAIL,
559                          "Invalid network interface name argument");
560
561         /* iptables rules */
562         ret = snprintf(block_buf, sizeof(block_buf), pattern, IPTABLES, cmd,
563                       iftype_name, classid, nfacct, jump);
564         ret_value_msg_if(ret > sizeof(block_buf), STC_ERROR_FAIL,
565                          "Not enough buffer");
566         exec_iptables_cmd(block_buf, pid);
567
568         /* ip6tables rules */
569         ret = snprintf(block_buf, sizeof(block_buf), pattern, IP6TABLES, cmd,
570                       iftype_name, classid, nfacct, jump);
571         ret_value_msg_if(ret > sizeof(block_buf), STC_ERROR_FAIL,
572                          "Not enough buffer");
573         return exec_ip6tables_cmd(block_buf, pid);
574 }
575
576 static char *get_iptables_cmd(const nfacct_rule_action action)
577 {
578         if (action == NFACCT_ACTION_APPEND)
579                 return APPEND;
580         else if (action == NFACCT_ACTION_DELETE)
581                 return DELETE;
582         else if (action == NFACCT_ACTION_INSERT)
583                 return INSERT;
584
585         return "";
586 }
587
588 static char *get_iptables_chain(const nfacct_rule_direction iotype)
589 {
590         if (iotype == NFACCT_COUNTER_IN)
591                 return IN_RULE;
592         else if (iotype == NFACCT_COUNTER_OUT)
593                 return OUT_RULE;
594
595         return "";
596 }
597
598 static char *get_iptables_jump(const nfacct_rule_jump jump)
599 {
600         if (jump == NFACCT_JUMP_ACCEPT)
601                 return ACCEPT_RULE;
602         else if (jump == NFACCT_JUMP_REJECT)
603                 return REJECT_RULE;
604
605         return "";
606 }
607
608 static stc_error_e produce_app_rule(nfacct_rule_s *rule,
609                                     const int64_t send_limit,
610                                     const int64_t rcv_limit,
611                                     const nfacct_rule_action action,
612                                     const nfacct_rule_jump jump,
613                                     const nfacct_rule_direction iotype)
614 {
615         char *set_cmd = get_iptables_cmd(action);
616         char *jump_cmd = get_iptables_jump(jump);
617         char nfacct_buf[sizeof(NFACCT_NAME_MOD) +
618                 3*MAX_DEC_SIZE(int) + 4];
619         stc_error_e ret = STC_ERROR_NONE;
620         pid_t pid = 0;
621
622         /* income part */
623         if (iotype & NFACCT_COUNTER_IN) {
624                 rule->quota = rcv_limit;
625                 rule->iotype = NFACCT_COUNTER_IN;
626                 generate_counter_name(rule);
627
628                 /* to support quated counter we need nfacct,
629                  *      don't use it in case of just block without a limit
630                  *      iow, send_limit = 0 and rcv_limit 0 */
631                 if (action != NFACCT_ACTION_DELETE) {
632                         ret = nfacct_send_del(rule);
633                         ret_value_msg_if(ret != STC_ERROR_NONE, ret,
634                                          "can't del quota counter");
635
636                         ret = nfacct_send_new(rule);
637                         ret_value_msg_if(ret != STC_ERROR_NONE, ret,
638                                          "can't set nfacct counter");
639                         keep_counter(rule);
640                 }
641
642                 /* we have a counter, let's key in a rule, drop in case of
643                  *  send_limit/rcv_limit */
644                 ret = snprintf(nfacct_buf, sizeof(nfacct_buf), NFACCT_NAME_MOD,
645                                rule->name);
646                 ret_value_msg_if(ret > sizeof(nfacct_buf) || ret < 0,
647                                  STC_ERROR_FAIL, "Not enought buffer");
648
649                 ret = exec_app_cmd(RULE_APP_IN, set_cmd, nfacct_buf, jump_cmd,
650                                    rule->classid, choose_iftype_name(rule),
651                                    &pid);
652                 ret_value_msg_if(ret != STC_ERROR_NONE, STC_ERROR_FAIL,
653                                  "Can't set conditional block for ingress"
654                                  " traffic, for classid %u, cmd %s, j %s",
655                                  rule->classid, set_cmd, jump_cmd);
656
657                 /* remove in any case */
658                 if (action == NFACCT_ACTION_DELETE) {
659                         /* TODO here and everywhere should be not just a del,
660                          *      here should be get counted value and than
661                          *      set new counter with that value, but it's minor issue,
662                          *      due it's not clear when actual counters was stored,
663                          *      and based on which value settings made such decition */
664                         wait_for_rule_cmd(pid);
665                         rule->iptables_rule = nfacct_send_del;
666                         set_finalize_flag(rule);
667                         nfacct_send_get(rule);
668                         ret = nfacct_send_del(rule);
669                         ret_value_msg_if(ret != STC_ERROR_NONE, ret,
670                                          "can't del quota counter");
671                 }
672         }
673
674         if (iotype & NFACCT_COUNTER_OUT) {
675                 /* outcome part */
676                 rule->iotype = NFACCT_COUNTER_OUT;
677                 rule->quota = send_limit;
678                 generate_counter_name(rule);
679                 if (action != NFACCT_ACTION_DELETE) {
680                         ret = nfacct_send_del(rule);
681                         ret_value_msg_if(ret != STC_ERROR_NONE, ret,
682                                          "can't del quota counter");
683
684                         ret = nfacct_send_new(rule);
685                         ret_value_msg_if(ret != STC_ERROR_NONE, ret,
686                                          "can't set quota counter");
687                         keep_counter(rule);
688                 }
689
690                 ret = snprintf(nfacct_buf, sizeof(nfacct_buf), NFACCT_NAME_MOD,
691                                rule->name);
692                 ret_value_msg_if(ret > sizeof(nfacct_buf) || ret < 0,
693                                  STC_ERROR_FAIL, "Not enought buffer");
694
695                 ret = exec_app_cmd(RULE_APP_OUT, set_cmd, nfacct_buf, jump_cmd,
696                                    rule->classid, choose_iftype_name(rule),
697                                    &pid);
698                 ret_value_msg_if(ret != STC_ERROR_NONE, STC_ERROR_FAIL,
699                                  "Can't set conditional block for engress"
700                                  " traffic, for classid %u, cmd %s, j %s",
701                                  rule->classid, set_cmd, jump_cmd);
702                 if (action == NFACCT_ACTION_DELETE) {
703                         wait_for_rule_cmd(pid);
704                         rule->iptables_rule = nfacct_send_del;
705                         /* not effective, it's better to replace
706                          * set_finalize_flag by set_property,
707                          * due keep_counter it necessary only for
708                          * setting iptables_rule */
709                         set_finalize_flag(rule);
710                         nfacct_send_get(rule);
711                         ret = nfacct_send_del(rule);
712                         ret_value_msg_if(ret != STC_ERROR_NONE, ret,
713                                          "can't del quota counter");
714                 }
715         }
716         return STC_ERROR_NONE;
717 }
718
719 static stc_error_e produce_iface_rule(nfacct_rule_s *rule,
720                                       const int64_t send_limit,
721                                       const int64_t rcv_limit,
722                                       const nfacct_rule_action action,
723                                       const nfacct_rule_jump jump,
724                                       const nfacct_rule_direction iotype)
725 {
726         char *set_cmd = get_iptables_cmd(action);
727         char *jump_cmd = get_iptables_jump(jump);
728         char nfacct_buf[sizeof(NFACCT_NAME_MOD) +
729                 3*MAX_DEC_SIZE(int) + 4];
730         stc_error_e ret;
731         pid_t pid = 0;
732
733         if (iotype & NFACCT_COUNTER_IN) {
734                 /* income part */
735                 rule->iotype = NFACCT_COUNTER_IN;
736                 rule->quota = rcv_limit;
737                 generate_counter_name(rule);
738
739                 if (action != NFACCT_ACTION_DELETE) {
740                         /* send delete comman in case of creation,
741                          * because nfacct doesn't reset value for nfacct quota
742                          * in case of quota existing */
743                         ret = nfacct_send_del(rule);
744                         ret_value_msg_if(ret != STC_ERROR_NONE, ret,
745                                          "can't del quota counter");
746
747                         ret = nfacct_send_new(rule);
748                         ret_value_msg_if(ret != STC_ERROR_NONE, ret,
749                                          "can't set quota counter");
750                         keep_counter(rule);
751                 }
752
753                 ret = snprintf(nfacct_buf, sizeof(nfacct_buf),
754                                NFACCT_NAME_MOD, rule->name);
755                 ret_value_msg_if(ret > sizeof(nfacct_buf) || ret < 0,
756                                  STC_ERROR_FAIL, "Not enought buffer");
757
758                 ret = exec_iface_cmd(RULE_IFACE_IN, set_cmd,
759                                      get_iptables_chain(rule->iotype),
760                                      nfacct_buf, jump_cmd,
761                                      choose_iftype_name(rule), &pid);
762                 ret_value_msg_if(ret != STC_ERROR_NONE, STC_ERROR_FAIL,
763                                  "Can't set conditional block for ingress"
764                                  " traffic, for iftype %d, cmd %s, j %s",
765                                  rule->iftype, set_cmd, jump_cmd);
766
767                 /* for tethering */
768                 if (rule->intend == NFACCT_WARN ||
769                     rule->intend == NFACCT_BLOCK) {
770                         /* RULE_IFACE_OUT is not a misprint here */
771                         wait_for_rule_cmd(pid);
772                         ret = exec_iface_cmd(RULE_IFACE_IN, set_cmd,
773                                              FORWARD_RULE, nfacct_buf, jump_cmd,
774                                              choose_iftype_name(rule), &pid);
775                         ret_value_msg_if(ret != STC_ERROR_NONE, STC_ERROR_FAIL,
776                                          "Can't set forward rule for ingress "
777                                          "traffic, for iftype %d, cmd %s, j %s",
778                                          rule->iftype, set_cmd, jump_cmd);
779                 }
780                 /* tethering */
781
782                 if (action == NFACCT_ACTION_DELETE) {
783                         wait_for_rule_cmd(pid);
784                         rule->iptables_rule = nfacct_send_del;
785                         set_finalize_flag(rule);
786                         nfacct_send_get(rule);
787                         ret = nfacct_send_del(rule);
788                         ret_value_msg_if(ret != STC_ERROR_NONE, ret,
789                                          "can't del quota counter");
790                 }
791         }
792
793         if (iotype & NFACCT_COUNTER_OUT) {
794                 /* outcome part */
795                 rule->iotype = NFACCT_COUNTER_OUT;
796                 rule->quota = send_limit;
797                 generate_counter_name(rule);
798
799                 if (action != NFACCT_ACTION_DELETE) {
800                         /* send delete comman in case of creation,
801                          * because nfacct doesn't reset value for nfacct quota
802                          * in case of quota existing */
803                         ret = nfacct_send_del(rule);
804                         ret_value_msg_if(ret != STC_ERROR_NONE, ret,
805                                          "can't del quota counter");
806
807                         ret = nfacct_send_new(rule);
808                         ret_value_msg_if(ret != STC_ERROR_NONE, ret,
809                                          "can't set quota counter");
810                         keep_counter(rule);
811                 }
812
813                 ret = snprintf(nfacct_buf, sizeof(nfacct_buf),
814                                NFACCT_NAME_MOD, rule->name);
815                 ret_value_msg_if(ret > sizeof(nfacct_buf) || ret < 0,
816                                  STC_ERROR_FAIL, "Not enough buffer");
817
818                 wait_for_rule_cmd(pid);
819                 ret = exec_iface_cmd(RULE_IFACE_OUT, set_cmd, OUT_RULE,
820                                      nfacct_buf, jump_cmd,
821                                      choose_iftype_name(rule), &pid);
822                 ret_value_msg_if(ret != STC_ERROR_NONE, STC_ERROR_FAIL,
823                                  "Can't set conditional block for "
824                                  "engress traffic, for iftype %d, cmd %s, j %s",
825                                  rule->iftype, set_cmd, jump_cmd);
826                 /* for tethering  */
827                 if (rule->intend == NFACCT_WARN ||
828                     rule->intend == NFACCT_BLOCK) {
829                         wait_for_rule_cmd(pid);
830                         ret = exec_iface_cmd(RULE_IFACE_OUT, set_cmd,
831                                              FORWARD_RULE, nfacct_buf, jump_cmd,
832                                              choose_iftype_name(rule), &pid);
833                         ret_value_msg_if(ret != STC_ERROR_NONE, STC_ERROR_FAIL,
834                                          "Can't set forward rule for engress "
835                                          "traffic, for iftype %d, cmd %s, j %s",
836                                          rule->iftype, set_cmd, jump_cmd);
837                 }
838                 /* tethering  */
839
840                 if (action == NFACCT_ACTION_DELETE) {
841                         wait_for_rule_cmd(pid);
842                         rule->iptables_rule = nfacct_send_del;
843                         set_finalize_flag(rule);
844                         nfacct_send_get(rule);
845                         ret = nfacct_send_del(rule);
846                         ret_value_msg_if(ret != STC_ERROR_NONE, ret,
847                                          "can't del quota counter");
848                 }
849         }
850         return STC_ERROR_NONE;
851 }
852
853 stc_error_e produce_net_rule(nfacct_rule_s *rule,
854                              const int64_t send_limit,
855                              const int64_t rcv_limit,
856                              const nfacct_rule_action action,
857                              const nfacct_rule_jump jump,
858                              const nfacct_rule_direction iotype)
859 {
860         stc_error_e ret = STC_ERROR_NONE;
861
862         if (action == NFACCT_ACTION_APPEND && rule->intend == NFACCT_WARN
863             && !send_limit && !rcv_limit)
864                 return STC_ERROR_NONE;
865
866         if (rule->classid != STC_ALL_APP_CLASSID &&
867             rule->classid != STC_TETHERING_APP_CLASSID)
868                 ret = produce_app_rule(rule, send_limit,
869                                        rcv_limit, action, jump, iotype);
870         else
871                 ret = produce_iface_rule(rule, send_limit, rcv_limit,
872                                          action, jump, iotype);
873
874         return ret;
875 }
876
877 void generate_counter_name(nfacct_rule_s *counter)
878 {
879         char warn_symbol = 'c';
880         if (!strlen(counter->ifname)) {
881                 char *iftype_name = get_iftype_name(counter->iftype);
882                 /* trace counter name, maybe name was already generated */
883                 ret_msg_if(iftype_name == NULL,
884                            "Can't get interface name for counter %s, iftype %d)!",
885                            counter->name, counter->iftype);
886                 STRING_SAVE_COPY(counter->ifname, iftype_name);
887         }
888
889         if (counter->intend  == NFACCT_WARN)
890                 warn_symbol = 'w';
891         else if (counter->intend  == NFACCT_BLOCK)
892                 warn_symbol = 'r';
893         snprintf(counter->name, NFACCT_NAME_MAX, "%c%d_%d_%d_%s",
894                  warn_symbol, counter->iotype, counter->iftype,
895                  counter->classid, counter->ifname);
896 }
897