source: ksyslog/trunk/ksyslog.c @ 268

/*
 * ksyslog: In-kernel syslog receiver 
 * Copyright(C) 2013 Atzm WATANABE All rights reserved
 * Distributed under the GPL
 */

#include <linux/version.h>
#include <linux/module.h>
#include <linux/inet.h>
#include <linux/ip.h>
#include <linux/udp.h>
#include <linux/namei.h>
#include <linux/fsnotify.h>
#include <linux/proc_fs.h>
#include <linux/u64_stats_sync.h>
#include <linux/percpu.h>
#include <net/udp.h>
#include "compat.h"
#include "ksyslog.h"

static struct ksyslog_queue ksyslog_queue;
static struct socket *ksyslog_rcv_sk = NULL;

static struct delayed_work ksyslog_work;
static struct workqueue_struct *ksyslog_wq = NULL;

#ifdef CONFIG_PROC_FS
static struct proc_dir_entry *ksyslog_procdir = NULL;
static struct proc_dir_entry *ksyslog_proc_queue = NULL;
static struct proc_dir_entry *ksyslog_proc_size = NULL;
static struct proc_dir_entry *ksyslog_proc_stats = NULL;
#endif

static char *ksyslog_host = "0.0.0.0";
static ushort ksyslog_port = 514;
static char *ksyslog_path = "/var/log/ksyslog.log";
static ulong ksyslog_queue_size_max = 4096;
static ulong ksyslog_flush_interval = 45;  /* milliseconds */

static DEFINE_SPINLOCK(ksyslog_write_lock);

module_param(ksyslog_host, charp, 0444);
module_param(ksyslog_port, ushort, 0444);
module_param(ksyslog_path, charp, 0644);
module_param(ksyslog_queue_size_max, ulong, 0644);
module_param(ksyslog_flush_interval, ulong, 0644);

static int
ksyslog_queue_init(struct ksyslog_queue *queue)
{
        memset(queue, 0, sizeof(*queue));
        INIT_LIST_HEAD(&queue->head);
        spin_lock_init(&queue->lock);
        atomic64_set(&queue->size, 0);
        queue->stats = alloc_percpu(struct ksyslog_stats);
        if (unlikely(queue->stats == NULL))
                return -ENOMEM;
        return 0;
}

static void
ksyslog_queue_uninit(struct ksyslog_queue *queue)
{
        if (likely(queue->stats))
                free_percpu(queue->stats);
        queue->stats = NULL;
}

static int
ksyslog_close(struct file *file)
{
        int err;
        mm_segment_t oldfs;

        oldfs = get_fs();
        set_fs(get_ds());

        err = filp_close(file, NULL);

        set_fs(oldfs);
        return err;
}

static struct file *
ksyslog_open(const char *path)
{
        struct file *file;
        struct path ppath;
        mm_segment_t oldfs;

        oldfs = get_fs();
        set_fs(get_ds());

        if (unlikely(kern_path(path, LOOKUP_OPEN|LOOKUP_FOLLOW, &ppath)))
                file = filp_open(path, O_CREAT|O_WRONLY|O_APPEND|O_LARGEFILE, 0600);
        else
                file = filp_open(path, O_WRONLY|O_APPEND|O_LARGEFILE, 0);

        if (unlikely(IS_ERR(file)))
                goto out;

        compat_fsnotify_open(file);

        if (unlikely(S_ISDIR(file->f_path.dentry->d_inode->i_mode))) {
                ksyslog_close(file);
                file = ERR_PTR(-EISDIR);
                goto out;
        }

        if (unlikely(file->f_pos < 0)) {
                ksyslog_close(file);
                file = ERR_PTR(-EIO);
                goto out;
        }

out:
        set_fs(oldfs);
        return file;
}

static int
ksyslog_write(struct file *file, const char *buf, const size_t length)
{
        int err;
        mm_segment_t oldfs;

        oldfs = get_fs();
        set_fs(get_ds());

        err = vfs_write(file, (__force void __user *)buf, length, &file->f_pos);

        set_fs(oldfs);
        return err;
}

static void
ksyslog_drop_warning(const struct ksyslog_entry *entry)
{
        net_warn_ratelimited("ksyslog: dropped: %llu %s.%s %u.%u.%u.%u %.*s\n",
                             timeval_to_ns(&entry->tv) / 1000 / 1000 / 1000,
                             ksyslog_facility_str(entry->facility),
                             ksyslog_severity_str(entry->severity),
                             entry->saddr.addr8[0], entry->saddr.addr8[1],
                             entry->saddr.addr8[2], entry->saddr.addr8[3],
                             (int)entry->length, entry->data);
}

static struct ksyslog_entry *
ksyslog_entry_create(const struct sk_buff *skb,
                     const struct iphdr *iph, const struct udphdr *udph)
{
        struct ksyslog_entry *entry;
        unsigned int priority, facility, severity, month, day, hour, minute, second;
        unsigned char *start, month_s[4];
        struct tm tm;
        int length, i;

        if (sscanf(skb->data, "<%3u>%3s %2u %2u:%2u:%2u ",
                   &priority, month_s, &day, &hour, &minute, &second) != 6)
                return ERR_PTR(-EINVAL);

        start = memchr(skb->data, '>', 5);
        if (start == NULL)
                return ERR_PTR(-EINVAL);
        start++;

        facility = priority >> 3;
        severity = priority & 7;

        if (facility >= __KSYSLOG_F_MAX)
                return ERR_PTR(-EINVAL);
        if (severity >= __KSYSLOG_S_MAX)
                return ERR_PTR(-EINVAL);

        month = ksyslog_month_num(month_s);
        if (!month)
                return ERR_PTR(-EINVAL);
        if (day > 31)
                return ERR_PTR(-EINVAL);
        if (hour > 23)
                return ERR_PTR(-EINVAL);
        if (minute > 59)
                return ERR_PTR(-EINVAL);
        if (second > 59)
                return ERR_PTR(-EINVAL);

        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
        if (unlikely(entry == NULL))
                return ERR_PTR(-ENOMEM);

        length = skb->len - (start - skb->data);
        entry->data = kzalloc(length, GFP_ATOMIC);
        if (unlikely(entry->data == NULL)) {
                kfree(entry);
                return ERR_PTR(-ENOMEM);
        }

        if (skb->tstamp.tv64)
                entry->tv = ktime_to_timeval(skb->tstamp);
        else
                do_gettimeofday(&entry->tv);

        time_to_tm(entry->tv.tv_sec, 0, &tm);
        entry->time = mktime(tm.tm_year + 1900, month, day, hour, minute, second);

        entry->priority = priority;
        entry->facility = facility;
        entry->severity = severity;

        entry->daddr.addr32 = iph->daddr;
        entry->saddr.addr32 = iph->saddr;

        entry->dport = udph->dest;
        entry->sport = udph->source;

        entry->length = length;
        memcpy(entry->data, start, length);

        for (i = 0; i < length; i++)
                if (unlikely(entry->data[i] == '\n'))
                        entry->data[i] = ' ';

        return entry;
}

static void
ksyslog_entry_free(struct rcu_head *head)
{
        struct ksyslog_entry *entry = container_of(head, struct ksyslog_entry, rcu);
        kfree(entry->data);
        kfree(entry);
}

static int
ksyslog_entry_add(struct ksyslog_queue *queue, struct ksyslog_entry *entry)
{
        if (unlikely(atomic64_read(&queue->size) >= ksyslog_queue_size_max))
                return -ENOBUFS;
        list_add_tail_rcu(&entry->list, &queue->head);
        WARN_ON(atomic64_inc_return(&queue->size) > ksyslog_queue_size_max);
        return 0;
}

static void
ksyslog_entry_del(struct ksyslog_queue *queue, struct ksyslog_entry *entry, bool free)
{
        WARN_ON(atomic64_dec_return(&queue->size) < 0);
        list_del_rcu(&entry->list);
        if (free)
                call_rcu(&entry->rcu, ksyslog_entry_free);
}

static void
ksyslog_entry_destroy(struct ksyslog_queue *queue)
{
        struct ksyslog_entry *entry, *next;

        list_for_each_entry_safe(entry, next, &queue->head, list)
                ksyslog_entry_del(queue, entry, true);
}

static int
ksyslog_entry_format(char **buf, const struct ksyslog_entry *entry)
{
        *buf = kzalloc(54 + entry->length + 2, GFP_ATOMIC);
        if (unlikely(*buf == NULL))
                return -ENOMEM;

        return sprintf(*buf, "%llu %s.%s %u.%u.%u.%u %.*s\n",
                       timeval_to_ns(&entry->tv) / 1000 / 1000 / 1000,
                       ksyslog_facility_str(entry->facility),
                       ksyslog_severity_str(entry->severity),
                       entry->saddr.addr8[0], entry->saddr.addr8[1],
                       entry->saddr.addr8[2], entry->saddr.addr8[3],
                       (int)entry->length, entry->data);
}

static bool
ksyslog_entry_write(struct file *file, struct ksyslog_entry *entry)
{
        int length;
        char *buf;

        length = ksyslog_entry_format(&buf, entry);

        if (unlikely(length < 0))
                return false;

        if (unlikely(ksyslog_write(file, buf, length) != length)) {
                kfree(buf);
                return false;
        }

        kfree(buf);
        return true;
}

static void
ksyslog_work_register(unsigned long timer)
{
        queue_delayed_work(ksyslog_wq, &ksyslog_work, timer * HZ / 1000);
}

static void
ksyslog_work_unregister(void)
{
        cancel_delayed_work_sync(&ksyslog_work);
}

static void
ksyslog_work_handler(struct work_struct *work)
{
        struct file *file = NULL;
        struct ksyslog_entry *entry;

        file = ksyslog_open(ksyslog_path);
        if (unlikely(IS_ERR(file)))
                goto out;

        while (true) {
                bool write_ok;

                spin_lock_bh(&ksyslog_queue.lock);
                entry = list_first_or_null_rcu(&ksyslog_queue.head,
                                               struct ksyslog_entry, list);
                if (!entry) {
                        spin_unlock_bh(&ksyslog_queue.lock);
                        break;
                }
                ksyslog_entry_del(&ksyslog_queue, entry, false);
                spin_unlock_bh(&ksyslog_queue.lock);

                spin_lock(&ksyslog_write_lock);
                write_ok = ksyslog_entry_write(file, entry);
                spin_unlock(&ksyslog_write_lock);

                if (likely(write_ok)) {
                        ksyslog_stats_add_write(&ksyslog_queue, entry->length);
                } else {
                        ksyslog_stats_add_drop(&ksyslog_queue, entry->length);
                        ksyslog_drop_warning(entry);
                }

                call_rcu(&entry->rcu, ksyslog_entry_free);
        }

        ksyslog_close(file);

out:
        ksyslog_work_register(ksyslog_flush_interval);
}

static int
ksyslog_rcv(struct sock *sk, struct sk_buff *skb)
{
        int err;
        struct iphdr *iph;
        struct udphdr *udph;
        struct ksyslog_entry *entry;

        if (unlikely(skb_linearize(skb))) {
                ksyslog_stats_add_drop(&ksyslog_queue, skb->len);
                goto out;
        }

        iph = ip_hdr(skb);
        udph = udp_hdr(skb);

        if (unlikely(!skb_pull(skb, sizeof(*udph)))) {
                ksyslog_stats_add_drop(&ksyslog_queue, skb->len);
                goto out;
        }

        entry = ksyslog_entry_create(skb, iph, udph);
        if (unlikely(IS_ERR(entry))) {
                if (PTR_ERR(entry) == -EINVAL) {
                        ksyslog_stats_add_discard(&ksyslog_queue, skb->len);
                        goto out;
                }

                ksyslog_stats_add_drop(&ksyslog_queue, skb->len);
                goto out;
        }

        spin_lock_bh(&ksyslog_queue.lock);
        err = ksyslog_entry_add(&ksyslog_queue, entry);
        spin_unlock_bh(&ksyslog_queue.lock);

        if (unlikely(err)) {
                ksyslog_stats_add_drop(&ksyslog_queue, entry->length);
                ksyslog_drop_warning(entry);
                ksyslog_entry_free(&entry->rcu);
                goto out;
        }

out:
        consume_skb(skb);
        return 0;
}

#ifdef CONFIG_PROC_FS
static void *
ksyslog_rculist_seq_start(struct seq_file *seq, loff_t *pos)
{
        struct list_head *lh, *head = seq->private;
        loff_t ppos = *pos;

        rcu_read_lock();

        __list_for_each_rcu(lh, head)
                if (ppos-- == 0)
                        return lh;

        return NULL;
}

static void *
ksyslog_rculist_seq_next(struct seq_file *seq, void *v, loff_t *pos)
{
        struct list_head *lh = rcu_dereference(((struct list_head *)v)->next);
        ++(*pos);
        return lh == seq->private ? NULL : lh;
}

static void
ksyslog_rculist_seq_stop(struct seq_file *seq, void *v)
{
        rcu_read_unlock();
}

static int
ksyslog_queue_seq_show(struct seq_file *seq, void *v)
{
        const struct ksyslog_entry *entry = list_entry_rcu(v, struct ksyslog_entry, list);

        seq_printf(seq, "%llu %s.%s %u.%u.%u.%u %.*s\n",
                   timeval_to_ns(&entry->tv) / 1000 / 1000 / 1000,
                   ksyslog_facility_str(entry->facility),
                   ksyslog_severity_str(entry->severity),
                   entry->saddr.addr8[0], entry->saddr.addr8[1],
                   entry->saddr.addr8[2], entry->saddr.addr8[3],
                   (int)entry->length, entry->data);

        return 0;
}

static struct seq_operations ksyslog_queue_seq_ops = {
        .start = ksyslog_rculist_seq_start,
        .next  = ksyslog_rculist_seq_next,
        .stop  = ksyslog_rculist_seq_stop,
        .show  = ksyslog_queue_seq_show,
};

static int
ksyslog_queue_seq_open(struct inode *inode, struct file *file)
{
        int err = seq_open(file, &ksyslog_queue_seq_ops);

        if (!err)
                ((struct seq_file *)file->private_data)->private = PDE_DATA(inode);

        return err;
}

static struct file_operations ksyslog_queue_fops = {
        .owner   = THIS_MODULE,
        .open    = ksyslog_queue_seq_open,
        .read    = seq_read,
        .llseek  = seq_lseek,
        .release = seq_release,
};

static int
ksyslog_size_seq_show(struct seq_file *seq, void *v)
{
        seq_printf(seq, "%lu\n", atomic64_read(&ksyslog_queue.size));
        return 0;
}

static int
ksyslog_size_seq_open(struct inode *inode, struct file *file)
{
        return single_open(file, ksyslog_size_seq_show, PDE_DATA(inode));
}

static int
ksyslog_stats_seq_show(struct seq_file *seq, void *v)
{
        int i;
        struct ksyslog_stats stats;

        memset(&stats, 0, sizeof(stats));

        for_each_possible_cpu(i) {
                const struct ksyslog_stats *percpu_stats;
                struct ksyslog_stats local_stats;
                unsigned int start;

                percpu_stats = per_cpu_ptr(ksyslog_queue.stats, i);

                do {
                        start = u64_stats_fetch_begin_bh(&percpu_stats->sync);
                        local_stats = *percpu_stats;
                } while (u64_stats_fetch_retry_bh(&percpu_stats->sync, start));

                stats.write_bytes += local_stats.write_bytes;
                stats.write_packets += local_stats.write_packets;
                stats.drop_bytes += local_stats.drop_bytes;
                stats.drop_packets += local_stats.drop_packets;
                stats.discard_bytes += local_stats.discard_bytes;
                stats.discard_packets += local_stats.discard_packets;
        }

        seq_puts(seq,   "{\n");
        seq_puts(seq,   "  \"write\": {\n");
        seq_printf(seq, "    \"bytes\":   \"%llu\",\n", stats.write_bytes);
        seq_printf(seq, "    \"packets\": \"%llu\"\n", stats.write_packets);
        seq_puts(seq,   "  },\n");
        seq_puts(seq,   "  \"drop\": {\n");
        seq_printf(seq, "    \"bytes\":   \"%llu\",\n", stats.drop_bytes);
        seq_printf(seq, "    \"packets\": \"%llu\"\n", stats.drop_packets);
        seq_puts(seq,   "  },\n");
        seq_puts(seq,   "  \"discard\": {\n");
        seq_printf(seq, "    \"bytes\":   \"%llu\",\n", stats.discard_bytes);
        seq_printf(seq, "    \"packets\": \"%llu\"\n", stats.discard_packets);
        seq_puts(seq,   "  }\n");
        seq_puts(seq,   "}\n");

        return 0;
}

static int
ksyslog_stats_seq_open(struct inode *inode, struct file *file)
{
        return single_open(file, ksyslog_stats_seq_show, PDE_DATA(inode));
}

static struct file_operations ksyslog_size_fops = {
        .owner   = THIS_MODULE,
        .open    = ksyslog_size_seq_open,
        .read    = seq_read,
        .llseek  = seq_lseek,
        .release = single_release,
};

static struct file_operations ksyslog_stats_fops = {
        .owner   = THIS_MODULE,
        .open    = ksyslog_stats_seq_open,
        .read    = seq_read,
        .llseek  = seq_lseek,
        .release = single_release,
};

static void
ksyslog_proc_destroy(void)
{
        if (ksyslog_proc_queue)
                remove_proc_entry("queue", ksyslog_procdir);
        ksyslog_proc_queue = NULL;

        if (ksyslog_proc_size)
                remove_proc_entry("size", ksyslog_procdir);
        ksyslog_proc_size = NULL;

        if (ksyslog_proc_stats)
                remove_proc_entry("stats", ksyslog_procdir);
        ksyslog_proc_stats = NULL;

        if (ksyslog_procdir)
                remove_proc_entry("ksyslog", NULL);
        ksyslog_procdir = NULL;
}

static int
ksyslog_proc_init(void)
{
        ksyslog_procdir = proc_mkdir("ksyslog", NULL);
        if (ksyslog_procdir == NULL) {
                pr_err("ksyslog: proc_mkdir failed\n");
                goto err;
        }

        ksyslog_proc_queue = proc_create_data("queue", S_IRUGO, ksyslog_procdir,
                                              &ksyslog_queue_fops, &ksyslog_queue.head);
        if (ksyslog_proc_queue == NULL) {
                pr_err("ksyslog: proc_create(queue) failed\n");
                goto err;
        }

        ksyslog_proc_size = proc_create("size", S_IRUGO, ksyslog_procdir,
                                        &ksyslog_size_fops);
        if (ksyslog_proc_size == NULL) {
                pr_err("ksyslog: proc_create(size) failed\n");
                goto err;
        }

        ksyslog_proc_stats = proc_create("stats", S_IRUGO, ksyslog_procdir,
                                         &ksyslog_stats_fops);
        if (ksyslog_proc_stats == NULL) {
                pr_err("ksyslog: proc_create(stats) failed\n");
                goto err;
        }

        return 0;

err:
        ksyslog_proc_destroy();
        return -ENOMEM;
}
#endif

static void
ksyslog_finish(void)
{
        if (ksyslog_rcv_sk)
                sock_release(ksyslog_rcv_sk);
        ksyslog_rcv_sk = NULL;

        if (ksyslog_wq) {
                ksyslog_work_unregister();
                destroy_workqueue(ksyslog_wq);
        }
        ksyslog_wq = NULL;

#ifdef CONFIG_PROC_FS
        ksyslog_proc_destroy();
#endif

        ksyslog_entry_destroy(&ksyslog_queue);
        rcu_barrier();

        ksyslog_queue_uninit(&ksyslog_queue);
}

static int __init
ksyslog_init(void)
{
        int err;
        struct sockaddr_in sin;

        err = ksyslog_queue_init(&ksyslog_queue);
        if (err)
                goto err;

#ifdef CONFIG_PROC_FS
        err = ksyslog_proc_init();
        if (err)
                goto err;
#endif

        ksyslog_wq = create_workqueue("ksyslog");
        if (ksyslog_wq == NULL) {
                pr_err("ksyslog: create_workqueue failed\n");
                err = -ENOMEM;
                goto err;
        }

        INIT_DELAYED_WORK(&ksyslog_work, ksyslog_work_handler);

        err = sock_create(AF_INET, SOCK_DGRAM, 0, &ksyslog_rcv_sk);
        if (err) {
                pr_err("ksyslog: sock_create failed\n");
                goto err;
        }

        sin.sin_family = AF_INET;
        sin.sin_addr.s_addr = in_aton(ksyslog_host);
        sin.sin_port = htons(ksyslog_port);

        err = kernel_bind(ksyslog_rcv_sk, (struct sockaddr *)&sin,
                          sizeof(struct sockaddr_in));
        if (err) {
                pr_err("ksyslog: kernel_bind failed\n");
                goto err;
        }

        ksyslog_work_register(ksyslog_flush_interval);

        udp_sk(ksyslog_rcv_sk->sk)->encap_type = UDP_ENCAP_KSYSLOG;
        udp_sk(ksyslog_rcv_sk->sk)->encap_rcv = ksyslog_rcv;
        udp_encap_enable();

        return 0;

err:
        ksyslog_finish();
        return err;
}

static void __exit
ksyslog_exit(void)
{
        ksyslog_finish();
}

module_init(ksyslog_init);
module_exit(ksyslog_exit);

MODULE_AUTHOR("Atzm WATANABE");
MODULE_DESCRIPTION("In-kernel syslog receiver");
MODULE_LICENSE("GPL");