net/netfilter/nft_last.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 #include <linux/kernel.h>
   3 #include <linux/init.h>
   4 #include <linux/module.h>
   5 #include <linux/netlink.h>
   6 #include <linux/netfilter.h>
   7 #include <linux/netfilter/nf_tables.h>
   8 #include <net/netfilter/nf_tables_core.h>
   9 #include <net/netfilter/nf_tables.h>
  10
  11 struct nft_last {
  12         unsigned long   jiffies;
  13         unsigned int    set;
  14 };
  15
  16 struct nft_last_priv {
  17         struct nft_last *last;
  18 };
  19
  20 static const struct nla_policy nft_last_policy[NFTA_LAST_MAX + 1] = {
  21         [NFTA_LAST_SET] = { .type = NLA_U32 },
  22         [NFTA_LAST_MSECS] = { .type = NLA_U64 },
  23 };
  24
  25 static int nft_last_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
  26                          const struct nlattr * const tb[])
  27 {
  28         struct nft_last_priv *priv = nft_expr_priv(expr);
  29         struct nft_last *last;
  30         u64 last_jiffies;
  31         int err;
  32
  33         last = kzalloc(sizeof(*last), GFP_KERNEL_ACCOUNT);
  34         if (!last)
  35                 return -ENOMEM;
  36
  37         if (tb[NFTA_LAST_SET])
  38                 last->set = ntohl(nla_get_be32(tb[NFTA_LAST_SET]));
  39
  40         if (last->set && tb[NFTA_LAST_MSECS]) {
  41                 err = nf_msecs_to_jiffies64(tb[NFTA_LAST_MSECS], &last_jiffies);
  42                 if (err < 0)
  43                         goto err;
  44
  45                 last->jiffies = jiffies - (unsigned long)last_jiffies;
  46         }
  47         priv->last = last;
  48
  49         return 0;
  50 err:
  51         kfree(last);
  52
  53         return err;
  54 }
  55
  56 static void nft_last_eval(const struct nft_expr *expr,
  57                           struct nft_regs *regs, const struct nft_pktinfo *pkt)
  58 {
  59         struct nft_last_priv *priv = nft_expr_priv(expr);
  60         struct nft_last *last = priv->last;
  61
  62         if (READ_ONCE(last->jiffies) != jiffies)
  63                 WRITE_ONCE(last->jiffies, jiffies);
  64         if (READ_ONCE(last->set) == 0)
  65                 WRITE_ONCE(last->set, 1);
  66 }
  67
  68 static int nft_last_dump(struct sk_buff *skb,
  69                          const struct nft_expr *expr, bool reset)
  70 {
  71         struct nft_last_priv *priv = nft_expr_priv(expr);
  72         struct nft_last *last = priv->last;
  73         unsigned long last_jiffies = READ_ONCE(last->jiffies);
  74         u32 last_set = READ_ONCE(last->set);
  75         __be64 msecs;
  76
  77         if (time_before(jiffies, last_jiffies)) {
  78                 WRITE_ONCE(last->set, 0);
  79                 last_set = 0;
  80         }
  81
  82         if (last_set)
  83                 msecs = nf_jiffies64_to_msecs(jiffies - last_jiffies);
  84         else
  85                 msecs = 0;
  86
  87         if (nla_put_be32(skb, NFTA_LAST_SET, htonl(last_set)) ||
  88             nla_put_be64(skb, NFTA_LAST_MSECS, msecs, NFTA_LAST_PAD))
  89                 goto nla_put_failure;
  90
  91         return 0;
  92
  93 nla_put_failure:
  94         return -1;
  95 }
  96
  97 static void nft_last_destroy(const struct nft_ctx *ctx,
  98                              const struct nft_expr *expr)
  99 {
 100         struct nft_last_priv *priv = nft_expr_priv(expr);
 101
 102         kfree(priv->last);
 103 }
 104
 105 static int nft_last_clone(struct nft_expr *dst, const struct nft_expr *src, gfp_t gfp)
 106 {
 107         struct nft_last_priv *priv_dst = nft_expr_priv(dst);
 108         struct nft_last_priv *priv_src = nft_expr_priv(src);
 109
 110         priv_dst->last = kzalloc(sizeof(*priv_dst->last), gfp);
 111         if (!priv_dst->last)
 112                 return -ENOMEM;
 113
 114         priv_dst->last->set = priv_src->last->set;
 115         priv_dst->last->jiffies = priv_src->last->jiffies;
 116
 117         return 0;
 118 }
 119
 120 static const struct nft_expr_ops nft_last_ops = {
 121         .type           = &nft_last_type,
 122         .size           = NFT_EXPR_SIZE(sizeof(struct nft_last_priv)),
 123         .eval           = nft_last_eval,
 124         .init           = nft_last_init,
 125         .destroy        = nft_last_destroy,
 126         .clone          = nft_last_clone,
 127         .dump           = nft_last_dump,
 128         .reduce         = NFT_REDUCE_READONLY,
 129 };
 130
 131 struct nft_expr_type nft_last_type __read_mostly = {
 132         .name           = "last",
 133         .ops            = &nft_last_ops,
 134         .policy         = nft_last_policy,
 135         .maxattr        = NFTA_LAST_MAX,
 136         .flags          = NFT_EXPR_STATEFUL,
 137         .owner          = THIS_MODULE,
 138 };