1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> |
4 | * |
5 | * Development of this code funded by Astaro AG (http://www.astaro.com/) |
6 | */ |
7 | |
8 | #include <linux/kernel.h> |
9 | #include <linux/init.h> |
10 | #include <linux/module.h> |
11 | #include <linux/spinlock.h> |
12 | #include <linux/netlink.h> |
13 | #include <linux/netfilter.h> |
14 | #include <linux/netfilter/nf_tables.h> |
15 | #include <net/netfilter/nf_tables.h> |
16 | |
17 | struct nft_limit { |
18 | spinlock_t lock; |
19 | u64 last; |
20 | u64 tokens; |
21 | }; |
22 | |
23 | struct nft_limit_priv { |
24 | struct nft_limit *limit; |
25 | u64 tokens_max; |
26 | u64 rate; |
27 | u64 nsecs; |
28 | u32 burst; |
29 | bool invert; |
30 | }; |
31 | |
32 | static inline bool nft_limit_eval(struct nft_limit_priv *priv, u64 cost) |
33 | { |
34 | u64 now, tokens; |
35 | s64 delta; |
36 | |
37 | spin_lock_bh(lock: &priv->limit->lock); |
38 | now = ktime_get_ns(); |
39 | tokens = priv->limit->tokens + now - priv->limit->last; |
40 | if (tokens > priv->tokens_max) |
41 | tokens = priv->tokens_max; |
42 | |
43 | priv->limit->last = now; |
44 | delta = tokens - cost; |
45 | if (delta >= 0) { |
46 | priv->limit->tokens = delta; |
47 | spin_unlock_bh(lock: &priv->limit->lock); |
48 | return priv->invert; |
49 | } |
50 | priv->limit->tokens = tokens; |
51 | spin_unlock_bh(lock: &priv->limit->lock); |
52 | return !priv->invert; |
53 | } |
54 | |
55 | /* Use same default as in iptables. */ |
56 | #define NFT_LIMIT_PKT_BURST_DEFAULT 5 |
57 | |
58 | static int nft_limit_init(struct nft_limit_priv *priv, |
59 | const struct nlattr * const tb[], bool pkts) |
60 | { |
61 | u64 unit, tokens; |
62 | |
63 | if (tb[NFTA_LIMIT_RATE] == NULL || |
64 | tb[NFTA_LIMIT_UNIT] == NULL) |
65 | return -EINVAL; |
66 | |
67 | priv->rate = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE])); |
68 | unit = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_UNIT])); |
69 | priv->nsecs = unit * NSEC_PER_SEC; |
70 | if (priv->rate == 0 || priv->nsecs < unit) |
71 | return -EOVERFLOW; |
72 | |
73 | if (tb[NFTA_LIMIT_BURST]) |
74 | priv->burst = ntohl(nla_get_be32(tb[NFTA_LIMIT_BURST])); |
75 | |
76 | if (pkts && priv->burst == 0) |
77 | priv->burst = NFT_LIMIT_PKT_BURST_DEFAULT; |
78 | |
79 | if (priv->rate + priv->burst < priv->rate) |
80 | return -EOVERFLOW; |
81 | |
82 | if (pkts) { |
83 | tokens = div64_u64(dividend: priv->nsecs, divisor: priv->rate) * priv->burst; |
84 | } else { |
85 | /* The token bucket size limits the number of tokens can be |
86 | * accumulated. tokens_max specifies the bucket size. |
87 | * tokens_max = unit * (rate + burst) / rate. |
88 | */ |
89 | tokens = div64_u64(dividend: priv->nsecs * (priv->rate + priv->burst), |
90 | divisor: priv->rate); |
91 | } |
92 | |
93 | priv->limit = kmalloc(size: sizeof(*priv->limit), GFP_KERNEL_ACCOUNT); |
94 | if (!priv->limit) |
95 | return -ENOMEM; |
96 | |
97 | priv->limit->tokens = tokens; |
98 | priv->tokens_max = priv->limit->tokens; |
99 | |
100 | if (tb[NFTA_LIMIT_FLAGS]) { |
101 | u32 flags = ntohl(nla_get_be32(tb[NFTA_LIMIT_FLAGS])); |
102 | |
103 | if (flags & NFT_LIMIT_F_INV) |
104 | priv->invert = true; |
105 | } |
106 | priv->limit->last = ktime_get_ns(); |
107 | spin_lock_init(&priv->limit->lock); |
108 | |
109 | return 0; |
110 | } |
111 | |
112 | static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit_priv *priv, |
113 | enum nft_limit_type type) |
114 | { |
115 | u32 flags = priv->invert ? NFT_LIMIT_F_INV : 0; |
116 | u64 secs = div_u64(dividend: priv->nsecs, NSEC_PER_SEC); |
117 | |
118 | if (nla_put_be64(skb, attrtype: NFTA_LIMIT_RATE, cpu_to_be64(priv->rate), |
119 | padattr: NFTA_LIMIT_PAD) || |
120 | nla_put_be64(skb, attrtype: NFTA_LIMIT_UNIT, cpu_to_be64(secs), |
121 | padattr: NFTA_LIMIT_PAD) || |
122 | nla_put_be32(skb, attrtype: NFTA_LIMIT_BURST, htonl(priv->burst)) || |
123 | nla_put_be32(skb, attrtype: NFTA_LIMIT_TYPE, htonl(type)) || |
124 | nla_put_be32(skb, attrtype: NFTA_LIMIT_FLAGS, htonl(flags))) |
125 | goto nla_put_failure; |
126 | return 0; |
127 | |
128 | nla_put_failure: |
129 | return -1; |
130 | } |
131 | |
132 | static void nft_limit_destroy(const struct nft_ctx *ctx, |
133 | const struct nft_limit_priv *priv) |
134 | { |
135 | kfree(objp: priv->limit); |
136 | } |
137 | |
138 | static int nft_limit_clone(struct nft_limit_priv *priv_dst, |
139 | const struct nft_limit_priv *priv_src) |
140 | { |
141 | priv_dst->tokens_max = priv_src->tokens_max; |
142 | priv_dst->rate = priv_src->rate; |
143 | priv_dst->nsecs = priv_src->nsecs; |
144 | priv_dst->burst = priv_src->burst; |
145 | priv_dst->invert = priv_src->invert; |
146 | |
147 | priv_dst->limit = kmalloc(size: sizeof(*priv_dst->limit), GFP_ATOMIC); |
148 | if (!priv_dst->limit) |
149 | return -ENOMEM; |
150 | |
151 | spin_lock_init(&priv_dst->limit->lock); |
152 | priv_dst->limit->tokens = priv_src->tokens_max; |
153 | priv_dst->limit->last = ktime_get_ns(); |
154 | |
155 | return 0; |
156 | } |
157 | |
158 | struct nft_limit_priv_pkts { |
159 | struct nft_limit_priv limit; |
160 | u64 cost; |
161 | }; |
162 | |
163 | static void nft_limit_pkts_eval(const struct nft_expr *expr, |
164 | struct nft_regs *regs, |
165 | const struct nft_pktinfo *pkt) |
166 | { |
167 | struct nft_limit_priv_pkts *priv = nft_expr_priv(expr); |
168 | |
169 | if (nft_limit_eval(priv: &priv->limit, cost: priv->cost)) |
170 | regs->verdict.code = NFT_BREAK; |
171 | } |
172 | |
173 | static const struct nla_policy nft_limit_policy[NFTA_LIMIT_MAX + 1] = { |
174 | [NFTA_LIMIT_RATE] = { .type = NLA_U64 }, |
175 | [NFTA_LIMIT_UNIT] = { .type = NLA_U64 }, |
176 | [NFTA_LIMIT_BURST] = { .type = NLA_U32 }, |
177 | [NFTA_LIMIT_TYPE] = { .type = NLA_U32 }, |
178 | [NFTA_LIMIT_FLAGS] = { .type = NLA_U32 }, |
179 | }; |
180 | |
181 | static int nft_limit_pkts_init(const struct nft_ctx *ctx, |
182 | const struct nft_expr *expr, |
183 | const struct nlattr * const tb[]) |
184 | { |
185 | struct nft_limit_priv_pkts *priv = nft_expr_priv(expr); |
186 | int err; |
187 | |
188 | err = nft_limit_init(priv: &priv->limit, tb, pkts: true); |
189 | if (err < 0) |
190 | return err; |
191 | |
192 | priv->cost = div64_u64(dividend: priv->limit.nsecs, divisor: priv->limit.rate); |
193 | return 0; |
194 | } |
195 | |
196 | static int nft_limit_pkts_dump(struct sk_buff *skb, |
197 | const struct nft_expr *expr, bool reset) |
198 | { |
199 | const struct nft_limit_priv_pkts *priv = nft_expr_priv(expr); |
200 | |
201 | return nft_limit_dump(skb, priv: &priv->limit, type: NFT_LIMIT_PKTS); |
202 | } |
203 | |
204 | static void nft_limit_pkts_destroy(const struct nft_ctx *ctx, |
205 | const struct nft_expr *expr) |
206 | { |
207 | const struct nft_limit_priv_pkts *priv = nft_expr_priv(expr); |
208 | |
209 | nft_limit_destroy(ctx, priv: &priv->limit); |
210 | } |
211 | |
212 | static int nft_limit_pkts_clone(struct nft_expr *dst, const struct nft_expr *src) |
213 | { |
214 | struct nft_limit_priv_pkts *priv_dst = nft_expr_priv(expr: dst); |
215 | struct nft_limit_priv_pkts *priv_src = nft_expr_priv(expr: src); |
216 | |
217 | priv_dst->cost = priv_src->cost; |
218 | |
219 | return nft_limit_clone(priv_dst: &priv_dst->limit, priv_src: &priv_src->limit); |
220 | } |
221 | |
222 | static struct nft_expr_type nft_limit_type; |
223 | static const struct nft_expr_ops nft_limit_pkts_ops = { |
224 | .type = &nft_limit_type, |
225 | .size = NFT_EXPR_SIZE(sizeof(struct nft_limit_priv_pkts)), |
226 | .eval = nft_limit_pkts_eval, |
227 | .init = nft_limit_pkts_init, |
228 | .destroy = nft_limit_pkts_destroy, |
229 | .clone = nft_limit_pkts_clone, |
230 | .dump = nft_limit_pkts_dump, |
231 | .reduce = NFT_REDUCE_READONLY, |
232 | }; |
233 | |
234 | static void nft_limit_bytes_eval(const struct nft_expr *expr, |
235 | struct nft_regs *regs, |
236 | const struct nft_pktinfo *pkt) |
237 | { |
238 | struct nft_limit_priv *priv = nft_expr_priv(expr); |
239 | u64 cost = div64_u64(dividend: priv->nsecs * pkt->skb->len, divisor: priv->rate); |
240 | |
241 | if (nft_limit_eval(priv, cost)) |
242 | regs->verdict.code = NFT_BREAK; |
243 | } |
244 | |
245 | static int nft_limit_bytes_init(const struct nft_ctx *ctx, |
246 | const struct nft_expr *expr, |
247 | const struct nlattr * const tb[]) |
248 | { |
249 | struct nft_limit_priv *priv = nft_expr_priv(expr); |
250 | |
251 | return nft_limit_init(priv, tb, pkts: false); |
252 | } |
253 | |
254 | static int nft_limit_bytes_dump(struct sk_buff *skb, |
255 | const struct nft_expr *expr, bool reset) |
256 | { |
257 | const struct nft_limit_priv *priv = nft_expr_priv(expr); |
258 | |
259 | return nft_limit_dump(skb, priv, type: NFT_LIMIT_PKT_BYTES); |
260 | } |
261 | |
262 | static void nft_limit_bytes_destroy(const struct nft_ctx *ctx, |
263 | const struct nft_expr *expr) |
264 | { |
265 | const struct nft_limit_priv *priv = nft_expr_priv(expr); |
266 | |
267 | nft_limit_destroy(ctx, priv); |
268 | } |
269 | |
270 | static int nft_limit_bytes_clone(struct nft_expr *dst, const struct nft_expr *src) |
271 | { |
272 | struct nft_limit_priv *priv_dst = nft_expr_priv(expr: dst); |
273 | struct nft_limit_priv *priv_src = nft_expr_priv(expr: src); |
274 | |
275 | return nft_limit_clone(priv_dst, priv_src); |
276 | } |
277 | |
278 | static const struct nft_expr_ops nft_limit_bytes_ops = { |
279 | .type = &nft_limit_type, |
280 | .size = NFT_EXPR_SIZE(sizeof(struct nft_limit_priv)), |
281 | .eval = nft_limit_bytes_eval, |
282 | .init = nft_limit_bytes_init, |
283 | .dump = nft_limit_bytes_dump, |
284 | .clone = nft_limit_bytes_clone, |
285 | .destroy = nft_limit_bytes_destroy, |
286 | .reduce = NFT_REDUCE_READONLY, |
287 | }; |
288 | |
289 | static const struct nft_expr_ops * |
290 | nft_limit_select_ops(const struct nft_ctx *ctx, |
291 | const struct nlattr * const tb[]) |
292 | { |
293 | if (tb[NFTA_LIMIT_TYPE] == NULL) |
294 | return &nft_limit_pkts_ops; |
295 | |
296 | switch (ntohl(nla_get_be32(tb[NFTA_LIMIT_TYPE]))) { |
297 | case NFT_LIMIT_PKTS: |
298 | return &nft_limit_pkts_ops; |
299 | case NFT_LIMIT_PKT_BYTES: |
300 | return &nft_limit_bytes_ops; |
301 | } |
302 | return ERR_PTR(error: -EOPNOTSUPP); |
303 | } |
304 | |
305 | static struct nft_expr_type nft_limit_type __read_mostly = { |
306 | .name = "limit" , |
307 | .select_ops = nft_limit_select_ops, |
308 | .policy = nft_limit_policy, |
309 | .maxattr = NFTA_LIMIT_MAX, |
310 | .flags = NFT_EXPR_STATEFUL, |
311 | .owner = THIS_MODULE, |
312 | }; |
313 | |
314 | static void nft_limit_obj_pkts_eval(struct nft_object *obj, |
315 | struct nft_regs *regs, |
316 | const struct nft_pktinfo *pkt) |
317 | { |
318 | struct nft_limit_priv_pkts *priv = nft_obj_data(obj); |
319 | |
320 | if (nft_limit_eval(priv: &priv->limit, cost: priv->cost)) |
321 | regs->verdict.code = NFT_BREAK; |
322 | } |
323 | |
324 | static int nft_limit_obj_pkts_init(const struct nft_ctx *ctx, |
325 | const struct nlattr * const tb[], |
326 | struct nft_object *obj) |
327 | { |
328 | struct nft_limit_priv_pkts *priv = nft_obj_data(obj); |
329 | int err; |
330 | |
331 | err = nft_limit_init(priv: &priv->limit, tb, pkts: true); |
332 | if (err < 0) |
333 | return err; |
334 | |
335 | priv->cost = div64_u64(dividend: priv->limit.nsecs, divisor: priv->limit.rate); |
336 | return 0; |
337 | } |
338 | |
339 | static int nft_limit_obj_pkts_dump(struct sk_buff *skb, |
340 | struct nft_object *obj, |
341 | bool reset) |
342 | { |
343 | const struct nft_limit_priv_pkts *priv = nft_obj_data(obj); |
344 | |
345 | return nft_limit_dump(skb, priv: &priv->limit, type: NFT_LIMIT_PKTS); |
346 | } |
347 | |
348 | static void nft_limit_obj_pkts_destroy(const struct nft_ctx *ctx, |
349 | struct nft_object *obj) |
350 | { |
351 | struct nft_limit_priv_pkts *priv = nft_obj_data(obj); |
352 | |
353 | nft_limit_destroy(ctx, priv: &priv->limit); |
354 | } |
355 | |
356 | static struct nft_object_type nft_limit_obj_type; |
357 | static const struct nft_object_ops nft_limit_obj_pkts_ops = { |
358 | .type = &nft_limit_obj_type, |
359 | .size = NFT_EXPR_SIZE(sizeof(struct nft_limit_priv_pkts)), |
360 | .init = nft_limit_obj_pkts_init, |
361 | .destroy = nft_limit_obj_pkts_destroy, |
362 | .eval = nft_limit_obj_pkts_eval, |
363 | .dump = nft_limit_obj_pkts_dump, |
364 | }; |
365 | |
366 | static void nft_limit_obj_bytes_eval(struct nft_object *obj, |
367 | struct nft_regs *regs, |
368 | const struct nft_pktinfo *pkt) |
369 | { |
370 | struct nft_limit_priv *priv = nft_obj_data(obj); |
371 | u64 cost = div64_u64(dividend: priv->nsecs * pkt->skb->len, divisor: priv->rate); |
372 | |
373 | if (nft_limit_eval(priv, cost)) |
374 | regs->verdict.code = NFT_BREAK; |
375 | } |
376 | |
377 | static int nft_limit_obj_bytes_init(const struct nft_ctx *ctx, |
378 | const struct nlattr * const tb[], |
379 | struct nft_object *obj) |
380 | { |
381 | struct nft_limit_priv *priv = nft_obj_data(obj); |
382 | |
383 | return nft_limit_init(priv, tb, pkts: false); |
384 | } |
385 | |
386 | static int nft_limit_obj_bytes_dump(struct sk_buff *skb, |
387 | struct nft_object *obj, |
388 | bool reset) |
389 | { |
390 | const struct nft_limit_priv *priv = nft_obj_data(obj); |
391 | |
392 | return nft_limit_dump(skb, priv, type: NFT_LIMIT_PKT_BYTES); |
393 | } |
394 | |
395 | static void nft_limit_obj_bytes_destroy(const struct nft_ctx *ctx, |
396 | struct nft_object *obj) |
397 | { |
398 | struct nft_limit_priv *priv = nft_obj_data(obj); |
399 | |
400 | nft_limit_destroy(ctx, priv); |
401 | } |
402 | |
403 | static struct nft_object_type nft_limit_obj_type; |
404 | static const struct nft_object_ops nft_limit_obj_bytes_ops = { |
405 | .type = &nft_limit_obj_type, |
406 | .size = sizeof(struct nft_limit_priv), |
407 | .init = nft_limit_obj_bytes_init, |
408 | .destroy = nft_limit_obj_bytes_destroy, |
409 | .eval = nft_limit_obj_bytes_eval, |
410 | .dump = nft_limit_obj_bytes_dump, |
411 | }; |
412 | |
413 | static const struct nft_object_ops * |
414 | nft_limit_obj_select_ops(const struct nft_ctx *ctx, |
415 | const struct nlattr * const tb[]) |
416 | { |
417 | if (!tb[NFTA_LIMIT_TYPE]) |
418 | return &nft_limit_obj_pkts_ops; |
419 | |
420 | switch (ntohl(nla_get_be32(tb[NFTA_LIMIT_TYPE]))) { |
421 | case NFT_LIMIT_PKTS: |
422 | return &nft_limit_obj_pkts_ops; |
423 | case NFT_LIMIT_PKT_BYTES: |
424 | return &nft_limit_obj_bytes_ops; |
425 | } |
426 | return ERR_PTR(error: -EOPNOTSUPP); |
427 | } |
428 | |
429 | static struct nft_object_type nft_limit_obj_type __read_mostly = { |
430 | .select_ops = nft_limit_obj_select_ops, |
431 | .type = NFT_OBJECT_LIMIT, |
432 | .maxattr = NFTA_LIMIT_MAX, |
433 | .policy = nft_limit_policy, |
434 | .owner = THIS_MODULE, |
435 | }; |
436 | |
437 | static int __init nft_limit_module_init(void) |
438 | { |
439 | int err; |
440 | |
441 | err = nft_register_obj(obj_type: &nft_limit_obj_type); |
442 | if (err < 0) |
443 | return err; |
444 | |
445 | err = nft_register_expr(&nft_limit_type); |
446 | if (err < 0) |
447 | goto err1; |
448 | |
449 | return 0; |
450 | err1: |
451 | nft_unregister_obj(obj_type: &nft_limit_obj_type); |
452 | return err; |
453 | } |
454 | |
455 | static void __exit nft_limit_module_exit(void) |
456 | { |
457 | nft_unregister_expr(&nft_limit_type); |
458 | nft_unregister_obj(obj_type: &nft_limit_obj_type); |
459 | } |
460 | |
461 | module_init(nft_limit_module_init); |
462 | module_exit(nft_limit_module_exit); |
463 | |
464 | MODULE_LICENSE("GPL" ); |
465 | MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>" ); |
466 | MODULE_ALIAS_NFT_EXPR("limit" ); |
467 | MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_LIMIT); |
468 | MODULE_DESCRIPTION("nftables limit expression support" ); |
469 | |