1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
5 * Development of this code funded by Astaro AG (http://www.astaro.com/)
8 #include <linux/kernel.h>
9 #include <linux/init.h>
10 #include <linux/module.h>
11 #include <linux/spinlock.h>
12 #include <linux/netlink.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <net/netfilter/nf_tables.h>
23 struct nft_limit_priv
{
24 struct nft_limit
*limit
;
32 static inline bool nft_limit_eval(struct nft_limit_priv
*priv
, u64 cost
)
37 spin_lock_bh(&priv
->limit
->lock
);
39 tokens
= priv
->limit
->tokens
+ now
- priv
->limit
->last
;
40 if (tokens
> priv
->tokens_max
)
41 tokens
= priv
->tokens_max
;
43 priv
->limit
->last
= now
;
44 delta
= tokens
- cost
;
46 priv
->limit
->tokens
= delta
;
47 spin_unlock_bh(&priv
->limit
->lock
);
50 priv
->limit
->tokens
= tokens
;
51 spin_unlock_bh(&priv
->limit
->lock
);
55 /* Use same default as in iptables. */
56 #define NFT_LIMIT_PKT_BURST_DEFAULT 5
58 static int nft_limit_init(struct nft_limit_priv
*priv
,
59 const struct nlattr
* const tb
[], bool pkts
)
63 if (tb
[NFTA_LIMIT_RATE
] == NULL
||
64 tb
[NFTA_LIMIT_UNIT
] == NULL
)
67 priv
->rate
= be64_to_cpu(nla_get_be64(tb
[NFTA_LIMIT_RATE
]));
68 unit
= be64_to_cpu(nla_get_be64(tb
[NFTA_LIMIT_UNIT
]));
69 priv
->nsecs
= unit
* NSEC_PER_SEC
;
70 if (priv
->rate
== 0 || priv
->nsecs
< unit
)
73 if (tb
[NFTA_LIMIT_BURST
])
74 priv
->burst
= ntohl(nla_get_be32(tb
[NFTA_LIMIT_BURST
]));
76 if (pkts
&& priv
->burst
== 0)
77 priv
->burst
= NFT_LIMIT_PKT_BURST_DEFAULT
;
79 if (priv
->rate
+ priv
->burst
< priv
->rate
)
83 tokens
= div64_u64(priv
->nsecs
, priv
->rate
) * priv
->burst
;
85 /* The token bucket size limits the number of tokens can be
86 * accumulated. tokens_max specifies the bucket size.
87 * tokens_max = unit * (rate + burst) / rate.
89 tokens
= div64_u64(priv
->nsecs
* (priv
->rate
+ priv
->burst
),
93 priv
->limit
= kmalloc(sizeof(*priv
->limit
), GFP_KERNEL_ACCOUNT
);
97 priv
->limit
->tokens
= tokens
;
98 priv
->tokens_max
= priv
->limit
->tokens
;
100 if (tb
[NFTA_LIMIT_FLAGS
]) {
101 u32 flags
= ntohl(nla_get_be32(tb
[NFTA_LIMIT_FLAGS
]));
103 if (flags
& NFT_LIMIT_F_INV
)
106 priv
->limit
->last
= ktime_get_ns();
107 spin_lock_init(&priv
->limit
->lock
);
112 static int nft_limit_dump(struct sk_buff
*skb
, const struct nft_limit_priv
*priv
,
113 enum nft_limit_type type
)
115 u32 flags
= priv
->invert
? NFT_LIMIT_F_INV
: 0;
116 u64 secs
= div_u64(priv
->nsecs
, NSEC_PER_SEC
);
118 if (nla_put_be64(skb
, NFTA_LIMIT_RATE
, cpu_to_be64(priv
->rate
),
120 nla_put_be64(skb
, NFTA_LIMIT_UNIT
, cpu_to_be64(secs
),
122 nla_put_be32(skb
, NFTA_LIMIT_BURST
, htonl(priv
->burst
)) ||
123 nla_put_be32(skb
, NFTA_LIMIT_TYPE
, htonl(type
)) ||
124 nla_put_be32(skb
, NFTA_LIMIT_FLAGS
, htonl(flags
)))
125 goto nla_put_failure
;
132 static void nft_limit_destroy(const struct nft_ctx
*ctx
,
133 const struct nft_limit_priv
*priv
)
138 static int nft_limit_clone(struct nft_limit_priv
*priv_dst
,
139 const struct nft_limit_priv
*priv_src
)
141 priv_dst
->tokens_max
= priv_src
->tokens_max
;
142 priv_dst
->rate
= priv_src
->rate
;
143 priv_dst
->nsecs
= priv_src
->nsecs
;
144 priv_dst
->burst
= priv_src
->burst
;
145 priv_dst
->invert
= priv_src
->invert
;
147 priv_dst
->limit
= kmalloc(sizeof(*priv_dst
->limit
), GFP_ATOMIC
);
148 if (!priv_dst
->limit
)
151 spin_lock_init(&priv_dst
->limit
->lock
);
152 priv_dst
->limit
->tokens
= priv_src
->tokens_max
;
153 priv_dst
->limit
->last
= ktime_get_ns();
158 struct nft_limit_priv_pkts
{
159 struct nft_limit_priv limit
;
163 static void nft_limit_pkts_eval(const struct nft_expr
*expr
,
164 struct nft_regs
*regs
,
165 const struct nft_pktinfo
*pkt
)
167 struct nft_limit_priv_pkts
*priv
= nft_expr_priv(expr
);
169 if (nft_limit_eval(&priv
->limit
, priv
->cost
))
170 regs
->verdict
.code
= NFT_BREAK
;
173 static const struct nla_policy nft_limit_policy
[NFTA_LIMIT_MAX
+ 1] = {
174 [NFTA_LIMIT_RATE
] = { .type
= NLA_U64
},
175 [NFTA_LIMIT_UNIT
] = { .type
= NLA_U64
},
176 [NFTA_LIMIT_BURST
] = { .type
= NLA_U32
},
177 [NFTA_LIMIT_TYPE
] = { .type
= NLA_U32
},
178 [NFTA_LIMIT_FLAGS
] = { .type
= NLA_U32
},
181 static int nft_limit_pkts_init(const struct nft_ctx
*ctx
,
182 const struct nft_expr
*expr
,
183 const struct nlattr
* const tb
[])
185 struct nft_limit_priv_pkts
*priv
= nft_expr_priv(expr
);
188 err
= nft_limit_init(&priv
->limit
, tb
, true);
192 priv
->cost
= div64_u64(priv
->limit
.nsecs
, priv
->limit
.rate
);
196 static int nft_limit_pkts_dump(struct sk_buff
*skb
,
197 const struct nft_expr
*expr
, bool reset
)
199 const struct nft_limit_priv_pkts
*priv
= nft_expr_priv(expr
);
201 return nft_limit_dump(skb
, &priv
->limit
, NFT_LIMIT_PKTS
);
204 static void nft_limit_pkts_destroy(const struct nft_ctx
*ctx
,
205 const struct nft_expr
*expr
)
207 const struct nft_limit_priv_pkts
*priv
= nft_expr_priv(expr
);
209 nft_limit_destroy(ctx
, &priv
->limit
);
212 static int nft_limit_pkts_clone(struct nft_expr
*dst
, const struct nft_expr
*src
)
214 struct nft_limit_priv_pkts
*priv_dst
= nft_expr_priv(dst
);
215 struct nft_limit_priv_pkts
*priv_src
= nft_expr_priv(src
);
217 priv_dst
->cost
= priv_src
->cost
;
219 return nft_limit_clone(&priv_dst
->limit
, &priv_src
->limit
);
222 static struct nft_expr_type nft_limit_type
;
223 static const struct nft_expr_ops nft_limit_pkts_ops
= {
224 .type
= &nft_limit_type
,
225 .size
= NFT_EXPR_SIZE(sizeof(struct nft_limit_priv_pkts
)),
226 .eval
= nft_limit_pkts_eval
,
227 .init
= nft_limit_pkts_init
,
228 .destroy
= nft_limit_pkts_destroy
,
229 .clone
= nft_limit_pkts_clone
,
230 .dump
= nft_limit_pkts_dump
,
231 .reduce
= NFT_REDUCE_READONLY
,
234 static void nft_limit_bytes_eval(const struct nft_expr
*expr
,
235 struct nft_regs
*regs
,
236 const struct nft_pktinfo
*pkt
)
238 struct nft_limit_priv
*priv
= nft_expr_priv(expr
);
239 u64 cost
= div64_u64(priv
->nsecs
* pkt
->skb
->len
, priv
->rate
);
241 if (nft_limit_eval(priv
, cost
))
242 regs
->verdict
.code
= NFT_BREAK
;
245 static int nft_limit_bytes_init(const struct nft_ctx
*ctx
,
246 const struct nft_expr
*expr
,
247 const struct nlattr
* const tb
[])
249 struct nft_limit_priv
*priv
= nft_expr_priv(expr
);
251 return nft_limit_init(priv
, tb
, false);
254 static int nft_limit_bytes_dump(struct sk_buff
*skb
,
255 const struct nft_expr
*expr
, bool reset
)
257 const struct nft_limit_priv
*priv
= nft_expr_priv(expr
);
259 return nft_limit_dump(skb
, priv
, NFT_LIMIT_PKT_BYTES
);
262 static void nft_limit_bytes_destroy(const struct nft_ctx
*ctx
,
263 const struct nft_expr
*expr
)
265 const struct nft_limit_priv
*priv
= nft_expr_priv(expr
);
267 nft_limit_destroy(ctx
, priv
);
270 static int nft_limit_bytes_clone(struct nft_expr
*dst
, const struct nft_expr
*src
)
272 struct nft_limit_priv
*priv_dst
= nft_expr_priv(dst
);
273 struct nft_limit_priv
*priv_src
= nft_expr_priv(src
);
275 return nft_limit_clone(priv_dst
, priv_src
);
278 static const struct nft_expr_ops nft_limit_bytes_ops
= {
279 .type
= &nft_limit_type
,
280 .size
= NFT_EXPR_SIZE(sizeof(struct nft_limit_priv
)),
281 .eval
= nft_limit_bytes_eval
,
282 .init
= nft_limit_bytes_init
,
283 .dump
= nft_limit_bytes_dump
,
284 .clone
= nft_limit_bytes_clone
,
285 .destroy
= nft_limit_bytes_destroy
,
286 .reduce
= NFT_REDUCE_READONLY
,
289 static const struct nft_expr_ops
*
290 nft_limit_select_ops(const struct nft_ctx
*ctx
,
291 const struct nlattr
* const tb
[])
293 if (tb
[NFTA_LIMIT_TYPE
] == NULL
)
294 return &nft_limit_pkts_ops
;
296 switch (ntohl(nla_get_be32(tb
[NFTA_LIMIT_TYPE
]))) {
298 return &nft_limit_pkts_ops
;
299 case NFT_LIMIT_PKT_BYTES
:
300 return &nft_limit_bytes_ops
;
302 return ERR_PTR(-EOPNOTSUPP
);
305 static struct nft_expr_type nft_limit_type __read_mostly
= {
307 .select_ops
= nft_limit_select_ops
,
308 .policy
= nft_limit_policy
,
309 .maxattr
= NFTA_LIMIT_MAX
,
310 .flags
= NFT_EXPR_STATEFUL
,
311 .owner
= THIS_MODULE
,
314 static void nft_limit_obj_pkts_eval(struct nft_object
*obj
,
315 struct nft_regs
*regs
,
316 const struct nft_pktinfo
*pkt
)
318 struct nft_limit_priv_pkts
*priv
= nft_obj_data(obj
);
320 if (nft_limit_eval(&priv
->limit
, priv
->cost
))
321 regs
->verdict
.code
= NFT_BREAK
;
324 static int nft_limit_obj_pkts_init(const struct nft_ctx
*ctx
,
325 const struct nlattr
* const tb
[],
326 struct nft_object
*obj
)
328 struct nft_limit_priv_pkts
*priv
= nft_obj_data(obj
);
331 err
= nft_limit_init(&priv
->limit
, tb
, true);
335 priv
->cost
= div64_u64(priv
->limit
.nsecs
, priv
->limit
.rate
);
339 static int nft_limit_obj_pkts_dump(struct sk_buff
*skb
,
340 struct nft_object
*obj
,
343 const struct nft_limit_priv_pkts
*priv
= nft_obj_data(obj
);
345 return nft_limit_dump(skb
, &priv
->limit
, NFT_LIMIT_PKTS
);
348 static void nft_limit_obj_pkts_destroy(const struct nft_ctx
*ctx
,
349 struct nft_object
*obj
)
351 struct nft_limit_priv_pkts
*priv
= nft_obj_data(obj
);
353 nft_limit_destroy(ctx
, &priv
->limit
);
356 static struct nft_object_type nft_limit_obj_type
;
357 static const struct nft_object_ops nft_limit_obj_pkts_ops
= {
358 .type
= &nft_limit_obj_type
,
359 .size
= NFT_EXPR_SIZE(sizeof(struct nft_limit_priv_pkts
)),
360 .init
= nft_limit_obj_pkts_init
,
361 .destroy
= nft_limit_obj_pkts_destroy
,
362 .eval
= nft_limit_obj_pkts_eval
,
363 .dump
= nft_limit_obj_pkts_dump
,
366 static void nft_limit_obj_bytes_eval(struct nft_object
*obj
,
367 struct nft_regs
*regs
,
368 const struct nft_pktinfo
*pkt
)
370 struct nft_limit_priv
*priv
= nft_obj_data(obj
);
371 u64 cost
= div64_u64(priv
->nsecs
* pkt
->skb
->len
, priv
->rate
);
373 if (nft_limit_eval(priv
, cost
))
374 regs
->verdict
.code
= NFT_BREAK
;
377 static int nft_limit_obj_bytes_init(const struct nft_ctx
*ctx
,
378 const struct nlattr
* const tb
[],
379 struct nft_object
*obj
)
381 struct nft_limit_priv
*priv
= nft_obj_data(obj
);
383 return nft_limit_init(priv
, tb
, false);
386 static int nft_limit_obj_bytes_dump(struct sk_buff
*skb
,
387 struct nft_object
*obj
,
390 const struct nft_limit_priv
*priv
= nft_obj_data(obj
);
392 return nft_limit_dump(skb
, priv
, NFT_LIMIT_PKT_BYTES
);
395 static void nft_limit_obj_bytes_destroy(const struct nft_ctx
*ctx
,
396 struct nft_object
*obj
)
398 struct nft_limit_priv
*priv
= nft_obj_data(obj
);
400 nft_limit_destroy(ctx
, priv
);
403 static struct nft_object_type nft_limit_obj_type
;
404 static const struct nft_object_ops nft_limit_obj_bytes_ops
= {
405 .type
= &nft_limit_obj_type
,
406 .size
= sizeof(struct nft_limit_priv
),
407 .init
= nft_limit_obj_bytes_init
,
408 .destroy
= nft_limit_obj_bytes_destroy
,
409 .eval
= nft_limit_obj_bytes_eval
,
410 .dump
= nft_limit_obj_bytes_dump
,
413 static const struct nft_object_ops
*
414 nft_limit_obj_select_ops(const struct nft_ctx
*ctx
,
415 const struct nlattr
* const tb
[])
417 if (!tb
[NFTA_LIMIT_TYPE
])
418 return &nft_limit_obj_pkts_ops
;
420 switch (ntohl(nla_get_be32(tb
[NFTA_LIMIT_TYPE
]))) {
422 return &nft_limit_obj_pkts_ops
;
423 case NFT_LIMIT_PKT_BYTES
:
424 return &nft_limit_obj_bytes_ops
;
426 return ERR_PTR(-EOPNOTSUPP
);
429 static struct nft_object_type nft_limit_obj_type __read_mostly
= {
430 .select_ops
= nft_limit_obj_select_ops
,
431 .type
= NFT_OBJECT_LIMIT
,
432 .maxattr
= NFTA_LIMIT_MAX
,
433 .policy
= nft_limit_policy
,
434 .owner
= THIS_MODULE
,
437 static int __init
nft_limit_module_init(void)
441 err
= nft_register_obj(&nft_limit_obj_type
);
445 err
= nft_register_expr(&nft_limit_type
);
451 nft_unregister_obj(&nft_limit_obj_type
);
455 static void __exit
nft_limit_module_exit(void)
457 nft_unregister_expr(&nft_limit_type
);
458 nft_unregister_obj(&nft_limit_obj_type
);
461 module_init(nft_limit_module_init
);
462 module_exit(nft_limit_module_exit
);
464 MODULE_LICENSE("GPL");
465 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
466 MODULE_ALIAS_NFT_EXPR("limit");
467 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_LIMIT
);
468 MODULE_DESCRIPTION("nftables limit expression support");