[people/ms/linux.git] / net / netfilter / nft_limit.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
 *
 * Development of this code funded by Astaro AG (http://www.astaro.com/)
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/spinlock.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>

struct nft_limit {
	spinlock_t	lock;
	u64		last;
	u64		tokens;
	u64		tokens_max;
	u64		rate;
	u64		nsecs;
	u32		burst;
	bool		invert;
};

static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost)
{
	u64 now, tokens;
	s64 delta;

	spin_lock_bh(&limit->lock);
	now = ktime_get_ns();
	tokens = limit->tokens + now - limit->last;
	if (tokens > limit->tokens_max)
		tokens = limit->tokens_max;

	limit->last = now;
	delta = tokens - cost;
	if (delta >= 0) {
		limit->tokens = delta;
		spin_unlock_bh(&limit->lock);
		return limit->invert;
	}
	limit->tokens = tokens;
	spin_unlock_bh(&limit->lock);
	return !limit->invert;
}

/* Use same default as in iptables. */
#define NFT_LIMIT_PKT_BURST_DEFAULT	5

static int nft_limit_init(struct nft_limit *limit,
			  const struct nlattr * const tb[], bool pkts)
{
	u64 unit, tokens;

	if (tb[NFTA_LIMIT_RATE] == NULL ||
	    tb[NFTA_LIMIT_UNIT] == NULL)
		return -EINVAL;

	limit->rate = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE]));
	unit = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_UNIT]));
	limit->nsecs = unit * NSEC_PER_SEC;
	if (limit->rate == 0 || limit->nsecs < unit)
		return -EOVERFLOW;

	if (tb[NFTA_LIMIT_BURST])
		limit->burst = ntohl(nla_get_be32(tb[NFTA_LIMIT_BURST]));

	if (pkts && limit->burst == 0)
		limit->burst = NFT_LIMIT_PKT_BURST_DEFAULT;

	if (limit->rate + limit->burst < limit->rate)
		return -EOVERFLOW;

	if (pkts) {
		tokens = div64_u64(limit->nsecs, limit->rate) * limit->burst;
	} else {
		/* The token bucket size limits the number of tokens can be
		 * accumulated. tokens_max specifies the bucket size.
		 * tokens_max = unit * (rate + burst) / rate.
		 */
		tokens = div64_u64(limit->nsecs * (limit->rate + limit->burst),
				 limit->rate);
	}

	limit->tokens = tokens;
	limit->tokens_max = limit->tokens;

	if (tb[NFTA_LIMIT_FLAGS]) {
		u32 flags = ntohl(nla_get_be32(tb[NFTA_LIMIT_FLAGS]));

		if (flags & NFT_LIMIT_F_INV)
			limit->invert = true;
	}
	limit->last = ktime_get_ns();
	spin_lock_init(&limit->lock);

	return 0;
}

static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit *limit,
			  enum nft_limit_type type)
{
	u32 flags = limit->invert ? NFT_LIMIT_F_INV : 0;
	u64 secs = div_u64(limit->nsecs, NSEC_PER_SEC);

	if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(limit->rate),
			 NFTA_LIMIT_PAD) ||
	    nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(secs),
			 NFTA_LIMIT_PAD) ||
	    nla_put_be32(skb, NFTA_LIMIT_BURST, htonl(limit->burst)) ||
	    nla_put_be32(skb, NFTA_LIMIT_TYPE, htonl(type)) ||
	    nla_put_be32(skb, NFTA_LIMIT_FLAGS, htonl(flags)))
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -1;
}

struct nft_limit_pkts {
	struct nft_limit	limit;
	u64			cost;
};

static void nft_limit_pkts_eval(const struct nft_expr *expr,
				struct nft_regs *regs,
				const struct nft_pktinfo *pkt)
{
	struct nft_limit_pkts *priv = nft_expr_priv(expr);

	if (nft_limit_eval(&priv->limit, priv->cost))
		regs->verdict.code = NFT_BREAK;
}

static const struct nla_policy nft_limit_policy[NFTA_LIMIT_MAX + 1] = {
	[NFTA_LIMIT_RATE]	= { .type = NLA_U64 },
	[NFTA_LIMIT_UNIT]	= { .type = NLA_U64 },
	[NFTA_LIMIT_BURST]	= { .type = NLA_U32 },
	[NFTA_LIMIT_TYPE]	= { .type = NLA_U32 },
	[NFTA_LIMIT_FLAGS]	= { .type = NLA_U32 },
};

static int nft_limit_pkts_init(const struct nft_ctx *ctx,
			       const struct nft_expr *expr,
			       const struct nlattr * const tb[])
{
	struct nft_limit_pkts *priv = nft_expr_priv(expr);
	int err;

	err = nft_limit_init(&priv->limit, tb, true);
	if (err < 0)
		return err;

	priv->cost = div64_u64(priv->limit.nsecs, priv->limit.rate);
	return 0;
}

static int nft_limit_pkts_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	const struct nft_limit_pkts *priv = nft_expr_priv(expr);

	return nft_limit_dump(skb, &priv->limit, NFT_LIMIT_PKTS);
}

static struct nft_expr_type nft_limit_type;
static const struct nft_expr_ops nft_limit_pkts_ops = {
	.type		= &nft_limit_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_limit_pkts)),
	.eval		= nft_limit_pkts_eval,
	.init		= nft_limit_pkts_init,
	.dump		= nft_limit_pkts_dump,
};

static void nft_limit_bytes_eval(const struct nft_expr *expr,
				 struct nft_regs *regs,
				 const struct nft_pktinfo *pkt)
{
	struct nft_limit *priv = nft_expr_priv(expr);
	u64 cost = div64_u64(priv->nsecs * pkt->skb->len, priv->rate);

	if (nft_limit_eval(priv, cost))
		regs->verdict.code = NFT_BREAK;
}

static int nft_limit_bytes_init(const struct nft_ctx *ctx,
				const struct nft_expr *expr,
				const struct nlattr * const tb[])
{
	struct nft_limit *priv = nft_expr_priv(expr);

	return nft_limit_init(priv, tb, false);
}

static int nft_limit_bytes_dump(struct sk_buff *skb,
				const struct nft_expr *expr)
{
	const struct nft_limit *priv = nft_expr_priv(expr);

	return nft_limit_dump(skb, priv, NFT_LIMIT_PKT_BYTES);
}

static const struct nft_expr_ops nft_limit_bytes_ops = {
	.type		= &nft_limit_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_limit)),
	.eval		= nft_limit_bytes_eval,
	.init		= nft_limit_bytes_init,
	.dump		= nft_limit_bytes_dump,
};

static const struct nft_expr_ops *
nft_limit_select_ops(const struct nft_ctx *ctx,
		     const struct nlattr * const tb[])
{
	if (tb[NFTA_LIMIT_TYPE] == NULL)
		return &nft_limit_pkts_ops;

	switch (ntohl(nla_get_be32(tb[NFTA_LIMIT_TYPE]))) {
	case NFT_LIMIT_PKTS:
		return &nft_limit_pkts_ops;
	case NFT_LIMIT_PKT_BYTES:
		return &nft_limit_bytes_ops;
	}
	return ERR_PTR(-EOPNOTSUPP);
}

static struct nft_expr_type nft_limit_type __read_mostly = {
	.name		= "limit",
	.select_ops	= nft_limit_select_ops,
	.policy		= nft_limit_policy,
	.maxattr	= NFTA_LIMIT_MAX,
	.flags		= NFT_EXPR_STATEFUL,
	.owner		= THIS_MODULE,
};

static void nft_limit_obj_pkts_eval(struct nft_object *obj,
				    struct nft_regs *regs,
				    const struct nft_pktinfo *pkt)
{
	struct nft_limit_pkts *priv = nft_obj_data(obj);

	if (nft_limit_eval(&priv->limit, priv->cost))
		regs->verdict.code = NFT_BREAK;
}

static int nft_limit_obj_pkts_init(const struct nft_ctx *ctx,
				   const struct nlattr * const tb[],
				   struct nft_object *obj)
{
	struct nft_limit_pkts *priv = nft_obj_data(obj);
	int err;

	err = nft_limit_init(&priv->limit, tb, true);
	if (err < 0)
		return err;

	priv->cost = div64_u64(priv->limit.nsecs, priv->limit.rate);
	return 0;
}

static int nft_limit_obj_pkts_dump(struct sk_buff *skb,
				   struct nft_object *obj,
				   bool reset)
{
	const struct nft_limit_pkts *priv = nft_obj_data(obj);

	return nft_limit_dump(skb, &priv->limit, NFT_LIMIT_PKTS);
}

static struct nft_object_type nft_limit_obj_type;
static const struct nft_object_ops nft_limit_obj_pkts_ops = {
	.type		= &nft_limit_obj_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_limit_pkts)),
	.init		= nft_limit_obj_pkts_init,
	.eval		= nft_limit_obj_pkts_eval,
	.dump		= nft_limit_obj_pkts_dump,
};

static void nft_limit_obj_bytes_eval(struct nft_object *obj,
				     struct nft_regs *regs,
				     const struct nft_pktinfo *pkt)
{
	struct nft_limit *priv = nft_obj_data(obj);
	u64 cost = div64_u64(priv->nsecs * pkt->skb->len, priv->rate);

	if (nft_limit_eval(priv, cost))
		regs->verdict.code = NFT_BREAK;
}

static int nft_limit_obj_bytes_init(const struct nft_ctx *ctx,
				    const struct nlattr * const tb[],
				    struct nft_object *obj)
{
	struct nft_limit *priv = nft_obj_data(obj);

	return nft_limit_init(priv, tb, false);
}

static int nft_limit_obj_bytes_dump(struct sk_buff *skb,
				    struct nft_object *obj,
				    bool reset)
{
	const struct nft_limit *priv = nft_obj_data(obj);

	return nft_limit_dump(skb, priv, NFT_LIMIT_PKT_BYTES);
}

static struct nft_object_type nft_limit_obj_type;
static const struct nft_object_ops nft_limit_obj_bytes_ops = {
	.type		= &nft_limit_obj_type,
	.size		= sizeof(struct nft_limit),
	.init		= nft_limit_obj_bytes_init,
	.eval		= nft_limit_obj_bytes_eval,
	.dump		= nft_limit_obj_bytes_dump,
};

static const struct nft_object_ops *
nft_limit_obj_select_ops(const struct nft_ctx *ctx,
			 const struct nlattr * const tb[])
{
	if (!tb[NFTA_LIMIT_TYPE])
		return &nft_limit_obj_pkts_ops;

	switch (ntohl(nla_get_be32(tb[NFTA_LIMIT_TYPE]))) {
	case NFT_LIMIT_PKTS:
		return &nft_limit_obj_pkts_ops;
	case NFT_LIMIT_PKT_BYTES:
		return &nft_limit_obj_bytes_ops;
	}
	return ERR_PTR(-EOPNOTSUPP);
}

static struct nft_object_type nft_limit_obj_type __read_mostly = {
	.select_ops	= nft_limit_obj_select_ops,
	.type		= NFT_OBJECT_LIMIT,
	.maxattr	= NFTA_LIMIT_MAX,
	.policy		= nft_limit_policy,
	.owner		= THIS_MODULE,
};

static int __init nft_limit_module_init(void)
{
	int err;

	err = nft_register_obj(&nft_limit_obj_type);
	if (err < 0)
		return err;

	err = nft_register_expr(&nft_limit_type);
	if (err < 0)
		goto err1;

	return 0;
err1:
	nft_unregister_obj(&nft_limit_obj_type);
	return err;
}

static void __exit nft_limit_module_exit(void)
{
	nft_unregister_expr(&nft_limit_type);
	nft_unregister_obj(&nft_limit_obj_type);
}

module_init(nft_limit_module_init);
module_exit(nft_limit_module_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_ALIAS_NFT_EXPR("limit");
MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_LIMIT);
MODULE_DESCRIPTION("nftables limit expression support");
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
96518518	2	/*
ef1f7df9	3	* Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
96518518	4	*
96518518 PM	5	* Development of this code funded by Astaro AG (http://www.astaro.com/)
	6	*/
	7
	8	#include <linux/kernel.h>
	9	#include <linux/init.h>
	10	#include <linux/module.h>
	11	#include <linux/spinlock.h>
	12	#include <linux/netlink.h>
	13	#include <linux/netfilter.h>
	14	#include <linux/netfilter/nf_tables.h>
	15	#include <net/netfilter/nf_tables.h>
	16
96518518	17	struct nft_limit {
2cb4bbd7	18	spinlock_t lock;
dba27ec1	19	u64 last;
96518518	20	u64 tokens;
dba27ec1	21	u64 tokens_max;
96518518	22	u64 rate;
dba27ec1	23	u64 nsecs;
3e87baaf	24	u32 burst;
c7862a5f	25	bool invert;
96518518 PM	26	};
96518518 PM	27
f8d3a6bc	28	static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost)
96518518	29	{
f8d3a6bc	30	u64 now, tokens;
dba27ec1	31	s64 delta;
96518518	32
2cb4bbd7	33	spin_lock_bh(&limit->lock);
dba27ec1	34	now = ktime_get_ns();
f8d3a6bc PNA	35	tokens = limit->tokens + now - limit->last;
	36	if (tokens > limit->tokens_max)
	37	tokens = limit->tokens_max;
dba27ec1	38
f8d3a6bc	39	limit->last = now;
dba27ec1 PNA	40	delta = tokens - cost;
dba27ec1 PNA	41	if (delta >= 0) {
f8d3a6bc	42	limit->tokens = delta;
2cb4bbd7	43	spin_unlock_bh(&limit->lock);
c7862a5f	44	return limit->invert;
96518518	45	}
f8d3a6bc	46	limit->tokens = tokens;
2cb4bbd7	47	spin_unlock_bh(&limit->lock);
c7862a5f	48	return !limit->invert;
96518518 PM	49	}
96518518 PM	50
3e0f64b7 PNA	51	/* Use same default as in iptables. */
	52	#define NFT_LIMIT_PKT_BURST_DEFAULT 5
	53
f8d3a6bc	54	static int nft_limit_init(struct nft_limit *limit,
3e0f64b7	55	const struct nlattr * const tb[], bool pkts)
96518518	56	{
3e0f64b7	57	u64 unit, tokens;
96518518 PM	58
	59	if (tb[NFTA_LIMIT_RATE] == NULL \|\|
	60	tb[NFTA_LIMIT_UNIT] == NULL)
	61	return -EINVAL;
	62
f8d3a6bc	63	limit->rate = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE]));
dba27ec1	64	unit = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_UNIT]));
f8d3a6bc PNA	65	limit->nsecs = unit * NSEC_PER_SEC;
f8d3a6bc PNA	66	if (limit->rate == 0 \|\| limit->nsecs < unit)
dba27ec1	67	return -EOVERFLOW;
3e87baaf	68
c26844ed	69	if (tb[NFTA_LIMIT_BURST])
3e87baaf	70	limit->burst = ntohl(nla_get_be32(tb[NFTA_LIMIT_BURST]));
3e0f64b7 PNA	71
	72	if (pkts && limit->burst == 0)
	73	limit->burst = NFT_LIMIT_PKT_BURST_DEFAULT;
c26844ed	74
	75	if (limit->rate + limit->burst < limit->rate)
	76	return -EOVERFLOW;
3e87baaf	77
3e0f64b7	78	if (pkts) {
b895bdf5	79	tokens = div64_u64(limit->nsecs, limit->rate) * limit->burst;
3e0f64b7 PNA	80	} else {
	81	/* The token bucket size limits the number of tokens can be
	82	* accumulated. tokens_max specifies the bucket size.
	83	* tokens_max = unit * (rate + burst) / rate.
	84	*/
b895bdf5	85	tokens = div64_u64(limit->nsecs * (limit->rate + limit->burst),
3e0f64b7 PNA	86	limit->rate);
	87	}
	88
	89	limit->tokens = tokens;
c26844ed	90	limit->tokens_max = limit->tokens;
3e87baaf	91
c7862a5f PNA	92	if (tb[NFTA_LIMIT_FLAGS]) {
	93	u32 flags = ntohl(nla_get_be32(tb[NFTA_LIMIT_FLAGS]));
	94
	95	if (flags & NFT_LIMIT_F_INV)
	96	limit->invert = true;
	97	}
f8d3a6bc	98	limit->last = ktime_get_ns();
2cb4bbd7	99	spin_lock_init(&limit->lock);
f8d3a6bc	100
96518518 PM	101	return 0;
	102	}
	103
d2168e84 PNA	104	static int nft_limit_dump(struct sk_buff skb, const struct nft_limit limit,
d2168e84 PNA	105	enum nft_limit_type type)
96518518	106	{
c7862a5f	107	u32 flags = limit->invert ? NFT_LIMIT_F_INV : 0;
f8d3a6bc	108	u64 secs = div_u64(limit->nsecs, NSEC_PER_SEC);
96518518	109
c26844ed	110	if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(limit->rate),
b46f6ded ND	111	NFTA_LIMIT_PAD) \|\|
	112	nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(secs),
	113	NFTA_LIMIT_PAD) \|\|
d2168e84	114	nla_put_be32(skb, NFTA_LIMIT_BURST, htonl(limit->burst)) \|\|
c7862a5f PNA	115	nla_put_be32(skb, NFTA_LIMIT_TYPE, htonl(type)) \|\|
c7862a5f PNA	116	nla_put_be32(skb, NFTA_LIMIT_FLAGS, htonl(flags)))
96518518 PM	117	goto nla_put_failure;
	118	return 0;
	119
	120	nla_put_failure:
	121	return -1;
	122	}
	123
8bdf3626 PNA	124	struct nft_limit_pkts {
	125	struct nft_limit limit;
	126	u64 cost;
	127	};
	128
f8d3a6bc PNA	129	static void nft_limit_pkts_eval(const struct nft_expr *expr,
	130	struct nft_regs *regs,
	131	const struct nft_pktinfo *pkt)
	132	{
8bdf3626	133	struct nft_limit_pkts *priv = nft_expr_priv(expr);
f8d3a6bc	134
8bdf3626	135	if (nft_limit_eval(&priv->limit, priv->cost))
f8d3a6bc PNA	136	regs->verdict.code = NFT_BREAK;
	137	}
	138
	139	static const struct nla_policy nft_limit_policy[NFTA_LIMIT_MAX + 1] = {
	140	[NFTA_LIMIT_RATE] = { .type = NLA_U64 },
	141	[NFTA_LIMIT_UNIT] = { .type = NLA_U64 },
3e87baaf	142	[NFTA_LIMIT_BURST] = { .type = NLA_U32 },
d2168e84	143	[NFTA_LIMIT_TYPE] = { .type = NLA_U32 },
c7862a5f	144	[NFTA_LIMIT_FLAGS] = { .type = NLA_U32 },
f8d3a6bc PNA	145	};
	146
	147	static int nft_limit_pkts_init(const struct nft_ctx *ctx,
	148	const struct nft_expr *expr,
	149	const struct nlattr * const tb[])
	150	{
8bdf3626 PNA	151	struct nft_limit_pkts *priv = nft_expr_priv(expr);
8bdf3626 PNA	152	int err;
f8d3a6bc	153
3e0f64b7	154	err = nft_limit_init(&priv->limit, tb, true);
8bdf3626 PNA	155	if (err < 0)
	156	return err;
	157
2fa46c13	158	priv->cost = div64_u64(priv->limit.nsecs, priv->limit.rate);
8bdf3626	159	return 0;
f8d3a6bc PNA	160	}
	161
	162	static int nft_limit_pkts_dump(struct sk_buff skb, const struct nft_expr expr)
	163	{
8bdf3626	164	const struct nft_limit_pkts *priv = nft_expr_priv(expr);
f8d3a6bc	165
d2168e84	166	return nft_limit_dump(skb, &priv->limit, NFT_LIMIT_PKTS);
f8d3a6bc PNA	167	}
f8d3a6bc PNA	168
ef1f7df9	169	static struct nft_expr_type nft_limit_type;
09e4e42a	170	static const struct nft_expr_ops nft_limit_pkts_ops = {
ef1f7df9	171	.type = &nft_limit_type,
8bdf3626	172	.size = NFT_EXPR_SIZE(sizeof(struct nft_limit_pkts)),
09e4e42a	173	.eval = nft_limit_pkts_eval,
f8d3a6bc PNA	174	.init = nft_limit_pkts_init,
f8d3a6bc PNA	175	.dump = nft_limit_pkts_dump,
ef1f7df9 PM	176	};
ef1f7df9 PM	177
6e323887 PBG	178	static void nft_limit_bytes_eval(const struct nft_expr *expr,
	179	struct nft_regs *regs,
	180	const struct nft_pktinfo *pkt)
d2168e84 PNA	181	{
d2168e84 PNA	182	struct nft_limit *priv = nft_expr_priv(expr);
2fa46c13	183	u64 cost = div64_u64(priv->nsecs * pkt->skb->len, priv->rate);
d2168e84 PNA	184
	185	if (nft_limit_eval(priv, cost))
	186	regs->verdict.code = NFT_BREAK;
	187	}
	188
6e323887 PBG	189	static int nft_limit_bytes_init(const struct nft_ctx *ctx,
	190	const struct nft_expr *expr,
	191	const struct nlattr * const tb[])
d2168e84 PNA	192	{
	193	struct nft_limit *priv = nft_expr_priv(expr);
	194
3e0f64b7	195	return nft_limit_init(priv, tb, false);
d2168e84 PNA	196	}
d2168e84 PNA	197
6e323887 PBG	198	static int nft_limit_bytes_dump(struct sk_buff *skb,
6e323887 PBG	199	const struct nft_expr *expr)
d2168e84 PNA	200	{
	201	const struct nft_limit *priv = nft_expr_priv(expr);
	202
	203	return nft_limit_dump(skb, priv, NFT_LIMIT_PKT_BYTES);
	204	}
	205
6e323887	206	static const struct nft_expr_ops nft_limit_bytes_ops = {
d2168e84 PNA	207	.type = &nft_limit_type,
d2168e84 PNA	208	.size = NFT_EXPR_SIZE(sizeof(struct nft_limit)),
6e323887 PBG	209	.eval = nft_limit_bytes_eval,
	210	.init = nft_limit_bytes_init,
	211	.dump = nft_limit_bytes_dump,
d2168e84 PNA	212	};
	213
	214	static const struct nft_expr_ops *
	215	nft_limit_select_ops(const struct nft_ctx *ctx,
	216	const struct nlattr * const tb[])
	217	{
	218	if (tb[NFTA_LIMIT_TYPE] == NULL)
	219	return &nft_limit_pkts_ops;
	220
	221	switch (ntohl(nla_get_be32(tb[NFTA_LIMIT_TYPE]))) {
	222	case NFT_LIMIT_PKTS:
	223	return &nft_limit_pkts_ops;
	224	case NFT_LIMIT_PKT_BYTES:
6e323887	225	return &nft_limit_bytes_ops;
d2168e84 PNA	226	}
	227	return ERR_PTR(-EOPNOTSUPP);
	228	}
	229
ef1f7df9 PM	230	static struct nft_expr_type nft_limit_type __read_mostly = {
ef1f7df9 PM	231	.name = "limit",
d2168e84	232	.select_ops = nft_limit_select_ops,
96518518 PM	233	.policy = nft_limit_policy,
96518518 PM	234	.maxattr = NFTA_LIMIT_MAX,
151d799a	235	.flags = NFT_EXPR_STATEFUL,
ef1f7df9	236	.owner = THIS_MODULE,
96518518 PM	237	};
96518518 PM	238
a6912055 PBG	239	static void nft_limit_obj_pkts_eval(struct nft_object *obj,
	240	struct nft_regs *regs,
	241	const struct nft_pktinfo *pkt)
	242	{
	243	struct nft_limit_pkts *priv = nft_obj_data(obj);
	244
	245	if (nft_limit_eval(&priv->limit, priv->cost))
	246	regs->verdict.code = NFT_BREAK;
	247	}
	248
	249	static int nft_limit_obj_pkts_init(const struct nft_ctx *ctx,
	250	const struct nlattr * const tb[],
	251	struct nft_object *obj)
	252	{
	253	struct nft_limit_pkts *priv = nft_obj_data(obj);
	254	int err;
	255
3e0f64b7	256	err = nft_limit_init(&priv->limit, tb, true);
a6912055 PBG	257	if (err < 0)
	258	return err;
	259
	260	priv->cost = div64_u64(priv->limit.nsecs, priv->limit.rate);
	261	return 0;
	262	}
	263
	264	static int nft_limit_obj_pkts_dump(struct sk_buff *skb,
	265	struct nft_object *obj,
	266	bool reset)
	267	{
	268	const struct nft_limit_pkts *priv = nft_obj_data(obj);
	269
	270	return nft_limit_dump(skb, &priv->limit, NFT_LIMIT_PKTS);
	271	}
	272
	273	static struct nft_object_type nft_limit_obj_type;
	274	static const struct nft_object_ops nft_limit_obj_pkts_ops = {
	275	.type = &nft_limit_obj_type,
	276	.size = NFT_EXPR_SIZE(sizeof(struct nft_limit_pkts)),
	277	.init = nft_limit_obj_pkts_init,
	278	.eval = nft_limit_obj_pkts_eval,
	279	.dump = nft_limit_obj_pkts_dump,
	280	};
	281
	282	static void nft_limit_obj_bytes_eval(struct nft_object *obj,
	283	struct nft_regs *regs,
	284	const struct nft_pktinfo *pkt)
	285	{
	286	struct nft_limit *priv = nft_obj_data(obj);
	287	u64 cost = div64_u64(priv->nsecs * pkt->skb->len, priv->rate);
	288
	289	if (nft_limit_eval(priv, cost))
	290	regs->verdict.code = NFT_BREAK;
	291	}
	292
	293	static int nft_limit_obj_bytes_init(const struct nft_ctx *ctx,
	294	const struct nlattr * const tb[],
	295	struct nft_object *obj)
	296	{
	297	struct nft_limit *priv = nft_obj_data(obj);
	298
3e0f64b7	299	return nft_limit_init(priv, tb, false);
a6912055 PBG	300	}
	301
	302	static int nft_limit_obj_bytes_dump(struct sk_buff *skb,
	303	struct nft_object *obj,
	304	bool reset)
	305	{
	306	const struct nft_limit *priv = nft_obj_data(obj);
	307
	308	return nft_limit_dump(skb, priv, NFT_LIMIT_PKT_BYTES);
	309	}
	310
	311	static struct nft_object_type nft_limit_obj_type;
	312	static const struct nft_object_ops nft_limit_obj_bytes_ops = {
	313	.type = &nft_limit_obj_type,
	314	.size = sizeof(struct nft_limit),
	315	.init = nft_limit_obj_bytes_init,
	316	.eval = nft_limit_obj_bytes_eval,
	317	.dump = nft_limit_obj_bytes_dump,
	318	};
	319
	320	static const struct nft_object_ops *
	321	nft_limit_obj_select_ops(const struct nft_ctx *ctx,
	322	const struct nlattr * const tb[])
	323	{
	324	if (!tb[NFTA_LIMIT_TYPE])
	325	return &nft_limit_obj_pkts_ops;
	326
	327	switch (ntohl(nla_get_be32(tb[NFTA_LIMIT_TYPE]))) {
	328	case NFT_LIMIT_PKTS:
	329	return &nft_limit_obj_pkts_ops;
	330	case NFT_LIMIT_PKT_BYTES:
	331	return &nft_limit_obj_bytes_ops;
	332	}
	333	return ERR_PTR(-EOPNOTSUPP);
	334	}
	335
	336	static struct nft_object_type nft_limit_obj_type __read_mostly = {
	337	.select_ops = nft_limit_obj_select_ops,
	338	.type = NFT_OBJECT_LIMIT,
	339	.maxattr = NFTA_LIMIT_MAX,
	340	.policy = nft_limit_policy,
	341	.owner = THIS_MODULE,
	342	};
	343
96518518 PM	344	static int __init nft_limit_module_init(void)
96518518 PM	345	{
a6912055 PBG	346	int err;
	347
	348	err = nft_register_obj(&nft_limit_obj_type);
	349	if (err < 0)
	350	return err;
	351
	352	err = nft_register_expr(&nft_limit_type);
	353	if (err < 0)
	354	goto err1;
	355
	356	return 0;
	357	err1:
	358	nft_unregister_obj(&nft_limit_obj_type);
	359	return err;
96518518 PM	360	}
	361
	362	static void __exit nft_limit_module_exit(void)
	363	{
ef1f7df9	364	nft_unregister_expr(&nft_limit_type);
a6912055	365	nft_unregister_obj(&nft_limit_obj_type);
96518518 PM	366	}
	367
	368	module_init(nft_limit_module_init);
	369	module_exit(nft_limit_module_exit);
	370
	371	MODULE_LICENSE("GPL");
	372	MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
	373	MODULE_ALIAS_NFT_EXPR("limit");
a6912055	374	MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_LIMIT);
4cacc395	375	MODULE_DESCRIPTION("nftables limit expression support");