Commit 836382dc authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: add last expression 



Add a new optional expression that tells you when last matching on a
given rule / set element element has happened.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 06e95f0a

include/net/netfilter/nf_tables_core.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -16,6 +16,7 @@ extern struct nft_expr_type nft_range_type; 
extern struct nft_expr_type nft_meta_type;

extern struct nft_expr_type nft_meta_type;

extern struct nft_expr_type nft_rt_type;

extern struct nft_expr_type nft_rt_type;

extern struct nft_expr_type nft_exthdr_type;

extern struct nft_expr_type nft_exthdr_type;

extern struct nft_expr_type nft_last_type;





#ifdef CONFIG_NETWORK_SECMARK

#ifdef CONFIG_NETWORK_SECMARK

extern struct nft_object_type nft_secmark_obj_type;

extern struct nft_object_type nft_secmark_obj_type;

include/uapi/linux/netfilter/nf_tables.h

+15 −0
Original line number Original line Diff line number Diff line
@@ -1195,6 +1195,21 @@ enum nft_counter_attributes { 
};

};

#define NFTA_COUNTER_MAX	(__NFTA_COUNTER_MAX - 1)

#define NFTA_COUNTER_MAX	(__NFTA_COUNTER_MAX - 1)





/**

 * enum nft_last_attributes - nf_tables last expression netlink attributes

 *

 * @NFTA_LAST_SET: last update has been set, zero means never updated (NLA_U32)

 * @NFTA_LAST_MSECS: milliseconds since last update (NLA_U64)

 */

enum nft_last_attributes {

	NFTA_LAST_UNSPEC,

	NFTA_LAST_SET,

	NFTA_LAST_MSECS,

	NFTA_LAST_PAD,

	__NFTA_LAST_MAX

};

#define NFTA_LAST_MAX	(__NFTA_LAST_MAX - 1)



/**

/**

 * enum nft_log_attributes - nf_tables log expression netlink attributes

 * enum nft_log_attributes - nf_tables log expression netlink attributes

 *

 *

net/netfilter/Makefile

+1 −1
Original line number Original line Diff line number Diff line
@@ -74,7 +74,7 @@ obj-$(CONFIG_NF_DUP_NETDEV) += nf_dup_netdev.o 
nf_tables-objs := nf_tables_core.o nf_tables_api.o nft_chain_filter.o \

nf_tables-objs := nf_tables_core.o nf_tables_api.o nft_chain_filter.o \

		  nf_tables_trace.o nft_immediate.o nft_cmp.o nft_range.o \

		  nf_tables_trace.o nft_immediate.o nft_cmp.o nft_range.o \

		  nft_bitwise.o nft_byteorder.o nft_payload.o nft_lookup.o \

		  nft_bitwise.o nft_byteorder.o nft_payload.o nft_lookup.o \

		  nft_dynset.o nft_meta.o nft_rt.o nft_exthdr.o \

		  nft_dynset.o nft_meta.o nft_rt.o nft_exthdr.o nft_last.o \

		  nft_chain_route.o nf_tables_offload.o \

		  nft_chain_route.o nf_tables_offload.o \

		  nft_set_hash.o nft_set_bitmap.o nft_set_rbtree.o \

		  nft_set_hash.o nft_set_bitmap.o nft_set_rbtree.o \

		  nft_set_pipapo.o

		  nft_set_pipapo.o

net/netfilter/nf_tables_core.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -268,6 +268,7 @@ static struct nft_expr_type *nft_basic_types[] = { 
	&nft_meta_type,

	&nft_meta_type,

	&nft_rt_type,

	&nft_rt_type,

	&nft_exthdr_type,

	&nft_exthdr_type,

	&nft_last_type,

};

};





static struct nft_object_type *nft_basic_objects[] = {

static struct nft_object_type *nft_basic_objects[] = {

net/netfilter/nft_last.c

0 → 100644
+87 −0
Original line number Original line Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

#include <linux/kernel.h>

#include <linux/init.h>

#include <linux/module.h>

#include <linux/netlink.h>

#include <linux/netfilter.h>

#include <linux/netfilter/nf_tables.h>

#include <net/netfilter/nf_tables_core.h>

#include <net/netfilter/nf_tables.h>



struct nft_last_priv {

	unsigned long	last_jiffies;

	unsigned int	last_set;

};



static const struct nla_policy nft_last_policy[NFTA_LAST_MAX + 1] = {

	[NFTA_LAST_SET] = { .type = NLA_U32 },

	[NFTA_LAST_MSECS] = { .type = NLA_U64 },

};



static int nft_last_init(const struct nft_ctx *ctx, const struct nft_expr *expr,

			 const struct nlattr * const tb[])

{

	struct nft_last_priv *priv = nft_expr_priv(expr);

	u64 last_jiffies;

	int err;



	if (tb[NFTA_LAST_MSECS]) {

		err = nf_msecs_to_jiffies64(tb[NFTA_LAST_MSECS], &last_jiffies);

		if (err < 0)

			return err;



		priv->last_jiffies = jiffies + (unsigned long)last_jiffies;

		priv->last_set = 1;

	}



	return 0;

}



static void nft_last_eval(const struct nft_expr *expr,

			  struct nft_regs *regs, const struct nft_pktinfo *pkt)

{

	struct nft_last_priv *priv = nft_expr_priv(expr);



	priv->last_jiffies = jiffies;

	priv->last_set = 1;

}



static int nft_last_dump(struct sk_buff *skb, const struct nft_expr *expr)

{

	struct nft_last_priv *priv = nft_expr_priv(expr);

	__be64 msecs;



	if (time_before(jiffies, priv->last_jiffies))

		priv->last_set = 0;



	if (priv->last_set)

		msecs = nf_jiffies64_to_msecs(jiffies - priv->last_jiffies);

	else

		msecs = 0;



	if (nla_put_be32(skb, NFTA_LAST_SET, htonl(priv->last_set)) ||

	    nla_put_be64(skb, NFTA_LAST_MSECS, msecs, NFTA_LAST_PAD))

		goto nla_put_failure;



	return 0;



nla_put_failure:

	return -1;

}



static const struct nft_expr_ops nft_last_ops = {

	.type		= &nft_last_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_last_priv)),

	.eval		= nft_last_eval,

	.init		= nft_last_init,

	.dump		= nft_last_dump,

};



struct nft_expr_type nft_last_type __read_mostly = {

	.name		= "last",

	.ops		= &nft_last_ops,

	.policy		= nft_last_policy,

	.maxattr	= NFTA_LAST_MAX,

	.flags		= NFT_EXPR_STATEFUL,

	.owner		= THIS_MODULE,

};