[linux-2.6-block.git] / net / netfilter / nft_limit.c

/*
 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Development of this code funded by Astaro AG (http://www.astaro.com/)
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/spinlock.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>

static DEFINE_SPINLOCK(limit_lock);

struct nft_limit {
	u64		tokens;
	u64		rate;
	u64		unit;
	unsigned long	stamp;
};

static void nft_limit_eval(const struct nft_expr *expr,
			   struct nft_regs *regs,
			   const struct nft_pktinfo *pkt)
{
	struct nft_limit *priv = nft_expr_priv(expr);

	spin_lock_bh(&limit_lock);
	if (time_after_eq(jiffies, priv->stamp)) {
		priv->tokens = priv->rate;
		priv->stamp = jiffies + priv->unit * HZ;
	}

	if (priv->tokens >= 1) {
		priv->tokens--;
		spin_unlock_bh(&limit_lock);
		return;
	}
	spin_unlock_bh(&limit_lock);

	regs->verdict.code = NFT_BREAK;
}

static const struct nla_policy nft_limit_policy[NFTA_LIMIT_MAX + 1] = {
	[NFTA_LIMIT_RATE]	= { .type = NLA_U64 },
	[NFTA_LIMIT_UNIT]	= { .type = NLA_U64 },
};

static int nft_limit_init(const struct nft_ctx *ctx,
			  const struct nft_expr *expr,
			  const struct nlattr * const tb[])
{
	struct nft_limit *priv = nft_expr_priv(expr);

	if (tb[NFTA_LIMIT_RATE] == NULL ||
	    tb[NFTA_LIMIT_UNIT] == NULL)
		return -EINVAL;

	priv->rate   = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE]));
	priv->unit   = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_UNIT]));
	priv->stamp  = jiffies + priv->unit * HZ;
	priv->tokens = priv->rate;
	return 0;
}

static int nft_limit_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	const struct nft_limit *priv = nft_expr_priv(expr);

	if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(priv->rate)))
		goto nla_put_failure;
	if (nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(priv->unit)))
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -1;
}

static struct nft_expr_type nft_limit_type;
static const struct nft_expr_ops nft_limit_ops = {
	.type		= &nft_limit_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_limit)),
	.eval		= nft_limit_eval,
	.init		= nft_limit_init,
	.dump		= nft_limit_dump,
};

static struct nft_expr_type nft_limit_type __read_mostly = {
	.name		= "limit",
	.ops		= &nft_limit_ops,
	.policy		= nft_limit_policy,
	.maxattr	= NFTA_LIMIT_MAX,
	.flags		= NFT_EXPR_STATEFUL,
	.owner		= THIS_MODULE,
};

static int __init nft_limit_module_init(void)
{
	return nft_register_expr(&nft_limit_type);
}

static void __exit nft_limit_module_exit(void)
{
	nft_unregister_expr(&nft_limit_type);
}

module_init(nft_limit_module_init);
module_exit(nft_limit_module_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_ALIAS_NFT_EXPR("limit");
Commit	Line	Data
96518518	1	/*
ef1f7df9	2	* Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
96518518 PM	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*
	8	* Development of this code funded by Astaro AG (http://www.astaro.com/)
	9	*/
	10
	11	#include <linux/kernel.h>
	12	#include <linux/init.h>
	13	#include <linux/module.h>
	14	#include <linux/spinlock.h>
	15	#include <linux/netlink.h>
	16	#include <linux/netfilter.h>
	17	#include <linux/netfilter/nf_tables.h>
	18	#include <net/netfilter/nf_tables.h>
	19
	20	static DEFINE_SPINLOCK(limit_lock);
	21
	22	struct nft_limit {
	23	u64 tokens;
	24	u64 rate;
	25	u64 unit;
	26	unsigned long stamp;
	27	};
	28
	29	static void nft_limit_eval(const struct nft_expr *expr,
a55e22e9	30	struct nft_regs *regs,
96518518 PM	31	const struct nft_pktinfo *pkt)
	32	{
	33	struct nft_limit *priv = nft_expr_priv(expr);
	34
	35	spin_lock_bh(&limit_lock);
	36	if (time_after_eq(jiffies, priv->stamp)) {
	37	priv->tokens = priv->rate;
	38	priv->stamp = jiffies + priv->unit * HZ;
	39	}
	40
	41	if (priv->tokens >= 1) {
	42	priv->tokens--;
	43	spin_unlock_bh(&limit_lock);
	44	return;
	45	}
	46	spin_unlock_bh(&limit_lock);
	47
a55e22e9	48	regs->verdict.code = NFT_BREAK;
96518518 PM	49	}
	50
	51	static const struct nla_policy nft_limit_policy[NFTA_LIMIT_MAX + 1] = {
	52	[NFTA_LIMIT_RATE] = { .type = NLA_U64 },
	53	[NFTA_LIMIT_UNIT] = { .type = NLA_U64 },
	54	};
	55
	56	static int nft_limit_init(const struct nft_ctx *ctx,
	57	const struct nft_expr *expr,
	58	const struct nlattr * const tb[])
	59	{
	60	struct nft_limit *priv = nft_expr_priv(expr);
	61
	62	if (tb[NFTA_LIMIT_RATE] == NULL \|\|
	63	tb[NFTA_LIMIT_UNIT] == NULL)
	64	return -EINVAL;
	65
	66	priv->rate = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE]));
	67	priv->unit = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_UNIT]));
	68	priv->stamp = jiffies + priv->unit * HZ;
	69	priv->tokens = priv->rate;
	70	return 0;
	71	}
	72
	73	static int nft_limit_dump(struct sk_buff skb, const struct nft_expr expr)
	74	{
	75	const struct nft_limit *priv = nft_expr_priv(expr);
	76
	77	if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(priv->rate)))
	78	goto nla_put_failure;
	79	if (nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(priv->unit)))
	80	goto nla_put_failure;
	81	return 0;
	82
	83	nla_put_failure:
	84	return -1;
	85	}
	86
ef1f7df9 PM	87	static struct nft_expr_type nft_limit_type;
	88	static const struct nft_expr_ops nft_limit_ops = {
	89	.type = &nft_limit_type,
96518518	90	.size = NFT_EXPR_SIZE(sizeof(struct nft_limit)),
96518518 PM	91	.eval = nft_limit_eval,
	92	.init = nft_limit_init,
	93	.dump = nft_limit_dump,
ef1f7df9 PM	94	};
	95
	96	static struct nft_expr_type nft_limit_type __read_mostly = {
	97	.name = "limit",
	98	.ops = &nft_limit_ops,
96518518 PM	99	.policy = nft_limit_policy,
96518518 PM	100	.maxattr = NFTA_LIMIT_MAX,
151d799a	101	.flags = NFT_EXPR_STATEFUL,
ef1f7df9	102	.owner = THIS_MODULE,
96518518 PM	103	};
	104
	105	static int __init nft_limit_module_init(void)
	106	{
ef1f7df9	107	return nft_register_expr(&nft_limit_type);
96518518 PM	108	}
	109
	110	static void __exit nft_limit_module_exit(void)
	111	{
ef1f7df9	112	nft_unregister_expr(&nft_limit_type);
96518518 PM	113	}
	114
	115	module_init(nft_limit_module_init);
	116	module_exit(nft_limit_module_exit);
	117
	118	MODULE_LICENSE("GPL");
	119	MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
	120	MODULE_ALIAS_NFT_EXPR("limit");