nft_set_bitmap.c 8.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Copyright (c) 2017 Pablo Neira Ayuso <pablo@netfilter.org>
  4. */
  5. #include <linux/kernel.h>
  6. #include <linux/init.h>
  7. #include <linux/module.h>
  8. #include <linux/list.h>
  9. #include <linux/netlink.h>
  10. #include <linux/netfilter.h>
  11. #include <linux/netfilter/nf_tables.h>
  12. #include <net/netfilter/nf_tables_core.h>
  13. struct nft_bitmap_elem {
  14. struct list_head head;
  15. struct nft_set_ext ext;
  16. };
  17. /* This bitmap uses two bits to represent one element. These two bits determine
  18. * the element state in the current and the future generation.
  19. *
  20. * An element can be in three states. The generation cursor is represented using
  21. * the ^ character, note that this cursor shifts on every succesful transaction.
  22. * If no transaction is going on, we observe all elements are in the following
  23. * state:
  24. *
  25. * 11 = this element is active in the current generation. In case of no updates,
  26. * ^ it stays active in the next generation.
  27. * 00 = this element is inactive in the current generation. In case of no
  28. * ^ updates, it stays inactive in the next generation.
  29. *
  30. * On transaction handling, we observe these two temporary states:
  31. *
  32. * 01 = this element is inactive in the current generation and it becomes active
  33. * ^ in the next one. This happens when the element is inserted but commit
  34. * path has not yet been executed yet, so activation is still pending. On
  35. * transaction abortion, the element is removed.
  36. * 10 = this element is active in the current generation and it becomes inactive
  37. * ^ in the next one. This happens when the element is deactivated but commit
  38. * path has not yet been executed yet, so removal is still pending. On
  39. * transation abortion, the next generation bit is reset to go back to
  40. * restore its previous state.
  41. */
  42. struct nft_bitmap {
  43. struct list_head list;
  44. u16 bitmap_size;
  45. u8 bitmap[];
  46. };
  47. static inline void nft_bitmap_location(const struct nft_set *set,
  48. const void *key,
  49. u32 *idx, u32 *off)
  50. {
  51. u32 k;
  52. if (set->klen == 2)
  53. k = *(u16 *)key;
  54. else
  55. k = *(u8 *)key;
  56. k <<= 1;
  57. *idx = k / BITS_PER_BYTE;
  58. *off = k % BITS_PER_BYTE;
  59. }
  60. /* Fetch the two bits that represent the element and check if it is active based
  61. * on the generation mask.
  62. */
  63. static inline bool
  64. nft_bitmap_active(const u8 *bitmap, u32 idx, u32 off, u8 genmask)
  65. {
  66. return (bitmap[idx] & (0x3 << off)) & (genmask << off);
  67. }
  68. static bool nft_bitmap_lookup(const struct net *net, const struct nft_set *set,
  69. const u32 *key, const struct nft_set_ext **ext)
  70. {
  71. const struct nft_bitmap *priv = nft_set_priv(set);
  72. u8 genmask = nft_genmask_cur(net);
  73. u32 idx, off;
  74. nft_bitmap_location(set, key, &idx, &off);
  75. return nft_bitmap_active(priv->bitmap, idx, off, genmask);
  76. }
  77. static struct nft_bitmap_elem *
  78. nft_bitmap_elem_find(const struct nft_set *set, struct nft_bitmap_elem *this,
  79. u8 genmask)
  80. {
  81. const struct nft_bitmap *priv = nft_set_priv(set);
  82. struct nft_bitmap_elem *be;
  83. list_for_each_entry_rcu(be, &priv->list, head) {
  84. if (memcmp(nft_set_ext_key(&be->ext),
  85. nft_set_ext_key(&this->ext), set->klen) ||
  86. !nft_set_elem_active(&be->ext, genmask))
  87. continue;
  88. return be;
  89. }
  90. return NULL;
  91. }
  92. static void *nft_bitmap_get(const struct net *net, const struct nft_set *set,
  93. const struct nft_set_elem *elem, unsigned int flags)
  94. {
  95. const struct nft_bitmap *priv = nft_set_priv(set);
  96. u8 genmask = nft_genmask_cur(net);
  97. struct nft_bitmap_elem *be;
  98. list_for_each_entry_rcu(be, &priv->list, head) {
  99. if (memcmp(nft_set_ext_key(&be->ext), elem->key.val.data, set->klen) ||
  100. !nft_set_elem_active(&be->ext, genmask))
  101. continue;
  102. return be;
  103. }
  104. return ERR_PTR(-ENOENT);
  105. }
  106. static int nft_bitmap_insert(const struct net *net, const struct nft_set *set,
  107. const struct nft_set_elem *elem,
  108. struct nft_set_ext **ext)
  109. {
  110. struct nft_bitmap *priv = nft_set_priv(set);
  111. struct nft_bitmap_elem *new = elem->priv, *be;
  112. u8 genmask = nft_genmask_next(net);
  113. u32 idx, off;
  114. be = nft_bitmap_elem_find(set, new, genmask);
  115. if (be) {
  116. *ext = &be->ext;
  117. return -EEXIST;
  118. }
  119. nft_bitmap_location(set, nft_set_ext_key(&new->ext), &idx, &off);
  120. /* Enter 01 state. */
  121. priv->bitmap[idx] |= (genmask << off);
  122. list_add_tail_rcu(&new->head, &priv->list);
  123. return 0;
  124. }
  125. static void nft_bitmap_remove(const struct net *net,
  126. const struct nft_set *set,
  127. const struct nft_set_elem *elem)
  128. {
  129. struct nft_bitmap *priv = nft_set_priv(set);
  130. struct nft_bitmap_elem *be = elem->priv;
  131. u8 genmask = nft_genmask_next(net);
  132. u32 idx, off;
  133. nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
  134. /* Enter 00 state. */
  135. priv->bitmap[idx] &= ~(genmask << off);
  136. list_del_rcu(&be->head);
  137. }
  138. static void nft_bitmap_activate(const struct net *net,
  139. const struct nft_set *set,
  140. const struct nft_set_elem *elem)
  141. {
  142. struct nft_bitmap *priv = nft_set_priv(set);
  143. struct nft_bitmap_elem *be = elem->priv;
  144. u8 genmask = nft_genmask_next(net);
  145. u32 idx, off;
  146. nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
  147. /* Enter 11 state. */
  148. priv->bitmap[idx] |= (genmask << off);
  149. nft_set_elem_change_active(net, set, &be->ext);
  150. }
  151. static bool nft_bitmap_flush(const struct net *net,
  152. const struct nft_set *set, void *_be)
  153. {
  154. struct nft_bitmap *priv = nft_set_priv(set);
  155. u8 genmask = nft_genmask_next(net);
  156. struct nft_bitmap_elem *be = _be;
  157. u32 idx, off;
  158. nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
  159. /* Enter 10 state, similar to deactivation. */
  160. priv->bitmap[idx] &= ~(genmask << off);
  161. nft_set_elem_change_active(net, set, &be->ext);
  162. return true;
  163. }
  164. static void *nft_bitmap_deactivate(const struct net *net,
  165. const struct nft_set *set,
  166. const struct nft_set_elem *elem)
  167. {
  168. struct nft_bitmap *priv = nft_set_priv(set);
  169. struct nft_bitmap_elem *this = elem->priv, *be;
  170. u8 genmask = nft_genmask_next(net);
  171. u32 idx, off;
  172. nft_bitmap_location(set, elem->key.val.data, &idx, &off);
  173. be = nft_bitmap_elem_find(set, this, genmask);
  174. if (!be)
  175. return NULL;
  176. /* Enter 10 state. */
  177. priv->bitmap[idx] &= ~(genmask << off);
  178. nft_set_elem_change_active(net, set, &be->ext);
  179. return be;
  180. }
  181. static void nft_bitmap_walk(const struct nft_ctx *ctx,
  182. struct nft_set *set,
  183. struct nft_set_iter *iter)
  184. {
  185. const struct nft_bitmap *priv = nft_set_priv(set);
  186. struct nft_bitmap_elem *be;
  187. struct nft_set_elem elem;
  188. list_for_each_entry_rcu(be, &priv->list, head) {
  189. if (iter->count < iter->skip)
  190. goto cont;
  191. if (!nft_set_elem_active(&be->ext, iter->genmask))
  192. goto cont;
  193. elem.priv = be;
  194. iter->err = iter->fn(ctx, set, iter, &elem);
  195. if (iter->err < 0)
  196. return;
  197. cont:
  198. iter->count++;
  199. }
  200. }
  201. /* The bitmap size is pow(2, key length in bits) / bits per byte. This is
  202. * multiplied by two since each element takes two bits. For 8 bit keys, the
  203. * bitmap consumes 66 bytes. For 16 bit keys, 16388 bytes.
  204. */
  205. static inline u32 nft_bitmap_size(u32 klen)
  206. {
  207. return ((2 << ((klen * BITS_PER_BYTE) - 1)) / BITS_PER_BYTE) << 1;
  208. }
  209. static inline u64 nft_bitmap_total_size(u32 klen)
  210. {
  211. return sizeof(struct nft_bitmap) + nft_bitmap_size(klen);
  212. }
  213. static u64 nft_bitmap_privsize(const struct nlattr * const nla[],
  214. const struct nft_set_desc *desc)
  215. {
  216. u32 klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
  217. return nft_bitmap_total_size(klen);
  218. }
  219. static int nft_bitmap_init(const struct nft_set *set,
  220. const struct nft_set_desc *desc,
  221. const struct nlattr * const nla[])
  222. {
  223. struct nft_bitmap *priv = nft_set_priv(set);
  224. INIT_LIST_HEAD(&priv->list);
  225. priv->bitmap_size = nft_bitmap_size(set->klen);
  226. return 0;
  227. }
  228. static void nft_bitmap_destroy(const struct nft_set *set)
  229. {
  230. struct nft_bitmap *priv = nft_set_priv(set);
  231. struct nft_bitmap_elem *be, *n;
  232. list_for_each_entry_safe(be, n, &priv->list, head)
  233. nft_set_elem_destroy(set, be, true);
  234. }
  235. static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features,
  236. struct nft_set_estimate *est)
  237. {
  238. /* Make sure bitmaps we don't get bitmaps larger than 16 Kbytes. */
  239. if (desc->klen > 2)
  240. return false;
  241. else if (desc->expr)
  242. return false;
  243. est->size = nft_bitmap_total_size(desc->klen);
  244. est->lookup = NFT_SET_CLASS_O_1;
  245. est->space = NFT_SET_CLASS_O_1;
  246. return true;
  247. }
  248. const struct nft_set_type nft_set_bitmap_type = {
  249. .ops = {
  250. .privsize = nft_bitmap_privsize,
  251. .elemsize = offsetof(struct nft_bitmap_elem, ext),
  252. .estimate = nft_bitmap_estimate,
  253. .init = nft_bitmap_init,
  254. .destroy = nft_bitmap_destroy,
  255. .insert = nft_bitmap_insert,
  256. .remove = nft_bitmap_remove,
  257. .deactivate = nft_bitmap_deactivate,
  258. .flush = nft_bitmap_flush,
  259. .activate = nft_bitmap_activate,
  260. .lookup = nft_bitmap_lookup,
  261. .walk = nft_bitmap_walk,
  262. .get = nft_bitmap_get,
  263. },
  264. };