netfilter: nf_tables: enable set expiration time for set elements

Currently, the expiration of every element in a set or map is a read-only parameter generated at kernel side. This change will permit to set a certain expiration date per element that will be required, for example, during stateful replication among several nodes. This patch handles the NFTA_SET_ELEM_EXPIRATION in order to configure the expiration parameter per element, or will use the timeout in the case that the expiration is not set.

Laura Garcia Liebana committed 7 years ago

Commit 79ebb5b1 parent 2f0513d3 files · +22 −8Browse files

Unified · Split

3 files

include/net/netfilter/nf_tables.h +1 −1
net/netfilter/nf_tables_api.c +20 −6
net/netfilter/nft_dynset.c +1 −1

include/net/netfilter/nf_tables.h+1−1

@@ -636,7 +636,7 @@ static inline struct nft_object *nft_set_ext_obj(const struct nft_set_ext ext) · 635 unmodified lines
636	void nft_set_elem_init(const struct nft_set set,	636	void nft_set_elem_init(const struct nft_set set,
637	const struct nft_set_ext_tmpl *tmpl,	637	const struct nft_set_ext_tmpl *tmpl,
638	const u32 key, const u32 data,	638	const u32 key, const u32 data,
639	u64 timeout, gfp_t gfp);	639	u64 timeout, u64 expiration, gfp_t gfp);
640	void nft_set_elem_destroy(const struct nft_set set, void elem,	640	void nft_set_elem_destroy(const struct nft_set set, void elem,
641	bool destroy_expr);	641	bool destroy_expr);
642		642

net/netfilter/nf_tables_api.c+20−6

 	[NFTA_SET_ELEM_DATA]		= { .type = NLA_NESTED },
 	[NFTA_SET_ELEM_FLAGS]		= { .type = NLA_U32 },
 	[NFTA_SET_ELEM_TIMEOUT]		= { .type = NLA_U64 },
+	[NFTA_SET_ELEM_EXPIRATION]	= { .type = NLA_U64 },
 	[NFTA_SET_ELEM_USERDATA]	= { .type = NLA_BINARY,
 					    .len = NFT_USERDATA_MAXLEN },
 	[NFTA_SET_ELEM_EXPR]		= { .type = NLA_NESTED },
 void *nft_set_elem_init(const struct nft_set *set,
 			const struct nft_set_ext_tmpl *tmpl,
 			const u32 *key, const u32 *data,
-			u64 timeout, gfp_t gfp)
+			u64 timeout, u64 expiration, gfp_t gfp)
 {
 	struct nft_set_ext *ext;
 	void *elem;
 	memcpy(nft_set_ext_key(ext), key, set->klen);
 	if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
 		memcpy(nft_set_ext_data(ext), data, set->dlen);
-	if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
+	if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
-		*nft_set_ext_expiration(ext) =
+		*nft_set_ext_expiration(ext) = get_jiffies_64() + expiration;
-			get_jiffies_64() + timeout;
+		if (expiration == 0)
+			*nft_set_ext_expiration(ext) += timeout;
+	}
 	if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
 		*nft_set_ext_timeout(ext) = timeout;
 	struct nft_trans *trans;
 	u32 flags = 0;
 	u64 timeout;
+	u64 expiration;
 	u8 ulen;
 	int err;
 		timeout = set->timeout;
 	}
+	expiration = 0;
+	if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) {
+		if (!(set->flags & NFT_SET_TIMEOUT))
+			return -EINVAL;
+		err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION],
+					    &expiration);
+		if (err)
+			return err;
+	}
 	err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
 			    nla[NFTA_SET_ELEM_KEY]);
 	if (err < 0)
 	err = -ENOMEM;
 	elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
-				      timeout, GFP_KERNEL);
+				      timeout, expiration, GFP_KERNEL);
 	if (elem.priv == NULL)
 		goto err3;
 	err = -ENOMEM;
 	elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
-				      GFP_KERNEL);
+				      0, GFP_KERNEL);
 	if (elem.priv == NULL)
 		goto err2;

net/netfilter/nft_dynset.c+1−1

@@ -60,7 +60,7 @@ static void nft_dynset_new(struct nft_set set, const struct nft_expr *expr, · 59 unmodified lines
60	elem = nft_set_elem_init(set, &priv->tmpl,	60	elem = nft_set_elem_init(set, &priv->tmpl,
61	&regs->data[priv->sreg_key],	61	&regs->data[priv->sreg_key],
62	&regs->data[priv->sreg_data],	62	&regs->data[priv->sreg_data],
63	timeout, GFP_ATOMIC);	63	timeout, 0, GFP_ATOMIC);
64	if (elem == NULL)	64	if (elem == NULL)
65	goto err1;	65	goto err1;
66		66

netfilter: nf_tables: enable set expiration time for set elements

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code