16 #include <arpa/inet.h>
18 #include <linux/netfilter/nf_tables.h>
21 #include <libmnl/libmnl.h>
22 #include <libnftnl/expr.h>
23 #include <libnftnl/rule.h>
32 nft_rule_expr_limit_set(
struct nft_rule_expr *e, uint16_t type,
33 const void *data, uint32_t data_len)
38 case NFT_EXPR_LIMIT_RATE:
39 limit->rate = *((uint64_t *)data);
41 case NFT_EXPR_LIMIT_UNIT:
42 limit->unit = *((uint64_t *)data);
51 nft_rule_expr_limit_get(
const struct nft_rule_expr *e, uint16_t type,
57 case NFT_EXPR_LIMIT_RATE:
58 *data_len =
sizeof(uint64_t);
60 case NFT_EXPR_LIMIT_UNIT:
61 *data_len =
sizeof(uint64_t);
67 static int nft_rule_expr_limit_cb(
const struct nlattr *attr,
void *data)
69 const struct nlattr **tb = data;
70 int type = mnl_attr_get_type(attr);
72 if (mnl_attr_type_valid(attr, NFTA_LIMIT_MAX) < 0)
78 if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0) {
79 perror(
"mnl_attr_validate");
90 nft_rule_expr_limit_build(
struct nlmsghdr *nlh,
struct nft_rule_expr *e)
94 if (e->flags & (1 << NFT_EXPR_LIMIT_RATE))
95 mnl_attr_put_u64(nlh, NFTA_LIMIT_RATE, htobe64(limit->rate));
96 if (e->flags & (1 << NFT_EXPR_LIMIT_UNIT))
97 mnl_attr_put_u64(nlh, NFTA_LIMIT_UNIT, htobe64(limit->unit));
101 nft_rule_expr_limit_parse(
struct nft_rule_expr *e,
struct nlattr *attr)
104 struct nlattr *tb[NFTA_LIMIT_MAX+1] = {};
106 if (mnl_attr_parse_nested(attr, nft_rule_expr_limit_cb, tb) < 0)
109 if (tb[NFTA_LIMIT_RATE]) {
110 limit->rate = be64toh(mnl_attr_get_u64(tb[NFTA_LIMIT_RATE]));
111 e->flags |= (1 << NFT_EXPR_LIMIT_RATE);
113 if (tb[NFTA_LIMIT_UNIT]) {
114 limit->unit = be64toh(mnl_attr_get_u64(tb[NFTA_LIMIT_UNIT]));
115 e->flags |= (1 << NFT_EXPR_LIMIT_UNIT);
121 static int nft_rule_expr_limit_json_parse(
struct nft_rule_expr *e, json_t *root,
122 struct nft_parse_err *err)
127 if (nft_jansson_parse_val(root,
"rate", NFT_TYPE_U64, &uval64, err) == 0)
128 nft_rule_expr_set_u64(e, NFT_EXPR_LIMIT_RATE, uval64);
130 if (nft_jansson_parse_val(root,
"unit", NFT_TYPE_U64, &uval64, err) == 0)
131 nft_rule_expr_set_u64(e, NFT_EXPR_LIMIT_UNIT, uval64);
140 static int nft_rule_expr_limit_xml_parse(
struct nft_rule_expr *e,
142 struct nft_parse_err *err)
147 if (nft_mxml_num_parse(tree,
"rate", MXML_DESCEND_FIRST, BASE_DEC,
148 &rate, NFT_TYPE_U64, NFT_XML_MAND, err) == 0)
149 nft_rule_expr_set_u64(e, NFT_EXPR_LIMIT_RATE, rate);
151 if (nft_mxml_num_parse(tree,
"unit", MXML_DESCEND_FIRST, BASE_DEC,
152 &unit, NFT_TYPE_U64, NFT_XML_MAND, err) == 0)
153 nft_rule_expr_set_u64(e, NFT_EXPR_LIMIT_UNIT, unit);
162 static const char *get_unit(uint64_t u)
165 case 1:
return "second";
166 case 60:
return "minute";
167 case 60 * 60:
return "hour";
168 case 60 * 60 * 24:
return "day";
169 case 60 * 60 * 24 * 7:
return "week";
174 static int nft_rule_expr_limit_snprintf_xml(
char *buf,
size_t len,
175 struct nft_rule_expr *e)
178 int ret, size = len, offset = 0;
180 if (e->flags & (1 << NFT_EXPR_LIMIT_RATE)) {
181 ret = snprintf(buf + offset, len,
"<rate>%"PRIu64
"</rate>",
183 SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
185 if (e->flags & (1 << NFT_EXPR_LIMIT_UNIT)) {
186 ret = snprintf(buf + offset, len,
"<unit>%"PRIu64
"</unit>",
188 SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
194 static int nft_rule_expr_limit_snprintf_json(
char *buf,
size_t len,
195 struct nft_rule_expr *e)
198 int ret, size = len, offset = 0;
200 if (e->flags & (1 << NFT_EXPR_LIMIT_RATE)) {
201 ret = snprintf(buf + offset, len,
"\"rate\":%"PRIu64
",",
203 SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
205 if (e->flags & (1 << NFT_EXPR_LIMIT_UNIT)) {
206 ret = snprintf(buf + offset, len,
"\"unit\":%"PRIu64
",",
208 SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
218 static int nft_rule_expr_limit_snprintf_default(
char *buf,
size_t len,
219 struct nft_rule_expr *e)
223 return snprintf(buf, len,
"rate %"PRIu64
"/%s ",
224 limit->rate, get_unit(limit->unit));
228 nft_rule_expr_limit_snprintf(
char *buf,
size_t len, uint32_t type,
229 uint32_t flags,
struct nft_rule_expr *e)
233 case NFT_OUTPUT_DEFAULT:
234 return nft_rule_expr_limit_snprintf_default(buf, len, e);
236 return nft_rule_expr_limit_snprintf_xml(buf, len, e);
237 case NFT_OUTPUT_JSON:
238 return nft_rule_expr_limit_snprintf_json(buf, len, e);
245 struct expr_ops expr_ops_limit = {
248 .max_attr = NFTA_LIMIT_MAX,
249 .set = nft_rule_expr_limit_set,
250 .get = nft_rule_expr_limit_get,
251 .parse = nft_rule_expr_limit_parse,
252 .build = nft_rule_expr_limit_build,
253 .snprintf = nft_rule_expr_limit_snprintf,
254 .xml_parse = nft_rule_expr_limit_xml_parse,
255 .json_parse = nft_rule_expr_limit_json_parse,
258 static void __init expr_limit_init(
void)
260 nft_expr_ops_register(&expr_ops_limit);