linux/net/netfilter/nft_set_bitmap.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Copyright (c) 2017 Pablo Neira Ayuso <[email protected]>
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/list.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables_core.h>

struct nft_bitmap_elem { … };

/* This bitmap uses two bits to represent one element. These two bits determine
 * the element state in the current and the future generation.
 *
 * An element can be in three states. The generation cursor is represented using
 * the ^ character, note that this cursor shifts on every successful transaction.
 * If no transaction is going on, we observe all elements are in the following
 * state:
 *
 * 11 = this element is active in the current generation. In case of no updates,
 * ^    it stays active in the next generation.
 * 00 = this element is inactive in the current generation. In case of no
 * ^    updates, it stays inactive in the next generation.
 *
 * On transaction handling, we observe these two temporary states:
 *
 * 01 = this element is inactive in the current generation and it becomes active
 * ^    in the next one. This happens when the element is inserted but commit
 *      path has not yet been executed yet, so activation is still pending. On
 *      transaction abortion, the element is removed.
 * 10 = this element is active in the current generation and it becomes inactive
 * ^    in the next one. This happens when the element is deactivated but commit
 *      path has not yet been executed yet, so removal is still pending. On
 *      transaction abortion, the next generation bit is reset to go back to
 *      restore its previous state.
 */
struct nft_bitmap { … };

static inline void nft_bitmap_location(const struct nft_set *set,
				       const void *key,
				       u32 *idx, u32 *off)
{ … }

/* Fetch the two bits that represent the element and check if it is active based
 * on the generation mask.
 */
static inline bool
nft_bitmap_active(const u8 *bitmap, u32 idx, u32 off, u8 genmask)
{ … }

INDIRECT_CALLABLE_SCOPE
bool nft_bitmap_lookup(const struct net *net, const struct nft_set *set,
		       const u32 *key, const struct nft_set_ext **ext)
{ … }

static struct nft_bitmap_elem *
nft_bitmap_elem_find(const struct nft_set *set, struct nft_bitmap_elem *this,
		     u8 genmask)
{ … }

static struct nft_elem_priv *
nft_bitmap_get(const struct net *net, const struct nft_set *set,
	       const struct nft_set_elem *elem, unsigned int flags)
{ … }

static int nft_bitmap_insert(const struct net *net, const struct nft_set *set,
			     const struct nft_set_elem *elem,
			     struct nft_elem_priv **elem_priv)
{ … }

static void nft_bitmap_remove(const struct net *net, const struct nft_set *set,
			      struct nft_elem_priv *elem_priv)
{ … }

static void nft_bitmap_activate(const struct net *net,
				const struct nft_set *set,
				struct nft_elem_priv *elem_priv)
{ … }

static void nft_bitmap_flush(const struct net *net,
			     const struct nft_set *set,
			     struct nft_elem_priv *elem_priv)
{ … }

static struct nft_elem_priv *
nft_bitmap_deactivate(const struct net *net, const struct nft_set *set,
		      const struct nft_set_elem *elem)
{ … }

static void nft_bitmap_walk(const struct nft_ctx *ctx,
			    struct nft_set *set,
			    struct nft_set_iter *iter)
{ … }

/* The bitmap size is pow(2, key length in bits) / bits per byte. This is
 * multiplied by two since each element takes two bits. For 8 bit keys, the
 * bitmap consumes 66 bytes. For 16 bit keys, 16388 bytes.
 */
static inline u32 nft_bitmap_size(u32 klen)
{ … }

static inline u64 nft_bitmap_total_size(u32 klen)
{ … }

static u64 nft_bitmap_privsize(const struct nlattr * const nla[],
			       const struct nft_set_desc *desc)
{ … }

static int nft_bitmap_init(const struct nft_set *set,
			   const struct nft_set_desc *desc,
			   const struct nlattr * const nla[])
{ … }

static void nft_bitmap_destroy(const struct nft_ctx *ctx,
			       const struct nft_set *set)
{ … }

static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features,
				struct nft_set_estimate *est)
{ … }

const struct nft_set_type nft_set_bitmap_type = …;