[PATCH v2] netfilter: nft_meta: support for time matching

[PATCH v2] netfilter: nft_meta: support for time matching

[Ander Juaristi]

This patch introduces meta matches in the kernel for time (a UNIX timestamp),
day (a day of week, represented as an integer between 0-6), and
hour (an hour in the current day, or: number of seconds since midnight).

All values are taken as unsigned 64-bit integers.

The 'time' keyword is internally converted to nanoseconds by nft in
userspace, and hence the timestamp is taken in nanoseconds as well.

Signed-off-by: Ander Juaristi <a@juaristi.eus>
---
 include/uapi/linux/netfilter/nf_tables.h |  6 +++++
 net/netfilter/nft_meta.c                 | 32 ++++++++++++++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index c6c8ec5c7c00..92c78813bc7d 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -795,6 +795,9 @@ enum nft_exthdr_attributes {
  * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
  * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
  * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
+ * @NFT_META_TIME: a UNIX timestamp
+ * @NFT_META_TIME_DAY: day of week
+ * @NFT_META_TIME_HOUR: hour of day
  */
 enum nft_meta_keys {
 	NFT_META_LEN,
@@ -825,6 +828,9 @@ enum nft_meta_keys {
 	NFT_META_SECPATH,
 	NFT_META_IIFKIND,
 	NFT_META_OIFKIND,
+	NFT_META_TIME,
+	NFT_META_TIME_DAY,
+	NFT_META_TIME_HOUR,
 };
 
 /**
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 987d2d6ce624..ed907b1f97cd 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -50,6 +50,7 @@ void nft_meta_get_eval(const struct nft_expr *expr,
 	const struct net_device *in = nft_in(pkt), *out = nft_out(pkt);
 	struct sock *sk;
 	u32 *dest = &regs->data[priv->dreg];
+	u64 *d64;
 #ifdef CONFIG_NF_TABLES_BRIDGE
 	const struct net_bridge_port *p;
 #endif
@@ -254,6 +255,28 @@ void nft_meta_get_eval(const struct nft_expr *expr,
 			goto err;
 		strncpy((char *)dest, out->rtnl_link_ops->kind, IFNAMSIZ);
 		break;
+	case NFT_META_TIME:
+		d64 = (u64 *) dest;
+		*d64 = ktime_get_real_ns();
+		break;
+	case NFT_META_TIME_DAY:
+	case NFT_META_TIME_HOUR:
+	{
+		s64 secs;
+		struct tm tm;
+
+		d64 = (u64 *) dest;
+
+		/* get timestamp in seconds, and convert to tm structure */
+		secs = get_seconds();
+		time64_to_tm(secs, 0, &tm);
+
+		if (priv->key == NFT_META_TIME_HOUR)
+			*d64 = (u64) (tm.tm_hour * 3600 + tm.tm_min * 60 + tm.tm_sec);
+		else
+			nft_reg_store8(dest, (u8) tm.tm_wday);
+	}
+		break;
 	default:
 		WARN_ON(1);
 		goto err;
@@ -371,6 +394,15 @@ static int nft_meta_get_init(const struct nft_ctx *ctx,
 		len = IFNAMSIZ;
 		break;
 #endif
+	case NFT_META_TIME:
+		len = sizeof(u64);
+		break;
+	case NFT_META_TIME_DAY:
+		len = sizeof(u8);
+		break;
+	case NFT_META_TIME_HOUR:
+		len = sizeof(u64);
+		break;
 	default:
 		return -EOPNOTSUPP;
 	}
-- 
2.17.1

Re: [PATCH v2] netfilter: nft_meta: support for time matching

[Florian Westphal]

Ander Juaristi <a@juaristi.eus> wrote:
> This patch introduces meta matches in the kernel for time (a UNIX timestamp),
> day (a day of week, represented as an integer between 0-6), and
> hour (an hour in the current day, or: number of seconds since midnight).
> 
> All values are taken as unsigned 64-bit integers.
> 
> The 'time' keyword is internally converted to nanoseconds by nft in
> userspace, and hence the timestamp is taken in nanoseconds as well.

I think this is conceptually fine, thanks Ander.

Can you run this throuch scripts/checkpatch.pl and fix up the style
nits?

> +	case NFT_META_TIME_HOUR:
> +		len = sizeof(u64);

As in my other comment, I think this can be u32.

Re: [PATCH v2] netfilter: nft_meta: support for time matching

[Pablo Neira Ayuso]

On Mon, Jul 15, 2019 at 01:28:08AM +0200, Florian Westphal wrote:
> Ander Juaristi <a@juaristi.eus> wrote:
> > This patch introduces meta matches in the kernel for time (a UNIX timestamp),
> > day (a day of week, represented as an integer between 0-6), and
> > hour (an hour in the current day, or: number of seconds since midnight).
> > 
> > All values are taken as unsigned 64-bit integers.
> > 
> > The 'time' keyword is internally converted to nanoseconds by nft in
> > userspace, and hence the timestamp is taken in nanoseconds as well.
> 
> I think this is conceptually fine, thanks Ander.
> 
> Can you run this throuch scripts/checkpatch.pl and fix up the style
> nits?
> 
> > +	case NFT_META_TIME_HOUR:
> > +		len = sizeof(u64);
> 
> As in my other comment, I think this can be u32.

Florian requested changes, so please follow up on this one and send v3.

BTW, I thought you agreed to stick to u32 (second resolution) for this
patch.

If you decide to go for u64, then get_unaligned() is missing in your
patch, just like in nft_byteorder.c.