Karuna Grewal <karunagrewal98@xxxxxxxxx> wrote: > I've a doubt in the nftables implementation for implementing the `-m > time` support. Full -m time is complicated, do not worry about this yet. > I'm unable to get a proper idea of where the start and > stop time comparison with the dest register's value takes place. Via the nftables evaluation loop. You only need to worry about placing the value (timestamp) in the dst register (on kernel side), so your patch looks pretty complete aside from the missing 'break'. Its userspace (nftables) responsibility to tell kernel to do something with the register, such as a compare or range. Have a look at http://git.netfilter.org/nftables/commit/src/meta.c?id=512795a673f999fb04b84dbbbe41174e9c581430 It should be enough to follow this approach, adding e.g. META_TEMPLATE("timestamp", .. we have TYPE_TIME already, even though its a relative one, it would/should work for a quick prototype. > From my understanding of implementation, I've noticed that after > parsing the rule and the meta expression is allocated, expression's > primary evaluation function is invoked. > Meanwhile, the kernel has the nft_meta_get_eval function setting the > register with the relevant field and in nf_tables_core.h the > registering of different nft_expr_types is accomplished. > Could someone please give me some pointers about where this processing > of the data set in the meta registers takes place? For instance in nft_cmp.c, but thats just one possibility, there are other consumers, such as nft_range.c, nft_lookup.c, and so on.
