projects / deliverable / linux.git / blame
| Commit | Line | Data |
|---|---|---|
| e385357a JK |
1 | /* Copyright (C) 2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> |
| 2 | * | |
| 3 | * This program is free software; you can redistribute it and/or modify | |
| 4 | * it under the terms of the GNU General Public License version 2 as | |
| 5 | * published by the Free Software Foundation. | |
| 6 | */ | |
| 7 | ||
| 8 | /* Kernel module implementing an IP set type: the hash:net,iface type */ | |
| 9 | ||
| 10 | #include <linux/jhash.h> | |
| 11 | #include <linux/module.h> | |
| 12 | #include <linux/ip.h> | |
| 13 | #include <linux/skbuff.h> | |
| 14 | #include <linux/errno.h> | |
| 15 | #include <linux/random.h> | |
| 16 | #include <linux/rbtree.h> | |
| 17 | #include <net/ip.h> | |
| 18 | #include <net/ipv6.h> | |
| 19 | #include <net/netlink.h> | |
| 20 | ||
| 21 | #include <linux/netfilter.h> | |
| 22 | #include <linux/netfilter/ipset/pfxlen.h> | |
| 23 | #include <linux/netfilter/ipset/ip_set.h> | |
| 24 | #include <linux/netfilter/ipset/ip_set_timeout.h> | |
| 25 | #include <linux/netfilter/ipset/ip_set_hash.h> | |
| 26 | ||
| 27 | MODULE_LICENSE("GPL"); | |
| 28 | MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>"); | |
| 29 | MODULE_DESCRIPTION("hash:net,iface type of IP sets"); | |
| 30 | MODULE_ALIAS("ip_set_hash:net,iface"); | |
| 31 | ||
| 32 | /* Interface name rbtree */ | |
| 33 | ||
| 34 | struct iface_node { | |
| 35 | struct rb_node node; | |
| 36 | char iface[IFNAMSIZ]; | |
| 37 | }; | |
| 38 | ||
| 39 | #define iface_data(n) (rb_entry(n, struct iface_node, node)->iface) | |
| 40 | ||
| e385357a JK |
41 | static void |
| 42 | rbtree_destroy(struct rb_root *root) | |
| 43 | { | |
| 44 | struct rb_node *p, *n = root->rb_node; | |
| 45 | struct iface_node *node; | |
| 46 | ||
| 47 | /* Non-recursive destroy, like in ext3 */ | |
| 48 | while (n) { | |
| 49 | if (n->rb_left) { | |
| 50 | n = n->rb_left; | |
| 51 | continue; | |
| 52 | } | |
| 53 | if (n->rb_right) { | |
| 54 | n = n->rb_right; | |
| 55 | continue; | |
| 56 | } | |
| 57 | p = rb_parent(n); | |
| 58 | node = rb_entry(n, struct iface_node, node); | |
| 59 | if (!p) | |
| 60 | *root = RB_ROOT; | |
| 61 | else if (p->rb_left == n) | |
| 62 | p->rb_left = NULL; | |
| 63 | else if (p->rb_right == n) | |
| 64 | p->rb_right = NULL; | |
| 65 | ||
| 66 | kfree(node); | |
| 67 | n = p; | |
| 68 | } | |
| 69 | } | |
| 70 | ||
| 71 | static int | |
| 72 | iface_test(struct rb_root *root, const char **iface) | |
| 73 | { | |
| 74 | struct rb_node *n = root->rb_node; | |
| 75 | ||
| 76 | while (n) { | |
| 77 | const char *d = iface_data(n); | |
| ef5b6e12 | 78 | int res = strcmp(*iface, d); |
| 15b4d93f | 79 | |
| e385357a JK |
80 | if (res < 0) |
| 81 | n = n->rb_left; | |
| 82 | else if (res > 0) | |
| 83 | n = n->rb_right; | |
| 84 | else { | |
| 85 | *iface = d; | |
| 86 | return 1; | |
| 87 | } | |
| 88 | } | |
| 89 | return 0; | |
| 90 | } | |
| 91 | ||
| 92 | static int | |
| 93 | iface_add(struct rb_root *root, const char **iface) | |
| 94 | { | |
| 95 | struct rb_node **n = &(root->rb_node), *p = NULL; | |
| 96 | struct iface_node *d; | |
| 15b4d93f | 97 | |
| e385357a JK |
98 | while (*n) { |
| 99 | char *ifname = iface_data(*n); | |
| ef5b6e12 | 100 | int res = strcmp(*iface, ifname); |
| e385357a JK |
101 | |
| 102 | p = *n; | |
| 103 | if (res < 0) | |
| 104 | n = &((*n)->rb_left); | |
| 105 | else if (res > 0) | |
| 106 | n = &((*n)->rb_right); | |
| 107 | else { | |
| 108 | *iface = ifname; | |
| 109 | return 0; | |
| 110 | } | |
| 111 | } | |
| 112 | ||
| 113 | d = kzalloc(sizeof(*d), GFP_ATOMIC); | |
| 114 | if (!d) | |
| 115 | return -ENOMEM; | |
| 116 | strcpy(d->iface, *iface); | |
| 117 | ||
| 118 | rb_link_node(&d->node, p, n); | |
| 119 | rb_insert_color(&d->node, root); | |
| 120 | ||
| 121 | *iface = d->iface; | |
| 122 | return 0; | |
| 123 | } | |
| 124 | ||
| 125 | /* Type specific function prefix */ | |
| 126 | #define TYPE hash_netiface | |
| 127 | ||
| 128 | static bool | |
| 129 | hash_netiface_same_set(const struct ip_set *a, const struct ip_set *b); | |
| 130 | ||
| 131 | #define hash_netiface4_same_set hash_netiface_same_set | |
| 132 | #define hash_netiface6_same_set hash_netiface_same_set | |
| 133 | ||
| 134 | #define STREQ(a, b) (strcmp(a, b) == 0) | |
| 135 | ||
| 136 | /* The type variant functions: IPv4 */ | |
| 137 | ||
| 89dc79b7 JK |
138 | struct hash_netiface4_elem_hashed { |
| 139 | __be32 ip; | |
| 140 | u8 physdev; | |
| 141 | u8 cidr; | |
| 2a7cef2a JK |
142 | u8 nomatch; |
| 143 | u8 padding; | |
| 89dc79b7 JK |
144 | }; |
| 145 | ||
| 146 | #define HKEY_DATALEN sizeof(struct hash_netiface4_elem_hashed) | |
| 147 | ||
| e385357a JK |
148 | /* Member elements without timeout */ |
| 149 | struct hash_netiface4_elem { | |
| 150 | __be32 ip; | |
| e385357a JK |
151 | u8 physdev; |
| 152 | u8 cidr; | |
| 2a7cef2a JK |
153 | u8 nomatch; |
| 154 | u8 padding; | |
| 89dc79b7 | 155 | const char *iface; |
| e385357a JK |
156 | }; |
| 157 | ||
| 158 | /* Member elements with timeout support */ | |
| 159 | struct hash_netiface4_telem { | |
| 160 | __be32 ip; | |
| e385357a JK |
161 | u8 physdev; |
| 162 | u8 cidr; | |
| 2a7cef2a JK |
163 | u8 nomatch; |
| 164 | u8 padding; | |
| 89dc79b7 | 165 | const char *iface; |
| e385357a JK |
166 | unsigned long timeout; |
| 167 | }; | |
| 168 | ||
| 169 | static inline bool | |
| 170 | hash_netiface4_data_equal(const struct hash_netiface4_elem *ip1, | |
| 89dc79b7 JK |
171 | const struct hash_netiface4_elem *ip2, |
| 172 | u32 *multi) | |
| e385357a JK |
173 | { |
| 174 | return ip1->ip == ip2->ip && | |
| 175 | ip1->cidr == ip2->cidr && | |
| 89dc79b7 | 176 | (++*multi) && |
| e385357a JK |
177 | ip1->physdev == ip2->physdev && |
| 178 | ip1->iface == ip2->iface; | |
| 179 | } | |
| 180 | ||
| 181 | static inline bool | |
| 182 | hash_netiface4_data_isnull(const struct hash_netiface4_elem *elem) | |
| 183 | { | |
| 184 | return elem->cidr == 0; | |
| 185 | } | |
| 186 | ||
| 187 | static inline void | |
| 188 | hash_netiface4_data_copy(struct hash_netiface4_elem *dst, | |
| 2a7cef2a JK |
189 | const struct hash_netiface4_elem *src) |
| 190 | { | |
| e385357a JK |
191 | dst->ip = src->ip; |
| 192 | dst->cidr = src->cidr; | |
| 193 | dst->physdev = src->physdev; | |
| 194 | dst->iface = src->iface; | |
| 2a7cef2a JK |
195 | dst->nomatch = src->nomatch; |
| 196 | } | |
| 197 | ||
| 198 | static inline void | |
| 199 | hash_netiface4_data_flags(struct hash_netiface4_elem *dst, u32 flags) | |
| 200 | { | |
| 201 | dst->nomatch = flags & IPSET_FLAG_NOMATCH; | |
| 202 | } | |
| 203 | ||
| 204 | static inline bool | |
| 205 | hash_netiface4_data_match(const struct hash_netiface4_elem *elem) | |
| 206 | { | |
| 207 | return !elem->nomatch; | |
| e385357a JK |
208 | } |
| 209 | ||
| 210 | static inline void | |
| 211 | hash_netiface4_data_netmask(struct hash_netiface4_elem *elem, u8 cidr) | |
| 212 | { | |
| 213 | elem->ip &= ip_set_netmask(cidr); | |
| 214 | elem->cidr = cidr; | |
| 215 | } | |
| 216 | ||
| 217 | static inline void | |
| 218 | hash_netiface4_data_zero_out(struct hash_netiface4_elem *elem) | |
| 219 | { | |
| 220 | elem->cidr = 0; | |
| 221 | } | |
| 222 | ||
| 223 | static bool | |
| 224 | hash_netiface4_data_list(struct sk_buff *skb, | |
| 225 | const struct hash_netiface4_elem *data) | |
| 226 | { | |
| 227 | u32 flags = data->physdev ? IPSET_FLAG_PHYSDEV : 0; | |
| 228 | ||
| 2a7cef2a JK |
229 | if (data->nomatch) |
| 230 | flags |= IPSET_FLAG_NOMATCH; | |
| 7cf7899d DM |
231 | if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) || |
| 232 | nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr) || | |
| 233 | nla_put_string(skb, IPSET_ATTR_IFACE, data->iface) || | |
| 234 | (flags && | |
| 235 | nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags)))) | |
| 236 | goto nla_put_failure; | |
| e385357a JK |
237 | return 0; |
| 238 | ||
| 239 | nla_put_failure: | |
| 240 | return 1; | |
| 241 | } | |
| 242 | ||
| 243 | static bool | |
| 244 | hash_netiface4_data_tlist(struct sk_buff *skb, | |
| 245 | const struct hash_netiface4_elem *data) | |
| 246 | { | |
| 247 | const struct hash_netiface4_telem *tdata = | |
| 248 | (const struct hash_netiface4_telem *)data; | |
| 249 | u32 flags = data->physdev ? IPSET_FLAG_PHYSDEV : 0; | |
| 250 | ||
| 2a7cef2a JK |
251 | if (data->nomatch) |
| 252 | flags |= IPSET_FLAG_NOMATCH; | |
| 7cf7899d DM |
253 | if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) || |
| 254 | nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr) || | |
| 255 | nla_put_string(skb, IPSET_ATTR_IFACE, data->iface) || | |
| 256 | (flags && | |
| 257 | nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))) || | |
| 258 | nla_put_net32(skb, IPSET_ATTR_TIMEOUT, | |
| 259 | htonl(ip_set_timeout_get(tdata->timeout)))) | |
| 260 | goto nla_put_failure; | |
| e385357a JK |
261 | |
| 262 | return 0; | |
| 263 | ||
| 264 | nla_put_failure: | |
| 265 | return 1; | |
| 266 | } | |
| 267 | ||
| 268 | #define IP_SET_HASH_WITH_NETS | |
| 269 | #define IP_SET_HASH_WITH_RBTREE | |
| 89dc79b7 | 270 | #define IP_SET_HASH_WITH_MULTI |
| e385357a JK |
271 | |
| 272 | #define PF 4 | |
| 273 | #define HOST_MASK 32 | |
| 274 | #include <linux/netfilter/ipset/ip_set_ahash.h> | |
| 275 | ||
| 276 | static inline void | |
| 277 | hash_netiface4_data_next(struct ip_set_hash *h, | |
| 278 | const struct hash_netiface4_elem *d) | |
| 279 | { | |
| 280 | h->next.ip = ntohl(d->ip); | |
| 281 | } | |
| 282 | ||
| 283 | static int | |
| 284 | hash_netiface4_kadt(struct ip_set *set, const struct sk_buff *skb, | |
| 285 | const struct xt_action_param *par, | |
| 286 | enum ipset_adt adt, const struct ip_set_adt_opt *opt) | |
| 287 | { | |
| 288 | struct ip_set_hash *h = set->data; | |
| 289 | ipset_adtfn adtfn = set->variant->adt[adt]; | |
| 290 | struct hash_netiface4_elem data = { | |
| 291 | .cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK | |
| 292 | }; | |
| 293 | int ret; | |
| 294 | ||
| 295 | if (data.cidr == 0) | |
| 296 | return -EINVAL; | |
| 297 | if (adt == IPSET_TEST) | |
| 298 | data.cidr = HOST_MASK; | |
| 299 | ||
| 300 | ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip); | |
| 301 | data.ip &= ip_set_netmask(data.cidr); | |
| 302 | ||
| 303 | #define IFACE(dir) (par->dir ? par->dir->name : NULL) | |
| 304 | #define PHYSDEV(dir) (nf_bridge->dir ? nf_bridge->dir->name : NULL) | |
| 305 | #define SRCDIR (opt->flags & IPSET_DIM_TWO_SRC) | |
| 306 | ||
| 307 | if (opt->cmdflags & IPSET_FLAG_PHYSDEV) { | |
| 308 | #ifdef CONFIG_BRIDGE_NETFILTER | |
| 309 | const struct nf_bridge_info *nf_bridge = skb->nf_bridge; | |
| 15b4d93f | 310 | |
| e385357a JK |
311 | if (!nf_bridge) |
| 312 | return -EINVAL; | |
| 15b4d93f | 313 | data.iface = SRCDIR ? PHYSDEV(physindev) : PHYSDEV(physoutdev); |
| e385357a JK |
314 | data.physdev = 1; |
| 315 | #else | |
| 316 | data.iface = NULL; | |
| 317 | #endif | |
| 318 | } else | |
| 319 | data.iface = SRCDIR ? IFACE(in) : IFACE(out); | |
| 320 | ||
| 321 | if (!data.iface) | |
| 322 | return -EINVAL; | |
| 323 | ret = iface_test(&h->rbtree, &data.iface); | |
| 324 | if (adt == IPSET_ADD) { | |
| 325 | if (!ret) { | |
| 326 | ret = iface_add(&h->rbtree, &data.iface); | |
| 327 | if (ret) | |
| 328 | return ret; | |
| 329 | } | |
| 330 | } else if (!ret) | |
| 331 | return ret; | |
| 332 | ||
| 333 | return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags); | |
| 334 | } | |
| 335 | ||
| 336 | static int | |
| 337 | hash_netiface4_uadt(struct ip_set *set, struct nlattr *tb[], | |
| 338 | enum ipset_adt adt, u32 *lineno, u32 flags, bool retried) | |
| 339 | { | |
| 340 | struct ip_set_hash *h = set->data; | |
| 341 | ipset_adtfn adtfn = set->variant->adt[adt]; | |
| 342 | struct hash_netiface4_elem data = { .cidr = HOST_MASK }; | |
| 343 | u32 ip = 0, ip_to, last; | |
| 344 | u32 timeout = h->timeout; | |
| ef5b6e12 | 345 | char iface[IFNAMSIZ]; |
| e385357a JK |
346 | int ret; |
| 347 | ||
| 348 | if (unlikely(!tb[IPSET_ATTR_IP] || | |
| 349 | !tb[IPSET_ATTR_IFACE] || | |
| 350 | !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) || | |
| 351 | !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS))) | |
| 352 | return -IPSET_ERR_PROTOCOL; | |
| 353 | ||
| 354 | if (tb[IPSET_ATTR_LINENO]) | |
| 355 | *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); | |
| 356 | ||
| 357 | ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip); | |
| 358 | if (ret) | |
| 359 | return ret; | |
| 360 | ||
| 361 | if (tb[IPSET_ATTR_CIDR]) { | |
| 362 | data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]); | |
| 2a7cef2a | 363 | if (!data.cidr || data.cidr > HOST_MASK) |
| 15b4d93f | 364 | return -IPSET_ERR_INVALID_CIDR; |
| e385357a JK |
365 | } |
| 366 | ||
| 367 | if (tb[IPSET_ATTR_TIMEOUT]) { | |
| 368 | if (!with_timeout(h->timeout)) | |
| 369 | return -IPSET_ERR_TIMEOUT; | |
| 370 | timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]); | |
| 371 | } | |
| 372 | ||
| 15b4d93f | 373 | strcpy(iface, nla_data(tb[IPSET_ATTR_IFACE])); |
| e385357a JK |
374 | data.iface = iface; |
| 375 | ret = iface_test(&h->rbtree, &data.iface); | |
| 376 | if (adt == IPSET_ADD) { | |
| 377 | if (!ret) { | |
| 378 | ret = iface_add(&h->rbtree, &data.iface); | |
| 379 | if (ret) | |
| 380 | return ret; | |
| 381 | } | |
| 382 | } else if (!ret) | |
| 383 | return ret; | |
| 384 | ||
| 385 | if (tb[IPSET_ATTR_CADT_FLAGS]) { | |
| 15b4d93f JK |
386 | u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]); |
| 387 | if (cadt_flags & IPSET_FLAG_PHYSDEV) | |
| e385357a | 388 | data.physdev = 1; |
| 2a7cef2a JK |
389 | if (adt == IPSET_ADD && (cadt_flags & IPSET_FLAG_NOMATCH)) |
| 390 | flags |= (cadt_flags << 16); | |
| e385357a JK |
391 | } |
| 392 | ||
| 393 | if (adt == IPSET_TEST || !tb[IPSET_ATTR_IP_TO]) { | |
| 394 | data.ip = htonl(ip & ip_set_hostmask(data.cidr)); | |
| 395 | ret = adtfn(set, &data, timeout, flags); | |
| 396 | return ip_set_eexist(ret, flags) ? 0 : ret; | |
| 397 | } | |
| 398 | ||
| 399 | if (tb[IPSET_ATTR_IP_TO]) { | |
| 400 | ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to); | |
| 401 | if (ret) | |
| 402 | return ret; | |
| 403 | if (ip_to < ip) | |
| 404 | swap(ip, ip_to); | |
| 405 | if (ip + UINT_MAX == ip_to) | |
| 406 | return -IPSET_ERR_HASH_RANGE; | |
| 407 | } else { | |
| 408 | ip_set_mask_from_to(ip, ip_to, data.cidr); | |
| 409 | } | |
| 410 | ||
| 411 | if (retried) | |
| 412 | ip = h->next.ip; | |
| 413 | while (!after(ip, ip_to)) { | |
| 414 | data.ip = htonl(ip); | |
| 415 | last = ip_set_range_to_cidr(ip, ip_to, &data.cidr); | |
| 416 | ret = adtfn(set, &data, timeout, flags); | |
| 417 | ||
| 418 | if (ret && !ip_set_eexist(ret, flags)) | |
| 419 | return ret; | |
| 420 | else | |
| 421 | ret = 0; | |
| 422 | ip = last + 1; | |
| 423 | } | |
| 424 | return ret; | |
| 425 | } | |
| 426 | ||
| 427 | static bool | |
| 428 | hash_netiface_same_set(const struct ip_set *a, const struct ip_set *b) | |
| 429 | { | |
| 430 | const struct ip_set_hash *x = a->data; | |
| 431 | const struct ip_set_hash *y = b->data; | |
| 432 | ||
| 433 | /* Resizing changes htable_bits, so we ignore it */ | |
| 434 | return x->maxelem == y->maxelem && | |
| 435 | x->timeout == y->timeout; | |
| 436 | } | |
| 437 | ||
| 438 | /* The type variant functions: IPv6 */ | |
| 439 | ||
| 89dc79b7 JK |
440 | struct hash_netiface6_elem_hashed { |
| 441 | union nf_inet_addr ip; | |
| 442 | u8 physdev; | |
| 443 | u8 cidr; | |
| 2a7cef2a JK |
444 | u8 nomatch; |
| 445 | u8 padding; | |
| 89dc79b7 JK |
446 | }; |
| 447 | ||
| 448 | #define HKEY_DATALEN sizeof(struct hash_netiface6_elem_hashed) | |
| 449 | ||
| e385357a JK |
450 | struct hash_netiface6_elem { |
| 451 | union nf_inet_addr ip; | |
| e385357a JK |
452 | u8 physdev; |
| 453 | u8 cidr; | |
| 2a7cef2a JK |
454 | u8 nomatch; |
| 455 | u8 padding; | |
| 89dc79b7 | 456 | const char *iface; |
| e385357a JK |
457 | }; |
| 458 | ||
| 459 | struct hash_netiface6_telem { | |
| 460 | union nf_inet_addr ip; | |
| e385357a JK |
461 | u8 physdev; |
| 462 | u8 cidr; | |
| 2a7cef2a JK |
463 | u8 nomatch; |
| 464 | u8 padding; | |
| 89dc79b7 | 465 | const char *iface; |
| e385357a JK |
466 | unsigned long timeout; |
| 467 | }; | |
| 468 | ||
| 469 | static inline bool | |
| 470 | hash_netiface6_data_equal(const struct hash_netiface6_elem *ip1, | |
| 89dc79b7 JK |
471 | const struct hash_netiface6_elem *ip2, |
| 472 | u32 *multi) | |
| e385357a JK |
473 | { |
| 474 | return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 && | |
| 475 | ip1->cidr == ip2->cidr && | |
| 89dc79b7 | 476 | (++*multi) && |
| e385357a JK |
477 | ip1->physdev == ip2->physdev && |
| 478 | ip1->iface == ip2->iface; | |
| 479 | } | |
| 480 | ||
| 481 | static inline bool | |
| 482 | hash_netiface6_data_isnull(const struct hash_netiface6_elem *elem) | |
| 483 | { | |
| 484 | return elem->cidr == 0; | |
| 485 | } | |
| 486 | ||
| 487 | static inline void | |
| 488 | hash_netiface6_data_copy(struct hash_netiface6_elem *dst, | |
| 489 | const struct hash_netiface6_elem *src) | |
| 490 | { | |
| 491 | memcpy(dst, src, sizeof(*dst)); | |
| 492 | } | |
| 493 | ||
| 2a7cef2a JK |
494 | static inline void |
| 495 | hash_netiface6_data_flags(struct hash_netiface6_elem *dst, u32 flags) | |
| 496 | { | |
| 497 | dst->nomatch = flags & IPSET_FLAG_NOMATCH; | |
| 498 | } | |
| 499 | ||
| 500 | static inline bool | |
| 501 | hash_netiface6_data_match(const struct hash_netiface6_elem *elem) | |
| 502 | { | |
| 503 | return !elem->nomatch; | |
| 504 | } | |
| 505 | ||
| e385357a JK |
506 | static inline void |
| 507 | hash_netiface6_data_zero_out(struct hash_netiface6_elem *elem) | |
| 508 | { | |
| 2a7cef2a | 509 | elem->cidr = 0; |
| e385357a JK |
510 | } |
| 511 | ||
| 512 | static inline void | |
| 513 | ip6_netmask(union nf_inet_addr *ip, u8 prefix) | |
| 514 | { | |
| 515 | ip->ip6[0] &= ip_set_netmask6(prefix)[0]; | |
| 516 | ip->ip6[1] &= ip_set_netmask6(prefix)[1]; | |
| 517 | ip->ip6[2] &= ip_set_netmask6(prefix)[2]; | |
| 518 | ip->ip6[3] &= ip_set_netmask6(prefix)[3]; | |
| 519 | } | |
| 520 | ||
| 521 | static inline void | |
| 522 | hash_netiface6_data_netmask(struct hash_netiface6_elem *elem, u8 cidr) | |
| 523 | { | |
| 524 | ip6_netmask(&elem->ip, cidr); | |
| 525 | elem->cidr = cidr; | |
| 526 | } | |
| 527 | ||
| 528 | static bool | |
| 529 | hash_netiface6_data_list(struct sk_buff *skb, | |
| 530 | const struct hash_netiface6_elem *data) | |
| 531 | { | |
| 532 | u32 flags = data->physdev ? IPSET_FLAG_PHYSDEV : 0; | |
| 533 | ||
| 2a7cef2a JK |
534 | if (data->nomatch) |
| 535 | flags |= IPSET_FLAG_NOMATCH; | |
| 7cf7899d DM |
536 | if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6) || |
| 537 | nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr) || | |
| 538 | nla_put_string(skb, IPSET_ATTR_IFACE, data->iface) || | |
| 539 | (flags && | |
| 540 | nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags)))) | |
| 541 | goto nla_put_failure; | |
| e385357a JK |
542 | return 0; |
| 543 | ||
| 544 | nla_put_failure: | |
| 545 | return 1; | |
| 546 | } | |
| 547 | ||
| 548 | static bool | |
| 549 | hash_netiface6_data_tlist(struct sk_buff *skb, | |
| 550 | const struct hash_netiface6_elem *data) | |
| 551 | { | |
| 552 | const struct hash_netiface6_telem *e = | |
| 553 | (const struct hash_netiface6_telem *)data; | |
| 554 | u32 flags = data->physdev ? IPSET_FLAG_PHYSDEV : 0; | |
| 555 | ||
| 2a7cef2a JK |
556 | if (data->nomatch) |
| 557 | flags |= IPSET_FLAG_NOMATCH; | |
| 7cf7899d DM |
558 | if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &e->ip.in6) || |
| 559 | nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr) || | |
| 560 | nla_put_string(skb, IPSET_ATTR_IFACE, data->iface) || | |
| 561 | (flags && | |
| 562 | nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))) || | |
| 563 | nla_put_net32(skb, IPSET_ATTR_TIMEOUT, | |
| 564 | htonl(ip_set_timeout_get(e->timeout)))) | |
| 565 | goto nla_put_failure; | |
| e385357a JK |
566 | return 0; |
| 567 | ||
| 568 | nla_put_failure: | |
| 569 | return 1; | |
| 570 | } | |
| 571 | ||
| 572 | #undef PF | |
| 573 | #undef HOST_MASK | |
| 574 | ||
| 575 | #define PF 6 | |
| 576 | #define HOST_MASK 128 | |
| 577 | #include <linux/netfilter/ipset/ip_set_ahash.h> | |
| 578 | ||
| 579 | static inline void | |
| 580 | hash_netiface6_data_next(struct ip_set_hash *h, | |
| 581 | const struct hash_netiface6_elem *d) | |
| 582 | { | |
| 583 | } | |
| 584 | ||
| 585 | static int | |
| 586 | hash_netiface6_kadt(struct ip_set *set, const struct sk_buff *skb, | |
| 587 | const struct xt_action_param *par, | |
| 588 | enum ipset_adt adt, const struct ip_set_adt_opt *opt) | |
| 589 | { | |
| 590 | struct ip_set_hash *h = set->data; | |
| 591 | ipset_adtfn adtfn = set->variant->adt[adt]; | |
| 592 | struct hash_netiface6_elem data = { | |
| 593 | .cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK | |
| 594 | }; | |
| 595 | int ret; | |
| 596 | ||
| 597 | if (data.cidr == 0) | |
| 598 | return -EINVAL; | |
| 599 | if (adt == IPSET_TEST) | |
| 600 | data.cidr = HOST_MASK; | |
| 601 | ||
| 602 | ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip.in6); | |
| 603 | ip6_netmask(&data.ip, data.cidr); | |
| 604 | ||
| 605 | if (opt->cmdflags & IPSET_FLAG_PHYSDEV) { | |
| 606 | #ifdef CONFIG_BRIDGE_NETFILTER | |
| 607 | const struct nf_bridge_info *nf_bridge = skb->nf_bridge; | |
| 15b4d93f | 608 | |
| e385357a JK |
609 | if (!nf_bridge) |
| 610 | return -EINVAL; | |
| 15b4d93f | 611 | data.iface = SRCDIR ? PHYSDEV(physindev) : PHYSDEV(physoutdev); |
| e385357a JK |
612 | data.physdev = 1; |
| 613 | #else | |
| 614 | data.iface = NULL; | |
| 615 | #endif | |
| 616 | } else | |
| 617 | data.iface = SRCDIR ? IFACE(in) : IFACE(out); | |
| 618 | ||
| 619 | if (!data.iface) | |
| 620 | return -EINVAL; | |
| 621 | ret = iface_test(&h->rbtree, &data.iface); | |
| 622 | if (adt == IPSET_ADD) { | |
| 623 | if (!ret) { | |
| 624 | ret = iface_add(&h->rbtree, &data.iface); | |
| 625 | if (ret) | |
| 626 | return ret; | |
| 627 | } | |
| 628 | } else if (!ret) | |
| 629 | return ret; | |
| 630 | ||
| 631 | return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags); | |
| 632 | } | |
| 633 | ||
| 634 | static int | |
| 635 | hash_netiface6_uadt(struct ip_set *set, struct nlattr *tb[], | |
| 636 | enum ipset_adt adt, u32 *lineno, u32 flags, bool retried) | |
| 637 | { | |
| 638 | struct ip_set_hash *h = set->data; | |
| 639 | ipset_adtfn adtfn = set->variant->adt[adt]; | |
| 640 | struct hash_netiface6_elem data = { .cidr = HOST_MASK }; | |
| 641 | u32 timeout = h->timeout; | |
| ef5b6e12 | 642 | char iface[IFNAMSIZ]; |
| e385357a JK |
643 | int ret; |
| 644 | ||
| 645 | if (unlikely(!tb[IPSET_ATTR_IP] || | |
| 646 | !tb[IPSET_ATTR_IFACE] || | |
| 647 | !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) || | |
| 648 | !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS))) | |
| 649 | return -IPSET_ERR_PROTOCOL; | |
| 650 | if (unlikely(tb[IPSET_ATTR_IP_TO])) | |
| 651 | return -IPSET_ERR_HASH_RANGE_UNSUPPORTED; | |
| 652 | ||
| 653 | if (tb[IPSET_ATTR_LINENO]) | |
| 654 | *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); | |
| 655 | ||
| 656 | ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &data.ip); | |
| 657 | if (ret) | |
| 658 | return ret; | |
| 659 | ||
| 660 | if (tb[IPSET_ATTR_CIDR]) | |
| 661 | data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]); | |
| 2a7cef2a | 662 | if (!data.cidr || data.cidr > HOST_MASK) |
| e385357a JK |
663 | return -IPSET_ERR_INVALID_CIDR; |
| 664 | ip6_netmask(&data.ip, data.cidr); | |
| 665 | ||
| 666 | if (tb[IPSET_ATTR_TIMEOUT]) { | |
| 667 | if (!with_timeout(h->timeout)) | |
| 668 | return -IPSET_ERR_TIMEOUT; | |
| 669 | timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]); | |
| 670 | } | |
| 671 | ||
| 15b4d93f | 672 | strcpy(iface, nla_data(tb[IPSET_ATTR_IFACE])); |
| e385357a JK |
673 | data.iface = iface; |
| 674 | ret = iface_test(&h->rbtree, &data.iface); | |
| 675 | if (adt == IPSET_ADD) { | |
| 676 | if (!ret) { | |
| 677 | ret = iface_add(&h->rbtree, &data.iface); | |
| 678 | if (ret) | |
| 679 | return ret; | |
| 680 | } | |
| 681 | } else if (!ret) | |
| 682 | return ret; | |
| 683 | ||
| 684 | if (tb[IPSET_ATTR_CADT_FLAGS]) { | |
| 15b4d93f JK |
685 | u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]); |
| 686 | if (cadt_flags & IPSET_FLAG_PHYSDEV) | |
| e385357a | 687 | data.physdev = 1; |
| 2a7cef2a JK |
688 | if (adt == IPSET_ADD && (cadt_flags & IPSET_FLAG_NOMATCH)) |
| 689 | flags |= (cadt_flags << 16); | |
| e385357a JK |
690 | } |
| 691 | ||
| 692 | ret = adtfn(set, &data, timeout, flags); | |
| 693 | ||
| 694 | return ip_set_eexist(ret, flags) ? 0 : ret; | |
| 695 | } | |
| 696 | ||
| 697 | /* Create hash:ip type of sets */ | |
| 698 | ||
| 699 | static int | |
| 700 | hash_netiface_create(struct ip_set *set, struct nlattr *tb[], u32 flags) | |
| 701 | { | |
| 702 | struct ip_set_hash *h; | |
| 703 | u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM; | |
| 704 | u8 hbits; | |
| 26a5d3cc | 705 | size_t hsize; |
| e385357a | 706 | |
| c15f1c83 | 707 | if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6)) |
| e385357a JK |
708 | return -IPSET_ERR_INVALID_FAMILY; |
| 709 | ||
| 710 | if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) || | |
| 711 | !ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) || | |
| 712 | !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT))) | |
| 713 | return -IPSET_ERR_PROTOCOL; | |
| 714 | ||
| 715 | if (tb[IPSET_ATTR_HASHSIZE]) { | |
| 716 | hashsize = ip_set_get_h32(tb[IPSET_ATTR_HASHSIZE]); | |
| 717 | if (hashsize < IPSET_MIMINAL_HASHSIZE) | |
| 718 | hashsize = IPSET_MIMINAL_HASHSIZE; | |
| 719 | } | |
| 720 | ||
| 721 | if (tb[IPSET_ATTR_MAXELEM]) | |
| 722 | maxelem = ip_set_get_h32(tb[IPSET_ATTR_MAXELEM]); | |
| 723 | ||
| 724 | h = kzalloc(sizeof(*h) | |
| 725 | + sizeof(struct ip_set_hash_nets) | |
| c15f1c83 | 726 | * (set->family == NFPROTO_IPV4 ? 32 : 128), GFP_KERNEL); |
| e385357a JK |
727 | if (!h) |
| 728 | return -ENOMEM; | |
| 729 | ||
| 730 | h->maxelem = maxelem; | |
| 731 | get_random_bytes(&h->initval, sizeof(h->initval)); | |
| 732 | h->timeout = IPSET_NO_TIMEOUT; | |
| 89dc79b7 | 733 | h->ahash_max = AHASH_MAX_SIZE; |
| e385357a JK |
734 | |
| 735 | hbits = htable_bits(hashsize); | |
| 26a5d3cc JK |
736 | hsize = htable_size(hbits); |
| 737 | if (hsize == 0) { | |
| 738 | kfree(h); | |
| 739 | return -ENOMEM; | |
| 740 | } | |
| 741 | h->table = ip_set_alloc(hsize); | |
| e385357a JK |
742 | if (!h->table) { |
| 743 | kfree(h); | |
| 744 | return -ENOMEM; | |
| 745 | } | |
| 746 | h->table->htable_bits = hbits; | |
| 747 | h->rbtree = RB_ROOT; | |
| 748 | ||
| 749 | set->data = h; | |
| 750 | ||
| 751 | if (tb[IPSET_ATTR_TIMEOUT]) { | |
| 752 | h->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]); | |
| 753 | ||
| c15f1c83 | 754 | set->variant = set->family == NFPROTO_IPV4 |
| e385357a JK |
755 | ? &hash_netiface4_tvariant : &hash_netiface6_tvariant; |
| 756 | ||
| c15f1c83 | 757 | if (set->family == NFPROTO_IPV4) |
| e385357a JK |
758 | hash_netiface4_gc_init(set); |
| 759 | else | |
| 760 | hash_netiface6_gc_init(set); | |
| 761 | } else { | |
| c15f1c83 | 762 | set->variant = set->family == NFPROTO_IPV4 |
| e385357a JK |
763 | ? &hash_netiface4_variant : &hash_netiface6_variant; |
| 764 | } | |
| 765 | ||
| 766 | pr_debug("create %s hashsize %u (%u) maxelem %u: %p(%p)\n", | |
| 767 | set->name, jhash_size(h->table->htable_bits), | |
| 768 | h->table->htable_bits, h->maxelem, set->data, h->table); | |
| 769 | ||
| 770 | return 0; | |
| 771 | } | |
| 772 | ||
| 773 | static struct ip_set_type hash_netiface_type __read_mostly = { | |
| 774 | .name = "hash:net,iface", | |
| 775 | .protocol = IPSET_PROTOCOL, | |
| 776 | .features = IPSET_TYPE_IP | IPSET_TYPE_IFACE, | |
| 777 | .dimension = IPSET_DIM_TWO, | |
| c15f1c83 | 778 | .family = NFPROTO_UNSPEC, |
| e385357a | 779 | .revision_min = 0, |
| 2a7cef2a | 780 | .revision_max = 1, /* nomatch flag support added */ |
| e385357a JK |
781 | .create = hash_netiface_create, |
| 782 | .create_policy = { | |
| 783 | [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 }, | |
| 784 | [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 }, | |
| 785 | [IPSET_ATTR_PROBES] = { .type = NLA_U8 }, | |
| 786 | [IPSET_ATTR_RESIZE] = { .type = NLA_U8 }, | |
| 787 | [IPSET_ATTR_PROTO] = { .type = NLA_U8 }, | |
| 788 | [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, | |
| 789 | }, | |
| 790 | .adt_policy = { | |
| 791 | [IPSET_ATTR_IP] = { .type = NLA_NESTED }, | |
| 792 | [IPSET_ATTR_IP_TO] = { .type = NLA_NESTED }, | |
| 793 | [IPSET_ATTR_IFACE] = { .type = NLA_NUL_STRING, | |
| 794 | .len = IPSET_MAXNAMELEN - 1 }, | |
| 795 | [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 }, | |
| 796 | [IPSET_ATTR_CIDR] = { .type = NLA_U8 }, | |
| 797 | [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, | |
| 798 | [IPSET_ATTR_LINENO] = { .type = NLA_U32 }, | |
| 799 | }, | |
| 800 | .me = THIS_MODULE, | |
| 801 | }; | |
| 802 | ||
| 803 | static int __init | |
| 804 | hash_netiface_init(void) | |
| 805 | { | |
| 806 | return ip_set_type_register(&hash_netiface_type); | |
| 807 | } | |
| 808 | ||
| 809 | static void __exit | |
| 810 | hash_netiface_fini(void) | |
| 811 | { | |
| 812 | ip_set_type_unregister(&hash_netiface_type); | |
| 813 | } | |
| 814 | ||
| 815 | module_init(hash_netiface_init); | |
| 816 | module_exit(hash_netiface_fini); |