~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/ipset/ip_set_core.c

Version: ~ [ linux-5.3-rc5 ] ~ [ linux-5.2.9 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.67 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.139 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.189 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.189 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.72 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
  2  *                         Patrick Schaaf <bof@bof.de>
  3  * Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  4  *
  5  * This program is free software; you can redistribute it and/or modify
  6  * it under the terms of the GNU General Public License version 2 as
  7  * published by the Free Software Foundation.
  8  */
  9 
 10 /* Kernel module for IP set management */
 11 
 12 #include <linux/init.h>
 13 #include <linux/module.h>
 14 #include <linux/moduleparam.h>
 15 #include <linux/ip.h>
 16 #include <linux/skbuff.h>
 17 #include <linux/spinlock.h>
 18 #include <linux/netlink.h>
 19 #include <linux/rculist.h>
 20 #include <net/netlink.h>
 21 
 22 #include <linux/netfilter.h>
 23 #include <linux/netfilter/x_tables.h>
 24 #include <linux/netfilter/nfnetlink.h>
 25 #include <linux/netfilter/ipset/ip_set.h>
 26 
 27 static LIST_HEAD(ip_set_type_list);             /* all registered set types */
 28 static DEFINE_MUTEX(ip_set_type_mutex);         /* protects ip_set_type_list */
 29 static DEFINE_RWLOCK(ip_set_ref_lock);          /* protects the set refs */
 30 
 31 static struct ip_set **ip_set_list;             /* all individual sets */
 32 static ip_set_id_t ip_set_max = CONFIG_IP_SET_MAX; /* max number of sets */
 33 
 34 #define STREQ(a, b)     (strncmp(a, b, IPSET_MAXNAMELEN) == 0)
 35 
 36 static unsigned int max_sets;
 37 
 38 module_param(max_sets, int, 0600);
 39 MODULE_PARM_DESC(max_sets, "maximal number of sets");
 40 MODULE_LICENSE("GPL");
 41 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
 42 MODULE_DESCRIPTION("core IP set support");
 43 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);
 44 
 45 /*
 46  * The set types are implemented in modules and registered set types
 47  * can be found in ip_set_type_list. Adding/deleting types is
 48  * serialized by ip_set_type_mutex.
 49  */
 50 
 51 static inline void
 52 ip_set_type_lock(void)
 53 {
 54         mutex_lock(&ip_set_type_mutex);
 55 }
 56 
 57 static inline void
 58 ip_set_type_unlock(void)
 59 {
 60         mutex_unlock(&ip_set_type_mutex);
 61 }
 62 
 63 /* Register and deregister settype */
 64 
 65 static struct ip_set_type *
 66 find_set_type(const char *name, u8 family, u8 revision)
 67 {
 68         struct ip_set_type *type;
 69 
 70         list_for_each_entry_rcu(type, &ip_set_type_list, list)
 71                 if (STREQ(type->name, name) &&
 72                     (type->family == family || type->family == NFPROTO_UNSPEC) &&
 73                     revision >= type->revision_min &&
 74                     revision <= type->revision_max)
 75                         return type;
 76         return NULL;
 77 }
 78 
 79 /* Unlock, try to load a set type module and lock again */
 80 static bool
 81 load_settype(const char *name)
 82 {
 83         nfnl_unlock();
 84         pr_debug("try to load ip_set_%s\n", name);
 85         if (request_module("ip_set_%s", name) < 0) {
 86                 pr_warning("Can't find ip_set type %s\n", name);
 87                 nfnl_lock();
 88                 return false;
 89         }
 90         nfnl_lock();
 91         return true;
 92 }
 93 
 94 /* Find a set type and reference it */
 95 #define find_set_type_get(name, family, revision, found)        \
 96         __find_set_type_get(name, family, revision, found, false)
 97 
 98 static int
 99 __find_set_type_get(const char *name, u8 family, u8 revision,
100                     struct ip_set_type **found, bool retry)
101 {
102         struct ip_set_type *type;
103         int err;
104 
105         if (retry && !load_settype(name))
106                 return -IPSET_ERR_FIND_TYPE;
107 
108         rcu_read_lock();
109         *found = find_set_type(name, family, revision);
110         if (*found) {
111                 err = !try_module_get((*found)->me) ? -EFAULT : 0;
112                 goto unlock;
113         }
114         /* Make sure the type is already loaded
115          * but we don't support the revision */
116         list_for_each_entry_rcu(type, &ip_set_type_list, list)
117                 if (STREQ(type->name, name)) {
118                         err = -IPSET_ERR_FIND_TYPE;
119                         goto unlock;
120                 }
121         rcu_read_unlock();
122 
123         return retry ? -IPSET_ERR_FIND_TYPE :
124                 __find_set_type_get(name, family, revision, found, true);
125 
126 unlock:
127         rcu_read_unlock();
128         return err;
129 }
130 
131 /* Find a given set type by name and family.
132  * If we succeeded, the supported minimal and maximum revisions are
133  * filled out.
134  */
135 #define find_set_type_minmax(name, family, min, max) \
136         __find_set_type_minmax(name, family, min, max, false)
137 
138 static int
139 __find_set_type_minmax(const char *name, u8 family, u8 *min, u8 *max,
140                        bool retry)
141 {
142         struct ip_set_type *type;
143         bool found = false;
144 
145         if (retry && !load_settype(name))
146                 return -IPSET_ERR_FIND_TYPE;
147 
148         *min = 255; *max = 0;
149         rcu_read_lock();
150         list_for_each_entry_rcu(type, &ip_set_type_list, list)
151                 if (STREQ(type->name, name) &&
152                     (type->family == family || type->family == NFPROTO_UNSPEC)) {
153                         found = true;
154                         if (type->revision_min < *min)
155                                 *min = type->revision_min;
156                         if (type->revision_max > *max)
157                                 *max = type->revision_max;
158                 }
159         rcu_read_unlock();
160         if (found)
161                 return 0;
162 
163         return retry ? -IPSET_ERR_FIND_TYPE :
164                 __find_set_type_minmax(name, family, min, max, true);
165 }
166 
167 #define family_name(f)  ((f) == NFPROTO_IPV4 ? "inet" : \
168                          (f) == NFPROTO_IPV6 ? "inet6" : "any")
169 
170 /* Register a set type structure. The type is identified by
171  * the unique triple of name, family and revision.
172  */
173 int
174 ip_set_type_register(struct ip_set_type *type)
175 {
176         int ret = 0;
177 
178         if (type->protocol != IPSET_PROTOCOL) {
179                 pr_warning("ip_set type %s, family %s, revision %u:%u uses "
180                            "wrong protocol version %u (want %u)\n",
181                            type->name, family_name(type->family),
182                            type->revision_min, type->revision_max,
183                            type->protocol, IPSET_PROTOCOL);
184                 return -EINVAL;
185         }
186 
187         ip_set_type_lock();
188         if (find_set_type(type->name, type->family, type->revision_min)) {
189                 /* Duplicate! */
190                 pr_warning("ip_set type %s, family %s with revision min %u "
191                            "already registered!\n", type->name,
192                            family_name(type->family), type->revision_min);
193                 ret = -EINVAL;
194                 goto unlock;
195         }
196         list_add_rcu(&type->list, &ip_set_type_list);
197         pr_debug("type %s, family %s, revision %u:%u registered.\n",
198                  type->name, family_name(type->family),
199                  type->revision_min, type->revision_max);
200 unlock:
201         ip_set_type_unlock();
202         return ret;
203 }
204 EXPORT_SYMBOL_GPL(ip_set_type_register);
205 
206 /* Unregister a set type. There's a small race with ip_set_create */
207 void
208 ip_set_type_unregister(struct ip_set_type *type)
209 {
210         ip_set_type_lock();
211         if (!find_set_type(type->name, type->family, type->revision_min)) {
212                 pr_warning("ip_set type %s, family %s with revision min %u "
213                            "not registered\n", type->name,
214                            family_name(type->family), type->revision_min);
215                 goto unlock;
216         }
217         list_del_rcu(&type->list);
218         pr_debug("type %s, family %s with revision min %u unregistered.\n",
219                  type->name, family_name(type->family), type->revision_min);
220 unlock:
221         ip_set_type_unlock();
222 
223         synchronize_rcu();
224 }
225 EXPORT_SYMBOL_GPL(ip_set_type_unregister);
226 
227 /* Utility functions */
228 void *
229 ip_set_alloc(size_t size)
230 {
231         void *members = NULL;
232 
233         if (size < KMALLOC_MAX_SIZE)
234                 members = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
235 
236         if (members) {
237                 pr_debug("%p: allocated with kmalloc\n", members);
238                 return members;
239         }
240 
241         members = vzalloc(size);
242         if (!members)
243                 return NULL;
244         pr_debug("%p: allocated with vmalloc\n", members);
245 
246         return members;
247 }
248 EXPORT_SYMBOL_GPL(ip_set_alloc);
249 
250 void
251 ip_set_free(void *members)
252 {
253         pr_debug("%p: free with %s\n", members,
254                  is_vmalloc_addr(members) ? "vfree" : "kfree");
255         if (is_vmalloc_addr(members))
256                 vfree(members);
257         else
258                 kfree(members);
259 }
260 EXPORT_SYMBOL_GPL(ip_set_free);
261 
262 static inline bool
263 flag_nested(const struct nlattr *nla)
264 {
265         return nla->nla_type & NLA_F_NESTED;
266 }
267 
268 static const struct nla_policy ipaddr_policy[IPSET_ATTR_IPADDR_MAX + 1] = {
269         [IPSET_ATTR_IPADDR_IPV4]        = { .type = NLA_U32 },
270         [IPSET_ATTR_IPADDR_IPV6]        = { .type = NLA_BINARY,
271                                             .len = sizeof(struct in6_addr) },
272 };
273 
274 int
275 ip_set_get_ipaddr4(struct nlattr *nla,  __be32 *ipaddr)
276 {
277         struct nlattr *tb[IPSET_ATTR_IPADDR_MAX+1];
278 
279         if (unlikely(!flag_nested(nla)))
280                 return -IPSET_ERR_PROTOCOL;
281         if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy))
282                 return -IPSET_ERR_PROTOCOL;
283         if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV4)))
284                 return -IPSET_ERR_PROTOCOL;
285 
286         *ipaddr = nla_get_be32(tb[IPSET_ATTR_IPADDR_IPV4]);
287         return 0;
288 }
289 EXPORT_SYMBOL_GPL(ip_set_get_ipaddr4);
290 
291 int
292 ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr)
293 {
294         struct nlattr *tb[IPSET_ATTR_IPADDR_MAX+1];
295 
296         if (unlikely(!flag_nested(nla)))
297                 return -IPSET_ERR_PROTOCOL;
298 
299         if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy))
300                 return -IPSET_ERR_PROTOCOL;
301         if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV6)))
302                 return -IPSET_ERR_PROTOCOL;
303 
304         memcpy(ipaddr, nla_data(tb[IPSET_ATTR_IPADDR_IPV6]),
305                 sizeof(struct in6_addr));
306         return 0;
307 }
308 EXPORT_SYMBOL_GPL(ip_set_get_ipaddr6);
309 
310 /*
311  * Creating/destroying/renaming/swapping affect the existence and
312  * the properties of a set. All of these can be executed from userspace
313  * only and serialized by the nfnl mutex indirectly from nfnetlink.
314  *
315  * Sets are identified by their index in ip_set_list and the index
316  * is used by the external references (set/SET netfilter modules).
317  *
318  * The set behind an index may change by swapping only, from userspace.
319  */
320 
321 static inline void
322 __ip_set_get(ip_set_id_t index)
323 {
324         write_lock_bh(&ip_set_ref_lock);
325         ip_set_list[index]->ref++;
326         write_unlock_bh(&ip_set_ref_lock);
327 }
328 
329 static inline void
330 __ip_set_put(ip_set_id_t index)
331 {
332         write_lock_bh(&ip_set_ref_lock);
333         BUG_ON(ip_set_list[index]->ref == 0);
334         ip_set_list[index]->ref--;
335         write_unlock_bh(&ip_set_ref_lock);
336 }
337 
338 /*
339  * Add, del and test set entries from kernel.
340  *
341  * The set behind the index must exist and must be referenced
342  * so it can't be destroyed (or changed) under our foot.
343  */
344 
345 int
346 ip_set_test(ip_set_id_t index, const struct sk_buff *skb,
347             const struct xt_action_param *par,
348             const struct ip_set_adt_opt *opt)
349 {
350         struct ip_set *set = ip_set_list[index];
351         int ret = 0;
352 
353         BUG_ON(set == NULL);
354         pr_debug("set %s, index %u\n", set->name, index);
355 
356         if (opt->dim < set->type->dimension ||
357             !(opt->family == set->family || set->family == NFPROTO_UNSPEC))
358                 return 0;
359 
360         read_lock_bh(&set->lock);
361         ret = set->variant->kadt(set, skb, par, IPSET_TEST, opt);
362         read_unlock_bh(&set->lock);
363 
364         if (ret == -EAGAIN) {
365                 /* Type requests element to be completed */
366                 pr_debug("element must be competed, ADD is triggered\n");
367                 write_lock_bh(&set->lock);
368                 set->variant->kadt(set, skb, par, IPSET_ADD, opt);
369                 write_unlock_bh(&set->lock);
370                 ret = 1;
371         }
372 
373         /* Convert error codes to nomatch */
374         return (ret < 0 ? 0 : ret);
375 }
376 EXPORT_SYMBOL_GPL(ip_set_test);
377 
378 int
379 ip_set_add(ip_set_id_t index, const struct sk_buff *skb,
380            const struct xt_action_param *par,
381            const struct ip_set_adt_opt *opt)
382 {
383         struct ip_set *set = ip_set_list[index];
384         int ret;
385 
386         BUG_ON(set == NULL);
387         pr_debug("set %s, index %u\n", set->name, index);
388 
389         if (opt->dim < set->type->dimension ||
390             !(opt->family == set->family || set->family == NFPROTO_UNSPEC))
391                 return 0;
392 
393         write_lock_bh(&set->lock);
394         ret = set->variant->kadt(set, skb, par, IPSET_ADD, opt);
395         write_unlock_bh(&set->lock);
396 
397         return ret;
398 }
399 EXPORT_SYMBOL_GPL(ip_set_add);
400 
401 int
402 ip_set_del(ip_set_id_t index, const struct sk_buff *skb,
403            const struct xt_action_param *par,
404            const struct ip_set_adt_opt *opt)
405 {
406         struct ip_set *set = ip_set_list[index];
407         int ret = 0;
408 
409         BUG_ON(set == NULL);
410         pr_debug("set %s, index %u\n", set->name, index);
411 
412         if (opt->dim < set->type->dimension ||
413             !(opt->family == set->family || set->family == NFPROTO_UNSPEC))
414                 return 0;
415 
416         write_lock_bh(&set->lock);
417         ret = set->variant->kadt(set, skb, par, IPSET_DEL, opt);
418         write_unlock_bh(&set->lock);
419 
420         return ret;
421 }
422 EXPORT_SYMBOL_GPL(ip_set_del);
423 
424 /*
425  * Find set by name, reference it once. The reference makes sure the
426  * thing pointed to, does not go away under our feet.
427  *
428  */
429 ip_set_id_t
430 ip_set_get_byname(const char *name, struct ip_set **set)
431 {
432         ip_set_id_t i, index = IPSET_INVALID_ID;
433         struct ip_set *s;
434 
435         for (i = 0; i < ip_set_max; i++) {
436                 s = ip_set_list[i];
437                 if (s != NULL && STREQ(s->name, name)) {
438                         __ip_set_get(i);
439                         index = i;
440                         *set = s;
441                 }
442         }
443 
444         return index;
445 }
446 EXPORT_SYMBOL_GPL(ip_set_get_byname);
447 
448 /*
449  * If the given set pointer points to a valid set, decrement
450  * reference count by 1. The caller shall not assume the index
451  * to be valid, after calling this function.
452  *
453  */
454 void
455 ip_set_put_byindex(ip_set_id_t index)
456 {
457         if (ip_set_list[index] != NULL)
458                 __ip_set_put(index);
459 }
460 EXPORT_SYMBOL_GPL(ip_set_put_byindex);
461 
462 /*
463  * Get the name of a set behind a set index.
464  * We assume the set is referenced, so it does exist and
465  * can't be destroyed. The set cannot be renamed due to
466  * the referencing either.
467  *
468  */
469 const char *
470 ip_set_name_byindex(ip_set_id_t index)
471 {
472         const struct ip_set *set = ip_set_list[index];
473 
474         BUG_ON(set == NULL);
475         BUG_ON(set->ref == 0);
476 
477         /* Referenced, so it's safe */
478         return set->name;
479 }
480 EXPORT_SYMBOL_GPL(ip_set_name_byindex);
481 
482 /*
483  * Routines to call by external subsystems, which do not
484  * call nfnl_lock for us.
485  */
486 
487 /*
488  * Find set by name, reference it once. The reference makes sure the
489  * thing pointed to, does not go away under our feet.
490  *
491  * The nfnl mutex is used in the function.
492  */
493 ip_set_id_t
494 ip_set_nfnl_get(const char *name)
495 {
496         struct ip_set *s;
497         ip_set_id_t index;
498 
499         nfnl_lock();
500         index = ip_set_get_byname(name, &s);
501         nfnl_unlock();
502 
503         return index;
504 }
505 EXPORT_SYMBOL_GPL(ip_set_nfnl_get);
506 
507 /*
508  * Find set by index, reference it once. The reference makes sure the
509  * thing pointed to, does not go away under our feet.
510  *
511  * The nfnl mutex is used in the function.
512  */
513 ip_set_id_t
514 ip_set_nfnl_get_byindex(ip_set_id_t index)
515 {
516         if (index > ip_set_max)
517                 return IPSET_INVALID_ID;
518 
519         nfnl_lock();
520         if (ip_set_list[index])
521                 __ip_set_get(index);
522         else
523                 index = IPSET_INVALID_ID;
524         nfnl_unlock();
525 
526         return index;
527 }
528 EXPORT_SYMBOL_GPL(ip_set_nfnl_get_byindex);
529 
530 /*
531  * If the given set pointer points to a valid set, decrement
532  * reference count by 1. The caller shall not assume the index
533  * to be valid, after calling this function.
534  *
535  * The nfnl mutex is used in the function.
536  */
537 void
538 ip_set_nfnl_put(ip_set_id_t index)
539 {
540         nfnl_lock();
541         ip_set_put_byindex(index);
542         nfnl_unlock();
543 }
544 EXPORT_SYMBOL_GPL(ip_set_nfnl_put);
545 
546 /*
547  * Communication protocol with userspace over netlink.
548  *
549  * The commands are serialized by the nfnl mutex.
550  */
551 
552 static inline bool
553 protocol_failed(const struct nlattr * const tb[])
554 {
555         return !tb[IPSET_ATTR_PROTOCOL] ||
556                nla_get_u8(tb[IPSET_ATTR_PROTOCOL]) != IPSET_PROTOCOL;
557 }
558 
559 static inline u32
560 flag_exist(const struct nlmsghdr *nlh)
561 {
562         return nlh->nlmsg_flags & NLM_F_EXCL ? 0 : IPSET_FLAG_EXIST;
563 }
564 
565 static struct nlmsghdr *
566 start_msg(struct sk_buff *skb, u32 pid, u32 seq, unsigned int flags,
567           enum ipset_cmd cmd)
568 {
569         struct nlmsghdr *nlh;
570         struct nfgenmsg *nfmsg;
571 
572         nlh = nlmsg_put(skb, pid, seq, cmd | (NFNL_SUBSYS_IPSET << 8),
573                         sizeof(*nfmsg), flags);
574         if (nlh == NULL)
575                 return NULL;
576 
577         nfmsg = nlmsg_data(nlh);
578         nfmsg->nfgen_family = NFPROTO_IPV4;
579         nfmsg->version = NFNETLINK_V0;
580         nfmsg->res_id = 0;
581 
582         return nlh;
583 }
584 
585 /* Create a set */
586 
587 static const struct nla_policy ip_set_create_policy[IPSET_ATTR_CMD_MAX + 1] = {
588         [IPSET_ATTR_PROTOCOL]   = { .type = NLA_U8 },
589         [IPSET_ATTR_SETNAME]    = { .type = NLA_NUL_STRING,
590                                     .len = IPSET_MAXNAMELEN - 1 },
591         [IPSET_ATTR_TYPENAME]   = { .type = NLA_NUL_STRING,
592                                     .len = IPSET_MAXNAMELEN - 1},
593         [IPSET_ATTR_REVISION]   = { .type = NLA_U8 },
594         [IPSET_ATTR_FAMILY]     = { .type = NLA_U8 },
595         [IPSET_ATTR_DATA]       = { .type = NLA_NESTED },
596 };
597 
598 static ip_set_id_t
599 find_set_id(const char *name)
600 {
601         ip_set_id_t i, index = IPSET_INVALID_ID;
602         const struct ip_set *set;
603 
604         for (i = 0; index == IPSET_INVALID_ID && i < ip_set_max; i++) {
605                 set = ip_set_list[i];
606                 if (set != NULL && STREQ(set->name, name))
607                         index = i;
608         }
609         return index;
610 }
611 
612 static inline struct ip_set *
613 find_set(const char *name)
614 {
615         ip_set_id_t index = find_set_id(name);
616 
617         return index == IPSET_INVALID_ID ? NULL : ip_set_list[index];
618 }
619 
620 static int
621 find_free_id(const char *name, ip_set_id_t *index, struct ip_set **set)
622 {
623         ip_set_id_t i;
624 
625         *index = IPSET_INVALID_ID;
626         for (i = 0;  i < ip_set_max; i++) {
627                 if (ip_set_list[i] == NULL) {
628                         if (*index == IPSET_INVALID_ID)
629                                 *index = i;
630                 } else if (STREQ(name, ip_set_list[i]->name)) {
631                         /* Name clash */
632                         *set = ip_set_list[i];
633                         return -EEXIST;
634                 }
635         }
636         if (*index == IPSET_INVALID_ID)
637                 /* No free slot remained */
638                 return -IPSET_ERR_MAX_SETS;
639         return 0;
640 }
641 
642 static int
643 ip_set_create(struct sock *ctnl, struct sk_buff *skb,
644               const struct nlmsghdr *nlh,
645               const struct nlattr * const attr[])
646 {
647         struct ip_set *set, *clash = NULL;
648         ip_set_id_t index = IPSET_INVALID_ID;
649         struct nlattr *tb[IPSET_ATTR_CREATE_MAX+1] = {};
650         const char *name, *typename;
651         u8 family, revision;
652         u32 flags = flag_exist(nlh);
653         int ret = 0;
654 
655         if (unlikely(protocol_failed(attr) ||
656                      attr[IPSET_ATTR_SETNAME] == NULL ||
657                      attr[IPSET_ATTR_TYPENAME] == NULL ||
658                      attr[IPSET_ATTR_REVISION] == NULL ||
659                      attr[IPSET_ATTR_FAMILY] == NULL ||
660                      (attr[IPSET_ATTR_DATA] != NULL &&
661                       !flag_nested(attr[IPSET_ATTR_DATA]))))
662                 return -IPSET_ERR_PROTOCOL;
663 
664         name = nla_data(attr[IPSET_ATTR_SETNAME]);
665         typename = nla_data(attr[IPSET_ATTR_TYPENAME]);
666         family = nla_get_u8(attr[IPSET_ATTR_FAMILY]);
667         revision = nla_get_u8(attr[IPSET_ATTR_REVISION]);
668         pr_debug("setname: %s, typename: %s, family: %s, revision: %u\n",
669                  name, typename, family_name(family), revision);
670 
671         /*
672          * First, and without any locks, allocate and initialize
673          * a normal base set structure.
674          */
675         set = kzalloc(sizeof(struct ip_set), GFP_KERNEL);
676         if (!set)
677                 return -ENOMEM;
678         rwlock_init(&set->lock);
679         strlcpy(set->name, name, IPSET_MAXNAMELEN);
680         set->family = family;
681         set->revision = revision;
682 
683         /*
684          * Next, check that we know the type, and take
685          * a reference on the type, to make sure it stays available
686          * while constructing our new set.
687          *
688          * After referencing the type, we try to create the type
689          * specific part of the set without holding any locks.
690          */
691         ret = find_set_type_get(typename, family, revision, &(set->type));
692         if (ret)
693                 goto out;
694 
695         /*
696          * Without holding any locks, create private part.
697          */
698         if (attr[IPSET_ATTR_DATA] &&
699             nla_parse_nested(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA],
700                              set->type->create_policy)) {
701                 ret = -IPSET_ERR_PROTOCOL;
702                 goto put_out;
703         }
704 
705         ret = set->type->create(set, tb, flags);
706         if (ret != 0)
707                 goto put_out;
708 
709         /* BTW, ret==0 here. */
710 
711         /*
712          * Here, we have a valid, constructed set and we are protected
713          * by the nfnl mutex. Find the first free index in ip_set_list
714          * and check clashing.
715          */
716         if ((ret = find_free_id(set->name, &index, &clash)) != 0) {
717                 /* If this is the same set and requested, ignore error */
718                 if (ret == -EEXIST &&
719                     (flags & IPSET_FLAG_EXIST) &&
720                     STREQ(set->type->name, clash->type->name) &&
721                     set->type->family == clash->type->family &&
722                     set->type->revision_min == clash->type->revision_min &&
723                     set->type->revision_max == clash->type->revision_max &&
724                     set->variant->same_set(set, clash))
725                         ret = 0;
726                 goto cleanup;
727         }
728 
729         /*
730          * Finally! Add our shiny new set to the list, and be done.
731          */
732         pr_debug("create: '%s' created with index %u!\n", set->name, index);
733         ip_set_list[index] = set;
734 
735         return ret;
736 
737 cleanup:
738         set->variant->destroy(set);
739 put_out:
740         module_put(set->type->me);
741 out:
742         kfree(set);
743         return ret;
744 }
745 
746 /* Destroy sets */
747 
748 static const struct nla_policy
749 ip_set_setname_policy[IPSET_ATTR_CMD_MAX + 1] = {
750         [IPSET_ATTR_PROTOCOL]   = { .type = NLA_U8 },
751         [IPSET_ATTR_SETNAME]    = { .type = NLA_NUL_STRING,
752                                     .len = IPSET_MAXNAMELEN - 1 },
753 };
754 
755 static void
756 ip_set_destroy_set(ip_set_id_t index)
757 {
758         struct ip_set *set = ip_set_list[index];
759 
760         pr_debug("set: %s\n",  set->name);
761         ip_set_list[index] = NULL;
762 
763         /* Must call it without holding any lock */
764         set->variant->destroy(set);
765         module_put(set->type->me);
766         kfree(set);
767 }
768 
769 static int
770 ip_set_destroy(struct sock *ctnl, struct sk_buff *skb,
771                const struct nlmsghdr *nlh,
772                const struct nlattr * const attr[])
773 {
774         ip_set_id_t i;
775         int ret = 0;
776 
777         if (unlikely(protocol_failed(attr)))
778                 return -IPSET_ERR_PROTOCOL;
779 
780         /* Commands are serialized and references are
781          * protected by the ip_set_ref_lock.
782          * External systems (i.e. xt_set) must call
783          * ip_set_put|get_nfnl_* functions, that way we
784          * can safely check references here.
785          *
786          * list:set timer can only decrement the reference
787          * counter, so if it's already zero, we can proceed
788          * without holding the lock.
789          */
790         read_lock_bh(&ip_set_ref_lock);
791         if (!attr[IPSET_ATTR_SETNAME]) {
792                 for (i = 0; i < ip_set_max; i++) {
793                         if (ip_set_list[i] != NULL && ip_set_list[i]->ref) {
794                                 ret = -IPSET_ERR_BUSY;
795                                 goto out;
796                         }
797                 }
798                 read_unlock_bh(&ip_set_ref_lock);
799                 for (i = 0; i < ip_set_max; i++) {
800                         if (ip_set_list[i] != NULL)
801                                 ip_set_destroy_set(i);
802                 }
803         } else {
804                 i = find_set_id(nla_data(attr[IPSET_ATTR_SETNAME]));
805                 if (i == IPSET_INVALID_ID) {
806                         ret = -ENOENT;
807                         goto out;
808                 } else if (ip_set_list[i]->ref) {
809                         ret = -IPSET_ERR_BUSY;
810                         goto out;
811                 }
812                 read_unlock_bh(&ip_set_ref_lock);
813 
814                 ip_set_destroy_set(i);
815         }
816         return 0;
817 out:
818         read_unlock_bh(&ip_set_ref_lock);
819         return ret;
820 }
821 
822 /* Flush sets */
823 
824 static void
825 ip_set_flush_set(struct ip_set *set)
826 {
827         pr_debug("set: %s\n",  set->name);
828 
829         write_lock_bh(&set->lock);
830         set->variant->flush(set);
831         write_unlock_bh(&set->lock);
832 }
833 
834 static int
835 ip_set_flush(struct sock *ctnl, struct sk_buff *skb,
836              const struct nlmsghdr *nlh,
837              const struct nlattr * const attr[])
838 {
839         ip_set_id_t i;
840 
841         if (unlikely(protocol_failed(attr)))
842                 return -IPSET_ERR_PROTOCOL;
843 
844         if (!attr[IPSET_ATTR_SETNAME]) {
845                 for (i = 0; i < ip_set_max; i++)
846                         if (ip_set_list[i] != NULL)
847                                 ip_set_flush_set(ip_set_list[i]);
848         } else {
849                 i = find_set_id(nla_data(attr[IPSET_ATTR_SETNAME]));
850                 if (i == IPSET_INVALID_ID)
851                         return -ENOENT;
852 
853                 ip_set_flush_set(ip_set_list[i]);
854         }
855 
856         return 0;
857 }
858 
859 /* Rename a set */
860 
861 static const struct nla_policy
862 ip_set_setname2_policy[IPSET_ATTR_CMD_MAX + 1] = {
863         [IPSET_ATTR_PROTOCOL]   = { .type = NLA_U8 },
864         [IPSET_ATTR_SETNAME]    = { .type = NLA_NUL_STRING,
865                                     .len = IPSET_MAXNAMELEN - 1 },
866         [IPSET_ATTR_SETNAME2]   = { .type = NLA_NUL_STRING,
867                                     .len = IPSET_MAXNAMELEN - 1 },
868 };
869 
870 static int
871 ip_set_rename(struct sock *ctnl, struct sk_buff *skb,
872               const struct nlmsghdr *nlh,
873               const struct nlattr * const attr[])
874 {
875         struct ip_set *set;
876         const char *name2;
877         ip_set_id_t i;
878         int ret = 0;
879 
880         if (unlikely(protocol_failed(attr) ||
881                      attr[IPSET_ATTR_SETNAME] == NULL ||
882                      attr[IPSET_ATTR_SETNAME2] == NULL))
883                 return -IPSET_ERR_PROTOCOL;
884 
885         set = find_set(nla_data(attr[IPSET_ATTR_SETNAME]));
886         if (set == NULL)
887                 return -ENOENT;
888 
889         read_lock_bh(&ip_set_ref_lock);
890         if (set->ref != 0) {
891                 ret = -IPSET_ERR_REFERENCED;
892                 goto out;
893         }
894 
895         name2 = nla_data(attr[IPSET_ATTR_SETNAME2]);
896         for (i = 0; i < ip_set_max; i++) {
897                 if (ip_set_list[i] != NULL &&
898                     STREQ(ip_set_list[i]->name, name2)) {
899                         ret = -IPSET_ERR_EXIST_SETNAME2;
900                         goto out;
901                 }
902         }
903         strncpy(set->name, name2, IPSET_MAXNAMELEN);
904 
905 out:
906         read_unlock_bh(&ip_set_ref_lock);
907         return ret;
908 }
909 
910 /* Swap two sets so that name/index points to the other.
911  * References and set names are also swapped.
912  *
913  * The commands are serialized by the nfnl mutex and references are
914  * protected by the ip_set_ref_lock. The kernel interfaces
915  * do not hold the mutex but the pointer settings are atomic
916  * so the ip_set_list always contains valid pointers to the sets.
917  */
918 
919 static int
920 ip_set_swap(struct sock *ctnl, struct sk_buff *skb,
921             const struct nlmsghdr *nlh,
922             const struct nlattr * const attr[])
923 {
924         struct ip_set *from, *to;
925         ip_set_id_t from_id, to_id;
926         char from_name[IPSET_MAXNAMELEN];
927 
928         if (unlikely(protocol_failed(attr) ||
929                      attr[IPSET_ATTR_SETNAME] == NULL ||
930                      attr[IPSET_ATTR_SETNAME2] == NULL))
931                 return -IPSET_ERR_PROTOCOL;
932 
933         from_id = find_set_id(nla_data(attr[IPSET_ATTR_SETNAME]));
934         if (from_id == IPSET_INVALID_ID)
935                 return -ENOENT;
936 
937         to_id = find_set_id(nla_data(attr[IPSET_ATTR_SETNAME2]));
938         if (to_id == IPSET_INVALID_ID)
939                 return -IPSET_ERR_EXIST_SETNAME2;
940 
941         from = ip_set_list[from_id];
942         to = ip_set_list[to_id];
943 
944         /* Features must not change.
945          * Not an artificial restriction anymore, as we must prevent
946          * possible loops created by swapping in setlist type of sets. */
947         if (!(from->type->features == to->type->features &&
948               from->type->family == to->type->family))
949                 return -IPSET_ERR_TYPE_MISMATCH;
950 
951         strncpy(from_name, from->name, IPSET_MAXNAMELEN);
952         strncpy(from->name, to->name, IPSET_MAXNAMELEN);
953         strncpy(to->name, from_name, IPSET_MAXNAMELEN);
954 
955         write_lock_bh(&ip_set_ref_lock);
956         swap(from->ref, to->ref);
957         ip_set_list[from_id] = to;
958         ip_set_list[to_id] = from;
959         write_unlock_bh(&ip_set_ref_lock);
960 
961         return 0;
962 }
963 
964 /* List/save set data */
965 
966 #define DUMP_INIT       0
967 #define DUMP_ALL        1
968 #define DUMP_ONE        2
969 #define DUMP_LAST       3
970 
971 #define DUMP_TYPE(arg)          (((u32)(arg)) & 0x0000FFFF)
972 #define DUMP_FLAGS(arg)         (((u32)(arg)) >> 16)
973 
974 static int
975 ip_set_dump_done(struct netlink_callback *cb)
976 {
977         if (cb->args[2]) {
978                 pr_debug("release set %s\n", ip_set_list[cb->args[1]]->name);
979                 ip_set_put_byindex((ip_set_id_t) cb->args[1]);
980         }
981         return 0;
982 }
983 
984 static inline void
985 dump_attrs(struct nlmsghdr *nlh)
986 {
987         const struct nlattr *attr;
988         int rem;
989 
990         pr_debug("dump nlmsg\n");
991         nlmsg_for_each_attr(attr, nlh, sizeof(struct nfgenmsg), rem) {
992                 pr_debug("type: %u, len %u\n", nla_type(attr), attr->nla_len);
993         }
994 }
995 
996 static int
997 dump_init(struct netlink_callback *cb)
998 {
999         struct nlmsghdr *nlh = nlmsg_hdr(cb->skb);
1000         int min_len = NLMSG_SPACE(sizeof(struct nfgenmsg));
1001         struct nlattr *cda[IPSET_ATTR_CMD_MAX+1];
1002         struct nlattr *attr = (void *)nlh + min_len;
1003         u32 dump_type;
1004         ip_set_id_t index;
1005 
1006         /* Second pass, so parser can't fail */
1007         nla_parse(cda, IPSET_ATTR_CMD_MAX,
1008                   attr, nlh->nlmsg_len - min_len, ip_set_setname_policy);
1009 
1010         /* cb->args[0] : dump single set/all sets
1011          *         [1] : set index
1012          *         [..]: type specific
1013          */
1014 
1015         if (cda[IPSET_ATTR_SETNAME]) {
1016                 index = find_set_id(nla_data(cda[IPSET_ATTR_SETNAME]));
1017                 if (index == IPSET_INVALID_ID)
1018                         return -ENOENT;
1019 
1020                 dump_type = DUMP_ONE;
1021                 cb->args[1] = index;
1022         } else
1023                 dump_type = DUMP_ALL;
1024 
1025         if (cda[IPSET_ATTR_FLAGS]) {
1026                 u32 f = ip_set_get_h32(cda[IPSET_ATTR_FLAGS]);
1027                 dump_type |= (f << 16);
1028         }
1029         cb->args[0] = dump_type;
1030 
1031         return 0;
1032 }
1033 
1034 static int
1035 ip_set_dump_start(struct sk_buff *skb, struct netlink_callback *cb)
1036 {
1037         ip_set_id_t index = IPSET_INVALID_ID, max;
1038         struct ip_set *set = NULL;
1039         struct nlmsghdr *nlh = NULL;
1040         unsigned int flags = NETLINK_CB(cb->skb).pid ? NLM_F_MULTI : 0;
1041         u32 dump_type, dump_flags;
1042         int ret = 0;
1043 
1044         if (!cb->args[0]) {
1045                 ret = dump_init(cb);
1046                 if (ret < 0) {
1047                         nlh = nlmsg_hdr(cb->skb);
1048                         /* We have to create and send the error message
1049                          * manually :-( */
1050                         if (nlh->nlmsg_flags & NLM_F_ACK)
1051                                 netlink_ack(cb->skb, nlh, ret);
1052                         return ret;
1053                 }
1054         }
1055 
1056         if (cb->args[1] >= ip_set_max)
1057                 goto out;
1058 
1059         dump_type = DUMP_TYPE(cb->args[0]);
1060         dump_flags = DUMP_FLAGS(cb->args[0]);
1061         max = dump_type == DUMP_ONE ? cb->args[1] + 1 : ip_set_max;
1062 dump_last:
1063         pr_debug("args[0]: %u %u args[1]: %ld\n",
1064                  dump_type, dump_flags, cb->args[1]);
1065         for (; cb->args[1] < max; cb->args[1]++) {
1066                 index = (ip_set_id_t) cb->args[1];
1067                 set = ip_set_list[index];
1068                 if (set == NULL) {
1069                         if (dump_type == DUMP_ONE) {
1070                                 ret = -ENOENT;
1071                                 goto out;
1072                         }
1073                         continue;
1074                 }
1075                 /* When dumping all sets, we must dump "sorted"
1076                  * so that lists (unions of sets) are dumped last.
1077                  */
1078                 if (dump_type != DUMP_ONE &&
1079                     ((dump_type == DUMP_ALL) ==
1080                      !!(set->type->features & IPSET_DUMP_LAST)))
1081                         continue;
1082                 pr_debug("List set: %s\n", set->name);
1083                 if (!cb->args[2]) {
1084                         /* Start listing: make sure set won't be destroyed */
1085                         pr_debug("reference set\n");
1086                         __ip_set_get(index);
1087                 }
1088                 nlh = start_msg(skb, NETLINK_CB(cb->skb).pid,
1089                                 cb->nlh->nlmsg_seq, flags,
1090                                 IPSET_CMD_LIST);
1091                 if (!nlh) {
1092                         ret = -EMSGSIZE;
1093                         goto release_refcount;
1094                 }
1095                 NLA_PUT_U8(skb, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL);
1096                 NLA_PUT_STRING(skb, IPSET_ATTR_SETNAME, set->name);
1097                 if (dump_flags & IPSET_FLAG_LIST_SETNAME)
1098                         goto next_set;
1099                 switch (cb->args[2]) {
1100                 case 0:
1101                         /* Core header data */
1102                         NLA_PUT_STRING(skb, IPSET_ATTR_TYPENAME,
1103                                        set->type->name);
1104                         NLA_PUT_U8(skb, IPSET_ATTR_FAMILY,
1105                                    set->family);
1106                         NLA_PUT_U8(skb, IPSET_ATTR_REVISION,
1107                                    set->revision);
1108                         ret = set->variant->head(set, skb);
1109                         if (ret < 0)
1110                                 goto release_refcount;
1111                         if (dump_flags & IPSET_FLAG_LIST_HEADER)
1112                                 goto next_set;
1113                         /* Fall through and add elements */
1114                 default:
1115                         read_lock_bh(&set->lock);
1116                         ret = set->variant->list(set, skb, cb);
1117                         read_unlock_bh(&set->lock);
1118                         if (!cb->args[2])
1119                                 /* Set is done, proceed with next one */
1120                                 goto next_set;
1121                         goto release_refcount;
1122                 }
1123         }
1124         /* If we dump all sets, continue with dumping last ones */
1125         if (dump_type == DUMP_ALL) {
1126                 dump_type = DUMP_LAST;
1127                 cb->args[0] = dump_type | (dump_flags << 16);
1128                 cb->args[1] = 0;
1129                 goto dump_last;
1130         }
1131         goto out;
1132 
1133 nla_put_failure:
1134         ret = -EFAULT;
1135 next_set:
1136         if (dump_type == DUMP_ONE)
1137                 cb->args[1] = IPSET_INVALID_ID;
1138         else
1139                 cb->args[1]++;
1140 release_refcount:
1141         /* If there was an error or set is done, release set */
1142         if (ret || !cb->args[2]) {
1143                 pr_debug("release set %s\n", ip_set_list[index]->name);
1144                 ip_set_put_byindex(index);
1145                 cb->args[2] = 0;
1146         }
1147 out:
1148         if (nlh) {
1149                 nlmsg_end(skb, nlh);
1150                 pr_debug("nlmsg_len: %u\n", nlh->nlmsg_len);
1151                 dump_attrs(nlh);
1152         }
1153 
1154         return ret < 0 ? ret : skb->len;
1155 }
1156 
1157 static int
1158 ip_set_dump(struct sock *ctnl, struct sk_buff *skb,
1159             const struct nlmsghdr *nlh,
1160             const struct nlattr * const attr[])
1161 {
1162         if (unlikely(protocol_failed(attr)))
1163                 return -IPSET_ERR_PROTOCOL;
1164 
1165         {
1166                 struct netlink_dump_control c = {
1167                         .dump = ip_set_dump_start,
1168                         .done = ip_set_dump_done,
1169                 };
1170                 return netlink_dump_start(ctnl, skb, nlh, &c);
1171         }
1172 }
1173 
1174 /* Add, del and test */
1175 
1176 static const struct nla_policy ip_set_adt_policy[IPSET_ATTR_CMD_MAX + 1] = {
1177         [IPSET_ATTR_PROTOCOL]   = { .type = NLA_U8 },
1178         [IPSET_ATTR_SETNAME]    = { .type = NLA_NUL_STRING,
1179                                     .len = IPSET_MAXNAMELEN - 1 },
1180         [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
1181         [IPSET_ATTR_DATA]       = { .type = NLA_NESTED },
1182         [IPSET_ATTR_ADT]        = { .type = NLA_NESTED },
1183 };
1184 
1185 static int
1186 call_ad(struct sock *ctnl, struct sk_buff *skb, struct ip_set *set,
1187         struct nlattr *tb[], enum ipset_adt adt,
1188         u32 flags, bool use_lineno)
1189 {
1190         int ret;
1191         u32 lineno = 0;
1192         bool eexist = flags & IPSET_FLAG_EXIST, retried = false;
1193 
1194         do {
1195                 write_lock_bh(&set->lock);
1196                 ret = set->variant->uadt(set, tb, adt, &lineno, flags, retried);
1197                 write_unlock_bh(&set->lock);
1198                 retried = true;
1199         } while (ret == -EAGAIN &&
1200                  set->variant->resize &&
1201                  (ret = set->variant->resize(set, retried)) == 0);
1202 
1203         if (!ret || (ret == -IPSET_ERR_EXIST && eexist))
1204                 return 0;
1205         if (lineno && use_lineno) {
1206                 /* Error in restore/batch mode: send back lineno */
1207                 struct nlmsghdr *rep, *nlh = nlmsg_hdr(skb);
1208                 struct sk_buff *skb2;
1209                 struct nlmsgerr *errmsg;
1210                 size_t payload = sizeof(*errmsg) + nlmsg_len(nlh);
1211                 int min_len = NLMSG_SPACE(sizeof(struct nfgenmsg));
1212                 struct nlattr *cda[IPSET_ATTR_CMD_MAX+1];
1213                 struct nlattr *cmdattr;
1214                 u32 *errline;
1215 
1216                 skb2 = nlmsg_new(payload, GFP_KERNEL);
1217                 if (skb2 == NULL)
1218                         return -ENOMEM;
1219                 rep = __nlmsg_put(skb2, NETLINK_CB(skb).pid,
1220                                   nlh->nlmsg_seq, NLMSG_ERROR, payload, 0);
1221                 errmsg = nlmsg_data(rep);
1222                 errmsg->error = ret;
1223                 memcpy(&errmsg->msg, nlh, nlh->nlmsg_len);
1224                 cmdattr = (void *)&errmsg->msg + min_len;
1225 
1226                 nla_parse(cda, IPSET_ATTR_CMD_MAX,
1227                           cmdattr, nlh->nlmsg_len - min_len,
1228                           ip_set_adt_policy);
1229 
1230                 errline = nla_data(cda[IPSET_ATTR_LINENO]);
1231 
1232                 *errline = lineno;
1233 
1234                 netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1235                 /* Signal netlink not to send its ACK/errmsg.  */
1236                 return -EINTR;
1237         }
1238 
1239         return ret;
1240 }
1241 
1242 static int
1243 ip_set_uadd(struct sock *ctnl, struct sk_buff *skb,
1244             const struct nlmsghdr *nlh,
1245             const struct nlattr * const attr[])
1246 {
1247         struct ip_set *set;
1248         struct nlattr *tb[IPSET_ATTR_ADT_MAX+1] = {};
1249         const struct nlattr *nla;
1250         u32 flags = flag_exist(nlh);
1251         bool use_lineno;
1252         int ret = 0;
1253 
1254         if (unlikely(protocol_failed(attr) ||
1255                      attr[IPSET_ATTR_SETNAME] == NULL ||
1256                      !((attr[IPSET_ATTR_DATA] != NULL) ^
1257                        (attr[IPSET_ATTR_ADT] != NULL)) ||
1258                      (attr[IPSET_ATTR_DATA] != NULL &&
1259                       !flag_nested(attr[IPSET_ATTR_DATA])) ||
1260                      (attr[IPSET_ATTR_ADT] != NULL &&
1261                       (!flag_nested(attr[IPSET_ATTR_ADT]) ||
1262                        attr[IPSET_ATTR_LINENO] == NULL))))
1263                 return -IPSET_ERR_PROTOCOL;
1264 
1265         set = find_set(nla_data(attr[IPSET_ATTR_SETNAME]));
1266         if (set == NULL)
1267                 return -ENOENT;
1268 
1269         use_lineno = !!attr[IPSET_ATTR_LINENO];
1270         if (attr[IPSET_ATTR_DATA]) {
1271                 if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX,
1272                                      attr[IPSET_ATTR_DATA],
1273                                      set->type->adt_policy))
1274                         return -IPSET_ERR_PROTOCOL;
1275                 ret = call_ad(ctnl, skb, set, tb, IPSET_ADD, flags,
1276                               use_lineno);
1277         } else {
1278                 int nla_rem;
1279 
1280                 nla_for_each_nested(nla, attr[IPSET_ATTR_ADT], nla_rem) {
1281                         memset(tb, 0, sizeof(tb));
1282                         if (nla_type(nla) != IPSET_ATTR_DATA ||
1283                             !flag_nested(nla) ||
1284                             nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, nla,
1285                                              set->type->adt_policy))
1286                                 return -IPSET_ERR_PROTOCOL;
1287                         ret = call_ad(ctnl, skb, set, tb, IPSET_ADD,
1288                                       flags, use_lineno);
1289                         if (ret < 0)
1290                                 return ret;
1291                 }
1292         }
1293         return ret;
1294 }
1295 
1296 static int
1297 ip_set_udel(struct sock *ctnl, struct sk_buff *skb,
1298             const struct nlmsghdr *nlh,
1299             const struct nlattr * const attr[])
1300 {
1301         struct ip_set *set;
1302         struct nlattr *tb[IPSET_ATTR_ADT_MAX+1] = {};
1303         const struct nlattr *nla;
1304         u32 flags = flag_exist(nlh);
1305         bool use_lineno;
1306         int ret = 0;
1307 
1308         if (unlikely(protocol_failed(attr) ||
1309                      attr[IPSET_ATTR_SETNAME] == NULL ||
1310                      !((attr[IPSET_ATTR_DATA] != NULL) ^
1311                        (attr[IPSET_ATTR_ADT] != NULL)) ||
1312                      (attr[IPSET_ATTR_DATA] != NULL &&
1313                       !flag_nested(attr[IPSET_ATTR_DATA])) ||
1314                      (attr[IPSET_ATTR_ADT] != NULL &&
1315                       (!flag_nested(attr[IPSET_ATTR_ADT]) ||
1316                        attr[IPSET_ATTR_LINENO] == NULL))))
1317                 return -IPSET_ERR_PROTOCOL;
1318 
1319         set = find_set(nla_data(attr[IPSET_ATTR_SETNAME]));
1320         if (set == NULL)
1321                 return -ENOENT;
1322 
1323         use_lineno = !!attr[IPSET_ATTR_LINENO];
1324         if (attr[IPSET_ATTR_DATA]) {
1325                 if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX,
1326                                      attr[IPSET_ATTR_DATA],
1327                                      set->type->adt_policy))
1328                         return -IPSET_ERR_PROTOCOL;
1329                 ret = call_ad(ctnl, skb, set, tb, IPSET_DEL, flags,
1330                               use_lineno);
1331         } else {
1332                 int nla_rem;
1333 
1334                 nla_for_each_nested(nla, attr[IPSET_ATTR_ADT], nla_rem) {
1335                         memset(tb, 0, sizeof(*tb));
1336                         if (nla_type(nla) != IPSET_ATTR_DATA ||
1337                             !flag_nested(nla) ||
1338                             nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, nla,
1339                                              set->type->adt_policy))
1340                                 return -IPSET_ERR_PROTOCOL;
1341                         ret = call_ad(ctnl, skb, set, tb, IPSET_DEL,
1342                                       flags, use_lineno);
1343                         if (ret < 0)
1344                                 return ret;
1345                 }
1346         }
1347         return ret;
1348 }
1349 
1350 static int
1351 ip_set_utest(struct sock *ctnl, struct sk_buff *skb,
1352              const struct nlmsghdr *nlh,
1353              const struct nlattr * const attr[])
1354 {
1355         struct ip_set *set;
1356         struct nlattr *tb[IPSET_ATTR_ADT_MAX+1] = {};
1357         int ret = 0;
1358 
1359         if (unlikely(protocol_failed(attr) ||
1360                      attr[IPSET_ATTR_SETNAME] == NULL ||
1361                      attr[IPSET_ATTR_DATA] == NULL ||
1362                      !flag_nested(attr[IPSET_ATTR_DATA])))
1363                 return -IPSET_ERR_PROTOCOL;
1364 
1365         set = find_set(nla_data(attr[IPSET_ATTR_SETNAME]));
1366         if (set == NULL)
1367                 return -ENOENT;
1368 
1369         if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA],
1370                              set->type->adt_policy))
1371                 return -IPSET_ERR_PROTOCOL;
1372 
1373         read_lock_bh(&set->lock);
1374         ret = set->variant->uadt(set, tb, IPSET_TEST, NULL, 0, 0);
1375         read_unlock_bh(&set->lock);
1376         /* Userspace can't trigger element to be re-added */
1377         if (ret == -EAGAIN)
1378                 ret = 1;
1379 
1380         return ret < 0 ? ret : ret > 0 ? 0 : -IPSET_ERR_EXIST;
1381 }
1382 
1383 /* Get headed data of a set */
1384 
1385 static int
1386 ip_set_header(struct sock *ctnl, struct sk_buff *skb,
1387               const struct nlmsghdr *nlh,
1388               const struct nlattr * const attr[])
1389 {
1390         const struct ip_set *set;
1391         struct sk_buff *skb2;
1392         struct nlmsghdr *nlh2;
1393         ip_set_id_t index;
1394         int ret = 0;
1395 
1396         if (unlikely(protocol_failed(attr) ||
1397                      attr[IPSET_ATTR_SETNAME] == NULL))
1398                 return -IPSET_ERR_PROTOCOL;
1399 
1400         index = find_set_id(nla_data(attr[IPSET_ATTR_SETNAME]));
1401         if (index == IPSET_INVALID_ID)
1402                 return -ENOENT;
1403         set = ip_set_list[index];
1404 
1405         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1406         if (skb2 == NULL)
1407                 return -ENOMEM;
1408 
1409         nlh2 = start_msg(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq, 0,
1410                          IPSET_CMD_HEADER);
1411         if (!nlh2)
1412                 goto nlmsg_failure;
1413         NLA_PUT_U8(skb2, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL);
1414         NLA_PUT_STRING(skb2, IPSET_ATTR_SETNAME, set->name);
1415         NLA_PUT_STRING(skb2, IPSET_ATTR_TYPENAME, set->type->name);
1416         NLA_PUT_U8(skb2, IPSET_ATTR_FAMILY, set->family);
1417         NLA_PUT_U8(skb2, IPSET_ATTR_REVISION, set->revision);
1418         nlmsg_end(skb2, nlh2);
1419 
1420         ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1421         if (ret < 0)
1422                 return ret;
1423 
1424         return 0;
1425 
1426 nla_put_failure:
1427         nlmsg_cancel(skb2, nlh2);
1428 nlmsg_failure:
1429         kfree_skb(skb2);
1430         return -EMSGSIZE;
1431 }
1432 
1433 /* Get type data */
1434 
1435 static const struct nla_policy ip_set_type_policy[IPSET_ATTR_CMD_MAX + 1] = {
1436         [IPSET_ATTR_PROTOCOL]   = { .type = NLA_U8 },
1437         [IPSET_ATTR_TYPENAME]   = { .type = NLA_NUL_STRING,
1438                                     .len = IPSET_MAXNAMELEN - 1 },
1439         [IPSET_ATTR_FAMILY]     = { .type = NLA_U8 },
1440 };
1441 
1442 static int
1443 ip_set_type(struct sock *ctnl, struct sk_buff *skb,
1444             const struct nlmsghdr *nlh,
1445             const struct nlattr * const attr[])
1446 {
1447         struct sk_buff *skb2;
1448         struct nlmsghdr *nlh2;
1449         u8 family, min, max;
1450         const char *typename;
1451         int ret = 0;
1452 
1453         if (unlikely(protocol_failed(attr) ||
1454                      attr[IPSET_ATTR_TYPENAME] == NULL ||
1455                      attr[IPSET_ATTR_FAMILY] == NULL))
1456                 return -IPSET_ERR_PROTOCOL;
1457 
1458         family = nla_get_u8(attr[IPSET_ATTR_FAMILY]);
1459         typename = nla_data(attr[IPSET_ATTR_TYPENAME]);
1460         ret = find_set_type_minmax(typename, family, &min, &max);
1461         if (ret)
1462                 return ret;
1463 
1464         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1465         if (skb2 == NULL)
1466                 return -ENOMEM;
1467 
1468         nlh2 = start_msg(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq, 0,
1469                          IPSET_CMD_TYPE);
1470         if (!nlh2)
1471                 goto nlmsg_failure;
1472         NLA_PUT_U8(skb2, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL);
1473         NLA_PUT_STRING(skb2, IPSET_ATTR_TYPENAME, typename);
1474         NLA_PUT_U8(skb2, IPSET_ATTR_FAMILY, family);
1475         NLA_PUT_U8(skb2, IPSET_ATTR_REVISION, max);
1476         NLA_PUT_U8(skb2, IPSET_ATTR_REVISION_MIN, min);
1477         nlmsg_end(skb2, nlh2);
1478 
1479         pr_debug("Send TYPE, nlmsg_len: %u\n", nlh2->nlmsg_len);
1480         ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1481         if (ret < 0)
1482                 return ret;
1483 
1484         return 0;
1485 
1486 nla_put_failure:
1487         nlmsg_cancel(skb2, nlh2);
1488 nlmsg_failure:
1489         kfree_skb(skb2);
1490         return -EMSGSIZE;
1491 }
1492 
1493 /* Get protocol version */
1494 
1495 static const struct nla_policy
1496 ip_set_protocol_policy[IPSET_ATTR_CMD_MAX + 1] = {
1497         [IPSET_ATTR_PROTOCOL]   = { .type = NLA_U8 },
1498 };
1499 
1500 static int
1501 ip_set_protocol(struct sock *ctnl, struct sk_buff *skb,
1502                 const struct nlmsghdr *nlh,
1503                 const struct nlattr * const attr[])
1504 {
1505         struct sk_buff *skb2;
1506         struct nlmsghdr *nlh2;
1507         int ret = 0;
1508 
1509         if (unlikely(attr[IPSET_ATTR_PROTOCOL] == NULL))
1510                 return -IPSET_ERR_PROTOCOL;
1511 
1512         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1513         if (skb2 == NULL)
1514                 return -ENOMEM;
1515 
1516         nlh2 = start_msg(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq, 0,
1517                          IPSET_CMD_PROTOCOL);
1518         if (!nlh2)
1519                 goto nlmsg_failure;
1520         NLA_PUT_U8(skb2, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL);
1521         nlmsg_end(skb2, nlh2);
1522 
1523         ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1524         if (ret < 0)
1525                 return ret;
1526 
1527         return 0;
1528 
1529 nla_put_failure:
1530         nlmsg_cancel(skb2, nlh2);
1531 nlmsg_failure:
1532         kfree_skb(skb2);
1533         return -EMSGSIZE;
1534 }
1535 
1536 static const struct nfnl_callback ip_set_netlink_subsys_cb[IPSET_MSG_MAX] = {
1537         [IPSET_CMD_CREATE]      = {
1538                 .call           = ip_set_create,
1539                 .attr_count     = IPSET_ATTR_CMD_MAX,
1540                 .policy         = ip_set_create_policy,
1541         },
1542         [IPSET_CMD_DESTROY]     = {
1543                 .call           = ip_set_destroy,
1544                 .attr_count     = IPSET_ATTR_CMD_MAX,
1545                 .policy         = ip_set_setname_policy,
1546         },
1547         [IPSET_CMD_FLUSH]       = {
1548                 .call           = ip_set_flush,
1549                 .attr_count     = IPSET_ATTR_CMD_MAX,
1550                 .policy         = ip_set_setname_policy,
1551         },
1552         [IPSET_CMD_RENAME]      = {
1553                 .call           = ip_set_rename,
1554                 .attr_count     = IPSET_ATTR_CMD_MAX,
1555                 .policy         = ip_set_setname2_policy,
1556         },
1557         [IPSET_CMD_SWAP]        = {
1558                 .call           = ip_set_swap,
1559                 .attr_count     = IPSET_ATTR_CMD_MAX,
1560                 .policy         = ip_set_setname2_policy,
1561         },
1562         [IPSET_CMD_LIST]        = {
1563                 .call           = ip_set_dump,
1564                 .attr_count     = IPSET_ATTR_CMD_MAX,
1565                 .policy         = ip_set_setname_policy,
1566         },
1567         [IPSET_CMD_SAVE]        = {
1568                 .call           = ip_set_dump,
1569                 .attr_count     = IPSET_ATTR_CMD_MAX,
1570                 .policy         = ip_set_setname_policy,
1571         },
1572         [IPSET_CMD_ADD] = {
1573                 .call           = ip_set_uadd,
1574                 .attr_count     = IPSET_ATTR_CMD_MAX,
1575                 .policy         = ip_set_adt_policy,
1576         },
1577         [IPSET_CMD_DEL] = {
1578                 .call           = ip_set_udel,
1579                 .attr_count     = IPSET_ATTR_CMD_MAX,
1580                 .policy         = ip_set_adt_policy,
1581         },
1582         [IPSET_CMD_TEST]        = {
1583                 .call           = ip_set_utest,
1584                 .attr_count     = IPSET_ATTR_CMD_MAX,
1585                 .policy         = ip_set_adt_policy,
1586         },
1587         [IPSET_CMD_HEADER]      = {
1588                 .call           = ip_set_header,
1589                 .attr_count     = IPSET_ATTR_CMD_MAX,
1590                 .policy         = ip_set_setname_policy,
1591         },
1592         [IPSET_CMD_TYPE]        = {
1593                 .call           = ip_set_type,
1594                 .attr_count     = IPSET_ATTR_CMD_MAX,
1595                 .policy         = ip_set_type_policy,
1596         },
1597         [IPSET_CMD_PROTOCOL]    = {
1598                 .call           = ip_set_protocol,
1599                 .attr_count     = IPSET_ATTR_CMD_MAX,
1600                 .policy         = ip_set_protocol_policy,
1601         },
1602 };
1603 
1604 static struct nfnetlink_subsystem ip_set_netlink_subsys __read_mostly = {
1605         .name           = "ip_set",
1606         .subsys_id      = NFNL_SUBSYS_IPSET,
1607         .cb_count       = IPSET_MSG_MAX,
1608         .cb             = ip_set_netlink_subsys_cb,
1609 };
1610 
1611 /* Interface to iptables/ip6tables */
1612 
1613 static int
1614 ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
1615 {
1616         unsigned *op;
1617         void *data;
1618         int copylen = *len, ret = 0;
1619 
1620         if (!capable(CAP_NET_ADMIN))
1621                 return -EPERM;
1622         if (optval != SO_IP_SET)
1623                 return -EBADF;
1624         if (*len < sizeof(unsigned))
1625                 return -EINVAL;
1626 
1627         data = vmalloc(*len);
1628         if (!data)
1629                 return -ENOMEM;
1630         if (copy_from_user(data, user, *len) != 0) {
1631                 ret = -EFAULT;
1632                 goto done;
1633         }
1634         op = (unsigned *) data;
1635 
1636         if (*op < IP_SET_OP_VERSION) {
1637                 /* Check the version at the beginning of operations */
1638                 struct ip_set_req_version *req_version = data;
1639                 if (req_version->version != IPSET_PROTOCOL) {
1640                         ret = -EPROTO;
1641                         goto done;
1642                 }
1643         }
1644 
1645         switch (*op) {
1646         case IP_SET_OP_VERSION: {
1647                 struct ip_set_req_version *req_version = data;
1648 
1649                 if (*len != sizeof(struct ip_set_req_version)) {
1650                         ret = -EINVAL;
1651                         goto done;
1652                 }
1653 
1654                 req_version->version = IPSET_PROTOCOL;
1655                 ret = copy_to_user(user, req_version,
1656                                    sizeof(struct ip_set_req_version));
1657                 goto done;
1658         }
1659         case IP_SET_OP_GET_BYNAME: {
1660                 struct ip_set_req_get_set *req_get = data;
1661 
1662                 if (*len != sizeof(struct ip_set_req_get_set)) {
1663                         ret = -EINVAL;
1664                         goto done;
1665                 }
1666                 req_get->set.name[IPSET_MAXNAMELEN - 1] = '\0';
1667                 nfnl_lock();
1668                 req_get->set.index = find_set_id(req_get->set.name);
1669                 nfnl_unlock();
1670                 goto copy;
1671         }
1672         case IP_SET_OP_GET_BYINDEX: {
1673                 struct ip_set_req_get_set *req_get = data;
1674 
1675                 if (*len != sizeof(struct ip_set_req_get_set) ||
1676                     req_get->set.index >= ip_set_max) {
1677                         ret = -EINVAL;
1678                         goto done;
1679                 }
1680                 nfnl_lock();
1681                 strncpy(req_get->set.name,
1682                         ip_set_list[req_get->set.index]
1683                                 ? ip_set_list[req_get->set.index]->name : "",
1684                         IPSET_MAXNAMELEN);
1685                 nfnl_unlock();
1686                 goto copy;
1687         }
1688         default:
1689                 ret = -EBADMSG;
1690                 goto done;
1691         }       /* end of switch(op) */
1692 
1693 copy:
1694         ret = copy_to_user(user, data, copylen);
1695 
1696 done:
1697         vfree(data);
1698         if (ret > 0)
1699                 ret = 0;
1700         return ret;
1701 }
1702 
1703 static struct nf_sockopt_ops so_set __read_mostly = {
1704         .pf             = PF_INET,
1705         .get_optmin     = SO_IP_SET,
1706         .get_optmax     = SO_IP_SET + 1,
1707         .get            = &ip_set_sockfn_get,
1708         .owner          = THIS_MODULE,
1709 };
1710 
1711 static int __init
1712 ip_set_init(void)
1713 {
1714         int ret;
1715 
1716         if (max_sets)
1717                 ip_set_max = max_sets;
1718         if (ip_set_max >= IPSET_INVALID_ID)
1719                 ip_set_max = IPSET_INVALID_ID - 1;
1720 
1721         ip_set_list = kzalloc(sizeof(struct ip_set *) * ip_set_max,
1722                               GFP_KERNEL);
1723         if (!ip_set_list)
1724                 return -ENOMEM;
1725 
1726         ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
1727         if (ret != 0) {
1728                 pr_err("ip_set: cannot register with nfnetlink.\n");
1729                 kfree(ip_set_list);
1730                 return ret;
1731         }
1732         ret = nf_register_sockopt(&so_set);
1733         if (ret != 0) {
1734                 pr_err("SO_SET registry failed: %d\n", ret);
1735                 nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
1736                 kfree(ip_set_list);
1737                 return ret;
1738         }
1739 
1740         pr_notice("ip_set: protocol %u\n", IPSET_PROTOCOL);
1741         return 0;
1742 }
1743 
1744 static void __exit
1745 ip_set_fini(void)
1746 {
1747         /* There can't be any existing set */
1748         nf_unregister_sockopt(&so_set);
1749         nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
1750         kfree(ip_set_list);
1751         pr_debug("these are the famous last words\n");
1752 }
1753 
1754 module_init(ip_set_init);
1755 module_exit(ip_set_fini);
1756 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp