~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/ipset/ip_set_core.c

Version: ~ [ linux-5.8-rc3 ] ~ [ linux-5.7.5 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.48 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.129 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.185 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.228 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.228 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0-only
  2 /* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
  3  *                         Patrick Schaaf <bof@bof.de>
  4  * Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@netfilter.org>
  5  */
  6 
  7 /* Kernel module for IP set management */
  8 
  9 #include <linux/init.h>
 10 #include <linux/module.h>
 11 #include <linux/moduleparam.h>
 12 #include <linux/ip.h>
 13 #include <linux/skbuff.h>
 14 #include <linux/spinlock.h>
 15 #include <linux/rculist.h>
 16 #include <net/netlink.h>
 17 #include <net/net_namespace.h>
 18 #include <net/netns/generic.h>
 19 
 20 #include <linux/netfilter.h>
 21 #include <linux/netfilter/x_tables.h>
 22 #include <linux/netfilter/nfnetlink.h>
 23 #include <linux/netfilter/ipset/ip_set.h>
 24 
 25 static LIST_HEAD(ip_set_type_list);             /* all registered set types */
 26 static DEFINE_MUTEX(ip_set_type_mutex);         /* protects ip_set_type_list */
 27 static DEFINE_RWLOCK(ip_set_ref_lock);          /* protects the set refs */
 28 
 29 struct ip_set_net {
 30         struct ip_set * __rcu *ip_set_list;     /* all individual sets */
 31         ip_set_id_t     ip_set_max;     /* max number of sets */
 32         bool            is_deleted;     /* deleted by ip_set_net_exit */
 33         bool            is_destroyed;   /* all sets are destroyed */
 34 };
 35 
 36 static unsigned int ip_set_net_id __read_mostly;
 37 
 38 static inline struct ip_set_net *ip_set_pernet(struct net *net)
 39 {
 40         return net_generic(net, ip_set_net_id);
 41 }
 42 
 43 #define IP_SET_INC      64
 44 #define STRNCMP(a, b)   (strncmp(a, b, IPSET_MAXNAMELEN) == 0)
 45 
 46 static unsigned int max_sets;
 47 
 48 module_param(max_sets, int, 0600);
 49 MODULE_PARM_DESC(max_sets, "maximal number of sets");
 50 MODULE_LICENSE("GPL");
 51 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
 52 MODULE_DESCRIPTION("core IP set support");
 53 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);
 54 
 55 /* When the nfnl mutex or ip_set_ref_lock is held: */
 56 #define ip_set_dereference(p)           \
 57         rcu_dereference_protected(p,    \
 58                 lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) || \
 59                 lockdep_is_held(&ip_set_ref_lock))
 60 #define ip_set(inst, id)                \
 61         ip_set_dereference((inst)->ip_set_list)[id]
 62 #define ip_set_ref_netlink(inst,id)     \
 63         rcu_dereference_raw((inst)->ip_set_list)[id]
 64 
 65 /* The set types are implemented in modules and registered set types
 66  * can be found in ip_set_type_list. Adding/deleting types is
 67  * serialized by ip_set_type_mutex.
 68  */
 69 
 70 static inline void
 71 ip_set_type_lock(void)
 72 {
 73         mutex_lock(&ip_set_type_mutex);
 74 }
 75 
 76 static inline void
 77 ip_set_type_unlock(void)
 78 {
 79         mutex_unlock(&ip_set_type_mutex);
 80 }
 81 
 82 /* Register and deregister settype */
 83 
 84 static struct ip_set_type *
 85 find_set_type(const char *name, u8 family, u8 revision)
 86 {
 87         struct ip_set_type *type;
 88 
 89         list_for_each_entry_rcu(type, &ip_set_type_list, list)
 90                 if (STRNCMP(type->name, name) &&
 91                     (type->family == family ||
 92                      type->family == NFPROTO_UNSPEC) &&
 93                     revision >= type->revision_min &&
 94                     revision <= type->revision_max)
 95                         return type;
 96         return NULL;
 97 }
 98 
 99 /* Unlock, try to load a set type module and lock again */
100 static bool
101 load_settype(const char *name)
102 {
103         nfnl_unlock(NFNL_SUBSYS_IPSET);
104         pr_debug("try to load ip_set_%s\n", name);
105         if (request_module("ip_set_%s", name) < 0) {
106                 pr_warn("Can't find ip_set type %s\n", name);
107                 nfnl_lock(NFNL_SUBSYS_IPSET);
108                 return false;
109         }
110         nfnl_lock(NFNL_SUBSYS_IPSET);
111         return true;
112 }
113 
114 /* Find a set type and reference it */
115 #define find_set_type_get(name, family, revision, found)        \
116         __find_set_type_get(name, family, revision, found, false)
117 
118 static int
119 __find_set_type_get(const char *name, u8 family, u8 revision,
120                     struct ip_set_type **found, bool retry)
121 {
122         struct ip_set_type *type;
123         int err;
124 
125         if (retry && !load_settype(name))
126                 return -IPSET_ERR_FIND_TYPE;
127 
128         rcu_read_lock();
129         *found = find_set_type(name, family, revision);
130         if (*found) {
131                 err = !try_module_get((*found)->me) ? -EFAULT : 0;
132                 goto unlock;
133         }
134         /* Make sure the type is already loaded
135          * but we don't support the revision
136          */
137         list_for_each_entry_rcu(type, &ip_set_type_list, list)
138                 if (STRNCMP(type->name, name)) {
139                         err = -IPSET_ERR_FIND_TYPE;
140                         goto unlock;
141                 }
142         rcu_read_unlock();
143 
144         return retry ? -IPSET_ERR_FIND_TYPE :
145                 __find_set_type_get(name, family, revision, found, true);
146 
147 unlock:
148         rcu_read_unlock();
149         return err;
150 }
151 
152 /* Find a given set type by name and family.
153  * If we succeeded, the supported minimal and maximum revisions are
154  * filled out.
155  */
156 #define find_set_type_minmax(name, family, min, max) \
157         __find_set_type_minmax(name, family, min, max, false)
158 
159 static int
160 __find_set_type_minmax(const char *name, u8 family, u8 *min, u8 *max,
161                        bool retry)
162 {
163         struct ip_set_type *type;
164         bool found = false;
165 
166         if (retry && !load_settype(name))
167                 return -IPSET_ERR_FIND_TYPE;
168 
169         *min = 255; *max = 0;
170         rcu_read_lock();
171         list_for_each_entry_rcu(type, &ip_set_type_list, list)
172                 if (STRNCMP(type->name, name) &&
173                     (type->family == family ||
174                      type->family == NFPROTO_UNSPEC)) {
175                         found = true;
176                         if (type->revision_min < *min)
177                                 *min = type->revision_min;
178                         if (type->revision_max > *max)
179                                 *max = type->revision_max;
180                 }
181         rcu_read_unlock();
182         if (found)
183                 return 0;
184 
185         return retry ? -IPSET_ERR_FIND_TYPE :
186                 __find_set_type_minmax(name, family, min, max, true);
187 }
188 
189 #define family_name(f)  ((f) == NFPROTO_IPV4 ? "inet" : \
190                          (f) == NFPROTO_IPV6 ? "inet6" : "any")
191 
192 /* Register a set type structure. The type is identified by
193  * the unique triple of name, family and revision.
194  */
195 int
196 ip_set_type_register(struct ip_set_type *type)
197 {
198         int ret = 0;
199 
200         if (type->protocol != IPSET_PROTOCOL) {
201                 pr_warn("ip_set type %s, family %s, revision %u:%u uses wrong protocol version %u (want %u)\n",
202                         type->name, family_name(type->family),
203                         type->revision_min, type->revision_max,
204                         type->protocol, IPSET_PROTOCOL);
205                 return -EINVAL;
206         }
207 
208         ip_set_type_lock();
209         if (find_set_type(type->name, type->family, type->revision_min)) {
210                 /* Duplicate! */
211                 pr_warn("ip_set type %s, family %s with revision min %u already registered!\n",
212                         type->name, family_name(type->family),
213                         type->revision_min);
214                 ip_set_type_unlock();
215                 return -EINVAL;
216         }
217         list_add_rcu(&type->list, &ip_set_type_list);
218         pr_debug("type %s, family %s, revision %u:%u registered.\n",
219                  type->name, family_name(type->family),
220                  type->revision_min, type->revision_max);
221         ip_set_type_unlock();
222 
223         return ret;
224 }
225 EXPORT_SYMBOL_GPL(ip_set_type_register);
226 
227 /* Unregister a set type. There's a small race with ip_set_create */
228 void
229 ip_set_type_unregister(struct ip_set_type *type)
230 {
231         ip_set_type_lock();
232         if (!find_set_type(type->name, type->family, type->revision_min)) {
233                 pr_warn("ip_set type %s, family %s with revision min %u not registered\n",
234                         type->name, family_name(type->family),
235                         type->revision_min);
236                 ip_set_type_unlock();
237                 return;
238         }
239         list_del_rcu(&type->list);
240         pr_debug("type %s, family %s with revision min %u unregistered.\n",
241                  type->name, family_name(type->family), type->revision_min);
242         ip_set_type_unlock();
243 
244         synchronize_rcu();
245 }
246 EXPORT_SYMBOL_GPL(ip_set_type_unregister);
247 
248 /* Utility functions */
249 void *
250 ip_set_alloc(size_t size)
251 {
252         void *members = NULL;
253 
254         if (size < KMALLOC_MAX_SIZE)
255                 members = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
256 
257         if (members) {
258                 pr_debug("%p: allocated with kmalloc\n", members);
259                 return members;
260         }
261 
262         members = vzalloc(size);
263         if (!members)
264                 return NULL;
265         pr_debug("%p: allocated with vmalloc\n", members);
266 
267         return members;
268 }
269 EXPORT_SYMBOL_GPL(ip_set_alloc);
270 
271 void
272 ip_set_free(void *members)
273 {
274         pr_debug("%p: free with %s\n", members,
275                  is_vmalloc_addr(members) ? "vfree" : "kfree");
276         kvfree(members);
277 }
278 EXPORT_SYMBOL_GPL(ip_set_free);
279 
280 static inline bool
281 flag_nested(const struct nlattr *nla)
282 {
283         return nla->nla_type & NLA_F_NESTED;
284 }
285 
286 static const struct nla_policy ipaddr_policy[IPSET_ATTR_IPADDR_MAX + 1] = {
287         [IPSET_ATTR_IPADDR_IPV4]        = { .type = NLA_U32 },
288         [IPSET_ATTR_IPADDR_IPV6]        = { .type = NLA_BINARY,
289                                             .len = sizeof(struct in6_addr) },
290 };
291 
292 int
293 ip_set_get_ipaddr4(struct nlattr *nla,  __be32 *ipaddr)
294 {
295         struct nlattr *tb[IPSET_ATTR_IPADDR_MAX + 1];
296 
297         if (unlikely(!flag_nested(nla)))
298                 return -IPSET_ERR_PROTOCOL;
299         if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla,
300                              ipaddr_policy, NULL))
301                 return -IPSET_ERR_PROTOCOL;
302         if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV4)))
303                 return -IPSET_ERR_PROTOCOL;
304 
305         *ipaddr = nla_get_be32(tb[IPSET_ATTR_IPADDR_IPV4]);
306         return 0;
307 }
308 EXPORT_SYMBOL_GPL(ip_set_get_ipaddr4);
309 
310 int
311 ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr)
312 {
313         struct nlattr *tb[IPSET_ATTR_IPADDR_MAX + 1];
314 
315         if (unlikely(!flag_nested(nla)))
316                 return -IPSET_ERR_PROTOCOL;
317 
318         if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla,
319                              ipaddr_policy, NULL))
320                 return -IPSET_ERR_PROTOCOL;
321         if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV6)))
322                 return -IPSET_ERR_PROTOCOL;
323 
324         memcpy(ipaddr, nla_data(tb[IPSET_ATTR_IPADDR_IPV6]),
325                sizeof(struct in6_addr));
326         return 0;
327 }
328 EXPORT_SYMBOL_GPL(ip_set_get_ipaddr6);
329 
330 typedef void (*destroyer)(struct ip_set *, void *);
331 /* ipset data extension types, in size order */
332 
333 const struct ip_set_ext_type ip_set_extensions[] = {
334         [IPSET_EXT_ID_COUNTER] = {
335                 .type   = IPSET_EXT_COUNTER,
336                 .flag   = IPSET_FLAG_WITH_COUNTERS,
337                 .len    = sizeof(struct ip_set_counter),
338                 .align  = __alignof__(struct ip_set_counter),
339         },
340         [IPSET_EXT_ID_TIMEOUT] = {
341                 .type   = IPSET_EXT_TIMEOUT,
342                 .len    = sizeof(unsigned long),
343                 .align  = __alignof__(unsigned long),
344         },
345         [IPSET_EXT_ID_SKBINFO] = {
346                 .type   = IPSET_EXT_SKBINFO,
347                 .flag   = IPSET_FLAG_WITH_SKBINFO,
348                 .len    = sizeof(struct ip_set_skbinfo),
349                 .align  = __alignof__(struct ip_set_skbinfo),
350         },
351         [IPSET_EXT_ID_COMMENT] = {
352                 .type    = IPSET_EXT_COMMENT | IPSET_EXT_DESTROY,
353                 .flag    = IPSET_FLAG_WITH_COMMENT,
354                 .len     = sizeof(struct ip_set_comment),
355                 .align   = __alignof__(struct ip_set_comment),
356                 .destroy = (destroyer) ip_set_comment_free,
357         },
358 };
359 EXPORT_SYMBOL_GPL(ip_set_extensions);
360 
361 static inline bool
362 add_extension(enum ip_set_ext_id id, u32 flags, struct nlattr *tb[])
363 {
364         return ip_set_extensions[id].flag ?
365                 (flags & ip_set_extensions[id].flag) :
366                 !!tb[IPSET_ATTR_TIMEOUT];
367 }
368 
369 size_t
370 ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], size_t len,
371                 size_t align)
372 {
373         enum ip_set_ext_id id;
374         u32 cadt_flags = 0;
375 
376         if (tb[IPSET_ATTR_CADT_FLAGS])
377                 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
378         if (cadt_flags & IPSET_FLAG_WITH_FORCEADD)
379                 set->flags |= IPSET_CREATE_FLAG_FORCEADD;
380         if (!align)
381                 align = 1;
382         for (id = 0; id < IPSET_EXT_ID_MAX; id++) {
383                 if (!add_extension(id, cadt_flags, tb))
384                         continue;
385                 len = ALIGN(len, ip_set_extensions[id].align);
386                 set->offset[id] = len;
387                 set->extensions |= ip_set_extensions[id].type;
388                 len += ip_set_extensions[id].len;
389         }
390         return ALIGN(len, align);
391 }
392 EXPORT_SYMBOL_GPL(ip_set_elem_len);
393 
394 int
395 ip_set_get_extensions(struct ip_set *set, struct nlattr *tb[],
396                       struct ip_set_ext *ext)
397 {
398         u64 fullmark;
399 
400         if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
401                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) ||
402                      !ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES) ||
403                      !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBMARK) ||
404                      !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBPRIO) ||
405                      !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBQUEUE)))
406                 return -IPSET_ERR_PROTOCOL;
407 
408         if (tb[IPSET_ATTR_TIMEOUT]) {
409                 if (!SET_WITH_TIMEOUT(set))
410                         return -IPSET_ERR_TIMEOUT;
411                 ext->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
412         }
413         if (tb[IPSET_ATTR_BYTES] || tb[IPSET_ATTR_PACKETS]) {
414                 if (!SET_WITH_COUNTER(set))
415                         return -IPSET_ERR_COUNTER;
416                 if (tb[IPSET_ATTR_BYTES])
417                         ext->bytes = be64_to_cpu(nla_get_be64(
418                                                  tb[IPSET_ATTR_BYTES]));
419                 if (tb[IPSET_ATTR_PACKETS])
420                         ext->packets = be64_to_cpu(nla_get_be64(
421                                                    tb[IPSET_ATTR_PACKETS]));
422         }
423         if (tb[IPSET_ATTR_COMMENT]) {
424                 if (!SET_WITH_COMMENT(set))
425                         return -IPSET_ERR_COMMENT;
426                 ext->comment = ip_set_comment_uget(tb[IPSET_ATTR_COMMENT]);
427         }
428         if (tb[IPSET_ATTR_SKBMARK]) {
429                 if (!SET_WITH_SKBINFO(set))
430                         return -IPSET_ERR_SKBINFO;
431                 fullmark = be64_to_cpu(nla_get_be64(tb[IPSET_ATTR_SKBMARK]));
432                 ext->skbinfo.skbmark = fullmark >> 32;
433                 ext->skbinfo.skbmarkmask = fullmark & 0xffffffff;
434         }
435         if (tb[IPSET_ATTR_SKBPRIO]) {
436                 if (!SET_WITH_SKBINFO(set))
437                         return -IPSET_ERR_SKBINFO;
438                 ext->skbinfo.skbprio =
439                         be32_to_cpu(nla_get_be32(tb[IPSET_ATTR_SKBPRIO]));
440         }
441         if (tb[IPSET_ATTR_SKBQUEUE]) {
442                 if (!SET_WITH_SKBINFO(set))
443                         return -IPSET_ERR_SKBINFO;
444                 ext->skbinfo.skbqueue =
445                         be16_to_cpu(nla_get_be16(tb[IPSET_ATTR_SKBQUEUE]));
446         }
447         return 0;
448 }
449 EXPORT_SYMBOL_GPL(ip_set_get_extensions);
450 
451 int
452 ip_set_put_extensions(struct sk_buff *skb, const struct ip_set *set,
453                       const void *e, bool active)
454 {
455         if (SET_WITH_TIMEOUT(set)) {
456                 unsigned long *timeout = ext_timeout(e, set);
457 
458                 if (nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
459                         htonl(active ? ip_set_timeout_get(timeout)
460                                 : *timeout)))
461                         return -EMSGSIZE;
462         }
463         if (SET_WITH_COUNTER(set) &&
464             ip_set_put_counter(skb, ext_counter(e, set)))
465                 return -EMSGSIZE;
466         if (SET_WITH_COMMENT(set) &&
467             ip_set_put_comment(skb, ext_comment(e, set)))
468                 return -EMSGSIZE;
469         if (SET_WITH_SKBINFO(set) &&
470             ip_set_put_skbinfo(skb, ext_skbinfo(e, set)))
471                 return -EMSGSIZE;
472         return 0;
473 }
474 EXPORT_SYMBOL_GPL(ip_set_put_extensions);
475 
476 bool
477 ip_set_match_extensions(struct ip_set *set, const struct ip_set_ext *ext,
478                         struct ip_set_ext *mext, u32 flags, void *data)
479 {
480         if (SET_WITH_TIMEOUT(set) &&
481             ip_set_timeout_expired(ext_timeout(data, set)))
482                 return false;
483         if (SET_WITH_COUNTER(set)) {
484                 struct ip_set_counter *counter = ext_counter(data, set);
485 
486                 if (flags & IPSET_FLAG_MATCH_COUNTERS &&
487                     !(ip_set_match_counter(ip_set_get_packets(counter),
488                                 mext->packets, mext->packets_op) &&
489                       ip_set_match_counter(ip_set_get_bytes(counter),
490                                 mext->bytes, mext->bytes_op)))
491                         return false;
492                 ip_set_update_counter(counter, ext, flags);
493         }
494         if (SET_WITH_SKBINFO(set))
495                 ip_set_get_skbinfo(ext_skbinfo(data, set),
496                                    ext, mext, flags);
497         return true;
498 }
499 EXPORT_SYMBOL_GPL(ip_set_match_extensions);
500 
501 /* Creating/destroying/renaming/swapping affect the existence and
502  * the properties of a set. All of these can be executed from userspace
503  * only and serialized by the nfnl mutex indirectly from nfnetlink.
504  *
505  * Sets are identified by their index in ip_set_list and the index
506  * is used by the external references (set/SET netfilter modules).
507  *
508  * The set behind an index may change by swapping only, from userspace.
509  */
510 
511 static inline void
512 __ip_set_get(struct ip_set *set)
513 {
514         write_lock_bh(&ip_set_ref_lock);
515         set->ref++;
516         write_unlock_bh(&ip_set_ref_lock);
517 }
518 
519 static inline void
520 __ip_set_put(struct ip_set *set)
521 {
522         write_lock_bh(&ip_set_ref_lock);
523         BUG_ON(set->ref == 0);
524         set->ref--;
525         write_unlock_bh(&ip_set_ref_lock);
526 }
527 
528 /* set->ref can be swapped out by ip_set_swap, netlink events (like dump) need
529  * a separate reference counter
530  */
531 static inline void
532 __ip_set_put_netlink(struct ip_set *set)
533 {
534         write_lock_bh(&ip_set_ref_lock);
535         BUG_ON(set->ref_netlink == 0);
536         set->ref_netlink--;
537         write_unlock_bh(&ip_set_ref_lock);
538 }
539 
540 /* Add, del and test set entries from kernel.
541  *
542  * The set behind the index must exist and must be referenced
543  * so it can't be destroyed (or changed) under our foot.
544  */
545 
546 static inline struct ip_set *
547 ip_set_rcu_get(struct net *net, ip_set_id_t index)
548 {
549         struct ip_set *set;
550         struct ip_set_net *inst = ip_set_pernet(net);
551 
552         rcu_read_lock();
553         /* ip_set_list itself needs to be protected */
554         set = rcu_dereference(inst->ip_set_list)[index];
555         rcu_read_unlock();
556 
557         return set;
558 }
559 
560 int
561 ip_set_test(ip_set_id_t index, const struct sk_buff *skb,
562             const struct xt_action_param *par, struct ip_set_adt_opt *opt)
563 {
564         struct ip_set *set = ip_set_rcu_get(xt_net(par), index);
565         int ret = 0;
566 
567         BUG_ON(!set);
568         pr_debug("set %s, index %u\n", set->name, index);
569 
570         if (opt->dim < set->type->dimension ||
571             !(opt->family == set->family || set->family == NFPROTO_UNSPEC))
572                 return 0;
573 
574         rcu_read_lock_bh();
575         ret = set->variant->kadt(set, skb, par, IPSET_TEST, opt);
576         rcu_read_unlock_bh();
577 
578         if (ret == -EAGAIN) {
579                 /* Type requests element to be completed */
580                 pr_debug("element must be completed, ADD is triggered\n");
581                 spin_lock_bh(&set->lock);
582                 set->variant->kadt(set, skb, par, IPSET_ADD, opt);
583                 spin_unlock_bh(&set->lock);
584                 ret = 1;
585         } else {
586                 /* --return-nomatch: invert matched element */
587                 if ((opt->cmdflags & IPSET_FLAG_RETURN_NOMATCH) &&
588                     (set->type->features & IPSET_TYPE_NOMATCH) &&
589                     (ret > 0 || ret == -ENOTEMPTY))
590                         ret = -ret;
591         }
592 
593         /* Convert error codes to nomatch */
594         return (ret < 0 ? 0 : ret);
595 }
596 EXPORT_SYMBOL_GPL(ip_set_test);
597 
598 int
599 ip_set_add(ip_set_id_t index, const struct sk_buff *skb,
600            const struct xt_action_param *par, struct ip_set_adt_opt *opt)
601 {
602         struct ip_set *set = ip_set_rcu_get(xt_net(par), index);
603         int ret;
604 
605         BUG_ON(!set);
606         pr_debug("set %s, index %u\n", set->name, index);
607 
608         if (opt->dim < set->type->dimension ||
609             !(opt->family == set->family || set->family == NFPROTO_UNSPEC))
610                 return -IPSET_ERR_TYPE_MISMATCH;
611 
612         spin_lock_bh(&set->lock);
613         ret = set->variant->kadt(set, skb, par, IPSET_ADD, opt);
614         spin_unlock_bh(&set->lock);
615 
616         return ret;
617 }
618 EXPORT_SYMBOL_GPL(ip_set_add);
619 
620 int
621 ip_set_del(ip_set_id_t index, const struct sk_buff *skb,
622            const struct xt_action_param *par, struct ip_set_adt_opt *opt)
623 {
624         struct ip_set *set = ip_set_rcu_get(xt_net(par), index);
625         int ret = 0;
626 
627         BUG_ON(!set);
628         pr_debug("set %s, index %u\n", set->name, index);
629 
630         if (opt->dim < set->type->dimension ||
631             !(opt->family == set->family || set->family == NFPROTO_UNSPEC))
632                 return -IPSET_ERR_TYPE_MISMATCH;
633 
634         spin_lock_bh(&set->lock);
635         ret = set->variant->kadt(set, skb, par, IPSET_DEL, opt);
636         spin_unlock_bh(&set->lock);
637 
638         return ret;
639 }
640 EXPORT_SYMBOL_GPL(ip_set_del);
641 
642 /* Find set by name, reference it once. The reference makes sure the
643  * thing pointed to, does not go away under our feet.
644  *
645  */
646 ip_set_id_t
647 ip_set_get_byname(struct net *net, const char *name, struct ip_set **set)
648 {
649         ip_set_id_t i, index = IPSET_INVALID_ID;
650         struct ip_set *s;
651         struct ip_set_net *inst = ip_set_pernet(net);
652 
653         rcu_read_lock();
654         for (i = 0; i < inst->ip_set_max; i++) {
655                 s = rcu_dereference(inst->ip_set_list)[i];
656                 if (s && STRNCMP(s->name, name)) {
657                         __ip_set_get(s);
658                         index = i;
659                         *set = s;
660                         break;
661                 }
662         }
663         rcu_read_unlock();
664 
665         return index;
666 }
667 EXPORT_SYMBOL_GPL(ip_set_get_byname);
668 
669 /* If the given set pointer points to a valid set, decrement
670  * reference count by 1. The caller shall not assume the index
671  * to be valid, after calling this function.
672  *
673  */
674 
675 static inline void
676 __ip_set_put_byindex(struct ip_set_net *inst, ip_set_id_t index)
677 {
678         struct ip_set *set;
679 
680         rcu_read_lock();
681         set = rcu_dereference(inst->ip_set_list)[index];
682         if (set)
683                 __ip_set_put(set);
684         rcu_read_unlock();
685 }
686 
687 void
688 ip_set_put_byindex(struct net *net, ip_set_id_t index)
689 {
690         struct ip_set_net *inst = ip_set_pernet(net);
691 
692         __ip_set_put_byindex(inst, index);
693 }
694 EXPORT_SYMBOL_GPL(ip_set_put_byindex);
695 
696 /* Get the name of a set behind a set index.
697  * Set itself is protected by RCU, but its name isn't: to protect against
698  * renaming, grab ip_set_ref_lock as reader (see ip_set_rename()) and copy the
699  * name.
700  */
701 void
702 ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name)
703 {
704         struct ip_set *set = ip_set_rcu_get(net, index);
705 
706         BUG_ON(!set);
707 
708         read_lock_bh(&ip_set_ref_lock);
709         strncpy(name, set->name, IPSET_MAXNAMELEN);
710         read_unlock_bh(&ip_set_ref_lock);
711 }
712 EXPORT_SYMBOL_GPL(ip_set_name_byindex);
713 
714 /* Routines to call by external subsystems, which do not
715  * call nfnl_lock for us.
716  */
717 
718 /* Find set by index, reference it once. The reference makes sure the
719  * thing pointed to, does not go away under our feet.
720  *
721  * The nfnl mutex is used in the function.
722  */
723 ip_set_id_t
724 ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index)
725 {
726         struct ip_set *set;
727         struct ip_set_net *inst = ip_set_pernet(net);
728 
729         if (index >= inst->ip_set_max)
730                 return IPSET_INVALID_ID;
731 
732         nfnl_lock(NFNL_SUBSYS_IPSET);
733         set = ip_set(inst, index);
734         if (set)
735                 __ip_set_get(set);
736         else
737                 index = IPSET_INVALID_ID;
738         nfnl_unlock(NFNL_SUBSYS_IPSET);
739 
740         return index;
741 }
742 EXPORT_SYMBOL_GPL(ip_set_nfnl_get_byindex);
743 
744 /* If the given set pointer points to a valid set, decrement
745  * reference count by 1. The caller shall not assume the index
746  * to be valid, after calling this function.
747  *
748  * The nfnl mutex is used in the function.
749  */
750 void
751 ip_set_nfnl_put(struct net *net, ip_set_id_t index)
752 {
753         struct ip_set *set;
754         struct ip_set_net *inst = ip_set_pernet(net);
755 
756         nfnl_lock(NFNL_SUBSYS_IPSET);
757         if (!inst->is_deleted) { /* already deleted from ip_set_net_exit() */
758                 set = ip_set(inst, index);
759                 if (set)
760                         __ip_set_put(set);
761         }
762         nfnl_unlock(NFNL_SUBSYS_IPSET);
763 }
764 EXPORT_SYMBOL_GPL(ip_set_nfnl_put);
765 
766 /* Communication protocol with userspace over netlink.
767  *
768  * The commands are serialized by the nfnl mutex.
769  */
770 
771 static inline u8 protocol(const struct nlattr * const tb[])
772 {
773         return nla_get_u8(tb[IPSET_ATTR_PROTOCOL]);
774 }
775 
776 static inline bool
777 protocol_failed(const struct nlattr * const tb[])
778 {
779         return !tb[IPSET_ATTR_PROTOCOL] || protocol(tb) != IPSET_PROTOCOL;
780 }
781 
782 static inline bool
783 protocol_min_failed(const struct nlattr * const tb[])
784 {
785         return !tb[IPSET_ATTR_PROTOCOL] || protocol(tb) < IPSET_PROTOCOL_MIN;
786 }
787 
788 static inline u32
789 flag_exist(const struct nlmsghdr *nlh)
790 {
791         return nlh->nlmsg_flags & NLM_F_EXCL ? 0 : IPSET_FLAG_EXIST;
792 }
793 
794 static struct nlmsghdr *
795 start_msg(struct sk_buff *skb, u32 portid, u32 seq, unsigned int flags,
796           enum ipset_cmd cmd)
797 {
798         struct nlmsghdr *nlh;
799         struct nfgenmsg *nfmsg;
800 
801         nlh = nlmsg_put(skb, portid, seq, nfnl_msg_type(NFNL_SUBSYS_IPSET, cmd),
802                         sizeof(*nfmsg), flags);
803         if (!nlh)
804                 return NULL;
805 
806         nfmsg = nlmsg_data(nlh);
807         nfmsg->nfgen_family = NFPROTO_IPV4;
808         nfmsg->version = NFNETLINK_V0;
809         nfmsg->res_id = 0;
810 
811         return nlh;
812 }
813 
814 /* Create a set */
815 
816 static const struct nla_policy ip_set_create_policy[IPSET_ATTR_CMD_MAX + 1] = {
817         [IPSET_ATTR_PROTOCOL]   = { .type = NLA_U8 },
818         [IPSET_ATTR_SETNAME]    = { .type = NLA_NUL_STRING,
819                                     .len = IPSET_MAXNAMELEN - 1 },
820         [IPSET_ATTR_TYPENAME]   = { .type = NLA_NUL_STRING,
821                                     .len = IPSET_MAXNAMELEN - 1},
822         [IPSET_ATTR_REVISION]   = { .type = NLA_U8 },
823         [IPSET_ATTR_FAMILY]     = { .type = NLA_U8 },
824         [IPSET_ATTR_DATA]       = { .type = NLA_NESTED },
825 };
826 
827 static struct ip_set *
828 find_set_and_id(struct ip_set_net *inst, const char *name, ip_set_id_t *id)
829 {
830         struct ip_set *set = NULL;
831         ip_set_id_t i;
832 
833         *id = IPSET_INVALID_ID;
834         for (i = 0; i < inst->ip_set_max; i++) {
835                 set = ip_set(inst, i);
836                 if (set && STRNCMP(set->name, name)) {
837                         *id = i;
838                         break;
839                 }
840         }
841         return (*id == IPSET_INVALID_ID ? NULL : set);
842 }
843 
844 static inline struct ip_set *
845 find_set(struct ip_set_net *inst, const char *name)
846 {
847         ip_set_id_t id;
848 
849         return find_set_and_id(inst, name, &id);
850 }
851 
852 static int
853 find_free_id(struct ip_set_net *inst, const char *name, ip_set_id_t *index,
854              struct ip_set **set)
855 {
856         struct ip_set *s;
857         ip_set_id_t i;
858 
859         *index = IPSET_INVALID_ID;
860         for (i = 0;  i < inst->ip_set_max; i++) {
861                 s = ip_set(inst, i);
862                 if (!s) {
863                         if (*index == IPSET_INVALID_ID)
864                                 *index = i;
865                 } else if (STRNCMP(name, s->name)) {
866                         /* Name clash */
867                         *set = s;
868                         return -EEXIST;
869                 }
870         }
871         if (*index == IPSET_INVALID_ID)
872                 /* No free slot remained */
873                 return -IPSET_ERR_MAX_SETS;
874         return 0;
875 }
876 
877 static int ip_set_none(struct net *net, struct sock *ctnl, struct sk_buff *skb,
878                        const struct nlmsghdr *nlh,
879                        const struct nlattr * const attr[],
880                        struct netlink_ext_ack *extack)
881 {
882         return -EOPNOTSUPP;
883 }
884 
885 static int ip_set_create(struct net *net, struct sock *ctnl,
886                          struct sk_buff *skb, const struct nlmsghdr *nlh,
887                          const struct nlattr * const attr[],
888                          struct netlink_ext_ack *extack)
889 {
890         struct ip_set_net *inst = ip_set_pernet(net);
891         struct ip_set *set, *clash = NULL;
892         ip_set_id_t index = IPSET_INVALID_ID;
893         struct nlattr *tb[IPSET_ATTR_CREATE_MAX + 1] = {};
894         const char *name, *typename;
895         u8 family, revision;
896         u32 flags = flag_exist(nlh);
897         int ret = 0;
898 
899         if (unlikely(protocol_min_failed(attr) ||
900                      !attr[IPSET_ATTR_SETNAME] ||
901                      !attr[IPSET_ATTR_TYPENAME] ||
902                      !attr[IPSET_ATTR_REVISION] ||
903                      !attr[IPSET_ATTR_FAMILY] ||
904                      (attr[IPSET_ATTR_DATA] &&
905                       !flag_nested(attr[IPSET_ATTR_DATA]))))
906                 return -IPSET_ERR_PROTOCOL;
907 
908         name = nla_data(attr[IPSET_ATTR_SETNAME]);
909         typename = nla_data(attr[IPSET_ATTR_TYPENAME]);
910         family = nla_get_u8(attr[IPSET_ATTR_FAMILY]);
911         revision = nla_get_u8(attr[IPSET_ATTR_REVISION]);
912         pr_debug("setname: %s, typename: %s, family: %s, revision: %u\n",
913                  name, typename, family_name(family), revision);
914 
915         /* First, and without any locks, allocate and initialize
916          * a normal base set structure.
917          */
918         set = kzalloc(sizeof(*set), GFP_KERNEL);
919         if (!set)
920                 return -ENOMEM;
921         spin_lock_init(&set->lock);
922         strlcpy(set->name, name, IPSET_MAXNAMELEN);
923         set->family = family;
924         set->revision = revision;
925 
926         /* Next, check that we know the type, and take
927          * a reference on the type, to make sure it stays available
928          * while constructing our new set.
929          *
930          * After referencing the type, we try to create the type
931          * specific part of the set without holding any locks.
932          */
933         ret = find_set_type_get(typename, family, revision, &set->type);
934         if (ret)
935                 goto out;
936 
937         /* Without holding any locks, create private part. */
938         if (attr[IPSET_ATTR_DATA] &&
939             nla_parse_nested(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA],
940                              set->type->create_policy, NULL)) {
941                 ret = -IPSET_ERR_PROTOCOL;
942                 goto put_out;
943         }
944 
945         ret = set->type->create(net, set, tb, flags);
946         if (ret != 0)
947                 goto put_out;
948 
949         /* BTW, ret==0 here. */
950 
951         /* Here, we have a valid, constructed set and we are protected
952          * by the nfnl mutex. Find the first free index in ip_set_list
953          * and check clashing.
954          */
955         ret = find_free_id(inst, set->name, &index, &clash);
956         if (ret == -EEXIST) {
957                 /* If this is the same set and requested, ignore error */
958                 if ((flags & IPSET_FLAG_EXIST) &&
959                     STRNCMP(set->type->name, clash->type->name) &&
960                     set->type->family == clash->type->family &&
961                     set->type->revision_min == clash->type->revision_min &&
962                     set->type->revision_max == clash->type->revision_max &&
963                     set->variant->same_set(set, clash))
964                         ret = 0;
965                 goto cleanup;
966         } else if (ret == -IPSET_ERR_MAX_SETS) {
967                 struct ip_set **list, **tmp;
968                 ip_set_id_t i = inst->ip_set_max + IP_SET_INC;
969 
970                 if (i < inst->ip_set_max || i == IPSET_INVALID_ID)
971                         /* Wraparound */
972                         goto cleanup;
973 
974                 list = kvcalloc(i, sizeof(struct ip_set *), GFP_KERNEL);
975                 if (!list)
976                         goto cleanup;
977                 /* nfnl mutex is held, both lists are valid */
978                 tmp = ip_set_dereference(inst->ip_set_list);
979                 memcpy(list, tmp, sizeof(struct ip_set *) * inst->ip_set_max);
980                 rcu_assign_pointer(inst->ip_set_list, list);
981                 /* Make sure all current packets have passed through */
982                 synchronize_net();
983                 /* Use new list */
984                 index = inst->ip_set_max;
985                 inst->ip_set_max = i;
986                 kvfree(tmp);
987                 ret = 0;
988         } else if (ret) {
989                 goto cleanup;
990         }
991 
992         /* Finally! Add our shiny new set to the list, and be done. */
993         pr_debug("create: '%s' created with index %u!\n", set->name, index);
994         ip_set(inst, index) = set;
995 
996         return ret;
997 
998 cleanup:
999         set->variant->destroy(set);
1000 put_out:
1001         module_put(set->type->me);
1002 out:
1003         kfree(set);
1004         return ret;
1005 }
1006 
1007 /* Destroy sets */
1008 
1009 static const struct nla_policy
1010 ip_set_setname_policy[IPSET_ATTR_CMD_MAX + 1] = {
1011         [IPSET_ATTR_PROTOCOL]   = { .type = NLA_U8 },
1012         [IPSET_ATTR_SETNAME]    = { .type = NLA_NUL_STRING,
1013                                     .len = IPSET_MAXNAMELEN - 1 },
1014 };
1015 
1016 static void
1017 ip_set_destroy_set(struct ip_set *set)
1018 {
1019         pr_debug("set: %s\n",  set->name);
1020 
1021         /* Must call it without holding any lock */
1022         set->variant->destroy(set);
1023         module_put(set->type->me);
1024         kfree(set);
1025 }
1026 
1027 static int ip_set_destroy(struct net *net, struct sock *ctnl,
1028                           struct sk_buff *skb, const struct nlmsghdr *nlh,
1029                           const struct nlattr * const attr[],
1030                           struct netlink_ext_ack *extack)
1031 {
1032         struct ip_set_net *inst = ip_set_pernet(net);
1033         struct ip_set *s;
1034         ip_set_id_t i;
1035         int ret = 0;
1036 
1037         if (unlikely(protocol_min_failed(attr)))
1038                 return -IPSET_ERR_PROTOCOL;
1039 
1040         /* Must wait for flush to be really finished in list:set */
1041         rcu_barrier();
1042 
1043         /* Commands are serialized and references are
1044          * protected by the ip_set_ref_lock.
1045          * External systems (i.e. xt_set) must call
1046          * ip_set_put|get_nfnl_* functions, that way we
1047          * can safely check references here.
1048          *
1049          * list:set timer can only decrement the reference
1050          * counter, so if it's already zero, we can proceed
1051          * without holding the lock.
1052          */
1053         read_lock_bh(&ip_set_ref_lock);
1054         if (!attr[IPSET_ATTR_SETNAME]) {
1055                 for (i = 0; i < inst->ip_set_max; i++) {
1056                         s = ip_set(inst, i);
1057                         if (s && (s->ref || s->ref_netlink)) {
1058                                 ret = -IPSET_ERR_BUSY;
1059                                 goto out;
1060                         }
1061                 }
1062                 inst->is_destroyed = true;
1063                 read_unlock_bh(&ip_set_ref_lock);
1064                 for (i = 0; i < inst->ip_set_max; i++) {
1065                         s = ip_set(inst, i);
1066                         if (s) {
1067                                 ip_set(inst, i) = NULL;
1068                                 ip_set_destroy_set(s);
1069                         }
1070                 }
1071                 /* Modified by ip_set_destroy() only, which is serialized */
1072                 inst->is_destroyed = false;
1073         } else {
1074                 s = find_set_and_id(inst, nla_data(attr[IPSET_ATTR_SETNAME]),
1075                                     &i);
1076                 if (!s) {
1077                         ret = -ENOENT;
1078                         goto out;
1079                 } else if (s->ref || s->ref_netlink) {
1080                         ret = -IPSET_ERR_BUSY;
1081                         goto out;
1082                 }
1083                 ip_set(inst, i) = NULL;
1084                 read_unlock_bh(&ip_set_ref_lock);
1085 
1086                 ip_set_destroy_set(s);
1087         }
1088         return 0;
1089 out:
1090         read_unlock_bh(&ip_set_ref_lock);
1091         return ret;
1092 }
1093 
1094 /* Flush sets */
1095 
1096 static void
1097 ip_set_flush_set(struct ip_set *set)
1098 {
1099         pr_debug("set: %s\n",  set->name);
1100 
1101         spin_lock_bh(&set->lock);
1102         set->variant->flush(set);
1103         spin_unlock_bh(&set->lock);
1104 }
1105 
1106 static int ip_set_flush(struct net *net, struct sock *ctnl, struct sk_buff *skb,
1107                         const struct nlmsghdr *nlh,
1108                         const struct nlattr * const attr[],
1109                         struct netlink_ext_ack *extack)
1110 {
1111         struct ip_set_net *inst = ip_set_pernet(net);
1112         struct ip_set *s;
1113         ip_set_id_t i;
1114 
1115         if (unlikely(protocol_min_failed(attr)))
1116                 return -IPSET_ERR_PROTOCOL;
1117 
1118         if (!attr[IPSET_ATTR_SETNAME]) {
1119                 for (i = 0; i < inst->ip_set_max; i++) {
1120                         s = ip_set(inst, i);
1121                         if (s)
1122                                 ip_set_flush_set(s);
1123                 }
1124         } else {
1125                 s = find_set(inst, nla_data(attr[IPSET_ATTR_SETNAME]));
1126                 if (!s)
1127                         return -ENOENT;
1128 
1129                 ip_set_flush_set(s);
1130         }
1131 
1132         return 0;
1133 }
1134 
1135 /* Rename a set */
1136 
1137 static const struct nla_policy
1138 ip_set_setname2_policy[IPSET_ATTR_CMD_MAX + 1] = {
1139         [IPSET_ATTR_PROTOCOL]   = { .type = NLA_U8 },
1140         [IPSET_ATTR_SETNAME]    = { .type = NLA_NUL_STRING,
1141                                     .len = IPSET_MAXNAMELEN - 1 },
1142         [IPSET_ATTR_SETNAME2]   = { .type = NLA_NUL_STRING,
1143                                     .len = IPSET_MAXNAMELEN - 1 },
1144 };
1145 
1146 static int ip_set_rename(struct net *net, struct sock *ctnl,
1147                          struct sk_buff *skb, const struct nlmsghdr *nlh,
1148                          const struct nlattr * const attr[],
1149                          struct netlink_ext_ack *extack)
1150 {
1151         struct ip_set_net *inst = ip_set_pernet(net);
1152         struct ip_set *set, *s;
1153         const char *name2;
1154         ip_set_id_t i;
1155         int ret = 0;
1156 
1157         if (unlikely(protocol_min_failed(attr) ||
1158                      !attr[IPSET_ATTR_SETNAME] ||
1159                      !attr[IPSET_ATTR_SETNAME2]))
1160                 return -IPSET_ERR_PROTOCOL;
1161 
1162         set = find_set(inst, nla_data(attr[IPSET_ATTR_SETNAME]));
1163         if (!set)
1164                 return -ENOENT;
1165 
1166         write_lock_bh(&ip_set_ref_lock);
1167         if (set->ref != 0 || set->ref_netlink != 0) {
1168                 ret = -IPSET_ERR_REFERENCED;
1169                 goto out;
1170         }
1171 
1172         name2 = nla_data(attr[IPSET_ATTR_SETNAME2]);
1173         for (i = 0; i < inst->ip_set_max; i++) {
1174                 s = ip_set(inst, i);
1175                 if (s && STRNCMP(s->name, name2)) {
1176                         ret = -IPSET_ERR_EXIST_SETNAME2;
1177                         goto out;
1178                 }
1179         }
1180         strncpy(set->name, name2, IPSET_MAXNAMELEN);
1181 
1182 out:
1183         write_unlock_bh(&ip_set_ref_lock);
1184         return ret;
1185 }
1186 
1187 /* Swap two sets so that name/index points to the other.
1188  * References and set names are also swapped.
1189  *
1190  * The commands are serialized by the nfnl mutex and references are
1191  * protected by the ip_set_ref_lock. The kernel interfaces
1192  * do not hold the mutex but the pointer settings are atomic
1193  * so the ip_set_list always contains valid pointers to the sets.
1194  */
1195 
1196 static int ip_set_swap(struct net *net, struct sock *ctnl, struct sk_buff *skb,
1197                        const struct nlmsghdr *nlh,
1198                        const struct nlattr * const attr[],
1199                        struct netlink_ext_ack *extack)
1200 {
1201         struct ip_set_net *inst = ip_set_pernet(net);
1202         struct ip_set *from, *to;
1203         ip_set_id_t from_id, to_id;
1204         char from_name[IPSET_MAXNAMELEN];
1205 
1206         if (unlikely(protocol_min_failed(attr) ||
1207                      !attr[IPSET_ATTR_SETNAME] ||
1208                      !attr[IPSET_ATTR_SETNAME2]))
1209                 return -IPSET_ERR_PROTOCOL;
1210 
1211         from = find_set_and_id(inst, nla_data(attr[IPSET_ATTR_SETNAME]),
1212                                &from_id);
1213         if (!from)
1214                 return -ENOENT;
1215 
1216         to = find_set_and_id(inst, nla_data(attr[IPSET_ATTR_SETNAME2]),
1217                              &to_id);
1218         if (!to)
1219                 return -IPSET_ERR_EXIST_SETNAME2;
1220 
1221         /* Features must not change.
1222          * Not an artifical restriction anymore, as we must prevent
1223          * possible loops created by swapping in setlist type of sets.
1224          */
1225         if (!(from->type->features == to->type->features &&
1226               from->family == to->family))
1227                 return -IPSET_ERR_TYPE_MISMATCH;
1228 
1229         write_lock_bh(&ip_set_ref_lock);
1230 
1231         if (from->ref_netlink || to->ref_netlink) {
1232                 write_unlock_bh(&ip_set_ref_lock);
1233                 return -EBUSY;
1234         }
1235 
1236         strncpy(from_name, from->name, IPSET_MAXNAMELEN);
1237         strncpy(from->name, to->name, IPSET_MAXNAMELEN);
1238         strncpy(to->name, from_name, IPSET_MAXNAMELEN);
1239 
1240         swap(from->ref, to->ref);
1241         ip_set(inst, from_id) = to;
1242         ip_set(inst, to_id) = from;
1243         write_unlock_bh(&ip_set_ref_lock);
1244 
1245         return 0;
1246 }
1247 
1248 /* List/save set data */
1249 
1250 #define DUMP_INIT       0
1251 #define DUMP_ALL        1
1252 #define DUMP_ONE        2
1253 #define DUMP_LAST       3
1254 
1255 #define DUMP_TYPE(arg)          (((u32)(arg)) & 0x0000FFFF)
1256 #define DUMP_FLAGS(arg)         (((u32)(arg)) >> 16)
1257 
1258 static int
1259 ip_set_dump_done(struct netlink_callback *cb)
1260 {
1261         if (cb->args[IPSET_CB_ARG0]) {
1262                 struct ip_set_net *inst =
1263                         (struct ip_set_net *)cb->args[IPSET_CB_NET];
1264                 ip_set_id_t index = (ip_set_id_t)cb->args[IPSET_CB_INDEX];
1265                 struct ip_set *set = ip_set_ref_netlink(inst, index);
1266 
1267                 if (set->variant->uref)
1268                         set->variant->uref(set, cb, false);
1269                 pr_debug("release set %s\n", set->name);
1270                 __ip_set_put_netlink(set);
1271         }
1272         return 0;
1273 }
1274 
1275 static inline void
1276 dump_attrs(struct nlmsghdr *nlh)
1277 {
1278         const struct nlattr *attr;
1279         int rem;
1280 
1281         pr_debug("dump nlmsg\n");
1282         nlmsg_for_each_attr(attr, nlh, sizeof(struct nfgenmsg), rem) {
1283                 pr_debug("type: %u, len %u\n", nla_type(attr), attr->nla_len);
1284         }
1285 }
1286 
1287 static const struct nla_policy
1288 ip_set_dump_policy[IPSET_ATTR_CMD_MAX + 1] = {
1289         [IPSET_ATTR_PROTOCOL]   = { .type = NLA_U8 },
1290         [IPSET_ATTR_SETNAME]    = { .type = NLA_NUL_STRING,
1291                                     .len = IPSET_MAXNAMELEN - 1 },
1292         [IPSET_ATTR_FLAGS]      = { .type = NLA_U32 },
1293 };
1294 
1295 static int
1296 dump_init(struct netlink_callback *cb, struct ip_set_net *inst)
1297 {
1298         struct nlmsghdr *nlh = nlmsg_hdr(cb->skb);
1299         int min_len = nlmsg_total_size(sizeof(struct nfgenmsg));
1300         struct nlattr *cda[IPSET_ATTR_CMD_MAX + 1];
1301         struct nlattr *attr = (void *)nlh + min_len;
1302         u32 dump_type;
1303         ip_set_id_t index;
1304         int ret;
1305 
1306         ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, attr,
1307                         nlh->nlmsg_len - min_len,
1308                         ip_set_dump_policy, NULL);
1309         if (ret)
1310                 return ret;
1311 
1312         cb->args[IPSET_CB_PROTO] = nla_get_u8(cda[IPSET_ATTR_PROTOCOL]);
1313         if (cda[IPSET_ATTR_SETNAME]) {
1314                 struct ip_set *set;
1315 
1316                 set = find_set_and_id(inst, nla_data(cda[IPSET_ATTR_SETNAME]),
1317                                       &index);
1318                 if (!set)
1319                         return -ENOENT;
1320 
1321                 dump_type = DUMP_ONE;
1322                 cb->args[IPSET_CB_INDEX] = index;
1323         } else {
1324                 dump_type = DUMP_ALL;
1325         }
1326 
1327         if (cda[IPSET_ATTR_FLAGS]) {
1328                 u32 f = ip_set_get_h32(cda[IPSET_ATTR_FLAGS]);
1329 
1330                 dump_type |= (f << 16);
1331         }
1332         cb->args[IPSET_CB_NET] = (unsigned long)inst;
1333         cb->args[IPSET_CB_DUMP] = dump_type;
1334 
1335         return 0;
1336 }
1337 
1338 static int
1339 ip_set_dump_start(struct sk_buff *skb, struct netlink_callback *cb)
1340 {
1341         ip_set_id_t index = IPSET_INVALID_ID, max;
1342         struct ip_set *set = NULL;
1343         struct nlmsghdr *nlh = NULL;
1344         unsigned int flags = NETLINK_CB(cb->skb).portid ? NLM_F_MULTI : 0;
1345         struct ip_set_net *inst = ip_set_pernet(sock_net(skb->sk));
1346         u32 dump_type, dump_flags;
1347         bool is_destroyed;
1348         int ret = 0;
1349 
1350         if (!cb->args[IPSET_CB_DUMP]) {
1351                 ret = dump_init(cb, inst);
1352                 if (ret < 0) {
1353                         nlh = nlmsg_hdr(cb->skb);
1354                         /* We have to create and send the error message
1355                          * manually :-(
1356                          */
1357                         if (nlh->nlmsg_flags & NLM_F_ACK)
1358                                 netlink_ack(cb->skb, nlh, ret, NULL);
1359                         return ret;
1360                 }
1361         }
1362 
1363         if (cb->args[IPSET_CB_INDEX] >= inst->ip_set_max)
1364                 goto out;
1365 
1366         dump_type = DUMP_TYPE(cb->args[IPSET_CB_DUMP]);
1367         dump_flags = DUMP_FLAGS(cb->args[IPSET_CB_DUMP]);
1368         max = dump_type == DUMP_ONE ? cb->args[IPSET_CB_INDEX] + 1
1369                                     : inst->ip_set_max;
1370 dump_last:
1371         pr_debug("dump type, flag: %u %u index: %ld\n",
1372                  dump_type, dump_flags, cb->args[IPSET_CB_INDEX]);
1373         for (; cb->args[IPSET_CB_INDEX] < max; cb->args[IPSET_CB_INDEX]++) {
1374                 index = (ip_set_id_t)cb->args[IPSET_CB_INDEX];
1375                 write_lock_bh(&ip_set_ref_lock);
1376                 set = ip_set(inst, index);
1377                 is_destroyed = inst->is_destroyed;
1378                 if (!set || is_destroyed) {
1379                         write_unlock_bh(&ip_set_ref_lock);
1380                         if (dump_type == DUMP_ONE) {
1381                                 ret = -ENOENT;
1382                                 goto out;
1383                         }
1384                         if (is_destroyed) {
1385                                 /* All sets are just being destroyed */
1386                                 ret = 0;
1387                                 goto out;
1388                         }
1389                         continue;
1390                 }
1391                 /* When dumping all sets, we must dump "sorted"
1392                  * so that lists (unions of sets) are dumped last.
1393                  */
1394                 if (dump_type != DUMP_ONE &&
1395                     ((dump_type == DUMP_ALL) ==
1396                      !!(set->type->features & IPSET_DUMP_LAST))) {
1397                         write_unlock_bh(&ip_set_ref_lock);
1398                         continue;
1399                 }
1400                 pr_debug("List set: %s\n", set->name);
1401                 if (!cb->args[IPSET_CB_ARG0]) {
1402                         /* Start listing: make sure set won't be destroyed */
1403                         pr_debug("reference set\n");
1404                         set->ref_netlink++;
1405                 }
1406                 write_unlock_bh(&ip_set_ref_lock);
1407                 nlh = start_msg(skb, NETLINK_CB(cb->skb).portid,
1408                                 cb->nlh->nlmsg_seq, flags,
1409                                 IPSET_CMD_LIST);
1410                 if (!nlh) {
1411                         ret = -EMSGSIZE;
1412                         goto release_refcount;
1413                 }
1414                 if (nla_put_u8(skb, IPSET_ATTR_PROTOCOL,
1415                                cb->args[IPSET_CB_PROTO]) ||
1416                     nla_put_string(skb, IPSET_ATTR_SETNAME, set->name))
1417                         goto nla_put_failure;
1418                 if (dump_flags & IPSET_FLAG_LIST_SETNAME)
1419                         goto next_set;
1420                 switch (cb->args[IPSET_CB_ARG0]) {
1421                 case 0:
1422                         /* Core header data */
1423                         if (nla_put_string(skb, IPSET_ATTR_TYPENAME,
1424                                            set->type->name) ||
1425                             nla_put_u8(skb, IPSET_ATTR_FAMILY,
1426                                        set->family) ||
1427                             nla_put_u8(skb, IPSET_ATTR_REVISION,
1428                                        set->revision))
1429                                 goto nla_put_failure;
1430                         if (cb->args[IPSET_CB_PROTO] > IPSET_PROTOCOL_MIN &&
1431                             nla_put_net16(skb, IPSET_ATTR_INDEX, htons(index)))
1432                                 goto nla_put_failure;
1433                         ret = set->variant->head(set, skb);
1434                         if (ret < 0)
1435                                 goto release_refcount;
1436                         if (dump_flags & IPSET_FLAG_LIST_HEADER)
1437                                 goto next_set;
1438                         if (set->variant->uref)
1439                                 set->variant->uref(set, cb, true);
1440                         /* fall through */
1441                 default:
1442                         ret = set->variant->list(set, skb, cb);
1443                         if (!cb->args[IPSET_CB_ARG0])
1444                                 /* Set is done, proceed with next one */
1445                                 goto next_set;
1446                         goto release_refcount;
1447                 }
1448         }
1449         /* If we dump all sets, continue with dumping last ones */
1450         if (dump_type == DUMP_ALL) {
1451                 dump_type = DUMP_LAST;
1452                 cb->args[IPSET_CB_DUMP] = dump_type | (dump_flags << 16);
1453                 cb->args[IPSET_CB_INDEX] = 0;
1454                 if (set && set->variant->uref)
1455                         set->variant->uref(set, cb, false);
1456                 goto dump_last;
1457         }
1458         goto out;
1459 
1460 nla_put_failure:
1461         ret = -EFAULT;
1462 next_set:
1463         if (dump_type == DUMP_ONE)
1464                 cb->args[IPSET_CB_INDEX] = IPSET_INVALID_ID;
1465         else
1466                 cb->args[IPSET_CB_INDEX]++;
1467 release_refcount:
1468         /* If there was an error or set is done, release set */
1469         if (ret || !cb->args[IPSET_CB_ARG0]) {
1470                 set = ip_set_ref_netlink(inst, index);
1471                 if (set->variant->uref)
1472                         set->variant->uref(set, cb, false);
1473                 pr_debug("release set %s\n", set->name);
1474                 __ip_set_put_netlink(set);
1475                 cb->args[IPSET_CB_ARG0] = 0;
1476         }
1477 out:
1478         if (nlh) {
1479                 nlmsg_end(skb, nlh);
1480                 pr_debug("nlmsg_len: %u\n", nlh->nlmsg_len);
1481                 dump_attrs(nlh);
1482         }
1483 
1484         return ret < 0 ? ret : skb->len;
1485 }
1486 
1487 static int ip_set_dump(struct net *net, struct sock *ctnl, struct sk_buff *skb,
1488                        const struct nlmsghdr *nlh,
1489                        const struct nlattr * const attr[],
1490                        struct netlink_ext_ack *extack)
1491 {
1492         if (unlikely(protocol_min_failed(attr)))
1493                 return -IPSET_ERR_PROTOCOL;
1494 
1495         {
1496                 struct netlink_dump_control c = {
1497                         .dump = ip_set_dump_start,
1498                         .done = ip_set_dump_done,
1499                 };
1500                 return netlink_dump_start(ctnl, skb, nlh, &c);
1501         }
1502 }
1503 
1504 /* Add, del and test */
1505 
1506 static const struct nla_policy ip_set_adt_policy[IPSET_ATTR_CMD_MAX + 1] = {
1507         [IPSET_ATTR_PROTOCOL]   = { .type = NLA_U8 },
1508         [IPSET_ATTR_SETNAME]    = { .type = NLA_NUL_STRING,
1509                                     .len = IPSET_MAXNAMELEN - 1 },
1510         [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
1511         [IPSET_ATTR_DATA]       = { .type = NLA_NESTED },
1512         [IPSET_ATTR_ADT]        = { .type = NLA_NESTED },
1513 };
1514 
1515 static int
1516 call_ad(struct sock *ctnl, struct sk_buff *skb, struct ip_set *set,
1517         struct nlattr *tb[], enum ipset_adt adt,
1518         u32 flags, bool use_lineno)
1519 {
1520         int ret;
1521         u32 lineno = 0;
1522         bool eexist = flags & IPSET_FLAG_EXIST, retried = false;
1523 
1524         do {
1525                 spin_lock_bh(&set->lock);
1526                 ret = set->variant->uadt(set, tb, adt, &lineno, flags, retried);
1527                 spin_unlock_bh(&set->lock);
1528                 retried = true;
1529         } while (ret == -EAGAIN &&
1530                  set->variant->resize &&
1531                  (ret = set->variant->resize(set, retried)) == 0);
1532 
1533         if (!ret || (ret == -IPSET_ERR_EXIST && eexist))
1534                 return 0;
1535         if (lineno && use_lineno) {
1536                 /* Error in restore/batch mode: send back lineno */
1537                 struct nlmsghdr *rep, *nlh = nlmsg_hdr(skb);
1538                 struct sk_buff *skb2;
1539                 struct nlmsgerr *errmsg;
1540                 size_t payload = min(SIZE_MAX,
1541                                      sizeof(*errmsg) + nlmsg_len(nlh));
1542                 int min_len = nlmsg_total_size(sizeof(struct nfgenmsg));
1543                 struct nlattr *cda[IPSET_ATTR_CMD_MAX + 1];
1544                 struct nlattr *cmdattr;
1545                 u32 *errline;
1546 
1547                 skb2 = nlmsg_new(payload, GFP_KERNEL);
1548                 if (!skb2)
1549                         return -ENOMEM;
1550                 rep = __nlmsg_put(skb2, NETLINK_CB(skb).portid,
1551                                   nlh->nlmsg_seq, NLMSG_ERROR, payload, 0);
1552                 errmsg = nlmsg_data(rep);
1553                 errmsg->error = ret;
1554                 memcpy(&errmsg->msg, nlh, nlh->nlmsg_len);
1555                 cmdattr = (void *)&errmsg->msg + min_len;
1556 
1557                 ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr,
1558                                 nlh->nlmsg_len - min_len, ip_set_adt_policy,
1559                                 NULL);
1560 
1561                 if (ret) {
1562                         nlmsg_free(skb2);
1563                         return ret;
1564                 }
1565                 errline = nla_data(cda[IPSET_ATTR_LINENO]);
1566 
1567                 *errline = lineno;
1568 
1569                 netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid,
1570                                 MSG_DONTWAIT);
1571                 /* Signal netlink not to send its ACK/errmsg.  */
1572                 return -EINTR;
1573         }
1574 
1575         return ret;
1576 }
1577 
1578 static int ip_set_ad(struct net *net, struct sock *ctnl,
1579                      struct sk_buff *skb,
1580                      enum ipset_adt adt,
1581                      const struct nlmsghdr *nlh,
1582                      const struct nlattr * const attr[],
1583                      struct netlink_ext_ack *extack)
1584 {
1585         struct ip_set_net *inst = ip_set_pernet(net);
1586         struct ip_set *set;
1587         struct nlattr *tb[IPSET_ATTR_ADT_MAX + 1] = {};
1588         const struct nlattr *nla;
1589         u32 flags = flag_exist(nlh);
1590         bool use_lineno;
1591         int ret = 0;
1592 
1593         if (unlikely(protocol_min_failed(attr) ||
1594                      !attr[IPSET_ATTR_SETNAME] ||
1595                      !((attr[IPSET_ATTR_DATA] != NULL) ^
1596                        (attr[IPSET_ATTR_ADT] != NULL)) ||
1597                      (attr[IPSET_ATTR_DATA] &&
1598                       !flag_nested(attr[IPSET_ATTR_DATA])) ||
1599                      (attr[IPSET_ATTR_ADT] &&
1600                       (!flag_nested(attr[IPSET_ATTR_ADT]) ||
1601                        !attr[IPSET_ATTR_LINENO]))))
1602                 return -IPSET_ERR_PROTOCOL;
1603 
1604         set = find_set(inst, nla_data(attr[IPSET_ATTR_SETNAME]));
1605         if (!set)
1606                 return -ENOENT;
1607 
1608         use_lineno = !!attr[IPSET_ATTR_LINENO];
1609         if (attr[IPSET_ATTR_DATA]) {
1610                 if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX,
1611                                      attr[IPSET_ATTR_DATA],
1612                                      set->type->adt_policy, NULL))
1613                         return -IPSET_ERR_PROTOCOL;
1614                 ret = call_ad(ctnl, skb, set, tb, adt, flags,
1615                               use_lineno);
1616         } else {
1617                 int nla_rem;
1618 
1619                 nla_for_each_nested(nla, attr[IPSET_ATTR_ADT], nla_rem) {
1620                         if (nla_type(nla) != IPSET_ATTR_DATA ||
1621                             !flag_nested(nla) ||
1622                             nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, nla,
1623                                              set->type->adt_policy, NULL))
1624                                 return -IPSET_ERR_PROTOCOL;
1625                         ret = call_ad(ctnl, skb, set, tb, adt,
1626                                       flags, use_lineno);
1627                         if (ret < 0)
1628                                 return ret;
1629                 }
1630         }
1631         return ret;
1632 }
1633 
1634 static int ip_set_uadd(struct net *net, struct sock *ctnl,
1635                        struct sk_buff *skb, const struct nlmsghdr *nlh,
1636                        const struct nlattr * const attr[],
1637                        struct netlink_ext_ack *extack)
1638 {
1639         return ip_set_ad(net, ctnl, skb,
1640                          IPSET_ADD, nlh, attr, extack);
1641 }
1642 
1643 static int ip_set_udel(struct net *net, struct sock *ctnl,
1644                        struct sk_buff *skb, const struct nlmsghdr *nlh,
1645                        const struct nlattr * const attr[],
1646                        struct netlink_ext_ack *extack)
1647 {
1648         return ip_set_ad(net, ctnl, skb,
1649                          IPSET_DEL, nlh, attr, extack);
1650 }
1651 
1652 static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb,
1653                         const struct nlmsghdr *nlh,
1654                         const struct nlattr * const attr[],
1655                         struct netlink_ext_ack *extack)
1656 {
1657         struct ip_set_net *inst = ip_set_pernet(net);
1658         struct ip_set *set;
1659         struct nlattr *tb[IPSET_ATTR_ADT_MAX + 1] = {};
1660         int ret = 0;
1661 
1662         if (unlikely(protocol_min_failed(attr) ||
1663                      !attr[IPSET_ATTR_SETNAME] ||
1664                      !attr[IPSET_ATTR_DATA] ||
1665                      !flag_nested(attr[IPSET_ATTR_DATA])))
1666                 return -IPSET_ERR_PROTOCOL;
1667 
1668         set = find_set(inst, nla_data(attr[IPSET_ATTR_SETNAME]));
1669         if (!set)
1670                 return -ENOENT;
1671 
1672         if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA],
1673                              set->type->adt_policy, NULL))
1674                 return -IPSET_ERR_PROTOCOL;
1675 
1676         rcu_read_lock_bh();
1677         ret = set->variant->uadt(set, tb, IPSET_TEST, NULL, 0, 0);
1678         rcu_read_unlock_bh();
1679         /* Userspace can't trigger element to be re-added */
1680         if (ret == -EAGAIN)
1681                 ret = 1;
1682 
1683         return ret > 0 ? 0 : -IPSET_ERR_EXIST;
1684 }
1685 
1686 /* Get headed data of a set */
1687 
1688 static int ip_set_header(struct net *net, struct sock *ctnl,
1689                          struct sk_buff *skb, const struct nlmsghdr *nlh,
1690                          const struct nlattr * const attr[],
1691                          struct netlink_ext_ack *extack)
1692 {
1693         struct ip_set_net *inst = ip_set_pernet(net);
1694         const struct ip_set *set;
1695         struct sk_buff *skb2;
1696         struct nlmsghdr *nlh2;
1697         int ret = 0;
1698 
1699         if (unlikely(protocol_min_failed(attr) ||
1700                      !attr[IPSET_ATTR_SETNAME]))
1701                 return -IPSET_ERR_PROTOCOL;
1702 
1703         set = find_set(inst, nla_data(attr[IPSET_ATTR_SETNAME]));
1704         if (!set)
1705                 return -ENOENT;
1706 
1707         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1708         if (!skb2)
1709                 return -ENOMEM;
1710 
1711         nlh2 = start_msg(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq, 0,
1712                          IPSET_CMD_HEADER);
1713         if (!nlh2)
1714                 goto nlmsg_failure;
1715         if (nla_put_u8(skb2, IPSET_ATTR_PROTOCOL, protocol(attr)) ||
1716             nla_put_string(skb2, IPSET_ATTR_SETNAME, set->name) ||
1717             nla_put_string(skb2, IPSET_ATTR_TYPENAME, set->type->name) ||
1718             nla_put_u8(skb2, IPSET_ATTR_FAMILY, set->family) ||
1719             nla_put_u8(skb2, IPSET_ATTR_REVISION, set->revision))
1720                 goto nla_put_failure;
1721         nlmsg_end(skb2, nlh2);
1722 
1723         ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
1724         if (ret < 0)
1725                 return ret;
1726 
1727         return 0;
1728 
1729 nla_put_failure:
1730         nlmsg_cancel(skb2, nlh2);
1731 nlmsg_failure:
1732         kfree_skb(skb2);
1733         return -EMSGSIZE;
1734 }
1735 
1736 /* Get type data */
1737 
1738 static const struct nla_policy ip_set_type_policy[IPSET_ATTR_CMD_MAX + 1] = {
1739         [IPSET_ATTR_PROTOCOL]   = { .type = NLA_U8 },
1740         [IPSET_ATTR_TYPENAME]   = { .type = NLA_NUL_STRING,
1741                                     .len = IPSET_MAXNAMELEN - 1 },
1742         [IPSET_ATTR_FAMILY]     = { .type = NLA_U8 },
1743 };
1744 
1745 static int ip_set_type(struct net *net, struct sock *ctnl, struct sk_buff *skb,
1746                        const struct nlmsghdr *nlh,
1747                        const struct nlattr * const attr[],
1748                        struct netlink_ext_ack *extack)
1749 {
1750         struct sk_buff *skb2;
1751         struct nlmsghdr *nlh2;
1752         u8 family, min, max;
1753         const char *typename;
1754         int ret = 0;
1755 
1756         if (unlikely(protocol_min_failed(attr) ||
1757                      !attr[IPSET_ATTR_TYPENAME] ||
1758                      !attr[IPSET_ATTR_FAMILY]))
1759                 return -IPSET_ERR_PROTOCOL;
1760 
1761         family = nla_get_u8(attr[IPSET_ATTR_FAMILY]);
1762         typename = nla_data(attr[IPSET_ATTR_TYPENAME]);
1763         ret = find_set_type_minmax(typename, family, &min, &max);
1764         if (ret)
1765                 return ret;
1766 
1767         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1768         if (!skb2)
1769                 return -ENOMEM;
1770 
1771         nlh2 = start_msg(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq, 0,
1772                          IPSET_CMD_TYPE);
1773         if (!nlh2)
1774                 goto nlmsg_failure;
1775         if (nla_put_u8(skb2, IPSET_ATTR_PROTOCOL, protocol(attr)) ||
1776             nla_put_string(skb2, IPSET_ATTR_TYPENAME, typename) ||
1777             nla_put_u8(skb2, IPSET_ATTR_FAMILY, family) ||
1778             nla_put_u8(skb2, IPSET_ATTR_REVISION, max) ||
1779             nla_put_u8(skb2, IPSET_ATTR_REVISION_MIN, min))
1780                 goto nla_put_failure;
1781         nlmsg_end(skb2, nlh2);
1782 
1783         pr_debug("Send TYPE, nlmsg_len: %u\n", nlh2->nlmsg_len);
1784         ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
1785         if (ret < 0)
1786                 return ret;
1787 
1788         return 0;
1789 
1790 nla_put_failure:
1791         nlmsg_cancel(skb2, nlh2);
1792 nlmsg_failure:
1793         kfree_skb(skb2);
1794         return -EMSGSIZE;
1795 }
1796 
1797 /* Get protocol version */
1798 
1799 static const struct nla_policy
1800 ip_set_protocol_policy[IPSET_ATTR_CMD_MAX + 1] = {
1801         [IPSET_ATTR_PROTOCOL]   = { .type = NLA_U8 },
1802 };
1803 
1804 static int ip_set_protocol(struct net *net, struct sock *ctnl,
1805                            struct sk_buff *skb, const struct nlmsghdr *nlh,
1806                            const struct nlattr * const attr[],
1807                            struct netlink_ext_ack *extack)
1808 {
1809         struct sk_buff *skb2;
1810         struct nlmsghdr *nlh2;
1811         int ret = 0;
1812 
1813         if (unlikely(!attr[IPSET_ATTR_PROTOCOL]))
1814                 return -IPSET_ERR_PROTOCOL;
1815 
1816         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1817         if (!skb2)
1818                 return -ENOMEM;
1819 
1820         nlh2 = start_msg(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq, 0,
1821                          IPSET_CMD_PROTOCOL);
1822         if (!nlh2)
1823                 goto nlmsg_failure;
1824         if (nla_put_u8(skb2, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL))
1825                 goto nla_put_failure;
1826         if (nla_put_u8(skb2, IPSET_ATTR_PROTOCOL_MIN, IPSET_PROTOCOL_MIN))
1827                 goto nla_put_failure;
1828         nlmsg_end(skb2, nlh2);
1829 
1830         ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
1831         if (ret < 0)
1832                 return ret;
1833 
1834         return 0;
1835 
1836 nla_put_failure:
1837         nlmsg_cancel(skb2, nlh2);
1838 nlmsg_failure:
1839         kfree_skb(skb2);
1840         return -EMSGSIZE;
1841 }
1842 
1843 /* Get set by name or index, from userspace */
1844 
1845 static int ip_set_byname(struct net *net, struct sock *ctnl,
1846                          struct sk_buff *skb, const struct nlmsghdr *nlh,
1847                          const struct nlattr * const attr[],
1848                          struct netlink_ext_ack *extack)
1849 {
1850         struct ip_set_net *inst = ip_set_pernet(net);
1851         struct sk_buff *skb2;
1852         struct nlmsghdr *nlh2;
1853         ip_set_id_t id = IPSET_INVALID_ID;
1854         const struct ip_set *set;
1855         int ret = 0;
1856 
1857         if (unlikely(protocol_failed(attr) ||
1858                      !attr[IPSET_ATTR_SETNAME]))
1859                 return -IPSET_ERR_PROTOCOL;
1860 
1861         set = find_set_and_id(inst, nla_data(attr[IPSET_ATTR_SETNAME]), &id);
1862         if (id == IPSET_INVALID_ID)
1863                 return -ENOENT;
1864 
1865         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1866         if (!skb2)
1867                 return -ENOMEM;
1868 
1869         nlh2 = start_msg(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq, 0,
1870                          IPSET_CMD_GET_BYNAME);
1871         if (!nlh2)
1872                 goto nlmsg_failure;
1873         if (nla_put_u8(skb2, IPSET_ATTR_PROTOCOL, protocol(attr)) ||
1874             nla_put_u8(skb2, IPSET_ATTR_FAMILY, set->family) ||
1875             nla_put_net16(skb2, IPSET_ATTR_INDEX, htons(id)))
1876                 goto nla_put_failure;
1877         nlmsg_end(skb2, nlh2);
1878 
1879         ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
1880         if (ret < 0)
1881                 return ret;
1882 
1883         return 0;
1884 
1885 nla_put_failure:
1886         nlmsg_cancel(skb2, nlh2);
1887 nlmsg_failure:
1888         kfree_skb(skb2);
1889         return -EMSGSIZE;
1890 }
1891 
1892 static const struct nla_policy ip_set_index_policy[IPSET_ATTR_CMD_MAX + 1] = {
1893         [IPSET_ATTR_PROTOCOL]   = { .type = NLA_U8 },
1894         [IPSET_ATTR_INDEX]      = { .type = NLA_U16 },
1895 };
1896 
1897 static int ip_set_byindex(struct net *net, struct sock *ctnl,
1898                           struct sk_buff *skb, const struct nlmsghdr *nlh,
1899                           const struct nlattr * const attr[],
1900                           struct netlink_ext_ack *extack)
1901 {
1902         struct ip_set_net *inst = ip_set_pernet(net);
1903         struct sk_buff *skb2;
1904         struct nlmsghdr *nlh2;
1905         ip_set_id_t id = IPSET_INVALID_ID;
1906         const struct ip_set *set;
1907         int ret = 0;
1908 
1909         if (unlikely(protocol_failed(attr) ||
1910                      !attr[IPSET_ATTR_INDEX]))
1911                 return -IPSET_ERR_PROTOCOL;
1912 
1913         id = ip_set_get_h16(attr[IPSET_ATTR_INDEX]);
1914         if (id >= inst->ip_set_max)
1915                 return -ENOENT;
1916         set = ip_set(inst, id);
1917         if (set == NULL)
1918                 return -ENOENT;
1919 
1920         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1921         if (!skb2)
1922                 return -ENOMEM;
1923 
1924         nlh2 = start_msg(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq, 0,
1925                          IPSET_CMD_GET_BYINDEX);
1926         if (!nlh2)
1927                 goto nlmsg_failure;
1928         if (nla_put_u8(skb2, IPSET_ATTR_PROTOCOL, protocol(attr)) ||
1929             nla_put_string(skb2, IPSET_ATTR_SETNAME, set->name))
1930                 goto nla_put_failure;
1931         nlmsg_end(skb2, nlh2);
1932 
1933         ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
1934         if (ret < 0)
1935                 return ret;
1936 
1937         return 0;
1938 
1939 nla_put_failure:
1940         nlmsg_cancel(skb2, nlh2);
1941 nlmsg_failure:
1942         kfree_skb(skb2);
1943         return -EMSGSIZE;
1944 }
1945 
1946 static const struct nfnl_callback ip_set_netlink_subsys_cb[IPSET_MSG_MAX] = {
1947         [IPSET_CMD_NONE]        = {
1948                 .call           = ip_set_none,
1949                 .attr_count     = IPSET_ATTR_CMD_MAX,
1950         },
1951         [IPSET_CMD_CREATE]      = {
1952                 .call           = ip_set_create,
1953                 .attr_count     = IPSET_ATTR_CMD_MAX,
1954                 .policy         = ip_set_create_policy,
1955         },
1956         [IPSET_CMD_DESTROY]     = {
1957                 .call           = ip_set_destroy,
1958                 .attr_count     = IPSET_ATTR_CMD_MAX,
1959                 .policy         = ip_set_setname_policy,
1960         },
1961         [IPSET_CMD_FLUSH]       = {
1962                 .call           = ip_set_flush,
1963                 .attr_count     = IPSET_ATTR_CMD_MAX,
1964                 .policy         = ip_set_setname_policy,
1965         },
1966         [IPSET_CMD_RENAME]      = {
1967                 .call           = ip_set_rename,
1968                 .attr_count     = IPSET_ATTR_CMD_MAX,
1969                 .policy         = ip_set_setname2_policy,
1970         },
1971         [IPSET_CMD_SWAP]        = {
1972                 .call           = ip_set_swap,
1973                 .attr_count     = IPSET_ATTR_CMD_MAX,
1974                 .policy         = ip_set_setname2_policy,
1975         },
1976         [IPSET_CMD_LIST]        = {
1977                 .call           = ip_set_dump,
1978                 .attr_count     = IPSET_ATTR_CMD_MAX,
1979                 .policy         = ip_set_dump_policy,
1980         },
1981         [IPSET_CMD_SAVE]        = {
1982                 .call           = ip_set_dump,
1983                 .attr_count     = IPSET_ATTR_CMD_MAX,
1984                 .policy         = ip_set_setname_policy,
1985         },
1986         [IPSET_CMD_ADD] = {
1987                 .call           = ip_set_uadd,
1988                 .attr_count     = IPSET_ATTR_CMD_MAX,
1989                 .policy         = ip_set_adt_policy,
1990         },
1991         [IPSET_CMD_DEL] = {
1992                 .call           = ip_set_udel,
1993                 .attr_count     = IPSET_ATTR_CMD_MAX,
1994                 .policy         = ip_set_adt_policy,
1995         },
1996         [IPSET_CMD_TEST]        = {
1997                 .call           = ip_set_utest,
1998                 .attr_count     = IPSET_ATTR_CMD_MAX,
1999                 .policy         = ip_set_adt_policy,
2000         },
2001         [IPSET_CMD_HEADER]      = {
2002                 .call           = ip_set_header,
2003                 .attr_count     = IPSET_ATTR_CMD_MAX,
2004                 .policy         = ip_set_setname_policy,
2005         },
2006         [IPSET_CMD_TYPE]        = {
2007                 .call           = ip_set_type,
2008                 .attr_count     = IPSET_ATTR_CMD_MAX,
2009                 .policy         = ip_set_type_policy,
2010         },
2011         [IPSET_CMD_PROTOCOL]    = {
2012                 .call           = ip_set_protocol,
2013                 .attr_count     = IPSET_ATTR_CMD_MAX,
2014                 .policy         = ip_set_protocol_policy,
2015         },
2016         [IPSET_CMD_GET_BYNAME]  = {
2017                 .call           = ip_set_byname,
2018                 .attr_count     = IPSET_ATTR_CMD_MAX,
2019                 .policy         = ip_set_setname_policy,
2020         },
2021         [IPSET_CMD_GET_BYINDEX] = {
2022                 .call           = ip_set_byindex,
2023                 .attr_count     = IPSET_ATTR_CMD_MAX,
2024                 .policy         = ip_set_index_policy,
2025         },
2026 };
2027 
2028 static struct nfnetlink_subsystem ip_set_netlink_subsys __read_mostly = {
2029         .name           = "ip_set",
2030         .subsys_id      = NFNL_SUBSYS_IPSET,
2031         .cb_count       = IPSET_MSG_MAX,
2032         .cb             = ip_set_netlink_subsys_cb,
2033 };
2034 
2035 /* Interface to iptables/ip6tables */
2036 
2037 static int
2038 ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
2039 {
2040         unsigned int *op;
2041         void *data;
2042         int copylen = *len, ret = 0;
2043         struct net *net = sock_net(sk);
2044         struct ip_set_net *inst = ip_set_pernet(net);
2045 
2046         if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2047                 return -EPERM;
2048         if (optval != SO_IP_SET)
2049                 return -EBADF;
2050         if (*len < sizeof(unsigned int))
2051                 return -EINVAL;
2052 
2053         data = vmalloc(*len);
2054         if (!data)
2055                 return -ENOMEM;
2056         if (copy_from_user(data, user, *len) != 0) {
2057                 ret = -EFAULT;
2058                 goto done;
2059         }
2060         op = data;
2061 
2062         if (*op < IP_SET_OP_VERSION) {
2063                 /* Check the version at the beginning of operations */
2064                 struct ip_set_req_version *req_version = data;
2065 
2066                 if (*len < sizeof(struct ip_set_req_version)) {
2067                         ret = -EINVAL;
2068                         goto done;
2069                 }
2070 
2071                 if (req_version->version < IPSET_PROTOCOL_MIN) {
2072                         ret = -EPROTO;
2073                         goto done;
2074                 }
2075         }
2076 
2077         switch (*op) {
2078         case IP_SET_OP_VERSION: {
2079                 struct ip_set_req_version *req_version = data;
2080 
2081                 if (*len != sizeof(struct ip_set_req_version)) {
2082                         ret = -EINVAL;
2083                         goto done;
2084                 }
2085 
2086                 req_version->version = IPSET_PROTOCOL;
2087                 if (copy_to_user(user, req_version,
2088                                  sizeof(struct ip_set_req_version)))
2089                         ret = -EFAULT;
2090                 goto done;
2091         }
2092         case IP_SET_OP_GET_BYNAME: {
2093                 struct ip_set_req_get_set *req_get = data;
2094                 ip_set_id_t id;
2095 
2096                 if (*len != sizeof(struct ip_set_req_get_set)) {
2097                         ret = -EINVAL;
2098                         goto done;
2099                 }
2100                 req_get->set.name[IPSET_MAXNAMELEN - 1] = '\0';
2101                 nfnl_lock(NFNL_SUBSYS_IPSET);
2102                 find_set_and_id(inst, req_get->set.name, &id);
2103                 req_get->set.index = id;
2104                 nfnl_unlock(NFNL_SUBSYS_IPSET);
2105                 goto copy;
2106         }
2107         case IP_SET_OP_GET_FNAME: {
2108                 struct ip_set_req_get_set_family *req_get = data;
2109                 ip_set_id_t id;
2110 
2111                 if (*len != sizeof(struct ip_set_req_get_set_family)) {
2112                         ret = -EINVAL;
2113                         goto done;
2114                 }
2115                 req_get->set.name[IPSET_MAXNAMELEN - 1] = '\0';
2116                 nfnl_lock(NFNL_SUBSYS_IPSET);
2117                 find_set_and_id(inst, req_get->set.name, &id);
2118                 req_get->set.index = id;
2119                 if (id != IPSET_INVALID_ID)
2120                         req_get->family = ip_set(inst, id)->family;
2121                 nfnl_unlock(NFNL_SUBSYS_IPSET);
2122                 goto copy;
2123         }
2124         case IP_SET_OP_GET_BYINDEX: {
2125                 struct ip_set_req_get_set *req_get = data;
2126                 struct ip_set *set;
2127 
2128                 if (*len != sizeof(struct ip_set_req_get_set) ||
2129                     req_get->set.index >= inst->ip_set_max) {
2130                         ret = -EINVAL;
2131                         goto done;
2132                 }
2133                 nfnl_lock(NFNL_SUBSYS_IPSET);
2134                 set = ip_set(inst, req_get->set.index);
2135                 ret = strscpy(req_get->set.name, set ? set->name : "",
2136                               IPSET_MAXNAMELEN);
2137                 nfnl_unlock(NFNL_SUBSYS_IPSET);
2138                 if (ret < 0)
2139                         goto done;
2140                 goto copy;
2141         }
2142         default:
2143                 ret = -EBADMSG;
2144                 goto done;
2145         }       /* end of switch(op) */
2146 
2147 copy:
2148         if (copy_to_user(user, data, copylen))
2149                 ret = -EFAULT;
2150 
2151 done:
2152         vfree(data);
2153         if (ret > 0)
2154                 ret = 0;
2155         return ret;
2156 }
2157 
2158 static struct nf_sockopt_ops so_set __read_mostly = {
2159         .pf             = PF_INET,
2160         .get_optmin     = SO_IP_SET,
2161         .get_optmax     = SO_IP_SET + 1,
2162         .get            = ip_set_sockfn_get,
2163         .owner          = THIS_MODULE,
2164 };
2165 
2166 static int __net_init
2167 ip_set_net_init(struct net *net)
2168 {
2169         struct ip_set_net *inst = ip_set_pernet(net);
2170         struct ip_set **list;
2171 
2172         inst->ip_set_max = max_sets ? max_sets : CONFIG_IP_SET_MAX;
2173         if (inst->ip_set_max >= IPSET_INVALID_ID)
2174                 inst->ip_set_max = IPSET_INVALID_ID - 1;
2175 
2176         list = kvcalloc(inst->ip_set_max, sizeof(struct ip_set *), GFP_KERNEL);
2177         if (!list)
2178                 return -ENOMEM;
2179         inst->is_deleted = false;
2180         inst->is_destroyed = false;
2181         rcu_assign_pointer(inst->ip_set_list, list);
2182         return 0;
2183 }
2184 
2185 static void __net_exit
2186 ip_set_net_exit(struct net *net)
2187 {
2188         struct ip_set_net *inst = ip_set_pernet(net);
2189 
2190         struct ip_set *set = NULL;
2191         ip_set_id_t i;
2192 
2193         inst->is_deleted = true; /* flag for ip_set_nfnl_put */
2194 
2195         nfnl_lock(NFNL_SUBSYS_IPSET);
2196         for (i = 0; i < inst->ip_set_max; i++) {
2197                 set = ip_set(inst, i);
2198                 if (set) {
2199                         ip_set(inst, i) = NULL;
2200                         ip_set_destroy_set(set);
2201                 }
2202         }
2203         nfnl_unlock(NFNL_SUBSYS_IPSET);
2204         kvfree(rcu_dereference_protected(inst->ip_set_list, 1));
2205 }
2206 
2207 static struct pernet_operations ip_set_net_ops = {
2208         .init   = ip_set_net_init,
2209         .exit   = ip_set_net_exit,
2210         .id     = &ip_set_net_id,
2211         .size   = sizeof(struct ip_set_net),
2212 };
2213 
2214 static int __init
2215 ip_set_init(void)
2216 {
2217         int ret = register_pernet_subsys(&ip_set_net_ops);
2218 
2219         if (ret) {
2220                 pr_err("ip_set: cannot register pernet_subsys.\n");
2221                 return ret;
2222         }
2223 
2224         ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
2225         if (ret != 0) {
2226                 pr_err("ip_set: cannot register with nfnetlink.\n");
2227                 unregister_pernet_subsys(&ip_set_net_ops);
2228                 return ret;
2229         }
2230 
2231         ret = nf_register_sockopt(&so_set);
2232         if (ret != 0) {
2233                 pr_err("SO_SET registry failed: %d\n", ret);
2234                 nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
2235                 unregister_pernet_subsys(&ip_set_net_ops);
2236                 return ret;
2237         }
2238 
2239         return 0;
2240 }
2241 
2242 static void __exit
2243 ip_set_fini(void)
2244 {
2245         nf_unregister_sockopt(&so_set);
2246         nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
2247 
2248         unregister_pernet_subsys(&ip_set_net_ops);
2249         pr_debug("these are the famous last words\n");
2250 }
2251 
2252 module_init(ip_set_init);
2253 module_exit(ip_set_fini);
2254 
2255 MODULE_DESCRIPTION("ip_set: protocol " __stringify(IPSET_PROTOCOL));
2256 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp