~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/ipset/ip_set_hash_ipmac.c

Version: ~ [ linux-5.16 ] ~ [ linux-5.15.13 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.90 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.170 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.224 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.261 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.296 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.298 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* Copyright (C) 2016 Tomasz Chilinski <tomasz.chilinski@chilan.com>
  2  *
  3  * This program is free software; you can redistribute it and/or modify
  4  * it under the terms of the GNU General Public License version 2 as
  5  * published by the Free Software Foundation.
  6  */
  7 
  8 /* Kernel module implementing an IP set type: the hash:ip,mac type */
  9 
 10 #include <linux/jhash.h>
 11 #include <linux/module.h>
 12 #include <linux/ip.h>
 13 #include <linux/etherdevice.h>
 14 #include <linux/skbuff.h>
 15 #include <linux/errno.h>
 16 #include <linux/random.h>
 17 #include <linux/if_ether.h>
 18 #include <net/ip.h>
 19 #include <net/ipv6.h>
 20 #include <net/netlink.h>
 21 #include <net/tcp.h>
 22 
 23 #include <linux/netfilter.h>
 24 #include <linux/netfilter/ipset/pfxlen.h>
 25 #include <linux/netfilter/ipset/ip_set.h>
 26 #include <linux/netfilter/ipset/ip_set_hash.h>
 27 
 28 #define IPSET_TYPE_REV_MIN      0
 29 #define IPSET_TYPE_REV_MAX      0
 30 
 31 MODULE_LICENSE("GPL");
 32 MODULE_AUTHOR("Tomasz Chilinski <tomasz.chilinski@chilan.com>");
 33 IP_SET_MODULE_DESC("hash:ip,mac", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
 34 MODULE_ALIAS("ip_set_hash:ip,mac");
 35 
 36 /* Type specific function prefix */
 37 #define HTYPE           hash_ipmac
 38 
 39 /* IPv4 variant */
 40 
 41 /* Member elements */
 42 struct hash_ipmac4_elem {
 43         /* Zero valued IP addresses cannot be stored */
 44         __be32 ip;
 45         union {
 46                 unsigned char ether[ETH_ALEN];
 47                 __be32 foo[2];
 48         };
 49 };
 50 
 51 /* Common functions */
 52 
 53 static inline bool
 54 hash_ipmac4_data_equal(const struct hash_ipmac4_elem *e1,
 55                        const struct hash_ipmac4_elem *e2,
 56                        u32 *multi)
 57 {
 58         return e1->ip == e2->ip && ether_addr_equal(e1->ether, e2->ether);
 59 }
 60 
 61 static bool
 62 hash_ipmac4_data_list(struct sk_buff *skb, const struct hash_ipmac4_elem *e)
 63 {
 64         if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, e->ip) ||
 65             nla_put(skb, IPSET_ATTR_ETHER, ETH_ALEN, e->ether))
 66                 goto nla_put_failure;
 67         return false;
 68 
 69 nla_put_failure:
 70         return true;
 71 }
 72 
 73 static inline void
 74 hash_ipmac4_data_next(struct hash_ipmac4_elem *next,
 75                       const struct hash_ipmac4_elem *e)
 76 {
 77         next->ip = e->ip;
 78 }
 79 
 80 #define MTYPE           hash_ipmac4
 81 #define PF              4
 82 #define HOST_MASK       32
 83 #define HKEY_DATALEN    sizeof(struct hash_ipmac4_elem)
 84 #include "ip_set_hash_gen.h"
 85 
 86 static int
 87 hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
 88                  const struct xt_action_param *par,
 89                  enum ipset_adt adt, struct ip_set_adt_opt *opt)
 90 {
 91         ipset_adtfn adtfn = set->variant->adt[adt];
 92         struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } };
 93         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
 94 
 95          /* MAC can be src only */
 96         if (!(opt->flags & IPSET_DIM_TWO_SRC))
 97                 return 0;
 98 
 99         if (skb_mac_header(skb) < skb->head ||
100             (skb_mac_header(skb) + ETH_HLEN) > skb->data)
101                 return -EINVAL;
102 
103         if (opt->flags & IPSET_DIM_ONE_SRC)
104                 ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
105         else
106                 ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
107 
108         if (is_zero_ether_addr(e.ether))
109                 return -EINVAL;
110 
111         ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip);
112 
113         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
114 }
115 
116 static int
117 hash_ipmac4_uadt(struct ip_set *set, struct nlattr *tb[],
118                  enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
119 {
120         ipset_adtfn adtfn = set->variant->adt[adt];
121         struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } };
122         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
123         int ret;
124 
125         if (unlikely(!tb[IPSET_ATTR_IP] ||
126                      !tb[IPSET_ATTR_ETHER] ||
127                      nla_len(tb[IPSET_ATTR_ETHER]) != ETH_ALEN ||
128                      !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
129                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) ||
130                      !ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES)   ||
131                      !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBMARK) ||
132                      !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBPRIO) ||
133                      !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBQUEUE)))
134                 return -IPSET_ERR_PROTOCOL;
135 
136         if (tb[IPSET_ATTR_LINENO])
137                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
138 
139         ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP], &e.ip) ||
140                 ip_set_get_extensions(set, tb, &ext);
141         if (ret)
142                 return ret;
143         memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN);
144         if (is_zero_ether_addr(e.ether))
145                 return -IPSET_ERR_HASH_ELEM;
146 
147         return adtfn(set, &e, &ext, &ext, flags);
148 }
149 
150 /* IPv6 variant */
151 
152 /* Member elements */
153 struct hash_ipmac6_elem {
154         /* Zero valued IP addresses cannot be stored */
155         union nf_inet_addr ip;
156         union {
157                 unsigned char ether[ETH_ALEN];
158                 __be32 foo[2];
159         };
160 };
161 
162 /* Common functions */
163 
164 static inline bool
165 hash_ipmac6_data_equal(const struct hash_ipmac6_elem *e1,
166                        const struct hash_ipmac6_elem *e2,
167                        u32 *multi)
168 {
169         return ipv6_addr_equal(&e1->ip.in6, &e2->ip.in6) &&
170                 ether_addr_equal(e1->ether, e2->ether);
171 }
172 
173 static bool
174 hash_ipmac6_data_list(struct sk_buff *skb, const struct hash_ipmac6_elem *e)
175 {
176         if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &e->ip.in6) ||
177             nla_put(skb, IPSET_ATTR_ETHER, ETH_ALEN, e->ether))
178                 goto nla_put_failure;
179         return false;
180 
181 nla_put_failure:
182         return true;
183 }
184 
185 static inline void
186 hash_ipmac6_data_next(struct hash_ipmac6_elem *next,
187                       const struct hash_ipmac6_elem *e)
188 {
189 }
190 
191 #undef MTYPE
192 #undef PF
193 #undef HOST_MASK
194 #undef HKEY_DATALEN
195 
196 #define MTYPE           hash_ipmac6
197 #define PF              6
198 #define HOST_MASK       128
199 #define HKEY_DATALEN    sizeof(struct hash_ipmac6_elem)
200 #define IP_SET_EMIT_CREATE
201 #include "ip_set_hash_gen.h"
202 
203 static int
204 hash_ipmac6_kadt(struct ip_set *set, const struct sk_buff *skb,
205                  const struct xt_action_param *par,
206                  enum ipset_adt adt, struct ip_set_adt_opt *opt)
207 {
208         ipset_adtfn adtfn = set->variant->adt[adt];
209         struct hash_ipmac6_elem e = {
210                 { .all = { 0 } },
211                 { .foo[0] = 0, .foo[1] = 0 }
212         };
213         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
214 
215         if (skb_mac_header(skb) < skb->head ||
216             (skb_mac_header(skb) + ETH_HLEN) > skb->data)
217                 return -EINVAL;
218 
219         if (opt->flags & IPSET_DIM_ONE_SRC)
220                 ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
221         else
222                 ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
223 
224         if (is_zero_ether_addr(e.ether))
225                 return -EINVAL;
226 
227         ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip.in6);
228 
229         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
230 }
231 
232 static int
233 hash_ipmac6_uadt(struct ip_set *set, struct nlattr *tb[],
234                  enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
235 {
236         ipset_adtfn adtfn = set->variant->adt[adt];
237         struct hash_ipmac6_elem e = {
238                 { .all = { 0 } },
239                 { .foo[0] = 0, .foo[1] = 0 }
240         };
241         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
242         int ret;
243 
244         if (unlikely(!tb[IPSET_ATTR_IP] ||
245                      !tb[IPSET_ATTR_ETHER] ||
246                      nla_len(tb[IPSET_ATTR_ETHER]) != ETH_ALEN ||
247                      !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
248                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) ||
249                      !ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES)   ||
250                      !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBMARK) ||
251                      !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBPRIO) ||
252                      !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBQUEUE)))
253                 return -IPSET_ERR_PROTOCOL;
254 
255         if (tb[IPSET_ATTR_LINENO])
256                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
257 
258         ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip) ||
259                 ip_set_get_extensions(set, tb, &ext);
260         if (ret)
261                 return ret;
262 
263         memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN);
264         if (is_zero_ether_addr(e.ether))
265                 return -IPSET_ERR_HASH_ELEM;
266 
267         return adtfn(set, &e, &ext, &ext, flags);
268 }
269 
270 static struct ip_set_type hash_ipmac_type __read_mostly = {
271         .name           = "hash:ip,mac",
272         .protocol       = IPSET_PROTOCOL,
273         .features       = IPSET_TYPE_IP | IPSET_TYPE_MAC,
274         .dimension      = IPSET_DIM_TWO,
275         .family         = NFPROTO_UNSPEC,
276         .revision_min   = IPSET_TYPE_REV_MIN,
277         .revision_max   = IPSET_TYPE_REV_MAX,
278         .create         = hash_ipmac_create,
279         .create_policy  = {
280                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
281                 [IPSET_ATTR_MAXELEM]    = { .type = NLA_U32 },
282                 [IPSET_ATTR_PROBES]     = { .type = NLA_U8 },
283                 [IPSET_ATTR_RESIZE]     = { .type = NLA_U8  },
284                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
285                 [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
286         },
287         .adt_policy     = {
288                 [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
289                 [IPSET_ATTR_ETHER]      = { .type = NLA_BINARY,
290                                 .len  = ETH_ALEN },
291                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
292                 [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
293                 [IPSET_ATTR_BYTES]      = { .type = NLA_U64 },
294                 [IPSET_ATTR_PACKETS]    = { .type = NLA_U64 },
295                 [IPSET_ATTR_COMMENT]    = { .type = NLA_NUL_STRING },
296                 [IPSET_ATTR_SKBMARK]    = { .type = NLA_U64 },
297                 [IPSET_ATTR_SKBPRIO]    = { .type = NLA_U32 },
298                 [IPSET_ATTR_SKBQUEUE]   = { .type = NLA_U16 },
299         },
300         .me             = THIS_MODULE,
301 };
302 
303 static int __init
304 hash_ipmac_init(void)
305 {
306         return ip_set_type_register(&hash_ipmac_type);
307 }
308 
309 static void __exit
310 hash_ipmac_fini(void)
311 {
312         ip_set_type_unregister(&hash_ipmac_type);
313 }
314 
315 module_init(hash_ipmac_init);
316 module_exit(hash_ipmac_fini);
317 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp