~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/ipset/ip_set_hash_ipport.c

Version: ~ [ linux-5.1-rc5 ] ~ [ linux-5.0.7 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.34 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.111 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.168 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.178 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.138 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.65 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.39.4 ] ~ [ linux-2.6.38.8 ] ~ [ linux-2.6.37.6 ] ~ [ linux-2.6.36.4 ] ~ [ linux-2.6.35.14 ] ~ [ linux-2.6.34.15 ] ~ [ linux-2.6.33.20 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  2  *
  3  * This program is free software; you can redistribute it and/or modify
  4  * it under the terms of the GNU General Public License version 2 as
  5  * published by the Free Software Foundation.
  6  */
  7 
  8 /* Kernel module implementing an IP set type: the hash:ip,port type */
  9 
 10 #include <linux/jhash.h>
 11 #include <linux/module.h>
 12 #include <linux/ip.h>
 13 #include <linux/skbuff.h>
 14 #include <linux/errno.h>
 15 #include <linux/random.h>
 16 #include <net/ip.h>
 17 #include <net/ipv6.h>
 18 #include <net/netlink.h>
 19 #include <net/tcp.h>
 20 
 21 #include <linux/netfilter.h>
 22 #include <linux/netfilter/ipset/pfxlen.h>
 23 #include <linux/netfilter/ipset/ip_set.h>
 24 #include <linux/netfilter/ipset/ip_set_getport.h>
 25 #include <linux/netfilter/ipset/ip_set_hash.h>
 26 
 27 #define IPSET_TYPE_REV_MIN      0
 28 /*                              1    SCTP and UDPLITE support added */
 29 /*                              2    Counters support added */
 30 /*                              3    Comments support added */
 31 /*                              4    Forceadd support added */
 32 #define IPSET_TYPE_REV_MAX      5 /* skbinfo support added */
 33 
 34 MODULE_LICENSE("GPL");
 35 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
 36 IP_SET_MODULE_DESC("hash:ip,port", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
 37 MODULE_ALIAS("ip_set_hash:ip,port");
 38 
 39 /* Type specific function prefix */
 40 #define HTYPE           hash_ipport
 41 
 42 /* IPv4 variant */
 43 
 44 /* Member elements */
 45 struct hash_ipport4_elem {
 46         __be32 ip;
 47         __be16 port;
 48         u8 proto;
 49         u8 padding;
 50 };
 51 
 52 /* Common functions */
 53 
 54 static inline bool
 55 hash_ipport4_data_equal(const struct hash_ipport4_elem *ip1,
 56                         const struct hash_ipport4_elem *ip2,
 57                         u32 *multi)
 58 {
 59         return ip1->ip == ip2->ip &&
 60                ip1->port == ip2->port &&
 61                ip1->proto == ip2->proto;
 62 }
 63 
 64 static bool
 65 hash_ipport4_data_list(struct sk_buff *skb,
 66                        const struct hash_ipport4_elem *data)
 67 {
 68         if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) ||
 69             nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
 70             nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto))
 71                 goto nla_put_failure;
 72         return false;
 73 
 74 nla_put_failure:
 75         return true;
 76 }
 77 
 78 static inline void
 79 hash_ipport4_data_next(struct hash_ipport4_elem *next,
 80                        const struct hash_ipport4_elem *d)
 81 {
 82         next->ip = d->ip;
 83         next->port = d->port;
 84 }
 85 
 86 #define MTYPE           hash_ipport4
 87 #define HOST_MASK       32
 88 #include "ip_set_hash_gen.h"
 89 
 90 static int
 91 hash_ipport4_kadt(struct ip_set *set, const struct sk_buff *skb,
 92                   const struct xt_action_param *par,
 93                   enum ipset_adt adt, struct ip_set_adt_opt *opt)
 94 {
 95         ipset_adtfn adtfn = set->variant->adt[adt];
 96         struct hash_ipport4_elem e = { .ip = 0 };
 97         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
 98 
 99         if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
100                                  &e.port, &e.proto))
101                 return -EINVAL;
102 
103         ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip);
104         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
105 }
106 
107 static int
108 hash_ipport4_uadt(struct ip_set *set, struct nlattr *tb[],
109                   enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
110 {
111         const struct hash_ipport4 *h = set->data;
112         ipset_adtfn adtfn = set->variant->adt[adt];
113         struct hash_ipport4_elem e = { .ip = 0 };
114         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
115         u32 ip, ip_to = 0, p = 0, port, port_to;
116         bool with_ports = false;
117         int ret;
118 
119         if (tb[IPSET_ATTR_LINENO])
120                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
121 
122         if (unlikely(!tb[IPSET_ATTR_IP] ||
123                      !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
124                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO)))
125                 return -IPSET_ERR_PROTOCOL;
126 
127         ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP], &e.ip);
128         if (ret)
129                 return ret;
130 
131         ret = ip_set_get_extensions(set, tb, &ext);
132         if (ret)
133                 return ret;
134 
135         e.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
136 
137         if (tb[IPSET_ATTR_PROTO]) {
138                 e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
139                 with_ports = ip_set_proto_with_ports(e.proto);
140 
141                 if (e.proto == 0)
142                         return -IPSET_ERR_INVALID_PROTO;
143         } else {
144                 return -IPSET_ERR_MISSING_PROTO;
145         }
146 
147         if (!(with_ports || e.proto == IPPROTO_ICMP))
148                 e.port = 0;
149 
150         if (adt == IPSET_TEST ||
151             !(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_CIDR] ||
152               tb[IPSET_ATTR_PORT_TO])) {
153                 ret = adtfn(set, &e, &ext, &ext, flags);
154                 return ip_set_eexist(ret, flags) ? 0 : ret;
155         }
156 
157         ip_to = ip = ntohl(e.ip);
158         if (tb[IPSET_ATTR_IP_TO]) {
159                 ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
160                 if (ret)
161                         return ret;
162                 if (ip > ip_to)
163                         swap(ip, ip_to);
164         } else if (tb[IPSET_ATTR_CIDR]) {
165                 u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
166 
167                 if (!cidr || cidr > HOST_MASK)
168                         return -IPSET_ERR_INVALID_CIDR;
169                 ip_set_mask_from_to(ip, ip_to, cidr);
170         }
171 
172         port_to = port = ntohs(e.port);
173         if (with_ports && tb[IPSET_ATTR_PORT_TO]) {
174                 port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
175                 if (port > port_to)
176                         swap(port, port_to);
177         }
178 
179         if (retried)
180                 ip = ntohl(h->next.ip);
181         for (; ip <= ip_to; ip++) {
182                 p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
183                                                        : port;
184                 for (; p <= port_to; p++) {
185                         e.ip = htonl(ip);
186                         e.port = htons(p);
187                         ret = adtfn(set, &e, &ext, &ext, flags);
188 
189                         if (ret && !ip_set_eexist(ret, flags))
190                                 return ret;
191 
192                         ret = 0;
193                 }
194         }
195         return ret;
196 }
197 
198 /* IPv6 variant */
199 
200 struct hash_ipport6_elem {
201         union nf_inet_addr ip;
202         __be16 port;
203         u8 proto;
204         u8 padding;
205 };
206 
207 /* Common functions */
208 
209 static inline bool
210 hash_ipport6_data_equal(const struct hash_ipport6_elem *ip1,
211                         const struct hash_ipport6_elem *ip2,
212                         u32 *multi)
213 {
214         return ipv6_addr_equal(&ip1->ip.in6, &ip2->ip.in6) &&
215                ip1->port == ip2->port &&
216                ip1->proto == ip2->proto;
217 }
218 
219 static bool
220 hash_ipport6_data_list(struct sk_buff *skb,
221                        const struct hash_ipport6_elem *data)
222 {
223         if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6) ||
224             nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
225             nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto))
226                 goto nla_put_failure;
227         return false;
228 
229 nla_put_failure:
230         return true;
231 }
232 
233 static inline void
234 hash_ipport6_data_next(struct hash_ipport6_elem *next,
235                        const struct hash_ipport6_elem *d)
236 {
237         next->port = d->port;
238 }
239 
240 #undef MTYPE
241 #undef HOST_MASK
242 
243 #define MTYPE           hash_ipport6
244 #define HOST_MASK       128
245 #define IP_SET_EMIT_CREATE
246 #include "ip_set_hash_gen.h"
247 
248 static int
249 hash_ipport6_kadt(struct ip_set *set, const struct sk_buff *skb,
250                   const struct xt_action_param *par,
251                   enum ipset_adt adt, struct ip_set_adt_opt *opt)
252 {
253         ipset_adtfn adtfn = set->variant->adt[adt];
254         struct hash_ipport6_elem e = { .ip = { .all = { 0 } } };
255         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
256 
257         if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
258                                  &e.port, &e.proto))
259                 return -EINVAL;
260 
261         ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip.in6);
262         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
263 }
264 
265 static int
266 hash_ipport6_uadt(struct ip_set *set, struct nlattr *tb[],
267                   enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
268 {
269         const struct hash_ipport6 *h = set->data;
270         ipset_adtfn adtfn = set->variant->adt[adt];
271         struct hash_ipport6_elem e = { .ip = { .all = { 0 } } };
272         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
273         u32 port, port_to;
274         bool with_ports = false;
275         int ret;
276 
277         if (tb[IPSET_ATTR_LINENO])
278                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
279 
280         if (unlikely(!tb[IPSET_ATTR_IP] ||
281                      !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
282                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO)))
283                 return -IPSET_ERR_PROTOCOL;
284         if (unlikely(tb[IPSET_ATTR_IP_TO]))
285                 return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
286         if (unlikely(tb[IPSET_ATTR_CIDR])) {
287                 u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
288 
289                 if (cidr != HOST_MASK)
290                         return -IPSET_ERR_INVALID_CIDR;
291         }
292 
293         ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip);
294         if (ret)
295                 return ret;
296 
297         ret = ip_set_get_extensions(set, tb, &ext);
298         if (ret)
299                 return ret;
300 
301         e.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
302 
303         if (tb[IPSET_ATTR_PROTO]) {
304                 e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
305                 with_ports = ip_set_proto_with_ports(e.proto);
306 
307                 if (e.proto == 0)
308                         return -IPSET_ERR_INVALID_PROTO;
309         } else {
310                 return -IPSET_ERR_MISSING_PROTO;
311         }
312 
313         if (!(with_ports || e.proto == IPPROTO_ICMPV6))
314                 e.port = 0;
315 
316         if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
317                 ret = adtfn(set, &e, &ext, &ext, flags);
318                 return ip_set_eexist(ret, flags) ? 0 : ret;
319         }
320 
321         port = ntohs(e.port);
322         port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
323         if (port > port_to)
324                 swap(port, port_to);
325 
326         if (retried)
327                 port = ntohs(h->next.port);
328         for (; port <= port_to; port++) {
329                 e.port = htons(port);
330                 ret = adtfn(set, &e, &ext, &ext, flags);
331 
332                 if (ret && !ip_set_eexist(ret, flags))
333                         return ret;
334 
335                 ret = 0;
336         }
337         return ret;
338 }
339 
340 static struct ip_set_type hash_ipport_type __read_mostly = {
341         .name           = "hash:ip,port",
342         .protocol       = IPSET_PROTOCOL,
343         .features       = IPSET_TYPE_IP | IPSET_TYPE_PORT,
344         .dimension      = IPSET_DIM_TWO,
345         .family         = NFPROTO_UNSPEC,
346         .revision_min   = IPSET_TYPE_REV_MIN,
347         .revision_max   = IPSET_TYPE_REV_MAX,
348         .create         = hash_ipport_create,
349         .create_policy  = {
350                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
351                 [IPSET_ATTR_MAXELEM]    = { .type = NLA_U32 },
352                 [IPSET_ATTR_PROBES]     = { .type = NLA_U8 },
353                 [IPSET_ATTR_RESIZE]     = { .type = NLA_U8  },
354                 [IPSET_ATTR_PROTO]      = { .type = NLA_U8 },
355                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
356                 [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
357         },
358         .adt_policy     = {
359                 [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
360                 [IPSET_ATTR_IP_TO]      = { .type = NLA_NESTED },
361                 [IPSET_ATTR_PORT]       = { .type = NLA_U16 },
362                 [IPSET_ATTR_PORT_TO]    = { .type = NLA_U16 },
363                 [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
364                 [IPSET_ATTR_PROTO]      = { .type = NLA_U8 },
365                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
366                 [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
367                 [IPSET_ATTR_BYTES]      = { .type = NLA_U64 },
368                 [IPSET_ATTR_PACKETS]    = { .type = NLA_U64 },
369                 [IPSET_ATTR_COMMENT]    = { .type = NLA_NUL_STRING,
370                                             .len  = IPSET_MAX_COMMENT_SIZE },
371                 [IPSET_ATTR_SKBMARK]    = { .type = NLA_U64 },
372                 [IPSET_ATTR_SKBPRIO]    = { .type = NLA_U32 },
373                 [IPSET_ATTR_SKBQUEUE]   = { .type = NLA_U16 },
374         },
375         .me             = THIS_MODULE,
376 };
377 
378 static int __init
379 hash_ipport_init(void)
380 {
381         return ip_set_type_register(&hash_ipport_type);
382 }
383 
384 static void __exit
385 hash_ipport_fini(void)
386 {
387         rcu_barrier();
388         ip_set_type_unregister(&hash_ipport_type);
389 }
390 
391 module_init(hash_ipport_init);
392 module_exit(hash_ipport_fini);
393 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp