~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/ipset/ip_set_hash_net.c

Version: ~ [ linux-5.16-rc3 ] ~ [ linux-5.15.5 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.82 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.162 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.218 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.256 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.291 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.293 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  2  *
  3  * This program is free software; you can redistribute it and/or modify
  4  * it under the terms of the GNU General Public License version 2 as
  5  * published by the Free Software Foundation.
  6  */
  7 
  8 /* Kernel module implementing an IP set type: the hash:net type */
  9 
 10 #include <linux/jhash.h>
 11 #include <linux/module.h>
 12 #include <linux/ip.h>
 13 #include <linux/skbuff.h>
 14 #include <linux/errno.h>
 15 #include <linux/random.h>
 16 #include <net/ip.h>
 17 #include <net/ipv6.h>
 18 #include <net/netlink.h>
 19 
 20 #include <linux/netfilter.h>
 21 #include <linux/netfilter/ipset/pfxlen.h>
 22 #include <linux/netfilter/ipset/ip_set.h>
 23 #include <linux/netfilter/ipset/ip_set_hash.h>
 24 
 25 #define IPSET_TYPE_REV_MIN      0
 26 /*                              1    Range as input support for IPv4 added */
 27 /*                              2    nomatch flag support added */
 28 /*                              3    Counters support added */
 29 /*                              4    Comments support added */
 30 /*                              5    Forceadd support added */
 31 #define IPSET_TYPE_REV_MAX      6 /* skbinfo mapping support added */
 32 
 33 MODULE_LICENSE("GPL");
 34 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
 35 IP_SET_MODULE_DESC("hash:net", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
 36 MODULE_ALIAS("ip_set_hash:net");
 37 
 38 /* Type specific function prefix */
 39 #define HTYPE           hash_net
 40 #define IP_SET_HASH_WITH_NETS
 41 
 42 /* IPv4 variant */
 43 
 44 /* Member elements  */
 45 struct hash_net4_elem {
 46         __be32 ip;
 47         u16 padding0;
 48         u8 nomatch;
 49         u8 cidr;
 50 };
 51 
 52 /* Common functions */
 53 
 54 static inline bool
 55 hash_net4_data_equal(const struct hash_net4_elem *ip1,
 56                      const struct hash_net4_elem *ip2,
 57                      u32 *multi)
 58 {
 59         return ip1->ip == ip2->ip &&
 60                ip1->cidr == ip2->cidr;
 61 }
 62 
 63 static inline int
 64 hash_net4_do_data_match(const struct hash_net4_elem *elem)
 65 {
 66         return elem->nomatch ? -ENOTEMPTY : 1;
 67 }
 68 
 69 static inline void
 70 hash_net4_data_set_flags(struct hash_net4_elem *elem, u32 flags)
 71 {
 72         elem->nomatch = (flags >> 16) & IPSET_FLAG_NOMATCH;
 73 }
 74 
 75 static inline void
 76 hash_net4_data_reset_flags(struct hash_net4_elem *elem, u8 *flags)
 77 {
 78         swap(*flags, elem->nomatch);
 79 }
 80 
 81 static inline void
 82 hash_net4_data_netmask(struct hash_net4_elem *elem, u8 cidr)
 83 {
 84         elem->ip &= ip_set_netmask(cidr);
 85         elem->cidr = cidr;
 86 }
 87 
 88 static bool
 89 hash_net4_data_list(struct sk_buff *skb, const struct hash_net4_elem *data)
 90 {
 91         u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
 92 
 93         if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) ||
 94             nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr) ||
 95             (flags &&
 96              nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
 97                 goto nla_put_failure;
 98         return false;
 99 
100 nla_put_failure:
101         return true;
102 }
103 
104 static inline void
105 hash_net4_data_next(struct hash_net4_elem *next,
106                     const struct hash_net4_elem *d)
107 {
108         next->ip = d->ip;
109 }
110 
111 #define MTYPE           hash_net4
112 #define HOST_MASK       32
113 #include "ip_set_hash_gen.h"
114 
115 static int
116 hash_net4_kadt(struct ip_set *set, const struct sk_buff *skb,
117                const struct xt_action_param *par,
118                enum ipset_adt adt, struct ip_set_adt_opt *opt)
119 {
120         const struct hash_net4 *h = set->data;
121         ipset_adtfn adtfn = set->variant->adt[adt];
122         struct hash_net4_elem e = {
123                 .cidr = INIT_CIDR(h->nets[0].cidr[0], HOST_MASK),
124         };
125         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
126 
127         if (e.cidr == 0)
128                 return -EINVAL;
129         if (adt == IPSET_TEST)
130                 e.cidr = HOST_MASK;
131 
132         ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip);
133         e.ip &= ip_set_netmask(e.cidr);
134 
135         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
136 }
137 
138 static int
139 hash_net4_uadt(struct ip_set *set, struct nlattr *tb[],
140                enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
141 {
142         const struct hash_net4 *h = set->data;
143         ipset_adtfn adtfn = set->variant->adt[adt];
144         struct hash_net4_elem e = { .cidr = HOST_MASK };
145         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
146         u32 ip = 0, ip_to = 0;
147         int ret;
148 
149         if (tb[IPSET_ATTR_LINENO])
150                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
151 
152         if (unlikely(!tb[IPSET_ATTR_IP] ||
153                      !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
154                 return -IPSET_ERR_PROTOCOL;
155 
156         ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
157         if (ret)
158                 return ret;
159 
160         ret = ip_set_get_extensions(set, tb, &ext);
161         if (ret)
162                 return ret;
163 
164         if (tb[IPSET_ATTR_CIDR]) {
165                 e.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
166                 if (!e.cidr || e.cidr > HOST_MASK)
167                         return -IPSET_ERR_INVALID_CIDR;
168         }
169 
170         if (tb[IPSET_ATTR_CADT_FLAGS]) {
171                 u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
172 
173                 if (cadt_flags & IPSET_FLAG_NOMATCH)
174                         flags |= (IPSET_FLAG_NOMATCH << 16);
175         }
176 
177         if (adt == IPSET_TEST || !tb[IPSET_ATTR_IP_TO]) {
178                 e.ip = htonl(ip & ip_set_hostmask(e.cidr));
179                 ret = adtfn(set, &e, &ext, &ext, flags);
180                 return ip_set_enomatch(ret, flags, adt, set) ? -ret :
181                        ip_set_eexist(ret, flags) ? 0 : ret;
182         }
183 
184         ip_to = ip;
185         if (tb[IPSET_ATTR_IP_TO]) {
186                 ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
187                 if (ret)
188                         return ret;
189                 if (ip_to < ip)
190                         swap(ip, ip_to);
191                 if (ip + UINT_MAX == ip_to)
192                         return -IPSET_ERR_HASH_RANGE;
193         }
194         if (retried)
195                 ip = ntohl(h->next.ip);
196         do {
197                 e.ip = htonl(ip);
198                 ip = ip_set_range_to_cidr(ip, ip_to, &e.cidr);
199                 ret = adtfn(set, &e, &ext, &ext, flags);
200                 if (ret && !ip_set_eexist(ret, flags))
201                         return ret;
202 
203                 ret = 0;
204         } while (ip++ < ip_to);
205         return ret;
206 }
207 
208 /* IPv6 variant */
209 
210 struct hash_net6_elem {
211         union nf_inet_addr ip;
212         u16 padding0;
213         u8 nomatch;
214         u8 cidr;
215 };
216 
217 /* Common functions */
218 
219 static inline bool
220 hash_net6_data_equal(const struct hash_net6_elem *ip1,
221                      const struct hash_net6_elem *ip2,
222                      u32 *multi)
223 {
224         return ipv6_addr_equal(&ip1->ip.in6, &ip2->ip.in6) &&
225                ip1->cidr == ip2->cidr;
226 }
227 
228 static inline int
229 hash_net6_do_data_match(const struct hash_net6_elem *elem)
230 {
231         return elem->nomatch ? -ENOTEMPTY : 1;
232 }
233 
234 static inline void
235 hash_net6_data_set_flags(struct hash_net6_elem *elem, u32 flags)
236 {
237         elem->nomatch = (flags >> 16) & IPSET_FLAG_NOMATCH;
238 }
239 
240 static inline void
241 hash_net6_data_reset_flags(struct hash_net6_elem *elem, u8 *flags)
242 {
243         swap(*flags, elem->nomatch);
244 }
245 
246 static inline void
247 hash_net6_data_netmask(struct hash_net6_elem *elem, u8 cidr)
248 {
249         ip6_netmask(&elem->ip, cidr);
250         elem->cidr = cidr;
251 }
252 
253 static bool
254 hash_net6_data_list(struct sk_buff *skb, const struct hash_net6_elem *data)
255 {
256         u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
257 
258         if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6) ||
259             nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr) ||
260             (flags &&
261              nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
262                 goto nla_put_failure;
263         return false;
264 
265 nla_put_failure:
266         return true;
267 }
268 
269 static inline void
270 hash_net6_data_next(struct hash_net6_elem *next,
271                     const struct hash_net6_elem *d)
272 {
273 }
274 
275 #undef MTYPE
276 #undef HOST_MASK
277 
278 #define MTYPE           hash_net6
279 #define HOST_MASK       128
280 #define IP_SET_EMIT_CREATE
281 #include "ip_set_hash_gen.h"
282 
283 static int
284 hash_net6_kadt(struct ip_set *set, const struct sk_buff *skb,
285                const struct xt_action_param *par,
286                enum ipset_adt adt, struct ip_set_adt_opt *opt)
287 {
288         const struct hash_net6 *h = set->data;
289         ipset_adtfn adtfn = set->variant->adt[adt];
290         struct hash_net6_elem e = {
291                 .cidr = INIT_CIDR(h->nets[0].cidr[0], HOST_MASK),
292         };
293         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
294 
295         if (e.cidr == 0)
296                 return -EINVAL;
297         if (adt == IPSET_TEST)
298                 e.cidr = HOST_MASK;
299 
300         ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip.in6);
301         ip6_netmask(&e.ip, e.cidr);
302 
303         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
304 }
305 
306 static int
307 hash_net6_uadt(struct ip_set *set, struct nlattr *tb[],
308                enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
309 {
310         ipset_adtfn adtfn = set->variant->adt[adt];
311         struct hash_net6_elem e = { .cidr = HOST_MASK };
312         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
313         int ret;
314 
315         if (tb[IPSET_ATTR_LINENO])
316                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
317 
318         if (unlikely(!tb[IPSET_ATTR_IP] ||
319                      !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
320                 return -IPSET_ERR_PROTOCOL;
321         if (unlikely(tb[IPSET_ATTR_IP_TO]))
322                 return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
323 
324         ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip);
325         if (ret)
326                 return ret;
327 
328         ret = ip_set_get_extensions(set, tb, &ext);
329         if (ret)
330                 return ret;
331 
332         if (tb[IPSET_ATTR_CIDR]) {
333                 e.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
334                 if (!e.cidr || e.cidr > HOST_MASK)
335                         return -IPSET_ERR_INVALID_CIDR;
336         }
337 
338         ip6_netmask(&e.ip, e.cidr);
339 
340         if (tb[IPSET_ATTR_CADT_FLAGS]) {
341                 u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
342 
343                 if (cadt_flags & IPSET_FLAG_NOMATCH)
344                         flags |= (IPSET_FLAG_NOMATCH << 16);
345         }
346 
347         ret = adtfn(set, &e, &ext, &ext, flags);
348 
349         return ip_set_enomatch(ret, flags, adt, set) ? -ret :
350                ip_set_eexist(ret, flags) ? 0 : ret;
351 }
352 
353 static struct ip_set_type hash_net_type __read_mostly = {
354         .name           = "hash:net",
355         .protocol       = IPSET_PROTOCOL,
356         .features       = IPSET_TYPE_IP | IPSET_TYPE_NOMATCH,
357         .dimension      = IPSET_DIM_ONE,
358         .family         = NFPROTO_UNSPEC,
359         .revision_min   = IPSET_TYPE_REV_MIN,
360         .revision_max   = IPSET_TYPE_REV_MAX,
361         .create         = hash_net_create,
362         .create_policy  = {
363                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
364                 [IPSET_ATTR_MAXELEM]    = { .type = NLA_U32 },
365                 [IPSET_ATTR_PROBES]     = { .type = NLA_U8 },
366                 [IPSET_ATTR_RESIZE]     = { .type = NLA_U8  },
367                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
368                 [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
369         },
370         .adt_policy     = {
371                 [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
372                 [IPSET_ATTR_IP_TO]      = { .type = NLA_NESTED },
373                 [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
374                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
375                 [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
376                 [IPSET_ATTR_BYTES]      = { .type = NLA_U64 },
377                 [IPSET_ATTR_PACKETS]    = { .type = NLA_U64 },
378                 [IPSET_ATTR_COMMENT]    = { .type = NLA_NUL_STRING,
379                                             .len  = IPSET_MAX_COMMENT_SIZE },
380                 [IPSET_ATTR_SKBMARK]    = { .type = NLA_U64 },
381                 [IPSET_ATTR_SKBPRIO]    = { .type = NLA_U32 },
382                 [IPSET_ATTR_SKBQUEUE]   = { .type = NLA_U16 },
383         },
384         .me             = THIS_MODULE,
385 };
386 
387 static int __init
388 hash_net_init(void)
389 {
390         return ip_set_type_register(&hash_net_type);
391 }
392 
393 static void __exit
394 hash_net_fini(void)
395 {
396         rcu_barrier();
397         ip_set_type_unregister(&hash_net_type);
398 }
399 
400 module_init(hash_net_init);
401 module_exit(hash_net_fini);
402 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp