~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/ipset/ip_set_hash_ipportip.c

Version: ~ [ linux-5.14-rc3 ] ~ [ linux-5.13.5 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.53 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.135 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.198 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.240 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.276 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.276 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0-only
  2 /* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@netfilter.org> */
  3 
  4 /* Kernel module implementing an IP set type: the hash:ip,port,ip type */
  5 
  6 #include <linux/jhash.h>
  7 #include <linux/module.h>
  8 #include <linux/ip.h>
  9 #include <linux/skbuff.h>
 10 #include <linux/errno.h>
 11 #include <linux/random.h>
 12 #include <net/ip.h>
 13 #include <net/ipv6.h>
 14 #include <net/netlink.h>
 15 #include <net/tcp.h>
 16 
 17 #include <linux/netfilter.h>
 18 #include <linux/netfilter/ipset/pfxlen.h>
 19 #include <linux/netfilter/ipset/ip_set.h>
 20 #include <linux/netfilter/ipset/ip_set_getport.h>
 21 #include <linux/netfilter/ipset/ip_set_hash.h>
 22 
 23 #define IPSET_TYPE_REV_MIN      0
 24 /*                              1    SCTP and UDPLITE support added */
 25 /*                              2    Counters support added */
 26 /*                              3    Comments support added */
 27 /*                              4    Forceadd support added */
 28 /*                              5    skbinfo support added */
 29 #define IPSET_TYPE_REV_MAX      6 /* bucketsize, initval support added */
 30 
 31 MODULE_LICENSE("GPL");
 32 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
 33 IP_SET_MODULE_DESC("hash:ip,port,ip", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
 34 MODULE_ALIAS("ip_set_hash:ip,port,ip");
 35 
 36 /* Type specific function prefix */
 37 #define HTYPE           hash_ipportip
 38 
 39 /* IPv4 variant */
 40 
 41 /* Member elements  */
 42 struct hash_ipportip4_elem {
 43         __be32 ip;
 44         __be32 ip2;
 45         __be16 port;
 46         u8 proto;
 47         u8 padding;
 48 };
 49 
 50 static bool
 51 hash_ipportip4_data_equal(const struct hash_ipportip4_elem *ip1,
 52                           const struct hash_ipportip4_elem *ip2,
 53                           u32 *multi)
 54 {
 55         return ip1->ip == ip2->ip &&
 56                ip1->ip2 == ip2->ip2 &&
 57                ip1->port == ip2->port &&
 58                ip1->proto == ip2->proto;
 59 }
 60 
 61 static bool
 62 hash_ipportip4_data_list(struct sk_buff *skb,
 63                          const struct hash_ipportip4_elem *data)
 64 {
 65         if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) ||
 66             nla_put_ipaddr4(skb, IPSET_ATTR_IP2, data->ip2) ||
 67             nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
 68             nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto))
 69                 goto nla_put_failure;
 70         return false;
 71 
 72 nla_put_failure:
 73         return true;
 74 }
 75 
 76 static void
 77 hash_ipportip4_data_next(struct hash_ipportip4_elem *next,
 78                          const struct hash_ipportip4_elem *d)
 79 {
 80         next->ip = d->ip;
 81         next->port = d->port;
 82 }
 83 
 84 /* Common functions */
 85 #define MTYPE           hash_ipportip4
 86 #define HOST_MASK       32
 87 #include "ip_set_hash_gen.h"
 88 
 89 static int
 90 hash_ipportip4_kadt(struct ip_set *set, const struct sk_buff *skb,
 91                     const struct xt_action_param *par,
 92                     enum ipset_adt adt, struct ip_set_adt_opt *opt)
 93 {
 94         ipset_adtfn adtfn = set->variant->adt[adt];
 95         struct hash_ipportip4_elem e = { .ip = 0 };
 96         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
 97 
 98         if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
 99                                  &e.port, &e.proto))
100                 return -EINVAL;
101 
102         ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip);
103         ip4addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &e.ip2);
104         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
105 }
106 
107 static int
108 hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[],
109                     enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
110 {
111         const struct hash_ipportip4 *h = set->data;
112         ipset_adtfn adtfn = set->variant->adt[adt];
113         struct hash_ipportip4_elem e = { .ip = 0 };
114         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
115         u32 ip, ip_to = 0, p = 0, port, port_to;
116         bool with_ports = false;
117         int ret;
118 
119         if (tb[IPSET_ATTR_LINENO])
120                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
121 
122         if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
123                      !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
124                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO)))
125                 return -IPSET_ERR_PROTOCOL;
126 
127         ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP], &e.ip);
128         if (ret)
129                 return ret;
130 
131         ret = ip_set_get_extensions(set, tb, &ext);
132         if (ret)
133                 return ret;
134 
135         ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP2], &e.ip2);
136         if (ret)
137                 return ret;
138 
139         e.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
140 
141         if (tb[IPSET_ATTR_PROTO]) {
142                 e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
143                 with_ports = ip_set_proto_with_ports(e.proto);
144 
145                 if (e.proto == 0)
146                         return -IPSET_ERR_INVALID_PROTO;
147         } else {
148                 return -IPSET_ERR_MISSING_PROTO;
149         }
150 
151         if (!(with_ports || e.proto == IPPROTO_ICMP))
152                 e.port = 0;
153 
154         if (adt == IPSET_TEST ||
155             !(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_CIDR] ||
156               tb[IPSET_ATTR_PORT_TO])) {
157                 ret = adtfn(set, &e, &ext, &ext, flags);
158                 return ip_set_eexist(ret, flags) ? 0 : ret;
159         }
160 
161         ip_to = ip = ntohl(e.ip);
162         if (tb[IPSET_ATTR_IP_TO]) {
163                 ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
164                 if (ret)
165                         return ret;
166                 if (ip > ip_to)
167                         swap(ip, ip_to);
168         } else if (tb[IPSET_ATTR_CIDR]) {
169                 u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
170 
171                 if (!cidr || cidr > HOST_MASK)
172                         return -IPSET_ERR_INVALID_CIDR;
173                 ip_set_mask_from_to(ip, ip_to, cidr);
174         }
175 
176         port_to = port = ntohs(e.port);
177         if (with_ports && tb[IPSET_ATTR_PORT_TO]) {
178                 port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
179                 if (port > port_to)
180                         swap(port, port_to);
181         }
182 
183         if (retried)
184                 ip = ntohl(h->next.ip);
185         for (; ip <= ip_to; ip++) {
186                 p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
187                                                        : port;
188                 for (; p <= port_to; p++) {
189                         e.ip = htonl(ip);
190                         e.port = htons(p);
191                         ret = adtfn(set, &e, &ext, &ext, flags);
192 
193                         if (ret && !ip_set_eexist(ret, flags))
194                                 return ret;
195 
196                         ret = 0;
197                 }
198         }
199         return ret;
200 }
201 
202 /* IPv6 variant */
203 
204 struct hash_ipportip6_elem {
205         union nf_inet_addr ip;
206         union nf_inet_addr ip2;
207         __be16 port;
208         u8 proto;
209         u8 padding;
210 };
211 
212 /* Common functions */
213 
214 static bool
215 hash_ipportip6_data_equal(const struct hash_ipportip6_elem *ip1,
216                           const struct hash_ipportip6_elem *ip2,
217                           u32 *multi)
218 {
219         return ipv6_addr_equal(&ip1->ip.in6, &ip2->ip.in6) &&
220                ipv6_addr_equal(&ip1->ip2.in6, &ip2->ip2.in6) &&
221                ip1->port == ip2->port &&
222                ip1->proto == ip2->proto;
223 }
224 
225 static bool
226 hash_ipportip6_data_list(struct sk_buff *skb,
227                          const struct hash_ipportip6_elem *data)
228 {
229         if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6) ||
230             nla_put_ipaddr6(skb, IPSET_ATTR_IP2, &data->ip2.in6) ||
231             nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
232             nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto))
233                 goto nla_put_failure;
234         return false;
235 
236 nla_put_failure:
237         return true;
238 }
239 
240 static void
241 hash_ipportip6_data_next(struct hash_ipportip6_elem *next,
242                          const struct hash_ipportip6_elem *d)
243 {
244         next->port = d->port;
245 }
246 
247 #undef MTYPE
248 #undef HOST_MASK
249 
250 #define MTYPE           hash_ipportip6
251 #define HOST_MASK       128
252 #define IP_SET_EMIT_CREATE
253 #include "ip_set_hash_gen.h"
254 
255 static int
256 hash_ipportip6_kadt(struct ip_set *set, const struct sk_buff *skb,
257                     const struct xt_action_param *par,
258                     enum ipset_adt adt, struct ip_set_adt_opt *opt)
259 {
260         ipset_adtfn adtfn = set->variant->adt[adt];
261         struct hash_ipportip6_elem e = { .ip = { .all = { 0 } } };
262         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
263 
264         if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
265                                  &e.port, &e.proto))
266                 return -EINVAL;
267 
268         ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip.in6);
269         ip6addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &e.ip2.in6);
270         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
271 }
272 
273 static int
274 hash_ipportip6_uadt(struct ip_set *set, struct nlattr *tb[],
275                     enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
276 {
277         const struct hash_ipportip6 *h = set->data;
278         ipset_adtfn adtfn = set->variant->adt[adt];
279         struct hash_ipportip6_elem e = {  .ip = { .all = { 0 } } };
280         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
281         u32 port, port_to;
282         bool with_ports = false;
283         int ret;
284 
285         if (tb[IPSET_ATTR_LINENO])
286                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
287 
288         if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
289                      !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
290                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO)))
291                 return -IPSET_ERR_PROTOCOL;
292         if (unlikely(tb[IPSET_ATTR_IP_TO]))
293                 return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
294         if (unlikely(tb[IPSET_ATTR_CIDR])) {
295                 u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
296 
297                 if (cidr != HOST_MASK)
298                         return -IPSET_ERR_INVALID_CIDR;
299         }
300 
301         ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip);
302         if (ret)
303                 return ret;
304 
305         ret = ip_set_get_extensions(set, tb, &ext);
306         if (ret)
307                 return ret;
308 
309         ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP2], &e.ip2);
310         if (ret)
311                 return ret;
312 
313         e.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
314 
315         if (tb[IPSET_ATTR_PROTO]) {
316                 e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
317                 with_ports = ip_set_proto_with_ports(e.proto);
318 
319                 if (e.proto == 0)
320                         return -IPSET_ERR_INVALID_PROTO;
321         } else {
322                 return -IPSET_ERR_MISSING_PROTO;
323         }
324 
325         if (!(with_ports || e.proto == IPPROTO_ICMPV6))
326                 e.port = 0;
327 
328         if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
329                 ret = adtfn(set, &e, &ext, &ext, flags);
330                 return ip_set_eexist(ret, flags) ? 0 : ret;
331         }
332 
333         port = ntohs(e.port);
334         port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
335         if (port > port_to)
336                 swap(port, port_to);
337 
338         if (retried)
339                 port = ntohs(h->next.port);
340         for (; port <= port_to; port++) {
341                 e.port = htons(port);
342                 ret = adtfn(set, &e, &ext, &ext, flags);
343 
344                 if (ret && !ip_set_eexist(ret, flags))
345                         return ret;
346 
347                 ret = 0;
348         }
349         return ret;
350 }
351 
352 static struct ip_set_type hash_ipportip_type __read_mostly = {
353         .name           = "hash:ip,port,ip",
354         .protocol       = IPSET_PROTOCOL,
355         .features       = IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_TYPE_IP2,
356         .dimension      = IPSET_DIM_THREE,
357         .family         = NFPROTO_UNSPEC,
358         .revision_min   = IPSET_TYPE_REV_MIN,
359         .revision_max   = IPSET_TYPE_REV_MAX,
360         .create_flags[IPSET_TYPE_REV_MAX] = IPSET_CREATE_FLAG_BUCKETSIZE,
361         .create         = hash_ipportip_create,
362         .create_policy  = {
363                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
364                 [IPSET_ATTR_MAXELEM]    = { .type = NLA_U32 },
365                 [IPSET_ATTR_INITVAL]    = { .type = NLA_U32 },
366                 [IPSET_ATTR_BUCKETSIZE] = { .type = NLA_U8 },
367                 [IPSET_ATTR_RESIZE]     = { .type = NLA_U8  },
368                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
369                 [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
370         },
371         .adt_policy     = {
372                 [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
373                 [IPSET_ATTR_IP_TO]      = { .type = NLA_NESTED },
374                 [IPSET_ATTR_IP2]        = { .type = NLA_NESTED },
375                 [IPSET_ATTR_PORT]       = { .type = NLA_U16 },
376                 [IPSET_ATTR_PORT_TO]    = { .type = NLA_U16 },
377                 [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
378                 [IPSET_ATTR_PROTO]      = { .type = NLA_U8 },
379                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
380                 [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
381                 [IPSET_ATTR_BYTES]      = { .type = NLA_U64 },
382                 [IPSET_ATTR_PACKETS]    = { .type = NLA_U64 },
383                 [IPSET_ATTR_COMMENT]    = { .type = NLA_NUL_STRING,
384                                             .len  = IPSET_MAX_COMMENT_SIZE },
385                 [IPSET_ATTR_SKBMARK]    = { .type = NLA_U64 },
386                 [IPSET_ATTR_SKBPRIO]    = { .type = NLA_U32 },
387                 [IPSET_ATTR_SKBQUEUE]   = { .type = NLA_U16 },
388         },
389         .me             = THIS_MODULE,
390 };
391 
392 static int __init
393 hash_ipportip_init(void)
394 {
395         return ip_set_type_register(&hash_ipportip_type);
396 }
397 
398 static void __exit
399 hash_ipportip_fini(void)
400 {
401         rcu_barrier();
402         ip_set_type_unregister(&hash_ipportip_type);
403 }
404 
405 module_init(hash_ipportip_init);
406 module_exit(hash_ipportip_fini);
407 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp