]>
Commit | Line | Data |
---|---|---|
5d50e1d8 | 1 | /* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> |
07896ed3 JK |
2 | * |
3 | * This program is free software; you can redistribute it and/or modify | |
4 | * it under the terms of the GNU General Public License version 2 as | |
5 | * published by the Free Software Foundation. | |
6 | */ | |
7 | ||
8 | /* Kernel module implementing an IP set type: the hash:ip,port type */ | |
9 | ||
10 | #include <linux/jhash.h> | |
11 | #include <linux/module.h> | |
12 | #include <linux/ip.h> | |
13 | #include <linux/skbuff.h> | |
14 | #include <linux/errno.h> | |
07896ed3 JK |
15 | #include <linux/random.h> |
16 | #include <net/ip.h> | |
17 | #include <net/ipv6.h> | |
18 | #include <net/netlink.h> | |
19 | #include <net/tcp.h> | |
20 | ||
21 | #include <linux/netfilter.h> | |
22 | #include <linux/netfilter/ipset/pfxlen.h> | |
23 | #include <linux/netfilter/ipset/ip_set.h> | |
07896ed3 JK |
24 | #include <linux/netfilter/ipset/ip_set_getport.h> |
25 | #include <linux/netfilter/ipset/ip_set_hash.h> | |
26 | ||
35b8dcf8 JK |
27 | #define IPSET_TYPE_REV_MIN 0 |
28 | /* 1 SCTP and UDPLITE support added */ | |
fda75c6d | 29 | /* 2 Counters support added */ |
07cf8f5a | 30 | /* 3 Comments support added */ |
af331419 AD |
31 | /* 4 Forceadd support added */ |
32 | #define IPSET_TYPE_REV_MAX 5 /* skbinfo support added */ | |
10111a6e | 33 | |
07896ed3 JK |
34 | MODULE_LICENSE("GPL"); |
35 | MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>"); | |
35b8dcf8 | 36 | IP_SET_MODULE_DESC("hash:ip,port", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX); |
07896ed3 JK |
37 | MODULE_ALIAS("ip_set_hash:ip,port"); |
38 | ||
39 | /* Type specific function prefix */ | |
5d50e1d8 | 40 | #define HTYPE hash_ipport |
07896ed3 | 41 | |
03c8b234 | 42 | /* IPv4 variant */ |
07896ed3 | 43 | |
5d50e1d8 | 44 | /* Member elements */ |
07896ed3 JK |
45 | struct hash_ipport4_elem { |
46 | __be32 ip; | |
47 | __be16 port; | |
48 | u8 proto; | |
49 | u8 padding; | |
50 | }; | |
51 | ||
5d50e1d8 JK |
52 | /* Common functions */ |
53 | ||
07896ed3 JK |
54 | static inline bool |
55 | hash_ipport4_data_equal(const struct hash_ipport4_elem *ip1, | |
89dc79b7 JK |
56 | const struct hash_ipport4_elem *ip2, |
57 | u32 *multi) | |
07896ed3 JK |
58 | { |
59 | return ip1->ip == ip2->ip && | |
60 | ip1->port == ip2->port && | |
61 | ip1->proto == ip2->proto; | |
62 | } | |
63 | ||
07896ed3 JK |
64 | static bool |
65 | hash_ipport4_data_list(struct sk_buff *skb, | |
66 | const struct hash_ipport4_elem *data) | |
67 | { | |
7cf7899d DM |
68 | if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) || |
69 | nla_put_net16(skb, IPSET_ATTR_PORT, data->port) || | |
70 | nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto)) | |
71 | goto nla_put_failure; | |
07896ed3 JK |
72 | return 0; |
73 | ||
74 | nla_put_failure: | |
75 | return 1; | |
76 | } | |
77 | ||
3d14b171 | 78 | static inline void |
5d50e1d8 | 79 | hash_ipport4_data_next(struct hash_ipport4_elem *next, |
3d14b171 JK |
80 | const struct hash_ipport4_elem *d) |
81 | { | |
5d50e1d8 JK |
82 | next->ip = d->ip; |
83 | next->port = d->port; | |
3d14b171 JK |
84 | } |
85 | ||
5d50e1d8 | 86 | #define MTYPE hash_ipport4 |
5d50e1d8 JK |
87 | #define HOST_MASK 32 |
88 | #define HKEY_DATALEN sizeof(struct hash_ipport4_elem) | |
89 | #include "ip_set_hash_gen.h" | |
90 | ||
07896ed3 JK |
91 | static int |
92 | hash_ipport4_kadt(struct ip_set *set, const struct sk_buff *skb, | |
b66554cf | 93 | const struct xt_action_param *par, |
5d50e1d8 | 94 | enum ipset_adt adt, struct ip_set_adt_opt *opt) |
07896ed3 | 95 | { |
07896ed3 | 96 | ipset_adtfn adtfn = set->variant->adt[adt]; |
94729f8a | 97 | struct hash_ipport4_elem e = { .ip = 0 }; |
ca134ce8 | 98 | struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); |
07896ed3 | 99 | |
ac8cc925 | 100 | if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC, |
5d50e1d8 | 101 | &e.port, &e.proto)) |
07896ed3 JK |
102 | return -EINVAL; |
103 | ||
5d50e1d8 JK |
104 | ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip); |
105 | return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags); | |
07896ed3 JK |
106 | } |
107 | ||
108 | static int | |
109 | hash_ipport4_uadt(struct ip_set *set, struct nlattr *tb[], | |
3d14b171 | 110 | enum ipset_adt adt, u32 *lineno, u32 flags, bool retried) |
07896ed3 | 111 | { |
5d50e1d8 | 112 | const struct hash_ipport *h = set->data; |
07896ed3 | 113 | ipset_adtfn adtfn = set->variant->adt[adt]; |
94729f8a | 114 | struct hash_ipport4_elem e = { .ip = 0 }; |
ca134ce8 | 115 | struct ip_set_ext ext = IP_SET_INIT_UEXT(set); |
20b2fab4 | 116 | u32 ip, ip_to = 0, p = 0, port, port_to; |
5e0c1eb7 | 117 | bool with_ports = false; |
07896ed3 JK |
118 | int ret; |
119 | ||
120 | if (unlikely(!tb[IPSET_ATTR_IP] || | |
121 | !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) || | |
122 | !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) || | |
00d71b27 JK |
123 | !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) || |
124 | !ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) || | |
af331419 AD |
125 | !ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES) || |
126 | !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBMARK) || | |
127 | !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBPRIO) || | |
128 | !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBQUEUE))) | |
07896ed3 JK |
129 | return -IPSET_ERR_PROTOCOL; |
130 | ||
131 | if (tb[IPSET_ATTR_LINENO]) | |
132 | *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); | |
133 | ||
8e55d2e5 SP |
134 | ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP], &e.ip); |
135 | if (ret) | |
136 | return ret; | |
137 | ||
138 | ret = ip_set_get_extensions(set, tb, &ext); | |
07896ed3 JK |
139 | if (ret) |
140 | return ret; | |
141 | ||
d25472e4 | 142 | e.port = nla_get_be16(tb[IPSET_ATTR_PORT]); |
07896ed3 JK |
143 | |
144 | if (tb[IPSET_ATTR_PROTO]) { | |
5d50e1d8 JK |
145 | e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]); |
146 | with_ports = ip_set_proto_with_ports(e.proto); | |
07896ed3 | 147 | |
5d50e1d8 | 148 | if (e.proto == 0) |
07896ed3 JK |
149 | return -IPSET_ERR_INVALID_PROTO; |
150 | } else | |
151 | return -IPSET_ERR_MISSING_PROTO; | |
152 | ||
5d50e1d8 JK |
153 | if (!(with_ports || e.proto == IPPROTO_ICMP)) |
154 | e.port = 0; | |
07896ed3 JK |
155 | |
156 | if (adt == IPSET_TEST || | |
07896ed3 JK |
157 | !(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_CIDR] || |
158 | tb[IPSET_ATTR_PORT_TO])) { | |
5d50e1d8 | 159 | ret = adtfn(set, &e, &ext, &ext, flags); |
07896ed3 JK |
160 | return ip_set_eexist(ret, flags) ? 0 : ret; |
161 | } | |
162 | ||
5d50e1d8 | 163 | ip_to = ip = ntohl(e.ip); |
07896ed3 JK |
164 | if (tb[IPSET_ATTR_IP_TO]) { |
165 | ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to); | |
166 | if (ret) | |
167 | return ret; | |
168 | if (ip > ip_to) | |
169 | swap(ip, ip_to); | |
170 | } else if (tb[IPSET_ATTR_CIDR]) { | |
171 | u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]); | |
172 | ||
b9fed748 | 173 | if (!cidr || cidr > 32) |
07896ed3 | 174 | return -IPSET_ERR_INVALID_CIDR; |
e6146e86 | 175 | ip_set_mask_from_to(ip, ip_to, cidr); |
4fe198e6 | 176 | } |
07896ed3 | 177 | |
5d50e1d8 | 178 | port_to = port = ntohs(e.port); |
5e0c1eb7 | 179 | if (with_ports && tb[IPSET_ATTR_PORT_TO]) { |
07896ed3 JK |
180 | port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]); |
181 | if (port > port_to) | |
182 | swap(port, port_to); | |
5e0c1eb7 | 183 | } |
07896ed3 | 184 | |
3d14b171 | 185 | if (retried) |
6e27c9b4 | 186 | ip = ntohl(h->next.ip); |
3d14b171 | 187 | for (; !before(ip_to, ip); ip++) { |
6e27c9b4 JK |
188 | p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port) |
189 | : port; | |
3d14b171 | 190 | for (; p <= port_to; p++) { |
5d50e1d8 JK |
191 | e.ip = htonl(ip); |
192 | e.port = htons(p); | |
193 | ret = adtfn(set, &e, &ext, &ext, flags); | |
07896ed3 JK |
194 | |
195 | if (ret && !ip_set_eexist(ret, flags)) | |
196 | return ret; | |
197 | else | |
198 | ret = 0; | |
199 | } | |
3d14b171 | 200 | } |
07896ed3 JK |
201 | return ret; |
202 | } | |
203 | ||
03c8b234 | 204 | /* IPv6 variant */ |
07896ed3 JK |
205 | |
206 | struct hash_ipport6_elem { | |
207 | union nf_inet_addr ip; | |
208 | __be16 port; | |
209 | u8 proto; | |
210 | u8 padding; | |
211 | }; | |
212 | ||
5d50e1d8 JK |
213 | /* Common functions */ |
214 | ||
07896ed3 JK |
215 | static inline bool |
216 | hash_ipport6_data_equal(const struct hash_ipport6_elem *ip1, | |
89dc79b7 JK |
217 | const struct hash_ipport6_elem *ip2, |
218 | u32 *multi) | |
07896ed3 | 219 | { |
29e3b160 | 220 | return ipv6_addr_equal(&ip1->ip.in6, &ip2->ip.in6) && |
07896ed3 JK |
221 | ip1->port == ip2->port && |
222 | ip1->proto == ip2->proto; | |
223 | } | |
224 | ||
07896ed3 JK |
225 | static bool |
226 | hash_ipport6_data_list(struct sk_buff *skb, | |
227 | const struct hash_ipport6_elem *data) | |
228 | { | |
7cf7899d DM |
229 | if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6) || |
230 | nla_put_net16(skb, IPSET_ATTR_PORT, data->port) || | |
231 | nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto)) | |
232 | goto nla_put_failure; | |
07896ed3 JK |
233 | return 0; |
234 | ||
235 | nla_put_failure: | |
236 | return 1; | |
237 | } | |
238 | ||
5d50e1d8 JK |
239 | static inline void |
240 | hash_ipport6_data_next(struct hash_ipport4_elem *next, | |
241 | const struct hash_ipport6_elem *d) | |
07896ed3 | 242 | { |
5d50e1d8 | 243 | next->port = d->port; |
07896ed3 JK |
244 | } |
245 | ||
5d50e1d8 | 246 | #undef MTYPE |
07896ed3 | 247 | #undef HOST_MASK |
5d50e1d8 | 248 | #undef HKEY_DATALEN |
07896ed3 | 249 | |
5d50e1d8 | 250 | #define MTYPE hash_ipport6 |
07896ed3 | 251 | #define HOST_MASK 128 |
5d50e1d8 JK |
252 | #define HKEY_DATALEN sizeof(struct hash_ipport6_elem) |
253 | #define IP_SET_EMIT_CREATE | |
254 | #include "ip_set_hash_gen.h" | |
3d14b171 | 255 | |
07896ed3 JK |
256 | static int |
257 | hash_ipport6_kadt(struct ip_set *set, const struct sk_buff *skb, | |
b66554cf | 258 | const struct xt_action_param *par, |
5d50e1d8 | 259 | enum ipset_adt adt, struct ip_set_adt_opt *opt) |
07896ed3 | 260 | { |
07896ed3 | 261 | ipset_adtfn adtfn = set->variant->adt[adt]; |
94729f8a | 262 | struct hash_ipport6_elem e = { .ip = { .all = { 0 } } }; |
ca134ce8 | 263 | struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); |
07896ed3 | 264 | |
ac8cc925 | 265 | if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC, |
5d50e1d8 | 266 | &e.port, &e.proto)) |
07896ed3 JK |
267 | return -EINVAL; |
268 | ||
5d50e1d8 JK |
269 | ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip.in6); |
270 | return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags); | |
07896ed3 JK |
271 | } |
272 | ||
273 | static int | |
274 | hash_ipport6_uadt(struct ip_set *set, struct nlattr *tb[], | |
3d14b171 | 275 | enum ipset_adt adt, u32 *lineno, u32 flags, bool retried) |
07896ed3 | 276 | { |
5d50e1d8 | 277 | const struct hash_ipport *h = set->data; |
07896ed3 | 278 | ipset_adtfn adtfn = set->variant->adt[adt]; |
94729f8a | 279 | struct hash_ipport6_elem e = { .ip = { .all = { 0 } } }; |
ca134ce8 | 280 | struct ip_set_ext ext = IP_SET_INIT_UEXT(set); |
07896ed3 | 281 | u32 port, port_to; |
5e0c1eb7 | 282 | bool with_ports = false; |
07896ed3 JK |
283 | int ret; |
284 | ||
285 | if (unlikely(!tb[IPSET_ATTR_IP] || | |
286 | !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) || | |
287 | !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) || | |
288 | !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) || | |
00d71b27 JK |
289 | !ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) || |
290 | !ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES) || | |
af331419 AD |
291 | !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBMARK) || |
292 | !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBPRIO) || | |
293 | !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBQUEUE) || | |
07896ed3 JK |
294 | tb[IPSET_ATTR_IP_TO] || |
295 | tb[IPSET_ATTR_CIDR])) | |
296 | return -IPSET_ERR_PROTOCOL; | |
297 | ||
298 | if (tb[IPSET_ATTR_LINENO]) | |
299 | *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); | |
300 | ||
8e55d2e5 SP |
301 | ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip); |
302 | if (ret) | |
303 | return ret; | |
304 | ||
305 | ret = ip_set_get_extensions(set, tb, &ext); | |
07896ed3 JK |
306 | if (ret) |
307 | return ret; | |
308 | ||
d25472e4 | 309 | e.port = nla_get_be16(tb[IPSET_ATTR_PORT]); |
07896ed3 JK |
310 | |
311 | if (tb[IPSET_ATTR_PROTO]) { | |
5d50e1d8 JK |
312 | e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]); |
313 | with_ports = ip_set_proto_with_ports(e.proto); | |
07896ed3 | 314 | |
5d50e1d8 | 315 | if (e.proto == 0) |
07896ed3 JK |
316 | return -IPSET_ERR_INVALID_PROTO; |
317 | } else | |
318 | return -IPSET_ERR_MISSING_PROTO; | |
319 | ||
5d50e1d8 JK |
320 | if (!(with_ports || e.proto == IPPROTO_ICMPV6)) |
321 | e.port = 0; | |
07896ed3 | 322 | |
5e0c1eb7 | 323 | if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) { |
5d50e1d8 | 324 | ret = adtfn(set, &e, &ext, &ext, flags); |
07896ed3 JK |
325 | return ip_set_eexist(ret, flags) ? 0 : ret; |
326 | } | |
327 | ||
5d50e1d8 | 328 | port = ntohs(e.port); |
07896ed3 JK |
329 | port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]); |
330 | if (port > port_to) | |
331 | swap(port, port_to); | |
332 | ||
3d14b171 | 333 | if (retried) |
6e27c9b4 | 334 | port = ntohs(h->next.port); |
07896ed3 | 335 | for (; port <= port_to; port++) { |
5d50e1d8 JK |
336 | e.port = htons(port); |
337 | ret = adtfn(set, &e, &ext, &ext, flags); | |
07896ed3 JK |
338 | |
339 | if (ret && !ip_set_eexist(ret, flags)) | |
340 | return ret; | |
341 | else | |
342 | ret = 0; | |
343 | } | |
344 | return ret; | |
345 | } | |
346 | ||
07896ed3 JK |
347 | static struct ip_set_type hash_ipport_type __read_mostly = { |
348 | .name = "hash:ip,port", | |
349 | .protocol = IPSET_PROTOCOL, | |
350 | .features = IPSET_TYPE_IP | IPSET_TYPE_PORT, | |
351 | .dimension = IPSET_DIM_TWO, | |
c15f1c83 | 352 | .family = NFPROTO_UNSPEC, |
35b8dcf8 JK |
353 | .revision_min = IPSET_TYPE_REV_MIN, |
354 | .revision_max = IPSET_TYPE_REV_MAX, | |
07896ed3 JK |
355 | .create = hash_ipport_create, |
356 | .create_policy = { | |
357 | [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 }, | |
358 | [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 }, | |
359 | [IPSET_ATTR_PROBES] = { .type = NLA_U8 }, | |
360 | [IPSET_ATTR_RESIZE] = { .type = NLA_U8 }, | |
361 | [IPSET_ATTR_PROTO] = { .type = NLA_U8 }, | |
362 | [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, | |
00d71b27 | 363 | [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 }, |
07896ed3 JK |
364 | }, |
365 | .adt_policy = { | |
366 | [IPSET_ATTR_IP] = { .type = NLA_NESTED }, | |
367 | [IPSET_ATTR_IP_TO] = { .type = NLA_NESTED }, | |
368 | [IPSET_ATTR_PORT] = { .type = NLA_U16 }, | |
369 | [IPSET_ATTR_PORT_TO] = { .type = NLA_U16 }, | |
370 | [IPSET_ATTR_CIDR] = { .type = NLA_U8 }, | |
371 | [IPSET_ATTR_PROTO] = { .type = NLA_U8 }, | |
372 | [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, | |
373 | [IPSET_ATTR_LINENO] = { .type = NLA_U32 }, | |
00d71b27 JK |
374 | [IPSET_ATTR_BYTES] = { .type = NLA_U64 }, |
375 | [IPSET_ATTR_PACKETS] = { .type = NLA_U64 }, | |
fda75c6d | 376 | [IPSET_ATTR_COMMENT] = { .type = NLA_NUL_STRING }, |
af331419 AD |
377 | [IPSET_ATTR_SKBMARK] = { .type = NLA_U64 }, |
378 | [IPSET_ATTR_SKBPRIO] = { .type = NLA_U32 }, | |
379 | [IPSET_ATTR_SKBQUEUE] = { .type = NLA_U16 }, | |
07896ed3 JK |
380 | }, |
381 | .me = THIS_MODULE, | |
382 | }; | |
383 | ||
384 | static int __init | |
385 | hash_ipport_init(void) | |
386 | { | |
387 | return ip_set_type_register(&hash_ipport_type); | |
388 | } | |
389 | ||
390 | static void __exit | |
391 | hash_ipport_fini(void) | |
392 | { | |
393 | ip_set_type_unregister(&hash_ipport_type); | |
394 | } | |
395 | ||
396 | module_init(hash_ipport_init); | |
397 | module_exit(hash_ipport_fini); |