]>
Commit | Line | Data |
---|---|---|
d2912cb1 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
1c5ba67d | 2 | /* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@netfilter.org> */ |
5663bc30 JK |
3 | |
4 | /* Kernel module implementing an IP set type: the hash:ip,port,ip type */ | |
5 | ||
6 | #include <linux/jhash.h> | |
7 | #include <linux/module.h> | |
8 | #include <linux/ip.h> | |
9 | #include <linux/skbuff.h> | |
10 | #include <linux/errno.h> | |
5663bc30 JK |
11 | #include <linux/random.h> |
12 | #include <net/ip.h> | |
13 | #include <net/ipv6.h> | |
14 | #include <net/netlink.h> | |
15 | #include <net/tcp.h> | |
16 | ||
17 | #include <linux/netfilter.h> | |
18 | #include <linux/netfilter/ipset/pfxlen.h> | |
19 | #include <linux/netfilter/ipset/ip_set.h> | |
5663bc30 JK |
20 | #include <linux/netfilter/ipset/ip_set_getport.h> |
21 | #include <linux/netfilter/ipset/ip_set_hash.h> | |
22 | ||
35b8dcf8 JK |
23 | #define IPSET_TYPE_REV_MIN 0 |
24 | /* 1 SCTP and UDPLITE support added */ | |
fda75c6d | 25 | /* 2 Counters support added */ |
07cf8f5a | 26 | /* 3 Comments support added */ |
af331419 AD |
27 | /* 4 Forceadd support added */ |
28 | #define IPSET_TYPE_REV_MAX 5 /* skbinfo support added */ | |
10111a6e | 29 | |
5663bc30 | 30 | MODULE_LICENSE("GPL"); |
fe03d474 | 31 | MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>"); |
35b8dcf8 | 32 | IP_SET_MODULE_DESC("hash:ip,port,ip", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX); |
5663bc30 JK |
33 | MODULE_ALIAS("ip_set_hash:ip,port,ip"); |
34 | ||
35 | /* Type specific function prefix */ | |
5d50e1d8 | 36 | #define HTYPE hash_ipportip |
5663bc30 | 37 | |
03c8b234 | 38 | /* IPv4 variant */ |
5663bc30 | 39 | |
5d50e1d8 | 40 | /* Member elements */ |
5663bc30 JK |
41 | struct hash_ipportip4_elem { |
42 | __be32 ip; | |
43 | __be32 ip2; | |
44 | __be16 port; | |
45 | u8 proto; | |
46 | u8 padding; | |
47 | }; | |
48 | ||
8dea982a | 49 | static bool |
5663bc30 | 50 | hash_ipportip4_data_equal(const struct hash_ipportip4_elem *ip1, |
89dc79b7 JK |
51 | const struct hash_ipportip4_elem *ip2, |
52 | u32 *multi) | |
5663bc30 JK |
53 | { |
54 | return ip1->ip == ip2->ip && | |
55 | ip1->ip2 == ip2->ip2 && | |
56 | ip1->port == ip2->port && | |
57 | ip1->proto == ip2->proto; | |
58 | } | |
59 | ||
5663bc30 JK |
60 | static bool |
61 | hash_ipportip4_data_list(struct sk_buff *skb, | |
ca0f6a5c | 62 | const struct hash_ipportip4_elem *data) |
5663bc30 | 63 | { |
7cf7899d DM |
64 | if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) || |
65 | nla_put_ipaddr4(skb, IPSET_ATTR_IP2, data->ip2) || | |
66 | nla_put_net16(skb, IPSET_ATTR_PORT, data->port) || | |
67 | nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto)) | |
68 | goto nla_put_failure; | |
728a7e69 | 69 | return false; |
5663bc30 JK |
70 | |
71 | nla_put_failure: | |
728a7e69 | 72 | return true; |
5663bc30 JK |
73 | } |
74 | ||
8dea982a | 75 | static void |
5d50e1d8 JK |
76 | hash_ipportip4_data_next(struct hash_ipportip4_elem *next, |
77 | const struct hash_ipportip4_elem *d) | |
5663bc30 | 78 | { |
5d50e1d8 JK |
79 | next->ip = d->ip; |
80 | next->port = d->port; | |
5663bc30 JK |
81 | } |
82 | ||
5d50e1d8 JK |
83 | /* Common functions */ |
84 | #define MTYPE hash_ipportip4 | |
5663bc30 | 85 | #define HOST_MASK 32 |
5d50e1d8 | 86 | #include "ip_set_hash_gen.h" |
3d14b171 | 87 | |
5663bc30 JK |
88 | static int |
89 | hash_ipportip4_kadt(struct ip_set *set, const struct sk_buff *skb, | |
b66554cf | 90 | const struct xt_action_param *par, |
5d50e1d8 | 91 | enum ipset_adt adt, struct ip_set_adt_opt *opt) |
5663bc30 | 92 | { |
5663bc30 | 93 | ipset_adtfn adtfn = set->variant->adt[adt]; |
94729f8a | 94 | struct hash_ipportip4_elem e = { .ip = 0 }; |
ca134ce8 | 95 | struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); |
5663bc30 | 96 | |
ac8cc925 | 97 | if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC, |
5d50e1d8 | 98 | &e.port, &e.proto)) |
5663bc30 JK |
99 | return -EINVAL; |
100 | ||
5d50e1d8 JK |
101 | ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip); |
102 | ip4addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &e.ip2); | |
103 | return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags); | |
5663bc30 JK |
104 | } |
105 | ||
106 | static int | |
107 | hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[], | |
3d14b171 | 108 | enum ipset_adt adt, u32 *lineno, u32 flags, bool retried) |
5663bc30 | 109 | { |
21956ab2 | 110 | const struct hash_ipportip4 *h = set->data; |
5663bc30 | 111 | ipset_adtfn adtfn = set->variant->adt[adt]; |
94729f8a | 112 | struct hash_ipportip4_elem e = { .ip = 0 }; |
ca134ce8 | 113 | struct ip_set_ext ext = IP_SET_INIT_UEXT(set); |
20b2fab4 | 114 | u32 ip, ip_to = 0, p = 0, port, port_to; |
5e0c1eb7 | 115 | bool with_ports = false; |
5663bc30 JK |
116 | int ret; |
117 | ||
a212e08e SP |
118 | if (tb[IPSET_ATTR_LINENO]) |
119 | *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); | |
120 | ||
5663bc30 JK |
121 | if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] || |
122 | !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) || | |
7dd37bc8 | 123 | !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO))) |
5663bc30 JK |
124 | return -IPSET_ERR_PROTOCOL; |
125 | ||
8e55d2e5 SP |
126 | ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP], &e.ip); |
127 | if (ret) | |
128 | return ret; | |
129 | ||
130 | ret = ip_set_get_extensions(set, tb, &ext); | |
5663bc30 JK |
131 | if (ret) |
132 | return ret; | |
133 | ||
5d50e1d8 | 134 | ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP2], &e.ip2); |
5663bc30 JK |
135 | if (ret) |
136 | return ret; | |
137 | ||
d25472e4 | 138 | e.port = nla_get_be16(tb[IPSET_ATTR_PORT]); |
5663bc30 JK |
139 | |
140 | if (tb[IPSET_ATTR_PROTO]) { | |
5d50e1d8 JK |
141 | e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]); |
142 | with_ports = ip_set_proto_with_ports(e.proto); | |
5663bc30 | 143 | |
5d50e1d8 | 144 | if (e.proto == 0) |
5663bc30 | 145 | return -IPSET_ERR_INVALID_PROTO; |
ca0f6a5c | 146 | } else { |
5663bc30 | 147 | return -IPSET_ERR_MISSING_PROTO; |
ca0f6a5c | 148 | } |
5663bc30 | 149 | |
5d50e1d8 JK |
150 | if (!(with_ports || e.proto == IPPROTO_ICMP)) |
151 | e.port = 0; | |
5663bc30 JK |
152 | |
153 | if (adt == IPSET_TEST || | |
5663bc30 JK |
154 | !(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_CIDR] || |
155 | tb[IPSET_ATTR_PORT_TO])) { | |
5d50e1d8 | 156 | ret = adtfn(set, &e, &ext, &ext, flags); |
5663bc30 JK |
157 | return ip_set_eexist(ret, flags) ? 0 : ret; |
158 | } | |
159 | ||
5d50e1d8 | 160 | ip_to = ip = ntohl(e.ip); |
5663bc30 JK |
161 | if (tb[IPSET_ATTR_IP_TO]) { |
162 | ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to); | |
163 | if (ret) | |
164 | return ret; | |
165 | if (ip > ip_to) | |
166 | swap(ip, ip_to); | |
167 | } else if (tb[IPSET_ATTR_CIDR]) { | |
168 | u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]); | |
169 | ||
cabfd139 | 170 | if (!cidr || cidr > HOST_MASK) |
5663bc30 | 171 | return -IPSET_ERR_INVALID_CIDR; |
e6146e86 | 172 | ip_set_mask_from_to(ip, ip_to, cidr); |
4fe198e6 | 173 | } |
5663bc30 | 174 | |
5d50e1d8 | 175 | port_to = port = ntohs(e.port); |
5e0c1eb7 | 176 | if (with_ports && tb[IPSET_ATTR_PORT_TO]) { |
5663bc30 JK |
177 | port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]); |
178 | if (port > port_to) | |
179 | swap(port, port_to); | |
5e0c1eb7 | 180 | } |
5663bc30 | 181 | |
3d14b171 | 182 | if (retried) |
6e27c9b4 | 183 | ip = ntohl(h->next.ip); |
48596a8d | 184 | for (; ip <= ip_to; ip++) { |
6e27c9b4 JK |
185 | p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port) |
186 | : port; | |
3d14b171 | 187 | for (; p <= port_to; p++) { |
5d50e1d8 JK |
188 | e.ip = htonl(ip); |
189 | e.port = htons(p); | |
190 | ret = adtfn(set, &e, &ext, &ext, flags); | |
5663bc30 JK |
191 | |
192 | if (ret && !ip_set_eexist(ret, flags)) | |
193 | return ret; | |
ca0f6a5c JK |
194 | |
195 | ret = 0; | |
5663bc30 | 196 | } |
3d14b171 | 197 | } |
5663bc30 JK |
198 | return ret; |
199 | } | |
200 | ||
03c8b234 | 201 | /* IPv6 variant */ |
5663bc30 JK |
202 | |
203 | struct hash_ipportip6_elem { | |
204 | union nf_inet_addr ip; | |
205 | union nf_inet_addr ip2; | |
206 | __be16 port; | |
207 | u8 proto; | |
208 | u8 padding; | |
209 | }; | |
210 | ||
5d50e1d8 JK |
211 | /* Common functions */ |
212 | ||
8dea982a | 213 | static bool |
5663bc30 | 214 | hash_ipportip6_data_equal(const struct hash_ipportip6_elem *ip1, |
89dc79b7 JK |
215 | const struct hash_ipportip6_elem *ip2, |
216 | u32 *multi) | |
5663bc30 | 217 | { |
29e3b160 YH |
218 | return ipv6_addr_equal(&ip1->ip.in6, &ip2->ip.in6) && |
219 | ipv6_addr_equal(&ip1->ip2.in6, &ip2->ip2.in6) && | |
5663bc30 JK |
220 | ip1->port == ip2->port && |
221 | ip1->proto == ip2->proto; | |
222 | } | |
223 | ||
5663bc30 JK |
224 | static bool |
225 | hash_ipportip6_data_list(struct sk_buff *skb, | |
226 | const struct hash_ipportip6_elem *data) | |
227 | { | |
7cf7899d DM |
228 | if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6) || |
229 | nla_put_ipaddr6(skb, IPSET_ATTR_IP2, &data->ip2.in6) || | |
230 | nla_put_net16(skb, IPSET_ATTR_PORT, data->port) || | |
231 | nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto)) | |
232 | goto nla_put_failure; | |
728a7e69 | 233 | return false; |
5663bc30 JK |
234 | |
235 | nla_put_failure: | |
728a7e69 | 236 | return true; |
5663bc30 JK |
237 | } |
238 | ||
8dea982a | 239 | static void |
21956ab2 | 240 | hash_ipportip6_data_next(struct hash_ipportip6_elem *next, |
5d50e1d8 | 241 | const struct hash_ipportip6_elem *d) |
5663bc30 | 242 | { |
5d50e1d8 | 243 | next->port = d->port; |
5663bc30 JK |
244 | } |
245 | ||
5d50e1d8 | 246 | #undef MTYPE |
5663bc30 JK |
247 | #undef HOST_MASK |
248 | ||
5d50e1d8 | 249 | #define MTYPE hash_ipportip6 |
5663bc30 | 250 | #define HOST_MASK 128 |
5d50e1d8 JK |
251 | #define IP_SET_EMIT_CREATE |
252 | #include "ip_set_hash_gen.h" | |
3d14b171 | 253 | |
5663bc30 JK |
254 | static int |
255 | hash_ipportip6_kadt(struct ip_set *set, const struct sk_buff *skb, | |
b66554cf | 256 | const struct xt_action_param *par, |
5d50e1d8 | 257 | enum ipset_adt adt, struct ip_set_adt_opt *opt) |
5663bc30 | 258 | { |
5663bc30 | 259 | ipset_adtfn adtfn = set->variant->adt[adt]; |
94729f8a | 260 | struct hash_ipportip6_elem e = { .ip = { .all = { 0 } } }; |
ca134ce8 | 261 | struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); |
5663bc30 | 262 | |
ac8cc925 | 263 | if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC, |
5d50e1d8 | 264 | &e.port, &e.proto)) |
5663bc30 JK |
265 | return -EINVAL; |
266 | ||
5d50e1d8 JK |
267 | ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip.in6); |
268 | ip6addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &e.ip2.in6); | |
269 | return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags); | |
5663bc30 JK |
270 | } |
271 | ||
272 | static int | |
273 | hash_ipportip6_uadt(struct ip_set *set, struct nlattr *tb[], | |
3d14b171 | 274 | enum ipset_adt adt, u32 *lineno, u32 flags, bool retried) |
5663bc30 | 275 | { |
21956ab2 | 276 | const struct hash_ipportip6 *h = set->data; |
5663bc30 | 277 | ipset_adtfn adtfn = set->variant->adt[adt]; |
94729f8a | 278 | struct hash_ipportip6_elem e = { .ip = { .all = { 0 } } }; |
ca134ce8 | 279 | struct ip_set_ext ext = IP_SET_INIT_UEXT(set); |
5663bc30 | 280 | u32 port, port_to; |
5e0c1eb7 | 281 | bool with_ports = false; |
5663bc30 JK |
282 | int ret; |
283 | ||
a212e08e SP |
284 | if (tb[IPSET_ATTR_LINENO]) |
285 | *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); | |
286 | ||
5663bc30 JK |
287 | if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] || |
288 | !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) || | |
2c227f27 | 289 | !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO))) |
5663bc30 | 290 | return -IPSET_ERR_PROTOCOL; |
2c227f27 SP |
291 | if (unlikely(tb[IPSET_ATTR_IP_TO])) |
292 | return -IPSET_ERR_HASH_RANGE_UNSUPPORTED; | |
293 | if (unlikely(tb[IPSET_ATTR_CIDR])) { | |
294 | u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]); | |
295 | ||
296 | if (cidr != HOST_MASK) | |
297 | return -IPSET_ERR_INVALID_CIDR; | |
298 | } | |
5663bc30 | 299 | |
8e55d2e5 SP |
300 | ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip); |
301 | if (ret) | |
302 | return ret; | |
303 | ||
304 | ret = ip_set_get_extensions(set, tb, &ext); | |
5663bc30 JK |
305 | if (ret) |
306 | return ret; | |
307 | ||
5d50e1d8 | 308 | ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP2], &e.ip2); |
5663bc30 JK |
309 | if (ret) |
310 | return ret; | |
311 | ||
d25472e4 | 312 | e.port = nla_get_be16(tb[IPSET_ATTR_PORT]); |
5663bc30 JK |
313 | |
314 | if (tb[IPSET_ATTR_PROTO]) { | |
5d50e1d8 JK |
315 | e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]); |
316 | with_ports = ip_set_proto_with_ports(e.proto); | |
5663bc30 | 317 | |
5d50e1d8 | 318 | if (e.proto == 0) |
5663bc30 | 319 | return -IPSET_ERR_INVALID_PROTO; |
ca0f6a5c | 320 | } else { |
5663bc30 | 321 | return -IPSET_ERR_MISSING_PROTO; |
ca0f6a5c | 322 | } |
5663bc30 | 323 | |
5d50e1d8 JK |
324 | if (!(with_ports || e.proto == IPPROTO_ICMPV6)) |
325 | e.port = 0; | |
5663bc30 | 326 | |
5e0c1eb7 | 327 | if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) { |
5d50e1d8 | 328 | ret = adtfn(set, &e, &ext, &ext, flags); |
5663bc30 JK |
329 | return ip_set_eexist(ret, flags) ? 0 : ret; |
330 | } | |
331 | ||
5d50e1d8 | 332 | port = ntohs(e.port); |
5663bc30 JK |
333 | port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]); |
334 | if (port > port_to) | |
335 | swap(port, port_to); | |
336 | ||
3d14b171 | 337 | if (retried) |
6e27c9b4 | 338 | port = ntohs(h->next.port); |
5663bc30 | 339 | for (; port <= port_to; port++) { |
5d50e1d8 JK |
340 | e.port = htons(port); |
341 | ret = adtfn(set, &e, &ext, &ext, flags); | |
5663bc30 JK |
342 | |
343 | if (ret && !ip_set_eexist(ret, flags)) | |
344 | return ret; | |
ca0f6a5c JK |
345 | |
346 | ret = 0; | |
5663bc30 JK |
347 | } |
348 | return ret; | |
349 | } | |
350 | ||
5663bc30 JK |
351 | static struct ip_set_type hash_ipportip_type __read_mostly = { |
352 | .name = "hash:ip,port,ip", | |
353 | .protocol = IPSET_PROTOCOL, | |
354 | .features = IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_TYPE_IP2, | |
355 | .dimension = IPSET_DIM_THREE, | |
c15f1c83 | 356 | .family = NFPROTO_UNSPEC, |
35b8dcf8 JK |
357 | .revision_min = IPSET_TYPE_REV_MIN, |
358 | .revision_max = IPSET_TYPE_REV_MAX, | |
5663bc30 JK |
359 | .create = hash_ipportip_create, |
360 | .create_policy = { | |
361 | [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 }, | |
362 | [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 }, | |
363 | [IPSET_ATTR_PROBES] = { .type = NLA_U8 }, | |
364 | [IPSET_ATTR_RESIZE] = { .type = NLA_U8 }, | |
365 | [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, | |
00d71b27 | 366 | [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 }, |
5663bc30 JK |
367 | }, |
368 | .adt_policy = { | |
369 | [IPSET_ATTR_IP] = { .type = NLA_NESTED }, | |
370 | [IPSET_ATTR_IP_TO] = { .type = NLA_NESTED }, | |
371 | [IPSET_ATTR_IP2] = { .type = NLA_NESTED }, | |
372 | [IPSET_ATTR_PORT] = { .type = NLA_U16 }, | |
373 | [IPSET_ATTR_PORT_TO] = { .type = NLA_U16 }, | |
374 | [IPSET_ATTR_CIDR] = { .type = NLA_U8 }, | |
375 | [IPSET_ATTR_PROTO] = { .type = NLA_U8 }, | |
376 | [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, | |
377 | [IPSET_ATTR_LINENO] = { .type = NLA_U32 }, | |
00d71b27 JK |
378 | [IPSET_ATTR_BYTES] = { .type = NLA_U64 }, |
379 | [IPSET_ATTR_PACKETS] = { .type = NLA_U64 }, | |
03726186 SP |
380 | [IPSET_ATTR_COMMENT] = { .type = NLA_NUL_STRING, |
381 | .len = IPSET_MAX_COMMENT_SIZE }, | |
af331419 AD |
382 | [IPSET_ATTR_SKBMARK] = { .type = NLA_U64 }, |
383 | [IPSET_ATTR_SKBPRIO] = { .type = NLA_U32 }, | |
384 | [IPSET_ATTR_SKBQUEUE] = { .type = NLA_U16 }, | |
5663bc30 JK |
385 | }, |
386 | .me = THIS_MODULE, | |
387 | }; | |
388 | ||
389 | static int __init | |
390 | hash_ipportip_init(void) | |
391 | { | |
392 | return ip_set_type_register(&hash_ipportip_type); | |
393 | } | |
394 | ||
395 | static void __exit | |
396 | hash_ipportip_fini(void) | |
397 | { | |
18f84d41 | 398 | rcu_barrier(); |
5663bc30 JK |
399 | ip_set_type_unregister(&hash_ipportip_type); |
400 | } | |
401 | ||
402 | module_init(hash_ipportip_init); | |
403 | module_exit(hash_ipportip_fini); |