ip_set_hash_netnet.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@netfilter.org>
  3. * Copyright (C) 2013 Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>
  4. */
  5. /* Kernel module implementing an IP set type: the hash:net type */
  6. #include <linux/jhash.h>
  7. #include <linux/module.h>
  8. #include <linux/ip.h>
  9. #include <linux/skbuff.h>
  10. #include <linux/errno.h>
  11. #include <linux/random.h>
  12. #include <net/ip.h>
  13. #include <net/ipv6.h>
  14. #include <net/netlink.h>
  15. #include <linux/netfilter.h>
  16. #include <linux/netfilter/ipset/pfxlen.h>
  17. #include <linux/netfilter/ipset/ip_set.h>
  18. #include <linux/netfilter/ipset/ip_set_hash.h>
  19. #define IPSET_TYPE_REV_MIN 0
  20. /* 1 Forceadd support added */
  21. #define IPSET_TYPE_REV_MAX 2 /* skbinfo support added */
  22. MODULE_LICENSE("GPL");
  23. MODULE_AUTHOR("Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>");
  24. IP_SET_MODULE_DESC("hash:net,net", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
  25. MODULE_ALIAS("ip_set_hash:net,net");
  26. /* Type specific function prefix */
  27. #define HTYPE hash_netnet
  28. #define IP_SET_HASH_WITH_NETS
  29. #define IPSET_NET_COUNT 2
  30. /* IPv4 variants */
  31. /* Member elements */
  32. struct hash_netnet4_elem {
  33. union {
  34. __be32 ip[2];
  35. __be64 ipcmp;
  36. };
  37. u8 nomatch;
  38. u8 padding;
  39. union {
  40. u8 cidr[2];
  41. u16 ccmp;
  42. };
  43. };
  44. /* Common functions */
  45. static bool
  46. hash_netnet4_data_equal(const struct hash_netnet4_elem *ip1,
  47. const struct hash_netnet4_elem *ip2,
  48. u32 *multi)
  49. {
  50. return ip1->ipcmp == ip2->ipcmp &&
  51. ip1->ccmp == ip2->ccmp;
  52. }
  53. static int
  54. hash_netnet4_do_data_match(const struct hash_netnet4_elem *elem)
  55. {
  56. return elem->nomatch ? -ENOTEMPTY : 1;
  57. }
  58. static void
  59. hash_netnet4_data_set_flags(struct hash_netnet4_elem *elem, u32 flags)
  60. {
  61. elem->nomatch = (flags >> 16) & IPSET_FLAG_NOMATCH;
  62. }
  63. static void
  64. hash_netnet4_data_reset_flags(struct hash_netnet4_elem *elem, u8 *flags)
  65. {
  66. swap(*flags, elem->nomatch);
  67. }
  68. static void
  69. hash_netnet4_data_reset_elem(struct hash_netnet4_elem *elem,
  70. struct hash_netnet4_elem *orig)
  71. {
  72. elem->ip[1] = orig->ip[1];
  73. }
  74. static void
  75. hash_netnet4_data_netmask(struct hash_netnet4_elem *elem, u8 cidr, bool inner)
  76. {
  77. if (inner) {
  78. elem->ip[1] &= ip_set_netmask(cidr);
  79. elem->cidr[1] = cidr;
  80. } else {
  81. elem->ip[0] &= ip_set_netmask(cidr);
  82. elem->cidr[0] = cidr;
  83. }
  84. }
  85. static bool
  86. hash_netnet4_data_list(struct sk_buff *skb,
  87. const struct hash_netnet4_elem *data)
  88. {
  89. u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
  90. if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip[0]) ||
  91. nla_put_ipaddr4(skb, IPSET_ATTR_IP2, data->ip[1]) ||
  92. nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr[0]) ||
  93. nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr[1]) ||
  94. (flags &&
  95. nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
  96. goto nla_put_failure;
  97. return false;
  98. nla_put_failure:
  99. return true;
  100. }
  101. static void
  102. hash_netnet4_data_next(struct hash_netnet4_elem *next,
  103. const struct hash_netnet4_elem *d)
  104. {
  105. next->ipcmp = d->ipcmp;
  106. }
  107. #define MTYPE hash_netnet4
  108. #define HOST_MASK 32
  109. #include "ip_set_hash_gen.h"
  110. static void
  111. hash_netnet4_init(struct hash_netnet4_elem *e)
  112. {
  113. e->cidr[0] = HOST_MASK;
  114. e->cidr[1] = HOST_MASK;
  115. }
  116. static int
  117. hash_netnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
  118. const struct xt_action_param *par,
  119. enum ipset_adt adt, struct ip_set_adt_opt *opt)
  120. {
  121. const struct hash_netnet4 *h = set->data;
  122. ipset_adtfn adtfn = set->variant->adt[adt];
  123. struct hash_netnet4_elem e = { };
  124. struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
  125. e.cidr[0] = INIT_CIDR(h->nets[0].cidr[0], HOST_MASK);
  126. e.cidr[1] = INIT_CIDR(h->nets[0].cidr[1], HOST_MASK);
  127. if (adt == IPSET_TEST)
  128. e.ccmp = (HOST_MASK << (sizeof(e.cidr[0]) * 8)) | HOST_MASK;
  129. ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip[0]);
  130. ip4addrptr(skb, opt->flags & IPSET_DIM_TWO_SRC, &e.ip[1]);
  131. e.ip[0] &= ip_set_netmask(e.cidr[0]);
  132. e.ip[1] &= ip_set_netmask(e.cidr[1]);
  133. return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
  134. }
  135. static int
  136. hash_netnet4_uadt(struct ip_set *set, struct nlattr *tb[],
  137. enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
  138. {
  139. const struct hash_netnet4 *h = set->data;
  140. ipset_adtfn adtfn = set->variant->adt[adt];
  141. struct hash_netnet4_elem e = { };
  142. struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
  143. u32 ip = 0, ip_to = 0;
  144. u32 ip2 = 0, ip2_from = 0, ip2_to = 0;
  145. int ret;
  146. if (tb[IPSET_ATTR_LINENO])
  147. *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
  148. hash_netnet4_init(&e);
  149. if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
  150. !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
  151. return -IPSET_ERR_PROTOCOL;
  152. ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
  153. if (ret)
  154. return ret;
  155. ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2], &ip2_from);
  156. if (ret)
  157. return ret;
  158. ret = ip_set_get_extensions(set, tb, &ext);
  159. if (ret)
  160. return ret;
  161. if (tb[IPSET_ATTR_CIDR]) {
  162. e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
  163. if (!e.cidr[0] || e.cidr[0] > HOST_MASK)
  164. return -IPSET_ERR_INVALID_CIDR;
  165. }
  166. if (tb[IPSET_ATTR_CIDR2]) {
  167. e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
  168. if (!e.cidr[1] || e.cidr[1] > HOST_MASK)
  169. return -IPSET_ERR_INVALID_CIDR;
  170. }
  171. if (tb[IPSET_ATTR_CADT_FLAGS]) {
  172. u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
  173. if (cadt_flags & IPSET_FLAG_NOMATCH)
  174. flags |= (IPSET_FLAG_NOMATCH << 16);
  175. }
  176. if (adt == IPSET_TEST || !(tb[IPSET_ATTR_IP_TO] ||
  177. tb[IPSET_ATTR_IP2_TO])) {
  178. e.ip[0] = htonl(ip & ip_set_hostmask(e.cidr[0]));
  179. e.ip[1] = htonl(ip2_from & ip_set_hostmask(e.cidr[1]));
  180. ret = adtfn(set, &e, &ext, &ext, flags);
  181. return ip_set_enomatch(ret, flags, adt, set) ? -ret :
  182. ip_set_eexist(ret, flags) ? 0 : ret;
  183. }
  184. ip_to = ip;
  185. if (tb[IPSET_ATTR_IP_TO]) {
  186. ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
  187. if (ret)
  188. return ret;
  189. if (ip_to < ip)
  190. swap(ip, ip_to);
  191. if (unlikely(ip + UINT_MAX == ip_to))
  192. return -IPSET_ERR_HASH_RANGE;
  193. } else {
  194. ip_set_mask_from_to(ip, ip_to, e.cidr[0]);
  195. }
  196. ip2_to = ip2_from;
  197. if (tb[IPSET_ATTR_IP2_TO]) {
  198. ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2_TO], &ip2_to);
  199. if (ret)
  200. return ret;
  201. if (ip2_to < ip2_from)
  202. swap(ip2_from, ip2_to);
  203. if (unlikely(ip2_from + UINT_MAX == ip2_to))
  204. return -IPSET_ERR_HASH_RANGE;
  205. } else {
  206. ip_set_mask_from_to(ip2_from, ip2_to, e.cidr[1]);
  207. }
  208. if (retried) {
  209. ip = ntohl(h->next.ip[0]);
  210. ip2 = ntohl(h->next.ip[1]);
  211. } else {
  212. ip2 = ip2_from;
  213. }
  214. do {
  215. e.ip[0] = htonl(ip);
  216. ip = ip_set_range_to_cidr(ip, ip_to, &e.cidr[0]);
  217. do {
  218. e.ip[1] = htonl(ip2);
  219. ip2 = ip_set_range_to_cidr(ip2, ip2_to, &e.cidr[1]);
  220. ret = adtfn(set, &e, &ext, &ext, flags);
  221. if (ret && !ip_set_eexist(ret, flags))
  222. return ret;
  223. ret = 0;
  224. } while (ip2++ < ip2_to);
  225. ip2 = ip2_from;
  226. } while (ip++ < ip_to);
  227. return ret;
  228. }
  229. /* IPv6 variants */
  230. struct hash_netnet6_elem {
  231. union nf_inet_addr ip[2];
  232. u8 nomatch;
  233. u8 padding;
  234. union {
  235. u8 cidr[2];
  236. u16 ccmp;
  237. };
  238. };
  239. /* Common functions */
  240. static bool
  241. hash_netnet6_data_equal(const struct hash_netnet6_elem *ip1,
  242. const struct hash_netnet6_elem *ip2,
  243. u32 *multi)
  244. {
  245. return ipv6_addr_equal(&ip1->ip[0].in6, &ip2->ip[0].in6) &&
  246. ipv6_addr_equal(&ip1->ip[1].in6, &ip2->ip[1].in6) &&
  247. ip1->ccmp == ip2->ccmp;
  248. }
  249. static int
  250. hash_netnet6_do_data_match(const struct hash_netnet6_elem *elem)
  251. {
  252. return elem->nomatch ? -ENOTEMPTY : 1;
  253. }
  254. static void
  255. hash_netnet6_data_set_flags(struct hash_netnet6_elem *elem, u32 flags)
  256. {
  257. elem->nomatch = (flags >> 16) & IPSET_FLAG_NOMATCH;
  258. }
  259. static void
  260. hash_netnet6_data_reset_flags(struct hash_netnet6_elem *elem, u8 *flags)
  261. {
  262. swap(*flags, elem->nomatch);
  263. }
  264. static void
  265. hash_netnet6_data_reset_elem(struct hash_netnet6_elem *elem,
  266. struct hash_netnet6_elem *orig)
  267. {
  268. elem->ip[1] = orig->ip[1];
  269. }
  270. static void
  271. hash_netnet6_data_netmask(struct hash_netnet6_elem *elem, u8 cidr, bool inner)
  272. {
  273. if (inner) {
  274. ip6_netmask(&elem->ip[1], cidr);
  275. elem->cidr[1] = cidr;
  276. } else {
  277. ip6_netmask(&elem->ip[0], cidr);
  278. elem->cidr[0] = cidr;
  279. }
  280. }
  281. static bool
  282. hash_netnet6_data_list(struct sk_buff *skb,
  283. const struct hash_netnet6_elem *data)
  284. {
  285. u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
  286. if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip[0].in6) ||
  287. nla_put_ipaddr6(skb, IPSET_ATTR_IP2, &data->ip[1].in6) ||
  288. nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr[0]) ||
  289. nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr[1]) ||
  290. (flags &&
  291. nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
  292. goto nla_put_failure;
  293. return false;
  294. nla_put_failure:
  295. return true;
  296. }
  297. static void
  298. hash_netnet6_data_next(struct hash_netnet6_elem *next,
  299. const struct hash_netnet6_elem *d)
  300. {
  301. }
  302. #undef MTYPE
  303. #undef HOST_MASK
  304. #define MTYPE hash_netnet6
  305. #define HOST_MASK 128
  306. #define IP_SET_EMIT_CREATE
  307. #include "ip_set_hash_gen.h"
  308. static void
  309. hash_netnet6_init(struct hash_netnet6_elem *e)
  310. {
  311. e->cidr[0] = HOST_MASK;
  312. e->cidr[1] = HOST_MASK;
  313. }
  314. static int
  315. hash_netnet6_kadt(struct ip_set *set, const struct sk_buff *skb,
  316. const struct xt_action_param *par,
  317. enum ipset_adt adt, struct ip_set_adt_opt *opt)
  318. {
  319. const struct hash_netnet6 *h = set->data;
  320. ipset_adtfn adtfn = set->variant->adt[adt];
  321. struct hash_netnet6_elem e = { };
  322. struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
  323. e.cidr[0] = INIT_CIDR(h->nets[0].cidr[0], HOST_MASK);
  324. e.cidr[1] = INIT_CIDR(h->nets[0].cidr[1], HOST_MASK);
  325. if (adt == IPSET_TEST)
  326. e.ccmp = (HOST_MASK << (sizeof(u8) * 8)) | HOST_MASK;
  327. ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip[0].in6);
  328. ip6addrptr(skb, opt->flags & IPSET_DIM_TWO_SRC, &e.ip[1].in6);
  329. ip6_netmask(&e.ip[0], e.cidr[0]);
  330. ip6_netmask(&e.ip[1], e.cidr[1]);
  331. return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
  332. }
  333. static int
  334. hash_netnet6_uadt(struct ip_set *set, struct nlattr *tb[],
  335. enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
  336. {
  337. ipset_adtfn adtfn = set->variant->adt[adt];
  338. struct hash_netnet6_elem e = { };
  339. struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
  340. int ret;
  341. if (tb[IPSET_ATTR_LINENO])
  342. *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
  343. hash_netnet6_init(&e);
  344. if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
  345. !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
  346. return -IPSET_ERR_PROTOCOL;
  347. if (unlikely(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_IP2_TO]))
  348. return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
  349. ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip[0]);
  350. if (ret)
  351. return ret;
  352. ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP2], &e.ip[1]);
  353. if (ret)
  354. return ret;
  355. ret = ip_set_get_extensions(set, tb, &ext);
  356. if (ret)
  357. return ret;
  358. if (tb[IPSET_ATTR_CIDR]) {
  359. e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
  360. if (!e.cidr[0] || e.cidr[0] > HOST_MASK)
  361. return -IPSET_ERR_INVALID_CIDR;
  362. }
  363. if (tb[IPSET_ATTR_CIDR2]) {
  364. e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
  365. if (!e.cidr[1] || e.cidr[1] > HOST_MASK)
  366. return -IPSET_ERR_INVALID_CIDR;
  367. }
  368. ip6_netmask(&e.ip[0], e.cidr[0]);
  369. ip6_netmask(&e.ip[1], e.cidr[1]);
  370. if (tb[IPSET_ATTR_CADT_FLAGS]) {
  371. u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
  372. if (cadt_flags & IPSET_FLAG_NOMATCH)
  373. flags |= (IPSET_FLAG_NOMATCH << 16);
  374. }
  375. ret = adtfn(set, &e, &ext, &ext, flags);
  376. return ip_set_enomatch(ret, flags, adt, set) ? -ret :
  377. ip_set_eexist(ret, flags) ? 0 : ret;
  378. }
  379. static struct ip_set_type hash_netnet_type __read_mostly = {
  380. .name = "hash:net,net",
  381. .protocol = IPSET_PROTOCOL,
  382. .features = IPSET_TYPE_IP | IPSET_TYPE_IP2 | IPSET_TYPE_NOMATCH,
  383. .dimension = IPSET_DIM_TWO,
  384. .family = NFPROTO_UNSPEC,
  385. .revision_min = IPSET_TYPE_REV_MIN,
  386. .revision_max = IPSET_TYPE_REV_MAX,
  387. .create = hash_netnet_create,
  388. .create_policy = {
  389. [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
  390. [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
  391. [IPSET_ATTR_PROBES] = { .type = NLA_U8 },
  392. [IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
  393. [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
  394. [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
  395. },
  396. .adt_policy = {
  397. [IPSET_ATTR_IP] = { .type = NLA_NESTED },
  398. [IPSET_ATTR_IP_TO] = { .type = NLA_NESTED },
  399. [IPSET_ATTR_IP2] = { .type = NLA_NESTED },
  400. [IPSET_ATTR_IP2_TO] = { .type = NLA_NESTED },
  401. [IPSET_ATTR_CIDR] = { .type = NLA_U8 },
  402. [IPSET_ATTR_CIDR2] = { .type = NLA_U8 },
  403. [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
  404. [IPSET_ATTR_LINENO] = { .type = NLA_U32 },
  405. [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
  406. [IPSET_ATTR_BYTES] = { .type = NLA_U64 },
  407. [IPSET_ATTR_PACKETS] = { .type = NLA_U64 },
  408. [IPSET_ATTR_COMMENT] = { .type = NLA_NUL_STRING,
  409. .len = IPSET_MAX_COMMENT_SIZE },
  410. [IPSET_ATTR_SKBMARK] = { .type = NLA_U64 },
  411. [IPSET_ATTR_SKBPRIO] = { .type = NLA_U32 },
  412. [IPSET_ATTR_SKBQUEUE] = { .type = NLA_U16 },
  413. },
  414. .me = THIS_MODULE,
  415. };
  416. static int __init
  417. hash_netnet_init(void)
  418. {
  419. return ip_set_type_register(&hash_netnet_type);
  420. }
  421. static void __exit
  422. hash_netnet_fini(void)
  423. {
  424. rcu_barrier();
  425. ip_set_type_unregister(&hash_netnet_type);
  426. }
  427. module_init(hash_netnet_init);
  428. module_exit(hash_netnet_fini);