em_ipset.c 2.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * net/sched/em_ipset.c ipset ematch
  4. *
  5. * Copyright (c) 2012 Florian Westphal <fw@strlen.de>
  6. */
  7. #include <linux/gfp.h>
  8. #include <linux/module.h>
  9. #include <linux/types.h>
  10. #include <linux/kernel.h>
  11. #include <linux/string.h>
  12. #include <linux/skbuff.h>
  13. #include <linux/netfilter/xt_set.h>
  14. #include <linux/ipv6.h>
  15. #include <net/ip.h>
  16. #include <net/pkt_cls.h>
  17. static int em_ipset_change(struct net *net, void *data, int data_len,
  18. struct tcf_ematch *em)
  19. {
  20. struct xt_set_info *set = data;
  21. ip_set_id_t index;
  22. if (data_len != sizeof(*set))
  23. return -EINVAL;
  24. index = ip_set_nfnl_get_byindex(net, set->index);
  25. if (index == IPSET_INVALID_ID)
  26. return -ENOENT;
  27. em->datalen = sizeof(*set);
  28. em->data = (unsigned long)kmemdup(data, em->datalen, GFP_KERNEL);
  29. if (em->data)
  30. return 0;
  31. ip_set_nfnl_put(net, index);
  32. return -ENOMEM;
  33. }
  34. static void em_ipset_destroy(struct tcf_ematch *em)
  35. {
  36. const struct xt_set_info *set = (const void *) em->data;
  37. if (set) {
  38. ip_set_nfnl_put(em->net, set->index);
  39. kfree((void *) em->data);
  40. }
  41. }
  42. static int em_ipset_match(struct sk_buff *skb, struct tcf_ematch *em,
  43. struct tcf_pkt_info *info)
  44. {
  45. struct ip_set_adt_opt opt;
  46. struct xt_action_param acpar;
  47. const struct xt_set_info *set = (const void *) em->data;
  48. struct net_device *dev, *indev = NULL;
  49. struct nf_hook_state state = {
  50. .net = em->net,
  51. };
  52. int ret, network_offset;
  53. switch (skb_protocol(skb, true)) {
  54. case htons(ETH_P_IP):
  55. state.pf = NFPROTO_IPV4;
  56. if (!pskb_network_may_pull(skb, sizeof(struct iphdr)))
  57. return 0;
  58. acpar.thoff = ip_hdrlen(skb);
  59. break;
  60. case htons(ETH_P_IPV6):
  61. state.pf = NFPROTO_IPV6;
  62. if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr)))
  63. return 0;
  64. /* doesn't call ipv6_find_hdr() because ipset doesn't use thoff, yet */
  65. acpar.thoff = sizeof(struct ipv6hdr);
  66. break;
  67. default:
  68. return 0;
  69. }
  70. opt.family = state.pf;
  71. opt.dim = set->dim;
  72. opt.flags = set->flags;
  73. opt.cmdflags = 0;
  74. opt.ext.timeout = ~0u;
  75. network_offset = skb_network_offset(skb);
  76. skb_pull(skb, network_offset);
  77. dev = skb->dev;
  78. rcu_read_lock();
  79. if (skb->skb_iif)
  80. indev = dev_get_by_index_rcu(em->net, skb->skb_iif);
  81. state.in = indev ? indev : dev;
  82. state.out = dev;
  83. acpar.state = &state;
  84. ret = ip_set_test(set->index, skb, &acpar, &opt);
  85. rcu_read_unlock();
  86. skb_push(skb, network_offset);
  87. return ret;
  88. }
  89. static struct tcf_ematch_ops em_ipset_ops = {
  90. .kind = TCF_EM_IPSET,
  91. .change = em_ipset_change,
  92. .destroy = em_ipset_destroy,
  93. .match = em_ipset_match,
  94. .owner = THIS_MODULE,
  95. .link = LIST_HEAD_INIT(em_ipset_ops.link)
  96. };
  97. static int __init init_em_ipset(void)
  98. {
  99. return tcf_em_register(&em_ipset_ops);
  100. }
  101. static void __exit exit_em_ipset(void)
  102. {
  103. tcf_em_unregister(&em_ipset_ops);
  104. }
  105. MODULE_LICENSE("GPL");
  106. MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
  107. MODULE_DESCRIPTION("TC extended match for IP sets");
  108. module_init(init_em_ipset);
  109. module_exit(exit_em_ipset);
  110. MODULE_ALIAS_TCF_EMATCH(TCF_EM_IPSET);