net/netfilter/ipset/ip_set_hash_netnet.c

   1 /* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
   2  * Copyright (C) 2013 Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8
   9 /* Kernel module implementing an IP set type: the hash:net type */
  10
  11 #include <linux/jhash.h>
  12 #include <linux/module.h>
  13 #include <linux/ip.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/errno.h>
  16 #include <linux/random.h>
  17 #include <net/ip.h>
  18 #include <net/ipv6.h>
  19 #include <net/netlink.h>
  20
  21 #include <linux/netfilter.h>
  22 #include <linux/netfilter/ipset/pfxlen.h>
  23 #include <linux/netfilter/ipset/ip_set.h>
  24 #include <linux/netfilter/ipset/ip_set_hash.h>
  25
  26 #define IPSET_TYPE_REV_MIN      0
  27 #define IPSET_TYPE_REV_MAX      1       /* Forceadd support added */
  28
  29 MODULE_LICENSE("GPL");
  30 MODULE_AUTHOR("Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>");
  31 IP_SET_MODULE_DESC("hash:net,net", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
  32 MODULE_ALIAS("ip_set_hash:net,net");
  33
  34 /* Type specific function prefix */
  35 #define HTYPE           hash_netnet
  36 #define IP_SET_HASH_WITH_NETS
  37 #define IPSET_NET_COUNT 2
  38
  39 /* IPv4 variants */
  40
  41 /* Member elements  */
  42 struct hash_netnet4_elem {
  43         union {
  44                 __be32 ip[2];
  45                 __be64 ipcmp;
  46         };
  47         u8 nomatch;
  48         union {
  49                 u8 cidr[2];
  50                 u16 ccmp;
  51         };
  52 };
  53
  54 /* Common functions */
  55
  56 static inline bool
  57 hash_netnet4_data_equal(const struct hash_netnet4_elem *ip1,
  58                      const struct hash_netnet4_elem *ip2,
  59                      u32 *multi)
  60 {
  61         return ip1->ipcmp == ip2->ipcmp &&
  62                ip1->ccmp == ip2->ccmp;
  63 }
  64
  65 static inline int
  66 hash_netnet4_do_data_match(const struct hash_netnet4_elem *elem)
  67 {
  68         return elem->nomatch ? -ENOTEMPTY : 1;
  69 }
  70
  71 static inline void
  72 hash_netnet4_data_set_flags(struct hash_netnet4_elem *elem, u32 flags)
  73 {
  74         elem->nomatch = (flags >> 16) & IPSET_FLAG_NOMATCH;
  75 }
  76
  77 static inline void
  78 hash_netnet4_data_reset_flags(struct hash_netnet4_elem *elem, u8 *flags)
  79 {
  80         swap(*flags, elem->nomatch);
  81 }
  82
  83 static inline void
  84 hash_netnet4_data_reset_elem(struct hash_netnet4_elem *elem,
  85                           struct hash_netnet4_elem *orig)
  86 {
  87         elem->ip[1] = orig->ip[1];
  88 }
  89
  90 static inline void
  91 hash_netnet4_data_netmask(struct hash_netnet4_elem *elem, u8 cidr, bool inner)
  92 {
  93         if (inner) {
  94                 elem->ip[1] &= ip_set_netmask(cidr);
  95                 elem->cidr[1] = cidr;
  96         } else {
  97                 elem->ip[0] &= ip_set_netmask(cidr);
  98                 elem->cidr[0] = cidr;
  99         }
 100 }
 101
 102 static bool
 103 hash_netnet4_data_list(struct sk_buff *skb,
 104                     const struct hash_netnet4_elem *data)
 105 {
 106         u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
 107
 108         if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip[0]) ||
 109             nla_put_ipaddr4(skb, IPSET_ATTR_IP2, data->ip[1]) ||
 110             nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr[0]) ||
 111             nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr[1]) ||
 112             (flags &&
 113              nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
 114                 goto nla_put_failure;
 115         return false;
 116
 117 nla_put_failure:
 118         return true;
 119 }
 120
 121 static inline void
 122 hash_netnet4_data_next(struct hash_netnet4_elem *next,
 123                     const struct hash_netnet4_elem *d)
 124 {
 125         next->ipcmp = d->ipcmp;
 126 }
 127
 128 #define MTYPE           hash_netnet4
 129 #define PF              4
 130 #define HOST_MASK       32
 131 #include "ip_set_hash_gen.h"
 132
 133 static int
 134 hash_netnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
 135                const struct xt_action_param *par,
 136                enum ipset_adt adt, struct ip_set_adt_opt *opt)
 137 {
 138         const struct hash_netnet *h = set->data;
 139         ipset_adtfn adtfn = set->variant->adt[adt];
 140         struct hash_netnet4_elem e = { };
 141         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
 142
 143         e.cidr[0] = IP_SET_INIT_CIDR(h->nets[0].cidr[0], HOST_MASK);
 144         e.cidr[1] = IP_SET_INIT_CIDR(h->nets[0].cidr[1], HOST_MASK);
 145         if (adt == IPSET_TEST)
 146                 e.ccmp = (HOST_MASK << (sizeof(e.cidr[0]) * 8)) | HOST_MASK;
 147
 148         ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip[0]);
 149         ip4addrptr(skb, opt->flags & IPSET_DIM_TWO_SRC, &e.ip[1]);
 150         e.ip[0] &= ip_set_netmask(e.cidr[0]);
 151         e.ip[1] &= ip_set_netmask(e.cidr[1]);
 152
 153         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
 154 }
 155
 156 static int
 157 hash_netnet4_uadt(struct ip_set *set, struct nlattr *tb[],
 158                enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 159 {
 160         const struct hash_netnet *h = set->data;
 161         ipset_adtfn adtfn = set->variant->adt[adt];
 162         struct hash_netnet4_elem e = { };
 163         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
 164         u32 ip = 0, ip_to = 0, last;
 165         u32 ip2 = 0, ip2_from = 0, ip2_to = 0, last2;
 166         u8 cidr, cidr2;
 167         int ret;
 168
 169         e.cidr[0] = e.cidr[1] = HOST_MASK;
 170         if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
 171                      !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
 172                      !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS) ||
 173                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) ||
 174                      !ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES)))
 175                 return -IPSET_ERR_PROTOCOL;
 176
 177         if (tb[IPSET_ATTR_LINENO])
 178                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
 179
 180         ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip) ||
 181               ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2], &ip2_from) ||
 182               ip_set_get_extensions(set, tb, &ext);
 183         if (ret)
 184                 return ret;
 185
 186         if (tb[IPSET_ATTR_CIDR]) {
 187                 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
 188                 if (!cidr || cidr > HOST_MASK)
 189                         return -IPSET_ERR_INVALID_CIDR;
 190                 e.cidr[0] = cidr;
 191         }
 192
 193         if (tb[IPSET_ATTR_CIDR2]) {
 194                 cidr2 = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
 195                 if (!cidr2 || cidr2 > HOST_MASK)
 196                         return -IPSET_ERR_INVALID_CIDR;
 197                 e.cidr[1] = cidr2;
 198         }
 199
 200         if (tb[IPSET_ATTR_CADT_FLAGS]) {
 201                 u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
 202                 if (cadt_flags & IPSET_FLAG_NOMATCH)
 203                         flags |= (IPSET_FLAG_NOMATCH << 16);
 204         }
 205
 206         if (adt == IPSET_TEST || !(tb[IPSET_ATTR_IP_TO] &&
 207                                    tb[IPSET_ATTR_IP2_TO])) {
 208                 e.ip[0] = htonl(ip & ip_set_hostmask(e.cidr[0]));
 209                 e.ip[1] = htonl(ip2_from & ip_set_hostmask(e.cidr[1]));
 210                 ret = adtfn(set, &e, &ext, &ext, flags);
 211                 return ip_set_enomatch(ret, flags, adt, set) ? -ret :
 212                        ip_set_eexist(ret, flags) ? 0 : ret;
 213         }
 214
 215         ip_to = ip;
 216         if (tb[IPSET_ATTR_IP_TO]) {
 217                 ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
 218                 if (ret)
 219                         return ret;
 220                 if (ip_to < ip)
 221                         swap(ip, ip_to);
 222                 if (ip + UINT_MAX == ip_to)
 223                         return -IPSET_ERR_HASH_RANGE;
 224         }
 225
 226         ip2_to = ip2_from;
 227         if (tb[IPSET_ATTR_IP2_TO]) {
 228                 ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2_TO], &ip2_to);
 229                 if (ret)
 230                         return ret;
 231                 if (ip2_to < ip2_from)
 232                         swap(ip2_from, ip2_to);
 233                 if (ip2_from + UINT_MAX == ip2_to)
 234                         return -IPSET_ERR_HASH_RANGE;
 235
 236         }
 237
 238         if (retried)
 239                 ip = ntohl(h->next.ip[0]);
 240
 241         while (!after(ip, ip_to)) {
 242                 e.ip[0] = htonl(ip);
 243                 last = ip_set_range_to_cidr(ip, ip_to, &cidr);
 244                 e.cidr[0] = cidr;
 245                 ip2 = (retried &&
 246                        ip == ntohl(h->next.ip[0])) ? ntohl(h->next.ip[1])
 247                                                    : ip2_from;
 248                 while (!after(ip2, ip2_to)) {
 249                         e.ip[1] = htonl(ip2);
 250                         last2 = ip_set_range_to_cidr(ip2, ip2_to, &cidr2);
 251                         e.cidr[1] = cidr2;
 252                         ret = adtfn(set, &e, &ext, &ext, flags);
 253                         if (ret && !ip_set_eexist(ret, flags))
 254                                 return ret;
 255                         else
 256                                 ret = 0;
 257                         ip2 = last2 + 1;
 258                 }
 259                 ip = last + 1;
 260         }
 261         return ret;
 262 }
 263
 264 /* IPv6 variants */
 265
 266 struct hash_netnet6_elem {
 267         union nf_inet_addr ip[2];
 268         u8 nomatch;
 269         union {
 270                 u8 cidr[2];
 271                 u16 ccmp;
 272         };
 273 };
 274
 275 /* Common functions */
 276
 277 static inline bool
 278 hash_netnet6_data_equal(const struct hash_netnet6_elem *ip1,
 279                      const struct hash_netnet6_elem *ip2,
 280                      u32 *multi)
 281 {
 282         return ipv6_addr_equal(&ip1->ip[0].in6, &ip2->ip[0].in6) &&
 283                ipv6_addr_equal(&ip1->ip[1].in6, &ip2->ip[1].in6) &&
 284                ip1->ccmp == ip2->ccmp;
 285 }
 286
 287 static inline int
 288 hash_netnet6_do_data_match(const struct hash_netnet6_elem *elem)
 289 {
 290         return elem->nomatch ? -ENOTEMPTY : 1;
 291 }
 292
 293 static inline void
 294 hash_netnet6_data_set_flags(struct hash_netnet6_elem *elem, u32 flags)
 295 {
 296         elem->nomatch = (flags >> 16) & IPSET_FLAG_NOMATCH;
 297 }
 298
 299 static inline void
 300 hash_netnet6_data_reset_flags(struct hash_netnet6_elem *elem, u8 *flags)
 301 {
 302         swap(*flags, elem->nomatch);
 303 }
 304
 305 static inline void
 306 hash_netnet6_data_reset_elem(struct hash_netnet6_elem *elem,
 307                           struct hash_netnet6_elem *orig)
 308 {
 309         elem->ip[1] = orig->ip[1];
 310 }
 311
 312 static inline void
 313 hash_netnet6_data_netmask(struct hash_netnet6_elem *elem, u8 cidr, bool inner)
 314 {
 315         if (inner) {
 316                 ip6_netmask(&elem->ip[1], cidr);
 317                 elem->cidr[1] = cidr;
 318         } else {
 319                 ip6_netmask(&elem->ip[0], cidr);
 320                 elem->cidr[0] = cidr;
 321         }
 322 }
 323
 324 static bool
 325 hash_netnet6_data_list(struct sk_buff *skb,
 326                     const struct hash_netnet6_elem *data)
 327 {
 328         u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
 329
 330         if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip[0].in6) ||
 331             nla_put_ipaddr6(skb, IPSET_ATTR_IP2, &data->ip[1].in6) ||
 332             nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr[0]) ||
 333             nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr[1]) ||
 334             (flags &&
 335              nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
 336                 goto nla_put_failure;
 337         return false;
 338
 339 nla_put_failure:
 340         return true;
 341 }
 342
 343 static inline void
 344 hash_netnet6_data_next(struct hash_netnet4_elem *next,
 345                     const struct hash_netnet6_elem *d)
 346 {
 347 }
 348
 349 #undef MTYPE
 350 #undef PF
 351 #undef HOST_MASK
 352
 353 #define MTYPE           hash_netnet6
 354 #define PF              6
 355 #define HOST_MASK       128
 356 #define IP_SET_EMIT_CREATE
 357 #include "ip_set_hash_gen.h"
 358
 359 static int
 360 hash_netnet6_kadt(struct ip_set *set, const struct sk_buff *skb,
 361                const struct xt_action_param *par,
 362                enum ipset_adt adt, struct ip_set_adt_opt *opt)
 363 {
 364         const struct hash_netnet *h = set->data;
 365         ipset_adtfn adtfn = set->variant->adt[adt];
 366         struct hash_netnet6_elem e = { };
 367         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
 368
 369         e.cidr[0] = IP_SET_INIT_CIDR(h->nets[0].cidr[0], HOST_MASK);
 370         e.cidr[1] = IP_SET_INIT_CIDR(h->nets[0].cidr[1], HOST_MASK);
 371         if (adt == IPSET_TEST)
 372                 e.ccmp = (HOST_MASK << (sizeof(u8)*8)) | HOST_MASK;
 373
 374         ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip[0].in6);
 375         ip6addrptr(skb, opt->flags & IPSET_DIM_TWO_SRC, &e.ip[1].in6);
 376         ip6_netmask(&e.ip[0], e.cidr[0]);
 377         ip6_netmask(&e.ip[1], e.cidr[1]);
 378
 379         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
 380 }
 381
 382 static int
 383 hash_netnet6_uadt(struct ip_set *set, struct nlattr *tb[],
 384                enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 385 {
 386         ipset_adtfn adtfn = set->variant->adt[adt];
 387         struct hash_netnet6_elem e = { };
 388         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
 389         int ret;
 390
 391         e.cidr[0] = e.cidr[1] = HOST_MASK;
 392         if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
 393                      !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
 394                      !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS) ||
 395                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) ||
 396                      !ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES)))
 397                 return -IPSET_ERR_PROTOCOL;
 398         if (unlikely(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_IP2_TO]))
 399                 return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
 400
 401         if (tb[IPSET_ATTR_LINENO])
 402                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
 403
 404         ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip[0]) ||
 405               ip_set_get_ipaddr6(tb[IPSET_ATTR_IP2], &e.ip[1]) ||
 406               ip_set_get_extensions(set, tb, &ext);
 407         if (ret)
 408                 return ret;
 409
 410         if (tb[IPSET_ATTR_CIDR])
 411                 e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
 412
 413         if (tb[IPSET_ATTR_CIDR2])
 414                 e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
 415
 416         if (!e.cidr[0] || e.cidr[0] > HOST_MASK || !e.cidr[1] ||
 417             e.cidr[1] > HOST_MASK)
 418                 return -IPSET_ERR_INVALID_CIDR;
 419
 420         ip6_netmask(&e.ip[0], e.cidr[0]);
 421         ip6_netmask(&e.ip[1], e.cidr[1]);
 422
 423         if (tb[IPSET_ATTR_CADT_FLAGS]) {
 424                 u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
 425                 if (cadt_flags & IPSET_FLAG_NOMATCH)
 426                         flags |= (IPSET_FLAG_NOMATCH << 16);
 427         }
 428
 429         ret = adtfn(set, &e, &ext, &ext, flags);
 430
 431         return ip_set_enomatch(ret, flags, adt, set) ? -ret :
 432                ip_set_eexist(ret, flags) ? 0 : ret;
 433 }
 434
 435 static struct ip_set_type hash_netnet_type __read_mostly = {
 436         .name           = "hash:net,net",
 437         .protocol       = IPSET_PROTOCOL,
 438         .features       = IPSET_TYPE_IP | IPSET_TYPE_IP2 | IPSET_TYPE_NOMATCH,
 439         .dimension      = IPSET_DIM_TWO,
 440         .family         = NFPROTO_UNSPEC,
 441         .revision_min   = IPSET_TYPE_REV_MIN,
 442         .revision_max   = IPSET_TYPE_REV_MAX,
 443         .create         = hash_netnet_create,
 444         .create_policy  = {
 445                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
 446                 [IPSET_ATTR_MAXELEM]    = { .type = NLA_U32 },
 447                 [IPSET_ATTR_PROBES]     = { .type = NLA_U8 },
 448                 [IPSET_ATTR_RESIZE]     = { .type = NLA_U8  },
 449                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
 450                 [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
 451         },
 452         .adt_policy     = {
 453                 [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
 454                 [IPSET_ATTR_IP_TO]      = { .type = NLA_NESTED },
 455                 [IPSET_ATTR_IP2]        = { .type = NLA_NESTED },
 456                 [IPSET_ATTR_IP2_TO]     = { .type = NLA_NESTED },
 457                 [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
 458                 [IPSET_ATTR_CIDR2]      = { .type = NLA_U8 },
 459                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
 460                 [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
 461                 [IPSET_ATTR_BYTES]      = { .type = NLA_U64 },
 462                 [IPSET_ATTR_PACKETS]    = { .type = NLA_U64 },
 463                 [IPSET_ATTR_COMMENT]    = { .type = NLA_NUL_STRING },
 464         },
 465         .me             = THIS_MODULE,
 466 };
 467
 468 static int __init
 469 hash_netnet_init(void)
 470 {
 471         return ip_set_type_register(&hash_netnet_type);
 472 }
 473
 474 static void __exit
 475 hash_netnet_fini(void)
 476 {
 477         ip_set_type_unregister(&hash_netnet_type);
 478 }
 479
 480 module_init(hash_netnet_init);
 481 module_exit(hash_netnet_fini);