Loading...
1/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
2 * Patrick Schaaf <bof@bof.de>
3 * Martin Josefsson <gandalf@wlug.westbo.se>
4 * Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
10
11/* Kernel module which implements the set match and SET target
12 * for netfilter/iptables.
13 */
14
15#include <linux/module.h>
16#include <linux/skbuff.h>
17
18#include <linux/netfilter/x_tables.h>
19#include <linux/netfilter/ipset/ip_set.h>
20#include <linux/netfilter/ipset/ip_set_timeout.h>
21#include <uapi/linux/netfilter/xt_set.h>
22
23MODULE_LICENSE("GPL");
24MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
25MODULE_DESCRIPTION("Xtables: IP set match and target module");
26MODULE_ALIAS("xt_SET");
27MODULE_ALIAS("ipt_set");
28MODULE_ALIAS("ip6t_set");
29MODULE_ALIAS("ipt_SET");
30MODULE_ALIAS("ip6t_SET");
31
32static inline int
33match_set(ip_set_id_t index, const struct sk_buff *skb,
34 const struct xt_action_param *par,
35 struct ip_set_adt_opt *opt, int inv)
36{
37 if (ip_set_test(index, skb, par, opt))
38 inv = !inv;
39 return inv;
40}
41
42#define ADT_OPT(n, f, d, fs, cfs, t) \
43struct ip_set_adt_opt n = { \
44 .family = f, \
45 .dim = d, \
46 .flags = fs, \
47 .cmdflags = cfs, \
48 .ext.timeout = t, \
49}
50
51/* Revision 0 interface: backward compatible with netfilter/iptables */
52
53static bool
54set_match_v0(const struct sk_buff *skb, struct xt_action_param *par)
55{
56 const struct xt_set_info_match_v0 *info = par->matchinfo;
57
58 ADT_OPT(opt, xt_family(par), info->match_set.u.compat.dim,
59 info->match_set.u.compat.flags, 0, UINT_MAX);
60
61 return match_set(info->match_set.index, skb, par, &opt,
62 info->match_set.u.compat.flags & IPSET_INV_MATCH);
63}
64
65static void
66compat_flags(struct xt_set_info_v0 *info)
67{
68 u_int8_t i;
69
70 /* Fill out compatibility data according to enum ip_set_kopt */
71 info->u.compat.dim = IPSET_DIM_ZERO;
72 if (info->u.flags[0] & IPSET_MATCH_INV)
73 info->u.compat.flags |= IPSET_INV_MATCH;
74 for (i = 0; i < IPSET_DIM_MAX - 1 && info->u.flags[i]; i++) {
75 info->u.compat.dim++;
76 if (info->u.flags[i] & IPSET_SRC)
77 info->u.compat.flags |= (1 << info->u.compat.dim);
78 }
79}
80
81static int
82set_match_v0_checkentry(const struct xt_mtchk_param *par)
83{
84 struct xt_set_info_match_v0 *info = par->matchinfo;
85 ip_set_id_t index;
86
87 index = ip_set_nfnl_get_byindex(par->net, info->match_set.index);
88
89 if (index == IPSET_INVALID_ID) {
90 pr_warn("Cannot find set identified by id %u to match\n",
91 info->match_set.index);
92 return -ENOENT;
93 }
94 if (info->match_set.u.flags[IPSET_DIM_MAX - 1] != 0) {
95 pr_warn("Protocol error: set match dimension is over the limit!\n");
96 ip_set_nfnl_put(par->net, info->match_set.index);
97 return -ERANGE;
98 }
99
100 /* Fill out compatibility data */
101 compat_flags(&info->match_set);
102
103 return 0;
104}
105
106static void
107set_match_v0_destroy(const struct xt_mtdtor_param *par)
108{
109 struct xt_set_info_match_v0 *info = par->matchinfo;
110
111 ip_set_nfnl_put(par->net, info->match_set.index);
112}
113
114/* Revision 1 match */
115
116static bool
117set_match_v1(const struct sk_buff *skb, struct xt_action_param *par)
118{
119 const struct xt_set_info_match_v1 *info = par->matchinfo;
120
121 ADT_OPT(opt, xt_family(par), info->match_set.dim,
122 info->match_set.flags, 0, UINT_MAX);
123
124 if (opt.flags & IPSET_RETURN_NOMATCH)
125 opt.cmdflags |= IPSET_FLAG_RETURN_NOMATCH;
126
127 return match_set(info->match_set.index, skb, par, &opt,
128 info->match_set.flags & IPSET_INV_MATCH);
129}
130
131static int
132set_match_v1_checkentry(const struct xt_mtchk_param *par)
133{
134 struct xt_set_info_match_v1 *info = par->matchinfo;
135 ip_set_id_t index;
136
137 index = ip_set_nfnl_get_byindex(par->net, info->match_set.index);
138
139 if (index == IPSET_INVALID_ID) {
140 pr_warn("Cannot find set identified by id %u to match\n",
141 info->match_set.index);
142 return -ENOENT;
143 }
144 if (info->match_set.dim > IPSET_DIM_MAX) {
145 pr_warn("Protocol error: set match dimension is over the limit!\n");
146 ip_set_nfnl_put(par->net, info->match_set.index);
147 return -ERANGE;
148 }
149
150 return 0;
151}
152
153static void
154set_match_v1_destroy(const struct xt_mtdtor_param *par)
155{
156 struct xt_set_info_match_v1 *info = par->matchinfo;
157
158 ip_set_nfnl_put(par->net, info->match_set.index);
159}
160
161/* Revision 3 match */
162
163static bool
164match_counter0(u64 counter, const struct ip_set_counter_match0 *info)
165{
166 switch (info->op) {
167 case IPSET_COUNTER_NONE:
168 return true;
169 case IPSET_COUNTER_EQ:
170 return counter == info->value;
171 case IPSET_COUNTER_NE:
172 return counter != info->value;
173 case IPSET_COUNTER_LT:
174 return counter < info->value;
175 case IPSET_COUNTER_GT:
176 return counter > info->value;
177 }
178 return false;
179}
180
181static bool
182set_match_v3(const struct sk_buff *skb, struct xt_action_param *par)
183{
184 const struct xt_set_info_match_v3 *info = par->matchinfo;
185 int ret;
186
187 ADT_OPT(opt, xt_family(par), info->match_set.dim,
188 info->match_set.flags, info->flags, UINT_MAX);
189
190 if (info->packets.op != IPSET_COUNTER_NONE ||
191 info->bytes.op != IPSET_COUNTER_NONE)
192 opt.cmdflags |= IPSET_FLAG_MATCH_COUNTERS;
193
194 ret = match_set(info->match_set.index, skb, par, &opt,
195 info->match_set.flags & IPSET_INV_MATCH);
196
197 if (!(ret && opt.cmdflags & IPSET_FLAG_MATCH_COUNTERS))
198 return ret;
199
200 if (!match_counter0(opt.ext.packets, &info->packets))
201 return false;
202 return match_counter0(opt.ext.bytes, &info->bytes);
203}
204
205#define set_match_v3_checkentry set_match_v1_checkentry
206#define set_match_v3_destroy set_match_v1_destroy
207
208/* Revision 4 match */
209
210static bool
211match_counter(u64 counter, const struct ip_set_counter_match *info)
212{
213 switch (info->op) {
214 case IPSET_COUNTER_NONE:
215 return true;
216 case IPSET_COUNTER_EQ:
217 return counter == info->value;
218 case IPSET_COUNTER_NE:
219 return counter != info->value;
220 case IPSET_COUNTER_LT:
221 return counter < info->value;
222 case IPSET_COUNTER_GT:
223 return counter > info->value;
224 }
225 return false;
226}
227
228static bool
229set_match_v4(const struct sk_buff *skb, struct xt_action_param *par)
230{
231 const struct xt_set_info_match_v4 *info = par->matchinfo;
232 int ret;
233
234 ADT_OPT(opt, xt_family(par), info->match_set.dim,
235 info->match_set.flags, info->flags, UINT_MAX);
236
237 if (info->packets.op != IPSET_COUNTER_NONE ||
238 info->bytes.op != IPSET_COUNTER_NONE)
239 opt.cmdflags |= IPSET_FLAG_MATCH_COUNTERS;
240
241 ret = match_set(info->match_set.index, skb, par, &opt,
242 info->match_set.flags & IPSET_INV_MATCH);
243
244 if (!(ret && opt.cmdflags & IPSET_FLAG_MATCH_COUNTERS))
245 return ret;
246
247 if (!match_counter(opt.ext.packets, &info->packets))
248 return false;
249 return match_counter(opt.ext.bytes, &info->bytes);
250}
251
252#define set_match_v4_checkentry set_match_v1_checkentry
253#define set_match_v4_destroy set_match_v1_destroy
254
255/* Revision 0 interface: backward compatible with netfilter/iptables */
256
257static unsigned int
258set_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
259{
260 const struct xt_set_info_target_v0 *info = par->targinfo;
261
262 ADT_OPT(add_opt, xt_family(par), info->add_set.u.compat.dim,
263 info->add_set.u.compat.flags, 0, UINT_MAX);
264 ADT_OPT(del_opt, xt_family(par), info->del_set.u.compat.dim,
265 info->del_set.u.compat.flags, 0, UINT_MAX);
266
267 if (info->add_set.index != IPSET_INVALID_ID)
268 ip_set_add(info->add_set.index, skb, par, &add_opt);
269 if (info->del_set.index != IPSET_INVALID_ID)
270 ip_set_del(info->del_set.index, skb, par, &del_opt);
271
272 return XT_CONTINUE;
273}
274
275static int
276set_target_v0_checkentry(const struct xt_tgchk_param *par)
277{
278 struct xt_set_info_target_v0 *info = par->targinfo;
279 ip_set_id_t index;
280
281 if (info->add_set.index != IPSET_INVALID_ID) {
282 index = ip_set_nfnl_get_byindex(par->net, info->add_set.index);
283 if (index == IPSET_INVALID_ID) {
284 pr_warn("Cannot find add_set index %u as target\n",
285 info->add_set.index);
286 return -ENOENT;
287 }
288 }
289
290 if (info->del_set.index != IPSET_INVALID_ID) {
291 index = ip_set_nfnl_get_byindex(par->net, info->del_set.index);
292 if (index == IPSET_INVALID_ID) {
293 pr_warn("Cannot find del_set index %u as target\n",
294 info->del_set.index);
295 if (info->add_set.index != IPSET_INVALID_ID)
296 ip_set_nfnl_put(par->net, info->add_set.index);
297 return -ENOENT;
298 }
299 }
300 if (info->add_set.u.flags[IPSET_DIM_MAX - 1] != 0 ||
301 info->del_set.u.flags[IPSET_DIM_MAX - 1] != 0) {
302 pr_warn("Protocol error: SET target dimension is over the limit!\n");
303 if (info->add_set.index != IPSET_INVALID_ID)
304 ip_set_nfnl_put(par->net, info->add_set.index);
305 if (info->del_set.index != IPSET_INVALID_ID)
306 ip_set_nfnl_put(par->net, info->del_set.index);
307 return -ERANGE;
308 }
309
310 /* Fill out compatibility data */
311 compat_flags(&info->add_set);
312 compat_flags(&info->del_set);
313
314 return 0;
315}
316
317static void
318set_target_v0_destroy(const struct xt_tgdtor_param *par)
319{
320 const struct xt_set_info_target_v0 *info = par->targinfo;
321
322 if (info->add_set.index != IPSET_INVALID_ID)
323 ip_set_nfnl_put(par->net, info->add_set.index);
324 if (info->del_set.index != IPSET_INVALID_ID)
325 ip_set_nfnl_put(par->net, info->del_set.index);
326}
327
328/* Revision 1 target */
329
330static unsigned int
331set_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
332{
333 const struct xt_set_info_target_v1 *info = par->targinfo;
334
335 ADT_OPT(add_opt, xt_family(par), info->add_set.dim,
336 info->add_set.flags, 0, UINT_MAX);
337 ADT_OPT(del_opt, xt_family(par), info->del_set.dim,
338 info->del_set.flags, 0, UINT_MAX);
339
340 if (info->add_set.index != IPSET_INVALID_ID)
341 ip_set_add(info->add_set.index, skb, par, &add_opt);
342 if (info->del_set.index != IPSET_INVALID_ID)
343 ip_set_del(info->del_set.index, skb, par, &del_opt);
344
345 return XT_CONTINUE;
346}
347
348static int
349set_target_v1_checkentry(const struct xt_tgchk_param *par)
350{
351 const struct xt_set_info_target_v1 *info = par->targinfo;
352 ip_set_id_t index;
353
354 if (info->add_set.index != IPSET_INVALID_ID) {
355 index = ip_set_nfnl_get_byindex(par->net, info->add_set.index);
356 if (index == IPSET_INVALID_ID) {
357 pr_warn("Cannot find add_set index %u as target\n",
358 info->add_set.index);
359 return -ENOENT;
360 }
361 }
362
363 if (info->del_set.index != IPSET_INVALID_ID) {
364 index = ip_set_nfnl_get_byindex(par->net, info->del_set.index);
365 if (index == IPSET_INVALID_ID) {
366 pr_warn("Cannot find del_set index %u as target\n",
367 info->del_set.index);
368 if (info->add_set.index != IPSET_INVALID_ID)
369 ip_set_nfnl_put(par->net, info->add_set.index);
370 return -ENOENT;
371 }
372 }
373 if (info->add_set.dim > IPSET_DIM_MAX ||
374 info->del_set.dim > IPSET_DIM_MAX) {
375 pr_warn("Protocol error: SET target dimension is over the limit!\n");
376 if (info->add_set.index != IPSET_INVALID_ID)
377 ip_set_nfnl_put(par->net, info->add_set.index);
378 if (info->del_set.index != IPSET_INVALID_ID)
379 ip_set_nfnl_put(par->net, info->del_set.index);
380 return -ERANGE;
381 }
382
383 return 0;
384}
385
386static void
387set_target_v1_destroy(const struct xt_tgdtor_param *par)
388{
389 const struct xt_set_info_target_v1 *info = par->targinfo;
390
391 if (info->add_set.index != IPSET_INVALID_ID)
392 ip_set_nfnl_put(par->net, info->add_set.index);
393 if (info->del_set.index != IPSET_INVALID_ID)
394 ip_set_nfnl_put(par->net, info->del_set.index);
395}
396
397/* Revision 2 target */
398
399static unsigned int
400set_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
401{
402 const struct xt_set_info_target_v2 *info = par->targinfo;
403
404 ADT_OPT(add_opt, xt_family(par), info->add_set.dim,
405 info->add_set.flags, info->flags, info->timeout);
406 ADT_OPT(del_opt, xt_family(par), info->del_set.dim,
407 info->del_set.flags, 0, UINT_MAX);
408
409 /* Normalize to fit into jiffies */
410 if (add_opt.ext.timeout != IPSET_NO_TIMEOUT &&
411 add_opt.ext.timeout > UINT_MAX / MSEC_PER_SEC)
412 add_opt.ext.timeout = UINT_MAX / MSEC_PER_SEC;
413 if (info->add_set.index != IPSET_INVALID_ID)
414 ip_set_add(info->add_set.index, skb, par, &add_opt);
415 if (info->del_set.index != IPSET_INVALID_ID)
416 ip_set_del(info->del_set.index, skb, par, &del_opt);
417
418 return XT_CONTINUE;
419}
420
421#define set_target_v2_checkentry set_target_v1_checkentry
422#define set_target_v2_destroy set_target_v1_destroy
423
424/* Revision 3 target */
425
426#define MOPT(opt, member) ((opt).ext.skbinfo.member)
427
428static unsigned int
429set_target_v3(struct sk_buff *skb, const struct xt_action_param *par)
430{
431 const struct xt_set_info_target_v3 *info = par->targinfo;
432 int ret;
433
434 ADT_OPT(add_opt, xt_family(par), info->add_set.dim,
435 info->add_set.flags, info->flags, info->timeout);
436 ADT_OPT(del_opt, xt_family(par), info->del_set.dim,
437 info->del_set.flags, 0, UINT_MAX);
438 ADT_OPT(map_opt, xt_family(par), info->map_set.dim,
439 info->map_set.flags, 0, UINT_MAX);
440
441 /* Normalize to fit into jiffies */
442 if (add_opt.ext.timeout != IPSET_NO_TIMEOUT &&
443 add_opt.ext.timeout > UINT_MAX / MSEC_PER_SEC)
444 add_opt.ext.timeout = UINT_MAX / MSEC_PER_SEC;
445 if (info->add_set.index != IPSET_INVALID_ID)
446 ip_set_add(info->add_set.index, skb, par, &add_opt);
447 if (info->del_set.index != IPSET_INVALID_ID)
448 ip_set_del(info->del_set.index, skb, par, &del_opt);
449 if (info->map_set.index != IPSET_INVALID_ID) {
450 map_opt.cmdflags |= info->flags & (IPSET_FLAG_MAP_SKBMARK |
451 IPSET_FLAG_MAP_SKBPRIO |
452 IPSET_FLAG_MAP_SKBQUEUE);
453 ret = match_set(info->map_set.index, skb, par, &map_opt,
454 info->map_set.flags & IPSET_INV_MATCH);
455 if (!ret)
456 return XT_CONTINUE;
457 if (map_opt.cmdflags & IPSET_FLAG_MAP_SKBMARK)
458 skb->mark = (skb->mark & ~MOPT(map_opt,skbmarkmask))
459 ^ MOPT(map_opt, skbmark);
460 if (map_opt.cmdflags & IPSET_FLAG_MAP_SKBPRIO)
461 skb->priority = MOPT(map_opt, skbprio);
462 if ((map_opt.cmdflags & IPSET_FLAG_MAP_SKBQUEUE) &&
463 skb->dev &&
464 skb->dev->real_num_tx_queues > MOPT(map_opt, skbqueue))
465 skb_set_queue_mapping(skb, MOPT(map_opt, skbqueue));
466 }
467 return XT_CONTINUE;
468}
469
470static int
471set_target_v3_checkentry(const struct xt_tgchk_param *par)
472{
473 const struct xt_set_info_target_v3 *info = par->targinfo;
474 ip_set_id_t index;
475
476 if (info->add_set.index != IPSET_INVALID_ID) {
477 index = ip_set_nfnl_get_byindex(par->net,
478 info->add_set.index);
479 if (index == IPSET_INVALID_ID) {
480 pr_warn("Cannot find add_set index %u as target\n",
481 info->add_set.index);
482 return -ENOENT;
483 }
484 }
485
486 if (info->del_set.index != IPSET_INVALID_ID) {
487 index = ip_set_nfnl_get_byindex(par->net,
488 info->del_set.index);
489 if (index == IPSET_INVALID_ID) {
490 pr_warn("Cannot find del_set index %u as target\n",
491 info->del_set.index);
492 if (info->add_set.index != IPSET_INVALID_ID)
493 ip_set_nfnl_put(par->net,
494 info->add_set.index);
495 return -ENOENT;
496 }
497 }
498
499 if (info->map_set.index != IPSET_INVALID_ID) {
500 if (strncmp(par->table, "mangle", 7)) {
501 pr_warn("--map-set only usable from mangle table\n");
502 return -EINVAL;
503 }
504 if (((info->flags & IPSET_FLAG_MAP_SKBPRIO) |
505 (info->flags & IPSET_FLAG_MAP_SKBQUEUE)) &&
506 !(par->hook_mask & (1 << NF_INET_FORWARD |
507 1 << NF_INET_LOCAL_OUT |
508 1 << NF_INET_POST_ROUTING))) {
509 pr_warn("mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains\n");
510 return -EINVAL;
511 }
512 index = ip_set_nfnl_get_byindex(par->net,
513 info->map_set.index);
514 if (index == IPSET_INVALID_ID) {
515 pr_warn("Cannot find map_set index %u as target\n",
516 info->map_set.index);
517 if (info->add_set.index != IPSET_INVALID_ID)
518 ip_set_nfnl_put(par->net,
519 info->add_set.index);
520 if (info->del_set.index != IPSET_INVALID_ID)
521 ip_set_nfnl_put(par->net,
522 info->del_set.index);
523 return -ENOENT;
524 }
525 }
526
527 if (info->add_set.dim > IPSET_DIM_MAX ||
528 info->del_set.dim > IPSET_DIM_MAX ||
529 info->map_set.dim > IPSET_DIM_MAX) {
530 pr_warn("Protocol error: SET target dimension is over the limit!\n");
531 if (info->add_set.index != IPSET_INVALID_ID)
532 ip_set_nfnl_put(par->net, info->add_set.index);
533 if (info->del_set.index != IPSET_INVALID_ID)
534 ip_set_nfnl_put(par->net, info->del_set.index);
535 if (info->map_set.index != IPSET_INVALID_ID)
536 ip_set_nfnl_put(par->net, info->map_set.index);
537 return -ERANGE;
538 }
539
540 return 0;
541}
542
543static void
544set_target_v3_destroy(const struct xt_tgdtor_param *par)
545{
546 const struct xt_set_info_target_v3 *info = par->targinfo;
547
548 if (info->add_set.index != IPSET_INVALID_ID)
549 ip_set_nfnl_put(par->net, info->add_set.index);
550 if (info->del_set.index != IPSET_INVALID_ID)
551 ip_set_nfnl_put(par->net, info->del_set.index);
552 if (info->map_set.index != IPSET_INVALID_ID)
553 ip_set_nfnl_put(par->net, info->map_set.index);
554}
555
556static struct xt_match set_matches[] __read_mostly = {
557 {
558 .name = "set",
559 .family = NFPROTO_IPV4,
560 .revision = 0,
561 .match = set_match_v0,
562 .matchsize = sizeof(struct xt_set_info_match_v0),
563 .checkentry = set_match_v0_checkentry,
564 .destroy = set_match_v0_destroy,
565 .me = THIS_MODULE
566 },
567 {
568 .name = "set",
569 .family = NFPROTO_IPV4,
570 .revision = 1,
571 .match = set_match_v1,
572 .matchsize = sizeof(struct xt_set_info_match_v1),
573 .checkentry = set_match_v1_checkentry,
574 .destroy = set_match_v1_destroy,
575 .me = THIS_MODULE
576 },
577 {
578 .name = "set",
579 .family = NFPROTO_IPV6,
580 .revision = 1,
581 .match = set_match_v1,
582 .matchsize = sizeof(struct xt_set_info_match_v1),
583 .checkentry = set_match_v1_checkentry,
584 .destroy = set_match_v1_destroy,
585 .me = THIS_MODULE
586 },
587 /* --return-nomatch flag support */
588 {
589 .name = "set",
590 .family = NFPROTO_IPV4,
591 .revision = 2,
592 .match = set_match_v1,
593 .matchsize = sizeof(struct xt_set_info_match_v1),
594 .checkentry = set_match_v1_checkentry,
595 .destroy = set_match_v1_destroy,
596 .me = THIS_MODULE
597 },
598 {
599 .name = "set",
600 .family = NFPROTO_IPV6,
601 .revision = 2,
602 .match = set_match_v1,
603 .matchsize = sizeof(struct xt_set_info_match_v1),
604 .checkentry = set_match_v1_checkentry,
605 .destroy = set_match_v1_destroy,
606 .me = THIS_MODULE
607 },
608 /* counters support: update, match */
609 {
610 .name = "set",
611 .family = NFPROTO_IPV4,
612 .revision = 3,
613 .match = set_match_v3,
614 .matchsize = sizeof(struct xt_set_info_match_v3),
615 .checkentry = set_match_v3_checkentry,
616 .destroy = set_match_v3_destroy,
617 .me = THIS_MODULE
618 },
619 {
620 .name = "set",
621 .family = NFPROTO_IPV6,
622 .revision = 3,
623 .match = set_match_v3,
624 .matchsize = sizeof(struct xt_set_info_match_v3),
625 .checkentry = set_match_v3_checkentry,
626 .destroy = set_match_v3_destroy,
627 .me = THIS_MODULE
628 },
629 /* new revision for counters support: update, match */
630 {
631 .name = "set",
632 .family = NFPROTO_IPV4,
633 .revision = 4,
634 .match = set_match_v4,
635 .matchsize = sizeof(struct xt_set_info_match_v4),
636 .checkentry = set_match_v4_checkentry,
637 .destroy = set_match_v4_destroy,
638 .me = THIS_MODULE
639 },
640 {
641 .name = "set",
642 .family = NFPROTO_IPV6,
643 .revision = 4,
644 .match = set_match_v4,
645 .matchsize = sizeof(struct xt_set_info_match_v4),
646 .checkentry = set_match_v4_checkentry,
647 .destroy = set_match_v4_destroy,
648 .me = THIS_MODULE
649 },
650};
651
652static struct xt_target set_targets[] __read_mostly = {
653 {
654 .name = "SET",
655 .revision = 0,
656 .family = NFPROTO_IPV4,
657 .target = set_target_v0,
658 .targetsize = sizeof(struct xt_set_info_target_v0),
659 .checkentry = set_target_v0_checkentry,
660 .destroy = set_target_v0_destroy,
661 .me = THIS_MODULE
662 },
663 {
664 .name = "SET",
665 .revision = 1,
666 .family = NFPROTO_IPV4,
667 .target = set_target_v1,
668 .targetsize = sizeof(struct xt_set_info_target_v1),
669 .checkentry = set_target_v1_checkentry,
670 .destroy = set_target_v1_destroy,
671 .me = THIS_MODULE
672 },
673 {
674 .name = "SET",
675 .revision = 1,
676 .family = NFPROTO_IPV6,
677 .target = set_target_v1,
678 .targetsize = sizeof(struct xt_set_info_target_v1),
679 .checkentry = set_target_v1_checkentry,
680 .destroy = set_target_v1_destroy,
681 .me = THIS_MODULE
682 },
683 /* --timeout and --exist flags support */
684 {
685 .name = "SET",
686 .revision = 2,
687 .family = NFPROTO_IPV4,
688 .target = set_target_v2,
689 .targetsize = sizeof(struct xt_set_info_target_v2),
690 .checkentry = set_target_v2_checkentry,
691 .destroy = set_target_v2_destroy,
692 .me = THIS_MODULE
693 },
694 {
695 .name = "SET",
696 .revision = 2,
697 .family = NFPROTO_IPV6,
698 .target = set_target_v2,
699 .targetsize = sizeof(struct xt_set_info_target_v2),
700 .checkentry = set_target_v2_checkentry,
701 .destroy = set_target_v2_destroy,
702 .me = THIS_MODULE
703 },
704 /* --map-set support */
705 {
706 .name = "SET",
707 .revision = 3,
708 .family = NFPROTO_IPV4,
709 .target = set_target_v3,
710 .targetsize = sizeof(struct xt_set_info_target_v3),
711 .checkentry = set_target_v3_checkentry,
712 .destroy = set_target_v3_destroy,
713 .me = THIS_MODULE
714 },
715 {
716 .name = "SET",
717 .revision = 3,
718 .family = NFPROTO_IPV6,
719 .target = set_target_v3,
720 .targetsize = sizeof(struct xt_set_info_target_v3),
721 .checkentry = set_target_v3_checkentry,
722 .destroy = set_target_v3_destroy,
723 .me = THIS_MODULE
724 },
725};
726
727static int __init xt_set_init(void)
728{
729 int ret = xt_register_matches(set_matches, ARRAY_SIZE(set_matches));
730
731 if (!ret) {
732 ret = xt_register_targets(set_targets,
733 ARRAY_SIZE(set_targets));
734 if (ret)
735 xt_unregister_matches(set_matches,
736 ARRAY_SIZE(set_matches));
737 }
738 return ret;
739}
740
741static void __exit xt_set_fini(void)
742{
743 xt_unregister_matches(set_matches, ARRAY_SIZE(set_matches));
744 xt_unregister_targets(set_targets, ARRAY_SIZE(set_targets));
745}
746
747module_init(xt_set_init);
748module_exit(xt_set_fini);
1/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
2 * Patrick Schaaf <bof@bof.de>
3 * Martin Josefsson <gandalf@wlug.westbo.se>
4 * Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
10
11/* Kernel module which implements the set match and SET target
12 * for netfilter/iptables. */
13
14#include <linux/module.h>
15#include <linux/skbuff.h>
16
17#include <linux/netfilter/x_tables.h>
18#include <linux/netfilter/xt_set.h>
19
20MODULE_LICENSE("GPL");
21MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
22MODULE_DESCRIPTION("Xtables: IP set match and target module");
23MODULE_ALIAS("xt_SET");
24MODULE_ALIAS("ipt_set");
25MODULE_ALIAS("ip6t_set");
26MODULE_ALIAS("ipt_SET");
27MODULE_ALIAS("ip6t_SET");
28
29static inline int
30match_set(ip_set_id_t index, const struct sk_buff *skb,
31 const struct xt_action_param *par,
32 const struct ip_set_adt_opt *opt, int inv)
33{
34 if (ip_set_test(index, skb, par, opt))
35 inv = !inv;
36 return inv;
37}
38
39#define ADT_OPT(n, f, d, fs, cfs, t) \
40const struct ip_set_adt_opt n = { \
41 .family = f, \
42 .dim = d, \
43 .flags = fs, \
44 .cmdflags = cfs, \
45 .timeout = t, \
46}
47
48/* Revision 0 interface: backward compatible with netfilter/iptables */
49
50static bool
51set_match_v0(const struct sk_buff *skb, struct xt_action_param *par)
52{
53 const struct xt_set_info_match_v0 *info = par->matchinfo;
54 ADT_OPT(opt, par->family, info->match_set.u.compat.dim,
55 info->match_set.u.compat.flags, 0, UINT_MAX);
56
57 return match_set(info->match_set.index, skb, par, &opt,
58 info->match_set.u.compat.flags & IPSET_INV_MATCH);
59}
60
61static void
62compat_flags(struct xt_set_info_v0 *info)
63{
64 u_int8_t i;
65
66 /* Fill out compatibility data according to enum ip_set_kopt */
67 info->u.compat.dim = IPSET_DIM_ZERO;
68 if (info->u.flags[0] & IPSET_MATCH_INV)
69 info->u.compat.flags |= IPSET_INV_MATCH;
70 for (i = 0; i < IPSET_DIM_MAX-1 && info->u.flags[i]; i++) {
71 info->u.compat.dim++;
72 if (info->u.flags[i] & IPSET_SRC)
73 info->u.compat.flags |= (1<<info->u.compat.dim);
74 }
75}
76
77static int
78set_match_v0_checkentry(const struct xt_mtchk_param *par)
79{
80 struct xt_set_info_match_v0 *info = par->matchinfo;
81 ip_set_id_t index;
82
83 index = ip_set_nfnl_get_byindex(info->match_set.index);
84
85 if (index == IPSET_INVALID_ID) {
86 pr_warning("Cannot find set indentified by id %u to match\n",
87 info->match_set.index);
88 return -ENOENT;
89 }
90 if (info->match_set.u.flags[IPSET_DIM_MAX-1] != 0) {
91 pr_warning("Protocol error: set match dimension "
92 "is over the limit!\n");
93 ip_set_nfnl_put(info->match_set.index);
94 return -ERANGE;
95 }
96
97 /* Fill out compatibility data */
98 compat_flags(&info->match_set);
99
100 return 0;
101}
102
103static void
104set_match_v0_destroy(const struct xt_mtdtor_param *par)
105{
106 struct xt_set_info_match_v0 *info = par->matchinfo;
107
108 ip_set_nfnl_put(info->match_set.index);
109}
110
111static unsigned int
112set_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
113{
114 const struct xt_set_info_target_v0 *info = par->targinfo;
115 ADT_OPT(add_opt, par->family, info->add_set.u.compat.dim,
116 info->add_set.u.compat.flags, 0, UINT_MAX);
117 ADT_OPT(del_opt, par->family, info->del_set.u.compat.dim,
118 info->del_set.u.compat.flags, 0, UINT_MAX);
119
120 if (info->add_set.index != IPSET_INVALID_ID)
121 ip_set_add(info->add_set.index, skb, par, &add_opt);
122 if (info->del_set.index != IPSET_INVALID_ID)
123 ip_set_del(info->del_set.index, skb, par, &del_opt);
124
125 return XT_CONTINUE;
126}
127
128static int
129set_target_v0_checkentry(const struct xt_tgchk_param *par)
130{
131 struct xt_set_info_target_v0 *info = par->targinfo;
132 ip_set_id_t index;
133
134 if (info->add_set.index != IPSET_INVALID_ID) {
135 index = ip_set_nfnl_get_byindex(info->add_set.index);
136 if (index == IPSET_INVALID_ID) {
137 pr_warning("Cannot find add_set index %u as target\n",
138 info->add_set.index);
139 return -ENOENT;
140 }
141 }
142
143 if (info->del_set.index != IPSET_INVALID_ID) {
144 index = ip_set_nfnl_get_byindex(info->del_set.index);
145 if (index == IPSET_INVALID_ID) {
146 pr_warning("Cannot find del_set index %u as target\n",
147 info->del_set.index);
148 if (info->add_set.index != IPSET_INVALID_ID)
149 ip_set_nfnl_put(info->add_set.index);
150 return -ENOENT;
151 }
152 }
153 if (info->add_set.u.flags[IPSET_DIM_MAX-1] != 0 ||
154 info->del_set.u.flags[IPSET_DIM_MAX-1] != 0) {
155 pr_warning("Protocol error: SET target dimension "
156 "is over the limit!\n");
157 if (info->add_set.index != IPSET_INVALID_ID)
158 ip_set_nfnl_put(info->add_set.index);
159 if (info->del_set.index != IPSET_INVALID_ID)
160 ip_set_nfnl_put(info->del_set.index);
161 return -ERANGE;
162 }
163
164 /* Fill out compatibility data */
165 compat_flags(&info->add_set);
166 compat_flags(&info->del_set);
167
168 return 0;
169}
170
171static void
172set_target_v0_destroy(const struct xt_tgdtor_param *par)
173{
174 const struct xt_set_info_target_v0 *info = par->targinfo;
175
176 if (info->add_set.index != IPSET_INVALID_ID)
177 ip_set_nfnl_put(info->add_set.index);
178 if (info->del_set.index != IPSET_INVALID_ID)
179 ip_set_nfnl_put(info->del_set.index);
180}
181
182/* Revision 1 match and target */
183
184static bool
185set_match_v1(const struct sk_buff *skb, struct xt_action_param *par)
186{
187 const struct xt_set_info_match_v1 *info = par->matchinfo;
188 ADT_OPT(opt, par->family, info->match_set.dim,
189 info->match_set.flags, 0, UINT_MAX);
190
191 return match_set(info->match_set.index, skb, par, &opt,
192 info->match_set.flags & IPSET_INV_MATCH);
193}
194
195static int
196set_match_v1_checkentry(const struct xt_mtchk_param *par)
197{
198 struct xt_set_info_match_v1 *info = par->matchinfo;
199 ip_set_id_t index;
200
201 index = ip_set_nfnl_get_byindex(info->match_set.index);
202
203 if (index == IPSET_INVALID_ID) {
204 pr_warning("Cannot find set indentified by id %u to match\n",
205 info->match_set.index);
206 return -ENOENT;
207 }
208 if (info->match_set.dim > IPSET_DIM_MAX) {
209 pr_warning("Protocol error: set match dimension "
210 "is over the limit!\n");
211 ip_set_nfnl_put(info->match_set.index);
212 return -ERANGE;
213 }
214
215 return 0;
216}
217
218static void
219set_match_v1_destroy(const struct xt_mtdtor_param *par)
220{
221 struct xt_set_info_match_v1 *info = par->matchinfo;
222
223 ip_set_nfnl_put(info->match_set.index);
224}
225
226static unsigned int
227set_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
228{
229 const struct xt_set_info_target_v1 *info = par->targinfo;
230 ADT_OPT(add_opt, par->family, info->add_set.dim,
231 info->add_set.flags, 0, UINT_MAX);
232 ADT_OPT(del_opt, par->family, info->del_set.dim,
233 info->del_set.flags, 0, UINT_MAX);
234
235 if (info->add_set.index != IPSET_INVALID_ID)
236 ip_set_add(info->add_set.index, skb, par, &add_opt);
237 if (info->del_set.index != IPSET_INVALID_ID)
238 ip_set_del(info->del_set.index, skb, par, &del_opt);
239
240 return XT_CONTINUE;
241}
242
243static int
244set_target_v1_checkentry(const struct xt_tgchk_param *par)
245{
246 const struct xt_set_info_target_v1 *info = par->targinfo;
247 ip_set_id_t index;
248
249 if (info->add_set.index != IPSET_INVALID_ID) {
250 index = ip_set_nfnl_get_byindex(info->add_set.index);
251 if (index == IPSET_INVALID_ID) {
252 pr_warning("Cannot find add_set index %u as target\n",
253 info->add_set.index);
254 return -ENOENT;
255 }
256 }
257
258 if (info->del_set.index != IPSET_INVALID_ID) {
259 index = ip_set_nfnl_get_byindex(info->del_set.index);
260 if (index == IPSET_INVALID_ID) {
261 pr_warning("Cannot find del_set index %u as target\n",
262 info->del_set.index);
263 if (info->add_set.index != IPSET_INVALID_ID)
264 ip_set_nfnl_put(info->add_set.index);
265 return -ENOENT;
266 }
267 }
268 if (info->add_set.dim > IPSET_DIM_MAX ||
269 info->del_set.dim > IPSET_DIM_MAX) {
270 pr_warning("Protocol error: SET target dimension "
271 "is over the limit!\n");
272 if (info->add_set.index != IPSET_INVALID_ID)
273 ip_set_nfnl_put(info->add_set.index);
274 if (info->del_set.index != IPSET_INVALID_ID)
275 ip_set_nfnl_put(info->del_set.index);
276 return -ERANGE;
277 }
278
279 return 0;
280}
281
282static void
283set_target_v1_destroy(const struct xt_tgdtor_param *par)
284{
285 const struct xt_set_info_target_v1 *info = par->targinfo;
286
287 if (info->add_set.index != IPSET_INVALID_ID)
288 ip_set_nfnl_put(info->add_set.index);
289 if (info->del_set.index != IPSET_INVALID_ID)
290 ip_set_nfnl_put(info->del_set.index);
291}
292
293/* Revision 2 target */
294
295static unsigned int
296set_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
297{
298 const struct xt_set_info_target_v2 *info = par->targinfo;
299 ADT_OPT(add_opt, par->family, info->add_set.dim,
300 info->add_set.flags, info->flags, info->timeout);
301 ADT_OPT(del_opt, par->family, info->del_set.dim,
302 info->del_set.flags, 0, UINT_MAX);
303
304 if (info->add_set.index != IPSET_INVALID_ID)
305 ip_set_add(info->add_set.index, skb, par, &add_opt);
306 if (info->del_set.index != IPSET_INVALID_ID)
307 ip_set_del(info->del_set.index, skb, par, &del_opt);
308
309 return XT_CONTINUE;
310}
311
312#define set_target_v2_checkentry set_target_v1_checkentry
313#define set_target_v2_destroy set_target_v1_destroy
314
315static struct xt_match set_matches[] __read_mostly = {
316 {
317 .name = "set",
318 .family = NFPROTO_IPV4,
319 .revision = 0,
320 .match = set_match_v0,
321 .matchsize = sizeof(struct xt_set_info_match_v0),
322 .checkentry = set_match_v0_checkentry,
323 .destroy = set_match_v0_destroy,
324 .me = THIS_MODULE
325 },
326 {
327 .name = "set",
328 .family = NFPROTO_IPV4,
329 .revision = 1,
330 .match = set_match_v1,
331 .matchsize = sizeof(struct xt_set_info_match_v1),
332 .checkentry = set_match_v1_checkentry,
333 .destroy = set_match_v1_destroy,
334 .me = THIS_MODULE
335 },
336 {
337 .name = "set",
338 .family = NFPROTO_IPV6,
339 .revision = 1,
340 .match = set_match_v1,
341 .matchsize = sizeof(struct xt_set_info_match_v1),
342 .checkentry = set_match_v1_checkentry,
343 .destroy = set_match_v1_destroy,
344 .me = THIS_MODULE
345 },
346};
347
348static struct xt_target set_targets[] __read_mostly = {
349 {
350 .name = "SET",
351 .revision = 0,
352 .family = NFPROTO_IPV4,
353 .target = set_target_v0,
354 .targetsize = sizeof(struct xt_set_info_target_v0),
355 .checkentry = set_target_v0_checkentry,
356 .destroy = set_target_v0_destroy,
357 .me = THIS_MODULE
358 },
359 {
360 .name = "SET",
361 .revision = 1,
362 .family = NFPROTO_IPV4,
363 .target = set_target_v1,
364 .targetsize = sizeof(struct xt_set_info_target_v1),
365 .checkentry = set_target_v1_checkentry,
366 .destroy = set_target_v1_destroy,
367 .me = THIS_MODULE
368 },
369 {
370 .name = "SET",
371 .revision = 1,
372 .family = NFPROTO_IPV6,
373 .target = set_target_v1,
374 .targetsize = sizeof(struct xt_set_info_target_v1),
375 .checkentry = set_target_v1_checkentry,
376 .destroy = set_target_v1_destroy,
377 .me = THIS_MODULE
378 },
379 {
380 .name = "SET",
381 .revision = 2,
382 .family = NFPROTO_IPV4,
383 .target = set_target_v2,
384 .targetsize = sizeof(struct xt_set_info_target_v2),
385 .checkentry = set_target_v2_checkentry,
386 .destroy = set_target_v2_destroy,
387 .me = THIS_MODULE
388 },
389 {
390 .name = "SET",
391 .revision = 2,
392 .family = NFPROTO_IPV6,
393 .target = set_target_v2,
394 .targetsize = sizeof(struct xt_set_info_target_v2),
395 .checkentry = set_target_v2_checkentry,
396 .destroy = set_target_v2_destroy,
397 .me = THIS_MODULE
398 },
399};
400
401static int __init xt_set_init(void)
402{
403 int ret = xt_register_matches(set_matches, ARRAY_SIZE(set_matches));
404
405 if (!ret) {
406 ret = xt_register_targets(set_targets,
407 ARRAY_SIZE(set_targets));
408 if (ret)
409 xt_unregister_matches(set_matches,
410 ARRAY_SIZE(set_matches));
411 }
412 return ret;
413}
414
415static void __exit xt_set_fini(void)
416{
417 xt_unregister_matches(set_matches, ARRAY_SIZE(set_matches));
418 xt_unregister_targets(set_targets, ARRAY_SIZE(set_targets));
419}
420
421module_init(xt_set_init);
422module_exit(xt_set_fini);