1 /* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
2  *                         Patrick Schaaf <bof@bof.de>
3  *			   Martin Josefsson <gandalf@wlug.westbo.se>
4  * Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License version 2 as
8  * published by the Free Software Foundation.
9  */
10 
11 /* Kernel module implementing an IP set type: the bitmap:ip,mac type */
12 
13 #include <linux/module.h>
14 #include <linux/ip.h>
15 #include <linux/etherdevice.h>
16 #include <linux/skbuff.h>
17 #include <linux/errno.h>
18 #include <linux/if_ether.h>
19 #include <linux/netlink.h>
20 #include <linux/jiffies.h>
21 #include <linux/timer.h>
22 #include <net/netlink.h>
23 
24 #include <linux/netfilter/ipset/pfxlen.h>
25 #include <linux/netfilter/ipset/ip_set.h>
26 #include <linux/netfilter/ipset/ip_set_bitmap.h>
27 
28 #define IPSET_TYPE_REV_MIN	0
29 /*				1	   Counter support added */
30 /*				2	   Comment support added */
31 #define IPSET_TYPE_REV_MAX	3	/* skbinfo support added */
32 
33 MODULE_LICENSE("GPL");
34 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
35 IP_SET_MODULE_DESC("bitmap:ip,mac", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
36 MODULE_ALIAS("ip_set_bitmap:ip,mac");
37 
38 #define MTYPE		bitmap_ipmac
39 #define HOST_MASK	32
40 #define IP_SET_BITMAP_STORED_TIMEOUT
41 
42 enum {
43 	MAC_UNSET,		/* element is set, without MAC */
44 	MAC_FILLED,		/* element is set with MAC */
45 };
46 
47 /* Type structure */
48 struct bitmap_ipmac {
49 	void *members;		/* the set members */
50 	u32 first_ip;		/* host byte order, included in range */
51 	u32 last_ip;		/* host byte order, included in range */
52 	u32 elements;		/* number of max elements in the set */
53 	size_t memsize;		/* members size */
54 	struct timer_list gc;	/* garbage collector */
55 	struct ip_set *set;	/* attached to this ip_set */
56 	unsigned char extensions[0]	/* MAC + data extensions */
57 		__aligned(__alignof__(u64));
58 };
59 
60 /* ADT structure for generic function args */
61 struct bitmap_ipmac_adt_elem {
62 	unsigned char ether[ETH_ALEN] __aligned(2);
63 	u16 id;
64 	u16 add_mac;
65 };
66 
67 struct bitmap_ipmac_elem {
68 	unsigned char ether[ETH_ALEN];
69 	unsigned char filled;
70 } __aligned(__alignof__(u64));
71 
72 static inline u32
73 ip_to_id(const struct bitmap_ipmac *m, u32 ip)
74 {
75 	return ip - m->first_ip;
76 }
77 
78 #define get_elem(extensions, id, dsize)		\
79 	(struct bitmap_ipmac_elem *)(extensions + (id) * (dsize))
80 
81 #define get_const_elem(extensions, id, dsize)	\
82 	(const struct bitmap_ipmac_elem *)(extensions + (id) * (dsize))
83 
84 /* Common functions */
85 
86 static inline int
87 bitmap_ipmac_do_test(const struct bitmap_ipmac_adt_elem *e,
88 		     const struct bitmap_ipmac *map, size_t dsize)
89 {
90 	const struct bitmap_ipmac_elem *elem;
91 
92 	if (!test_bit(e->id, map->members))
93 		return 0;
94 	elem = get_const_elem(map->extensions, e->id, dsize);
95 	if (e->add_mac && elem->filled == MAC_FILLED)
96 		return ether_addr_equal(e->ether, elem->ether);
97 	/* Trigger kernel to fill out the ethernet address */
98 	return -EAGAIN;
99 }
100 
101 static inline int
102 bitmap_ipmac_gc_test(u16 id, const struct bitmap_ipmac *map, size_t dsize)
103 {
104 	const struct bitmap_ipmac_elem *elem;
105 
106 	if (!test_bit(id, map->members))
107 		return 0;
108 	elem = get_const_elem(map->extensions, id, dsize);
109 	/* Timer not started for the incomplete elements */
110 	return elem->filled == MAC_FILLED;
111 }
112 
113 static inline int
114 bitmap_ipmac_is_filled(const struct bitmap_ipmac_elem *elem)
115 {
116 	return elem->filled == MAC_FILLED;
117 }
118 
119 static inline int
120 bitmap_ipmac_add_timeout(unsigned long *timeout,
121 			 const struct bitmap_ipmac_adt_elem *e,
122 			 const struct ip_set_ext *ext, struct ip_set *set,
123 			 struct bitmap_ipmac *map, int mode)
124 {
125 	u32 t = ext->timeout;
126 
127 	if (mode == IPSET_ADD_START_STORED_TIMEOUT) {
128 		if (t == set->timeout)
129 			/* Timeout was not specified, get stored one */
130 			t = *timeout;
131 		ip_set_timeout_set(timeout, t);
132 	} else {
133 		/* If MAC is unset yet, we store plain timeout value
134 		 * because the timer is not activated yet
135 		 * and we can reuse it later when MAC is filled out,
136 		 * possibly by the kernel
137 		 */
138 		if (e->add_mac)
139 			ip_set_timeout_set(timeout, t);
140 		else
141 			*timeout = t;
142 	}
143 	return 0;
144 }
145 
146 static inline int
147 bitmap_ipmac_do_add(const struct bitmap_ipmac_adt_elem *e,
148 		    struct bitmap_ipmac *map, u32 flags, size_t dsize)
149 {
150 	struct bitmap_ipmac_elem *elem;
151 
152 	elem = get_elem(map->extensions, e->id, dsize);
153 	if (test_bit(e->id, map->members)) {
154 		if (elem->filled == MAC_FILLED) {
155 			if (e->add_mac &&
156 			    (flags & IPSET_FLAG_EXIST) &&
157 			    !ether_addr_equal(e->ether, elem->ether)) {
158 				/* memcpy isn't atomic */
159 				clear_bit(e->id, map->members);
160 				smp_mb__after_atomic();
161 				ether_addr_copy(elem->ether, e->ether);
162 			}
163 			return IPSET_ADD_FAILED;
164 		} else if (!e->add_mac)
165 			/* Already added without ethernet address */
166 			return IPSET_ADD_FAILED;
167 		/* Fill the MAC address and trigger the timer activation */
168 		clear_bit(e->id, map->members);
169 		smp_mb__after_atomic();
170 		ether_addr_copy(elem->ether, e->ether);
171 		elem->filled = MAC_FILLED;
172 		return IPSET_ADD_START_STORED_TIMEOUT;
173 	} else if (e->add_mac) {
174 		/* We can store MAC too */
175 		ether_addr_copy(elem->ether, e->ether);
176 		elem->filled = MAC_FILLED;
177 		return 0;
178 	}
179 	elem->filled = MAC_UNSET;
180 	/* MAC is not stored yet, don't start timer */
181 	return IPSET_ADD_STORE_PLAIN_TIMEOUT;
182 }
183 
184 static inline int
185 bitmap_ipmac_do_del(const struct bitmap_ipmac_adt_elem *e,
186 		    struct bitmap_ipmac *map)
187 {
188 	return !test_and_clear_bit(e->id, map->members);
189 }
190 
191 static inline int
192 bitmap_ipmac_do_list(struct sk_buff *skb, const struct bitmap_ipmac *map,
193 		     u32 id, size_t dsize)
194 {
195 	const struct bitmap_ipmac_elem *elem =
196 		get_const_elem(map->extensions, id, dsize);
197 
198 	return nla_put_ipaddr4(skb, IPSET_ATTR_IP,
199 			       htonl(map->first_ip + id)) ||
200 	       (elem->filled == MAC_FILLED &&
201 		nla_put(skb, IPSET_ATTR_ETHER, ETH_ALEN, elem->ether));
202 }
203 
204 static inline int
205 bitmap_ipmac_do_head(struct sk_buff *skb, const struct bitmap_ipmac *map)
206 {
207 	return nla_put_ipaddr4(skb, IPSET_ATTR_IP, htonl(map->first_ip)) ||
208 	       nla_put_ipaddr4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
209 }
210 
211 static int
212 bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
213 		  const struct xt_action_param *par,
214 		  enum ipset_adt adt, struct ip_set_adt_opt *opt)
215 {
216 	struct bitmap_ipmac *map = set->data;
217 	ipset_adtfn adtfn = set->variant->adt[adt];
218 	struct bitmap_ipmac_adt_elem e = { .id = 0, .add_mac = 1 };
219 	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
220 	u32 ip;
221 
222 	/* MAC can be src only */
223 	if (!(opt->flags & IPSET_DIM_TWO_SRC))
224 		return 0;
225 
226 	ip = ntohl(ip4addr(skb, opt->flags & IPSET_DIM_ONE_SRC));
227 	if (ip < map->first_ip || ip > map->last_ip)
228 		return -IPSET_ERR_BITMAP_RANGE;
229 
230 	/* Backward compatibility: we don't check the second flag */
231 	if (skb_mac_header(skb) < skb->head ||
232 	    (skb_mac_header(skb) + ETH_HLEN) > skb->data)
233 		return -EINVAL;
234 
235 	e.id = ip_to_id(map, ip);
236 	memcpy(e.ether, eth_hdr(skb)->h_source, ETH_ALEN);
237 
238 	return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
239 }
240 
241 static int
242 bitmap_ipmac_uadt(struct ip_set *set, struct nlattr *tb[],
243 		  enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
244 {
245 	const struct bitmap_ipmac *map = set->data;
246 	ipset_adtfn adtfn = set->variant->adt[adt];
247 	struct bitmap_ipmac_adt_elem e = { .id = 0 };
248 	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
249 	u32 ip = 0;
250 	int ret = 0;
251 
252 	if (tb[IPSET_ATTR_LINENO])
253 		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
254 
255 	if (unlikely(!tb[IPSET_ATTR_IP]))
256 		return -IPSET_ERR_PROTOCOL;
257 
258 	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
259 	if (ret)
260 		return ret;
261 
262 	ret = ip_set_get_extensions(set, tb, &ext);
263 	if (ret)
264 		return ret;
265 
266 	if (ip < map->first_ip || ip > map->last_ip)
267 		return -IPSET_ERR_BITMAP_RANGE;
268 
269 	e.id = ip_to_id(map, ip);
270 	if (tb[IPSET_ATTR_ETHER]) {
271 		if (nla_len(tb[IPSET_ATTR_ETHER]) != ETH_ALEN)
272 			return -IPSET_ERR_PROTOCOL;
273 		memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN);
274 		e.add_mac = 1;
275 	}
276 	ret = adtfn(set, &e, &ext, &ext, flags);
277 
278 	return ip_set_eexist(ret, flags) ? 0 : ret;
279 }
280 
281 static bool
282 bitmap_ipmac_same_set(const struct ip_set *a, const struct ip_set *b)
283 {
284 	const struct bitmap_ipmac *x = a->data;
285 	const struct bitmap_ipmac *y = b->data;
286 
287 	return x->first_ip == y->first_ip &&
288 	       x->last_ip == y->last_ip &&
289 	       a->timeout == b->timeout &&
290 	       a->extensions == b->extensions;
291 }
292 
293 /* Plain variant */
294 
295 #include "ip_set_bitmap_gen.h"
296 
297 /* Create bitmap:ip,mac type of sets */
298 
299 static bool
300 init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,
301 	       u32 first_ip, u32 last_ip, u32 elements)
302 {
303 	map->members = ip_set_alloc(map->memsize);
304 	if (!map->members)
305 		return false;
306 	map->first_ip = first_ip;
307 	map->last_ip = last_ip;
308 	map->elements = elements;
309 	set->timeout = IPSET_NO_TIMEOUT;
310 
311 	map->set = set;
312 	set->data = map;
313 	set->family = NFPROTO_IPV4;
314 
315 	return true;
316 }
317 
318 static int
319 bitmap_ipmac_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
320 		    u32 flags)
321 {
322 	u32 first_ip = 0, last_ip = 0;
323 	u64 elements;
324 	struct bitmap_ipmac *map;
325 	int ret;
326 
327 	if (unlikely(!tb[IPSET_ATTR_IP] ||
328 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
329 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
330 		return -IPSET_ERR_PROTOCOL;
331 
332 	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &first_ip);
333 	if (ret)
334 		return ret;
335 
336 	if (tb[IPSET_ATTR_IP_TO]) {
337 		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &last_ip);
338 		if (ret)
339 			return ret;
340 		if (first_ip > last_ip)
341 			swap(first_ip, last_ip);
342 	} else if (tb[IPSET_ATTR_CIDR]) {
343 		u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
344 
345 		if (cidr >= HOST_MASK)
346 			return -IPSET_ERR_INVALID_CIDR;
347 		ip_set_mask_from_to(first_ip, last_ip, cidr);
348 	} else {
349 		return -IPSET_ERR_PROTOCOL;
350 	}
351 
352 	elements = (u64)last_ip - first_ip + 1;
353 
354 	if (elements > IPSET_BITMAP_MAX_RANGE + 1)
355 		return -IPSET_ERR_BITMAP_RANGE_SIZE;
356 
357 	set->dsize = ip_set_elem_len(set, tb,
358 				     sizeof(struct bitmap_ipmac_elem),
359 				     __alignof__(struct bitmap_ipmac_elem));
360 	map = ip_set_alloc(sizeof(*map) + elements * set->dsize);
361 	if (!map)
362 		return -ENOMEM;
363 
364 	map->memsize = bitmap_bytes(0, elements - 1);
365 	set->variant = &bitmap_ipmac;
366 	if (!init_map_ipmac(set, map, first_ip, last_ip, elements)) {
367 		kfree(map);
368 		return -ENOMEM;
369 	}
370 	if (tb[IPSET_ATTR_TIMEOUT]) {
371 		set->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
372 		bitmap_ipmac_gc_init(set, bitmap_ipmac_gc);
373 	}
374 	return 0;
375 }
376 
377 static struct ip_set_type bitmap_ipmac_type = {
378 	.name		= "bitmap:ip,mac",
379 	.protocol	= IPSET_PROTOCOL,
380 	.features	= IPSET_TYPE_IP | IPSET_TYPE_MAC,
381 	.dimension	= IPSET_DIM_TWO,
382 	.family		= NFPROTO_IPV4,
383 	.revision_min	= IPSET_TYPE_REV_MIN,
384 	.revision_max	= IPSET_TYPE_REV_MAX,
385 	.create		= bitmap_ipmac_create,
386 	.create_policy	= {
387 		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
388 		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
389 		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
390 		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
391 		[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },
392 	},
393 	.adt_policy	= {
394 		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
395 		[IPSET_ATTR_ETHER]	= { .type = NLA_BINARY,
396 					    .len  = ETH_ALEN },
397 		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
398 		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
399 		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },
400 		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },
401 		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING,
402 					    .len  = IPSET_MAX_COMMENT_SIZE },
403 		[IPSET_ATTR_SKBMARK]	= { .type = NLA_U64 },
404 		[IPSET_ATTR_SKBPRIO]	= { .type = NLA_U32 },
405 		[IPSET_ATTR_SKBQUEUE]	= { .type = NLA_U16 },
406 	},
407 	.me		= THIS_MODULE,
408 };
409 
410 static int __init
411 bitmap_ipmac_init(void)
412 {
413 	return ip_set_type_register(&bitmap_ipmac_type);
414 }
415 
416 static void __exit
417 bitmap_ipmac_fini(void)
418 {
419 	rcu_barrier();
420 	ip_set_type_unregister(&bitmap_ipmac_type);
421 }
422 
423 module_init(bitmap_ipmac_init);
424 module_exit(bitmap_ipmac_fini);
425