1 // SPDX-License-Identifier: GPL-2.0-only
2 /* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@netfilter.org> */
3 
4 /* Kernel module implementing an IP set type: the hash:ip,port,ip type */
5 
6 #include <linux/jhash.h>
7 #include <linux/module.h>
8 #include <linux/ip.h>
9 #include <linux/skbuff.h>
10 #include <linux/errno.h>
11 #include <linux/random.h>
12 #include <net/ip.h>
13 #include <net/ipv6.h>
14 #include <net/netlink.h>
15 #include <net/tcp.h>
16 
17 #include <linux/netfilter.h>
18 #include <linux/netfilter/ipset/pfxlen.h>
19 #include <linux/netfilter/ipset/ip_set.h>
20 #include <linux/netfilter/ipset/ip_set_getport.h>
21 #include <linux/netfilter/ipset/ip_set_hash.h>
22 
23 #define IPSET_TYPE_REV_MIN	0
24 /*				1    SCTP and UDPLITE support added */
25 /*				2    Counters support added */
26 /*				3    Comments support added */
27 /*				4    Forceadd support added */
28 /*				5    skbinfo support added */
29 #define IPSET_TYPE_REV_MAX	6 /* bucketsize support added */
30 
31 MODULE_LICENSE("GPL");
32 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
33 IP_SET_MODULE_DESC("hash:ip,port,ip", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
34 MODULE_ALIAS("ip_set_hash:ip,port,ip");
35 
36 /* Type specific function prefix */
37 #define HTYPE		hash_ipportip
38 
39 /* IPv4 variant */
40 
41 /* Member elements  */
42 struct hash_ipportip4_elem {
43 	__be32 ip;
44 	__be32 ip2;
45 	__be16 port;
46 	u8 proto;
47 	u8 padding;
48 };
49 
50 static bool
51 hash_ipportip4_data_equal(const struct hash_ipportip4_elem *ip1,
52 			  const struct hash_ipportip4_elem *ip2,
53 			  u32 *multi)
54 {
55 	return ip1->ip == ip2->ip &&
56 	       ip1->ip2 == ip2->ip2 &&
57 	       ip1->port == ip2->port &&
58 	       ip1->proto == ip2->proto;
59 }
60 
61 static bool
62 hash_ipportip4_data_list(struct sk_buff *skb,
63 			 const struct hash_ipportip4_elem *data)
64 {
65 	if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) ||
66 	    nla_put_ipaddr4(skb, IPSET_ATTR_IP2, data->ip2) ||
67 	    nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
68 	    nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto))
69 		goto nla_put_failure;
70 	return false;
71 
72 nla_put_failure:
73 	return true;
74 }
75 
76 static void
77 hash_ipportip4_data_next(struct hash_ipportip4_elem *next,
78 			 const struct hash_ipportip4_elem *d)
79 {
80 	next->ip = d->ip;
81 	next->port = d->port;
82 }
83 
84 /* Common functions */
85 #define MTYPE		hash_ipportip4
86 #define HOST_MASK	32
87 #include "ip_set_hash_gen.h"
88 
89 static int
90 hash_ipportip4_kadt(struct ip_set *set, const struct sk_buff *skb,
91 		    const struct xt_action_param *par,
92 		    enum ipset_adt adt, struct ip_set_adt_opt *opt)
93 {
94 	ipset_adtfn adtfn = set->variant->adt[adt];
95 	struct hash_ipportip4_elem e = { .ip = 0 };
96 	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
97 
98 	if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
99 				 &e.port, &e.proto))
100 		return -EINVAL;
101 
102 	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip);
103 	ip4addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &e.ip2);
104 	return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
105 }
106 
107 static int
108 hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[],
109 		    enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
110 {
111 	const struct hash_ipportip4 *h = set->data;
112 	ipset_adtfn adtfn = set->variant->adt[adt];
113 	struct hash_ipportip4_elem e = { .ip = 0 };
114 	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
115 	u32 ip, ip_to = 0, p = 0, port, port_to;
116 	bool with_ports = false;
117 	int ret;
118 
119 	if (tb[IPSET_ATTR_LINENO])
120 		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
121 
122 	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
123 		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
124 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO)))
125 		return -IPSET_ERR_PROTOCOL;
126 
127 	ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP], &e.ip);
128 	if (ret)
129 		return ret;
130 
131 	ret = ip_set_get_extensions(set, tb, &ext);
132 	if (ret)
133 		return ret;
134 
135 	ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP2], &e.ip2);
136 	if (ret)
137 		return ret;
138 
139 	e.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
140 
141 	if (tb[IPSET_ATTR_PROTO]) {
142 		e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
143 		with_ports = ip_set_proto_with_ports(e.proto);
144 
145 		if (e.proto == 0)
146 			return -IPSET_ERR_INVALID_PROTO;
147 	} else {
148 		return -IPSET_ERR_MISSING_PROTO;
149 	}
150 
151 	if (!(with_ports || e.proto == IPPROTO_ICMP))
152 		e.port = 0;
153 
154 	if (adt == IPSET_TEST ||
155 	    !(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_CIDR] ||
156 	      tb[IPSET_ATTR_PORT_TO])) {
157 		ret = adtfn(set, &e, &ext, &ext, flags);
158 		return ip_set_eexist(ret, flags) ? 0 : ret;
159 	}
160 
161 	ip_to = ip = ntohl(e.ip);
162 	if (tb[IPSET_ATTR_IP_TO]) {
163 		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
164 		if (ret)
165 			return ret;
166 		if (ip > ip_to)
167 			swap(ip, ip_to);
168 	} else if (tb[IPSET_ATTR_CIDR]) {
169 		u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
170 
171 		if (!cidr || cidr > HOST_MASK)
172 			return -IPSET_ERR_INVALID_CIDR;
173 		ip_set_mask_from_to(ip, ip_to, cidr);
174 	}
175 
176 	port_to = port = ntohs(e.port);
177 	if (with_ports && tb[IPSET_ATTR_PORT_TO]) {
178 		port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
179 		if (port > port_to)
180 			swap(port, port_to);
181 	}
182 
183 	if (retried)
184 		ip = ntohl(h->next.ip);
185 	for (; ip <= ip_to; ip++) {
186 		p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
187 						       : port;
188 		for (; p <= port_to; p++) {
189 			e.ip = htonl(ip);
190 			e.port = htons(p);
191 			ret = adtfn(set, &e, &ext, &ext, flags);
192 
193 			if (ret && !ip_set_eexist(ret, flags))
194 				return ret;
195 
196 			ret = 0;
197 		}
198 	}
199 	return ret;
200 }
201 
202 /* IPv6 variant */
203 
204 struct hash_ipportip6_elem {
205 	union nf_inet_addr ip;
206 	union nf_inet_addr ip2;
207 	__be16 port;
208 	u8 proto;
209 	u8 padding;
210 };
211 
212 /* Common functions */
213 
214 static bool
215 hash_ipportip6_data_equal(const struct hash_ipportip6_elem *ip1,
216 			  const struct hash_ipportip6_elem *ip2,
217 			  u32 *multi)
218 {
219 	return ipv6_addr_equal(&ip1->ip.in6, &ip2->ip.in6) &&
220 	       ipv6_addr_equal(&ip1->ip2.in6, &ip2->ip2.in6) &&
221 	       ip1->port == ip2->port &&
222 	       ip1->proto == ip2->proto;
223 }
224 
225 static bool
226 hash_ipportip6_data_list(struct sk_buff *skb,
227 			 const struct hash_ipportip6_elem *data)
228 {
229 	if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6) ||
230 	    nla_put_ipaddr6(skb, IPSET_ATTR_IP2, &data->ip2.in6) ||
231 	    nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
232 	    nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto))
233 		goto nla_put_failure;
234 	return false;
235 
236 nla_put_failure:
237 	return true;
238 }
239 
240 static void
241 hash_ipportip6_data_next(struct hash_ipportip6_elem *next,
242 			 const struct hash_ipportip6_elem *d)
243 {
244 	next->port = d->port;
245 }
246 
247 #undef MTYPE
248 #undef HOST_MASK
249 
250 #define MTYPE		hash_ipportip6
251 #define HOST_MASK	128
252 #define IP_SET_EMIT_CREATE
253 #include "ip_set_hash_gen.h"
254 
255 static int
256 hash_ipportip6_kadt(struct ip_set *set, const struct sk_buff *skb,
257 		    const struct xt_action_param *par,
258 		    enum ipset_adt adt, struct ip_set_adt_opt *opt)
259 {
260 	ipset_adtfn adtfn = set->variant->adt[adt];
261 	struct hash_ipportip6_elem e = { .ip = { .all = { 0 } } };
262 	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
263 
264 	if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
265 				 &e.port, &e.proto))
266 		return -EINVAL;
267 
268 	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip.in6);
269 	ip6addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &e.ip2.in6);
270 	return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
271 }
272 
273 static int
274 hash_ipportip6_uadt(struct ip_set *set, struct nlattr *tb[],
275 		    enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
276 {
277 	const struct hash_ipportip6 *h = set->data;
278 	ipset_adtfn adtfn = set->variant->adt[adt];
279 	struct hash_ipportip6_elem e = {  .ip = { .all = { 0 } } };
280 	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
281 	u32 port, port_to;
282 	bool with_ports = false;
283 	int ret;
284 
285 	if (tb[IPSET_ATTR_LINENO])
286 		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
287 
288 	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
289 		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
290 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO)))
291 		return -IPSET_ERR_PROTOCOL;
292 	if (unlikely(tb[IPSET_ATTR_IP_TO]))
293 		return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
294 	if (unlikely(tb[IPSET_ATTR_CIDR])) {
295 		u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
296 
297 		if (cidr != HOST_MASK)
298 			return -IPSET_ERR_INVALID_CIDR;
299 	}
300 
301 	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip);
302 	if (ret)
303 		return ret;
304 
305 	ret = ip_set_get_extensions(set, tb, &ext);
306 	if (ret)
307 		return ret;
308 
309 	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP2], &e.ip2);
310 	if (ret)
311 		return ret;
312 
313 	e.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
314 
315 	if (tb[IPSET_ATTR_PROTO]) {
316 		e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
317 		with_ports = ip_set_proto_with_ports(e.proto);
318 
319 		if (e.proto == 0)
320 			return -IPSET_ERR_INVALID_PROTO;
321 	} else {
322 		return -IPSET_ERR_MISSING_PROTO;
323 	}
324 
325 	if (!(with_ports || e.proto == IPPROTO_ICMPV6))
326 		e.port = 0;
327 
328 	if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
329 		ret = adtfn(set, &e, &ext, &ext, flags);
330 		return ip_set_eexist(ret, flags) ? 0 : ret;
331 	}
332 
333 	port = ntohs(e.port);
334 	port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
335 	if (port > port_to)
336 		swap(port, port_to);
337 
338 	if (retried)
339 		port = ntohs(h->next.port);
340 	for (; port <= port_to; port++) {
341 		e.port = htons(port);
342 		ret = adtfn(set, &e, &ext, &ext, flags);
343 
344 		if (ret && !ip_set_eexist(ret, flags))
345 			return ret;
346 
347 		ret = 0;
348 	}
349 	return ret;
350 }
351 
352 static struct ip_set_type hash_ipportip_type __read_mostly = {
353 	.name		= "hash:ip,port,ip",
354 	.protocol	= IPSET_PROTOCOL,
355 	.features	= IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_TYPE_IP2,
356 	.dimension	= IPSET_DIM_THREE,
357 	.family		= NFPROTO_UNSPEC,
358 	.revision_min	= IPSET_TYPE_REV_MIN,
359 	.revision_max	= IPSET_TYPE_REV_MAX,
360 	.create_flags[IPSET_TYPE_REV_MAX] = IPSET_CREATE_FLAG_BUCKETSIZE,
361 	.create		= hash_ipportip_create,
362 	.create_policy	= {
363 		[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
364 		[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
365 		[IPSET_ATTR_BUCKETSIZE]	= { .type = NLA_U8 },
366 		[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
367 		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
368 		[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },
369 	},
370 	.adt_policy	= {
371 		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
372 		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
373 		[IPSET_ATTR_IP2]	= { .type = NLA_NESTED },
374 		[IPSET_ATTR_PORT]	= { .type = NLA_U16 },
375 		[IPSET_ATTR_PORT_TO]	= { .type = NLA_U16 },
376 		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
377 		[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
378 		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
379 		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
380 		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },
381 		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },
382 		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING,
383 					    .len  = IPSET_MAX_COMMENT_SIZE },
384 		[IPSET_ATTR_SKBMARK]	= { .type = NLA_U64 },
385 		[IPSET_ATTR_SKBPRIO]	= { .type = NLA_U32 },
386 		[IPSET_ATTR_SKBQUEUE]	= { .type = NLA_U16 },
387 	},
388 	.me		= THIS_MODULE,
389 };
390 
391 static int __init
392 hash_ipportip_init(void)
393 {
394 	return ip_set_type_register(&hash_ipportip_type);
395 }
396 
397 static void __exit
398 hash_ipportip_fini(void)
399 {
400 	rcu_barrier();
401 	ip_set_type_unregister(&hash_ipportip_type);
402 }
403 
404 module_init(hash_ipportip_init);
405 module_exit(hash_ipportip_fini);
406