net/netfilter/xt_set.c

   1 /* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
   2  *                         Patrick Schaaf <bof@bof.de>
   3  *                         Martin Josefsson <gandalf@wlug.westbo.se>
   4  * Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  */
  10
  11 /* Kernel module which implements the set match and SET target
  12  * for netfilter/iptables. */
  13
  14 #include <linux/module.h>
  15 #include <linux/skbuff.h>
  16 #include <linux/version.h>
  17
  18 #include <linux/netfilter/x_tables.h>
  19 #include <linux/netfilter/xt_set.h>
  20
  21 MODULE_LICENSE("GPL");
  22 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
  23 MODULE_DESCRIPTION("Xtables: IP set match and target module");
  24 MODULE_ALIAS("xt_SET");
  25 MODULE_ALIAS("ipt_set");
  26 MODULE_ALIAS("ip6t_set");
  27 MODULE_ALIAS("ipt_SET");
  28 MODULE_ALIAS("ip6t_SET");
  29
  30 static inline int
  31 match_set(ip_set_id_t index, const struct sk_buff *skb,
  32           u8 pf, u8 dim, u8 flags, int inv)
  33 {
  34         if (ip_set_test(index, skb, pf, dim, flags))
  35                 inv = !inv;
  36         return inv;
  37 }
  38
  39 /* Revision 0 interface: backward compatible with netfilter/iptables */
  40
  41 static bool
  42 set_match_v0(const struct sk_buff *skb, struct xt_action_param *par)
  43 {
  44         const struct xt_set_info_match_v0 *info = par->matchinfo;
  45
  46         return match_set(info->match_set.index, skb, par->family,
  47                          info->match_set.u.compat.dim,
  48                          info->match_set.u.compat.flags,
  49                          info->match_set.u.compat.flags & IPSET_INV_MATCH);
  50 }
  51
  52 static void
  53 compat_flags(struct xt_set_info_v0 *info)
  54 {
  55         u_int8_t i;
  56
  57         /* Fill out compatibility data according to enum ip_set_kopt */
  58         info->u.compat.dim = IPSET_DIM_ZERO;
  59         if (info->u.flags[0] & IPSET_MATCH_INV)
  60                 info->u.compat.flags |= IPSET_INV_MATCH;
  61         for (i = 0; i < IPSET_DIM_MAX-1 && info->u.flags[i]; i++) {
  62                 info->u.compat.dim++;
  63                 if (info->u.flags[i] & IPSET_SRC)
  64                         info->u.compat.flags |= (1<<info->u.compat.dim);
  65         }
  66 }
  67
  68 static int
  69 set_match_v0_checkentry(const struct xt_mtchk_param *par)
  70 {
  71         struct xt_set_info_match_v0 *info = par->matchinfo;
  72         ip_set_id_t index;
  73
  74         index = ip_set_nfnl_get_byindex(info->match_set.index);
  75
  76         if (index == IPSET_INVALID_ID) {
  77                 pr_warning("Cannot find set indentified by id %u to match\n",
  78                            info->match_set.index);
  79                 return -ENOENT;
  80         }
  81         if (info->match_set.u.flags[IPSET_DIM_MAX-1] != 0) {
  82                 pr_warning("Protocol error: set match dimension "
  83                            "is over the limit!\n");
  84                 ip_set_nfnl_put(info->match_set.index);
  85                 return -ERANGE;
  86         }
  87
  88         /* Fill out compatibility data */
  89         compat_flags(&info->match_set);
  90
  91         return 0;
  92 }
  93
  94 static void
  95 set_match_v0_destroy(const struct xt_mtdtor_param *par)
  96 {
  97         struct xt_set_info_match_v0 *info = par->matchinfo;
  98
  99         ip_set_nfnl_put(info->match_set.index);
 100 }
 101
 102 static unsigned int
 103 set_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
 104 {
 105         const struct xt_set_info_target_v0 *info = par->targinfo;
 106
 107         if (info->add_set.index != IPSET_INVALID_ID)
 108                 ip_set_add(info->add_set.index, skb, par->family,
 109                            info->add_set.u.compat.dim,
 110                            info->add_set.u.compat.flags);
 111         if (info->del_set.index != IPSET_INVALID_ID)
 112                 ip_set_del(info->del_set.index, skb, par->family,
 113                            info->del_set.u.compat.dim,
 114                            info->del_set.u.compat.flags);
 115
 116         return XT_CONTINUE;
 117 }
 118
 119 static int
 120 set_target_v0_checkentry(const struct xt_tgchk_param *par)
 121 {
 122         struct xt_set_info_target_v0 *info = par->targinfo;
 123         ip_set_id_t index;
 124
 125         if (info->add_set.index != IPSET_INVALID_ID) {
 126                 index = ip_set_nfnl_get_byindex(info->add_set.index);
 127                 if (index == IPSET_INVALID_ID) {
 128                         pr_warning("Cannot find add_set index %u as target\n",
 129                                    info->add_set.index);
 130                         return -ENOENT;
 131                 }
 132         }
 133
 134         if (info->del_set.index != IPSET_INVALID_ID) {
 135                 index = ip_set_nfnl_get_byindex(info->del_set.index);
 136                 if (index == IPSET_INVALID_ID) {
 137                         pr_warning("Cannot find del_set index %u as target\n",
 138                                    info->del_set.index);
 139                         if (info->add_set.index != IPSET_INVALID_ID)
 140                                 ip_set_nfnl_put(info->add_set.index);
 141                         return -ENOENT;
 142                 }
 143         }
 144         if (info->add_set.u.flags[IPSET_DIM_MAX-1] != 0 ||
 145             info->del_set.u.flags[IPSET_DIM_MAX-1] != 0) {
 146                 pr_warning("Protocol error: SET target dimension "
 147                            "is over the limit!\n");
 148                 if (info->add_set.index != IPSET_INVALID_ID)
 149                         ip_set_nfnl_put(info->add_set.index);
 150                 if (info->del_set.index != IPSET_INVALID_ID)
 151                         ip_set_nfnl_put(info->del_set.index);
 152                 return -ERANGE;
 153         }
 154
 155         /* Fill out compatibility data */
 156         compat_flags(&info->add_set);
 157         compat_flags(&info->del_set);
 158
 159         return 0;
 160 }
 161
 162 static void
 163 set_target_v0_destroy(const struct xt_tgdtor_param *par)
 164 {
 165         const struct xt_set_info_target_v0 *info = par->targinfo;
 166
 167         if (info->add_set.index != IPSET_INVALID_ID)
 168                 ip_set_nfnl_put(info->add_set.index);
 169         if (info->del_set.index != IPSET_INVALID_ID)
 170                 ip_set_nfnl_put(info->del_set.index);
 171 }
 172
 173 /* Revision 1: current interface to netfilter/iptables */
 174
 175 static bool
 176 set_match(const struct sk_buff *skb, struct xt_action_param *par)
 177 {
 178         const struct xt_set_info_match *info = par->matchinfo;
 179
 180         return match_set(info->match_set.index, skb, par->family,
 181                          info->match_set.dim,
 182                          info->match_set.flags,
 183                          info->match_set.flags & IPSET_INV_MATCH);
 184 }
 185
 186 static int
 187 set_match_checkentry(const struct xt_mtchk_param *par)
 188 {
 189         struct xt_set_info_match *info = par->matchinfo;
 190         ip_set_id_t index;
 191
 192         index = ip_set_nfnl_get_byindex(info->match_set.index);
 193
 194         if (index == IPSET_INVALID_ID) {
 195                 pr_warning("Cannot find set indentified by id %u to match\n",
 196                            info->match_set.index);
 197                 return -ENOENT;
 198         }
 199         if (info->match_set.dim > IPSET_DIM_MAX) {
 200                 pr_warning("Protocol error: set match dimension "
 201                            "is over the limit!\n");
 202                 ip_set_nfnl_put(info->match_set.index);
 203                 return -ERANGE;
 204         }
 205
 206         return 0;
 207 }
 208
 209 static void
 210 set_match_destroy(const struct xt_mtdtor_param *par)
 211 {
 212         struct xt_set_info_match *info = par->matchinfo;
 213
 214         ip_set_nfnl_put(info->match_set.index);
 215 }
 216
 217 static unsigned int
 218 set_target(struct sk_buff *skb, const struct xt_action_param *par)
 219 {
 220         const struct xt_set_info_target *info = par->targinfo;
 221
 222         if (info->add_set.index != IPSET_INVALID_ID)
 223                 ip_set_add(info->add_set.index,
 224                            skb, par->family,
 225                            info->add_set.dim,
 226                            info->add_set.flags);
 227         if (info->del_set.index != IPSET_INVALID_ID)
 228                 ip_set_del(info->del_set.index,
 229                            skb, par->family,
 230                            info->del_set.dim,
 231                            info->del_set.flags);
 232
 233         return XT_CONTINUE;
 234 }
 235
 236 static int
 237 set_target_checkentry(const struct xt_tgchk_param *par)
 238 {
 239         const struct xt_set_info_target *info = par->targinfo;
 240         ip_set_id_t index;
 241
 242         if (info->add_set.index != IPSET_INVALID_ID) {
 243                 index = ip_set_nfnl_get_byindex(info->add_set.index);
 244                 if (index == IPSET_INVALID_ID) {
 245                         pr_warning("Cannot find add_set index %u as target\n",
 246                                    info->add_set.index);
 247                         return -ENOENT;
 248                 }
 249         }
 250
 251         if (info->del_set.index != IPSET_INVALID_ID) {
 252                 index = ip_set_nfnl_get_byindex(info->del_set.index);
 253                 if (index == IPSET_INVALID_ID) {
 254                         pr_warning("Cannot find del_set index %u as target\n",
 255                                    info->del_set.index);
 256                         if (info->add_set.index != IPSET_INVALID_ID)
 257                                 ip_set_nfnl_put(info->add_set.index);
 258                         return -ENOENT;
 259                 }
 260         }
 261         if (info->add_set.dim > IPSET_DIM_MAX ||
 262             info->del_set.dim > IPSET_DIM_MAX) {
 263                 pr_warning("Protocol error: SET target dimension "
 264                            "is over the limit!\n");
 265                 if (info->add_set.index != IPSET_INVALID_ID)
 266                         ip_set_nfnl_put(info->add_set.index);
 267                 if (info->del_set.index != IPSET_INVALID_ID)
 268                         ip_set_nfnl_put(info->del_set.index);
 269                 return -ERANGE;
 270         }
 271
 272         return 0;
 273 }
 274
 275 static void
 276 set_target_destroy(const struct xt_tgdtor_param *par)
 277 {
 278         const struct xt_set_info_target *info = par->targinfo;
 279
 280         if (info->add_set.index != IPSET_INVALID_ID)
 281                 ip_set_nfnl_put(info->add_set.index);
 282         if (info->del_set.index != IPSET_INVALID_ID)
 283                 ip_set_nfnl_put(info->del_set.index);
 284 }
 285
 286 static struct xt_match set_matches[] __read_mostly = {
 287         {
 288                 .name           = "set",
 289                 .family         = NFPROTO_IPV4,
 290                 .revision       = 0,
 291                 .match          = set_match_v0,
 292                 .matchsize      = sizeof(struct xt_set_info_match_v0),
 293                 .checkentry     = set_match_v0_checkentry,
 294                 .destroy        = set_match_v0_destroy,
 295                 .me             = THIS_MODULE
 296         },
 297         {
 298                 .name           = "set",
 299                 .family         = NFPROTO_IPV4,
 300                 .revision       = 1,
 301                 .match          = set_match,
 302                 .matchsize      = sizeof(struct xt_set_info_match),
 303                 .checkentry     = set_match_checkentry,
 304                 .destroy        = set_match_destroy,
 305                 .me             = THIS_MODULE
 306         },
 307         {
 308                 .name           = "set",
 309                 .family         = NFPROTO_IPV6,
 310                 .revision       = 1,
 311                 .match          = set_match,
 312                 .matchsize      = sizeof(struct xt_set_info_match),
 313                 .checkentry     = set_match_checkentry,
 314                 .destroy        = set_match_destroy,
 315                 .me             = THIS_MODULE
 316         },
 317 };
 318
 319 static struct xt_target set_targets[] __read_mostly = {
 320         {
 321                 .name           = "SET",
 322                 .revision       = 0,
 323                 .family         = NFPROTO_IPV4,
 324                 .target         = set_target_v0,
 325                 .targetsize     = sizeof(struct xt_set_info_target_v0),
 326                 .checkentry     = set_target_v0_checkentry,
 327                 .destroy        = set_target_v0_destroy,
 328                 .me             = THIS_MODULE
 329         },
 330         {
 331                 .name           = "SET",
 332                 .revision       = 1,
 333                 .family         = NFPROTO_IPV4,
 334                 .target         = set_target,
 335                 .targetsize     = sizeof(struct xt_set_info_target),
 336                 .checkentry     = set_target_checkentry,
 337                 .destroy        = set_target_destroy,
 338                 .me             = THIS_MODULE
 339         },
 340         {
 341                 .name           = "SET",
 342                 .revision       = 1,
 343                 .family         = NFPROTO_IPV6,
 344                 .target         = set_target,
 345                 .targetsize     = sizeof(struct xt_set_info_target),
 346                 .checkentry     = set_target_checkentry,
 347                 .destroy        = set_target_destroy,
 348                 .me             = THIS_MODULE
 349         },
 350 };
 351
 352 static int __init xt_set_init(void)
 353 {
 354         int ret = xt_register_matches(set_matches, ARRAY_SIZE(set_matches));
 355
 356         if (!ret) {
 357                 ret = xt_register_targets(set_targets,
 358                                           ARRAY_SIZE(set_targets));
 359                 if (ret)
 360                         xt_unregister_matches(set_matches,
 361                                               ARRAY_SIZE(set_matches));
 362         }
 363         return ret;
 364 }
 365
 366 static void __exit xt_set_fini(void)
 367 {
 368         xt_unregister_matches(set_matches, ARRAY_SIZE(set_matches));
 369         xt_unregister_targets(set_targets, ARRAY_SIZE(set_targets));
 370 }
 371
 372 module_init(xt_set_init);
 373 module_exit(xt_set_fini);