|
Packit |
99347c |
/*
|
|
Packit |
99347c |
* net/sched/em_ipset.c ipset ematch
|
|
Packit |
99347c |
*
|
|
Packit |
99347c |
* Copyright (c) 2012 Florian Westphal <fw@strlen.de>
|
|
Packit |
99347c |
*
|
|
Packit |
99347c |
* This program is free software; you can redistribute it and/or
|
|
Packit |
99347c |
* modify it under the terms of the GNU General Public License
|
|
Packit |
99347c |
* version 2 as published by the Free Software Foundation.
|
|
Packit |
99347c |
*/
|
|
Packit |
99347c |
|
|
Packit |
99347c |
#include <linux/gfp.h>
|
|
Packit |
99347c |
#include <linux/module.h>
|
|
Packit |
99347c |
#include <linux/types.h>
|
|
Packit |
99347c |
#include <linux/kernel.h>
|
|
Packit |
99347c |
#include <linux/string.h>
|
|
Packit |
99347c |
#include <linux/skbuff.h>
|
|
Packit |
99347c |
#include <linux/netfilter/xt_set.h>
|
|
Packit |
99347c |
#include <linux/netfilter/ipset/ip_set_compat.h>
|
|
Packit |
99347c |
#include <linux/ipv6.h>
|
|
Packit |
99347c |
#include <net/ip.h>
|
|
Packit |
99347c |
#include <net/pkt_cls.h>
|
|
Packit |
99347c |
|
|
Packit |
99347c |
#ifdef HAVE_TCF_EMATCH_OPS_CHANGE_ARG_NET
|
|
Packit |
99347c |
static int em_ipset_change(struct net *net, void *data, int data_len,
|
|
Packit |
99347c |
struct tcf_ematch *em)
|
|
Packit |
99347c |
#else
|
|
Packit |
99347c |
static int em_ipset_change(struct tcf_proto *tp, void *data, int data_len,
|
|
Packit |
99347c |
struct tcf_ematch *em)
|
|
Packit |
99347c |
#endif
|
|
Packit |
99347c |
{
|
|
Packit |
99347c |
struct xt_set_info *set = data;
|
|
Packit |
99347c |
ip_set_id_t index;
|
|
Packit |
99347c |
#ifndef HAVE_TCF_EMATCH_OPS_CHANGE_ARG_NET
|
|
Packit |
99347c |
struct net *net = dev_net(qdisc_dev(tp->q));
|
|
Packit |
99347c |
#endif
|
|
Packit |
99347c |
|
|
Packit |
99347c |
if (data_len != sizeof(*set))
|
|
Packit |
99347c |
return -EINVAL;
|
|
Packit |
99347c |
|
|
Packit |
99347c |
index = ip_set_nfnl_get_byindex(net, set->index);
|
|
Packit |
99347c |
if (index == IPSET_INVALID_ID)
|
|
Packit |
99347c |
return -ENOENT;
|
|
Packit |
99347c |
|
|
Packit |
99347c |
em->datalen = sizeof(*set);
|
|
Packit |
99347c |
em->data = (unsigned long)kmemdup(data, em->datalen, GFP_KERNEL);
|
|
Packit |
99347c |
if (em->data)
|
|
Packit |
99347c |
return 0;
|
|
Packit |
99347c |
|
|
Packit |
99347c |
ip_set_nfnl_put(net, index);
|
|
Packit |
99347c |
return -ENOMEM;
|
|
Packit |
99347c |
}
|
|
Packit |
99347c |
|
|
Packit |
99347c |
#ifdef HAVE_TCF_EMATCH_STRUCT_NET
|
|
Packit |
99347c |
static void em_ipset_destroy(struct tcf_ematch *em)
|
|
Packit |
99347c |
#else
|
|
Packit |
99347c |
static void em_ipset_destroy(struct tcf_proto *p, struct tcf_ematch *em)
|
|
Packit |
99347c |
#endif
|
|
Packit |
99347c |
{
|
|
Packit |
99347c |
const struct xt_set_info *set = (const void *) em->data;
|
|
Packit |
99347c |
|
|
Packit |
99347c |
if (set) {
|
|
Packit |
99347c |
#ifdef HAVE_TCF_EMATCH_STRUCT_NET
|
|
Packit |
99347c |
ip_set_nfnl_put(em->net, set->index);
|
|
Packit |
99347c |
#else
|
|
Packit |
99347c |
ip_set_nfnl_put(dev_net(qdisc_dev(p->q)), set->index);
|
|
Packit |
99347c |
#endif
|
|
Packit |
99347c |
kfree((void *) em->data);
|
|
Packit |
99347c |
}
|
|
Packit |
99347c |
}
|
|
Packit |
99347c |
|
|
Packit |
99347c |
static int em_ipset_match(struct sk_buff *skb, struct tcf_ematch *em,
|
|
Packit |
99347c |
struct tcf_pkt_info *info)
|
|
Packit |
99347c |
{
|
|
Packit |
99347c |
struct ip_set_adt_opt opt;
|
|
Packit |
99347c |
struct xt_action_param acpar;
|
|
Packit |
99347c |
const struct xt_set_info *set = (const void *) em->data;
|
|
Packit |
99347c |
struct net_device *dev, *indev = NULL;
|
|
Packit |
99347c |
#ifdef HAVE_STATE_IN_XT_ACTION_PARAM
|
|
Packit |
99347c |
struct nf_hook_state state = {
|
|
Packit |
99347c |
.net = em->net,
|
|
Packit |
99347c |
};
|
|
Packit |
99347c |
#endif
|
|
Packit |
99347c |
int ret, network_offset;
|
|
Packit |
99347c |
|
|
Packit |
99347c |
#ifdef HAVE_STATE_IN_XT_ACTION_PARAM
|
|
Packit |
99347c |
#define ACPAR_FAMILY(f) state.pf = f
|
|
Packit |
99347c |
#else
|
|
Packit |
99347c |
#define ACPAR_FAMILY(f) acpar.family = f
|
|
Packit |
99347c |
#endif
|
|
Packit |
99347c |
switch (tc_skb_protocol(skb)) {
|
|
Packit |
99347c |
case htons(ETH_P_IP):
|
|
Packit |
99347c |
ACPAR_FAMILY(NFPROTO_IPV4);
|
|
Packit |
99347c |
if (!pskb_network_may_pull(skb, sizeof(struct iphdr)))
|
|
Packit |
99347c |
return 0;
|
|
Packit |
99347c |
acpar.thoff = ip_hdrlen(skb);
|
|
Packit |
99347c |
break;
|
|
Packit |
99347c |
case htons(ETH_P_IPV6):
|
|
Packit |
99347c |
ACPAR_FAMILY(NFPROTO_IPV6);
|
|
Packit |
99347c |
if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr)))
|
|
Packit |
99347c |
return 0;
|
|
Packit |
99347c |
/* doesn't call ipv6_find_hdr() because ipset doesn't use
|
|
Packit |
99347c |
* thoff, yet
|
|
Packit |
99347c |
*/
|
|
Packit |
99347c |
acpar.thoff = sizeof(struct ipv6hdr);
|
|
Packit |
99347c |
break;
|
|
Packit |
99347c |
default:
|
|
Packit |
99347c |
return 0;
|
|
Packit |
99347c |
}
|
|
Packit |
99347c |
|
|
Packit |
99347c |
#ifdef HAVE_STATE_IN_XT_ACTION_PARAM
|
|
Packit |
99347c |
opt.family = state.pf;
|
|
Packit |
99347c |
#else
|
|
Packit |
99347c |
acpar.hooknum = 0;
|
|
Packit |
99347c |
|
|
Packit |
99347c |
opt.family = acpar.family;
|
|
Packit |
99347c |
#endif
|
|
Packit |
99347c |
opt.dim = set->dim;
|
|
Packit |
99347c |
opt.flags = set->flags;
|
|
Packit |
99347c |
opt.cmdflags = 0;
|
|
Packit |
99347c |
opt.ext.timeout = ~0u;
|
|
Packit |
99347c |
|
|
Packit |
99347c |
network_offset = skb_network_offset(skb);
|
|
Packit |
99347c |
skb_pull(skb, network_offset);
|
|
Packit |
99347c |
|
|
Packit |
99347c |
dev = skb->dev;
|
|
Packit |
99347c |
|
|
Packit |
99347c |
rcu_read_lock();
|
|
Packit |
99347c |
|
|
Packit |
99347c |
if (skb->skb_iif)
|
|
Packit |
99347c |
#ifdef HAVE_TCF_EMATCH_STRUCT_NET
|
|
Packit |
99347c |
indev = dev_get_by_index_rcu(em->net, skb->skb_iif);
|
|
Packit |
99347c |
#else
|
|
Packit |
99347c |
indev = dev_get_by_index_rcu(dev_net(dev), skb->skb_iif);
|
|
Packit |
99347c |
#endif
|
|
Packit |
99347c |
|
|
Packit |
99347c |
#ifdef HAVE_STATE_IN_XT_ACTION_PARAM
|
|
Packit |
99347c |
state.in = indev ? indev : dev;
|
|
Packit |
99347c |
state.out = dev;
|
|
Packit |
99347c |
acpar.state = &stat;;
|
|
Packit |
99347c |
#else
|
|
Packit |
99347c |
#ifdef HAVE_NET_IN_XT_ACTION_PARAM
|
|
Packit |
99347c |
acpar.net = em->net;
|
|
Packit |
99347c |
#endif
|
|
Packit |
99347c |
acpar.in = indev ? indev : dev;
|
|
Packit |
99347c |
acpar.out = dev;
|
|
Packit |
99347c |
#endif /* HAVE_STATE_IN_XT_ACTION_PARAM */
|
|
Packit |
99347c |
|
|
Packit |
99347c |
ret = ip_set_test(set->index, skb, &acpar, &opt;;
|
|
Packit |
99347c |
|
|
Packit |
99347c |
rcu_read_unlock();
|
|
Packit |
99347c |
|
|
Packit |
99347c |
skb_push(skb, network_offset);
|
|
Packit |
99347c |
return ret;
|
|
Packit |
99347c |
}
|
|
Packit |
99347c |
|
|
Packit |
99347c |
static struct tcf_ematch_ops em_ipset_ops = {
|
|
Packit |
99347c |
.kind = TCF_EM_IPSET,
|
|
Packit |
99347c |
.change = em_ipset_change,
|
|
Packit |
99347c |
.destroy = em_ipset_destroy,
|
|
Packit |
99347c |
.match = em_ipset_match,
|
|
Packit |
99347c |
.owner = THIS_MODULE,
|
|
Packit |
99347c |
.link = LIST_HEAD_INIT(em_ipset_ops.link)
|
|
Packit |
99347c |
};
|
|
Packit |
99347c |
|
|
Packit |
99347c |
static int __init init_em_ipset(void)
|
|
Packit |
99347c |
{
|
|
Packit |
99347c |
return tcf_em_register(&em_ipset_ops);
|
|
Packit |
99347c |
}
|
|
Packit |
99347c |
|
|
Packit |
99347c |
static void __exit exit_em_ipset(void)
|
|
Packit |
99347c |
{
|
|
Packit |
99347c |
tcf_em_unregister(&em_ipset_ops);
|
|
Packit |
99347c |
}
|
|
Packit |
99347c |
|
|
Packit |
99347c |
MODULE_LICENSE("GPL");
|
|
Packit |
99347c |
MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
|
|
Packit |
99347c |
MODULE_DESCRIPTION("TC extended match for IP sets");
|
|
Packit |
99347c |
|
|
Packit |
99347c |
module_init(init_em_ipset);
|
|
Packit |
99347c |
module_exit(exit_em_ipset);
|
|
Packit |
99347c |
|
|
Packit |
99347c |
MODULE_ALIAS_TCF_EMATCH(TCF_EM_IPSET);
|