1 /* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
2  *                         Patrick Schaaf <bof@bof.de>
3  * Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License version 2 as
7  * published by the Free Software Foundation.
8  */
9 
10 /* Kernel module for IP set management */
11 
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/moduleparam.h>
15 #include <linux/ip.h>
16 #include <linux/skbuff.h>
17 #include <linux/spinlock.h>
18 #include <linux/netlink.h>
19 #include <linux/rculist.h>
20 #include <net/netlink.h>
21 
22 #include <linux/netfilter.h>
23 #include <linux/netfilter/x_tables.h>
24 #include <linux/netfilter/nfnetlink.h>
25 #include <linux/netfilter/ipset/ip_set.h>
26 
27 static LIST_HEAD(ip_set_type_list);		/* all registered set types */
28 static DEFINE_MUTEX(ip_set_type_mutex);		/* protects ip_set_type_list */
29 static DEFINE_RWLOCK(ip_set_ref_lock);		/* protects the set refs */
30 
31 static struct ip_set **ip_set_list;		/* all individual sets */
32 static ip_set_id_t ip_set_max = CONFIG_IP_SET_MAX; /* max number of sets */
33 
34 #define STREQ(a, b)	(strncmp(a, b, IPSET_MAXNAMELEN) == 0)
35 
36 static unsigned int max_sets;
37 
38 module_param(max_sets, int, 0600);
39 MODULE_PARM_DESC(max_sets, "maximal number of sets");
40 MODULE_LICENSE("GPL");
41 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
42 MODULE_DESCRIPTION("core IP set support");
43 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);
44 
45 /*
46  * The set types are implemented in modules and registered set types
47  * can be found in ip_set_type_list. Adding/deleting types is
48  * serialized by ip_set_type_mutex.
49  */
50 
51 static inline void
ip_set_type_lock(void)52 ip_set_type_lock(void)
53 {
54 	mutex_lock(&ip_set_type_mutex);
55 }
56 
57 static inline void
ip_set_type_unlock(void)58 ip_set_type_unlock(void)
59 {
60 	mutex_unlock(&ip_set_type_mutex);
61 }
62 
63 /* Register and deregister settype */
64 
65 static struct ip_set_type *
find_set_type(const char * name,u8 family,u8 revision)66 find_set_type(const char *name, u8 family, u8 revision)
67 {
68 	struct ip_set_type *type;
69 
70 	list_for_each_entry_rcu(type, &ip_set_type_list, list)
71 		if (STREQ(type->name, name) &&
72 		    (type->family == family || type->family == AF_UNSPEC) &&
73 		    revision >= type->revision_min &&
74 		    revision <= type->revision_max)
75 			return type;
76 	return NULL;
77 }
78 
79 /* Unlock, try to load a set type module and lock again */
80 static bool
load_settype(const char * name)81 load_settype(const char *name)
82 {
83 	nfnl_unlock();
84 	pr_debug("try to load ip_set_%s\n", name);
85 	if (request_module("ip_set_%s", name) < 0) {
86 		pr_warning("Can't find ip_set type %s\n", name);
87 		nfnl_lock();
88 		return false;
89 	}
90 	nfnl_lock();
91 	return true;
92 }
93 
94 /* Find a set type and reference it */
95 #define find_set_type_get(name, family, revision, found)	\
96 	__find_set_type_get(name, family, revision, found, false)
97 
98 static int
__find_set_type_get(const char * name,u8 family,u8 revision,struct ip_set_type ** found,bool retry)99 __find_set_type_get(const char *name, u8 family, u8 revision,
100 		    struct ip_set_type **found, bool retry)
101 {
102 	struct ip_set_type *type;
103 	int err;
104 
105 	if (retry && !load_settype(name))
106 		return -IPSET_ERR_FIND_TYPE;
107 
108 	rcu_read_lock();
109 	*found = find_set_type(name, family, revision);
110 	if (*found) {
111 		err = !try_module_get((*found)->me) ? -EFAULT : 0;
112 		goto unlock;
113 	}
114 	/* Make sure the type is already loaded
115 	 * but we don't support the revision */
116 	list_for_each_entry_rcu(type, &ip_set_type_list, list)
117 		if (STREQ(type->name, name)) {
118 			err = -IPSET_ERR_FIND_TYPE;
119 			goto unlock;
120 		}
121 	rcu_read_unlock();
122 
123 	return retry ? -IPSET_ERR_FIND_TYPE :
124 		__find_set_type_get(name, family, revision, found, true);
125 
126 unlock:
127 	rcu_read_unlock();
128 	return err;
129 }
130 
131 /* Find a given set type by name and family.
132  * If we succeeded, the supported minimal and maximum revisions are
133  * filled out.
134  */
135 #define find_set_type_minmax(name, family, min, max) \
136 	__find_set_type_minmax(name, family, min, max, false)
137 
138 static int
__find_set_type_minmax(const char * name,u8 family,u8 * min,u8 * max,bool retry)139 __find_set_type_minmax(const char *name, u8 family, u8 *min, u8 *max,
140 		       bool retry)
141 {
142 	struct ip_set_type *type;
143 	bool found = false;
144 
145 	if (retry && !load_settype(name))
146 		return -IPSET_ERR_FIND_TYPE;
147 
148 	*min = 255; *max = 0;
149 	rcu_read_lock();
150 	list_for_each_entry_rcu(type, &ip_set_type_list, list)
151 		if (STREQ(type->name, name) &&
152 		    (type->family == family || type->family == AF_UNSPEC)) {
153 			found = true;
154 			if (type->revision_min < *min)
155 				*min = type->revision_min;
156 			if (type->revision_max > *max)
157 				*max = type->revision_max;
158 		}
159 	rcu_read_unlock();
160 	if (found)
161 		return 0;
162 
163 	return retry ? -IPSET_ERR_FIND_TYPE :
164 		__find_set_type_minmax(name, family, min, max, true);
165 }
166 
167 #define family_name(f)	((f) == AF_INET ? "inet" : \
168 			 (f) == AF_INET6 ? "inet6" : "any")
169 
170 /* Register a set type structure. The type is identified by
171  * the unique triple of name, family and revision.
172  */
173 int
ip_set_type_register(struct ip_set_type * type)174 ip_set_type_register(struct ip_set_type *type)
175 {
176 	int ret = 0;
177 
178 	if (type->protocol != IPSET_PROTOCOL) {
179 		pr_warning("ip_set type %s, family %s, revision %u:%u uses "
180 			   "wrong protocol version %u (want %u)\n",
181 			   type->name, family_name(type->family),
182 			   type->revision_min, type->revision_max,
183 			   type->protocol, IPSET_PROTOCOL);
184 		return -EINVAL;
185 	}
186 
187 	ip_set_type_lock();
188 	if (find_set_type(type->name, type->family, type->revision_min)) {
189 		/* Duplicate! */
190 		pr_warning("ip_set type %s, family %s with revision min %u "
191 			   "already registered!\n", type->name,
192 			   family_name(type->family), type->revision_min);
193 		ret = -EINVAL;
194 		goto unlock;
195 	}
196 	list_add_rcu(&type->list, &ip_set_type_list);
197 	pr_debug("type %s, family %s, revision %u:%u registered.\n",
198 		 type->name, family_name(type->family),
199 		 type->revision_min, type->revision_max);
200 unlock:
201 	ip_set_type_unlock();
202 	return ret;
203 }
204 EXPORT_SYMBOL_GPL(ip_set_type_register);
205 
206 /* Unregister a set type. There's a small race with ip_set_create */
207 void
ip_set_type_unregister(struct ip_set_type * type)208 ip_set_type_unregister(struct ip_set_type *type)
209 {
210 	ip_set_type_lock();
211 	if (!find_set_type(type->name, type->family, type->revision_min)) {
212 		pr_warning("ip_set type %s, family %s with revision min %u "
213 			   "not registered\n", type->name,
214 			   family_name(type->family), type->revision_min);
215 		goto unlock;
216 	}
217 	list_del_rcu(&type->list);
218 	pr_debug("type %s, family %s with revision min %u unregistered.\n",
219 		 type->name, family_name(type->family), type->revision_min);
220 unlock:
221 	ip_set_type_unlock();
222 
223 	synchronize_rcu();
224 }
225 EXPORT_SYMBOL_GPL(ip_set_type_unregister);
226 
227 /* Utility functions */
228 void *
ip_set_alloc(size_t size)229 ip_set_alloc(size_t size)
230 {
231 	void *members = NULL;
232 
233 	if (size < KMALLOC_MAX_SIZE)
234 		members = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
235 
236 	if (members) {
237 		pr_debug("%p: allocated with kmalloc\n", members);
238 		return members;
239 	}
240 
241 	members = vzalloc(size);
242 	if (!members)
243 		return NULL;
244 	pr_debug("%p: allocated with vmalloc\n", members);
245 
246 	return members;
247 }
248 EXPORT_SYMBOL_GPL(ip_set_alloc);
249 
250 void
ip_set_free(void * members)251 ip_set_free(void *members)
252 {
253 	pr_debug("%p: free with %s\n", members,
254 		 is_vmalloc_addr(members) ? "vfree" : "kfree");
255 	if (is_vmalloc_addr(members))
256 		vfree(members);
257 	else
258 		kfree(members);
259 }
260 EXPORT_SYMBOL_GPL(ip_set_free);
261 
262 static inline bool
flag_nested(const struct nlattr * nla)263 flag_nested(const struct nlattr *nla)
264 {
265 	return nla->nla_type & NLA_F_NESTED;
266 }
267 
268 static const struct nla_policy ipaddr_policy[IPSET_ATTR_IPADDR_MAX + 1] = {
269 	[IPSET_ATTR_IPADDR_IPV4]	= { .type = NLA_U32 },
270 	[IPSET_ATTR_IPADDR_IPV6]	= { .type = NLA_BINARY,
271 					    .len = sizeof(struct in6_addr) },
272 };
273 
274 int
ip_set_get_ipaddr4(struct nlattr * nla,__be32 * ipaddr)275 ip_set_get_ipaddr4(struct nlattr *nla,  __be32 *ipaddr)
276 {
277 	struct nlattr *tb[IPSET_ATTR_IPADDR_MAX+1];
278 
279 	if (unlikely(!flag_nested(nla)))
280 		return -IPSET_ERR_PROTOCOL;
281 	if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy))
282 		return -IPSET_ERR_PROTOCOL;
283 	if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV4)))
284 		return -IPSET_ERR_PROTOCOL;
285 
286 	*ipaddr = nla_get_be32(tb[IPSET_ATTR_IPADDR_IPV4]);
287 	return 0;
288 }
289 EXPORT_SYMBOL_GPL(ip_set_get_ipaddr4);
290 
291 int
ip_set_get_ipaddr6(struct nlattr * nla,union nf_inet_addr * ipaddr)292 ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr)
293 {
294 	struct nlattr *tb[IPSET_ATTR_IPADDR_MAX+1];
295 
296 	if (unlikely(!flag_nested(nla)))
297 		return -IPSET_ERR_PROTOCOL;
298 
299 	if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy))
300 		return -IPSET_ERR_PROTOCOL;
301 	if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV6)))
302 		return -IPSET_ERR_PROTOCOL;
303 
304 	memcpy(ipaddr, nla_data(tb[IPSET_ATTR_IPADDR_IPV6]),
305 		sizeof(struct in6_addr));
306 	return 0;
307 }
308 EXPORT_SYMBOL_GPL(ip_set_get_ipaddr6);
309 
310 /*
311  * Creating/destroying/renaming/swapping affect the existence and
312  * the properties of a set. All of these can be executed from userspace
313  * only and serialized by the nfnl mutex indirectly from nfnetlink.
314  *
315  * Sets are identified by their index in ip_set_list and the index
316  * is used by the external references (set/SET netfilter modules).
317  *
318  * The set behind an index may change by swapping only, from userspace.
319  */
320 
321 static inline void
__ip_set_get(ip_set_id_t index)322 __ip_set_get(ip_set_id_t index)
323 {
324 	write_lock_bh(&ip_set_ref_lock);
325 	ip_set_list[index]->ref++;
326 	write_unlock_bh(&ip_set_ref_lock);
327 }
328 
329 static inline void
__ip_set_put(ip_set_id_t index)330 __ip_set_put(ip_set_id_t index)
331 {
332 	write_lock_bh(&ip_set_ref_lock);
333 	BUG_ON(ip_set_list[index]->ref == 0);
334 	ip_set_list[index]->ref--;
335 	write_unlock_bh(&ip_set_ref_lock);
336 }
337 
338 /*
339  * Add, del and test set entries from kernel.
340  *
341  * The set behind the index must exist and must be referenced
342  * so it can't be destroyed (or changed) under our foot.
343  */
344 
345 int
ip_set_test(ip_set_id_t index,const struct sk_buff * skb,const struct xt_action_param * par,const struct ip_set_adt_opt * opt)346 ip_set_test(ip_set_id_t index, const struct sk_buff *skb,
347 	    const struct xt_action_param *par,
348 	    const struct ip_set_adt_opt *opt)
349 {
350 	struct ip_set *set = ip_set_list[index];
351 	int ret = 0;
352 
353 	BUG_ON(set == NULL);
354 	pr_debug("set %s, index %u\n", set->name, index);
355 
356 	if (opt->dim < set->type->dimension ||
357 	    !(opt->family == set->family || set->family == AF_UNSPEC))
358 		return 0;
359 
360 	read_lock_bh(&set->lock);
361 	ret = set->variant->kadt(set, skb, par, IPSET_TEST, opt);
362 	read_unlock_bh(&set->lock);
363 
364 	if (ret == -EAGAIN) {
365 		/* Type requests element to be completed */
366 		pr_debug("element must be competed, ADD is triggered\n");
367 		write_lock_bh(&set->lock);
368 		set->variant->kadt(set, skb, par, IPSET_ADD, opt);
369 		write_unlock_bh(&set->lock);
370 		ret = 1;
371 	}
372 
373 	/* Convert error codes to nomatch */
374 	return (ret < 0 ? 0 : ret);
375 }
376 EXPORT_SYMBOL_GPL(ip_set_test);
377 
378 int
ip_set_add(ip_set_id_t index,const struct sk_buff * skb,const struct xt_action_param * par,const struct ip_set_adt_opt * opt)379 ip_set_add(ip_set_id_t index, const struct sk_buff *skb,
380 	   const struct xt_action_param *par,
381 	   const struct ip_set_adt_opt *opt)
382 {
383 	struct ip_set *set = ip_set_list[index];
384 	int ret;
385 
386 	BUG_ON(set == NULL);
387 	pr_debug("set %s, index %u\n", set->name, index);
388 
389 	if (opt->dim < set->type->dimension ||
390 	    !(opt->family == set->family || set->family == AF_UNSPEC))
391 		return 0;
392 
393 	write_lock_bh(&set->lock);
394 	ret = set->variant->kadt(set, skb, par, IPSET_ADD, opt);
395 	write_unlock_bh(&set->lock);
396 
397 	return ret;
398 }
399 EXPORT_SYMBOL_GPL(ip_set_add);
400 
401 int
ip_set_del(ip_set_id_t index,const struct sk_buff * skb,const struct xt_action_param * par,const struct ip_set_adt_opt * opt)402 ip_set_del(ip_set_id_t index, const struct sk_buff *skb,
403 	   const struct xt_action_param *par,
404 	   const struct ip_set_adt_opt *opt)
405 {
406 	struct ip_set *set = ip_set_list[index];
407 	int ret = 0;
408 
409 	BUG_ON(set == NULL);
410 	pr_debug("set %s, index %u\n", set->name, index);
411 
412 	if (opt->dim < set->type->dimension ||
413 	    !(opt->family == set->family || set->family == AF_UNSPEC))
414 		return 0;
415 
416 	write_lock_bh(&set->lock);
417 	ret = set->variant->kadt(set, skb, par, IPSET_DEL, opt);
418 	write_unlock_bh(&set->lock);
419 
420 	return ret;
421 }
422 EXPORT_SYMBOL_GPL(ip_set_del);
423 
424 /*
425  * Find set by name, reference it once. The reference makes sure the
426  * thing pointed to, does not go away under our feet.
427  *
428  */
429 ip_set_id_t
ip_set_get_byname(const char * name,struct ip_set ** set)430 ip_set_get_byname(const char *name, struct ip_set **set)
431 {
432 	ip_set_id_t i, index = IPSET_INVALID_ID;
433 	struct ip_set *s;
434 
435 	for (i = 0; i < ip_set_max; i++) {
436 		s = ip_set_list[i];
437 		if (s != NULL && STREQ(s->name, name)) {
438 			__ip_set_get(i);
439 			index = i;
440 			*set = s;
441 		}
442 	}
443 
444 	return index;
445 }
446 EXPORT_SYMBOL_GPL(ip_set_get_byname);
447 
448 /*
449  * If the given set pointer points to a valid set, decrement
450  * reference count by 1. The caller shall not assume the index
451  * to be valid, after calling this function.
452  *
453  */
454 void
ip_set_put_byindex(ip_set_id_t index)455 ip_set_put_byindex(ip_set_id_t index)
456 {
457 	if (ip_set_list[index] != NULL)
458 		__ip_set_put(index);
459 }
460 EXPORT_SYMBOL_GPL(ip_set_put_byindex);
461 
462 /*
463  * Get the name of a set behind a set index.
464  * We assume the set is referenced, so it does exist and
465  * can't be destroyed. The set cannot be renamed due to
466  * the referencing either.
467  *
468  */
469 const char *
ip_set_name_byindex(ip_set_id_t index)470 ip_set_name_byindex(ip_set_id_t index)
471 {
472 	const struct ip_set *set = ip_set_list[index];
473 
474 	BUG_ON(set == NULL);
475 	BUG_ON(set->ref == 0);
476 
477 	/* Referenced, so it's safe */
478 	return set->name;
479 }
480 EXPORT_SYMBOL_GPL(ip_set_name_byindex);
481 
482 /*
483  * Routines to call by external subsystems, which do not
484  * call nfnl_lock for us.
485  */
486 
487 /*
488  * Find set by name, reference it once. The reference makes sure the
489  * thing pointed to, does not go away under our feet.
490  *
491  * The nfnl mutex is used in the function.
492  */
493 ip_set_id_t
ip_set_nfnl_get(const char * name)494 ip_set_nfnl_get(const char *name)
495 {
496 	struct ip_set *s;
497 	ip_set_id_t index;
498 
499 	nfnl_lock();
500 	index = ip_set_get_byname(name, &s);
501 	nfnl_unlock();
502 
503 	return index;
504 }
505 EXPORT_SYMBOL_GPL(ip_set_nfnl_get);
506 
507 /*
508  * Find set by index, reference it once. The reference makes sure the
509  * thing pointed to, does not go away under our feet.
510  *
511  * The nfnl mutex is used in the function.
512  */
513 ip_set_id_t
ip_set_nfnl_get_byindex(ip_set_id_t index)514 ip_set_nfnl_get_byindex(ip_set_id_t index)
515 {
516 	if (index > ip_set_max)
517 		return IPSET_INVALID_ID;
518 
519 	nfnl_lock();
520 	if (ip_set_list[index])
521 		__ip_set_get(index);
522 	else
523 		index = IPSET_INVALID_ID;
524 	nfnl_unlock();
525 
526 	return index;
527 }
528 EXPORT_SYMBOL_GPL(ip_set_nfnl_get_byindex);
529 
530 /*
531  * If the given set pointer points to a valid set, decrement
532  * reference count by 1. The caller shall not assume the index
533  * to be valid, after calling this function.
534  *
535  * The nfnl mutex is used in the function.
536  */
537 void
ip_set_nfnl_put(ip_set_id_t index)538 ip_set_nfnl_put(ip_set_id_t index)
539 {
540 	nfnl_lock();
541 	ip_set_put_byindex(index);
542 	nfnl_unlock();
543 }
544 EXPORT_SYMBOL_GPL(ip_set_nfnl_put);
545 
546 /*
547  * Communication protocol with userspace over netlink.
548  *
549  * The commands are serialized by the nfnl mutex.
550  */
551 
552 static inline bool
protocol_failed(const struct nlattr * const tb[])553 protocol_failed(const struct nlattr * const tb[])
554 {
555 	return !tb[IPSET_ATTR_PROTOCOL] ||
556 	       nla_get_u8(tb[IPSET_ATTR_PROTOCOL]) != IPSET_PROTOCOL;
557 }
558 
559 static inline u32
flag_exist(const struct nlmsghdr * nlh)560 flag_exist(const struct nlmsghdr *nlh)
561 {
562 	return nlh->nlmsg_flags & NLM_F_EXCL ? 0 : IPSET_FLAG_EXIST;
563 }
564 
565 static struct nlmsghdr *
start_msg(struct sk_buff * skb,u32 pid,u32 seq,unsigned int flags,enum ipset_cmd cmd)566 start_msg(struct sk_buff *skb, u32 pid, u32 seq, unsigned int flags,
567 	  enum ipset_cmd cmd)
568 {
569 	struct nlmsghdr *nlh;
570 	struct nfgenmsg *nfmsg;
571 
572 	nlh = nlmsg_put(skb, pid, seq, cmd | (NFNL_SUBSYS_IPSET << 8),
573 			sizeof(*nfmsg), flags);
574 	if (nlh == NULL)
575 		return NULL;
576 
577 	nfmsg = nlmsg_data(nlh);
578 	nfmsg->nfgen_family = AF_INET;
579 	nfmsg->version = NFNETLINK_V0;
580 	nfmsg->res_id = 0;
581 
582 	return nlh;
583 }
584 
585 /* Create a set */
586 
587 static const struct nla_policy ip_set_create_policy[IPSET_ATTR_CMD_MAX + 1] = {
588 	[IPSET_ATTR_PROTOCOL]	= { .type = NLA_U8 },
589 	[IPSET_ATTR_SETNAME]	= { .type = NLA_NUL_STRING,
590 				    .len = IPSET_MAXNAMELEN - 1 },
591 	[IPSET_ATTR_TYPENAME]	= { .type = NLA_NUL_STRING,
592 				    .len = IPSET_MAXNAMELEN - 1},
593 	[IPSET_ATTR_REVISION]	= { .type = NLA_U8 },
594 	[IPSET_ATTR_FAMILY]	= { .type = NLA_U8 },
595 	[IPSET_ATTR_DATA]	= { .type = NLA_NESTED },
596 };
597 
598 static ip_set_id_t
find_set_id(const char * name)599 find_set_id(const char *name)
600 {
601 	ip_set_id_t i, index = IPSET_INVALID_ID;
602 	const struct ip_set *set;
603 
604 	for (i = 0; index == IPSET_INVALID_ID && i < ip_set_max; i++) {
605 		set = ip_set_list[i];
606 		if (set != NULL && STREQ(set->name, name))
607 			index = i;
608 	}
609 	return index;
610 }
611 
612 static inline struct ip_set *
find_set(const char * name)613 find_set(const char *name)
614 {
615 	ip_set_id_t index = find_set_id(name);
616 
617 	return index == IPSET_INVALID_ID ? NULL : ip_set_list[index];
618 }
619 
620 static int
find_free_id(const char * name,ip_set_id_t * index,struct ip_set ** set)621 find_free_id(const char *name, ip_set_id_t *index, struct ip_set **set)
622 {
623 	ip_set_id_t i;
624 
625 	*index = IPSET_INVALID_ID;
626 	for (i = 0;  i < ip_set_max; i++) {
627 		if (ip_set_list[i] == NULL) {
628 			if (*index == IPSET_INVALID_ID)
629 				*index = i;
630 		} else if (STREQ(name, ip_set_list[i]->name)) {
631 			/* Name clash */
632 			*set = ip_set_list[i];
633 			return -EEXIST;
634 		}
635 	}
636 	if (*index == IPSET_INVALID_ID)
637 		/* No free slot remained */
638 		return -IPSET_ERR_MAX_SETS;
639 	return 0;
640 }
641 
642 static int
ip_set_create(struct sock * ctnl,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const attr[])643 ip_set_create(struct sock *ctnl, struct sk_buff *skb,
644 	      const struct nlmsghdr *nlh,
645 	      const struct nlattr * const attr[])
646 {
647 	struct ip_set *set, *clash = NULL;
648 	ip_set_id_t index = IPSET_INVALID_ID;
649 	struct nlattr *tb[IPSET_ATTR_CREATE_MAX+1] = {};
650 	const char *name, *typename;
651 	u8 family, revision;
652 	u32 flags = flag_exist(nlh);
653 	int ret = 0;
654 
655 	if (unlikely(protocol_failed(attr) ||
656 		     attr[IPSET_ATTR_SETNAME] == NULL ||
657 		     attr[IPSET_ATTR_TYPENAME] == NULL ||
658 		     attr[IPSET_ATTR_REVISION] == NULL ||
659 		     attr[IPSET_ATTR_FAMILY] == NULL ||
660 		     (attr[IPSET_ATTR_DATA] != NULL &&
661 		      !flag_nested(attr[IPSET_ATTR_DATA]))))
662 		return -IPSET_ERR_PROTOCOL;
663 
664 	name = nla_data(attr[IPSET_ATTR_SETNAME]);
665 	typename = nla_data(attr[IPSET_ATTR_TYPENAME]);
666 	family = nla_get_u8(attr[IPSET_ATTR_FAMILY]);
667 	revision = nla_get_u8(attr[IPSET_ATTR_REVISION]);
668 	pr_debug("setname: %s, typename: %s, family: %s, revision: %u\n",
669 		 name, typename, family_name(family), revision);
670 
671 	/*
672 	 * First, and without any locks, allocate and initialize
673 	 * a normal base set structure.
674 	 */
675 	set = kzalloc(sizeof(struct ip_set), GFP_KERNEL);
676 	if (!set)
677 		return -ENOMEM;
678 	rwlock_init(&set->lock);
679 	strlcpy(set->name, name, IPSET_MAXNAMELEN);
680 	set->family = family;
681 	set->revision = revision;
682 
683 	/*
684 	 * Next, check that we know the type, and take
685 	 * a reference on the type, to make sure it stays available
686 	 * while constructing our new set.
687 	 *
688 	 * After referencing the type, we try to create the type
689 	 * specific part of the set without holding any locks.
690 	 */
691 	ret = find_set_type_get(typename, family, revision, &(set->type));
692 	if (ret)
693 		goto out;
694 
695 	/*
696 	 * Without holding any locks, create private part.
697 	 */
698 	if (attr[IPSET_ATTR_DATA] &&
699 	    nla_parse_nested(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA],
700 			     set->type->create_policy)) {
701 		ret = -IPSET_ERR_PROTOCOL;
702 		goto put_out;
703 	}
704 
705 	ret = set->type->create(set, tb, flags);
706 	if (ret != 0)
707 		goto put_out;
708 
709 	/* BTW, ret==0 here. */
710 
711 	/*
712 	 * Here, we have a valid, constructed set and we are protected
713 	 * by the nfnl mutex. Find the first free index in ip_set_list
714 	 * and check clashing.
715 	 */
716 	if ((ret = find_free_id(set->name, &index, &clash)) != 0) {
717 		/* If this is the same set and requested, ignore error */
718 		if (ret == -EEXIST &&
719 		    (flags & IPSET_FLAG_EXIST) &&
720 		    STREQ(set->type->name, clash->type->name) &&
721 		    set->type->family == clash->type->family &&
722 		    set->type->revision_min == clash->type->revision_min &&
723 		    set->type->revision_max == clash->type->revision_max &&
724 		    set->variant->same_set(set, clash))
725 			ret = 0;
726 		goto cleanup;
727 	}
728 
729 	/*
730 	 * Finally! Add our shiny new set to the list, and be done.
731 	 */
732 	pr_debug("create: '%s' created with index %u!\n", set->name, index);
733 	ip_set_list[index] = set;
734 
735 	return ret;
736 
737 cleanup:
738 	set->variant->destroy(set);
739 put_out:
740 	module_put(set->type->me);
741 out:
742 	kfree(set);
743 	return ret;
744 }
745 
746 /* Destroy sets */
747 
748 static const struct nla_policy
749 ip_set_setname_policy[IPSET_ATTR_CMD_MAX + 1] = {
750 	[IPSET_ATTR_PROTOCOL]	= { .type = NLA_U8 },
751 	[IPSET_ATTR_SETNAME]	= { .type = NLA_NUL_STRING,
752 				    .len = IPSET_MAXNAMELEN - 1 },
753 };
754 
755 static void
ip_set_destroy_set(ip_set_id_t index)756 ip_set_destroy_set(ip_set_id_t index)
757 {
758 	struct ip_set *set = ip_set_list[index];
759 
760 	pr_debug("set: %s\n",  set->name);
761 	ip_set_list[index] = NULL;
762 
763 	/* Must call it without holding any lock */
764 	set->variant->destroy(set);
765 	module_put(set->type->me);
766 	kfree(set);
767 }
768 
769 static int
ip_set_destroy(struct sock * ctnl,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const attr[])770 ip_set_destroy(struct sock *ctnl, struct sk_buff *skb,
771 	       const struct nlmsghdr *nlh,
772 	       const struct nlattr * const attr[])
773 {
774 	ip_set_id_t i;
775 	int ret = 0;
776 
777 	if (unlikely(protocol_failed(attr)))
778 		return -IPSET_ERR_PROTOCOL;
779 
780 	/* Commands are serialized and references are
781 	 * protected by the ip_set_ref_lock.
782 	 * External systems (i.e. xt_set) must call
783 	 * ip_set_put|get_nfnl_* functions, that way we
784 	 * can safely check references here.
785 	 *
786 	 * list:set timer can only decrement the reference
787 	 * counter, so if it's already zero, we can proceed
788 	 * without holding the lock.
789 	 */
790 	read_lock_bh(&ip_set_ref_lock);
791 	if (!attr[IPSET_ATTR_SETNAME]) {
792 		for (i = 0; i < ip_set_max; i++) {
793 			if (ip_set_list[i] != NULL && ip_set_list[i]->ref) {
794 				ret = -IPSET_ERR_BUSY;
795 				goto out;
796 			}
797 		}
798 		read_unlock_bh(&ip_set_ref_lock);
799 		for (i = 0; i < ip_set_max; i++) {
800 			if (ip_set_list[i] != NULL)
801 				ip_set_destroy_set(i);
802 		}
803 	} else {
804 		i = find_set_id(nla_data(attr[IPSET_ATTR_SETNAME]));
805 		if (i == IPSET_INVALID_ID) {
806 			ret = -ENOENT;
807 			goto out;
808 		} else if (ip_set_list[i]->ref) {
809 			ret = -IPSET_ERR_BUSY;
810 			goto out;
811 		}
812 		read_unlock_bh(&ip_set_ref_lock);
813 
814 		ip_set_destroy_set(i);
815 	}
816 	return 0;
817 out:
818 	read_unlock_bh(&ip_set_ref_lock);
819 	return ret;
820 }
821 
822 /* Flush sets */
823 
824 static void
ip_set_flush_set(struct ip_set * set)825 ip_set_flush_set(struct ip_set *set)
826 {
827 	pr_debug("set: %s\n",  set->name);
828 
829 	write_lock_bh(&set->lock);
830 	set->variant->flush(set);
831 	write_unlock_bh(&set->lock);
832 }
833 
834 static int
ip_set_flush(struct sock * ctnl,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const attr[])835 ip_set_flush(struct sock *ctnl, struct sk_buff *skb,
836 	     const struct nlmsghdr *nlh,
837 	     const struct nlattr * const attr[])
838 {
839 	ip_set_id_t i;
840 
841 	if (unlikely(protocol_failed(attr)))
842 		return -IPSET_ERR_PROTOCOL;
843 
844 	if (!attr[IPSET_ATTR_SETNAME]) {
845 		for (i = 0; i < ip_set_max; i++)
846 			if (ip_set_list[i] != NULL)
847 				ip_set_flush_set(ip_set_list[i]);
848 	} else {
849 		i = find_set_id(nla_data(attr[IPSET_ATTR_SETNAME]));
850 		if (i == IPSET_INVALID_ID)
851 			return -ENOENT;
852 
853 		ip_set_flush_set(ip_set_list[i]);
854 	}
855 
856 	return 0;
857 }
858 
859 /* Rename a set */
860 
861 static const struct nla_policy
862 ip_set_setname2_policy[IPSET_ATTR_CMD_MAX + 1] = {
863 	[IPSET_ATTR_PROTOCOL]	= { .type = NLA_U8 },
864 	[IPSET_ATTR_SETNAME]	= { .type = NLA_NUL_STRING,
865 				    .len = IPSET_MAXNAMELEN - 1 },
866 	[IPSET_ATTR_SETNAME2]	= { .type = NLA_NUL_STRING,
867 				    .len = IPSET_MAXNAMELEN - 1 },
868 };
869 
870 static int
ip_set_rename(struct sock * ctnl,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const attr[])871 ip_set_rename(struct sock *ctnl, struct sk_buff *skb,
872 	      const struct nlmsghdr *nlh,
873 	      const struct nlattr * const attr[])
874 {
875 	struct ip_set *set;
876 	const char *name2;
877 	ip_set_id_t i;
878 	int ret = 0;
879 
880 	if (unlikely(protocol_failed(attr) ||
881 		     attr[IPSET_ATTR_SETNAME] == NULL ||
882 		     attr[IPSET_ATTR_SETNAME2] == NULL))
883 		return -IPSET_ERR_PROTOCOL;
884 
885 	set = find_set(nla_data(attr[IPSET_ATTR_SETNAME]));
886 	if (set == NULL)
887 		return -ENOENT;
888 
889 	read_lock_bh(&ip_set_ref_lock);
890 	if (set->ref != 0) {
891 		ret = -IPSET_ERR_REFERENCED;
892 		goto out;
893 	}
894 
895 	name2 = nla_data(attr[IPSET_ATTR_SETNAME2]);
896 	for (i = 0; i < ip_set_max; i++) {
897 		if (ip_set_list[i] != NULL &&
898 		    STREQ(ip_set_list[i]->name, name2)) {
899 			ret = -IPSET_ERR_EXIST_SETNAME2;
900 			goto out;
901 		}
902 	}
903 	strncpy(set->name, name2, IPSET_MAXNAMELEN);
904 
905 out:
906 	read_unlock_bh(&ip_set_ref_lock);
907 	return ret;
908 }
909 
910 /* Swap two sets so that name/index points to the other.
911  * References and set names are also swapped.
912  *
913  * The commands are serialized by the nfnl mutex and references are
914  * protected by the ip_set_ref_lock. The kernel interfaces
915  * do not hold the mutex but the pointer settings are atomic
916  * so the ip_set_list always contains valid pointers to the sets.
917  */
918 
919 static int
ip_set_swap(struct sock * ctnl,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const attr[])920 ip_set_swap(struct sock *ctnl, struct sk_buff *skb,
921 	    const struct nlmsghdr *nlh,
922 	    const struct nlattr * const attr[])
923 {
924 	struct ip_set *from, *to;
925 	ip_set_id_t from_id, to_id;
926 	char from_name[IPSET_MAXNAMELEN];
927 
928 	if (unlikely(protocol_failed(attr) ||
929 		     attr[IPSET_ATTR_SETNAME] == NULL ||
930 		     attr[IPSET_ATTR_SETNAME2] == NULL))
931 		return -IPSET_ERR_PROTOCOL;
932 
933 	from_id = find_set_id(nla_data(attr[IPSET_ATTR_SETNAME]));
934 	if (from_id == IPSET_INVALID_ID)
935 		return -ENOENT;
936 
937 	to_id = find_set_id(nla_data(attr[IPSET_ATTR_SETNAME2]));
938 	if (to_id == IPSET_INVALID_ID)
939 		return -IPSET_ERR_EXIST_SETNAME2;
940 
941 	from = ip_set_list[from_id];
942 	to = ip_set_list[to_id];
943 
944 	/* Features must not change.
945 	 * Not an artificial restriction anymore, as we must prevent
946 	 * possible loops created by swapping in setlist type of sets. */
947 	if (!(from->type->features == to->type->features &&
948 	      from->type->family == to->type->family))
949 		return -IPSET_ERR_TYPE_MISMATCH;
950 
951 	strncpy(from_name, from->name, IPSET_MAXNAMELEN);
952 	strncpy(from->name, to->name, IPSET_MAXNAMELEN);
953 	strncpy(to->name, from_name, IPSET_MAXNAMELEN);
954 
955 	write_lock_bh(&ip_set_ref_lock);
956 	swap(from->ref, to->ref);
957 	ip_set_list[from_id] = to;
958 	ip_set_list[to_id] = from;
959 	write_unlock_bh(&ip_set_ref_lock);
960 
961 	return 0;
962 }
963 
964 /* List/save set data */
965 
966 #define DUMP_INIT	0
967 #define DUMP_ALL	1
968 #define DUMP_ONE	2
969 #define DUMP_LAST	3
970 
971 #define DUMP_TYPE(arg)		(((u32)(arg)) & 0x0000FFFF)
972 #define DUMP_FLAGS(arg)		(((u32)(arg)) >> 16)
973 
974 static int
ip_set_dump_done(struct netlink_callback * cb)975 ip_set_dump_done(struct netlink_callback *cb)
976 {
977 	if (cb->args[2]) {
978 		pr_debug("release set %s\n", ip_set_list[cb->args[1]]->name);
979 		ip_set_put_byindex((ip_set_id_t) cb->args[1]);
980 	}
981 	return 0;
982 }
983 
984 static inline void
dump_attrs(struct nlmsghdr * nlh)985 dump_attrs(struct nlmsghdr *nlh)
986 {
987 	const struct nlattr *attr;
988 	int rem;
989 
990 	pr_debug("dump nlmsg\n");
991 	nlmsg_for_each_attr(attr, nlh, sizeof(struct nfgenmsg), rem) {
992 		pr_debug("type: %u, len %u\n", nla_type(attr), attr->nla_len);
993 	}
994 }
995 
996 static int
dump_init(struct netlink_callback * cb)997 dump_init(struct netlink_callback *cb)
998 {
999 	struct nlmsghdr *nlh = nlmsg_hdr(cb->skb);
1000 	int min_len = NLMSG_SPACE(sizeof(struct nfgenmsg));
1001 	struct nlattr *cda[IPSET_ATTR_CMD_MAX+1];
1002 	struct nlattr *attr = (void *)nlh + min_len;
1003 	u32 dump_type;
1004 	ip_set_id_t index;
1005 
1006 	/* Second pass, so parser can't fail */
1007 	nla_parse(cda, IPSET_ATTR_CMD_MAX,
1008 		  attr, nlh->nlmsg_len - min_len, ip_set_setname_policy);
1009 
1010 	/* cb->args[0] : dump single set/all sets
1011 	 *         [1] : set index
1012 	 *         [..]: type specific
1013 	 */
1014 
1015 	if (cda[IPSET_ATTR_SETNAME]) {
1016 		index = find_set_id(nla_data(cda[IPSET_ATTR_SETNAME]));
1017 		if (index == IPSET_INVALID_ID)
1018 			return -ENOENT;
1019 
1020 		dump_type = DUMP_ONE;
1021 		cb->args[1] = index;
1022 	} else
1023 		dump_type = DUMP_ALL;
1024 
1025 	if (cda[IPSET_ATTR_FLAGS]) {
1026 		u32 f = ip_set_get_h32(cda[IPSET_ATTR_FLAGS]);
1027 		dump_type |= (f << 16);
1028 	}
1029 	cb->args[0] = dump_type;
1030 
1031 	return 0;
1032 }
1033 
1034 static int
ip_set_dump_start(struct sk_buff * skb,struct netlink_callback * cb)1035 ip_set_dump_start(struct sk_buff *skb, struct netlink_callback *cb)
1036 {
1037 	ip_set_id_t index = IPSET_INVALID_ID, max;
1038 	struct ip_set *set = NULL;
1039 	struct nlmsghdr *nlh = NULL;
1040 	unsigned int flags = NETLINK_CB(cb->skb).pid ? NLM_F_MULTI : 0;
1041 	u32 dump_type, dump_flags;
1042 	int ret = 0;
1043 
1044 	if (!cb->args[0]) {
1045 		ret = dump_init(cb);
1046 		if (ret < 0) {
1047 			nlh = nlmsg_hdr(cb->skb);
1048 			/* We have to create and send the error message
1049 			 * manually :-( */
1050 			if (nlh->nlmsg_flags & NLM_F_ACK)
1051 				netlink_ack(cb->skb, nlh, ret);
1052 			return ret;
1053 		}
1054 	}
1055 
1056 	if (cb->args[1] >= ip_set_max)
1057 		goto out;
1058 
1059 	dump_type = DUMP_TYPE(cb->args[0]);
1060 	dump_flags = DUMP_FLAGS(cb->args[0]);
1061 	max = dump_type == DUMP_ONE ? cb->args[1] + 1 : ip_set_max;
1062 dump_last:
1063 	pr_debug("args[0]: %u %u args[1]: %ld\n",
1064 		 dump_type, dump_flags, cb->args[1]);
1065 	for (; cb->args[1] < max; cb->args[1]++) {
1066 		index = (ip_set_id_t) cb->args[1];
1067 		set = ip_set_list[index];
1068 		if (set == NULL) {
1069 			if (dump_type == DUMP_ONE) {
1070 				ret = -ENOENT;
1071 				goto out;
1072 			}
1073 			continue;
1074 		}
1075 		/* When dumping all sets, we must dump "sorted"
1076 		 * so that lists (unions of sets) are dumped last.
1077 		 */
1078 		if (dump_type != DUMP_ONE &&
1079 		    ((dump_type == DUMP_ALL) ==
1080 		     !!(set->type->features & IPSET_DUMP_LAST)))
1081 			continue;
1082 		pr_debug("List set: %s\n", set->name);
1083 		if (!cb->args[2]) {
1084 			/* Start listing: make sure set won't be destroyed */
1085 			pr_debug("reference set\n");
1086 			__ip_set_get(index);
1087 		}
1088 		nlh = start_msg(skb, NETLINK_CB(cb->skb).pid,
1089 				cb->nlh->nlmsg_seq, flags,
1090 				IPSET_CMD_LIST);
1091 		if (!nlh) {
1092 			ret = -EMSGSIZE;
1093 			goto release_refcount;
1094 		}
1095 		NLA_PUT_U8(skb, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL);
1096 		NLA_PUT_STRING(skb, IPSET_ATTR_SETNAME, set->name);
1097 		if (dump_flags & IPSET_FLAG_LIST_SETNAME)
1098 			goto next_set;
1099 		switch (cb->args[2]) {
1100 		case 0:
1101 			/* Core header data */
1102 			NLA_PUT_STRING(skb, IPSET_ATTR_TYPENAME,
1103 				       set->type->name);
1104 			NLA_PUT_U8(skb, IPSET_ATTR_FAMILY,
1105 				   set->family);
1106 			NLA_PUT_U8(skb, IPSET_ATTR_REVISION,
1107 				   set->revision);
1108 			ret = set->variant->head(set, skb);
1109 			if (ret < 0)
1110 				goto release_refcount;
1111 			if (dump_flags & IPSET_FLAG_LIST_HEADER)
1112 				goto next_set;
1113 			/* Fall through and add elements */
1114 		default:
1115 			read_lock_bh(&set->lock);
1116 			ret = set->variant->list(set, skb, cb);
1117 			read_unlock_bh(&set->lock);
1118 			if (!cb->args[2])
1119 				/* Set is done, proceed with next one */
1120 				goto next_set;
1121 			goto release_refcount;
1122 		}
1123 	}
1124 	/* If we dump all sets, continue with dumping last ones */
1125 	if (dump_type == DUMP_ALL) {
1126 		dump_type = DUMP_LAST;
1127 		cb->args[0] = dump_type | (dump_flags << 16);
1128 		cb->args[1] = 0;
1129 		goto dump_last;
1130 	}
1131 	goto out;
1132 
1133 nla_put_failure:
1134 	ret = -EFAULT;
1135 next_set:
1136 	if (dump_type == DUMP_ONE)
1137 		cb->args[1] = IPSET_INVALID_ID;
1138 	else
1139 		cb->args[1]++;
1140 release_refcount:
1141 	/* If there was an error or set is done, release set */
1142 	if (ret || !cb->args[2]) {
1143 		pr_debug("release set %s\n", ip_set_list[index]->name);
1144 		ip_set_put_byindex(index);
1145 		cb->args[2] = 0;
1146 	}
1147 out:
1148 	if (nlh) {
1149 		nlmsg_end(skb, nlh);
1150 		pr_debug("nlmsg_len: %u\n", nlh->nlmsg_len);
1151 		dump_attrs(nlh);
1152 	}
1153 
1154 	return ret < 0 ? ret : skb->len;
1155 }
1156 
1157 static int
ip_set_dump(struct sock * ctnl,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const attr[])1158 ip_set_dump(struct sock *ctnl, struct sk_buff *skb,
1159 	    const struct nlmsghdr *nlh,
1160 	    const struct nlattr * const attr[])
1161 {
1162 	if (unlikely(protocol_failed(attr)))
1163 		return -IPSET_ERR_PROTOCOL;
1164 
1165 	return netlink_dump_start(ctnl, skb, nlh,
1166 				  ip_set_dump_start,
1167 				  ip_set_dump_done, 0);
1168 }
1169 
1170 /* Add, del and test */
1171 
1172 static const struct nla_policy ip_set_adt_policy[IPSET_ATTR_CMD_MAX + 1] = {
1173 	[IPSET_ATTR_PROTOCOL]	= { .type = NLA_U8 },
1174 	[IPSET_ATTR_SETNAME]	= { .type = NLA_NUL_STRING,
1175 				    .len = IPSET_MAXNAMELEN - 1 },
1176 	[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
1177 	[IPSET_ATTR_DATA]	= { .type = NLA_NESTED },
1178 	[IPSET_ATTR_ADT]	= { .type = NLA_NESTED },
1179 };
1180 
1181 static int
call_ad(struct sock * ctnl,struct sk_buff * skb,struct ip_set * set,struct nlattr * tb[],enum ipset_adt adt,u32 flags,bool use_lineno)1182 call_ad(struct sock *ctnl, struct sk_buff *skb, struct ip_set *set,
1183 	struct nlattr *tb[], enum ipset_adt adt,
1184 	u32 flags, bool use_lineno)
1185 {
1186 	int ret;
1187 	u32 lineno = 0;
1188 	bool eexist = flags & IPSET_FLAG_EXIST, retried = false;
1189 
1190 	do {
1191 		write_lock_bh(&set->lock);
1192 		ret = set->variant->uadt(set, tb, adt, &lineno, flags, retried);
1193 		write_unlock_bh(&set->lock);
1194 		retried = true;
1195 	} while (ret == -EAGAIN &&
1196 		 set->variant->resize &&
1197 		 (ret = set->variant->resize(set, retried)) == 0);
1198 
1199 	if (!ret || (ret == -IPSET_ERR_EXIST && eexist))
1200 		return 0;
1201 	if (lineno && use_lineno) {
1202 		/* Error in restore/batch mode: send back lineno */
1203 		struct nlmsghdr *rep, *nlh = nlmsg_hdr(skb);
1204 		struct sk_buff *skb2;
1205 		struct nlmsgerr *errmsg;
1206 		size_t payload = sizeof(*errmsg) + nlmsg_len(nlh);
1207 		int min_len = NLMSG_SPACE(sizeof(struct nfgenmsg));
1208 		struct nlattr *cda[IPSET_ATTR_CMD_MAX+1];
1209 		struct nlattr *cmdattr;
1210 		u32 *errline;
1211 
1212 		skb2 = nlmsg_new(payload, GFP_KERNEL);
1213 		if (skb2 == NULL)
1214 			return -ENOMEM;
1215 		rep = __nlmsg_put(skb2, NETLINK_CB(skb).pid,
1216 				  nlh->nlmsg_seq, NLMSG_ERROR, payload, 0);
1217 		errmsg = nlmsg_data(rep);
1218 		errmsg->error = ret;
1219 		memcpy(&errmsg->msg, nlh, nlh->nlmsg_len);
1220 		cmdattr = (void *)&errmsg->msg + min_len;
1221 
1222 		nla_parse(cda, IPSET_ATTR_CMD_MAX,
1223 			  cmdattr, nlh->nlmsg_len - min_len,
1224 			  ip_set_adt_policy);
1225 
1226 		errline = nla_data(cda[IPSET_ATTR_LINENO]);
1227 
1228 		*errline = lineno;
1229 
1230 		netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1231 		/* Signal netlink not to send its ACK/errmsg.  */
1232 		return -EINTR;
1233 	}
1234 
1235 	return ret;
1236 }
1237 
1238 static int
ip_set_uadd(struct sock * ctnl,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const attr[])1239 ip_set_uadd(struct sock *ctnl, struct sk_buff *skb,
1240 	    const struct nlmsghdr *nlh,
1241 	    const struct nlattr * const attr[])
1242 {
1243 	struct ip_set *set;
1244 	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1] = {};
1245 	const struct nlattr *nla;
1246 	u32 flags = flag_exist(nlh);
1247 	bool use_lineno;
1248 	int ret = 0;
1249 
1250 	if (unlikely(protocol_failed(attr) ||
1251 		     attr[IPSET_ATTR_SETNAME] == NULL ||
1252 		     !((attr[IPSET_ATTR_DATA] != NULL) ^
1253 		       (attr[IPSET_ATTR_ADT] != NULL)) ||
1254 		     (attr[IPSET_ATTR_DATA] != NULL &&
1255 		      !flag_nested(attr[IPSET_ATTR_DATA])) ||
1256 		     (attr[IPSET_ATTR_ADT] != NULL &&
1257 		      (!flag_nested(attr[IPSET_ATTR_ADT]) ||
1258 		       attr[IPSET_ATTR_LINENO] == NULL))))
1259 		return -IPSET_ERR_PROTOCOL;
1260 
1261 	set = find_set(nla_data(attr[IPSET_ATTR_SETNAME]));
1262 	if (set == NULL)
1263 		return -ENOENT;
1264 
1265 	use_lineno = !!attr[IPSET_ATTR_LINENO];
1266 	if (attr[IPSET_ATTR_DATA]) {
1267 		if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX,
1268 				     attr[IPSET_ATTR_DATA],
1269 				     set->type->adt_policy))
1270 			return -IPSET_ERR_PROTOCOL;
1271 		ret = call_ad(ctnl, skb, set, tb, IPSET_ADD, flags,
1272 			      use_lineno);
1273 	} else {
1274 		int nla_rem;
1275 
1276 		nla_for_each_nested(nla, attr[IPSET_ATTR_ADT], nla_rem) {
1277 			memset(tb, 0, sizeof(tb));
1278 			if (nla_type(nla) != IPSET_ATTR_DATA ||
1279 			    !flag_nested(nla) ||
1280 			    nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, nla,
1281 					     set->type->adt_policy))
1282 				return -IPSET_ERR_PROTOCOL;
1283 			ret = call_ad(ctnl, skb, set, tb, IPSET_ADD,
1284 				      flags, use_lineno);
1285 			if (ret < 0)
1286 				return ret;
1287 		}
1288 	}
1289 	return ret;
1290 }
1291 
1292 static int
ip_set_udel(struct sock * ctnl,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const attr[])1293 ip_set_udel(struct sock *ctnl, struct sk_buff *skb,
1294 	    const struct nlmsghdr *nlh,
1295 	    const struct nlattr * const attr[])
1296 {
1297 	struct ip_set *set;
1298 	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1] = {};
1299 	const struct nlattr *nla;
1300 	u32 flags = flag_exist(nlh);
1301 	bool use_lineno;
1302 	int ret = 0;
1303 
1304 	if (unlikely(protocol_failed(attr) ||
1305 		     attr[IPSET_ATTR_SETNAME] == NULL ||
1306 		     !((attr[IPSET_ATTR_DATA] != NULL) ^
1307 		       (attr[IPSET_ATTR_ADT] != NULL)) ||
1308 		     (attr[IPSET_ATTR_DATA] != NULL &&
1309 		      !flag_nested(attr[IPSET_ATTR_DATA])) ||
1310 		     (attr[IPSET_ATTR_ADT] != NULL &&
1311 		      (!flag_nested(attr[IPSET_ATTR_ADT]) ||
1312 		       attr[IPSET_ATTR_LINENO] == NULL))))
1313 		return -IPSET_ERR_PROTOCOL;
1314 
1315 	set = find_set(nla_data(attr[IPSET_ATTR_SETNAME]));
1316 	if (set == NULL)
1317 		return -ENOENT;
1318 
1319 	use_lineno = !!attr[IPSET_ATTR_LINENO];
1320 	if (attr[IPSET_ATTR_DATA]) {
1321 		if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX,
1322 				     attr[IPSET_ATTR_DATA],
1323 				     set->type->adt_policy))
1324 			return -IPSET_ERR_PROTOCOL;
1325 		ret = call_ad(ctnl, skb, set, tb, IPSET_DEL, flags,
1326 			      use_lineno);
1327 	} else {
1328 		int nla_rem;
1329 
1330 		nla_for_each_nested(nla, attr[IPSET_ATTR_ADT], nla_rem) {
1331 			memset(tb, 0, sizeof(*tb));
1332 			if (nla_type(nla) != IPSET_ATTR_DATA ||
1333 			    !flag_nested(nla) ||
1334 			    nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, nla,
1335 					     set->type->adt_policy))
1336 				return -IPSET_ERR_PROTOCOL;
1337 			ret = call_ad(ctnl, skb, set, tb, IPSET_DEL,
1338 				      flags, use_lineno);
1339 			if (ret < 0)
1340 				return ret;
1341 		}
1342 	}
1343 	return ret;
1344 }
1345 
1346 static int
ip_set_utest(struct sock * ctnl,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const attr[])1347 ip_set_utest(struct sock *ctnl, struct sk_buff *skb,
1348 	     const struct nlmsghdr *nlh,
1349 	     const struct nlattr * const attr[])
1350 {
1351 	struct ip_set *set;
1352 	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1] = {};
1353 	int ret = 0;
1354 
1355 	if (unlikely(protocol_failed(attr) ||
1356 		     attr[IPSET_ATTR_SETNAME] == NULL ||
1357 		     attr[IPSET_ATTR_DATA] == NULL ||
1358 		     !flag_nested(attr[IPSET_ATTR_DATA])))
1359 		return -IPSET_ERR_PROTOCOL;
1360 
1361 	set = find_set(nla_data(attr[IPSET_ATTR_SETNAME]));
1362 	if (set == NULL)
1363 		return -ENOENT;
1364 
1365 	if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA],
1366 			     set->type->adt_policy))
1367 		return -IPSET_ERR_PROTOCOL;
1368 
1369 	read_lock_bh(&set->lock);
1370 	ret = set->variant->uadt(set, tb, IPSET_TEST, NULL, 0, 0);
1371 	read_unlock_bh(&set->lock);
1372 	/* Userspace can't trigger element to be re-added */
1373 	if (ret == -EAGAIN)
1374 		ret = 1;
1375 
1376 	return ret < 0 ? ret : ret > 0 ? 0 : -IPSET_ERR_EXIST;
1377 }
1378 
1379 /* Get headed data of a set */
1380 
1381 static int
ip_set_header(struct sock * ctnl,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const attr[])1382 ip_set_header(struct sock *ctnl, struct sk_buff *skb,
1383 	      const struct nlmsghdr *nlh,
1384 	      const struct nlattr * const attr[])
1385 {
1386 	const struct ip_set *set;
1387 	struct sk_buff *skb2;
1388 	struct nlmsghdr *nlh2;
1389 	ip_set_id_t index;
1390 	int ret = 0;
1391 
1392 	if (unlikely(protocol_failed(attr) ||
1393 		     attr[IPSET_ATTR_SETNAME] == NULL))
1394 		return -IPSET_ERR_PROTOCOL;
1395 
1396 	index = find_set_id(nla_data(attr[IPSET_ATTR_SETNAME]));
1397 	if (index == IPSET_INVALID_ID)
1398 		return -ENOENT;
1399 	set = ip_set_list[index];
1400 
1401 	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1402 	if (skb2 == NULL)
1403 		return -ENOMEM;
1404 
1405 	nlh2 = start_msg(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq, 0,
1406 			 IPSET_CMD_HEADER);
1407 	if (!nlh2)
1408 		goto nlmsg_failure;
1409 	NLA_PUT_U8(skb2, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL);
1410 	NLA_PUT_STRING(skb2, IPSET_ATTR_SETNAME, set->name);
1411 	NLA_PUT_STRING(skb2, IPSET_ATTR_TYPENAME, set->type->name);
1412 	NLA_PUT_U8(skb2, IPSET_ATTR_FAMILY, set->family);
1413 	NLA_PUT_U8(skb2, IPSET_ATTR_REVISION, set->revision);
1414 	nlmsg_end(skb2, nlh2);
1415 
1416 	ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1417 	if (ret < 0)
1418 		return ret;
1419 
1420 	return 0;
1421 
1422 nla_put_failure:
1423 	nlmsg_cancel(skb2, nlh2);
1424 nlmsg_failure:
1425 	kfree_skb(skb2);
1426 	return -EMSGSIZE;
1427 }
1428 
1429 /* Get type data */
1430 
1431 static const struct nla_policy ip_set_type_policy[IPSET_ATTR_CMD_MAX + 1] = {
1432 	[IPSET_ATTR_PROTOCOL]	= { .type = NLA_U8 },
1433 	[IPSET_ATTR_TYPENAME]	= { .type = NLA_NUL_STRING,
1434 				    .len = IPSET_MAXNAMELEN - 1 },
1435 	[IPSET_ATTR_FAMILY]	= { .type = NLA_U8 },
1436 };
1437 
1438 static int
ip_set_type(struct sock * ctnl,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const attr[])1439 ip_set_type(struct sock *ctnl, struct sk_buff *skb,
1440 	    const struct nlmsghdr *nlh,
1441 	    const struct nlattr * const attr[])
1442 {
1443 	struct sk_buff *skb2;
1444 	struct nlmsghdr *nlh2;
1445 	u8 family, min, max;
1446 	const char *typename;
1447 	int ret = 0;
1448 
1449 	if (unlikely(protocol_failed(attr) ||
1450 		     attr[IPSET_ATTR_TYPENAME] == NULL ||
1451 		     attr[IPSET_ATTR_FAMILY] == NULL))
1452 		return -IPSET_ERR_PROTOCOL;
1453 
1454 	family = nla_get_u8(attr[IPSET_ATTR_FAMILY]);
1455 	typename = nla_data(attr[IPSET_ATTR_TYPENAME]);
1456 	ret = find_set_type_minmax(typename, family, &min, &max);
1457 	if (ret)
1458 		return ret;
1459 
1460 	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1461 	if (skb2 == NULL)
1462 		return -ENOMEM;
1463 
1464 	nlh2 = start_msg(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq, 0,
1465 			 IPSET_CMD_TYPE);
1466 	if (!nlh2)
1467 		goto nlmsg_failure;
1468 	NLA_PUT_U8(skb2, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL);
1469 	NLA_PUT_STRING(skb2, IPSET_ATTR_TYPENAME, typename);
1470 	NLA_PUT_U8(skb2, IPSET_ATTR_FAMILY, family);
1471 	NLA_PUT_U8(skb2, IPSET_ATTR_REVISION, max);
1472 	NLA_PUT_U8(skb2, IPSET_ATTR_REVISION_MIN, min);
1473 	nlmsg_end(skb2, nlh2);
1474 
1475 	pr_debug("Send TYPE, nlmsg_len: %u\n", nlh2->nlmsg_len);
1476 	ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1477 	if (ret < 0)
1478 		return ret;
1479 
1480 	return 0;
1481 
1482 nla_put_failure:
1483 	nlmsg_cancel(skb2, nlh2);
1484 nlmsg_failure:
1485 	kfree_skb(skb2);
1486 	return -EMSGSIZE;
1487 }
1488 
1489 /* Get protocol version */
1490 
1491 static const struct nla_policy
1492 ip_set_protocol_policy[IPSET_ATTR_CMD_MAX + 1] = {
1493 	[IPSET_ATTR_PROTOCOL]	= { .type = NLA_U8 },
1494 };
1495 
1496 static int
ip_set_protocol(struct sock * ctnl,struct sk_buff * skb,const struct nlmsghdr * nlh,const struct nlattr * const attr[])1497 ip_set_protocol(struct sock *ctnl, struct sk_buff *skb,
1498 		const struct nlmsghdr *nlh,
1499 		const struct nlattr * const attr[])
1500 {
1501 	struct sk_buff *skb2;
1502 	struct nlmsghdr *nlh2;
1503 	int ret = 0;
1504 
1505 	if (unlikely(attr[IPSET_ATTR_PROTOCOL] == NULL))
1506 		return -IPSET_ERR_PROTOCOL;
1507 
1508 	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1509 	if (skb2 == NULL)
1510 		return -ENOMEM;
1511 
1512 	nlh2 = start_msg(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq, 0,
1513 			 IPSET_CMD_PROTOCOL);
1514 	if (!nlh2)
1515 		goto nlmsg_failure;
1516 	NLA_PUT_U8(skb2, IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL);
1517 	nlmsg_end(skb2, nlh2);
1518 
1519 	ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1520 	if (ret < 0)
1521 		return ret;
1522 
1523 	return 0;
1524 
1525 nla_put_failure:
1526 	nlmsg_cancel(skb2, nlh2);
1527 nlmsg_failure:
1528 	kfree_skb(skb2);
1529 	return -EMSGSIZE;
1530 }
1531 
1532 static const struct nfnl_callback ip_set_netlink_subsys_cb[IPSET_MSG_MAX] = {
1533 	[IPSET_CMD_CREATE]	= {
1534 		.call		= ip_set_create,
1535 		.attr_count	= IPSET_ATTR_CMD_MAX,
1536 		.policy		= ip_set_create_policy,
1537 	},
1538 	[IPSET_CMD_DESTROY]	= {
1539 		.call		= ip_set_destroy,
1540 		.attr_count	= IPSET_ATTR_CMD_MAX,
1541 		.policy		= ip_set_setname_policy,
1542 	},
1543 	[IPSET_CMD_FLUSH]	= {
1544 		.call		= ip_set_flush,
1545 		.attr_count	= IPSET_ATTR_CMD_MAX,
1546 		.policy		= ip_set_setname_policy,
1547 	},
1548 	[IPSET_CMD_RENAME]	= {
1549 		.call		= ip_set_rename,
1550 		.attr_count	= IPSET_ATTR_CMD_MAX,
1551 		.policy		= ip_set_setname2_policy,
1552 	},
1553 	[IPSET_CMD_SWAP]	= {
1554 		.call		= ip_set_swap,
1555 		.attr_count	= IPSET_ATTR_CMD_MAX,
1556 		.policy		= ip_set_setname2_policy,
1557 	},
1558 	[IPSET_CMD_LIST]	= {
1559 		.call		= ip_set_dump,
1560 		.attr_count	= IPSET_ATTR_CMD_MAX,
1561 		.policy		= ip_set_setname_policy,
1562 	},
1563 	[IPSET_CMD_SAVE]	= {
1564 		.call		= ip_set_dump,
1565 		.attr_count	= IPSET_ATTR_CMD_MAX,
1566 		.policy		= ip_set_setname_policy,
1567 	},
1568 	[IPSET_CMD_ADD]	= {
1569 		.call		= ip_set_uadd,
1570 		.attr_count	= IPSET_ATTR_CMD_MAX,
1571 		.policy		= ip_set_adt_policy,
1572 	},
1573 	[IPSET_CMD_DEL]	= {
1574 		.call		= ip_set_udel,
1575 		.attr_count	= IPSET_ATTR_CMD_MAX,
1576 		.policy		= ip_set_adt_policy,
1577 	},
1578 	[IPSET_CMD_TEST]	= {
1579 		.call		= ip_set_utest,
1580 		.attr_count	= IPSET_ATTR_CMD_MAX,
1581 		.policy		= ip_set_adt_policy,
1582 	},
1583 	[IPSET_CMD_HEADER]	= {
1584 		.call		= ip_set_header,
1585 		.attr_count	= IPSET_ATTR_CMD_MAX,
1586 		.policy		= ip_set_setname_policy,
1587 	},
1588 	[IPSET_CMD_TYPE]	= {
1589 		.call		= ip_set_type,
1590 		.attr_count	= IPSET_ATTR_CMD_MAX,
1591 		.policy		= ip_set_type_policy,
1592 	},
1593 	[IPSET_CMD_PROTOCOL]	= {
1594 		.call		= ip_set_protocol,
1595 		.attr_count	= IPSET_ATTR_CMD_MAX,
1596 		.policy		= ip_set_protocol_policy,
1597 	},
1598 };
1599 
1600 static struct nfnetlink_subsystem ip_set_netlink_subsys __read_mostly = {
1601 	.name		= "ip_set",
1602 	.subsys_id	= NFNL_SUBSYS_IPSET,
1603 	.cb_count	= IPSET_MSG_MAX,
1604 	.cb		= ip_set_netlink_subsys_cb,
1605 };
1606 
1607 /* Interface to iptables/ip6tables */
1608 
1609 static int
ip_set_sockfn_get(struct sock * sk,int optval,void __user * user,int * len)1610 ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
1611 {
1612 	unsigned *op;
1613 	void *data;
1614 	int copylen = *len, ret = 0;
1615 
1616 	if (!capable(CAP_NET_ADMIN))
1617 		return -EPERM;
1618 	if (optval != SO_IP_SET)
1619 		return -EBADF;
1620 	if (*len < sizeof(unsigned))
1621 		return -EINVAL;
1622 
1623 	data = vmalloc(*len);
1624 	if (!data)
1625 		return -ENOMEM;
1626 	if (copy_from_user(data, user, *len) != 0) {
1627 		ret = -EFAULT;
1628 		goto done;
1629 	}
1630 	op = (unsigned *) data;
1631 
1632 	if (*op < IP_SET_OP_VERSION) {
1633 		/* Check the version at the beginning of operations */
1634 		struct ip_set_req_version *req_version = data;
1635 		if (req_version->version != IPSET_PROTOCOL) {
1636 			ret = -EPROTO;
1637 			goto done;
1638 		}
1639 	}
1640 
1641 	switch (*op) {
1642 	case IP_SET_OP_VERSION: {
1643 		struct ip_set_req_version *req_version = data;
1644 
1645 		if (*len != sizeof(struct ip_set_req_version)) {
1646 			ret = -EINVAL;
1647 			goto done;
1648 		}
1649 
1650 		req_version->version = IPSET_PROTOCOL;
1651 		ret = copy_to_user(user, req_version,
1652 				   sizeof(struct ip_set_req_version));
1653 		goto done;
1654 	}
1655 	case IP_SET_OP_GET_BYNAME: {
1656 		struct ip_set_req_get_set *req_get = data;
1657 
1658 		if (*len != sizeof(struct ip_set_req_get_set)) {
1659 			ret = -EINVAL;
1660 			goto done;
1661 		}
1662 		req_get->set.name[IPSET_MAXNAMELEN - 1] = '\0';
1663 		nfnl_lock();
1664 		req_get->set.index = find_set_id(req_get->set.name);
1665 		nfnl_unlock();
1666 		goto copy;
1667 	}
1668 	case IP_SET_OP_GET_BYINDEX: {
1669 		struct ip_set_req_get_set *req_get = data;
1670 
1671 		if (*len != sizeof(struct ip_set_req_get_set) ||
1672 		    req_get->set.index >= ip_set_max) {
1673 			ret = -EINVAL;
1674 			goto done;
1675 		}
1676 		nfnl_lock();
1677 		strncpy(req_get->set.name,
1678 			ip_set_list[req_get->set.index]
1679 				? ip_set_list[req_get->set.index]->name : "",
1680 			IPSET_MAXNAMELEN);
1681 		nfnl_unlock();
1682 		goto copy;
1683 	}
1684 	default:
1685 		ret = -EBADMSG;
1686 		goto done;
1687 	}	/* end of switch(op) */
1688 
1689 copy:
1690 	ret = copy_to_user(user, data, copylen);
1691 
1692 done:
1693 	vfree(data);
1694 	if (ret > 0)
1695 		ret = 0;
1696 	return ret;
1697 }
1698 
1699 static struct nf_sockopt_ops so_set __read_mostly = {
1700 	.pf		= PF_INET,
1701 	.get_optmin	= SO_IP_SET,
1702 	.get_optmax	= SO_IP_SET + 1,
1703 	.get		= &ip_set_sockfn_get,
1704 	.owner		= THIS_MODULE,
1705 };
1706 
1707 static int __init
ip_set_init(void)1708 ip_set_init(void)
1709 {
1710 	int ret;
1711 
1712 	if (max_sets)
1713 		ip_set_max = max_sets;
1714 	if (ip_set_max >= IPSET_INVALID_ID)
1715 		ip_set_max = IPSET_INVALID_ID - 1;
1716 
1717 	ip_set_list = kzalloc(sizeof(struct ip_set *) * ip_set_max,
1718 			      GFP_KERNEL);
1719 	if (!ip_set_list)
1720 		return -ENOMEM;
1721 
1722 	ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
1723 	if (ret != 0) {
1724 		pr_err("ip_set: cannot register with nfnetlink.\n");
1725 		kfree(ip_set_list);
1726 		return ret;
1727 	}
1728 	ret = nf_register_sockopt(&so_set);
1729 	if (ret != 0) {
1730 		pr_err("SO_SET registry failed: %d\n", ret);
1731 		nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
1732 		kfree(ip_set_list);
1733 		return ret;
1734 	}
1735 
1736 	pr_notice("ip_set: protocol %u\n", IPSET_PROTOCOL);
1737 	return 0;
1738 }
1739 
1740 static void __exit
ip_set_fini(void)1741 ip_set_fini(void)
1742 {
1743 	/* There can't be any existing set */
1744 	nf_unregister_sockopt(&so_set);
1745 	nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
1746 	kfree(ip_set_list);
1747 	pr_debug("these are the famous last words\n");
1748 }
1749 
1750 module_init(ip_set_init);
1751 module_exit(ip_set_fini);
1752