1// SPDX-License-Identifier: GPL-2.0-only
2/* Copyright (C) 2014 Jozsef Kadlecsik <kadlec@netfilter.org> */
3
4/* Kernel module implementing an IP set type: the hash:mac type */
5
6#include <linux/jhash.h>
7#include <linux/module.h>
8#include <linux/etherdevice.h>
9#include <linux/skbuff.h>
10#include <linux/errno.h>
11#include <linux/if_ether.h>
12#include <net/netlink.h>
13
14#include <linux/netfilter.h>
15#include <linux/netfilter/ipset/ip_set.h>
16#include <linux/netfilter/ipset/ip_set_hash.h>
17
18#define IPSET_TYPE_REV_MIN	0
19#define IPSET_TYPE_REV_MAX	1	/* bucketsize, initval support */
20
21MODULE_LICENSE("GPL");
22MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
23IP_SET_MODULE_DESC("hash:mac", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
24MODULE_ALIAS("ip_set_hash:mac");
25
26/* Type specific function prefix */
27#define HTYPE		hash_mac
28
29/* Member elements */
30struct hash_mac4_elem {
31	/* Zero valued IP addresses cannot be stored */
32	union {
33		unsigned char ether[ETH_ALEN];
34		__be32 foo[2];
35	};
36};
37
38/* Common functions */
39
40static bool
41hash_mac4_data_equal(const struct hash_mac4_elem *e1,
42		     const struct hash_mac4_elem *e2,
43		     u32 *multi)
44{
45	return ether_addr_equal(e1->ether, e2->ether);
46}
47
48static bool
49hash_mac4_data_list(struct sk_buff *skb, const struct hash_mac4_elem *e)
50{
51	if (nla_put(skb, IPSET_ATTR_ETHER, ETH_ALEN, e->ether))
52		goto nla_put_failure;
53	return false;
54
55nla_put_failure:
56	return true;
57}
58
59static void
60hash_mac4_data_next(struct hash_mac4_elem *next,
61		    const struct hash_mac4_elem *e)
62{
63}
64
65#define MTYPE		hash_mac4
66#define HOST_MASK	32
67#define IP_SET_EMIT_CREATE
68#define IP_SET_PROTO_UNDEF
69#include "ip_set_hash_gen.h"
70
71static int
72hash_mac4_kadt(struct ip_set *set, const struct sk_buff *skb,
73	       const struct xt_action_param *par,
74	       enum ipset_adt adt, struct ip_set_adt_opt *opt)
75{
76	ipset_adtfn adtfn = set->variant->adt[adt];
77	struct hash_mac4_elem e = { { .foo[0] = 0, .foo[1] = 0 } };
78	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
79
80	if (skb_mac_header(skb) < skb->head ||
81	    (skb_mac_header(skb) + ETH_HLEN) > skb->data)
82		return -EINVAL;
83
84	if (opt->flags & IPSET_DIM_ONE_SRC)
85		ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
86	else
87		ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
88
89	if (is_zero_ether_addr(e.ether))
90		return -EINVAL;
91	return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
92}
93
94static int
95hash_mac4_uadt(struct ip_set *set, struct nlattr *tb[],
96	       enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
97{
98	ipset_adtfn adtfn = set->variant->adt[adt];
99	struct hash_mac4_elem e = { { .foo[0] = 0, .foo[1] = 0 } };
100	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
101	int ret;
102
103	if (tb[IPSET_ATTR_LINENO])
104		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
105
106	if (unlikely(!tb[IPSET_ATTR_ETHER] ||
107		     nla_len(tb[IPSET_ATTR_ETHER]) != ETH_ALEN))
108		return -IPSET_ERR_PROTOCOL;
109
110	ret = ip_set_get_extensions(set, tb, &ext);
111	if (ret)
112		return ret;
113	ether_addr_copy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]));
114	if (is_zero_ether_addr(e.ether))
115		return -IPSET_ERR_HASH_ELEM;
116
117	return adtfn(set, &e, &ext, &ext, flags);
118}
119
120static struct ip_set_type hash_mac_type __read_mostly = {
121	.name		= "hash:mac",
122	.protocol	= IPSET_PROTOCOL,
123	.features	= IPSET_TYPE_MAC,
124	.dimension	= IPSET_DIM_ONE,
125	.family		= NFPROTO_UNSPEC,
126	.revision_min	= IPSET_TYPE_REV_MIN,
127	.revision_max	= IPSET_TYPE_REV_MAX,
128	.create_flags[IPSET_TYPE_REV_MAX] = IPSET_CREATE_FLAG_BUCKETSIZE,
129	.create		= hash_mac_create,
130	.create_policy	= {
131		[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
132		[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
133		[IPSET_ATTR_INITVAL]	= { .type = NLA_U32 },
134		[IPSET_ATTR_BUCKETSIZE]	= { .type = NLA_U8 },
135		[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
136		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
137		[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },
138	},
139	.adt_policy	= {
140		[IPSET_ATTR_ETHER]	= { .type = NLA_BINARY,
141					    .len  = ETH_ALEN },
142		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
143		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
144		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },
145		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },
146		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING,
147					    .len  = IPSET_MAX_COMMENT_SIZE },
148		[IPSET_ATTR_SKBMARK]	= { .type = NLA_U64 },
149		[IPSET_ATTR_SKBPRIO]	= { .type = NLA_U32 },
150		[IPSET_ATTR_SKBQUEUE]	= { .type = NLA_U16 },
151	},
152	.me		= THIS_MODULE,
153};
154
155static int __init
156hash_mac_init(void)
157{
158	return ip_set_type_register(&hash_mac_type);
159}
160
161static void __exit
162hash_mac_fini(void)
163{
164	rcu_barrier();
165	ip_set_type_unregister(&hash_mac_type);
166}
167
168module_init(hash_mac_init);
169module_exit(hash_mac_fini);
170