projects / openwrt / openwrt.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
Update ipset to version 3.2
[openwrt/openwrt.git] / target / linux / generic-2.6 / patches-2.6.30 / 130-netfilter_ipset.patch
1 --- a/include/linux/netfilter_ipv4/Kbuild
2 +++ b/include/linux/netfilter_ipv4/Kbuild
3 @@ -45,3 +45,20 @@ header-y += ipt_ttl.h
4
5 unifdef-y += ip_queue.h
6 unifdef-y += ip_tables.h
7 +
8 +unifdef-y += ip_set.h
9 +header-y += ip_set_iphash.h
10 +unifdef-y += ip_set_bitmaps.h
11 +unifdef-y += ip_set_getport.h
12 +unifdef-y += ip_set_hashes.h
13 +header-y += ip_set_ipmap.h
14 +header-y += ip_set_ipporthash.h
15 +header-y += ip_set_ipportiphash.h
16 +header-y += ip_set_ipportnethash.h
17 +unifdef-y += ip_set_iptree.h
18 +unifdef-y += ip_set_iptreemap.h
19 +header-y += ip_set_jhash.h
20 +header-y += ip_set_macipmap.h
21 +header-y += ip_set_nethash.h
22 +header-y += ip_set_portmap.h
23 +header-y += ip_set_setlist.h
24 --- /dev/null
25 +++ b/include/linux/netfilter_ipv4/ip_set.h
26 @@ -0,0 +1,574 @@
27 +#ifndef _IP_SET_H
28 +#define _IP_SET_H
29 +
30 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
31 + * Patrick Schaaf <bof@bof.de>
32 + * Martin Josefsson <gandalf@wlug.westbo.se>
33 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
34 + *
35 + * This program is free software; you can redistribute it and/or modify
36 + * it under the terms of the GNU General Public License version 2 as
37 + * published by the Free Software Foundation.
38 + */
39 +
40 +#if 0
41 +#define IP_SET_DEBUG
42 +#endif
43 +
44 +/*
45 + * A sockopt of such quality has hardly ever been seen before on the open
46 + * market! This little beauty, hardly ever used: above 64, so it's
47 + * traditionally used for firewalling, not touched (even once!) by the
48 + * 2.0, 2.2 and 2.4 kernels!
49 + *
50 + * Comes with its own certificate of authenticity, valid anywhere in the
51 + * Free world!
52 + *
53 + * Rusty, 19.4.2000
54 + */
55 +#define SO_IP_SET 83
56 +
57 +/*
58 + * Heavily modify by Joakim Axelsson 08.03.2002
59 + * - Made it more modulebased
60 + *
61 + * Additional heavy modifications by Jozsef Kadlecsik 22.02.2004
62 + * - bindings added
63 + * - in order to "deal with" backward compatibility, renamed to ipset
64 + */
65 +
66 +/*
67 + * Used so that the kernel module and ipset-binary can match their versions
68 + */
69 +#define IP_SET_PROTOCOL_VERSION 3
70 +
71 +#define IP_SET_MAXNAMELEN 32 /* set names and set typenames */
72 +
73 +/* Lets work with our own typedef for representing an IP address.
74 + * We hope to make the code more portable, possibly to IPv6...
75 + *
76 + * The representation works in HOST byte order, because most set types
77 + * will perform arithmetic operations and compare operations.
78 + *
79 + * For now the type is an uint32_t.
80 + *
81 + * Make sure to ONLY use the functions when translating and parsing
82 + * in order to keep the host byte order and make it more portable:
83 + * parse_ip()
84 + * parse_mask()
85 + * parse_ipandmask()
86 + * ip_tostring()
87 + * (Joakim: where are they???)
88 + */
89 +
90 +typedef uint32_t ip_set_ip_t;
91 +
92 +/* Sets are identified by an id in kernel space. Tweak with ip_set_id_t
93 + * and IP_SET_INVALID_ID if you want to increase the max number of sets.
94 + */
95 +typedef uint16_t ip_set_id_t;
96 +
97 +#define IP_SET_INVALID_ID 65535
98 +
99 +/* How deep we follow bindings */
100 +#define IP_SET_MAX_BINDINGS 6
101 +
102 +/*
103 + * Option flags for kernel operations (ipt_set_info)
104 + */
105 +#define IPSET_SRC 0x01 /* Source match/add */
106 +#define IPSET_DST 0x02 /* Destination match/add */
107 +#define IPSET_MATCH_INV 0x04 /* Inverse matching */
108 +
109 +/*
110 + * Set features
111 + */
112 +#define IPSET_TYPE_IP 0x01 /* IP address type of set */
113 +#define IPSET_TYPE_PORT 0x02 /* Port type of set */
114 +#define IPSET_DATA_SINGLE 0x04 /* Single data storage */
115 +#define IPSET_DATA_DOUBLE 0x08 /* Double data storage */
116 +#define IPSET_DATA_TRIPLE 0x10 /* Triple data storage */
117 +#define IPSET_TYPE_IP1 0x20 /* IP address type of set */
118 +#define IPSET_TYPE_SETNAME 0x40 /* setname type of set */
119 +
120 +/* Reserved keywords */
121 +#define IPSET_TOKEN_DEFAULT ":default:"
122 +#define IPSET_TOKEN_ALL ":all:"
123 +
124 +/* SO_IP_SET operation constants, and their request struct types.
125 + *
126 + * Operation ids:
127 + * 0-99: commands with version checking
128 + * 100-199: add/del/test/bind/unbind
129 + * 200-299: list, save, restore
130 + */
131 +
132 +/* Single shot operations:
133 + * version, create, destroy, flush, rename and swap
134 + *
135 + * Sets are identified by name.
136 + */
137 +
138 +#define IP_SET_REQ_STD \
139 + unsigned op; \
140 + unsigned version; \
141 + char name[IP_SET_MAXNAMELEN]
142 +
143 +#define IP_SET_OP_CREATE 0x00000001 /* Create a new (empty) set */
144 +struct ip_set_req_create {
145 + IP_SET_REQ_STD;
146 + char typename[IP_SET_MAXNAMELEN];
147 +};
148 +
149 +#define IP_SET_OP_DESTROY 0x00000002 /* Remove a (empty) set */
150 +struct ip_set_req_std {
151 + IP_SET_REQ_STD;
152 +};
153 +
154 +#define IP_SET_OP_FLUSH 0x00000003 /* Remove all IPs in a set */
155 +/* Uses ip_set_req_std */
156 +
157 +#define IP_SET_OP_RENAME 0x00000004 /* Rename a set */
158 +/* Uses ip_set_req_create */
159 +
160 +#define IP_SET_OP_SWAP 0x00000005 /* Swap two sets */
161 +/* Uses ip_set_req_create */
162 +
163 +union ip_set_name_index {
164 + char name[IP_SET_MAXNAMELEN];
165 + ip_set_id_t index;
166 +};
167 +
168 +#define IP_SET_OP_GET_BYNAME 0x00000006 /* Get set index by name */
169 +struct ip_set_req_get_set {
170 + unsigned op;
171 + unsigned version;
172 + union ip_set_name_index set;
173 +};
174 +
175 +#define IP_SET_OP_GET_BYINDEX 0x00000007 /* Get set name by index */
176 +/* Uses ip_set_req_get_set */
177 +
178 +#define IP_SET_OP_VERSION 0x00000100 /* Ask kernel version */
179 +struct ip_set_req_version {
180 + unsigned op;
181 + unsigned version;
182 +};
183 +
184 +/* Double shots operations:
185 + * add, del, test, bind and unbind.
186 + *
187 + * First we query the kernel to get the index and type of the target set,
188 + * then issue the command. Validity of IP is checked in kernel in order
189 + * to minimalize sockopt operations.
190 + */
191 +
192 +/* Get minimal set data for add/del/test/bind/unbind IP */
193 +#define IP_SET_OP_ADT_GET 0x00000010 /* Get set and type */
194 +struct ip_set_req_adt_get {
195 + unsigned op;
196 + unsigned version;
197 + union ip_set_name_index set;
198 + char typename[IP_SET_MAXNAMELEN];
199 +};
200 +
201 +#define IP_SET_REQ_BYINDEX \
202 + unsigned op; \
203 + ip_set_id_t index;
204 +
205 +struct ip_set_req_adt {
206 + IP_SET_REQ_BYINDEX;
207 +};
208 +
209 +#define IP_SET_OP_ADD_IP 0x00000101 /* Add an IP to a set */
210 +/* Uses ip_set_req_adt, with type specific addage */
211 +
212 +#define IP_SET_OP_DEL_IP 0x00000102 /* Remove an IP from a set */
213 +/* Uses ip_set_req_adt, with type specific addage */
214 +
215 +#define IP_SET_OP_TEST_IP 0x00000103 /* Test an IP in a set */
216 +/* Uses ip_set_req_adt, with type specific addage */
217 +
218 +#define IP_SET_OP_BIND_SET 0x00000104 /* Bind an IP to a set */
219 +/* Uses ip_set_req_bind, with type specific addage */
220 +struct ip_set_req_bind {
221 + IP_SET_REQ_BYINDEX;
222 + char binding[IP_SET_MAXNAMELEN];
223 +};
224 +
225 +#define IP_SET_OP_UNBIND_SET 0x00000105 /* Unbind an IP from a set */
226 +/* Uses ip_set_req_bind, with type speficic addage
227 + * index = 0 means unbinding for all sets */
228 +
229 +#define IP_SET_OP_TEST_BIND_SET 0x00000106 /* Test binding an IP to a set */
230 +/* Uses ip_set_req_bind, with type specific addage */
231 +
232 +/* Multiple shots operations: list, save, restore.
233 + *
234 + * - check kernel version and query the max number of sets
235 + * - get the basic information on all sets
236 + * and size required for the next step
237 + * - get actual set data: header, data, bindings
238 + */
239 +
240 +/* Get max_sets and the index of a queried set
241 + */
242 +#define IP_SET_OP_MAX_SETS 0x00000020
243 +struct ip_set_req_max_sets {
244 + unsigned op;
245 + unsigned version;
246 + ip_set_id_t max_sets; /* max_sets */
247 + ip_set_id_t sets; /* real number of sets */
248 + union ip_set_name_index set; /* index of set if name used */
249 +};
250 +
251 +/* Get the id and name of the sets plus size for next step */
252 +#define IP_SET_OP_LIST_SIZE 0x00000201
253 +#define IP_SET_OP_SAVE_SIZE 0x00000202
254 +struct ip_set_req_setnames {
255 + unsigned op;
256 + ip_set_id_t index; /* set to list/save */
257 + u_int32_t size; /* size to get setdata/bindings */
258 + /* followed by sets number of struct ip_set_name_list */
259 +};
260 +
261 +struct ip_set_name_list {
262 + char name[IP_SET_MAXNAMELEN];
263 + char typename[IP_SET_MAXNAMELEN];
264 + ip_set_id_t index;
265 + ip_set_id_t id;
266 +};
267 +
268 +/* The actual list operation */
269 +#define IP_SET_OP_LIST 0x00000203
270 +struct ip_set_req_list {
271 + IP_SET_REQ_BYINDEX;
272 + /* sets number of struct ip_set_list in reply */
273 +};
274 +
275 +struct ip_set_list {
276 + ip_set_id_t index;
277 + ip_set_id_t binding;
278 + u_int32_t ref;
279 + u_int32_t header_size; /* Set header data of header_size */
280 + u_int32_t members_size; /* Set members data of members_size */
281 + u_int32_t bindings_size;/* Set bindings data of bindings_size */
282 +};
283 +
284 +struct ip_set_hash_list {
285 + ip_set_ip_t ip;
286 + ip_set_id_t binding;
287 +};
288 +
289 +/* The save operation */
290 +#define IP_SET_OP_SAVE 0x00000204
291 +/* Uses ip_set_req_list, in the reply replaced by
292 + * sets number of struct ip_set_save plus a marker
293 + * ip_set_save followed by ip_set_hash_save structures.
294 + */
295 +struct ip_set_save {
296 + ip_set_id_t index;
297 + ip_set_id_t binding;
298 + u_int32_t header_size; /* Set header data of header_size */
299 + u_int32_t members_size; /* Set members data of members_size */
300 +};
301 +
302 +/* At restoring, ip == 0 means default binding for the given set: */
303 +struct ip_set_hash_save {
304 + ip_set_ip_t ip;
305 + ip_set_id_t id;
306 + ip_set_id_t binding;
307 +};
308 +
309 +/* The restore operation */
310 +#define IP_SET_OP_RESTORE 0x00000205
311 +/* Uses ip_set_req_setnames followed by ip_set_restore structures
312 + * plus a marker ip_set_restore, followed by ip_set_hash_save
313 + * structures.
314 + */
315 +struct ip_set_restore {
316 + char name[IP_SET_MAXNAMELEN];
317 + char typename[IP_SET_MAXNAMELEN];
318 + ip_set_id_t index;
319 + u_int32_t header_size; /* Create data of header_size */
320 + u_int32_t members_size; /* Set members data of members_size */
321 +};
322 +
323 +static inline int bitmap_bytes(ip_set_ip_t a, ip_set_ip_t b)
324 +{
325 + return 4 * ((((b - a + 8) / 8) + 3) / 4);
326 +}
327 +
328 +/* General limit for the elements in a set */
329 +#define MAX_RANGE 0x0000FFFF
330 +
331 +#ifdef __KERNEL__
332 +#include <linux/netfilter_ipv4/ip_set_compat.h>
333 +#include <linux/netfilter_ipv4/ip_set_malloc.h>
334 +
335 +#define ip_set_printk(format, args...) \
336 + do { \
337 + printk("%s: %s: ", __FILE__, __FUNCTION__); \
338 + printk(format "\n" , ## args); \
339 + } while (0)
340 +
341 +#if defined(IP_SET_DEBUG)
342 +#define DP(format, args...) \
343 + do { \
344 + printk("%s: %s (DBG): ", __FILE__, __FUNCTION__);\
345 + printk(format "\n" , ## args); \
346 + } while (0)
347 +#define IP_SET_ASSERT(x) \
348 + do { \
349 + if (!(x)) \
350 + printk("IP_SET_ASSERT: %s:%i(%s)\n", \
351 + __FILE__, __LINE__, __FUNCTION__); \
352 + } while (0)
353 +#else
354 +#define DP(format, args...)
355 +#define IP_SET_ASSERT(x)
356 +#endif
357 +
358 +struct ip_set;
359 +
360 +/*
361 + * The ip_set_type definition - one per set type, e.g. "ipmap".
362 + *
363 + * Each individual set has a pointer, set->type, going to one
364 + * of these structures. Function pointers inside the structure implement
365 + * the real behaviour of the sets.
366 + *
367 + * If not mentioned differently, the implementation behind the function
368 + * pointers of a set_type, is expected to return 0 if ok, and a negative
369 + * errno (e.g. -EINVAL) on error.
370 + */
371 +struct ip_set_type {
372 + struct list_head list; /* next in list of set types */
373 +
374 + /* test for IP in set (kernel: iptables -m set src|dst)
375 + * return 0 if not in set, 1 if in set.
376 + */
377 + int (*testip_kernel) (struct ip_set *set,
378 + const struct sk_buff * skb,
379 + ip_set_ip_t *ip,
380 + const u_int32_t *flags,
381 + unsigned char index);
382 +
383 + /* test for IP in set (userspace: ipset -T set IP)
384 + * return 0 if not in set, 1 if in set.
385 + */
386 + int (*testip) (struct ip_set *set,
387 + const void *data, u_int32_t size,
388 + ip_set_ip_t *ip);
389 +
390 + /*
391 + * Size of the data structure passed by when
392 + * adding/deletin/testing an entry.
393 + */
394 + u_int32_t reqsize;
395 +
396 + /* Add IP into set (userspace: ipset -A set IP)
397 + * Return -EEXIST if the address is already in the set,
398 + * and -ERANGE if the address lies outside the set bounds.
399 + * If the address was not already in the set, 0 is returned.
400 + */
401 + int (*addip) (struct ip_set *set,
402 + const void *data, u_int32_t size,
403 + ip_set_ip_t *ip);
404 +
405 + /* Add IP into set (kernel: iptables ... -j SET set src|dst)
406 + * Return -EEXIST if the address is already in the set,
407 + * and -ERANGE if the address lies outside the set bounds.
408 + * If the address was not already in the set, 0 is returned.
409 + */
410 + int (*addip_kernel) (struct ip_set *set,
411 + const struct sk_buff * skb,
412 + ip_set_ip_t *ip,
413 + const u_int32_t *flags,
414 + unsigned char index);
415 +
416 + /* remove IP from set (userspace: ipset -D set --entry x)
417 + * Return -EEXIST if the address is NOT in the set,
418 + * and -ERANGE if the address lies outside the set bounds.
419 + * If the address really was in the set, 0 is returned.
420 + */
421 + int (*delip) (struct ip_set *set,
422 + const void *data, u_int32_t size,
423 + ip_set_ip_t *ip);
424 +
425 + /* remove IP from set (kernel: iptables ... -j SET --entry x)
426 + * Return -EEXIST if the address is NOT in the set,
427 + * and -ERANGE if the address lies outside the set bounds.
428 + * If the address really was in the set, 0 is returned.
429 + */
430 + int (*delip_kernel) (struct ip_set *set,
431 + const struct sk_buff * skb,
432 + ip_set_ip_t *ip,
433 + const u_int32_t *flags,
434 + unsigned char index);
435 +
436 + /* new set creation - allocated type specific items
437 + */
438 + int (*create) (struct ip_set *set,
439 + const void *data, u_int32_t size);
440 +
441 + /* retry the operation after successfully tweaking the set
442 + */
443 + int (*retry) (struct ip_set *set);
444 +
445 + /* set destruction - free type specific items
446 + * There is no return value.
447 + * Can be called only when child sets are destroyed.
448 + */
449 + void (*destroy) (struct ip_set *set);
450 +
451 + /* set flushing - reset all bits in the set, or something similar.
452 + * There is no return value.
453 + */
454 + void (*flush) (struct ip_set *set);
455 +
456 + /* Listing: size needed for header
457 + */
458 + u_int32_t header_size;
459 +
460 + /* Listing: Get the header
461 + *
462 + * Fill in the information in "data".
463 + * This function is always run after list_header_size() under a
464 + * writelock on the set. Therefor is the length of "data" always
465 + * correct.
466 + */
467 + void (*list_header) (const struct ip_set *set,
468 + void *data);
469 +
470 + /* Listing: Get the size for the set members
471 + */
472 + int (*list_members_size) (const struct ip_set *set);
473 +
474 + /* Listing: Get the set members
475 + *
476 + * Fill in the information in "data".
477 + * This function is always run after list_member_size() under a
478 + * writelock on the set. Therefor is the length of "data" always
479 + * correct.
480 + */
481 + void (*list_members) (const struct ip_set *set,
482 + void *data);
483 +
484 + char typename[IP_SET_MAXNAMELEN];
485 + unsigned char features;
486 + int protocol_version;
487 +
488 + /* Set this to THIS_MODULE if you are a module, otherwise NULL */
489 + struct module *me;
490 +};
491 +
492 +extern int ip_set_register_set_type(struct ip_set_type *set_type);
493 +extern void ip_set_unregister_set_type(struct ip_set_type *set_type);
494 +
495 +/* A generic ipset */
496 +struct ip_set {
497 + char name[IP_SET_MAXNAMELEN]; /* the name of the set */
498 + rwlock_t lock; /* lock for concurrency control */
499 + ip_set_id_t id; /* set id for swapping */
500 + ip_set_id_t binding; /* default binding for the set */
501 + atomic_t ref; /* in kernel and in hash references */
502 + struct ip_set_type *type; /* the set types */
503 + void *data; /* pooltype specific data */
504 +};
505 +
506 +/* Structure to bind set elements to sets */
507 +struct ip_set_hash {
508 + struct list_head list; /* list of clashing entries in hash */
509 + ip_set_ip_t ip; /* ip from set */
510 + ip_set_id_t id; /* set id */
511 + ip_set_id_t binding; /* set we bind the element to */
512 +};
513 +
514 +/* register and unregister set references */
515 +extern ip_set_id_t ip_set_get_byname(const char name[IP_SET_MAXNAMELEN]);
516 +extern ip_set_id_t ip_set_get_byindex(ip_set_id_t index);
517 +extern void ip_set_put_byindex(ip_set_id_t index);
518 +extern ip_set_id_t ip_set_id(ip_set_id_t index);
519 +extern ip_set_id_t __ip_set_get_byname(const char name[IP_SET_MAXNAMELEN],
520 + struct ip_set **set);
521 +extern void __ip_set_put_byindex(ip_set_id_t index);
522 +
523 +/* API for iptables set match, and SET target */
524 +extern int ip_set_addip_kernel(ip_set_id_t id,
525 + const struct sk_buff *skb,
526 + const u_int32_t *flags);
527 +extern int ip_set_delip_kernel(ip_set_id_t id,
528 + const struct sk_buff *skb,
529 + const u_int32_t *flags);
530 +extern int ip_set_testip_kernel(ip_set_id_t id,
531 + const struct sk_buff *skb,
532 + const u_int32_t *flags);
533 +
534 +/* Macros to generate functions */
535 +
536 +#define STRUCT(pre, type) CONCAT2(pre, type)
537 +#define CONCAT2(pre, type) struct pre##type
538 +
539 +#define FNAME(pre, mid, post) CONCAT3(pre, mid, post)
540 +#define CONCAT3(pre, mid, post) pre##mid##post
541 +
542 +#define UADT0(type, adt, args...) \
543 +static int \
544 +FNAME(type,_u,adt)(struct ip_set *set, const void *data, u_int32_t size,\
545 + ip_set_ip_t *hash_ip) \
546 +{ \
547 + const STRUCT(ip_set_req_,type) *req = data; \
548 + \
549 + return FNAME(type,_,adt)(set, hash_ip , ## args); \
550 +}
551 +
552 +#define UADT(type, adt, args...) \
553 + UADT0(type, adt, req->ip , ## args)
554 +
555 +#define KADT(type, adt, getfn, args...) \
556 +static int \
557 +FNAME(type,_k,adt)(struct ip_set *set, \
558 + const struct sk_buff *skb, \
559 + ip_set_ip_t *hash_ip, \
560 + const u_int32_t *flags, \
561 + unsigned char index) \
562 +{ \
563 + ip_set_ip_t ip = getfn(skb, flags[index]); \
564 + \
565 + KADT_CONDITION \
566 + return FNAME(type,_,adt)(set, hash_ip, ip , ##args); \
567 +}
568 +
569 +#define REGISTER_MODULE(type) \
570 +static int __init ip_set_##type##_init(void) \
571 +{ \
572 + init_max_page_size(); \
573 + return ip_set_register_set_type(&ip_set_##type); \
574 +} \
575 + \
576 +static void __exit ip_set_##type##_fini(void) \
577 +{ \
578 + /* FIXME: possible race with ip_set_create() */ \
579 + ip_set_unregister_set_type(&ip_set_##type); \
580 +} \
581 + \
582 +module_init(ip_set_##type##_init); \
583 +module_exit(ip_set_##type##_fini);
584 +
585 +/* Common functions */
586 +
587 +static inline ip_set_ip_t
588 +ipaddr(const struct sk_buff *skb, u_int32_t flag)
589 +{
590 + return ntohl(flag & IPSET_SRC ? ip_hdr(skb)->saddr : ip_hdr(skb)->daddr);
591 +}
592 +
593 +#define jhash_ip(map, i, ip) jhash_1word(ip, *(map->initval + i))
594 +
595 +#define pack_ip_port(map, ip, port) \
596 + (port + ((ip - ((map)->first_ip)) << 16))
597 +
598 +#endif /* __KERNEL__ */
599 +
600 +#endif /*_IP_SET_H*/
601 --- /dev/null
602 +++ b/include/linux/netfilter_ipv4/ip_set_bitmaps.h
603 @@ -0,0 +1,121 @@
604 +#ifndef __IP_SET_BITMAPS_H
605 +#define __IP_SET_BITMAPS_H
606 +
607 +/* Macros to generate functions */
608 +
609 +#ifdef __KERNEL__
610 +#define BITMAP_CREATE(type) \
611 +static int \
612 +type##_create(struct ip_set *set, const void *data, u_int32_t size) \
613 +{ \
614 + int newbytes; \
615 + const struct ip_set_req_##type##_create *req = data; \
616 + struct ip_set_##type *map; \
617 + \
618 + if (req->from > req->to) { \
619 + DP("bad range"); \
620 + return -ENOEXEC; \
621 + } \
622 + \
623 + map = kmalloc(sizeof(struct ip_set_##type), GFP_KERNEL); \
624 + if (!map) { \
625 + DP("out of memory for %zu bytes", \
626 + sizeof(struct ip_set_##type)); \
627 + return -ENOMEM; \
628 + } \
629 + map->first_ip = req->from; \
630 + map->last_ip = req->to; \
631 + \
632 + newbytes = __##type##_create(req, map); \
633 + if (newbytes < 0) { \
634 + kfree(map); \
635 + return newbytes; \
636 + } \
637 + \
638 + map->size = newbytes; \
639 + map->members = ip_set_malloc(newbytes); \
640 + if (!map->members) { \
641 + DP("out of memory for %i bytes", newbytes); \
642 + kfree(map); \
643 + return -ENOMEM; \
644 + } \
645 + memset(map->members, 0, newbytes); \
646 + \
647 + set->data = map; \
648 + return 0; \
649 +}
650 +
651 +#define BITMAP_DESTROY(type) \
652 +static void \
653 +type##_destroy(struct ip_set *set) \
654 +{ \
655 + struct ip_set_##type *map = set->data; \
656 + \
657 + ip_set_free(map->members, map->size); \
658 + kfree(map); \
659 + \
660 + set->data = NULL; \
661 +}
662 +
663 +#define BITMAP_FLUSH(type) \
664 +static void \
665 +type##_flush(struct ip_set *set) \
666 +{ \
667 + struct ip_set_##type *map = set->data; \
668 + memset(map->members, 0, map->size); \
669 +}
670 +
671 +#define BITMAP_LIST_HEADER(type) \
672 +static void \
673 +type##_list_header(const struct ip_set *set, void *data) \
674 +{ \
675 + const struct ip_set_##type *map = set->data; \
676 + struct ip_set_req_##type##_create *header = data; \
677 + \
678 + header->from = map->first_ip; \
679 + header->to = map->last_ip; \
680 + __##type##_list_header(map, header); \
681 +}
682 +
683 +#define BITMAP_LIST_MEMBERS_SIZE(type) \
684 +static int \
685 +type##_list_members_size(const struct ip_set *set) \
686 +{ \
687 + const struct ip_set_##type *map = set->data; \
688 + \
689 + return map->size; \
690 +}
691 +
692 +#define BITMAP_LIST_MEMBERS(type) \
693 +static void \
694 +type##_list_members(const struct ip_set *set, void *data) \
695 +{ \
696 + const struct ip_set_##type *map = set->data; \
697 + \
698 + memcpy(data, map->members, map->size); \
699 +}
700 +
701 +#define IP_SET_TYPE(type, __features) \
702 +struct ip_set_type ip_set_##type = { \
703 + .typename = #type, \
704 + .features = __features, \
705 + .protocol_version = IP_SET_PROTOCOL_VERSION, \
706 + .create = &type##_create, \
707 + .destroy = &type##_destroy, \
708 + .flush = &type##_flush, \
709 + .reqsize = sizeof(struct ip_set_req_##type), \
710 + .addip = &type##_uadd, \
711 + .addip_kernel = &type##_kadd, \
712 + .delip = &type##_udel, \
713 + .delip_kernel = &type##_kdel, \
714 + .testip = &type##_utest, \
715 + .testip_kernel = &type##_ktest, \
716 + .header_size = sizeof(struct ip_set_req_##type##_create),\
717 + .list_header = &type##_list_header, \
718 + .list_members_size = &type##_list_members_size, \
719 + .list_members = &type##_list_members, \
720 + .me = THIS_MODULE, \
721 +};
722 +#endif /* __KERNEL */
723 +
724 +#endif /* __IP_SET_BITMAPS_H */
725 --- /dev/null
726 +++ b/include/linux/netfilter_ipv4/ip_set_compat.h
727 @@ -0,0 +1,71 @@
728 +#ifndef _IP_SET_COMPAT_H
729 +#define _IP_SET_COMPAT_H
730 +
731 +#ifdef __KERNEL__
732 +#include <linux/version.h>
733 +
734 +/* Arrgh */
735 +#ifdef MODULE
736 +#define __MOD_INC(foo) __MOD_INC_USE_COUNT(foo)
737 +#define __MOD_DEC(foo) __MOD_DEC_USE_COUNT(foo)
738 +#else
739 +#define __MOD_INC(foo) 1
740 +#define __MOD_DEC(foo)
741 +#endif
742 +
743 +/* Backward compatibility */
744 +#ifndef __nocast
745 +#define __nocast
746 +#endif
747 +#ifndef __bitwise__
748 +#define __bitwise__
749 +#endif
750 +
751 +/* Compatibility glue code */
752 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
753 +#include <linux/interrupt.h>
754 +#define DEFINE_RWLOCK(x) rwlock_t x = RW_LOCK_UNLOCKED
755 +#define try_module_get(x) __MOD_INC(x)
756 +#define module_put(x) __MOD_DEC(x)
757 +#define __clear_bit(nr, addr) clear_bit(nr, addr)
758 +#define __set_bit(nr, addr) set_bit(nr, addr)
759 +#define __test_and_set_bit(nr, addr) test_and_set_bit(nr, addr)
760 +#define __test_and_clear_bit(nr, addr) test_and_clear_bit(nr, addr)
761 +
762 +typedef unsigned __bitwise__ gfp_t;
763 +
764 +static inline void *kzalloc(size_t size, gfp_t flags)
765 +{
766 + void *data = kmalloc(size, flags);
767 +
768 + if (data)
769 + memset(data, 0, size);
770 +
771 + return data;
772 +}
773 +#endif
774 +
775 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
776 +#define __KMEM_CACHE_T__ kmem_cache_t
777 +#else
778 +#define __KMEM_CACHE_T__ struct kmem_cache
779 +#endif
780 +
781 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)
782 +#define ip_hdr(skb) ((skb)->nh.iph)
783 +#define skb_mac_header(skb) ((skb)->mac.raw)
784 +#define eth_hdr(skb) ((struct ethhdr *)skb_mac_header(skb))
785 +#endif
786 +
787 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,23)
788 +#include <linux/netfilter.h>
789 +#define KMEM_CACHE_CREATE(name, size) \
790 + kmem_cache_create(name, size, 0, 0, NULL, NULL)
791 +#else
792 +#define KMEM_CACHE_CREATE(name, size) \
793 + kmem_cache_create(name, size, 0, 0, NULL)
794 +#endif
795 +
796 +
797 +#endif /* __KERNEL__ */
798 +#endif /* _IP_SET_COMPAT_H */
799 --- /dev/null
800 +++ b/include/linux/netfilter_ipv4/ip_set_getport.h
801 @@ -0,0 +1,48 @@
802 +#ifndef _IP_SET_GETPORT_H
803 +#define _IP_SET_GETPORT_H
804 +
805 +#ifdef __KERNEL__
806 +
807 +#define INVALID_PORT (MAX_RANGE + 1)
808 +
809 +/* We must handle non-linear skbs */
810 +static inline ip_set_ip_t
811 +get_port(const struct sk_buff *skb, u_int32_t flags)
812 +{
813 + struct iphdr *iph = ip_hdr(skb);
814 + u_int16_t offset = ntohs(iph->frag_off) & IP_OFFSET;
815 + switch (iph->protocol) {
816 + case IPPROTO_TCP: {
817 + struct tcphdr tcph;
818 +
819 + /* See comments at tcp_match in ip_tables.c */
820 + if (offset)
821 + return INVALID_PORT;
822 +
823 + if (skb_copy_bits(skb, ip_hdr(skb)->ihl*4, &tcph, sizeof(tcph)) < 0)
824 + /* No choice either */
825 + return INVALID_PORT;
826 +
827 + return ntohs(flags & IPSET_SRC ?
828 + tcph.source : tcph.dest);
829 + }
830 + case IPPROTO_UDP: {
831 + struct udphdr udph;
832 +
833 + if (offset)
834 + return INVALID_PORT;
835 +
836 + if (skb_copy_bits(skb, ip_hdr(skb)->ihl*4, &udph, sizeof(udph)) < 0)
837 + /* No choice either */
838 + return INVALID_PORT;
839 +
840 + return ntohs(flags & IPSET_SRC ?
841 + udph.source : udph.dest);
842 + }
843 + default:
844 + return INVALID_PORT;
845 + }
846 +}
847 +#endif /* __KERNEL__ */
848 +
849 +#endif /*_IP_SET_GETPORT_H*/
850 --- /dev/null
851 +++ b/include/linux/netfilter_ipv4/ip_set_hashes.h
852 @@ -0,0 +1,306 @@
853 +#ifndef __IP_SET_HASHES_H
854 +#define __IP_SET_HASHES_H
855 +
856 +#define initval_t uint32_t
857 +
858 +/* Macros to generate functions */
859 +
860 +#ifdef __KERNEL__
861 +#define HASH_RETRY0(type, dtype, cond) \
862 +static int \
863 +type##_retry(struct ip_set *set) \
864 +{ \
865 + struct ip_set_##type *map = set->data, *tmp; \
866 + dtype *elem; \
867 + void *members; \
868 + u_int32_t i, hashsize = map->hashsize; \
869 + int res; \
870 + \
871 + if (map->resize == 0) \
872 + return -ERANGE; \
873 + \
874 + again: \
875 + res = 0; \
876 + \
877 + /* Calculate new hash size */ \
878 + hashsize += (hashsize * map->resize)/100; \
879 + if (hashsize == map->hashsize) \
880 + hashsize++; \
881 + \
882 + ip_set_printk("rehashing of set %s triggered: " \
883 + "hashsize grows from %lu to %lu", \
884 + set->name, \
885 + (long unsigned)map->hashsize, \
886 + (long unsigned)hashsize); \
887 + \
888 + tmp = kmalloc(sizeof(struct ip_set_##type) \
889 + + map->probes * sizeof(initval_t), GFP_ATOMIC); \
890 + if (!tmp) { \
891 + DP("out of memory for %zu bytes", \
892 + sizeof(struct ip_set_##type) \
893 + + map->probes * sizeof(initval_t)); \
894 + return -ENOMEM; \
895 + } \
896 + tmp->members = harray_malloc(hashsize, sizeof(dtype), GFP_ATOMIC);\
897 + if (!tmp->members) { \
898 + DP("out of memory for %zu bytes", hashsize * sizeof(dtype));\
899 + kfree(tmp); \
900 + return -ENOMEM; \
901 + } \
902 + tmp->hashsize = hashsize; \
903 + tmp->elements = 0; \
904 + tmp->probes = map->probes; \
905 + tmp->resize = map->resize; \
906 + memcpy(tmp->initval, map->initval, map->probes * sizeof(initval_t));\
907 + __##type##_retry(tmp, map); \
908 + \
909 + write_lock_bh(&set->lock); \
910 + map = set->data; /* Play safe */ \
911 + for (i = 0; i < map->hashsize && res == 0; i++) { \
912 + elem = HARRAY_ELEM(map->members, dtype *, i); \
913 + if (cond) \
914 + res = __##type##_add(tmp, elem); \
915 + } \
916 + if (res) { \
917 + /* Failure, try again */ \
918 + write_unlock_bh(&set->lock); \
919 + harray_free(tmp->members); \
920 + kfree(tmp); \
921 + goto again; \
922 + } \
923 + \
924 + /* Success at resizing! */ \
925 + members = map->members; \
926 + \
927 + map->hashsize = tmp->hashsize; \
928 + map->members = tmp->members; \
929 + write_unlock_bh(&set->lock); \
930 + \
931 + harray_free(members); \
932 + kfree(tmp); \
933 + \
934 + return 0; \
935 +}
936 +
937 +#define HASH_RETRY(type, dtype) \
938 + HASH_RETRY0(type, dtype, *elem)
939 +
940 +#define HASH_RETRY2(type, dtype) \
941 + HASH_RETRY0(type, dtype, elem->ip || elem->ip1)
942 +
943 +#define HASH_CREATE(type, dtype) \
944 +static int \
945 +type##_create(struct ip_set *set, const void *data, u_int32_t size) \
946 +{ \
947 + const struct ip_set_req_##type##_create *req = data; \
948 + struct ip_set_##type *map; \
949 + uint16_t i; \
950 + \
951 + if (req->hashsize < 1) { \
952 + ip_set_printk("hashsize too small"); \
953 + return -ENOEXEC; \
954 + } \
955 + \
956 + if (req->probes < 1) { \
957 + ip_set_printk("probes too small"); \
958 + return -ENOEXEC; \
959 + } \
960 + \
961 + map = kmalloc(sizeof(struct ip_set_##type) \
962 + + req->probes * sizeof(initval_t), GFP_KERNEL); \
963 + if (!map) { \
964 + DP("out of memory for %zu bytes", \
965 + sizeof(struct ip_set_##type) \
966 + + req->probes * sizeof(initval_t)); \
967 + return -ENOMEM; \
968 + } \
969 + for (i = 0; i < req->probes; i++) \
970 + get_random_bytes(((initval_t *) map->initval)+i, 4); \
971 + map->elements = 0; \
972 + map->hashsize = req->hashsize; \
973 + map->probes = req->probes; \
974 + map->resize = req->resize; \
975 + if (__##type##_create(req, map)) { \
976 + kfree(map); \
977 + return -ENOEXEC; \
978 + } \
979 + map->members = harray_malloc(map->hashsize, sizeof(dtype), GFP_KERNEL);\
980 + if (!map->members) { \
981 + DP("out of memory for %zu bytes", map->hashsize * sizeof(dtype));\
982 + kfree(map); \
983 + return -ENOMEM; \
984 + } \
985 + \
986 + set->data = map; \
987 + return 0; \
988 +}
989 +
990 +#define HASH_DESTROY(type) \
991 +static void \
992 +type##_destroy(struct ip_set *set) \
993 +{ \
994 + struct ip_set_##type *map = set->data; \
995 + \
996 + harray_free(map->members); \
997 + kfree(map); \
998 + \
999 + set->data = NULL; \
1000 +}
1001 +
1002 +#define HASH_FLUSH(type, dtype) \
1003 +static void \
1004 +type##_flush(struct ip_set *set) \
1005 +{ \
1006 + struct ip_set_##type *map = set->data; \
1007 + harray_flush(map->members, map->hashsize, sizeof(dtype)); \
1008 + map->elements = 0; \
1009 +}
1010 +
1011 +#define HASH_FLUSH_CIDR(type, dtype) \
1012 +static void \
1013 +type##_flush(struct ip_set *set) \
1014 +{ \
1015 + struct ip_set_##type *map = set->data; \
1016 + harray_flush(map->members, map->hashsize, sizeof(dtype)); \
1017 + memset(map->cidr, 0, sizeof(map->cidr)); \
1018 + memset(map->nets, 0, sizeof(map->nets)); \
1019 + map->elements = 0; \
1020 +}
1021 +
1022 +#define HASH_LIST_HEADER(type) \
1023 +static void \
1024 +type##_list_header(const struct ip_set *set, void *data) \
1025 +{ \
1026 + const struct ip_set_##type *map = set->data; \
1027 + struct ip_set_req_##type##_create *header = data; \
1028 + \
1029 + header->hashsize = map->hashsize; \
1030 + header->probes = map->probes; \
1031 + header->resize = map->resize; \
1032 + __##type##_list_header(map, header); \
1033 +}
1034 +
1035 +#define HASH_LIST_MEMBERS_SIZE(type, dtype) \
1036 +static int \
1037 +type##_list_members_size(const struct ip_set *set) \
1038 +{ \
1039 + const struct ip_set_##type *map = set->data; \
1040 + \
1041 + return (map->hashsize * sizeof(dtype)); \
1042 +}
1043 +
1044 +#define HASH_LIST_MEMBERS(type, dtype) \
1045 +static void \
1046 +type##_list_members(const struct ip_set *set, void *data) \
1047 +{ \
1048 + const struct ip_set_##type *map = set->data; \
1049 + dtype *elem; \
1050 + uint32_t i; \
1051 + \
1052 + for (i = 0; i < map->hashsize; i++) { \
1053 + elem = HARRAY_ELEM(map->members, dtype *, i); \
1054 + ((dtype *)data)[i] = *elem; \
1055 + } \
1056 +}
1057 +
1058 +#define HASH_LIST_MEMBERS_MEMCPY(type, dtype) \
1059 +static void \
1060 +type##_list_members(const struct ip_set *set, void *data) \
1061 +{ \
1062 + const struct ip_set_##type *map = set->data; \
1063 + dtype *elem; \
1064 + uint32_t i; \
1065 + \
1066 + for (i = 0; i < map->hashsize; i++) { \
1067 + elem = HARRAY_ELEM(map->members, dtype *, i); \
1068 + memcpy((((dtype *)data)+i), elem, sizeof(dtype)); \
1069 + } \
1070 +}
1071 +
1072 +#define IP_SET_RTYPE(type, __features) \
1073 +struct ip_set_type ip_set_##type = { \
1074 + .typename = #type, \
1075 + .features = __features, \
1076 + .protocol_version = IP_SET_PROTOCOL_VERSION, \
1077 + .create = &type##_create, \
1078 + .retry = &type##_retry, \
1079 + .destroy = &type##_destroy, \
1080 + .flush = &type##_flush, \
1081 + .reqsize = sizeof(struct ip_set_req_##type), \
1082 + .addip = &type##_uadd, \
1083 + .addip_kernel = &type##_kadd, \
1084 + .delip = &type##_udel, \
1085 + .delip_kernel = &type##_kdel, \
1086 + .testip = &type##_utest, \
1087 + .testip_kernel = &type##_ktest, \
1088 + .header_size = sizeof(struct ip_set_req_##type##_create),\
1089 + .list_header = &type##_list_header, \
1090 + .list_members_size = &type##_list_members_size, \
1091 + .list_members = &type##_list_members, \
1092 + .me = THIS_MODULE, \
1093 +};
1094 +
1095 +/* Helper functions */
1096 +static inline void
1097 +add_cidr_size(uint8_t *cidr, uint8_t size)
1098 +{
1099 + uint8_t next;
1100 + int i;
1101 +
1102 + for (i = 0; i < 30 && cidr[i]; i++) {
1103 + if (cidr[i] < size) {
1104 + next = cidr[i];
1105 + cidr[i] = size;
1106 + size = next;
1107 + }
1108 + }
1109 + if (i < 30)
1110 + cidr[i] = size;
1111 +}
1112 +
1113 +static inline void
1114 +del_cidr_size(uint8_t *cidr, uint8_t size)
1115 +{
1116 + int i;
1117 +
1118 + for (i = 0; i < 29 && cidr[i]; i++) {
1119 + if (cidr[i] == size)
1120 + cidr[i] = size = cidr[i+1];
1121 + }
1122 + cidr[29] = 0;
1123 +}
1124 +#else
1125 +#include <arpa/inet.h>
1126 +#endif /* __KERNEL */
1127 +
1128 +#ifndef UINT16_MAX
1129 +#define UINT16_MAX 65535
1130 +#endif
1131 +
1132 +static unsigned char shifts[] = {255, 253, 249, 241, 225, 193, 129, 1};
1133 +
1134 +static inline ip_set_ip_t
1135 +pack_ip_cidr(ip_set_ip_t ip, unsigned char cidr)
1136 +{
1137 + ip_set_ip_t addr, *paddr = &addr;
1138 + unsigned char n, t, *a;
1139 +
1140 + addr = htonl(ip & (0xFFFFFFFF << (32 - (cidr))));
1141 +#ifdef __KERNEL__
1142 + DP("ip:%u.%u.%u.%u/%u", NIPQUAD(addr), cidr);
1143 +#endif
1144 + n = cidr / 8;
1145 + t = cidr % 8;
1146 + a = &((unsigned char *)paddr)[n];
1147 + *a = *a /(1 << (8 - t)) + shifts[t];
1148 +#ifdef __KERNEL__
1149 + DP("n: %u, t: %u, a: %u", n, t, *a);
1150 + DP("ip:%u.%u.%u.%u/%u, %u.%u.%u.%u",
1151 + HIPQUAD(ip), cidr, NIPQUAD(addr));
1152 +#endif
1153 +
1154 + return ntohl(addr);
1155 +}
1156 +
1157 +
1158 +#endif /* __IP_SET_HASHES_H */
1159 --- /dev/null
1160 +++ b/include/linux/netfilter_ipv4/ip_set_iphash.h
1161 @@ -0,0 +1,30 @@
1162 +#ifndef __IP_SET_IPHASH_H
1163 +#define __IP_SET_IPHASH_H
1164 +
1165 +#include <linux/netfilter_ipv4/ip_set.h>
1166 +#include <linux/netfilter_ipv4/ip_set_hashes.h>
1167 +
1168 +#define SETTYPE_NAME "iphash"
1169 +
1170 +struct ip_set_iphash {
1171 + ip_set_ip_t *members; /* the iphash proper */
1172 + uint32_t elements; /* number of elements */
1173 + uint32_t hashsize; /* hash size */
1174 + uint16_t probes; /* max number of probes */
1175 + uint16_t resize; /* resize factor in percent */
1176 + ip_set_ip_t netmask; /* netmask */
1177 + initval_t initval[0]; /* initvals for jhash_1word */
1178 +};
1179 +
1180 +struct ip_set_req_iphash_create {
1181 + uint32_t hashsize;
1182 + uint16_t probes;
1183 + uint16_t resize;
1184 + ip_set_ip_t netmask;
1185 +};
1186 +
1187 +struct ip_set_req_iphash {
1188 + ip_set_ip_t ip;
1189 +};
1190 +
1191 +#endif /* __IP_SET_IPHASH_H */
1192 --- /dev/null
1193 +++ b/include/linux/netfilter_ipv4/ip_set_ipmap.h
1194 @@ -0,0 +1,57 @@
1195 +#ifndef __IP_SET_IPMAP_H
1196 +#define __IP_SET_IPMAP_H
1197 +
1198 +#include <linux/netfilter_ipv4/ip_set.h>
1199 +#include <linux/netfilter_ipv4/ip_set_bitmaps.h>
1200 +
1201 +#define SETTYPE_NAME "ipmap"
1202 +
1203 +struct ip_set_ipmap {
1204 + void *members; /* the ipmap proper */
1205 + ip_set_ip_t first_ip; /* host byte order, included in range */
1206 + ip_set_ip_t last_ip; /* host byte order, included in range */
1207 + ip_set_ip_t netmask; /* subnet netmask */
1208 + ip_set_ip_t sizeid; /* size of set in IPs */
1209 + ip_set_ip_t hosts; /* number of hosts in a subnet */
1210 + u_int32_t size; /* size of the ipmap proper */
1211 +};
1212 +
1213 +struct ip_set_req_ipmap_create {
1214 + ip_set_ip_t from;
1215 + ip_set_ip_t to;
1216 + ip_set_ip_t netmask;
1217 +};
1218 +
1219 +struct ip_set_req_ipmap {
1220 + ip_set_ip_t ip;
1221 +};
1222 +
1223 +static inline unsigned int
1224 +mask_to_bits(ip_set_ip_t mask)
1225 +{
1226 + unsigned int bits = 32;
1227 + ip_set_ip_t maskaddr;
1228 +
1229 + if (mask == 0xFFFFFFFF)
1230 + return bits;
1231 +
1232 + maskaddr = 0xFFFFFFFE;
1233 + while (--bits > 0 && maskaddr != mask)
1234 + maskaddr <<= 1;
1235 +
1236 + return bits;
1237 +}
1238 +
1239 +static inline ip_set_ip_t
1240 +range_to_mask(ip_set_ip_t from, ip_set_ip_t to, unsigned int *bits)
1241 +{
1242 + ip_set_ip_t mask = 0xFFFFFFFE;
1243 +
1244 + *bits = 32;
1245 + while (--(*bits) > 0 && mask && (to & mask) != from)
1246 + mask <<= 1;
1247 +
1248 + return mask;
1249 +}
1250 +
1251 +#endif /* __IP_SET_IPMAP_H */
1252 --- /dev/null
1253 +++ b/include/linux/netfilter_ipv4/ip_set_ipporthash.h
1254 @@ -0,0 +1,33 @@
1255 +#ifndef __IP_SET_IPPORTHASH_H
1256 +#define __IP_SET_IPPORTHASH_H
1257 +
1258 +#include <linux/netfilter_ipv4/ip_set.h>
1259 +#include <linux/netfilter_ipv4/ip_set_hashes.h>
1260 +
1261 +#define SETTYPE_NAME "ipporthash"
1262 +
1263 +struct ip_set_ipporthash {
1264 + ip_set_ip_t *members; /* the ipporthash proper */
1265 + uint32_t elements; /* number of elements */
1266 + uint32_t hashsize; /* hash size */
1267 + uint16_t probes; /* max number of probes */
1268 + uint16_t resize; /* resize factor in percent */
1269 + ip_set_ip_t first_ip; /* host byte order, included in range */
1270 + ip_set_ip_t last_ip; /* host byte order, included in range */
1271 + initval_t initval[0]; /* initvals for jhash_1word */
1272 +};
1273 +
1274 +struct ip_set_req_ipporthash_create {
1275 + uint32_t hashsize;
1276 + uint16_t probes;
1277 + uint16_t resize;
1278 + ip_set_ip_t from;
1279 + ip_set_ip_t to;
1280 +};
1281 +
1282 +struct ip_set_req_ipporthash {
1283 + ip_set_ip_t ip;
1284 + ip_set_ip_t port;
1285 +};
1286 +
1287 +#endif /* __IP_SET_IPPORTHASH_H */
1288 --- /dev/null
1289 +++ b/include/linux/netfilter_ipv4/ip_set_ipportiphash.h
1290 @@ -0,0 +1,39 @@
1291 +#ifndef __IP_SET_IPPORTIPHASH_H
1292 +#define __IP_SET_IPPORTIPHASH_H
1293 +
1294 +#include <linux/netfilter_ipv4/ip_set.h>
1295 +#include <linux/netfilter_ipv4/ip_set_hashes.h>
1296 +
1297 +#define SETTYPE_NAME "ipportiphash"
1298 +
1299 +struct ipportip {
1300 + ip_set_ip_t ip;
1301 + ip_set_ip_t ip1;
1302 +};
1303 +
1304 +struct ip_set_ipportiphash {
1305 + struct ipportip *members; /* the ipportip proper */
1306 + uint32_t elements; /* number of elements */
1307 + uint32_t hashsize; /* hash size */
1308 + uint16_t probes; /* max number of probes */
1309 + uint16_t resize; /* resize factor in percent */
1310 + ip_set_ip_t first_ip; /* host byte order, included in range */
1311 + ip_set_ip_t last_ip; /* host byte order, included in range */
1312 + initval_t initval[0]; /* initvals for jhash_1word */
1313 +};
1314 +
1315 +struct ip_set_req_ipportiphash_create {
1316 + uint32_t hashsize;
1317 + uint16_t probes;
1318 + uint16_t resize;
1319 + ip_set_ip_t from;
1320 + ip_set_ip_t to;
1321 +};
1322 +
1323 +struct ip_set_req_ipportiphash {
1324 + ip_set_ip_t ip;
1325 + ip_set_ip_t port;
1326 + ip_set_ip_t ip1;
1327 +};
1328 +
1329 +#endif /* __IP_SET_IPPORTIPHASH_H */
1330 --- /dev/null
1331 +++ b/include/linux/netfilter_ipv4/ip_set_ipportnethash.h
1332 @@ -0,0 +1,42 @@
1333 +#ifndef __IP_SET_IPPORTNETHASH_H
1334 +#define __IP_SET_IPPORTNETHASH_H
1335 +
1336 +#include <linux/netfilter_ipv4/ip_set.h>
1337 +#include <linux/netfilter_ipv4/ip_set_hashes.h>
1338 +
1339 +#define SETTYPE_NAME "ipportnethash"
1340 +
1341 +struct ipportip {
1342 + ip_set_ip_t ip;
1343 + ip_set_ip_t ip1;
1344 +};
1345 +
1346 +struct ip_set_ipportnethash {
1347 + struct ipportip *members; /* the ipportip proper */
1348 + uint32_t elements; /* number of elements */
1349 + uint32_t hashsize; /* hash size */
1350 + uint16_t probes; /* max number of probes */
1351 + uint16_t resize; /* resize factor in percent */
1352 + ip_set_ip_t first_ip; /* host byte order, included in range */
1353 + ip_set_ip_t last_ip; /* host byte order, included in range */
1354 + uint8_t cidr[30]; /* CIDR sizes */
1355 + uint16_t nets[30]; /* nr of nets by CIDR sizes */
1356 + initval_t initval[0]; /* initvals for jhash_1word */
1357 +};
1358 +
1359 +struct ip_set_req_ipportnethash_create {
1360 + uint32_t hashsize;
1361 + uint16_t probes;
1362 + uint16_t resize;
1363 + ip_set_ip_t from;
1364 + ip_set_ip_t to;
1365 +};
1366 +
1367 +struct ip_set_req_ipportnethash {
1368 + ip_set_ip_t ip;
1369 + ip_set_ip_t port;
1370 + ip_set_ip_t ip1;
1371 + uint8_t cidr;
1372 +};
1373 +
1374 +#endif /* __IP_SET_IPPORTNETHASH_H */
1375 --- /dev/null
1376 +++ b/include/linux/netfilter_ipv4/ip_set_iptree.h
1377 @@ -0,0 +1,39 @@
1378 +#ifndef __IP_SET_IPTREE_H
1379 +#define __IP_SET_IPTREE_H
1380 +
1381 +#include <linux/netfilter_ipv4/ip_set.h>
1382 +
1383 +#define SETTYPE_NAME "iptree"
1384 +
1385 +struct ip_set_iptreed {
1386 + unsigned long expires[256]; /* x.x.x.ADDR */
1387 +};
1388 +
1389 +struct ip_set_iptreec {
1390 + struct ip_set_iptreed *tree[256]; /* x.x.ADDR.* */
1391 +};
1392 +
1393 +struct ip_set_iptreeb {
1394 + struct ip_set_iptreec *tree[256]; /* x.ADDR.*.* */
1395 +};
1396 +
1397 +struct ip_set_iptree {
1398 + unsigned int timeout;
1399 + unsigned int gc_interval;
1400 +#ifdef __KERNEL__
1401 + uint32_t elements; /* number of elements */
1402 + struct timer_list gc;
1403 + struct ip_set_iptreeb *tree[256]; /* ADDR.*.*.* */
1404 +#endif
1405 +};
1406 +
1407 +struct ip_set_req_iptree_create {
1408 + unsigned int timeout;
1409 +};
1410 +
1411 +struct ip_set_req_iptree {
1412 + ip_set_ip_t ip;
1413 + unsigned int timeout;
1414 +};
1415 +
1416 +#endif /* __IP_SET_IPTREE_H */
1417 --- /dev/null
1418 +++ b/include/linux/netfilter_ipv4/ip_set_iptreemap.h
1419 @@ -0,0 +1,40 @@
1420 +#ifndef __IP_SET_IPTREEMAP_H
1421 +#define __IP_SET_IPTREEMAP_H
1422 +
1423 +#include <linux/netfilter_ipv4/ip_set.h>
1424 +
1425 +#define SETTYPE_NAME "iptreemap"
1426 +
1427 +#ifdef __KERNEL__
1428 +struct ip_set_iptreemap_d {
1429 + unsigned char bitmap[32]; /* x.x.x.y */
1430 +};
1431 +
1432 +struct ip_set_iptreemap_c {
1433 + struct ip_set_iptreemap_d *tree[256]; /* x.x.y.x */
1434 +};
1435 +
1436 +struct ip_set_iptreemap_b {
1437 + struct ip_set_iptreemap_c *tree[256]; /* x.y.x.x */
1438 + unsigned char dirty[32];
1439 +};
1440 +#endif
1441 +
1442 +struct ip_set_iptreemap {
1443 + unsigned int gc_interval;
1444 +#ifdef __KERNEL__
1445 + struct timer_list gc;
1446 + struct ip_set_iptreemap_b *tree[256]; /* y.x.x.x */
1447 +#endif
1448 +};
1449 +
1450 +struct ip_set_req_iptreemap_create {
1451 + unsigned int gc_interval;
1452 +};
1453 +
1454 +struct ip_set_req_iptreemap {
1455 + ip_set_ip_t ip;
1456 + ip_set_ip_t end;
1457 +};
1458 +
1459 +#endif /* __IP_SET_IPTREEMAP_H */
1460 --- /dev/null
1461 +++ b/include/linux/netfilter_ipv4/ip_set_jhash.h
1462 @@ -0,0 +1,157 @@
1463 +#ifndef _LINUX_JHASH_H
1464 +#define _LINUX_JHASH_H
1465 +
1466 +/* jhash.h: Jenkins hash support.
1467 + *
1468 + * Copyright (C) 2006. Bob Jenkins (bob_jenkins@burtleburtle.net)
1469 + *
1470 + * http://burtleburtle.net/bob/hash/
1471 + *
1472 + * These are the credits from Bob's sources:
1473 + *
1474 + * lookup3.c, by Bob Jenkins, May 2006, Public Domain.
1475 + *
1476 + * These are functions for producing 32-bit hashes for hash table lookup.
1477 + * hashword(), hashlittle(), hashlittle2(), hashbig(), mix(), and final()
1478 + * are externally useful functions. Routines to test the hash are included
1479 + * if SELF_TEST is defined. You can use this free for any purpose. It's in
1480 + * the public domain. It has no warranty.
1481 + *
1482 + * Copyright (C) 2009 Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
1483 + *
1484 + * I've modified Bob's hash to be useful in the Linux kernel, and
1485 + * any bugs present are my fault. Jozsef
1486 + */
1487 +
1488 +#define __rot(x,k) (((x)<<(k)) | ((x)>>(32-(k))))
1489 +
1490 +/* __jhash_mix - mix 3 32-bit values reversibly. */
1491 +#define __jhash_mix(a,b,c) \
1492 +{ \
1493 + a -= c; a ^= __rot(c, 4); c += b; \
1494 + b -= a; b ^= __rot(a, 6); a += c; \
1495 + c -= b; c ^= __rot(b, 8); b += a; \
1496 + a -= c; a ^= __rot(c,16); c += b; \
1497 + b -= a; b ^= __rot(a,19); a += c; \
1498 + c -= b; c ^= __rot(b, 4); b += a; \
1499 +}
1500 +
1501 +/* __jhash_final - final mixing of 3 32-bit values (a,b,c) into c */
1502 +#define __jhash_final(a,b,c) \
1503 +{ \
1504 + c ^= b; c -= __rot(b,14); \
1505 + a ^= c; a -= __rot(c,11); \
1506 + b ^= a; b -= __rot(a,25); \
1507 + c ^= b; c -= __rot(b,16); \
1508 + a ^= c; a -= __rot(c,4); \
1509 + b ^= a; b -= __rot(a,14); \
1510 + c ^= b; c -= __rot(b,24); \
1511 +}
1512 +
1513 +/* The golden ration: an arbitrary value */
1514 +#define JHASH_GOLDEN_RATIO 0xdeadbeef
1515 +
1516 +/* The most generic version, hashes an arbitrary sequence
1517 + * of bytes. No alignment or length assumptions are made about
1518 + * the input key. The result depends on endianness.
1519 + */
1520 +static inline u32 jhash(const void *key, u32 length, u32 initval)
1521 +{
1522 + u32 a,b,c;
1523 + const u8 *k = key;
1524 +
1525 + /* Set up the internal state */
1526 + a = b = c = JHASH_GOLDEN_RATIO + length + initval;
1527 +
1528 + /* all but the last block: affect some 32 bits of (a,b,c) */
1529 + while (length > 12) {
1530 + a += (k[0] + ((u32)k[1]<<8) + ((u32)k[2]<<16) + ((u32)k[3]<<24));
1531 + b += (k[4] + ((u32)k[5]<<8) + ((u32)k[6]<<16) + ((u32)k[7]<<24));
1532 + c += (k[8] + ((u32)k[9]<<8) + ((u32)k[10]<<16) + ((u32)k[11]<<24));
1533 + __jhash_mix(a, b, c);
1534 + length -= 12;
1535 + k += 12;
1536 + }
1537 +
1538 + /* last block: affect all 32 bits of (c) */
1539 + /* all the case statements fall through */
1540 + switch (length) {
1541 + case 12: c += (u32)k[11]<<24;
1542 + case 11: c += (u32)k[10]<<16;
1543 + case 10: c += (u32)k[9]<<8;
1544 + case 9 : c += k[8];
1545 + case 8 : b += (u32)k[7]<<24;
1546 + case 7 : b += (u32)k[6]<<16;
1547 + case 6 : b += (u32)k[5]<<8;
1548 + case 5 : b += k[4];
1549 + case 4 : a += (u32)k[3]<<24;
1550 + case 3 : a += (u32)k[2]<<16;
1551 + case 2 : a += (u32)k[1]<<8;
1552 + case 1 : a += k[0];
1553 + __jhash_final(a, b, c);
1554 + case 0 :
1555 + break;
1556 + }
1557 +
1558 + return c;
1559 +}
1560 +
1561 +/* A special optimized version that handles 1 or more of u32s.
1562 + * The length parameter here is the number of u32s in the key.
1563 + */
1564 +static inline u32 jhash2(const u32 *k, u32 length, u32 initval)
1565 +{
1566 + u32 a, b, c;
1567 +
1568 + /* Set up the internal state */
1569 + a = b = c = JHASH_GOLDEN_RATIO + (length<<2) + initval;
1570 +
1571 + /* handle most of the key */
1572 + while (length > 3) {
1573 + a += k[0];
1574 + b += k[1];
1575 + c += k[2];
1576 + __jhash_mix(a, b, c);
1577 + length -= 3;
1578 + k += 3;
1579 + }
1580 +
1581 + /* handle the last 3 u32's */
1582 + /* all the case statements fall through */
1583 + switch (length) {
1584 + case 3: c += k[2];
1585 + case 2: b += k[1];
1586 + case 1: a += k[0];
1587 + __jhash_final(a, b, c);
1588 + case 0: /* case 0: nothing left to add */
1589 + break;
1590 + }
1591 +
1592 + return c;
1593 +}
1594 +
1595 +/* A special ultra-optimized versions that knows they are hashing exactly
1596 + * 3, 2 or 1 word(s).
1597 + */
1598 +static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
1599 +{
1600 + a += JHASH_GOLDEN_RATIO + initval;
1601 + b += JHASH_GOLDEN_RATIO + initval;
1602 + c += JHASH_GOLDEN_RATIO + initval;
1603 +
1604 + __jhash_final(a, b, c);
1605 +
1606 + return c;
1607 +}
1608 +
1609 +static inline u32 jhash_2words(u32 a, u32 b, u32 initval)
1610 +{
1611 + return jhash_3words(0, a, b, initval);
1612 +}
1613 +
1614 +static inline u32 jhash_1word(u32 a, u32 initval)
1615 +{
1616 + return jhash_3words(0, 0, a, initval);
1617 +}
1618 +
1619 +#endif /* _LINUX_JHASH_H */
1620 --- /dev/null
1621 +++ b/include/linux/netfilter_ipv4/ip_set_macipmap.h
1622 @@ -0,0 +1,39 @@
1623 +#ifndef __IP_SET_MACIPMAP_H
1624 +#define __IP_SET_MACIPMAP_H
1625 +
1626 +#include <linux/netfilter_ipv4/ip_set.h>
1627 +#include <linux/netfilter_ipv4/ip_set_bitmaps.h>
1628 +
1629 +#define SETTYPE_NAME "macipmap"
1630 +
1631 +/* general flags */
1632 +#define IPSET_MACIP_MATCHUNSET 1
1633 +
1634 +/* per ip flags */
1635 +#define IPSET_MACIP_ISSET 1
1636 +
1637 +struct ip_set_macipmap {
1638 + void *members; /* the macipmap proper */
1639 + ip_set_ip_t first_ip; /* host byte order, included in range */
1640 + ip_set_ip_t last_ip; /* host byte order, included in range */
1641 + u_int32_t flags;
1642 + u_int32_t size; /* size of the ipmap proper */
1643 +};
1644 +
1645 +struct ip_set_req_macipmap_create {
1646 + ip_set_ip_t from;
1647 + ip_set_ip_t to;
1648 + u_int32_t flags;
1649 +};
1650 +
1651 +struct ip_set_req_macipmap {
1652 + ip_set_ip_t ip;
1653 + unsigned char ethernet[ETH_ALEN];
1654 +};
1655 +
1656 +struct ip_set_macip {
1657 + unsigned short match;
1658 + unsigned char ethernet[ETH_ALEN];
1659 +};
1660 +
1661 +#endif /* __IP_SET_MACIPMAP_H */
1662 --- /dev/null
1663 +++ b/include/linux/netfilter_ipv4/ip_set_malloc.h
1664 @@ -0,0 +1,153 @@
1665 +#ifndef _IP_SET_MALLOC_H
1666 +#define _IP_SET_MALLOC_H
1667 +
1668 +#ifdef __KERNEL__
1669 +#include <linux/vmalloc.h>
1670 +
1671 +static size_t max_malloc_size = 0, max_page_size = 0;
1672 +static size_t default_max_malloc_size = 131072; /* Guaranteed: slab.c */
1673 +
1674 +static inline int init_max_page_size(void)
1675 +{
1676 +/* Compatibility glues to support 2.4.36 */
1677 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
1678 +#define __GFP_NOWARN 0
1679 +
1680 + /* Guaranteed: slab.c */
1681 + max_malloc_size = max_page_size = default_max_malloc_size;
1682 +#else
1683 + size_t page_size = 0;
1684 +
1685 +#define CACHE(x) if (max_page_size == 0 || x < max_page_size) \
1686 + page_size = x;
1687 +#include <linux/kmalloc_sizes.h>
1688 +#undef CACHE
1689 + if (page_size) {
1690 + if (max_malloc_size == 0)
1691 + max_malloc_size = page_size;
1692 +
1693 + max_page_size = page_size;
1694 +
1695 + return 1;
1696 + }
1697 +#endif
1698 + return 0;
1699 +}
1700 +
1701 +struct harray {
1702 + size_t max_elements;
1703 + void *arrays[0];
1704 +};
1705 +
1706 +static inline void *
1707 +__harray_malloc(size_t hashsize, size_t typesize, gfp_t flags)
1708 +{
1709 + struct harray *harray;
1710 + size_t max_elements, size, i, j;
1711 +
1712 + BUG_ON(max_page_size == 0);
1713 +
1714 + if (typesize > max_page_size)
1715 + return NULL;
1716 +
1717 + max_elements = max_page_size/typesize;
1718 + size = hashsize/max_elements;
1719 + if (hashsize % max_elements)
1720 + size++;
1721 +
1722 + /* Last pointer signals end of arrays */
1723 + harray = kmalloc(sizeof(struct harray) + (size + 1) * sizeof(void *),
1724 + flags);
1725 +
1726 + if (!harray)
1727 + return NULL;
1728 +
1729 + for (i = 0; i < size - 1; i++) {
1730 + harray->arrays[i] = kmalloc(max_elements * typesize, flags);
1731 + if (!harray->arrays[i])
1732 + goto undo;
1733 + memset(harray->arrays[i], 0, max_elements * typesize);
1734 + }
1735 + harray->arrays[i] = kmalloc((hashsize - i * max_elements) * typesize,
1736 + flags);
1737 + if (!harray->arrays[i])
1738 + goto undo;
1739 + memset(harray->arrays[i], 0, (hashsize - i * max_elements) * typesize);
1740 +
1741 + harray->max_elements = max_elements;
1742 + harray->arrays[size] = NULL;
1743 +
1744 + return (void *)harray;
1745 +
1746 + undo:
1747 + for (j = 0; j < i; j++) {
1748 + kfree(harray->arrays[j]);
1749 + }
1750 + kfree(harray);
1751 + return NULL;
1752 +}
1753 +
1754 +static inline void *
1755 +harray_malloc(size_t hashsize, size_t typesize, gfp_t flags)
1756 +{
1757 + void *harray;
1758 +
1759 + do {
1760 + harray = __harray_malloc(hashsize, typesize, flags|__GFP_NOWARN);
1761 + } while (harray == NULL && init_max_page_size());
1762 +
1763 + return harray;
1764 +}
1765 +
1766 +static inline void harray_free(void *h)
1767 +{
1768 + struct harray *harray = (struct harray *) h;
1769 + size_t i;
1770 +
1771 + for (i = 0; harray->arrays[i] != NULL; i++)
1772 + kfree(harray->arrays[i]);
1773 + kfree(harray);
1774 +}
1775 +
1776 +static inline void harray_flush(void *h, size_t hashsize, size_t typesize)
1777 +{
1778 + struct harray *harray = (struct harray *) h;
1779 + size_t i;
1780 +
1781 + for (i = 0; harray->arrays[i+1] != NULL; i++)
1782 + memset(harray->arrays[i], 0, harray->max_elements * typesize);
1783 + memset(harray->arrays[i], 0,
1784 + (hashsize - i * harray->max_elements) * typesize);
1785 +}
1786 +
1787 +#define HARRAY_ELEM(h, type, which) \
1788 +({ \
1789 + struct harray *__h = (struct harray *)(h); \
1790 + ((type)((__h)->arrays[(which)/(__h)->max_elements]) \
1791 + + (which)%(__h)->max_elements); \
1792 +})
1793 +
1794 +/* General memory allocation and deallocation */
1795 +static inline void * ip_set_malloc(size_t bytes)
1796 +{
1797 + BUG_ON(max_malloc_size == 0);
1798 +
1799 + if (bytes > default_max_malloc_size)
1800 + return vmalloc(bytes);
1801 + else
1802 + return kmalloc(bytes, GFP_KERNEL | __GFP_NOWARN);
1803 +}
1804 +
1805 +static inline void ip_set_free(void * data, size_t bytes)
1806 +{
1807 + BUG_ON(max_malloc_size == 0);
1808 +
1809 + if (bytes > default_max_malloc_size)
1810 + vfree(data);
1811 + else
1812 + kfree(data);
1813 +}
1814 +
1815 +#endif /* __KERNEL__ */
1816 +
1817 +#endif /*_IP_SET_MALLOC_H*/
1818 --- /dev/null
1819 +++ b/include/linux/netfilter_ipv4/ip_set_nethash.h
1820 @@ -0,0 +1,31 @@
1821 +#ifndef __IP_SET_NETHASH_H
1822 +#define __IP_SET_NETHASH_H
1823 +
1824 +#include <linux/netfilter_ipv4/ip_set.h>
1825 +#include <linux/netfilter_ipv4/ip_set_hashes.h>
1826 +
1827 +#define SETTYPE_NAME "nethash"
1828 +
1829 +struct ip_set_nethash {
1830 + ip_set_ip_t *members; /* the nethash proper */
1831 + uint32_t elements; /* number of elements */
1832 + uint32_t hashsize; /* hash size */
1833 + uint16_t probes; /* max number of probes */
1834 + uint16_t resize; /* resize factor in percent */
1835 + uint8_t cidr[30]; /* CIDR sizes */
1836 + uint16_t nets[30]; /* nr of nets by CIDR sizes */
1837 + initval_t initval[0]; /* initvals for jhash_1word */
1838 +};
1839 +
1840 +struct ip_set_req_nethash_create {
1841 + uint32_t hashsize;
1842 + uint16_t probes;
1843 + uint16_t resize;
1844 +};
1845 +
1846 +struct ip_set_req_nethash {
1847 + ip_set_ip_t ip;
1848 + uint8_t cidr;
1849 +};
1850 +
1851 +#endif /* __IP_SET_NETHASH_H */
1852 --- /dev/null
1853 +++ b/include/linux/netfilter_ipv4/ip_set_portmap.h
1854 @@ -0,0 +1,25 @@
1855 +#ifndef __IP_SET_PORTMAP_H
1856 +#define __IP_SET_PORTMAP_H
1857 +
1858 +#include <linux/netfilter_ipv4/ip_set.h>
1859 +#include <linux/netfilter_ipv4/ip_set_bitmaps.h>
1860 +
1861 +#define SETTYPE_NAME "portmap"
1862 +
1863 +struct ip_set_portmap {
1864 + void *members; /* the portmap proper */
1865 + ip_set_ip_t first_ip; /* host byte order, included in range */
1866 + ip_set_ip_t last_ip; /* host byte order, included in range */
1867 + u_int32_t size; /* size of the ipmap proper */
1868 +};
1869 +
1870 +struct ip_set_req_portmap_create {
1871 + ip_set_ip_t from;
1872 + ip_set_ip_t to;
1873 +};
1874 +
1875 +struct ip_set_req_portmap {
1876 + ip_set_ip_t ip;
1877 +};
1878 +
1879 +#endif /* __IP_SET_PORTMAP_H */
1880 --- /dev/null
1881 +++ b/include/linux/netfilter_ipv4/ip_set_setlist.h
1882 @@ -0,0 +1,26 @@
1883 +#ifndef __IP_SET_SETLIST_H
1884 +#define __IP_SET_SETLIST_H
1885 +
1886 +#include <linux/netfilter_ipv4/ip_set.h>
1887 +
1888 +#define SETTYPE_NAME "setlist"
1889 +
1890 +#define IP_SET_SETLIST_ADD_AFTER 0
1891 +#define IP_SET_SETLIST_ADD_BEFORE 1
1892 +
1893 +struct ip_set_setlist {
1894 + uint8_t size;
1895 + ip_set_id_t index[0];
1896 +};
1897 +
1898 +struct ip_set_req_setlist_create {
1899 + uint8_t size;
1900 +};
1901 +
1902 +struct ip_set_req_setlist {
1903 + char name[IP_SET_MAXNAMELEN];
1904 + char ref[IP_SET_MAXNAMELEN];
1905 + uint8_t before;
1906 +};
1907 +
1908 +#endif /* __IP_SET_SETLIST_H */
1909 --- /dev/null
1910 +++ b/include/linux/netfilter_ipv4/ipt_set.h
1911 @@ -0,0 +1,21 @@
1912 +#ifndef _IPT_SET_H
1913 +#define _IPT_SET_H
1914 +
1915 +#include <linux/netfilter_ipv4/ip_set.h>
1916 +
1917 +struct ipt_set_info {
1918 + ip_set_id_t index;
1919 + u_int32_t flags[IP_SET_MAX_BINDINGS + 1];
1920 +};
1921 +
1922 +/* match info */
1923 +struct ipt_set_info_match {
1924 + struct ipt_set_info match_set;
1925 +};
1926 +
1927 +struct ipt_set_info_target {
1928 + struct ipt_set_info add_set;
1929 + struct ipt_set_info del_set;
1930 +};
1931 +
1932 +#endif /*_IPT_SET_H*/
1933 --- /dev/null
1934 +++ b/net/ipv4/netfilter/ip_set.c
1935 @@ -0,0 +1,2076 @@
1936 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
1937 + * Patrick Schaaf <bof@bof.de>
1938 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
1939 + *
1940 + * This program is free software; you can redistribute it and/or modify
1941 + * it under the terms of the GNU General Public License version 2 as
1942 + * published by the Free Software Foundation.
1943 + */
1944 +
1945 +/* Kernel module for IP set management */
1946 +
1947 +#include <linux/version.h>
1948 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
1949 +#include <linux/config.h>
1950 +#endif
1951 +#include <linux/module.h>
1952 +#include <linux/moduleparam.h>
1953 +#include <linux/kmod.h>
1954 +#include <linux/ip.h>
1955 +#include <linux/skbuff.h>
1956 +#include <linux/random.h>
1957 +#include <linux/netfilter_ipv4/ip_set_jhash.h>
1958 +#include <linux/errno.h>
1959 +#include <linux/capability.h>
1960 +#include <asm/uaccess.h>
1961 +#include <asm/bitops.h>
1962 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,27)
1963 +#include <asm/semaphore.h>
1964 +#else
1965 +#include <linux/semaphore.h>
1966 +#endif
1967 +#include <linux/spinlock.h>
1968 +
1969 +#define ASSERT_READ_LOCK(x)
1970 +#define ASSERT_WRITE_LOCK(x)
1971 +#include <linux/netfilter.h>
1972 +#include <linux/netfilter_ipv4/ip_set.h>
1973 +
1974 +static struct list_head set_type_list; /* all registered sets */
1975 +static struct ip_set **ip_set_list; /* all individual sets */
1976 +static DEFINE_RWLOCK(ip_set_lock); /* protects the lists and the hash */
1977 +static DECLARE_MUTEX(ip_set_app_mutex); /* serializes user access */
1978 +static ip_set_id_t ip_set_max = CONFIG_IP_NF_SET_MAX;
1979 +static ip_set_id_t ip_set_bindings_hash_size = CONFIG_IP_NF_SET_HASHSIZE;
1980 +static struct list_head *ip_set_hash; /* hash of bindings */
1981 +static unsigned int ip_set_hash_random; /* random seed */
1982 +
1983 +#define SETNAME_EQ(a,b) (strncmp(a,b,IP_SET_MAXNAMELEN) == 0)
1984 +
1985 +/*
1986 + * Sets are identified either by the index in ip_set_list or by id.
1987 + * The id never changes and is used to find a key in the hash.
1988 + * The index may change by swapping and used at all other places
1989 + * (set/SET netfilter modules, binding value, etc.)
1990 + *
1991 + * Userspace requests are serialized by ip_set_mutex and sets can
1992 + * be deleted only from userspace. Therefore ip_set_list locking
1993 + * must obey the following rules:
1994 + *
1995 + * - kernel requests: read and write locking mandatory
1996 + * - user requests: read locking optional, write locking mandatory
1997 + */
1998 +
1999 +static inline void
2000 +__ip_set_get(ip_set_id_t index)
2001 +{
2002 + atomic_inc(&ip_set_list[index]->ref);
2003 +}
2004 +
2005 +static inline void
2006 +__ip_set_put(ip_set_id_t index)
2007 +{
2008 + atomic_dec(&ip_set_list[index]->ref);
2009 +}
2010 +
2011 +/*
2012 + * Binding routines
2013 + */
2014 +
2015 +static inline struct ip_set_hash *
2016 +__ip_set_find(u_int32_t key, ip_set_id_t id, ip_set_ip_t ip)
2017 +{
2018 + struct ip_set_hash *set_hash;
2019 +
2020 + list_for_each_entry(set_hash, &ip_set_hash[key], list)
2021 + if (set_hash->id == id && set_hash->ip == ip)
2022 + return set_hash;
2023 +
2024 + return NULL;
2025 +}
2026 +
2027 +static ip_set_id_t
2028 +ip_set_find_in_hash(ip_set_id_t id, ip_set_ip_t ip)
2029 +{
2030 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
2031 + % ip_set_bindings_hash_size;
2032 + struct ip_set_hash *set_hash;
2033 +
2034 + ASSERT_READ_LOCK(&ip_set_lock);
2035 + IP_SET_ASSERT(ip_set_list[id]);
2036 + DP("set: %s, ip: %u.%u.%u.%u", ip_set_list[id]->name, HIPQUAD(ip));
2037 +
2038 + set_hash = __ip_set_find(key, id, ip);
2039 +
2040 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
2041 + HIPQUAD(ip),
2042 + set_hash != NULL ? ip_set_list[set_hash->binding]->name : "");
2043 +
2044 + return (set_hash != NULL ? set_hash->binding : IP_SET_INVALID_ID);
2045 +}
2046 +
2047 +static inline void
2048 +__set_hash_del(struct ip_set_hash *set_hash)
2049 +{
2050 + ASSERT_WRITE_LOCK(&ip_set_lock);
2051 + IP_SET_ASSERT(ip_set_list[set_hash->binding]);
2052 +
2053 + __ip_set_put(set_hash->binding);
2054 + list_del(&set_hash->list);
2055 + kfree(set_hash);
2056 +}
2057 +
2058 +static int
2059 +ip_set_hash_del(ip_set_id_t id, ip_set_ip_t ip)
2060 +{
2061 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
2062 + % ip_set_bindings_hash_size;
2063 + struct ip_set_hash *set_hash;
2064 +
2065 + IP_SET_ASSERT(ip_set_list[id]);
2066 + DP("set: %s, ip: %u.%u.%u.%u", ip_set_list[id]->name, HIPQUAD(ip));
2067 + write_lock_bh(&ip_set_lock);
2068 + set_hash = __ip_set_find(key, id, ip);
2069 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
2070 + HIPQUAD(ip),
2071 + set_hash != NULL ? ip_set_list[set_hash->binding]->name : "");
2072 +
2073 + if (set_hash != NULL)
2074 + __set_hash_del(set_hash);
2075 + write_unlock_bh(&ip_set_lock);
2076 + return 0;
2077 +}
2078 +
2079 +static int
2080 +ip_set_hash_add(ip_set_id_t id, ip_set_ip_t ip, ip_set_id_t binding)
2081 +{
2082 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
2083 + % ip_set_bindings_hash_size;
2084 + struct ip_set_hash *set_hash;
2085 + int ret = 0;
2086 +
2087 + IP_SET_ASSERT(ip_set_list[id]);
2088 + IP_SET_ASSERT(ip_set_list[binding]);
2089 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
2090 + HIPQUAD(ip), ip_set_list[binding]->name);
2091 + write_lock_bh(&ip_set_lock);
2092 + set_hash = __ip_set_find(key, id, ip);
2093 + if (!set_hash) {
2094 + set_hash = kmalloc(sizeof(struct ip_set_hash), GFP_ATOMIC);
2095 + if (!set_hash) {
2096 + ret = -ENOMEM;
2097 + goto unlock;
2098 + }
2099 + INIT_LIST_HEAD(&set_hash->list);
2100 + set_hash->id = id;
2101 + set_hash->ip = ip;
2102 + list_add(&set_hash->list, &ip_set_hash[key]);
2103 + } else {
2104 + IP_SET_ASSERT(ip_set_list[set_hash->binding]);
2105 + DP("overwrite binding: %s",
2106 + ip_set_list[set_hash->binding]->name);
2107 + __ip_set_put(set_hash->binding);
2108 + }
2109 + set_hash->binding = binding;
2110 + __ip_set_get(set_hash->binding);
2111 + DP("stored: key %u, id %u (%s), ip %u.%u.%u.%u, binding %u (%s)",
2112 + key, id, ip_set_list[id]->name,
2113 + HIPQUAD(ip), binding, ip_set_list[binding]->name);
2114 + unlock:
2115 + write_unlock_bh(&ip_set_lock);
2116 + return ret;
2117 +}
2118 +
2119 +#define FOREACH_HASH_DO(fn, args...) \
2120 +({ \
2121 + ip_set_id_t __key; \
2122 + struct ip_set_hash *__set_hash; \
2123 + \
2124 + for (__key = 0; __key < ip_set_bindings_hash_size; __key++) { \
2125 + list_for_each_entry(__set_hash, &ip_set_hash[__key], list) \
2126 + fn(__set_hash , ## args); \
2127 + } \
2128 +})
2129 +
2130 +#define FOREACH_HASH_RW_DO(fn, args...) \
2131 +({ \
2132 + ip_set_id_t __key; \
2133 + struct ip_set_hash *__set_hash, *__n; \
2134 + \
2135 + ASSERT_WRITE_LOCK(&ip_set_lock); \
2136 + for (__key = 0; __key < ip_set_bindings_hash_size; __key++) { \
2137 + list_for_each_entry_safe(__set_hash, __n, &ip_set_hash[__key], list)\
2138 + fn(__set_hash , ## args); \
2139 + } \
2140 +})
2141 +
2142 +/* Add, del and test set entries from kernel */
2143 +
2144 +#define follow_bindings(index, set, ip) \
2145 +((index = ip_set_find_in_hash((set)->id, ip)) != IP_SET_INVALID_ID \
2146 + || (index = (set)->binding) != IP_SET_INVALID_ID)
2147 +
2148 +int
2149 +ip_set_testip_kernel(ip_set_id_t index,
2150 + const struct sk_buff *skb,
2151 + const u_int32_t *flags)
2152 +{
2153 + struct ip_set *set;
2154 + ip_set_ip_t ip;
2155 + int res;
2156 + unsigned char i = 0;
2157 +
2158 + IP_SET_ASSERT(flags[i]);
2159 + read_lock_bh(&ip_set_lock);
2160 + do {
2161 + set = ip_set_list[index];
2162 + IP_SET_ASSERT(set);
2163 + DP("set %s, index %u", set->name, index);
2164 + read_lock_bh(&set->lock);
2165 + res = set->type->testip_kernel(set, skb, &ip, flags, i++);
2166 + read_unlock_bh(&set->lock);
2167 + i += !!(set->type->features & IPSET_DATA_DOUBLE);
2168 + } while (res > 0
2169 + && flags[i]
2170 + && follow_bindings(index, set, ip));
2171 + read_unlock_bh(&ip_set_lock);
2172 +
2173 + return (res < 0 ? 0 : res);
2174 +}
2175 +
2176 +int
2177 +ip_set_addip_kernel(ip_set_id_t index,
2178 + const struct sk_buff *skb,
2179 + const u_int32_t *flags)
2180 +{
2181 + struct ip_set *set;
2182 + ip_set_ip_t ip;
2183 + int res;
2184 + unsigned char i = 0;
2185 +
2186 + IP_SET_ASSERT(flags[i]);
2187 + retry:
2188 + read_lock_bh(&ip_set_lock);
2189 + do {
2190 + set = ip_set_list[index];
2191 + IP_SET_ASSERT(set);
2192 + DP("set %s, index %u", set->name, index);
2193 + write_lock_bh(&set->lock);
2194 + res = set->type->addip_kernel(set, skb, &ip, flags, i++);
2195 + write_unlock_bh(&set->lock);
2196 + i += !!(set->type->features & IPSET_DATA_DOUBLE);
2197 + } while ((res == 0 || res == -EEXIST)
2198 + && flags[i]
2199 + && follow_bindings(index, set, ip));
2200 + read_unlock_bh(&ip_set_lock);
2201 +
2202 + if (res == -EAGAIN
2203 + && set->type->retry
2204 + && (res = set->type->retry(set)) == 0)
2205 + goto retry;
2206 +
2207 + return res;
2208 +}
2209 +
2210 +int
2211 +ip_set_delip_kernel(ip_set_id_t index,
2212 + const struct sk_buff *skb,
2213 + const u_int32_t *flags)
2214 +{
2215 + struct ip_set *set;
2216 + ip_set_ip_t ip;
2217 + int res;
2218 + unsigned char i = 0;
2219 +
2220 + IP_SET_ASSERT(flags[i]);
2221 + read_lock_bh(&ip_set_lock);
2222 + do {
2223 + set = ip_set_list[index];
2224 + IP_SET_ASSERT(set);
2225 + DP("set %s, index %u", set->name, index);
2226 + write_lock_bh(&set->lock);
2227 + res = set->type->delip_kernel(set, skb, &ip, flags, i++);
2228 + write_unlock_bh(&set->lock);
2229 + i += !!(set->type->features & IPSET_DATA_DOUBLE);
2230 + } while ((res == 0 || res == -EEXIST)
2231 + && flags[i]
2232 + && follow_bindings(index, set, ip));
2233 + read_unlock_bh(&ip_set_lock);
2234 +
2235 + return res;
2236 +}
2237 +
2238 +/* Register and deregister settype */
2239 +
2240 +static inline struct ip_set_type *
2241 +find_set_type(const char *name)
2242 +{
2243 + struct ip_set_type *set_type;
2244 +
2245 + list_for_each_entry(set_type, &set_type_list, list)
2246 + if (!strncmp(set_type->typename, name, IP_SET_MAXNAMELEN - 1))
2247 + return set_type;
2248 + return NULL;
2249 +}
2250 +
2251 +int
2252 +ip_set_register_set_type(struct ip_set_type *set_type)
2253 +{
2254 + int ret = 0;
2255 +
2256 + if (set_type->protocol_version != IP_SET_PROTOCOL_VERSION) {
2257 + ip_set_printk("'%s' uses wrong protocol version %u (want %u)",
2258 + set_type->typename,
2259 + set_type->protocol_version,
2260 + IP_SET_PROTOCOL_VERSION);
2261 + return -EINVAL;
2262 + }
2263 +
2264 + write_lock_bh(&ip_set_lock);
2265 + if (find_set_type(set_type->typename)) {
2266 + /* Duplicate! */
2267 + ip_set_printk("'%s' already registered!",
2268 + set_type->typename);
2269 + ret = -EINVAL;
2270 + goto unlock;
2271 + }
2272 + if (!try_module_get(THIS_MODULE)) {
2273 + ret = -EFAULT;
2274 + goto unlock;
2275 + }
2276 + list_add(&set_type->list, &set_type_list);
2277 + DP("'%s' registered.", set_type->typename);
2278 + unlock:
2279 + write_unlock_bh(&ip_set_lock);
2280 + return ret;
2281 +}
2282 +
2283 +void
2284 +ip_set_unregister_set_type(struct ip_set_type *set_type)
2285 +{
2286 + write_lock_bh(&ip_set_lock);
2287 + if (!find_set_type(set_type->typename)) {
2288 + ip_set_printk("'%s' not registered?",
2289 + set_type->typename);
2290 + goto unlock;
2291 + }
2292 + list_del(&set_type->list);
2293 + module_put(THIS_MODULE);
2294 + DP("'%s' unregistered.", set_type->typename);
2295 + unlock:
2296 + write_unlock_bh(&ip_set_lock);
2297 +
2298 +}
2299 +
2300 +ip_set_id_t
2301 +__ip_set_get_byname(const char *name, struct ip_set **set)
2302 +{
2303 + ip_set_id_t i, index = IP_SET_INVALID_ID;
2304 +
2305 + for (i = 0; i < ip_set_max; i++) {
2306 + if (ip_set_list[i] != NULL
2307 + && SETNAME_EQ(ip_set_list[i]->name, name)) {
2308 + __ip_set_get(i);
2309 + index = i;
2310 + *set = ip_set_list[i];
2311 + break;
2312 + }
2313 + }
2314 + return index;
2315 +}
2316 +
2317 +void __ip_set_put_byindex(ip_set_id_t index)
2318 +{
2319 + if (ip_set_list[index])
2320 + __ip_set_put(index);
2321 +}
2322 +
2323 +/*
2324 + * Userspace routines
2325 + */
2326 +
2327 +/*
2328 + * Find set by name, reference it once. The reference makes sure the
2329 + * thing pointed to, does not go away under our feet. Drop the reference
2330 + * later, using ip_set_put().
2331 + */
2332 +ip_set_id_t
2333 +ip_set_get_byname(const char *name)
2334 +{
2335 + ip_set_id_t i, index = IP_SET_INVALID_ID;
2336 +
2337 + down(&ip_set_app_mutex);
2338 + for (i = 0; i < ip_set_max; i++) {
2339 + if (ip_set_list[i] != NULL
2340 + && SETNAME_EQ(ip_set_list[i]->name, name)) {
2341 + __ip_set_get(i);
2342 + index = i;
2343 + break;
2344 + }
2345 + }
2346 + up(&ip_set_app_mutex);
2347 + return index;
2348 +}
2349 +
2350 +/*
2351 + * Find set by index, reference it once. The reference makes sure the
2352 + * thing pointed to, does not go away under our feet. Drop the reference
2353 + * later, using ip_set_put().
2354 + */
2355 +ip_set_id_t
2356 +ip_set_get_byindex(ip_set_id_t index)
2357 +{
2358 + down(&ip_set_app_mutex);
2359 +
2360 + if (index >= ip_set_max)
2361 + return IP_SET_INVALID_ID;
2362 +
2363 + if (ip_set_list[index])
2364 + __ip_set_get(index);
2365 + else
2366 + index = IP_SET_INVALID_ID;
2367 +
2368 + up(&ip_set_app_mutex);
2369 + return index;
2370 +}
2371 +
2372 +/*
2373 + * Find the set id belonging to the index.
2374 + * We are protected by the mutex, so we do not need to use
2375 + * ip_set_lock. There is no need to reference the sets either.
2376 + */
2377 +ip_set_id_t
2378 +ip_set_id(ip_set_id_t index)
2379 +{
2380 + if (index >= ip_set_max || !ip_set_list[index])
2381 + return IP_SET_INVALID_ID;
2382 +
2383 + return ip_set_list[index]->id;
2384 +}
2385 +
2386 +/*
2387 + * If the given set pointer points to a valid set, decrement
2388 + * reference count by 1. The caller shall not assume the index
2389 + * to be valid, after calling this function.
2390 + */
2391 +void ip_set_put_byindex(ip_set_id_t index)
2392 +{
2393 + down(&ip_set_app_mutex);
2394 + if (ip_set_list[index])
2395 + __ip_set_put(index);
2396 + up(&ip_set_app_mutex);
2397 +}
2398 +
2399 +/* Find a set by name or index */
2400 +static ip_set_id_t
2401 +ip_set_find_byname(const char *name)
2402 +{
2403 + ip_set_id_t i, index = IP_SET_INVALID_ID;
2404 +
2405 + for (i = 0; i < ip_set_max; i++) {
2406 + if (ip_set_list[i] != NULL
2407 + && SETNAME_EQ(ip_set_list[i]->name, name)) {
2408 + index = i;
2409 + break;
2410 + }
2411 + }
2412 + return index;
2413 +}
2414 +
2415 +static ip_set_id_t
2416 +ip_set_find_byindex(ip_set_id_t index)
2417 +{
2418 + if (index >= ip_set_max || ip_set_list[index] == NULL)
2419 + index = IP_SET_INVALID_ID;
2420 +
2421 + return index;
2422 +}
2423 +
2424 +/*
2425 + * Add, del, test, bind and unbind
2426 + */
2427 +
2428 +static inline int
2429 +__ip_set_testip(struct ip_set *set,
2430 + const void *data,
2431 + u_int32_t size,
2432 + ip_set_ip_t *ip)
2433 +{
2434 + int res;
2435 +
2436 + read_lock_bh(&set->lock);
2437 + res = set->type->testip(set, data, size, ip);
2438 + read_unlock_bh(&set->lock);
2439 +
2440 + return res;
2441 +}
2442 +
2443 +static int
2444 +__ip_set_addip(ip_set_id_t index,
2445 + const void *data,
2446 + u_int32_t size)
2447 +{
2448 + struct ip_set *set = ip_set_list[index];
2449 + ip_set_ip_t ip;
2450 + int res;
2451 +
2452 + IP_SET_ASSERT(set);
2453 + do {
2454 + write_lock_bh(&set->lock);
2455 + res = set->type->addip(set, data, size, &ip);
2456 + write_unlock_bh(&set->lock);
2457 + } while (res == -EAGAIN
2458 + && set->type->retry
2459 + && (res = set->type->retry(set)) == 0);
2460 +
2461 + return res;
2462 +}
2463 +
2464 +static int
2465 +ip_set_addip(ip_set_id_t index,
2466 + const void *data,
2467 + u_int32_t size)
2468 +{
2469 + struct ip_set *set = ip_set_list[index];
2470 +
2471 + IP_SET_ASSERT(set);
2472 +
2473 + if (size - sizeof(struct ip_set_req_adt) != set->type->reqsize) {
2474 + ip_set_printk("data length wrong (want %lu, have %zu)",
2475 + (long unsigned)set->type->reqsize,
2476 + size - sizeof(struct ip_set_req_adt));
2477 + return -EINVAL;
2478 + }
2479 + return __ip_set_addip(index,
2480 + data + sizeof(struct ip_set_req_adt),
2481 + size - sizeof(struct ip_set_req_adt));
2482 +}
2483 +
2484 +static int
2485 +ip_set_delip(ip_set_id_t index,
2486 + const void *data,
2487 + u_int32_t size)
2488 +{
2489 + struct ip_set *set = ip_set_list[index];
2490 + ip_set_ip_t ip;
2491 + int res;
2492 +
2493 + IP_SET_ASSERT(set);
2494 +
2495 + if (size - sizeof(struct ip_set_req_adt) != set->type->reqsize) {
2496 + ip_set_printk("data length wrong (want %lu, have %zu)",
2497 + (long unsigned)set->type->reqsize,
2498 + size - sizeof(struct ip_set_req_adt));
2499 + return -EINVAL;
2500 + }
2501 + write_lock_bh(&set->lock);
2502 + res = set->type->delip(set,
2503 + data + sizeof(struct ip_set_req_adt),
2504 + size - sizeof(struct ip_set_req_adt),
2505 + &ip);
2506 + write_unlock_bh(&set->lock);
2507 +
2508 + return res;
2509 +}
2510 +
2511 +static int
2512 +ip_set_testip(ip_set_id_t index,
2513 + const void *data,
2514 + u_int32_t size)
2515 +{
2516 + struct ip_set *set = ip_set_list[index];
2517 + ip_set_ip_t ip;
2518 + int res;
2519 +
2520 + IP_SET_ASSERT(set);
2521 +
2522 + if (size - sizeof(struct ip_set_req_adt) != set->type->reqsize) {
2523 + ip_set_printk("data length wrong (want %lu, have %zu)",
2524 + (long unsigned)set->type->reqsize,
2525 + size - sizeof(struct ip_set_req_adt));
2526 + return -EINVAL;
2527 + }
2528 + res = __ip_set_testip(set,
2529 + data + sizeof(struct ip_set_req_adt),
2530 + size - sizeof(struct ip_set_req_adt),
2531 + &ip);
2532 +
2533 + return (res > 0 ? -EEXIST : res);
2534 +}
2535 +
2536 +static int
2537 +ip_set_bindip(ip_set_id_t index,
2538 + const void *data,
2539 + u_int32_t size)
2540 +{
2541 + struct ip_set *set = ip_set_list[index];
2542 + const struct ip_set_req_bind *req_bind;
2543 + ip_set_id_t binding;
2544 + ip_set_ip_t ip;
2545 + int res;
2546 +
2547 + IP_SET_ASSERT(set);
2548 + if (size < sizeof(struct ip_set_req_bind))
2549 + return -EINVAL;
2550 +
2551 + req_bind = data;
2552 +
2553 + if (SETNAME_EQ(req_bind->binding, IPSET_TOKEN_DEFAULT)) {
2554 + /* Default binding of a set */
2555 + const char *binding_name;
2556 +
2557 + if (size != sizeof(struct ip_set_req_bind) + IP_SET_MAXNAMELEN)
2558 + return -EINVAL;
2559 +
2560 + binding_name = data + sizeof(struct ip_set_req_bind);
2561 +
2562 + binding = ip_set_find_byname(binding_name);
2563 + if (binding == IP_SET_INVALID_ID)
2564 + return -ENOENT;
2565 +
2566 + write_lock_bh(&ip_set_lock);
2567 + /* Sets as binding values are referenced */
2568 + if (set->binding != IP_SET_INVALID_ID)
2569 + __ip_set_put(set->binding);
2570 + set->binding = binding;
2571 + __ip_set_get(set->binding);
2572 + write_unlock_bh(&ip_set_lock);
2573 +
2574 + return 0;
2575 + }
2576 + binding = ip_set_find_byname(req_bind->binding);
2577 + if (binding == IP_SET_INVALID_ID)
2578 + return -ENOENT;
2579 +
2580 + res = __ip_set_testip(set,
2581 + data + sizeof(struct ip_set_req_bind),
2582 + size - sizeof(struct ip_set_req_bind),
2583 + &ip);
2584 + DP("set %s, ip: %u.%u.%u.%u, binding %s",
2585 + set->name, HIPQUAD(ip), ip_set_list[binding]->name);
2586 +
2587 + if (res >= 0)
2588 + res = ip_set_hash_add(set->id, ip, binding);
2589 +
2590 + return res;
2591 +}
2592 +
2593 +#define FOREACH_SET_DO(fn, args...) \
2594 +({ \
2595 + ip_set_id_t __i; \
2596 + struct ip_set *__set; \
2597 + \
2598 + for (__i = 0; __i < ip_set_max; __i++) { \
2599 + __set = ip_set_list[__i]; \
2600 + if (__set != NULL) \
2601 + fn(__set , ##args); \
2602 + } \
2603 +})
2604 +
2605 +static inline void
2606 +__set_hash_del_byid(struct ip_set_hash *set_hash, ip_set_id_t id)
2607 +{
2608 + if (set_hash->id == id)
2609 + __set_hash_del(set_hash);
2610 +}
2611 +
2612 +static inline void
2613 +__unbind_default(struct ip_set *set)
2614 +{
2615 + if (set->binding != IP_SET_INVALID_ID) {
2616 + /* Sets as binding values are referenced */
2617 + __ip_set_put(set->binding);
2618 + set->binding = IP_SET_INVALID_ID;
2619 + }
2620 +}
2621 +
2622 +static int
2623 +ip_set_unbindip(ip_set_id_t index,
2624 + const void *data,
2625 + u_int32_t size)
2626 +{
2627 + struct ip_set *set;
2628 + const struct ip_set_req_bind *req_bind;
2629 + ip_set_ip_t ip;
2630 + int res;
2631 +
2632 + DP("");
2633 + if (size < sizeof(struct ip_set_req_bind))
2634 + return -EINVAL;
2635 +
2636 + req_bind = data;
2637 +
2638 + DP("%u %s", index, req_bind->binding);
2639 + if (index == IP_SET_INVALID_ID) {
2640 + /* unbind :all: */
2641 + if (SETNAME_EQ(req_bind->binding, IPSET_TOKEN_DEFAULT)) {
2642 + /* Default binding of sets */
2643 + write_lock_bh(&ip_set_lock);
2644 + FOREACH_SET_DO(__unbind_default);
2645 + write_unlock_bh(&ip_set_lock);
2646 + return 0;
2647 + } else if (SETNAME_EQ(req_bind->binding, IPSET_TOKEN_ALL)) {
2648 + /* Flush all bindings of all sets*/
2649 + write_lock_bh(&ip_set_lock);
2650 + FOREACH_HASH_RW_DO(__set_hash_del);
2651 + write_unlock_bh(&ip_set_lock);
2652 + return 0;
2653 + }
2654 + DP("unreachable reached!");
2655 + return -EINVAL;
2656 + }
2657 +
2658 + set = ip_set_list[index];
2659 + IP_SET_ASSERT(set);
2660 + if (SETNAME_EQ(req_bind->binding, IPSET_TOKEN_DEFAULT)) {
2661 + /* Default binding of set */
2662 + ip_set_id_t binding = ip_set_find_byindex(set->binding);
2663 +
2664 + if (binding == IP_SET_INVALID_ID)
2665 + return -ENOENT;
2666 +
2667 + write_lock_bh(&ip_set_lock);
2668 + /* Sets in hash values are referenced */
2669 + __ip_set_put(set->binding);
2670 + set->binding = IP_SET_INVALID_ID;
2671 + write_unlock_bh(&ip_set_lock);
2672 +
2673 + return 0;
2674 + } else if (SETNAME_EQ(req_bind->binding, IPSET_TOKEN_ALL)) {
2675 + /* Flush all bindings */
2676 +
2677 + write_lock_bh(&ip_set_lock);
2678 + FOREACH_HASH_RW_DO(__set_hash_del_byid, set->id);
2679 + write_unlock_bh(&ip_set_lock);
2680 + return 0;
2681 + }
2682 +
2683 + res = __ip_set_testip(set,
2684 + data + sizeof(struct ip_set_req_bind),
2685 + size - sizeof(struct ip_set_req_bind),
2686 + &ip);
2687 +
2688 + DP("set %s, ip: %u.%u.%u.%u", set->name, HIPQUAD(ip));
2689 + if (res >= 0)
2690 + res = ip_set_hash_del(set->id, ip);
2691 +
2692 + return res;
2693 +}
2694 +
2695 +static int
2696 +ip_set_testbind(ip_set_id_t index,
2697 + const void *data,
2698 + u_int32_t size)
2699 +{
2700 + struct ip_set *set = ip_set_list[index];
2701 + const struct ip_set_req_bind *req_bind;
2702 + ip_set_id_t binding;
2703 + ip_set_ip_t ip;
2704 + int res;
2705 +
2706 + IP_SET_ASSERT(set);
2707 + if (size < sizeof(struct ip_set_req_bind))
2708 + return -EINVAL;
2709 +
2710 + req_bind = data;
2711 +
2712 + if (SETNAME_EQ(req_bind->binding, IPSET_TOKEN_DEFAULT)) {
2713 + /* Default binding of set */
2714 + const char *binding_name;
2715 +
2716 + if (size != sizeof(struct ip_set_req_bind) + IP_SET_MAXNAMELEN)
2717 + return -EINVAL;
2718 +
2719 + binding_name = data + sizeof(struct ip_set_req_bind);
2720 +
2721 + binding = ip_set_find_byname(binding_name);
2722 + if (binding == IP_SET_INVALID_ID)
2723 + return -ENOENT;
2724 +
2725 + res = (set->binding == binding) ? -EEXIST : 0;
2726 +
2727 + return res;
2728 + }
2729 + binding = ip_set_find_byname(req_bind->binding);
2730 + if (binding == IP_SET_INVALID_ID)
2731 + return -ENOENT;
2732 +
2733 +
2734 + res = __ip_set_testip(set,
2735 + data + sizeof(struct ip_set_req_bind),
2736 + size - sizeof(struct ip_set_req_bind),
2737 + &ip);
2738 + DP("set %s, ip: %u.%u.%u.%u, binding %s",
2739 + set->name, HIPQUAD(ip), ip_set_list[binding]->name);
2740 +
2741 + if (res >= 0)
2742 + res = (ip_set_find_in_hash(set->id, ip) == binding)
2743 + ? -EEXIST : 0;
2744 +
2745 + return res;
2746 +}
2747 +
2748 +static struct ip_set_type *
2749 +find_set_type_rlock(const char *typename)
2750 +{
2751 + struct ip_set_type *type;
2752 +
2753 + read_lock_bh(&ip_set_lock);
2754 + type = find_set_type(typename);
2755 + if (type == NULL)
2756 + read_unlock_bh(&ip_set_lock);
2757 +
2758 + return type;
2759 +}
2760 +
2761 +static int
2762 +find_free_id(const char *name,
2763 + ip_set_id_t *index,
2764 + ip_set_id_t *id)
2765 +{
2766 + ip_set_id_t i;
2767 +
2768 + *id = IP_SET_INVALID_ID;
2769 + for (i = 0; i < ip_set_max; i++) {
2770 + if (ip_set_list[i] == NULL) {
2771 + if (*id == IP_SET_INVALID_ID)
2772 + *id = *index = i;
2773 + } else if (SETNAME_EQ(name, ip_set_list[i]->name))
2774 + /* Name clash */
2775 + return -EEXIST;
2776 + }
2777 + if (*id == IP_SET_INVALID_ID)
2778 + /* No free slot remained */
2779 + return -ERANGE;
2780 + /* Check that index is usable as id (swapping) */
2781 + check:
2782 + for (i = 0; i < ip_set_max; i++) {
2783 + if (ip_set_list[i] != NULL
2784 + && ip_set_list[i]->id == *id) {
2785 + *id = i;
2786 + goto check;
2787 + }
2788 + }
2789 + return 0;
2790 +}
2791 +
2792 +/*
2793 + * Create a set
2794 + */
2795 +static int
2796 +ip_set_create(const char *name,
2797 + const char *typename,
2798 + ip_set_id_t restore,
2799 + const void *data,
2800 + u_int32_t size)
2801 +{
2802 + struct ip_set *set;
2803 + ip_set_id_t index = 0, id;
2804 + int res = 0;
2805 +
2806 + DP("setname: %s, typename: %s, id: %u", name, typename, restore);
2807 +
2808 + /*
2809 + * First, and without any locks, allocate and initialize
2810 + * a normal base set structure.
2811 + */
2812 + set = kmalloc(sizeof(struct ip_set), GFP_KERNEL);
2813 + if (!set)
2814 + return -ENOMEM;
2815 + rwlock_init(&set->lock);
2816 + strncpy(set->name, name, IP_SET_MAXNAMELEN);
2817 + set->binding = IP_SET_INVALID_ID;
2818 + atomic_set(&set->ref, 0);
2819 +
2820 + /*
2821 + * Next, take the &ip_set_lock, check that we know the type,
2822 + * and take a reference on the type, to make sure it
2823 + * stays available while constructing our new set.
2824 + *
2825 + * After referencing the type, we drop the &ip_set_lock,
2826 + * and let the new set construction run without locks.
2827 + */
2828 + set->type = find_set_type_rlock(typename);
2829 + if (set->type == NULL) {
2830 + /* Try loading the module */
2831 + char modulename[IP_SET_MAXNAMELEN + strlen("ip_set_") + 1];
2832 + strcpy(modulename, "ip_set_");
2833 + strcat(modulename, typename);
2834 + DP("try to load %s", modulename);
2835 + request_module(modulename);
2836 + set->type = find_set_type_rlock(typename);
2837 + }
2838 + if (set->type == NULL) {
2839 + ip_set_printk("no set type '%s', set '%s' not created",
2840 + typename, name);
2841 + res = -ENOENT;
2842 + goto out;
2843 + }
2844 + if (!try_module_get(set->type->me)) {
2845 + read_unlock_bh(&ip_set_lock);
2846 + res = -EFAULT;
2847 + goto out;
2848 + }
2849 + read_unlock_bh(&ip_set_lock);
2850 +
2851 + /* Check request size */
2852 + if (size != set->type->header_size) {
2853 + ip_set_printk("data length wrong (want %lu, have %lu)",
2854 + (long unsigned)set->type->header_size,
2855 + (long unsigned)size);
2856 + goto put_out;
2857 + }
2858 +
2859 + /*
2860 + * Without holding any locks, create private part.
2861 + */
2862 + res = set->type->create(set, data, size);
2863 + if (res != 0)
2864 + goto put_out;
2865 +
2866 + /* BTW, res==0 here. */
2867 +
2868 + /*
2869 + * Here, we have a valid, constructed set. &ip_set_lock again,
2870 + * find free id/index and check that it is not already in
2871 + * ip_set_list.
2872 + */
2873 + write_lock_bh(&ip_set_lock);
2874 + if ((res = find_free_id(set->name, &index, &id)) != 0) {
2875 + DP("no free id!");
2876 + goto cleanup;
2877 + }
2878 +
2879 + /* Make sure restore gets the same index */
2880 + if (restore != IP_SET_INVALID_ID && index != restore) {
2881 + DP("Can't restore, sets are screwed up");
2882 + res = -ERANGE;
2883 + goto cleanup;
2884 + }
2885 +
2886 + /*
2887 + * Finally! Add our shiny new set to the list, and be done.
2888 + */
2889 + DP("create: '%s' created with index %u, id %u!", set->name, index, id);
2890 + set->id = id;
2891 + ip_set_list[index] = set;
2892 + write_unlock_bh(&ip_set_lock);
2893 + return res;
2894 +
2895 + cleanup:
2896 + write_unlock_bh(&ip_set_lock);
2897 + set->type->destroy(set);
2898 + put_out:
2899 + module_put(set->type->me);
2900 + out:
2901 + kfree(set);
2902 + return res;
2903 +}
2904 +
2905 +/*
2906 + * Destroy a given existing set
2907 + */
2908 +static void
2909 +ip_set_destroy_set(ip_set_id_t index)
2910 +{
2911 + struct ip_set *set = ip_set_list[index];
2912 +
2913 + IP_SET_ASSERT(set);
2914 + DP("set: %s", set->name);
2915 + write_lock_bh(&ip_set_lock);
2916 + FOREACH_HASH_RW_DO(__set_hash_del_byid, set->id);
2917 + if (set->binding != IP_SET_INVALID_ID)
2918 + __ip_set_put(set->binding);
2919 + ip_set_list[index] = NULL;
2920 + write_unlock_bh(&ip_set_lock);
2921 +
2922 + /* Must call it without holding any lock */
2923 + set->type->destroy(set);
2924 + module_put(set->type->me);
2925 + kfree(set);
2926 +}
2927 +
2928 +/*
2929 + * Destroy a set - or all sets
2930 + * Sets must not be referenced/used.
2931 + */
2932 +static int
2933 +ip_set_destroy(ip_set_id_t index)
2934 +{
2935 + ip_set_id_t i;
2936 +
2937 + /* ref modification always protected by the mutex */
2938 + if (index != IP_SET_INVALID_ID) {
2939 + if (atomic_read(&ip_set_list[index]->ref))
2940 + return -EBUSY;
2941 + ip_set_destroy_set(index);
2942 + } else {
2943 + for (i = 0; i < ip_set_max; i++) {
2944 + if (ip_set_list[i] != NULL
2945 + && (atomic_read(&ip_set_list[i]->ref)))
2946 + return -EBUSY;
2947 + }
2948 +
2949 + for (i = 0; i < ip_set_max; i++) {
2950 + if (ip_set_list[i] != NULL)
2951 + ip_set_destroy_set(i);
2952 + }
2953 + }
2954 + return 0;
2955 +}
2956 +
2957 +static void
2958 +ip_set_flush_set(struct ip_set *set)
2959 +{
2960 + DP("set: %s %u", set->name, set->id);
2961 +
2962 + write_lock_bh(&set->lock);
2963 + set->type->flush(set);
2964 + write_unlock_bh(&set->lock);
2965 +}
2966 +
2967 +/*
2968 + * Flush data in a set - or in all sets
2969 + */
2970 +static int
2971 +ip_set_flush(ip_set_id_t index)
2972 +{
2973 + if (index != IP_SET_INVALID_ID) {
2974 + IP_SET_ASSERT(ip_set_list[index]);
2975 + ip_set_flush_set(ip_set_list[index]);
2976 + } else
2977 + FOREACH_SET_DO(ip_set_flush_set);
2978 +
2979 + return 0;
2980 +}
2981 +
2982 +/* Rename a set */
2983 +static int
2984 +ip_set_rename(ip_set_id_t index, const char *name)
2985 +{
2986 + struct ip_set *set = ip_set_list[index];
2987 + ip_set_id_t i;
2988 + int res = 0;
2989 +
2990 + DP("set: %s to %s", set->name, name);
2991 + write_lock_bh(&ip_set_lock);
2992 + for (i = 0; i < ip_set_max; i++) {
2993 + if (ip_set_list[i] != NULL
2994 + && SETNAME_EQ(ip_set_list[i]->name, name)) {
2995 + res = -EEXIST;
2996 + goto unlock;
2997 + }
2998 + }
2999 + strncpy(set->name, name, IP_SET_MAXNAMELEN);
3000 + unlock:
3001 + write_unlock_bh(&ip_set_lock);
3002 + return res;
3003 +}
3004 +
3005 +/*
3006 + * Swap two sets so that name/index points to the other.
3007 + * References are also swapped.
3008 + */
3009 +static int
3010 +ip_set_swap(ip_set_id_t from_index, ip_set_id_t to_index)
3011 +{
3012 + struct ip_set *from = ip_set_list[from_index];
3013 + struct ip_set *to = ip_set_list[to_index];
3014 + char from_name[IP_SET_MAXNAMELEN];
3015 + u_int32_t from_ref;
3016 +
3017 + DP("set: %s to %s", from->name, to->name);
3018 + /* Features must not change.
3019 + * Not an artifical restriction anymore, as we must prevent
3020 + * possible loops created by swapping in setlist type of sets. */
3021 + if (from->type->features != to->type->features)
3022 + return -ENOEXEC;
3023 +
3024 + /* No magic here: ref munging protected by the mutex */
3025 + write_lock_bh(&ip_set_lock);
3026 + strncpy(from_name, from->name, IP_SET_MAXNAMELEN);
3027 + from_ref = atomic_read(&from->ref);
3028 +
3029 + strncpy(from->name, to->name, IP_SET_MAXNAMELEN);
3030 + atomic_set(&from->ref, atomic_read(&to->ref));
3031 + strncpy(to->name, from_name, IP_SET_MAXNAMELEN);
3032 + atomic_set(&to->ref, from_ref);
3033 +
3034 + ip_set_list[from_index] = to;
3035 + ip_set_list[to_index] = from;
3036 +
3037 + write_unlock_bh(&ip_set_lock);
3038 + return 0;
3039 +}
3040 +
3041 +/*
3042 + * List set data
3043 + */
3044 +
3045 +static inline void
3046 +__set_hash_bindings_size_list(struct ip_set_hash *set_hash,
3047 + ip_set_id_t id, u_int32_t *size)
3048 +{
3049 + if (set_hash->id == id)
3050 + *size += sizeof(struct ip_set_hash_list);
3051 +}
3052 +
3053 +static inline void
3054 +__set_hash_bindings_size_save(struct ip_set_hash *set_hash,
3055 + ip_set_id_t id, u_int32_t *size)
3056 +{
3057 + if (set_hash->id == id)
3058 + *size += sizeof(struct ip_set_hash_save);
3059 +}
3060 +
3061 +static inline void
3062 +__set_hash_bindings(struct ip_set_hash *set_hash,
3063 + ip_set_id_t id, void *data, int *used)
3064 +{
3065 + if (set_hash->id == id) {
3066 + struct ip_set_hash_list *hash_list = data + *used;
3067 +
3068 + hash_list->ip = set_hash->ip;
3069 + hash_list->binding = set_hash->binding;
3070 + *used += sizeof(struct ip_set_hash_list);
3071 + }
3072 +}
3073 +
3074 +static int ip_set_list_set(ip_set_id_t index,
3075 + void *data,
3076 + int *used,
3077 + int len)
3078 +{
3079 + struct ip_set *set = ip_set_list[index];
3080 + struct ip_set_list *set_list;
3081 +
3082 + /* Pointer to our header */
3083 + set_list = data + *used;
3084 +
3085 + DP("set: %s, used: %d %p %p", set->name, *used, data, data + *used);
3086 +
3087 + /* Get and ensure header size */
3088 + if (*used + sizeof(struct ip_set_list) > len)
3089 + goto not_enough_mem;
3090 + *used += sizeof(struct ip_set_list);
3091 +
3092 + read_lock_bh(&set->lock);
3093 + /* Get and ensure set specific header size */
3094 + set_list->header_size = set->type->header_size;
3095 + if (*used + set_list->header_size > len)
3096 + goto unlock_set;
3097 +
3098 + /* Fill in the header */
3099 + set_list->index = index;
3100 + set_list->binding = set->binding;
3101 + set_list->ref = atomic_read(&set->ref);
3102 +
3103 + /* Fill in set spefific header data */
3104 + set->type->list_header(set, data + *used);
3105 + *used += set_list->header_size;
3106 +
3107 + /* Get and ensure set specific members size */
3108 + set_list->members_size = set->type->list_members_size(set);
3109 + if (*used + set_list->members_size > len)
3110 + goto unlock_set;
3111 +
3112 + /* Fill in set spefific members data */
3113 + set->type->list_members(set, data + *used);
3114 + *used += set_list->members_size;
3115 + read_unlock_bh(&set->lock);
3116 +
3117 + /* Bindings */
3118 +
3119 + /* Get and ensure set specific bindings size */
3120 + set_list->bindings_size = 0;
3121 + FOREACH_HASH_DO(__set_hash_bindings_size_list,
3122 + set->id, &set_list->bindings_size);
3123 + if (*used + set_list->bindings_size > len)
3124 + goto not_enough_mem;
3125 +
3126 + /* Fill in set spefific bindings data */
3127 + FOREACH_HASH_DO(__set_hash_bindings, set->id, data, used);
3128 +
3129 + return 0;
3130 +
3131 + unlock_set:
3132 + read_unlock_bh(&set->lock);
3133 + not_enough_mem:
3134 + DP("not enough mem, try again");
3135 + return -EAGAIN;
3136 +}
3137 +
3138 +/*
3139 + * Save sets
3140 + */
3141 +static int ip_set_save_set(ip_set_id_t index,
3142 + void *data,
3143 + int *used,
3144 + int len)
3145 +{
3146 + struct ip_set *set;
3147 + struct ip_set_save *set_save;
3148 +
3149 + /* Pointer to our header */
3150 + set_save = data + *used;
3151 +
3152 + /* Get and ensure header size */
3153 + if (*used + sizeof(struct ip_set_save) > len)
3154 + goto not_enough_mem;
3155 + *used += sizeof(struct ip_set_save);
3156 +
3157 + set = ip_set_list[index];
3158 + DP("set: %s, used: %d(%d) %p %p", set->name, *used, len,
3159 + data, data + *used);
3160 +
3161 + read_lock_bh(&set->lock);
3162 + /* Get and ensure set specific header size */
3163 + set_save->header_size = set->type->header_size;
3164 + if (*used + set_save->header_size > len)
3165 + goto unlock_set;
3166 +
3167 + /* Fill in the header */
3168 + set_save->index = index;
3169 + set_save->binding = set->binding;
3170 +
3171 + /* Fill in set spefific header data */
3172 + set->type->list_header(set, data + *used);
3173 + *used += set_save->header_size;
3174 +
3175 + DP("set header filled: %s, used: %d(%lu) %p %p", set->name, *used,
3176 + (unsigned long)set_save->header_size, data, data + *used);
3177 + /* Get and ensure set specific members size */
3178 + set_save->members_size = set->type->list_members_size(set);
3179 + if (*used + set_save->members_size > len)
3180 + goto unlock_set;
3181 +
3182 + /* Fill in set spefific members data */
3183 + set->type->list_members(set, data + *used);
3184 + *used += set_save->members_size;
3185 + read_unlock_bh(&set->lock);
3186 + DP("set members filled: %s, used: %d(%lu) %p %p", set->name, *used,
3187 + (unsigned long)set_save->members_size, data, data + *used);
3188 + return 0;
3189 +
3190 + unlock_set:
3191 + read_unlock_bh(&set->lock);
3192 + not_enough_mem:
3193 + DP("not enough mem, try again");
3194 + return -EAGAIN;
3195 +}
3196 +
3197 +static inline void
3198 +__set_hash_save_bindings(struct ip_set_hash *set_hash,
3199 + ip_set_id_t id,
3200 + void *data,
3201 + int *used,
3202 + int len,
3203 + int *res)
3204 +{
3205 + if (*res == 0
3206 + && (id == IP_SET_INVALID_ID || set_hash->id == id)) {
3207 + struct ip_set_hash_save *hash_save = data + *used;
3208 + /* Ensure bindings size */
3209 + if (*used + sizeof(struct ip_set_hash_save) > len) {
3210 + *res = -ENOMEM;
3211 + return;
3212 + }
3213 + hash_save->id = set_hash->id;
3214 + hash_save->ip = set_hash->ip;
3215 + hash_save->binding = set_hash->binding;
3216 + *used += sizeof(struct ip_set_hash_save);
3217 + }
3218 +}
3219 +
3220 +static int ip_set_save_bindings(ip_set_id_t index,
3221 + void *data,
3222 + int *used,
3223 + int len)
3224 +{
3225 + int res = 0;
3226 + struct ip_set_save *set_save;
3227 +
3228 + DP("used %u, len %u", *used, len);
3229 + /* Get and ensure header size */
3230 + if (*used + sizeof(struct ip_set_save) > len)
3231 + return -ENOMEM;
3232 +
3233 + /* Marker */
3234 + set_save = data + *used;
3235 + set_save->index = IP_SET_INVALID_ID;
3236 + set_save->header_size = 0;
3237 + set_save->members_size = 0;
3238 + *used += sizeof(struct ip_set_save);
3239 +
3240 + DP("marker added used %u, len %u", *used, len);
3241 + /* Fill in bindings data */
3242 + if (index != IP_SET_INVALID_ID)
3243 + /* Sets are identified by id in hash */
3244 + index = ip_set_list[index]->id;
3245 + FOREACH_HASH_DO(__set_hash_save_bindings, index, data, used, len, &res);
3246 +
3247 + return res;
3248 +}
3249 +
3250 +/*
3251 + * Restore sets
3252 + */
3253 +static int ip_set_restore(void *data,
3254 + int len)
3255 +{
3256 + int res = 0;
3257 + int line = 0, used = 0, members_size;
3258 + struct ip_set *set;
3259 + struct ip_set_hash_save *hash_save;
3260 + struct ip_set_restore *set_restore;
3261 + ip_set_id_t index;
3262 +
3263 + /* Loop to restore sets */
3264 + while (1) {
3265 + line++;
3266 +
3267 + DP("%d %zu %d", used, sizeof(struct ip_set_restore), len);
3268 + /* Get and ensure header size */
3269 + if (used + sizeof(struct ip_set_restore) > len)
3270 + return line;
3271 + set_restore = data + used;
3272 + used += sizeof(struct ip_set_restore);
3273 +
3274 + /* Ensure data size */
3275 + if (used
3276 + + set_restore->header_size
3277 + + set_restore->members_size > len)
3278 + return line;
3279 +
3280 + /* Check marker */
3281 + if (set_restore->index == IP_SET_INVALID_ID) {
3282 + line--;
3283 + goto bindings;
3284 + }
3285 +
3286 + /* Try to create the set */
3287 + DP("restore %s %s", set_restore->name, set_restore->typename);
3288 + res = ip_set_create(set_restore->name,
3289 + set_restore->typename,
3290 + set_restore->index,
3291 + data + used,
3292 + set_restore->header_size);
3293 +
3294 + if (res != 0)
3295 + return line;
3296 + used += set_restore->header_size;
3297 +
3298 + index = ip_set_find_byindex(set_restore->index);
3299 + DP("index %u, restore_index %u", index, set_restore->index);
3300 + if (index != set_restore->index)
3301 + return line;
3302 + /* Try to restore members data */
3303 + set = ip_set_list[index];
3304 + members_size = 0;
3305 + DP("members_size %lu reqsize %lu",
3306 + (unsigned long)set_restore->members_size,
3307 + (unsigned long)set->type->reqsize);
3308 + while (members_size + set->type->reqsize <=
3309 + set_restore->members_size) {
3310 + line++;
3311 + DP("members: %d, line %d", members_size, line);
3312 + res = __ip_set_addip(index,
3313 + data + used + members_size,
3314 + set->type->reqsize);
3315 + if (!(res == 0 || res == -EEXIST))
3316 + return line;
3317 + members_size += set->type->reqsize;
3318 + }
3319 +
3320 + DP("members_size %lu %d",
3321 + (unsigned long)set_restore->members_size, members_size);
3322 + if (members_size != set_restore->members_size)
3323 + return line++;
3324 + used += set_restore->members_size;
3325 + }
3326 +
3327 + bindings:
3328 + /* Loop to restore bindings */
3329 + while (used < len) {
3330 + line++;
3331 +
3332 + DP("restore binding, line %u", line);
3333 + /* Get and ensure size */
3334 + if (used + sizeof(struct ip_set_hash_save) > len)
3335 + return line;
3336 + hash_save = data + used;
3337 + used += sizeof(struct ip_set_hash_save);
3338 +
3339 + /* hash_save->id is used to store the index */
3340 + index = ip_set_find_byindex(hash_save->id);
3341 + DP("restore binding index %u, id %u, %u -> %u",
3342 + index, hash_save->id, hash_save->ip, hash_save->binding);
3343 + if (index != hash_save->id)
3344 + return line;
3345 + if (ip_set_find_byindex(hash_save->binding) == IP_SET_INVALID_ID) {
3346 + DP("corrupt binding set index %u", hash_save->binding);
3347 + return line;
3348 + }
3349 + set = ip_set_list[hash_save->id];
3350 + /* Null valued IP means default binding */
3351 + if (hash_save->ip)
3352 + res = ip_set_hash_add(set->id,
3353 + hash_save->ip,
3354 + hash_save->binding);
3355 + else {
3356 + IP_SET_ASSERT(set->binding == IP_SET_INVALID_ID);
3357 + write_lock_bh(&ip_set_lock);
3358 + set->binding = hash_save->binding;
3359 + __ip_set_get(set->binding);
3360 + write_unlock_bh(&ip_set_lock);
3361 + DP("default binding: %u", set->binding);
3362 + }
3363 + if (res != 0)
3364 + return line;
3365 + }
3366 + if (used != len)
3367 + return line;
3368 +
3369 + return 0;
3370 +}
3371 +
3372 +static int
3373 +ip_set_sockfn_set(struct sock *sk, int optval, void *user, unsigned int len)
3374 +{
3375 + void *data;
3376 + int res = 0; /* Assume OK */
3377 + unsigned *op;
3378 + struct ip_set_req_adt *req_adt;
3379 + ip_set_id_t index = IP_SET_INVALID_ID;
3380 + int (*adtfn)(ip_set_id_t index,
3381 + const void *data, u_int32_t size);
3382 + struct fn_table {
3383 + int (*fn)(ip_set_id_t index,
3384 + const void *data, u_int32_t size);
3385 + } adtfn_table[] =
3386 + { { ip_set_addip }, { ip_set_delip }, { ip_set_testip},
3387 + { ip_set_bindip}, { ip_set_unbindip }, { ip_set_testbind },
3388 + };
3389 +
3390 + DP("optval=%d, user=%p, len=%d", optval, user, len);
3391 + if (!capable(CAP_NET_ADMIN))
3392 + return -EPERM;
3393 + if (optval != SO_IP_SET)
3394 + return -EBADF;
3395 + if (len <= sizeof(unsigned)) {
3396 + ip_set_printk("short userdata (want >%zu, got %u)",
3397 + sizeof(unsigned), len);
3398 + return -EINVAL;
3399 + }
3400 + data = vmalloc(len);
3401 + if (!data) {
3402 + DP("out of mem for %u bytes", len);
3403 + return -ENOMEM;
3404 + }
3405 + if (copy_from_user(data, user, len) != 0) {
3406 + res = -EFAULT;
3407 + goto done;
3408 + }
3409 + if (down_interruptible(&ip_set_app_mutex)) {
3410 + res = -EINTR;
3411 + goto done;
3412 + }
3413 +
3414 + op = (unsigned *)data;
3415 + DP("op=%x", *op);
3416 +
3417 + if (*op < IP_SET_OP_VERSION) {
3418 + /* Check the version at the beginning of operations */
3419 + struct ip_set_req_version *req_version = data;
3420 + if (req_version->version != IP_SET_PROTOCOL_VERSION) {
3421 + res = -EPROTO;
3422 + goto done;
3423 + }
3424 + }
3425 +
3426 + switch (*op) {
3427 + case IP_SET_OP_CREATE:{
3428 + struct ip_set_req_create *req_create = data;
3429 +
3430 + if (len < sizeof(struct ip_set_req_create)) {
3431 + ip_set_printk("short CREATE data (want >=%zu, got %u)",
3432 + sizeof(struct ip_set_req_create), len);
3433 + res = -EINVAL;
3434 + goto done;
3435 + }
3436 + req_create->name[IP_SET_MAXNAMELEN - 1] = '\0';
3437 + req_create->typename[IP_SET_MAXNAMELEN - 1] = '\0';
3438 + res = ip_set_create(req_create->name,
3439 + req_create->typename,
3440 + IP_SET_INVALID_ID,
3441 + data + sizeof(struct ip_set_req_create),
3442 + len - sizeof(struct ip_set_req_create));
3443 + goto done;
3444 + }
3445 + case IP_SET_OP_DESTROY:{
3446 + struct ip_set_req_std *req_destroy = data;
3447 +
3448 + if (len != sizeof(struct ip_set_req_std)) {
3449 + ip_set_printk("invalid DESTROY data (want %zu, got %u)",
3450 + sizeof(struct ip_set_req_std), len);
3451 + res = -EINVAL;
3452 + goto done;
3453 + }
3454 + if (SETNAME_EQ(req_destroy->name, IPSET_TOKEN_ALL)) {
3455 + /* Destroy all sets */
3456 + index = IP_SET_INVALID_ID;
3457 + } else {
3458 + req_destroy->name[IP_SET_MAXNAMELEN - 1] = '\0';
3459 + index = ip_set_find_byname(req_destroy->name);
3460 +
3461 + if (index == IP_SET_INVALID_ID) {
3462 + res = -ENOENT;
3463 + goto done;
3464 + }
3465 + }
3466 +
3467 + res = ip_set_destroy(index);
3468 + goto done;
3469 + }
3470 + case IP_SET_OP_FLUSH:{
3471 + struct ip_set_req_std *req_flush = data;
3472 +
3473 + if (len != sizeof(struct ip_set_req_std)) {
3474 + ip_set_printk("invalid FLUSH data (want %zu, got %u)",
3475 + sizeof(struct ip_set_req_std), len);
3476 + res = -EINVAL;
3477 + goto done;
3478 + }
3479 + if (SETNAME_EQ(req_flush->name, IPSET_TOKEN_ALL)) {
3480 + /* Flush all sets */
3481 + index = IP_SET_INVALID_ID;
3482 + } else {
3483 + req_flush->name[IP_SET_MAXNAMELEN - 1] = '\0';
3484 + index = ip_set_find_byname(req_flush->name);
3485 +
3486 + if (index == IP_SET_INVALID_ID) {
3487 + res = -ENOENT;
3488 + goto done;
3489 + }
3490 + }
3491 + res = ip_set_flush(index);
3492 + goto done;
3493 + }
3494 + case IP_SET_OP_RENAME:{
3495 + struct ip_set_req_create *req_rename = data;
3496 +
3497 + if (len != sizeof(struct ip_set_req_create)) {
3498 + ip_set_printk("invalid RENAME data (want %zu, got %u)",
3499 + sizeof(struct ip_set_req_create), len);
3500 + res = -EINVAL;
3501 + goto done;
3502 + }
3503 +
3504 + req_rename->name[IP_SET_MAXNAMELEN - 1] = '\0';
3505 + req_rename->typename[IP_SET_MAXNAMELEN - 1] = '\0';
3506 +
3507 + index = ip_set_find_byname(req_rename->name);
3508 + if (index == IP_SET_INVALID_ID) {
3509 + res = -ENOENT;
3510 + goto done;
3511 + }
3512 + res = ip_set_rename(index, req_rename->typename);
3513 + goto done;
3514 + }
3515 + case IP_SET_OP_SWAP:{
3516 + struct ip_set_req_create *req_swap = data;
3517 + ip_set_id_t to_index;
3518 +
3519 + if (len != sizeof(struct ip_set_req_create)) {
3520 + ip_set_printk("invalid SWAP data (want %zu, got %u)",
3521 + sizeof(struct ip_set_req_create), len);
3522 + res = -EINVAL;
3523 + goto done;
3524 + }
3525 +
3526 + req_swap->name[IP_SET_MAXNAMELEN - 1] = '\0';
3527 + req_swap->typename[IP_SET_MAXNAMELEN - 1] = '\0';
3528 +
3529 + index = ip_set_find_byname(req_swap->name);
3530 + if (index == IP_SET_INVALID_ID) {
3531 + res = -ENOENT;
3532 + goto done;
3533 + }
3534 + to_index = ip_set_find_byname(req_swap->typename);
3535 + if (to_index == IP_SET_INVALID_ID) {
3536 + res = -ENOENT;
3537 + goto done;
3538 + }
3539 + res = ip_set_swap(index, to_index);
3540 + goto done;
3541 + }
3542 + default:
3543 + break; /* Set identified by id */
3544 + }
3545 +
3546 + /* There we may have add/del/test/bind/unbind/test_bind operations */
3547 + if (*op < IP_SET_OP_ADD_IP || *op > IP_SET_OP_TEST_BIND_SET) {
3548 + res = -EBADMSG;
3549 + goto done;
3550 + }
3551 + adtfn = adtfn_table[*op - IP_SET_OP_ADD_IP].fn;
3552 +
3553 + if (len < sizeof(struct ip_set_req_adt)) {
3554 + ip_set_printk("short data in adt request (want >=%zu, got %u)",
3555 + sizeof(struct ip_set_req_adt), len);
3556 + res = -EINVAL;
3557 + goto done;
3558 + }
3559 + req_adt = data;
3560 +
3561 + /* -U :all: :all:|:default: uses IP_SET_INVALID_ID */
3562 + if (!(*op == IP_SET_OP_UNBIND_SET
3563 + && req_adt->index == IP_SET_INVALID_ID)) {
3564 + index = ip_set_find_byindex(req_adt->index);
3565 + if (index == IP_SET_INVALID_ID) {
3566 + res = -ENOENT;
3567 + goto done;
3568 + }
3569 + }
3570 + res = adtfn(index, data, len);
3571 +
3572 + done:
3573 + up(&ip_set_app_mutex);
3574 + vfree(data);
3575 + if (res > 0)
3576 + res = 0;
3577 + DP("final result %d", res);
3578 + return res;
3579 +}
3580 +
3581 +static int
3582 +ip_set_sockfn_get(struct sock *sk, int optval, void *user, int *len)
3583 +{
3584 + int res = 0;
3585 + unsigned *op;
3586 + ip_set_id_t index = IP_SET_INVALID_ID;
3587 + void *data;
3588 + int copylen = *len;
3589 +
3590 + DP("optval=%d, user=%p, len=%d", optval, user, *len);
3591 + if (!capable(CAP_NET_ADMIN))
3592 + return -EPERM;
3593 + if (optval != SO_IP_SET)
3594 + return -EBADF;
3595 + if (*len < sizeof(unsigned)) {
3596 + ip_set_printk("short userdata (want >=%zu, got %d)",
3597 + sizeof(unsigned), *len);
3598 + return -EINVAL;
3599 + }
3600 + data = vmalloc(*len);
3601 + if (!data) {
3602 + DP("out of mem for %d bytes", *len);
3603 + return -ENOMEM;
3604 + }
3605 + if (copy_from_user(data, user, *len) != 0) {
3606 + res = -EFAULT;
3607 + goto done;
3608 + }
3609 + if (down_interruptible(&ip_set_app_mutex)) {
3610 + res = -EINTR;
3611 + goto done;
3612 + }
3613 +
3614 + op = (unsigned *) data;
3615 + DP("op=%x", *op);
3616 +
3617 + if (*op < IP_SET_OP_VERSION) {
3618 + /* Check the version at the beginning of operations */
3619 + struct ip_set_req_version *req_version = data;
3620 + if (req_version->version != IP_SET_PROTOCOL_VERSION) {
3621 + res = -EPROTO;
3622 + goto done;
3623 + }
3624 + }
3625 +
3626 + switch (*op) {
3627 + case IP_SET_OP_VERSION: {
3628 + struct ip_set_req_version *req_version = data;
3629 +
3630 + if (*len != sizeof(struct ip_set_req_version)) {
3631 + ip_set_printk("invalid VERSION (want %zu, got %d)",
3632 + sizeof(struct ip_set_req_version),
3633 + *len);
3634 + res = -EINVAL;
3635 + goto done;
3636 + }
3637 +
3638 + req_version->version = IP_SET_PROTOCOL_VERSION;
3639 + res = copy_to_user(user, req_version,
3640 + sizeof(struct ip_set_req_version));
3641 + goto done;
3642 + }
3643 + case IP_SET_OP_GET_BYNAME: {
3644 + struct ip_set_req_get_set *req_get = data;
3645 +
3646 + if (*len != sizeof(struct ip_set_req_get_set)) {
3647 + ip_set_printk("invalid GET_BYNAME (want %zu, got %d)",
3648 + sizeof(struct ip_set_req_get_set), *len);
3649 + res = -EINVAL;
3650 + goto done;
3651 + }
3652 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
3653 + index = ip_set_find_byname(req_get->set.name);
3654 + req_get->set.index = index;
3655 + goto copy;
3656 + }
3657 + case IP_SET_OP_GET_BYINDEX: {
3658 + struct ip_set_req_get_set *req_get = data;
3659 +
3660 + if (*len != sizeof(struct ip_set_req_get_set)) {
3661 + ip_set_printk("invalid GET_BYINDEX (want %zu, got %d)",
3662 + sizeof(struct ip_set_req_get_set), *len);
3663 + res = -EINVAL;
3664 + goto done;
3665 + }
3666 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
3667 + index = ip_set_find_byindex(req_get->set.index);
3668 + strncpy(req_get->set.name,
3669 + index == IP_SET_INVALID_ID ? ""
3670 + : ip_set_list[index]->name, IP_SET_MAXNAMELEN);
3671 + goto copy;
3672 + }
3673 + case IP_SET_OP_ADT_GET: {
3674 + struct ip_set_req_adt_get *req_get = data;
3675 +
3676 + if (*len != sizeof(struct ip_set_req_adt_get)) {
3677 + ip_set_printk("invalid ADT_GET (want %zu, got %d)",
3678 + sizeof(struct ip_set_req_adt_get), *len);
3679 + res = -EINVAL;
3680 + goto done;
3681 + }
3682 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
3683 + index = ip_set_find_byname(req_get->set.name);
3684 + if (index != IP_SET_INVALID_ID) {
3685 + req_get->set.index = index;
3686 + strncpy(req_get->typename,
3687 + ip_set_list[index]->type->typename,
3688 + IP_SET_MAXNAMELEN - 1);
3689 + } else {
3690 + res = -ENOENT;
3691 + goto done;
3692 + }
3693 + goto copy;
3694 + }
3695 + case IP_SET_OP_MAX_SETS: {
3696 + struct ip_set_req_max_sets *req_max_sets = data;
3697 + ip_set_id_t i;
3698 +
3699 + if (*len != sizeof(struct ip_set_req_max_sets)) {
3700 + ip_set_printk("invalid MAX_SETS (want %zu, got %d)",
3701 + sizeof(struct ip_set_req_max_sets), *len);
3702 + res = -EINVAL;
3703 + goto done;
3704 + }
3705 +
3706 + if (SETNAME_EQ(req_max_sets->set.name, IPSET_TOKEN_ALL)) {
3707 + req_max_sets->set.index = IP_SET_INVALID_ID;
3708 + } else {
3709 + req_max_sets->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
3710 + req_max_sets->set.index =
3711 + ip_set_find_byname(req_max_sets->set.name);
3712 + if (req_max_sets->set.index == IP_SET_INVALID_ID) {
3713 + res = -ENOENT;
3714 + goto done;
3715 + }
3716 + }
3717 + req_max_sets->max_sets = ip_set_max;
3718 + req_max_sets->sets = 0;
3719 + for (i = 0; i < ip_set_max; i++) {
3720 + if (ip_set_list[i] != NULL)
3721 + req_max_sets->sets++;
3722 + }
3723 + goto copy;
3724 + }
3725 + case IP_SET_OP_LIST_SIZE:
3726 + case IP_SET_OP_SAVE_SIZE: {
3727 + struct ip_set_req_setnames *req_setnames = data;
3728 + struct ip_set_name_list *name_list;
3729 + struct ip_set *set;
3730 + ip_set_id_t i;
3731 + int used;
3732 +
3733 + if (*len < sizeof(struct ip_set_req_setnames)) {
3734 + ip_set_printk("short LIST_SIZE (want >=%zu, got %d)",
3735 + sizeof(struct ip_set_req_setnames), *len);
3736 + res = -EINVAL;
3737 + goto done;
3738 + }
3739 +
3740 + req_setnames->size = 0;
3741 + used = sizeof(struct ip_set_req_setnames);
3742 + for (i = 0; i < ip_set_max; i++) {
3743 + if (ip_set_list[i] == NULL)
3744 + continue;
3745 + name_list = data + used;
3746 + used += sizeof(struct ip_set_name_list);
3747 + if (used > copylen) {
3748 + res = -EAGAIN;
3749 + goto done;
3750 + }
3751 + set = ip_set_list[i];
3752 + /* Fill in index, name, etc. */
3753 + name_list->index = i;
3754 + name_list->id = set->id;
3755 + strncpy(name_list->name,
3756 + set->name,
3757 + IP_SET_MAXNAMELEN - 1);
3758 + strncpy(name_list->typename,
3759 + set->type->typename,
3760 + IP_SET_MAXNAMELEN - 1);
3761 + DP("filled %s of type %s, index %u\n",
3762 + name_list->name, name_list->typename,
3763 + name_list->index);
3764 + if (!(req_setnames->index == IP_SET_INVALID_ID
3765 + || req_setnames->index == i))
3766 + continue;
3767 + /* Update size */
3768 + switch (*op) {
3769 + case IP_SET_OP_LIST_SIZE: {
3770 + req_setnames->size += sizeof(struct ip_set_list)
3771 + + set->type->header_size
3772 + + set->type->list_members_size(set);
3773 + /* Sets are identified by id in the hash */
3774 + FOREACH_HASH_DO(__set_hash_bindings_size_list,
3775 + set->id, &req_setnames->size);
3776 + break;
3777 + }
3778 + case IP_SET_OP_SAVE_SIZE: {
3779 + req_setnames->size += sizeof(struct ip_set_save)
3780 + + set->type->header_size
3781 + + set->type->list_members_size(set);
3782 + FOREACH_HASH_DO(__set_hash_bindings_size_save,
3783 + set->id, &req_setnames->size);
3784 + break;
3785 + }
3786 + default:
3787 + break;
3788 + }
3789 + }
3790 + if (copylen != used) {
3791 + res = -EAGAIN;
3792 + goto done;
3793 + }
3794 + goto copy;
3795 + }
3796 + case IP_SET_OP_LIST: {
3797 + struct ip_set_req_list *req_list = data;
3798 + ip_set_id_t i;
3799 + int used;
3800 +
3801 + if (*len < sizeof(struct ip_set_req_list)) {
3802 + ip_set_printk("short LIST (want >=%zu, got %d)",
3803 + sizeof(struct ip_set_req_list), *len);
3804 + res = -EINVAL;
3805 + goto done;
3806 + }
3807 + index = req_list->index;
3808 + if (index != IP_SET_INVALID_ID
3809 + && ip_set_find_byindex(index) != index) {
3810 + res = -ENOENT;
3811 + goto done;
3812 + }
3813 + used = 0;
3814 + if (index == IP_SET_INVALID_ID) {
3815 + /* List all sets */
3816 + for (i = 0; i < ip_set_max && res == 0; i++) {
3817 + if (ip_set_list[i] != NULL)
3818 + res = ip_set_list_set(i, data, &used, *len);
3819 + }
3820 + } else {
3821 + /* List an individual set */
3822 + res = ip_set_list_set(index, data, &used, *len);
3823 + }
3824 + if (res != 0)
3825 + goto done;
3826 + else if (copylen != used) {
3827 + res = -EAGAIN;
3828 + goto done;
3829 + }
3830 + goto copy;
3831 + }
3832 + case IP_SET_OP_SAVE: {
3833 + struct ip_set_req_list *req_save = data;
3834 + ip_set_id_t i;
3835 + int used;
3836 +
3837 + if (*len < sizeof(struct ip_set_req_list)) {
3838 + ip_set_printk("short SAVE (want >=%zu, got %d)",
3839 + sizeof(struct ip_set_req_list), *len);
3840 + res = -EINVAL;
3841 + goto done;
3842 + }
3843 + index = req_save->index;
3844 + if (index != IP_SET_INVALID_ID
3845 + && ip_set_find_byindex(index) != index) {
3846 + res = -ENOENT;
3847 + goto done;
3848 + }
3849 +
3850 +#define SETLIST(set) (strcmp(set->type->typename, "setlist") == 0)
3851 +
3852 + used = 0;
3853 + if (index == IP_SET_INVALID_ID) {
3854 + /* Save all sets: ugly setlist type dependency */
3855 + int setlist = 0;
3856 + setlists:
3857 + for (i = 0; i < ip_set_max && res == 0; i++) {
3858 + if (ip_set_list[i] != NULL
3859 + && !(setlist ^ SETLIST(ip_set_list[i])))
3860 + res = ip_set_save_set(i, data, &used, *len);
3861 + }
3862 + if (!setlist) {
3863 + setlist = 1;
3864 + goto setlists;
3865 + }
3866 + } else {
3867 + /* Save an individual set */
3868 + res = ip_set_save_set(index, data, &used, *len);
3869 + }
3870 + if (res == 0)
3871 + res = ip_set_save_bindings(index, data, &used, *len);
3872 +
3873 + if (res != 0)
3874 + goto done;
3875 + else if (copylen != used) {
3876 + res = -EAGAIN;
3877 + goto done;
3878 + }
3879 + goto copy;
3880 + }
3881 + case IP_SET_OP_RESTORE: {
3882 + struct ip_set_req_setnames *req_restore = data;
3883 + int line;
3884 +
3885 + if (*len < sizeof(struct ip_set_req_setnames)
3886 + || *len != req_restore->size) {
3887 + ip_set_printk("invalid RESTORE (want =%lu, got %d)",
3888 + (long unsigned)req_restore->size, *len);
3889 + res = -EINVAL;
3890 + goto done;
3891 + }
3892 + line = ip_set_restore(data + sizeof(struct ip_set_req_setnames),
3893 + req_restore->size - sizeof(struct ip_set_req_setnames));
3894 + DP("ip_set_restore: %d", line);
3895 + if (line != 0) {
3896 + res = -EAGAIN;
3897 + req_restore->size = line;
3898 + copylen = sizeof(struct ip_set_req_setnames);
3899 + goto copy;
3900 + }
3901 + goto done;
3902 + }
3903 + default:
3904 + res = -EBADMSG;
3905 + goto done;
3906 + } /* end of switch(op) */
3907 +
3908 + copy:
3909 + DP("set %s, copylen %d", index != IP_SET_INVALID_ID
3910 + && ip_set_list[index]
3911 + ? ip_set_list[index]->name
3912 + : ":all:", copylen);
3913 + res = copy_to_user(user, data, copylen);
3914 +
3915 + done:
3916 + up(&ip_set_app_mutex);
3917 + vfree(data);
3918 + if (res > 0)
3919 + res = 0;
3920 + DP("final result %d", res);
3921 + return res;
3922 +}
3923 +
3924 +static struct nf_sockopt_ops so_set = {
3925 + .pf = PF_INET,
3926 + .set_optmin = SO_IP_SET,
3927 + .set_optmax = SO_IP_SET + 1,
3928 + .set = &ip_set_sockfn_set,
3929 + .get_optmin = SO_IP_SET,
3930 + .get_optmax = SO_IP_SET + 1,
3931 + .get = &ip_set_sockfn_get,
3932 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,23)
3933 + .use = 0,
3934 +#else
3935 + .owner = THIS_MODULE,
3936 +#endif
3937 +};
3938 +
3939 +static int max_sets, hash_size;
3940 +
3941 +module_param(max_sets, int, 0600);
3942 +MODULE_PARM_DESC(max_sets, "maximal number of sets");
3943 +module_param(hash_size, int, 0600);
3944 +MODULE_PARM_DESC(hash_size, "hash size for bindings");
3945 +MODULE_LICENSE("GPL");
3946 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
3947 +MODULE_DESCRIPTION("module implementing core IP set support");
3948 +
3949 +static int __init ip_set_init(void)
3950 +{
3951 + int res;
3952 + ip_set_id_t i;
3953 +
3954 + get_random_bytes(&ip_set_hash_random, 4);
3955 + if (max_sets)
3956 + ip_set_max = max_sets;
3957 + ip_set_list = vmalloc(sizeof(struct ip_set *) * ip_set_max);
3958 + if (!ip_set_list) {
3959 + printk(KERN_ERR "Unable to create ip_set_list\n");
3960 + return -ENOMEM;
3961 + }
3962 + memset(ip_set_list, 0, sizeof(struct ip_set *) * ip_set_max);
3963 + if (hash_size)
3964 + ip_set_bindings_hash_size = hash_size;
3965 + ip_set_hash = vmalloc(sizeof(struct list_head) * ip_set_bindings_hash_size);
3966 + if (!ip_set_hash) {
3967 + printk(KERN_ERR "Unable to create ip_set_hash\n");
3968 + vfree(ip_set_list);
3969 + return -ENOMEM;
3970 + }
3971 + for (i = 0; i < ip_set_bindings_hash_size; i++)
3972 + INIT_LIST_HEAD(&ip_set_hash[i]);
3973 +
3974 + INIT_LIST_HEAD(&set_type_list);
3975 +
3976 + res = nf_register_sockopt(&so_set);
3977 + if (res != 0) {
3978 + ip_set_printk("SO_SET registry failed: %d", res);
3979 + vfree(ip_set_list);
3980 + vfree(ip_set_hash);
3981 + return res;
3982 + }
3983 +
3984 + return 0;
3985 +}
3986 +
3987 +static void __exit ip_set_fini(void)
3988 +{
3989 + /* There can't be any existing set or binding */
3990 + nf_unregister_sockopt(&so_set);
3991 + vfree(ip_set_list);
3992 + vfree(ip_set_hash);
3993 + DP("these are the famous last words");
3994 +}
3995 +
3996 +EXPORT_SYMBOL(ip_set_register_set_type);
3997 +EXPORT_SYMBOL(ip_set_unregister_set_type);
3998 +
3999 +EXPORT_SYMBOL(ip_set_get_byname);
4000 +EXPORT_SYMBOL(ip_set_get_byindex);
4001 +EXPORT_SYMBOL(ip_set_put_byindex);
4002 +EXPORT_SYMBOL(ip_set_id);
4003 +EXPORT_SYMBOL(__ip_set_get_byname);
4004 +EXPORT_SYMBOL(__ip_set_put_byindex);
4005 +
4006 +EXPORT_SYMBOL(ip_set_addip_kernel);
4007 +EXPORT_SYMBOL(ip_set_delip_kernel);
4008 +EXPORT_SYMBOL(ip_set_testip_kernel);
4009 +
4010 +module_init(ip_set_init);
4011 +module_exit(ip_set_fini);
4012 --- /dev/null
4013 +++ b/net/ipv4/netfilter/ip_set_iphash.c
4014 @@ -0,0 +1,166 @@
4015 +/* Copyright (C) 2003-2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
4016 + *
4017 + * This program is free software; you can redistribute it and/or modify
4018 + * it under the terms of the GNU General Public License version 2 as
4019 + * published by the Free Software Foundation.
4020 + */
4021 +
4022 +/* Kernel module implementing an ip hash set */
4023 +
4024 +#include <linux/module.h>
4025 +#include <linux/moduleparam.h>
4026 +#include <linux/ip.h>
4027 +#include <linux/skbuff.h>
4028 +#include <linux/netfilter_ipv4/ip_set_jhash.h>
4029 +#include <linux/errno.h>
4030 +#include <asm/uaccess.h>
4031 +#include <asm/bitops.h>
4032 +#include <linux/spinlock.h>
4033 +#include <linux/random.h>
4034 +
4035 +#include <net/ip.h>
4036 +
4037 +#include <linux/netfilter_ipv4/ip_set_iphash.h>
4038 +
4039 +static int limit = MAX_RANGE;
4040 +
4041 +static inline __u32
4042 +iphash_id(struct ip_set *set, ip_set_ip_t *hash_ip, ip_set_ip_t ip)
4043 +{
4044 + struct ip_set_iphash *map = set->data;
4045 + __u32 id;
4046 + u_int16_t i;
4047 + ip_set_ip_t *elem;
4048 +
4049 + *hash_ip = ip & map->netmask;
4050 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u, %u.%u.%u.%u",
4051 + set->name, HIPQUAD(ip), HIPQUAD(*hash_ip), HIPQUAD(map->netmask));
4052 +
4053 + for (i = 0; i < map->probes; i++) {
4054 + id = jhash_ip(map, i, *hash_ip) % map->hashsize;
4055 + DP("hash key: %u", id);
4056 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
4057 + if (*elem == *hash_ip)
4058 + return id;
4059 + /* No shortcut - there can be deleted entries. */
4060 + }
4061 + return UINT_MAX;
4062 +}
4063 +
4064 +static inline int
4065 +iphash_test(struct ip_set *set, ip_set_ip_t *hash_ip, ip_set_ip_t ip)
4066 +{
4067 + return (ip && iphash_id(set, hash_ip, ip) != UINT_MAX);
4068 +}
4069 +
4070 +#define KADT_CONDITION
4071 +
4072 +UADT(iphash, test)
4073 +KADT(iphash, test, ipaddr)
4074 +
4075 +static inline int
4076 +__iphash_add(struct ip_set_iphash *map, ip_set_ip_t *ip)
4077 +{
4078 + __u32 probe;
4079 + u_int16_t i;
4080 + ip_set_ip_t *elem, *slot = NULL;
4081 +
4082 + for (i = 0; i < map->probes; i++) {
4083 + probe = jhash_ip(map, i, *ip) % map->hashsize;
4084 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, probe);
4085 + if (*elem == *ip)
4086 + return -EEXIST;
4087 + if (!(slot || *elem))
4088 + slot = elem;
4089 + /* There can be deleted entries, must check all slots */
4090 + }
4091 + if (slot) {
4092 + *slot = *ip;
4093 + map->elements++;
4094 + return 0;
4095 + }
4096 + /* Trigger rehashing */
4097 + return -EAGAIN;
4098 +}
4099 +
4100 +static inline int
4101 +iphash_add(struct ip_set *set, ip_set_ip_t *hash_ip, ip_set_ip_t ip)
4102 +{
4103 + struct ip_set_iphash *map = set->data;
4104 +
4105 + if (!ip || map->elements >= limit)
4106 + return -ERANGE;
4107 +
4108 + *hash_ip = ip & map->netmask;
4109 +
4110 + return __iphash_add(map, hash_ip);
4111 +}
4112 +
4113 +UADT(iphash, add)
4114 +KADT(iphash, add, ipaddr)
4115 +
4116 +static inline void
4117 +__iphash_retry(struct ip_set_iphash *tmp, struct ip_set_iphash *map)
4118 +{
4119 + tmp->netmask = map->netmask;
4120 +}
4121 +
4122 +HASH_RETRY(iphash, ip_set_ip_t)
4123 +
4124 +static inline int
4125 +iphash_del(struct ip_set *set, ip_set_ip_t *hash_ip, ip_set_ip_t ip)
4126 +{
4127 + struct ip_set_iphash *map = set->data;
4128 + ip_set_ip_t id, *elem;
4129 +
4130 + if (!ip)
4131 + return -ERANGE;
4132 +
4133 + id = iphash_id(set, hash_ip, ip);
4134 + if (id == UINT_MAX)
4135 + return -EEXIST;
4136 +
4137 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
4138 + *elem = 0;
4139 + map->elements--;
4140 +
4141 + return 0;
4142 +}
4143 +
4144 +UADT(iphash, del)
4145 +KADT(iphash, del, ipaddr)
4146 +
4147 +static inline int
4148 +__iphash_create(const struct ip_set_req_iphash_create *req,
4149 + struct ip_set_iphash *map)
4150 +{
4151 + map->netmask = req->netmask;
4152 +
4153 + return 0;
4154 +}
4155 +
4156 +HASH_CREATE(iphash, ip_set_ip_t)
4157 +HASH_DESTROY(iphash)
4158 +
4159 +HASH_FLUSH(iphash, ip_set_ip_t)
4160 +
4161 +static inline void
4162 +__iphash_list_header(const struct ip_set_iphash *map,
4163 + struct ip_set_req_iphash_create *header)
4164 +{
4165 + header->netmask = map->netmask;
4166 +}
4167 +
4168 +HASH_LIST_HEADER(iphash)
4169 +HASH_LIST_MEMBERS_SIZE(iphash, ip_set_ip_t)
4170 +HASH_LIST_MEMBERS(iphash, ip_set_ip_t)
4171 +
4172 +IP_SET_RTYPE(iphash, IPSET_TYPE_IP | IPSET_DATA_SINGLE)
4173 +
4174 +MODULE_LICENSE("GPL");
4175 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
4176 +MODULE_DESCRIPTION("iphash type of IP sets");
4177 +module_param(limit, int, 0600);
4178 +MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
4179 +
4180 +REGISTER_MODULE(iphash)
4181 --- /dev/null
4182 +++ b/net/ipv4/netfilter/ip_set_ipmap.c
4183 @@ -0,0 +1,142 @@
4184 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
4185 + * Patrick Schaaf <bof@bof.de>
4186 + * Copyright (C) 2003-2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
4187 + *
4188 + * This program is free software; you can redistribute it and/or modify
4189 + * it under the terms of the GNU General Public License version 2 as
4190 + * published by the Free Software Foundation.
4191 + */
4192 +
4193 +/* Kernel module implementing an IP set type: the single bitmap type */
4194 +
4195 +#include <linux/module.h>
4196 +#include <linux/ip.h>
4197 +#include <linux/skbuff.h>
4198 +#include <linux/errno.h>
4199 +#include <asm/uaccess.h>
4200 +#include <asm/bitops.h>
4201 +#include <linux/spinlock.h>
4202 +
4203 +#include <linux/netfilter_ipv4/ip_set_ipmap.h>
4204 +
4205 +static inline ip_set_ip_t
4206 +ip_to_id(const struct ip_set_ipmap *map, ip_set_ip_t ip)
4207 +{
4208 + return (ip - map->first_ip)/map->hosts;
4209 +}
4210 +
4211 +static inline int
4212 +ipmap_test(const struct ip_set *set, ip_set_ip_t *hash_ip, ip_set_ip_t ip)
4213 +{
4214 + const struct ip_set_ipmap *map = set->data;
4215 +
4216 + if (ip < map->first_ip || ip > map->last_ip)
4217 + return -ERANGE;
4218 +
4219 + *hash_ip = ip & map->netmask;
4220 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u",
4221 + set->name, HIPQUAD(ip), HIPQUAD(*hash_ip));
4222 + return !!test_bit(ip_to_id(map, *hash_ip), map->members);
4223 +}
4224 +
4225 +#define KADT_CONDITION
4226 +
4227 +UADT(ipmap, test)
4228 +KADT(ipmap, test, ipaddr)
4229 +
4230 +static inline int
4231 +ipmap_add(struct ip_set *set, ip_set_ip_t *hash_ip, ip_set_ip_t ip)
4232 +{
4233 + struct ip_set_ipmap *map = set->data;
4234 +
4235 + if (ip < map->first_ip || ip > map->last_ip)
4236 + return -ERANGE;
4237 +
4238 + *hash_ip = ip & map->netmask;
4239 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
4240 + if (test_and_set_bit(ip_to_id(map, *hash_ip), map->members))
4241 + return -EEXIST;
4242 +
4243 + return 0;
4244 +}
4245 +
4246 +UADT(ipmap, add)
4247 +KADT(ipmap, add, ipaddr)
4248 +
4249 +static inline int
4250 +ipmap_del(struct ip_set *set, ip_set_ip_t *hash_ip, ip_set_ip_t ip)
4251 +{
4252 + struct ip_set_ipmap *map = set->data;
4253 +
4254 + if (ip < map->first_ip || ip > map->last_ip)
4255 + return -ERANGE;
4256 +
4257 + *hash_ip = ip & map->netmask;
4258 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
4259 + if (!test_and_clear_bit(ip_to_id(map, *hash_ip), map->members))
4260 + return -EEXIST;
4261 +
4262 + return 0;
4263 +}
4264 +
4265 +UADT(ipmap, del)
4266 +KADT(ipmap, del, ipaddr)
4267 +
4268 +static inline int
4269 +__ipmap_create(const struct ip_set_req_ipmap_create *req,
4270 + struct ip_set_ipmap *map)
4271 +{
4272 + map->netmask = req->netmask;
4273 +
4274 + if (req->netmask == 0xFFFFFFFF) {
4275 + map->hosts = 1;
4276 + map->sizeid = map->last_ip - map->first_ip + 1;
4277 + } else {
4278 + unsigned int mask_bits, netmask_bits;
4279 + ip_set_ip_t mask;
4280 +
4281 + map->first_ip &= map->netmask; /* Should we better bark? */
4282 +
4283 + mask = range_to_mask(map->first_ip, map->last_ip, &mask_bits);
4284 + netmask_bits = mask_to_bits(map->netmask);
4285 +
4286 + if ((!mask && (map->first_ip || map->last_ip != 0xFFFFFFFF))
4287 + || netmask_bits <= mask_bits)
4288 + return -ENOEXEC;
4289 +
4290 + DP("mask_bits %u, netmask_bits %u",
4291 + mask_bits, netmask_bits);
4292 + map->hosts = 2 << (32 - netmask_bits - 1);
4293 + map->sizeid = 2 << (netmask_bits - mask_bits - 1);
4294 + }
4295 + if (map->sizeid > MAX_RANGE + 1) {
4296 + ip_set_printk("range too big, %d elements (max %d)",
4297 + map->sizeid, MAX_RANGE+1);
4298 + return -ENOEXEC;
4299 + }
4300 + DP("hosts %u, sizeid %u", map->hosts, map->sizeid);
4301 + return bitmap_bytes(0, map->sizeid - 1);
4302 +}
4303 +
4304 +BITMAP_CREATE(ipmap)
4305 +BITMAP_DESTROY(ipmap)
4306 +BITMAP_FLUSH(ipmap)
4307 +
4308 +static inline void
4309 +__ipmap_list_header(const struct ip_set_ipmap *map,
4310 + struct ip_set_req_ipmap_create *header)
4311 +{
4312 + header->netmask = map->netmask;
4313 +}
4314 +
4315 +BITMAP_LIST_HEADER(ipmap)
4316 +BITMAP_LIST_MEMBERS_SIZE(ipmap)
4317 +BITMAP_LIST_MEMBERS(ipmap)
4318 +
4319 +IP_SET_TYPE(ipmap, IPSET_TYPE_IP | IPSET_DATA_SINGLE)
4320 +
4321 +MODULE_LICENSE("GPL");
4322 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
4323 +MODULE_DESCRIPTION("ipmap type of IP sets");
4324 +
4325 +REGISTER_MODULE(ipmap)
4326 --- /dev/null
4327 +++ b/net/ipv4/netfilter/ip_set_ipporthash.c
4328 @@ -0,0 +1,203 @@
4329 +/* Copyright (C) 2003-2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
4330 + *
4331 + * This program is free software; you can redistribute it and/or modify
4332 + * it under the terms of the GNU General Public License version 2 as
4333 + * published by the Free Software Foundation.
4334 + */
4335 +
4336 +/* Kernel module implementing an ip+port hash set */
4337 +
4338 +#include <linux/module.h>
4339 +#include <linux/moduleparam.h>
4340 +#include <linux/ip.h>
4341 +#include <linux/tcp.h>
4342 +#include <linux/udp.h>
4343 +#include <linux/skbuff.h>
4344 +#include <linux/netfilter_ipv4/ip_set_jhash.h>
4345 +#include <linux/errno.h>
4346 +#include <asm/uaccess.h>
4347 +#include <asm/bitops.h>
4348 +#include <linux/spinlock.h>
4349 +#include <linux/random.h>
4350 +
4351 +#include <net/ip.h>
4352 +
4353 +#include <linux/netfilter_ipv4/ip_set_ipporthash.h>
4354 +#include <linux/netfilter_ipv4/ip_set_getport.h>
4355 +
4356 +static int limit = MAX_RANGE;
4357 +
4358 +static inline __u32
4359 +ipporthash_id(struct ip_set *set, ip_set_ip_t *hash_ip,
4360 + ip_set_ip_t ip, ip_set_ip_t port)
4361 +{
4362 + struct ip_set_ipporthash *map = set->data;
4363 + __u32 id;
4364 + u_int16_t i;
4365 + ip_set_ip_t *elem;
4366 +
4367 + *hash_ip = pack_ip_port(map, ip, port);
4368 +
4369 + DP("set: %s, ipport:%u.%u.%u.%u:%u, %u.%u.%u.%u",
4370 + set->name, HIPQUAD(ip), port, HIPQUAD(*hash_ip));
4371 + if (!*hash_ip)
4372 + return UINT_MAX;
4373 +
4374 + for (i = 0; i < map->probes; i++) {
4375 + id = jhash_ip(map, i, *hash_ip) % map->hashsize;
4376 + DP("hash key: %u", id);
4377 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
4378 + if (*elem == *hash_ip)
4379 + return id;
4380 + /* No shortcut - there can be deleted entries. */
4381 + }
4382 + return UINT_MAX;
4383 +}
4384 +
4385 +static inline int
4386 +ipporthash_test(struct ip_set *set, ip_set_ip_t *hash_ip,
4387 + ip_set_ip_t ip, ip_set_ip_t port)
4388 +{
4389 + struct ip_set_ipporthash *map = set->data;
4390 +
4391 + if (ip < map->first_ip || ip > map->last_ip)
4392 + return -ERANGE;
4393 +
4394 + return (ipporthash_id(set, hash_ip, ip, port) != UINT_MAX);
4395 +}
4396 +
4397 +#define KADT_CONDITION \
4398 + ip_set_ip_t port; \
4399 + \
4400 + if (flags[index+1] == 0) \
4401 + return 0; \
4402 + \
4403 + port = get_port(skb, flags[index+1]); \
4404 + \
4405 + if (port == INVALID_PORT) \
4406 + return 0;
4407 +
4408 +UADT(ipporthash, test, req->port)
4409 +KADT(ipporthash, test, ipaddr, port)
4410 +
4411 +static inline int
4412 +__ipporthash_add(struct ip_set_ipporthash *map, ip_set_ip_t *ip)
4413 +{
4414 + __u32 probe;
4415 + u_int16_t i;
4416 + ip_set_ip_t *elem, *slot = NULL;
4417 +
4418 + for (i = 0; i < map->probes; i++) {
4419 + probe = jhash_ip(map, i, *ip) % map->hashsize;
4420 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, probe);
4421 + if (*elem == *ip)
4422 + return -EEXIST;
4423 + if (!(slot || *elem))
4424 + slot = elem;
4425 + /* There can be deleted entries, must check all slots */
4426 + }
4427 + if (slot) {
4428 + *slot = *ip;
4429 + map->elements++;
4430 + return 0;
4431 + }
4432 + /* Trigger rehashing */
4433 + return -EAGAIN;
4434 +}
4435 +
4436 +static inline int
4437 +ipporthash_add(struct ip_set *set, ip_set_ip_t *hash_ip,
4438 + ip_set_ip_t ip, ip_set_ip_t port)
4439 +{
4440 + struct ip_set_ipporthash *map = set->data;
4441 + if (map->elements > limit)
4442 + return -ERANGE;
4443 + if (ip < map->first_ip || ip > map->last_ip)
4444 + return -ERANGE;
4445 +
4446 + *hash_ip = pack_ip_port(map, ip, port);
4447 +
4448 + if (!*hash_ip)
4449 + return -ERANGE;
4450 +
4451 + return __ipporthash_add(map, hash_ip);
4452 +}
4453 +
4454 +UADT(ipporthash, add, req->port)
4455 +KADT(ipporthash, add, ipaddr, port)
4456 +
4457 +static inline void
4458 +__ipporthash_retry(struct ip_set_ipporthash *tmp,
4459 + struct ip_set_ipporthash *map)
4460 +{
4461 + tmp->first_ip = map->first_ip;
4462 + tmp->last_ip = map->last_ip;
4463 +}
4464 +
4465 +HASH_RETRY(ipporthash, ip_set_ip_t)
4466 +
4467 +static inline int
4468 +ipporthash_del(struct ip_set *set, ip_set_ip_t *hash_ip,
4469 + ip_set_ip_t ip, ip_set_ip_t port)
4470 +{
4471 + struct ip_set_ipporthash *map = set->data;
4472 + ip_set_ip_t id;
4473 + ip_set_ip_t *elem;
4474 +
4475 + if (ip < map->first_ip || ip > map->last_ip)
4476 + return -ERANGE;
4477 +
4478 + id = ipporthash_id(set, hash_ip, ip, port);
4479 +
4480 + if (id == UINT_MAX)
4481 + return -EEXIST;
4482 +
4483 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
4484 + *elem = 0;
4485 + map->elements--;
4486 +
4487 + return 0;
4488 +}
4489 +
4490 +UADT(ipporthash, del, req->port)
4491 +KADT(ipporthash, del, ipaddr, port)
4492 +
4493 +static inline int
4494 +__ipporthash_create(const struct ip_set_req_ipporthash_create *req,
4495 + struct ip_set_ipporthash *map)
4496 +{
4497 + if (req->to - req->from > MAX_RANGE) {
4498 + ip_set_printk("range too big, %d elements (max %d)",
4499 + req->to - req->from + 1, MAX_RANGE+1);
4500 + return -ENOEXEC;
4501 + }
4502 + map->first_ip = req->from;
4503 + map->last_ip = req->to;
4504 + return 0;
4505 +}
4506 +
4507 +HASH_CREATE(ipporthash, ip_set_ip_t)
4508 +HASH_DESTROY(ipporthash)
4509 +HASH_FLUSH(ipporthash, ip_set_ip_t)
4510 +
4511 +static inline void
4512 +__ipporthash_list_header(const struct ip_set_ipporthash *map,
4513 + struct ip_set_req_ipporthash_create *header)
4514 +{
4515 + header->from = map->first_ip;
4516 + header->to = map->last_ip;
4517 +}
4518 +
4519 +HASH_LIST_HEADER(ipporthash)
4520 +HASH_LIST_MEMBERS_SIZE(ipporthash, ip_set_ip_t)
4521 +HASH_LIST_MEMBERS(ipporthash, ip_set_ip_t)
4522 +
4523 +IP_SET_RTYPE(ipporthash, IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_DATA_DOUBLE)
4524 +
4525 +MODULE_LICENSE("GPL");
4526 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
4527 +MODULE_DESCRIPTION("ipporthash type of IP sets");
4528 +module_param(limit, int, 0600);
4529 +MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
4530 +
4531 +REGISTER_MODULE(ipporthash)
4532 --- /dev/null
4533 +++ b/net/ipv4/netfilter/ip_set_ipportiphash.c
4534 @@ -0,0 +1,216 @@
4535 +/* Copyright (C) 2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
4536 + *
4537 + * This program is free software; you can redistribute it and/or modify
4538 + * it under the terms of the GNU General Public License version 2 as
4539 + * published by the Free Software Foundation.
4540 + */
4541 +
4542 +/* Kernel module implementing an ip+port+ip hash set */
4543 +
4544 +#include <linux/module.h>
4545 +#include <linux/moduleparam.h>
4546 +#include <linux/ip.h>
4547 +#include <linux/tcp.h>
4548 +#include <linux/udp.h>
4549 +#include <linux/skbuff.h>
4550 +#include <linux/netfilter_ipv4/ip_set_jhash.h>
4551 +#include <linux/errno.h>
4552 +#include <asm/uaccess.h>
4553 +#include <asm/bitops.h>
4554 +#include <linux/spinlock.h>
4555 +#include <linux/random.h>
4556 +
4557 +#include <net/ip.h>
4558 +
4559 +#include <linux/netfilter_ipv4/ip_set_ipportiphash.h>
4560 +#include <linux/netfilter_ipv4/ip_set_getport.h>
4561 +
4562 +static int limit = MAX_RANGE;
4563 +
4564 +#define jhash_ip2(map, i, ipport, ip1) \
4565 + jhash_2words(ipport, ip1, *(map->initval + i))
4566 +
4567 +static inline __u32
4568 +ipportiphash_id(struct ip_set *set, ip_set_ip_t *hash_ip,
4569 + ip_set_ip_t ip, ip_set_ip_t port, ip_set_ip_t ip1)
4570 +{
4571 + struct ip_set_ipportiphash *map = set->data;
4572 + __u32 id;
4573 + u_int16_t i;
4574 + struct ipportip *elem;
4575 +
4576 + *hash_ip = pack_ip_port(map, ip, port);
4577 + DP("set: %s, ipport:%u.%u.%u.%u:%u, %u.%u.%u.%u",
4578 + set->name, HIPQUAD(ip), port, HIPQUAD(*hash_ip));
4579 + if (!(*hash_ip || ip1))
4580 + return UINT_MAX;
4581 +
4582 + for (i = 0; i < map->probes; i++) {
4583 + id = jhash_ip2(map, i, *hash_ip, ip1) % map->hashsize;
4584 + DP("hash key: %u", id);
4585 + elem = HARRAY_ELEM(map->members, struct ipportip *, id);
4586 + if (elem->ip == *hash_ip && elem->ip1 == ip1)
4587 + return id;
4588 + /* No shortcut - there can be deleted entries. */
4589 + }
4590 + return UINT_MAX;
4591 +}
4592 +
4593 +static inline int
4594 +ipportiphash_test(struct ip_set *set, ip_set_ip_t *hash_ip,
4595 + ip_set_ip_t ip, ip_set_ip_t port, ip_set_ip_t ip1)
4596 +{
4597 + struct ip_set_ipportiphash *map = set->data;
4598 +
4599 + if (ip < map->first_ip || ip > map->last_ip)
4600 + return -ERANGE;
4601 +
4602 + return (ipportiphash_id(set, hash_ip, ip, port, ip1) != UINT_MAX);
4603 +}
4604 +
4605 +#define KADT_CONDITION \
4606 + ip_set_ip_t port, ip1; \
4607 + \
4608 + if (flags[index+2] == 0) \
4609 + return 0; \
4610 + \
4611 + port = get_port(skb, flags[index+1]); \
4612 + ip1 = ipaddr(skb, flags[index+2]); \
4613 + \
4614 + if (port == INVALID_PORT) \
4615 + return 0;
4616 +
4617 +UADT(ipportiphash, test, req->port, req->ip1)
4618 +KADT(ipportiphash, test, ipaddr, port, ip1)
4619 +
4620 +static inline int
4621 +__ipportip_add(struct ip_set_ipportiphash *map,
4622 + ip_set_ip_t hash_ip, ip_set_ip_t ip1)
4623 +{
4624 + __u32 probe;
4625 + u_int16_t i;
4626 + struct ipportip *elem, *slot = NULL;
4627 +
4628 + for (i = 0; i < map->probes; i++) {
4629 + probe = jhash_ip2(map, i, hash_ip, ip1) % map->hashsize;
4630 + elem = HARRAY_ELEM(map->members, struct ipportip *, probe);
4631 + if (elem->ip == hash_ip && elem->ip1 == ip1)
4632 + return -EEXIST;
4633 + if (!(slot || elem->ip || elem->ip1))
4634 + slot = elem;
4635 + /* There can be deleted entries, must check all slots */
4636 + }
4637 + if (slot) {
4638 + slot->ip = hash_ip;
4639 + slot->ip1 = ip1;
4640 + map->elements++;
4641 + return 0;
4642 + }
4643 + /* Trigger rehashing */
4644 + return -EAGAIN;
4645 +}
4646 +
4647 +static inline int
4648 +__ipportiphash_add(struct ip_set_ipportiphash *map,
4649 + struct ipportip *elem)
4650 +{
4651 + return __ipportip_add(map, elem->ip, elem->ip1);
4652 +}
4653 +
4654 +static inline int
4655 +ipportiphash_add(struct ip_set *set, ip_set_ip_t *hash_ip,
4656 + ip_set_ip_t ip, ip_set_ip_t port, ip_set_ip_t ip1)
4657 +{
4658 + struct ip_set_ipportiphash *map = set->data;
4659 +
4660 + if (map->elements > limit)
4661 + return -ERANGE;
4662 + if (ip < map->first_ip || ip > map->last_ip)
4663 + return -ERANGE;
4664 +
4665 + *hash_ip = pack_ip_port(map, ip, port);
4666 + if (!(*hash_ip || ip1))
4667 + return -ERANGE;
4668 +
4669 + return __ipportip_add(map, *hash_ip, ip1);
4670 +}
4671 +
4672 +UADT(ipportiphash, add, req->port, req->ip1)
4673 +KADT(ipportiphash, add, ipaddr, port, ip1)
4674 +
4675 +static inline void
4676 +__ipportiphash_retry(struct ip_set_ipportiphash *tmp,
4677 + struct ip_set_ipportiphash *map)
4678 +{
4679 + tmp->first_ip = map->first_ip;
4680 + tmp->last_ip = map->last_ip;
4681 +}
4682 +
4683 +HASH_RETRY2(ipportiphash, struct ipportip)
4684 +
4685 +static inline int
4686 +ipportiphash_del(struct ip_set *set, ip_set_ip_t *hash_ip,
4687 + ip_set_ip_t ip, ip_set_ip_t port, ip_set_ip_t ip1)
4688 +{
4689 + struct ip_set_ipportiphash *map = set->data;
4690 + ip_set_ip_t id;
4691 + struct ipportip *elem;
4692 +
4693 + if (ip < map->first_ip || ip > map->last_ip)
4694 + return -ERANGE;
4695 +
4696 + id = ipportiphash_id(set, hash_ip, ip, port, ip1);
4697 +
4698 + if (id == UINT_MAX)
4699 + return -EEXIST;
4700 +
4701 + elem = HARRAY_ELEM(map->members, struct ipportip *, id);
4702 + elem->ip = elem->ip1 = 0;
4703 + map->elements--;
4704 +
4705 + return 0;
4706 +}
4707 +
4708 +UADT(ipportiphash, del, req->port, req->ip1)
4709 +KADT(ipportiphash, del, ipaddr, port, ip1)
4710 +
4711 +static inline int
4712 +__ipportiphash_create(const struct ip_set_req_ipportiphash_create *req,
4713 + struct ip_set_ipportiphash *map)
4714 +{
4715 + if (req->to - req->from > MAX_RANGE) {
4716 + ip_set_printk("range too big, %d elements (max %d)",
4717 + req->to - req->from + 1, MAX_RANGE+1);
4718 + return -ENOEXEC;
4719 + }
4720 + map->first_ip = req->from;
4721 + map->last_ip = req->to;
4722 + return 0;
4723 +}
4724 +
4725 +HASH_CREATE(ipportiphash, struct ipportip)
4726 +HASH_DESTROY(ipportiphash)
4727 +HASH_FLUSH(ipportiphash, struct ipportip)
4728 +
4729 +static inline void
4730 +__ipportiphash_list_header(const struct ip_set_ipportiphash *map,
4731 + struct ip_set_req_ipportiphash_create *header)
4732 +{
4733 + header->from = map->first_ip;
4734 + header->to = map->last_ip;
4735 +}
4736 +
4737 +HASH_LIST_HEADER(ipportiphash)
4738 +HASH_LIST_MEMBERS_SIZE(ipportiphash, struct ipportip)
4739 +HASH_LIST_MEMBERS_MEMCPY(ipportiphash, struct ipportip)
4740 +
4741 +IP_SET_RTYPE(ipportiphash, IPSET_TYPE_IP | IPSET_TYPE_PORT
4742 + | IPSET_TYPE_IP1 | IPSET_DATA_TRIPLE)
4743 +
4744 +MODULE_LICENSE("GPL");
4745 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
4746 +MODULE_DESCRIPTION("ipportiphash type of IP sets");
4747 +module_param(limit, int, 0600);
4748 +MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
4749 +
4750 +REGISTER_MODULE(ipportiphash)
4751 --- /dev/null
4752 +++ b/net/ipv4/netfilter/ip_set_ipportnethash.c
4753 @@ -0,0 +1,304 @@
4754 +/* Copyright (C) 2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
4755 + *
4756 + * This program is free software; you can redistribute it and/or modify
4757 + * it under the terms of the GNU General Public License version 2 as
4758 + * published by the Free Software Foundation.
4759 + */
4760 +
4761 +/* Kernel module implementing an ip+port+net hash set */
4762 +
4763 +#include <linux/module.h>
4764 +#include <linux/moduleparam.h>
4765 +#include <linux/ip.h>
4766 +#include <linux/tcp.h>
4767 +#include <linux/udp.h>
4768 +#include <linux/skbuff.h>
4769 +#include <linux/netfilter_ipv4/ip_set_jhash.h>
4770 +#include <linux/errno.h>
4771 +#include <asm/uaccess.h>
4772 +#include <asm/bitops.h>
4773 +#include <linux/spinlock.h>
4774 +#include <linux/random.h>
4775 +
4776 +#include <net/ip.h>
4777 +
4778 +#include <linux/netfilter_ipv4/ip_set_ipportnethash.h>
4779 +#include <linux/netfilter_ipv4/ip_set_getport.h>
4780 +
4781 +static int limit = MAX_RANGE;
4782 +
4783 +#define jhash_ip2(map, i, ipport, ip1) \
4784 + jhash_2words(ipport, ip1, *(map->initval + i))
4785 +
4786 +static inline __u32
4787 +ipportnethash_id_cidr(struct ip_set *set, ip_set_ip_t *hash_ip,
4788 + ip_set_ip_t ip, ip_set_ip_t port,
4789 + ip_set_ip_t ip1, uint8_t cidr)
4790 +{
4791 + struct ip_set_ipportnethash *map = set->data;
4792 + __u32 id;
4793 + u_int16_t i;
4794 + struct ipportip *elem;
4795 +
4796 + *hash_ip = pack_ip_port(map, ip, port);
4797 + DP("set: %s, ipport:%u.%u.%u.%u:%u, %u.%u.%u.%u",
4798 + set->name, HIPQUAD(ip), port, HIPQUAD(*hash_ip));
4799 + ip1 = pack_ip_cidr(ip1, cidr);
4800 + if (!(*hash_ip || ip1))
4801 + return UINT_MAX;
4802 +
4803 + for (i = 0; i < map->probes; i++) {
4804 + id = jhash_ip2(map, i, *hash_ip, ip1) % map->hashsize;
4805 + DP("hash key: %u", id);
4806 + elem = HARRAY_ELEM(map->members, struct ipportip *, id);
4807 + if (elem->ip == *hash_ip && elem->ip1 == ip1)
4808 + return id;
4809 + /* No shortcut - there can be deleted entries. */
4810 + }
4811 + return UINT_MAX;
4812 +}
4813 +
4814 +static inline __u32
4815 +ipportnethash_id(struct ip_set *set, ip_set_ip_t *hash_ip,
4816 + ip_set_ip_t ip, ip_set_ip_t port, ip_set_ip_t ip1)
4817 +{
4818 + struct ip_set_ipportnethash *map = set->data;
4819 + __u32 id = UINT_MAX;
4820 + int i;
4821 +
4822 + for (i = 0; i < 30 && map->cidr[i]; i++) {
4823 + id = ipportnethash_id_cidr(set, hash_ip, ip, port, ip1,
4824 + map->cidr[i]);
4825 + if (id != UINT_MAX)
4826 + break;
4827 + }
4828 + return id;
4829 +}
4830 +
4831 +static inline int
4832 +ipportnethash_test_cidr(struct ip_set *set, ip_set_ip_t *hash_ip,
4833 + ip_set_ip_t ip, ip_set_ip_t port,
4834 + ip_set_ip_t ip1, uint8_t cidr)
4835 +{
4836 + struct ip_set_ipportnethash *map = set->data;
4837 +
4838 + if (ip < map->first_ip || ip > map->last_ip)
4839 + return -ERANGE;
4840 +
4841 + return (ipportnethash_id_cidr(set, hash_ip, ip, port, ip1,
4842 + cidr) != UINT_MAX);
4843 +}
4844 +
4845 +static inline int
4846 +ipportnethash_test(struct ip_set *set, ip_set_ip_t *hash_ip,
4847 + ip_set_ip_t ip, ip_set_ip_t port, ip_set_ip_t ip1)
4848 +{
4849 + struct ip_set_ipportnethash *map = set->data;
4850 +
4851 + if (ip < map->first_ip || ip > map->last_ip)
4852 + return -ERANGE;
4853 +
4854 + return (ipportnethash_id(set, hash_ip, ip, port, ip1) != UINT_MAX);
4855 +}
4856 +
4857 +static int
4858 +ipportnethash_utest(struct ip_set *set, const void *data, u_int32_t size,
4859 + ip_set_ip_t *hash_ip)
4860 +{
4861 + const struct ip_set_req_ipportnethash *req = data;
4862 +
4863 + if (req->cidr <= 0 || req->cidr > 32)
4864 + return -EINVAL;
4865 + return (req->cidr == 32
4866 + ? ipportnethash_test(set, hash_ip, req->ip, req->port,
4867 + req->ip1)
4868 + : ipportnethash_test_cidr(set, hash_ip, req->ip, req->port,
4869 + req->ip1, req->cidr));
4870 +}
4871 +
4872 +#define KADT_CONDITION \
4873 + ip_set_ip_t port, ip1; \
4874 + \
4875 + if (flags[index+2] == 0) \
4876 + return 0; \
4877 + \
4878 + port = get_port(skb, flags[index+1]); \
4879 + ip1 = ipaddr(skb, flags[index+2]); \
4880 + \
4881 + if (port == INVALID_PORT) \
4882 + return 0;
4883 +
4884 +KADT(ipportnethash, test, ipaddr, port, ip1)
4885 +
4886 +static inline int
4887 +__ipportnet_add(struct ip_set_ipportnethash *map,
4888 + ip_set_ip_t hash_ip, ip_set_ip_t ip1)
4889 +{
4890 + __u32 probe;
4891 + u_int16_t i;
4892 + struct ipportip *elem, *slot = NULL;
4893 +
4894 + for (i = 0; i < map->probes; i++) {
4895 + probe = jhash_ip2(map, i, hash_ip, ip1) % map->hashsize;
4896 + elem = HARRAY_ELEM(map->members, struct ipportip *, probe);
4897 + if (elem->ip == hash_ip && elem->ip1 == ip1)
4898 + return -EEXIST;
4899 + if (!(slot || elem->ip || elem->ip1))
4900 + slot = elem;
4901 + /* There can be deleted entries, must check all slots */
4902 + }
4903 + if (slot) {
4904 + slot->ip = hash_ip;
4905 + slot->ip1 = ip1;
4906 + map->elements++;
4907 + return 0;
4908 + }
4909 + /* Trigger rehashing */
4910 + return -EAGAIN;
4911 +}
4912 +
4913 +static inline int
4914 +__ipportnethash_add(struct ip_set_ipportnethash *map,
4915 + struct ipportip *elem)
4916 +{
4917 + return __ipportnet_add(map, elem->ip, elem->ip1);
4918 +}
4919 +
4920 +static inline int
4921 +ipportnethash_add(struct ip_set *set, ip_set_ip_t *hash_ip,
4922 + ip_set_ip_t ip, ip_set_ip_t port,
4923 + ip_set_ip_t ip1, uint8_t cidr)
4924 +{
4925 + struct ip_set_ipportnethash *map = set->data;
4926 + struct ipportip;
4927 + int ret;
4928 +
4929 + if (map->elements > limit)
4930 + return -ERANGE;
4931 + if (ip < map->first_ip || ip > map->last_ip)
4932 + return -ERANGE;
4933 + if (cidr <= 0 || cidr >= 32)
4934 + return -EINVAL;
4935 + if (map->nets[cidr-1] == UINT16_MAX)
4936 + return -ERANGE;
4937 +
4938 + *hash_ip = pack_ip_port(map, ip, port);
4939 + ip1 = pack_ip_cidr(ip1, cidr);
4940 + if (!(*hash_ip || ip1))
4941 + return -ERANGE;
4942 +
4943 + ret =__ipportnet_add(map, *hash_ip, ip1);
4944 + if (ret == 0) {
4945 + if (!map->nets[cidr-1]++)
4946 + add_cidr_size(map->cidr, cidr);
4947 + map->elements++;
4948 + }
4949 + return ret;
4950 +}
4951 +
4952 +#undef KADT_CONDITION
4953 +#define KADT_CONDITION \
4954 + struct ip_set_ipportnethash *map = set->data; \
4955 + uint8_t cidr = map->cidr[0] ? map->cidr[0] : 31; \
4956 + ip_set_ip_t port, ip1; \
4957 + \
4958 + if (flags[index+2] == 0) \
4959 + return 0; \
4960 + \
4961 + port = get_port(skb, flags[index+1]); \
4962 + ip1 = ipaddr(skb, flags[index+2]); \
4963 + \
4964 + if (port == INVALID_PORT) \
4965 + return 0;
4966 +
4967 +UADT(ipportnethash, add, req->port, req->ip1, req->cidr)
4968 +KADT(ipportnethash, add, ipaddr, port, ip1, cidr)
4969 +
4970 +static inline void
4971 +__ipportnethash_retry(struct ip_set_ipportnethash *tmp,
4972 + struct ip_set_ipportnethash *map)
4973 +{
4974 + tmp->first_ip = map->first_ip;
4975 + tmp->last_ip = map->last_ip;
4976 + memcpy(tmp->cidr, map->cidr, sizeof(tmp->cidr));
4977 + memcpy(tmp->nets, map->nets, sizeof(tmp->nets));
4978 +}
4979 +
4980 +HASH_RETRY2(ipportnethash, struct ipportip)
4981 +
4982 +static inline int
4983 +ipportnethash_del(struct ip_set *set, ip_set_ip_t *hash_ip,
4984 + ip_set_ip_t ip, ip_set_ip_t port,
4985 + ip_set_ip_t ip1, uint8_t cidr)
4986 +{
4987 + struct ip_set_ipportnethash *map = set->data;
4988 + ip_set_ip_t id;
4989 + struct ipportip *elem;
4990 +
4991 + if (ip < map->first_ip || ip > map->last_ip)
4992 + return -ERANGE;
4993 + if (!ip)
4994 + return -ERANGE;
4995 + if (cidr <= 0 || cidr >= 32)
4996 + return -EINVAL;
4997 +
4998 + id = ipportnethash_id_cidr(set, hash_ip, ip, port, ip1, cidr);
4999 +
5000 + if (id == UINT_MAX)
5001 + return -EEXIST;
5002 +
5003 + elem = HARRAY_ELEM(map->members, struct ipportip *, id);
5004 + elem->ip = elem->ip1 = 0;
5005 + map->elements--;
5006 + if (!map->nets[cidr-1]--)
5007 + del_cidr_size(map->cidr, cidr);
5008 +
5009 + return 0;
5010 +}
5011 +
5012 +UADT(ipportnethash, del, req->port, req->ip1, req->cidr)
5013 +KADT(ipportnethash, del, ipaddr, port, ip1, cidr)
5014 +
5015 +static inline int
5016 +__ipportnethash_create(const struct ip_set_req_ipportnethash_create *req,
5017 + struct ip_set_ipportnethash *map)
5018 +{
5019 + if (req->to - req->from > MAX_RANGE) {
5020 + ip_set_printk("range too big, %d elements (max %d)",
5021 + req->to - req->from + 1, MAX_RANGE+1);
5022 + return -ENOEXEC;
5023 + }
5024 + map->first_ip = req->from;
5025 + map->last_ip = req->to;
5026 + memset(map->cidr, 0, sizeof(map->cidr));
5027 + memset(map->nets, 0, sizeof(map->nets));
5028 + return 0;
5029 +}
5030 +
5031 +HASH_CREATE(ipportnethash, struct ipportip)
5032 +HASH_DESTROY(ipportnethash)
5033 +HASH_FLUSH_CIDR(ipportnethash, struct ipportip);
5034 +
5035 +static inline void
5036 +__ipportnethash_list_header(const struct ip_set_ipportnethash *map,
5037 + struct ip_set_req_ipportnethash_create *header)
5038 +{
5039 + header->from = map->first_ip;
5040 + header->to = map->last_ip;
5041 +}
5042 +
5043 +HASH_LIST_HEADER(ipportnethash)
5044 +
5045 +HASH_LIST_MEMBERS_SIZE(ipportnethash, struct ipportip)
5046 +HASH_LIST_MEMBERS_MEMCPY(ipportnethash, struct ipportip)
5047 +
5048 +IP_SET_RTYPE(ipportnethash, IPSET_TYPE_IP | IPSET_TYPE_PORT
5049 + | IPSET_TYPE_IP1 | IPSET_DATA_TRIPLE)
5050 +
5051 +MODULE_LICENSE("GPL");
5052 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
5053 +MODULE_DESCRIPTION("ipportnethash type of IP sets");
5054 +module_param(limit, int, 0600);
5055 +MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
5056 +
5057 +REGISTER_MODULE(ipportnethash)
5058 --- /dev/null
5059 +++ b/net/ipv4/netfilter/ip_set_iptree.c
5060 @@ -0,0 +1,466 @@
5061 +/* Copyright (C) 2005-2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
5062 + *
5063 + * This program is free software; you can redistribute it and/or modify
5064 + * it under the terms of the GNU General Public License version 2 as
5065 + * published by the Free Software Foundation.
5066 + */
5067 +
5068 +/* Kernel module implementing an IP set type: the iptree type */
5069 +
5070 +#include <linux/module.h>
5071 +#include <linux/moduleparam.h>
5072 +#include <linux/ip.h>
5073 +#include <linux/skbuff.h>
5074 +#include <linux/slab.h>
5075 +#include <linux/delay.h>
5076 +#include <linux/errno.h>
5077 +#include <asm/uaccess.h>
5078 +#include <asm/bitops.h>
5079 +#include <linux/spinlock.h>
5080 +#include <linux/timer.h>
5081 +
5082 +#include <linux/netfilter_ipv4/ip_set.h>
5083 +#include <linux/netfilter_ipv4/ip_set_bitmaps.h>
5084 +#include <linux/netfilter_ipv4/ip_set_iptree.h>
5085 +
5086 +static int limit = MAX_RANGE;
5087 +
5088 +/* Garbage collection interval in seconds: */
5089 +#define IPTREE_GC_TIME 5*60
5090 +/* Sleep so many milliseconds before trying again
5091 + * to delete the gc timer at destroying/flushing a set */
5092 +#define IPTREE_DESTROY_SLEEP 100
5093 +
5094 +static __KMEM_CACHE_T__ *branch_cachep;
5095 +static __KMEM_CACHE_T__ *leaf_cachep;
5096 +
5097 +
5098 +#if defined(__LITTLE_ENDIAN)
5099 +#define ABCD(a,b,c,d,addrp) do { \
5100 + a = ((unsigned char *)addrp)[3]; \
5101 + b = ((unsigned char *)addrp)[2]; \
5102 + c = ((unsigned char *)addrp)[1]; \
5103 + d = ((unsigned char *)addrp)[0]; \
5104 +} while (0)
5105 +#elif defined(__BIG_ENDIAN)
5106 +#define ABCD(a,b,c,d,addrp) do { \
5107 + a = ((unsigned char *)addrp)[0]; \
5108 + b = ((unsigned char *)addrp)[1]; \
5109 + c = ((unsigned char *)addrp)[2]; \
5110 + d = ((unsigned char *)addrp)[3]; \
5111 +} while (0)
5112 +#else
5113 +#error "Please fix asm/byteorder.h"
5114 +#endif /* __LITTLE_ENDIAN */
5115 +
5116 +#define TESTIP_WALK(map, elem, branch) do { \
5117 + if ((map)->tree[elem]) { \
5118 + branch = (map)->tree[elem]; \
5119 + } else \
5120 + return 0; \
5121 +} while (0)
5122 +
5123 +static inline int
5124 +iptree_test(struct ip_set *set, ip_set_ip_t *hash_ip, ip_set_ip_t ip)
5125 +{
5126 + struct ip_set_iptree *map = set->data;
5127 + struct ip_set_iptreeb *btree;
5128 + struct ip_set_iptreec *ctree;
5129 + struct ip_set_iptreed *dtree;
5130 + unsigned char a,b,c,d;
5131 +
5132 + if (!ip)
5133 + return -ERANGE;
5134 +
5135 + *hash_ip = ip;
5136 + ABCD(a, b, c, d, hash_ip);
5137 + DP("%u %u %u %u timeout %u", a, b, c, d, map->timeout);
5138 + TESTIP_WALK(map, a, btree);
5139 + TESTIP_WALK(btree, b, ctree);
5140 + TESTIP_WALK(ctree, c, dtree);
5141 + DP("%lu %lu", dtree->expires[d], jiffies);
5142 + return dtree->expires[d]
5143 + && (!map->timeout
5144 + || time_after(dtree->expires[d], jiffies));
5145 +}
5146 +
5147 +#define KADT_CONDITION
5148 +
5149 +UADT(iptree, test)
5150 +KADT(iptree, test, ipaddr)
5151 +
5152 +#define ADDIP_WALK(map, elem, branch, type, cachep) do { \
5153 + if ((map)->tree[elem]) { \
5154 + DP("found %u", elem); \
5155 + branch = (map)->tree[elem]; \
5156 + } else { \
5157 + branch = (type *) \
5158 + kmem_cache_alloc(cachep, GFP_ATOMIC); \
5159 + if (branch == NULL) \
5160 + return -ENOMEM; \
5161 + memset(branch, 0, sizeof(*branch)); \
5162 + (map)->tree[elem] = branch; \
5163 + DP("alloc %u", elem); \
5164 + } \
5165 +} while (0)
5166 +
5167 +static inline int
5168 +iptree_add(struct ip_set *set, ip_set_ip_t *hash_ip,
5169 + ip_set_ip_t ip, unsigned int timeout)
5170 +{
5171 + struct ip_set_iptree *map = set->data;
5172 + struct ip_set_iptreeb *btree;
5173 + struct ip_set_iptreec *ctree;
5174 + struct ip_set_iptreed *dtree;
5175 + unsigned char a,b,c,d;
5176 + int ret = 0;
5177 +
5178 + if (!ip || map->elements >= limit)
5179 + /* We could call the garbage collector
5180 + * but it's probably overkill */
5181 + return -ERANGE;
5182 +
5183 + *hash_ip = ip;
5184 + ABCD(a, b, c, d, hash_ip);
5185 + DP("%u %u %u %u timeout %u", a, b, c, d, timeout);
5186 + ADDIP_WALK(map, a, btree, struct ip_set_iptreeb, branch_cachep);
5187 + ADDIP_WALK(btree, b, ctree, struct ip_set_iptreec, branch_cachep);
5188 + ADDIP_WALK(ctree, c, dtree, struct ip_set_iptreed, leaf_cachep);
5189 + if (dtree->expires[d]
5190 + && (!map->timeout || time_after(dtree->expires[d], jiffies)))
5191 + ret = -EEXIST;
5192 + if (map->timeout && timeout == 0)
5193 + timeout = map->timeout;
5194 + dtree->expires[d] = map->timeout ? (timeout * HZ + jiffies) : 1;
5195 + /* Lottery: I won! */
5196 + if (dtree->expires[d] == 0)
5197 + dtree->expires[d] = 1;
5198 + DP("%u %lu", d, dtree->expires[d]);
5199 + if (ret == 0)
5200 + map->elements++;
5201 + return ret;
5202 +}
5203 +
5204 +UADT(iptree, add, req->timeout)
5205 +KADT(iptree, add, ipaddr, 0)
5206 +
5207 +#define DELIP_WALK(map, elem, branch) do { \
5208 + if ((map)->tree[elem]) { \
5209 + branch = (map)->tree[elem]; \
5210 + } else \
5211 + return -EEXIST; \
5212 +} while (0)
5213 +
5214 +static inline int
5215 +iptree_del(struct ip_set *set, ip_set_ip_t *hash_ip, ip_set_ip_t ip)
5216 +{
5217 + struct ip_set_iptree *map = set->data;
5218 + struct ip_set_iptreeb *btree;
5219 + struct ip_set_iptreec *ctree;
5220 + struct ip_set_iptreed *dtree;
5221 + unsigned char a,b,c,d;
5222 +
5223 + if (!ip)
5224 + return -ERANGE;
5225 +
5226 + *hash_ip = ip;
5227 + ABCD(a, b, c, d, hash_ip);
5228 + DELIP_WALK(map, a, btree);
5229 + DELIP_WALK(btree, b, ctree);
5230 + DELIP_WALK(ctree, c, dtree);
5231 +
5232 + if (dtree->expires[d]) {
5233 + dtree->expires[d] = 0;
5234 + map->elements--;
5235 + return 0;
5236 + }
5237 + return -EEXIST;
5238 +}
5239 +
5240 +UADT(iptree, del)
5241 +KADT(iptree, del, ipaddr)
5242 +
5243 +#define LOOP_WALK_BEGIN(map, i, branch) \
5244 + for (i = 0; i < 256; i++) { \
5245 + if (!(map)->tree[i]) \
5246 + continue; \
5247 + branch = (map)->tree[i]
5248 +
5249 +#define LOOP_WALK_END }
5250 +
5251 +static void
5252 +ip_tree_gc(unsigned long ul_set)
5253 +{
5254 + struct ip_set *set = (struct ip_set *) ul_set;
5255 + struct ip_set_iptree *map = set->data;
5256 + struct ip_set_iptreeb *btree;
5257 + struct ip_set_iptreec *ctree;
5258 + struct ip_set_iptreed *dtree;
5259 + unsigned int a,b,c,d;
5260 + unsigned char i,j,k;
5261 +
5262 + i = j = k = 0;
5263 + DP("gc: %s", set->name);
5264 + write_lock_bh(&set->lock);
5265 + LOOP_WALK_BEGIN(map, a, btree);
5266 + LOOP_WALK_BEGIN(btree, b, ctree);
5267 + LOOP_WALK_BEGIN(ctree, c, dtree);
5268 + for (d = 0; d < 256; d++) {
5269 + if (dtree->expires[d]) {
5270 + DP("gc: %u %u %u %u: expires %lu jiffies %lu",
5271 + a, b, c, d,
5272 + dtree->expires[d], jiffies);
5273 + if (map->timeout
5274 + && time_before(dtree->expires[d], jiffies)) {
5275 + dtree->expires[d] = 0;
5276 + map->elements--;
5277 + } else
5278 + k = 1;
5279 + }
5280 + }
5281 + if (k == 0) {
5282 + DP("gc: %s: leaf %u %u %u empty",
5283 + set->name, a, b, c);
5284 + kmem_cache_free(leaf_cachep, dtree);
5285 + ctree->tree[c] = NULL;
5286 + } else {
5287 + DP("gc: %s: leaf %u %u %u not empty",
5288 + set->name, a, b, c);
5289 + j = 1;
5290 + k = 0;
5291 + }
5292 + LOOP_WALK_END;
5293 + if (j == 0) {
5294 + DP("gc: %s: branch %u %u empty",
5295 + set->name, a, b);
5296 + kmem_cache_free(branch_cachep, ctree);
5297 + btree->tree[b] = NULL;
5298 + } else {
5299 + DP("gc: %s: branch %u %u not empty",
5300 + set->name, a, b);
5301 + i = 1;
5302 + j = k = 0;
5303 + }
5304 + LOOP_WALK_END;
5305 + if (i == 0) {
5306 + DP("gc: %s: branch %u empty",
5307 + set->name, a);
5308 + kmem_cache_free(branch_cachep, btree);
5309 + map->tree[a] = NULL;
5310 + } else {
5311 + DP("gc: %s: branch %u not empty",
5312 + set->name, a);
5313 + i = j = k = 0;
5314 + }
5315 + LOOP_WALK_END;
5316 + write_unlock_bh(&set->lock);
5317 +
5318 + map->gc.expires = jiffies + map->gc_interval * HZ;
5319 + add_timer(&map->gc);
5320 +}
5321 +
5322 +static inline void
5323 +init_gc_timer(struct ip_set *set)
5324 +{
5325 + struct ip_set_iptree *map = set->data;
5326 +
5327 + /* Even if there is no timeout for the entries,
5328 + * we still have to call gc because delete
5329 + * do not clean up empty branches */
5330 + map->gc_interval = IPTREE_GC_TIME;
5331 + init_timer(&map->gc);
5332 + map->gc.data = (unsigned long) set;
5333 + map->gc.function = ip_tree_gc;
5334 + map->gc.expires = jiffies + map->gc_interval * HZ;
5335 + add_timer(&map->gc);
5336 +}
5337 +
5338 +static int
5339 +iptree_create(struct ip_set *set, const void *data, u_int32_t size)
5340 +{
5341 + const struct ip_set_req_iptree_create *req = data;
5342 + struct ip_set_iptree *map;
5343 +
5344 + if (size != sizeof(struct ip_set_req_iptree_create)) {
5345 + ip_set_printk("data length wrong (want %zu, have %lu)",
5346 + sizeof(struct ip_set_req_iptree_create),
5347 + (unsigned long)size);
5348 + return -EINVAL;
5349 + }
5350 +
5351 + map = kmalloc(sizeof(struct ip_set_iptree), GFP_KERNEL);
5352 + if (!map) {
5353 + DP("out of memory for %zu bytes",
5354 + sizeof(struct ip_set_iptree));
5355 + return -ENOMEM;
5356 + }
5357 + memset(map, 0, sizeof(*map));
5358 + map->timeout = req->timeout;
5359 + map->elements = 0;
5360 + set->data = map;
5361 +
5362 + init_gc_timer(set);
5363 +
5364 + return 0;
5365 +}
5366 +
5367 +static inline void
5368 +__flush(struct ip_set_iptree *map)
5369 +{
5370 + struct ip_set_iptreeb *btree;
5371 + struct ip_set_iptreec *ctree;
5372 + struct ip_set_iptreed *dtree;
5373 + unsigned int a,b,c;
5374 +
5375 + LOOP_WALK_BEGIN(map, a, btree);
5376 + LOOP_WALK_BEGIN(btree, b, ctree);
5377 + LOOP_WALK_BEGIN(ctree, c, dtree);
5378 + kmem_cache_free(leaf_cachep, dtree);
5379 + LOOP_WALK_END;
5380 + kmem_cache_free(branch_cachep, ctree);
5381 + LOOP_WALK_END;
5382 + kmem_cache_free(branch_cachep, btree);
5383 + LOOP_WALK_END;
5384 + map->elements = 0;
5385 +}
5386 +
5387 +static void
5388 +iptree_destroy(struct ip_set *set)
5389 +{
5390 + struct ip_set_iptree *map = set->data;
5391 +
5392 + /* gc might be running */
5393 + while (!del_timer(&map->gc))
5394 + msleep(IPTREE_DESTROY_SLEEP);
5395 + __flush(map);
5396 + kfree(map);
5397 + set->data = NULL;
5398 +}
5399 +
5400 +static void
5401 +iptree_flush(struct ip_set *set)
5402 +{
5403 + struct ip_set_iptree *map = set->data;
5404 + unsigned int timeout = map->timeout;
5405 +
5406 + /* gc might be running */
5407 + while (!del_timer(&map->gc))
5408 + msleep(IPTREE_DESTROY_SLEEP);
5409 + __flush(map);
5410 + memset(map, 0, sizeof(*map));
5411 + map->timeout = timeout;
5412 +
5413 + init_gc_timer(set);
5414 +}
5415 +
5416 +static void
5417 +iptree_list_header(const struct ip_set *set, void *data)
5418 +{
5419 + const struct ip_set_iptree *map = set->data;
5420 + struct ip_set_req_iptree_create *header = data;
5421 +
5422 + header->timeout = map->timeout;
5423 +}
5424 +
5425 +static int
5426 +iptree_list_members_size(const struct ip_set *set)
5427 +{
5428 + const struct ip_set_iptree *map = set->data;
5429 + struct ip_set_iptreeb *btree;
5430 + struct ip_set_iptreec *ctree;
5431 + struct ip_set_iptreed *dtree;
5432 + unsigned int a,b,c,d;
5433 + unsigned int count = 0;
5434 +
5435 + LOOP_WALK_BEGIN(map, a, btree);
5436 + LOOP_WALK_BEGIN(btree, b, ctree);
5437 + LOOP_WALK_BEGIN(ctree, c, dtree);
5438 + for (d = 0; d < 256; d++) {
5439 + if (dtree->expires[d]
5440 + && (!map->timeout || time_after(dtree->expires[d], jiffies)))
5441 + count++;
5442 + }
5443 + LOOP_WALK_END;
5444 + LOOP_WALK_END;
5445 + LOOP_WALK_END;
5446 +
5447 + DP("members %u", count);
5448 + return (count * sizeof(struct ip_set_req_iptree));
5449 +}
5450 +
5451 +static void
5452 +iptree_list_members(const struct ip_set *set, void *data)
5453 +{
5454 + const struct ip_set_iptree *map = set->data;
5455 + struct ip_set_iptreeb *btree;
5456 + struct ip_set_iptreec *ctree;
5457 + struct ip_set_iptreed *dtree;
5458 + unsigned int a,b,c,d;
5459 + size_t offset = 0;
5460 + struct ip_set_req_iptree *entry;
5461 +
5462 + LOOP_WALK_BEGIN(map, a, btree);
5463 + LOOP_WALK_BEGIN(btree, b, ctree);
5464 + LOOP_WALK_BEGIN(ctree, c, dtree);
5465 + for (d = 0; d < 256; d++) {
5466 + if (dtree->expires[d]
5467 + && (!map->timeout || time_after(dtree->expires[d], jiffies))) {
5468 + entry = data + offset;
5469 + entry->ip = ((a << 24) | (b << 16) | (c << 8) | d);
5470 + entry->timeout = !map->timeout ? 0
5471 + : (dtree->expires[d] - jiffies)/HZ;
5472 + offset += sizeof(struct ip_set_req_iptree);
5473 + }
5474 + }
5475 + LOOP_WALK_END;
5476 + LOOP_WALK_END;
5477 + LOOP_WALK_END;
5478 +}
5479 +
5480 +IP_SET_TYPE(iptree, IPSET_TYPE_IP | IPSET_DATA_SINGLE)
5481 +
5482 +MODULE_LICENSE("GPL");
5483 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
5484 +MODULE_DESCRIPTION("iptree type of IP sets");
5485 +module_param(limit, int, 0600);
5486 +MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
5487 +
5488 +static int __init ip_set_iptree_init(void)
5489 +{
5490 + int ret;
5491 +
5492 + branch_cachep = KMEM_CACHE_CREATE("ip_set_iptreeb",
5493 + sizeof(struct ip_set_iptreeb));
5494 + if (!branch_cachep) {
5495 + printk(KERN_ERR "Unable to create ip_set_iptreeb slab cache\n");
5496 + ret = -ENOMEM;
5497 + goto out;
5498 + }
5499 + leaf_cachep = KMEM_CACHE_CREATE("ip_set_iptreed",
5500 + sizeof(struct ip_set_iptreed));
5501 + if (!leaf_cachep) {
5502 + printk(KERN_ERR "Unable to create ip_set_iptreed slab cache\n");
5503 + ret = -ENOMEM;
5504 + goto free_branch;
5505 + }
5506 + ret = ip_set_register_set_type(&ip_set_iptree);
5507 + if (ret == 0)
5508 + goto out;
5509 +
5510 + kmem_cache_destroy(leaf_cachep);
5511 + free_branch:
5512 + kmem_cache_destroy(branch_cachep);
5513 + out:
5514 + return ret;
5515 +}
5516 +
5517 +static void __exit ip_set_iptree_fini(void)
5518 +{
5519 + /* FIXME: possible race with ip_set_create() */
5520 + ip_set_unregister_set_type(&ip_set_iptree);
5521 + kmem_cache_destroy(leaf_cachep);
5522 + kmem_cache_destroy(branch_cachep);
5523 +}
5524 +
5525 +module_init(ip_set_iptree_init);
5526 +module_exit(ip_set_iptree_fini);
5527 --- /dev/null
5528 +++ b/net/ipv4/netfilter/ip_set_iptreemap.c
5529 @@ -0,0 +1,708 @@
5530 +/* Copyright (C) 2007 Sven Wegener <sven.wegener@stealer.net>
5531 + *
5532 + * This program is free software; you can redistribute it and/or modify it
5533 + * under the terms of the GNU General Public License version 2 as published by
5534 + * the Free Software Foundation.
5535 + */
5536 +
5537 +/* This modules implements the iptreemap ipset type. It uses bitmaps to
5538 + * represent every single IPv4 address as a bit. The bitmaps are managed in a
5539 + * tree structure, where the first three octets of an address are used as an
5540 + * index to find the bitmap and the last octet is used as the bit number.
5541 + */
5542 +
5543 +#include <linux/kernel.h>
5544 +#include <linux/module.h>
5545 +#include <linux/ip.h>
5546 +#include <linux/skbuff.h>
5547 +#include <linux/slab.h>
5548 +#include <linux/delay.h>
5549 +#include <linux/errno.h>
5550 +#include <asm/uaccess.h>
5551 +#include <asm/bitops.h>
5552 +#include <linux/spinlock.h>
5553 +#include <linux/timer.h>
5554 +
5555 +#include <linux/netfilter_ipv4/ip_set.h>
5556 +#include <linux/netfilter_ipv4/ip_set_bitmaps.h>
5557 +#include <linux/netfilter_ipv4/ip_set_iptreemap.h>
5558 +
5559 +#define IPTREEMAP_DEFAULT_GC_TIME (5 * 60)
5560 +#define IPTREEMAP_DESTROY_SLEEP (100)
5561 +
5562 +static __KMEM_CACHE_T__ *cachep_b;
5563 +static __KMEM_CACHE_T__ *cachep_c;
5564 +static __KMEM_CACHE_T__ *cachep_d;
5565 +
5566 +static struct ip_set_iptreemap_d *fullbitmap_d;
5567 +static struct ip_set_iptreemap_c *fullbitmap_c;
5568 +static struct ip_set_iptreemap_b *fullbitmap_b;
5569 +
5570 +#if defined(__LITTLE_ENDIAN)
5571 +#define ABCD(a, b, c, d, addr) \
5572 + do { \
5573 + a = ((unsigned char *)addr)[3]; \
5574 + b = ((unsigned char *)addr)[2]; \
5575 + c = ((unsigned char *)addr)[1]; \
5576 + d = ((unsigned char *)addr)[0]; \
5577 + } while (0)
5578 +#elif defined(__BIG_ENDIAN)
5579 +#define ABCD(a,b,c,d,addrp) do { \
5580 + a = ((unsigned char *)addrp)[0]; \
5581 + b = ((unsigned char *)addrp)[1]; \
5582 + c = ((unsigned char *)addrp)[2]; \
5583 + d = ((unsigned char *)addrp)[3]; \
5584 +} while (0)
5585 +#else
5586 +#error "Please fix asm/byteorder.h"
5587 +#endif /* __LITTLE_ENDIAN */
5588 +
5589 +#define TESTIP_WALK(map, elem, branch, full) \
5590 + do { \
5591 + branch = (map)->tree[elem]; \
5592 + if (!branch) \
5593 + return 0; \
5594 + else if (branch == full) \
5595 + return 1; \
5596 + } while (0)
5597 +
5598 +#define ADDIP_WALK(map, elem, branch, type, cachep, full) \
5599 + do { \
5600 + branch = (map)->tree[elem]; \
5601 + if (!branch) { \
5602 + branch = (type *) kmem_cache_alloc(cachep, GFP_ATOMIC); \
5603 + if (!branch) \
5604 + return -ENOMEM; \
5605 + memset(branch, 0, sizeof(*branch)); \
5606 + (map)->tree[elem] = branch; \
5607 + } else if (branch == full) { \
5608 + return -EEXIST; \
5609 + } \
5610 + } while (0)
5611 +
5612 +#define ADDIP_RANGE_LOOP(map, a, a1, a2, hint, branch, full, cachep, free) \
5613 + for (a = a1; a <= a2; a++) { \
5614 + branch = (map)->tree[a]; \
5615 + if (branch != full) { \
5616 + if ((a > a1 && a < a2) || (hint)) { \
5617 + if (branch) \
5618 + free(branch); \
5619 + (map)->tree[a] = full; \
5620 + continue; \
5621 + } else if (!branch) { \
5622 + branch = kmem_cache_alloc(cachep, GFP_ATOMIC); \
5623 + if (!branch) \
5624 + return -ENOMEM; \
5625 + memset(branch, 0, sizeof(*branch)); \
5626 + (map)->tree[a] = branch; \
5627 + }
5628 +
5629 +#define ADDIP_RANGE_LOOP_END() \
5630 + } \
5631 + }
5632 +
5633 +#define DELIP_WALK(map, elem, branch, cachep, full, flags) \
5634 + do { \
5635 + branch = (map)->tree[elem]; \
5636 + if (!branch) { \
5637 + return -EEXIST; \
5638 + } else if (branch == full) { \
5639 + branch = kmem_cache_alloc(cachep, flags); \
5640 + if (!branch) \
5641 + return -ENOMEM; \
5642 + memcpy(branch, full, sizeof(*full)); \
5643 + (map)->tree[elem] = branch; \
5644 + } \
5645 + } while (0)
5646 +
5647 +#define DELIP_RANGE_LOOP(map, a, a1, a2, hint, branch, full, cachep, free, flags) \
5648 + for (a = a1; a <= a2; a++) { \
5649 + branch = (map)->tree[a]; \
5650 + if (branch) { \
5651 + if ((a > a1 && a < a2) || (hint)) { \
5652 + if (branch != full) \
5653 + free(branch); \
5654 + (map)->tree[a] = NULL; \
5655 + continue; \
5656 + } else if (branch == full) { \
5657 + branch = kmem_cache_alloc(cachep, flags); \
5658 + if (!branch) \
5659 + return -ENOMEM; \
5660 + memcpy(branch, full, sizeof(*branch)); \
5661 + (map)->tree[a] = branch; \
5662 + }
5663 +
5664 +#define DELIP_RANGE_LOOP_END() \
5665 + } \
5666 + }
5667 +
5668 +#define LOOP_WALK_BEGIN(map, i, branch) \
5669 + for (i = 0; i < 256; i++) { \
5670 + branch = (map)->tree[i]; \
5671 + if (likely(!branch)) \
5672 + continue;
5673 +
5674 +#define LOOP_WALK_END() \
5675 + }
5676 +
5677 +#define LOOP_WALK_BEGIN_GC(map, i, branch, full, cachep, count) \
5678 + count = -256; \
5679 + for (i = 0; i < 256; i++) { \
5680 + branch = (map)->tree[i]; \
5681 + if (likely(!branch)) \
5682 + continue; \
5683 + count++; \
5684 + if (branch == full) { \
5685 + count++; \
5686 + continue; \
5687 + }
5688 +
5689 +#define LOOP_WALK_END_GC(map, i, branch, full, cachep, count) \
5690 + if (-256 == count) { \
5691 + kmem_cache_free(cachep, branch); \
5692 + (map)->tree[i] = NULL; \
5693 + } else if (256 == count) { \
5694 + kmem_cache_free(cachep, branch); \
5695 + (map)->tree[i] = full; \
5696 + } \
5697 + }
5698 +
5699 +#define LOOP_WALK_BEGIN_COUNT(map, i, branch, inrange, count) \
5700 + for (i = 0; i < 256; i++) { \
5701 + if (!(map)->tree[i]) { \
5702 + if (inrange) { \
5703 + count++; \
5704 + inrange = 0; \
5705 + } \
5706 + continue; \
5707 + } \
5708 + branch = (map)->tree[i];
5709 +
5710 +#define LOOP_WALK_END_COUNT() \
5711 + }
5712 +
5713 +#define GETVALUE1(a, a1, b1, r) \
5714 + (a == a1 ? b1 : r)
5715 +
5716 +#define GETVALUE2(a, b, a1, b1, c1, r) \
5717 + (a == a1 && b == b1 ? c1 : r)
5718 +
5719 +#define GETVALUE3(a, b, c, a1, b1, c1, d1, r) \
5720 + (a == a1 && b == b1 && c == c1 ? d1 : r)
5721 +
5722 +#define CHECK1(a, a1, a2, b1, b2, c1, c2, d1, d2) \
5723 + ( \
5724 + GETVALUE1(a, a1, b1, 0) == 0 \
5725 + && GETVALUE1(a, a2, b2, 255) == 255 \
5726 + && c1 == 0 \
5727 + && c2 == 255 \
5728 + && d1 == 0 \
5729 + && d2 == 255 \
5730 + )
5731 +
5732 +#define CHECK2(a, b, a1, a2, b1, b2, c1, c2, d1, d2) \
5733 + ( \
5734 + GETVALUE2(a, b, a1, b1, c1, 0) == 0 \
5735 + && GETVALUE2(a, b, a2, b2, c2, 255) == 255 \
5736 + && d1 == 0 \
5737 + && d2 == 255 \
5738 + )
5739 +
5740 +#define CHECK3(a, b, c, a1, a2, b1, b2, c1, c2, d1, d2) \
5741 + ( \
5742 + GETVALUE3(a, b, c, a1, b1, c1, d1, 0) == 0 \
5743 + && GETVALUE3(a, b, c, a2, b2, c2, d2, 255) == 255 \
5744 + )
5745 +
5746 +
5747 +static inline void
5748 +free_d(struct ip_set_iptreemap_d *map)
5749 +{
5750 + kmem_cache_free(cachep_d, map);
5751 +}
5752 +
5753 +static inline void
5754 +free_c(struct ip_set_iptreemap_c *map)
5755 +{
5756 + struct ip_set_iptreemap_d *dtree;
5757 + unsigned int i;
5758 +
5759 + LOOP_WALK_BEGIN(map, i, dtree) {
5760 + if (dtree != fullbitmap_d)
5761 + free_d(dtree);
5762 + } LOOP_WALK_END();
5763 +
5764 + kmem_cache_free(cachep_c, map);
5765 +}
5766 +
5767 +static inline void
5768 +free_b(struct ip_set_iptreemap_b *map)
5769 +{
5770 + struct ip_set_iptreemap_c *ctree;
5771 + unsigned int i;
5772 +
5773 + LOOP_WALK_BEGIN(map, i, ctree) {
5774 + if (ctree != fullbitmap_c)
5775 + free_c(ctree);
5776 + } LOOP_WALK_END();
5777 +
5778 + kmem_cache_free(cachep_b, map);
5779 +}
5780 +
5781 +static inline int
5782 +iptreemap_test(struct ip_set *set, ip_set_ip_t *hash_ip, ip_set_ip_t ip)
5783 +{
5784 + struct ip_set_iptreemap *map = set->data;
5785 + struct ip_set_iptreemap_b *btree;
5786 + struct ip_set_iptreemap_c *ctree;
5787 + struct ip_set_iptreemap_d *dtree;
5788 + unsigned char a, b, c, d;
5789 +
5790 + *hash_ip = ip;
5791 +
5792 + ABCD(a, b, c, d, hash_ip);
5793 +
5794 + TESTIP_WALK(map, a, btree, fullbitmap_b);
5795 + TESTIP_WALK(btree, b, ctree, fullbitmap_c);
5796 + TESTIP_WALK(ctree, c, dtree, fullbitmap_d);
5797 +
5798 + return !!test_bit(d, (void *) dtree->bitmap);
5799 +}
5800 +
5801 +#define KADT_CONDITION
5802 +
5803 +UADT(iptreemap, test)
5804 +KADT(iptreemap, test, ipaddr)
5805 +
5806 +static inline int
5807 +__addip_single(struct ip_set *set, ip_set_ip_t *hash_ip, ip_set_ip_t ip)
5808 +{
5809 + struct ip_set_iptreemap *map = (struct ip_set_iptreemap *) set->data;
5810 + struct ip_set_iptreemap_b *btree;
5811 + struct ip_set_iptreemap_c *ctree;
5812 + struct ip_set_iptreemap_d *dtree;
5813 + unsigned char a, b, c, d;
5814 +
5815 + *hash_ip = ip;
5816 +
5817 + ABCD(a, b, c, d, hash_ip);
5818 +
5819 + ADDIP_WALK(map, a, btree, struct ip_set_iptreemap_b, cachep_b, fullbitmap_b);
5820 + ADDIP_WALK(btree, b, ctree, struct ip_set_iptreemap_c, cachep_c, fullbitmap_c);
5821 + ADDIP_WALK(ctree, c, dtree, struct ip_set_iptreemap_d, cachep_d, fullbitmap_d);
5822 +
5823 + if (__test_and_set_bit(d, (void *) dtree->bitmap))
5824 + return -EEXIST;
5825 +
5826 + __set_bit(b, (void *) btree->dirty);
5827 +
5828 + return 0;
5829 +}
5830 +
5831 +static inline int
5832 +iptreemap_add(struct ip_set *set, ip_set_ip_t *hash_ip,
5833 + ip_set_ip_t start, ip_set_ip_t end)
5834 +{
5835 + struct ip_set_iptreemap *map = set->data;
5836 + struct ip_set_iptreemap_b *btree;
5837 + struct ip_set_iptreemap_c *ctree;
5838 + struct ip_set_iptreemap_d *dtree;
5839 + unsigned int a, b, c, d;
5840 + unsigned char a1, b1, c1, d1;
5841 + unsigned char a2, b2, c2, d2;
5842 +
5843 + if (start == end)
5844 + return __addip_single(set, hash_ip, start);
5845 +
5846 + *hash_ip = start;
5847 +
5848 + ABCD(a1, b1, c1, d1, &start);
5849 + ABCD(a2, b2, c2, d2, &end);
5850 +
5851 + /* This is sooo ugly... */
5852 + ADDIP_RANGE_LOOP(map, a, a1, a2, CHECK1(a, a1, a2, b1, b2, c1, c2, d1, d2), btree, fullbitmap_b, cachep_b, free_b) {
5853 + ADDIP_RANGE_LOOP(btree, b, GETVALUE1(a, a1, b1, 0), GETVALUE1(a, a2, b2, 255), CHECK2(a, b, a1, a2, b1, b2, c1, c2, d1, d2), ctree, fullbitmap_c, cachep_c, free_c) {
5854 + ADDIP_RANGE_LOOP(ctree, c, GETVALUE2(a, b, a1, b1, c1, 0), GETVALUE2(a, b, a2, b2, c2, 255), CHECK3(a, b, c, a1, a2, b1, b2, c1, c2, d1, d2), dtree, fullbitmap_d, cachep_d, free_d) {
5855 + for (d = GETVALUE3(a, b, c, a1, b1, c1, d1, 0); d <= GETVALUE3(a, b, c, a2, b2, c2, d2, 255); d++)
5856 + __set_bit(d, (void *) dtree->bitmap);
5857 + __set_bit(b, (void *) btree->dirty);
5858 + } ADDIP_RANGE_LOOP_END();
5859 + } ADDIP_RANGE_LOOP_END();
5860 + } ADDIP_RANGE_LOOP_END();
5861 +
5862 + return 0;
5863 +}
5864 +
5865 +UADT0(iptreemap, add, min(req->ip, req->end), max(req->ip, req->end))
5866 +KADT(iptreemap, add, ipaddr, ip)
5867 +
5868 +static inline int
5869 +__delip_single(struct ip_set *set, ip_set_ip_t *hash_ip,
5870 + ip_set_ip_t ip, gfp_t flags)
5871 +{
5872 + struct ip_set_iptreemap *map = set->data;
5873 + struct ip_set_iptreemap_b *btree;
5874 + struct ip_set_iptreemap_c *ctree;
5875 + struct ip_set_iptreemap_d *dtree;
5876 + unsigned char a,b,c,d;
5877 +
5878 + *hash_ip = ip;
5879 +
5880 + ABCD(a, b, c, d, hash_ip);
5881 +
5882 + DELIP_WALK(map, a, btree, cachep_b, fullbitmap_b, flags);
5883 + DELIP_WALK(btree, b, ctree, cachep_c, fullbitmap_c, flags);
5884 + DELIP_WALK(ctree, c, dtree, cachep_d, fullbitmap_d, flags);
5885 +
5886 + if (!__test_and_clear_bit(d, (void *) dtree->bitmap))
5887 + return -EEXIST;
5888 +
5889 + __set_bit(b, (void *) btree->dirty);
5890 +
5891 + return 0;
5892 +}
5893 +
5894 +static inline int
5895 +iptreemap_del(struct ip_set *set, ip_set_ip_t *hash_ip,
5896 + ip_set_ip_t start, ip_set_ip_t end, gfp_t flags)
5897 +{
5898 + struct ip_set_iptreemap *map = set->data;
5899 + struct ip_set_iptreemap_b *btree;
5900 + struct ip_set_iptreemap_c *ctree;
5901 + struct ip_set_iptreemap_d *dtree;
5902 + unsigned int a, b, c, d;
5903 + unsigned char a1, b1, c1, d1;
5904 + unsigned char a2, b2, c2, d2;
5905 +
5906 + if (start == end)
5907 + return __delip_single(set, hash_ip, start, flags);
5908 +
5909 + *hash_ip = start;
5910 +
5911 + ABCD(a1, b1, c1, d1, &start);
5912 + ABCD(a2, b2, c2, d2, &end);
5913 +
5914 + /* This is sooo ugly... */
5915 + DELIP_RANGE_LOOP(map, a, a1, a2, CHECK1(a, a1, a2, b1, b2, c1, c2, d1, d2), btree, fullbitmap_b, cachep_b, free_b, flags) {
5916 + DELIP_RANGE_LOOP(btree, b, GETVALUE1(a, a1, b1, 0), GETVALUE1(a, a2, b2, 255), CHECK2(a, b, a1, a2, b1, b2, c1, c2, d1, d2), ctree, fullbitmap_c, cachep_c, free_c, flags) {
5917 + DELIP_RANGE_LOOP(ctree, c, GETVALUE2(a, b, a1, b1, c1, 0), GETVALUE2(a, b, a2, b2, c2, 255), CHECK3(a, b, c, a1, a2, b1, b2, c1, c2, d1, d2), dtree, fullbitmap_d, cachep_d, free_d, flags) {
5918 + for (d = GETVALUE3(a, b, c, a1, b1, c1, d1, 0); d <= GETVALUE3(a, b, c, a2, b2, c2, d2, 255); d++)
5919 + __clear_bit(d, (void *) dtree->bitmap);
5920 + __set_bit(b, (void *) btree->dirty);
5921 + } DELIP_RANGE_LOOP_END();
5922 + } DELIP_RANGE_LOOP_END();
5923 + } DELIP_RANGE_LOOP_END();
5924 +
5925 + return 0;
5926 +}
5927 +
5928 +UADT0(iptreemap, del, min(req->ip, req->end), max(req->ip, req->end), GFP_KERNEL)
5929 +KADT(iptreemap, del, ipaddr, ip, GFP_ATOMIC)
5930 +
5931 +/* Check the status of the bitmap
5932 + * -1 == all bits cleared
5933 + * 1 == all bits set
5934 + * 0 == anything else
5935 + */
5936 +static inline int
5937 +bitmap_status(struct ip_set_iptreemap_d *dtree)
5938 +{
5939 + unsigned char first = dtree->bitmap[0];
5940 + int a;
5941 +
5942 + for (a = 1; a < 32; a++)
5943 + if (dtree->bitmap[a] != first)
5944 + return 0;
5945 +
5946 + return (first == 0 ? -1 : (first == 255 ? 1 : 0));
5947 +}
5948 +
5949 +static void
5950 +gc(unsigned long addr)
5951 +{
5952 + struct ip_set *set = (struct ip_set *) addr;
5953 + struct ip_set_iptreemap *map = set->data;
5954 + struct ip_set_iptreemap_b *btree;
5955 + struct ip_set_iptreemap_c *ctree;
5956 + struct ip_set_iptreemap_d *dtree;
5957 + unsigned int a, b, c;
5958 + int i, j, k;
5959 +
5960 + write_lock_bh(&set->lock);
5961 +
5962 + LOOP_WALK_BEGIN_GC(map, a, btree, fullbitmap_b, cachep_b, i) {
5963 + LOOP_WALK_BEGIN_GC(btree, b, ctree, fullbitmap_c, cachep_c, j) {
5964 + if (!__test_and_clear_bit(b, (void *) btree->dirty))
5965 + continue;
5966 + LOOP_WALK_BEGIN_GC(ctree, c, dtree, fullbitmap_d, cachep_d, k) {
5967 + switch (bitmap_status(dtree)) {
5968 + case -1:
5969 + kmem_cache_free(cachep_d, dtree);
5970 + ctree->tree[c] = NULL;
5971 + k--;
5972 + break;
5973 + case 1:
5974 + kmem_cache_free(cachep_d, dtree);
5975 + ctree->tree[c] = fullbitmap_d;
5976 + k++;
5977 + break;
5978 + }
5979 + } LOOP_WALK_END();
5980 + } LOOP_WALK_END_GC(btree, b, ctree, fullbitmap_c, cachep_c, k);
5981 + } LOOP_WALK_END_GC(map, a, btree, fullbitmap_b, cachep_b, j);
5982 +
5983 + write_unlock_bh(&set->lock);
5984 +
5985 + map->gc.expires = jiffies + map->gc_interval * HZ;
5986 + add_timer(&map->gc);
5987 +}
5988 +
5989 +static inline void
5990 +init_gc_timer(struct ip_set *set)
5991 +{
5992 + struct ip_set_iptreemap *map = set->data;
5993 +
5994 + init_timer(&map->gc);
5995 + map->gc.data = (unsigned long) set;
5996 + map->gc.function = gc;
5997 + map->gc.expires = jiffies + map->gc_interval * HZ;
5998 + add_timer(&map->gc);
5999 +}
6000 +
6001 +static int
6002 +iptreemap_create(struct ip_set *set, const void *data, u_int32_t size)
6003 +{
6004 + const struct ip_set_req_iptreemap_create *req = data;
6005 + struct ip_set_iptreemap *map;
6006 +
6007 + map = kzalloc(sizeof(*map), GFP_KERNEL);
6008 + if (!map)
6009 + return -ENOMEM;
6010 +
6011 + map->gc_interval = req->gc_interval ? req->gc_interval : IPTREEMAP_DEFAULT_GC_TIME;
6012 + set->data = map;
6013 +
6014 + init_gc_timer(set);
6015 +
6016 + return 0;
6017 +}
6018 +
6019 +static inline void
6020 +__flush(struct ip_set_iptreemap *map)
6021 +{
6022 + struct ip_set_iptreemap_b *btree;
6023 + unsigned int a;
6024 +
6025 + LOOP_WALK_BEGIN(map, a, btree);
6026 + if (btree != fullbitmap_b)
6027 + free_b(btree);
6028 + LOOP_WALK_END();
6029 +}
6030 +
6031 +static void
6032 +iptreemap_destroy(struct ip_set *set)
6033 +{
6034 + struct ip_set_iptreemap *map = set->data;
6035 +
6036 + while (!del_timer(&map->gc))
6037 + msleep(IPTREEMAP_DESTROY_SLEEP);
6038 +
6039 + __flush(map);
6040 + kfree(map);
6041 +
6042 + set->data = NULL;
6043 +}
6044 +
6045 +static void
6046 +iptreemap_flush(struct ip_set *set)
6047 +{
6048 + struct ip_set_iptreemap *map = set->data;
6049 +
6050 + while (!del_timer(&map->gc))
6051 + msleep(IPTREEMAP_DESTROY_SLEEP);
6052 +
6053 + __flush(map);
6054 +
6055 + memset(map, 0, sizeof(*map));
6056 +
6057 + init_gc_timer(set);
6058 +}
6059 +
6060 +static void
6061 +iptreemap_list_header(const struct ip_set *set, void *data)
6062 +{
6063 + struct ip_set_iptreemap *map = set->data;
6064 + struct ip_set_req_iptreemap_create *header = data;
6065 +
6066 + header->gc_interval = map->gc_interval;
6067 +}
6068 +
6069 +static int
6070 +iptreemap_list_members_size(const struct ip_set *set)
6071 +{
6072 + struct ip_set_iptreemap *map = set->data;
6073 + struct ip_set_iptreemap_b *btree;
6074 + struct ip_set_iptreemap_c *ctree;
6075 + struct ip_set_iptreemap_d *dtree;
6076 + unsigned int a, b, c, d, inrange = 0, count = 0;
6077 +
6078 + LOOP_WALK_BEGIN_COUNT(map, a, btree, inrange, count) {
6079 + LOOP_WALK_BEGIN_COUNT(btree, b, ctree, inrange, count) {
6080 + LOOP_WALK_BEGIN_COUNT(ctree, c, dtree, inrange, count) {
6081 + for (d = 0; d < 256; d++) {
6082 + if (test_bit(d, (void *) dtree->bitmap)) {
6083 + inrange = 1;
6084 + } else if (inrange) {
6085 + count++;
6086 + inrange = 0;
6087 + }
6088 + }
6089 + } LOOP_WALK_END_COUNT();
6090 + } LOOP_WALK_END_COUNT();
6091 + } LOOP_WALK_END_COUNT();
6092 +
6093 + if (inrange)
6094 + count++;
6095 +
6096 + return (count * sizeof(struct ip_set_req_iptreemap));
6097 +}
6098 +
6099 +static inline u_int32_t
6100 +add_member(void *data, size_t offset, ip_set_ip_t start, ip_set_ip_t end)
6101 +{
6102 + struct ip_set_req_iptreemap *entry = data + offset;
6103 +
6104 + entry->ip = start;
6105 + entry->end = end;
6106 +
6107 + return sizeof(*entry);
6108 +}
6109 +
6110 +static void
6111 +iptreemap_list_members(const struct ip_set *set, void *data)
6112 +{
6113 + struct ip_set_iptreemap *map = set->data;
6114 + struct ip_set_iptreemap_b *btree;
6115 + struct ip_set_iptreemap_c *ctree;
6116 + struct ip_set_iptreemap_d *dtree;
6117 + unsigned int a, b, c, d, inrange = 0;
6118 + size_t offset = 0;
6119 + ip_set_ip_t start = 0, end = 0, ip;
6120 +
6121 + LOOP_WALK_BEGIN(map, a, btree) {
6122 + LOOP_WALK_BEGIN(btree, b, ctree) {
6123 + LOOP_WALK_BEGIN(ctree, c, dtree) {
6124 + for (d = 0; d < 256; d++) {
6125 + if (test_bit(d, (void *) dtree->bitmap)) {
6126 + ip = ((a << 24) | (b << 16) | (c << 8) | d);
6127 + if (!inrange) {
6128 + inrange = 1;
6129 + start = ip;
6130 + } else if (end < ip - 1) {
6131 + offset += add_member(data, offset, start, end);
6132 + start = ip;
6133 + }
6134 + end = ip;
6135 + } else if (inrange) {
6136 + offset += add_member(data, offset, start, end);
6137 + inrange = 0;
6138 + }
6139 + }
6140 + } LOOP_WALK_END();
6141 + } LOOP_WALK_END();
6142 + } LOOP_WALK_END();
6143 +
6144 + if (inrange)
6145 + add_member(data, offset, start, end);
6146 +}
6147 +
6148 +IP_SET_TYPE(iptreemap, IPSET_TYPE_IP | IPSET_DATA_SINGLE)
6149 +
6150 +MODULE_LICENSE("GPL");
6151 +MODULE_AUTHOR("Sven Wegener <sven.wegener@stealer.net>");
6152 +MODULE_DESCRIPTION("iptreemap type of IP sets");
6153 +
6154 +static int __init ip_set_iptreemap_init(void)
6155 +{
6156 + int ret = -ENOMEM;
6157 + int a;
6158 +
6159 + cachep_b = KMEM_CACHE_CREATE("ip_set_iptreemap_b",
6160 + sizeof(struct ip_set_iptreemap_b));
6161 + if (!cachep_b) {
6162 + ip_set_printk("Unable to create ip_set_iptreemap_b slab cache");
6163 + goto out;
6164 + }
6165 +
6166 + cachep_c = KMEM_CACHE_CREATE("ip_set_iptreemap_c",
6167 + sizeof(struct ip_set_iptreemap_c));
6168 + if (!cachep_c) {
6169 + ip_set_printk("Unable to create ip_set_iptreemap_c slab cache");
6170 + goto outb;
6171 + }
6172 +
6173 + cachep_d = KMEM_CACHE_CREATE("ip_set_iptreemap_d",
6174 + sizeof(struct ip_set_iptreemap_d));
6175 + if (!cachep_d) {
6176 + ip_set_printk("Unable to create ip_set_iptreemap_d slab cache");
6177 + goto outc;
6178 + }
6179 +
6180 + fullbitmap_d = kmem_cache_alloc(cachep_d, GFP_KERNEL);
6181 + if (!fullbitmap_d)
6182 + goto outd;
6183 +
6184 + fullbitmap_c = kmem_cache_alloc(cachep_c, GFP_KERNEL);
6185 + if (!fullbitmap_c)
6186 + goto outbitmapd;
6187 +
6188 + fullbitmap_b = kmem_cache_alloc(cachep_b, GFP_KERNEL);
6189 + if (!fullbitmap_b)
6190 + goto outbitmapc;
6191 +
6192 + ret = ip_set_register_set_type(&ip_set_iptreemap);
6193 + if (0 > ret)
6194 + goto outbitmapb;
6195 +
6196 + /* Now init our global bitmaps */
6197 + memset(fullbitmap_d->bitmap, 0xff, sizeof(fullbitmap_d->bitmap));
6198 +
6199 + for (a = 0; a < 256; a++)
6200 + fullbitmap_c->tree[a] = fullbitmap_d;
6201 +
6202 + for (a = 0; a < 256; a++)
6203 + fullbitmap_b->tree[a] = fullbitmap_c;
6204 + memset(fullbitmap_b->dirty, 0, sizeof(fullbitmap_b->dirty));
6205 +
6206 + return 0;
6207 +
6208 +outbitmapb:
6209 + kmem_cache_free(cachep_b, fullbitmap_b);
6210 +outbitmapc:
6211 + kmem_cache_free(cachep_c, fullbitmap_c);
6212 +outbitmapd:
6213 + kmem_cache_free(cachep_d, fullbitmap_d);
6214 +outd:
6215 + kmem_cache_destroy(cachep_d);
6216 +outc:
6217 + kmem_cache_destroy(cachep_c);
6218 +outb:
6219 + kmem_cache_destroy(cachep_b);
6220 +out:
6221 +
6222 + return ret;
6223 +}
6224 +
6225 +static void __exit ip_set_iptreemap_fini(void)
6226 +{
6227 + ip_set_unregister_set_type(&ip_set_iptreemap);
6228 + kmem_cache_free(cachep_d, fullbitmap_d);
6229 + kmem_cache_free(cachep_c, fullbitmap_c);
6230 + kmem_cache_free(cachep_b, fullbitmap_b);
6231 + kmem_cache_destroy(cachep_d);
6232 + kmem_cache_destroy(cachep_c);
6233 + kmem_cache_destroy(cachep_b);
6234 +}
6235 +
6236 +module_init(ip_set_iptreemap_init);
6237 +module_exit(ip_set_iptreemap_fini);
6238 --- /dev/null
6239 +++ b/net/ipv4/netfilter/ip_set_macipmap.c
6240 @@ -0,0 +1,164 @@
6241 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
6242 + * Patrick Schaaf <bof@bof.de>
6243 + * Martin Josefsson <gandalf@wlug.westbo.se>
6244 + * Copyright (C) 2003-2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
6245 + *
6246 + * This program is free software; you can redistribute it and/or modify
6247 + * it under the terms of the GNU General Public License version 2 as
6248 + * published by the Free Software Foundation.
6249 + */
6250 +
6251 +/* Kernel module implementing an IP set type: the macipmap type */
6252 +
6253 +#include <linux/module.h>
6254 +#include <linux/ip.h>
6255 +#include <linux/skbuff.h>
6256 +#include <linux/errno.h>
6257 +#include <asm/uaccess.h>
6258 +#include <asm/bitops.h>
6259 +#include <linux/spinlock.h>
6260 +#include <linux/if_ether.h>
6261 +
6262 +#include <linux/netfilter_ipv4/ip_set_macipmap.h>
6263 +
6264 +static int
6265 +macipmap_utest(struct ip_set *set, const void *data, u_int32_t size,
6266 + ip_set_ip_t *hash_ip)
6267 +{
6268 + const struct ip_set_macipmap *map = set->data;
6269 + const struct ip_set_macip *table = map->members;
6270 + const struct ip_set_req_macipmap *req = data;
6271 +
6272 + if (req->ip < map->first_ip || req->ip > map->last_ip)
6273 + return -ERANGE;
6274 +
6275 + *hash_ip = req->ip;
6276 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u",
6277 + set->name, HIPQUAD(req->ip), HIPQUAD(*hash_ip));
6278 + if (table[req->ip - map->first_ip].match) {
6279 + return (memcmp(req->ethernet,
6280 + &table[req->ip - map->first_ip].ethernet,
6281 + ETH_ALEN) == 0);
6282 + } else {
6283 + return (map->flags & IPSET_MACIP_MATCHUNSET ? 1 : 0);
6284 + }
6285 +}
6286 +
6287 +static int
6288 +macipmap_ktest(struct ip_set *set,
6289 + const struct sk_buff *skb,
6290 + ip_set_ip_t *hash_ip,
6291 + const u_int32_t *flags,
6292 + unsigned char index)
6293 +{
6294 + const struct ip_set_macipmap *map = set->data;
6295 + const struct ip_set_macip *table = map->members;
6296 + ip_set_ip_t ip;
6297 +
6298 + ip = ipaddr(skb, flags[index]);
6299 +
6300 + if (ip < map->first_ip || ip > map->last_ip)
6301 + return 0;
6302 +
6303 + *hash_ip = ip;
6304 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u",
6305 + set->name, HIPQUAD(ip), HIPQUAD(*hash_ip));
6306 + if (table[ip - map->first_ip].match) {
6307 + /* Is mac pointer valid?
6308 + * If so, compare... */
6309 + return (skb_mac_header(skb) >= skb->head
6310 + && (skb_mac_header(skb) + ETH_HLEN) <= skb->data
6311 + && (memcmp(eth_hdr(skb)->h_source,
6312 + &table[ip - map->first_ip].ethernet,
6313 + ETH_ALEN) == 0));
6314 + } else {
6315 + return (map->flags & IPSET_MACIP_MATCHUNSET ? 1 : 0);
6316 + }
6317 +}
6318 +
6319 +/* returns 0 on success */
6320 +static inline int
6321 +macipmap_add(struct ip_set *set, ip_set_ip_t *hash_ip,
6322 + ip_set_ip_t ip, const unsigned char *ethernet)
6323 +{
6324 + struct ip_set_macipmap *map = set->data;
6325 + struct ip_set_macip *table = map->members;
6326 +
6327 + if (ip < map->first_ip || ip > map->last_ip)
6328 + return -ERANGE;
6329 + if (table[ip - map->first_ip].match)
6330 + return -EEXIST;
6331 +
6332 + *hash_ip = ip;
6333 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
6334 + memcpy(&table[ip - map->first_ip].ethernet, ethernet, ETH_ALEN);
6335 + table[ip - map->first_ip].match = IPSET_MACIP_ISSET;
6336 + return 0;
6337 +}
6338 +
6339 +#define KADT_CONDITION \
6340 + if (!(skb_mac_header(skb) >= skb->head \
6341 + && (skb_mac_header(skb) + ETH_HLEN) <= skb->data))\
6342 + return -EINVAL;
6343 +
6344 +UADT(macipmap, add, req->ethernet)
6345 +KADT(macipmap, add, ipaddr, eth_hdr(skb)->h_source)
6346 +
6347 +static inline int
6348 +macipmap_del(struct ip_set *set, ip_set_ip_t *hash_ip, ip_set_ip_t ip)
6349 +{
6350 + struct ip_set_macipmap *map = set->data;
6351 + struct ip_set_macip *table = map->members;
6352 +
6353 + if (ip < map->first_ip || ip > map->last_ip)
6354 + return -ERANGE;
6355 + if (!table[ip - map->first_ip].match)
6356 + return -EEXIST;
6357 +
6358 + *hash_ip = ip;
6359 + table[ip - map->first_ip].match = 0;
6360 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
6361 + return 0;
6362 +}
6363 +
6364 +#undef KADT_CONDITION
6365 +#define KADT_CONDITION
6366 +
6367 +UADT(macipmap, del)
6368 +KADT(macipmap, del, ipaddr)
6369 +
6370 +static inline int
6371 +__macipmap_create(const struct ip_set_req_macipmap_create *req,
6372 + struct ip_set_macipmap *map)
6373 +{
6374 + if (req->to - req->from > MAX_RANGE) {
6375 + ip_set_printk("range too big, %d elements (max %d)",
6376 + req->to - req->from + 1, MAX_RANGE+1);
6377 + return -ENOEXEC;
6378 + }
6379 + map->flags = req->flags;
6380 + return (req->to - req->from + 1) * sizeof(struct ip_set_macip);
6381 +}
6382 +
6383 +BITMAP_CREATE(macipmap)
6384 +BITMAP_DESTROY(macipmap)
6385 +BITMAP_FLUSH(macipmap)
6386 +
6387 +static inline void
6388 +__macipmap_list_header(const struct ip_set_macipmap *map,
6389 + struct ip_set_req_macipmap_create *header)
6390 +{
6391 + header->flags = map->flags;
6392 +}
6393 +
6394 +BITMAP_LIST_HEADER(macipmap)
6395 +BITMAP_LIST_MEMBERS_SIZE(macipmap)
6396 +BITMAP_LIST_MEMBERS(macipmap)
6397 +
6398 +IP_SET_TYPE(macipmap, IPSET_TYPE_IP | IPSET_DATA_SINGLE)
6399 +
6400 +MODULE_LICENSE("GPL");
6401 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
6402 +MODULE_DESCRIPTION("macipmap type of IP sets");
6403 +
6404 +REGISTER_MODULE(macipmap)
6405 --- /dev/null
6406 +++ b/net/ipv4/netfilter/ip_set_nethash.c
6407 @@ -0,0 +1,225 @@
6408 +/* Copyright (C) 2003-2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
6409 + *
6410 + * This program is free software; you can redistribute it and/or modify
6411 + * it under the terms of the GNU General Public License version 2 as
6412 + * published by the Free Software Foundation.
6413 + */
6414 +
6415 +/* Kernel module implementing a cidr nethash set */
6416 +
6417 +#include <linux/module.h>
6418 +#include <linux/moduleparam.h>
6419 +#include <linux/ip.h>
6420 +#include <linux/skbuff.h>
6421 +#include <linux/netfilter_ipv4/ip_set_jhash.h>
6422 +#include <linux/errno.h>
6423 +#include <asm/uaccess.h>
6424 +#include <asm/bitops.h>
6425 +#include <linux/spinlock.h>
6426 +#include <linux/random.h>
6427 +
6428 +#include <net/ip.h>
6429 +
6430 +#include <linux/netfilter_ipv4/ip_set_nethash.h>
6431 +
6432 +static int limit = MAX_RANGE;
6433 +
6434 +static inline __u32
6435 +nethash_id_cidr(const struct ip_set_nethash *map,
6436 + ip_set_ip_t *hash_ip,
6437 + ip_set_ip_t ip,
6438 + uint8_t cidr)
6439 +{
6440 + __u32 id;
6441 + u_int16_t i;
6442 + ip_set_ip_t *elem;
6443 +
6444 + *hash_ip = pack_ip_cidr(ip, cidr);
6445 + if (!*hash_ip)
6446 + return MAX_RANGE;
6447 +
6448 + for (i = 0; i < map->probes; i++) {
6449 + id = jhash_ip(map, i, *hash_ip) % map->hashsize;
6450 + DP("hash key: %u", id);
6451 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
6452 + if (*elem == *hash_ip)
6453 + return id;
6454 + /* No shortcut - there can be deleted entries. */
6455 + }
6456 + return UINT_MAX;
6457 +}
6458 +
6459 +static inline __u32
6460 +nethash_id(struct ip_set *set, ip_set_ip_t *hash_ip, ip_set_ip_t ip)
6461 +{
6462 + const struct ip_set_nethash *map = set->data;
6463 + __u32 id = UINT_MAX;
6464 + int i;
6465 +
6466 + for (i = 0; i < 30 && map->cidr[i]; i++) {
6467 + id = nethash_id_cidr(map, hash_ip, ip, map->cidr[i]);
6468 + if (id != UINT_MAX)
6469 + break;
6470 + }
6471 + return id;
6472 +}
6473 +
6474 +static inline int
6475 +nethash_test_cidr(struct ip_set *set, ip_set_ip_t *hash_ip,
6476 + ip_set_ip_t ip, uint8_t cidr)
6477 +{
6478 + const struct ip_set_nethash *map = set->data;
6479 +
6480 + return (nethash_id_cidr(map, hash_ip, ip, cidr) != UINT_MAX);
6481 +}
6482 +
6483 +static inline int
6484 +nethash_test(struct ip_set *set, ip_set_ip_t *hash_ip, ip_set_ip_t ip)
6485 +{
6486 + return (nethash_id(set, hash_ip, ip) != UINT_MAX);
6487 +}
6488 +
6489 +static int
6490 +nethash_utest(struct ip_set *set, const void *data, u_int32_t size,
6491 + ip_set_ip_t *hash_ip)
6492 +{
6493 + const struct ip_set_req_nethash *req = data;
6494 +
6495 + if (req->cidr <= 0 || req->cidr > 32)
6496 + return -EINVAL;
6497 + return (req->cidr == 32 ? nethash_test(set, hash_ip, req->ip)
6498 + : nethash_test_cidr(set, hash_ip, req->ip, req->cidr));
6499 +}
6500 +
6501 +#define KADT_CONDITION
6502 +
6503 +KADT(nethash, test, ipaddr)
6504 +
6505 +static inline int
6506 +__nethash_add(struct ip_set_nethash *map, ip_set_ip_t *ip)
6507 +{
6508 + __u32 probe;
6509 + u_int16_t i;
6510 + ip_set_ip_t *elem, *slot = NULL;
6511 +
6512 + for (i = 0; i < map->probes; i++) {
6513 + probe = jhash_ip(map, i, *ip) % map->hashsize;
6514 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, probe);
6515 + if (*elem == *ip)
6516 + return -EEXIST;
6517 + if (!(slot || *elem))
6518 + slot = elem;
6519 + /* There can be deleted entries, must check all slots */
6520 + }
6521 + if (slot) {
6522 + *slot = *ip;
6523 + map->elements++;
6524 + return 0;
6525 + }
6526 + /* Trigger rehashing */
6527 + return -EAGAIN;
6528 +}
6529 +
6530 +static inline int
6531 +nethash_add(struct ip_set *set, ip_set_ip_t *hash_ip,
6532 + ip_set_ip_t ip, uint8_t cidr)
6533 +{
6534 + struct ip_set_nethash *map = set->data;
6535 + int ret;
6536 +
6537 + if (map->elements >= limit || map->nets[cidr-1] == UINT16_MAX)
6538 + return -ERANGE;
6539 + if (cidr <= 0 || cidr >= 32)
6540 + return -EINVAL;
6541 +
6542 + *hash_ip = pack_ip_cidr(ip, cidr);
6543 + DP("%u.%u.%u.%u/%u, %u.%u.%u.%u", HIPQUAD(ip), cidr, HIPQUAD(*hash_ip));
6544 + if (!*hash_ip)
6545 + return -ERANGE;
6546 +
6547 + ret = __nethash_add(map, hash_ip);
6548 + if (ret == 0) {
6549 + if (!map->nets[cidr-1]++)
6550 + add_cidr_size(map->cidr, cidr);
6551 + map->elements++;
6552 + }
6553 +
6554 + return ret;
6555 +}
6556 +
6557 +#undef KADT_CONDITION
6558 +#define KADT_CONDITION \
6559 + struct ip_set_nethash *map = set->data; \
6560 + uint8_t cidr = map->cidr[0] ? map->cidr[0] : 31;
6561 +
6562 +UADT(nethash, add, req->cidr)
6563 +KADT(nethash, add, ipaddr, cidr)
6564 +
6565 +static inline void
6566 +__nethash_retry(struct ip_set_nethash *tmp, struct ip_set_nethash *map)
6567 +{
6568 + memcpy(tmp->cidr, map->cidr, sizeof(tmp->cidr));
6569 + memcpy(tmp->nets, map->nets, sizeof(tmp->nets));
6570 +}
6571 +
6572 +HASH_RETRY(nethash, ip_set_ip_t)
6573 +
6574 +static inline int
6575 +nethash_del(struct ip_set *set, ip_set_ip_t *hash_ip,
6576 + ip_set_ip_t ip, uint8_t cidr)
6577 +{
6578 + struct ip_set_nethash *map = set->data;
6579 + ip_set_ip_t id, *elem;
6580 +
6581 + if (cidr <= 0 || cidr >= 32)
6582 + return -EINVAL;
6583 +
6584 + id = nethash_id_cidr(map, hash_ip, ip, cidr);
6585 + if (id == UINT_MAX)
6586 + return -EEXIST;
6587 +
6588 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
6589 + *elem = 0;
6590 + map->elements--;
6591 + if (!map->nets[cidr-1]--)
6592 + del_cidr_size(map->cidr, cidr);
6593 + return 0;
6594 +}
6595 +
6596 +UADT(nethash, del, req->cidr)
6597 +KADT(nethash, del, ipaddr, cidr)
6598 +
6599 +static inline int
6600 +__nethash_create(const struct ip_set_req_nethash_create *req,
6601 + struct ip_set_nethash *map)
6602 +{
6603 + memset(map->cidr, 0, sizeof(map->cidr));
6604 + memset(map->nets, 0, sizeof(map->nets));
6605 +
6606 + return 0;
6607 +}
6608 +
6609 +HASH_CREATE(nethash, ip_set_ip_t)
6610 +HASH_DESTROY(nethash)
6611 +
6612 +HASH_FLUSH_CIDR(nethash, ip_set_ip_t)
6613 +
6614 +static inline void
6615 +__nethash_list_header(const struct ip_set_nethash *map,
6616 + struct ip_set_req_nethash_create *header)
6617 +{
6618 +}
6619 +
6620 +HASH_LIST_HEADER(nethash)
6621 +HASH_LIST_MEMBERS_SIZE(nethash, ip_set_ip_t)
6622 +HASH_LIST_MEMBERS(nethash, ip_set_ip_t)
6623 +
6624 +IP_SET_RTYPE(nethash, IPSET_TYPE_IP | IPSET_DATA_SINGLE)
6625 +
6626 +MODULE_LICENSE("GPL");
6627 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
6628 +MODULE_DESCRIPTION("nethash type of IP sets");
6629 +module_param(limit, int, 0600);
6630 +MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
6631 +
6632 +REGISTER_MODULE(nethash)
6633 --- /dev/null
6634 +++ b/net/ipv4/netfilter/ip_set_portmap.c
6635 @@ -0,0 +1,114 @@
6636 +/* Copyright (C) 2003-2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
6637 + *
6638 + * This program is free software; you can redistribute it and/or modify
6639 + * it under the terms of the GNU General Public License version 2 as
6640 + * published by the Free Software Foundation.
6641 + */
6642 +
6643 +/* Kernel module implementing a port set type as a bitmap */
6644 +
6645 +#include <linux/module.h>
6646 +#include <linux/ip.h>
6647 +#include <linux/tcp.h>
6648 +#include <linux/udp.h>
6649 +#include <linux/skbuff.h>
6650 +#include <linux/errno.h>
6651 +#include <asm/uaccess.h>
6652 +#include <asm/bitops.h>
6653 +#include <linux/spinlock.h>
6654 +
6655 +#include <net/ip.h>
6656 +
6657 +#include <linux/netfilter_ipv4/ip_set_portmap.h>
6658 +#include <linux/netfilter_ipv4/ip_set_getport.h>
6659 +
6660 +static inline int
6661 +portmap_test(const struct ip_set *set, ip_set_ip_t *hash_port,
6662 + ip_set_ip_t port)
6663 +{
6664 + const struct ip_set_portmap *map = set->data;
6665 +
6666 + if (port < map->first_ip || port > map->last_ip)
6667 + return -ERANGE;
6668 +
6669 + *hash_port = port;
6670 + DP("set: %s, port:%u, %u", set->name, port, *hash_port);
6671 + return !!test_bit(port - map->first_ip, map->members);
6672 +}
6673 +
6674 +#define KADT_CONDITION \
6675 + if (ip == INVALID_PORT) \
6676 + return 0;
6677 +
6678 +UADT(portmap, test)
6679 +KADT(portmap, test, get_port)
6680 +
6681 +static inline int
6682 +portmap_add(struct ip_set *set, ip_set_ip_t *hash_port, ip_set_ip_t port)
6683 +{
6684 + struct ip_set_portmap *map = set->data;
6685 +
6686 + if (port < map->first_ip || port > map->last_ip)
6687 + return -ERANGE;
6688 + if (test_and_set_bit(port - map->first_ip, map->members))
6689 + return -EEXIST;
6690 +
6691 + *hash_port = port;
6692 + DP("port %u", port);
6693 + return 0;
6694 +}
6695 +
6696 +UADT(portmap, add)
6697 +KADT(portmap, add, get_port)
6698 +
6699 +static inline int
6700 +portmap_del(struct ip_set *set, ip_set_ip_t *hash_port, ip_set_ip_t port)
6701 +{
6702 + struct ip_set_portmap *map = set->data;
6703 +
6704 + if (port < map->first_ip || port > map->last_ip)
6705 + return -ERANGE;
6706 + if (!test_and_clear_bit(port - map->first_ip, map->members))
6707 + return -EEXIST;
6708 +
6709 + *hash_port = port;
6710 + DP("port %u", port);
6711 + return 0;
6712 +}
6713 +
6714 +UADT(portmap, del)
6715 +KADT(portmap, del, get_port)
6716 +
6717 +static inline int
6718 +__portmap_create(const struct ip_set_req_portmap_create *req,
6719 + struct ip_set_portmap *map)
6720 +{
6721 + if (req->to - req->from > MAX_RANGE) {
6722 + ip_set_printk("range too big, %d elements (max %d)",
6723 + req->to - req->from + 1, MAX_RANGE+1);
6724 + return -ENOEXEC;
6725 + }
6726 + return bitmap_bytes(req->from, req->to);
6727 +}
6728 +
6729 +BITMAP_CREATE(portmap)
6730 +BITMAP_DESTROY(portmap)
6731 +BITMAP_FLUSH(portmap)
6732 +
6733 +static inline void
6734 +__portmap_list_header(const struct ip_set_portmap *map,
6735 + struct ip_set_req_portmap_create *header)
6736 +{
6737 +}
6738 +
6739 +BITMAP_LIST_HEADER(portmap)
6740 +BITMAP_LIST_MEMBERS_SIZE(portmap)
6741 +BITMAP_LIST_MEMBERS(portmap)
6742 +
6743 +IP_SET_TYPE(portmap, IPSET_TYPE_PORT | IPSET_DATA_SINGLE)
6744 +
6745 +MODULE_LICENSE("GPL");
6746 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
6747 +MODULE_DESCRIPTION("portmap type of IP sets");
6748 +
6749 +REGISTER_MODULE(portmap)
6750 --- /dev/null
6751 +++ b/net/ipv4/netfilter/ip_set_setlist.c
6752 @@ -0,0 +1,330 @@
6753 +/* Copyright (C) 2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
6754 + *
6755 + * This program is free software; you can redistribute it and/or modify
6756 + * it under the terms of the GNU General Public License version 2 as
6757 + * published by the Free Software Foundation.
6758 + */
6759 +
6760 +/* Kernel module implementing an IP set type: the setlist type */
6761 +
6762 +#include <linux/module.h>
6763 +#include <linux/ip.h>
6764 +#include <linux/skbuff.h>
6765 +#include <linux/errno.h>
6766 +
6767 +#include <linux/netfilter_ipv4/ip_set.h>
6768 +#include <linux/netfilter_ipv4/ip_set_bitmaps.h>
6769 +#include <linux/netfilter_ipv4/ip_set_setlist.h>
6770 +
6771 +/*
6772 + * before ==> index, ref
6773 + * after ==> ref, index
6774 + */
6775 +
6776 +static inline int
6777 +next_index_eq(const struct ip_set_setlist *map, int i, ip_set_id_t index)
6778 +{
6779 + return i < map->size && map->index[i] == index;
6780 +}
6781 +
6782 +static int
6783 +setlist_utest(struct ip_set *set, const void *data, u_int32_t size,
6784 + ip_set_ip_t *hash_ip)
6785 +{
6786 + const struct ip_set_setlist *map = set->data;
6787 + const struct ip_set_req_setlist *req = data;
6788 + ip_set_id_t index, ref = IP_SET_INVALID_ID;
6789 + int i, res = 0;
6790 + struct ip_set *s;
6791 +
6792 + if (req->before && req->ref[0] == '\0')
6793 + return 0;
6794 +
6795 + index = __ip_set_get_byname(req->name, &s);
6796 + if (index == IP_SET_INVALID_ID)
6797 + return 0;
6798 + if (req->ref[0] != '\0') {
6799 + ref = __ip_set_get_byname(req->ref, &s);
6800 + if (ref == IP_SET_INVALID_ID)
6801 + goto finish;
6802 + }
6803 + for (i = 0; i < map->size
6804 + && map->index[i] != IP_SET_INVALID_ID; i++) {
6805 + if (req->before && map->index[i] == index) {
6806 + res = next_index_eq(map, i + 1, ref);
6807 + break;
6808 + } else if (!req->before) {
6809 + if ((ref == IP_SET_INVALID_ID
6810 + && map->index[i] == index)
6811 + || (map->index[i] == ref
6812 + && next_index_eq(map, i + 1, index))) {
6813 + res = 1;
6814 + break;
6815 + }
6816 + }
6817 + }
6818 + if (ref != IP_SET_INVALID_ID)
6819 + __ip_set_put_byindex(ref);
6820 +finish:
6821 + __ip_set_put_byindex(index);
6822 + return res;
6823 +}
6824 +
6825 +static int
6826 +setlist_ktest(struct ip_set *set,
6827 + const struct sk_buff *skb,
6828 + ip_set_ip_t *hash_ip,
6829 + const u_int32_t *flags,
6830 + unsigned char index)
6831 +{
6832 + struct ip_set_setlist *map = set->data;
6833 + int i, res = 0;
6834 +
6835 + for (i = 0; i < map->size
6836 + && map->index[i] != IP_SET_INVALID_ID
6837 + && res == 0; i++)
6838 + res = ip_set_testip_kernel(map->index[i], skb, flags);
6839 + return res;
6840 +}
6841 +
6842 +static inline int
6843 +insert_setlist(struct ip_set_setlist *map, int i, ip_set_id_t index)
6844 +{
6845 + ip_set_id_t tmp;
6846 + int j;
6847 +
6848 + DP("i: %u, last %u\n", i, map->index[map->size - 1]);
6849 + if (i >= map->size || map->index[map->size - 1] != IP_SET_INVALID_ID)
6850 + return -ERANGE;
6851 +
6852 + for (j = i; j < map->size
6853 + && index != IP_SET_INVALID_ID; j++) {
6854 + tmp = map->index[j];
6855 + map->index[j] = index;
6856 + index = tmp;
6857 + }
6858 + return 0;
6859 +}
6860 +
6861 +static int
6862 +setlist_uadd(struct ip_set *set, const void *data, u_int32_t size,
6863 + ip_set_ip_t *hash_ip)
6864 +{
6865 + struct ip_set_setlist *map = set->data;
6866 + const struct ip_set_req_setlist *req = data;
6867 + ip_set_id_t index, ref = IP_SET_INVALID_ID;
6868 + int i, res = -ERANGE;
6869 + struct ip_set *s;
6870 +
6871 + if (req->before && req->ref[0] == '\0')
6872 + return -EINVAL;
6873 +
6874 + index = __ip_set_get_byname(req->name, &s);
6875 + if (index == IP_SET_INVALID_ID)
6876 + return -EEXIST;
6877 + /* "Loop detection" */
6878 + if (strcmp(s->type->typename, "setlist") == 0)
6879 + goto finish;
6880 +
6881 + if (req->ref[0] != '\0') {
6882 + ref = __ip_set_get_byname(req->ref, &s);
6883 + if (ref == IP_SET_INVALID_ID) {
6884 + res = -EEXIST;
6885 + goto finish;
6886 + }
6887 + }
6888 + for (i = 0; i < map->size; i++) {
6889 + if (map->index[i] != ref)
6890 + continue;
6891 + if (req->before)
6892 + res = insert_setlist(map, i, index);
6893 + else
6894 + res = insert_setlist(map,
6895 + ref == IP_SET_INVALID_ID ? i : i + 1,
6896 + index);
6897 + break;
6898 + }
6899 + if (ref != IP_SET_INVALID_ID)
6900 + __ip_set_put_byindex(ref);
6901 + /* In case of success, we keep the reference to the set */
6902 +finish:
6903 + if (res != 0)
6904 + __ip_set_put_byindex(index);
6905 + return res;
6906 +}
6907 +
6908 +static int
6909 +setlist_kadd(struct ip_set *set,
6910 + const struct sk_buff *skb,
6911 + ip_set_ip_t *hash_ip,
6912 + const u_int32_t *flags,
6913 + unsigned char index)
6914 +{
6915 + struct ip_set_setlist *map = set->data;
6916 + int i, res = -EINVAL;
6917 +
6918 + for (i = 0; i < map->size
6919 + && map->index[i] != IP_SET_INVALID_ID
6920 + && res != 0; i++)
6921 + res = ip_set_addip_kernel(map->index[i], skb, flags);
6922 + return res;
6923 +}
6924 +
6925 +static inline int
6926 +unshift_setlist(struct ip_set_setlist *map, int i)
6927 +{
6928 + int j;
6929 +
6930 + for (j = i; j < map->size - 1; j++)
6931 + map->index[j] = map->index[j+1];
6932 + map->index[map->size-1] = IP_SET_INVALID_ID;
6933 + return 0;
6934 +}
6935 +
6936 +static int
6937 +setlist_udel(struct ip_set *set, const void *data, u_int32_t size,
6938 + ip_set_ip_t *hash_ip)
6939 +{
6940 + struct ip_set_setlist *map = set->data;
6941 + const struct ip_set_req_setlist *req = data;
6942 + ip_set_id_t index, ref = IP_SET_INVALID_ID;
6943 + int i, res = -EEXIST;
6944 + struct ip_set *s;
6945 +
6946 + if (req->before && req->ref[0] == '\0')
6947 + return -EINVAL;
6948 +
6949 + index = __ip_set_get_byname(req->name, &s);
6950 + if (index == IP_SET_INVALID_ID)
6951 + return -EEXIST;
6952 + if (req->ref[0] != '\0') {
6953 + ref = __ip_set_get_byname(req->ref, &s);
6954 + if (ref == IP_SET_INVALID_ID)
6955 + goto finish;
6956 + }
6957 + for (i = 0; i < map->size
6958 + && map->index[i] != IP_SET_INVALID_ID; i++) {
6959 + if (req->before) {
6960 + if (map->index[i] == index
6961 + && next_index_eq(map, i + 1, ref)) {
6962 + res = unshift_setlist(map, i);
6963 + break;
6964 + }
6965 + } else if (ref == IP_SET_INVALID_ID) {
6966 + if (map->index[i] == index) {
6967 + res = unshift_setlist(map, i);
6968 + break;
6969 + }
6970 + } else if (map->index[i] == ref
6971 + && next_index_eq(map, i + 1, index)) {
6972 + res = unshift_setlist(map, i + 1);
6973 + break;
6974 + }
6975 + }
6976 + if (ref != IP_SET_INVALID_ID)
6977 + __ip_set_put_byindex(ref);
6978 +finish:
6979 + __ip_set_put_byindex(index);
6980 + /* In case of success, release the reference to the set */
6981 + if (res == 0)
6982 + __ip_set_put_byindex(index);
6983 + return res;
6984 +}
6985 +
6986 +static int
6987 +setlist_kdel(struct ip_set *set,
6988 + const struct sk_buff *skb,
6989 + ip_set_ip_t *hash_ip,
6990 + const u_int32_t *flags,
6991 + unsigned char index)
6992 +{
6993 + struct ip_set_setlist *map = set->data;
6994 + int i, res = -EINVAL;
6995 +
6996 + for (i = 0; i < map->size
6997 + && map->index[i] != IP_SET_INVALID_ID
6998 + && res != 0; i++)
6999 + res = ip_set_delip_kernel(map->index[i], skb, flags);
7000 + return res;
7001 +}
7002 +
7003 +static int
7004 +setlist_create(struct ip_set *set, const void *data, u_int32_t size)
7005 +{
7006 + struct ip_set_setlist *map;
7007 + const struct ip_set_req_setlist_create *req = data;
7008 + int i;
7009 +
7010 + map = kmalloc(sizeof(struct ip_set_setlist) +
7011 + req->size * sizeof(ip_set_id_t), GFP_KERNEL);
7012 + if (!map)
7013 + return -ENOMEM;
7014 + map->size = req->size;
7015 + for (i = 0; i < map->size; i++)
7016 + map->index[i] = IP_SET_INVALID_ID;
7017 +
7018 + set->data = map;
7019 + return 0;
7020 +}
7021 +
7022 +static void
7023 +setlist_destroy(struct ip_set *set)
7024 +{
7025 + struct ip_set_setlist *map = set->data;
7026 + int i;
7027 +
7028 + for (i = 0; i < map->size
7029 + && map->index[i] != IP_SET_INVALID_ID; i++)
7030 + __ip_set_put_byindex(map->index[i]);
7031 +
7032 + kfree(map);
7033 + set->data = NULL;
7034 +}
7035 +
7036 +static void
7037 +setlist_flush(struct ip_set *set)
7038 +{
7039 + struct ip_set_setlist *map = set->data;
7040 + int i;
7041 +
7042 + for (i = 0; i < map->size
7043 + && map->index[i] != IP_SET_INVALID_ID; i++) {
7044 + __ip_set_put_byindex(map->index[i]);
7045 + map->index[i] = IP_SET_INVALID_ID;
7046 + }
7047 +}
7048 +
7049 +static void
7050 +setlist_list_header(const struct ip_set *set, void *data)
7051 +{
7052 + const struct ip_set_setlist *map = set->data;
7053 + struct ip_set_req_setlist_create *header = data;
7054 +
7055 + header->size = map->size;
7056 +}
7057 +
7058 +static int
7059 +setlist_list_members_size(const struct ip_set *set)
7060 +{
7061 + const struct ip_set_setlist *map = set->data;
7062 +
7063 + return map->size * sizeof(ip_set_id_t);
7064 +}
7065 +
7066 +static void
7067 +setlist_list_members(const struct ip_set *set, void *data)
7068 +{
7069 + struct ip_set_setlist *map = set->data;
7070 + int i;
7071 +
7072 + for (i = 0; i < map->size; i++)
7073 + *((ip_set_id_t *)data + i) = ip_set_id(map->index[i]);
7074 +}
7075 +
7076 +IP_SET_TYPE(setlist, IPSET_TYPE_SETNAME | IPSET_DATA_SINGLE)
7077 +
7078 +MODULE_LICENSE("GPL");
7079 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
7080 +MODULE_DESCRIPTION("setlist type of IP sets");
7081 +
7082 +REGISTER_MODULE(setlist)
7083 --- /dev/null
7084 +++ b/net/ipv4/netfilter/ipt_set.c
7085 @@ -0,0 +1,238 @@
7086 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
7087 + * Patrick Schaaf <bof@bof.de>
7088 + * Martin Josefsson <gandalf@wlug.westbo.se>
7089 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
7090 + *
7091 + * This program is free software; you can redistribute it and/or modify
7092 + * it under the terms of the GNU General Public License version 2 as
7093 + * published by the Free Software Foundation.
7094 + */
7095 +
7096 +/* Kernel module to match an IP set. */
7097 +
7098 +#include <linux/module.h>
7099 +#include <linux/ip.h>
7100 +#include <linux/skbuff.h>
7101 +#include <linux/version.h>
7102 +
7103 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16)
7104 +#include <linux/netfilter_ipv4/ip_tables.h>
7105 +#define xt_register_match ipt_register_match
7106 +#define xt_unregister_match ipt_unregister_match
7107 +#define xt_match ipt_match
7108 +#else
7109 +#include <linux/netfilter/x_tables.h>
7110 +#endif
7111 +#include <linux/netfilter_ipv4/ip_set.h>
7112 +#include <linux/netfilter_ipv4/ipt_set.h>
7113 +
7114 +static inline int
7115 +match_set(const struct ipt_set_info *info,
7116 + const struct sk_buff *skb,
7117 + int inv)
7118 +{
7119 + if (ip_set_testip_kernel(info->index, skb, info->flags))
7120 + inv = !inv;
7121 + return inv;
7122 +}
7123 +
7124 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
7125 +static int
7126 +match(const struct sk_buff *skb,
7127 + const struct net_device *in,
7128 + const struct net_device *out,
7129 + const void *matchinfo,
7130 + int offset,
7131 + const void *hdr,
7132 + u_int16_t datalen,
7133 + int *hotdrop)
7134 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16)
7135 +static int
7136 +match(const struct sk_buff *skb,
7137 + const struct net_device *in,
7138 + const struct net_device *out,
7139 + const void *matchinfo,
7140 + int offset,
7141 + int *hotdrop)
7142 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
7143 +static int
7144 +match(const struct sk_buff *skb,
7145 + const struct net_device *in,
7146 + const struct net_device *out,
7147 + const void *matchinfo,
7148 + int offset,
7149 + unsigned int protoff,
7150 + int *hotdrop)
7151 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,23)
7152 +static int
7153 +match(const struct sk_buff *skb,
7154 + const struct net_device *in,
7155 + const struct net_device *out,
7156 + const struct xt_match *match,
7157 + const void *matchinfo,
7158 + int offset,
7159 + unsigned int protoff,
7160 + int *hotdrop)
7161 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
7162 +static bool
7163 +match(const struct sk_buff *skb,
7164 + const struct net_device *in,
7165 + const struct net_device *out,
7166 + const struct xt_match *match,
7167 + const void *matchinfo,
7168 + int offset,
7169 + unsigned int protoff,
7170 + bool *hotdrop)
7171 +#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28) */
7172 +static bool
7173 +match(const struct sk_buff *skb,
7174 + const struct xt_match_param *par)
7175 +#endif
7176 +{
7177 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
7178 + const struct ipt_set_info_match *info = matchinfo;
7179 +#else
7180 + const struct ipt_set_info_match *info = par->matchinfo;
7181 +#endif
7182 +
7183 + return match_set(&info->match_set,
7184 + skb,
7185 + info->match_set.flags[0] & IPSET_MATCH_INV);
7186 +}
7187 +
7188 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16)
7189 +static int
7190 +checkentry(const char *tablename,
7191 + const struct ipt_ip *ip,
7192 + void *matchinfo,
7193 + unsigned int matchsize,
7194 + unsigned int hook_mask)
7195 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
7196 +static int
7197 +checkentry(const char *tablename,
7198 + const void *inf,
7199 + void *matchinfo,
7200 + unsigned int matchsize,
7201 + unsigned int hook_mask)
7202 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
7203 +static int
7204 +checkentry(const char *tablename,
7205 + const void *inf,
7206 + const struct xt_match *match,
7207 + void *matchinfo,
7208 + unsigned int matchsize,
7209 + unsigned int hook_mask)
7210 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,23)
7211 +static int
7212 +checkentry(const char *tablename,
7213 + const void *inf,
7214 + const struct xt_match *match,
7215 + void *matchinfo,
7216 + unsigned int hook_mask)
7217 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
7218 +static bool
7219 +checkentry(const char *tablename,
7220 + const void *inf,
7221 + const struct xt_match *match,
7222 + void *matchinfo,
7223 + unsigned int hook_mask)
7224 +#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28) */
7225 +static bool
7226 +checkentry(const struct xt_mtchk_param *par)
7227 +#endif
7228 +{
7229 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
7230 + struct ipt_set_info_match *info = matchinfo;
7231 +#else
7232 + struct ipt_set_info_match *info = par->matchinfo;
7233 +#endif
7234 + ip_set_id_t index;
7235 +
7236 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
7237 + if (matchsize != IPT_ALIGN(sizeof(struct ipt_set_info_match))) {
7238 + ip_set_printk("invalid matchsize %d", matchsize);
7239 + return 0;
7240 + }
7241 +#endif
7242 +
7243 + index = ip_set_get_byindex(info->match_set.index);
7244 +
7245 + if (index == IP_SET_INVALID_ID) {
7246 + ip_set_printk("Cannot find set indentified by id %u to match",
7247 + info->match_set.index);
7248 + return 0; /* error */
7249 + }
7250 + if (info->match_set.flags[IP_SET_MAX_BINDINGS] != 0) {
7251 + ip_set_printk("That's nasty!");
7252 + return 0; /* error */
7253 + }
7254 +
7255 + return 1;
7256 +}
7257 +
7258 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
7259 +static void destroy(void *matchinfo,
7260 + unsigned int matchsize)
7261 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
7262 +static void destroy(const struct xt_match *match,
7263 + void *matchinfo,
7264 + unsigned int matchsize)
7265 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
7266 +static void destroy(const struct xt_match *match,
7267 + void *matchinfo)
7268 +#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28) */
7269 +static void destroy(const struct xt_mtdtor_param *par)
7270 +#endif
7271 +{
7272 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
7273 + struct ipt_set_info_match *info = matchinfo;
7274 +#else
7275 + struct ipt_set_info_match *info = par->matchinfo;
7276 +#endif
7277 +
7278 +
7279 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
7280 + if (matchsize != IPT_ALIGN(sizeof(struct ipt_set_info_match))) {
7281 + ip_set_printk("invalid matchsize %d", matchsize);
7282 + return;
7283 + }
7284 +#endif
7285 + ip_set_put_byindex(info->match_set.index);
7286 +}
7287 +
7288 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
7289 +static struct xt_match set_match = {
7290 + .name = "set",
7291 + .match = &match,
7292 + .checkentry = &checkentry,
7293 + .destroy = &destroy,
7294 + .me = THIS_MODULE
7295 +};
7296 +#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17) */
7297 +static struct xt_match set_match = {
7298 + .name = "set",
7299 + .family = AF_INET,
7300 + .match = &match,
7301 + .matchsize = sizeof(struct ipt_set_info_match),
7302 + .checkentry = &checkentry,
7303 + .destroy = &destroy,
7304 + .me = THIS_MODULE
7305 +};
7306 +#endif
7307 +
7308 +MODULE_LICENSE("GPL");
7309 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
7310 +MODULE_DESCRIPTION("iptables IP set match module");
7311 +
7312 +static int __init ipt_ipset_init(void)
7313 +{
7314 + return xt_register_match(&set_match);
7315 +}
7316 +
7317 +static void __exit ipt_ipset_fini(void)
7318 +{
7319 + xt_unregister_match(&set_match);
7320 +}
7321 +
7322 +module_init(ipt_ipset_init);
7323 +module_exit(ipt_ipset_fini);
7324 --- /dev/null
7325 +++ b/net/ipv4/netfilter/ipt_SET.c
7326 @@ -0,0 +1,242 @@
7327 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
7328 + * Patrick Schaaf <bof@bof.de>
7329 + * Martin Josefsson <gandalf@wlug.westbo.se>
7330 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
7331 + *
7332 + * This program is free software; you can redistribute it and/or modify
7333 + * it under the terms of the GNU General Public License version 2 as
7334 + * published by the Free Software Foundation.
7335 + */
7336 +
7337 +/* ipt_SET.c - netfilter target to manipulate IP sets */
7338 +
7339 +#include <linux/module.h>
7340 +#include <linux/ip.h>
7341 +#include <linux/skbuff.h>
7342 +#include <linux/version.h>
7343 +
7344 +#include <linux/netfilter_ipv4.h>
7345 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16)
7346 +#include <linux/netfilter_ipv4/ip_tables.h>
7347 +#define xt_register_target ipt_register_target
7348 +#define xt_unregister_target ipt_unregister_target
7349 +#define xt_target ipt_target
7350 +#define XT_CONTINUE IPT_CONTINUE
7351 +#else
7352 +#include <linux/netfilter/x_tables.h>
7353 +#endif
7354 +#include <linux/netfilter_ipv4/ipt_set.h>
7355 +
7356 +static unsigned int
7357 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
7358 +target(struct sk_buff **pskb,
7359 + unsigned int hooknum,
7360 + const struct net_device *in,
7361 + const struct net_device *out,
7362 + const void *targinfo,
7363 + void *userinfo)
7364 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
7365 +target(struct sk_buff **pskb,
7366 + const struct net_device *in,
7367 + const struct net_device *out,
7368 + unsigned int hooknum,
7369 + const void *targinfo,
7370 + void *userinfo)
7371 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
7372 +target(struct sk_buff **pskb,
7373 + const struct net_device *in,
7374 + const struct net_device *out,
7375 + unsigned int hooknum,
7376 + const struct xt_target *target,
7377 + const void *targinfo,
7378 + void *userinfo)
7379 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24)
7380 +target(struct sk_buff **pskb,
7381 + const struct net_device *in,
7382 + const struct net_device *out,
7383 + unsigned int hooknum,
7384 + const struct xt_target *target,
7385 + const void *targinfo)
7386 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
7387 +target(struct sk_buff *skb,
7388 + const struct net_device *in,
7389 + const struct net_device *out,
7390 + unsigned int hooknum,
7391 + const struct xt_target *target,
7392 + const void *targinfo)
7393 +#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28) */
7394 +target(struct sk_buff *skb,
7395 + const struct xt_target_param *par)
7396 +#endif
7397 +{
7398 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
7399 + const struct ipt_set_info_target *info = targinfo;
7400 +#else
7401 + const struct ipt_set_info_target *info = par->targinfo;
7402 +#endif
7403 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24)
7404 + struct sk_buff *skb = *pskb;
7405 +#endif
7406 +
7407 +
7408 + if (info->add_set.index != IP_SET_INVALID_ID)
7409 + ip_set_addip_kernel(info->add_set.index,
7410 + skb,
7411 + info->add_set.flags);
7412 + if (info->del_set.index != IP_SET_INVALID_ID)
7413 + ip_set_delip_kernel(info->del_set.index,
7414 + skb,
7415 + info->del_set.flags);
7416 +
7417 + return XT_CONTINUE;
7418 +}
7419 +
7420 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16)
7421 +static int
7422 +checkentry(const char *tablename,
7423 + const struct ipt_entry *e,
7424 + void *targinfo,
7425 + unsigned int targinfosize,
7426 + unsigned int hook_mask)
7427 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
7428 +static int
7429 +checkentry(const char *tablename,
7430 + const void *e,
7431 + void *targinfo,
7432 + unsigned int targinfosize,
7433 + unsigned int hook_mask)
7434 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
7435 +static int
7436 +checkentry(const char *tablename,
7437 + const void *e,
7438 + const struct xt_target *target,
7439 + void *targinfo,
7440 + unsigned int targinfosize,
7441 + unsigned int hook_mask)
7442 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,23)
7443 +static int
7444 +checkentry(const char *tablename,
7445 + const void *e,
7446 + const struct xt_target *target,
7447 + void *targinfo,
7448 + unsigned int hook_mask)
7449 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
7450 +static bool
7451 +checkentry(const char *tablename,
7452 + const void *e,
7453 + const struct xt_target *target,
7454 + void *targinfo,
7455 + unsigned int hook_mask)
7456 +#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28) */
7457 +static bool
7458 +checkentry(const struct xt_tgchk_param *par)
7459 +#endif
7460 +{
7461 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
7462 + const struct ipt_set_info_target *info = targinfo;
7463 +#else
7464 + const struct ipt_set_info_target *info = par->targinfo;
7465 +#endif
7466 + ip_set_id_t index;
7467 +
7468 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
7469 + if (targinfosize != IPT_ALIGN(sizeof(*info))) {
7470 + DP("bad target info size %u", targinfosize);
7471 + return 0;
7472 + }
7473 +#endif
7474 +
7475 + if (info->add_set.index != IP_SET_INVALID_ID) {
7476 + index = ip_set_get_byindex(info->add_set.index);
7477 + if (index == IP_SET_INVALID_ID) {
7478 + ip_set_printk("cannot find add_set index %u as target",
7479 + info->add_set.index);
7480 + return 0; /* error */
7481 + }
7482 + }
7483 +
7484 + if (info->del_set.index != IP_SET_INVALID_ID) {
7485 + index = ip_set_get_byindex(info->del_set.index);
7486 + if (index == IP_SET_INVALID_ID) {
7487 + ip_set_printk("cannot find del_set index %u as target",
7488 + info->del_set.index);
7489 + return 0; /* error */
7490 + }
7491 + }
7492 + if (info->add_set.flags[IP_SET_MAX_BINDINGS] != 0
7493 + || info->del_set.flags[IP_SET_MAX_BINDINGS] != 0) {
7494 + ip_set_printk("That's nasty!");
7495 + return 0; /* error */
7496 + }
7497 +
7498 + return 1;
7499 +}
7500 +
7501 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
7502 +static void destroy(void *targetinfo,
7503 + unsigned int targetsize)
7504 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
7505 +static void destroy(const struct xt_target *target,
7506 + void *targetinfo,
7507 + unsigned int targetsize)
7508 +#elif LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
7509 +static void destroy(const struct xt_target *target,
7510 + void *targetinfo)
7511 +#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28) */
7512 +static void destroy(const struct xt_tgdtor_param *par)
7513 +#endif
7514 +{
7515 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
7516 + const struct ipt_set_info_target *info = targetinfo;
7517 +#else
7518 + const struct ipt_set_info_target *info = par->targinfo;
7519 +#endif
7520 +
7521 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
7522 + if (targetsize != IPT_ALIGN(sizeof(struct ipt_set_info_target))) {
7523 + ip_set_printk("invalid targetsize %d", targetsize);
7524 + return;
7525 + }
7526 +#endif
7527 + if (info->add_set.index != IP_SET_INVALID_ID)
7528 + ip_set_put_byindex(info->add_set.index);
7529 + if (info->del_set.index != IP_SET_INVALID_ID)
7530 + ip_set_put_byindex(info->del_set.index);
7531 +}
7532 +
7533 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
7534 +static struct xt_target SET_target = {
7535 + .name = "SET",
7536 + .target = target,
7537 + .checkentry = checkentry,
7538 + .destroy = destroy,
7539 + .me = THIS_MODULE
7540 +};
7541 +#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17) */
7542 +static struct xt_target SET_target = {
7543 + .name = "SET",
7544 + .family = AF_INET,
7545 + .target = target,
7546 + .targetsize = sizeof(struct ipt_set_info_target),
7547 + .checkentry = checkentry,
7548 + .destroy = destroy,
7549 + .me = THIS_MODULE
7550 +};
7551 +#endif
7552 +
7553 +MODULE_LICENSE("GPL");
7554 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
7555 +MODULE_DESCRIPTION("iptables IP set target module");
7556 +
7557 +static int __init ipt_SET_init(void)
7558 +{
7559 + return xt_register_target(&SET_target);
7560 +}
7561 +
7562 +static void __exit ipt_SET_fini(void)
7563 +{
7564 + xt_unregister_target(&SET_target);
7565 +}
7566 +
7567 +module_init(ipt_SET_init);
7568 +module_exit(ipt_SET_fini);
7569 --- a/net/ipv4/netfilter/Kconfig
7570 +++ b/net/ipv4/netfilter/Kconfig
7571 @@ -388,5 +388,146 @@ config IP_NF_ARP_MANGLE
7572
7573 endif # IP_NF_ARPTABLES
7574
7575 +config IP_NF_SET
7576 + tristate "IP set support"
7577 + depends on INET && NETFILTER
7578 + help
7579 + This option adds IP set support to the kernel.
7580 + In order to define and use sets, you need the userspace utility
7581 + ipset(8).
7582 +
7583 + To compile it as a module, choose M here. If unsure, say N.
7584 +
7585 +config IP_NF_SET_MAX
7586 + int "Maximum number of IP sets"
7587 + default 256
7588 + range 2 65534
7589 + depends on IP_NF_SET
7590 + help
7591 + You can define here default value of the maximum number
7592 + of IP sets for the kernel.
7593 +
7594 + The value can be overriden by the 'max_sets' module
7595 + parameter of the 'ip_set' module.
7596 +
7597 +config IP_NF_SET_HASHSIZE
7598 + int "Hash size for bindings of IP sets"
7599 + default 1024
7600 + depends on IP_NF_SET
7601 + help
7602 + You can define here default value of the hash size for
7603 + bindings of IP sets.
7604 +
7605 + The value can be overriden by the 'hash_size' module
7606 + parameter of the 'ip_set' module.
7607 +
7608 +config IP_NF_SET_IPMAP
7609 + tristate "ipmap set support"
7610 + depends on IP_NF_SET
7611 + help
7612 + This option adds the ipmap set type support.
7613 +
7614 + To compile it as a module, choose M here. If unsure, say N.
7615 +
7616 +config IP_NF_SET_MACIPMAP
7617 + tristate "macipmap set support"
7618 + depends on IP_NF_SET
7619 + help
7620 + This option adds the macipmap set type support.
7621 +
7622 + To compile it as a module, choose M here. If unsure, say N.
7623 +
7624 +config IP_NF_SET_PORTMAP
7625 + tristate "portmap set support"
7626 + depends on IP_NF_SET
7627 + help
7628 + This option adds the portmap set type support.
7629 +
7630 + To compile it as a module, choose M here. If unsure, say N.
7631 +
7632 +config IP_NF_SET_IPHASH
7633 + tristate "iphash set support"
7634 + depends on IP_NF_SET
7635 + help
7636 + This option adds the iphash set type support.
7637 +
7638 + To compile it as a module, choose M here. If unsure, say N.
7639 +
7640 +config IP_NF_SET_NETHASH
7641 + tristate "nethash set support"
7642 + depends on IP_NF_SET
7643 + help
7644 + This option adds the nethash set type support.
7645 +
7646 + To compile it as a module, choose M here. If unsure, say N.
7647 +
7648 +config IP_NF_SET_IPPORTHASH
7649 + tristate "ipporthash set support"
7650 + depends on IP_NF_SET
7651 + help
7652 + This option adds the ipporthash set type support.
7653 +
7654 + To compile it as a module, choose M here. If unsure, say N.
7655 +
7656 +config IP_NF_SET_IPPORTIPHASH
7657 + tristate "ipportiphash set support"
7658 + depends on IP_NF_SET
7659 + help
7660 + This option adds the ipportiphash set type support.
7661 +
7662 + To compile it as a module, choose M here. If unsure, say N.
7663 +
7664 +config IP_NF_SET_IPPORTNETHASH
7665 + tristate "ipportnethash set support"
7666 + depends on IP_NF_SET
7667 + help
7668 + This option adds the ipportnethash set type support.
7669 +
7670 + To compile it as a module, choose M here. If unsure, say N.
7671 +
7672 +config IP_NF_SET_IPTREE
7673 + tristate "iptree set support"
7674 + depends on IP_NF_SET
7675 + help
7676 + This option adds the iptree set type support.
7677 +
7678 + To compile it as a module, choose M here. If unsure, say N.
7679 +
7680 +config IP_NF_SET_IPTREEMAP
7681 + tristate "iptreemap set support"
7682 + depends on IP_NF_SET
7683 + help
7684 + This option adds the iptreemap set type support.
7685 +
7686 + To compile it as a module, choose M here. If unsure, say N.
7687 +
7688 +config IP_NF_SET_SETLIST
7689 + tristate "setlist set support"
7690 + depends on IP_NF_SET
7691 + help
7692 + This option adds the setlist set type support.
7693 +
7694 + To compile it as a module, choose M here. If unsure, say N.
7695 +
7696 +config IP_NF_MATCH_SET
7697 + tristate "set match support"
7698 + depends on IP_NF_SET
7699 + help
7700 + Set matching matches against given IP sets.
7701 + You need the ipset utility to create and set up the sets.
7702 +
7703 + To compile it as a module, choose M here. If unsure, say N.
7704 +
7705 +config IP_NF_TARGET_SET
7706 + tristate "SET target support"
7707 + depends on IP_NF_SET
7708 + help
7709 + The SET target makes possible to add/delete entries
7710 + in IP sets.
7711 + You need the ipset utility to create and set up the sets.
7712 +
7713 + To compile it as a module, choose M here. If unsure, say N.
7714 +
7715 +
7716 endmenu
7717
7718 --- a/net/ipv4/netfilter/Makefile
7719 +++ b/net/ipv4/netfilter/Makefile
7720 @@ -51,6 +51,7 @@ obj-$(CONFIG_IP_NF_SECURITY) += iptable_
7721 obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o
7722 obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
7723 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
7724 +obj-$(CONFIG_IP_NF_MATCH_SET) += ipt_set.o
7725
7726 # targets
7727 obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o
7728 @@ -61,6 +62,21 @@ obj-$(CONFIG_IP_NF_TARGET_NETMAP) += ipt
7729 obj-$(CONFIG_IP_NF_TARGET_REDIRECT) += ipt_REDIRECT.o
7730 obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
7731 obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
7732 +obj-$(CONFIG_IP_NF_TARGET_SET) += ipt_SET.o
7733 +
7734 +# sets
7735 +obj-$(CONFIG_IP_NF_SET) += ip_set.o
7736 +obj-$(CONFIG_IP_NF_SET_IPMAP) += ip_set_ipmap.o
7737 +obj-$(CONFIG_IP_NF_SET_PORTMAP) += ip_set_portmap.o
7738 +obj-$(CONFIG_IP_NF_SET_MACIPMAP) += ip_set_macipmap.o
7739 +obj-$(CONFIG_IP_NF_SET_IPHASH) += ip_set_iphash.o
7740 +obj-$(CONFIG_IP_NF_SET_NETHASH) += ip_set_nethash.o
7741 +obj-$(CONFIG_IP_NF_SET_IPPORTHASH) += ip_set_ipporthash.o
7742 +obj-$(CONFIG_IP_NF_SET_IPPORTIPHASH) += ip_set_ipportiphash.o
7743 +obj-$(CONFIG_IP_NF_SET_IPPORTNETHASH) += ip_set_ipportnethash.o
7744 +obj-$(CONFIG_IP_NF_SET_IPTREE) += ip_set_iptree.o
7745 +obj-$(CONFIG_IP_NF_SET_IPTREEMAP) += ip_set_iptreemap.o
7746 +obj-$(CONFIG_IP_NF_SET_SETLIST) += ip_set_setlist.o
7747
7748 # generic ARP tables
7749 obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
OpenWrt Source Repository