fix ipset patch to have headers installed when using 'make -C $(KDIR) headers_install'
[openwrt/svn-archive/archive.git] / target / linux / generic-2.6 / patches-2.6.21 / 130-netfilter_ipset.patch
1 --- a/include/linux/netfilter_ipv4/Kbuild
2 +++ b/include/linux/netfilter_ipv4/Kbuild
3 @@ -59,3 +59,14 @@
4 unifdef-y += ip_nat_rule.h
5 unifdef-y += ip_queue.h
6 unifdef-y += ip_tables.h
7 +
8 +unifdef-y += ip_set.h
9 +header-y += ip_set_iphash.h
10 +header-y += ip_set_ipmap.h
11 +header-y += ip_set_ipporthash.h
12 +unifdef-y += ip_set_iptree.h
13 +unifdef-y += ip_set_iptreemap.h
14 +header-y += ip_set_jhash.h
15 +header-y += ip_set_macipmap.h
16 +unifdef-y += ip_set_nethash.h
17 +header-y += ip_set_portmap.h
18 Index: linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set.h
19 ===================================================================
20 --- /dev/null
21 +++ linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set.h
22 @@ -0,0 +1,498 @@
23 +#ifndef _IP_SET_H
24 +#define _IP_SET_H
25 +
26 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
27 + * Patrick Schaaf <bof@bof.de>
28 + * Martin Josefsson <gandalf@wlug.westbo.se>
29 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
30 + *
31 + * This program is free software; you can redistribute it and/or modify
32 + * it under the terms of the GNU General Public License version 2 as
33 + * published by the Free Software Foundation.
34 + */
35 +
36 +#if 0
37 +#define IP_SET_DEBUG
38 +#endif
39 +
40 +/*
41 + * A sockopt of such quality has hardly ever been seen before on the open
42 + * market! This little beauty, hardly ever used: above 64, so it's
43 + * traditionally used for firewalling, not touched (even once!) by the
44 + * 2.0, 2.2 and 2.4 kernels!
45 + *
46 + * Comes with its own certificate of authenticity, valid anywhere in the
47 + * Free world!
48 + *
49 + * Rusty, 19.4.2000
50 + */
51 +#define SO_IP_SET 83
52 +
53 +/*
54 + * Heavily modify by Joakim Axelsson 08.03.2002
55 + * - Made it more modulebased
56 + *
57 + * Additional heavy modifications by Jozsef Kadlecsik 22.02.2004
58 + * - bindings added
59 + * - in order to "deal with" backward compatibility, renamed to ipset
60 + */
61 +
62 +/*
63 + * Used so that the kernel module and ipset-binary can match their versions
64 + */
65 +#define IP_SET_PROTOCOL_VERSION 2
66 +
67 +#define IP_SET_MAXNAMELEN 32 /* set names and set typenames */
68 +
69 +/* Lets work with our own typedef for representing an IP address.
70 + * We hope to make the code more portable, possibly to IPv6...
71 + *
72 + * The representation works in HOST byte order, because most set types
73 + * will perform arithmetic operations and compare operations.
74 + *
75 + * For now the type is an uint32_t.
76 + *
77 + * Make sure to ONLY use the functions when translating and parsing
78 + * in order to keep the host byte order and make it more portable:
79 + * parse_ip()
80 + * parse_mask()
81 + * parse_ipandmask()
82 + * ip_tostring()
83 + * (Joakim: where are they???)
84 + */
85 +
86 +typedef uint32_t ip_set_ip_t;
87 +
88 +/* Sets are identified by an id in kernel space. Tweak with ip_set_id_t
89 + * and IP_SET_INVALID_ID if you want to increase the max number of sets.
90 + */
91 +typedef uint16_t ip_set_id_t;
92 +
93 +#define IP_SET_INVALID_ID 65535
94 +
95 +/* How deep we follow bindings */
96 +#define IP_SET_MAX_BINDINGS 6
97 +
98 +/*
99 + * Option flags for kernel operations (ipt_set_info)
100 + */
101 +#define IPSET_SRC 0x01 /* Source match/add */
102 +#define IPSET_DST 0x02 /* Destination match/add */
103 +#define IPSET_MATCH_INV 0x04 /* Inverse matching */
104 +
105 +/*
106 + * Set features
107 + */
108 +#define IPSET_TYPE_IP 0x01 /* IP address type of set */
109 +#define IPSET_TYPE_PORT 0x02 /* Port type of set */
110 +#define IPSET_DATA_SINGLE 0x04 /* Single data storage */
111 +#define IPSET_DATA_DOUBLE 0x08 /* Double data storage */
112 +
113 +/* Reserved keywords */
114 +#define IPSET_TOKEN_DEFAULT ":default:"
115 +#define IPSET_TOKEN_ALL ":all:"
116 +
117 +/* SO_IP_SET operation constants, and their request struct types.
118 + *
119 + * Operation ids:
120 + * 0-99: commands with version checking
121 + * 100-199: add/del/test/bind/unbind
122 + * 200-299: list, save, restore
123 + */
124 +
125 +/* Single shot operations:
126 + * version, create, destroy, flush, rename and swap
127 + *
128 + * Sets are identified by name.
129 + */
130 +
131 +#define IP_SET_REQ_STD \
132 + unsigned op; \
133 + unsigned version; \
134 + char name[IP_SET_MAXNAMELEN]
135 +
136 +#define IP_SET_OP_CREATE 0x00000001 /* Create a new (empty) set */
137 +struct ip_set_req_create {
138 + IP_SET_REQ_STD;
139 + char typename[IP_SET_MAXNAMELEN];
140 +};
141 +
142 +#define IP_SET_OP_DESTROY 0x00000002 /* Remove a (empty) set */
143 +struct ip_set_req_std {
144 + IP_SET_REQ_STD;
145 +};
146 +
147 +#define IP_SET_OP_FLUSH 0x00000003 /* Remove all IPs in a set */
148 +/* Uses ip_set_req_std */
149 +
150 +#define IP_SET_OP_RENAME 0x00000004 /* Rename a set */
151 +/* Uses ip_set_req_create */
152 +
153 +#define IP_SET_OP_SWAP 0x00000005 /* Swap two sets */
154 +/* Uses ip_set_req_create */
155 +
156 +union ip_set_name_index {
157 + char name[IP_SET_MAXNAMELEN];
158 + ip_set_id_t index;
159 +};
160 +
161 +#define IP_SET_OP_GET_BYNAME 0x00000006 /* Get set index by name */
162 +struct ip_set_req_get_set {
163 + unsigned op;
164 + unsigned version;
165 + union ip_set_name_index set;
166 +};
167 +
168 +#define IP_SET_OP_GET_BYINDEX 0x00000007 /* Get set name by index */
169 +/* Uses ip_set_req_get_set */
170 +
171 +#define IP_SET_OP_VERSION 0x00000100 /* Ask kernel version */
172 +struct ip_set_req_version {
173 + unsigned op;
174 + unsigned version;
175 +};
176 +
177 +/* Double shots operations:
178 + * add, del, test, bind and unbind.
179 + *
180 + * First we query the kernel to get the index and type of the target set,
181 + * then issue the command. Validity of IP is checked in kernel in order
182 + * to minimalize sockopt operations.
183 + */
184 +
185 +/* Get minimal set data for add/del/test/bind/unbind IP */
186 +#define IP_SET_OP_ADT_GET 0x00000010 /* Get set and type */
187 +struct ip_set_req_adt_get {
188 + unsigned op;
189 + unsigned version;
190 + union ip_set_name_index set;
191 + char typename[IP_SET_MAXNAMELEN];
192 +};
193 +
194 +#define IP_SET_REQ_BYINDEX \
195 + unsigned op; \
196 + ip_set_id_t index;
197 +
198 +struct ip_set_req_adt {
199 + IP_SET_REQ_BYINDEX;
200 +};
201 +
202 +#define IP_SET_OP_ADD_IP 0x00000101 /* Add an IP to a set */
203 +/* Uses ip_set_req_adt, with type specific addage */
204 +
205 +#define IP_SET_OP_DEL_IP 0x00000102 /* Remove an IP from a set */
206 +/* Uses ip_set_req_adt, with type specific addage */
207 +
208 +#define IP_SET_OP_TEST_IP 0x00000103 /* Test an IP in a set */
209 +/* Uses ip_set_req_adt, with type specific addage */
210 +
211 +#define IP_SET_OP_BIND_SET 0x00000104 /* Bind an IP to a set */
212 +/* Uses ip_set_req_bind, with type specific addage */
213 +struct ip_set_req_bind {
214 + IP_SET_REQ_BYINDEX;
215 + char binding[IP_SET_MAXNAMELEN];
216 +};
217 +
218 +#define IP_SET_OP_UNBIND_SET 0x00000105 /* Unbind an IP from a set */
219 +/* Uses ip_set_req_bind, with type speficic addage
220 + * index = 0 means unbinding for all sets */
221 +
222 +#define IP_SET_OP_TEST_BIND_SET 0x00000106 /* Test binding an IP to a set */
223 +/* Uses ip_set_req_bind, with type specific addage */
224 +
225 +/* Multiple shots operations: list, save, restore.
226 + *
227 + * - check kernel version and query the max number of sets
228 + * - get the basic information on all sets
229 + * and size required for the next step
230 + * - get actual set data: header, data, bindings
231 + */
232 +
233 +/* Get max_sets and the index of a queried set
234 + */
235 +#define IP_SET_OP_MAX_SETS 0x00000020
236 +struct ip_set_req_max_sets {
237 + unsigned op;
238 + unsigned version;
239 + ip_set_id_t max_sets; /* max_sets */
240 + ip_set_id_t sets; /* real number of sets */
241 + union ip_set_name_index set; /* index of set if name used */
242 +};
243 +
244 +/* Get the id and name of the sets plus size for next step */
245 +#define IP_SET_OP_LIST_SIZE 0x00000201
246 +#define IP_SET_OP_SAVE_SIZE 0x00000202
247 +struct ip_set_req_setnames {
248 + unsigned op;
249 + ip_set_id_t index; /* set to list/save */
250 + size_t size; /* size to get setdata/bindings */
251 + /* followed by sets number of struct ip_set_name_list */
252 +};
253 +
254 +struct ip_set_name_list {
255 + char name[IP_SET_MAXNAMELEN];
256 + char typename[IP_SET_MAXNAMELEN];
257 + ip_set_id_t index;
258 + ip_set_id_t id;
259 +};
260 +
261 +/* The actual list operation */
262 +#define IP_SET_OP_LIST 0x00000203
263 +struct ip_set_req_list {
264 + IP_SET_REQ_BYINDEX;
265 + /* sets number of struct ip_set_list in reply */
266 +};
267 +
268 +struct ip_set_list {
269 + ip_set_id_t index;
270 + ip_set_id_t binding;
271 + u_int32_t ref;
272 + size_t header_size; /* Set header data of header_size */
273 + size_t members_size; /* Set members data of members_size */
274 + size_t bindings_size; /* Set bindings data of bindings_size */
275 +};
276 +
277 +struct ip_set_hash_list {
278 + ip_set_ip_t ip;
279 + ip_set_id_t binding;
280 +};
281 +
282 +/* The save operation */
283 +#define IP_SET_OP_SAVE 0x00000204
284 +/* Uses ip_set_req_list, in the reply replaced by
285 + * sets number of struct ip_set_save plus a marker
286 + * ip_set_save followed by ip_set_hash_save structures.
287 + */
288 +struct ip_set_save {
289 + ip_set_id_t index;
290 + ip_set_id_t binding;
291 + size_t header_size; /* Set header data of header_size */
292 + size_t members_size; /* Set members data of members_size */
293 +};
294 +
295 +/* At restoring, ip == 0 means default binding for the given set: */
296 +struct ip_set_hash_save {
297 + ip_set_ip_t ip;
298 + ip_set_id_t id;
299 + ip_set_id_t binding;
300 +};
301 +
302 +/* The restore operation */
303 +#define IP_SET_OP_RESTORE 0x00000205
304 +/* Uses ip_set_req_setnames followed by ip_set_restore structures
305 + * plus a marker ip_set_restore, followed by ip_set_hash_save
306 + * structures.
307 + */
308 +struct ip_set_restore {
309 + char name[IP_SET_MAXNAMELEN];
310 + char typename[IP_SET_MAXNAMELEN];
311 + ip_set_id_t index;
312 + size_t header_size; /* Create data of header_size */
313 + size_t members_size; /* Set members data of members_size */
314 +};
315 +
316 +static inline int bitmap_bytes(ip_set_ip_t a, ip_set_ip_t b)
317 +{
318 + return 4 * ((((b - a + 8) / 8) + 3) / 4);
319 +}
320 +
321 +#ifdef __KERNEL__
322 +
323 +#define ip_set_printk(format, args...) \
324 + do { \
325 + printk("%s: %s: ", __FILE__, __FUNCTION__); \
326 + printk(format "\n" , ## args); \
327 + } while (0)
328 +
329 +#if defined(IP_SET_DEBUG)
330 +#define DP(format, args...) \
331 + do { \
332 + printk("%s: %s (DBG): ", __FILE__, __FUNCTION__);\
333 + printk(format "\n" , ## args); \
334 + } while (0)
335 +#define IP_SET_ASSERT(x) \
336 + do { \
337 + if (!(x)) \
338 + printk("IP_SET_ASSERT: %s:%i(%s)\n", \
339 + __FILE__, __LINE__, __FUNCTION__); \
340 + } while (0)
341 +#else
342 +#define DP(format, args...)
343 +#define IP_SET_ASSERT(x)
344 +#endif
345 +
346 +struct ip_set;
347 +
348 +/*
349 + * The ip_set_type definition - one per set type, e.g. "ipmap".
350 + *
351 + * Each individual set has a pointer, set->type, going to one
352 + * of these structures. Function pointers inside the structure implement
353 + * the real behaviour of the sets.
354 + *
355 + * If not mentioned differently, the implementation behind the function
356 + * pointers of a set_type, is expected to return 0 if ok, and a negative
357 + * errno (e.g. -EINVAL) on error.
358 + */
359 +struct ip_set_type {
360 + struct list_head list; /* next in list of set types */
361 +
362 + /* test for IP in set (kernel: iptables -m set src|dst)
363 + * return 0 if not in set, 1 if in set.
364 + */
365 + int (*testip_kernel) (struct ip_set *set,
366 + const struct sk_buff * skb,
367 + ip_set_ip_t *ip,
368 + const u_int32_t *flags,
369 + unsigned char index);
370 +
371 + /* test for IP in set (userspace: ipset -T set IP)
372 + * return 0 if not in set, 1 if in set.
373 + */
374 + int (*testip) (struct ip_set *set,
375 + const void *data, size_t size,
376 + ip_set_ip_t *ip);
377 +
378 + /*
379 + * Size of the data structure passed by when
380 + * adding/deletin/testing an entry.
381 + */
382 + size_t reqsize;
383 +
384 + /* Add IP into set (userspace: ipset -A set IP)
385 + * Return -EEXIST if the address is already in the set,
386 + * and -ERANGE if the address lies outside the set bounds.
387 + * If the address was not already in the set, 0 is returned.
388 + */
389 + int (*addip) (struct ip_set *set,
390 + const void *data, size_t size,
391 + ip_set_ip_t *ip);
392 +
393 + /* Add IP into set (kernel: iptables ... -j SET set src|dst)
394 + * Return -EEXIST if the address is already in the set,
395 + * and -ERANGE if the address lies outside the set bounds.
396 + * If the address was not already in the set, 0 is returned.
397 + */
398 + int (*addip_kernel) (struct ip_set *set,
399 + const struct sk_buff * skb,
400 + ip_set_ip_t *ip,
401 + const u_int32_t *flags,
402 + unsigned char index);
403 +
404 + /* remove IP from set (userspace: ipset -D set --entry x)
405 + * Return -EEXIST if the address is NOT in the set,
406 + * and -ERANGE if the address lies outside the set bounds.
407 + * If the address really was in the set, 0 is returned.
408 + */
409 + int (*delip) (struct ip_set *set,
410 + const void *data, size_t size,
411 + ip_set_ip_t *ip);
412 +
413 + /* remove IP from set (kernel: iptables ... -j SET --entry x)
414 + * Return -EEXIST if the address is NOT in the set,
415 + * and -ERANGE if the address lies outside the set bounds.
416 + * If the address really was in the set, 0 is returned.
417 + */
418 + int (*delip_kernel) (struct ip_set *set,
419 + const struct sk_buff * skb,
420 + ip_set_ip_t *ip,
421 + const u_int32_t *flags,
422 + unsigned char index);
423 +
424 + /* new set creation - allocated type specific items
425 + */
426 + int (*create) (struct ip_set *set,
427 + const void *data, size_t size);
428 +
429 + /* retry the operation after successfully tweaking the set
430 + */
431 + int (*retry) (struct ip_set *set);
432 +
433 + /* set destruction - free type specific items
434 + * There is no return value.
435 + * Can be called only when child sets are destroyed.
436 + */
437 + void (*destroy) (struct ip_set *set);
438 +
439 + /* set flushing - reset all bits in the set, or something similar.
440 + * There is no return value.
441 + */
442 + void (*flush) (struct ip_set *set);
443 +
444 + /* Listing: size needed for header
445 + */
446 + size_t header_size;
447 +
448 + /* Listing: Get the header
449 + *
450 + * Fill in the information in "data".
451 + * This function is always run after list_header_size() under a
452 + * writelock on the set. Therefor is the length of "data" always
453 + * correct.
454 + */
455 + void (*list_header) (const struct ip_set *set,
456 + void *data);
457 +
458 + /* Listing: Get the size for the set members
459 + */
460 + int (*list_members_size) (const struct ip_set *set);
461 +
462 + /* Listing: Get the set members
463 + *
464 + * Fill in the information in "data".
465 + * This function is always run after list_member_size() under a
466 + * writelock on the set. Therefor is the length of "data" always
467 + * correct.
468 + */
469 + void (*list_members) (const struct ip_set *set,
470 + void *data);
471 +
472 + char typename[IP_SET_MAXNAMELEN];
473 + unsigned char features;
474 + int protocol_version;
475 +
476 + /* Set this to THIS_MODULE if you are a module, otherwise NULL */
477 + struct module *me;
478 +};
479 +
480 +extern int ip_set_register_set_type(struct ip_set_type *set_type);
481 +extern void ip_set_unregister_set_type(struct ip_set_type *set_type);
482 +
483 +/* A generic ipset */
484 +struct ip_set {
485 + char name[IP_SET_MAXNAMELEN]; /* the name of the set */
486 + rwlock_t lock; /* lock for concurrency control */
487 + ip_set_id_t id; /* set id for swapping */
488 + ip_set_id_t binding; /* default binding for the set */
489 + atomic_t ref; /* in kernel and in hash references */
490 + struct ip_set_type *type; /* the set types */
491 + void *data; /* pooltype specific data */
492 +};
493 +
494 +/* Structure to bind set elements to sets */
495 +struct ip_set_hash {
496 + struct list_head list; /* list of clashing entries in hash */
497 + ip_set_ip_t ip; /* ip from set */
498 + ip_set_id_t id; /* set id */
499 + ip_set_id_t binding; /* set we bind the element to */
500 +};
501 +
502 +/* register and unregister set references */
503 +extern ip_set_id_t ip_set_get_byname(const char name[IP_SET_MAXNAMELEN]);
504 +extern ip_set_id_t ip_set_get_byindex(ip_set_id_t id);
505 +extern void ip_set_put(ip_set_id_t id);
506 +
507 +/* API for iptables set match, and SET target */
508 +extern void ip_set_addip_kernel(ip_set_id_t id,
509 + const struct sk_buff *skb,
510 + const u_int32_t *flags);
511 +extern void ip_set_delip_kernel(ip_set_id_t id,
512 + const struct sk_buff *skb,
513 + const u_int32_t *flags);
514 +extern int ip_set_testip_kernel(ip_set_id_t id,
515 + const struct sk_buff *skb,
516 + const u_int32_t *flags);
517 +
518 +#endif /* __KERNEL__ */
519 +
520 +#endif /*_IP_SET_H*/
521 Index: linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_iphash.h
522 ===================================================================
523 --- /dev/null
524 +++ linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_iphash.h
525 @@ -0,0 +1,30 @@
526 +#ifndef __IP_SET_IPHASH_H
527 +#define __IP_SET_IPHASH_H
528 +
529 +#include <linux/netfilter_ipv4/ip_set.h>
530 +
531 +#define SETTYPE_NAME "iphash"
532 +#define MAX_RANGE 0x0000FFFF
533 +
534 +struct ip_set_iphash {
535 + ip_set_ip_t *members; /* the iphash proper */
536 + uint32_t elements; /* number of elements */
537 + uint32_t hashsize; /* hash size */
538 + uint16_t probes; /* max number of probes */
539 + uint16_t resize; /* resize factor in percent */
540 + ip_set_ip_t netmask; /* netmask */
541 + void *initval[0]; /* initvals for jhash_1word */
542 +};
543 +
544 +struct ip_set_req_iphash_create {
545 + uint32_t hashsize;
546 + uint16_t probes;
547 + uint16_t resize;
548 + ip_set_ip_t netmask;
549 +};
550 +
551 +struct ip_set_req_iphash {
552 + ip_set_ip_t ip;
553 +};
554 +
555 +#endif /* __IP_SET_IPHASH_H */
556 Index: linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_ipmap.h
557 ===================================================================
558 --- /dev/null
559 +++ linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_ipmap.h
560 @@ -0,0 +1,56 @@
561 +#ifndef __IP_SET_IPMAP_H
562 +#define __IP_SET_IPMAP_H
563 +
564 +#include <linux/netfilter_ipv4/ip_set.h>
565 +
566 +#define SETTYPE_NAME "ipmap"
567 +#define MAX_RANGE 0x0000FFFF
568 +
569 +struct ip_set_ipmap {
570 + void *members; /* the ipmap proper */
571 + ip_set_ip_t first_ip; /* host byte order, included in range */
572 + ip_set_ip_t last_ip; /* host byte order, included in range */
573 + ip_set_ip_t netmask; /* subnet netmask */
574 + ip_set_ip_t sizeid; /* size of set in IPs */
575 + ip_set_ip_t hosts; /* number of hosts in a subnet */
576 +};
577 +
578 +struct ip_set_req_ipmap_create {
579 + ip_set_ip_t from;
580 + ip_set_ip_t to;
581 + ip_set_ip_t netmask;
582 +};
583 +
584 +struct ip_set_req_ipmap {
585 + ip_set_ip_t ip;
586 +};
587 +
588 +unsigned int
589 +mask_to_bits(ip_set_ip_t mask)
590 +{
591 + unsigned int bits = 32;
592 + ip_set_ip_t maskaddr;
593 +
594 + if (mask == 0xFFFFFFFF)
595 + return bits;
596 +
597 + maskaddr = 0xFFFFFFFE;
598 + while (--bits >= 0 && maskaddr != mask)
599 + maskaddr <<= 1;
600 +
601 + return bits;
602 +}
603 +
604 +ip_set_ip_t
605 +range_to_mask(ip_set_ip_t from, ip_set_ip_t to, unsigned int *bits)
606 +{
607 + ip_set_ip_t mask = 0xFFFFFFFE;
608 +
609 + *bits = 32;
610 + while (--(*bits) >= 0 && mask && (to & mask) != from)
611 + mask <<= 1;
612 +
613 + return mask;
614 +}
615 +
616 +#endif /* __IP_SET_IPMAP_H */
617 Index: linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_ipporthash.h
618 ===================================================================
619 --- /dev/null
620 +++ linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_ipporthash.h
621 @@ -0,0 +1,34 @@
622 +#ifndef __IP_SET_IPPORTHASH_H
623 +#define __IP_SET_IPPORTHASH_H
624 +
625 +#include <linux/netfilter_ipv4/ip_set.h>
626 +
627 +#define SETTYPE_NAME "ipporthash"
628 +#define MAX_RANGE 0x0000FFFF
629 +#define INVALID_PORT (MAX_RANGE + 1)
630 +
631 +struct ip_set_ipporthash {
632 + ip_set_ip_t *members; /* the ipporthash proper */
633 + uint32_t elements; /* number of elements */
634 + uint32_t hashsize; /* hash size */
635 + uint16_t probes; /* max number of probes */
636 + uint16_t resize; /* resize factor in percent */
637 + ip_set_ip_t first_ip; /* host byte order, included in range */
638 + ip_set_ip_t last_ip; /* host byte order, included in range */
639 + void *initval[0]; /* initvals for jhash_1word */
640 +};
641 +
642 +struct ip_set_req_ipporthash_create {
643 + uint32_t hashsize;
644 + uint16_t probes;
645 + uint16_t resize;
646 + ip_set_ip_t from;
647 + ip_set_ip_t to;
648 +};
649 +
650 +struct ip_set_req_ipporthash {
651 + ip_set_ip_t ip;
652 + ip_set_ip_t port;
653 +};
654 +
655 +#endif /* __IP_SET_IPPORTHASH_H */
656 Index: linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_iptree.h
657 ===================================================================
658 --- /dev/null
659 +++ linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_iptree.h
660 @@ -0,0 +1,40 @@
661 +#ifndef __IP_SET_IPTREE_H
662 +#define __IP_SET_IPTREE_H
663 +
664 +#include <linux/netfilter_ipv4/ip_set.h>
665 +
666 +#define SETTYPE_NAME "iptree"
667 +#define MAX_RANGE 0x0000FFFF
668 +
669 +struct ip_set_iptreed {
670 + unsigned long expires[256]; /* x.x.x.ADDR */
671 +};
672 +
673 +struct ip_set_iptreec {
674 + struct ip_set_iptreed *tree[256]; /* x.x.ADDR.* */
675 +};
676 +
677 +struct ip_set_iptreeb {
678 + struct ip_set_iptreec *tree[256]; /* x.ADDR.*.* */
679 +};
680 +
681 +struct ip_set_iptree {
682 + unsigned int timeout;
683 + unsigned int gc_interval;
684 +#ifdef __KERNEL__
685 + uint32_t elements; /* number of elements */
686 + struct timer_list gc;
687 + struct ip_set_iptreeb *tree[256]; /* ADDR.*.*.* */
688 +#endif
689 +};
690 +
691 +struct ip_set_req_iptree_create {
692 + unsigned int timeout;
693 +};
694 +
695 +struct ip_set_req_iptree {
696 + ip_set_ip_t ip;
697 + unsigned int timeout;
698 +};
699 +
700 +#endif /* __IP_SET_IPTREE_H */
701 Index: linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_iptreemap.h
702 ===================================================================
703 --- /dev/null
704 +++ linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_iptreemap.h
705 @@ -0,0 +1,40 @@
706 +#ifndef __IP_SET_IPTREEMAP_H
707 +#define __IP_SET_IPTREEMAP_H
708 +
709 +#include <linux/netfilter_ipv4/ip_set.h>
710 +
711 +#define SETTYPE_NAME "iptreemap"
712 +
713 +#ifdef __KERNEL__
714 +struct ip_set_iptreemap_d {
715 + unsigned char bitmap[32]; /* x.x.x.y */
716 +};
717 +
718 +struct ip_set_iptreemap_c {
719 + struct ip_set_iptreemap_d *tree[256]; /* x.x.y.x */
720 +};
721 +
722 +struct ip_set_iptreemap_b {
723 + struct ip_set_iptreemap_c *tree[256]; /* x.y.x.x */
724 + unsigned char dirty[32];
725 +};
726 +#endif
727 +
728 +struct ip_set_iptreemap {
729 + unsigned int gc_interval;
730 +#ifdef __KERNEL__
731 + struct timer_list gc;
732 + struct ip_set_iptreemap_b *tree[256]; /* y.x.x.x */
733 +#endif
734 +};
735 +
736 +struct ip_set_req_iptreemap_create {
737 + unsigned int gc_interval;
738 +};
739 +
740 +struct ip_set_req_iptreemap {
741 + ip_set_ip_t start;
742 + ip_set_ip_t end;
743 +};
744 +
745 +#endif /* __IP_SET_IPTREEMAP_H */
746 Index: linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_jhash.h
747 ===================================================================
748 --- /dev/null
749 +++ linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_jhash.h
750 @@ -0,0 +1,148 @@
751 +#ifndef _LINUX_IPSET_JHASH_H
752 +#define _LINUX_IPSET_JHASH_H
753 +
754 +/* This is a copy of linux/jhash.h but the types u32/u8 are changed
755 + * to __u32/__u8 so that the header file can be included into
756 + * userspace code as well. Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
757 + */
758 +
759 +/* jhash.h: Jenkins hash support.
760 + *
761 + * Copyright (C) 1996 Bob Jenkins (bob_jenkins@burtleburtle.net)
762 + *
763 + * http://burtleburtle.net/bob/hash/
764 + *
765 + * These are the credits from Bob's sources:
766 + *
767 + * lookup2.c, by Bob Jenkins, December 1996, Public Domain.
768 + * hash(), hash2(), hash3, and mix() are externally useful functions.
769 + * Routines to test the hash are included if SELF_TEST is defined.
770 + * You can use this free for any purpose. It has no warranty.
771 + *
772 + * Copyright (C) 2003 David S. Miller (davem@redhat.com)
773 + *
774 + * I've modified Bob's hash to be useful in the Linux kernel, and
775 + * any bugs present are surely my fault. -DaveM
776 + */
777 +
778 +/* NOTE: Arguments are modified. */
779 +#define __jhash_mix(a, b, c) \
780 +{ \
781 + a -= b; a -= c; a ^= (c>>13); \
782 + b -= c; b -= a; b ^= (a<<8); \
783 + c -= a; c -= b; c ^= (b>>13); \
784 + a -= b; a -= c; a ^= (c>>12); \
785 + b -= c; b -= a; b ^= (a<<16); \
786 + c -= a; c -= b; c ^= (b>>5); \
787 + a -= b; a -= c; a ^= (c>>3); \
788 + b -= c; b -= a; b ^= (a<<10); \
789 + c -= a; c -= b; c ^= (b>>15); \
790 +}
791 +
792 +/* The golden ration: an arbitrary value */
793 +#define JHASH_GOLDEN_RATIO 0x9e3779b9
794 +
795 +/* The most generic version, hashes an arbitrary sequence
796 + * of bytes. No alignment or length assumptions are made about
797 + * the input key.
798 + */
799 +static inline __u32 jhash(void *key, __u32 length, __u32 initval)
800 +{
801 + __u32 a, b, c, len;
802 + __u8 *k = key;
803 +
804 + len = length;
805 + a = b = JHASH_GOLDEN_RATIO;
806 + c = initval;
807 +
808 + while (len >= 12) {
809 + a += (k[0] +((__u32)k[1]<<8) +((__u32)k[2]<<16) +((__u32)k[3]<<24));
810 + b += (k[4] +((__u32)k[5]<<8) +((__u32)k[6]<<16) +((__u32)k[7]<<24));
811 + c += (k[8] +((__u32)k[9]<<8) +((__u32)k[10]<<16)+((__u32)k[11]<<24));
812 +
813 + __jhash_mix(a,b,c);
814 +
815 + k += 12;
816 + len -= 12;
817 + }
818 +
819 + c += length;
820 + switch (len) {
821 + case 11: c += ((__u32)k[10]<<24);
822 + case 10: c += ((__u32)k[9]<<16);
823 + case 9 : c += ((__u32)k[8]<<8);
824 + case 8 : b += ((__u32)k[7]<<24);
825 + case 7 : b += ((__u32)k[6]<<16);
826 + case 6 : b += ((__u32)k[5]<<8);
827 + case 5 : b += k[4];
828 + case 4 : a += ((__u32)k[3]<<24);
829 + case 3 : a += ((__u32)k[2]<<16);
830 + case 2 : a += ((__u32)k[1]<<8);
831 + case 1 : a += k[0];
832 + };
833 +
834 + __jhash_mix(a,b,c);
835 +
836 + return c;
837 +}
838 +
839 +/* A special optimized version that handles 1 or more of __u32s.
840 + * The length parameter here is the number of __u32s in the key.
841 + */
842 +static inline __u32 jhash2(__u32 *k, __u32 length, __u32 initval)
843 +{
844 + __u32 a, b, c, len;
845 +
846 + a = b = JHASH_GOLDEN_RATIO;
847 + c = initval;
848 + len = length;
849 +
850 + while (len >= 3) {
851 + a += k[0];
852 + b += k[1];
853 + c += k[2];
854 + __jhash_mix(a, b, c);
855 + k += 3; len -= 3;
856 + }
857 +
858 + c += length * 4;
859 +
860 + switch (len) {
861 + case 2 : b += k[1];
862 + case 1 : a += k[0];
863 + };
864 +
865 + __jhash_mix(a,b,c);
866 +
867 + return c;
868 +}
869 +
870 +
871 +/* A special ultra-optimized versions that knows they are hashing exactly
872 + * 3, 2 or 1 word(s).
873 + *
874 + * NOTE: In partilar the "c += length; __jhash_mix(a,b,c);" normally
875 + * done at the end is not done here.
876 + */
877 +static inline __u32 jhash_3words(__u32 a, __u32 b, __u32 c, __u32 initval)
878 +{
879 + a += JHASH_GOLDEN_RATIO;
880 + b += JHASH_GOLDEN_RATIO;
881 + c += initval;
882 +
883 + __jhash_mix(a, b, c);
884 +
885 + return c;
886 +}
887 +
888 +static inline __u32 jhash_2words(__u32 a, __u32 b, __u32 initval)
889 +{
890 + return jhash_3words(a, b, 0, initval);
891 +}
892 +
893 +static inline __u32 jhash_1word(__u32 a, __u32 initval)
894 +{
895 + return jhash_3words(a, 0, 0, initval);
896 +}
897 +
898 +#endif /* _LINUX_IPSET_JHASH_H */
899 Index: linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_macipmap.h
900 ===================================================================
901 --- /dev/null
902 +++ linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_macipmap.h
903 @@ -0,0 +1,38 @@
904 +#ifndef __IP_SET_MACIPMAP_H
905 +#define __IP_SET_MACIPMAP_H
906 +
907 +#include <linux/netfilter_ipv4/ip_set.h>
908 +
909 +#define SETTYPE_NAME "macipmap"
910 +#define MAX_RANGE 0x0000FFFF
911 +
912 +/* general flags */
913 +#define IPSET_MACIP_MATCHUNSET 1
914 +
915 +/* per ip flags */
916 +#define IPSET_MACIP_ISSET 1
917 +
918 +struct ip_set_macipmap {
919 + void *members; /* the macipmap proper */
920 + ip_set_ip_t first_ip; /* host byte order, included in range */
921 + ip_set_ip_t last_ip; /* host byte order, included in range */
922 + u_int32_t flags;
923 +};
924 +
925 +struct ip_set_req_macipmap_create {
926 + ip_set_ip_t from;
927 + ip_set_ip_t to;
928 + u_int32_t flags;
929 +};
930 +
931 +struct ip_set_req_macipmap {
932 + ip_set_ip_t ip;
933 + unsigned char ethernet[ETH_ALEN];
934 +};
935 +
936 +struct ip_set_macip {
937 + unsigned short flags;
938 + unsigned char ethernet[ETH_ALEN];
939 +};
940 +
941 +#endif /* __IP_SET_MACIPMAP_H */
942 Index: linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_malloc.h
943 ===================================================================
944 --- /dev/null
945 +++ linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_malloc.h
946 @@ -0,0 +1,116 @@
947 +#ifndef _IP_SET_MALLOC_H
948 +#define _IP_SET_MALLOC_H
949 +
950 +#ifdef __KERNEL__
951 +
952 +/* Memory allocation and deallocation */
953 +static size_t max_malloc_size = 0;
954 +
955 +static inline void init_max_malloc_size(void)
956 +{
957 +#define CACHE(x) max_malloc_size = x;
958 +#include <linux/kmalloc_sizes.h>
959 +#undef CACHE
960 +}
961 +
962 +static inline void * ip_set_malloc(size_t bytes)
963 +{
964 + if (bytes > max_malloc_size)
965 + return vmalloc(bytes);
966 + else
967 + return kmalloc(bytes, GFP_KERNEL);
968 +}
969 +
970 +static inline void ip_set_free(void * data, size_t bytes)
971 +{
972 + if (bytes > max_malloc_size)
973 + vfree(data);
974 + else
975 + kfree(data);
976 +}
977 +
978 +struct harray {
979 + size_t max_elements;
980 + void *arrays[0];
981 +};
982 +
983 +static inline void *
984 +harray_malloc(size_t hashsize, size_t typesize, int flags)
985 +{
986 + struct harray *harray;
987 + size_t max_elements, size, i, j;
988 +
989 + if (!max_malloc_size)
990 + init_max_malloc_size();
991 +
992 + if (typesize > max_malloc_size)
993 + return NULL;
994 +
995 + max_elements = max_malloc_size/typesize;
996 + size = hashsize/max_elements;
997 + if (hashsize % max_elements)
998 + size++;
999 +
1000 + /* Last pointer signals end of arrays */
1001 + harray = kmalloc(sizeof(struct harray) + (size + 1) * sizeof(void *),
1002 + flags);
1003 +
1004 + if (!harray)
1005 + return NULL;
1006 +
1007 + for (i = 0; i < size - 1; i++) {
1008 + harray->arrays[i] = kmalloc(max_elements * typesize, flags);
1009 + if (!harray->arrays[i])
1010 + goto undo;
1011 + memset(harray->arrays[i], 0, max_elements * typesize);
1012 + }
1013 + harray->arrays[i] = kmalloc((hashsize - i * max_elements) * typesize,
1014 + flags);
1015 + if (!harray->arrays[i])
1016 + goto undo;
1017 + memset(harray->arrays[i], 0, (hashsize - i * max_elements) * typesize);
1018 +
1019 + harray->max_elements = max_elements;
1020 + harray->arrays[size] = NULL;
1021 +
1022 + return (void *)harray;
1023 +
1024 + undo:
1025 + for (j = 0; j < i; j++) {
1026 + kfree(harray->arrays[j]);
1027 + }
1028 + kfree(harray);
1029 + return NULL;
1030 +}
1031 +
1032 +static inline void harray_free(void *h)
1033 +{
1034 + struct harray *harray = (struct harray *) h;
1035 + size_t i;
1036 +
1037 + for (i = 0; harray->arrays[i] != NULL; i++)
1038 + kfree(harray->arrays[i]);
1039 + kfree(harray);
1040 +}
1041 +
1042 +static inline void harray_flush(void *h, size_t hashsize, size_t typesize)
1043 +{
1044 + struct harray *harray = (struct harray *) h;
1045 + size_t i;
1046 +
1047 + for (i = 0; harray->arrays[i+1] != NULL; i++)
1048 + memset(harray->arrays[i], 0, harray->max_elements * typesize);
1049 + memset(harray->arrays[i], 0,
1050 + (hashsize - i * harray->max_elements) * typesize);
1051 +}
1052 +
1053 +#define HARRAY_ELEM(h, type, which) \
1054 +({ \
1055 + struct harray *__h = (struct harray *)(h); \
1056 + ((type)((__h)->arrays[(which)/(__h)->max_elements]) \
1057 + + (which)%(__h)->max_elements); \
1058 +})
1059 +
1060 +#endif /* __KERNEL__ */
1061 +
1062 +#endif /*_IP_SET_MALLOC_H*/
1063 Index: linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_nethash.h
1064 ===================================================================
1065 --- /dev/null
1066 +++ linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_nethash.h
1067 @@ -0,0 +1,55 @@
1068 +#ifndef __IP_SET_NETHASH_H
1069 +#define __IP_SET_NETHASH_H
1070 +
1071 +#include <linux/netfilter_ipv4/ip_set.h>
1072 +
1073 +#define SETTYPE_NAME "nethash"
1074 +#define MAX_RANGE 0x0000FFFF
1075 +
1076 +struct ip_set_nethash {
1077 + ip_set_ip_t *members; /* the nethash proper */
1078 + uint32_t elements; /* number of elements */
1079 + uint32_t hashsize; /* hash size */
1080 + uint16_t probes; /* max number of probes */
1081 + uint16_t resize; /* resize factor in percent */
1082 + unsigned char cidr[30]; /* CIDR sizes */
1083 + void *initval[0]; /* initvals for jhash_1word */
1084 +};
1085 +
1086 +struct ip_set_req_nethash_create {
1087 + uint32_t hashsize;
1088 + uint16_t probes;
1089 + uint16_t resize;
1090 +};
1091 +
1092 +struct ip_set_req_nethash {
1093 + ip_set_ip_t ip;
1094 + unsigned char cidr;
1095 +};
1096 +
1097 +static unsigned char shifts[] = {255, 253, 249, 241, 225, 193, 129, 1};
1098 +
1099 +static inline ip_set_ip_t
1100 +pack(ip_set_ip_t ip, unsigned char cidr)
1101 +{
1102 + ip_set_ip_t addr, *paddr = &addr;
1103 + unsigned char n, t, *a;
1104 +
1105 + addr = htonl(ip & (0xFFFFFFFF << (32 - (cidr))));
1106 +#ifdef __KERNEL__
1107 + DP("ip:%u.%u.%u.%u/%u", NIPQUAD(addr), cidr);
1108 +#endif
1109 + n = cidr / 8;
1110 + t = cidr % 8;
1111 + a = &((unsigned char *)paddr)[n];
1112 + *a = *a /(1 << (8 - t)) + shifts[t];
1113 +#ifdef __KERNEL__
1114 + DP("n: %u, t: %u, a: %u", n, t, *a);
1115 + DP("ip:%u.%u.%u.%u/%u, %u.%u.%u.%u",
1116 + HIPQUAD(ip), cidr, NIPQUAD(addr));
1117 +#endif
1118 +
1119 + return ntohl(addr);
1120 +}
1121 +
1122 +#endif /* __IP_SET_NETHASH_H */
1123 Index: linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_portmap.h
1124 ===================================================================
1125 --- /dev/null
1126 +++ linux-2.6.21.7/include/linux/netfilter_ipv4/ip_set_portmap.h
1127 @@ -0,0 +1,25 @@
1128 +#ifndef __IP_SET_PORTMAP_H
1129 +#define __IP_SET_PORTMAP_H
1130 +
1131 +#include <linux/netfilter_ipv4/ip_set.h>
1132 +
1133 +#define SETTYPE_NAME "portmap"
1134 +#define MAX_RANGE 0x0000FFFF
1135 +#define INVALID_PORT (MAX_RANGE + 1)
1136 +
1137 +struct ip_set_portmap {
1138 + void *members; /* the portmap proper */
1139 + ip_set_ip_t first_port; /* host byte order, included in range */
1140 + ip_set_ip_t last_port; /* host byte order, included in range */
1141 +};
1142 +
1143 +struct ip_set_req_portmap_create {
1144 + ip_set_ip_t from;
1145 + ip_set_ip_t to;
1146 +};
1147 +
1148 +struct ip_set_req_portmap {
1149 + ip_set_ip_t port;
1150 +};
1151 +
1152 +#endif /* __IP_SET_PORTMAP_H */
1153 Index: linux-2.6.21.7/include/linux/netfilter_ipv4/ipt_set.h
1154 ===================================================================
1155 --- /dev/null
1156 +++ linux-2.6.21.7/include/linux/netfilter_ipv4/ipt_set.h
1157 @@ -0,0 +1,21 @@
1158 +#ifndef _IPT_SET_H
1159 +#define _IPT_SET_H
1160 +
1161 +#include <linux/netfilter_ipv4/ip_set.h>
1162 +
1163 +struct ipt_set_info {
1164 + ip_set_id_t index;
1165 + u_int32_t flags[IP_SET_MAX_BINDINGS + 1];
1166 +};
1167 +
1168 +/* match info */
1169 +struct ipt_set_info_match {
1170 + struct ipt_set_info match_set;
1171 +};
1172 +
1173 +struct ipt_set_info_target {
1174 + struct ipt_set_info add_set;
1175 + struct ipt_set_info del_set;
1176 +};
1177 +
1178 +#endif /*_IPT_SET_H*/
1179 Index: linux-2.6.21.7/net/ipv4/netfilter/ip_set.c
1180 ===================================================================
1181 --- /dev/null
1182 +++ linux-2.6.21.7/net/ipv4/netfilter/ip_set.c
1183 @@ -0,0 +1,2003 @@
1184 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
1185 + * Patrick Schaaf <bof@bof.de>
1186 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
1187 + *
1188 + * This program is free software; you can redistribute it and/or modify
1189 + * it under the terms of the GNU General Public License version 2 as
1190 + * published by the Free Software Foundation.
1191 + */
1192 +
1193 +/* Kernel module for IP set management */
1194 +
1195 +#include <linux/version.h>
1196 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
1197 +#include <linux/config.h>
1198 +#endif
1199 +#include <linux/module.h>
1200 +#include <linux/moduleparam.h>
1201 +#include <linux/kmod.h>
1202 +#include <linux/ip.h>
1203 +#include <linux/skbuff.h>
1204 +#include <linux/random.h>
1205 +#include <linux/jhash.h>
1206 +#include <linux/netfilter_ipv4/ip_tables.h>
1207 +#include <linux/errno.h>
1208 +#include <asm/uaccess.h>
1209 +#include <asm/bitops.h>
1210 +#include <asm/semaphore.h>
1211 +#include <linux/spinlock.h>
1212 +#include <linux/vmalloc.h>
1213 +
1214 +#define ASSERT_READ_LOCK(x)
1215 +#define ASSERT_WRITE_LOCK(x)
1216 +#include <linux/netfilter_ipv4/ip_set.h>
1217 +
1218 +static struct list_head set_type_list; /* all registered sets */
1219 +static struct ip_set **ip_set_list; /* all individual sets */
1220 +static DEFINE_RWLOCK(ip_set_lock); /* protects the lists and the hash */
1221 +static DECLARE_MUTEX(ip_set_app_mutex); /* serializes user access */
1222 +static ip_set_id_t ip_set_max = CONFIG_IP_NF_SET_MAX;
1223 +static ip_set_id_t ip_set_bindings_hash_size = CONFIG_IP_NF_SET_HASHSIZE;
1224 +static struct list_head *ip_set_hash; /* hash of bindings */
1225 +static unsigned int ip_set_hash_random; /* random seed */
1226 +
1227 +/*
1228 + * Sets are identified either by the index in ip_set_list or by id.
1229 + * The id never changes and is used to find a key in the hash.
1230 + * The index may change by swapping and used at all other places
1231 + * (set/SET netfilter modules, binding value, etc.)
1232 + *
1233 + * Userspace requests are serialized by ip_set_mutex and sets can
1234 + * be deleted only from userspace. Therefore ip_set_list locking
1235 + * must obey the following rules:
1236 + *
1237 + * - kernel requests: read and write locking mandatory
1238 + * - user requests: read locking optional, write locking mandatory
1239 + */
1240 +
1241 +static inline void
1242 +__ip_set_get(ip_set_id_t index)
1243 +{
1244 + atomic_inc(&ip_set_list[index]->ref);
1245 +}
1246 +
1247 +static inline void
1248 +__ip_set_put(ip_set_id_t index)
1249 +{
1250 + atomic_dec(&ip_set_list[index]->ref);
1251 +}
1252 +
1253 +/*
1254 + * Binding routines
1255 + */
1256 +
1257 +static inline struct ip_set_hash *
1258 +__ip_set_find(u_int32_t key, ip_set_id_t id, ip_set_ip_t ip)
1259 +{
1260 + struct ip_set_hash *set_hash;
1261 +
1262 + list_for_each_entry(set_hash, &ip_set_hash[key], list)
1263 + if (set_hash->id == id && set_hash->ip == ip)
1264 + return set_hash;
1265 +
1266 + return NULL;
1267 +}
1268 +
1269 +static ip_set_id_t
1270 +ip_set_find_in_hash(ip_set_id_t id, ip_set_ip_t ip)
1271 +{
1272 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
1273 + % ip_set_bindings_hash_size;
1274 + struct ip_set_hash *set_hash;
1275 +
1276 + ASSERT_READ_LOCK(&ip_set_lock);
1277 + IP_SET_ASSERT(ip_set_list[id]);
1278 + DP("set: %s, ip: %u.%u.%u.%u", ip_set_list[id]->name, HIPQUAD(ip));
1279 +
1280 + set_hash = __ip_set_find(key, id, ip);
1281 +
1282 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
1283 + HIPQUAD(ip),
1284 + set_hash != NULL ? ip_set_list[set_hash->binding]->name : "");
1285 +
1286 + return (set_hash != NULL ? set_hash->binding : IP_SET_INVALID_ID);
1287 +}
1288 +
1289 +static inline void
1290 +__set_hash_del(struct ip_set_hash *set_hash)
1291 +{
1292 + ASSERT_WRITE_LOCK(&ip_set_lock);
1293 + IP_SET_ASSERT(ip_set_list[set_hash->binding]);
1294 +
1295 + __ip_set_put(set_hash->binding);
1296 + list_del(&set_hash->list);
1297 + kfree(set_hash);
1298 +}
1299 +
1300 +static int
1301 +ip_set_hash_del(ip_set_id_t id, ip_set_ip_t ip)
1302 +{
1303 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
1304 + % ip_set_bindings_hash_size;
1305 + struct ip_set_hash *set_hash;
1306 +
1307 + IP_SET_ASSERT(ip_set_list[id]);
1308 + DP("set: %s, ip: %u.%u.%u.%u", ip_set_list[id]->name, HIPQUAD(ip));
1309 + write_lock_bh(&ip_set_lock);
1310 + set_hash = __ip_set_find(key, id, ip);
1311 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
1312 + HIPQUAD(ip),
1313 + set_hash != NULL ? ip_set_list[set_hash->binding]->name : "");
1314 +
1315 + if (set_hash != NULL)
1316 + __set_hash_del(set_hash);
1317 + write_unlock_bh(&ip_set_lock);
1318 + return 0;
1319 +}
1320 +
1321 +static int
1322 +ip_set_hash_add(ip_set_id_t id, ip_set_ip_t ip, ip_set_id_t binding)
1323 +{
1324 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
1325 + % ip_set_bindings_hash_size;
1326 + struct ip_set_hash *set_hash;
1327 + int ret = 0;
1328 +
1329 + IP_SET_ASSERT(ip_set_list[id]);
1330 + IP_SET_ASSERT(ip_set_list[binding]);
1331 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
1332 + HIPQUAD(ip), ip_set_list[binding]->name);
1333 + write_lock_bh(&ip_set_lock);
1334 + set_hash = __ip_set_find(key, id, ip);
1335 + if (!set_hash) {
1336 + set_hash = kmalloc(sizeof(struct ip_set_hash), GFP_ATOMIC);
1337 + if (!set_hash) {
1338 + ret = -ENOMEM;
1339 + goto unlock;
1340 + }
1341 + INIT_LIST_HEAD(&set_hash->list);
1342 + set_hash->id = id;
1343 + set_hash->ip = ip;
1344 + list_add(&set_hash->list, &ip_set_hash[key]);
1345 + } else {
1346 + IP_SET_ASSERT(ip_set_list[set_hash->binding]);
1347 + DP("overwrite binding: %s",
1348 + ip_set_list[set_hash->binding]->name);
1349 + __ip_set_put(set_hash->binding);
1350 + }
1351 + set_hash->binding = binding;
1352 + __ip_set_get(set_hash->binding);
1353 + DP("stored: key %u, id %u (%s), ip %u.%u.%u.%u, binding %u (%s)",
1354 + key, id, ip_set_list[id]->name,
1355 + HIPQUAD(ip), binding, ip_set_list[binding]->name);
1356 + unlock:
1357 + write_unlock_bh(&ip_set_lock);
1358 + return ret;
1359 +}
1360 +
1361 +#define FOREACH_HASH_DO(fn, args...) \
1362 +({ \
1363 + ip_set_id_t __key; \
1364 + struct ip_set_hash *__set_hash; \
1365 + \
1366 + for (__key = 0; __key < ip_set_bindings_hash_size; __key++) { \
1367 + list_for_each_entry(__set_hash, &ip_set_hash[__key], list) \
1368 + fn(__set_hash , ## args); \
1369 + } \
1370 +})
1371 +
1372 +#define FOREACH_HASH_RW_DO(fn, args...) \
1373 +({ \
1374 + ip_set_id_t __key; \
1375 + struct ip_set_hash *__set_hash, *__n; \
1376 + \
1377 + ASSERT_WRITE_LOCK(&ip_set_lock); \
1378 + for (__key = 0; __key < ip_set_bindings_hash_size; __key++) { \
1379 + list_for_each_entry_safe(__set_hash, __n, &ip_set_hash[__key], list)\
1380 + fn(__set_hash , ## args); \
1381 + } \
1382 +})
1383 +
1384 +/* Add, del and test set entries from kernel */
1385 +
1386 +#define follow_bindings(index, set, ip) \
1387 +((index = ip_set_find_in_hash((set)->id, ip)) != IP_SET_INVALID_ID \
1388 + || (index = (set)->binding) != IP_SET_INVALID_ID)
1389 +
1390 +int
1391 +ip_set_testip_kernel(ip_set_id_t index,
1392 + const struct sk_buff *skb,
1393 + const u_int32_t *flags)
1394 +{
1395 + struct ip_set *set;
1396 + ip_set_ip_t ip;
1397 + int res;
1398 + unsigned char i = 0;
1399 +
1400 + IP_SET_ASSERT(flags[i]);
1401 + read_lock_bh(&ip_set_lock);
1402 + do {
1403 + set = ip_set_list[index];
1404 + IP_SET_ASSERT(set);
1405 + DP("set %s, index %u", set->name, index);
1406 + read_lock_bh(&set->lock);
1407 + res = set->type->testip_kernel(set, skb, &ip, flags, i++);
1408 + read_unlock_bh(&set->lock);
1409 + i += !!(set->type->features & IPSET_DATA_DOUBLE);
1410 + } while (res > 0
1411 + && flags[i]
1412 + && follow_bindings(index, set, ip));
1413 + read_unlock_bh(&ip_set_lock);
1414 +
1415 + return res;
1416 +}
1417 +
1418 +void
1419 +ip_set_addip_kernel(ip_set_id_t index,
1420 + const struct sk_buff *skb,
1421 + const u_int32_t *flags)
1422 +{
1423 + struct ip_set *set;
1424 + ip_set_ip_t ip;
1425 + int res;
1426 + unsigned char i = 0;
1427 +
1428 + IP_SET_ASSERT(flags[i]);
1429 + retry:
1430 + read_lock_bh(&ip_set_lock);
1431 + do {
1432 + set = ip_set_list[index];
1433 + IP_SET_ASSERT(set);
1434 + DP("set %s, index %u", set->name, index);
1435 + write_lock_bh(&set->lock);
1436 + res = set->type->addip_kernel(set, skb, &ip, flags, i++);
1437 + write_unlock_bh(&set->lock);
1438 + i += !!(set->type->features & IPSET_DATA_DOUBLE);
1439 + } while ((res == 0 || res == -EEXIST)
1440 + && flags[i]
1441 + && follow_bindings(index, set, ip));
1442 + read_unlock_bh(&ip_set_lock);
1443 +
1444 + if (res == -EAGAIN
1445 + && set->type->retry
1446 + && (res = set->type->retry(set)) == 0)
1447 + goto retry;
1448 +}
1449 +
1450 +void
1451 +ip_set_delip_kernel(ip_set_id_t index,
1452 + const struct sk_buff *skb,
1453 + const u_int32_t *flags)
1454 +{
1455 + struct ip_set *set;
1456 + ip_set_ip_t ip;
1457 + int res;
1458 + unsigned char i = 0;
1459 +
1460 + IP_SET_ASSERT(flags[i]);
1461 + read_lock_bh(&ip_set_lock);
1462 + do {
1463 + set = ip_set_list[index];
1464 + IP_SET_ASSERT(set);
1465 + DP("set %s, index %u", set->name, index);
1466 + write_lock_bh(&set->lock);
1467 + res = set->type->delip_kernel(set, skb, &ip, flags, i++);
1468 + write_unlock_bh(&set->lock);
1469 + i += !!(set->type->features & IPSET_DATA_DOUBLE);
1470 + } while ((res == 0 || res == -EEXIST)
1471 + && flags[i]
1472 + && follow_bindings(index, set, ip));
1473 + read_unlock_bh(&ip_set_lock);
1474 +}
1475 +
1476 +/* Register and deregister settype */
1477 +
1478 +static inline struct ip_set_type *
1479 +find_set_type(const char *name)
1480 +{
1481 + struct ip_set_type *set_type;
1482 +
1483 + list_for_each_entry(set_type, &set_type_list, list)
1484 + if (!strncmp(set_type->typename, name, IP_SET_MAXNAMELEN - 1))
1485 + return set_type;
1486 + return NULL;
1487 +}
1488 +
1489 +int
1490 +ip_set_register_set_type(struct ip_set_type *set_type)
1491 +{
1492 + int ret = 0;
1493 +
1494 + if (set_type->protocol_version != IP_SET_PROTOCOL_VERSION) {
1495 + ip_set_printk("'%s' uses wrong protocol version %u (want %u)",
1496 + set_type->typename,
1497 + set_type->protocol_version,
1498 + IP_SET_PROTOCOL_VERSION);
1499 + return -EINVAL;
1500 + }
1501 +
1502 + write_lock_bh(&ip_set_lock);
1503 + if (find_set_type(set_type->typename)) {
1504 + /* Duplicate! */
1505 + ip_set_printk("'%s' already registered!",
1506 + set_type->typename);
1507 + ret = -EINVAL;
1508 + goto unlock;
1509 + }
1510 + if (!try_module_get(THIS_MODULE)) {
1511 + ret = -EFAULT;
1512 + goto unlock;
1513 + }
1514 + list_add(&set_type->list, &set_type_list);
1515 + DP("'%s' registered.", set_type->typename);
1516 + unlock:
1517 + write_unlock_bh(&ip_set_lock);
1518 + return ret;
1519 +}
1520 +
1521 +void
1522 +ip_set_unregister_set_type(struct ip_set_type *set_type)
1523 +{
1524 + write_lock_bh(&ip_set_lock);
1525 + if (!find_set_type(set_type->typename)) {
1526 + ip_set_printk("'%s' not registered?",
1527 + set_type->typename);
1528 + goto unlock;
1529 + }
1530 + list_del(&set_type->list);
1531 + module_put(THIS_MODULE);
1532 + DP("'%s' unregistered.", set_type->typename);
1533 + unlock:
1534 + write_unlock_bh(&ip_set_lock);
1535 +
1536 +}
1537 +
1538 +/*
1539 + * Userspace routines
1540 + */
1541 +
1542 +/*
1543 + * Find set by name, reference it once. The reference makes sure the
1544 + * thing pointed to, does not go away under our feet. Drop the reference
1545 + * later, using ip_set_put().
1546 + */
1547 +ip_set_id_t
1548 +ip_set_get_byname(const char *name)
1549 +{
1550 + ip_set_id_t i, index = IP_SET_INVALID_ID;
1551 +
1552 + down(&ip_set_app_mutex);
1553 + for (i = 0; i < ip_set_max; i++) {
1554 + if (ip_set_list[i] != NULL
1555 + && strcmp(ip_set_list[i]->name, name) == 0) {
1556 + __ip_set_get(i);
1557 + index = i;
1558 + break;
1559 + }
1560 + }
1561 + up(&ip_set_app_mutex);
1562 + return index;
1563 +}
1564 +
1565 +/*
1566 + * Find set by index, reference it once. The reference makes sure the
1567 + * thing pointed to, does not go away under our feet. Drop the reference
1568 + * later, using ip_set_put().
1569 + */
1570 +ip_set_id_t
1571 +ip_set_get_byindex(ip_set_id_t index)
1572 +{
1573 + down(&ip_set_app_mutex);
1574 +
1575 + if (index >= ip_set_max)
1576 + return IP_SET_INVALID_ID;
1577 +
1578 + if (ip_set_list[index])
1579 + __ip_set_get(index);
1580 + else
1581 + index = IP_SET_INVALID_ID;
1582 +
1583 + up(&ip_set_app_mutex);
1584 + return index;
1585 +}
1586 +
1587 +/*
1588 + * If the given set pointer points to a valid set, decrement
1589 + * reference count by 1. The caller shall not assume the index
1590 + * to be valid, after calling this function.
1591 + */
1592 +void ip_set_put(ip_set_id_t index)
1593 +{
1594 + down(&ip_set_app_mutex);
1595 + if (ip_set_list[index])
1596 + __ip_set_put(index);
1597 + up(&ip_set_app_mutex);
1598 +}
1599 +
1600 +/* Find a set by name or index */
1601 +static ip_set_id_t
1602 +ip_set_find_byname(const char *name)
1603 +{
1604 + ip_set_id_t i, index = IP_SET_INVALID_ID;
1605 +
1606 + for (i = 0; i < ip_set_max; i++) {
1607 + if (ip_set_list[i] != NULL
1608 + && strcmp(ip_set_list[i]->name, name) == 0) {
1609 + index = i;
1610 + break;
1611 + }
1612 + }
1613 + return index;
1614 +}
1615 +
1616 +static ip_set_id_t
1617 +ip_set_find_byindex(ip_set_id_t index)
1618 +{
1619 + if (index >= ip_set_max || ip_set_list[index] == NULL)
1620 + index = IP_SET_INVALID_ID;
1621 +
1622 + return index;
1623 +}
1624 +
1625 +/*
1626 + * Add, del, test, bind and unbind
1627 + */
1628 +
1629 +static inline int
1630 +__ip_set_testip(struct ip_set *set,
1631 + const void *data,
1632 + size_t size,
1633 + ip_set_ip_t *ip)
1634 +{
1635 + int res;
1636 +
1637 + read_lock_bh(&set->lock);
1638 + res = set->type->testip(set, data, size, ip);
1639 + read_unlock_bh(&set->lock);
1640 +
1641 + return res;
1642 +}
1643 +
1644 +static int
1645 +__ip_set_addip(ip_set_id_t index,
1646 + const void *data,
1647 + size_t size)
1648 +{
1649 + struct ip_set *set = ip_set_list[index];
1650 + ip_set_ip_t ip;
1651 + int res;
1652 +
1653 + IP_SET_ASSERT(set);
1654 + do {
1655 + write_lock_bh(&set->lock);
1656 + res = set->type->addip(set, data, size, &ip);
1657 + write_unlock_bh(&set->lock);
1658 + } while (res == -EAGAIN
1659 + && set->type->retry
1660 + && (res = set->type->retry(set)) == 0);
1661 +
1662 + return res;
1663 +}
1664 +
1665 +static int
1666 +ip_set_addip(ip_set_id_t index,
1667 + const void *data,
1668 + size_t size)
1669 +{
1670 +
1671 + return __ip_set_addip(index,
1672 + data + sizeof(struct ip_set_req_adt),
1673 + size - sizeof(struct ip_set_req_adt));
1674 +}
1675 +
1676 +static int
1677 +ip_set_delip(ip_set_id_t index,
1678 + const void *data,
1679 + size_t size)
1680 +{
1681 + struct ip_set *set = ip_set_list[index];
1682 + ip_set_ip_t ip;
1683 + int res;
1684 +
1685 + IP_SET_ASSERT(set);
1686 + write_lock_bh(&set->lock);
1687 + res = set->type->delip(set,
1688 + data + sizeof(struct ip_set_req_adt),
1689 + size - sizeof(struct ip_set_req_adt),
1690 + &ip);
1691 + write_unlock_bh(&set->lock);
1692 +
1693 + return res;
1694 +}
1695 +
1696 +static int
1697 +ip_set_testip(ip_set_id_t index,
1698 + const void *data,
1699 + size_t size)
1700 +{
1701 + struct ip_set *set = ip_set_list[index];
1702 + ip_set_ip_t ip;
1703 + int res;
1704 +
1705 + IP_SET_ASSERT(set);
1706 + res = __ip_set_testip(set,
1707 + data + sizeof(struct ip_set_req_adt),
1708 + size - sizeof(struct ip_set_req_adt),
1709 + &ip);
1710 +
1711 + return (res > 0 ? -EEXIST : res);
1712 +}
1713 +
1714 +static int
1715 +ip_set_bindip(ip_set_id_t index,
1716 + const void *data,
1717 + size_t size)
1718 +{
1719 + struct ip_set *set = ip_set_list[index];
1720 + struct ip_set_req_bind *req_bind;
1721 + ip_set_id_t binding;
1722 + ip_set_ip_t ip;
1723 + int res;
1724 +
1725 + IP_SET_ASSERT(set);
1726 + if (size < sizeof(struct ip_set_req_bind))
1727 + return -EINVAL;
1728 +
1729 + req_bind = (struct ip_set_req_bind *) data;
1730 + req_bind->binding[IP_SET_MAXNAMELEN - 1] = '\0';
1731 +
1732 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1733 + /* Default binding of a set */
1734 + char *binding_name;
1735 +
1736 + if (size != sizeof(struct ip_set_req_bind) + IP_SET_MAXNAMELEN)
1737 + return -EINVAL;
1738 +
1739 + binding_name = (char *)(data + sizeof(struct ip_set_req_bind));
1740 + binding_name[IP_SET_MAXNAMELEN - 1] = '\0';
1741 +
1742 + binding = ip_set_find_byname(binding_name);
1743 + if (binding == IP_SET_INVALID_ID)
1744 + return -ENOENT;
1745 +
1746 + write_lock_bh(&ip_set_lock);
1747 + /* Sets as binding values are referenced */
1748 + if (set->binding != IP_SET_INVALID_ID)
1749 + __ip_set_put(set->binding);
1750 + set->binding = binding;
1751 + __ip_set_get(set->binding);
1752 + write_unlock_bh(&ip_set_lock);
1753 +
1754 + return 0;
1755 + }
1756 + binding = ip_set_find_byname(req_bind->binding);
1757 + if (binding == IP_SET_INVALID_ID)
1758 + return -ENOENT;
1759 +
1760 + res = __ip_set_testip(set,
1761 + data + sizeof(struct ip_set_req_bind),
1762 + size - sizeof(struct ip_set_req_bind),
1763 + &ip);
1764 + DP("set %s, ip: %u.%u.%u.%u, binding %s",
1765 + set->name, HIPQUAD(ip), ip_set_list[binding]->name);
1766 +
1767 + if (res >= 0)
1768 + res = ip_set_hash_add(set->id, ip, binding);
1769 +
1770 + return res;
1771 +}
1772 +
1773 +#define FOREACH_SET_DO(fn, args...) \
1774 +({ \
1775 + ip_set_id_t __i; \
1776 + struct ip_set *__set; \
1777 + \
1778 + for (__i = 0; __i < ip_set_max; __i++) { \
1779 + __set = ip_set_list[__i]; \
1780 + if (__set != NULL) \
1781 + fn(__set , ##args); \
1782 + } \
1783 +})
1784 +
1785 +static inline void
1786 +__set_hash_del_byid(struct ip_set_hash *set_hash, ip_set_id_t id)
1787 +{
1788 + if (set_hash->id == id)
1789 + __set_hash_del(set_hash);
1790 +}
1791 +
1792 +static inline void
1793 +__unbind_default(struct ip_set *set)
1794 +{
1795 + if (set->binding != IP_SET_INVALID_ID) {
1796 + /* Sets as binding values are referenced */
1797 + __ip_set_put(set->binding);
1798 + set->binding = IP_SET_INVALID_ID;
1799 + }
1800 +}
1801 +
1802 +static int
1803 +ip_set_unbindip(ip_set_id_t index,
1804 + const void *data,
1805 + size_t size)
1806 +{
1807 + struct ip_set *set;
1808 + struct ip_set_req_bind *req_bind;
1809 + ip_set_ip_t ip;
1810 + int res;
1811 +
1812 + DP("");
1813 + if (size < sizeof(struct ip_set_req_bind))
1814 + return -EINVAL;
1815 +
1816 + req_bind = (struct ip_set_req_bind *) data;
1817 + req_bind->binding[IP_SET_MAXNAMELEN - 1] = '\0';
1818 +
1819 + DP("%u %s", index, req_bind->binding);
1820 + if (index == IP_SET_INVALID_ID) {
1821 + /* unbind :all: */
1822 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1823 + /* Default binding of sets */
1824 + write_lock_bh(&ip_set_lock);
1825 + FOREACH_SET_DO(__unbind_default);
1826 + write_unlock_bh(&ip_set_lock);
1827 + return 0;
1828 + } else if (strcmp(req_bind->binding, IPSET_TOKEN_ALL) == 0) {
1829 + /* Flush all bindings of all sets*/
1830 + write_lock_bh(&ip_set_lock);
1831 + FOREACH_HASH_RW_DO(__set_hash_del);
1832 + write_unlock_bh(&ip_set_lock);
1833 + return 0;
1834 + }
1835 + DP("unreachable reached!");
1836 + return -EINVAL;
1837 + }
1838 +
1839 + set = ip_set_list[index];
1840 + IP_SET_ASSERT(set);
1841 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1842 + /* Default binding of set */
1843 + ip_set_id_t binding = ip_set_find_byindex(set->binding);
1844 +
1845 + if (binding == IP_SET_INVALID_ID)
1846 + return -ENOENT;
1847 +
1848 + write_lock_bh(&ip_set_lock);
1849 + /* Sets in hash values are referenced */
1850 + __ip_set_put(set->binding);
1851 + set->binding = IP_SET_INVALID_ID;
1852 + write_unlock_bh(&ip_set_lock);
1853 +
1854 + return 0;
1855 + } else if (strcmp(req_bind->binding, IPSET_TOKEN_ALL) == 0) {
1856 + /* Flush all bindings */
1857 +
1858 + write_lock_bh(&ip_set_lock);
1859 + FOREACH_HASH_RW_DO(__set_hash_del_byid, set->id);
1860 + write_unlock_bh(&ip_set_lock);
1861 + return 0;
1862 + }
1863 +
1864 + res = __ip_set_testip(set,
1865 + data + sizeof(struct ip_set_req_bind),
1866 + size - sizeof(struct ip_set_req_bind),
1867 + &ip);
1868 +
1869 + DP("set %s, ip: %u.%u.%u.%u", set->name, HIPQUAD(ip));
1870 + if (res >= 0)
1871 + res = ip_set_hash_del(set->id, ip);
1872 +
1873 + return res;
1874 +}
1875 +
1876 +static int
1877 +ip_set_testbind(ip_set_id_t index,
1878 + const void *data,
1879 + size_t size)
1880 +{
1881 + struct ip_set *set = ip_set_list[index];
1882 + struct ip_set_req_bind *req_bind;
1883 + ip_set_id_t binding;
1884 + ip_set_ip_t ip;
1885 + int res;
1886 +
1887 + IP_SET_ASSERT(set);
1888 + if (size < sizeof(struct ip_set_req_bind))
1889 + return -EINVAL;
1890 +
1891 + req_bind = (struct ip_set_req_bind *) data;
1892 + req_bind->binding[IP_SET_MAXNAMELEN - 1] = '\0';
1893 +
1894 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1895 + /* Default binding of set */
1896 + char *binding_name;
1897 +
1898 + if (size != sizeof(struct ip_set_req_bind) + IP_SET_MAXNAMELEN)
1899 + return -EINVAL;
1900 +
1901 + binding_name = (char *)(data + sizeof(struct ip_set_req_bind));
1902 + binding_name[IP_SET_MAXNAMELEN - 1] = '\0';
1903 +
1904 + binding = ip_set_find_byname(binding_name);
1905 + if (binding == IP_SET_INVALID_ID)
1906 + return -ENOENT;
1907 +
1908 + res = (set->binding == binding) ? -EEXIST : 0;
1909 +
1910 + return res;
1911 + }
1912 + binding = ip_set_find_byname(req_bind->binding);
1913 + if (binding == IP_SET_INVALID_ID)
1914 + return -ENOENT;
1915 +
1916 +
1917 + res = __ip_set_testip(set,
1918 + data + sizeof(struct ip_set_req_bind),
1919 + size - sizeof(struct ip_set_req_bind),
1920 + &ip);
1921 + DP("set %s, ip: %u.%u.%u.%u, binding %s",
1922 + set->name, HIPQUAD(ip), ip_set_list[binding]->name);
1923 +
1924 + if (res >= 0)
1925 + res = (ip_set_find_in_hash(set->id, ip) == binding)
1926 + ? -EEXIST : 0;
1927 +
1928 + return res;
1929 +}
1930 +
1931 +static struct ip_set_type *
1932 +find_set_type_rlock(const char *typename)
1933 +{
1934 + struct ip_set_type *type;
1935 +
1936 + read_lock_bh(&ip_set_lock);
1937 + type = find_set_type(typename);
1938 + if (type == NULL)
1939 + read_unlock_bh(&ip_set_lock);
1940 +
1941 + return type;
1942 +}
1943 +
1944 +static int
1945 +find_free_id(const char *name,
1946 + ip_set_id_t *index,
1947 + ip_set_id_t *id)
1948 +{
1949 + ip_set_id_t i;
1950 +
1951 + *id = IP_SET_INVALID_ID;
1952 + for (i = 0; i < ip_set_max; i++) {
1953 + if (ip_set_list[i] == NULL) {
1954 + if (*id == IP_SET_INVALID_ID)
1955 + *id = *index = i;
1956 + } else if (strcmp(name, ip_set_list[i]->name) == 0)
1957 + /* Name clash */
1958 + return -EEXIST;
1959 + }
1960 + if (*id == IP_SET_INVALID_ID)
1961 + /* No free slot remained */
1962 + return -ERANGE;
1963 + /* Check that index is usable as id (swapping) */
1964 + check:
1965 + for (i = 0; i < ip_set_max; i++) {
1966 + if (ip_set_list[i] != NULL
1967 + && ip_set_list[i]->id == *id) {
1968 + *id = i;
1969 + goto check;
1970 + }
1971 + }
1972 + return 0;
1973 +}
1974 +
1975 +/*
1976 + * Create a set
1977 + */
1978 +static int
1979 +ip_set_create(const char *name,
1980 + const char *typename,
1981 + ip_set_id_t restore,
1982 + const void *data,
1983 + size_t size)
1984 +{
1985 + struct ip_set *set;
1986 + ip_set_id_t index = 0, id;
1987 + int res = 0;
1988 +
1989 + DP("setname: %s, typename: %s, id: %u", name, typename, restore);
1990 + /*
1991 + * First, and without any locks, allocate and initialize
1992 + * a normal base set structure.
1993 + */
1994 + set = kmalloc(sizeof(struct ip_set), GFP_KERNEL);
1995 + if (!set)
1996 + return -ENOMEM;
1997 + set->lock = RW_LOCK_UNLOCKED;
1998 + strncpy(set->name, name, IP_SET_MAXNAMELEN);
1999 + set->binding = IP_SET_INVALID_ID;
2000 + atomic_set(&set->ref, 0);
2001 +
2002 + /*
2003 + * Next, take the &ip_set_lock, check that we know the type,
2004 + * and take a reference on the type, to make sure it
2005 + * stays available while constructing our new set.
2006 + *
2007 + * After referencing the type, we drop the &ip_set_lock,
2008 + * and let the new set construction run without locks.
2009 + */
2010 + set->type = find_set_type_rlock(typename);
2011 + if (set->type == NULL) {
2012 + /* Try loading the module */
2013 + char modulename[IP_SET_MAXNAMELEN + strlen("ip_set_") + 1];
2014 + strcpy(modulename, "ip_set_");
2015 + strcat(modulename, typename);
2016 + DP("try to load %s", modulename);
2017 + request_module(modulename);
2018 + set->type = find_set_type_rlock(typename);
2019 + }
2020 + if (set->type == NULL) {
2021 + ip_set_printk("no set type '%s', set '%s' not created",
2022 + typename, name);
2023 + res = -ENOENT;
2024 + goto out;
2025 + }
2026 + if (!try_module_get(set->type->me)) {
2027 + read_unlock_bh(&ip_set_lock);
2028 + res = -EFAULT;
2029 + goto out;
2030 + }
2031 + read_unlock_bh(&ip_set_lock);
2032 +
2033 + /*
2034 + * Without holding any locks, create private part.
2035 + */
2036 + res = set->type->create(set, data, size);
2037 + if (res != 0)
2038 + goto put_out;
2039 +
2040 + /* BTW, res==0 here. */
2041 +
2042 + /*
2043 + * Here, we have a valid, constructed set. &ip_set_lock again,
2044 + * find free id/index and check that it is not already in
2045 + * ip_set_list.
2046 + */
2047 + write_lock_bh(&ip_set_lock);
2048 + if ((res = find_free_id(set->name, &index, &id)) != 0) {
2049 + DP("no free id!");
2050 + goto cleanup;
2051 + }
2052 +
2053 + /* Make sure restore gets the same index */
2054 + if (restore != IP_SET_INVALID_ID && index != restore) {
2055 + DP("Can't restore, sets are screwed up");
2056 + res = -ERANGE;
2057 + goto cleanup;
2058 + }
2059 +
2060 + /*
2061 + * Finally! Add our shiny new set to the list, and be done.
2062 + */
2063 + DP("create: '%s' created with index %u, id %u!", set->name, index, id);
2064 + set->id = id;
2065 + ip_set_list[index] = set;
2066 + write_unlock_bh(&ip_set_lock);
2067 + return res;
2068 +
2069 + cleanup:
2070 + write_unlock_bh(&ip_set_lock);
2071 + set->type->destroy(set);
2072 + put_out:
2073 + module_put(set->type->me);
2074 + out:
2075 + kfree(set);
2076 + return res;
2077 +}
2078 +
2079 +/*
2080 + * Destroy a given existing set
2081 + */
2082 +static void
2083 +ip_set_destroy_set(ip_set_id_t index)
2084 +{
2085 + struct ip_set *set = ip_set_list[index];
2086 +
2087 + IP_SET_ASSERT(set);
2088 + DP("set: %s", set->name);
2089 + write_lock_bh(&ip_set_lock);
2090 + FOREACH_HASH_RW_DO(__set_hash_del_byid, set->id);
2091 + if (set->binding != IP_SET_INVALID_ID)
2092 + __ip_set_put(set->binding);
2093 + ip_set_list[index] = NULL;
2094 + write_unlock_bh(&ip_set_lock);
2095 +
2096 + /* Must call it without holding any lock */
2097 + set->type->destroy(set);
2098 + module_put(set->type->me);
2099 + kfree(set);
2100 +}
2101 +
2102 +/*
2103 + * Destroy a set - or all sets
2104 + * Sets must not be referenced/used.
2105 + */
2106 +static int
2107 +ip_set_destroy(ip_set_id_t index)
2108 +{
2109 + ip_set_id_t i;
2110 +
2111 + /* ref modification always protected by the mutex */
2112 + if (index != IP_SET_INVALID_ID) {
2113 + if (atomic_read(&ip_set_list[index]->ref))
2114 + return -EBUSY;
2115 + ip_set_destroy_set(index);
2116 + } else {
2117 + for (i = 0; i < ip_set_max; i++) {
2118 + if (ip_set_list[i] != NULL
2119 + && (atomic_read(&ip_set_list[i]->ref)))
2120 + return -EBUSY;
2121 + }
2122 +
2123 + for (i = 0; i < ip_set_max; i++) {
2124 + if (ip_set_list[i] != NULL)
2125 + ip_set_destroy_set(i);
2126 + }
2127 + }
2128 + return 0;
2129 +}
2130 +
2131 +static void
2132 +ip_set_flush_set(struct ip_set *set)
2133 +{
2134 + DP("set: %s %u", set->name, set->id);
2135 +
2136 + write_lock_bh(&set->lock);
2137 + set->type->flush(set);
2138 + write_unlock_bh(&set->lock);
2139 +}
2140 +
2141 +/*
2142 + * Flush data in a set - or in all sets
2143 + */
2144 +static int
2145 +ip_set_flush(ip_set_id_t index)
2146 +{
2147 + if (index != IP_SET_INVALID_ID) {
2148 + IP_SET_ASSERT(ip_set_list[index]);
2149 + ip_set_flush_set(ip_set_list[index]);
2150 + } else
2151 + FOREACH_SET_DO(ip_set_flush_set);
2152 +
2153 + return 0;
2154 +}
2155 +
2156 +/* Rename a set */
2157 +static int
2158 +ip_set_rename(ip_set_id_t index, const char *name)
2159 +{
2160 + struct ip_set *set = ip_set_list[index];
2161 + ip_set_id_t i;
2162 + int res = 0;
2163 +
2164 + DP("set: %s to %s", set->name, name);
2165 + write_lock_bh(&ip_set_lock);
2166 + for (i = 0; i < ip_set_max; i++) {
2167 + if (ip_set_list[i] != NULL
2168 + && strncmp(ip_set_list[i]->name,
2169 + name,
2170 + IP_SET_MAXNAMELEN - 1) == 0) {
2171 + res = -EEXIST;
2172 + goto unlock;
2173 + }
2174 + }
2175 + strncpy(set->name, name, IP_SET_MAXNAMELEN);
2176 + unlock:
2177 + write_unlock_bh(&ip_set_lock);
2178 + return res;
2179 +}
2180 +
2181 +/*
2182 + * Swap two sets so that name/index points to the other.
2183 + * References are also swapped.
2184 + */
2185 +static int
2186 +ip_set_swap(ip_set_id_t from_index, ip_set_id_t to_index)
2187 +{
2188 + struct ip_set *from = ip_set_list[from_index];
2189 + struct ip_set *to = ip_set_list[to_index];
2190 + char from_name[IP_SET_MAXNAMELEN];
2191 + u_int32_t from_ref;
2192 +
2193 + DP("set: %s to %s", from->name, to->name);
2194 + /* Features must not change. Artifical restriction. */
2195 + if (from->type->features != to->type->features)
2196 + return -ENOEXEC;
2197 +
2198 + /* No magic here: ref munging protected by the mutex */
2199 + write_lock_bh(&ip_set_lock);
2200 + strncpy(from_name, from->name, IP_SET_MAXNAMELEN);
2201 + from_ref = atomic_read(&from->ref);
2202 +
2203 + strncpy(from->name, to->name, IP_SET_MAXNAMELEN);
2204 + atomic_set(&from->ref, atomic_read(&to->ref));
2205 + strncpy(to->name, from_name, IP_SET_MAXNAMELEN);
2206 + atomic_set(&to->ref, from_ref);
2207 +
2208 + ip_set_list[from_index] = to;
2209 + ip_set_list[to_index] = from;
2210 +
2211 + write_unlock_bh(&ip_set_lock);
2212 + return 0;
2213 +}
2214 +
2215 +/*
2216 + * List set data
2217 + */
2218 +
2219 +static inline void
2220 +__set_hash_bindings_size_list(struct ip_set_hash *set_hash,
2221 + ip_set_id_t id, size_t *size)
2222 +{
2223 + if (set_hash->id == id)
2224 + *size += sizeof(struct ip_set_hash_list);
2225 +}
2226 +
2227 +static inline void
2228 +__set_hash_bindings_size_save(struct ip_set_hash *set_hash,
2229 + ip_set_id_t id, size_t *size)
2230 +{
2231 + if (set_hash->id == id)
2232 + *size += sizeof(struct ip_set_hash_save);
2233 +}
2234 +
2235 +static inline void
2236 +__set_hash_bindings(struct ip_set_hash *set_hash,
2237 + ip_set_id_t id, void *data, int *used)
2238 +{
2239 + if (set_hash->id == id) {
2240 + struct ip_set_hash_list *hash_list =
2241 + (struct ip_set_hash_list *)(data + *used);
2242 +
2243 + hash_list->ip = set_hash->ip;
2244 + hash_list->binding = set_hash->binding;
2245 + *used += sizeof(struct ip_set_hash_list);
2246 + }
2247 +}
2248 +
2249 +static int ip_set_list_set(ip_set_id_t index,
2250 + void *data,
2251 + int *used,
2252 + int len)
2253 +{
2254 + struct ip_set *set = ip_set_list[index];
2255 + struct ip_set_list *set_list;
2256 +
2257 + /* Pointer to our header */
2258 + set_list = (struct ip_set_list *) (data + *used);
2259 +
2260 + DP("set: %s, used: %d %p %p", set->name, *used, data, data + *used);
2261 +
2262 + /* Get and ensure header size */
2263 + if (*used + sizeof(struct ip_set_list) > len)
2264 + goto not_enough_mem;
2265 + *used += sizeof(struct ip_set_list);
2266 +
2267 + read_lock_bh(&set->lock);
2268 + /* Get and ensure set specific header size */
2269 + set_list->header_size = set->type->header_size;
2270 + if (*used + set_list->header_size > len)
2271 + goto unlock_set;
2272 +
2273 + /* Fill in the header */
2274 + set_list->index = index;
2275 + set_list->binding = set->binding;
2276 + set_list->ref = atomic_read(&set->ref);
2277 +
2278 + /* Fill in set spefific header data */
2279 + set->type->list_header(set, data + *used);
2280 + *used += set_list->header_size;
2281 +
2282 + /* Get and ensure set specific members size */
2283 + set_list->members_size = set->type->list_members_size(set);
2284 + if (*used + set_list->members_size > len)
2285 + goto unlock_set;
2286 +
2287 + /* Fill in set spefific members data */
2288 + set->type->list_members(set, data + *used);
2289 + *used += set_list->members_size;
2290 + read_unlock_bh(&set->lock);
2291 +
2292 + /* Bindings */
2293 +
2294 + /* Get and ensure set specific bindings size */
2295 + set_list->bindings_size = 0;
2296 + FOREACH_HASH_DO(__set_hash_bindings_size_list,
2297 + set->id, &set_list->bindings_size);
2298 + if (*used + set_list->bindings_size > len)
2299 + goto not_enough_mem;
2300 +
2301 + /* Fill in set spefific bindings data */
2302 + FOREACH_HASH_DO(__set_hash_bindings, set->id, data, used);
2303 +
2304 + return 0;
2305 +
2306 + unlock_set:
2307 + read_unlock_bh(&set->lock);
2308 + not_enough_mem:
2309 + DP("not enough mem, try again");
2310 + return -EAGAIN;
2311 +}
2312 +
2313 +/*
2314 + * Save sets
2315 + */
2316 +static int ip_set_save_set(ip_set_id_t index,
2317 + void *data,
2318 + int *used,
2319 + int len)
2320 +{
2321 + struct ip_set *set;
2322 + struct ip_set_save *set_save;
2323 +
2324 + /* Pointer to our header */
2325 + set_save = (struct ip_set_save *) (data + *used);
2326 +
2327 + /* Get and ensure header size */
2328 + if (*used + sizeof(struct ip_set_save) > len)
2329 + goto not_enough_mem;
2330 + *used += sizeof(struct ip_set_save);
2331 +
2332 + set = ip_set_list[index];
2333 + DP("set: %s, used: %u(%u) %p %p", set->name, *used, len,
2334 + data, data + *used);
2335 +
2336 + read_lock_bh(&set->lock);
2337 + /* Get and ensure set specific header size */
2338 + set_save->header_size = set->type->header_size;
2339 + if (*used + set_save->header_size > len)
2340 + goto unlock_set;
2341 +
2342 + /* Fill in the header */
2343 + set_save->index = index;
2344 + set_save->binding = set->binding;
2345 +
2346 + /* Fill in set spefific header data */
2347 + set->type->list_header(set, data + *used);
2348 + *used += set_save->header_size;
2349 +
2350 + DP("set header filled: %s, used: %u(%u) %p %p", set->name, *used,
2351 + set_save->header_size, data, data + *used);
2352 + /* Get and ensure set specific members size */
2353 + set_save->members_size = set->type->list_members_size(set);
2354 + if (*used + set_save->members_size > len)
2355 + goto unlock_set;
2356 +
2357 + /* Fill in set spefific members data */
2358 + set->type->list_members(set, data + *used);
2359 + *used += set_save->members_size;
2360 + read_unlock_bh(&set->lock);
2361 + DP("set members filled: %s, used: %u(%u) %p %p", set->name, *used,
2362 + set_save->members_size, data, data + *used);
2363 + return 0;
2364 +
2365 + unlock_set:
2366 + read_unlock_bh(&set->lock);
2367 + not_enough_mem:
2368 + DP("not enough mem, try again");
2369 + return -EAGAIN;
2370 +}
2371 +
2372 +static inline void
2373 +__set_hash_save_bindings(struct ip_set_hash *set_hash,
2374 + ip_set_id_t id,
2375 + void *data,
2376 + int *used,
2377 + int len,
2378 + int *res)
2379 +{
2380 + if (*res == 0
2381 + && (id == IP_SET_INVALID_ID || set_hash->id == id)) {
2382 + struct ip_set_hash_save *hash_save =
2383 + (struct ip_set_hash_save *)(data + *used);
2384 + /* Ensure bindings size */
2385 + if (*used + sizeof(struct ip_set_hash_save) > len) {
2386 + *res = -ENOMEM;
2387 + return;
2388 + }
2389 + hash_save->id = set_hash->id;
2390 + hash_save->ip = set_hash->ip;
2391 + hash_save->binding = set_hash->binding;
2392 + *used += sizeof(struct ip_set_hash_save);
2393 + }
2394 +}
2395 +
2396 +static int ip_set_save_bindings(ip_set_id_t index,
2397 + void *data,
2398 + int *used,
2399 + int len)
2400 +{
2401 + int res = 0;
2402 + struct ip_set_save *set_save;
2403 +
2404 + DP("used %u, len %u", *used, len);
2405 + /* Get and ensure header size */
2406 + if (*used + sizeof(struct ip_set_save) > len)
2407 + return -ENOMEM;
2408 +
2409 + /* Marker */
2410 + set_save = (struct ip_set_save *) (data + *used);
2411 + set_save->index = IP_SET_INVALID_ID;
2412 + set_save->header_size = 0;
2413 + set_save->members_size = 0;
2414 + *used += sizeof(struct ip_set_save);
2415 +
2416 + DP("marker added used %u, len %u", *used, len);
2417 + /* Fill in bindings data */
2418 + if (index != IP_SET_INVALID_ID)
2419 + /* Sets are identified by id in hash */
2420 + index = ip_set_list[index]->id;
2421 + FOREACH_HASH_DO(__set_hash_save_bindings, index, data, used, len, &res);
2422 +
2423 + return res;
2424 +}
2425 +
2426 +/*
2427 + * Restore sets
2428 + */
2429 +static int ip_set_restore(void *data,
2430 + int len)
2431 +{
2432 + int res = 0;
2433 + int line = 0, used = 0, members_size;
2434 + struct ip_set *set;
2435 + struct ip_set_hash_save *hash_save;
2436 + struct ip_set_restore *set_restore;
2437 + ip_set_id_t index;
2438 +
2439 + /* Loop to restore sets */
2440 + while (1) {
2441 + line++;
2442 +
2443 + DP("%u %u %u", used, sizeof(struct ip_set_restore), len);
2444 + /* Get and ensure header size */
2445 + if (used + sizeof(struct ip_set_restore) > len)
2446 + return line;
2447 + set_restore = (struct ip_set_restore *) (data + used);
2448 + used += sizeof(struct ip_set_restore);
2449 +
2450 + /* Ensure data size */
2451 + if (used
2452 + + set_restore->header_size
2453 + + set_restore->members_size > len)
2454 + return line;
2455 +
2456 + /* Check marker */
2457 + if (set_restore->index == IP_SET_INVALID_ID) {
2458 + line--;
2459 + goto bindings;
2460 + }
2461 +
2462 + /* Try to create the set */
2463 + DP("restore %s %s", set_restore->name, set_restore->typename);
2464 + res = ip_set_create(set_restore->name,
2465 + set_restore->typename,
2466 + set_restore->index,
2467 + data + used,
2468 + set_restore->header_size);
2469 +
2470 + if (res != 0)
2471 + return line;
2472 + used += set_restore->header_size;
2473 +
2474 + index = ip_set_find_byindex(set_restore->index);
2475 + DP("index %u, restore_index %u", index, set_restore->index);
2476 + if (index != set_restore->index)
2477 + return line;
2478 + /* Try to restore members data */
2479 + set = ip_set_list[index];
2480 + members_size = 0;
2481 + DP("members_size %u reqsize %u",
2482 + set_restore->members_size, set->type->reqsize);
2483 + while (members_size + set->type->reqsize <=
2484 + set_restore->members_size) {
2485 + line++;
2486 + DP("members: %u, line %u", members_size, line);
2487 + res = __ip_set_addip(index,
2488 + data + used + members_size,
2489 + set->type->reqsize);
2490 + if (!(res == 0 || res == -EEXIST))
2491 + return line;
2492 + members_size += set->type->reqsize;
2493 + }
2494 +
2495 + DP("members_size %u %u",
2496 + set_restore->members_size, members_size);
2497 + if (members_size != set_restore->members_size)
2498 + return line++;
2499 + used += set_restore->members_size;
2500 + }
2501 +
2502 + bindings:
2503 + /* Loop to restore bindings */
2504 + while (used < len) {
2505 + line++;
2506 +
2507 + DP("restore binding, line %u", line);
2508 + /* Get and ensure size */
2509 + if (used + sizeof(struct ip_set_hash_save) > len)
2510 + return line;
2511 + hash_save = (struct ip_set_hash_save *) (data + used);
2512 + used += sizeof(struct ip_set_hash_save);
2513 +
2514 + /* hash_save->id is used to store the index */
2515 + index = ip_set_find_byindex(hash_save->id);
2516 + DP("restore binding index %u, id %u, %u -> %u",
2517 + index, hash_save->id, hash_save->ip, hash_save->binding);
2518 + if (index != hash_save->id)
2519 + return line;
2520 + if (ip_set_find_byindex(hash_save->binding) == IP_SET_INVALID_ID) {
2521 + DP("corrupt binding set index %u", hash_save->binding);
2522 + return line;
2523 + }
2524 + set = ip_set_list[hash_save->id];
2525 + /* Null valued IP means default binding */
2526 + if (hash_save->ip)
2527 + res = ip_set_hash_add(set->id,
2528 + hash_save->ip,
2529 + hash_save->binding);
2530 + else {
2531 + IP_SET_ASSERT(set->binding == IP_SET_INVALID_ID);
2532 + write_lock_bh(&ip_set_lock);
2533 + set->binding = hash_save->binding;
2534 + __ip_set_get(set->binding);
2535 + write_unlock_bh(&ip_set_lock);
2536 + DP("default binding: %u", set->binding);
2537 + }
2538 + if (res != 0)
2539 + return line;
2540 + }
2541 + if (used != len)
2542 + return line;
2543 +
2544 + return 0;
2545 +}
2546 +
2547 +static int
2548 +ip_set_sockfn_set(struct sock *sk, int optval, void *user, unsigned int len)
2549 +{
2550 + void *data;
2551 + int res = 0; /* Assume OK */
2552 + unsigned *op;
2553 + struct ip_set_req_adt *req_adt;
2554 + ip_set_id_t index = IP_SET_INVALID_ID;
2555 + int (*adtfn)(ip_set_id_t index,
2556 + const void *data, size_t size);
2557 + struct fn_table {
2558 + int (*fn)(ip_set_id_t index,
2559 + const void *data, size_t size);
2560 + } adtfn_table[] =
2561 + { { ip_set_addip }, { ip_set_delip }, { ip_set_testip},
2562 + { ip_set_bindip}, { ip_set_unbindip }, { ip_set_testbind },
2563 + };
2564 +
2565 + DP("optval=%d, user=%p, len=%d", optval, user, len);
2566 + if (!capable(CAP_NET_ADMIN))
2567 + return -EPERM;
2568 + if (optval != SO_IP_SET)
2569 + return -EBADF;
2570 + if (len <= sizeof(unsigned)) {
2571 + ip_set_printk("short userdata (want >%zu, got %u)",
2572 + sizeof(unsigned), len);
2573 + return -EINVAL;
2574 + }
2575 + data = vmalloc(len);
2576 + if (!data) {
2577 + DP("out of mem for %u bytes", len);
2578 + return -ENOMEM;
2579 + }
2580 + if (copy_from_user(data, user, len) != 0) {
2581 + res = -EFAULT;
2582 + goto done;
2583 + }
2584 + if (down_interruptible(&ip_set_app_mutex)) {
2585 + res = -EINTR;
2586 + goto done;
2587 + }
2588 +
2589 + op = (unsigned *)data;
2590 + DP("op=%x", *op);
2591 +
2592 + if (*op < IP_SET_OP_VERSION) {
2593 + /* Check the version at the beginning of operations */
2594 + struct ip_set_req_version *req_version =
2595 + (struct ip_set_req_version *) data;
2596 + if (req_version->version != IP_SET_PROTOCOL_VERSION) {
2597 + res = -EPROTO;
2598 + goto done;
2599 + }
2600 + }
2601 +
2602 + switch (*op) {
2603 + case IP_SET_OP_CREATE:{
2604 + struct ip_set_req_create *req_create
2605 + = (struct ip_set_req_create *) data;
2606 +
2607 + if (len < sizeof(struct ip_set_req_create)) {
2608 + ip_set_printk("short CREATE data (want >=%zu, got %u)",
2609 + sizeof(struct ip_set_req_create), len);
2610 + res = -EINVAL;
2611 + goto done;
2612 + }
2613 + req_create->name[IP_SET_MAXNAMELEN - 1] = '\0';
2614 + req_create->typename[IP_SET_MAXNAMELEN - 1] = '\0';
2615 + res = ip_set_create(req_create->name,
2616 + req_create->typename,
2617 + IP_SET_INVALID_ID,
2618 + data + sizeof(struct ip_set_req_create),
2619 + len - sizeof(struct ip_set_req_create));
2620 + goto done;
2621 + }
2622 + case IP_SET_OP_DESTROY:{
2623 + struct ip_set_req_std *req_destroy
2624 + = (struct ip_set_req_std *) data;
2625 +
2626 + if (len != sizeof(struct ip_set_req_std)) {
2627 + ip_set_printk("invalid DESTROY data (want %zu, got %u)",
2628 + sizeof(struct ip_set_req_std), len);
2629 + res = -EINVAL;
2630 + goto done;
2631 + }
2632 + if (strcmp(req_destroy->name, IPSET_TOKEN_ALL) == 0) {
2633 + /* Destroy all sets */
2634 + index = IP_SET_INVALID_ID;
2635 + } else {
2636 + req_destroy->name[IP_SET_MAXNAMELEN - 1] = '\0';
2637 + index = ip_set_find_byname(req_destroy->name);
2638 +
2639 + if (index == IP_SET_INVALID_ID) {
2640 + res = -ENOENT;
2641 + goto done;
2642 + }
2643 + }
2644 +
2645 + res = ip_set_destroy(index);
2646 + goto done;
2647 + }
2648 + case IP_SET_OP_FLUSH:{
2649 + struct ip_set_req_std *req_flush =
2650 + (struct ip_set_req_std *) data;
2651 +
2652 + if (len != sizeof(struct ip_set_req_std)) {
2653 + ip_set_printk("invalid FLUSH data (want %zu, got %u)",
2654 + sizeof(struct ip_set_req_std), len);
2655 + res = -EINVAL;
2656 + goto done;
2657 + }
2658 + if (strcmp(req_flush->name, IPSET_TOKEN_ALL) == 0) {
2659 + /* Flush all sets */
2660 + index = IP_SET_INVALID_ID;
2661 + } else {
2662 + req_flush->name[IP_SET_MAXNAMELEN - 1] = '\0';
2663 + index = ip_set_find_byname(req_flush->name);
2664 +
2665 + if (index == IP_SET_INVALID_ID) {
2666 + res = -ENOENT;
2667 + goto done;
2668 + }
2669 + }
2670 + res = ip_set_flush(index);
2671 + goto done;
2672 + }
2673 + case IP_SET_OP_RENAME:{
2674 + struct ip_set_req_create *req_rename
2675 + = (struct ip_set_req_create *) data;
2676 +
2677 + if (len != sizeof(struct ip_set_req_create)) {
2678 + ip_set_printk("invalid RENAME data (want %zu, got %u)",
2679 + sizeof(struct ip_set_req_create), len);
2680 + res = -EINVAL;
2681 + goto done;
2682 + }
2683 +
2684 + req_rename->name[IP_SET_MAXNAMELEN - 1] = '\0';
2685 + req_rename->typename[IP_SET_MAXNAMELEN - 1] = '\0';
2686 +
2687 + index = ip_set_find_byname(req_rename->name);
2688 + if (index == IP_SET_INVALID_ID) {
2689 + res = -ENOENT;
2690 + goto done;
2691 + }
2692 + res = ip_set_rename(index, req_rename->typename);
2693 + goto done;
2694 + }
2695 + case IP_SET_OP_SWAP:{
2696 + struct ip_set_req_create *req_swap
2697 + = (struct ip_set_req_create *) data;
2698 + ip_set_id_t to_index;
2699 +
2700 + if (len != sizeof(struct ip_set_req_create)) {
2701 + ip_set_printk("invalid SWAP data (want %zu, got %u)",
2702 + sizeof(struct ip_set_req_create), len);
2703 + res = -EINVAL;
2704 + goto done;
2705 + }
2706 +
2707 + req_swap->name[IP_SET_MAXNAMELEN - 1] = '\0';
2708 + req_swap->typename[IP_SET_MAXNAMELEN - 1] = '\0';
2709 +
2710 + index = ip_set_find_byname(req_swap->name);
2711 + if (index == IP_SET_INVALID_ID) {
2712 + res = -ENOENT;
2713 + goto done;
2714 + }
2715 + to_index = ip_set_find_byname(req_swap->typename);
2716 + if (to_index == IP_SET_INVALID_ID) {
2717 + res = -ENOENT;
2718 + goto done;
2719 + }
2720 + res = ip_set_swap(index, to_index);
2721 + goto done;
2722 + }
2723 + default:
2724 + break; /* Set identified by id */
2725 + }
2726 +
2727 + /* There we may have add/del/test/bind/unbind/test_bind operations */
2728 + if (*op < IP_SET_OP_ADD_IP || *op > IP_SET_OP_TEST_BIND_SET) {
2729 + res = -EBADMSG;
2730 + goto done;
2731 + }
2732 + adtfn = adtfn_table[*op - IP_SET_OP_ADD_IP].fn;
2733 +
2734 + if (len < sizeof(struct ip_set_req_adt)) {
2735 + ip_set_printk("short data in adt request (want >=%zu, got %u)",
2736 + sizeof(struct ip_set_req_adt), len);
2737 + res = -EINVAL;
2738 + goto done;
2739 + }
2740 + req_adt = (struct ip_set_req_adt *) data;
2741 +
2742 + /* -U :all: :all:|:default: uses IP_SET_INVALID_ID */
2743 + if (!(*op == IP_SET_OP_UNBIND_SET
2744 + && req_adt->index == IP_SET_INVALID_ID)) {
2745 + index = ip_set_find_byindex(req_adt->index);
2746 + if (index == IP_SET_INVALID_ID) {
2747 + res = -ENOENT;
2748 + goto done;
2749 + }
2750 + }
2751 + res = adtfn(index, data, len);
2752 +
2753 + done:
2754 + up(&ip_set_app_mutex);
2755 + vfree(data);
2756 + if (res > 0)
2757 + res = 0;
2758 + DP("final result %d", res);
2759 + return res;
2760 +}
2761 +
2762 +static int
2763 +ip_set_sockfn_get(struct sock *sk, int optval, void *user, int *len)
2764 +{
2765 + int res = 0;
2766 + unsigned *op;
2767 + ip_set_id_t index = IP_SET_INVALID_ID;
2768 + void *data;
2769 + int copylen = *len;
2770 +
2771 + DP("optval=%d, user=%p, len=%d", optval, user, *len);
2772 + if (!capable(CAP_NET_ADMIN))
2773 + return -EPERM;
2774 + if (optval != SO_IP_SET)
2775 + return -EBADF;
2776 + if (*len < sizeof(unsigned)) {
2777 + ip_set_printk("short userdata (want >=%zu, got %d)",
2778 + sizeof(unsigned), *len);
2779 + return -EINVAL;
2780 + }
2781 + data = vmalloc(*len);
2782 + if (!data) {
2783 + DP("out of mem for %d bytes", *len);
2784 + return -ENOMEM;
2785 + }
2786 + if (copy_from_user(data, user, *len) != 0) {
2787 + res = -EFAULT;
2788 + goto done;
2789 + }
2790 + if (down_interruptible(&ip_set_app_mutex)) {
2791 + res = -EINTR;
2792 + goto done;
2793 + }
2794 +
2795 + op = (unsigned *) data;
2796 + DP("op=%x", *op);
2797 +
2798 + if (*op < IP_SET_OP_VERSION) {
2799 + /* Check the version at the beginning of operations */
2800 + struct ip_set_req_version *req_version =
2801 + (struct ip_set_req_version *) data;
2802 + if (req_version->version != IP_SET_PROTOCOL_VERSION) {
2803 + res = -EPROTO;
2804 + goto done;
2805 + }
2806 + }
2807 +
2808 + switch (*op) {
2809 + case IP_SET_OP_VERSION: {
2810 + struct ip_set_req_version *req_version =
2811 + (struct ip_set_req_version *) data;
2812 +
2813 + if (*len != sizeof(struct ip_set_req_version)) {
2814 + ip_set_printk("invalid VERSION (want %zu, got %d)",
2815 + sizeof(struct ip_set_req_version),
2816 + *len);
2817 + res = -EINVAL;
2818 + goto done;
2819 + }
2820 +
2821 + req_version->version = IP_SET_PROTOCOL_VERSION;
2822 + res = copy_to_user(user, req_version,
2823 + sizeof(struct ip_set_req_version));
2824 + goto done;
2825 + }
2826 + case IP_SET_OP_GET_BYNAME: {
2827 + struct ip_set_req_get_set *req_get
2828 + = (struct ip_set_req_get_set *) data;
2829 +
2830 + if (*len != sizeof(struct ip_set_req_get_set)) {
2831 + ip_set_printk("invalid GET_BYNAME (want %zu, got %d)",
2832 + sizeof(struct ip_set_req_get_set), *len);
2833 + res = -EINVAL;
2834 + goto done;
2835 + }
2836 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2837 + index = ip_set_find_byname(req_get->set.name);
2838 + req_get->set.index = index;
2839 + goto copy;
2840 + }
2841 + case IP_SET_OP_GET_BYINDEX: {
2842 + struct ip_set_req_get_set *req_get
2843 + = (struct ip_set_req_get_set *) data;
2844 +
2845 + if (*len != sizeof(struct ip_set_req_get_set)) {
2846 + ip_set_printk("invalid GET_BYINDEX (want %zu, got %d)",
2847 + sizeof(struct ip_set_req_get_set), *len);
2848 + res = -EINVAL;
2849 + goto done;
2850 + }
2851 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2852 + index = ip_set_find_byindex(req_get->set.index);
2853 + strncpy(req_get->set.name,
2854 + index == IP_SET_INVALID_ID ? ""
2855 + : ip_set_list[index]->name, IP_SET_MAXNAMELEN);
2856 + goto copy;
2857 + }
2858 + case IP_SET_OP_ADT_GET: {
2859 + struct ip_set_req_adt_get *req_get
2860 + = (struct ip_set_req_adt_get *) data;
2861 +
2862 + if (*len != sizeof(struct ip_set_req_adt_get)) {
2863 + ip_set_printk("invalid ADT_GET (want %zu, got %d)",
2864 + sizeof(struct ip_set_req_adt_get), *len);
2865 + res = -EINVAL;
2866 + goto done;
2867 + }
2868 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2869 + index = ip_set_find_byname(req_get->set.name);
2870 + if (index != IP_SET_INVALID_ID) {
2871 + req_get->set.index = index;
2872 + strncpy(req_get->typename,
2873 + ip_set_list[index]->type->typename,
2874 + IP_SET_MAXNAMELEN - 1);
2875 + } else {
2876 + res = -ENOENT;
2877 + goto done;
2878 + }
2879 + goto copy;
2880 + }
2881 + case IP_SET_OP_MAX_SETS: {
2882 + struct ip_set_req_max_sets *req_max_sets
2883 + = (struct ip_set_req_max_sets *) data;
2884 + ip_set_id_t i;
2885 +
2886 + if (*len != sizeof(struct ip_set_req_max_sets)) {
2887 + ip_set_printk("invalid MAX_SETS (want %zu, got %d)",
2888 + sizeof(struct ip_set_req_max_sets), *len);
2889 + res = -EINVAL;
2890 + goto done;
2891 + }
2892 +
2893 + if (strcmp(req_max_sets->set.name, IPSET_TOKEN_ALL) == 0) {
2894 + req_max_sets->set.index = IP_SET_INVALID_ID;
2895 + } else {
2896 + req_max_sets->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2897 + req_max_sets->set.index =
2898 + ip_set_find_byname(req_max_sets->set.name);
2899 + if (req_max_sets->set.index == IP_SET_INVALID_ID) {
2900 + res = -ENOENT;
2901 + goto done;
2902 + }
2903 + }
2904 + req_max_sets->max_sets = ip_set_max;
2905 + req_max_sets->sets = 0;
2906 + for (i = 0; i < ip_set_max; i++) {
2907 + if (ip_set_list[i] != NULL)
2908 + req_max_sets->sets++;
2909 + }
2910 + goto copy;
2911 + }
2912 + case IP_SET_OP_LIST_SIZE:
2913 + case IP_SET_OP_SAVE_SIZE: {
2914 + struct ip_set_req_setnames *req_setnames
2915 + = (struct ip_set_req_setnames *) data;
2916 + struct ip_set_name_list *name_list;
2917 + struct ip_set *set;
2918 + ip_set_id_t i;
2919 + int used;
2920 +
2921 + if (*len < sizeof(struct ip_set_req_setnames)) {
2922 + ip_set_printk("short LIST_SIZE (want >=%zu, got %d)",
2923 + sizeof(struct ip_set_req_setnames), *len);
2924 + res = -EINVAL;
2925 + goto done;
2926 + }
2927 +
2928 + req_setnames->size = 0;
2929 + used = sizeof(struct ip_set_req_setnames);
2930 + for (i = 0; i < ip_set_max; i++) {
2931 + if (ip_set_list[i] == NULL)
2932 + continue;
2933 + name_list = (struct ip_set_name_list *)
2934 + (data + used);
2935 + used += sizeof(struct ip_set_name_list);
2936 + if (used > copylen) {
2937 + res = -EAGAIN;
2938 + goto done;
2939 + }
2940 + set = ip_set_list[i];
2941 + /* Fill in index, name, etc. */
2942 + name_list->index = i;
2943 + name_list->id = set->id;
2944 + strncpy(name_list->name,
2945 + set->name,
2946 + IP_SET_MAXNAMELEN - 1);
2947 + strncpy(name_list->typename,
2948 + set->type->typename,
2949 + IP_SET_MAXNAMELEN - 1);
2950 + DP("filled %s of type %s, index %u\n",
2951 + name_list->name, name_list->typename,
2952 + name_list->index);
2953 + if (!(req_setnames->index == IP_SET_INVALID_ID
2954 + || req_setnames->index == i))
2955 + continue;
2956 + /* Update size */
2957 + switch (*op) {
2958 + case IP_SET_OP_LIST_SIZE: {
2959 + req_setnames->size += sizeof(struct ip_set_list)
2960 + + set->type->header_size
2961 + + set->type->list_members_size(set);
2962 + /* Sets are identified by id in the hash */
2963 + FOREACH_HASH_DO(__set_hash_bindings_size_list,
2964 + set->id, &req_setnames->size);
2965 + break;
2966 + }
2967 + case IP_SET_OP_SAVE_SIZE: {
2968 + req_setnames->size += sizeof(struct ip_set_save)
2969 + + set->type->header_size
2970 + + set->type->list_members_size(set);
2971 + FOREACH_HASH_DO(__set_hash_bindings_size_save,
2972 + set->id, &req_setnames->size);
2973 + break;
2974 + }
2975 + default:
2976 + break;
2977 + }
2978 + }
2979 + if (copylen != used) {
2980 + res = -EAGAIN;
2981 + goto done;
2982 + }
2983 + goto copy;
2984 + }
2985 + case IP_SET_OP_LIST: {
2986 + struct ip_set_req_list *req_list
2987 + = (struct ip_set_req_list *) data;
2988 + ip_set_id_t i;
2989 + int used;
2990 +
2991 + if (*len < sizeof(struct ip_set_req_list)) {
2992 + ip_set_printk("short LIST (want >=%zu, got %d)",
2993 + sizeof(struct ip_set_req_list), *len);
2994 + res = -EINVAL;
2995 + goto done;
2996 + }
2997 + index = req_list->index;
2998 + if (index != IP_SET_INVALID_ID
2999 + && ip_set_find_byindex(index) != index) {
3000 + res = -ENOENT;
3001 + goto done;
3002 + }
3003 + used = 0;
3004 + if (index == IP_SET_INVALID_ID) {
3005 + /* List all sets */
3006 + for (i = 0; i < ip_set_max && res == 0; i++) {
3007 + if (ip_set_list[i] != NULL)
3008 + res = ip_set_list_set(i, data, &used, *len);
3009 + }
3010 + } else {
3011 + /* List an individual set */
3012 + res = ip_set_list_set(index, data, &used, *len);
3013 + }
3014 + if (res != 0)
3015 + goto done;
3016 + else if (copylen != used) {
3017 + res = -EAGAIN;
3018 + goto done;
3019 + }
3020 + goto copy;
3021 + }
3022 + case IP_SET_OP_SAVE: {
3023 + struct ip_set_req_list *req_save
3024 + = (struct ip_set_req_list *) data;
3025 + ip_set_id_t i;
3026 + int used;
3027 +
3028 + if (*len < sizeof(struct ip_set_req_list)) {
3029 + ip_set_printk("short SAVE (want >=%zu, got %d)",
3030 + sizeof(struct ip_set_req_list), *len);
3031 + res = -EINVAL;
3032 + goto done;
3033 + }
3034 + index = req_save->index;
3035 + if (index != IP_SET_INVALID_ID
3036 + && ip_set_find_byindex(index) != index) {
3037 + res = -ENOENT;
3038 + goto done;
3039 + }
3040 + used = 0;
3041 + if (index == IP_SET_INVALID_ID) {
3042 + /* Save all sets */
3043 + for (i = 0; i < ip_set_max && res == 0; i++) {
3044 + if (ip_set_list[i] != NULL)
3045 + res = ip_set_save_set(i, data, &used, *len);
3046 + }
3047 + } else {
3048 + /* Save an individual set */
3049 + res = ip_set_save_set(index, data, &used, *len);
3050 + }
3051 + if (res == 0)
3052 + res = ip_set_save_bindings(index, data, &used, *len);
3053 +
3054 + if (res != 0)
3055 + goto done;
3056 + else if (copylen != used) {
3057 + res = -EAGAIN;
3058 + goto done;
3059 + }
3060 + goto copy;
3061 + }
3062 + case IP_SET_OP_RESTORE: {
3063 + struct ip_set_req_setnames *req_restore
3064 + = (struct ip_set_req_setnames *) data;
3065 + int line;
3066 +
3067 + if (*len < sizeof(struct ip_set_req_setnames)
3068 + || *len != req_restore->size) {
3069 + ip_set_printk("invalid RESTORE (want =%zu, got %d)",
3070 + req_restore->size, *len);
3071 + res = -EINVAL;
3072 + goto done;
3073 + }
3074 + line = ip_set_restore(data + sizeof(struct ip_set_req_setnames),
3075 + req_restore->size - sizeof(struct ip_set_req_setnames));
3076 + DP("ip_set_restore: %u", line);
3077 + if (line != 0) {
3078 + res = -EAGAIN;
3079 + req_restore->size = line;
3080 + copylen = sizeof(struct ip_set_req_setnames);
3081 + goto copy;
3082 + }
3083 + goto done;
3084 + }
3085 + default:
3086 + res = -EBADMSG;
3087 + goto done;
3088 + } /* end of switch(op) */
3089 +
3090 + copy:
3091 + DP("set %s, copylen %u", index != IP_SET_INVALID_ID
3092 + && ip_set_list[index]
3093 + ? ip_set_list[index]->name
3094 + : ":all:", copylen);
3095 + res = copy_to_user(user, data, copylen);
3096 +
3097 + done:
3098 + up(&ip_set_app_mutex);
3099 + vfree(data);
3100 + if (res > 0)
3101 + res = 0;
3102 + DP("final result %d", res);
3103 + return res;
3104 +}
3105 +
3106 +static struct nf_sockopt_ops so_set = {
3107 + .pf = PF_INET,
3108 + .set_optmin = SO_IP_SET,
3109 + .set_optmax = SO_IP_SET + 1,
3110 + .set = &ip_set_sockfn_set,
3111 + .get_optmin = SO_IP_SET,
3112 + .get_optmax = SO_IP_SET + 1,
3113 + .get = &ip_set_sockfn_get,
3114 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
3115 + .owner = THIS_MODULE,
3116 +#endif
3117 +};
3118 +
3119 +static int max_sets, hash_size;
3120 +module_param(max_sets, int, 0600);
3121 +MODULE_PARM_DESC(max_sets, "maximal number of sets");
3122 +module_param(hash_size, int, 0600);
3123 +MODULE_PARM_DESC(hash_size, "hash size for bindings");
3124 +MODULE_LICENSE("GPL");
3125 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
3126 +MODULE_DESCRIPTION("module implementing core IP set support");
3127 +
3128 +static int __init ip_set_init(void)
3129 +{
3130 + int res;
3131 + ip_set_id_t i;
3132 +
3133 + get_random_bytes(&ip_set_hash_random, 4);
3134 + if (max_sets)
3135 + ip_set_max = max_sets;
3136 + ip_set_list = vmalloc(sizeof(struct ip_set *) * ip_set_max);
3137 + if (!ip_set_list) {
3138 + printk(KERN_ERR "Unable to create ip_set_list\n");
3139 + return -ENOMEM;
3140 + }
3141 + memset(ip_set_list, 0, sizeof(struct ip_set *) * ip_set_max);
3142 + if (hash_size)
3143 + ip_set_bindings_hash_size = hash_size;
3144 + ip_set_hash = vmalloc(sizeof(struct list_head) * ip_set_bindings_hash_size);
3145 + if (!ip_set_hash) {
3146 + printk(KERN_ERR "Unable to create ip_set_hash\n");
3147 + vfree(ip_set_list);
3148 + return -ENOMEM;
3149 + }
3150 + for (i = 0; i < ip_set_bindings_hash_size; i++)
3151 + INIT_LIST_HEAD(&ip_set_hash[i]);
3152 +
3153 + INIT_LIST_HEAD(&set_type_list);
3154 +
3155 + res = nf_register_sockopt(&so_set);
3156 + if (res != 0) {
3157 + ip_set_printk("SO_SET registry failed: %d", res);
3158 + vfree(ip_set_list);
3159 + vfree(ip_set_hash);
3160 + return res;
3161 + }
3162 + return 0;
3163 +}
3164 +
3165 +static void __exit ip_set_fini(void)
3166 +{
3167 + /* There can't be any existing set or binding */
3168 + nf_unregister_sockopt(&so_set);
3169 + vfree(ip_set_list);
3170 + vfree(ip_set_hash);
3171 + DP("these are the famous last words");
3172 +}
3173 +
3174 +EXPORT_SYMBOL(ip_set_register_set_type);
3175 +EXPORT_SYMBOL(ip_set_unregister_set_type);
3176 +
3177 +EXPORT_SYMBOL(ip_set_get_byname);
3178 +EXPORT_SYMBOL(ip_set_get_byindex);
3179 +EXPORT_SYMBOL(ip_set_put);
3180 +
3181 +EXPORT_SYMBOL(ip_set_addip_kernel);
3182 +EXPORT_SYMBOL(ip_set_delip_kernel);
3183 +EXPORT_SYMBOL(ip_set_testip_kernel);
3184 +
3185 +module_init(ip_set_init);
3186 +module_exit(ip_set_fini);
3187 Index: linux-2.6.21.7/net/ipv4/netfilter/ip_set_iphash.c
3188 ===================================================================
3189 --- /dev/null
3190 +++ linux-2.6.21.7/net/ipv4/netfilter/ip_set_iphash.c
3191 @@ -0,0 +1,429 @@
3192 +/* Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
3193 + *
3194 + * This program is free software; you can redistribute it and/or modify
3195 + * it under the terms of the GNU General Public License version 2 as
3196 + * published by the Free Software Foundation.
3197 + */
3198 +
3199 +/* Kernel module implementing an ip hash set */
3200 +
3201 +#include <linux/module.h>
3202 +#include <linux/ip.h>
3203 +#include <linux/skbuff.h>
3204 +#include <linux/version.h>
3205 +#include <linux/jhash.h>
3206 +#include <linux/netfilter_ipv4/ip_tables.h>
3207 +#include <linux/netfilter_ipv4/ip_set.h>
3208 +#include <linux/errno.h>
3209 +#include <asm/uaccess.h>
3210 +#include <asm/bitops.h>
3211 +#include <linux/spinlock.h>
3212 +#include <linux/vmalloc.h>
3213 +#include <linux/random.h>
3214 +
3215 +#include <net/ip.h>
3216 +
3217 +#include <linux/netfilter_ipv4/ip_set_malloc.h>
3218 +#include <linux/netfilter_ipv4/ip_set_iphash.h>
3219 +
3220 +static int limit = MAX_RANGE;
3221 +
3222 +static inline __u32
3223 +jhash_ip(const struct ip_set_iphash *map, uint16_t i, ip_set_ip_t ip)
3224 +{
3225 + return jhash_1word(ip, *(((uint32_t *) map->initval) + i));
3226 +}
3227 +
3228 +static inline __u32
3229 +hash_id(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3230 +{
3231 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3232 + __u32 id;
3233 + u_int16_t i;
3234 + ip_set_ip_t *elem;
3235 +
3236 + *hash_ip = ip & map->netmask;
3237 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u, %u.%u.%u.%u",
3238 + set->name, HIPQUAD(ip), HIPQUAD(*hash_ip), HIPQUAD(map->netmask));
3239 +
3240 + for (i = 0; i < map->probes; i++) {
3241 + id = jhash_ip(map, i, *hash_ip) % map->hashsize;
3242 + DP("hash key: %u", id);
3243 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
3244 + if (*elem == *hash_ip)
3245 + return id;
3246 + /* No shortcut at testing - there can be deleted
3247 + * entries. */
3248 + }
3249 + return UINT_MAX;
3250 +}
3251 +
3252 +static inline int
3253 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3254 +{
3255 + return (ip && hash_id(set, ip, hash_ip) != UINT_MAX);
3256 +}
3257 +
3258 +static int
3259 +testip(struct ip_set *set, const void *data, size_t size,
3260 + ip_set_ip_t *hash_ip)
3261 +{
3262 + struct ip_set_req_iphash *req =
3263 + (struct ip_set_req_iphash *) data;
3264 +
3265 + if (size != sizeof(struct ip_set_req_iphash)) {
3266 + ip_set_printk("data length wrong (want %zu, have %zu)",
3267 + sizeof(struct ip_set_req_iphash),
3268 + size);
3269 + return -EINVAL;
3270 + }
3271 + return __testip(set, req->ip, hash_ip);
3272 +}
3273 +
3274 +static int
3275 +testip_kernel(struct ip_set *set,
3276 + const struct sk_buff *skb,
3277 + ip_set_ip_t *hash_ip,
3278 + const u_int32_t *flags,
3279 + unsigned char index)
3280 +{
3281 + return __testip(set,
3282 + ntohl(flags[index] & IPSET_SRC
3283 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
3284 + ? ip_hdr(skb)->saddr
3285 + : ip_hdr(skb)->daddr),
3286 +#else
3287 + ? skb->nh.iph->saddr
3288 + : skb->nh.iph->daddr),
3289 +#endif
3290 + hash_ip);
3291 +}
3292 +
3293 +static inline int
3294 +__addip(struct ip_set_iphash *map, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3295 +{
3296 + __u32 probe;
3297 + u_int16_t i;
3298 + ip_set_ip_t *elem;
3299 +
3300 + if (!ip || map->elements >= limit)
3301 + return -ERANGE;
3302 +
3303 + *hash_ip = ip & map->netmask;
3304 +
3305 + for (i = 0; i < map->probes; i++) {
3306 + probe = jhash_ip(map, i, *hash_ip) % map->hashsize;
3307 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, probe);
3308 + if (*elem == *hash_ip)
3309 + return -EEXIST;
3310 + if (!*elem) {
3311 + *elem = *hash_ip;
3312 + map->elements++;
3313 + return 0;
3314 + }
3315 + }
3316 + /* Trigger rehashing */
3317 + return -EAGAIN;
3318 +}
3319 +
3320 +static int
3321 +addip(struct ip_set *set, const void *data, size_t size,
3322 + ip_set_ip_t *hash_ip)
3323 +{
3324 + struct ip_set_req_iphash *req =
3325 + (struct ip_set_req_iphash *) data;
3326 +
3327 + if (size != sizeof(struct ip_set_req_iphash)) {
3328 + ip_set_printk("data length wrong (want %zu, have %zu)",
3329 + sizeof(struct ip_set_req_iphash),
3330 + size);
3331 + return -EINVAL;
3332 + }
3333 + return __addip((struct ip_set_iphash *) set->data, req->ip, hash_ip);
3334 +}
3335 +
3336 +static int
3337 +addip_kernel(struct ip_set *set,
3338 + const struct sk_buff *skb,
3339 + ip_set_ip_t *hash_ip,
3340 + const u_int32_t *flags,
3341 + unsigned char index)
3342 +{
3343 + return __addip((struct ip_set_iphash *) set->data,
3344 + ntohl(flags[index] & IPSET_SRC
3345 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
3346 + ? ip_hdr(skb)->saddr
3347 + : ip_hdr(skb)->daddr),
3348 +#else
3349 + ? skb->nh.iph->saddr
3350 + : skb->nh.iph->daddr),
3351 +#endif
3352 + hash_ip);
3353 +}
3354 +
3355 +static int retry(struct ip_set *set)
3356 +{
3357 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3358 + ip_set_ip_t hash_ip, *elem;
3359 + void *members;
3360 + u_int32_t i, hashsize = map->hashsize;
3361 + int res;
3362 + struct ip_set_iphash *tmp;
3363 +
3364 + if (map->resize == 0)
3365 + return -ERANGE;
3366 +
3367 + again:
3368 + res = 0;
3369 +
3370 + /* Calculate new hash size */
3371 + hashsize += (hashsize * map->resize)/100;
3372 + if (hashsize == map->hashsize)
3373 + hashsize++;
3374 +
3375 + ip_set_printk("rehashing of set %s triggered: "
3376 + "hashsize grows from %u to %u",
3377 + set->name, map->hashsize, hashsize);
3378 +
3379 + tmp = kmalloc(sizeof(struct ip_set_iphash)
3380 + + map->probes * sizeof(uint32_t), GFP_ATOMIC);
3381 + if (!tmp) {
3382 + DP("out of memory for %d bytes",
3383 + sizeof(struct ip_set_iphash)
3384 + + map->probes * sizeof(uint32_t));
3385 + return -ENOMEM;
3386 + }
3387 + tmp->members = harray_malloc(hashsize, sizeof(ip_set_ip_t), GFP_ATOMIC);
3388 + if (!tmp->members) {
3389 + DP("out of memory for %d bytes", hashsize * sizeof(ip_set_ip_t));
3390 + kfree(tmp);
3391 + return -ENOMEM;
3392 + }
3393 + tmp->hashsize = hashsize;
3394 + tmp->elements = 0;
3395 + tmp->probes = map->probes;
3396 + tmp->resize = map->resize;
3397 + tmp->netmask = map->netmask;
3398 + memcpy(tmp->initval, map->initval, map->probes * sizeof(uint32_t));
3399 +
3400 + write_lock_bh(&set->lock);
3401 + map = (struct ip_set_iphash *) set->data; /* Play safe */
3402 + for (i = 0; i < map->hashsize && res == 0; i++) {
3403 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, i);
3404 + if (*elem)
3405 + res = __addip(tmp, *elem, &hash_ip);
3406 + }
3407 + if (res) {
3408 + /* Failure, try again */
3409 + write_unlock_bh(&set->lock);
3410 + harray_free(tmp->members);
3411 + kfree(tmp);
3412 + goto again;
3413 + }