projects / openwrt / svn-archive / archive.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
fix ipset compile with 2.6.22-rc4
[openwrt/svn-archive/archive.git] / target / linux / generic-2.6 / patches-2.6.22 / 130-netfilter-ipset.patch
1 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set.h
2 ===================================================================
3 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
4 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set.h 2007-06-17 01:56:58.435888424 +0200
5 @@ -0,0 +1,498 @@
6 +#ifndef _IP_SET_H
7 +#define _IP_SET_H
8 +
9 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
10 + * Patrick Schaaf <bof@bof.de>
11 + * Martin Josefsson <gandalf@wlug.westbo.se>
12 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 + *
14 + * This program is free software; you can redistribute it and/or modify
15 + * it under the terms of the GNU General Public License version 2 as
16 + * published by the Free Software Foundation.
17 + */
18 +
19 +#if 0
20 +#define IP_SET_DEBUG
21 +#endif
22 +
23 +/*
24 + * A sockopt of such quality has hardly ever been seen before on the open
25 + * market! This little beauty, hardly ever used: above 64, so it's
26 + * traditionally used for firewalling, not touched (even once!) by the
27 + * 2.0, 2.2 and 2.4 kernels!
28 + *
29 + * Comes with its own certificate of authenticity, valid anywhere in the
30 + * Free world!
31 + *
32 + * Rusty, 19.4.2000
33 + */
34 +#define SO_IP_SET 83
35 +
36 +/*
37 + * Heavily modify by Joakim Axelsson 08.03.2002
38 + * - Made it more modulebased
39 + *
40 + * Additional heavy modifications by Jozsef Kadlecsik 22.02.2004
41 + * - bindings added
42 + * - in order to "deal with" backward compatibility, renamed to ipset
43 + */
44 +
45 +/*
46 + * Used so that the kernel module and ipset-binary can match their versions
47 + */
48 +#define IP_SET_PROTOCOL_VERSION 2
49 +
50 +#define IP_SET_MAXNAMELEN 32 /* set names and set typenames */
51 +
52 +/* Lets work with our own typedef for representing an IP address.
53 + * We hope to make the code more portable, possibly to IPv6...
54 + *
55 + * The representation works in HOST byte order, because most set types
56 + * will perform arithmetic operations and compare operations.
57 + *
58 + * For now the type is an uint32_t.
59 + *
60 + * Make sure to ONLY use the functions when translating and parsing
61 + * in order to keep the host byte order and make it more portable:
62 + * parse_ip()
63 + * parse_mask()
64 + * parse_ipandmask()
65 + * ip_tostring()
66 + * (Joakim: where are they???)
67 + */
68 +
69 +typedef uint32_t ip_set_ip_t;
70 +
71 +/* Sets are identified by an id in kernel space. Tweak with ip_set_id_t
72 + * and IP_SET_INVALID_ID if you want to increase the max number of sets.
73 + */
74 +typedef uint16_t ip_set_id_t;
75 +
76 +#define IP_SET_INVALID_ID 65535
77 +
78 +/* How deep we follow bindings */
79 +#define IP_SET_MAX_BINDINGS 6
80 +
81 +/*
82 + * Option flags for kernel operations (ipt_set_info)
83 + */
84 +#define IPSET_SRC 0x01 /* Source match/add */
85 +#define IPSET_DST 0x02 /* Destination match/add */
86 +#define IPSET_MATCH_INV 0x04 /* Inverse matching */
87 +
88 +/*
89 + * Set features
90 + */
91 +#define IPSET_TYPE_IP 0x01 /* IP address type of set */
92 +#define IPSET_TYPE_PORT 0x02 /* Port type of set */
93 +#define IPSET_DATA_SINGLE 0x04 /* Single data storage */
94 +#define IPSET_DATA_DOUBLE 0x08 /* Double data storage */
95 +
96 +/* Reserved keywords */
97 +#define IPSET_TOKEN_DEFAULT ":default:"
98 +#define IPSET_TOKEN_ALL ":all:"
99 +
100 +/* SO_IP_SET operation constants, and their request struct types.
101 + *
102 + * Operation ids:
103 + * 0-99: commands with version checking
104 + * 100-199: add/del/test/bind/unbind
105 + * 200-299: list, save, restore
106 + */
107 +
108 +/* Single shot operations:
109 + * version, create, destroy, flush, rename and swap
110 + *
111 + * Sets are identified by name.
112 + */
113 +
114 +#define IP_SET_REQ_STD \
115 + unsigned op; \
116 + unsigned version; \
117 + char name[IP_SET_MAXNAMELEN]
118 +
119 +#define IP_SET_OP_CREATE 0x00000001 /* Create a new (empty) set */
120 +struct ip_set_req_create {
121 + IP_SET_REQ_STD;
122 + char typename[IP_SET_MAXNAMELEN];
123 +};
124 +
125 +#define IP_SET_OP_DESTROY 0x00000002 /* Remove a (empty) set */
126 +struct ip_set_req_std {
127 + IP_SET_REQ_STD;
128 +};
129 +
130 +#define IP_SET_OP_FLUSH 0x00000003 /* Remove all IPs in a set */
131 +/* Uses ip_set_req_std */
132 +
133 +#define IP_SET_OP_RENAME 0x00000004 /* Rename a set */
134 +/* Uses ip_set_req_create */
135 +
136 +#define IP_SET_OP_SWAP 0x00000005 /* Swap two sets */
137 +/* Uses ip_set_req_create */
138 +
139 +union ip_set_name_index {
140 + char name[IP_SET_MAXNAMELEN];
141 + ip_set_id_t index;
142 +};
143 +
144 +#define IP_SET_OP_GET_BYNAME 0x00000006 /* Get set index by name */
145 +struct ip_set_req_get_set {
146 + unsigned op;
147 + unsigned version;
148 + union ip_set_name_index set;
149 +};
150 +
151 +#define IP_SET_OP_GET_BYINDEX 0x00000007 /* Get set name by index */
152 +/* Uses ip_set_req_get_set */
153 +
154 +#define IP_SET_OP_VERSION 0x00000100 /* Ask kernel version */
155 +struct ip_set_req_version {
156 + unsigned op;
157 + unsigned version;
158 +};
159 +
160 +/* Double shots operations:
161 + * add, del, test, bind and unbind.
162 + *
163 + * First we query the kernel to get the index and type of the target set,
164 + * then issue the command. Validity of IP is checked in kernel in order
165 + * to minimalize sockopt operations.
166 + */
167 +
168 +/* Get minimal set data for add/del/test/bind/unbind IP */
169 +#define IP_SET_OP_ADT_GET 0x00000010 /* Get set and type */
170 +struct ip_set_req_adt_get {
171 + unsigned op;
172 + unsigned version;
173 + union ip_set_name_index set;
174 + char typename[IP_SET_MAXNAMELEN];
175 +};
176 +
177 +#define IP_SET_REQ_BYINDEX \
178 + unsigned op; \
179 + ip_set_id_t index;
180 +
181 +struct ip_set_req_adt {
182 + IP_SET_REQ_BYINDEX;
183 +};
184 +
185 +#define IP_SET_OP_ADD_IP 0x00000101 /* Add an IP to a set */
186 +/* Uses ip_set_req_adt, with type specific addage */
187 +
188 +#define IP_SET_OP_DEL_IP 0x00000102 /* Remove an IP from a set */
189 +/* Uses ip_set_req_adt, with type specific addage */
190 +
191 +#define IP_SET_OP_TEST_IP 0x00000103 /* Test an IP in a set */
192 +/* Uses ip_set_req_adt, with type specific addage */
193 +
194 +#define IP_SET_OP_BIND_SET 0x00000104 /* Bind an IP to a set */
195 +/* Uses ip_set_req_bind, with type specific addage */
196 +struct ip_set_req_bind {
197 + IP_SET_REQ_BYINDEX;
198 + char binding[IP_SET_MAXNAMELEN];
199 +};
200 +
201 +#define IP_SET_OP_UNBIND_SET 0x00000105 /* Unbind an IP from a set */
202 +/* Uses ip_set_req_bind, with type speficic addage
203 + * index = 0 means unbinding for all sets */
204 +
205 +#define IP_SET_OP_TEST_BIND_SET 0x00000106 /* Test binding an IP to a set */
206 +/* Uses ip_set_req_bind, with type specific addage */
207 +
208 +/* Multiple shots operations: list, save, restore.
209 + *
210 + * - check kernel version and query the max number of sets
211 + * - get the basic information on all sets
212 + * and size required for the next step
213 + * - get actual set data: header, data, bindings
214 + */
215 +
216 +/* Get max_sets and the index of a queried set
217 + */
218 +#define IP_SET_OP_MAX_SETS 0x00000020
219 +struct ip_set_req_max_sets {
220 + unsigned op;
221 + unsigned version;
222 + ip_set_id_t max_sets; /* max_sets */
223 + ip_set_id_t sets; /* real number of sets */
224 + union ip_set_name_index set; /* index of set if name used */
225 +};
226 +
227 +/* Get the id and name of the sets plus size for next step */
228 +#define IP_SET_OP_LIST_SIZE 0x00000201
229 +#define IP_SET_OP_SAVE_SIZE 0x00000202
230 +struct ip_set_req_setnames {
231 + unsigned op;
232 + ip_set_id_t index; /* set to list/save */
233 + size_t size; /* size to get setdata/bindings */
234 + /* followed by sets number of struct ip_set_name_list */
235 +};
236 +
237 +struct ip_set_name_list {
238 + char name[IP_SET_MAXNAMELEN];
239 + char typename[IP_SET_MAXNAMELEN];
240 + ip_set_id_t index;
241 + ip_set_id_t id;
242 +};
243 +
244 +/* The actual list operation */
245 +#define IP_SET_OP_LIST 0x00000203
246 +struct ip_set_req_list {
247 + IP_SET_REQ_BYINDEX;
248 + /* sets number of struct ip_set_list in reply */
249 +};
250 +
251 +struct ip_set_list {
252 + ip_set_id_t index;
253 + ip_set_id_t binding;
254 + u_int32_t ref;
255 + size_t header_size; /* Set header data of header_size */
256 + size_t members_size; /* Set members data of members_size */
257 + size_t bindings_size; /* Set bindings data of bindings_size */
258 +};
259 +
260 +struct ip_set_hash_list {
261 + ip_set_ip_t ip;
262 + ip_set_id_t binding;
263 +};
264 +
265 +/* The save operation */
266 +#define IP_SET_OP_SAVE 0x00000204
267 +/* Uses ip_set_req_list, in the reply replaced by
268 + * sets number of struct ip_set_save plus a marker
269 + * ip_set_save followed by ip_set_hash_save structures.
270 + */
271 +struct ip_set_save {
272 + ip_set_id_t index;
273 + ip_set_id_t binding;
274 + size_t header_size; /* Set header data of header_size */
275 + size_t members_size; /* Set members data of members_size */
276 +};
277 +
278 +/* At restoring, ip == 0 means default binding for the given set: */
279 +struct ip_set_hash_save {
280 + ip_set_ip_t ip;
281 + ip_set_id_t id;
282 + ip_set_id_t binding;
283 +};
284 +
285 +/* The restore operation */
286 +#define IP_SET_OP_RESTORE 0x00000205
287 +/* Uses ip_set_req_setnames followed by ip_set_restore structures
288 + * plus a marker ip_set_restore, followed by ip_set_hash_save
289 + * structures.
290 + */
291 +struct ip_set_restore {
292 + char name[IP_SET_MAXNAMELEN];
293 + char typename[IP_SET_MAXNAMELEN];
294 + ip_set_id_t index;
295 + size_t header_size; /* Create data of header_size */
296 + size_t members_size; /* Set members data of members_size */
297 +};
298 +
299 +static inline int bitmap_bytes(ip_set_ip_t a, ip_set_ip_t b)
300 +{
301 + return 4 * ((((b - a + 8) / 8) + 3) / 4);
302 +}
303 +
304 +#ifdef __KERNEL__
305 +
306 +#define ip_set_printk(format, args...) \
307 + do { \
308 + printk("%s: %s: ", __FILE__, __FUNCTION__); \
309 + printk(format "\n" , ## args); \
310 + } while (0)
311 +
312 +#if defined(IP_SET_DEBUG)
313 +#define DP(format, args...) \
314 + do { \
315 + printk("%s: %s (DBG): ", __FILE__, __FUNCTION__);\
316 + printk(format "\n" , ## args); \
317 + } while (0)
318 +#define IP_SET_ASSERT(x) \
319 + do { \
320 + if (!(x)) \
321 + printk("IP_SET_ASSERT: %s:%i(%s)\n", \
322 + __FILE__, __LINE__, __FUNCTION__); \
323 + } while (0)
324 +#else
325 +#define DP(format, args...)
326 +#define IP_SET_ASSERT(x)
327 +#endif
328 +
329 +struct ip_set;
330 +
331 +/*
332 + * The ip_set_type definition - one per set type, e.g. "ipmap".
333 + *
334 + * Each individual set has a pointer, set->type, going to one
335 + * of these structures. Function pointers inside the structure implement
336 + * the real behaviour of the sets.
337 + *
338 + * If not mentioned differently, the implementation behind the function
339 + * pointers of a set_type, is expected to return 0 if ok, and a negative
340 + * errno (e.g. -EINVAL) on error.
341 + */
342 +struct ip_set_type {
343 + struct list_head list; /* next in list of set types */
344 +
345 + /* test for IP in set (kernel: iptables -m set src|dst)
346 + * return 0 if not in set, 1 if in set.
347 + */
348 + int (*testip_kernel) (struct ip_set *set,
349 + const struct sk_buff * skb,
350 + ip_set_ip_t *ip,
351 + const u_int32_t *flags,
352 + unsigned char index);
353 +
354 + /* test for IP in set (userspace: ipset -T set IP)
355 + * return 0 if not in set, 1 if in set.
356 + */
357 + int (*testip) (struct ip_set *set,
358 + const void *data, size_t size,
359 + ip_set_ip_t *ip);
360 +
361 + /*
362 + * Size of the data structure passed by when
363 + * adding/deletin/testing an entry.
364 + */
365 + size_t reqsize;
366 +
367 + /* Add IP into set (userspace: ipset -A set IP)
368 + * Return -EEXIST if the address is already in the set,
369 + * and -ERANGE if the address lies outside the set bounds.
370 + * If the address was not already in the set, 0 is returned.
371 + */
372 + int (*addip) (struct ip_set *set,
373 + const void *data, size_t size,
374 + ip_set_ip_t *ip);
375 +
376 + /* Add IP into set (kernel: iptables ... -j SET set src|dst)
377 + * Return -EEXIST if the address is already in the set,
378 + * and -ERANGE if the address lies outside the set bounds.
379 + * If the address was not already in the set, 0 is returned.
380 + */
381 + int (*addip_kernel) (struct ip_set *set,
382 + const struct sk_buff * skb,
383 + ip_set_ip_t *ip,
384 + const u_int32_t *flags,
385 + unsigned char index);
386 +
387 + /* remove IP from set (userspace: ipset -D set --entry x)
388 + * Return -EEXIST if the address is NOT in the set,
389 + * and -ERANGE if the address lies outside the set bounds.
390 + * If the address really was in the set, 0 is returned.
391 + */
392 + int (*delip) (struct ip_set *set,
393 + const void *data, size_t size,
394 + ip_set_ip_t *ip);
395 +
396 + /* remove IP from set (kernel: iptables ... -j SET --entry x)
397 + * Return -EEXIST if the address is NOT in the set,
398 + * and -ERANGE if the address lies outside the set bounds.
399 + * If the address really was in the set, 0 is returned.
400 + */
401 + int (*delip_kernel) (struct ip_set *set,
402 + const struct sk_buff * skb,
403 + ip_set_ip_t *ip,
404 + const u_int32_t *flags,
405 + unsigned char index);
406 +
407 + /* new set creation - allocated type specific items
408 + */
409 + int (*create) (struct ip_set *set,
410 + const void *data, size_t size);
411 +
412 + /* retry the operation after successfully tweaking the set
413 + */
414 + int (*retry) (struct ip_set *set);
415 +
416 + /* set destruction - free type specific items
417 + * There is no return value.
418 + * Can be called only when child sets are destroyed.
419 + */
420 + void (*destroy) (struct ip_set *set);
421 +
422 + /* set flushing - reset all bits in the set, or something similar.
423 + * There is no return value.
424 + */
425 + void (*flush) (struct ip_set *set);
426 +
427 + /* Listing: size needed for header
428 + */
429 + size_t header_size;
430 +
431 + /* Listing: Get the header
432 + *
433 + * Fill in the information in "data".
434 + * This function is always run after list_header_size() under a
435 + * writelock on the set. Therefor is the length of "data" always
436 + * correct.
437 + */
438 + void (*list_header) (const struct ip_set *set,
439 + void *data);
440 +
441 + /* Listing: Get the size for the set members
442 + */
443 + int (*list_members_size) (const struct ip_set *set);
444 +
445 + /* Listing: Get the set members
446 + *
447 + * Fill in the information in "data".
448 + * This function is always run after list_member_size() under a
449 + * writelock on the set. Therefor is the length of "data" always
450 + * correct.
451 + */
452 + void (*list_members) (const struct ip_set *set,
453 + void *data);
454 +
455 + char typename[IP_SET_MAXNAMELEN];
456 + unsigned char features;
457 + int protocol_version;
458 +
459 + /* Set this to THIS_MODULE if you are a module, otherwise NULL */
460 + struct module *me;
461 +};
462 +
463 +extern int ip_set_register_set_type(struct ip_set_type *set_type);
464 +extern void ip_set_unregister_set_type(struct ip_set_type *set_type);
465 +
466 +/* A generic ipset */
467 +struct ip_set {
468 + char name[IP_SET_MAXNAMELEN]; /* the name of the set */
469 + rwlock_t lock; /* lock for concurrency control */
470 + ip_set_id_t id; /* set id for swapping */
471 + ip_set_id_t binding; /* default binding for the set */
472 + atomic_t ref; /* in kernel and in hash references */
473 + struct ip_set_type *type; /* the set types */
474 + void *data; /* pooltype specific data */
475 +};
476 +
477 +/* Structure to bind set elements to sets */
478 +struct ip_set_hash {
479 + struct list_head list; /* list of clashing entries in hash */
480 + ip_set_ip_t ip; /* ip from set */
481 + ip_set_id_t id; /* set id */
482 + ip_set_id_t binding; /* set we bind the element to */
483 +};
484 +
485 +/* register and unregister set references */
486 +extern ip_set_id_t ip_set_get_byname(const char name[IP_SET_MAXNAMELEN]);
487 +extern ip_set_id_t ip_set_get_byindex(ip_set_id_t id);
488 +extern void ip_set_put(ip_set_id_t id);
489 +
490 +/* API for iptables set match, and SET target */
491 +extern void ip_set_addip_kernel(ip_set_id_t id,
492 + const struct sk_buff *skb,
493 + const u_int32_t *flags);
494 +extern void ip_set_delip_kernel(ip_set_id_t id,
495 + const struct sk_buff *skb,
496 + const u_int32_t *flags);
497 +extern int ip_set_testip_kernel(ip_set_id_t id,
498 + const struct sk_buff *skb,
499 + const u_int32_t *flags);
500 +
501 +#endif /* __KERNEL__ */
502 +
503 +#endif /*_IP_SET_H*/
504 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_iphash.h
505 ===================================================================
506 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
507 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_iphash.h 2007-06-17 01:56:58.435888424 +0200
508 @@ -0,0 +1,30 @@
509 +#ifndef __IP_SET_IPHASH_H
510 +#define __IP_SET_IPHASH_H
511 +
512 +#include <linux/netfilter_ipv4/ip_set.h>
513 +
514 +#define SETTYPE_NAME "iphash"
515 +#define MAX_RANGE 0x0000FFFF
516 +
517 +struct ip_set_iphash {
518 + ip_set_ip_t *members; /* the iphash proper */
519 + uint32_t elements; /* number of elements */
520 + uint32_t hashsize; /* hash size */
521 + uint16_t probes; /* max number of probes */
522 + uint16_t resize; /* resize factor in percent */
523 + ip_set_ip_t netmask; /* netmask */
524 + void *initval[0]; /* initvals for jhash_1word */
525 +};
526 +
527 +struct ip_set_req_iphash_create {
528 + uint32_t hashsize;
529 + uint16_t probes;
530 + uint16_t resize;
531 + ip_set_ip_t netmask;
532 +};
533 +
534 +struct ip_set_req_iphash {
535 + ip_set_ip_t ip;
536 +};
537 +
538 +#endif /* __IP_SET_IPHASH_H */
539 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_ipmap.h
540 ===================================================================
541 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
542 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_ipmap.h 2007-06-17 01:56:58.436888272 +0200
543 @@ -0,0 +1,56 @@
544 +#ifndef __IP_SET_IPMAP_H
545 +#define __IP_SET_IPMAP_H
546 +
547 +#include <linux/netfilter_ipv4/ip_set.h>
548 +
549 +#define SETTYPE_NAME "ipmap"
550 +#define MAX_RANGE 0x0000FFFF
551 +
552 +struct ip_set_ipmap {
553 + void *members; /* the ipmap proper */
554 + ip_set_ip_t first_ip; /* host byte order, included in range */
555 + ip_set_ip_t last_ip; /* host byte order, included in range */
556 + ip_set_ip_t netmask; /* subnet netmask */
557 + ip_set_ip_t sizeid; /* size of set in IPs */
558 + ip_set_ip_t hosts; /* number of hosts in a subnet */
559 +};
560 +
561 +struct ip_set_req_ipmap_create {
562 + ip_set_ip_t from;
563 + ip_set_ip_t to;
564 + ip_set_ip_t netmask;
565 +};
566 +
567 +struct ip_set_req_ipmap {
568 + ip_set_ip_t ip;
569 +};
570 +
571 +unsigned int
572 +mask_to_bits(ip_set_ip_t mask)
573 +{
574 + unsigned int bits = 32;
575 + ip_set_ip_t maskaddr;
576 +
577 + if (mask == 0xFFFFFFFF)
578 + return bits;
579 +
580 + maskaddr = 0xFFFFFFFE;
581 + while (--bits >= 0 && maskaddr != mask)
582 + maskaddr <<= 1;
583 +
584 + return bits;
585 +}
586 +
587 +ip_set_ip_t
588 +range_to_mask(ip_set_ip_t from, ip_set_ip_t to, unsigned int *bits)
589 +{
590 + ip_set_ip_t mask = 0xFFFFFFFE;
591 +
592 + *bits = 32;
593 + while (--(*bits) >= 0 && mask && (to & mask) != from)
594 + mask <<= 1;
595 +
596 + return mask;
597 +}
598 +
599 +#endif /* __IP_SET_IPMAP_H */
600 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_ipporthash.h
601 ===================================================================
602 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
603 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_ipporthash.h 2007-06-17 01:56:58.436888272 +0200
604 @@ -0,0 +1,34 @@
605 +#ifndef __IP_SET_IPPORTHASH_H
606 +#define __IP_SET_IPPORTHASH_H
607 +
608 +#include <linux/netfilter_ipv4/ip_set.h>
609 +
610 +#define SETTYPE_NAME "ipporthash"
611 +#define MAX_RANGE 0x0000FFFF
612 +#define INVALID_PORT (MAX_RANGE + 1)
613 +
614 +struct ip_set_ipporthash {
615 + ip_set_ip_t *members; /* the ipporthash proper */
616 + uint32_t elements; /* number of elements */
617 + uint32_t hashsize; /* hash size */
618 + uint16_t probes; /* max number of probes */
619 + uint16_t resize; /* resize factor in percent */
620 + ip_set_ip_t first_ip; /* host byte order, included in range */
621 + ip_set_ip_t last_ip; /* host byte order, included in range */
622 + void *initval[0]; /* initvals for jhash_1word */
623 +};
624 +
625 +struct ip_set_req_ipporthash_create {
626 + uint32_t hashsize;
627 + uint16_t probes;
628 + uint16_t resize;
629 + ip_set_ip_t from;
630 + ip_set_ip_t to;
631 +};
632 +
633 +struct ip_set_req_ipporthash {
634 + ip_set_ip_t ip;
635 + ip_set_ip_t port;
636 +};
637 +
638 +#endif /* __IP_SET_IPPORTHASH_H */
639 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_iptree.h
640 ===================================================================
641 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
642 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_iptree.h 2007-06-17 01:56:58.436888272 +0200
643 @@ -0,0 +1,40 @@
644 +#ifndef __IP_SET_IPTREE_H
645 +#define __IP_SET_IPTREE_H
646 +
647 +#include <linux/netfilter_ipv4/ip_set.h>
648 +
649 +#define SETTYPE_NAME "iptree"
650 +#define MAX_RANGE 0x0000FFFF
651 +
652 +struct ip_set_iptreed {
653 + unsigned long expires[256]; /* x.x.x.ADDR */
654 +};
655 +
656 +struct ip_set_iptreec {
657 + struct ip_set_iptreed *tree[256]; /* x.x.ADDR.* */
658 +};
659 +
660 +struct ip_set_iptreeb {
661 + struct ip_set_iptreec *tree[256]; /* x.ADDR.*.* */
662 +};
663 +
664 +struct ip_set_iptree {
665 + unsigned int timeout;
666 + unsigned int gc_interval;
667 +#ifdef __KERNEL__
668 + uint32_t elements; /* number of elements */
669 + struct timer_list gc;
670 + struct ip_set_iptreeb *tree[256]; /* ADDR.*.*.* */
671 +#endif
672 +};
673 +
674 +struct ip_set_req_iptree_create {
675 + unsigned int timeout;
676 +};
677 +
678 +struct ip_set_req_iptree {
679 + ip_set_ip_t ip;
680 + unsigned int timeout;
681 +};
682 +
683 +#endif /* __IP_SET_IPTREE_H */
684 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_macipmap.h
685 ===================================================================
686 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
687 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_macipmap.h 2007-06-17 01:56:58.437888120 +0200
688 @@ -0,0 +1,38 @@
689 +#ifndef __IP_SET_MACIPMAP_H
690 +#define __IP_SET_MACIPMAP_H
691 +
692 +#include <linux/netfilter_ipv4/ip_set.h>
693 +
694 +#define SETTYPE_NAME "macipmap"
695 +#define MAX_RANGE 0x0000FFFF
696 +
697 +/* general flags */
698 +#define IPSET_MACIP_MATCHUNSET 1
699 +
700 +/* per ip flags */
701 +#define IPSET_MACIP_ISSET 1
702 +
703 +struct ip_set_macipmap {
704 + void *members; /* the macipmap proper */
705 + ip_set_ip_t first_ip; /* host byte order, included in range */
706 + ip_set_ip_t last_ip; /* host byte order, included in range */
707 + u_int32_t flags;
708 +};
709 +
710 +struct ip_set_req_macipmap_create {
711 + ip_set_ip_t from;
712 + ip_set_ip_t to;
713 + u_int32_t flags;
714 +};
715 +
716 +struct ip_set_req_macipmap {
717 + ip_set_ip_t ip;
718 + unsigned char ethernet[ETH_ALEN];
719 +};
720 +
721 +struct ip_set_macip {
722 + unsigned short flags;
723 + unsigned char ethernet[ETH_ALEN];
724 +};
725 +
726 +#endif /* __IP_SET_MACIPMAP_H */
727 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_malloc.h
728 ===================================================================
729 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
730 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_malloc.h 2007-06-17 01:56:58.437888120 +0200
731 @@ -0,0 +1,116 @@
732 +#ifndef _IP_SET_MALLOC_H
733 +#define _IP_SET_MALLOC_H
734 +
735 +#ifdef __KERNEL__
736 +
737 +/* Memory allocation and deallocation */
738 +static size_t max_malloc_size = 0;
739 +
740 +static inline void init_max_malloc_size(void)
741 +{
742 +#define CACHE(x) max_malloc_size = x;
743 +#include <linux/kmalloc_sizes.h>
744 +#undef CACHE
745 +}
746 +
747 +static inline void * ip_set_malloc(size_t bytes)
748 +{
749 + if (bytes > max_malloc_size)
750 + return vmalloc(bytes);
751 + else
752 + return kmalloc(bytes, GFP_KERNEL);
753 +}
754 +
755 +static inline void ip_set_free(void * data, size_t bytes)
756 +{
757 + if (bytes > max_malloc_size)
758 + vfree(data);
759 + else
760 + kfree(data);
761 +}
762 +
763 +struct harray {
764 + size_t max_elements;
765 + void *arrays[0];
766 +};
767 +
768 +static inline void *
769 +harray_malloc(size_t hashsize, size_t typesize, int flags)
770 +{
771 + struct harray *harray;
772 + size_t max_elements, size, i, j;
773 +
774 + if (!max_malloc_size)
775 + init_max_malloc_size();
776 +
777 + if (typesize > max_malloc_size)
778 + return NULL;
779 +
780 + max_elements = max_malloc_size/typesize;
781 + size = hashsize/max_elements;
782 + if (hashsize % max_elements)
783 + size++;
784 +
785 + /* Last pointer signals end of arrays */
786 + harray = kmalloc(sizeof(struct harray) + (size + 1) * sizeof(void *),
787 + flags);
788 +
789 + if (!harray)
790 + return NULL;
791 +
792 + for (i = 0; i < size - 1; i++) {
793 + harray->arrays[i] = kmalloc(max_elements * typesize, flags);
794 + if (!harray->arrays[i])
795 + goto undo;
796 + memset(harray->arrays[i], 0, max_elements * typesize);
797 + }
798 + harray->arrays[i] = kmalloc((hashsize - i * max_elements) * typesize,
799 + flags);
800 + if (!harray->arrays[i])
801 + goto undo;
802 + memset(harray->arrays[i], 0, (hashsize - i * max_elements) * typesize);
803 +
804 + harray->max_elements = max_elements;
805 + harray->arrays[size] = NULL;
806 +
807 + return (void *)harray;
808 +
809 + undo:
810 + for (j = 0; j < i; j++) {
811 + kfree(harray->arrays[j]);
812 + }
813 + kfree(harray);
814 + return NULL;
815 +}
816 +
817 +static inline void harray_free(void *h)
818 +{
819 + struct harray *harray = (struct harray *) h;
820 + size_t i;
821 +
822 + for (i = 0; harray->arrays[i] != NULL; i++)
823 + kfree(harray->arrays[i]);
824 + kfree(harray);
825 +}
826 +
827 +static inline void harray_flush(void *h, size_t hashsize, size_t typesize)
828 +{
829 + struct harray *harray = (struct harray *) h;
830 + size_t i;
831 +
832 + for (i = 0; harray->arrays[i+1] != NULL; i++)
833 + memset(harray->arrays[i], 0, harray->max_elements * typesize);
834 + memset(harray->arrays[i], 0,
835 + (hashsize - i * harray->max_elements) * typesize);
836 +}
837 +
838 +#define HARRAY_ELEM(h, type, which) \
839 +({ \
840 + struct harray *__h = (struct harray *)(h); \
841 + ((type)((__h)->arrays[(which)/(__h)->max_elements]) \
842 + + (which)%(__h)->max_elements); \
843 +})
844 +
845 +#endif /* __KERNEL__ */
846 +
847 +#endif /*_IP_SET_MALLOC_H*/
848 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_nethash.h
849 ===================================================================
850 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
851 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_nethash.h 2007-06-17 01:56:58.437888120 +0200
852 @@ -0,0 +1,55 @@
853 +#ifndef __IP_SET_NETHASH_H
854 +#define __IP_SET_NETHASH_H
855 +
856 +#include <linux/netfilter_ipv4/ip_set.h>
857 +
858 +#define SETTYPE_NAME "nethash"
859 +#define MAX_RANGE 0x0000FFFF
860 +
861 +struct ip_set_nethash {
862 + ip_set_ip_t *members; /* the nethash proper */
863 + uint32_t elements; /* number of elements */
864 + uint32_t hashsize; /* hash size */
865 + uint16_t probes; /* max number of probes */
866 + uint16_t resize; /* resize factor in percent */
867 + unsigned char cidr[30]; /* CIDR sizes */
868 + void *initval[0]; /* initvals for jhash_1word */
869 +};
870 +
871 +struct ip_set_req_nethash_create {
872 + uint32_t hashsize;
873 + uint16_t probes;
874 + uint16_t resize;
875 +};
876 +
877 +struct ip_set_req_nethash {
878 + ip_set_ip_t ip;
879 + unsigned char cidr;
880 +};
881 +
882 +static unsigned char shifts[] = {255, 253, 249, 241, 225, 193, 129, 1};
883 +
884 +static inline ip_set_ip_t
885 +pack(ip_set_ip_t ip, unsigned char cidr)
886 +{
887 + ip_set_ip_t addr, *paddr = &addr;
888 + unsigned char n, t, *a;
889 +
890 + addr = htonl(ip & (0xFFFFFFFF << (32 - (cidr))));
891 +#ifdef __KERNEL__
892 + DP("ip:%u.%u.%u.%u/%u", NIPQUAD(addr), cidr);
893 +#endif
894 + n = cidr / 8;
895 + t = cidr % 8;
896 + a = &((unsigned char *)paddr)[n];
897 + *a = *a /(1 << (8 - t)) + shifts[t];
898 +#ifdef __KERNEL__
899 + DP("n: %u, t: %u, a: %u", n, t, *a);
900 + DP("ip:%u.%u.%u.%u/%u, %u.%u.%u.%u",
901 + HIPQUAD(ip), cidr, NIPQUAD(addr));
902 +#endif
903 +
904 + return ntohl(addr);
905 +}
906 +
907 +#endif /* __IP_SET_NETHASH_H */
908 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_portmap.h
909 ===================================================================
910 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
911 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_portmap.h 2007-06-17 01:56:58.437888120 +0200
912 @@ -0,0 +1,25 @@
913 +#ifndef __IP_SET_PORTMAP_H
914 +#define __IP_SET_PORTMAP_H
915 +
916 +#include <linux/netfilter_ipv4/ip_set.h>
917 +
918 +#define SETTYPE_NAME "portmap"
919 +#define MAX_RANGE 0x0000FFFF
920 +#define INVALID_PORT (MAX_RANGE + 1)
921 +
922 +struct ip_set_portmap {
923 + void *members; /* the portmap proper */
924 + ip_set_ip_t first_port; /* host byte order, included in range */
925 + ip_set_ip_t last_port; /* host byte order, included in range */
926 +};
927 +
928 +struct ip_set_req_portmap_create {
929 + ip_set_ip_t from;
930 + ip_set_ip_t to;
931 +};
932 +
933 +struct ip_set_req_portmap {
934 + ip_set_ip_t port;
935 +};
936 +
937 +#endif /* __IP_SET_PORTMAP_H */
938 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ipt_set.h
939 ===================================================================
940 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
941 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ipt_set.h 2007-06-17 01:56:58.437888120 +0200
942 @@ -0,0 +1,21 @@
943 +#ifndef _IPT_SET_H
944 +#define _IPT_SET_H
945 +
946 +#include <linux/netfilter_ipv4/ip_set.h>
947 +
948 +struct ipt_set_info {
949 + ip_set_id_t index;
950 + u_int32_t flags[IP_SET_MAX_BINDINGS + 1];
951 +};
952 +
953 +/* match info */
954 +struct ipt_set_info_match {
955 + struct ipt_set_info match_set;
956 +};
957 +
958 +struct ipt_set_info_target {
959 + struct ipt_set_info add_set;
960 + struct ipt_set_info del_set;
961 +};
962 +
963 +#endif /*_IPT_SET_H*/
964 Index: linux-2.6.22-rc4/net/ipv4/netfilter/ip_set.c
965 ===================================================================
966 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
967 +++ linux-2.6.22-rc4/net/ipv4/netfilter/ip_set.c 2007-06-17 01:56:58.439887816 +0200
968 @@ -0,0 +1,2001 @@
969 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
970 + * Patrick Schaaf <bof@bof.de>
971 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
972 + *
973 + * This program is free software; you can redistribute it and/or modify
974 + * it under the terms of the GNU General Public License version 2 as
975 + * published by the Free Software Foundation.
976 + */
977 +
978 +/* Kernel module for IP set management */
979 +
980 +#include <linux/version.h>
981 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
982 +#include <linux/config.h>
983 +#endif
984 +#include <linux/module.h>
985 +#include <linux/moduleparam.h>
986 +#include <linux/kmod.h>
987 +#include <linux/ip.h>
988 +#include <linux/skbuff.h>
989 +#include <linux/random.h>
990 +#include <linux/jhash.h>
991 +#include <linux/netfilter_ipv4/ip_tables.h>
992 +#include <linux/errno.h>
993 +#include <asm/uaccess.h>
994 +#include <asm/bitops.h>
995 +#include <asm/semaphore.h>
996 +#include <linux/spinlock.h>
997 +#include <linux/vmalloc.h>
998 +
999 +#define ASSERT_READ_LOCK(x)
1000 +#define ASSERT_WRITE_LOCK(x)
1001 +#include <linux/netfilter_ipv4/ip_set.h>
1002 +
1003 +static struct list_head set_type_list; /* all registered sets */
1004 +static struct ip_set **ip_set_list; /* all individual sets */
1005 +static DEFINE_RWLOCK(ip_set_lock); /* protects the lists and the hash */
1006 +static DECLARE_MUTEX(ip_set_app_mutex); /* serializes user access */
1007 +static ip_set_id_t ip_set_max = CONFIG_IP_NF_SET_MAX;
1008 +static ip_set_id_t ip_set_bindings_hash_size = CONFIG_IP_NF_SET_HASHSIZE;
1009 +static struct list_head *ip_set_hash; /* hash of bindings */
1010 +static unsigned int ip_set_hash_random; /* random seed */
1011 +
1012 +/*
1013 + * Sets are identified either by the index in ip_set_list or by id.
1014 + * The id never changes and is used to find a key in the hash.
1015 + * The index may change by swapping and used at all other places
1016 + * (set/SET netfilter modules, binding value, etc.)
1017 + *
1018 + * Userspace requests are serialized by ip_set_mutex and sets can
1019 + * be deleted only from userspace. Therefore ip_set_list locking
1020 + * must obey the following rules:
1021 + *
1022 + * - kernel requests: read and write locking mandatory
1023 + * - user requests: read locking optional, write locking mandatory
1024 + */
1025 +
1026 +static inline void
1027 +__ip_set_get(ip_set_id_t index)
1028 +{
1029 + atomic_inc(&ip_set_list[index]->ref);
1030 +}
1031 +
1032 +static inline void
1033 +__ip_set_put(ip_set_id_t index)
1034 +{
1035 + atomic_dec(&ip_set_list[index]->ref);
1036 +}
1037 +
1038 +/*
1039 + * Binding routines
1040 + */
1041 +
1042 +static inline struct ip_set_hash *
1043 +__ip_set_find(u_int32_t key, ip_set_id_t id, ip_set_ip_t ip)
1044 +{
1045 + struct ip_set_hash *set_hash;
1046 +
1047 + list_for_each_entry(set_hash, &ip_set_hash[key], list)
1048 + if (set_hash->id == id && set_hash->ip == ip)
1049 + return set_hash;
1050 +
1051 + return NULL;
1052 +}
1053 +
1054 +static ip_set_id_t
1055 +ip_set_find_in_hash(ip_set_id_t id, ip_set_ip_t ip)
1056 +{
1057 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
1058 + % ip_set_bindings_hash_size;
1059 + struct ip_set_hash *set_hash;
1060 +
1061 + ASSERT_READ_LOCK(&ip_set_lock);
1062 + IP_SET_ASSERT(ip_set_list[id]);
1063 + DP("set: %s, ip: %u.%u.%u.%u", ip_set_list[id]->name, HIPQUAD(ip));
1064 +
1065 + set_hash = __ip_set_find(key, id, ip);
1066 +
1067 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
1068 + HIPQUAD(ip),
1069 + set_hash != NULL ? ip_set_list[set_hash->binding]->name : "");
1070 +
1071 + return (set_hash != NULL ? set_hash->binding : IP_SET_INVALID_ID);
1072 +}
1073 +
1074 +static inline void
1075 +__set_hash_del(struct ip_set_hash *set_hash)
1076 +{
1077 + ASSERT_WRITE_LOCK(&ip_set_lock);
1078 + IP_SET_ASSERT(ip_set_list[set_hash->binding]);
1079 +
1080 + __ip_set_put(set_hash->binding);
1081 + list_del(&set_hash->list);
1082 + kfree(set_hash);
1083 +}
1084 +
1085 +static int
1086 +ip_set_hash_del(ip_set_id_t id, ip_set_ip_t ip)
1087 +{
1088 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
1089 + % ip_set_bindings_hash_size;
1090 + struct ip_set_hash *set_hash;
1091 +
1092 + IP_SET_ASSERT(ip_set_list[id]);
1093 + DP("set: %s, ip: %u.%u.%u.%u", ip_set_list[id]->name, HIPQUAD(ip));
1094 + write_lock_bh(&ip_set_lock);
1095 + set_hash = __ip_set_find(key, id, ip);
1096 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
1097 + HIPQUAD(ip),
1098 + set_hash != NULL ? ip_set_list[set_hash->binding]->name : "");
1099 +
1100 + if (set_hash != NULL)
1101 + __set_hash_del(set_hash);
1102 + write_unlock_bh(&ip_set_lock);
1103 + return 0;
1104 +}
1105 +
1106 +static int
1107 +ip_set_hash_add(ip_set_id_t id, ip_set_ip_t ip, ip_set_id_t binding)
1108 +{
1109 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
1110 + % ip_set_bindings_hash_size;
1111 + struct ip_set_hash *set_hash;
1112 + int ret = 0;
1113 +
1114 + IP_SET_ASSERT(ip_set_list[id]);
1115 + IP_SET_ASSERT(ip_set_list[binding]);
1116 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
1117 + HIPQUAD(ip), ip_set_list[binding]->name);
1118 + write_lock_bh(&ip_set_lock);
1119 + set_hash = __ip_set_find(key, id, ip);
1120 + if (!set_hash) {
1121 + set_hash = kmalloc(sizeof(struct ip_set_hash), GFP_ATOMIC);
1122 + if (!set_hash) {
1123 + ret = -ENOMEM;
1124 + goto unlock;
1125 + }
1126 + INIT_LIST_HEAD(&set_hash->list);
1127 + set_hash->id = id;
1128 + set_hash->ip = ip;
1129 + list_add(&set_hash->list, &ip_set_hash[key]);
1130 + } else {
1131 + IP_SET_ASSERT(ip_set_list[set_hash->binding]);
1132 + DP("overwrite binding: %s",
1133 + ip_set_list[set_hash->binding]->name);
1134 + __ip_set_put(set_hash->binding);
1135 + }
1136 + set_hash->binding = binding;
1137 + __ip_set_get(set_hash->binding);
1138 + DP("stored: key %u, id %u (%s), ip %u.%u.%u.%u, binding %u (%s)",
1139 + key, id, ip_set_list[id]->name,
1140 + HIPQUAD(ip), binding, ip_set_list[binding]->name);
1141 + unlock:
1142 + write_unlock_bh(&ip_set_lock);
1143 + return ret;
1144 +}
1145 +
1146 +#define FOREACH_HASH_DO(fn, args...) \
1147 +({ \
1148 + ip_set_id_t __key; \
1149 + struct ip_set_hash *__set_hash; \
1150 + \
1151 + for (__key = 0; __key < ip_set_bindings_hash_size; __key++) { \
1152 + list_for_each_entry(__set_hash, &ip_set_hash[__key], list) \
1153 + fn(__set_hash , ## args); \
1154 + } \
1155 +})
1156 +
1157 +#define FOREACH_HASH_RW_DO(fn, args...) \
1158 +({ \
1159 + ip_set_id_t __key; \
1160 + struct ip_set_hash *__set_hash, *__n; \
1161 + \
1162 + ASSERT_WRITE_LOCK(&ip_set_lock); \
1163 + for (__key = 0; __key < ip_set_bindings_hash_size; __key++) { \
1164 + list_for_each_entry_safe(__set_hash, __n, &ip_set_hash[__key], list)\
1165 + fn(__set_hash , ## args); \
1166 + } \
1167 +})
1168 +
1169 +/* Add, del and test set entries from kernel */
1170 +
1171 +#define follow_bindings(index, set, ip) \
1172 +((index = ip_set_find_in_hash((set)->id, ip)) != IP_SET_INVALID_ID \
1173 + || (index = (set)->binding) != IP_SET_INVALID_ID)
1174 +
1175 +int
1176 +ip_set_testip_kernel(ip_set_id_t index,
1177 + const struct sk_buff *skb,
1178 + const u_int32_t *flags)
1179 +{
1180 + struct ip_set *set;
1181 + ip_set_ip_t ip;
1182 + int res;
1183 + unsigned char i = 0;
1184 +
1185 + IP_SET_ASSERT(flags[i]);
1186 + read_lock_bh(&ip_set_lock);
1187 + do {
1188 + set = ip_set_list[index];
1189 + IP_SET_ASSERT(set);
1190 + DP("set %s, index %u", set->name, index);
1191 + read_lock_bh(&set->lock);
1192 + res = set->type->testip_kernel(set, skb, &ip, flags, i++);
1193 + read_unlock_bh(&set->lock);
1194 + i += !!(set->type->features & IPSET_DATA_DOUBLE);
1195 + } while (res > 0
1196 + && flags[i]
1197 + && follow_bindings(index, set, ip));
1198 + read_unlock_bh(&ip_set_lock);
1199 +
1200 + return res;
1201 +}
1202 +
1203 +void
1204 +ip_set_addip_kernel(ip_set_id_t index,
1205 + const struct sk_buff *skb,
1206 + const u_int32_t *flags)
1207 +{
1208 + struct ip_set *set;
1209 + ip_set_ip_t ip;
1210 + int res;
1211 + unsigned char i = 0;
1212 +
1213 + IP_SET_ASSERT(flags[i]);
1214 + retry:
1215 + read_lock_bh(&ip_set_lock);
1216 + do {
1217 + set = ip_set_list[index];
1218 + IP_SET_ASSERT(set);
1219 + DP("set %s, index %u", set->name, index);
1220 + write_lock_bh(&set->lock);
1221 + res = set->type->addip_kernel(set, skb, &ip, flags, i++);
1222 + write_unlock_bh(&set->lock);
1223 + i += !!(set->type->features & IPSET_DATA_DOUBLE);
1224 + } while ((res == 0 || res == -EEXIST)
1225 + && flags[i]
1226 + && follow_bindings(index, set, ip));
1227 + read_unlock_bh(&ip_set_lock);
1228 +
1229 + if (res == -EAGAIN
1230 + && set->type->retry
1231 + && (res = set->type->retry(set)) == 0)
1232 + goto retry;
1233 +}
1234 +
1235 +void
1236 +ip_set_delip_kernel(ip_set_id_t index,
1237 + const struct sk_buff *skb,
1238 + const u_int32_t *flags)
1239 +{
1240 + struct ip_set *set;
1241 + ip_set_ip_t ip;
1242 + int res;
1243 + unsigned char i = 0;
1244 +
1245 + IP_SET_ASSERT(flags[i]);
1246 + read_lock_bh(&ip_set_lock);
1247 + do {
1248 + set = ip_set_list[index];
1249 + IP_SET_ASSERT(set);
1250 + DP("set %s, index %u", set->name, index);
1251 + write_lock_bh(&set->lock);
1252 + res = set->type->delip_kernel(set, skb, &ip, flags, i++);
1253 + write_unlock_bh(&set->lock);
1254 + i += !!(set->type->features & IPSET_DATA_DOUBLE);
1255 + } while ((res == 0 || res == -EEXIST)
1256 + && flags[i]
1257 + && follow_bindings(index, set, ip));
1258 + read_unlock_bh(&ip_set_lock);
1259 +}
1260 +
1261 +/* Register and deregister settype */
1262 +
1263 +static inline struct ip_set_type *
1264 +find_set_type(const char *name)
1265 +{
1266 + struct ip_set_type *set_type;
1267 +
1268 + list_for_each_entry(set_type, &set_type_list, list)
1269 + if (!strncmp(set_type->typename, name, IP_SET_MAXNAMELEN - 1))
1270 + return set_type;
1271 + return NULL;
1272 +}
1273 +
1274 +int
1275 +ip_set_register_set_type(struct ip_set_type *set_type)
1276 +{
1277 + int ret = 0;
1278 +
1279 + if (set_type->protocol_version != IP_SET_PROTOCOL_VERSION) {
1280 + ip_set_printk("'%s' uses wrong protocol version %u (want %u)",
1281 + set_type->typename,
1282 + set_type->protocol_version,
1283 + IP_SET_PROTOCOL_VERSION);
1284 + return -EINVAL;
1285 + }
1286 +
1287 + write_lock_bh(&ip_set_lock);
1288 + if (find_set_type(set_type->typename)) {
1289 + /* Duplicate! */
1290 + ip_set_printk("'%s' already registered!",
1291 + set_type->typename);
1292 + ret = -EINVAL;
1293 + goto unlock;
1294 + }
1295 + if (!try_module_get(THIS_MODULE)) {
1296 + ret = -EFAULT;
1297 + goto unlock;
1298 + }
1299 + list_add(&set_type->list, &set_type_list);
1300 + DP("'%s' registered.", set_type->typename);
1301 + unlock:
1302 + write_unlock_bh(&ip_set_lock);
1303 + return ret;
1304 +}
1305 +
1306 +void
1307 +ip_set_unregister_set_type(struct ip_set_type *set_type)
1308 +{
1309 + write_lock_bh(&ip_set_lock);
1310 + if (!find_set_type(set_type->typename)) {
1311 + ip_set_printk("'%s' not registered?",
1312 + set_type->typename);
1313 + goto unlock;
1314 + }
1315 + list_del(&set_type->list);
1316 + module_put(THIS_MODULE);
1317 + DP("'%s' unregistered.", set_type->typename);
1318 + unlock:
1319 + write_unlock_bh(&ip_set_lock);
1320 +
1321 +}
1322 +
1323 +/*
1324 + * Userspace routines
1325 + */
1326 +
1327 +/*
1328 + * Find set by name, reference it once. The reference makes sure the
1329 + * thing pointed to, does not go away under our feet. Drop the reference
1330 + * later, using ip_set_put().
1331 + */
1332 +ip_set_id_t
1333 +ip_set_get_byname(const char *name)
1334 +{
1335 + ip_set_id_t i, index = IP_SET_INVALID_ID;
1336 +
1337 + down(&ip_set_app_mutex);
1338 + for (i = 0; i < ip_set_max; i++) {
1339 + if (ip_set_list[i] != NULL
1340 + && strcmp(ip_set_list[i]->name, name) == 0) {
1341 + __ip_set_get(i);
1342 + index = i;
1343 + break;
1344 + }
1345 + }
1346 + up(&ip_set_app_mutex);
1347 + return index;
1348 +}
1349 +
1350 +/*
1351 + * Find set by index, reference it once. The reference makes sure the
1352 + * thing pointed to, does not go away under our feet. Drop the reference
1353 + * later, using ip_set_put().
1354 + */
1355 +ip_set_id_t
1356 +ip_set_get_byindex(ip_set_id_t index)
1357 +{
1358 + down(&ip_set_app_mutex);
1359 +
1360 + if (index >= ip_set_max)
1361 + return IP_SET_INVALID_ID;
1362 +
1363 + if (ip_set_list[index])
1364 + __ip_set_get(index);
1365 + else
1366 + index = IP_SET_INVALID_ID;
1367 +
1368 + up(&ip_set_app_mutex);
1369 + return index;
1370 +}
1371 +
1372 +/*
1373 + * If the given set pointer points to a valid set, decrement
1374 + * reference count by 1. The caller shall not assume the index
1375 + * to be valid, after calling this function.
1376 + */
1377 +void ip_set_put(ip_set_id_t index)
1378 +{
1379 + down(&ip_set_app_mutex);
1380 + if (ip_set_list[index])
1381 + __ip_set_put(index);
1382 + up(&ip_set_app_mutex);
1383 +}
1384 +
1385 +/* Find a set by name or index */
1386 +static ip_set_id_t
1387 +ip_set_find_byname(const char *name)
1388 +{
1389 + ip_set_id_t i, index = IP_SET_INVALID_ID;
1390 +
1391 + for (i = 0; i < ip_set_max; i++) {
1392 + if (ip_set_list[i] != NULL
1393 + && strcmp(ip_set_list[i]->name, name) == 0) {
1394 + index = i;
1395 + break;
1396 + }
1397 + }
1398 + return index;
1399 +}
1400 +
1401 +static ip_set_id_t
1402 +ip_set_find_byindex(ip_set_id_t index)
1403 +{
1404 + if (index >= ip_set_max || ip_set_list[index] == NULL)
1405 + index = IP_SET_INVALID_ID;
1406 +
1407 + return index;
1408 +}
1409 +
1410 +/*
1411 + * Add, del, test, bind and unbind
1412 + */
1413 +
1414 +static inline int
1415 +__ip_set_testip(struct ip_set *set,
1416 + const void *data,
1417 + size_t size,
1418 + ip_set_ip_t *ip)
1419 +{
1420 + int res;
1421 +
1422 + read_lock_bh(&set->lock);
1423 + res = set->type->testip(set, data, size, ip);
1424 + read_unlock_bh(&set->lock);
1425 +
1426 + return res;
1427 +}
1428 +
1429 +static int
1430 +__ip_set_addip(ip_set_id_t index,
1431 + const void *data,
1432 + size_t size)
1433 +{
1434 + struct ip_set *set = ip_set_list[index];
1435 + ip_set_ip_t ip;
1436 + int res;
1437 +
1438 + IP_SET_ASSERT(set);
1439 + do {
1440 + write_lock_bh(&set->lock);
1441 + res = set->type->addip(set, data, size, &ip);
1442 + write_unlock_bh(&set->lock);
1443 + } while (res == -EAGAIN
1444 + && set->type->retry
1445 + && (res = set->type->retry(set)) == 0);
1446 +
1447 + return res;
1448 +}
1449 +
1450 +static int
1451 +ip_set_addip(ip_set_id_t index,
1452 + const void *data,
1453 + size_t size)
1454 +{
1455 +
1456 + return __ip_set_addip(index,
1457 + data + sizeof(struct ip_set_req_adt),
1458 + size - sizeof(struct ip_set_req_adt));
1459 +}
1460 +
1461 +static int
1462 +ip_set_delip(ip_set_id_t index,
1463 + const void *data,
1464 + size_t size)
1465 +{
1466 + struct ip_set *set = ip_set_list[index];
1467 + ip_set_ip_t ip;
1468 + int res;
1469 +
1470 + IP_SET_ASSERT(set);
1471 + write_lock_bh(&set->lock);
1472 + res = set->type->delip(set,
1473 + data + sizeof(struct ip_set_req_adt),
1474 + size - sizeof(struct ip_set_req_adt),
1475 + &ip);
1476 + write_unlock_bh(&set->lock);
1477 +
1478 + return res;
1479 +}
1480 +
1481 +static int
1482 +ip_set_testip(ip_set_id_t index,
1483 + const void *data,
1484 + size_t size)
1485 +{
1486 + struct ip_set *set = ip_set_list[index];
1487 + ip_set_ip_t ip;
1488 + int res;
1489 +
1490 + IP_SET_ASSERT(set);
1491 + res = __ip_set_testip(set,
1492 + data + sizeof(struct ip_set_req_adt),
1493 + size - sizeof(struct ip_set_req_adt),
1494 + &ip);
1495 +
1496 + return (res > 0 ? -EEXIST : res);
1497 +}
1498 +
1499 +static int
1500 +ip_set_bindip(ip_set_id_t index,
1501 + const void *data,
1502 + size_t size)
1503 +{
1504 + struct ip_set *set = ip_set_list[index];
1505 + struct ip_set_req_bind *req_bind;
1506 + ip_set_id_t binding;
1507 + ip_set_ip_t ip;
1508 + int res;
1509 +
1510 + IP_SET_ASSERT(set);
1511 + if (size < sizeof(struct ip_set_req_bind))
1512 + return -EINVAL;
1513 +
1514 + req_bind = (struct ip_set_req_bind *) data;
1515 + req_bind->binding[IP_SET_MAXNAMELEN - 1] = '\0';
1516 +
1517 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1518 + /* Default binding of a set */
1519 + char *binding_name;
1520 +
1521 + if (size != sizeof(struct ip_set_req_bind) + IP_SET_MAXNAMELEN)
1522 + return -EINVAL;
1523 +
1524 + binding_name = (char *)(data + sizeof(struct ip_set_req_bind));
1525 + binding_name[IP_SET_MAXNAMELEN - 1] = '\0';
1526 +
1527 + binding = ip_set_find_byname(binding_name);
1528 + if (binding == IP_SET_INVALID_ID)
1529 + return -ENOENT;
1530 +
1531 + write_lock_bh(&ip_set_lock);
1532 + /* Sets as binding values are referenced */
1533 + if (set->binding != IP_SET_INVALID_ID)
1534 + __ip_set_put(set->binding);
1535 + set->binding = binding;
1536 + __ip_set_get(set->binding);
1537 + write_unlock_bh(&ip_set_lock);
1538 +
1539 + return 0;
1540 + }
1541 + binding = ip_set_find_byname(req_bind->binding);
1542 + if (binding == IP_SET_INVALID_ID)
1543 + return -ENOENT;
1544 +
1545 + res = __ip_set_testip(set,
1546 + data + sizeof(struct ip_set_req_bind),
1547 + size - sizeof(struct ip_set_req_bind),
1548 + &ip);
1549 + DP("set %s, ip: %u.%u.%u.%u, binding %s",
1550 + set->name, HIPQUAD(ip), ip_set_list[binding]->name);
1551 +
1552 + if (res >= 0)
1553 + res = ip_set_hash_add(set->id, ip, binding);
1554 +
1555 + return res;
1556 +}
1557 +
1558 +#define FOREACH_SET_DO(fn, args...) \
1559 +({ \
1560 + ip_set_id_t __i; \
1561 + struct ip_set *__set; \
1562 + \
1563 + for (__i = 0; __i < ip_set_max; __i++) { \
1564 + __set = ip_set_list[__i]; \
1565 + if (__set != NULL) \
1566 + fn(__set , ##args); \
1567 + } \
1568 +})
1569 +
1570 +static inline void
1571 +__set_hash_del_byid(struct ip_set_hash *set_hash, ip_set_id_t id)
1572 +{
1573 + if (set_hash->id == id)
1574 + __set_hash_del(set_hash);
1575 +}
1576 +
1577 +static inline void
1578 +__unbind_default(struct ip_set *set)
1579 +{
1580 + if (set->binding != IP_SET_INVALID_ID) {
1581 + /* Sets as binding values are referenced */
1582 + __ip_set_put(set->binding);
1583 + set->binding = IP_SET_INVALID_ID;
1584 + }
1585 +}
1586 +
1587 +static int
1588 +ip_set_unbindip(ip_set_id_t index,
1589 + const void *data,
1590 + size_t size)
1591 +{
1592 + struct ip_set *set;
1593 + struct ip_set_req_bind *req_bind;
1594 + ip_set_ip_t ip;
1595 + int res;
1596 +
1597 + DP("");
1598 + if (size < sizeof(struct ip_set_req_bind))
1599 + return -EINVAL;
1600 +
1601 + req_bind = (struct ip_set_req_bind *) data;
1602 + req_bind->binding[IP_SET_MAXNAMELEN - 1] = '\0';
1603 +
1604 + DP("%u %s", index, req_bind->binding);
1605 + if (index == IP_SET_INVALID_ID) {
1606 + /* unbind :all: */
1607 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1608 + /* Default binding of sets */
1609 + write_lock_bh(&ip_set_lock);
1610 + FOREACH_SET_DO(__unbind_default);
1611 + write_unlock_bh(&ip_set_lock);
1612 + return 0;
1613 + } else if (strcmp(req_bind->binding, IPSET_TOKEN_ALL) == 0) {
1614 + /* Flush all bindings of all sets*/
1615 + write_lock_bh(&ip_set_lock);
1616 + FOREACH_HASH_RW_DO(__set_hash_del);
1617 + write_unlock_bh(&ip_set_lock);
1618 + return 0;
1619 + }
1620 + DP("unreachable reached!");
1621 + return -EINVAL;
1622 + }
1623 +
1624 + set = ip_set_list[index];
1625 + IP_SET_ASSERT(set);
1626 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1627 + /* Default binding of set */
1628 + ip_set_id_t binding = ip_set_find_byindex(set->binding);
1629 +
1630 + if (binding == IP_SET_INVALID_ID)
1631 + return -ENOENT;
1632 +
1633 + write_lock_bh(&ip_set_lock);
1634 + /* Sets in hash values are referenced */
1635 + __ip_set_put(set->binding);
1636 + set->binding = IP_SET_INVALID_ID;
1637 + write_unlock_bh(&ip_set_lock);
1638 +
1639 + return 0;
1640 + } else if (strcmp(req_bind->binding, IPSET_TOKEN_ALL) == 0) {
1641 + /* Flush all bindings */
1642 +
1643 + write_lock_bh(&ip_set_lock);
1644 + FOREACH_HASH_RW_DO(__set_hash_del_byid, set->id);
1645 + write_unlock_bh(&ip_set_lock);
1646 + return 0;
1647 + }
1648 +
1649 + res = __ip_set_testip(set,
1650 + data + sizeof(struct ip_set_req_bind),
1651 + size - sizeof(struct ip_set_req_bind),
1652 + &ip);
1653 +
1654 + DP("set %s, ip: %u.%u.%u.%u", set->name, HIPQUAD(ip));
1655 + if (res >= 0)
1656 + res = ip_set_hash_del(set->id, ip);
1657 +
1658 + return res;
1659 +}
1660 +
1661 +static int
1662 +ip_set_testbind(ip_set_id_t index,
1663 + const void *data,
1664 + size_t size)
1665 +{
1666 + struct ip_set *set = ip_set_list[index];
1667 + struct ip_set_req_bind *req_bind;
1668 + ip_set_id_t binding;
1669 + ip_set_ip_t ip;
1670 + int res;
1671 +
1672 + IP_SET_ASSERT(set);
1673 + if (size < sizeof(struct ip_set_req_bind))
1674 + return -EINVAL;
1675 +
1676 + req_bind = (struct ip_set_req_bind *) data;
1677 + req_bind->binding[IP_SET_MAXNAMELEN - 1] = '\0';
1678 +
1679 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1680 + /* Default binding of set */
1681 + char *binding_name;
1682 +
1683 + if (size != sizeof(struct ip_set_req_bind) + IP_SET_MAXNAMELEN)
1684 + return -EINVAL;
1685 +
1686 + binding_name = (char *)(data + sizeof(struct ip_set_req_bind));
1687 + binding_name[IP_SET_MAXNAMELEN - 1] = '\0';
1688 +
1689 + binding = ip_set_find_byname(binding_name);
1690 + if (binding == IP_SET_INVALID_ID)
1691 + return -ENOENT;
1692 +
1693 + res = (set->binding == binding) ? -EEXIST : 0;
1694 +
1695 + return res;
1696 + }
1697 + binding = ip_set_find_byname(req_bind->binding);
1698 + if (binding == IP_SET_INVALID_ID)
1699 + return -ENOENT;
1700 +
1701 +
1702 + res = __ip_set_testip(set,
1703 + data + sizeof(struct ip_set_req_bind),
1704 + size - sizeof(struct ip_set_req_bind),
1705 + &ip);
1706 + DP("set %s, ip: %u.%u.%u.%u, binding %s",
1707 + set->name, HIPQUAD(ip), ip_set_list[binding]->name);
1708 +
1709 + if (res >= 0)
1710 + res = (ip_set_find_in_hash(set->id, ip) == binding)
1711 + ? -EEXIST : 0;
1712 +
1713 + return res;
1714 +}
1715 +
1716 +static struct ip_set_type *
1717 +find_set_type_rlock(const char *typename)
1718 +{
1719 + struct ip_set_type *type;
1720 +
1721 + read_lock_bh(&ip_set_lock);
1722 + type = find_set_type(typename);
1723 + if (type == NULL)
1724 + read_unlock_bh(&ip_set_lock);
1725 +
1726 + return type;
1727 +}
1728 +
1729 +static int
1730 +find_free_id(const char *name,
1731 + ip_set_id_t *index,
1732 + ip_set_id_t *id)
1733 +{
1734 + ip_set_id_t i;
1735 +
1736 + *id = IP_SET_INVALID_ID;
1737 + for (i = 0; i < ip_set_max; i++) {
1738 + if (ip_set_list[i] == NULL) {
1739 + if (*id == IP_SET_INVALID_ID)
1740 + *id = *index = i;
1741 + } else if (strcmp(name, ip_set_list[i]->name) == 0)
1742 + /* Name clash */
1743 + return -EEXIST;
1744 + }
1745 + if (*id == IP_SET_INVALID_ID)
1746 + /* No free slot remained */
1747 + return -ERANGE;
1748 + /* Check that index is usable as id (swapping) */
1749 + check:
1750 + for (i = 0; i < ip_set_max; i++) {
1751 + if (ip_set_list[i] != NULL
1752 + && ip_set_list[i]->id == *id) {
1753 + *id = i;
1754 + goto check;
1755 + }
1756 + }
1757 + return 0;
1758 +}
1759 +
1760 +/*
1761 + * Create a set
1762 + */
1763 +static int
1764 +ip_set_create(const char *name,
1765 + const char *typename,
1766 + ip_set_id_t restore,
1767 + const void *data,
1768 + size_t size)
1769 +{
1770 + struct ip_set *set;
1771 + ip_set_id_t index = 0, id;
1772 + int res = 0;
1773 +
1774 + DP("setname: %s, typename: %s, id: %u", name, typename, restore);
1775 + /*
1776 + * First, and without any locks, allocate and initialize
1777 + * a normal base set structure.
1778 + */
1779 + set = kmalloc(sizeof(struct ip_set), GFP_KERNEL);
1780 + if (!set)
1781 + return -ENOMEM;
1782 + set->lock = RW_LOCK_UNLOCKED;
1783 + strncpy(set->name, name, IP_SET_MAXNAMELEN);
1784 + set->binding = IP_SET_INVALID_ID;
1785 + atomic_set(&set->ref, 0);
1786 +
1787 + /*
1788 + * Next, take the &ip_set_lock, check that we know the type,
1789 + * and take a reference on the type, to make sure it
1790 + * stays available while constructing our new set.
1791 + *
1792 + * After referencing the type, we drop the &ip_set_lock,
1793 + * and let the new set construction run without locks.
1794 + */
1795 + set->type = find_set_type_rlock(typename);
1796 + if (set->type == NULL) {
1797 + /* Try loading the module */
1798 + char modulename[IP_SET_MAXNAMELEN + strlen("ip_set_") + 1];
1799 + strcpy(modulename, "ip_set_");
1800 + strcat(modulename, typename);
1801 + DP("try to load %s", modulename);
1802 + request_module(modulename);
1803 + set->type = find_set_type_rlock(typename);
1804 + }
1805 + if (set->type == NULL) {
1806 + ip_set_printk("no set type '%s', set '%s' not created",
1807 + typename, name);
1808 + res = -ENOENT;
1809 + goto out;
1810 + }
1811 + if (!try_module_get(set->type->me)) {
1812 + read_unlock_bh(&ip_set_lock);
1813 + res = -EFAULT;
1814 + goto out;
1815 + }
1816 + read_unlock_bh(&ip_set_lock);
1817 +
1818 + /*
1819 + * Without holding any locks, create private part.
1820 + */
1821 + res = set->type->create(set, data, size);
1822 + if (res != 0)
1823 + goto put_out;
1824 +
1825 + /* BTW, res==0 here. */
1826 +
1827 + /*
1828 + * Here, we have a valid, constructed set. &ip_set_lock again,
1829 + * find free id/index and check that it is not already in
1830 + * ip_set_list.
1831 + */
1832 + write_lock_bh(&ip_set_lock);
1833 + if ((res = find_free_id(set->name, &index, &id)) != 0) {
1834 + DP("no free id!");
1835 + goto cleanup;
1836 + }
1837 +
1838 + /* Make sure restore gets the same index */
1839 + if (restore != IP_SET_INVALID_ID && index != restore) {
1840 + DP("Can't restore, sets are screwed up");
1841 + res = -ERANGE;
1842 + goto cleanup;
1843 + }
1844 +
1845 + /*
1846 + * Finally! Add our shiny new set to the list, and be done.
1847 + */
1848 + DP("create: '%s' created with index %u, id %u!", set->name, index, id);
1849 + set->id = id;
1850 + ip_set_list[index] = set;
1851 + write_unlock_bh(&ip_set_lock);
1852 + return res;
1853 +
1854 + cleanup:
1855 + write_unlock_bh(&ip_set_lock);
1856 + set->type->destroy(set);
1857 + put_out:
1858 + module_put(set->type->me);
1859 + out:
1860 + kfree(set);
1861 + return res;
1862 +}
1863 +
1864 +/*
1865 + * Destroy a given existing set
1866 + */
1867 +static void
1868 +ip_set_destroy_set(ip_set_id_t index)
1869 +{
1870 + struct ip_set *set = ip_set_list[index];
1871 +
1872 + IP_SET_ASSERT(set);
1873 + DP("set: %s", set->name);
1874 + write_lock_bh(&ip_set_lock);
1875 + FOREACH_HASH_RW_DO(__set_hash_del_byid, set->id);
1876 + if (set->binding != IP_SET_INVALID_ID)
1877 + __ip_set_put(set->binding);
1878 + ip_set_list[index] = NULL;
1879 + write_unlock_bh(&ip_set_lock);
1880 +
1881 + /* Must call it without holding any lock */
1882 + set->type->destroy(set);
1883 + module_put(set->type->me);
1884 + kfree(set);
1885 +}
1886 +
1887 +/*
1888 + * Destroy a set - or all sets
1889 + * Sets must not be referenced/used.
1890 + */
1891 +static int
1892 +ip_set_destroy(ip_set_id_t index)
1893 +{
1894 + ip_set_id_t i;
1895 +
1896 + /* ref modification always protected by the mutex */
1897 + if (index != IP_SET_INVALID_ID) {
1898 + if (atomic_read(&ip_set_list[index]->ref))
1899 + return -EBUSY;
1900 + ip_set_destroy_set(index);
1901 + } else {
1902 + for (i = 0; i < ip_set_max; i++) {
1903 + if (ip_set_list[i] != NULL
1904 + && (atomic_read(&ip_set_list[i]->ref)))
1905 + return -EBUSY;
1906 + }
1907 +
1908 + for (i = 0; i < ip_set_max; i++) {
1909 + if (ip_set_list[i] != NULL)
1910 + ip_set_destroy_set(i);
1911 + }
1912 + }
1913 + return 0;
1914 +}
1915 +
1916 +static void
1917 +ip_set_flush_set(struct ip_set *set)
1918 +{
1919 + DP("set: %s %u", set->name, set->id);
1920 +
1921 + write_lock_bh(&set->lock);
1922 + set->type->flush(set);
1923 + write_unlock_bh(&set->lock);
1924 +}
1925 +
1926 +/*
1927 + * Flush data in a set - or in all sets
1928 + */
1929 +static int
1930 +ip_set_flush(ip_set_id_t index)
1931 +{
1932 + if (index != IP_SET_INVALID_ID) {
1933 + IP_SET_ASSERT(ip_set_list[index]);
1934 + ip_set_flush_set(ip_set_list[index]);
1935 + } else
1936 + FOREACH_SET_DO(ip_set_flush_set);
1937 +
1938 + return 0;
1939 +}
1940 +
1941 +/* Rename a set */
1942 +static int
1943 +ip_set_rename(ip_set_id_t index, const char *name)
1944 +{
1945 + struct ip_set *set = ip_set_list[index];
1946 + ip_set_id_t i;
1947 + int res = 0;
1948 +
1949 + DP("set: %s to %s", set->name, name);
1950 + write_lock_bh(&ip_set_lock);
1951 + for (i = 0; i < ip_set_max; i++) {
1952 + if (ip_set_list[i] != NULL
1953 + && strncmp(ip_set_list[i]->name,
1954 + name,
1955 + IP_SET_MAXNAMELEN - 1) == 0) {
1956 + res = -EEXIST;
1957 + goto unlock;
1958 + }
1959 + }
1960 + strncpy(set->name, name, IP_SET_MAXNAMELEN);
1961 + unlock:
1962 + write_unlock_bh(&ip_set_lock);
1963 + return res;
1964 +}
1965 +
1966 +/*
1967 + * Swap two sets so that name/index points to the other.
1968 + * References are also swapped.
1969 + */
1970 +static int
1971 +ip_set_swap(ip_set_id_t from_index, ip_set_id_t to_index)
1972 +{
1973 + struct ip_set *from = ip_set_list[from_index];
1974 + struct ip_set *to = ip_set_list[to_index];
1975 + char from_name[IP_SET_MAXNAMELEN];
1976 + u_int32_t from_ref;
1977 +
1978 + DP("set: %s to %s", from->name, to->name);
1979 + /* Features must not change. Artifical restriction. */
1980 + if (from->type->features != to->type->features)
1981 + return -ENOEXEC;
1982 +
1983 + /* No magic here: ref munging protected by the mutex */
1984 + write_lock_bh(&ip_set_lock);
1985 + strncpy(from_name, from->name, IP_SET_MAXNAMELEN);
1986 + from_ref = atomic_read(&from->ref);
1987 +
1988 + strncpy(from->name, to->name, IP_SET_MAXNAMELEN);
1989 + atomic_set(&from->ref, atomic_read(&to->ref));
1990 + strncpy(to->name, from_name, IP_SET_MAXNAMELEN);
1991 + atomic_set(&to->ref, from_ref);
1992 +
1993 + ip_set_list[from_index] = to;
1994 + ip_set_list[to_index] = from;
1995 +
1996 + write_unlock_bh(&ip_set_lock);
1997 + return 0;
1998 +}
1999 +
2000 +/*
2001 + * List set data
2002 + */
2003 +
2004 +static inline void
2005 +__set_hash_bindings_size_list(struct ip_set_hash *set_hash,
2006 + ip_set_id_t id, size_t *size)
2007 +{
2008 + if (set_hash->id == id)
2009 + *size += sizeof(struct ip_set_hash_list);
2010 +}
2011 +
2012 +static inline void
2013 +__set_hash_bindings_size_save(struct ip_set_hash *set_hash,
2014 + ip_set_id_t id, size_t *size)
2015 +{
2016 + if (set_hash->id == id)
2017 + *size += sizeof(struct ip_set_hash_save);
2018 +}
2019 +
2020 +static inline void
2021 +__set_hash_bindings(struct ip_set_hash *set_hash,
2022 + ip_set_id_t id, void *data, int *used)
2023 +{
2024 + if (set_hash->id == id) {
2025 + struct ip_set_hash_list *hash_list =
2026 + (struct ip_set_hash_list *)(data + *used);
2027 +
2028 + hash_list->ip = set_hash->ip;
2029 + hash_list->binding = set_hash->binding;
2030 + *used += sizeof(struct ip_set_hash_list);
2031 + }
2032 +}
2033 +
2034 +static int ip_set_list_set(ip_set_id_t index,
2035 + void *data,
2036 + int *used,
2037 + int len)
2038 +{
2039 + struct ip_set *set = ip_set_list[index];
2040 + struct ip_set_list *set_list;
2041 +
2042 + /* Pointer to our header */
2043 + set_list = (struct ip_set_list *) (data + *used);
2044 +
2045 + DP("set: %s, used: %d %p %p", set->name, *used, data, data + *used);
2046 +
2047 + /* Get and ensure header size */
2048 + if (*used + sizeof(struct ip_set_list) > len)
2049 + goto not_enough_mem;
2050 + *used += sizeof(struct ip_set_list);
2051 +
2052 + read_lock_bh(&set->lock);
2053 + /* Get and ensure set specific header size */
2054 + set_list->header_size = set->type->header_size;
2055 + if (*used + set_list->header_size > len)
2056 + goto unlock_set;
2057 +
2058 + /* Fill in the header */
2059 + set_list->index = index;
2060 + set_list->binding = set->binding;
2061 + set_list->ref = atomic_read(&set->ref);
2062 +
2063 + /* Fill in set spefific header data */
2064 + set->type->list_header(set, data + *used);
2065 + *used += set_list->header_size;
2066 +
2067 + /* Get and ensure set specific members size */
2068 + set_list->members_size = set->type->list_members_size(set);
2069 + if (*used + set_list->members_size > len)
2070 + goto unlock_set;
2071 +
2072 + /* Fill in set spefific members data */
2073 + set->type->list_members(set, data + *used);
2074 + *used += set_list->members_size;
2075 + read_unlock_bh(&set->lock);
2076 +
2077 + /* Bindings */
2078 +
2079 + /* Get and ensure set specific bindings size */
2080 + set_list->bindings_size = 0;
2081 + FOREACH_HASH_DO(__set_hash_bindings_size_list,
2082 + set->id, &set_list->bindings_size);
2083 + if (*used + set_list->bindings_size > len)
2084 + goto not_enough_mem;
2085 +
2086 + /* Fill in set spefific bindings data */
2087 + FOREACH_HASH_DO(__set_hash_bindings, set->id, data, used);
2088 +
2089 + return 0;
2090 +
2091 + unlock_set:
2092 + read_unlock_bh(&set->lock);
2093 + not_enough_mem:
2094 + DP("not enough mem, try again");
2095 + return -EAGAIN;
2096 +}
2097 +
2098 +/*
2099 + * Save sets
2100 + */
2101 +static int ip_set_save_set(ip_set_id_t index,
2102 + void *data,
2103 + int *used,
2104 + int len)
2105 +{
2106 + struct ip_set *set;
2107 + struct ip_set_save *set_save;
2108 +
2109 + /* Pointer to our header */
2110 + set_save = (struct ip_set_save *) (data + *used);
2111 +
2112 + /* Get and ensure header size */
2113 + if (*used + sizeof(struct ip_set_save) > len)
2114 + goto not_enough_mem;
2115 + *used += sizeof(struct ip_set_save);
2116 +
2117 + set = ip_set_list[index];
2118 + DP("set: %s, used: %u(%u) %p %p", set->name, *used, len,
2119 + data, data + *used);
2120 +
2121 + read_lock_bh(&set->lock);
2122 + /* Get and ensure set specific header size */
2123 + set_save->header_size = set->type->header_size;
2124 + if (*used + set_save->header_size > len)
2125 + goto unlock_set;
2126 +
2127 + /* Fill in the header */
2128 + set_save->index = index;
2129 + set_save->binding = set->binding;
2130 +
2131 + /* Fill in set spefific header data */
2132 + set->type->list_header(set, data + *used);
2133 + *used += set_save->header_size;
2134 +
2135 + DP("set header filled: %s, used: %u(%u) %p %p", set->name, *used,
2136 + set_save->header_size, data, data + *used);
2137 + /* Get and ensure set specific members size */
2138 + set_save->members_size = set->type->list_members_size(set);
2139 + if (*used + set_save->members_size > len)
2140 + goto unlock_set;
2141 +
2142 + /* Fill in set spefific members data */
2143 + set->type->list_members(set, data + *used);
2144 + *used += set_save->members_size;
2145 + read_unlock_bh(&set->lock);
2146 + DP("set members filled: %s, used: %u(%u) %p %p", set->name, *used,
2147 + set_save->members_size, data, data + *used);
2148 + return 0;
2149 +
2150 + unlock_set:
2151 + read_unlock_bh(&set->lock);
2152 + not_enough_mem:
2153 + DP("not enough mem, try again");
2154 + return -EAGAIN;
2155 +}
2156 +
2157 +static inline void
2158 +__set_hash_save_bindings(struct ip_set_hash *set_hash,
2159 + ip_set_id_t id,
2160 + void *data,
2161 + int *used,
2162 + int len,
2163 + int *res)
2164 +{
2165 + if (*res == 0
2166 + && (id == IP_SET_INVALID_ID || set_hash->id == id)) {
2167 + struct ip_set_hash_save *hash_save =
2168 + (struct ip_set_hash_save *)(data + *used);
2169 + /* Ensure bindings size */
2170 + if (*used + sizeof(struct ip_set_hash_save) > len) {
2171 + *res = -ENOMEM;
2172 + return;
2173 + }
2174 + hash_save->id = set_hash->id;
2175 + hash_save->ip = set_hash->ip;
2176 + hash_save->binding = set_hash->binding;
2177 + *used += sizeof(struct ip_set_hash_save);
2178 + }
2179 +}
2180 +
2181 +static int ip_set_save_bindings(ip_set_id_t index,
2182 + void *data,
2183 + int *used,
2184 + int len)
2185 +{
2186 + int res = 0;
2187 + struct ip_set_save *set_save;
2188 +
2189 + DP("used %u, len %u", *used, len);
2190 + /* Get and ensure header size */
2191 + if (*used + sizeof(struct ip_set_save) > len)
2192 + return -ENOMEM;
2193 +
2194 + /* Marker */
2195 + set_save = (struct ip_set_save *) (data + *used);
2196 + set_save->index = IP_SET_INVALID_ID;
2197 + set_save->header_size = 0;
2198 + set_save->members_size = 0;
2199 + *used += sizeof(struct ip_set_save);
2200 +
2201 + DP("marker added used %u, len %u", *used, len);
2202 + /* Fill in bindings data */
2203 + if (index != IP_SET_INVALID_ID)
2204 + /* Sets are identified by id in hash */
2205 + index = ip_set_list[index]->id;
2206 + FOREACH_HASH_DO(__set_hash_save_bindings, index, data, used, len, &res);
2207 +
2208 + return res;
2209 +}
2210 +
2211 +/*
2212 + * Restore sets
2213 + */
2214 +static int ip_set_restore(void *data,
2215 + int len)
2216 +{
2217 + int res = 0;
2218 + int line = 0, used = 0, members_size;
2219 + struct ip_set *set;
2220 + struct ip_set_hash_save *hash_save;
2221 + struct ip_set_restore *set_restore;
2222 + ip_set_id_t index;
2223 +
2224 + /* Loop to restore sets */
2225 + while (1) {
2226 + line++;
2227 +
2228 + DP("%u %u %u", used, sizeof(struct ip_set_restore), len);
2229 + /* Get and ensure header size */
2230 + if (used + sizeof(struct ip_set_restore) > len)
2231 + return line;
2232 + set_restore = (struct ip_set_restore *) (data + used);
2233 + used += sizeof(struct ip_set_restore);
2234 +
2235 + /* Ensure data size */
2236 + if (used
2237 + + set_restore->header_size
2238 + + set_restore->members_size > len)
2239 + return line;
2240 +
2241 + /* Check marker */
2242 + if (set_restore->index == IP_SET_INVALID_ID) {
2243 + line--;
2244 + goto bindings;
2245 + }
2246 +
2247 + /* Try to create the set */
2248 + DP("restore %s %s", set_restore->name, set_restore->typename);
2249 + res = ip_set_create(set_restore->name,
2250 + set_restore->typename,
2251 + set_restore->index,
2252 + data + used,
2253 + set_restore->header_size);
2254 +
2255 + if (res != 0)
2256 + return line;
2257 + used += set_restore->header_size;
2258 +
2259 + index = ip_set_find_byindex(set_restore->index);
2260 + DP("index %u, restore_index %u", index, set_restore->index);
2261 + if (index != set_restore->index)
2262 + return line;
2263 + /* Try to restore members data */
2264 + set = ip_set_list[index];
2265 + members_size = 0;
2266 + DP("members_size %u reqsize %u",
2267 + set_restore->members_size, set->type->reqsize);
2268 + while (members_size + set->type->reqsize <=
2269 + set_restore->members_size) {
2270 + line++;
2271 + DP("members: %u, line %u", members_size, line);
2272 + res = __ip_set_addip(index,
2273 + data + used + members_size,
2274 + set->type->reqsize);
2275 + if (!(res == 0 || res == -EEXIST))
2276 + return line;
2277 + members_size += set->type->reqsize;
2278 + }
2279 +
2280 + DP("members_size %u %u",
2281 + set_restore->members_size, members_size);
2282 + if (members_size != set_restore->members_size)
2283 + return line++;
2284 + used += set_restore->members_size;
2285 + }
2286 +
2287 + bindings:
2288 + /* Loop to restore bindings */
2289 + while (used < len) {
2290 + line++;
2291 +
2292 + DP("restore binding, line %u", line);
2293 + /* Get and ensure size */
2294 + if (used + sizeof(struct ip_set_hash_save) > len)
2295 + return line;
2296 + hash_save = (struct ip_set_hash_save *) (data + used);
2297 + used += sizeof(struct ip_set_hash_save);
2298 +
2299 + /* hash_save->id is used to store the index */
2300 + index = ip_set_find_byindex(hash_save->id);
2301 + DP("restore binding index %u, id %u, %u -> %u",
2302 + index, hash_save->id, hash_save->ip, hash_save->binding);
2303 + if (index != hash_save->id)
2304 + return line;
2305 + if (ip_set_find_byindex(hash_save->binding) == IP_SET_INVALID_ID) {
2306 + DP("corrupt binding set index %u", hash_save->binding);
2307 + return line;
2308 + }
2309 + set = ip_set_list[hash_save->id];
2310 + /* Null valued IP means default binding */
2311 + if (hash_save->ip)
2312 + res = ip_set_hash_add(set->id,
2313 + hash_save->ip,
2314 + hash_save->binding);
2315 + else {
2316 + IP_SET_ASSERT(set->binding == IP_SET_INVALID_ID);
2317 + write_lock_bh(&ip_set_lock);
2318 + set->binding = hash_save->binding;
2319 + __ip_set_get(set->binding);
2320 + write_unlock_bh(&ip_set_lock);
2321 + DP("default binding: %u", set->binding);
2322 + }
2323 + if (res != 0)
2324 + return line;
2325 + }
2326 + if (used != len)
2327 + return line;
2328 +
2329 + return 0;
2330 +}
2331 +
2332 +static int
2333 +ip_set_sockfn_set(struct sock *sk, int optval, void *user, unsigned int len)
2334 +{
2335 + void *data;
2336 + int res = 0; /* Assume OK */
2337 + unsigned *op;
2338 + struct ip_set_req_adt *req_adt;
2339 + ip_set_id_t index = IP_SET_INVALID_ID;
2340 + int (*adtfn)(ip_set_id_t index,
2341 + const void *data, size_t size);
2342 + struct fn_table {
2343 + int (*fn)(ip_set_id_t index,
2344 + const void *data, size_t size);
2345 + } adtfn_table[] =
2346 + { { ip_set_addip }, { ip_set_delip }, { ip_set_testip},
2347 + { ip_set_bindip}, { ip_set_unbindip }, { ip_set_testbind },
2348 + };
2349 +
2350 + DP("optval=%d, user=%p, len=%d", optval, user, len);
2351 + if (!capable(CAP_NET_ADMIN))
2352 + return -EPERM;
2353 + if (optval != SO_IP_SET)
2354 + return -EBADF;
2355 + if (len <= sizeof(unsigned)) {
2356 + ip_set_printk("short userdata (want >%zu, got %u)",
2357 + sizeof(unsigned), len);
2358 + return -EINVAL;
2359 + }
2360 + data = vmalloc(len);
2361 + if (!data) {
2362 + DP("out of mem for %u bytes", len);
2363 + return -ENOMEM;
2364 + }
2365 + if (copy_from_user(data, user, len) != 0) {
2366 + res = -EFAULT;
2367 + goto done;
2368 + }
2369 + if (down_interruptible(&ip_set_app_mutex)) {
2370 + res = -EINTR;
2371 + goto done;
2372 + }
2373 +
2374 + op = (unsigned *)data;
2375 + DP("op=%x", *op);
2376 +
2377 + if (*op < IP_SET_OP_VERSION) {
2378 + /* Check the version at the beginning of operations */
2379 + struct ip_set_req_version *req_version =
2380 + (struct ip_set_req_version *) data;
2381 + if (req_version->version != IP_SET_PROTOCOL_VERSION) {
2382 + res = -EPROTO;
2383 + goto done;
2384 + }
2385 + }
2386 +
2387 + switch (*op) {
2388 + case IP_SET_OP_CREATE:{
2389 + struct ip_set_req_create *req_create
2390 + = (struct ip_set_req_create *) data;
2391 +
2392 + if (len < sizeof(struct ip_set_req_create)) {
2393 + ip_set_printk("short CREATE data (want >=%zu, got %u)",
2394 + sizeof(struct ip_set_req_create), len);
2395 + res = -EINVAL;
2396 + goto done;
2397 + }
2398 + req_create->name[IP_SET_MAXNAMELEN - 1] = '\0';
2399 + req_create->typename[IP_SET_MAXNAMELEN - 1] = '\0';
2400 + res = ip_set_create(req_create->name,
2401 + req_create->typename,
2402 + IP_SET_INVALID_ID,
2403 + data + sizeof(struct ip_set_req_create),
2404 + len - sizeof(struct ip_set_req_create));
2405 + goto done;
2406 + }
2407 + case IP_SET_OP_DESTROY:{
2408 + struct ip_set_req_std *req_destroy
2409 + = (struct ip_set_req_std *) data;
2410 +
2411 + if (len != sizeof(struct ip_set_req_std)) {
2412 + ip_set_printk("invalid DESTROY data (want %zu, got %u)",
2413 + sizeof(struct ip_set_req_std), len);
2414 + res = -EINVAL;
2415 + goto done;
2416 + }
2417 + if (strcmp(req_destroy->name, IPSET_TOKEN_ALL) == 0) {
2418 + /* Destroy all sets */
2419 + index = IP_SET_INVALID_ID;
2420 + } else {
2421 + req_destroy->name[IP_SET_MAXNAMELEN - 1] = '\0';
2422 + index = ip_set_find_byname(req_destroy->name);
2423 +
2424 + if (index == IP_SET_INVALID_ID) {
2425 + res = -ENOENT;
2426 + goto done;
2427 + }
2428 + }
2429 +
2430 + res = ip_set_destroy(index);
2431 + goto done;
2432 + }
2433 + case IP_SET_OP_FLUSH:{
2434 + struct ip_set_req_std *req_flush =
2435 + (struct ip_set_req_std *) data;
2436 +
2437 + if (len != sizeof(struct ip_set_req_std)) {
2438 + ip_set_printk("invalid FLUSH data (want %zu, got %u)",
2439 + sizeof(struct ip_set_req_std), len);
2440 + res = -EINVAL;
2441 + goto done;
2442 + }
2443 + if (strcmp(req_flush->name, IPSET_TOKEN_ALL) == 0) {
2444 + /* Flush all sets */
2445 + index = IP_SET_INVALID_ID;
2446 + } else {
2447 + req_flush->name[IP_SET_MAXNAMELEN - 1] = '\0';
2448 + index = ip_set_find_byname(req_flush->name);
2449 +
2450 + if (index == IP_SET_INVALID_ID) {
2451 + res = -ENOENT;
2452 + goto done;
2453 + }
2454 + }
2455 + res = ip_set_flush(index);
2456 + goto done;
2457 + }
2458 + case IP_SET_OP_RENAME:{
2459 + struct ip_set_req_create *req_rename
2460 + = (struct ip_set_req_create *) data;
2461 +
2462 + if (len != sizeof(struct ip_set_req_create)) {
2463 + ip_set_printk("invalid RENAME data (want %zu, got %u)",
2464 + sizeof(struct ip_set_req_create), len);
2465 + res = -EINVAL;
2466 + goto done;
2467 + }
2468 +
2469 + req_rename->name[IP_SET_MAXNAMELEN - 1] = '\0';
2470 + req_rename->typename[IP_SET_MAXNAMELEN - 1] = '\0';
2471 +
2472 + index = ip_set_find_byname(req_rename->name);
2473 + if (index == IP_SET_INVALID_ID) {
2474 + res = -ENOENT;
2475 + goto done;
2476 + }
2477 + res = ip_set_rename(index, req_rename->typename);
2478 + goto done;
2479 + }
2480 + case IP_SET_OP_SWAP:{
2481 + struct ip_set_req_create *req_swap
2482 + = (struct ip_set_req_create *) data;
2483 + ip_set_id_t to_index;
2484 +
2485 + if (len != sizeof(struct ip_set_req_create)) {
2486 + ip_set_printk("invalid SWAP data (want %zu, got %u)",
2487 + sizeof(struct ip_set_req_create), len);
2488 + res = -EINVAL;
2489 + goto done;
2490 + }
2491 +
2492 + req_swap->name[IP_SET_MAXNAMELEN - 1] = '\0';
2493 + req_swap->typename[IP_SET_MAXNAMELEN - 1] = '\0';
2494 +
2495 + index = ip_set_find_byname(req_swap->name);
2496 + if (index == IP_SET_INVALID_ID) {
2497 + res = -ENOENT;
2498 + goto done;
2499 + }
2500 + to_index = ip_set_find_byname(req_swap->typename);
2501 + if (to_index == IP_SET_INVALID_ID) {
2502 + res = -ENOENT;
2503 + goto done;
2504 + }
2505 + res = ip_set_swap(index, to_index);
2506 + goto done;
2507 + }
2508 + default:
2509 + break; /* Set identified by id */
2510 + }
2511 +
2512 + /* There we may have add/del/test/bind/unbind/test_bind operations */
2513 + if (*op < IP_SET_OP_ADD_IP || *op > IP_SET_OP_TEST_BIND_SET) {
2514 + res = -EBADMSG;
2515 + goto done;
2516 + }
2517 + adtfn = adtfn_table[*op - IP_SET_OP_ADD_IP].fn;
2518 +
2519 + if (len < sizeof(struct ip_set_req_adt)) {
2520 + ip_set_printk("short data in adt request (want >=%zu, got %u)",
2521 + sizeof(struct ip_set_req_adt), len);
2522 + res = -EINVAL;
2523 + goto done;
2524 + }
2525 + req_adt = (struct ip_set_req_adt *) data;
2526 +
2527 + /* -U :all: :all:|:default: uses IP_SET_INVALID_ID */
2528 + if (!(*op == IP_SET_OP_UNBIND_SET
2529 + && req_adt->index == IP_SET_INVALID_ID)) {
2530 + index = ip_set_find_byindex(req_adt->index);
2531 + if (index == IP_SET_INVALID_ID) {
2532 + res = -ENOENT;
2533 + goto done;
2534 + }
2535 + }
2536 + res = adtfn(index, data, len);
2537 +
2538 + done:
2539 + up(&ip_set_app_mutex);
2540 + vfree(data);
2541 + if (res > 0)
2542 + res = 0;
2543 + DP("final result %d", res);
2544 + return res;
2545 +}
2546 +
2547 +static int
2548 +ip_set_sockfn_get(struct sock *sk, int optval, void *user, int *len)
2549 +{
2550 + int res = 0;
2551 + unsigned *op;
2552 + ip_set_id_t index = IP_SET_INVALID_ID;
2553 + void *data;
2554 + int copylen = *len;
2555 +
2556 + DP("optval=%d, user=%p, len=%d", optval, user, *len);
2557 + if (!capable(CAP_NET_ADMIN))
2558 + return -EPERM;
2559 + if (optval != SO_IP_SET)
2560 + return -EBADF;
2561 + if (*len < sizeof(unsigned)) {
2562 + ip_set_printk("short userdata (want >=%zu, got %d)",
2563 + sizeof(unsigned), *len);
2564 + return -EINVAL;
2565 + }
2566 + data = vmalloc(*len);
2567 + if (!data) {
2568 + DP("out of mem for %d bytes", *len);
2569 + return -ENOMEM;
2570 + }
2571 + if (copy_from_user(data, user, *len) != 0) {
2572 + res = -EFAULT;
2573 + goto done;
2574 + }
2575 + if (down_interruptible(&ip_set_app_mutex)) {
2576 + res = -EINTR;
2577 + goto done;
2578 + }
2579 +
2580 + op = (unsigned *) data;
2581 + DP("op=%x", *op);
2582 +
2583 + if (*op < IP_SET_OP_VERSION) {
2584 + /* Check the version at the beginning of operations */
2585 + struct ip_set_req_version *req_version =
2586 + (struct ip_set_req_version *) data;
2587 + if (req_version->version != IP_SET_PROTOCOL_VERSION) {
2588 + res = -EPROTO;
2589 + goto done;
2590 + }
2591 + }
2592 +
2593 + switch (*op) {
2594 + case IP_SET_OP_VERSION: {
2595 + struct ip_set_req_version *req_version =
2596 + (struct ip_set_req_version *) data;
2597 +
2598 + if (*len != sizeof(struct ip_set_req_version)) {
2599 + ip_set_printk("invalid VERSION (want %zu, got %d)",
2600 + sizeof(struct ip_set_req_version),
2601 + *len);
2602 + res = -EINVAL;
2603 + goto done;
2604 + }
2605 +
2606 + req_version->version = IP_SET_PROTOCOL_VERSION;
2607 + res = copy_to_user(user, req_version,
2608 + sizeof(struct ip_set_req_version));
2609 + goto done;
2610 + }
2611 + case IP_SET_OP_GET_BYNAME: {
2612 + struct ip_set_req_get_set *req_get
2613 + = (struct ip_set_req_get_set *) data;
2614 +
2615 + if (*len != sizeof(struct ip_set_req_get_set)) {
2616 + ip_set_printk("invalid GET_BYNAME (want %zu, got %d)",
2617 + sizeof(struct ip_set_req_get_set), *len);
2618 + res = -EINVAL;
2619 + goto done;
2620 + }
2621 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2622 + index = ip_set_find_byname(req_get->set.name);
2623 + req_get->set.index = index;
2624 + goto copy;
2625 + }
2626 + case IP_SET_OP_GET_BYINDEX: {
2627 + struct ip_set_req_get_set *req_get
2628 + = (struct ip_set_req_get_set *) data;
2629 +
2630 + if (*len != sizeof(struct ip_set_req_get_set)) {
2631 + ip_set_printk("invalid GET_BYINDEX (want %zu, got %d)",
2632 + sizeof(struct ip_set_req_get_set), *len);
2633 + res = -EINVAL;
2634 + goto done;
2635 + }
2636 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2637 + index = ip_set_find_byindex(req_get->set.index);
2638 + strncpy(req_get->set.name,
2639 + index == IP_SET_INVALID_ID ? ""
2640 + : ip_set_list[index]->name, IP_SET_MAXNAMELEN);
2641 + goto copy;
2642 + }
2643 + case IP_SET_OP_ADT_GET: {
2644 + struct ip_set_req_adt_get *req_get
2645 + = (struct ip_set_req_adt_get *) data;
2646 +
2647 + if (*len != sizeof(struct ip_set_req_adt_get)) {
2648 + ip_set_printk("invalid ADT_GET (want %zu, got %d)",
2649 + sizeof(struct ip_set_req_adt_get), *len);
2650 + res = -EINVAL;
2651 + goto done;
2652 + }
2653 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2654 + index = ip_set_find_byname(req_get->set.name);
2655 + if (index != IP_SET_INVALID_ID) {
2656 + req_get->set.index = index;
2657 + strncpy(req_get->typename,
2658 + ip_set_list[index]->type->typename,
2659 + IP_SET_MAXNAMELEN - 1);
2660 + } else {
2661 + res = -ENOENT;
2662 + goto done;
2663 + }
2664 + goto copy;
2665 + }
2666 + case IP_SET_OP_MAX_SETS: {
2667 + struct ip_set_req_max_sets *req_max_sets
2668 + = (struct ip_set_req_max_sets *) data;
2669 + ip_set_id_t i;
2670 +
2671 + if (*len != sizeof(struct ip_set_req_max_sets)) {
2672 + ip_set_printk("invalid MAX_SETS (want %zu, got %d)",
2673 + sizeof(struct ip_set_req_max_sets), *len);
2674 + res = -EINVAL;
2675 + goto done;
2676 + }
2677 +
2678 + if (strcmp(req_max_sets->set.name, IPSET_TOKEN_ALL) == 0) {
2679 + req_max_sets->set.index = IP_SET_INVALID_ID;
2680 + } else {
2681 + req_max_sets->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2682 + req_max_sets->set.index =
2683 + ip_set_find_byname(req_max_sets->set.name);
2684 + if (req_max_sets->set.index == IP_SET_INVALID_ID) {
2685 + res = -ENOENT;
2686 + goto done;
2687 + }
2688 + }
2689 + req_max_sets->max_sets = ip_set_max;
2690 + req_max_sets->sets = 0;
2691 + for (i = 0; i < ip_set_max; i++) {
2692 + if (ip_set_list[i] != NULL)
2693 + req_max_sets->sets++;
2694 + }
2695 + goto copy;
2696 + }
2697 + case IP_SET_OP_LIST_SIZE:
2698 + case IP_SET_OP_SAVE_SIZE: {
2699 + struct ip_set_req_setnames *req_setnames
2700 + = (struct ip_set_req_setnames *) data;
2701 + struct ip_set_name_list *name_list;
2702 + struct ip_set *set;
2703 + ip_set_id_t i;
2704 + int used;
2705 +
2706 + if (*len < sizeof(struct ip_set_req_setnames)) {
2707 + ip_set_printk("short LIST_SIZE (want >=%zu, got %d)",
2708 + sizeof(struct ip_set_req_setnames), *len);
2709 + res = -EINVAL;
2710 + goto done;
2711 + }
2712 +
2713 + req_setnames->size = 0;
2714 + used = sizeof(struct ip_set_req_setnames);
2715 + for (i = 0; i < ip_set_max; i++) {
2716 + if (ip_set_list[i] == NULL)
2717 + continue;
2718 + name_list = (struct ip_set_name_list *)
2719 + (data + used);
2720 + used += sizeof(struct ip_set_name_list);
2721 + if (used > copylen) {
2722 + res = -EAGAIN;
2723 + goto done;
2724 + }
2725 + set = ip_set_list[i];
2726 + /* Fill in index, name, etc. */
2727 + name_list->index = i;
2728 + name_list->id = set->id;
2729 + strncpy(name_list->name,
2730 + set->name,
2731 + IP_SET_MAXNAMELEN - 1);
2732 + strncpy(name_list->typename,
2733 + set->type->typename,
2734 + IP_SET_MAXNAMELEN - 1);
2735 + DP("filled %s of type %s, index %u\n",
2736 + name_list->name, name_list->typename,
2737 + name_list->index);
2738 + if (!(req_setnames->index == IP_SET_INVALID_ID
2739 + || req_setnames->index == i))
2740 + continue;
2741 + /* Update size */
2742 + switch (*op) {
2743 + case IP_SET_OP_LIST_SIZE: {
2744 + req_setnames->size += sizeof(struct ip_set_list)
2745 + + set->type->header_size
2746 + + set->type->list_members_size(set);
2747 + /* Sets are identified by id in the hash */
2748 + FOREACH_HASH_DO(__set_hash_bindings_size_list,
2749 + set->id, &req_setnames->size);
2750 + break;
2751 + }
2752 + case IP_SET_OP_SAVE_SIZE: {
2753 + req_setnames->size += sizeof(struct ip_set_save)
2754 + + set->type->header_size
2755 + + set->type->list_members_size(set);
2756 + FOREACH_HASH_DO(__set_hash_bindings_size_save,
2757 + set->id, &req_setnames->size);
2758 + break;
2759 + }
2760 + default:
2761 + break;
2762 + }
2763 + }
2764 + if (copylen != used) {
2765 + res = -EAGAIN;
2766 + goto done;
2767 + }
2768 + goto copy;
2769 + }
2770 + case IP_SET_OP_LIST: {
2771 + struct ip_set_req_list *req_list
2772 + = (struct ip_set_req_list *) data;
2773 + ip_set_id_t i;
2774 + int used;
2775 +
2776 + if (*len < sizeof(struct ip_set_req_list)) {
2777 + ip_set_printk("short LIST (want >=%zu, got %d)",
2778 + sizeof(struct ip_set_req_list), *len);
2779 + res = -EINVAL;
2780 + goto done;
2781 + }
2782 + index = req_list->index;
2783 + if (index != IP_SET_INVALID_ID
2784 + && ip_set_find_byindex(index) != index) {
2785 + res = -ENOENT;
2786 + goto done;
2787 + }
2788 + used = 0;
2789 + if (index == IP_SET_INVALID_ID) {
2790 + /* List all sets */
2791 + for (i = 0; i < ip_set_max && res == 0; i++) {
2792 + if (ip_set_list[i] != NULL)
2793 + res = ip_set_list_set(i, data, &used, *len);
2794 + }
2795 + } else {
2796 + /* List an individual set */
2797 + res = ip_set_list_set(index, data, &used, *len);
2798 + }
2799 + if (res != 0)
2800 + goto done;
2801 + else if (copylen != used) {
2802 + res = -EAGAIN;
2803 + goto done;
2804 + }
2805 + goto copy;
2806 + }
2807 + case IP_SET_OP_SAVE: {
2808 + struct ip_set_req_list *req_save
2809 + = (struct ip_set_req_list *) data;
2810 + ip_set_id_t i;
2811 + int used;
2812 +
2813 + if (*len < sizeof(struct ip_set_req_list)) {
2814 + ip_set_printk("short SAVE (want >=%zu, got %d)",
2815 + sizeof(struct ip_set_req_list), *len);
2816 + res = -EINVAL;
2817 + goto done;
2818 + }
2819 + index = req_save->index;
2820 + if (index != IP_SET_INVALID_ID
2821 + && ip_set_find_byindex(index) != index) {
2822 + res = -ENOENT;
2823 + goto done;
2824 + }
2825 + used = 0;
2826 + if (index == IP_SET_INVALID_ID) {
2827 + /* Save all sets */
2828 + for (i = 0; i < ip_set_max && res == 0; i++) {
2829 + if (ip_set_list[i] != NULL)
2830 + res = ip_set_save_set(i, data, &used, *len);
2831 + }
2832 + } else {
2833 + /* Save an individual set */
2834 + res = ip_set_save_set(index, data, &used, *len);
2835 + }
2836 + if (res == 0)
2837 + res = ip_set_save_bindings(index, data, &used, *len);
2838 +
2839 + if (res != 0)
2840 + goto done;
2841 + else if (copylen != used) {
2842 + res = -EAGAIN;
2843 + goto done;
2844 + }
2845 + goto copy;
2846 + }
2847 + case IP_SET_OP_RESTORE: {
2848 + struct ip_set_req_setnames *req_restore
2849 + = (struct ip_set_req_setnames *) data;
2850 + int line;
2851 +
2852 + if (*len < sizeof(struct ip_set_req_setnames)
2853 + || *len != req_restore->size) {
2854 + ip_set_printk("invalid RESTORE (want =%zu, got %d)",
2855 + req_restore->size, *len);
2856 + res = -EINVAL;
2857 + goto done;
2858 + }
2859 + line = ip_set_restore(data + sizeof(struct ip_set_req_setnames),
2860 + req_restore->size - sizeof(struct ip_set_req_setnames));
2861 + DP("ip_set_restore: %u", line);
2862 + if (line != 0) {
2863 + res = -EAGAIN;
2864 + req_restore->size = line;
2865 + copylen = sizeof(struct ip_set_req_setnames);
2866 + goto copy;
2867 + }
2868 + goto done;
2869 + }
2870 + default:
2871 + res = -EBADMSG;
2872 + goto done;
2873 + } /* end of switch(op) */
2874 +
2875 + copy:
2876 + DP("set %s, copylen %u", index != IP_SET_INVALID_ID
2877 + && ip_set_list[index]
2878 + ? ip_set_list[index]->name
2879 + : ":all:", copylen);
2880 + res = copy_to_user(user, data, copylen);
2881 +
2882 + done:
2883 + up(&ip_set_app_mutex);
2884 + vfree(data);
2885 + if (res > 0)
2886 + res = 0;
2887 + DP("final result %d", res);
2888 + return res;
2889 +}
2890 +
2891 +static struct nf_sockopt_ops so_set = {
2892 + .pf = PF_INET,
2893 + .set_optmin = SO_IP_SET,
2894 + .set_optmax = SO_IP_SET + 1,
2895 + .set = &ip_set_sockfn_set,
2896 + .get_optmin = SO_IP_SET,
2897 + .get_optmax = SO_IP_SET + 1,
2898 + .get = &ip_set_sockfn_get,
2899 + .use = 0
2900 +};
2901 +
2902 +static int max_sets, hash_size;
2903 +module_param(max_sets, int, 0600);
2904 +MODULE_PARM_DESC(max_sets, "maximal number of sets");
2905 +module_param(hash_size, int, 0600);
2906 +MODULE_PARM_DESC(hash_size, "hash size for bindings");
2907 +MODULE_LICENSE("GPL");
2908 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
2909 +MODULE_DESCRIPTION("module implementing core IP set support");
2910 +
2911 +static int __init init(void)
2912 +{
2913 + int res;
2914 + ip_set_id_t i;
2915 +
2916 + get_random_bytes(&ip_set_hash_random, 4);
2917 + if (max_sets)
2918 + ip_set_max = max_sets;
2919 + ip_set_list = vmalloc(sizeof(struct ip_set *) * ip_set_max);
2920 + if (!ip_set_list) {
2921 + printk(KERN_ERR "Unable to create ip_set_list\n");
2922 + return -ENOMEM;
2923 + }
2924 + memset(ip_set_list, 0, sizeof(struct ip_set *) * ip_set_max);
2925 + if (hash_size)
2926 + ip_set_bindings_hash_size = hash_size;
2927 + ip_set_hash = vmalloc(sizeof(struct list_head) * ip_set_bindings_hash_size);
2928 + if (!ip_set_hash) {
2929 + printk(KERN_ERR "Unable to create ip_set_hash\n");
2930 + vfree(ip_set_list);
2931 + return -ENOMEM;
2932 + }
2933 + for (i = 0; i < ip_set_bindings_hash_size; i++)
2934 + INIT_LIST_HEAD(&ip_set_hash[i]);
2935 +
2936 + INIT_LIST_HEAD(&set_type_list);
2937 +
2938 + res = nf_register_sockopt(&so_set);
2939 + if (res != 0) {
2940 + ip_set_printk("SO_SET registry failed: %d", res);
2941 + vfree(ip_set_list);
2942 + vfree(ip_set_hash);
2943 + return res;
2944 + }
2945 + return 0;
2946 +}
2947 +
2948 +static void __exit fini(void)
2949 +{
2950 + /* There can't be any existing set or binding */
2951 + nf_unregister_sockopt(&so_set);
2952 + vfree(ip_set_list);
2953 + vfree(ip_set_hash);
2954 + DP("these are the famous last words");
2955 +}
2956 +
2957 +EXPORT_SYMBOL(ip_set_register_set_type);
2958 +EXPORT_SYMBOL(ip_set_unregister_set_type);
2959 +
2960 +EXPORT_SYMBOL(ip_set_get_byname);
2961 +EXPORT_SYMBOL(ip_set_get_byindex);
2962 +EXPORT_SYMBOL(ip_set_put);
2963 +
2964 +EXPORT_SYMBOL(ip_set_addip_kernel);
2965 +EXPORT_SYMBOL(ip_set_delip_kernel);
2966 +EXPORT_SYMBOL(ip_set_testip_kernel);
2967 +
2968 +module_init(init);
2969 +module_exit(fini);
2970 Index: linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_iphash.c
2971 ===================================================================
2972 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
2973 +++ linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_iphash.c 2007-06-17 01:57:56.984987608 +0200
2974 @@ -0,0 +1,413 @@
2975 +/* Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
2976 + *
2977 + * This program is free software; you can redistribute it and/or modify
2978 + * it under the terms of the GNU General Public License version 2 as
2979 + * published by the Free Software Foundation.
2980 + */
2981 +
2982 +/* Kernel module implementing an ip hash set */
2983 +
2984 +#include <linux/module.h>
2985 +#include <linux/ip.h>
2986 +#include <linux/skbuff.h>
2987 +#include <linux/netfilter_ipv4/ip_tables.h>
2988 +#include <linux/netfilter_ipv4/ip_set.h>
2989 +#include <linux/errno.h>
2990 +#include <asm/uaccess.h>
2991 +#include <asm/bitops.h>
2992 +#include <linux/spinlock.h>
2993 +#include <linux/vmalloc.h>
2994 +#include <linux/random.h>
2995 +#include <linux/jhash.h>
2996 +
2997 +#include <net/ip.h>
2998 +
2999 +#include <linux/netfilter_ipv4/ip_set_malloc.h>
3000 +#include <linux/netfilter_ipv4/ip_set_iphash.h>
3001 +
3002 +static int limit = MAX_RANGE;
3003 +
3004 +static inline __u32
3005 +jhash_ip(const struct ip_set_iphash *map, uint16_t i, ip_set_ip_t ip)
3006 +{
3007 + return jhash_1word(ip, *(((uint32_t *) map->initval) + i));
3008 +}
3009 +
3010 +static inline __u32
3011 +hash_id(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3012 +{
3013 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3014 + __u32 id;
3015 + u_int16_t i;
3016 + ip_set_ip_t *elem;
3017 +
3018 + *hash_ip = ip & map->netmask;
3019 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u, %u.%u.%u.%u",
3020 + set->name, HIPQUAD(ip), HIPQUAD(*hash_ip), HIPQUAD(map->netmask));
3021 +
3022 + for (i = 0; i < map->probes; i++) {
3023 + id = jhash_ip(map, i, *hash_ip) % map->hashsize;
3024 + DP("hash key: %u", id);
3025 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
3026 + if (*elem == *hash_ip)
3027 + return id;
3028 + /* No shortcut at testing - there can be deleted
3029 + * entries. */
3030 + }
3031 + return UINT_MAX;
3032 +}
3033 +
3034 +static inline int
3035 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3036 +{
3037 + return (ip && hash_id(set, ip, hash_ip) != UINT_MAX);
3038 +}
3039 +
3040 +static int
3041 +testip(struct ip_set *set, const void *data, size_t size,
3042 + ip_set_ip_t *hash_ip)
3043 +{
3044 + struct ip_set_req_iphash *req =
3045 + (struct ip_set_req_iphash *) data;
3046 +
3047 + if (size != sizeof(struct ip_set_req_iphash)) {
3048 + ip_set_printk("data length wrong (want %zu, have %zu)",
3049 + sizeof(struct ip_set_req_iphash),
3050 + size);
3051 + return -EINVAL;
3052 + }
3053 + return __testip(set, req->ip, hash_ip);
3054 +}
3055 +
3056 +static int
3057 +testip_kernel(struct ip_set *set,
3058 + const struct sk_buff *skb,
3059 + ip_set_ip_t *hash_ip,
3060 + const u_int32_t *flags,
3061 + unsigned char index)
3062 +{
3063 + return __testip(set,
3064 + ntohl(flags[index] & IPSET_SRC
3065 + ? ip_hdr(skb)->saddr
3066 + : ip_hdr(skb)->daddr),
3067 + hash_ip);
3068 +}
3069 +
3070 +static inline int
3071 +__addip(struct ip_set_iphash *map, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3072 +{
3073 + __u32 probe;
3074 + u_int16_t i;
3075 + ip_set_ip_t *elem;
3076 +
3077 + if (!ip || map->elements > limit)
3078 + return -ERANGE;
3079 +
3080 + *hash_ip = ip & map->netmask;
3081 +
3082 + for (i = 0; i < map->probes; i++) {
3083 + probe = jhash_ip(map, i, *hash_ip) % map->hashsize;
3084 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, probe);
3085 + if (*elem == *hash_ip)
3086 + return -EEXIST;
3087 + if (!*elem) {
3088 + *elem = *hash_ip;
3089 + map->elements++;
3090 + return 0;
3091 + }
3092 + }
3093 + /* Trigger rehashing */
3094 + return -EAGAIN;
3095 +}
3096 +
3097 +static int
3098 +addip(struct ip_set *set, const void *data, size_t size,
3099 + ip_set_ip_t *hash_ip)
3100 +{
3101 + struct ip_set_req_iphash *req =
3102 + (struct ip_set_req_iphash *) data;
3103 +
3104 + if (size != sizeof(struct ip_set_req_iphash)) {
3105 + ip_set_printk("data length wrong (want %zu, have %zu)",
3106 + sizeof(struct ip_set_req_iphash),
3107 + size);
3108 + return -EINVAL;
3109 + }
3110 + return __addip((struct ip_set_iphash *) set->data, req->ip, hash_ip);
3111 +}
3112 +
3113 +static int
3114 +addip_kernel(struct ip_set *set,
3115 + const struct sk_buff *skb,
3116 + ip_set_ip_t *hash_ip,
3117 + const u_int32_t *flags,
3118 + unsigned char index)
3119 +{
3120 + return __addip((struct ip_set_iphash *) set->data,
3121 + ntohl(flags[index] & IPSET_SRC
3122 + ? ip_hdr(skb)->saddr
3123 + : ip_hdr(skb)->daddr),
3124 + hash_ip);
3125 +}
3126 +
3127 +static int retry(struct ip_set *set)
3128 +{
3129 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3130 + ip_set_ip_t hash_ip, *elem;
3131 + void *members;
3132 + u_int32_t i, hashsize = map->hashsize;
3133 + int res;
3134 + struct ip_set_iphash *tmp;
3135 +
3136 + if (map->resize == 0)
3137 + return -ERANGE;
3138 +
3139 + again:
3140 + res = 0;
3141 +
3142 + /* Calculate new hash size */
3143 + hashsize += (hashsize * map->resize)/100;
3144 + if (hashsize == map->hashsize)
3145 + hashsize++;
3146 +
3147 + ip_set_printk("rehashing of set %s triggered: "
3148 + "hashsize grows from %u to %u",
3149 + set->name, map->hashsize, hashsize);
3150 +
3151 + tmp = kmalloc(sizeof(struct ip_set_iphash)
3152 + + map->probes * sizeof(uint32_t), GFP_ATOMIC);
3153 + if (!tmp) {
3154 + DP("out of memory for %d bytes",
3155 + sizeof(struct ip_set_iphash)
3156 + + map->probes * sizeof(uint32_t));
3157 + return -ENOMEM;
3158 + }
3159 + tmp->members = harray_malloc(hashsize, sizeof(ip_set_ip_t), GFP_ATOMIC);
3160 + if (!tmp->members) {
3161 + DP("out of memory for %d bytes", hashsize * sizeof(ip_set_ip_t));
3162 + kfree(tmp);
3163 + return -ENOMEM;
3164 + }
3165 + tmp->hashsize = hashsize;
3166 + tmp->elements = 0;
3167 + tmp->probes = map->probes;
3168 + tmp->resize = map->resize;
3169 + tmp->netmask = map->netmask;
3170 + memcpy(tmp->initval, map->initval, map->probes * sizeof(uint32_t));
3171 +
3172 + write_lock_bh(&set->lock);
3173 + map = (struct ip_set_iphash *) set->data; /* Play safe */
3174 + for (i = 0; i < map->hashsize && res == 0; i++) {
3175 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, i);
3176 + if (*elem)
3177 + res = __addip(tmp, *elem, &hash_ip);
3178 + }
3179 + if (res) {
3180 + /* Failure, try again */
3181 + write_unlock_bh(&set->lock);
3182 + harray_free(tmp->members);
3183 + kfree(tmp);
3184 + goto again;
3185 + }
3186 +
3187 + /* Success at resizing! */
3188 + members = map->members;
3189 +
3190 + map->hashsize = tmp->hashsize;
3191 + map->members = tmp->members;
3192 + write_unlock_bh(&set->lock);
3193 +
3194 + harray_free(members);
3195 + kfree(tmp);
3196 +
3197 + return 0;
3198 +}
3199 +
3200 +static inline int
3201 +__delip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3202 +{
3203 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3204 + ip_set_ip_t id, *elem;
3205 +
3206 + if (!ip)
3207 + return -ERANGE;
3208 +
3209 + id = hash_id(set, ip, hash_ip);
3210 + if (id == UINT_MAX)
3211 + return -EEXIST;
3212 +
3213 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
3214 + *elem = 0;
3215 + map->elements--;
3216 +
3217 + return 0;
3218 +}
3219 +
3220 +static int
3221 +delip(struct ip_set *set, const void *data, size_t size,
3222 + ip_set_ip_t *hash_ip)
3223 +{
3224 + struct ip_set_req_iphash *req =
3225 + (struct ip_set_req_iphash *) data;
3226 +
3227 + if (size != sizeof(struct ip_set_req_iphash)) {
3228 + ip_set_printk("data length wrong (want %zu, have %zu)",
3229 + sizeof(struct ip_set_req_iphash),
3230 + size);
3231 + return -EINVAL;
3232 + }
3233 + return __delip(set, req->ip, hash_ip);
3234 +}
3235 +
3236 +static int
3237 +delip_kernel(struct ip_set *set,
3238 + const struct sk_buff *skb,
3239 + ip_set_ip_t *hash_ip,
3240 + const u_int32_t *flags,
3241 + unsigned char index)
3242 +{
3243 + return __delip(set,
3244 + ntohl(flags[index] & IPSET_SRC
3245 + ? ip_hdr(skb)->saddr
3246 + : ip_hdr(skb)->daddr),
3247 + hash_ip);
3248 +}
3249 +
3250 +static int create(struct ip_set *set, const void *data, size_t size)
3251 +{
3252 + struct ip_set_req_iphash_create *req =
3253 + (struct ip_set_req_iphash_create *) data;
3254 + struct ip_set_iphash *map;
3255 + uint16_t i;
3256 +
3257 + if (size != sizeof(struct ip_set_req_iphash_create)) {
3258 + ip_set_printk("data length wrong (want %zu, have %zu)",
3259 + sizeof(struct ip_set_req_iphash_create),
3260 + size);
3261 + return -EINVAL;
3262 + }
3263 +
3264 + if (req->hashsize < 1) {
3265 + ip_set_printk("hashsize too small");
3266 + return -ENOEXEC;
3267 + }
3268 +
3269 + if (req->probes < 1) {
3270 + ip_set_printk("probes too small");
3271 + return -ENOEXEC;
3272 + }
3273 +
3274 + map = kmalloc(sizeof(struct ip_set_iphash)
3275 + + req->probes * sizeof(uint32_t), GFP_KERNEL);
3276 + if (!map) {
3277 + DP("out of memory for %d bytes",
3278 + sizeof(struct ip_set_iphash)
3279 + + req->probes * sizeof(uint32_t));
3280 + return -ENOMEM;
3281 + }
3282 + for (i = 0; i < req->probes; i++)
3283 + get_random_bytes(((uint32_t *) map->initval)+i, 4);
3284 + map->elements = 0;
3285 + map->hashsize = req->hashsize;
3286 + map->probes = req->probes;
3287 + map->resize = req->resize;
3288 + map->netmask = req->netmask;
3289 + map->members = harray_malloc(map->hashsize, sizeof(ip_set_ip_t), GFP_KERNEL);
3290 + if (!map->members) {
3291 + DP("out of memory for %d bytes", map->hashsize * sizeof(ip_set_ip_t));
3292 + kfree(map);
3293 + return -ENOMEM;
3294 + }
3295 +
3296 + set->data = map;
3297 + return 0;
3298 +}
3299 +
3300 +static void destroy(struct ip_set *set)
3301 +{
3302 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3303 +
3304 + harray_free(map->members);
3305 + kfree(map);
3306 +
3307 + set->data = NULL;
3308 +}
3309 +
3310 +static void flush(struct ip_set *set)
3311 +{
3312 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3313 + harray_flush(map->members, map->hashsize, sizeof(ip_set_ip_t));
3314 + map->elements = 0;
3315 +}
3316 +
3317 +static void list_header(const struct ip_set *set, void *data)
3318 +{
3319 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3320 + struct ip_set_req_iphash_create *header =
3321 + (struct ip_set_req_iphash_create *) data;
3322 +
3323 + header->hashsize = map->hashsize;
3324 + header->probes = map->probes;
3325 + header->resize = map->resize;
3326 + header->netmask = map->netmask;
3327 +}
3328 +
3329 +static int list_members_size(const struct ip_set *set)
3330 +{
3331 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3332 +
3333 + return (map->hashsize * sizeof(ip_set_ip_t));
3334 +}
3335 +
3336 +static void list_members(const struct ip_set *set, void *data)
3337 +{
3338 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3339 + ip_set_ip_t i, *elem;
3340 +
3341 + for (i = 0; i < map->hashsize; i++) {
3342 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, i);
3343 + ((ip_set_ip_t *)data)[i] = *elem;
3344 + }
3345 +}
3346 +
3347 +static struct ip_set_type ip_set_iphash = {
3348 + .typename = SETTYPE_NAME,
3349 + .features = IPSET_TYPE_IP | IPSET_DATA_SINGLE,
3350 + .protocol_version = IP_SET_PROTOCOL_VERSION,
3351 + .create = &create,
3352 + .destroy = &destroy,
3353 + .flush = &flush,
3354 + .reqsize = sizeof(struct ip_set_req_iphash),
3355 + .addip = &addip,
3356 + .addip_kernel = &addip_kernel,
3357 + .retry = &retry,
3358 + .delip = &delip,
3359 + .delip_kernel = &delip_kernel,
3360 + .testip = &testip,
3361 + .testip_kernel = &testip_kernel,
3362 + .header_size = sizeof(struct ip_set_req_iphash_create),
3363 + .list_header = &list_header,
3364 + .list_members_size = &list_members_size,
3365 + .list_members = &list_members,
3366 + .me = THIS_MODULE,
3367 +};
3368 +
3369 +MODULE_LICENSE("GPL");
3370 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
3371 +MODULE_DESCRIPTION("iphash type of IP sets");
3372 +module_param(limit, int, 0600);
3373 +MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
3374 +
3375 +static int __init init(void)
3376 +{
3377 + return ip_set_register_set_type(&ip_set_iphash);
3378 +}
3379 +
3380 +static void __exit fini(void)
3381 +{
3382 + /* FIXME: possible race with ip_set_create() */
3383 + ip_set_unregister_set_type(&ip_set_iphash);
3384 +}
3385 +
3386 +module_init(init);
3387 +module_exit(fini);
3388 Index: linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_ipmap.c
3389 ===================================================================
3390 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
3391 +++ linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_ipmap.c 2007-06-17 01:57:56.985987456 +0200
3392 @@ -0,0 +1,327 @@
3393 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
3394 + * Patrick Schaaf <bof@bof.de>
3395 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
3396 + *
3397 + * This program is free software; you can redistribute it and/or modify
3398 + * it under the terms of the GNU General Public License version 2 as
3399 + * published by the Free Software Foundation.
3400 + */
3401 +
3402 +/* Kernel module implementing an IP set type: the single bitmap type */
3403 +
3404 +#include <linux/module.h>
3405 +#include <linux/ip.h>
3406 +#include <linux/skbuff.h>
3407 +#include <