projects / openwrt / svn-archive / archive.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
fix ipset compile with 2.6.22-rc4
[openwrt/svn-archive/archive.git] / target / linux / generic-2.6 / patches-2.6.22 / 130-netfilter-ipset.patch
1 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set.h
2 ===================================================================
3 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
4 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set.h 2007-06-17 01:56:58.435888424 +0200
5 @@ -0,0 +1,498 @@
6 +#ifndef _IP_SET_H
7 +#define _IP_SET_H
8 +
9 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
10 + * Patrick Schaaf <bof@bof.de>
11 + * Martin Josefsson <gandalf@wlug.westbo.se>
12 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 + *
14 + * This program is free software; you can redistribute it and/or modify
15 + * it under the terms of the GNU General Public License version 2 as
16 + * published by the Free Software Foundation.
17 + */
18 +
19 +#if 0
20 +#define IP_SET_DEBUG
21 +#endif
22 +
23 +/*
24 + * A sockopt of such quality has hardly ever been seen before on the open
25 + * market! This little beauty, hardly ever used: above 64, so it's
26 + * traditionally used for firewalling, not touched (even once!) by the
27 + * 2.0, 2.2 and 2.4 kernels!
28 + *
29 + * Comes with its own certificate of authenticity, valid anywhere in the
30 + * Free world!
31 + *
32 + * Rusty, 19.4.2000
33 + */
34 +#define SO_IP_SET 83
35 +
36 +/*
37 + * Heavily modify by Joakim Axelsson 08.03.2002
38 + * - Made it more modulebased
39 + *
40 + * Additional heavy modifications by Jozsef Kadlecsik 22.02.2004
41 + * - bindings added
42 + * - in order to "deal with" backward compatibility, renamed to ipset
43 + */
44 +
45 +/*
46 + * Used so that the kernel module and ipset-binary can match their versions
47 + */
48 +#define IP_SET_PROTOCOL_VERSION 2
49 +
50 +#define IP_SET_MAXNAMELEN 32 /* set names and set typenames */
51 +
52 +/* Lets work with our own typedef for representing an IP address.
53 + * We hope to make the code more portable, possibly to IPv6...
54 + *
55 + * The representation works in HOST byte order, because most set types
56 + * will perform arithmetic operations and compare operations.
57 + *
58 + * For now the type is an uint32_t.
59 + *
60 + * Make sure to ONLY use the functions when translating and parsing
61 + * in order to keep the host byte order and make it more portable:
62 + * parse_ip()
63 + * parse_mask()
64 + * parse_ipandmask()
65 + * ip_tostring()
66 + * (Joakim: where are they???)
67 + */
68 +
69 +typedef uint32_t ip_set_ip_t;
70 +
71 +/* Sets are identified by an id in kernel space. Tweak with ip_set_id_t
72 + * and IP_SET_INVALID_ID if you want to increase the max number of sets.
73 + */
74 +typedef uint16_t ip_set_id_t;
75 +
76 +#define IP_SET_INVALID_ID 65535
77 +
78 +/* How deep we follow bindings */
79 +#define IP_SET_MAX_BINDINGS 6
80 +
81 +/*
82 + * Option flags for kernel operations (ipt_set_info)
83 + */
84 +#define IPSET_SRC 0x01 /* Source match/add */
85 +#define IPSET_DST 0x02 /* Destination match/add */
86 +#define IPSET_MATCH_INV 0x04 /* Inverse matching */
87 +
88 +/*
89 + * Set features
90 + */
91 +#define IPSET_TYPE_IP 0x01 /* IP address type of set */
92 +#define IPSET_TYPE_PORT 0x02 /* Port type of set */
93 +#define IPSET_DATA_SINGLE 0x04 /* Single data storage */
94 +#define IPSET_DATA_DOUBLE 0x08 /* Double data storage */
95 +
96 +/* Reserved keywords */
97 +#define IPSET_TOKEN_DEFAULT ":default:"
98 +#define IPSET_TOKEN_ALL ":all:"
99 +
100 +/* SO_IP_SET operation constants, and their request struct types.
101 + *
102 + * Operation ids:
103 + * 0-99: commands with version checking
104 + * 100-199: add/del/test/bind/unbind
105 + * 200-299: list, save, restore
106 + */
107 +
108 +/* Single shot operations:
109 + * version, create, destroy, flush, rename and swap
110 + *
111 + * Sets are identified by name.
112 + */
113 +
114 +#define IP_SET_REQ_STD \
115 + unsigned op; \
116 + unsigned version; \
117 + char name[IP_SET_MAXNAMELEN]
118 +
119 +#define IP_SET_OP_CREATE 0x00000001 /* Create a new (empty) set */
120 +struct ip_set_req_create {
121 + IP_SET_REQ_STD;
122 + char typename[IP_SET_MAXNAMELEN];
123 +};
124 +
125 +#define IP_SET_OP_DESTROY 0x00000002 /* Remove a (empty) set */
126 +struct ip_set_req_std {
127 + IP_SET_REQ_STD;
128 +};
129 +
130 +#define IP_SET_OP_FLUSH 0x00000003 /* Remove all IPs in a set */
131 +/* Uses ip_set_req_std */
132 +
133 +#define IP_SET_OP_RENAME 0x00000004 /* Rename a set */
134 +/* Uses ip_set_req_create */
135 +
136 +#define IP_SET_OP_SWAP 0x00000005 /* Swap two sets */
137 +/* Uses ip_set_req_create */
138 +
139 +union ip_set_name_index {
140 + char name[IP_SET_MAXNAMELEN];
141 + ip_set_id_t index;
142 +};
143 +
144 +#define IP_SET_OP_GET_BYNAME 0x00000006 /* Get set index by name */
145 +struct ip_set_req_get_set {
146 + unsigned op;
147 + unsigned version;
148 + union ip_set_name_index set;
149 +};
150 +
151 +#define IP_SET_OP_GET_BYINDEX 0x00000007 /* Get set name by index */
152 +/* Uses ip_set_req_get_set */
153 +
154 +#define IP_SET_OP_VERSION 0x00000100 /* Ask kernel version */
155 +struct ip_set_req_version {
156 + unsigned op;
157 + unsigned version;
158 +};
159 +
160 +/* Double shots operations:
161 + * add, del, test, bind and unbind.
162 + *
163 + * First we query the kernel to get the index and type of the target set,
164 + * then issue the command. Validity of IP is checked in kernel in order
165 + * to minimalize sockopt operations.
166 + */
167 +
168 +/* Get minimal set data for add/del/test/bind/unbind IP */
169 +#define IP_SET_OP_ADT_GET 0x00000010 /* Get set and type */
170 +struct ip_set_req_adt_get {
171 + unsigned op;
172 + unsigned version;
173 + union ip_set_name_index set;
174 + char typename[IP_SET_MAXNAMELEN];
175 +};
176 +
177 +#define IP_SET_REQ_BYINDEX \
178 + unsigned op; \
179 + ip_set_id_t index;
180 +
181 +struct ip_set_req_adt {
182 + IP_SET_REQ_BYINDEX;
183 +};
184 +
185 +#define IP_SET_OP_ADD_IP 0x00000101 /* Add an IP to a set */
186 +/* Uses ip_set_req_adt, with type specific addage */
187 +
188 +#define IP_SET_OP_DEL_IP 0x00000102 /* Remove an IP from a set */
189 +/* Uses ip_set_req_adt, with type specific addage */
190 +
191 +#define IP_SET_OP_TEST_IP 0x00000103 /* Test an IP in a set */
192 +/* Uses ip_set_req_adt, with type specific addage */
193 +
194 +#define IP_SET_OP_BIND_SET 0x00000104 /* Bind an IP to a set */
195 +/* Uses ip_set_req_bind, with type specific addage */
196 +struct ip_set_req_bind {
197 + IP_SET_REQ_BYINDEX;
198 + char binding[IP_SET_MAXNAMELEN];
199 +};
200 +
201 +#define IP_SET_OP_UNBIND_SET 0x00000105 /* Unbind an IP from a set */
202 +/* Uses ip_set_req_bind, with type speficic addage
203 + * index = 0 means unbinding for all sets */
204 +
205 +#define IP_SET_OP_TEST_BIND_SET 0x00000106 /* Test binding an IP to a set */
206 +/* Uses ip_set_req_bind, with type specific addage */
207 +
208 +/* Multiple shots operations: list, save, restore.
209 + *
210 + * - check kernel version and query the max number of sets
211 + * - get the basic information on all sets
212 + * and size required for the next step
213 + * - get actual set data: header, data, bindings
214 + */
215 +
216 +/* Get max_sets and the index of a queried set
217 + */
218 +#define IP_SET_OP_MAX_SETS 0x00000020
219 +struct ip_set_req_max_sets {
220 + unsigned op;
221 + unsigned version;
222 + ip_set_id_t max_sets; /* max_sets */
223 + ip_set_id_t sets; /* real number of sets */
224 + union ip_set_name_index set; /* index of set if name used */
225 +};
226 +
227 +/* Get the id and name of the sets plus size for next step */
228 +#define IP_SET_OP_LIST_SIZE 0x00000201
229 +#define IP_SET_OP_SAVE_SIZE 0x00000202
230 +struct ip_set_req_setnames {
231 + unsigned op;
232 + ip_set_id_t index; /* set to list/save */
233 + size_t size; /* size to get setdata/bindings */
234 + /* followed by sets number of struct ip_set_name_list */
235 +};
236 +
237 +struct ip_set_name_list {
238 + char name[IP_SET_MAXNAMELEN];
239 + char typename[IP_SET_MAXNAMELEN];
240 + ip_set_id_t index;
241 + ip_set_id_t id;
242 +};
243 +
244 +/* The actual list operation */
245 +#define IP_SET_OP_LIST 0x00000203
246 +struct ip_set_req_list {
247 + IP_SET_REQ_BYINDEX;
248 + /* sets number of struct ip_set_list in reply */
249 +};
250 +
251 +struct ip_set_list {
252 + ip_set_id_t index;
253 + ip_set_id_t binding;
254 + u_int32_t ref;
255 + size_t header_size; /* Set header data of header_size */
256 + size_t members_size; /* Set members data of members_size */
257 + size_t bindings_size; /* Set bindings data of bindings_size */
258 +};
259 +
260 +struct ip_set_hash_list {
261 + ip_set_ip_t ip;
262 + ip_set_id_t binding;
263 +};
264 +
265 +/* The save operation */
266 +#define IP_SET_OP_SAVE 0x00000204
267 +/* Uses ip_set_req_list, in the reply replaced by
268 + * sets number of struct ip_set_save plus a marker
269 + * ip_set_save followed by ip_set_hash_save structures.
270 + */
271 +struct ip_set_save {
272 + ip_set_id_t index;
273 + ip_set_id_t binding;
274 + size_t header_size; /* Set header data of header_size */
275 + size_t members_size; /* Set members data of members_size */
276 +};
277 +
278 +/* At restoring, ip == 0 means default binding for the given set: */
279 +struct ip_set_hash_save {
280 + ip_set_ip_t ip;
281 + ip_set_id_t id;
282 + ip_set_id_t binding;
283 +};
284 +
285 +/* The restore operation */
286 +#define IP_SET_OP_RESTORE 0x00000205
287 +/* Uses ip_set_req_setnames followed by ip_set_restore structures
288 + * plus a marker ip_set_restore, followed by ip_set_hash_save
289 + * structures.
290 + */
291 +struct ip_set_restore {
292 + char name[IP_SET_MAXNAMELEN];
293 + char typename[IP_SET_MAXNAMELEN];
294 + ip_set_id_t index;
295 + size_t header_size; /* Create data of header_size */
296 + size_t members_size; /* Set members data of members_size */
297 +};
298 +
299 +static inline int bitmap_bytes(ip_set_ip_t a, ip_set_ip_t b)
300 +{
301 + return 4 * ((((b - a + 8) / 8) + 3) / 4);
302 +}
303 +
304 +#ifdef __KERNEL__
305 +
306 +#define ip_set_printk(format, args...) \
307 + do { \
308 + printk("%s: %s: ", __FILE__, __FUNCTION__); \
309 + printk(format "\n" , ## args); \
310 + } while (0)
311 +
312 +#if defined(IP_SET_DEBUG)
313 +#define DP(format, args...) \
314 + do { \
315 + printk("%s: %s (DBG): ", __FILE__, __FUNCTION__);\
316 + printk(format "\n" , ## args); \
317 + } while (0)
318 +#define IP_SET_ASSERT(x) \
319 + do { \
320 + if (!(x)) \
321 + printk("IP_SET_ASSERT: %s:%i(%s)\n", \
322 + __FILE__, __LINE__, __FUNCTION__); \
323 + } while (0)
324 +#else
325 +#define DP(format, args...)
326 +#define IP_SET_ASSERT(x)
327 +#endif
328 +
329 +struct ip_set;
330 +
331 +/*
332 + * The ip_set_type definition - one per set type, e.g. "ipmap".
333 + *
334 + * Each individual set has a pointer, set->type, going to one
335 + * of these structures. Function pointers inside the structure implement
336 + * the real behaviour of the sets.
337 + *
338 + * If not mentioned differently, the implementation behind the function
339 + * pointers of a set_type, is expected to return 0 if ok, and a negative
340 + * errno (e.g. -EINVAL) on error.
341 + */
342 +struct ip_set_type {
343 + struct list_head list; /* next in list of set types */
344 +
345 + /* test for IP in set (kernel: iptables -m set src|dst)
346 + * return 0 if not in set, 1 if in set.
347 + */
348 + int (*testip_kernel) (struct ip_set *set,
349 + const struct sk_buff * skb,
350 + ip_set_ip_t *ip,
351 + const u_int32_t *flags,
352 + unsigned char index);
353 +
354 + /* test for IP in set (userspace: ipset -T set IP)
355 + * return 0 if not in set, 1 if in set.
356 + */
357 + int (*testip) (struct ip_set *set,
358 + const void *data, size_t size,
359 + ip_set_ip_t *ip);
360 +
361 + /*
362 + * Size of the data structure passed by when
363 + * adding/deletin/testing an entry.
364 + */
365 + size_t reqsize;
366 +
367 + /* Add IP into set (userspace: ipset -A set IP)
368 + * Return -EEXIST if the address is already in the set,
369 + * and -ERANGE if the address lies outside the set bounds.
370 + * If the address was not already in the set, 0 is returned.
371 + */
372 + int (*addip) (struct ip_set *set,
373 + const void *data, size_t size,
374 + ip_set_ip_t *ip);
375 +
376 + /* Add IP into set (kernel: iptables ... -j SET set src|dst)
377 + * Return -EEXIST if the address is already in the set,
378 + * and -ERANGE if the address lies outside the set bounds.
379 + * If the address was not already in the set, 0 is returned.
380 + */
381 + int (*addip_kernel) (struct ip_set *set,
382 + const struct sk_buff * skb,
383 + ip_set_ip_t *ip,
384 + const u_int32_t *flags,
385 + unsigned char index);
386 +
387 + /* remove IP from set (userspace: ipset -D set --entry x)
388 + * Return -EEXIST if the address is NOT in the set,
389 + * and -ERANGE if the address lies outside the set bounds.
390 + * If the address really was in the set, 0 is returned.
391 + */
392 + int (*delip) (struct ip_set *set,
393 + const void *data, size_t size,
394 + ip_set_ip_t *ip);
395 +
396 + /* remove IP from set (kernel: iptables ... -j SET --entry x)
397 + * Return -EEXIST if the address is NOT in the set,
398 + * and -ERANGE if the address lies outside the set bounds.
399 + * If the address really was in the set, 0 is returned.
400 + */
401 + int (*delip_kernel) (struct ip_set *set,
402 + const struct sk_buff * skb,
403 + ip_set_ip_t *ip,
404 + const u_int32_t *flags,
405 + unsigned char index);
406 +
407 + /* new set creation - allocated type specific items
408 + */
409 + int (*create) (struct ip_set *set,
410 + const void *data, size_t size);
411 +
412 + /* retry the operation after successfully tweaking the set
413 + */
414 + int (*retry) (struct ip_set *set);
415 +
416 + /* set destruction - free type specific items
417 + * There is no return value.
418 + * Can be called only when child sets are destroyed.
419 + */
420 + void (*destroy) (struct ip_set *set);
421 +
422 + /* set flushing - reset all bits in the set, or something similar.
423 + * There is no return value.
424 + */
425 + void (*flush) (struct ip_set *set);
426 +
427 + /* Listing: size needed for header
428 + */
429 + size_t header_size;
430 +
431 + /* Listing: Get the header
432 + *
433 + * Fill in the information in "data".
434 + * This function is always run after list_header_size() under a
435 + * writelock on the set. Therefor is the length of "data" always
436 + * correct.
437 + */
438 + void (*list_header) (const struct ip_set *set,
439 + void *data);
440 +
441 + /* Listing: Get the size for the set members
442 + */
443 + int (*list_members_size) (const struct ip_set *set);
444 +
445 + /* Listing: Get the set members
446 + *
447 + * Fill in the information in "data".
448 + * This function is always run after list_member_size() under a
449 + * writelock on the set. Therefor is the length of "data" always
450 + * correct.
451 + */
452 + void (*list_members) (const struct ip_set *set,
453 + void *data);
454 +
455 + char typename[IP_SET_MAXNAMELEN];
456 + unsigned char features;
457 + int protocol_version;
458 +
459 + /* Set this to THIS_MODULE if you are a module, otherwise NULL */
460 + struct module *me;
461 +};
462 +
463 +extern int ip_set_register_set_type(struct ip_set_type *set_type);
464 +extern void ip_set_unregister_set_type(struct ip_set_type *set_type);
465 +
466 +/* A generic ipset */
467 +struct ip_set {
468 + char name[IP_SET_MAXNAMELEN]; /* the name of the set */
469 + rwlock_t lock; /* lock for concurrency control */
470 + ip_set_id_t id; /* set id for swapping */
471 + ip_set_id_t binding; /* default binding for the set */
472 + atomic_t ref; /* in kernel and in hash references */
473 + struct ip_set_type *type; /* the set types */
474 + void *data; /* pooltype specific data */
475 +};
476 +
477 +/* Structure to bind set elements to sets */
478 +struct ip_set_hash {
479 + struct list_head list; /* list of clashing entries in hash */
480 + ip_set_ip_t ip; /* ip from set */
481 + ip_set_id_t id; /* set id */
482 + ip_set_id_t binding; /* set we bind the element to */
483 +};
484 +
485 +/* register and unregister set references */
486 +extern ip_set_id_t ip_set_get_byname(const char name[IP_SET_MAXNAMELEN]);
487 +extern ip_set_id_t ip_set_get_byindex(ip_set_id_t id);
488 +extern void ip_set_put(ip_set_id_t id);
489 +
490 +/* API for iptables set match, and SET target */
491 +extern void ip_set_addip_kernel(ip_set_id_t id,
492 + const struct sk_buff *skb,
493 + const u_int32_t *flags);
494 +extern void ip_set_delip_kernel(ip_set_id_t id,
495 + const struct sk_buff *skb,
496 + const u_int32_t *flags);
497 +extern int ip_set_testip_kernel(ip_set_id_t id,
498 + const struct sk_buff *skb,
499 + const u_int32_t *flags);
500 +
501 +#endif /* __KERNEL__ */
502 +
503 +#endif /*_IP_SET_H*/
504 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_iphash.h
505 ===================================================================
506 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
507 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_iphash.h 2007-06-17 01:56:58.435888424 +0200
508 @@ -0,0 +1,30 @@
509 +#ifndef __IP_SET_IPHASH_H
510 +#define __IP_SET_IPHASH_H
511 +
512 +#include <linux/netfilter_ipv4/ip_set.h>
513 +
514 +#define SETTYPE_NAME "iphash"
515 +#define MAX_RANGE 0x0000FFFF
516 +
517 +struct ip_set_iphash {
518 + ip_set_ip_t *members; /* the iphash proper */
519 + uint32_t elements; /* number of elements */
520 + uint32_t hashsize; /* hash size */
521 + uint16_t probes; /* max number of probes */
522 + uint16_t resize; /* resize factor in percent */
523 + ip_set_ip_t netmask; /* netmask */
524 + void *initval[0]; /* initvals for jhash_1word */
525 +};
526 +
527 +struct ip_set_req_iphash_create {
528 + uint32_t hashsize;
529 + uint16_t probes;
530 + uint16_t resize;
531 + ip_set_ip_t netmask;
532 +};
533 +
534 +struct ip_set_req_iphash {
535 + ip_set_ip_t ip;
536 +};
537 +
538 +#endif /* __IP_SET_IPHASH_H */
539 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_ipmap.h
540 ===================================================================
541 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
542 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_ipmap.h 2007-06-17 01:56:58.436888272 +0200
543 @@ -0,0 +1,56 @@
544 +#ifndef __IP_SET_IPMAP_H
545 +#define __IP_SET_IPMAP_H
546 +
547 +#include <linux/netfilter_ipv4/ip_set.h>
548 +
549 +#define SETTYPE_NAME "ipmap"
550 +#define MAX_RANGE 0x0000FFFF
551 +
552 +struct ip_set_ipmap {
553 + void *members; /* the ipmap proper */
554 + ip_set_ip_t first_ip; /* host byte order, included in range */
555 + ip_set_ip_t last_ip; /* host byte order, included in range */
556 + ip_set_ip_t netmask; /* subnet netmask */
557 + ip_set_ip_t sizeid; /* size of set in IPs */
558 + ip_set_ip_t hosts; /* number of hosts in a subnet */
559 +};
560 +
561 +struct ip_set_req_ipmap_create {
562 + ip_set_ip_t from;
563 + ip_set_ip_t to;
564 + ip_set_ip_t netmask;
565 +};
566 +
567 +struct ip_set_req_ipmap {
568 + ip_set_ip_t ip;
569 +};
570 +
571 +unsigned int
572 +mask_to_bits(ip_set_ip_t mask)
573 +{
574 + unsigned int bits = 32;
575 + ip_set_ip_t maskaddr;
576 +
577 + if (mask == 0xFFFFFFFF)
578 + return bits;
579 +
580 + maskaddr = 0xFFFFFFFE;
581 + while (--bits >= 0 && maskaddr != mask)
582 + maskaddr <<= 1;
583 +
584 + return bits;
585 +}
586 +
587 +ip_set_ip_t
588 +range_to_mask(ip_set_ip_t from, ip_set_ip_t to, unsigned int *bits)
589 +{
590 + ip_set_ip_t mask = 0xFFFFFFFE;
591 +
592 + *bits = 32;
593 + while (--(*bits) >= 0 && mask && (to & mask) != from)
594 + mask <<= 1;
595 +
596 + return mask;
597 +}
598 +
599 +#endif /* __IP_SET_IPMAP_H */
600 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_ipporthash.h
601 ===================================================================
602 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
603 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_ipporthash.h 2007-06-17 01:56:58.436888272 +0200
604 @@ -0,0 +1,34 @@
605 +#ifndef __IP_SET_IPPORTHASH_H
606 +#define __IP_SET_IPPORTHASH_H
607 +
608 +#include <linux/netfilter_ipv4/ip_set.h>
609 +
610 +#define SETTYPE_NAME "ipporthash"
611 +#define MAX_RANGE 0x0000FFFF
612 +#define INVALID_PORT (MAX_RANGE + 1)
613 +
614 +struct ip_set_ipporthash {
615 + ip_set_ip_t *members; /* the ipporthash proper */
616 + uint32_t elements; /* number of elements */
617 + uint32_t hashsize; /* hash size */
618 + uint16_t probes; /* max number of probes */
619 + uint16_t resize; /* resize factor in percent */
620 + ip_set_ip_t first_ip; /* host byte order, included in range */
621 + ip_set_ip_t last_ip; /* host byte order, included in range */
622 + void *initval[0]; /* initvals for jhash_1word */
623 +};
624 +
625 +struct ip_set_req_ipporthash_create {
626 + uint32_t hashsize;
627 + uint16_t probes;
628 + uint16_t resize;
629 + ip_set_ip_t from;
630 + ip_set_ip_t to;
631 +};
632 +
633 +struct ip_set_req_ipporthash {
634 + ip_set_ip_t ip;
635 + ip_set_ip_t port;
636 +};
637 +
638 +#endif /* __IP_SET_IPPORTHASH_H */
639 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_iptree.h
640 ===================================================================
641 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
642 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_iptree.h 2007-06-17 01:56:58.436888272 +0200
643 @@ -0,0 +1,40 @@
644 +#ifndef __IP_SET_IPTREE_H
645 +#define __IP_SET_IPTREE_H
646 +
647 +#include <linux/netfilter_ipv4/ip_set.h>
648 +
649 +#define SETTYPE_NAME "iptree"
650 +#define MAX_RANGE 0x0000FFFF
651 +
652 +struct ip_set_iptreed {
653 + unsigned long expires[256]; /* x.x.x.ADDR */
654 +};
655 +
656 +struct ip_set_iptreec {
657 + struct ip_set_iptreed *tree[256]; /* x.x.ADDR.* */
658 +};
659 +
660 +struct ip_set_iptreeb {
661 + struct ip_set_iptreec *tree[256]; /* x.ADDR.*.* */
662 +};
663 +
664 +struct ip_set_iptree {
665 + unsigned int timeout;
666 + unsigned int gc_interval;
667 +#ifdef __KERNEL__
668 + uint32_t elements; /* number of elements */
669 + struct timer_list gc;
670 + struct ip_set_iptreeb *tree[256]; /* ADDR.*.*.* */
671 +#endif
672 +};
673 +
674 +struct ip_set_req_iptree_create {
675 + unsigned int timeout;
676 +};
677 +
678 +struct ip_set_req_iptree {
679 + ip_set_ip_t ip;
680 + unsigned int timeout;
681 +};
682 +
683 +#endif /* __IP_SET_IPTREE_H */
684 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_macipmap.h
685 ===================================================================
686 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
687 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_macipmap.h 2007-06-17 01:56:58.437888120 +0200
688 @@ -0,0 +1,38 @@
689 +#ifndef __IP_SET_MACIPMAP_H
690 +#define __IP_SET_MACIPMAP_H
691 +
692 +#include <linux/netfilter_ipv4/ip_set.h>
693 +
694 +#define SETTYPE_NAME "macipmap"
695 +#define MAX_RANGE 0x0000FFFF
696 +
697 +/* general flags */
698 +#define IPSET_MACIP_MATCHUNSET 1
699 +
700 +/* per ip flags */
701 +#define IPSET_MACIP_ISSET 1
702 +
703 +struct ip_set_macipmap {
704 + void *members; /* the macipmap proper */
705 + ip_set_ip_t first_ip; /* host byte order, included in range */
706 + ip_set_ip_t last_ip; /* host byte order, included in range */
707 + u_int32_t flags;
708 +};
709 +
710 +struct ip_set_req_macipmap_create {
711 + ip_set_ip_t from;
712 + ip_set_ip_t to;
713 + u_int32_t flags;
714 +};
715 +
716 +struct ip_set_req_macipmap {
717 + ip_set_ip_t ip;
718 + unsigned char ethernet[ETH_ALEN];
719 +};
720 +
721 +struct ip_set_macip {
722 + unsigned short flags;
723 + unsigned char ethernet[ETH_ALEN];
724 +};
725 +
726 +#endif /* __IP_SET_MACIPMAP_H */
727 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_malloc.h
728 ===================================================================
729 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
730 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_malloc.h 2007-06-17 01:56:58.437888120 +0200
731 @@ -0,0 +1,116 @@
732 +#ifndef _IP_SET_MALLOC_H
733 +#define _IP_SET_MALLOC_H
734 +
735 +#ifdef __KERNEL__
736 +
737 +/* Memory allocation and deallocation */
738 +static size_t max_malloc_size = 0;
739 +
740 +static inline void init_max_malloc_size(void)
741 +{
742 +#define CACHE(x) max_malloc_size = x;
743 +#include <linux/kmalloc_sizes.h>
744 +#undef CACHE
745 +}
746 +
747 +static inline void * ip_set_malloc(size_t bytes)
748 +{
749 + if (bytes > max_malloc_size)
750 + return vmalloc(bytes);
751 + else
752 + return kmalloc(bytes, GFP_KERNEL);
753 +}
754 +
755 +static inline void ip_set_free(void * data, size_t bytes)
756 +{
757 + if (bytes > max_malloc_size)
758 + vfree(data);
759 + else
760 + kfree(data);
761 +}
762 +
763 +struct harray {
764 + size_t max_elements;
765 + void *arrays[0];
766 +};
767 +
768 +static inline void *
769 +harray_malloc(size_t hashsize, size_t typesize, int flags)
770 +{
771 + struct harray *harray;
772 + size_t max_elements, size, i, j;
773 +
774 + if (!max_malloc_size)
775 + init_max_malloc_size();
776 +
777 + if (typesize > max_malloc_size)
778 + return NULL;
779 +
780 + max_elements = max_malloc_size/typesize;
781 + size = hashsize/max_elements;
782 + if (hashsize % max_elements)
783 + size++;
784 +
785 + /* Last pointer signals end of arrays */
786 + harray = kmalloc(sizeof(struct harray) + (size + 1) * sizeof(void *),
787 + flags);
788 +
789 + if (!harray)
790 + return NULL;
791 +
792 + for (i = 0; i < size - 1; i++) {
793 + harray->arrays[i] = kmalloc(max_elements * typesize, flags);
794 + if (!harray->arrays[i])
795 + goto undo;
796 + memset(harray->arrays[i], 0, max_elements * typesize);
797 + }
798 + harray->arrays[i] = kmalloc((hashsize - i * max_elements) * typesize,
799 + flags);
800 + if (!harray->arrays[i])
801 + goto undo;
802 + memset(harray->arrays[i], 0, (hashsize - i * max_elements) * typesize);
803 +
804 + harray->max_elements = max_elements;
805 + harray->arrays[size] = NULL;
806 +
807 + return (void *)harray;
808 +
809 + undo:
810 + for (j = 0; j < i; j++) {
811 + kfree(harray->arrays[j]);
812 + }
813 + kfree(harray);
814 + return NULL;
815 +}
816 +
817 +static inline void harray_free(void *h)
818 +{
819 + struct harray *harray = (struct harray *) h;
820 + size_t i;
821 +
822 + for (i = 0; harray->arrays[i] != NULL; i++)
823 + kfree(harray->arrays[i]);
824 + kfree(harray);
825 +}
826 +
827 +static inline void harray_flush(void *h, size_t hashsize, size_t typesize)
828 +{
829 + struct harray *harray = (struct harray *) h;
830 + size_t i;
831 +
832 + for (i = 0; harray->arrays[i+1] != NULL; i++)
833 + memset(harray->arrays[i], 0, harray->max_elements * typesize);
834 + memset(harray->arrays[i], 0,
835 + (hashsize - i * harray->max_elements) * typesize);
836 +}
837 +
838 +#define HARRAY_ELEM(h, type, which) \
839 +({ \
840 + struct harray *__h = (struct harray *)(h); \
841 + ((type)((__h)->arrays[(which)/(__h)->max_elements]) \
842 + + (which)%(__h)->max_elements); \
843 +})
844 +
845 +#endif /* __KERNEL__ */
846 +
847 +#endif /*_IP_SET_MALLOC_H*/
848 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_nethash.h
849 ===================================================================
850 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
851 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_nethash.h 2007-06-17 01:56:58.437888120 +0200
852 @@ -0,0 +1,55 @@
853 +#ifndef __IP_SET_NETHASH_H
854 +#define __IP_SET_NETHASH_H
855 +
856 +#include <linux/netfilter_ipv4/ip_set.h>
857 +
858 +#define SETTYPE_NAME "nethash"
859 +#define MAX_RANGE 0x0000FFFF
860 +
861 +struct ip_set_nethash {
862 + ip_set_ip_t *members; /* the nethash proper */
863 + uint32_t elements; /* number of elements */
864 + uint32_t hashsize; /* hash size */
865 + uint16_t probes; /* max number of probes */
866 + uint16_t resize; /* resize factor in percent */
867 + unsigned char cidr[30]; /* CIDR sizes */
868 + void *initval[0]; /* initvals for jhash_1word */
869 +};
870 +
871 +struct ip_set_req_nethash_create {
872 + uint32_t hashsize;
873 + uint16_t probes;
874 + uint16_t resize;
875 +};
876 +
877 +struct ip_set_req_nethash {
878 + ip_set_ip_t ip;
879 + unsigned char cidr;
880 +};
881 +
882 +static unsigned char shifts[] = {255, 253, 249, 241, 225, 193, 129, 1};
883 +
884 +static inline ip_set_ip_t
885 +pack(ip_set_ip_t ip, unsigned char cidr)
886 +{
887 + ip_set_ip_t addr, *paddr = &addr;
888 + unsigned char n, t, *a;
889 +
890 + addr = htonl(ip & (0xFFFFFFFF << (32 - (cidr))));
891 +#ifdef __KERNEL__
892 + DP("ip:%u.%u.%u.%u/%u", NIPQUAD(addr), cidr);
893 +#endif
894 + n = cidr / 8;
895 + t = cidr % 8;
896 + a = &((unsigned char *)paddr)[n];
897 + *a = *a /(1 << (8 - t)) + shifts[t];
898 +#ifdef __KERNEL__
899 + DP("n: %u, t: %u, a: %u", n, t, *a);
900 + DP("ip:%u.%u.%u.%u/%u, %u.%u.%u.%u",
901 + HIPQUAD(ip), cidr, NIPQUAD(addr));
902 +#endif
903 +
904 + return ntohl(addr);
905 +}
906 +
907 +#endif /* __IP_SET_NETHASH_H */
908 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_portmap.h
909 ===================================================================
910 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
911 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ip_set_portmap.h 2007-06-17 01:56:58.437888120 +0200
912 @@ -0,0 +1,25 @@
913 +#ifndef __IP_SET_PORTMAP_H
914 +#define __IP_SET_PORTMAP_H
915 +
916 +#include <linux/netfilter_ipv4/ip_set.h>
917 +
918 +#define SETTYPE_NAME "portmap"
919 +#define MAX_RANGE 0x0000FFFF
920 +#define INVALID_PORT (MAX_RANGE + 1)
921 +
922 +struct ip_set_portmap {
923 + void *members; /* the portmap proper */
924 + ip_set_ip_t first_port; /* host byte order, included in range */
925 + ip_set_ip_t last_port; /* host byte order, included in range */
926 +};
927 +
928 +struct ip_set_req_portmap_create {
929 + ip_set_ip_t from;
930 + ip_set_ip_t to;
931 +};
932 +
933 +struct ip_set_req_portmap {
934 + ip_set_ip_t port;
935 +};
936 +
937 +#endif /* __IP_SET_PORTMAP_H */
938 Index: linux-2.6.22-rc4/include/linux/netfilter_ipv4/ipt_set.h
939 ===================================================================
940 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
941 +++ linux-2.6.22-rc4/include/linux/netfilter_ipv4/ipt_set.h 2007-06-17 01:56:58.437888120 +0200
942 @@ -0,0 +1,21 @@
943 +#ifndef _IPT_SET_H
944 +#define _IPT_SET_H
945 +
946 +#include <linux/netfilter_ipv4/ip_set.h>
947 +
948 +struct ipt_set_info {
949 + ip_set_id_t index;
950 + u_int32_t flags[IP_SET_MAX_BINDINGS + 1];
951 +};
952 +
953 +/* match info */
954 +struct ipt_set_info_match {
955 + struct ipt_set_info match_set;
956 +};
957 +
958 +struct ipt_set_info_target {
959 + struct ipt_set_info add_set;
960 + struct ipt_set_info del_set;
961 +};
962 +
963 +#endif /*_IPT_SET_H*/
964 Index: linux-2.6.22-rc4/net/ipv4/netfilter/ip_set.c
965 ===================================================================
966 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
967 +++ linux-2.6.22-rc4/net/ipv4/netfilter/ip_set.c 2007-06-17 01:56:58.439887816 +0200
968 @@ -0,0 +1,2001 @@
969 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
970 + * Patrick Schaaf <bof@bof.de>
971 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
972 + *
973 + * This program is free software; you can redistribute it and/or modify
974 + * it under the terms of the GNU General Public License version 2 as
975 + * published by the Free Software Foundation.
976 + */
977 +
978 +/* Kernel module for IP set management */
979 +
980 +#include <linux/version.h>
981 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
982 +#include <linux/config.h>
983 +#endif
984 +#include <linux/module.h>
985 +#include <linux/moduleparam.h>
986 +#include <linux/kmod.h>
987 +#include <linux/ip.h>
988 +#include <linux/skbuff.h>
989 +#include <linux/random.h>
990 +#include <linux/jhash.h>
991 +#include <linux/netfilter_ipv4/ip_tables.h>
992 +#include <linux/errno.h>
993 +#include <asm/uaccess.h>
994 +#include <asm/bitops.h>
995 +#include <asm/semaphore.h>
996 +#include <linux/spinlock.h>
997 +#include <linux/vmalloc.h>
998 +
999 +#define ASSERT_READ_LOCK(x)
1000 +#define ASSERT_WRITE_LOCK(x)
1001 +#include <linux/netfilter_ipv4/ip_set.h>
1002 +
1003 +static struct list_head set_type_list; /* all registered sets */
1004 +static struct ip_set **ip_set_list; /* all individual sets */
1005 +static DEFINE_RWLOCK(ip_set_lock); /* protects the lists and the hash */
1006 +static DECLARE_MUTEX(ip_set_app_mutex); /* serializes user access */
1007 +static ip_set_id_t ip_set_max = CONFIG_IP_NF_SET_MAX;
1008 +static ip_set_id_t ip_set_bindings_hash_size = CONFIG_IP_NF_SET_HASHSIZE;
1009 +static struct list_head *ip_set_hash; /* hash of bindings */
1010 +static unsigned int ip_set_hash_random; /* random seed */
1011 +
1012 +/*
1013 + * Sets are identified either by the index in ip_set_list or by id.
1014 + * The id never changes and is used to find a key in the hash.
1015 + * The index may change by swapping and used at all other places
1016 + * (set/SET netfilter modules, binding value, etc.)
1017 + *
1018 + * Userspace requests are serialized by ip_set_mutex and sets can
1019 + * be deleted only from userspace. Therefore ip_set_list locking
1020 + * must obey the following rules:
1021 + *
1022 + * - kernel requests: read and write locking mandatory
1023 + * - user requests: read locking optional, write locking mandatory
1024 + */
1025 +
1026 +static inline void
1027 +__ip_set_get(ip_set_id_t index)
1028 +{
1029 + atomic_inc(&ip_set_list[index]->ref);
1030 +}
1031 +
1032 +static inline void
1033 +__ip_set_put(ip_set_id_t index)
1034 +{
1035 + atomic_dec(&ip_set_list[index]->ref);
1036 +}
1037 +
1038 +/*
1039 + * Binding routines
1040 + */
1041 +
1042 +static inline struct ip_set_hash *
1043 +__ip_set_find(u_int32_t key, ip_set_id_t id, ip_set_ip_t ip)
1044 +{
1045 + struct ip_set_hash *set_hash;
1046 +
1047 + list_for_each_entry(set_hash, &ip_set_hash[key], list)
1048 + if (set_hash->id == id && set_hash->ip == ip)
1049 + return set_hash;
1050 +
1051 + return NULL;
1052 +}
1053 +
1054 +static ip_set_id_t
1055 +ip_set_find_in_hash(ip_set_id_t id, ip_set_ip_t ip)
1056 +{
1057 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
1058 + % ip_set_bindings_hash_size;
1059 + struct ip_set_hash *set_hash;
1060 +
1061 + ASSERT_READ_LOCK(&ip_set_lock);
1062 + IP_SET_ASSERT(ip_set_list[id]);
1063 + DP("set: %s, ip: %u.%u.%u.%u", ip_set_list[id]->name, HIPQUAD(ip));
1064 +
1065 + set_hash = __ip_set_find(key, id, ip);
1066 +
1067 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
1068 + HIPQUAD(ip),
1069 + set_hash != NULL ? ip_set_list[set_hash->binding]->name : "");
1070 +
1071 + return (set_hash != NULL ? set_hash->binding : IP_SET_INVALID_ID);
1072 +}
1073 +
1074 +static inline void
1075 +__set_hash_del(struct ip_set_hash *set_hash)
1076 +{
1077 + ASSERT_WRITE_LOCK(&ip_set_lock);
1078 + IP_SET_ASSERT(ip_set_list[set_hash->binding]);
1079 +
1080 + __ip_set_put(set_hash->binding);
1081 + list_del(&set_hash->list);
1082 + kfree(set_hash);
1083 +}
1084 +
1085 +static int
1086 +ip_set_hash_del(ip_set_id_t id, ip_set_ip_t ip)
1087 +{
1088 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
1089 + % ip_set_bindings_hash_size;
1090 + struct ip_set_hash *set_hash;
1091 +
1092 + IP_SET_ASSERT(ip_set_list[id]);
1093 + DP("set: %s, ip: %u.%u.%u.%u", ip_set_list[id]->name, HIPQUAD(ip));
1094 + write_lock_bh(&ip_set_lock);
1095 + set_hash = __ip_set_find(key, id, ip);
1096 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
1097 + HIPQUAD(ip),
1098 + set_hash != NULL ? ip_set_list[set_hash->binding]->name : "");
1099 +
1100 + if (set_hash != NULL)
1101 + __set_hash_del(set_hash);
1102 + write_unlock_bh(&ip_set_lock);
1103 + return 0;
1104 +}
1105 +
1106 +static int
1107 +ip_set_hash_add(ip_set_id_t id, ip_set_ip_t ip, ip_set_id_t binding)
1108 +{
1109 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
1110 + % ip_set_bindings_hash_size;
1111 + struct ip_set_hash *set_hash;
1112 + int ret = 0;
1113 +
1114 + IP_SET_ASSERT(ip_set_list[id]);
1115 + IP_SET_ASSERT(ip_set_list[binding]);
1116 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
1117 + HIPQUAD(ip), ip_set_list[binding]->name);
1118 + write_lock_bh(&ip_set_lock);
1119 + set_hash = __ip_set_find(key, id, ip);
1120 + if (!set_hash) {
1121 + set_hash = kmalloc(sizeof(struct ip_set_hash), GFP_ATOMIC);
1122 + if (!set_hash) {
1123 + ret = -ENOMEM;
1124 + goto unlock;
1125 + }
1126 + INIT_LIST_HEAD(&set_hash->list);
1127 + set_hash->id = id;
1128 + set_hash->ip = ip;
1129 + list_add(&set_hash->list, &ip_set_hash[key]);
1130 + } else {
1131 + IP_SET_ASSERT(ip_set_list[set_hash->binding]);
1132 + DP("overwrite binding: %s",
1133 + ip_set_list[set_hash->binding]->name);
1134 + __ip_set_put(set_hash->binding);
1135 + }
1136 + set_hash->binding = binding;
1137 + __ip_set_get(set_hash->binding);
1138 + DP("stored: key %u, id %u (%s), ip %u.%u.%u.%u, binding %u (%s)",
1139 + key, id, ip_set_list[id]->name,
1140 + HIPQUAD(ip), binding, ip_set_list[binding]->name);
1141 + unlock:
1142 + write_unlock_bh(&ip_set_lock);
1143 + return ret;
1144 +}
1145 +
1146 +#define FOREACH_HASH_DO(fn, args...) \
1147 +({ \
1148 + ip_set_id_t __key; \
1149 + struct ip_set_hash *__set_hash; \
1150 + \
1151 + for (__key = 0; __key < ip_set_bindings_hash_size; __key++) { \
1152 + list_for_each_entry(__set_hash, &ip_set_hash[__key], list) \
1153 + fn(__set_hash , ## args); \
1154 + } \
1155 +})
1156 +
1157 +#define FOREACH_HASH_RW_DO(fn, args...) \
1158 +({ \
1159 + ip_set_id_t __key; \
1160 + struct ip_set_hash *__set_hash, *__n; \
1161 + \
1162 + ASSERT_WRITE_LOCK(&ip_set_lock); \
1163 + for (__key = 0; __key < ip_set_bindings_hash_size; __key++) { \
1164 + list_for_each_entry_safe(__set_hash, __n, &ip_set_hash[__key], list)\
1165 + fn(__set_hash , ## args); \
1166 + } \
1167 +})
1168 +
1169 +/* Add, del and test set entries from kernel */
1170 +
1171 +#define follow_bindings(index, set, ip) \
1172 +((index = ip_set_find_in_hash((set)->id, ip)) != IP_SET_INVALID_ID \
1173 + || (index = (set)->binding) != IP_SET_INVALID_ID)
1174 +
1175 +int
1176 +ip_set_testip_kernel(ip_set_id_t index,
1177 + const struct sk_buff *skb,
1178 + const u_int32_t *flags)
1179 +{
1180 + struct ip_set *set;
1181 + ip_set_ip_t ip;
1182 + int res;
1183 + unsigned char i = 0;
1184 +
1185 + IP_SET_ASSERT(flags[i]);
1186 + read_lock_bh(&ip_set_lock);
1187 + do {
1188 + set = ip_set_list[index];
1189 + IP_SET_ASSERT(set);
1190 + DP("set %s, index %u", set->name, index);
1191 + read_lock_bh(&set->lock);
1192 + res = set->type->testip_kernel(set, skb, &ip, flags, i++);
1193 + read_unlock_bh(&set->lock);
1194 + i += !!(set->type->features & IPSET_DATA_DOUBLE);
1195 + } while (res > 0
1196 + && flags[i]
1197 + && follow_bindings(index, set, ip));
1198 + read_unlock_bh(&ip_set_lock);
1199 +
1200 + return res;
1201 +}
1202 +
1203 +void
1204 +ip_set_addip_kernel(ip_set_id_t index,
1205 + const struct sk_buff *skb,
1206 + const u_int32_t *flags)
1207 +{
1208 + struct ip_set *set;
1209 + ip_set_ip_t ip;
1210 + int res;
1211 + unsigned char i = 0;
1212 +
1213 + IP_SET_ASSERT(flags[i]);
1214 + retry:
1215 + read_lock_bh(&ip_set_lock);
1216 + do {
1217 + set = ip_set_list[index];
1218 + IP_SET_ASSERT(set);
1219 + DP("set %s, index %u", set->name, index);
1220 + write_lock_bh(&set->lock);
1221 + res = set->type->addip_kernel(set, skb, &ip, flags, i++);
1222 + write_unlock_bh(&set->lock);
1223 + i += !!(set->type->features & IPSET_DATA_DOUBLE);
1224 + } while ((res == 0 || res == -EEXIST)
1225 + && flags[i]
1226 + && follow_bindings(index, set, ip));
1227 + read_unlock_bh(&ip_set_lock);
1228 +
1229 + if (res == -EAGAIN
1230 + && set->type->retry
1231 + && (res = set->type->retry(set)) == 0)
1232 + goto retry;
1233 +}
1234 +
1235 +void
1236 +ip_set_delip_kernel(ip_set_id_t index,
1237 + const struct sk_buff *skb,
1238 + const u_int32_t *flags)
1239 +{
1240 + struct ip_set *set;
1241 + ip_set_ip_t ip;
1242 + int res;
1243 + unsigned char i = 0;
1244 +
1245 + IP_SET_ASSERT(flags[i]);
1246 + read_lock_bh(&ip_set_lock);
1247 + do {
1248 + set = ip_set_list[index];
1249 + IP_SET_ASSERT(set);
1250 + DP("set %s, index %u", set->name, index);
1251 + write_lock_bh(&set->lock);
1252 + res = set->type->delip_kernel(set, skb, &ip, flags, i++);
1253 + write_unlock_bh(&set->lock);
1254 + i += !!(set->type->features & IPSET_DATA_DOUBLE);
1255 + } while ((res == 0 || res == -EEXIST)
1256 + && flags[i]
1257 + && follow_bindings(index, set, ip));
1258 + read_unlock_bh(&ip_set_lock);
1259 +}
1260 +
1261 +/* Register and deregister settype */
1262 +
1263 +static inline struct ip_set_type *
1264 +find_set_type(const char *name)
1265 +{
1266 + struct ip_set_type *set_type;
1267 +
1268 + list_for_each_entry(set_type, &set_type_list, list)
1269 + if (!strncmp(set_type->typename, name, IP_SET_MAXNAMELEN - 1))
1270 + return set_type;
1271 + return NULL;
1272 +}
1273 +
1274 +int
1275 +ip_set_register_set_type(struct ip_set_type *set_type)
1276 +{
1277 + int ret = 0;
1278 +
1279 + if (set_type->protocol_version != IP_SET_PROTOCOL_VERSION) {
1280 + ip_set_printk("'%s' uses wrong protocol version %u (want %u)",
1281 + set_type->typename,
1282 + set_type->protocol_version,
1283 + IP_SET_PROTOCOL_VERSION);
1284 + return -EINVAL;
1285 + }
1286 +
1287 + write_lock_bh(&ip_set_lock);
1288 + if (find_set_type(set_type->typename)) {
1289 + /* Duplicate! */
1290 + ip_set_printk("'%s' already registered!",
1291 + set_type->typename);
1292 + ret = -EINVAL;
1293 + goto unlock;
1294 + }
1295 + if (!try_module_get(THIS_MODULE)) {
1296 + ret = -EFAULT;
1297 + goto unlock;
1298 + }
1299 + list_add(&set_type->list, &set_type_list);
1300 + DP("'%s' registered.", set_type->typename);
1301 + unlock:
1302 + write_unlock_bh(&ip_set_lock);
1303 + return ret;
1304 +}
1305 +
1306 +void
1307 +ip_set_unregister_set_type(struct ip_set_type *set_type)
1308 +{
1309 + write_lock_bh(&ip_set_lock);
1310 + if (!find_set_type(set_type->typename)) {
1311 + ip_set_printk("'%s' not registered?",
1312 + set_type->typename);
1313 + goto unlock;
1314 + }
1315 + list_del(&set_type->list);
1316 + module_put(THIS_MODULE);
1317 + DP("'%s' unregistered.", set_type->typename);
1318 + unlock:
1319 + write_unlock_bh(&ip_set_lock);
1320 +
1321 +}
1322 +
1323 +/*
1324 + * Userspace routines
1325 + */
1326 +
1327 +/*
1328 + * Find set by name, reference it once. The reference makes sure the
1329 + * thing pointed to, does not go away under our feet. Drop the reference
1330 + * later, using ip_set_put().
1331 + */
1332 +ip_set_id_t
1333 +ip_set_get_byname(const char *name)
1334 +{
1335 + ip_set_id_t i, index = IP_SET_INVALID_ID;
1336 +
1337 + down(&ip_set_app_mutex);
1338 + for (i = 0; i < ip_set_max; i++) {
1339 + if (ip_set_list[i] != NULL
1340 + && strcmp(ip_set_list[i]->name, name) == 0) {
1341 + __ip_set_get(i);
1342 + index = i;
1343 + break;
1344 + }
1345 + }
1346 + up(&ip_set_app_mutex);
1347 + return index;
1348 +}
1349 +
1350 +/*
1351 + * Find set by index, reference it once. The reference makes sure the
1352 + * thing pointed to, does not go away under our feet. Drop the reference
1353 + * later, using ip_set_put().
1354 + */
1355 +ip_set_id_t
1356 +ip_set_get_byindex(ip_set_id_t index)
1357 +{
1358 + down(&ip_set_app_mutex);
1359 +
1360 + if (index >= ip_set_max)
1361 + return IP_SET_INVALID_ID;
1362 +
1363 + if (ip_set_list[index])
1364 + __ip_set_get(index);
1365 + else
1366 + index = IP_SET_INVALID_ID;
1367 +
1368 + up(&ip_set_app_mutex);
1369 + return index;
1370 +}
1371 +
1372 +/*
1373 + * If the given set pointer points to a valid set, decrement
1374 + * reference count by 1. The caller shall not assume the index
1375 + * to be valid, after calling this function.
1376 + */
1377 +void ip_set_put(ip_set_id_t index)
1378 +{
1379 + down(&ip_set_app_mutex);
1380 + if (ip_set_list[index])
1381 + __ip_set_put(index);
1382 + up(&ip_set_app_mutex);
1383 +}
1384 +
1385 +/* Find a set by name or index */
1386 +static ip_set_id_t
1387 +ip_set_find_byname(const char *name)
1388 +{
1389 + ip_set_id_t i, index = IP_SET_INVALID_ID;
1390 +
1391 + for (i = 0; i < ip_set_max; i++) {
1392 + if (ip_set_list[i] != NULL
1393 + && strcmp(ip_set_list[i]->name, name) == 0) {
1394 + index = i;
1395 + break;
1396 + }
1397 + }
1398 + return index;
1399 +}
1400 +
1401 +static ip_set_id_t
1402 +ip_set_find_byindex(ip_set_id_t index)
1403 +{
1404 + if (index >= ip_set_max || ip_set_list[index] == NULL)
1405 + index = IP_SET_INVALID_ID;
1406 +
1407 + return index;
1408 +}
1409 +
1410 +/*
1411 + * Add, del, test, bind and unbind
1412 + */
1413 +
1414 +static inline int
1415 +__ip_set_testip(struct ip_set *set,
1416 + const void *data,
1417 + size_t size,
1418 + ip_set_ip_t *ip)
1419 +{
1420 + int res;
1421 +
1422 + read_lock_bh(&set->lock);
1423 + res = set->type->testip(set, data, size, ip);
1424 + read_unlock_bh(&set->lock);
1425 +
1426 + return res;
1427 +}
1428 +
1429 +static int
1430 +__ip_set_addip(ip_set_id_t index,
1431 + const void *data,
1432 + size_t size)
1433 +{
1434 + struct ip_set *set = ip_set_list[index];
1435 + ip_set_ip_t ip;
1436 + int res;
1437 +
1438 + IP_SET_ASSERT(set);
1439 + do {
1440 + write_lock_bh(&set->lock);
1441 + res = set->type->addip(set, data, size, &ip);
1442 + write_unlock_bh(&set->lock);
1443 + } while (res == -EAGAIN
1444 + && set->type->retry
1445 + && (res = set->type->retry(set)) == 0);
1446 +
1447 + return res;
1448 +}
1449 +
1450 +static int
1451 +ip_set_addip(ip_set_id_t index,
1452 + const void *data,
1453 + size_t size)
1454 +{
1455 +
1456 + return __ip_set_addip(index,
1457 + data + sizeof(struct ip_set_req_adt),
1458 + size - sizeof(struct ip_set_req_adt));
1459 +}
1460 +
1461 +static int
1462 +ip_set_delip(ip_set_id_t index,
1463 + const void *data,
1464 + size_t size)
1465 +{
1466 + struct ip_set *set = ip_set_list[index];
1467 + ip_set_ip_t ip;
1468 + int res;
1469 +
1470 + IP_SET_ASSERT(set);
1471 + write_lock_bh(&set->lock);
1472 + res = set->type->delip(set,
1473 + data + sizeof(struct ip_set_req_adt),
1474 + size - sizeof(struct ip_set_req_adt),
1475 + &ip);
1476 + write_unlock_bh(&set->lock);
1477 +
1478 + return res;
1479 +}
1480 +
1481 +static int
1482 +ip_set_testip(ip_set_id_t index,
1483 + const void *data,
1484 + size_t size)
1485 +{
1486 + struct ip_set *set = ip_set_list[index];
1487 + ip_set_ip_t ip;
1488 + int res;
1489 +
1490 + IP_SET_ASSERT(set);
1491 + res = __ip_set_testip(set,
1492 + data + sizeof(struct ip_set_req_adt),
1493 + size - sizeof(struct ip_set_req_adt),
1494 + &ip);
1495 +
1496 + return (res > 0 ? -EEXIST : res);
1497 +}
1498 +
1499 +static int
1500 +ip_set_bindip(ip_set_id_t index,
1501 + const void *data,
1502 + size_t size)
1503 +{
1504 + struct ip_set *set = ip_set_list[index];
1505 + struct ip_set_req_bind *req_bind;
1506 + ip_set_id_t binding;
1507 + ip_set_ip_t ip;
1508 + int res;
1509 +
1510 + IP_SET_ASSERT(set);
1511 + if (size < sizeof(struct ip_set_req_bind))
1512 + return -EINVAL;
1513 +
1514 + req_bind = (struct ip_set_req_bind *) data;
1515 + req_bind->binding[IP_SET_MAXNAMELEN - 1] = '\0';
1516 +
1517 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1518 + /* Default binding of a set */
1519 + char *binding_name;
1520 +
1521 + if (size != sizeof(struct ip_set_req_bind) + IP_SET_MAXNAMELEN)
1522 + return -EINVAL;
1523 +
1524 + binding_name = (char *)(data + sizeof(struct ip_set_req_bind));
1525 + binding_name[IP_SET_MAXNAMELEN - 1] = '\0';
1526 +
1527 + binding = ip_set_find_byname(binding_name);
1528 + if (binding == IP_SET_INVALID_ID)
1529 + return -ENOENT;
1530 +
1531 + write_lock_bh(&ip_set_lock);
1532 + /* Sets as binding values are referenced */
1533 + if (set->binding != IP_SET_INVALID_ID)
1534 + __ip_set_put(set->binding);
1535 + set->binding = binding;
1536 + __ip_set_get(set->binding);
1537 + write_unlock_bh(&ip_set_lock);
1538 +
1539 + return 0;
1540 + }
1541 + binding = ip_set_find_byname(req_bind->binding);
1542 + if (binding == IP_SET_INVALID_ID)
1543 + return -ENOENT;
1544 +
1545 + res = __ip_set_testip(set,
1546 + data + sizeof(struct ip_set_req_bind),
1547 + size - sizeof(struct ip_set_req_bind),
1548 + &ip);
1549 + DP("set %s, ip: %u.%u.%u.%u, binding %s",
1550 + set->name, HIPQUAD(ip), ip_set_list[binding]->name);
1551 +
1552 + if (res >= 0)
1553 + res = ip_set_hash_add(set->id, ip, binding);
1554 +
1555 + return res;
1556 +}
1557 +
1558 +#define FOREACH_SET_DO(fn, args...) \
1559 +({ \
1560 + ip_set_id_t __i; \
1561 + struct ip_set *__set; \
1562 + \
1563 + for (__i = 0; __i < ip_set_max; __i++) { \
1564 + __set = ip_set_list[__i]; \
1565 + if (__set != NULL) \
1566 + fn(__set , ##args); \
1567 + } \
1568 +})
1569 +
1570 +static inline void
1571 +__set_hash_del_byid(struct ip_set_hash *set_hash, ip_set_id_t id)
1572 +{
1573 + if (set_hash->id == id)
1574 + __set_hash_del(set_hash);
1575 +}
1576 +
1577 +static inline void
1578 +__unbind_default(struct ip_set *set)
1579 +{
1580 + if (set->binding != IP_SET_INVALID_ID) {
1581 + /* Sets as binding values are referenced */
1582 + __ip_set_put(set->binding);
1583 + set->binding = IP_SET_INVALID_ID;
1584 + }
1585 +}
1586 +
1587 +static int
1588 +ip_set_unbindip(ip_set_id_t index,
1589 + const void *data,
1590 + size_t size)
1591 +{
1592 + struct ip_set *set;
1593 + struct ip_set_req_bind *req_bind;
1594 + ip_set_ip_t ip;
1595 + int res;
1596 +
1597 + DP("");
1598 + if (size < sizeof(struct ip_set_req_bind))
1599 + return -EINVAL;
1600 +
1601 + req_bind = (struct ip_set_req_bind *) data;
1602 + req_bind->binding[IP_SET_MAXNAMELEN - 1] = '\0';
1603 +
1604 + DP("%u %s", index, req_bind->binding);
1605 + if (index == IP_SET_INVALID_ID) {
1606 + /* unbind :all: */
1607 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1608 + /* Default binding of sets */
1609 + write_lock_bh(&ip_set_lock);
1610 + FOREACH_SET_DO(__unbind_default);
1611 + write_unlock_bh(&ip_set_lock);
1612 + return 0;
1613 + } else if (strcmp(req_bind->binding, IPSET_TOKEN_ALL) == 0) {
1614 + /* Flush all bindings of all sets*/
1615 + write_lock_bh(&ip_set_lock);
1616 + FOREACH_HASH_RW_DO(__set_hash_del);
1617 + write_unlock_bh(&ip_set_lock);
1618 + return 0;
1619 + }
1620 + DP("unreachable reached!");
1621 + return -EINVAL;
1622 + }
1623 +
1624 + set = ip_set_list[index];
1625 + IP_SET_ASSERT(set);
1626 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1627 + /* Default binding of set */
1628 + ip_set_id_t binding = ip_set_find_byindex(set->binding);
1629 +
1630 + if (binding == IP_SET_INVALID_ID)
1631 + return -ENOENT;
1632 +
1633 + write_lock_bh(&ip_set_lock);
1634 + /* Sets in hash values are referenced */
1635 + __ip_set_put(set->binding);
1636 + set->binding = IP_SET_INVALID_ID;
1637 + write_unlock_bh(&ip_set_lock);
1638 +
1639 + return 0;
1640 + } else if (strcmp(req_bind->binding, IPSET_TOKEN_ALL) == 0) {
1641 + /* Flush all bindings */
1642 +
1643 + write_lock_bh(&ip_set_lock);
1644 + FOREACH_HASH_RW_DO(__set_hash_del_byid, set->id);
1645 + write_unlock_bh(&ip_set_lock);
1646 + return 0;
1647 + }
1648 +
1649 + res = __ip_set_testip(set,
1650 + data + sizeof(struct ip_set_req_bind),
1651 + size - sizeof(struct ip_set_req_bind),
1652 + &ip);
1653 +
1654 + DP("set %s, ip: %u.%u.%u.%u", set->name, HIPQUAD(ip));
1655 + if (res >= 0)
1656 + res = ip_set_hash_del(set->id, ip);
1657 +
1658 + return res;
1659 +}
1660 +
1661 +static int
1662 +ip_set_testbind(ip_set_id_t index,
1663 + const void *data,
1664 + size_t size)
1665 +{
1666 + struct ip_set *set = ip_set_list[index];
1667 + struct ip_set_req_bind *req_bind;
1668 + ip_set_id_t binding;
1669 + ip_set_ip_t ip;
1670 + int res;
1671 +
1672 + IP_SET_ASSERT(set);
1673 + if (size < sizeof(struct ip_set_req_bind))
1674 + return -EINVAL;
1675 +
1676 + req_bind = (struct ip_set_req_bind *) data;
1677 + req_bind->binding[IP_SET_MAXNAMELEN - 1] = '\0';
1678 +
1679 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1680 + /* Default binding of set */
1681 + char *binding_name;
1682 +
1683 + if (size != sizeof(struct ip_set_req_bind) + IP_SET_MAXNAMELEN)
1684 + return -EINVAL;
1685 +
1686 + binding_name = (char *)(data + sizeof(struct ip_set_req_bind));
1687 + binding_name[IP_SET_MAXNAMELEN - 1] = '\0';
1688 +
1689 + binding = ip_set_find_byname(binding_name);
1690 + if (binding == IP_SET_INVALID_ID)
1691 + return -ENOENT;
1692 +
1693 + res = (set->binding == binding) ? -EEXIST : 0;
1694 +
1695 + return res;
1696 + }
1697 + binding = ip_set_find_byname(req_bind->binding);
1698 + if (binding == IP_SET_INVALID_ID)
1699 + return -ENOENT;
1700 +
1701 +
1702 + res = __ip_set_testip(set,
1703 + data + sizeof(struct ip_set_req_bind),
1704 + size - sizeof(struct ip_set_req_bind),
1705 + &ip);
1706 + DP("set %s, ip: %u.%u.%u.%u, binding %s",
1707 + set->name, HIPQUAD(ip), ip_set_list[binding]->name);
1708 +
1709 + if (res >= 0)
1710 + res = (ip_set_find_in_hash(set->id, ip) == binding)
1711 + ? -EEXIST : 0;
1712 +
1713 + return res;
1714 +}
1715 +
1716 +static struct ip_set_type *
1717 +find_set_type_rlock(const char *typename)
1718 +{
1719 + struct ip_set_type *type;
1720 +
1721 + read_lock_bh(&ip_set_lock);
1722 + type = find_set_type(typename);
1723 + if (type == NULL)
1724 + read_unlock_bh(&ip_set_lock);
1725 +
1726 + return type;
1727 +}
1728 +
1729 +static int
1730 +find_free_id(const char *name,
1731 + ip_set_id_t *index,
1732 + ip_set_id_t *id)
1733 +{
1734 + ip_set_id_t i;
1735 +
1736 + *id = IP_SET_INVALID_ID;
1737 + for (i = 0; i < ip_set_max; i++) {
1738 + if (ip_set_list[i] == NULL) {
1739 + if (*id == IP_SET_INVALID_ID)
1740 + *id = *index = i;
1741 + } else if (strcmp(name, ip_set_list[i]->name) == 0)
1742 + /* Name clash */
1743 + return -EEXIST;
1744 + }
1745 + if (*id == IP_SET_INVALID_ID)
1746 + /* No free slot remained */
1747 + return -ERANGE;
1748 + /* Check that index is usable as id (swapping) */
1749 + check:
1750 + for (i = 0; i < ip_set_max; i++) {
1751 + if (ip_set_list[i] != NULL
1752 + && ip_set_list[i]->id == *id) {
1753 + *id = i;
1754 + goto check;
1755 + }
1756 + }
1757 + return 0;
1758 +}
1759 +
1760 +/*
1761 + * Create a set
1762 + */
1763 +static int
1764 +ip_set_create(const char *name,
1765 + const char *typename,
1766 + ip_set_id_t restore,
1767 + const void *data,
1768 + size_t size)
1769 +{
1770 + struct ip_set *set;
1771 + ip_set_id_t index = 0, id;
1772 + int res = 0;
1773 +
1774 + DP("setname: %s, typename: %s, id: %u", name, typename, restore);
1775 + /*
1776 + * First, and without any locks, allocate and initialize
1777 + * a normal base set structure.
1778 + */
1779 + set = kmalloc(sizeof(struct ip_set), GFP_KERNEL);
1780 + if (!set)
1781 + return -ENOMEM;
1782 + set->lock = RW_LOCK_UNLOCKED;
1783 + strncpy(set->name, name, IP_SET_MAXNAMELEN);
1784 + set->binding = IP_SET_INVALID_ID;
1785 + atomic_set(&set->ref, 0);
1786 +
1787 + /*
1788 + * Next, take the &ip_set_lock, check that we know the type,
1789 + * and take a reference on the type, to make sure it
1790 + * stays available while constructing our new set.
1791 + *
1792 + * After referencing the type, we drop the &ip_set_lock,
1793 + * and let the new set construction run without locks.
1794 + */
1795 + set->type = find_set_type_rlock(typename);
1796 + if (set->type == NULL) {
1797 + /* Try loading the module */
1798 + char modulename[IP_SET_MAXNAMELEN + strlen("ip_set_") + 1];
1799 + strcpy(modulename, "ip_set_");
1800 + strcat(modulename, typename);
1801 + DP("try to load %s", modulename);
1802 + request_module(modulename);
1803 + set->type = find_set_type_rlock(typename);
1804 + }
1805 + if (set->type == NULL) {
1806 + ip_set_printk("no set type '%s', set '%s' not created",
1807 + typename, name);
1808 + res = -ENOENT;
1809 + goto out;
1810 + }
1811 + if (!try_module_get(set->type->me)) {
1812 + read_unlock_bh(&ip_set_lock);
1813 + res = -EFAULT;
1814 + goto out;
1815 + }
1816 + read_unlock_bh(&ip_set_lock);
1817 +
1818 + /*
1819 + * Without holding any locks, create private part.
1820 + */
1821 + res = set->type->create(set, data, size);
1822 + if (res != 0)
1823 + goto put_out;
1824 +
1825 + /* BTW, res==0 here. */
1826 +
1827 + /*
1828 + * Here, we have a valid, constructed set. &ip_set_lock again,
1829 + * find free id/index and check that it is not already in
1830 + * ip_set_list.
1831 + */
1832 + write_lock_bh(&ip_set_lock);
1833 + if ((res = find_free_id(set->name, &index, &id)) != 0) {
1834 + DP("no free id!");
1835 + goto cleanup;
1836 + }
1837 +
1838 + /* Make sure restore gets the same index */
1839 + if (restore != IP_SET_INVALID_ID && index != restore) {
1840 + DP("Can't restore, sets are screwed up");
1841 + res = -ERANGE;
1842 + goto cleanup;
1843 + }
1844 +
1845 + /*
1846 + * Finally! Add our shiny new set to the list, and be done.
1847 + */
1848 + DP("create: '%s' created with index %u, id %u!", set->name, index, id);
1849 + set->id = id;
1850 + ip_set_list[index] = set;
1851 + write_unlock_bh(&ip_set_lock);
1852 + return res;
1853 +
1854 + cleanup:
1855 + write_unlock_bh(&ip_set_lock);
1856 + set->type->destroy(set);
1857 + put_out:
1858 + module_put(set->type->me);
1859 + out:
1860 + kfree(set);
1861 + return res;
1862 +}
1863 +
1864 +/*
1865 + * Destroy a given existing set
1866 + */
1867 +static void
1868 +ip_set_destroy_set(ip_set_id_t index)
1869 +{
1870 + struct ip_set *set = ip_set_list[index];
1871 +
1872 + IP_SET_ASSERT(set);
1873 + DP("set: %s", set->name);
1874 + write_lock_bh(&ip_set_lock);
1875 + FOREACH_HASH_RW_DO(__set_hash_del_byid, set->id);
1876 + if (set->binding != IP_SET_INVALID_ID)
1877 + __ip_set_put(set->binding);
1878 + ip_set_list[index] = NULL;
1879 + write_unlock_bh(&ip_set_lock);
1880 +
1881 + /* Must call it without holding any lock */
1882 + set->type->destroy(set);
1883 + module_put(set->type->me);
1884 + kfree(set);
1885 +}
1886 +
1887 +/*
1888 + * Destroy a set - or all sets
1889 + * Sets must not be referenced/used.
1890 + */
1891 +static int
1892 +ip_set_destroy(ip_set_id_t index)
1893 +{
1894 + ip_set_id_t i;
1895 +
1896 + /* ref modification always protected by the mutex */
1897 + if (index != IP_SET_INVALID_ID) {
1898 + if (atomic_read(&ip_set_list[index]->ref))
1899 + return -EBUSY;
1900 + ip_set_destroy_set(index);
1901 + } else {
1902 + for (i = 0; i < ip_set_max; i++) {
1903 + if (ip_set_list[i] != NULL
1904 + && (atomic_read(&ip_set_list[i]->ref)))
1905 + return -EBUSY;
1906 + }
1907 +
1908 + for (i = 0; i < ip_set_max; i++) {
1909 + if (ip_set_list[i] != NULL)
1910 + ip_set_destroy_set(i);
1911 + }
1912 + }
1913 + return 0;
1914 +}
1915 +
1916 +static void
1917 +ip_set_flush_set(struct ip_set *set)
1918 +{
1919 + DP("set: %s %u", set->name, set->id);
1920 +
1921 + write_lock_bh(&set->lock);
1922 + set->type->flush(set);
1923 + write_unlock_bh(&set->lock);
1924 +}
1925 +
1926 +/*
1927 + * Flush data in a set - or in all sets
1928 + */
1929 +static int
1930 +ip_set_flush(ip_set_id_t index)
1931 +{
1932 + if (index != IP_SET_INVALID_ID) {
1933 + IP_SET_ASSERT(ip_set_list[index]);
1934 + ip_set_flush_set(ip_set_list[index]);
1935 + } else
1936 + FOREACH_SET_DO(ip_set_flush_set);
1937 +
1938 + return 0;
1939 +}
1940 +
1941 +/* Rename a set */
1942 +static int
1943 +ip_set_rename(ip_set_id_t index, const char *name)
1944 +{
1945 + struct ip_set *set = ip_set_list[index];
1946 + ip_set_id_t i;
1947 + int res = 0;
1948 +
1949 + DP("set: %s to %s", set->name, name);
1950 + write_lock_bh(&ip_set_lock);
1951 + for (i = 0; i < ip_set_max; i++) {
1952 + if (ip_set_list[i] != NULL
1953 + && strncmp(ip_set_list[i]->name,
1954 + name,
1955 + IP_SET_MAXNAMELEN - 1) == 0) {
1956 + res = -EEXIST;
1957 + goto unlock;
1958 + }
1959 + }
1960 + strncpy(set->name, name, IP_SET_MAXNAMELEN);
1961 + unlock:
1962 + write_unlock_bh(&ip_set_lock);
1963 + return res;
1964 +}
1965 +
1966 +/*
1967 + * Swap two sets so that name/index points to the other.
1968 + * References are also swapped.
1969 + */
1970 +static int
1971 +ip_set_swap(ip_set_id_t from_index, ip_set_id_t to_index)
1972 +{
1973 + struct ip_set *from = ip_set_list[from_index];
1974 + struct ip_set *to = ip_set_list[to_index];
1975 + char from_name[IP_SET_MAXNAMELEN];
1976 + u_int32_t from_ref;
1977 +
1978 + DP("set: %s to %s", from->name, to->name);
1979 + /* Features must not change. Artifical restriction. */
1980 + if (from->type->features != to->type->features)
1981 + return -ENOEXEC;
1982 +
1983 + /* No magic here: ref munging protected by the mutex */
1984 + write_lock_bh(&ip_set_lock);
1985 + strncpy(from_name, from->name, IP_SET_MAXNAMELEN);
1986 + from_ref = atomic_read(&from->ref);
1987 +
1988 + strncpy(from->name, to->name, IP_SET_MAXNAMELEN);
1989 + atomic_set(&from->ref, atomic_read(&to->ref));
1990 + strncpy(to->name, from_name, IP_SET_MAXNAMELEN);
1991 + atomic_set(&to->ref, from_ref);
1992 +
1993 + ip_set_list[from_index] = to;
1994 + ip_set_list[to_index] = from;
1995 +
1996 + write_unlock_bh(&ip_set_lock);
1997 + return 0;
1998 +}
1999 +
2000 +/*
2001 + * List set data
2002 + */
2003 +
2004 +static inline void
2005 +__set_hash_bindings_size_list(struct ip_set_hash *set_hash,
2006 + ip_set_id_t id, size_t *size)
2007 +{
2008 + if (set_hash->id == id)
2009 + *size += sizeof(struct ip_set_hash_list);
2010 +}
2011 +
2012 +static inline void
2013 +__set_hash_bindings_size_save(struct ip_set_hash *set_hash,
2014 + ip_set_id_t id, size_t *size)
2015 +{
2016 + if (set_hash->id == id)
2017 + *size += sizeof(struct ip_set_hash_save);
2018 +}
2019 +
2020 +static inline void
2021 +__set_hash_bindings(struct ip_set_hash *set_hash,
2022 + ip_set_id_t id, void *data, int *used)
2023 +{
2024 + if (set_hash->id == id) {
2025 + struct ip_set_hash_list *hash_list =
2026 + (struct ip_set_hash_list *)(data + *used);
2027 +
2028 + hash_list->ip = set_hash->ip;
2029 + hash_list->binding = set_hash->binding;
2030 + *used += sizeof(struct ip_set_hash_list);
2031 + }
2032 +}
2033 +
2034 +static int ip_set_list_set(ip_set_id_t index,
2035 + void *data,
2036 + int *used,
2037 + int len)
2038 +{
2039 + struct ip_set *set = ip_set_list[index];
2040 + struct ip_set_list *set_list;
2041 +
2042 + /* Pointer to our header */
2043 + set_list = (struct ip_set_list *) (data + *used);
2044 +
2045 + DP("set: %s, used: %d %p %p", set->name, *used, data, data + *used);
2046 +
2047 + /* Get and ensure header size */
2048 + if (*used + sizeof(struct ip_set_list) > len)
2049 + goto not_enough_mem;
2050 + *used += sizeof(struct ip_set_list);
2051 +
2052 + read_lock_bh(&set->lock);
2053 + /* Get and ensure set specific header size */
2054 + set_list->header_size = set->type->header_size;
2055 + if (*used + set_list->header_size > len)
2056 + goto unlock_set;
2057 +
2058 + /* Fill in the header */
2059 + set_list->index = index;
2060 + set_list->binding = set->binding;
2061 + set_list->ref = atomic_read(&set->ref);
2062 +
2063 + /* Fill in set spefific header data */
2064 + set->type->list_header(set, data + *used);
2065 + *used += set_list->header_size;
2066 +
2067 + /* Get and ensure set specific members size */
2068 + set_list->members_size = set->type->list_members_size(set);
2069 + if (*used + set_list->members_size > len)
2070 + goto unlock_set;
2071 +
2072 + /* Fill in set spefific members data */
2073 + set->type->list_members(set, data + *used);
2074 + *used += set_list->members_size;
2075 + read_unlock_bh(&set->lock);
2076 +
2077 + /* Bindings */
2078 +
2079 + /* Get and ensure set specific bindings size */
2080 + set_list->bindings_size = 0;
2081 + FOREACH_HASH_DO(__set_hash_bindings_size_list,
2082 + set->id, &set_list->bindings_size);
2083 + if (*used + set_list->bindings_size > len)
2084 + goto not_enough_mem;
2085 +
2086 + /* Fill in set spefific bindings data */
2087 + FOREACH_HASH_DO(__set_hash_bindings, set->id, data, used);
2088 +
2089 + return 0;
2090 +
2091 + unlock_set:
2092 + read_unlock_bh(&set->lock);
2093 + not_enough_mem:
2094 + DP("not enough mem, try again");
2095 + return -EAGAIN;
2096 +}
2097 +
2098 +/*
2099 + * Save sets
2100 + */
2101 +static int ip_set_save_set(ip_set_id_t index,
2102 + void *data,
2103 + int *used,
2104 + int len)
2105 +{
2106 + struct ip_set *set;
2107 + struct ip_set_save *set_save;
2108 +
2109 + /* Pointer to our header */
2110 + set_save = (struct ip_set_save *) (data + *used);
2111 +
2112 + /* Get and ensure header size */
2113 + if (*used + sizeof(struct ip_set_save) > len)
2114 + goto not_enough_mem;
2115 + *used += sizeof(struct ip_set_save);
2116 +
2117 + set = ip_set_list[index];
2118 + DP("set: %s, used: %u(%u) %p %p", set->name, *used, len,
2119 + data, data + *used);
2120 +
2121 + read_lock_bh(&set->lock);
2122 + /* Get and ensure set specific header size */
2123 + set_save->header_size = set->type->header_size;
2124 + if (*used + set_save->header_size > len)
2125 + goto unlock_set;
2126 +
2127 + /* Fill in the header */
2128 + set_save->index = index;
2129 + set_save->binding = set->binding;
2130 +
2131 + /* Fill in set spefific header data */
2132 + set->type->list_header(set, data + *used);
2133 + *used += set_save->header_size;
2134 +
2135 + DP("set header filled: %s, used: %u(%u) %p %p", set->name, *used,
2136 + set_save->header_size, data, data + *used);
2137 + /* Get and ensure set specific members size */
2138 + set_save->members_size = set->type->list_members_size(set);
2139 + if (*used + set_save->members_size > len)
2140 + goto unlock_set;
2141 +
2142 + /* Fill in set spefific members data */
2143 + set->type->list_members(set, data + *used);
2144 + *used += set_save->members_size;
2145 + read_unlock_bh(&set->lock);
2146 + DP("set members filled: %s, used: %u(%u) %p %p", set->name, *used,
2147 + set_save->members_size, data, data + *used);
2148 + return 0;
2149 +
2150 + unlock_set:
2151 + read_unlock_bh(&set->lock);
2152 + not_enough_mem:
2153 + DP("not enough mem, try again");
2154 + return -EAGAIN;
2155 +}
2156 +
2157 +static inline void
2158 +__set_hash_save_bindings(struct ip_set_hash *set_hash,
2159 + ip_set_id_t id,
2160 + void *data,
2161 + int *used,
2162 + int len,
2163 + int *res)
2164 +{
2165 + if (*res == 0
2166 + && (id == IP_SET_INVALID_ID || set_hash->id == id)) {
2167 + struct ip_set_hash_save *hash_save =
2168 + (struct ip_set_hash_save *)(data + *used);
2169 + /* Ensure bindings size */
2170 + if (*used + sizeof(struct ip_set_hash_save) > len) {
2171 + *res = -ENOMEM;
2172 + return;
2173 + }
2174 + hash_save->id = set_hash->id;
2175 + hash_save->ip = set_hash->ip;
2176 + hash_save->binding = set_hash->binding;
2177 + *used += sizeof(struct ip_set_hash_save);
2178 + }
2179 +}
2180 +
2181 +static int ip_set_save_bindings(ip_set_id_t index,
2182 + void *data,
2183 + int *used,
2184 + int len)
2185 +{
2186 + int res = 0;
2187 + struct ip_set_save *set_save;
2188 +
2189 + DP("used %u, len %u", *used, len);
2190 + /* Get and ensure header size */
2191 + if (*used + sizeof(struct ip_set_save) > len)
2192 + return -ENOMEM;
2193 +
2194 + /* Marker */
2195 + set_save = (struct ip_set_save *) (data + *used);
2196 + set_save->index = IP_SET_INVALID_ID;
2197 + set_save->header_size = 0;
2198 + set_save->members_size = 0;
2199 + *used += sizeof(struct ip_set_save);
2200 +
2201 + DP("marker added used %u, len %u", *used, len);
2202 + /* Fill in bindings data */
2203 + if (index != IP_SET_INVALID_ID)
2204 + /* Sets are identified by id in hash */
2205 + index = ip_set_list[index]->id;
2206 + FOREACH_HASH_DO(__set_hash_save_bindings, index, data, used, len, &res);
2207 +
2208 + return res;
2209 +}
2210 +
2211 +/*
2212 + * Restore sets
2213 + */
2214 +static int ip_set_restore(void *data,
2215 + int len)
2216 +{
2217 + int res = 0;
2218 + int line = 0, used = 0, members_size;
2219 + struct ip_set *set;
2220 + struct ip_set_hash_save *hash_save;
2221 + struct ip_set_restore *set_restore;
2222 + ip_set_id_t index;
2223 +
2224 + /* Loop to restore sets */
2225 + while (1) {
2226 + line++;
2227 +
2228 + DP("%u %u %u", used, sizeof(struct ip_set_restore), len);
2229 + /* Get and ensure header size */
2230 + if (used + sizeof(struct ip_set_restore) > len)
2231 + return line;
2232 + set_restore = (struct ip_set_restore *) (data + used);
2233 + used += sizeof(struct ip_set_restore);
2234 +
2235 + /* Ensure data size */
2236 + if (used
2237 + + set_restore->header_size
2238 + + set_restore->members_size > len)
2239 + return line;
2240 +
2241 + /* Check marker */
2242 + if (set_restore->index == IP_SET_INVALID_ID) {
2243 + line--;
2244 + goto bindings;
2245 + }
2246 +
2247 + /* Try to create the set */
2248 + DP("restore %s %s", set_restore->name, set_restore->typename);
2249 + res = ip_set_create(set_restore->name,
2250 + set_restore->typename,
2251 + set_restore->index,
2252 + data + used,
2253 + set_restore->header_size);
2254 +
2255 + if (res != 0)
2256 + return line;
2257 + used += set_restore->header_size;
2258 +
2259 + index = ip_set_find_byindex(set_restore->index);
2260 + DP("index %u, restore_index %u", index, set_restore->index);
2261 + if (index != set_restore->index)
2262 + return line;
2263 + /* Try to restore members data */
2264 + set = ip_set_list[index];
2265 + members_size = 0;
2266 + DP("members_size %u reqsize %u",
2267 + set_restore->members_size, set->type->reqsize);
2268 + while (members_size + set->type->reqsize <=
2269 + set_restore->members_size) {
2270 + line++;
2271 + DP("members: %u, line %u", members_size, line);
2272 + res = __ip_set_addip(index,
2273 + data + used + members_size,
2274 + set->type->reqsize);
2275 + if (!(res == 0 || res == -EEXIST))
2276 + return line;
2277 + members_size += set->type->reqsize;
2278 + }
2279 +
2280 + DP("members_size %u %u",
2281 + set_restore->members_size, members_size);
2282 + if (members_size != set_restore->members_size)
2283 + return line++;
2284 + used += set_restore->members_size;
2285 + }
2286 +
2287 + bindings:
2288 + /* Loop to restore bindings */
2289 + while (used < len) {
2290 + line++;
2291 +
2292 + DP("restore binding, line %u", line);
2293 + /* Get and ensure size */
2294 + if (used + sizeof(struct ip_set_hash_save) > len)
2295 + return line;
2296 + hash_save = (struct ip_set_hash_save *) (data + used);
2297 + used += sizeof(struct ip_set_hash_save);
2298 +
2299 + /* hash_save->id is used to store the index */
2300 + index = ip_set_find_byindex(hash_save->id);
2301 + DP("restore binding index %u, id %u, %u -> %u",
2302 + index, hash_save->id, hash_save->ip, hash_save->binding);
2303 + if (index != hash_save->id)
2304 + return line;
2305 + if (ip_set_find_byindex(hash_save->binding) == IP_SET_INVALID_ID) {
2306 + DP("corrupt binding set index %u", hash_save->binding);
2307 + return line;
2308 + }
2309 + set = ip_set_list[hash_save->id];
2310 + /* Null valued IP means default binding */
2311 + if (hash_save->ip)
2312 + res = ip_set_hash_add(set->id,
2313 + hash_save->ip,
2314 + hash_save->binding);
2315 + else {
2316 + IP_SET_ASSERT(set->binding == IP_SET_INVALID_ID);
2317 + write_lock_bh(&ip_set_lock);
2318 + set->binding = hash_save->binding;
2319 + __ip_set_get(set->binding);
2320 + write_unlock_bh(&ip_set_lock);
2321 + DP("default binding: %u", set->binding);
2322 + }
2323 + if (res != 0)
2324 + return line;
2325 + }
2326 + if (used != len)
2327 + return line;
2328 +
2329 + return 0;
2330 +}
2331 +
2332 +static int
2333 +ip_set_sockfn_set(struct sock *sk, int optval, void *user, unsigned int len)
2334 +{
2335 + void *data;
2336 + int res = 0; /* Assume OK */
2337 + unsigned *op;
2338 + struct ip_set_req_adt *req_adt;
2339 + ip_set_id_t index = IP_SET_INVALID_ID;
2340 + int (*adtfn)(ip_set_id_t index,
2341 + const void *data, size_t size);
2342 + struct fn_table {
2343 + int (*fn)(ip_set_id_t index,
2344 + const void *data, size_t size);
2345 + } adtfn_table[] =
2346 + { { ip_set_addip }, { ip_set_delip }, { ip_set_testip},
2347 + { ip_set_bindip}, { ip_set_unbindip }, { ip_set_testbind },
2348 + };
2349 +
2350 + DP("optval=%d, user=%p, len=%d", optval, user, len);
2351 + if (!capable(CAP_NET_ADMIN))
2352 + return -EPERM;
2353 + if (optval != SO_IP_SET)
2354 + return -EBADF;
2355 + if (len <= sizeof(unsigned)) {
2356 + ip_set_printk("short userdata (want >%zu, got %u)",
2357 + sizeof(unsigned), len);
2358 + return -EINVAL;
2359 + }
2360 + data = vmalloc(len);
2361 + if (!data) {
2362 + DP("out of mem for %u bytes", len);
2363 + return -ENOMEM;
2364 + }
2365 + if (copy_from_user(data, user, len) != 0) {
2366 + res = -EFAULT;
2367 + goto done;
2368 + }
2369 + if (down_interruptible(&ip_set_app_mutex)) {
2370 + res = -EINTR;
2371 + goto done;
2372 + }
2373 +
2374 + op = (unsigned *)data;
2375 + DP("op=%x", *op);
2376 +
2377 + if (*op < IP_SET_OP_VERSION) {
2378 + /* Check the version at the beginning of operations */
2379 + struct ip_set_req_version *req_version =
2380 + (struct ip_set_req_version *) data;
2381 + if (req_version->version != IP_SET_PROTOCOL_VERSION) {
2382 + res = -EPROTO;
2383 + goto done;
2384 + }
2385 + }
2386 +
2387 + switch (*op) {
2388 + case IP_SET_OP_CREATE:{
2389 + struct ip_set_req_create *req_create
2390 + = (struct ip_set_req_create *) data;
2391 +
2392 + if (len < sizeof(struct ip_set_req_create)) {
2393 + ip_set_printk("short CREATE data (want >=%zu, got %u)",
2394 + sizeof(struct ip_set_req_create), len);
2395 + res = -EINVAL;
2396 + goto done;
2397 + }
2398 + req_create->name[IP_SET_MAXNAMELEN - 1] = '\0';
2399 + req_create->typename[IP_SET_MAXNAMELEN - 1] = '\0';
2400 + res = ip_set_create(req_create->name,
2401 + req_create->typename,
2402 + IP_SET_INVALID_ID,
2403 + data + sizeof(struct ip_set_req_create),
2404 + len - sizeof(struct ip_set_req_create));
2405 + goto done;
2406 + }
2407 + case IP_SET_OP_DESTROY:{
2408 + struct ip_set_req_std *req_destroy
2409 + = (struct ip_set_req_std *) data;
2410 +
2411 + if (len != sizeof(struct ip_set_req_std)) {
2412 + ip_set_printk("invalid DESTROY data (want %zu, got %u)",
2413 + sizeof(struct ip_set_req_std), len);
2414 + res = -EINVAL;
2415 + goto done;
2416 + }
2417 + if (strcmp(req_destroy->name, IPSET_TOKEN_ALL) == 0) {
2418 + /* Destroy all sets */
2419 + index = IP_SET_INVALID_ID;
2420 + } else {
2421 + req_destroy->name[IP_SET_MAXNAMELEN - 1] = '\0';
2422 + index = ip_set_find_byname(req_destroy->name);
2423 +
2424 + if (index == IP_SET_INVALID_ID) {
2425 + res = -ENOENT;
2426 + goto done;
2427 + }
2428 + }
2429 +
2430 + res = ip_set_destroy(index);
2431 + goto done;
2432 + }
2433 + case IP_SET_OP_FLUSH:{
2434 + struct ip_set_req_std *req_flush =
2435 + (struct ip_set_req_std *) data;
2436 +
2437 + if (len != sizeof(struct ip_set_req_std)) {
2438 + ip_set_printk("invalid FLUSH data (want %zu, got %u)",
2439 + sizeof(struct ip_set_req_std), len);
2440 + res = -EINVAL;
2441 + goto done;
2442 + }
2443 + if (strcmp(req_flush->name, IPSET_TOKEN_ALL) == 0) {
2444 + /* Flush all sets */
2445 + index = IP_SET_INVALID_ID;
2446 + } else {
2447 + req_flush->name[IP_SET_MAXNAMELEN - 1] = '\0';
2448 + index = ip_set_find_byname(req_flush->name);
2449 +
2450 + if (index == IP_SET_INVALID_ID) {
2451 + res = -ENOENT;
2452 + goto done;
2453 + }
2454 + }
2455 + res = ip_set_flush(index);
2456 + goto done;
2457 + }
2458 + case IP_SET_OP_RENAME:{
2459 + struct ip_set_req_create *req_rename
2460 + = (struct ip_set_req_create *) data;
2461 +
2462 + if (len != sizeof(struct ip_set_req_create)) {
2463 + ip_set_printk("invalid RENAME data (want %zu, got %u)",
2464 + sizeof(struct ip_set_req_create), len);
2465 + res = -EINVAL;
2466 + goto done;
2467 + }
2468 +
2469 + req_rename->name[IP_SET_MAXNAMELEN - 1] = '\0';
2470 + req_rename->typename[IP_SET_MAXNAMELEN - 1] = '\0';
2471 +
2472 + index = ip_set_find_byname(req_rename->name);
2473 + if (index == IP_SET_INVALID_ID) {
2474 + res = -ENOENT;
2475 + goto done;
2476 + }
2477 + res = ip_set_rename(index, req_rename->typename);
2478 + goto done;
2479 + }
2480 + case IP_SET_OP_SWAP:{
2481 + struct ip_set_req_create *req_swap
2482 + = (struct ip_set_req_create *) data;
2483 + ip_set_id_t to_index;
2484 +
2485 + if (len != sizeof(struct ip_set_req_create)) {
2486 + ip_set_printk("invalid SWAP data (want %zu, got %u)",
2487 + sizeof(struct ip_set_req_create), len);
2488 + res = -EINVAL;
2489 + goto done;
2490 + }
2491 +
2492 + req_swap->name[IP_SET_MAXNAMELEN - 1] = '\0';
2493 + req_swap->typename[IP_SET_MAXNAMELEN - 1] = '\0';
2494 +
2495 + index = ip_set_find_byname(req_swap->name);
2496 + if (index == IP_SET_INVALID_ID) {
2497 + res = -ENOENT;
2498 + goto done;
2499 + }
2500 + to_index = ip_set_find_byname(req_swap->typename);
2501 + if (to_index == IP_SET_INVALID_ID) {
2502 + res = -ENOENT;
2503 + goto done;
2504 + }
2505 + res = ip_set_swap(index, to_index);
2506 + goto done;
2507 + }
2508 + default:
2509 + break; /* Set identified by id */
2510 + }
2511 +
2512 + /* There we may have add/del/test/bind/unbind/test_bind operations */
2513 + if (*op < IP_SET_OP_ADD_IP || *op > IP_SET_OP_TEST_BIND_SET) {
2514 + res = -EBADMSG;
2515 + goto done;
2516 + }
2517 + adtfn = adtfn_table[*op - IP_SET_OP_ADD_IP].fn;
2518 +
2519 + if (len < sizeof(struct ip_set_req_adt)) {
2520 + ip_set_printk("short data in adt request (want >=%zu, got %u)",
2521 + sizeof(struct ip_set_req_adt), len);
2522 + res = -EINVAL;
2523 + goto done;
2524 + }
2525 + req_adt = (struct ip_set_req_adt *) data;
2526 +
2527 + /* -U :all: :all:|:default: uses IP_SET_INVALID_ID */
2528 + if (!(*op == IP_SET_OP_UNBIND_SET
2529 + && req_adt->index == IP_SET_INVALID_ID)) {
2530 + index = ip_set_find_byindex(req_adt->index);
2531 + if (index == IP_SET_INVALID_ID) {
2532 + res = -ENOENT;
2533 + goto done;
2534 + }
2535 + }
2536 + res = adtfn(index, data, len);
2537 +
2538 + done:
2539 + up(&ip_set_app_mutex);
2540 + vfree(data);
2541 + if (res > 0)
2542 + res = 0;
2543 + DP("final result %d", res);
2544 + return res;
2545 +}
2546 +
2547 +static int
2548 +ip_set_sockfn_get(struct sock *sk, int optval, void *user, int *len)
2549 +{
2550 + int res = 0;
2551 + unsigned *op;
2552 + ip_set_id_t index = IP_SET_INVALID_ID;
2553 + void *data;
2554 + int copylen = *len;
2555 +
2556 + DP("optval=%d, user=%p, len=%d", optval, user, *len);
2557 + if (!capable(CAP_NET_ADMIN))
2558 + return -EPERM;
2559 + if (optval != SO_IP_SET)
2560 + return -EBADF;
2561 + if (*len < sizeof(unsigned)) {
2562 + ip_set_printk("short userdata (want >=%zu, got %d)",
2563 + sizeof(unsigned), *len);
2564 + return -EINVAL;
2565 + }
2566 + data = vmalloc(*len);
2567 + if (!data) {
2568 + DP("out of mem for %d bytes", *len);
2569 + return -ENOMEM;
2570 + }
2571 + if (copy_from_user(data, user, *len) != 0) {
2572 + res = -EFAULT;
2573 + goto done;
2574 + }
2575 + if (down_interruptible(&ip_set_app_mutex)) {
2576 + res = -EINTR;
2577 + goto done;
2578 + }
2579 +
2580 + op = (unsigned *) data;
2581 + DP("op=%x", *op);
2582 +
2583 + if (*op < IP_SET_OP_VERSION) {
2584 + /* Check the version at the beginning of operations */
2585 + struct ip_set_req_version *req_version =
2586 + (struct ip_set_req_version *) data;
2587 + if (req_version->version != IP_SET_PROTOCOL_VERSION) {
2588 + res = -EPROTO;
2589 + goto done;
2590 + }
2591 + }
2592 +
2593 + switch (*op) {
2594 + case IP_SET_OP_VERSION: {
2595 + struct ip_set_req_version *req_version =
2596 + (struct ip_set_req_version *) data;
2597 +
2598 + if (*len != sizeof(struct ip_set_req_version)) {
2599 + ip_set_printk("invalid VERSION (want %zu, got %d)",
2600 + sizeof(struct ip_set_req_version),
2601 + *len);
2602 + res = -EINVAL;
2603 + goto done;
2604 + }
2605 +
2606 + req_version->version = IP_SET_PROTOCOL_VERSION;
2607 + res = copy_to_user(user, req_version,
2608 + sizeof(struct ip_set_req_version));
2609 + goto done;
2610 + }
2611 + case IP_SET_OP_GET_BYNAME: {
2612 + struct ip_set_req_get_set *req_get
2613 + = (struct ip_set_req_get_set *) data;
2614 +
2615 + if (*len != sizeof(struct ip_set_req_get_set)) {
2616 + ip_set_printk("invalid GET_BYNAME (want %zu, got %d)",
2617 + sizeof(struct ip_set_req_get_set), *len);
2618 + res = -EINVAL;
2619 + goto done;
2620 + }
2621 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2622 + index = ip_set_find_byname(req_get->set.name);
2623 + req_get->set.index = index;
2624 + goto copy;
2625 + }
2626 + case IP_SET_OP_GET_BYINDEX: {
2627 + struct ip_set_req_get_set *req_get
2628 + = (struct ip_set_req_get_set *) data;
2629 +
2630 + if (*len != sizeof(struct ip_set_req_get_set)) {
2631 + ip_set_printk("invalid GET_BYINDEX (want %zu, got %d)",
2632 + sizeof(struct ip_set_req_get_set), *len);
2633 + res = -EINVAL;
2634 + goto done;
2635 + }
2636 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2637 + index = ip_set_find_byindex(req_get->set.index);
2638 + strncpy(req_get->set.name,
2639 + index == IP_SET_INVALID_ID ? ""
2640 + : ip_set_list[index]->name, IP_SET_MAXNAMELEN);
2641 + goto copy;
2642 + }
2643 + case IP_SET_OP_ADT_GET: {
2644 + struct ip_set_req_adt_get *req_get
2645 + = (struct ip_set_req_adt_get *) data;
2646 +
2647 + if (*len != sizeof(struct ip_set_req_adt_get)) {
2648 + ip_set_printk("invalid ADT_GET (want %zu, got %d)",
2649 + sizeof(struct ip_set_req_adt_get), *len);
2650 + res = -EINVAL;
2651 + goto done;
2652 + }
2653 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2654 + index = ip_set_find_byname(req_get->set.name);
2655 + if (index != IP_SET_INVALID_ID) {
2656 + req_get->set.index = index;
2657 + strncpy(req_get->typename,
2658 + ip_set_list[index]->type->typename,
2659 + IP_SET_MAXNAMELEN - 1);
2660 + } else {
2661 + res = -ENOENT;
2662 + goto done;
2663 + }
2664 + goto copy;
2665 + }
2666 + case IP_SET_OP_MAX_SETS: {
2667 + struct ip_set_req_max_sets *req_max_sets
2668 + = (struct ip_set_req_max_sets *) data;
2669 + ip_set_id_t i;
2670 +
2671 + if (*len != sizeof(struct ip_set_req_max_sets)) {
2672 + ip_set_printk("invalid MAX_SETS (want %zu, got %d)",
2673 + sizeof(struct ip_set_req_max_sets), *len);
2674 + res = -EINVAL;
2675 + goto done;
2676 + }
2677 +
2678 + if (strcmp(req_max_sets->set.name, IPSET_TOKEN_ALL) == 0) {
2679 + req_max_sets->set.index = IP_SET_INVALID_ID;
2680 + } else {
2681 + req_max_sets->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2682 + req_max_sets->set.index =
2683 + ip_set_find_byname(req_max_sets->set.name);
2684 + if (req_max_sets->set.index == IP_SET_INVALID_ID) {
2685 + res = -ENOENT;
2686 + goto done;
2687 + }
2688 + }
2689 + req_max_sets->max_sets = ip_set_max;
2690 + req_max_sets->sets = 0;
2691 + for (i = 0; i < ip_set_max; i++) {
2692 + if (ip_set_list[i] != NULL)
2693 + req_max_sets->sets++;
2694 + }
2695 + goto copy;
2696 + }
2697 + case IP_SET_OP_LIST_SIZE:
2698 + case IP_SET_OP_SAVE_SIZE: {
2699 + struct ip_set_req_setnames *req_setnames
2700 + = (struct ip_set_req_setnames *) data;
2701 + struct ip_set_name_list *name_list;
2702 + struct ip_set *set;
2703 + ip_set_id_t i;
2704 + int used;
2705 +
2706 + if (*len < sizeof(struct ip_set_req_setnames)) {
2707 + ip_set_printk("short LIST_SIZE (want >=%zu, got %d)",
2708 + sizeof(struct ip_set_req_setnames), *len);
2709 + res = -EINVAL;
2710 + goto done;
2711 + }
2712 +
2713 + req_setnames->size = 0;
2714 + used = sizeof(struct ip_set_req_setnames);
2715 + for (i = 0; i < ip_set_max; i++) {
2716 + if (ip_set_list[i] == NULL)
2717 + continue;
2718 + name_list = (struct ip_set_name_list *)
2719 + (data + used);
2720 + used += sizeof(struct ip_set_name_list);
2721 + if (used > copylen) {
2722 + res = -EAGAIN;
2723 + goto done;
2724 + }
2725 + set = ip_set_list[i];
2726 + /* Fill in index, name, etc. */
2727 + name_list->index = i;
2728 + name_list->id = set->id;
2729 + strncpy(name_list->name,
2730 + set->name,
2731 + IP_SET_MAXNAMELEN - 1);
2732 + strncpy(name_list->typename,
2733 + set->type->typename,
2734 + IP_SET_MAXNAMELEN - 1);
2735 + DP("filled %s of type %s, index %u\n",
2736 + name_list->name, name_list->typename,
2737 + name_list->index);
2738 + if (!(req_setnames->index == IP_SET_INVALID_ID
2739 + || req_setnames->index == i))
2740 + continue;
2741 + /* Update size */
2742 + switch (*op) {
2743 + case IP_SET_OP_LIST_SIZE: {
2744 + req_setnames->size += sizeof(struct ip_set_list)
2745 + + set->type->header_size
2746 + + set->type->list_members_size(set);
2747 + /* Sets are identified by id in the hash */
2748 + FOREACH_HASH_DO(__set_hash_bindings_size_list,
2749 + set->id, &req_setnames->size);
2750 + break;
2751 + }
2752 + case IP_SET_OP_SAVE_SIZE: {
2753 + req_setnames->size += sizeof(struct ip_set_save)
2754 + + set->type->header_size
2755 + + set->type->list_members_size(set);
2756 + FOREACH_HASH_DO(__set_hash_bindings_size_save,
2757 + set->id, &req_setnames->size);
2758 + break;
2759 + }
2760 + default:
2761 + break;
2762 + }
2763 + }
2764 + if (copylen != used) {
2765 + res = -EAGAIN;
2766 + goto done;
2767 + }
2768 + goto copy;
2769 + }
2770 + case IP_SET_OP_LIST: {
2771 + struct ip_set_req_list *req_list
2772 + = (struct ip_set_req_list *) data;
2773 + ip_set_id_t i;
2774 + int used;
2775 +
2776 + if (*len < sizeof(struct ip_set_req_list)) {
2777 + ip_set_printk("short LIST (want >=%zu, got %d)",
2778 + sizeof(struct ip_set_req_list), *len);
2779 + res = -EINVAL;
2780 + goto done;
2781 + }
2782 + index = req_list->index;
2783 + if (index != IP_SET_INVALID_ID
2784 + && ip_set_find_byindex(index) != index) {
2785 + res = -ENOENT;
2786 + goto done;
2787 + }
2788 + used = 0;
2789 + if (index == IP_SET_INVALID_ID) {
2790 + /* List all sets */
2791 + for (i = 0; i < ip_set_max && res == 0; i++) {
2792 + if (ip_set_list[i] != NULL)
2793 + res = ip_set_list_set(i, data, &used, *len);
2794 + }
2795 + } else {
2796 + /* List an individual set */
2797 + res = ip_set_list_set(index, data, &used, *len);
2798 + }
2799 + if (res != 0)
2800 + goto done;
2801 + else if (copylen != used) {
2802 + res = -EAGAIN;
2803 + goto done;
2804 + }
2805 + goto copy;
2806 + }
2807 + case IP_SET_OP_SAVE: {
2808 + struct ip_set_req_list *req_save
2809 + = (struct ip_set_req_list *) data;
2810 + ip_set_id_t i;
2811 + int used;
2812 +
2813 + if (*len < sizeof(struct ip_set_req_list)) {
2814 + ip_set_printk("short SAVE (want >=%zu, got %d)",
2815 + sizeof(struct ip_set_req_list), *len);
2816 + res = -EINVAL;
2817 + goto done;
2818 + }
2819 + index = req_save->index;
2820 + if (index != IP_SET_INVALID_ID
2821 + && ip_set_find_byindex(index) != index) {
2822 + res = -ENOENT;
2823 + goto done;
2824 + }
2825 + used = 0;
2826 + if (index == IP_SET_INVALID_ID) {
2827 + /* Save all sets */
2828 + for (i = 0; i < ip_set_max && res == 0; i++) {
2829 + if (ip_set_list[i] != NULL)
2830 + res = ip_set_save_set(i, data, &used, *len);
2831 + }
2832 + } else {
2833 + /* Save an individual set */
2834 + res = ip_set_save_set(index, data, &used, *len);
2835 + }
2836 + if (res == 0)
2837 + res = ip_set_save_bindings(index, data, &used, *len);
2838 +
2839 + if (res != 0)
2840 + goto done;
2841 + else if (copylen != used) {
2842 + res = -EAGAIN;
2843 + goto done;
2844 + }
2845 + goto copy;
2846 + }
2847 + case IP_SET_OP_RESTORE: {
2848 + struct ip_set_req_setnames *req_restore
2849 + = (struct ip_set_req_setnames *) data;
2850 + int line;
2851 +
2852 + if (*len < sizeof(struct ip_set_req_setnames)
2853 + || *len != req_restore->size) {
2854 + ip_set_printk("invalid RESTORE (want =%zu, got %d)",
2855 + req_restore->size, *len);
2856 + res = -EINVAL;
2857 + goto done;
2858 + }
2859 + line = ip_set_restore(data + sizeof(struct ip_set_req_setnames),
2860 + req_restore->size - sizeof(struct ip_set_req_setnames));
2861 + DP("ip_set_restore: %u", line);
2862 + if (line != 0) {
2863 + res = -EAGAIN;
2864 + req_restore->size = line;
2865 + copylen = sizeof(struct ip_set_req_setnames);
2866 + goto copy;
2867 + }
2868 + goto done;
2869 + }
2870 + default:
2871 + res = -EBADMSG;
2872 + goto done;
2873 + } /* end of switch(op) */
2874 +
2875 + copy:
2876 + DP("set %s, copylen %u", index != IP_SET_INVALID_ID
2877 + && ip_set_list[index]
2878 + ? ip_set_list[index]->name
2879 + : ":all:", copylen);
2880 + res = copy_to_user(user, data, copylen);
2881 +
2882 + done:
2883 + up(&ip_set_app_mutex);
2884 + vfree(data);
2885 + if (res > 0)
2886 + res = 0;
2887 + DP("final result %d", res);
2888 + return res;
2889 +}
2890 +
2891 +static struct nf_sockopt_ops so_set = {
2892 + .pf = PF_INET,
2893 + .set_optmin = SO_IP_SET,
2894 + .set_optmax = SO_IP_SET + 1,
2895 + .set = &ip_set_sockfn_set,
2896 + .get_optmin = SO_IP_SET,
2897 + .get_optmax = SO_IP_SET + 1,
2898 + .get = &ip_set_sockfn_get,
2899 + .use = 0
2900 +};
2901 +
2902 +static int max_sets, hash_size;
2903 +module_param(max_sets, int, 0600);
2904 +MODULE_PARM_DESC(max_sets, "maximal number of sets");
2905 +module_param(hash_size, int, 0600);
2906 +MODULE_PARM_DESC(hash_size, "hash size for bindings");
2907 +MODULE_LICENSE("GPL");
2908 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
2909 +MODULE_DESCRIPTION("module implementing core IP set support");
2910 +
2911 +static int __init init(void)
2912 +{
2913 + int res;
2914 + ip_set_id_t i;
2915 +
2916 + get_random_bytes(&ip_set_hash_random, 4);
2917 + if (max_sets)
2918 + ip_set_max = max_sets;
2919 + ip_set_list = vmalloc(sizeof(struct ip_set *) * ip_set_max);
2920 + if (!ip_set_list) {
2921 + printk(KERN_ERR "Unable to create ip_set_list\n");
2922 + return -ENOMEM;
2923 + }
2924 + memset(ip_set_list, 0, sizeof(struct ip_set *) * ip_set_max);
2925 + if (hash_size)
2926 + ip_set_bindings_hash_size = hash_size;
2927 + ip_set_hash = vmalloc(sizeof(struct list_head) * ip_set_bindings_hash_size);
2928 + if (!ip_set_hash) {
2929 + printk(KERN_ERR "Unable to create ip_set_hash\n");
2930 + vfree(ip_set_list);
2931 + return -ENOMEM;
2932 + }
2933 + for (i = 0; i < ip_set_bindings_hash_size; i++)
2934 + INIT_LIST_HEAD(&ip_set_hash[i]);
2935 +
2936 + INIT_LIST_HEAD(&set_type_list);
2937 +
2938 + res = nf_register_sockopt(&so_set);
2939 + if (res != 0) {
2940 + ip_set_printk("SO_SET registry failed: %d", res);
2941 + vfree(ip_set_list);
2942 + vfree(ip_set_hash);
2943 + return res;
2944 + }
2945 + return 0;
2946 +}
2947 +
2948 +static void __exit fini(void)
2949 +{
2950 + /* There can't be any existing set or binding */
2951 + nf_unregister_sockopt(&so_set);
2952 + vfree(ip_set_list);
2953 + vfree(ip_set_hash);
2954 + DP("these are the famous last words");
2955 +}
2956 +
2957 +EXPORT_SYMBOL(ip_set_register_set_type);
2958 +EXPORT_SYMBOL(ip_set_unregister_set_type);
2959 +
2960 +EXPORT_SYMBOL(ip_set_get_byname);
2961 +EXPORT_SYMBOL(ip_set_get_byindex);
2962 +EXPORT_SYMBOL(ip_set_put);
2963 +
2964 +EXPORT_SYMBOL(ip_set_addip_kernel);
2965 +EXPORT_SYMBOL(ip_set_delip_kernel);
2966 +EXPORT_SYMBOL(ip_set_testip_kernel);
2967 +
2968 +module_init(init);
2969 +module_exit(fini);
2970 Index: linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_iphash.c
2971 ===================================================================
2972 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
2973 +++ linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_iphash.c 2007-06-17 01:57:56.984987608 +0200
2974 @@ -0,0 +1,413 @@
2975 +/* Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
2976 + *
2977 + * This program is free software; you can redistribute it and/or modify
2978 + * it under the terms of the GNU General Public License version 2 as
2979 + * published by the Free Software Foundation.
2980 + */
2981 +
2982 +/* Kernel module implementing an ip hash set */
2983 +
2984 +#include <linux/module.h>
2985 +#include <linux/ip.h>
2986 +#include <linux/skbuff.h>
2987 +#include <linux/netfilter_ipv4/ip_tables.h>
2988 +#include <linux/netfilter_ipv4/ip_set.h>
2989 +#include <linux/errno.h>
2990 +#include <asm/uaccess.h>
2991 +#include <asm/bitops.h>
2992 +#include <linux/spinlock.h>
2993 +#include <linux/vmalloc.h>
2994 +#include <linux/random.h>
2995 +#include <linux/jhash.h>
2996 +
2997 +#include <net/ip.h>
2998 +
2999 +#include <linux/netfilter_ipv4/ip_set_malloc.h>
3000 +#include <linux/netfilter_ipv4/ip_set_iphash.h>
3001 +
3002 +static int limit = MAX_RANGE;
3003 +
3004 +static inline __u32
3005 +jhash_ip(const struct ip_set_iphash *map, uint16_t i, ip_set_ip_t ip)
3006 +{
3007 + return jhash_1word(ip, *(((uint32_t *) map->initval) + i));
3008 +}
3009 +
3010 +static inline __u32
3011 +hash_id(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3012 +{
3013 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3014 + __u32 id;
3015 + u_int16_t i;
3016 + ip_set_ip_t *elem;
3017 +
3018 + *hash_ip = ip & map->netmask;
3019 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u, %u.%u.%u.%u",
3020 + set->name, HIPQUAD(ip), HIPQUAD(*hash_ip), HIPQUAD(map->netmask));
3021 +
3022 + for (i = 0; i < map->probes; i++) {
3023 + id = jhash_ip(map, i, *hash_ip) % map->hashsize;
3024 + DP("hash key: %u", id);
3025 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
3026 + if (*elem == *hash_ip)
3027 + return id;
3028 + /* No shortcut at testing - there can be deleted
3029 + * entries. */
3030 + }
3031 + return UINT_MAX;
3032 +}
3033 +
3034 +static inline int
3035 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3036 +{
3037 + return (ip && hash_id(set, ip, hash_ip) != UINT_MAX);
3038 +}
3039 +
3040 +static int
3041 +testip(struct ip_set *set, const void *data, size_t size,
3042 + ip_set_ip_t *hash_ip)
3043 +{
3044 + struct ip_set_req_iphash *req =
3045 + (struct ip_set_req_iphash *) data;
3046 +
3047 + if (size != sizeof(struct ip_set_req_iphash)) {
3048 + ip_set_printk("data length wrong (want %zu, have %zu)",
3049 + sizeof(struct ip_set_req_iphash),
3050 + size);
3051 + return -EINVAL;
3052 + }
3053 + return __testip(set, req->ip, hash_ip);
3054 +}
3055 +
3056 +static int
3057 +testip_kernel(struct ip_set *set,
3058 + const struct sk_buff *skb,
3059 + ip_set_ip_t *hash_ip,
3060 + const u_int32_t *flags,
3061 + unsigned char index)
3062 +{
3063 + return __testip(set,
3064 + ntohl(flags[index] & IPSET_SRC
3065 + ? ip_hdr(skb)->saddr
3066 + : ip_hdr(skb)->daddr),
3067 + hash_ip);
3068 +}
3069 +
3070 +static inline int
3071 +__addip(struct ip_set_iphash *map, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3072 +{
3073 + __u32 probe;
3074 + u_int16_t i;
3075 + ip_set_ip_t *elem;
3076 +
3077 + if (!ip || map->elements > limit)
3078 + return -ERANGE;
3079 +
3080 + *hash_ip = ip & map->netmask;
3081 +
3082 + for (i = 0; i < map->probes; i++) {
3083 + probe = jhash_ip(map, i, *hash_ip) % map->hashsize;
3084 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, probe);
3085 + if (*elem == *hash_ip)
3086 + return -EEXIST;
3087 + if (!*elem) {
3088 + *elem = *hash_ip;
3089 + map->elements++;
3090 + return 0;
3091 + }
3092 + }
3093 + /* Trigger rehashing */
3094 + return -EAGAIN;
3095 +}
3096 +
3097 +static int
3098 +addip(struct ip_set *set, const void *data, size_t size,
3099 + ip_set_ip_t *hash_ip)
3100 +{
3101 + struct ip_set_req_iphash *req =
3102 + (struct ip_set_req_iphash *) data;
3103 +
3104 + if (size != sizeof(struct ip_set_req_iphash)) {
3105 + ip_set_printk("data length wrong (want %zu, have %zu)",
3106 + sizeof(struct ip_set_req_iphash),
3107 + size);
3108 + return -EINVAL;
3109 + }
3110 + return __addip((struct ip_set_iphash *) set->data, req->ip, hash_ip);
3111 +}
3112 +
3113 +static int
3114 +addip_kernel(struct ip_set *set,
3115 + const struct sk_buff *skb,
3116 + ip_set_ip_t *hash_ip,
3117 + const u_int32_t *flags,
3118 + unsigned char index)
3119 +{
3120 + return __addip((struct ip_set_iphash *) set->data,
3121 + ntohl(flags[index] & IPSET_SRC
3122 + ? ip_hdr(skb)->saddr
3123 + : ip_hdr(skb)->daddr),
3124 + hash_ip);
3125 +}
3126 +
3127 +static int retry(struct ip_set *set)
3128 +{
3129 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3130 + ip_set_ip_t hash_ip, *elem;
3131 + void *members;
3132 + u_int32_t i, hashsize = map->hashsize;
3133 + int res;
3134 + struct ip_set_iphash *tmp;
3135 +
3136 + if (map->resize == 0)
3137 + return -ERANGE;
3138 +
3139 + again:
3140 + res = 0;
3141 +
3142 + /* Calculate new hash size */
3143 + hashsize += (hashsize * map->resize)/100;
3144 + if (hashsize == map->hashsize)
3145 + hashsize++;
3146 +
3147 + ip_set_printk("rehashing of set %s triggered: "
3148 + "hashsize grows from %u to %u",
3149 + set->name, map->hashsize, hashsize);
3150 +
3151 + tmp = kmalloc(sizeof(struct ip_set_iphash)
3152 + + map->probes * sizeof(uint32_t), GFP_ATOMIC);
3153 + if (!tmp) {
3154 + DP("out of memory for %d bytes",
3155 + sizeof(struct ip_set_iphash)
3156 + + map->probes * sizeof(uint32_t));
3157 + return -ENOMEM;
3158 + }
3159 + tmp->members = harray_malloc(hashsize, sizeof(ip_set_ip_t), GFP_ATOMIC);
3160 + if (!tmp->members) {
3161 + DP("out of memory for %d bytes", hashsize * sizeof(ip_set_ip_t));
3162 + kfree(tmp);
3163 + return -ENOMEM;
3164 + }
3165 + tmp->hashsize = hashsize;
3166 + tmp->elements = 0;
3167 + tmp->probes = map->probes;
3168 + tmp->resize = map->resize;
3169 + tmp->netmask = map->netmask;
3170 + memcpy(tmp->initval, map->initval, map->probes * sizeof(uint32_t));
3171 +
3172 + write_lock_bh(&set->lock);
3173 + map = (struct ip_set_iphash *) set->data; /* Play safe */
3174 + for (i = 0; i < map->hashsize && res == 0; i++) {
3175 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, i);
3176 + if (*elem)
3177 + res = __addip(tmp, *elem, &hash_ip);
3178 + }
3179 + if (res) {
3180 + /* Failure, try again */
3181 + write_unlock_bh(&set->lock);
3182 + harray_free(tmp->members);
3183 + kfree(tmp);
3184 + goto again;
3185 + }
3186 +
3187 + /* Success at resizing! */
3188 + members = map->members;
3189 +
3190 + map->hashsize = tmp->hashsize;
3191 + map->members = tmp->members;
3192 + write_unlock_bh(&set->lock);
3193 +
3194 + harray_free(members);
3195 + kfree(tmp);
3196 +
3197 + return 0;
3198 +}
3199 +
3200 +static inline int
3201 +__delip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3202 +{
3203 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3204 + ip_set_ip_t id, *elem;
3205 +
3206 + if (!ip)
3207 + return -ERANGE;
3208 +
3209 + id = hash_id(set, ip, hash_ip);
3210 + if (id == UINT_MAX)
3211 + return -EEXIST;
3212 +
3213 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
3214 + *elem = 0;
3215 + map->elements--;
3216 +
3217 + return 0;
3218 +}
3219 +
3220 +static int
3221 +delip(struct ip_set *set, const void *data, size_t size,
3222 + ip_set_ip_t *hash_ip)
3223 +{
3224 + struct ip_set_req_iphash *req =
3225 + (struct ip_set_req_iphash *) data;
3226 +
3227 + if (size != sizeof(struct ip_set_req_iphash)) {
3228 + ip_set_printk("data length wrong (want %zu, have %zu)",
3229 + sizeof(struct ip_set_req_iphash),
3230 + size);
3231 + return -EINVAL;
3232 + }
3233 + return __delip(set, req->ip, hash_ip);
3234 +}
3235 +
3236 +static int
3237 +delip_kernel(struct ip_set *set,
3238 + const struct sk_buff *skb,
3239 + ip_set_ip_t *hash_ip,
3240 + const u_int32_t *flags,
3241 + unsigned char index)
3242 +{
3243 + return __delip(set,
3244 + ntohl(flags[index] & IPSET_SRC
3245 + ? ip_hdr(skb)->saddr
3246 + : ip_hdr(skb)->daddr),
3247 + hash_ip);
3248 +}
3249 +
3250 +static int create(struct ip_set *set, const void *data, size_t size)
3251 +{
3252 + struct ip_set_req_iphash_create *req =
3253 + (struct ip_set_req_iphash_create *) data;
3254 + struct ip_set_iphash *map;
3255 + uint16_t i;
3256 +
3257 + if (size != sizeof(struct ip_set_req_iphash_create)) {
3258 + ip_set_printk("data length wrong (want %zu, have %zu)",
3259 + sizeof(struct ip_set_req_iphash_create),
3260 + size);
3261 + return -EINVAL;
3262 + }
3263 +
3264 + if (req->hashsize < 1) {
3265 + ip_set_printk("hashsize too small");
3266 + return -ENOEXEC;
3267 + }
3268 +
3269 + if (req->probes < 1) {
3270 + ip_set_printk("probes too small");
3271 + return -ENOEXEC;
3272 + }
3273 +
3274 + map = kmalloc(sizeof(struct ip_set_iphash)
3275 + + req->probes * sizeof(uint32_t), GFP_KERNEL);
3276 + if (!map) {
3277 + DP("out of memory for %d bytes",
3278 + sizeof(struct ip_set_iphash)
3279 + + req->probes * sizeof(uint32_t));
3280 + return -ENOMEM;
3281 + }
3282 + for (i = 0; i < req->probes; i++)
3283 + get_random_bytes(((uint32_t *) map->initval)+i, 4);
3284 + map->elements = 0;
3285 + map->hashsize = req->hashsize;
3286 + map->probes = req->probes;
3287 + map->resize = req->resize;
3288 + map->netmask = req->netmask;
3289 + map->members = harray_malloc(map->hashsize, sizeof(ip_set_ip_t), GFP_KERNEL);
3290 + if (!map->members) {
3291 + DP("out of memory for %d bytes", map->hashsize * sizeof(ip_set_ip_t));
3292 + kfree(map);
3293 + return -ENOMEM;
3294 + }
3295 +
3296 + set->data = map;
3297 + return 0;
3298 +}
3299 +
3300 +static void destroy(struct ip_set *set)
3301 +{
3302 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3303 +
3304 + harray_free(map->members);
3305 + kfree(map);
3306 +
3307 + set->data = NULL;
3308 +}
3309 +
3310 +static void flush(struct ip_set *set)
3311 +{
3312 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3313 + harray_flush(map->members, map->hashsize, sizeof(ip_set_ip_t));
3314 + map->elements = 0;
3315 +}
3316 +
3317 +static void list_header(const struct ip_set *set, void *data)
3318 +{
3319 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3320 + struct ip_set_req_iphash_create *header =
3321 + (struct ip_set_req_iphash_create *) data;
3322 +
3323 + header->hashsize = map->hashsize;
3324 + header->probes = map->probes;
3325 + header->resize = map->resize;
3326 + header->netmask = map->netmask;
3327 +}
3328 +
3329 +static int list_members_size(const struct ip_set *set)
3330 +{
3331 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3332 +
3333 + return (map->hashsize * sizeof(ip_set_ip_t));
3334 +}
3335 +
3336 +static void list_members(const struct ip_set *set, void *data)
3337 +{
3338 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3339 + ip_set_ip_t i, *elem;
3340 +
3341 + for (i = 0; i < map->hashsize; i++) {
3342 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, i);
3343 + ((ip_set_ip_t *)data)[i] = *elem;
3344 + }
3345 +}
3346 +
3347 +static struct ip_set_type ip_set_iphash = {
3348 + .typename = SETTYPE_NAME,
3349 + .features = IPSET_TYPE_IP | IPSET_DATA_SINGLE,
3350 + .protocol_version = IP_SET_PROTOCOL_VERSION,
3351 + .create = &create,
3352 + .destroy = &destroy,
3353 + .flush = &flush,
3354 + .reqsize = sizeof(struct ip_set_req_iphash),
3355 + .addip = &addip,
3356 + .addip_kernel = &addip_kernel,
3357 + .retry = &retry,
3358 + .delip = &delip,
3359 + .delip_kernel = &delip_kernel,
3360 + .testip = &testip,
3361 + .testip_kernel = &testip_kernel,
3362 + .header_size = sizeof(struct ip_set_req_iphash_create),
3363 + .list_header = &list_header,
3364 + .list_members_size = &list_members_size,
3365 + .list_members = &list_members,
3366 + .me = THIS_MODULE,
3367 +};
3368 +
3369 +MODULE_LICENSE("GPL");
3370 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
3371 +MODULE_DESCRIPTION("iphash type of IP sets");
3372 +module_param(limit, int, 0600);
3373 +MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
3374 +
3375 +static int __init init(void)
3376 +{
3377 + return ip_set_register_set_type(&ip_set_iphash);
3378 +}
3379 +
3380 +static void __exit fini(void)
3381 +{
3382 + /* FIXME: possible race with ip_set_create() */
3383 + ip_set_unregister_set_type(&ip_set_iphash);
3384 +}
3385 +
3386 +module_init(init);
3387 +module_exit(fini);
3388 Index: linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_ipmap.c
3389 ===================================================================
3390 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
3391 +++ linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_ipmap.c 2007-06-17 01:57:56.985987456 +0200
3392 @@ -0,0 +1,327 @@
3393 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
3394 + * Patrick Schaaf <bof@bof.de>
3395 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
3396 + *
3397 + * This program is free software; you can redistribute it and/or modify
3398 + * it under the terms of the GNU General Public License version 2 as
3399 + * published by the Free Software Foundation.
3400 + */
3401 +
3402 +/* Kernel module implementing an IP set type: the single bitmap type */
3403 +
3404 +#include <linux/module.h>
3405 +#include <linux/ip.h>
3406 +#include <linux/skbuff.h>
3407 +#include <linux/netfilter_ipv4/ip_tables.h>
3408 +#include <linux/netfilter_ipv4/ip_set.h>
3409 +#include <linux/errno.h>
3410 +#include <asm/uaccess.h>
3411 +#include <asm/bitops.h>
3412 +#include <linux/spinlock.h>
3413 +#include <linux/skbuff.h>
3414 +#include <linux/netfilter_ipv4/ip_set_ipmap.h>
3415 +
3416 +static inline ip_set_ip_t
3417 +ip_to_id(const struct ip_set_ipmap *map, ip_set_ip_t ip)
3418 +{
3419 + return (ip - map->first_ip)/map->hosts;
3420 +}
3421 +
3422 +static inline int
3423 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3424 +{
3425 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3426 +
3427 + if (ip < map->first_ip || ip > map->last_ip)
3428 + return -ERANGE;
3429 +
3430 + *hash_ip = ip & map->netmask;
3431 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u",
3432 + set->name, HIPQUAD(ip), HIPQUAD(*hash_ip));
3433 + return !!test_bit(ip_to_id(map, *hash_ip), map->members);
3434 +}
3435 +
3436 +static int
3437 +testip(struct ip_set *set, const void *data, size_t size,
3438 + ip_set_ip_t *hash_ip)
3439 +{
3440 + struct ip_set_req_ipmap *req =
3441 + (struct ip_set_req_ipmap *) data;
3442 +
3443 + if (size != sizeof(struct ip_set_req_ipmap)) {
3444 + ip_set_printk("data length wrong (want %zu, have %zu)",
3445 + sizeof(struct ip_set_req_ipmap),
3446 + size);
3447 + return -EINVAL;
3448 + }
3449 + return __testip(set, req->ip, hash_ip);
3450 +}
3451 +
3452 +static int
3453 +testip_kernel(struct ip_set *set,
3454 + const struct sk_buff *skb,
3455 + ip_set_ip_t *hash_ip,
3456 + const u_int32_t *flags,
3457 + unsigned char index)
3458 +{
3459 + int res;
3460 +
3461 + DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
3462 + flags[index] & IPSET_SRC ? "SRC" : "DST",
3463 + NIPQUAD(ip_hdr(skb)->saddr),
3464 + NIPQUAD(ip_hdr(skb)->daddr));
3465 +
3466 + res = __testip(set,
3467 + ntohl(flags[index] & IPSET_SRC
3468 + ? ip_hdr(skb)->saddr
3469 + : ip_hdr(skb)->daddr),
3470 + hash_ip);
3471 + return (res < 0 ? 0 : res);
3472 +}
3473 +
3474 +static inline int
3475 +__addip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3476 +{
3477 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3478 +
3479 + if (ip < map->first_ip || ip > map->last_ip)
3480 + return -ERANGE;
3481 +
3482 + *hash_ip = ip & map->netmask;
3483 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
3484 + if (test_and_set_bit(ip_to_id(map, *hash_ip), map->members))
3485 + return -EEXIST;
3486 +
3487 + return 0;
3488 +}
3489 +
3490 +static int
3491 +addip(struct ip_set *set, const void *data, size_t size,
3492 + ip_set_ip_t *hash_ip)
3493 +{
3494 + struct ip_set_req_ipmap *req =
3495 + (struct ip_set_req_ipmap *) data;
3496 +
3497 + if (size != sizeof(struct ip_set_req_ipmap)) {
3498 + ip_set_printk("data length wrong (want %zu, have %zu)",
3499 + sizeof(struct ip_set_req_ipmap),
3500 + size);
3501 + return -EINVAL;
3502 + }
3503 + DP("%u.%u.%u.%u", HIPQUAD(req->ip));
3504 + return __addip(set, req->ip, hash_ip);
3505 +}
3506 +
3507 +static int
3508 +addip_kernel(struct ip_set *set,
3509 + const struct sk_buff *skb,
3510 + ip_set_ip_t *hash_ip,
3511 + const u_int32_t *flags,
3512 + unsigned char index)
3513 +{
3514 + return __addip(set,
3515 + ntohl(flags[index] & IPSET_SRC
3516 + ? ip_hdr(skb)->saddr
3517 + : ip_hdr(skb)->daddr),
3518 + hash_ip);
3519 +}
3520 +
3521 +static inline int
3522 +__delip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3523 +{
3524 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3525 +
3526 + if (ip < map->first_ip || ip > map->last_ip)
3527 + return -ERANGE;
3528 +
3529 + *hash_ip = ip & map->netmask;
3530 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
3531 + if (!test_and_clear_bit(ip_to_id(map, *hash_ip), map->members))
3532 + return -EEXIST;
3533 +
3534 + return 0;
3535 +}
3536 +
3537 +static int
3538 +delip(struct ip_set *set, const void *data, size_t size,
3539 + ip_set_ip_t *hash_ip)
3540 +{
3541 + struct ip_set_req_ipmap *req =
3542 + (struct ip_set_req_ipmap *) data;
3543 +
3544 + if (size != sizeof(struct ip_set_req_ipmap)) {
3545 + ip_set_printk("data length wrong (want %zu, have %zu)",
3546 + sizeof(struct ip_set_req_ipmap),
3547 + size);
3548 + return -EINVAL;
3549 + }
3550 + return __delip(set, req->ip, hash_ip);
3551 +}
3552 +
3553 +static int
3554 +delip_kernel(struct ip_set *set,
3555 + const struct sk_buff *skb,
3556 + ip_set_ip_t *hash_ip,
3557 + const u_int32_t *flags,
3558 + unsigned char index)
3559 +{
3560 + return __delip(set,
3561 + ntohl(flags[index] & IPSET_SRC
3562 + ? ip_hdr(skb)->saddr
3563 + : ip_hdr(skb)->daddr),
3564 + hash_ip);
3565 +}
3566 +
3567 +static int create(struct ip_set *set, const void *data, size_t size)
3568 +{
3569 + int newbytes;
3570 + struct ip_set_req_ipmap_create *req =
3571 + (struct ip_set_req_ipmap_create *) data;
3572 + struct ip_set_ipmap *map;
3573 +
3574 + if (size != sizeof(struct ip_set_req_ipmap_create)) {
3575 + ip_set_printk("data length wrong (want %zu, have %zu)",
3576 + sizeof(struct ip_set_req_ipmap_create),
3577 + size);
3578 + return -EINVAL;
3579 + }
3580 +
3581 + DP("from %u.%u.%u.%u to %u.%u.%u.%u",
3582 + HIPQUAD(req->from), HIPQUAD(req->to));
3583 +
3584 + if (req->from > req->to) {
3585 + DP("bad ip range");
3586 + return -ENOEXEC;
3587 + }
3588 +
3589 + map = kmalloc(sizeof(struct ip_set_ipmap), GFP_KERNEL);
3590 + if (!map) {
3591 + DP("out of memory for %d bytes",
3592 + sizeof(struct ip_set_ipmap));
3593 + return -ENOMEM;
3594 + }
3595 + map->first_ip = req->from;
3596 + map->last_ip = req->to;
3597 + map->netmask = req->netmask;
3598 +
3599 + if (req->netmask == 0xFFFFFFFF) {
3600 + map->hosts = 1;
3601 + map->sizeid = map->last_ip - map->first_ip + 1;
3602 + } else {
3603 + unsigned int mask_bits, netmask_bits;
3604 + ip_set_ip_t mask;
3605 +
3606 + map->first_ip &= map->netmask; /* Should we better bark? */
3607 +
3608 + mask = range_to_mask(map->first_ip, map->last_ip, &mask_bits);
3609 + netmask_bits = mask_to_bits(map->netmask);
3610 +
3611 + if ((!mask && (map->first_ip || map->last_ip != 0xFFFFFFFF))
3612 + || netmask_bits <= mask_bits)
3613 + return -ENOEXEC;
3614 +
3615 + DP("mask_bits %u, netmask_bits %u",
3616 + mask_bits, netmask_bits);
3617 + map->hosts = 2 << (32 - netmask_bits - 1);
3618 + map->sizeid = 2 << (netmask_bits - mask_bits - 1);
3619 + }
3620 + if (map->sizeid > MAX_RANGE + 1) {
3621 + ip_set_printk("range too big (max %d addresses)",
3622 + MAX_RANGE+1);
3623 + kfree(map);
3624 + return -ENOEXEC;
3625 + }
3626 + DP("hosts %u, sizeid %u", map->hosts, map->sizeid);
3627 + newbytes = bitmap_bytes(0, map->sizeid - 1);
3628 + map->members = kmalloc(newbytes, GFP_KERNEL);
3629 + if (!map->members) {
3630 + DP("out of memory for %d bytes", newbytes);
3631 + kfree(map);
3632 + return -ENOMEM;
3633 + }
3634 + memset(map->members, 0, newbytes);
3635 +
3636 + set->data = map;
3637 + return 0;
3638 +}
3639 +
3640 +static void destroy(struct ip_set *set)
3641 +{
3642 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3643 +
3644 + kfree(map->members);
3645 + kfree(map);
3646 +
3647 + set->data = NULL;
3648 +}
3649 +
3650 +static void flush(struct ip_set *set)
3651 +{
3652 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3653 + memset(map->members, 0, bitmap_bytes(0, map->sizeid - 1));
3654 +}
3655 +
3656 +static void list_header(const struct ip_set *set, void *data)
3657 +{
3658 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3659 + struct ip_set_req_ipmap_create *header =
3660 + (struct ip_set_req_ipmap_create *) data;
3661 +
3662 + header->from = map->first_ip;
3663 + header->to = map->last_ip;
3664 + header->netmask = map->netmask;
3665 +}
3666 +
3667 +static int list_members_size(const struct ip_set *set)
3668 +{
3669 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3670 +
3671 + return bitmap_bytes(0, map->sizeid - 1);
3672 +}
3673 +
3674 +static void list_members(const struct ip_set *set, void *data)
3675 +{
3676 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3677 + int bytes = bitmap_bytes(0, map->sizeid - 1);
3678 +
3679 + memcpy(data, map->members, bytes);
3680 +}
3681 +
3682 +static struct ip_set_type ip_set_ipmap = {
3683 + .typename = SETTYPE_NAME,
3684 + .features = IPSET_TYPE_IP | IPSET_DATA_SINGLE,
3685 + .protocol_version = IP_SET_PROTOCOL_VERSION,
3686 + .create = &create,
3687 + .destroy = &destroy,
3688 + .flush = &flush,
3689 + .reqsize = sizeof(struct ip_set_req_ipmap),
3690 + .addip = &addip,
3691 + .addip_kernel = &addip_kernel,
3692 + .delip = &delip,
3693 + .delip_kernel = &delip_kernel,
3694 + .testip = &testip,
3695 + .testip_kernel = &testip_kernel,
3696 + .header_size = sizeof(struct ip_set_req_ipmap_create),
3697 + .list_header = &list_header,
3698 + .list_members_size = &list_members_size,
3699 + .list_members = &list_members,
3700 + .me = THIS_MODULE,
3701 +};
3702 +
3703 +MODULE_LICENSE("GPL");
3704 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
3705 +MODULE_DESCRIPTION("ipmap type of IP sets");
3706 +
3707 +static int __init init(void)
3708 +{
3709 + return ip_set_register_set_type(&ip_set_ipmap);
3710 +}
3711 +
3712 +static void __exit fini(void)
3713 +{
3714 + /* FIXME: possible race with ip_set_create() */
3715 + ip_set_unregister_set_type(&ip_set_ipmap);
3716 +}
3717 +
3718 +module_init(init);
3719 +module_exit(fini);
3720 Index: linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_ipporthash.c
3721 ===================================================================
3722 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
3723 +++ linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_ipporthash.c 2007-06-17 01:57:56.985987456 +0200
3724 @@ -0,0 +1,535 @@
3725 +/* Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
3726 + *
3727 + * This program is free software; you can redistribute it and/or modify
3728 + * it under the terms of the GNU General Public License version 2 as
3729 + * published by the Free Software Foundation.
3730 + */
3731 +
3732 +/* Kernel module implementing an ip+port hash set */
3733 +
3734 +#include <linux/module.h>
3735 +#include <linux/ip.h>
3736 +#include <linux/tcp.h>
3737 +#include <linux/udp.h>
3738 +#include <linux/skbuff.h>
3739 +#include <linux/netfilter_ipv4/ip_tables.h>
3740 +#include <linux/netfilter_ipv4/ip_set.h>
3741 +#include <linux/errno.h>
3742 +#include <asm/uaccess.h>
3743 +#include <asm/bitops.h>
3744 +#include <linux/spinlock.h>
3745 +#include <linux/vmalloc.h>
3746 +#include <linux/random.h>
3747 +#include <linux/jhash.h>
3748 +
3749 +#include <net/ip.h>
3750 +
3751 +#include <linux/netfilter_ipv4/ip_set_malloc.h>
3752 +#include <linux/netfilter_ipv4/ip_set_ipporthash.h>
3753 +
3754 +static int limit = MAX_RANGE;
3755 +
3756 +/* We must handle non-linear skbs */
3757 +static inline ip_set_ip_t
3758 +get_port(const struct sk_buff *skb, u_int32_t flags)
3759 +{
3760 + struct iphdr *iph = skb->nh.iph;
3761 + u_int16_t offset = ntohs(iph->frag_off) & IP_OFFSET;
3762 +
3763 + switch (iph->protocol) {
3764 + case IPPROTO_TCP: {
3765 + struct tcphdr tcph;
3766 +
3767 + /* See comments at tcp_match in ip_tables.c */
3768 + if (offset)
3769 + return INVALID_PORT;
3770 +
3771 + if (skb_copy_bits(skb, skb->nh.iph->ihl*4, &tcph, sizeof(tcph)) < 0)
3772 + /* No choice either */
3773 + return INVALID_PORT;
3774 +
3775 + return ntohs(flags & IPSET_SRC ?
3776 + tcph.source : tcph.dest);
3777 + }
3778 + case IPPROTO_UDP: {
3779 + struct udphdr udph;
3780 +
3781 + if (offset)
3782 + return INVALID_PORT;
3783 +
3784 + if (skb_copy_bits(skb, skb->nh.iph->ihl*4, &udph, sizeof(udph)) < 0)
3785 + /* No choice either */
3786 + return INVALID_PORT;
3787 +
3788 + return ntohs(flags & IPSET_SRC ?
3789 + udph.source : udph.dest);
3790 + }
3791 + default:
3792 + return INVALID_PORT;
3793 + }
3794 +}
3795 +
3796 +static inline __u32
3797 +jhash_ip(const struct ip_set_ipporthash *map, uint16_t i, ip_set_ip_t ip)
3798 +{
3799 + return jhash_1word(ip, *(((uint32_t *) map->initval) + i));
3800 +}
3801 +
3802 +#define HASH_IP(map, ip, port) (port + ((ip - ((map)->first_ip)) << 16))
3803 +
3804 +static inline __u32
3805 +hash_id(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t port,
3806 + ip_set_ip_t *hash_ip)
3807 +{
3808 + struct ip_set_ipporthash *map =
3809 + (struct ip_set_ipporthash *) set->data;
3810 + __u32 id;
3811 + u_int16_t i;
3812 + ip_set_ip_t *elem;
3813 +
3814 + *hash_ip = HASH_IP(map, ip, port);
3815 + DP("set: %s, ipport:%u.%u.%u.%u:%u, %u.%u.%u.%u",
3816 + set->name, HIPQUAD(ip), port, HIPQUAD(*hash_ip));
3817 +
3818 + for (i = 0; i < map->probes; i++) {
3819 + id = jhash_ip(map, i, *hash_ip) % map->hashsize;
3820 + DP("hash key: %u", id);
3821 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
3822 + if (*elem == *hash_ip)
3823 + return id;
3824 + /* No shortcut at testing - there can be deleted
3825 + * entries. */
3826 + }
3827 + return UINT_MAX;
3828 +}
3829 +
3830 +static inline int
3831 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t port,
3832 + ip_set_ip_t *hash_ip)
3833 +{
3834 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
3835 +
3836 + if (ip < map->first_ip || ip > map->last_ip)
3837 + return -ERANGE;
3838 +
3839 + return (hash_id(set, ip, port, hash_ip) != UINT_MAX);
3840 +}
3841 +
3842 +static int
3843 +testip(struct ip_set *set, const void *data, size_t size,
3844 + ip_set_ip_t *hash_ip)
3845 +{
3846 + struct ip_set_req_ipporthash *req =
3847 + (struct ip_set_req_ipporthash *) data;
3848 +
3849 + if (size != sizeof(struct ip_set_req_ipporthash)) {
3850 + ip_set_printk("data length wrong (want %zu, have %zu)",
3851 + sizeof(struct ip_set_req_ipporthash),
3852 + size);
3853 + return -EINVAL;
3854 + }
3855 + return __testip(set, req->ip, req->port, hash_ip);
3856 +}
3857 +
3858 +static int
3859 +testip_kernel(struct ip_set *set,
3860 + const struct sk_buff *skb,
3861 + ip_set_ip_t *hash_ip,
3862 + const u_int32_t *flags,
3863 + unsigned char index)
3864 +{
3865 + ip_set_ip_t port;
3866 +
3867 + if (flags[index+1] == 0)
3868 + return -EINVAL;
3869 +
3870 + port = get_port(skb, flags[index+1]);
3871 +
3872 + DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
3873 + flags[index] & IPSET_SRC ? "SRC" : "DST",
3874 + NIPQUAD(skb->nh.iph->saddr),
3875 + NIPQUAD(skb->nh.iph->daddr));
3876 + DP("flag %s port %u",
3877 + flags[index+1] & IPSET_SRC ? "SRC" : "DST",
3878 + port);
3879 + if (port == INVALID_PORT)
3880 + return 0;
3881 +
3882 + return __testip(set,
3883 + ntohl(flags[index] & IPSET_SRC
3884 + ? skb->nh.iph->saddr
3885 + : skb->nh.iph->daddr),
3886 + port,
3887 + hash_ip);
3888 +}
3889 +
3890 +static inline int
3891 +__add_haship(struct ip_set_ipporthash *map, ip_set_ip_t hash_ip)
3892 +{
3893 + __u32 probe;
3894 + u_int16_t i;
3895 + ip_set_ip_t *elem;
3896 +
3897 + for (i = 0; i < map->probes; i++) {
3898 + probe = jhash_ip(map, i, hash_ip) % map->hashsize;
3899 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, probe);
3900 + if (*elem == hash_ip)
3901 + return -EEXIST;
3902 + if (!*elem) {
3903 + *elem = hash_ip;
3904 + map->elements++;
3905 + return 0;
3906 + }
3907 + }
3908 + /* Trigger rehashing */
3909 + return -EAGAIN;
3910 +}
3911 +
3912 +static inline int
3913 +__addip(struct ip_set_ipporthash *map, ip_set_ip_t ip, ip_set_ip_t port,
3914 + ip_set_ip_t *hash_ip)
3915 +{
3916 + if (map->elements > limit)
3917 + return -ERANGE;
3918 + if (ip < map->first_ip || ip > map->last_ip)
3919 + return -ERANGE;
3920 +
3921 + *hash_ip = HASH_IP(map, ip, port);
3922 +
3923 + return __add_haship(map, *hash_ip);
3924 +}
3925 +
3926 +static int
3927 +addip(struct ip_set *set, const void *data, size_t size,
3928 + ip_set_ip_t *hash_ip)
3929 +{
3930 + struct ip_set_req_ipporthash *req =
3931 + (struct ip_set_req_ipporthash *) data;
3932 +
3933 + if (size != sizeof(struct ip_set_req_ipporthash)) {
3934 + ip_set_printk("data length wrong (want %zu, have %zu)",
3935 + sizeof(struct ip_set_req_ipporthash),
3936 + size);
3937 + return -EINVAL;
3938 + }
3939 + return __addip((struct ip_set_ipporthash *) set->data,
3940 + req->ip, req->port, hash_ip);
3941 +}
3942 +
3943 +static int
3944 +addip_kernel(struct ip_set *set,
3945 + const struct sk_buff *skb,
3946 + ip_set_ip_t *hash_ip,
3947 + const u_int32_t *flags,
3948 + unsigned char index)
3949 +{
3950 + ip_set_ip_t port;
3951 +
3952 + if (flags[index+1] == 0)
3953 + return -EINVAL;
3954 +
3955 + port = get_port(skb, flags[index+1]);
3956 +
3957 + DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
3958 + flags[index] & IPSET_SRC ? "SRC" : "DST",
3959 + NIPQUAD(skb->nh.iph->saddr),
3960 + NIPQUAD(skb->nh.iph->daddr));
3961 + DP("flag %s port %u",
3962 + flags[index+1] & IPSET_SRC ? "SRC" : "DST",
3963 + port);
3964 + if (port == INVALID_PORT)
3965 + return -EINVAL;
3966 +
3967 + return __addip((struct ip_set_ipporthash *) set->data,
3968 + ntohl(flags[index] & IPSET_SRC
3969 + ? skb->nh.iph->saddr
3970 + : skb->nh.iph->daddr),
3971 + port,
3972 + hash_ip);
3973 +}
3974 +
3975 +static int retry(struct ip_set *set)
3976 +{
3977 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
3978 + ip_set_ip_t *elem;
3979 + void *members;
3980 + u_int32_t i, hashsize = map->hashsize;
3981 + int res;
3982 + struct ip_set_ipporthash *tmp;
3983 +
3984 + if (map->resize == 0)
3985 + return -ERANGE;
3986 +
3987 + again:
3988 + res = 0;
3989 +
3990 + /* Calculate new hash size */
3991 + hashsize += (hashsize * map->resize)/100;
3992 + if (hashsize == map->hashsize)
3993 + hashsize++;
3994 +
3995 + ip_set_printk("rehashing of set %s triggered: "
3996 + "hashsize grows from %u to %u",
3997 + set->name, map->hashsize, hashsize);
3998 +
3999 + tmp = kmalloc(sizeof(struct ip_set_ipporthash)
4000 + + map->probes * sizeof(uint32_t), GFP_ATOMIC);
4001 + if (!tmp) {
4002 + DP("out of memory for %d bytes",
4003 + sizeof(struct ip_set_ipporthash)
4004 + + map->probes * sizeof(uint32_t));
4005 + return -ENOMEM;
4006 + }
4007 + tmp->members = harray_malloc(hashsize, sizeof(ip_set_ip_t), GFP_ATOMIC);
4008 + if (!tmp->members) {
4009 + DP("out of memory for %d bytes", hashsize * sizeof(ip_set_ip_t));
4010 + kfree(tmp);
4011 + return -ENOMEM;
4012 + }
4013 + tmp->hashsize = hashsize;
4014 + tmp->elements = 0;
4015 + tmp->probes = map->probes;
4016 + tmp->resize = map->resize;
4017 + tmp->first_ip = map->first_ip;
4018 + tmp->last_ip = map->last_ip;
4019 + memcpy(tmp->initval, map->initval, map->probes * sizeof(uint32_t));
4020 +
4021 + write_lock_bh(&set->lock);
4022 + map = (struct ip_set_ipporthash *) set->data; /* Play safe */
4023 + for (i = 0; i < map->hashsize && res == 0; i++) {
4024 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, i);
4025 + if (*elem)
4026 + res = __add_haship(tmp, *elem);
4027 + }
4028 + if (res) {
4029 + /* Failure, try again */
4030 + write_unlock_bh(&set->lock);
4031 + harray_free(tmp->members);
4032 + kfree(tmp);
4033 + goto again;
4034 + }
4035 +
4036 + /* Success at resizing! */
4037 + members = map->members;
4038 +
4039 + map->hashsize = tmp->hashsize;
4040 + map->members = tmp->members;
4041 + write_unlock_bh(&set->lock);
4042 +
4043 + harray_free(members);
4044 + kfree(tmp);
4045 +
4046 + return 0;
4047 +}
4048 +
4049 +static inline int
4050 +__delip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t port,
4051 + ip_set_ip_t *hash_ip)
4052 +{
4053 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
4054 + ip_set_ip_t id;
4055 + ip_set_ip_t *elem;
4056 +
4057 + if (ip < map->first_ip || ip > map->last_ip)
4058 + return -ERANGE;
4059 +
4060 + id = hash_id(set, ip, port, hash_ip);
4061 +
4062 + if (id == UINT_MAX)
4063 + return -EEXIST;
4064 +
4065 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
4066 + *elem = 0;
4067 + map->elements--;
4068 +
4069 + return 0;
4070 +}
4071 +
4072 +static int
4073 +delip(struct ip_set *set, const void *data, size_t size,
4074 + ip_set_ip_t *hash_ip)
4075 +{
4076 + struct ip_set_req_ipporthash *req =
4077 + (struct ip_set_req_ipporthash *) data;
4078 +
4079 + if (size != sizeof(struct ip_set_req_ipporthash)) {
4080 + ip_set_printk("data length wrong (want %zu, have %zu)",
4081 + sizeof(struct ip_set_req_ipporthash),
4082 + size);
4083 + return -EINVAL;
4084 + }
4085 + return __delip(set, req->ip, req->port, hash_ip);
4086 +}
4087 +
4088 +static int
4089 +delip_kernel(struct ip_set *set,
4090 + const struct sk_buff *skb,
4091 + ip_set_ip_t *hash_ip,
4092 + const u_int32_t *flags,
4093 + unsigned char index)
4094 +{
4095 + ip_set_ip_t port;
4096 +
4097 + if (flags[index+1] == 0)
4098 + return -EINVAL;
4099 +
4100 + port = get_port(skb, flags[index+1]);
4101 +
4102 + DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
4103 + flags[index] & IPSET_SRC ? "SRC" : "DST",
4104 + NIPQUAD(skb->nh.iph->saddr),
4105 + NIPQUAD(skb->nh.iph->daddr));
4106 + DP("flag %s port %u",
4107 + flags[index+1] & IPSET_SRC ? "SRC" : "DST",
4108 + port);
4109 + if (port == INVALID_PORT)
4110 + return -EINVAL;
4111 +
4112 + return __delip(set,
4113 + ntohl(flags[index] & IPSET_SRC
4114 + ? skb->nh.iph->saddr
4115 + : skb->nh.iph->daddr),
4116 + port,
4117 + hash_ip);
4118 +}
4119 +
4120 +static int create(struct ip_set *set, const void *data, size_t size)
4121 +{
4122 + struct ip_set_req_ipporthash_create *req =
4123 + (struct ip_set_req_ipporthash_create *) data;
4124 + struct ip_set_ipporthash *map;
4125 + uint16_t i;
4126 +
4127 + if (size != sizeof(struct ip_set_req_ipporthash_create)) {
4128 + ip_set_printk("data length wrong (want %zu, have %zu)",
4129 + sizeof(struct ip_set_req_ipporthash_create),
4130 + size);
4131 + return -EINVAL;
4132 + }
4133 +
4134 + if (req->hashsize < 1) {
4135 + ip_set_printk("hashsize too small");
4136 + return -ENOEXEC;
4137 + }
4138 +
4139 + if (req->probes < 1) {
4140 + ip_set_printk("probes too small");
4141 + return -ENOEXEC;
4142 + }
4143 +
4144 + map = kmalloc(sizeof(struct ip_set_ipporthash)
4145 + + req->probes * sizeof(uint32_t), GFP_KERNEL);
4146 + if (!map) {
4147 + DP("out of memory for %d bytes",
4148 + sizeof(struct ip_set_ipporthash)
4149 + + req->probes * sizeof(uint32_t));
4150 + return -ENOMEM;
4151 + }
4152 + for (i = 0; i < req->probes; i++)
4153 + get_random_bytes(((uint32_t *) map->initval)+i, 4);
4154 + map->elements = 0;
4155 + map->hashsize = req->hashsize;
4156 + map->probes = req->probes;
4157 + map->resize = req->resize;
4158 + map->first_ip = req->from;
4159 + map->last_ip = req->to;
4160 + map->members = harray_malloc(map->hashsize, sizeof(ip_set_ip_t), GFP_KERNEL);
4161 + if (!map->members) {
4162 + DP("out of memory for %d bytes", map->hashsize * sizeof(ip_set_ip_t));
4163 + kfree(map);
4164 + return -ENOMEM;
4165 + }
4166 +
4167 + set->data = map;
4168 + return 0;
4169 +}
4170 +
4171 +static void destroy(struct ip_set *set)
4172 +{
4173 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
4174 +
4175 + harray_free(map->members);
4176 + kfree(map);
4177 +
4178 + set->data = NULL;
4179 +}
4180 +
4181 +static void flush(struct ip_set *set)
4182 +{
4183 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
4184 + harray_flush(map->members, map->hashsize, sizeof(ip_set_ip_t));
4185 + map->elements = 0;
4186 +}
4187 +
4188 +static void list_header(const struct ip_set *set, void *data)
4189 +{
4190 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
4191 + struct ip_set_req_ipporthash_create *header =
4192 + (struct ip_set_req_ipporthash_create *) data;
4193 +
4194 + header->hashsize = map->hashsize;
4195 + header->probes = map->probes;
4196 + header->resize = map->resize;
4197 + header->from = map->first_ip;
4198 + header->to = map->last_ip;
4199 +}
4200 +
4201 +static int list_members_size(const struct ip_set *set)
4202 +{
4203 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
4204 +
4205 + return (map->hashsize * sizeof(ip_set_ip_t));
4206 +}
4207 +
4208 +static void list_members(const struct ip_set *set, void *data)
4209 +{
4210 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
4211 + ip_set_ip_t i, *elem;
4212 +
4213 + for (i = 0; i < map->hashsize; i++) {
4214 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, i);
4215 + ((ip_set_ip_t *)data)[i] = *elem;
4216 + }
4217 +}
4218 +
4219 +static struct ip_set_type ip_set_ipporthash = {
4220 + .typename = SETTYPE_NAME,
4221 + .features = IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_DATA_DOUBLE,
4222 + .protocol_version = IP_SET_PROTOCOL_VERSION,
4223 + .create = &create,
4224 + .destroy = &destroy,
4225 + .flush = &flush,
4226 + .reqsize = sizeof(struct ip_set_req_ipporthash),
4227 + .addip = &addip,
4228 + .addip_kernel = &addip_kernel,
4229 + .retry = &retry,
4230 + .delip = &delip,
4231 + .delip_kernel = &delip_kernel,
4232 + .testip = &testip,
4233 + .testip_kernel = &testip_kernel,
4234 + .header_size = sizeof(struct ip_set_req_ipporthash_create),
4235 + .list_header = &list_header,
4236 + .list_members_size = &list_members_size,
4237 + .list_members = &list_members,
4238 + .me = THIS_MODULE,
4239 +};
4240 +
4241 +MODULE_LICENSE("GPL");
4242 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
4243 +MODULE_DESCRIPTION("ipporthash type of IP sets");
4244 +module_param(limit, int, 0600);
4245 +MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
4246 +
4247 +static int __init init(void)
4248 +{
4249 + return ip_set_register_set_type(&ip_set_ipporthash);
4250 +}
4251 +
4252 +static void __exit fini(void)
4253 +{
4254 + /* FIXME: possible race with ip_set_create() */
4255 + ip_set_unregister_set_type(&ip_set_ipporthash);
4256 +}
4257 +
4258 +module_init(init);
4259 +module_exit(fini);
4260 Index: linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_iptree.c
4261 ===================================================================
4262 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
4263 +++ linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_iptree.c 2007-06-17 01:57:56.985987456 +0200
4264 @@ -0,0 +1,571 @@
4265 +/* Copyright (C) 2005 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
4266 + *
4267 + * This program is free software; you can redistribute it and/or modify
4268 + * it under the terms of the GNU General Public License version 2 as
4269 + * published by the Free Software Foundation.
4270 + */
4271 +
4272 +/* Kernel module implementing an IP set type: the iptree type */
4273 +
4274 +#include <linux/version.h>
4275 +#include <linux/module.h>
4276 +#include <linux/ip.h>
4277 +#include <linux/skbuff.h>
4278 +#include <linux/slab.h>
4279 +#include <linux/delay.h>
4280 +#include <linux/netfilter_ipv4/ip_tables.h>
4281 +#include <linux/netfilter_ipv4/ip_set.h>
4282 +#include <linux/errno.h>
4283 +#include <asm/uaccess.h>
4284 +#include <asm/bitops.h>
4285 +#include <linux/spinlock.h>
4286 +
4287 +/* Backward compatibility */
4288 +#ifndef __nocast
4289 +#define __nocast
4290 +#endif
4291 +
4292 +#include <linux/netfilter_ipv4/ip_set_iptree.h>
4293 +
4294 +static int limit = MAX_RANGE;
4295 +
4296 +/* Garbage collection interval in seconds: */
4297 +#define IPTREE_GC_TIME 5*60
4298 +/* Sleep so many milliseconds before trying again
4299 + * to delete the gc timer at destroying/flushing a set */
4300 +#define IPTREE_DESTROY_SLEEP 100
4301 +
4302 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
4303 +static struct kmem_cache *branch_cachep;
4304 +static struct kmem_cache *leaf_cachep;
4305 +#else
4306 +static kmem_cache_t *branch_cachep;
4307 +static kmem_cache_t *leaf_cachep;
4308 +#endif
4309 +
4310 +#define ABCD(a,b,c,d,addrp) do { \
4311 + a = ((unsigned char *)addrp)[3]; \
4312 + b = ((unsigned char *)addrp)[2]; \
4313 + c = ((unsigned char *)addrp)[1]; \
4314 + d = ((unsigned char *)addrp)[0]; \
4315 +} while (0)
4316 +
4317 +#define TESTIP_WALK(map, elem, branch) do { \
4318 + if ((map)->tree[elem]) { \
4319 + branch = (map)->tree[elem]; \
4320 + } else \
4321 + return 0; \
4322 +} while (0)
4323 +
4324 +static inline int
4325 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
4326 +{
4327 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4328 + struct ip_set_iptreeb *btree;
4329 + struct ip_set_iptreec *ctree;
4330 + struct ip_set_iptreed *dtree;
4331 + unsigned char a,b,c,d;
4332 +
4333 + if (!ip)
4334 + return -ERANGE;
4335 +
4336 + *hash_ip = ip;
4337 + ABCD(a, b, c, d, hash_ip);
4338 + DP("%u %u %u %u timeout %u", a, b, c, d, map->timeout);
4339 + TESTIP_WALK(map, a, btree);
4340 + TESTIP_WALK(btree, b, ctree);
4341 + TESTIP_WALK(ctree, c, dtree);
4342 + DP("%lu %lu", dtree->expires[d], jiffies);
4343 + return !!(map->timeout ? (time_after(dtree->expires[d], jiffies))
4344 + : dtree->expires[d]);
4345 +}
4346 +
4347 +static int
4348 +testip(struct ip_set *set, const void *data, size_t size,
4349 + ip_set_ip_t *hash_ip)
4350 +{
4351 + struct ip_set_req_iptree *req =
4352 + (struct ip_set_req_iptree *) data;
4353 +
4354 + if (size != sizeof(struct ip_set_req_iptree)) {
4355 + ip_set_printk("data length wrong (want %zu, have %zu)",
4356 + sizeof(struct ip_set_req_iptree),
4357 + size);
4358 + return -EINVAL;
4359 + }
4360 + return __testip(set, req->ip, hash_ip);
4361 +}
4362 +
4363 +static int
4364 +testip_kernel(struct ip_set *set,
4365 + const struct sk_buff *skb,
4366 + ip_set_ip_t *hash_ip,
4367 + const u_int32_t *flags,
4368 + unsigned char index)
4369 +{
4370 + int res;
4371 +
4372 + DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
4373 + flags[index] & IPSET_SRC ? "SRC" : "DST",
4374 + NIPQUAD(ip_hdr(skb)->saddr),
4375 + NIPQUAD(ip_hdr(skb)->daddr));
4376 +
4377 + res = __testip(set,
4378 + ntohl(flags[index] & IPSET_SRC
4379 + ? ip_hdr(skb)->saddr
4380 + : ip_hdr(skb)->daddr),
4381 + hash_ip);
4382 + return (res < 0 ? 0 : res);
4383 +}
4384 +
4385 +#define ADDIP_WALK(map, elem, branch, type, cachep, flags) do { \
4386 + if ((map)->tree[elem]) { \
4387 + DP("found %u", elem); \
4388 + branch = (map)->tree[elem]; \
4389 + } else { \
4390 + branch = (type *) \
4391 + kmem_cache_alloc(cachep, flags); \
4392 + if (branch == NULL) \
4393 + return -ENOMEM; \
4394 + memset(branch, 0, sizeof(*branch)); \
4395 + (map)->tree[elem] = branch; \
4396 + DP("alloc %u", elem); \
4397 + } \
4398 +} while (0)
4399 +
4400 +static inline int
4401 +__addip(struct ip_set *set, ip_set_ip_t ip, unsigned int timeout,
4402 + ip_set_ip_t *hash_ip,
4403 + unsigned int __nocast flags)
4404 +{
4405 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4406 + struct ip_set_iptreeb *btree;
4407 + struct ip_set_iptreec *ctree;
4408 + struct ip_set_iptreed *dtree;
4409 + unsigned char a,b,c,d;
4410 + int ret = 0;
4411 +
4412 + if (!ip || map->elements > limit)
4413 + /* We could call the garbage collector
4414 + * but it's probably overkill */
4415 + return -ERANGE;
4416 +
4417 + *hash_ip = ip;
4418 + ABCD(a, b, c, d, hash_ip);
4419 + DP("%u %u %u %u timeout %u", a, b, c, d, timeout);
4420 + ADDIP_WALK(map, a, btree, struct ip_set_iptreeb, branch_cachep, flags);
4421 + ADDIP_WALK(btree, b, ctree, struct ip_set_iptreec, branch_cachep, flags);
4422 + ADDIP_WALK(ctree, c, dtree, struct ip_set_iptreed, leaf_cachep, flags);
4423 + if (dtree->expires[d]
4424 + && (!map->timeout || time_after(dtree->expires[d], jiffies)))
4425 + ret = -EEXIST;
4426 + dtree->expires[d] = map->timeout ? (timeout * HZ + jiffies) : 1;
4427 + /* Lottery */
4428 + if (dtree->expires[d] == 0)
4429 + dtree->expires[d] = 1;
4430 + DP("%u %lu", d, dtree->expires[d]);
4431 + if (ret == 0)
4432 + map->elements++;
4433 + return ret;
4434 +}
4435 +
4436 +static int
4437 +addip(struct ip_set *set, const void *data, size_t size,
4438 + ip_set_ip_t *hash_ip)
4439 +{
4440 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4441 + struct ip_set_req_iptree *req =
4442 + (struct ip_set_req_iptree *) data;
4443 +
4444 + if (size != sizeof(struct ip_set_req_iptree)) {
4445 + ip_set_printk("data length wrong (want %zu, have %zu)",
4446 + sizeof(struct ip_set_req_iptree),
4447 + size);
4448 + return -EINVAL;
4449 + }
4450 + DP("%u.%u.%u.%u %u", HIPQUAD(req->ip), req->timeout);
4451 + return __addip(set, req->ip,
4452 + req->timeout ? req->timeout : map->timeout,
4453 + hash_ip,
4454 + GFP_ATOMIC);
4455 +}
4456 +
4457 +static int
4458 +addip_kernel(struct ip_set *set,
4459 + const struct sk_buff *skb,
4460 + ip_set_ip_t *hash_ip,
4461 + const u_int32_t *flags,
4462 + unsigned char index)
4463 +{
4464 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4465 +
4466 + return __addip(set,
4467 + ntohl(flags[index] & IPSET_SRC
4468 + ? ip_hdr(skb)->saddr
4469 + : ip_hdr(skb)->daddr),
4470 + map->timeout,
4471 + hash_ip,
4472 + GFP_ATOMIC);
4473 +}
4474 +
4475 +#define DELIP_WALK(map, elem, branch) do { \
4476 + if ((map)->tree[elem]) { \
4477 + branch = (map)->tree[elem]; \
4478 + } else \
4479 + return -EEXIST; \
4480 +} while (0)
4481 +
4482 +static inline int
4483 +__delip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
4484 +{
4485 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4486 + struct ip_set_iptreeb *btree;
4487 + struct ip_set_iptreec *ctree;
4488 + struct ip_set_iptreed *dtree;
4489 + unsigned char a,b,c,d;
4490 +
4491 + if (!ip)
4492 + return -ERANGE;
4493 +
4494 + *hash_ip = ip;
4495 + ABCD(a, b, c, d, hash_ip);
4496 + DELIP_WALK(map, a, btree);
4497 + DELIP_WALK(btree, b, ctree);
4498 + DELIP_WALK(ctree, c, dtree);
4499 +
4500 + if (dtree->expires[d]) {
4501 + dtree->expires[d] = 0;
4502 + map->elements--;
4503 + return 0;
4504 + }
4505 + return -EEXIST;
4506 +}
4507 +
4508 +static int
4509 +delip(struct ip_set *set, const void *data, size_t size,
4510 + ip_set_ip_t *hash_ip)
4511 +{
4512 + struct ip_set_req_iptree *req =
4513 + (struct ip_set_req_iptree *) data;
4514 +
4515 + if (size != sizeof(struct ip_set_req_iptree)) {
4516 + ip_set_printk("data length wrong (want %zu, have %zu)",
4517 + sizeof(struct ip_set_req_iptree),
4518 + size);
4519 + return -EINVAL;
4520 + }
4521 + return __delip(set, req->ip, hash_ip);
4522 +}
4523 +
4524 +static int
4525 +delip_kernel(struct ip_set *set,
4526 + const struct sk_buff *skb,
4527 + ip_set_ip_t *hash_ip,
4528 + const u_int32_t *flags,
4529 + unsigned char index)
4530 +{
4531 + return __delip(set,
4532 + ntohl(flags[index] & IPSET_SRC
4533 + ? ip_hdr(skb)->saddr
4534 + : ip_hdr(skb)->daddr),
4535 + hash_ip);
4536 +}
4537 +
4538 +#define LOOP_WALK_BEGIN(map, i, branch) \
4539 + for (i = 0; i < 256; i++) { \
4540 + if (!(map)->tree[i]) \
4541 + continue; \
4542 + branch = (map)->tree[i]
4543 +
4544 +#define LOOP_WALK_END }
4545 +
4546 +static void ip_tree_gc(unsigned long ul_set)
4547 +{
4548 + struct ip_set *set = (void *) ul_set;
4549 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4550 + struct ip_set_iptreeb *btree;
4551 + struct ip_set_iptreec *ctree;
4552 + struct ip_set_iptreed *dtree;
4553 + unsigned int a,b,c,d;
4554 + unsigned char i,j,k;
4555 +
4556 + i = j = k = 0;
4557 + DP("gc: %s", set->name);
4558 + write_lock_bh(&set->lock);
4559 + LOOP_WALK_BEGIN(map, a, btree);
4560 + LOOP_WALK_BEGIN(btree, b, ctree);
4561 + LOOP_WALK_BEGIN(ctree, c, dtree);
4562 + for (d = 0; d < 256; d++) {
4563 + if (dtree->expires[d]) {
4564 + DP("gc: %u %u %u %u: expires %lu jiffies %lu",
4565 + a, b, c, d,
4566 + dtree->expires[d], jiffies);
4567 + if (map->timeout
4568 + && time_before(dtree->expires[d], jiffies)) {
4569 + dtree->expires[d] = 0;
4570 + map->elements--;
4571 + } else
4572 + k = 1;
4573 + }
4574 + }
4575 + if (k == 0) {
4576 + DP("gc: %s: leaf %u %u %u empty",
4577 + set->name, a, b, c);
4578 + kmem_cache_free(leaf_cachep, dtree);
4579 + ctree->tree[c] = NULL;
4580 + } else {
4581 + DP("gc: %s: leaf %u %u %u not empty",
4582 + set->name, a, b, c);
4583 + j = 1;
4584 + k = 0;
4585 + }
4586 + LOOP_WALK_END;
4587 + if (j == 0) {
4588 + DP("gc: %s: branch %u %u empty",
4589 + set->name, a, b);
4590 + kmem_cache_free(branch_cachep, ctree);
4591 + btree->tree[b] = NULL;
4592 + } else {
4593 + DP("gc: %s: branch %u %u not empty",
4594 + set->name, a, b);
4595 + i = 1;
4596 + j = k = 0;
4597 + }
4598 + LOOP_WALK_END;
4599 + if (i == 0) {
4600 + DP("gc: %s: branch %u empty",
4601 + set->name, a);
4602 + kmem_cache_free(branch_cachep, btree);
4603 + map->tree[a] = NULL;
4604 + } else {
4605 + DP("gc: %s: branch %u not empty",
4606 + set->name, a);
4607 + i = j = k = 0;
4608 + }
4609 + LOOP_WALK_END;
4610 + write_unlock_bh(&set->lock);
4611 +
4612 + map->gc.expires = jiffies + map->gc_interval * HZ;
4613 + add_timer(&map->gc);
4614 +}
4615 +
4616 +static inline void init_gc_timer(struct ip_set *set)
4617 +{
4618 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4619 +
4620 + /* Even if there is no timeout for the entries,
4621 + * we still have to call gc because delete
4622 + * do not clean up empty branches */
4623 + map->gc_interval = IPTREE_GC_TIME;
4624 + init_timer(&map->gc);
4625 + map->gc.data = (unsigned long) set;
4626 + map->gc.function = ip_tree_gc;
4627 + map->gc.expires = jiffies + map->gc_interval * HZ;
4628 + add_timer(&map->gc);
4629 +}
4630 +
4631 +static int create(struct ip_set *set, const void *data, size_t size)
4632 +{
4633 + struct ip_set_req_iptree_create *req =
4634 + (struct ip_set_req_iptree_create *) data;
4635 + struct ip_set_iptree *map;
4636 +
4637 + if (size != sizeof(struct ip_set_req_iptree_create)) {
4638 + ip_set_printk("data length wrong (want %zu, have %zu)",
4639 + sizeof(struct ip_set_req_iptree_create),
4640 + size);
4641 + return -EINVAL;
4642 + }
4643 +
4644 + map = kmalloc(sizeof(struct ip_set_iptree), GFP_KERNEL);
4645 + if (!map) {
4646 + DP("out of memory for %d bytes",
4647 + sizeof(struct ip_set_iptree));
4648 + return -ENOMEM;
4649 + }
4650 + memset(map, 0, sizeof(*map));
4651 + map->timeout = req->timeout;
4652 + map->elements = 0;
4653 + set->data = map;
4654 +
4655 + init_gc_timer(set);
4656 +
4657 + return 0;
4658 +}
4659 +
4660 +static void __flush(struct ip_set_iptree *map)
4661 +{
4662 + struct ip_set_iptreeb *btree;
4663 + struct ip_set_iptreec *ctree;
4664 + struct ip_set_iptreed *dtree;
4665 + unsigned int a,b,c;
4666 +
4667 + LOOP_WALK_BEGIN(map, a, btree);
4668 + LOOP_WALK_BEGIN(btree, b, ctree);
4669 + LOOP_WALK_BEGIN(ctree, c, dtree);
4670 + kmem_cache_free(leaf_cachep, dtree);
4671 + LOOP_WALK_END;
4672 + kmem_cache_free(branch_cachep, ctree);
4673 + LOOP_WALK_END;
4674 + kmem_cache_free(branch_cachep, btree);
4675 + LOOP_WALK_END;
4676 + map->elements = 0;
4677 +}
4678 +
4679 +static void destroy(struct ip_set *set)
4680 +{
4681 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4682 +
4683 + /* gc might be running */
4684 + while (!del_timer(&map->gc))
4685 + msleep(IPTREE_DESTROY_SLEEP);
4686 + __flush(map);
4687 + kfree(map);
4688 + set->data = NULL;
4689 +}
4690 +
4691 +static void flush(struct ip_set *set)
4692 +{
4693 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4694 + unsigned int timeout = map->timeout;
4695 +
4696 + /* gc might be running */
4697 + while (!del_timer(&map->gc))
4698 + msleep(IPTREE_DESTROY_SLEEP);
4699 + __flush(map);
4700 + memset(map, 0, sizeof(*map));
4701 + map->timeout = timeout;
4702 +
4703 + init_gc_timer(set);
4704 +}
4705 +
4706 +static void list_header(const struct ip_set *set, void *data)
4707 +{
4708 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4709 + struct ip_set_req_iptree_create *header =
4710 + (struct ip_set_req_iptree_create *) data;
4711 +
4712 + header->timeout = map->timeout;
4713 +}
4714 +
4715 +static int list_members_size(const struct ip_set *set)
4716 +{
4717 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4718 + struct ip_set_iptreeb *btree;
4719 + struct ip_set_iptreec *ctree;
4720 + struct ip_set_iptreed *dtree;
4721 + unsigned int a,b,c,d;
4722 + unsigned int count = 0;
4723 +
4724 + LOOP_WALK_BEGIN(map, a, btree);
4725 + LOOP_WALK_BEGIN(btree, b, ctree);
4726 + LOOP_WALK_BEGIN(ctree, c, dtree);
4727 + for (d = 0; d < 256; d++) {
4728 + if (dtree->expires[d]
4729 + && (!map->timeout || time_after(dtree->expires[d], jiffies)))
4730 + count++;
4731 + }
4732 + LOOP_WALK_END;
4733 + LOOP_WALK_END;
4734 + LOOP_WALK_END;
4735 +
4736 + DP("members %u", count);
4737 + return (count * sizeof(struct ip_set_req_iptree));
4738 +}
4739 +
4740 +static void list_members(const struct ip_set *set, void *data)
4741 +{
4742 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4743 + struct ip_set_iptreeb *btree;
4744 + struct ip_set_iptreec *ctree;
4745 + struct ip_set_iptreed *dtree;
4746 + unsigned int a,b,c,d;
4747 + size_t offset = 0;
4748 + struct ip_set_req_iptree *entry;
4749 +
4750 + LOOP_WALK_BEGIN(map, a, btree);
4751 + LOOP_WALK_BEGIN(btree, b, ctree);
4752 + LOOP_WALK_BEGIN(ctree, c, dtree);
4753 + for (d = 0; d < 256; d++) {
4754 + if (dtree->expires[d]
4755 + && (!map->timeout || time_after(dtree->expires[d], jiffies))) {
4756 + entry = (struct ip_set_req_iptree *)(data + offset);
4757 + entry->ip = ((a << 24) | (b << 16) | (c << 8) | d);
4758 + entry->timeout = !map->timeout ? 0
4759 + : (dtree->expires[d] - jiffies)/HZ;
4760 + offset += sizeof(struct ip_set_req_iptree);
4761 + }
4762 + }
4763 + LOOP_WALK_END;
4764 + LOOP_WALK_END;
4765 + LOOP_WALK_END;
4766 +}
4767 +
4768 +static struct ip_set_type ip_set_iptree = {
4769 + .typename = SETTYPE_NAME,
4770 + .features = IPSET_TYPE_IP | IPSET_DATA_SINGLE,
4771 + .protocol_version = IP_SET_PROTOCOL_VERSION,
4772 + .create = &create,
4773 + .destroy = &destroy,
4774 + .flush = &flush,
4775 + .reqsize = sizeof(struct ip_set_req_iptree),
4776 + .addip = &addip,
4777 + .addip_kernel = &addip_kernel,
4778 + .delip = &delip,
4779 + .delip_kernel = &delip_kernel,
4780 + .testip = &testip,
4781 + .testip_kernel = &testip_kernel,
4782 + .header_size = sizeof(struct ip_set_req_iptree_create),
4783 + .list_header = &list_header,
4784 + .list_members_size = &list_members_size,
4785 + .list_members = &list_members,
4786 + .me = THIS_MODULE,
4787 +};
4788 +
4789 +MODULE_LICENSE("GPL");
4790 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
4791 +MODULE_DESCRIPTION("iptree type of IP sets");
4792 +module_param(limit, int, 0600);
4793 +MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
4794 +
4795 +static int __init init(void)
4796 +{
4797 + int ret;
4798 +
4799 + branch_cachep = kmem_cache_create("ip_set_iptreeb",
4800 + sizeof(struct ip_set_iptreeb),
4801 + 0, 0, NULL, NULL);
4802 + if (!branch_cachep) {
4803 + printk(KERN_ERR "Unable to create ip_set_iptreeb slab cache\n");
4804 + ret = -ENOMEM;
4805 + goto out;
4806 + }
4807 + leaf_cachep = kmem_cache_create("ip_set_iptreed",
4808 + sizeof(struct ip_set_iptreed),
4809 + 0, 0, NULL, NULL);
4810 + if (!leaf_cachep) {
4811 + printk(KERN_ERR "Unable to create ip_set_iptreed slab cache\n");
4812 + ret = -ENOMEM;
4813 + goto free_branch;
4814 + }
4815 + ret = ip_set_register_set_type(&ip_set_iptree);
4816 + if (ret == 0)
4817 + goto out;
4818 +
4819 + kmem_cache_destroy(leaf_cachep);
4820 + free_branch:
4821 + kmem_cache_destroy(branch_cachep);
4822 + out:
4823 + return ret;
4824 +}
4825 +
4826 +static void __exit fini(void)
4827 +{
4828 + /* FIXME: possible race with ip_set_create() */
4829 + ip_set_unregister_set_type(&ip_set_iptree);
4830 + kmem_cache_destroy(leaf_cachep);
4831 + kmem_cache_destroy(branch_cachep);
4832 +}
4833 +
4834 +module_init(init);
4835 +module_exit(fini);
4836 Index: linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_macipmap.c
4837 ===================================================================
4838 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
4839 +++ linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_macipmap.c 2007-06-17 01:57:56.985987456 +0200
4840 @@ -0,0 +1,353 @@
4841 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
4842 + * Patrick Schaaf <bof@bof.de>
4843 + * Martin Josefsson <gandalf@wlug.westbo.se>
4844 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
4845 + *
4846 + * This program is free software; you can redistribute it and/or modify
4847 + * it under the terms of the GNU General Public License version 2 as
4848 + * published by the Free Software Foundation.
4849 + */
4850 +
4851 +/* Kernel module implementing an IP set type: the macipmap type */
4852 +
4853 +#include <linux/module.h>
4854 +#include <linux/ip.h>
4855 +#include <linux/skbuff.h>
4856 +#include <linux/netfilter_ipv4/ip_tables.h>
4857 +#include <linux/netfilter_ipv4/ip_set.h>
4858 +#include <linux/errno.h>
4859 +#include <asm/uaccess.h>
4860 +#include <asm/bitops.h>
4861 +#include <linux/spinlock.h>
4862 +#include <linux/if_ether.h>
4863 +#include <linux/vmalloc.h>
4864 +
4865 +#include <linux/netfilter_ipv4/ip_set_malloc.h>
4866 +#include <linux/netfilter_ipv4/ip_set_macipmap.h>
4867 +
4868 +static int
4869 +testip(struct ip_set *set, const void *data, size_t size, ip_set_ip_t *hash_ip)
4870 +{
4871 + struct ip_set_macipmap *map = (struct ip_set_macipmap *) set->data;
4872 + struct ip_set_macip *table = (struct ip_set_macip *) map->members;
4873 + struct ip_set_req_macipmap *req = (struct ip_set_req_macipmap *) data;
4874 +
4875 + if (size != sizeof(struct ip_set_req_macipmap)) {
4876 + ip_set_printk("data length wrong (want %zu, have %zu)",
4877 + sizeof(struct ip_set_req_macipmap),
4878 + size);
4879 + return -EINVAL;
4880 + }
4881 +
4882 + if (req->ip < map->first_ip || req->ip > map->last_ip)
4883 + return -ERANGE;
4884 +
4885 + *hash_ip = req->ip;
4886 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u",
4887 + set->name, HIPQUAD(req->ip), HIPQUAD(*hash_ip));
4888 + if (test_bit(IPSET_MACIP_ISSET,
4889 + (void *) &table[req->ip - map->first_ip].flags)) {
4890 + return (memcmp(req->ethernet,
4891 + &table[req->ip - map->first_ip].ethernet,
4892 + ETH_ALEN) == 0);
4893 + } else {
4894 + return (map->flags & IPSET_MACIP_MATCHUNSET ? 1 : 0);
4895 + }
4896 +}
4897 +
4898 +static int
4899 +testip_kernel(struct ip_set *set,
4900 + const struct sk_buff *skb,
4901 + ip_set_ip_t *hash_ip,
4902 + const u_int32_t *flags,
4903 + unsigned char index)
4904 +{
4905 + struct ip_set_macipmap *map =
4906 + (struct ip_set_macipmap *) set->data;
4907 + struct ip_set_macip *table =
4908 + (struct ip_set_macip *) map->members;
4909 + ip_set_ip_t ip;
4910 +
4911 + ip = ntohl(flags[index] & IPSET_SRC
4912 + ? ip_hdr(skb)->saddr
4913 + : ip_hdr(skb)->daddr);
4914 + DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
4915 + flags[index] & IPSET_SRC ? "SRC" : "DST",
4916 + NIPQUAD(ip_hdr(skb)->saddr),
4917 + NIPQUAD(ip_hdr(skb)->daddr));
4918 +
4919 + if (ip < map->first_ip || ip > map->last_ip)
4920 + return 0;
4921 +
4922 + *hash_ip = ip;
4923 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u",
4924 + set->name, HIPQUAD(ip), HIPQUAD(*hash_ip));
4925 + if (test_bit(IPSET_MACIP_ISSET,
4926 + (void *) &table[ip - map->first_ip].flags)) {
4927 + /* Is mac pointer valid?
4928 + * If so, compare... */
4929 + return (skb_mac_header(skb) >= skb->head
4930 + && (skb_mac_header(skb) + ETH_HLEN) <= skb->data
4931 + && (memcmp(eth_hdr(skb)->h_source,
4932 + &table[ip - map->first_ip].ethernet,
4933 + ETH_ALEN) == 0));
4934 + } else {
4935 + return (map->flags & IPSET_MACIP_MATCHUNSET ? 1 : 0);
4936 + }
4937 +}
4938 +
4939 +/* returns 0 on success */
4940 +static inline int
4941 +__addip(struct ip_set *set,
4942 + ip_set_ip_t ip, unsigned char *ethernet, ip_set_ip_t *hash_ip)
4943 +{
4944 + struct ip_set_macipmap *map =
4945 + (struct ip_set_macipmap *) set->data;
4946 + struct ip_set_macip *table =
4947 + (struct ip_set_macip *) map->members;
4948 +
4949 + if (ip < map->first_ip || ip > map->last_ip)
4950 + return -ERANGE;
4951 + if (test_and_set_bit(IPSET_MACIP_ISSET,
4952 + (void *) &table[ip - map->first_ip].flags))
4953 + return -EEXIST;
4954 +
4955 + *hash_ip = ip;
4956 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
4957 + memcpy(&table[ip - map->first_ip].ethernet, ethernet, ETH_ALEN);
4958 + return 0;
4959 +}
4960 +
4961 +static int
4962 +addip(struct ip_set *set, const void *data, size_t size,
4963 + ip_set_ip_t *hash_ip)
4964 +{
4965 + struct ip_set_req_macipmap *req =
4966 + (struct ip_set_req_macipmap *) data;
4967 +
4968 + if (size != sizeof(struct ip_set_req_macipmap)) {
4969 + ip_set_printk("data length wrong (want %zu, have %zu)",
4970 + sizeof(struct ip_set_req_macipmap),
4971 + size);
4972 + return -EINVAL;
4973 + }
4974 + return __addip(set, req->ip, req->ethernet, hash_ip);
4975 +}
4976 +
4977 +static int
4978 +addip_kernel(struct ip_set *set,
4979 + const struct sk_buff *skb,
4980 + ip_set_ip_t *hash_ip,
4981 + const u_int32_t *flags,
4982 + unsigned char index)
4983 +{
4984 + ip_set_ip_t ip;
4985 +
4986 + ip = ntohl(flags[index] & IPSET_SRC
4987 + ? ip_hdr(skb)->saddr
4988 + : ip_hdr(skb)->daddr);
4989 +
4990 + if (!(skb_mac_header(skb) >= skb->head
4991 + && (skb_mac_header(skb) + ETH_HLEN) <= skb->data))
4992 + return -EINVAL;
4993 +
4994 + return __addip(set, ip, eth_hdr(skb)->h_source, hash_ip);
4995 +}
4996 +
4997 +static inline int
4998 +__delip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
4999 +{
5000 + struct ip_set_macipmap *map =
5001 + (struct ip_set_macipmap *) set->data;
5002 + struct ip_set_macip *table =
5003 + (struct ip_set_macip *) map->members;
5004 +
5005 + if (ip < map->first_ip || ip > map->last_ip)
5006 + return -ERANGE;
5007 + if (!test_and_clear_bit(IPSET_MACIP_ISSET,
5008 + (void *)&table[ip - map->first_ip].flags))
5009 + return -EEXIST;
5010 +
5011 + *hash_ip = ip;
5012 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
5013 + return 0;
5014 +}
5015 +
5016 +static int
5017 +delip(struct ip_set *set, const void *data, size_t size,
5018 + ip_set_ip_t *hash_ip)
5019 +{
5020 + struct ip_set_req_macipmap *req =
5021 + (struct ip_set_req_macipmap *) data;
5022 +
5023 + if (size != sizeof(struct ip_set_req_macipmap)) {
5024 + ip_set_printk("data length wrong (want %zu, have %zu)",
5025 + sizeof(struct ip_set_req_macipmap),
5026 + size);
5027 + return -EINVAL;
5028 + }
5029 + return __delip(set, req->ip, hash_ip);
5030 +}
5031 +
5032 +static int
5033 +delip_kernel(struct ip_set *set,
5034 + const struct sk_buff *skb,
5035 + ip_set_ip_t *hash_ip,
5036 + const u_int32_t *flags,
5037 + unsigned char index)
5038 +{
5039 + return __delip(set,
5040 + ntohl(flags[index] & IPSET_SRC
5041 + ? ip_hdr(skb)->saddr
5042 + : ip_hdr(skb)->daddr),
5043 + hash_ip);
5044 +}
5045 +
5046 +static inline size_t members_size(ip_set_id_t from, ip_set_id_t to)
5047 +{
5048 + return (size_t)((to - from + 1) * sizeof(struct ip_set_macip));
5049 +}
5050 +
5051 +static int create(struct ip_set *set, const void *data, size_t size)
5052 +{
5053 + int newbytes;
5054 + struct ip_set_req_macipmap_create *req =
5055 + (struct ip_set_req_macipmap_create *) data;
5056 + struct ip_set_macipmap *map;
5057 +
5058 + if (size != sizeof(struct ip_set_req_macipmap_create)) {
5059 + ip_set_printk("data length wrong (want %zu, have %zu)",
5060 + sizeof(struct ip_set_req_macipmap_create),
5061 + size);
5062 + return -EINVAL;
5063 + }
5064 +
5065 + DP("from %u.%u.%u.%u to %u.%u.%u.%u",
5066 + HIPQUAD(req->from), HIPQUAD(req->to));
5067 +
5068 + if (req->from > req->to) {
5069 + DP("bad ip range");
5070 + return -ENOEXEC;
5071 + }
5072 +
5073 + if (req->to - req->from > MAX_RANGE) {
5074 + ip_set_printk("range too big (max %d addresses)",
5075 + MAX_RANGE+1);
5076 + return -ENOEXEC;
5077 + }
5078 +
5079 + map = kmalloc(sizeof(struct ip_set_macipmap), GFP_KERNEL);
5080 + if (!map) {
5081 + DP("out of memory for %d bytes",
5082 + sizeof(struct ip_set_macipmap));
5083 + return -ENOMEM;
5084 + }
5085 + map->flags = req->flags;
5086 + map->first_ip = req->from;
5087 + map->last_ip = req->to;
5088 + newbytes = members_size(map->first_ip, map->last_ip);
5089 + map->members = ip_set_malloc(newbytes);
5090 + DP("members: %u %p", newbytes, map->members);
5091 + if (!map->members) {
5092 + DP("out of memory for %d bytes", newbytes);
5093 + kfree(map);
5094 + return -ENOMEM;
5095 + }
5096 + memset(map->members, 0, newbytes);
5097 +
5098 + set->data = map;
5099 + return 0;
5100 +}
5101 +
5102 +static void destroy(struct ip_set *set)
5103 +{
5104 + struct ip_set_macipmap *map =
5105 + (struct ip_set_macipmap *) set->data;
5106 +
5107 + ip_set_free(map->members, members_size(map->first_ip, map->last_ip));
5108 + kfree(map);
5109 +
5110 + set->data = NULL;
5111 +}
5112 +
5113 +static void flush(struct ip_set *set)
5114 +{
5115 + struct ip_set_macipmap *map =
5116 + (struct ip_set_macipmap *) set->data;
5117 + memset(map->members, 0, members_size(map->first_ip, map->last_ip));
5118 +}
5119 +
5120 +static void list_header(const struct ip_set *set, void *data)
5121 +{
5122 + struct ip_set_macipmap *map =
5123 + (struct ip_set_macipmap *) set->data;
5124 + struct ip_set_req_macipmap_create *header =
5125 + (struct ip_set_req_macipmap_create *) data;
5126 +
5127 + DP("list_header %x %x %u", map->first_ip, map->last_ip,
5128 + map->flags);
5129 +
5130 + header->from = map->first_ip;
5131 + header->to = map->last_ip;
5132 + header->flags = map->flags;
5133 +}
5134 +
5135 +static int list_members_size(const struct ip_set *set)
5136 +{
5137 + struct ip_set_macipmap *map =
5138 + (struct ip_set_macipmap *) set->data;
5139 +
5140 + DP("%u", members_size(map->first_ip, map->last_ip));
5141 + return members_size(map->first_ip, map->last_ip);
5142 +}
5143 +
5144 +static void list_members(const struct ip_set *set, void *data)
5145 +{
5146 + struct ip_set_macipmap *map =
5147 + (struct ip_set_macipmap *) set->data;
5148 +
5149 + int bytes = members_size(map->first_ip, map->last_ip);
5150 +
5151 + DP("members: %u %p", bytes, map->members);
5152 + memcpy(data, map->members, bytes);
5153 +}
5154 +
5155 +static struct ip_set_type ip_set_macipmap = {
5156 + .typename = SETTYPE_NAME,
5157 + .features = IPSET_TYPE_IP | IPSET_DATA_SINGLE,
5158 + .protocol_version = IP_SET_PROTOCOL_VERSION,
5159 + .create = &create,
5160 + .destroy = &destroy,
5161 + .flush = &flush,
5162 + .reqsize = sizeof(struct ip_set_req_macipmap),
5163 + .addip = &addip,
5164 + .addip_kernel = &addip_kernel,
5165 + .delip = &delip,
5166 + .delip_kernel = &delip_kernel,
5167 + .testip = &testip,
5168 + .testip_kernel = &testip_kernel,
5169 + .header_size = sizeof(struct ip_set_req_macipmap_create),
5170 + .list_header = &list_header,
5171 + .list_members_size = &list_members_size,
5172 + .list_members = &list_members,
5173 + .me = THIS_MODULE,
5174 +};
5175 +
5176 +MODULE_LICENSE("GPL");
5177 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
5178 +MODULE_DESCRIPTION("macipmap type of IP sets");
5179 +
5180 +static int __init init(void)
5181 +{
5182 + init_max_malloc_size();
5183 + return ip_set_register_set_type(&ip_set_macipmap);
5184 +}
5185 +
5186 +static void __exit fini(void)
5187 +{
5188 + /* FIXME: possible race with ip_set_create() */
5189 + ip_set_unregister_set_type(&ip_set_macipmap);
5190 +}
5191 +
5192 +module_init(init);
5193 +module_exit(fini);
5194 Index: linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_nethash.c
5195 ===================================================================
5196 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
5197 +++ linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_nethash.c 2007-06-17 01:57:56.985987456 +0200
5198 @@ -0,0 +1,481 @@
5199 +/* Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
5200 + *
5201 + * This program is free software; you can redistribute it and/or modify
5202 + * it under the terms of the GNU General Public License version 2 as
5203 + * published by the Free Software Foundation.
5204 + */
5205 +
5206 +/* Kernel module implementing a cidr nethash set */
5207 +
5208 +#include <linux/module.h>
5209 +#include <linux/ip.h>
5210 +#include <linux/skbuff.h>
5211 +#include <linux/netfilter_ipv4/ip_tables.h>
5212 +#include <linux/netfilter_ipv4/ip_set.h>
5213 +#include <linux/errno.h>
5214 +#include <asm/uaccess.h>
5215 +#include <asm/bitops.h>
5216 +#include <linux/spinlock.h>
5217 +#include <linux/vmalloc.h>
5218 +#include <linux/random.h>
5219 +#include <linux/jhash.h>
5220 +
5221 +#include <net/ip.h>
5222 +
5223 +#include <linux/netfilter_ipv4/ip_set_malloc.h>
5224 +#include <linux/netfilter_ipv4/ip_set_nethash.h>
5225 +
5226 +static int limit = MAX_RANGE;
5227 +
5228 +static inline __u32
5229 +jhash_ip(const struct ip_set_nethash *map, uint16_t i, ip_set_ip_t ip)
5230 +{
5231 + return jhash_1word(ip, *(((uint32_t *) map->initval) + i));
5232 +}
5233 +
5234 +static inline __u32
5235 +hash_id_cidr(struct ip_set_nethash *map,
5236 + ip_set_ip_t ip,
5237 + unsigned char cidr,
5238 + ip_set_ip_t *hash_ip)
5239 +{
5240 + __u32 id;
5241 + u_int16_t i;
5242 + ip_set_ip_t *elem;
5243 +
5244 + *hash_ip = pack(ip, cidr);
5245 +
5246 + for (i = 0; i < map->probes; i++) {
5247 + id = jhash_ip(map, i, *hash_ip) % map->hashsize;
5248 + DP("hash key: %u", id);
5249 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
5250 + if (*elem == *hash_ip)
5251 + return id;
5252 + }
5253 + return UINT_MAX;
5254 +}
5255 +
5256 +static inline __u32
5257 +hash_id(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
5258 +{
5259 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5260 + __u32 id = UINT_MAX;
5261 + int i;
5262 +
5263 + for (i = 0; i < 30 && map->cidr[i]; i++) {
5264 + id = hash_id_cidr(map, ip, map->cidr[i], hash_ip);
5265 + if (id != UINT_MAX)
5266 + break;
5267 + }
5268 + return id;
5269 +}
5270 +
5271 +static inline int
5272 +__testip_cidr(struct ip_set *set, ip_set_ip_t ip, unsigned char cidr,
5273 + ip_set_ip_t *hash_ip)
5274 +{
5275 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5276 +
5277 + return (ip && hash_id_cidr(map, ip, cidr, hash_ip) != UINT_MAX);
5278 +}
5279 +
5280 +static inline int
5281 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
5282 +{
5283 + return (ip && hash_id(set, ip, hash_ip) != UINT_MAX);
5284 +}
5285 +
5286 +static int
5287 +testip(struct ip_set *set, const void *data, size_t size,
5288 + ip_set_ip_t *hash_ip)
5289 +{
5290 + struct ip_set_req_nethash *req =
5291 + (struct ip_set_req_nethash *) data;
5292 +
5293 + if (size != sizeof(struct ip_set_req_nethash)) {
5294 + ip_set_printk("data length wrong (want %zu, have %zu)",
5295 + sizeof(struct ip_set_req_nethash),
5296 + size);
5297 + return -EINVAL;
5298 + }
5299 + return (req->cidr == 32 ? __testip(set, req->ip, hash_ip)
5300 + : __testip_cidr(set, req->ip, req->cidr, hash_ip));
5301 +}
5302 +
5303 +static int
5304 +testip_kernel(struct ip_set *set,
5305 + const struct sk_buff *skb,
5306 + ip_set_ip_t *hash_ip,
5307 + const u_int32_t *flags,
5308 + unsigned char index)
5309 +{
5310 + return __testip(set,
5311 + ntohl(flags[index] & IPSET_SRC
5312 + ? ip_hdr(skb)->saddr
5313 + : ip_hdr(skb)->daddr),
5314 + hash_ip);
5315 +}
5316 +
5317 +static inline int
5318 +__addip_base(struct ip_set_nethash *map, ip_set_ip_t ip)
5319 +{
5320 + __u32 probe;
5321 + u_int16_t i;
5322 + ip_set_ip_t *elem;
5323 +
5324 + for (i = 0; i < map->probes; i++) {
5325 + probe = jhash_ip(map, i, ip) % map->hashsize;
5326 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, probe);
5327 + if (*elem == ip)
5328 + return -EEXIST;
5329 + if (!*elem) {
5330 + *elem = ip;
5331 + map->elements++;
5332 + return 0;
5333 + }
5334 + }
5335 + /* Trigger rehashing */
5336 + return -EAGAIN;
5337 +}
5338 +
5339 +static inline int
5340 +__addip(struct ip_set_nethash *map, ip_set_ip_t ip, unsigned char cidr,
5341 + ip_set_ip_t *hash_ip)
5342 +{
5343 + if (!ip || map->elements > limit)
5344 + return -ERANGE;
5345 +
5346 + *hash_ip = pack(ip, cidr);
5347 + DP("%u.%u.%u.%u/%u, %u.%u.%u.%u", HIPQUAD(ip), cidr, HIPQUAD(*hash_ip));
5348 +
5349 + return __addip_base(map, *hash_ip);
5350 +}
5351 +
5352 +static void
5353 +update_cidr_sizes(struct ip_set_nethash *map, unsigned char cidr)
5354 +{
5355 + unsigned char next;
5356 + int i;
5357 +
5358 + for (i = 0; i < 30 && map->cidr[i]; i++) {
5359 + if (map->cidr[i] == cidr) {
5360 + return;
5361 + } else if (map->cidr[i] < cidr) {
5362 + next = map->cidr[i];
5363 + map->cidr[i] = cidr;
5364 + cidr = next;
5365 + }
5366 + }
5367 + if (i < 30)
5368 + map->cidr[i] = cidr;
5369 +}
5370 +
5371 +static int
5372 +addip(struct ip_set *set, const void *data, size_t size,
5373 + ip_set_ip_t *hash_ip)
5374 +{
5375 + struct ip_set_req_nethash *req =
5376 + (struct ip_set_req_nethash *) data;
5377 + int ret;
5378 +
5379 + if (size != sizeof(struct ip_set_req_nethash)) {
5380 + ip_set_printk("data length wrong (want %zu, have %zu)",
5381 + sizeof(struct ip_set_req_nethash),
5382 + size);
5383 + return -EINVAL;
5384 + }
5385 + ret = __addip((struct ip_set_nethash *) set->data,
5386 + req->ip, req->cidr, hash_ip);
5387 +
5388 + if (ret == 0)
5389 + update_cidr_sizes((struct ip_set_nethash *) set->data,
5390 + req->cidr);
5391 +
5392 + return ret;
5393 +}
5394 +
5395 +static int
5396 +addip_kernel(struct ip_set *set,
5397 + const struct sk_buff *skb,
5398 + ip_set_ip_t *hash_ip,
5399 + const u_int32_t *flags,
5400 + unsigned char index)
5401 +{
5402 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5403 + int ret = -ERANGE;
5404 + ip_set_ip_t ip = ntohl(flags[index] & IPSET_SRC
5405 + ? ip_hdr(skb)->saddr
5406 + : ip_hdr(skb)->daddr);
5407 +
5408 + if (map->cidr[0])
5409 + ret = __addip(map, ip, map->cidr[0], hash_ip);
5410 +
5411 + return ret;
5412 +}
5413 +
5414 +static int retry(struct ip_set *set)
5415 +{
5416 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5417 + ip_set_ip_t *elem;
5418 + void *members;
5419 + u_int32_t i, hashsize = map->hashsize;
5420 + int res;
5421 + struct ip_set_nethash *tmp;
5422 +
5423 + if (map->resize == 0)
5424 + return -ERANGE;
5425 +
5426 + again:
5427 + res = 0;
5428 +
5429 + /* Calculate new parameters */
5430 + hashsize += (hashsize * map->resize)/100;
5431 + if (hashsize == map->hashsize)
5432 + hashsize++;
5433 +
5434 + ip_set_printk("rehashing of set %s triggered: "
5435 + "hashsize grows from %u to %u",
5436 + set->name, map->hashsize, hashsize);
5437 +
5438 + tmp = kmalloc(sizeof(struct ip_set_nethash)
5439 + + map->probes * sizeof(uint32_t), GFP_ATOMIC);
5440 + if (!tmp) {
5441 + DP("out of memory for %d bytes",
5442 + sizeof(struct ip_set_nethash)
5443 + + map->probes * sizeof(uint32_t));
5444 + return -ENOMEM;
5445 + }
5446 + tmp->members = harray_malloc(hashsize, sizeof(ip_set_ip_t), GFP_ATOMIC);
5447 + if (!tmp->members) {
5448 + DP("out of memory for %d bytes", hashsize * sizeof(ip_set_ip_t));
5449 + kfree(tmp);
5450 + return -ENOMEM;
5451 + }
5452 + tmp->hashsize = hashsize;
5453 + tmp->elements = 0;
5454 + tmp->probes = map->probes;
5455 + tmp->resize = map->resize;
5456 + memcpy(tmp->initval, map->initval, map->probes * sizeof(uint32_t));
5457 + memcpy(tmp->cidr, map->cidr, 30 * sizeof(unsigned char));
5458 +
5459 + write_lock_bh(&set->lock);
5460 + map = (struct ip_set_nethash *) set->data; /* Play safe */
5461 + for (i = 0; i < map->hashsize && res == 0; i++) {
5462 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, i);
5463 + if (*elem)
5464 + res = __addip_base(tmp, *elem);
5465 + }
5466 + if (res) {
5467 + /* Failure, try again */
5468 + write_unlock_bh(&set->lock);
5469 + harray_free(tmp->members);
5470 + kfree(tmp);
5471 + goto again;
5472 + }
5473 +
5474 + /* Success at resizing! */
5475 + members = map->members;
5476 +
5477 + map->hashsize = tmp->hashsize;
5478 + map->members = tmp->members;
5479 + write_unlock_bh(&set->lock);
5480 +
5481 + harray_free(members);
5482 + kfree(tmp);
5483 +
5484 + return 0;
5485 +}
5486 +
5487 +static inline int
5488 +__delip(struct ip_set_nethash *map, ip_set_ip_t ip, unsigned char cidr,
5489 + ip_set_ip_t *hash_ip)
5490 +{
5491 + ip_set_ip_t id, *elem;
5492 +
5493 + if (!ip)
5494 + return -ERANGE;
5495 +
5496 + id = hash_id_cidr(map, ip, cidr, hash_ip);
5497 + if (id == UINT_MAX)
5498 + return -EEXIST;
5499 +
5500 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
5501 + *elem = 0;
5502 + map->elements--;
5503 + return 0;
5504 +}
5505 +
5506 +static int
5507 +delip(struct ip_set *set, const void *data, size_t size,
5508 + ip_set_ip_t *hash_ip)
5509 +{
5510 + struct ip_set_req_nethash *req =
5511 + (struct ip_set_req_nethash *) data;
5512 +
5513 + if (size != sizeof(struct ip_set_req_nethash)) {
5514 + ip_set_printk("data length wrong (want %zu, have %zu)",
5515 + sizeof(struct ip_set_req_nethash),
5516 + size);
5517 + return -EINVAL;
5518 + }
5519 + /* TODO: no garbage collection in map->cidr */
5520 + return __delip((struct ip_set_nethash *) set->data,
5521 + req->ip, req->cidr, hash_ip);
5522 +}
5523 +
5524 +static int
5525 +delip_kernel(struct ip_set *set,
5526 + const struct sk_buff *skb,
5527 + ip_set_ip_t *hash_ip,
5528 + const u_int32_t *flags,
5529 + unsigned char index)
5530 +{
5531 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5532 + int ret = -ERANGE;
5533 + ip_set_ip_t ip = ntohl(flags[index] & IPSET_SRC
5534 + ? ip_hdr(skb)->saddr
5535 + : ip_hdr(skb)->daddr);
5536 +
5537 + if (map->cidr[0])
5538 + ret = __delip(map, ip, map->cidr[0], hash_ip);
5539 +
5540 + return ret;
5541 +}
5542 +
5543 +static int create(struct ip_set *set, const void *data, size_t size)
5544 +{
5545 + struct ip_set_req_nethash_create *req =
5546 + (struct ip_set_req_nethash_create *) data;
5547 + struct ip_set_nethash *map;
5548 + uint16_t i;
5549 +
5550 + if (size != sizeof(struct ip_set_req_nethash_create)) {
5551 + ip_set_printk("data length wrong (want %zu, have %zu)",
5552 + sizeof(struct ip_set_req_nethash_create),
5553 + size);
5554 + return -EINVAL;
5555 + }
5556 +
5557 + if (req->hashsize < 1) {
5558 + ip_set_printk("hashsize too small");
5559 + return -ENOEXEC;
5560 + }
5561 + if (req->probes < 1) {
5562 + ip_set_printk("probes too small");
5563 + return -ENOEXEC;
5564 + }
5565 +
5566 + map = kmalloc(sizeof(struct ip_set_nethash)
5567 + + req->probes * sizeof(uint32_t), GFP_KERNEL);
5568 + if (!map) {
5569 + DP("out of memory for %d bytes",
5570 + sizeof(struct ip_set_nethash)
5571 + + req->probes * sizeof(uint32_t));
5572 + return -ENOMEM;
5573 + }
5574 + for (i = 0; i < req->probes; i++)
5575 + get_random_bytes(((uint32_t *) map->initval)+i, 4);
5576 + map->elements = 0;
5577 + map->hashsize = req->hashsize;
5578 + map->probes = req->probes;
5579 + map->resize = req->resize;
5580 + memset(map->cidr, 0, 30 * sizeof(unsigned char));
5581 + map->members = harray_malloc(map->hashsize, sizeof(ip_set_ip_t), GFP_KERNEL);
5582 + if (!map->members) {
5583 + DP("out of memory for %d bytes", map->hashsize * sizeof(ip_set_ip_t));
5584 + kfree(map);
5585 + return -ENOMEM;
5586 + }
5587 +
5588 + set->data = map;
5589 + return 0;
5590 +}
5591 +
5592 +static void destroy(struct ip_set *set)
5593 +{
5594 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5595 +
5596 + harray_free(map->members);
5597 + kfree(map);
5598 +
5599 + set->data = NULL;
5600 +}
5601 +
5602 +static void flush(struct ip_set *set)
5603 +{
5604 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5605 + harray_flush(map->members, map->hashsize, sizeof(ip_set_ip_t));
5606 + memset(map->cidr, 0, 30 * sizeof(unsigned char));
5607 + map->elements = 0;
5608 +}
5609 +
5610 +static void list_header(const struct ip_set *set, void *data)
5611 +{
5612 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5613 + struct ip_set_req_nethash_create *header =
5614 + (struct ip_set_req_nethash_create *) data;
5615 +
5616 + header->hashsize = map->hashsize;
5617 + header->probes = map->probes;
5618 + header->resize = map->resize;
5619 +}
5620 +
5621 +static int list_members_size(const struct ip_set *set)
5622 +{
5623 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5624 +
5625 + return (map->hashsize * sizeof(ip_set_ip_t));
5626 +}
5627 +
5628 +static void list_members(const struct ip_set *set, void *data)
5629 +{
5630 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5631 + ip_set_ip_t i, *elem;
5632 +
5633 + for (i = 0; i < map->hashsize; i++) {
5634 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, i);
5635 + ((ip_set_ip_t *)data)[i] = *elem;
5636 + }
5637 +}
5638 +
5639 +static struct ip_set_type ip_set_nethash = {
5640 + .typename = SETTYPE_NAME,
5641 + .features = IPSET_TYPE_IP | IPSET_DATA_SINGLE,
5642 + .protocol_version = IP_SET_PROTOCOL_VERSION,
5643 + .create = &create,
5644 + .destroy = &destroy,
5645 + .flush = &flush,
5646 + .reqsize = sizeof(struct ip_set_req_nethash),
5647 + .addip = &addip,
5648 + .addip_kernel = &addip_kernel,
5649 + .retry = &retry,
5650 + .delip = &delip,
5651 + .delip_kernel = &delip_kernel,
5652 + .testip = &testip,
5653 + .testip_kernel = &testip_kernel,
5654 + .header_size = sizeof(struct ip_set_req_nethash_create),
5655 + .list_header = &list_header,
5656 + .list_members_size = &list_members_size,
5657 + .list_members = &list_members,
5658 + .me = THIS_MODULE,
5659 +};
5660 +
5661 +MODULE_LICENSE("GPL");
5662 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
5663 +MODULE_DESCRIPTION("nethash type of IP sets");
5664 +module_param(limit, int, 0600);
5665 +MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
5666 +
5667 +static int __init init(void)
5668 +{
5669 + return ip_set_register_set_type(&ip_set_nethash);
5670 +}
5671 +
5672 +static void __exit fini(void)
5673 +{
5674 + /* FIXME: possible race with ip_set_create() */
5675 + ip_set_unregister_set_type(&ip_set_nethash);
5676 +}
5677 +
5678 +module_init(init);
5679 +module_exit(fini);
5680 Index: linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_portmap.c
5681 ===================================================================
5682 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
5683 +++ linux-2.6.22-rc4/net/ipv4/netfilter/ip_set_portmap.c 2007-06-17 01:57:56.985987456 +0200
5684 @@ -0,0 +1,334 @@
5685 +/* Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
5686 + *
5687 + * This program is free software; you can redistribute it and/or modify
5688 + * it under the terms of the GNU General Public License version 2 as
5689 + * published by the Free Software Foundation.
5690 + */
5691 +
5692 +/* Kernel module implementing a port set type as a bitmap */
5693 +
5694 +#include <linux/module.h>
5695 +#include <linux/ip.h>
5696 +#include <linux/tcp.h>
5697 +#include <linux/udp.h>
5698 +#include <linux/skbuff.h>
5699 +#include <linux/netfilter_ipv4/ip_tables.h>
5700 +#include <linux/netfilter_ipv4/ip_set.h>
5701 +#include <linux/errno.h>
5702 +#include <asm/uaccess.h>
5703 +#include <asm/bitops.h>
5704 +#include <linux/spinlock.h>
5705 +
5706 +#include <net/ip.h>
5707 +
5708 +#include <linux/netfilter_ipv4/ip_set_portmap.h>
5709 +
5710 +/* We must handle non-linear skbs */
5711 +static inline ip_set_ip_t
5712 +get_port(const struct sk_buff *skb, u_int32_t flags)
5713 +{
5714 + struct iphdr *iph = ip_hdr(skb);
5715 + u_int16_t offset = ntohs(iph->frag_off) & IP_OFFSET;
5716 +
5717 + switch (iph->protocol) {
5718 + case IPPROTO_TCP: {
5719 + struct tcphdr tcph;
5720 +
5721 + /* See comments at tcp_match in ip_tables.c */
5722 + if (offset)
5723 + return INVALID_PORT;
5724 +
5725 + if (skb_copy_bits(skb, ip_hdr(skb)->ihl*4, &tcph, sizeof(tcph)) < 0)
5726 + /* No choice either */
5727 + return INVALID_PORT;
5728 +
5729 + return ntohs(flags & IPSET_SRC ?
5730 + tcph.source : tcph.dest);
5731 + }
5732 + case IPPROTO_UDP: {
5733 + struct udphdr udph;
5734 +
5735 + if (offset)
5736 + return INVALID_PORT;
5737 +
5738 + if (skb_copy_bits(skb, ip_hdr(skb)->ihl*4, &udph, sizeof(udph)) < 0)
5739 + /* No choice either */
5740 + return INVALID_PORT;
5741 +
5742 + return ntohs(flags & IPSET_SRC ?
5743 + udph.source : udph.dest);
5744 + }
5745 + default:
5746 + return INVALID_PORT;
5747 + }
5748 +}
5749 +
5750 +static inline int
5751 +__testport(struct ip_set *set, ip_set_ip_t port, ip_set_ip_t *hash_port)
5752 +{
5753 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5754 +
5755 + if (port < map->first_port || port > map->last_port)
5756 + return -ERANGE;
5757 +
5758 + *hash_port = port;
5759 + DP("set: %s, port:%u, %u", set->name, port, *hash_port);
5760 + return !!test_bit(port - map->first_port, map->members);
5761 +}
5762 +
5763 +static int
5764 +testport(struct ip_set *set, const void *data, size_t size,
5765 + ip_set_ip_t *hash_port)
5766 +{
5767 + struct ip_set_req_portmap *req =
5768 + (struct ip_set_req_portmap *) data;
5769 +
5770 + if (size != sizeof(struct ip_set_req_portmap)) {
5771 + ip_set_printk("data length wrong (want %zu, have %zu)",
5772 + sizeof(struct ip_set_req_portmap),
5773 + size);
5774 + return -EINVAL;
5775 + }
5776 + return __testport(set, req->port, hash_port);
5777 +}
5778 +
5779 +static int
5780 +testport_kernel(struct ip_set *set,
5781 + const struct sk_buff *skb,
5782 + ip_set_ip_t *hash_port,
5783 + const u_int32_t *flags,
5784 + unsigned char index)
5785 +{
5786 + int res;
5787 + ip_set_ip_t port = get_port(skb, flags[index]);
5788 +
5789 + DP("flag %s port %u", flags[index] & IPSET_SRC ? "SRC" : "DST", port);
5790 + if (port == INVALID_PORT)
5791 + return 0;
5792 +
5793 + res = __testport(set, port, hash_port);
5794 +
5795 + return (res < 0 ? 0 : res);
5796 +}
5797 +
5798 +static inline int
5799 +__addport(struct ip_set *set, ip_set_ip_t port, ip_set_ip_t *hash_port)
5800 +{
5801 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5802 +
5803 + if (port < map->first_port || port > map->last_port)
5804 + return -ERANGE;
5805 + if (test_and_set_bit(port - map->first_port, map->members))
5806 + return -EEXIST;
5807 +
5808 + *hash_port = port;
5809 + DP("port %u", port);
5810 + return 0;
5811 +}
5812 +
5813 +static int
5814 +addport(struct ip_set *set, const void *data, size_t size,
5815 + ip_set_ip_t *hash_port)
5816 +{
5817 + struct ip_set_req_portmap *req =
5818 + (struct ip_set_req_portmap *) data;
5819 +
5820 + if (size != sizeof(struct ip_set_req_portmap)) {
5821 + ip_set_printk("data length wrong (want %zu, have %zu)",
5822 + sizeof(struct ip_set_req_portmap),
5823 + size);
5824 + return -EINVAL;
5825 + }
5826 + return __addport(set, req->port, hash_port);
5827 +}
5828 +
5829 +static int
5830 +addport_kernel(struct ip_set *set,
5831 + const struct sk_buff *skb,
5832 + ip_set_ip_t *hash_port,
5833 + const u_int32_t *flags,
5834 + unsigned char index)
5835 +{
5836 + ip_set_ip_t port = get_port(skb, flags[index]);
5837 +
5838 + if (port == INVALID_PORT)
5839 + return -EINVAL;
5840 +
5841 + return __addport(set, port, hash_port);
5842 +}
5843 +
5844 +static inline int
5845 +__delport(struct ip_set *set, ip_set_ip_t port, ip_set_ip_t *hash_port)
5846 +{
5847 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5848 +
5849 + if (port < map->first_port || port > map->last_port)
5850 + return -ERANGE;
5851 + if (!test_and_clear_bit(port - map->first_port, map->members))
5852 + return -EEXIST;
5853 +
5854 + *hash_port = port;
5855 + DP("port %u", port);
5856 + return 0;
5857 +}
5858 +
5859 +static int
5860 +delport(struct ip_set *set, const void *data, size_t size,
5861 + ip_set_ip_t *hash_port)
5862 +{
5863 + struct ip_set_req_portmap *req =
5864 + (struct ip_set_req_portmap *) data;
5865 +
5866 + if (size != sizeof(struct ip_set_req_portmap)) {
5867 + ip_set_printk("data length wrong (want %zu, have %zu)",
5868 + sizeof(struct ip_set_req_portmap),
5869 + size);
5870 + return -EINVAL;
5871 + }
5872 + return __delport(set, req->port, hash_port);
5873 +}
5874 +
5875 +static int
5876 +delport_kernel(struct ip_set *set,
5877 + const struct sk_buff *skb,
5878 + ip_set_ip_t *hash_port,
5879 + const u_int32_t *flags,
5880 + unsigned char index)
5881 +{
5882 + ip_set_ip_t port = get_port(skb, flags[index]);
5883 +
5884 + if (port == INVALID_PORT)
5885 + return -EINVAL;
5886 +
5887 + return __delport(set, port, hash_port);
5888 +}
5889 +
5890 +static int create(struct ip_set *set, const void *data, size_t size)
5891 +{
5892 + int newbytes;
5893 + struct ip_set_req_portmap_create *req =
5894 + (struct ip_set_req_portmap_create *) data;
5895 + struct ip_set_portmap *map;
5896 +
5897 + if (size != sizeof(struct ip_set_req_portmap_create)) {
5898 + ip_set_printk("data length wrong (want %zu, have %zu)",
5899 + sizeof(struct ip_set_req_portmap_create),
5900 + size);
5901 + return -EINVAL;
5902 + }
5903 +
5904 + DP("from %u to %u", req->from, req->to);
5905 +
5906 + if (req->from > req->to) {
5907 + DP("bad port range");
5908 + return -ENOEXEC;
5909 + }
5910 +
5911 + if (req->to - req->from > MAX_RANGE) {
5912 + ip_set_printk("range too big (max %d ports)",
5913 + MAX_RANGE+1);
5914 + return -ENOEXEC;
5915 + }
5916 +
5917 + map = kmalloc(sizeof(struct ip_set_portmap), GFP_KERNEL);
5918 + if (!map) {
5919 + DP("out of memory for %d bytes",
5920 + sizeof(struct ip_set_portmap));
5921 + return -ENOMEM;
5922 + }
5923 + map->first_port = req->from;
5924 + map->last_port = req->to;
5925 + newbytes = bitmap_bytes(req->from, req->to);
5926 + map->members = kmalloc(newbytes, GFP_KERNEL);
5927 + if (!map->members) {
5928 + DP("out of memory for %d bytes", newbytes);
5929 + kfree(map);
5930 + return -ENOMEM;
5931 + }
5932 + memset(map->members, 0, newbytes);
5933 +
5934 + set->data = map;
5935 + return 0;
5936 +}
5937 +
5938 +static void destroy(struct ip_set *set)
5939 +{
5940 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5941 +
5942 + kfree(map->members);
5943 + kfree(map);
5944 +
5945 + set->data = NULL;
5946 +}
5947 +
5948 +static void flush(struct ip_set *set)
5949 +{
5950 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5951 + memset(map->members, 0, bitmap_bytes(map->first_port, map->last_port));
5952 +}
5953 +
5954 +static void list_header(const struct ip_set *set, void *data)
5955 +{
5956 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5957 + struct ip_set_req_portmap_create *header =
5958 + (struct ip_set_req_portmap_create *) data;
5959 +
5960 + DP("list_header %u %u", map->first_port, map->last_port);
5961 +
5962 + header->from = map->first_port;
5963 + header->to = map->last_port;
5964 +}
5965 +
5966 +static int list_members_size(const struct ip_set *set)
5967 +{
5968 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5969 +
5970 + return bitmap_bytes(map->first_port, map->last_port);
5971 +}
5972 +
5973 +static void list_members(const struct ip_set *set, void *data)
5974 +{
5975 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5976 + int bytes = bitmap_bytes(map->first_port, map->last_port);
5977 +
5978 + memcpy(data, map->members, bytes);
5979 +}
5980 +
5981 +static struct ip_set_type ip_set_portmap = {
5982 + .typename = SETTYPE_NAME,
5983 + .features = IPSET_TYPE_PORT | IPSET_DATA_SINGLE,
5984 + .protocol_version = IP_SET_PROTOCOL_VERSION,
5985 + .create = &create,
5986 + .destroy = &destroy,
5987 + .flush = &flush,
5988 + .reqsize = sizeof(struct ip_set_req_portmap),
5989 + .addip = &addport,
5990 + .addip_kernel = &addport_kernel,
5991 + .delip = &delport,
5992 + .delip_kernel = &delport_kernel,
5993 + .testip = &testport,
5994 + .testip_kernel = &testport_kernel,
5995 + .header_size = sizeof(struct ip_set_req_portmap_create),
5996 + .list_header = &list_header,
5997 + .list_members_size = &list_members_size,
5998 + .list_members = &list_members,
5999 + .me = THIS_MODULE,
6000 +};
6001 +
6002 +MODULE_LICENSE("GPL");
6003 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
6004 +MODULE_DESCRIPTION("portmap type of IP sets");
6005 +
6006 +static int __init init(void)
6007 +{
6008 + return ip_set_register_set_type(&ip_set_portmap);
6009 +}
6010 +
6011 +static void __exit fini(void)
6012 +{
6013 + /* FIXME: possible race with ip_set_create() */
6014 + ip_set_unregister_set_type(&ip_set_portmap);
6015 +}
6016 +
6017 +module_init(init);
6018 +module_exit(fini);
6019 Index: linux-2.6.22-rc4/net/ipv4/netfilter/ipt_set.c
6020 ===================================================================
6021 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
6022 +++ linux-2.6.22-rc4/net/ipv4/netfilter/ipt_set.c 2007-06-17 01:56:58.443887208 +0200
6023 @@ -0,0 +1,150 @@
6024 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
6025 + * Patrick Schaaf <bof@bof.de>
6026 + * Martin Josefsson <gandalf@wlug.westbo.se>
6027 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
6028 + *
6029 + * This program is free software; you can redistribute it and/or modify
6030 + * it under the terms of the GNU General Public License version 2 as
6031 + * published by the Free Software Foundation.
6032 + */
6033 +
6034 +/* Kernel module to match an IP set. */
6035 +
6036 +#include <linux/module.h>
6037 +#include <linux/ip.h>
6038 +#include <linux/skbuff.h>
6039 +#include <linux/version.h>
6040 +
6041 +#include <linux/netfilter_ipv4/ip_tables.h>
6042 +#include <linux/netfilter_ipv4/ip_set.h>
6043 +#include <linux/netfilter_ipv4/ipt_set.h>
6044 +
6045 +static inline int
6046 +match_set(const struct ipt_set_info *info,
6047 + const struct sk_buff *skb,
6048 + int inv)
6049 +{
6050 + if (ip_set_testip_kernel(info->index, skb, info->flags))
6051 + inv = !inv;
6052 + return inv;
6053 +}
6054 +
6055 +static int
6056 +match(const struct sk_buff *skb,
6057 + const struct net_device *in,
6058 + const struct net_device *out,
6059 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6060 + const struct xt_match *match,
6061 +#endif
6062 + const void *matchinfo,
6063 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
6064 + int offset, unsigned int protoff, int *hotdrop)
6065 +#else
6066 + int offset, int *hotdrop)
6067 +#endif
6068 +{
6069 + const struct ipt_set_info_match *info = matchinfo;
6070 +
6071 + return match_set(&info->match_set,
6072 + skb,
6073 + info->match_set.flags[0] & IPSET_MATCH_INV);
6074 +}
6075 +
6076 +static int
6077 +checkentry(const char *tablename,
6078 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
6079 + const void *inf,
6080 +#else
6081 + const struct ipt_ip *ip,
6082 +#endif
6083 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6084 + const struct xt_match *match,
6085 +#endif
6086 + void *matchinfo,
6087 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6088 + unsigned int matchsize,
6089 +#endif
6090 + unsigned int hook_mask)
6091 +{
6092 + struct ipt_set_info_match *info =
6093 + (struct ipt_set_info_match *) matchinfo;
6094 + ip_set_id_t index;
6095 +
6096 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6097 + if (matchsize != IPT_ALIGN(sizeof(struct ipt_set_info_match))) {
6098 + ip_set_printk("invalid matchsize %d", matchsize);
6099 + return 0;
6100 + }
6101 +#endif
6102 +
6103 + index = ip_set_get_byindex(info->match_set.index);
6104 +
6105 + if (index == IP_SET_INVALID_ID) {
6106 + ip_set_printk("Cannot find set indentified by id %u to match",
6107 + info->match_set.index);
6108 + return 0; /* error */
6109 + }
6110 + if (info->match_set.flags[IP_SET_MAX_BINDINGS] != 0) {
6111 + ip_set_printk("That's nasty!");
6112 + return 0; /* error */
6113 + }
6114 +
6115 + return 1;
6116 +}
6117 +
6118 +static void destroy(
6119 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6120 + const struct xt_match *match,
6121 +#endif
6122 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6123 + void *matchinfo, unsigned int matchsize)
6124 +#else
6125 + void *matchinfo)
6126 +#endif
6127 +{
6128 + struct ipt_set_info_match *info = matchinfo;
6129 +
6130 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6131 + if (matchsize != IPT_ALIGN(sizeof(struct ipt_set_info_match))) {
6132 + ip_set_printk("invalid matchsize %d", matchsize);
6133 + return;
6134 + }
6135 +#endif
6136 + ip_set_put(info->match_set.index);
6137 +}
6138 +
6139 +static struct ipt_match set_match = {
6140 + .name = "set",
6141 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
6142 + .family = AF_INET,
6143 +#endif
6144 + .match = &match,
6145 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6146 + .matchsize = sizeof(struct ipt_set_info_match),
6147 +#endif
6148 + .checkentry = &checkentry,
6149 + .destroy = &destroy,
6150 + .me = THIS_MODULE
6151 +};
6152 +
6153 +MODULE_LICENSE("GPL");
6154 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
6155 +MODULE_DESCRIPTION("iptables IP set match module");
6156 +
6157 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
6158 +#define ipt_register_match xt_register_match
6159 +#define ipt_unregister_match xt_unregister_match
6160 +#endif
6161 +
6162 +static int __init ipt_ipset_init(void)
6163 +{
6164 + return ipt_register_match(&set_match);
6165 +}
6166 +
6167 +static void __exit ipt_ipset_fini(void)
6168 +{
6169 + ipt_unregister_match(&set_match);
6170 +}
6171 +
6172 +module_init(ipt_ipset_init);
6173 +module_exit(ipt_ipset_fini);
6174 Index: linux-2.6.22-rc4/net/ipv4/netfilter/ipt_SET.c
6175 ===================================================================
6176 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
6177 +++ linux-2.6.22-rc4/net/ipv4/netfilter/ipt_SET.c 2007-06-17 01:57:56.985987456 +0200
6178 @@ -0,0 +1,169 @@
6179 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
6180 + * Patrick Schaaf <bof@bof.de>
6181 + * Martin Josefsson <gandalf@wlug.westbo.se>
6182 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
6183 + *
6184 + * This program is free software; you can redistribute it and/or modify
6185 + * it under the terms of the GNU General Public License version 2 as
6186 + * published by the Free Software Foundation.
6187 + */
6188 +
6189 +/* ipt_SET.c - netfilter target to manipulate IP sets */
6190 +
6191 +#include <linux/types.h>
6192 +#include <linux/ip.h>
6193 +#include <linux/timer.h>
6194 +#include <linux/module.h>
6195 +#include <linux/netfilter.h>
6196 +#include <linux/netdevice.h>
6197 +#include <linux/if.h>
6198 +#include <linux/inetdevice.h>
6199 +#include <linux/version.h>
6200 +#include <linux/skbuff.h>
6201 +#include <net/protocol.h>
6202 +#include <net/checksum.h>
6203 +#include <linux/netfilter_ipv4.h>
6204 +#include <linux/netfilter_ipv4/ip_tables.h>
6205 +#include <linux/netfilter_ipv4/ipt_set.h>
6206 +
6207 +static unsigned int
6208 +target(struct sk_buff **pskb,
6209 + const struct net_device *in,
6210 + const struct net_device *out,
6211 + unsigned int hooknum,
6212 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6213 + const struct xt_target *target,
6214 +#endif
6215 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6216 + const void *targinfo,
6217 + void *userinfo)
6218 +#else
6219 + const void *targinfo)
6220 +#endif
6221 +{
6222 + const struct ipt_set_info_target *info = targinfo;
6223 +
6224 + if (info->add_set.index != IP_SET_INVALID_ID)
6225 + ip_set_addip_kernel(info->add_set.index,
6226 + *pskb,
6227 + info->add_set.flags);
6228 + if (info->del_set.index != IP_SET_INVALID_ID)
6229 + ip_set_delip_kernel(info->del_set.index,
6230 + *pskb,
6231 + info->del_set.flags);
6232 +
6233 + return IPT_CONTINUE;
6234 +}
6235 +
6236 +static int
6237 +checkentry(const char *tablename,
6238 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
6239 + const void *e,
6240 +#else
6241 + const struct ipt_entry *e,
6242 +#endif
6243 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6244 + const struct xt_target *target,
6245 +#endif
6246 + void *targinfo,
6247 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6248 + unsigned int targinfosize,
6249 +#endif
6250 + unsigned int hook_mask)
6251 +{
6252 + struct ipt_set_info_target *info =
6253 + (struct ipt_set_info_target *) targinfo;
6254 + ip_set_id_t index;
6255 +
6256 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6257 + if (targinfosize != IPT_ALIGN(sizeof(*info))) {
6258 + DP("bad target info size %u", targinfosize);
6259 + return 0;
6260 + }
6261 +#endif
6262 +
6263 + if (info->add_set.index != IP_SET_INVALID_ID) {
6264 + index = ip_set_get_byindex(info->add_set.index);
6265 + if (index == IP_SET_INVALID_ID) {
6266 + ip_set_printk("cannot find add_set index %u as target",
6267 + info->add_set.index);
6268 + return 0; /* error */
6269 + }
6270 + }
6271 +
6272 + if (info->del_set.index != IP_SET_INVALID_ID) {
6273 + index = ip_set_get_byindex(info->del_set.index);
6274 + if (index == IP_SET_INVALID_ID) {
6275 + ip_set_printk("cannot find del_set index %u as target",
6276 + info->del_set.index);
6277 + return 0; /* error */
6278 + }
6279 + }
6280 + if (info->add_set.flags[IP_SET_MAX_BINDINGS] != 0
6281 + || info->del_set.flags[IP_SET_MAX_BINDINGS] != 0) {
6282 + ip_set_printk("That's nasty!");
6283 + return 0; /* error */
6284 + }
6285 +
6286 + return 1;
6287 +}
6288 +
6289 +static void destroy(
6290 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6291 + const struct xt_target *target,
6292 +#endif
6293 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6294 + void *targetinfo, unsigned int targetsize)
6295 +#else
6296 + void *targetinfo)
6297 +#endif
6298 +{
6299 + struct ipt_set_info_target *info = targetinfo;
6300 +
6301 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6302 + if (targetsize != IPT_ALIGN(sizeof(struct ipt_set_info_target))) {
6303 + ip_set_printk("invalid targetsize %d", targetsize);
6304 + return;
6305 + }
6306 +#endif
6307 + if (info->add_set.index != IP_SET_INVALID_ID)
6308 + ip_set_put(info->add_set.index);
6309 + if (info->del_set.index != IP_SET_INVALID_ID)
6310 + ip_set_put(info->del_set.index);
6311 +}
6312 +
6313 +static struct ipt_target SET_target = {
6314 + .name = "SET",
6315 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
6316 + .family = AF_INET,
6317 +#endif
6318 + .target = target,
6319 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6320 + .targetsize = sizeof(struct ipt_set_info_target),
6321 +#endif
6322 + .checkentry = checkentry,
6323 + .destroy = destroy,
6324 + .me = THIS_MODULE
6325 +};
6326 +
6327 +MODULE_LICENSE("GPL");
6328 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
6329 +MODULE_DESCRIPTION("iptables IP set target module");
6330 +
6331 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
6332 +#define ipt_register_target xt_register_target
6333 +#define ipt_unregister_target xt_unregister_target
6334 +#endif
6335 +
6336 +static int __init ipt_SET_init(void)
6337 +{
6338 + return ipt_register_target(&SET_target);
6339 +}
6340 +
6341 +static void __exit ipt_SET_fini(void)
6342 +{
6343 + ipt_unregister_target(&SET_target);
6344 +}
6345 +
6346 +module_init(ipt_SET_init);
6347 +module_exit(ipt_SET_fini);
6348 Index: linux-2.6.22-rc4/net/ipv4/netfilter/Kconfig
6349 ===================================================================
6350 --- linux-2.6.22-rc4.orig/net/ipv4/netfilter/Kconfig 2007-06-17 01:56:52.055858336 +0200
6351 +++ linux-2.6.22-rc4/net/ipv4/netfilter/Kconfig 2007-06-17 01:56:58.443887208 +0200
6352 @@ -426,5 +426,114 @@
6353 Allows altering the ARP packet payload: source and destination
6354 hardware and network addresses.
6355
6356 +config IP_NF_SET
6357 + tristate "IP set support"
6358 + depends on INET && NETFILTER
6359 + help
6360 + This option adds IP set support to the kernel.
6361 + In order to define and use sets, you need the userspace utility
6362 + ipset(8).
6363 +
6364 + To compile it as a module, choose M here. If unsure, say N.
6365 +
6366 +config IP_NF_SET_MAX
6367 + int "Maximum number of IP sets"
6368 + default 256
6369 + range 2 65534
6370 + depends on IP_NF_SET
6371 + help
6372 + You can define here default value of the maximum number
6373 + of IP sets for the kernel.
6374 +
6375 + The value can be overriden by the 'max_sets' module
6376 + parameter of the 'ip_set' module.
6377 +
6378 +config IP_NF_SET_HASHSIZE
6379 + int "Hash size for bindings of IP sets"
6380 + default 1024
6381 + depends on IP_NF_SET
6382 + help
6383 + You can define here default value of the hash size for
6384 + bindings of IP sets.
6385 +
6386 + The value can be overriden by the 'hash_size' module
6387 + parameter of the 'ip_set' module.
6388 +
6389 +config IP_NF_SET_IPMAP
6390 + tristate "ipmap set support"
6391 + depends on IP_NF_SET
6392 + help
6393 + This option adds the ipmap set type support.
6394 +
6395 + To compile it as a module, choose M here. If unsure, say N.
6396 +
6397 +config IP_NF_SET_MACIPMAP
6398 + tristate "macipmap set support"
6399 + depends on IP_NF_SET
6400 + help
6401 + This option adds the macipmap set type support.
6402 +
6403 + To compile it as a module, choose M here. If unsure, say N.
6404 +
6405 +config IP_NF_SET_PORTMAP
6406 + tristate "portmap set support"
6407 + depends on IP_NF_SET
6408 + help
6409 + This option adds the portmap set type support.
6410 +
6411 + To compile it as a module, choose M here. If unsure, say N.
6412 +
6413 +config IP_NF_SET_IPHASH
6414 + tristate "iphash set support"
6415 + depends on IP_NF_SET
6416 + help
6417 + This option adds the iphash set type support.
6418 +
6419 + To compile it as a module, choose M here. If unsure, say N.
6420 +
6421 +config IP_NF_SET_NETHASH
6422 + tristate "nethash set support"
6423 + depends on IP_NF_SET
6424 + help
6425 + This option adds the nethash set type support.
6426 +
6427 + To compile it as a module, choose M here. If unsure, say N.
6428 +
6429 +config IP_NF_SET_IPPORTHASH
6430 + tristate "ipporthash set support"
6431 + depends on IP_NF_SET
6432 + help
6433 + This option adds the ipporthash set type support.
6434 +
6435 + To compile it as a module, choose M here. If unsure, say N.
6436 +
6437 +config IP_NF_SET_IPTREE
6438 + tristate "iptree set support"
6439 + depends on IP_NF_SET
6440 + help
6441 + This option adds the iptree set type support.
6442 +
6443 + To compile it as a module, choose M here. If unsure, say N.
6444 +
6445 +config IP_NF_MATCH_SET
6446 + tristate "set match support"
6447 + depends on IP_NF_SET
6448 + help
6449 + Set matching matches against given IP sets.
6450 + You need the ipset utility to create and set up the sets.
6451 +
6452 + To compile it as a module, choose M here. If unsure, say N.
6453 +
6454 +config IP_NF_TARGET_SET
6455 + tristate "SET target support"
6456 + depends on IP_NF_SET
6457 + help
6458 + The SET target makes possible to add/delete entries
6459 + in IP sets.
6460 + You need the ipset utility to create and set up the sets.
6461 +
6462 + To compile it as a module, choose M here. If unsure, say N.
6463 +
6464 +
6465 endmenu
6466
6467 Index: linux-2.6.22-rc4/net/ipv4/netfilter/Makefile
6468 ===================================================================
6469 --- linux-2.6.22-rc4.orig/net/ipv4/netfilter/Makefile 2007-06-17 01:56:52.065856816 +0200
6470 +++ linux-2.6.22-rc4/net/ipv4/netfilter/Makefile 2007-06-17 01:56:58.444887056 +0200
6471 @@ -48,6 +48,7 @@
6472 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
6473 obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
6474 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
6475 +obj-$(CONFIG_IP_NF_MATCH_SET) += ipt_set.o
6476 obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o
6477 obj-$(CONFIG_IP_NF_MATCH_IPP2P) += ipt_ipp2p.o
6478 obj-$(CONFIG_IP_NF_MATCH_LAYER7) += ipt_layer7.o
6479 @@ -64,6 +65,17 @@
6480 obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
6481 obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o
6482 obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
6483 +obj-$(CONFIG_IP_NF_TARGET_SET) += ipt_SET.o
6484 +
6485 +# sets
6486 +obj-$(CONFIG_IP_NF_SET) += ip_set.o
6487 +obj-$(CONFIG_IP_NF_SET_IPMAP) += ip_set_ipmap.o
6488 +obj-$(CONFIG_IP_NF_SET_PORTMAP) += ip_set_portmap.o
6489 +obj-$(CONFIG_IP_NF_SET_MACIPMAP) += ip_set_macipmap.o
6490 +obj-$(CONFIG_IP_NF_SET_IPHASH) += ip_set_iphash.o
6491 +obj-$(CONFIG_IP_NF_SET_NETHASH) += ip_set_nethash.o
6492 +obj-$(CONFIG_IP_NF_SET_IPPORTHASH) += ip_set_ipporthash.o
6493 +obj-$(CONFIG_IP_NF_SET_IPTREE) += ip_set_iptree.o
6494
6495 # generic ARP tables
6496 obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
OpenWrt SVN history