projects / openwrt.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
fix x86-2.6, update kernel config for 2.6.17.
[openwrt.git] / target / linux / generic-2.6 / patches / 103-netfilter-ipset.patch
1 diff -Nur linux-2.6.16/include/linux/netfilter_ipv4/ip_set.h linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set.h
2 --- linux-2.6.16/include/linux/netfilter_ipv4/ip_set.h 1970-01-01 01:00:00.000000000 +0100
3 +++ linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set.h 2006-03-20 12:53:59.000000000 +0100
4 @@ -0,0 +1,489 @@
5 +#ifndef _IP_SET_H
6 +#define _IP_SET_H
7 +
8 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
9 + * Patrick Schaaf <bof@bof.de>
10 + * Martin Josefsson <gandalf@wlug.westbo.se>
11 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
12 + *
13 + * This program is free software; you can redistribute it and/or modify
14 + * it under the terms of the GNU General Public License version 2 as
15 + * published by the Free Software Foundation.
16 + */
17 +
18 +/*
19 + * A sockopt of such quality has hardly ever been seen before on the open
20 + * market! This little beauty, hardly ever used: above 64, so it's
21 + * traditionally used for firewalling, not touched (even once!) by the
22 + * 2.0, 2.2 and 2.4 kernels!
23 + *
24 + * Comes with its own certificate of authenticity, valid anywhere in the
25 + * Free world!
26 + *
27 + * Rusty, 19.4.2000
28 + */
29 +#define SO_IP_SET 83
30 +
31 +/*
32 + * Heavily modify by Joakim Axelsson 08.03.2002
33 + * - Made it more modulebased
34 + *
35 + * Additional heavy modifications by Jozsef Kadlecsik 22.02.2004
36 + * - bindings added
37 + * - in order to "deal with" backward compatibility, renamed to ipset
38 + */
39 +
40 +/*
41 + * Used so that the kernel module and ipset-binary can match their versions
42 + */
43 +#define IP_SET_PROTOCOL_VERSION 2
44 +
45 +#define IP_SET_MAXNAMELEN 32 /* set names and set typenames */
46 +
47 +/* Lets work with our own typedef for representing an IP address.
48 + * We hope to make the code more portable, possibly to IPv6...
49 + *
50 + * The representation works in HOST byte order, because most set types
51 + * will perform arithmetic operations and compare operations.
52 + *
53 + * For now the type is an uint32_t.
54 + *
55 + * Make sure to ONLY use the functions when translating and parsing
56 + * in order to keep the host byte order and make it more portable:
57 + * parse_ip()
58 + * parse_mask()
59 + * parse_ipandmask()
60 + * ip_tostring()
61 + * (Joakim: where are they???)
62 + */
63 +
64 +typedef uint32_t ip_set_ip_t;
65 +
66 +/* Sets are identified by an id in kernel space. Tweak with ip_set_id_t
67 + * and IP_SET_INVALID_ID if you want to increase the max number of sets.
68 + */
69 +typedef uint16_t ip_set_id_t;
70 +
71 +#define IP_SET_INVALID_ID 65535
72 +
73 +/* How deep we follow bindings */
74 +#define IP_SET_MAX_BINDINGS 6
75 +
76 +/*
77 + * Option flags for kernel operations (ipt_set_info)
78 + */
79 +#define IPSET_SRC 0x01 /* Source match/add */
80 +#define IPSET_DST 0x02 /* Destination match/add */
81 +#define IPSET_MATCH_INV 0x04 /* Inverse matching */
82 +
83 +/*
84 + * Set types (flavours)
85 + */
86 +#define IPSET_TYPE_IP 0 /* IP address type of set */
87 +#define IPSET_TYPE_PORT 1 /* Port type of set */
88 +
89 +/* Reserved keywords */
90 +#define IPSET_TOKEN_DEFAULT ":default:"
91 +#define IPSET_TOKEN_ALL ":all:"
92 +
93 +/* SO_IP_SET operation constants, and their request struct types.
94 + *
95 + * Operation ids:
96 + * 0-99: commands with version checking
97 + * 100-199: add/del/test/bind/unbind
98 + * 200-299: list, save, restore
99 + */
100 +
101 +/* Single shot operations:
102 + * version, create, destroy, flush, rename and swap
103 + *
104 + * Sets are identified by name.
105 + */
106 +
107 +#define IP_SET_REQ_STD \
108 + unsigned op; \
109 + unsigned version; \
110 + char name[IP_SET_MAXNAMELEN]
111 +
112 +#define IP_SET_OP_CREATE 0x00000001 /* Create a new (empty) set */
113 +struct ip_set_req_create {
114 + IP_SET_REQ_STD;
115 + char typename[IP_SET_MAXNAMELEN];
116 +};
117 +
118 +#define IP_SET_OP_DESTROY 0x00000002 /* Remove a (empty) set */
119 +struct ip_set_req_std {
120 + IP_SET_REQ_STD;
121 +};
122 +
123 +#define IP_SET_OP_FLUSH 0x00000003 /* Remove all IPs in a set */
124 +/* Uses ip_set_req_std */
125 +
126 +#define IP_SET_OP_RENAME 0x00000004 /* Rename a set */
127 +/* Uses ip_set_req_create */
128 +
129 +#define IP_SET_OP_SWAP 0x00000005 /* Swap two sets */
130 +/* Uses ip_set_req_create */
131 +
132 +union ip_set_name_index {
133 + char name[IP_SET_MAXNAMELEN];
134 + ip_set_id_t index;
135 +};
136 +
137 +#define IP_SET_OP_GET_BYNAME 0x00000006 /* Get set index by name */
138 +struct ip_set_req_get_set {
139 + unsigned op;
140 + unsigned version;
141 + union ip_set_name_index set;
142 +};
143 +
144 +#define IP_SET_OP_GET_BYINDEX 0x00000007 /* Get set name by index */
145 +/* Uses ip_set_req_get_set */
146 +
147 +#define IP_SET_OP_VERSION 0x00000100 /* Ask kernel version */
148 +struct ip_set_req_version {
149 + unsigned op;
150 + unsigned version;
151 +};
152 +
153 +/* Double shots operations:
154 + * add, del, test, bind and unbind.
155 + *
156 + * First we query the kernel to get the index and type of the target set,
157 + * then issue the command. Validity of IP is checked in kernel in order
158 + * to minimalize sockopt operations.
159 + */
160 +
161 +/* Get minimal set data for add/del/test/bind/unbind IP */
162 +#define IP_SET_OP_ADT_GET 0x00000010 /* Get set and type */
163 +struct ip_set_req_adt_get {
164 + unsigned op;
165 + unsigned version;
166 + union ip_set_name_index set;
167 + char typename[IP_SET_MAXNAMELEN];
168 +};
169 +
170 +#define IP_SET_REQ_BYINDEX \
171 + unsigned op; \
172 + ip_set_id_t index;
173 +
174 +struct ip_set_req_adt {
175 + IP_SET_REQ_BYINDEX;
176 +};
177 +
178 +#define IP_SET_OP_ADD_IP 0x00000101 /* Add an IP to a set */
179 +/* Uses ip_set_req_adt, with type specific addage */
180 +
181 +#define IP_SET_OP_DEL_IP 0x00000102 /* Remove an IP from a set */
182 +/* Uses ip_set_req_adt, with type specific addage */
183 +
184 +#define IP_SET_OP_TEST_IP 0x00000103 /* Test an IP in a set */
185 +/* Uses ip_set_req_adt, with type specific addage */
186 +
187 +#define IP_SET_OP_BIND_SET 0x00000104 /* Bind an IP to a set */
188 +/* Uses ip_set_req_bind, with type specific addage */
189 +struct ip_set_req_bind {
190 + IP_SET_REQ_BYINDEX;
191 + char binding[IP_SET_MAXNAMELEN];
192 +};
193 +
194 +#define IP_SET_OP_UNBIND_SET 0x00000105 /* Unbind an IP from a set */
195 +/* Uses ip_set_req_bind, with type speficic addage
196 + * index = 0 means unbinding for all sets */
197 +
198 +#define IP_SET_OP_TEST_BIND_SET 0x00000106 /* Test binding an IP to a set */
199 +/* Uses ip_set_req_bind, with type specific addage */
200 +
201 +/* Multiple shots operations: list, save, restore.
202 + *
203 + * - check kernel version and query the max number of sets
204 + * - get the basic information on all sets
205 + * and size required for the next step
206 + * - get actual set data: header, data, bindings
207 + */
208 +
209 +/* Get max_sets and the index of a queried set
210 + */
211 +#define IP_SET_OP_MAX_SETS 0x00000020
212 +struct ip_set_req_max_sets {
213 + unsigned op;
214 + unsigned version;
215 + ip_set_id_t max_sets; /* max_sets */
216 + ip_set_id_t sets; /* real number of sets */
217 + union ip_set_name_index set; /* index of set if name used */
218 +};
219 +
220 +/* Get the id and name of the sets plus size for next step */
221 +#define IP_SET_OP_LIST_SIZE 0x00000201
222 +#define IP_SET_OP_SAVE_SIZE 0x00000202
223 +struct ip_set_req_setnames {
224 + unsigned op;
225 + ip_set_id_t index; /* set to list/save */
226 + size_t size; /* size to get setdata/bindings */
227 + /* followed by sets number of struct ip_set_name_list */
228 +};
229 +
230 +struct ip_set_name_list {
231 + char name[IP_SET_MAXNAMELEN];
232 + char typename[IP_SET_MAXNAMELEN];
233 + ip_set_id_t index;
234 + ip_set_id_t id;
235 +};
236 +
237 +/* The actual list operation */
238 +#define IP_SET_OP_LIST 0x00000203
239 +struct ip_set_req_list {
240 + IP_SET_REQ_BYINDEX;
241 + /* sets number of struct ip_set_list in reply */
242 +};
243 +
244 +struct ip_set_list {
245 + ip_set_id_t index;
246 + ip_set_id_t binding;
247 + u_int32_t ref;
248 + size_t header_size; /* Set header data of header_size */
249 + size_t members_size; /* Set members data of members_size */
250 + size_t bindings_size; /* Set bindings data of bindings_size */
251 +};
252 +
253 +struct ip_set_hash_list {
254 + ip_set_ip_t ip;
255 + ip_set_id_t binding;
256 +};
257 +
258 +/* The save operation */
259 +#define IP_SET_OP_SAVE 0x00000204
260 +/* Uses ip_set_req_list, in the reply replaced by
261 + * sets number of struct ip_set_save plus a marker
262 + * ip_set_save followed by ip_set_hash_save structures.
263 + */
264 +struct ip_set_save {
265 + ip_set_id_t index;
266 + ip_set_id_t binding;
267 + size_t header_size; /* Set header data of header_size */
268 + size_t members_size; /* Set members data of members_size */
269 +};
270 +
271 +/* At restoring, ip == 0 means default binding for the given set: */
272 +struct ip_set_hash_save {
273 + ip_set_ip_t ip;
274 + ip_set_id_t id;
275 + ip_set_id_t binding;
276 +};
277 +
278 +/* The restore operation */
279 +#define IP_SET_OP_RESTORE 0x00000205
280 +/* Uses ip_set_req_setnames followed by ip_set_restore structures
281 + * plus a marker ip_set_restore, followed by ip_set_hash_save
282 + * structures.
283 + */
284 +struct ip_set_restore {
285 + char name[IP_SET_MAXNAMELEN];
286 + char typename[IP_SET_MAXNAMELEN];
287 + ip_set_id_t index;
288 + size_t header_size; /* Create data of header_size */
289 + size_t members_size; /* Set members data of members_size */
290 +};
291 +
292 +static inline int bitmap_bytes(ip_set_ip_t a, ip_set_ip_t b)
293 +{
294 + return 4 * ((((b - a + 8) / 8) + 3) / 4);
295 +}
296 +
297 +#ifdef __KERNEL__
298 +
299 +#define ip_set_printk(format, args...) \
300 + do { \
301 + printk("%s: %s: ", __FILE__, __FUNCTION__); \
302 + printk(format "\n" , ## args); \
303 + } while (0)
304 +
305 +#if defined(IP_SET_DEBUG)
306 +#define DP(format, args...) \
307 + do { \
308 + printk("%s: %s (DBG): ", __FILE__, __FUNCTION__);\
309 + printk(format "\n" , ## args); \
310 + } while (0)
311 +#define IP_SET_ASSERT(x) \
312 + do { \
313 + if (!(x)) \
314 + printk("IP_SET_ASSERT: %s:%i(%s)\n", \
315 + __FILE__, __LINE__, __FUNCTION__); \
316 + } while (0)
317 +#else
318 +#define DP(format, args...)
319 +#define IP_SET_ASSERT(x)
320 +#endif
321 +
322 +struct ip_set;
323 +
324 +/*
325 + * The ip_set_type definition - one per set type, e.g. "ipmap".
326 + *
327 + * Each individual set has a pointer, set->type, going to one
328 + * of these structures. Function pointers inside the structure implement
329 + * the real behaviour of the sets.
330 + *
331 + * If not mentioned differently, the implementation behind the function
332 + * pointers of a set_type, is expected to return 0 if ok, and a negative
333 + * errno (e.g. -EINVAL) on error.
334 + */
335 +struct ip_set_type {
336 + struct list_head list; /* next in list of set types */
337 +
338 + /* test for IP in set (kernel: iptables -m set src|dst)
339 + * return 0 if not in set, 1 if in set.
340 + */
341 + int (*testip_kernel) (struct ip_set *set,
342 + const struct sk_buff * skb,
343 + u_int32_t flags,
344 + ip_set_ip_t *ip);
345 +
346 + /* test for IP in set (userspace: ipset -T set IP)
347 + * return 0 if not in set, 1 if in set.
348 + */
349 + int (*testip) (struct ip_set *set,
350 + const void *data, size_t size,
351 + ip_set_ip_t *ip);
352 +
353 + /*
354 + * Size of the data structure passed by when
355 + * adding/deletin/testing an entry.
356 + */
357 + size_t reqsize;
358 +
359 + /* Add IP into set (userspace: ipset -A set IP)
360 + * Return -EEXIST if the address is already in the set,
361 + * and -ERANGE if the address lies outside the set bounds.
362 + * If the address was not already in the set, 0 is returned.
363 + */
364 + int (*addip) (struct ip_set *set,
365 + const void *data, size_t size,
366 + ip_set_ip_t *ip);
367 +
368 + /* Add IP into set (kernel: iptables ... -j SET set src|dst)
369 + * Return -EEXIST if the address is already in the set,
370 + * and -ERANGE if the address lies outside the set bounds.
371 + * If the address was not already in the set, 0 is returned.
372 + */
373 + int (*addip_kernel) (struct ip_set *set,
374 + const struct sk_buff * skb,
375 + u_int32_t flags,
376 + ip_set_ip_t *ip);
377 +
378 + /* remove IP from set (userspace: ipset -D set --entry x)
379 + * Return -EEXIST if the address is NOT in the set,
380 + * and -ERANGE if the address lies outside the set bounds.
381 + * If the address really was in the set, 0 is returned.
382 + */
383 + int (*delip) (struct ip_set *set,
384 + const void *data, size_t size,
385 + ip_set_ip_t *ip);
386 +
387 + /* remove IP from set (kernel: iptables ... -j SET --entry x)
388 + * Return -EEXIST if the address is NOT in the set,
389 + * and -ERANGE if the address lies outside the set bounds.
390 + * If the address really was in the set, 0 is returned.
391 + */
392 + int (*delip_kernel) (struct ip_set *set,
393 + const struct sk_buff * skb,
394 + u_int32_t flags,
395 + ip_set_ip_t *ip);
396 +
397 + /* new set creation - allocated type specific items
398 + */
399 + int (*create) (struct ip_set *set,
400 + const void *data, size_t size);
401 +
402 + /* retry the operation after successfully tweaking the set
403 + */
404 + int (*retry) (struct ip_set *set);
405 +
406 + /* set destruction - free type specific items
407 + * There is no return value.
408 + * Can be called only when child sets are destroyed.
409 + */
410 + void (*destroy) (struct ip_set *set);
411 +
412 + /* set flushing - reset all bits in the set, or something similar.
413 + * There is no return value.
414 + */
415 + void (*flush) (struct ip_set *set);
416 +
417 + /* Listing: size needed for header
418 + */
419 + size_t header_size;
420 +
421 + /* Listing: Get the header
422 + *
423 + * Fill in the information in "data".
424 + * This function is always run after list_header_size() under a
425 + * writelock on the set. Therefor is the length of "data" always
426 + * correct.
427 + */
428 + void (*list_header) (const struct ip_set *set,
429 + void *data);
430 +
431 + /* Listing: Get the size for the set members
432 + */
433 + int (*list_members_size) (const struct ip_set *set);
434 +
435 + /* Listing: Get the set members
436 + *
437 + * Fill in the information in "data".
438 + * This function is always run after list_member_size() under a
439 + * writelock on the set. Therefor is the length of "data" always
440 + * correct.
441 + */
442 + void (*list_members) (const struct ip_set *set,
443 + void *data);
444 +
445 + char typename[IP_SET_MAXNAMELEN];
446 + char typecode;
447 + int protocol_version;
448 +
449 + /* Set this to THIS_MODULE if you are a module, otherwise NULL */
450 + struct module *me;
451 +};
452 +
453 +extern int ip_set_register_set_type(struct ip_set_type *set_type);
454 +extern void ip_set_unregister_set_type(struct ip_set_type *set_type);
455 +
456 +/* A generic ipset */
457 +struct ip_set {
458 + char name[IP_SET_MAXNAMELEN]; /* the name of the set */
459 + rwlock_t lock; /* lock for concurrency control */
460 + ip_set_id_t id; /* set id for swapping */
461 + ip_set_id_t binding; /* default binding for the set */
462 + atomic_t ref; /* in kernel and in hash references */
463 + struct ip_set_type *type; /* the set types */
464 + void *data; /* pooltype specific data */
465 +};
466 +
467 +/* Structure to bind set elements to sets */
468 +struct ip_set_hash {
469 + struct list_head list; /* list of clashing entries in hash */
470 + ip_set_ip_t ip; /* ip from set */
471 + ip_set_id_t id; /* set id */
472 + ip_set_id_t binding; /* set we bind the element to */
473 +};
474 +
475 +/* register and unregister set references */
476 +extern ip_set_id_t ip_set_get_byname(const char name[IP_SET_MAXNAMELEN]);
477 +extern ip_set_id_t ip_set_get_byindex(ip_set_id_t id);
478 +extern void ip_set_put(ip_set_id_t id);
479 +
480 +/* API for iptables set match, and SET target */
481 +extern void ip_set_addip_kernel(ip_set_id_t id,
482 + const struct sk_buff *skb,
483 + const u_int32_t *flags);
484 +extern void ip_set_delip_kernel(ip_set_id_t id,
485 + const struct sk_buff *skb,
486 + const u_int32_t *flags);
487 +extern int ip_set_testip_kernel(ip_set_id_t id,
488 + const struct sk_buff *skb,
489 + const u_int32_t *flags);
490 +
491 +#endif /* __KERNEL__ */
492 +
493 +#endif /*_IP_SET_H*/
494 diff -Nur linux-2.6.16/include/linux/netfilter_ipv4/ip_set_iphash.h linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_iphash.h
495 --- linux-2.6.16/include/linux/netfilter_ipv4/ip_set_iphash.h 1970-01-01 01:00:00.000000000 +0100
496 +++ linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_iphash.h 2006-03-20 12:53:59.000000000 +0100
497 @@ -0,0 +1,30 @@
498 +#ifndef __IP_SET_IPHASH_H
499 +#define __IP_SET_IPHASH_H
500 +
501 +#include <linux/netfilter_ipv4/ip_set.h>
502 +
503 +#define SETTYPE_NAME "iphash"
504 +#define MAX_RANGE 0x0000FFFF
505 +
506 +struct ip_set_iphash {
507 + ip_set_ip_t *members; /* the iphash proper */
508 + uint32_t initval; /* initval for jhash_1word */
509 + uint32_t prime; /* prime for double hashing */
510 + uint32_t hashsize; /* hash size */
511 + uint16_t probes; /* max number of probes */
512 + uint16_t resize; /* resize factor in percent */
513 + ip_set_ip_t netmask; /* netmask */
514 +};
515 +
516 +struct ip_set_req_iphash_create {
517 + uint32_t hashsize;
518 + uint16_t probes;
519 + uint16_t resize;
520 + ip_set_ip_t netmask;
521 +};
522 +
523 +struct ip_set_req_iphash {
524 + ip_set_ip_t ip;
525 +};
526 +
527 +#endif /* __IP_SET_IPHASH_H */
528 diff -Nur linux-2.6.16/include/linux/netfilter_ipv4/ip_set_ipmap.h linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_ipmap.h
529 --- linux-2.6.16/include/linux/netfilter_ipv4/ip_set_ipmap.h 1970-01-01 01:00:00.000000000 +0100
530 +++ linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_ipmap.h 2006-03-20 12:53:59.000000000 +0100
531 @@ -0,0 +1,56 @@
532 +#ifndef __IP_SET_IPMAP_H
533 +#define __IP_SET_IPMAP_H
534 +
535 +#include <linux/netfilter_ipv4/ip_set.h>
536 +
537 +#define SETTYPE_NAME "ipmap"
538 +#define MAX_RANGE 0x0000FFFF
539 +
540 +struct ip_set_ipmap {
541 + void *members; /* the ipmap proper */
542 + ip_set_ip_t first_ip; /* host byte order, included in range */
543 + ip_set_ip_t last_ip; /* host byte order, included in range */
544 + ip_set_ip_t netmask; /* subnet netmask */
545 + ip_set_ip_t sizeid; /* size of set in IPs */
546 + u_int16_t hosts; /* number of hosts in a subnet */
547 +};
548 +
549 +struct ip_set_req_ipmap_create {
550 + ip_set_ip_t from;
551 + ip_set_ip_t to;
552 + ip_set_ip_t netmask;
553 +};
554 +
555 +struct ip_set_req_ipmap {
556 + ip_set_ip_t ip;
557 +};
558 +
559 +unsigned int
560 +mask_to_bits(ip_set_ip_t mask)
561 +{
562 + unsigned int bits = 32;
563 + ip_set_ip_t maskaddr;
564 +
565 + if (mask == 0xFFFFFFFF)
566 + return bits;
567 +
568 + maskaddr = 0xFFFFFFFE;
569 + while (--bits >= 0 && maskaddr != mask)
570 + maskaddr <<= 1;
571 +
572 + return bits;
573 +}
574 +
575 +ip_set_ip_t
576 +range_to_mask(ip_set_ip_t from, ip_set_ip_t to, unsigned int *bits)
577 +{
578 + ip_set_ip_t mask = 0xFFFFFFFE;
579 +
580 + *bits = 32;
581 + while (--(*bits) >= 0 && mask && (to & mask) != from)
582 + mask <<= 1;
583 +
584 + return mask;
585 +}
586 +
587 +#endif /* __IP_SET_IPMAP_H */
588 diff -Nur linux-2.6.16/include/linux/netfilter_ipv4/ip_set_iptree.h linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_iptree.h
589 --- linux-2.6.16/include/linux/netfilter_ipv4/ip_set_iptree.h 1970-01-01 01:00:00.000000000 +0100
590 +++ linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_iptree.h 2006-03-20 12:53:59.000000000 +0100
591 @@ -0,0 +1,39 @@
592 +#ifndef __IP_SET_IPTREE_H
593 +#define __IP_SET_IPTREE_H
594 +
595 +#include <linux/netfilter_ipv4/ip_set.h>
596 +
597 +#define SETTYPE_NAME "iptree"
598 +#define MAX_RANGE 0x0000FFFF
599 +
600 +struct ip_set_iptreed {
601 + unsigned long expires[255]; /* x.x.x.ADDR */
602 +};
603 +
604 +struct ip_set_iptreec {
605 + struct ip_set_iptreed *tree[255]; /* x.x.ADDR.* */
606 +};
607 +
608 +struct ip_set_iptreeb {
609 + struct ip_set_iptreec *tree[255]; /* x.ADDR.*.* */
610 +};
611 +
612 +struct ip_set_iptree {
613 + unsigned int timeout;
614 + unsigned int gc_interval;
615 +#ifdef __KERNEL__
616 + struct timer_list gc;
617 + struct ip_set_iptreeb *tree[255]; /* ADDR.*.*.* */
618 +#endif
619 +};
620 +
621 +struct ip_set_req_iptree_create {
622 + unsigned int timeout;
623 +};
624 +
625 +struct ip_set_req_iptree {
626 + ip_set_ip_t ip;
627 + unsigned int timeout;
628 +};
629 +
630 +#endif /* __IP_SET_IPTREE_H */
631 diff -Nur linux-2.6.16/include/linux/netfilter_ipv4/ip_set_jhash.h linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_jhash.h
632 --- linux-2.6.16/include/linux/netfilter_ipv4/ip_set_jhash.h 1970-01-01 01:00:00.000000000 +0100
633 +++ linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_jhash.h 2006-03-20 12:53:59.000000000 +0100
634 @@ -0,0 +1,148 @@
635 +#ifndef _LINUX_IPSET_JHASH_H
636 +#define _LINUX_IPSET_JHASH_H
637 +
638 +/* This is a copy of linux/jhash.h but the types u32/u8 are changed
639 + * to __u32/__u8 so that the header file can be included into
640 + * userspace code as well. Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
641 + */
642 +
643 +/* jhash.h: Jenkins hash support.
644 + *
645 + * Copyright (C) 1996 Bob Jenkins (bob_jenkins@burtleburtle.net)
646 + *
647 + * http://burtleburtle.net/bob/hash/
648 + *
649 + * These are the credits from Bob's sources:
650 + *
651 + * lookup2.c, by Bob Jenkins, December 1996, Public Domain.
652 + * hash(), hash2(), hash3, and mix() are externally useful functions.
653 + * Routines to test the hash are included if SELF_TEST is defined.
654 + * You can use this free for any purpose. It has no warranty.
655 + *
656 + * Copyright (C) 2003 David S. Miller (davem@redhat.com)
657 + *
658 + * I've modified Bob's hash to be useful in the Linux kernel, and
659 + * any bugs present are surely my fault. -DaveM
660 + */
661 +
662 +/* NOTE: Arguments are modified. */
663 +#define __jhash_mix(a, b, c) \
664 +{ \
665 + a -= b; a -= c; a ^= (c>>13); \
666 + b -= c; b -= a; b ^= (a<<8); \
667 + c -= a; c -= b; c ^= (b>>13); \
668 + a -= b; a -= c; a ^= (c>>12); \
669 + b -= c; b -= a; b ^= (a<<16); \
670 + c -= a; c -= b; c ^= (b>>5); \
671 + a -= b; a -= c; a ^= (c>>3); \
672 + b -= c; b -= a; b ^= (a<<10); \
673 + c -= a; c -= b; c ^= (b>>15); \
674 +}
675 +
676 +/* The golden ration: an arbitrary value */
677 +#define JHASH_GOLDEN_RATIO 0x9e3779b9
678 +
679 +/* The most generic version, hashes an arbitrary sequence
680 + * of bytes. No alignment or length assumptions are made about
681 + * the input key.
682 + */
683 +static inline __u32 jhash(void *key, __u32 length, __u32 initval)
684 +{
685 + __u32 a, b, c, len;
686 + __u8 *k = key;
687 +
688 + len = length;
689 + a = b = JHASH_GOLDEN_RATIO;
690 + c = initval;
691 +
692 + while (len >= 12) {
693 + a += (k[0] +((__u32)k[1]<<8) +((__u32)k[2]<<16) +((__u32)k[3]<<24));
694 + b += (k[4] +((__u32)k[5]<<8) +((__u32)k[6]<<16) +((__u32)k[7]<<24));
695 + c += (k[8] +((__u32)k[9]<<8) +((__u32)k[10]<<16)+((__u32)k[11]<<24));
696 +
697 + __jhash_mix(a,b,c);
698 +
699 + k += 12;
700 + len -= 12;
701 + }
702 +
703 + c += length;
704 + switch (len) {
705 + case 11: c += ((__u32)k[10]<<24);
706 + case 10: c += ((__u32)k[9]<<16);
707 + case 9 : c += ((__u32)k[8]<<8);
708 + case 8 : b += ((__u32)k[7]<<24);
709 + case 7 : b += ((__u32)k[6]<<16);
710 + case 6 : b += ((__u32)k[5]<<8);
711 + case 5 : b += k[4];
712 + case 4 : a += ((__u32)k[3]<<24);
713 + case 3 : a += ((__u32)k[2]<<16);
714 + case 2 : a += ((__u32)k[1]<<8);
715 + case 1 : a += k[0];
716 + };
717 +
718 + __jhash_mix(a,b,c);
719 +
720 + return c;
721 +}
722 +
723 +/* A special optimized version that handles 1 or more of __u32s.
724 + * The length parameter here is the number of __u32s in the key.
725 + */
726 +static inline __u32 jhash2(__u32 *k, __u32 length, __u32 initval)
727 +{
728 + __u32 a, b, c, len;
729 +
730 + a = b = JHASH_GOLDEN_RATIO;
731 + c = initval;
732 + len = length;
733 +
734 + while (len >= 3) {
735 + a += k[0];
736 + b += k[1];
737 + c += k[2];
738 + __jhash_mix(a, b, c);
739 + k += 3; len -= 3;
740 + }
741 +
742 + c += length * 4;
743 +
744 + switch (len) {
745 + case 2 : b += k[1];
746 + case 1 : a += k[0];
747 + };
748 +
749 + __jhash_mix(a,b,c);
750 +
751 + return c;
752 +}
753 +
754 +
755 +/* A special ultra-optimized versions that knows they are hashing exactly
756 + * 3, 2 or 1 word(s).
757 + *
758 + * NOTE: In partilar the "c += length; __jhash_mix(a,b,c);" normally
759 + * done at the end is not done here.
760 + */
761 +static inline __u32 jhash_3words(__u32 a, __u32 b, __u32 c, __u32 initval)
762 +{
763 + a += JHASH_GOLDEN_RATIO;
764 + b += JHASH_GOLDEN_RATIO;
765 + c += initval;
766 +
767 + __jhash_mix(a, b, c);
768 +
769 + return c;
770 +}
771 +
772 +static inline __u32 jhash_2words(__u32 a, __u32 b, __u32 initval)
773 +{
774 + return jhash_3words(a, b, 0, initval);
775 +}
776 +
777 +static inline __u32 jhash_1word(__u32 a, __u32 initval)
778 +{
779 + return jhash_3words(a, 0, 0, initval);
780 +}
781 +
782 +#endif /* _LINUX_IPSET_JHASH_H */
783 diff -Nur linux-2.6.16/include/linux/netfilter_ipv4/ip_set_macipmap.h linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_macipmap.h
784 --- linux-2.6.16/include/linux/netfilter_ipv4/ip_set_macipmap.h 1970-01-01 01:00:00.000000000 +0100
785 +++ linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_macipmap.h 2006-03-20 12:53:59.000000000 +0100
786 @@ -0,0 +1,38 @@
787 +#ifndef __IP_SET_MACIPMAP_H
788 +#define __IP_SET_MACIPMAP_H
789 +
790 +#include <linux/netfilter_ipv4/ip_set.h>
791 +
792 +#define SETTYPE_NAME "macipmap"
793 +#define MAX_RANGE 0x0000FFFF
794 +
795 +/* general flags */
796 +#define IPSET_MACIP_MATCHUNSET 1
797 +
798 +/* per ip flags */
799 +#define IPSET_MACIP_ISSET 1
800 +
801 +struct ip_set_macipmap {
802 + void *members; /* the macipmap proper */
803 + ip_set_ip_t first_ip; /* host byte order, included in range */
804 + ip_set_ip_t last_ip; /* host byte order, included in range */
805 + u_int32_t flags;
806 +};
807 +
808 +struct ip_set_req_macipmap_create {
809 + ip_set_ip_t from;
810 + ip_set_ip_t to;
811 + u_int32_t flags;
812 +};
813 +
814 +struct ip_set_req_macipmap {
815 + ip_set_ip_t ip;
816 + unsigned char ethernet[ETH_ALEN];
817 +};
818 +
819 +struct ip_set_macip {
820 + unsigned short flags;
821 + unsigned char ethernet[ETH_ALEN];
822 +};
823 +
824 +#endif /* __IP_SET_MACIPMAP_H */
825 diff -Nur linux-2.6.16/include/linux/netfilter_ipv4/ip_set_malloc.h linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_malloc.h
826 --- linux-2.6.16/include/linux/netfilter_ipv4/ip_set_malloc.h 1970-01-01 01:00:00.000000000 +0100
827 +++ linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_malloc.h 2006-03-20 12:53:59.000000000 +0100
828 @@ -0,0 +1,42 @@
829 +#ifndef _IP_SET_MALLOC_H
830 +#define _IP_SET_MALLOC_H
831 +
832 +#ifdef __KERNEL__
833 +
834 +/* Memory allocation and deallocation */
835 +static size_t max_malloc_size = 0;
836 +
837 +static inline void init_max_malloc_size(void)
838 +{
839 +#define CACHE(x) max_malloc_size = x;
840 +#include <linux/kmalloc_sizes.h>
841 +#undef CACHE
842 +}
843 +
844 +static inline void * ip_set_malloc_atomic(size_t bytes)
845 +{
846 + if (bytes > max_malloc_size)
847 + return __vmalloc(bytes, GFP_ATOMIC, PAGE_KERNEL);
848 + else
849 + return kmalloc(bytes, GFP_ATOMIC);
850 +}
851 +
852 +static inline void * ip_set_malloc(size_t bytes)
853 +{
854 + if (bytes > max_malloc_size)
855 + return vmalloc(bytes);
856 + else
857 + return kmalloc(bytes, GFP_KERNEL);
858 +}
859 +
860 +static inline void ip_set_free(void * data, size_t bytes)
861 +{
862 + if (bytes > max_malloc_size)
863 + vfree(data);
864 + else
865 + kfree(data);
866 +}
867 +
868 +#endif /* __KERNEL__ */
869 +
870 +#endif /*_IP_SET_MALLOC_H*/
871 diff -Nur linux-2.6.16/include/linux/netfilter_ipv4/ip_set_nethash.h linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_nethash.h
872 --- linux-2.6.16/include/linux/netfilter_ipv4/ip_set_nethash.h 1970-01-01 01:00:00.000000000 +0100
873 +++ linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_nethash.h 2006-03-20 12:53:59.000000000 +0100
874 @@ -0,0 +1,55 @@
875 +#ifndef __IP_SET_NETHASH_H
876 +#define __IP_SET_NETHASH_H
877 +
878 +#include <linux/netfilter_ipv4/ip_set.h>
879 +
880 +#define SETTYPE_NAME "nethash"
881 +#define MAX_RANGE 0x0000FFFF
882 +
883 +struct ip_set_nethash {
884 + ip_set_ip_t *members; /* the nethash proper */
885 + uint32_t initval; /* initval for jhash_1word */
886 + uint32_t prime; /* prime for double hashing */
887 + uint32_t hashsize; /* hash size */
888 + uint16_t probes; /* max number of probes */
889 + uint16_t resize; /* resize factor in percent */
890 + unsigned char cidr[30]; /* CIDR sizes */
891 +};
892 +
893 +struct ip_set_req_nethash_create {
894 + uint32_t hashsize;
895 + uint16_t probes;
896 + uint16_t resize;
897 +};
898 +
899 +struct ip_set_req_nethash {
900 + ip_set_ip_t ip;
901 + unsigned char cidr;
902 +};
903 +
904 +static unsigned char shifts[] = {255, 253, 249, 241, 225, 193, 129, 1};
905 +
906 +static inline ip_set_ip_t
907 +pack(ip_set_ip_t ip, unsigned char cidr)
908 +{
909 + ip_set_ip_t addr, *paddr = &addr;
910 + unsigned char n, t, *a;
911 +
912 + addr = htonl(ip & (0xFFFFFFFF << (32 - (cidr))));
913 +#ifdef __KERNEL__
914 + DP("ip:%u.%u.%u.%u/%u", NIPQUAD(addr), cidr);
915 +#endif
916 + n = cidr / 8;
917 + t = cidr % 8;
918 + a = &((unsigned char *)paddr)[n];
919 + *a = *a /(1 << (8 - t)) + shifts[t];
920 +#ifdef __KERNEL__
921 + DP("n: %u, t: %u, a: %u", n, t, *a);
922 + DP("ip:%u.%u.%u.%u/%u, %u.%u.%u.%u",
923 + HIPQUAD(ip), cidr, NIPQUAD(addr));
924 +#endif
925 +
926 + return ntohl(addr);
927 +}
928 +
929 +#endif /* __IP_SET_NETHASH_H */
930 diff -Nur linux-2.6.16/include/linux/netfilter_ipv4/ip_set_portmap.h linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_portmap.h
931 --- linux-2.6.16/include/linux/netfilter_ipv4/ip_set_portmap.h 1970-01-01 01:00:00.000000000 +0100
932 +++ linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_portmap.h 2006-03-20 12:53:59.000000000 +0100
933 @@ -0,0 +1,25 @@
934 +#ifndef __IP_SET_PORTMAP_H
935 +#define __IP_SET_PORTMAP_H
936 +
937 +#include <linux/netfilter_ipv4/ip_set.h>
938 +
939 +#define SETTYPE_NAME "portmap"
940 +#define MAX_RANGE 0x0000FFFF
941 +#define INVALID_PORT (MAX_RANGE + 1)
942 +
943 +struct ip_set_portmap {
944 + void *members; /* the portmap proper */
945 + ip_set_ip_t first_port; /* host byte order, included in range */
946 + ip_set_ip_t last_port; /* host byte order, included in range */
947 +};
948 +
949 +struct ip_set_req_portmap_create {
950 + ip_set_ip_t from;
951 + ip_set_ip_t to;
952 +};
953 +
954 +struct ip_set_req_portmap {
955 + ip_set_ip_t port;
956 +};
957 +
958 +#endif /* __IP_SET_PORTMAP_H */
959 diff -Nur linux-2.6.16/include/linux/netfilter_ipv4/ip_set_prime.h linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_prime.h
960 --- linux-2.6.16/include/linux/netfilter_ipv4/ip_set_prime.h 1970-01-01 01:00:00.000000000 +0100
961 +++ linux-2.6.16-owrt/include/linux/netfilter_ipv4/ip_set_prime.h 2006-03-20 12:53:59.000000000 +0100
962 @@ -0,0 +1,34 @@
963 +#ifndef __IP_SET_PRIME_H
964 +#define __IP_SET_PRIME_H
965 +
966 +static inline unsigned make_prime_bound(unsigned nr)
967 +{
968 + unsigned long long nr64 = nr;
969 + unsigned long long x = 1;
970 + nr = 1;
971 + while (x <= nr64) { x <<= 2; nr <<= 1; }
972 + return nr;
973 +}
974 +
975 +static inline int make_prime_check(unsigned nr)
976 +{
977 + unsigned x = 3;
978 + unsigned b = make_prime_bound(nr);
979 + while (x <= b) {
980 + if (0 == (nr % x)) return 0;
981 + x += 2;
982 + }
983 + return 1;
984 +}
985 +
986 +static unsigned make_prime(unsigned nr)
987 +{
988 + if (0 == (nr & 1)) nr--;
989 + while (nr > 1) {
990 + if (make_prime_check(nr)) return nr;
991 + nr -= 2;
992 + }
993 + return 2;
994 +}
995 +
996 +#endif /* __IP_SET_PRIME_H */
997 diff -Nur linux-2.6.16/include/linux/netfilter_ipv4/ipt_set.h linux-2.6.16-owrt/include/linux/netfilter_ipv4/ipt_set.h
998 --- linux-2.6.16/include/linux/netfilter_ipv4/ipt_set.h 1970-01-01 01:00:00.000000000 +0100
999 +++ linux-2.6.16-owrt/include/linux/netfilter_ipv4/ipt_set.h 2006-03-20 12:53:59.000000000 +0100
1000 @@ -0,0 +1,21 @@
1001 +#ifndef _IPT_SET_H
1002 +#define _IPT_SET_H
1003 +
1004 +#include <linux/netfilter_ipv4/ip_set.h>
1005 +
1006 +struct ipt_set_info {
1007 + ip_set_id_t index;
1008 + u_int32_t flags[IP_SET_MAX_BINDINGS + 1];
1009 +};
1010 +
1011 +/* match info */
1012 +struct ipt_set_info_match {
1013 + struct ipt_set_info match_set;
1014 +};
1015 +
1016 +struct ipt_set_info_target {
1017 + struct ipt_set_info add_set;
1018 + struct ipt_set_info del_set;
1019 +};
1020 +
1021 +#endif /*_IPT_SET_H*/
1022 diff -Nur linux-2.6.16/net/ipv4/netfilter/ip_set.c linux-2.6.16-owrt/net/ipv4/netfilter/ip_set.c
1023 --- linux-2.6.16/net/ipv4/netfilter/ip_set.c 1970-01-01 01:00:00.000000000 +0100
1024 +++ linux-2.6.16-owrt/net/ipv4/netfilter/ip_set.c 2006-03-20 12:53:59.000000000 +0100
1025 @@ -0,0 +1,1989 @@
1026 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
1027 + * Patrick Schaaf <bof@bof.de>
1028 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
1029 + *
1030 + * This program is free software; you can redistribute it and/or modify
1031 + * it under the terms of the GNU General Public License version 2 as
1032 + * published by the Free Software Foundation.
1033 + */
1034 +
1035 +/* Kernel module for IP set management */
1036 +
1037 +#include <linux/config.h>
1038 +#include <linux/module.h>
1039 +#include <linux/moduleparam.h>
1040 +#include <linux/kmod.h>
1041 +#include <linux/ip.h>
1042 +#include <linux/skbuff.h>
1043 +#include <linux/random.h>
1044 +#include <linux/jhash.h>
1045 +#include <linux/netfilter_ipv4/ip_tables.h>
1046 +#include <linux/errno.h>
1047 +#include <asm/uaccess.h>
1048 +#include <asm/bitops.h>
1049 +#include <asm/semaphore.h>
1050 +#include <linux/spinlock.h>
1051 +#include <linux/vmalloc.h>
1052 +
1053 +#define ASSERT_READ_LOCK(x) /* dont use that */
1054 +#define ASSERT_WRITE_LOCK(x)
1055 +#include <linux/netfilter_ipv4/listhelp.h>
1056 +#include <linux/netfilter_ipv4/ip_set.h>
1057 +
1058 +static struct list_head set_type_list; /* all registered sets */
1059 +static struct ip_set **ip_set_list; /* all individual sets */
1060 +static DEFINE_RWLOCK(ip_set_lock); /* protects the lists and the hash */
1061 +static DECLARE_MUTEX(ip_set_app_mutex); /* serializes user access */
1062 +static ip_set_id_t ip_set_max = CONFIG_IP_NF_SET_MAX;
1063 +static ip_set_id_t ip_set_bindings_hash_size = CONFIG_IP_NF_SET_HASHSIZE;
1064 +static struct list_head *ip_set_hash; /* hash of bindings */
1065 +static unsigned int ip_set_hash_random; /* random seed */
1066 +
1067 +/*
1068 + * Sets are identified either by the index in ip_set_list or by id.
1069 + * The id never changes and is used to find a key in the hash.
1070 + * The index may change by swapping and used at all other places
1071 + * (set/SET netfilter modules, binding value, etc.)
1072 + *
1073 + * Userspace requests are serialized by ip_set_mutex and sets can
1074 + * be deleted only from userspace. Therefore ip_set_list locking
1075 + * must obey the following rules:
1076 + *
1077 + * - kernel requests: read and write locking mandatory
1078 + * - user requests: read locking optional, write locking mandatory
1079 + */
1080 +
1081 +static inline void
1082 +__ip_set_get(ip_set_id_t index)
1083 +{
1084 + atomic_inc(&ip_set_list[index]->ref);
1085 +}
1086 +
1087 +static inline void
1088 +__ip_set_put(ip_set_id_t index)
1089 +{
1090 + atomic_dec(&ip_set_list[index]->ref);
1091 +}
1092 +
1093 +/*
1094 + * Binding routines
1095 + */
1096 +
1097 +static inline int
1098 +ip_hash_cmp(const struct ip_set_hash *set_hash,
1099 + ip_set_id_t id, ip_set_ip_t ip)
1100 +{
1101 + return set_hash->id == id && set_hash->ip == ip;
1102 +}
1103 +
1104 +static ip_set_id_t
1105 +ip_set_find_in_hash(ip_set_id_t id, ip_set_ip_t ip)
1106 +{
1107 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
1108 + % ip_set_bindings_hash_size;
1109 + struct ip_set_hash *set_hash;
1110 +
1111 + ASSERT_READ_LOCK(&ip_set_lock);
1112 + IP_SET_ASSERT(ip_set_list[id]);
1113 + DP("set: %s, ip: %u.%u.%u.%u", ip_set_list[id]->name, HIPQUAD(ip));
1114 +
1115 + set_hash = LIST_FIND(&ip_set_hash[key], ip_hash_cmp,
1116 + struct ip_set_hash *, id, ip);
1117 +
1118 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
1119 + HIPQUAD(ip),
1120 + set_hash != NULL ? ip_set_list[set_hash->binding]->name : "");
1121 +
1122 + return (set_hash != NULL ? set_hash->binding : IP_SET_INVALID_ID);
1123 +}
1124 +
1125 +static inline void
1126 +__set_hash_del(struct ip_set_hash *set_hash)
1127 +{
1128 + ASSERT_WRITE_LOCK(&ip_set_lock);
1129 + IP_SET_ASSERT(ip_set_list[set_hash->binding]);
1130 +
1131 + __ip_set_put(set_hash->binding);
1132 + list_del(&set_hash->list);
1133 + kfree(set_hash);
1134 +}
1135 +
1136 +static int
1137 +ip_set_hash_del(ip_set_id_t id, ip_set_ip_t ip)
1138 +{
1139 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
1140 + % ip_set_bindings_hash_size;
1141 + struct ip_set_hash *set_hash;
1142 +
1143 + IP_SET_ASSERT(ip_set_list[id]);
1144 + DP("set: %s, ip: %u.%u.%u.%u", ip_set_list[id]->name, HIPQUAD(ip));
1145 + write_lock_bh(&ip_set_lock);
1146 + set_hash = LIST_FIND(&ip_set_hash[key], ip_hash_cmp,
1147 + struct ip_set_hash *, id, ip);
1148 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
1149 + HIPQUAD(ip),
1150 + set_hash != NULL ? ip_set_list[set_hash->binding]->name : "");
1151 +
1152 + if (set_hash != NULL)
1153 + __set_hash_del(set_hash);
1154 + write_unlock_bh(&ip_set_lock);
1155 + return 0;
1156 +}
1157 +
1158 +static int
1159 +ip_set_hash_add(ip_set_id_t id, ip_set_ip_t ip, ip_set_id_t binding)
1160 +{
1161 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
1162 + % ip_set_bindings_hash_size;
1163 + struct ip_set_hash *set_hash;
1164 + int ret = 0;
1165 +
1166 + IP_SET_ASSERT(ip_set_list[id]);
1167 + IP_SET_ASSERT(ip_set_list[binding]);
1168 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
1169 + HIPQUAD(ip), ip_set_list[binding]->name);
1170 + write_lock_bh(&ip_set_lock);
1171 + set_hash = LIST_FIND(&ip_set_hash[key], ip_hash_cmp,
1172 + struct ip_set_hash *, id, ip);
1173 + if (!set_hash) {
1174 + set_hash = kmalloc(sizeof(struct ip_set_hash), GFP_KERNEL);
1175 + if (!set_hash) {
1176 + ret = -ENOMEM;
1177 + goto unlock;
1178 + }
1179 + INIT_LIST_HEAD(&set_hash->list);
1180 + set_hash->id = id;
1181 + set_hash->ip = ip;
1182 + list_add(&ip_set_hash[key], &set_hash->list);
1183 + } else {
1184 + IP_SET_ASSERT(ip_set_list[set_hash->binding]);
1185 + DP("overwrite binding: %s",
1186 + ip_set_list[set_hash->binding]->name);
1187 + __ip_set_put(set_hash->binding);
1188 + }
1189 + set_hash->binding = binding;
1190 + __ip_set_get(set_hash->binding);
1191 + unlock:
1192 + write_unlock_bh(&ip_set_lock);
1193 + return ret;
1194 +}
1195 +
1196 +#define FOREACH_HASH_DO(fn, args...) \
1197 +({ \
1198 + ip_set_id_t __key; \
1199 + struct ip_set_hash *__set_hash; \
1200 + \
1201 + for (__key = 0; __key < ip_set_bindings_hash_size; __key++) { \
1202 + list_for_each_entry(__set_hash, &ip_set_hash[__key], list) \
1203 + fn(__set_hash , ## args); \
1204 + } \
1205 +})
1206 +
1207 +#define FOREACH_HASH_RW_DO(fn, args...) \
1208 +({ \
1209 + ip_set_id_t __key; \
1210 + struct ip_set_hash *__set_hash, *__n; \
1211 + \
1212 + ASSERT_WRITE_LOCK(&ip_set_lock); \
1213 + for (__key = 0; __key < ip_set_bindings_hash_size; __key++) { \
1214 + list_for_each_entry_safe(__set_hash, __n, &ip_set_hash[__key], list)\
1215 + fn(__set_hash , ## args); \
1216 + } \
1217 +})
1218 +
1219 +/* Add, del and test set entries from kernel */
1220 +
1221 +#define follow_bindings(index, set, ip) \
1222 +((index = ip_set_find_in_hash((set)->id, ip)) != IP_SET_INVALID_ID \
1223 + || (index = (set)->binding) != IP_SET_INVALID_ID)
1224 +
1225 +int
1226 +ip_set_testip_kernel(ip_set_id_t index,
1227 + const struct sk_buff *skb,
1228 + const u_int32_t *flags)
1229 +{
1230 + struct ip_set *set;
1231 + ip_set_ip_t ip;
1232 + int res, i = 0;
1233 +
1234 + IP_SET_ASSERT(flags[i]);
1235 + read_lock_bh(&ip_set_lock);
1236 + do {
1237 + set = ip_set_list[index];
1238 + IP_SET_ASSERT(set);
1239 + DP("set %s, index %u", set->name, index);
1240 + read_lock_bh(&set->lock);
1241 + res = set->type->testip_kernel(set, skb, flags[i], &ip);
1242 + read_unlock_bh(&set->lock);
1243 + } while (res > 0
1244 + && flags[++i]
1245 + && follow_bindings(index, set, ip));
1246 + read_unlock_bh(&ip_set_lock);
1247 +
1248 + return res;
1249 +}
1250 +
1251 +void
1252 +ip_set_addip_kernel(ip_set_id_t index,
1253 + const struct sk_buff *skb,
1254 + const u_int32_t *flags)
1255 +{
1256 + struct ip_set *set;
1257 + ip_set_ip_t ip;
1258 + int res, i= 0;
1259 +
1260 + IP_SET_ASSERT(flags[i]);
1261 + retry:
1262 + read_lock_bh(&ip_set_lock);
1263 + do {
1264 + set = ip_set_list[index];
1265 + IP_SET_ASSERT(set);
1266 + DP("set %s, index %u", set->name, index);
1267 + write_lock_bh(&set->lock);
1268 + res = set->type->addip_kernel(set, skb, flags[i], &ip);
1269 + write_unlock_bh(&set->lock);
1270 + } while ((res == 0 || res == -EEXIST)
1271 + && flags[++i]
1272 + && follow_bindings(index, set, ip));
1273 + read_unlock_bh(&ip_set_lock);
1274 +
1275 + if (res == -EAGAIN
1276 + && set->type->retry
1277 + && (res = set->type->retry(set)) == 0)
1278 + goto retry;
1279 +}
1280 +
1281 +void
1282 +ip_set_delip_kernel(ip_set_id_t index,
1283 + const struct sk_buff *skb,
1284 + const u_int32_t *flags)
1285 +{
1286 + struct ip_set *set;
1287 + ip_set_ip_t ip;
1288 + int res, i = 0;
1289 +
1290 + IP_SET_ASSERT(flags[i]);
1291 + read_lock_bh(&ip_set_lock);
1292 + do {
1293 + set = ip_set_list[index];
1294 + IP_SET_ASSERT(set);
1295 + DP("set %s, index %u", set->name, index);
1296 + write_lock_bh(&set->lock);
1297 + res = set->type->delip_kernel(set, skb, flags[i], &ip);
1298 + write_unlock_bh(&set->lock);
1299 + } while ((res == 0 || res == -EEXIST)
1300 + && flags[++i]
1301 + && follow_bindings(index, set, ip));
1302 + read_unlock_bh(&ip_set_lock);
1303 +}
1304 +
1305 +/* Register and deregister settype */
1306 +
1307 +static inline int
1308 +set_type_equal(const struct ip_set_type *set_type, const char *str2)
1309 +{
1310 + return !strncmp(set_type->typename, str2, IP_SET_MAXNAMELEN - 1);
1311 +}
1312 +
1313 +static inline struct ip_set_type *
1314 +find_set_type(const char *name)
1315 +{
1316 + return LIST_FIND(&set_type_list,
1317 + set_type_equal,
1318 + struct ip_set_type *,
1319 + name);
1320 +}
1321 +
1322 +int
1323 +ip_set_register_set_type(struct ip_set_type *set_type)
1324 +{
1325 + int ret = 0;
1326 +
1327 + if (set_type->protocol_version != IP_SET_PROTOCOL_VERSION) {
1328 + ip_set_printk("'%s' uses wrong protocol version %u (want %u)",
1329 + set_type->typename,
1330 + set_type->protocol_version,
1331 + IP_SET_PROTOCOL_VERSION);
1332 + return -EINVAL;
1333 + }
1334 +
1335 + write_lock_bh(&ip_set_lock);
1336 + if (find_set_type(set_type->typename)) {
1337 + /* Duplicate! */
1338 + ip_set_printk("'%s' already registered!",
1339 + set_type->typename);
1340 + ret = -EINVAL;
1341 + goto unlock;
1342 + }
1343 + if (!try_module_get(THIS_MODULE)) {
1344 + ret = -EFAULT;
1345 + goto unlock;
1346 + }
1347 + list_append(&set_type_list, set_type);
1348 + DP("'%s' registered.", set_type->typename);
1349 + unlock:
1350 + write_unlock_bh(&ip_set_lock);
1351 + return ret;
1352 +}
1353 +
1354 +void
1355 +ip_set_unregister_set_type(struct ip_set_type *set_type)
1356 +{
1357 + write_lock_bh(&ip_set_lock);
1358 + if (!find_set_type(set_type->typename)) {
1359 + ip_set_printk("'%s' not registered?",
1360 + set_type->typename);
1361 + goto unlock;
1362 + }
1363 + LIST_DELETE(&set_type_list, set_type);
1364 + module_put(THIS_MODULE);
1365 + DP("'%s' unregistered.", set_type->typename);
1366 + unlock:
1367 + write_unlock_bh(&ip_set_lock);
1368 +
1369 +}
1370 +
1371 +/*
1372 + * Userspace routines
1373 + */
1374 +
1375 +/*
1376 + * Find set by name, reference it once. The reference makes sure the
1377 + * thing pointed to, does not go away under our feet. Drop the reference
1378 + * later, using ip_set_put().
1379 + */
1380 +ip_set_id_t
1381 +ip_set_get_byname(const char *name)
1382 +{
1383 + ip_set_id_t i, index = IP_SET_INVALID_ID;
1384 +
1385 + down(&ip_set_app_mutex);
1386 + for (i = 0; i < ip_set_max; i++) {
1387 + if (ip_set_list[i] != NULL
1388 + && strcmp(ip_set_list[i]->name, name) == 0) {
1389 + __ip_set_get(i);
1390 + index = i;
1391 + break;
1392 + }
1393 + }
1394 + up(&ip_set_app_mutex);
1395 + return index;
1396 +}
1397 +
1398 +/*
1399 + * Find set by index, reference it once. The reference makes sure the
1400 + * thing pointed to, does not go away under our feet. Drop the reference
1401 + * later, using ip_set_put().
1402 + */
1403 +ip_set_id_t
1404 +ip_set_get_byindex(ip_set_id_t index)
1405 +{
1406 + down(&ip_set_app_mutex);
1407 +
1408 + if (index >= ip_set_max)
1409 + return IP_SET_INVALID_ID;
1410 +
1411 + if (ip_set_list[index])
1412 + __ip_set_get(index);
1413 + else
1414 + index = IP_SET_INVALID_ID;
1415 +
1416 + up(&ip_set_app_mutex);
1417 + return index;
1418 +}
1419 +
1420 +/*
1421 + * If the given set pointer points to a valid set, decrement
1422 + * reference count by 1. The caller shall not assume the index
1423 + * to be valid, after calling this function.
1424 + */
1425 +void ip_set_put(ip_set_id_t index)
1426 +{
1427 + down(&ip_set_app_mutex);
1428 + if (ip_set_list[index])
1429 + __ip_set_put(index);
1430 + up(&ip_set_app_mutex);
1431 +}
1432 +
1433 +/* Find a set by name or index */
1434 +static ip_set_id_t
1435 +ip_set_find_byname(const char *name)
1436 +{
1437 + ip_set_id_t i, index = IP_SET_INVALID_ID;
1438 +
1439 + for (i = 0; i < ip_set_max; i++) {
1440 + if (ip_set_list[i] != NULL
1441 + && strcmp(ip_set_list[i]->name, name) == 0) {
1442 + index = i;
1443 + break;
1444 + }
1445 + }
1446 + return index;
1447 +}
1448 +
1449 +static ip_set_id_t
1450 +ip_set_find_byindex(ip_set_id_t index)
1451 +{
1452 + if (index >= ip_set_max || ip_set_list[index] == NULL)
1453 + index = IP_SET_INVALID_ID;
1454 +
1455 + return index;
1456 +}
1457 +
1458 +/*
1459 + * Add, del, test, bind and unbind
1460 + */
1461 +
1462 +static inline int
1463 +__ip_set_testip(struct ip_set *set,
1464 + const void *data,
1465 + size_t size,
1466 + ip_set_ip_t *ip)
1467 +{
1468 + int res;
1469 +
1470 + read_lock_bh(&set->lock);
1471 + res = set->type->testip(set, data, size, ip);
1472 + read_unlock_bh(&set->lock);
1473 +
1474 + return res;
1475 +}
1476 +
1477 +static int
1478 +__ip_set_addip(ip_set_id_t index,
1479 + const void *data,
1480 + size_t size)
1481 +{
1482 + struct ip_set *set = ip_set_list[index];
1483 + ip_set_ip_t ip;
1484 + int res;
1485 +
1486 + IP_SET_ASSERT(set);
1487 + do {
1488 + write_lock_bh(&set->lock);
1489 + res = set->type->addip(set, data, size, &ip);
1490 + write_unlock_bh(&set->lock);
1491 + } while (res == -EAGAIN
1492 + && set->type->retry
1493 + && (res = set->type->retry(set)) == 0);
1494 +
1495 + return res;
1496 +}
1497 +
1498 +static int
1499 +ip_set_addip(ip_set_id_t index,
1500 + const void *data,
1501 + size_t size)
1502 +{
1503 +
1504 + return __ip_set_addip(index,
1505 + data + sizeof(struct ip_set_req_adt),
1506 + size - sizeof(struct ip_set_req_adt));
1507 +}
1508 +
1509 +static int
1510 +ip_set_delip(ip_set_id_t index,
1511 + const void *data,
1512 + size_t size)
1513 +{
1514 + struct ip_set *set = ip_set_list[index];
1515 + ip_set_ip_t ip;
1516 + int res;
1517 +
1518 + IP_SET_ASSERT(set);
1519 + write_lock_bh(&set->lock);
1520 + res = set->type->delip(set,
1521 + data + sizeof(struct ip_set_req_adt),
1522 + size - sizeof(struct ip_set_req_adt),
1523 + &ip);
1524 + write_unlock_bh(&set->lock);
1525 +
1526 + return res;
1527 +}
1528 +
1529 +static int
1530 +ip_set_testip(ip_set_id_t index,
1531 + const void *data,
1532 + size_t size)
1533 +{
1534 + struct ip_set *set = ip_set_list[index];
1535 + ip_set_ip_t ip;
1536 + int res;
1537 +
1538 + IP_SET_ASSERT(set);
1539 + res = __ip_set_testip(set,
1540 + data + sizeof(struct ip_set_req_adt),
1541 + size - sizeof(struct ip_set_req_adt),
1542 + &ip);
1543 +
1544 + return (res > 0 ? -EEXIST : res);
1545 +}
1546 +
1547 +static int
1548 +ip_set_bindip(ip_set_id_t index,
1549 + const void *data,
1550 + size_t size)
1551 +{
1552 + struct ip_set *set = ip_set_list[index];
1553 + struct ip_set_req_bind *req_bind;
1554 + ip_set_id_t binding;
1555 + ip_set_ip_t ip;
1556 + int res;
1557 +
1558 + IP_SET_ASSERT(set);
1559 + if (size < sizeof(struct ip_set_req_bind))
1560 + return -EINVAL;
1561 +
1562 + req_bind = (struct ip_set_req_bind *) data;
1563 + req_bind->binding[IP_SET_MAXNAMELEN - 1] = '\0';
1564 +
1565 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1566 + /* Default binding of a set */
1567 + char *binding_name;
1568 +
1569 + if (size != sizeof(struct ip_set_req_bind) + IP_SET_MAXNAMELEN)
1570 + return -EINVAL;
1571 +
1572 + binding_name = (char *)(data + sizeof(struct ip_set_req_bind));
1573 + binding_name[IP_SET_MAXNAMELEN - 1] = '\0';
1574 +
1575 + binding = ip_set_find_byname(binding_name);
1576 + if (binding == IP_SET_INVALID_ID)
1577 + return -ENOENT;
1578 +
1579 + write_lock_bh(&ip_set_lock);
1580 + /* Sets as binding values are referenced */
1581 + if (set->binding != IP_SET_INVALID_ID)
1582 + __ip_set_put(set->binding);
1583 + set->binding = binding;
1584 + __ip_set_get(set->binding);
1585 + write_unlock_bh(&ip_set_lock);
1586 +
1587 + return 0;
1588 + }
1589 + binding = ip_set_find_byname(req_bind->binding);
1590 + if (binding == IP_SET_INVALID_ID)
1591 + return -ENOENT;
1592 +
1593 + res = __ip_set_testip(set,
1594 + data + sizeof(struct ip_set_req_bind),
1595 + size - sizeof(struct ip_set_req_bind),
1596 + &ip);
1597 + DP("set %s, ip: %u.%u.%u.%u, binding %s",
1598 + set->name, HIPQUAD(ip), ip_set_list[binding]->name);
1599 +
1600 + if (res >= 0)
1601 + res = ip_set_hash_add(set->id, ip, binding);
1602 +
1603 + return res;
1604 +}
1605 +
1606 +#define FOREACH_SET_DO(fn, args...) \
1607 +({ \
1608 + ip_set_id_t __i; \
1609 + struct ip_set *__set; \
1610 + \
1611 + for (__i = 0; __i < ip_set_max; __i++) { \
1612 + __set = ip_set_list[__i]; \
1613 + if (__set != NULL) \
1614 + fn(__set , ##args); \
1615 + } \
1616 +})
1617 +
1618 +static inline void
1619 +__set_hash_del_byid(struct ip_set_hash *set_hash, ip_set_id_t id)
1620 +{
1621 + if (set_hash->id == id)
1622 + __set_hash_del(set_hash);
1623 +}
1624 +
1625 +static inline void
1626 +__unbind_default(struct ip_set *set)
1627 +{
1628 + if (set->binding != IP_SET_INVALID_ID) {
1629 + /* Sets as binding values are referenced */
1630 + __ip_set_put(set->binding);
1631 + set->binding = IP_SET_INVALID_ID;
1632 + }
1633 +}
1634 +
1635 +static int
1636 +ip_set_unbindip(ip_set_id_t index,
1637 + const void *data,
1638 + size_t size)
1639 +{
1640 + struct ip_set *set;
1641 + struct ip_set_req_bind *req_bind;
1642 + ip_set_ip_t ip;
1643 + int res;
1644 +
1645 + DP("");
1646 + if (size < sizeof(struct ip_set_req_bind))
1647 + return -EINVAL;
1648 +
1649 + req_bind = (struct ip_set_req_bind *) data;
1650 + req_bind->binding[IP_SET_MAXNAMELEN - 1] = '\0';
1651 +
1652 + DP("%u %s", index, req_bind->binding);
1653 + if (index == IP_SET_INVALID_ID) {
1654 + /* unbind :all: */
1655 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1656 + /* Default binding of sets */
1657 + write_lock_bh(&ip_set_lock);
1658 + FOREACH_SET_DO(__unbind_default);
1659 + write_unlock_bh(&ip_set_lock);
1660 + return 0;
1661 + } else if (strcmp(req_bind->binding, IPSET_TOKEN_ALL) == 0) {
1662 + /* Flush all bindings of all sets*/
1663 + write_lock_bh(&ip_set_lock);
1664 + FOREACH_HASH_RW_DO(__set_hash_del);
1665 + write_unlock_bh(&ip_set_lock);
1666 + return 0;
1667 + }
1668 + DP("unreachable reached!");
1669 + return -EINVAL;
1670 + }
1671 +
1672 + set = ip_set_list[index];
1673 + IP_SET_ASSERT(set);
1674 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1675 + /* Default binding of set */
1676 + ip_set_id_t binding = ip_set_find_byindex(set->binding);
1677 +
1678 + if (binding == IP_SET_INVALID_ID)
1679 + return -ENOENT;
1680 +
1681 + write_lock_bh(&ip_set_lock);
1682 + /* Sets in hash values are referenced */
1683 + __ip_set_put(set->binding);
1684 + set->binding = IP_SET_INVALID_ID;
1685 + write_unlock_bh(&ip_set_lock);
1686 +
1687 + return 0;
1688 + } else if (strcmp(req_bind->binding, IPSET_TOKEN_ALL) == 0) {
1689 + /* Flush all bindings */
1690 +
1691 + write_lock_bh(&ip_set_lock);
1692 + FOREACH_HASH_RW_DO(__set_hash_del_byid, set->id);
1693 + write_unlock_bh(&ip_set_lock);
1694 + return 0;
1695 + }
1696 +
1697 + res = __ip_set_testip(set,
1698 + data + sizeof(struct ip_set_req_bind),
1699 + size - sizeof(struct ip_set_req_bind),
1700 + &ip);
1701 +
1702 + DP("set %s, ip: %u.%u.%u.%u", set->name, HIPQUAD(ip));
1703 + if (res >= 0)
1704 + res = ip_set_hash_del(set->id, ip);
1705 +
1706 + return res;
1707 +}
1708 +
1709 +static int
1710 +ip_set_testbind(ip_set_id_t index,
1711 + const void *data,
1712 + size_t size)
1713 +{
1714 + struct ip_set *set = ip_set_list[index];
1715 + struct ip_set_req_bind *req_bind;
1716 + ip_set_id_t binding;
1717 + ip_set_ip_t ip;
1718 + int res;
1719 +
1720 + IP_SET_ASSERT(set);
1721 + if (size < sizeof(struct ip_set_req_bind))
1722 + return -EINVAL;
1723 +
1724 + req_bind = (struct ip_set_req_bind *) data;
1725 + req_bind->binding[IP_SET_MAXNAMELEN - 1] = '\0';
1726 +
1727 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1728 + /* Default binding of set */
1729 + char *binding_name;
1730 +
1731 + if (size != sizeof(struct ip_set_req_bind) + IP_SET_MAXNAMELEN)
1732 + return -EINVAL;
1733 +
1734 + binding_name = (char *)(data + sizeof(struct ip_set_req_bind));
1735 + binding_name[IP_SET_MAXNAMELEN - 1] = '\0';
1736 +
1737 + binding = ip_set_find_byname(binding_name);
1738 + if (binding == IP_SET_INVALID_ID)
1739 + return -ENOENT;
1740 +
1741 + res = (set->binding == binding) ? -EEXIST : 0;
1742 +
1743 + return res;
1744 + }
1745 + binding = ip_set_find_byname(req_bind->binding);
1746 + if (binding == IP_SET_INVALID_ID)
1747 + return -ENOENT;
1748 +
1749 +
1750 + res = __ip_set_testip(set,
1751 + data + sizeof(struct ip_set_req_bind),
1752 + size - sizeof(struct ip_set_req_bind),
1753 + &ip);
1754 + DP("set %s, ip: %u.%u.%u.%u, binding %s",
1755 + set->name, HIPQUAD(ip), ip_set_list[binding]->name);
1756 +
1757 + if (res >= 0)
1758 + res = (ip_set_find_in_hash(set->id, ip) == binding)
1759 + ? -EEXIST : 0;
1760 +
1761 + return res;
1762 +}
1763 +
1764 +static struct ip_set_type *
1765 +find_set_type_rlock(const char *typename)
1766 +{
1767 + struct ip_set_type *type;
1768 +
1769 + read_lock_bh(&ip_set_lock);
1770 + type = find_set_type(typename);
1771 + if (type == NULL)
1772 + read_unlock_bh(&ip_set_lock);
1773 +
1774 + return type;
1775 +}
1776 +
1777 +static int
1778 +find_free_id(const char *name,
1779 + ip_set_id_t *index,
1780 + ip_set_id_t *id)
1781 +{
1782 + ip_set_id_t i;
1783 +
1784 + *id = IP_SET_INVALID_ID;
1785 + for (i = 0; i < ip_set_max; i++) {
1786 + if (ip_set_list[i] == NULL) {
1787 + if (*id == IP_SET_INVALID_ID)
1788 + *id = *index = i;
1789 + } else if (strcmp(name, ip_set_list[i]->name) == 0)
1790 + /* Name clash */
1791 + return -EEXIST;
1792 + }
1793 + if (*id == IP_SET_INVALID_ID)
1794 + /* No free slot remained */
1795 + return -ERANGE;
1796 + /* Check that index is usable as id (swapping) */
1797 + check:
1798 + for (i = 0; i < ip_set_max; i++) {
1799 + if (ip_set_list[i] != NULL
1800 + && ip_set_list[i]->id == *id) {
1801 + *id = i;
1802 + goto check;
1803 + }
1804 + }
1805 + return 0;
1806 +}
1807 +
1808 +/*
1809 + * Create a set
1810 + */
1811 +static int
1812 +ip_set_create(const char *name,
1813 + const char *typename,
1814 + ip_set_id_t restore,
1815 + const void *data,
1816 + size_t size)
1817 +{
1818 + struct ip_set *set;
1819 + ip_set_id_t index, id;
1820 + int res = 0;
1821 +
1822 + DP("setname: %s, typename: %s, id: %u", name, typename, restore);
1823 + /*
1824 + * First, and without any locks, allocate and initialize
1825 + * a normal base set structure.
1826 + */
1827 + set = kmalloc(sizeof(struct ip_set), GFP_KERNEL);
1828 + if (!set)
1829 + return -ENOMEM;
1830 + set->lock = RW_LOCK_UNLOCKED;
1831 + strncpy(set->name, name, IP_SET_MAXNAMELEN);
1832 + set->binding = IP_SET_INVALID_ID;
1833 + atomic_set(&set->ref, 0);
1834 +
1835 + /*
1836 + * Next, take the &ip_set_lock, check that we know the type,
1837 + * and take a reference on the type, to make sure it
1838 + * stays available while constructing our new set.
1839 + *
1840 + * After referencing the type, we drop the &ip_set_lock,
1841 + * and let the new set construction run without locks.
1842 + */
1843 + set->type = find_set_type_rlock(typename);
1844 + if (set->type == NULL) {
1845 + /* Try loading the module */
1846 + char modulename[IP_SET_MAXNAMELEN + strlen("ip_set_") + 1];
1847 + strcpy(modulename, "ip_set_");
1848 + strcat(modulename, typename);
1849 + DP("try to load %s", modulename);
1850 + request_module(modulename);
1851 + set->type = find_set_type_rlock(typename);
1852 + }
1853 + if (set->type == NULL) {
1854 + ip_set_printk("no set type '%s', set '%s' not created",
1855 + typename, name);
1856 + res = -ENOENT;
1857 + goto out;
1858 + }
1859 + if (!try_module_get(set->type->me)) {
1860 + read_unlock_bh(&ip_set_lock);
1861 + res = -EFAULT;
1862 + goto out;
1863 + }
1864 + read_unlock_bh(&ip_set_lock);
1865 +
1866 + /*
1867 + * Without holding any locks, create private part.
1868 + */
1869 + res = set->type->create(set, data, size);
1870 + if (res != 0)
1871 + goto put_out;
1872 +
1873 + /* BTW, res==0 here. */
1874 +
1875 + /*
1876 + * Here, we have a valid, constructed set. &ip_set_lock again,
1877 + * find free id/index and check that it is not already in
1878 + * ip_set_list.
1879 + */
1880 + write_lock_bh(&ip_set_lock);
1881 + if ((res = find_free_id(set->name, &index, &id)) != 0) {
1882 + DP("no free id!");
1883 + goto cleanup;
1884 + }
1885 +
1886 + /* Make sure restore gets the same index */
1887 + if (restore != IP_SET_INVALID_ID && index != restore) {
1888 + DP("Can't restore, sets are screwed up");
1889 + res = -ERANGE;
1890 + goto cleanup;
1891 + }
1892 +
1893 + /*
1894 + * Finally! Add our shiny new set to the list, and be done.
1895 + */
1896 + DP("create: '%s' created with index %u, id %u!", set->name, index, id);
1897 + set->id = id;
1898 + ip_set_list[index] = set;
1899 + write_unlock_bh(&ip_set_lock);
1900 + return res;
1901 +
1902 + cleanup:
1903 + write_unlock_bh(&ip_set_lock);
1904 + set->type->destroy(set);
1905 + put_out:
1906 + module_put(set->type->me);
1907 + out:
1908 + kfree(set);
1909 + return res;
1910 +}
1911 +
1912 +/*
1913 + * Destroy a given existing set
1914 + */
1915 +static void
1916 +ip_set_destroy_set(ip_set_id_t index)
1917 +{
1918 + struct ip_set *set = ip_set_list[index];
1919 +
1920 + IP_SET_ASSERT(set);
1921 + DP("set: %s", set->name);
1922 + write_lock_bh(&ip_set_lock);
1923 + FOREACH_HASH_RW_DO(__set_hash_del_byid, set->id);
1924 + if (set->binding != IP_SET_INVALID_ID)
1925 + __ip_set_put(set->binding);
1926 + ip_set_list[index] = NULL;
1927 + write_unlock_bh(&ip_set_lock);
1928 +
1929 + /* Must call it without holding any lock */
1930 + set->type->destroy(set);
1931 + module_put(set->type->me);
1932 + kfree(set);
1933 +}
1934 +
1935 +/*
1936 + * Destroy a set - or all sets
1937 + * Sets must not be referenced/used.
1938 + */
1939 +static int
1940 +ip_set_destroy(ip_set_id_t index)
1941 +{
1942 + ip_set_id_t i;
1943 +
1944 + /* ref modification always protected by the mutex */
1945 + if (index != IP_SET_INVALID_ID) {
1946 + if (atomic_read(&ip_set_list[index]->ref))
1947 + return -EBUSY;
1948 + ip_set_destroy_set(index);
1949 + } else {
1950 + for (i = 0; i < ip_set_max; i++) {
1951 + if (ip_set_list[i] != NULL
1952 + && (atomic_read(&ip_set_list[i]->ref)))
1953 + return -EBUSY;
1954 + }
1955 +
1956 + for (i = 0; i < ip_set_max; i++) {
1957 + if (ip_set_list[i] != NULL)
1958 + ip_set_destroy_set(i);
1959 + }
1960 + }
1961 + return 0;
1962 +}
1963 +
1964 +static void
1965 +ip_set_flush_set(struct ip_set *set)
1966 +{
1967 + DP("set: %s %u", set->name, set->id);
1968 +
1969 + write_lock_bh(&set->lock);
1970 + set->type->flush(set);
1971 + write_unlock_bh(&set->lock);
1972 +}
1973 +
1974 +/*
1975 + * Flush data in a set - or in all sets
1976 + */
1977 +static int
1978 +ip_set_flush(ip_set_id_t index)
1979 +{
1980 + if (index != IP_SET_INVALID_ID) {
1981 + IP_SET_ASSERT(ip_set_list[index]);
1982 + ip_set_flush_set(ip_set_list[index]);
1983 + } else
1984 + FOREACH_SET_DO(ip_set_flush_set);
1985 +
1986 + return 0;
1987 +}
1988 +
1989 +/* Rename a set */
1990 +static int
1991 +ip_set_rename(ip_set_id_t index, const char *name)
1992 +{
1993 + struct ip_set *set = ip_set_list[index];
1994 + ip_set_id_t i;
1995 + int res = 0;
1996 +
1997 + DP("set: %s to %s", set->name, name);
1998 + write_lock_bh(&ip_set_lock);
1999 + for (i = 0; i < ip_set_max; i++) {
2000 + if (ip_set_list[i] != NULL
2001 + && strncmp(ip_set_list[i]->name,
2002 + name,
2003 + IP_SET_MAXNAMELEN - 1) == 0) {
2004 + res = -EEXIST;
2005 + goto unlock;
2006 + }
2007 + }
2008 + strncpy(set->name, name, IP_SET_MAXNAMELEN);
2009 + unlock:
2010 + write_unlock_bh(&ip_set_lock);
2011 + return res;
2012 +}
2013 +
2014 +/*
2015 + * Swap two sets so that name/index points to the other.
2016 + * References are also swapped.
2017 + */
2018 +static int
2019 +ip_set_swap(ip_set_id_t from_index, ip_set_id_t to_index)
2020 +{
2021 + struct ip_set *from = ip_set_list[from_index];
2022 + struct ip_set *to = ip_set_list[to_index];
2023 + char from_name[IP_SET_MAXNAMELEN];
2024 + u_int32_t from_ref;
2025 +
2026 + DP("set: %s to %s", from->name, to->name);
2027 + /* Type can't be changed. Artifical restriction. */
2028 + if (from->type->typecode != to->type->typecode)
2029 + return -ENOEXEC;
2030 +
2031 + /* No magic here: ref munging protected by the mutex */
2032 + write_lock_bh(&ip_set_lock);
2033 + strncpy(from_name, from->name, IP_SET_MAXNAMELEN);
2034 + from_ref = atomic_read(&from->ref);
2035 +
2036 + strncpy(from->name, to->name, IP_SET_MAXNAMELEN);
2037 + atomic_set(&from->ref, atomic_read(&to->ref));
2038 + strncpy(to->name, from_name, IP_SET_MAXNAMELEN);
2039 + atomic_set(&to->ref, from_ref);
2040 +
2041 + ip_set_list[from_index] = to;
2042 + ip_set_list[to_index] = from;
2043 +
2044 + write_unlock_bh(&ip_set_lock);
2045 + return 0;
2046 +}
2047 +
2048 +/*
2049 + * List set data
2050 + */
2051 +
2052 +static inline void
2053 +__set_hash_bindings_size_list(struct ip_set_hash *set_hash,
2054 + ip_set_id_t id, size_t *size)
2055 +{
2056 + if (set_hash->id == id)
2057 + *size += sizeof(struct ip_set_hash_list);
2058 +}
2059 +
2060 +static inline void
2061 +__set_hash_bindings_size_save(struct ip_set_hash *set_hash,
2062 + ip_set_id_t id, size_t *size)
2063 +{
2064 + if (set_hash->id == id)
2065 + *size += sizeof(struct ip_set_hash_save);
2066 +}
2067 +
2068 +static inline void
2069 +__set_hash_bindings(struct ip_set_hash *set_hash,
2070 + ip_set_id_t id, void *data, int *used)
2071 +{
2072 + if (set_hash->id == id) {
2073 + struct ip_set_hash_list *hash_list =
2074 + (struct ip_set_hash_list *)(data + *used);
2075 +
2076 + hash_list->ip = set_hash->ip;
2077 + hash_list->binding = set_hash->binding;
2078 + *used += sizeof(struct ip_set_hash_list);
2079 + }
2080 +}
2081 +
2082 +static int ip_set_list_set(ip_set_id_t index,
2083 + void *data,
2084 + int *used,
2085 + int len)
2086 +{
2087 + struct ip_set *set = ip_set_list[index];
2088 + struct ip_set_list *set_list;
2089 +
2090 + /* Pointer to our header */
2091 + set_list = (struct ip_set_list *) (data + *used);
2092 +
2093 + DP("set: %s, used: %d %p %p", set->name, *used, data, data + *used);
2094 +
2095 + /* Get and ensure header size */
2096 + if (*used + sizeof(struct ip_set_list) > len)
2097 + goto not_enough_mem;
2098 + *used += sizeof(struct ip_set_list);
2099 +
2100 + read_lock_bh(&set->lock);
2101 + /* Get and ensure set specific header size */
2102 + set_list->header_size = set->type->header_size;
2103 + if (*used + set_list->header_size > len)
2104 + goto unlock_set;
2105 +
2106 + /* Fill in the header */
2107 + set_list->index = index;
2108 + set_list->binding = set->binding;
2109 + set_list->ref = atomic_read(&set->ref);
2110 +
2111 + /* Fill in set spefific header data */
2112 + set->type->list_header(set, data + *used);
2113 + *used += set_list->header_size;
2114 +
2115 + /* Get and ensure set specific members size */
2116 + set_list->members_size = set->type->list_members_size(set);
2117 + if (*used + set_list->members_size > len)
2118 + goto unlock_set;
2119 +
2120 + /* Fill in set spefific members data */
2121 + set->type->list_members(set, data + *used);
2122 + *used += set_list->members_size;
2123 + read_unlock_bh(&set->lock);
2124 +
2125 + /* Bindings */
2126 +
2127 + /* Get and ensure set specific bindings size */
2128 + set_list->bindings_size = 0;
2129 + FOREACH_HASH_DO(__set_hash_bindings_size_list,
2130 + set->id, &set_list->bindings_size);
2131 + if (*used + set_list->bindings_size > len)
2132 + goto not_enough_mem;
2133 +
2134 + /* Fill in set spefific bindings data */
2135 + FOREACH_HASH_DO(__set_hash_bindings, set->id, data, used);
2136 +
2137 + return 0;
2138 +
2139 + unlock_set:
2140 + read_unlock_bh(&set->lock);
2141 + not_enough_mem:
2142 + DP("not enough mem, try again");
2143 + return -EAGAIN;
2144 +}
2145 +
2146 +/*
2147 + * Save sets
2148 + */
2149 +static int ip_set_save_set(ip_set_id_t index,
2150 + void *data,
2151 + int *used,
2152 + int len)
2153 +{
2154 + struct ip_set *set;
2155 + struct ip_set_save *set_save;
2156 +
2157 + /* Pointer to our header */
2158 + set_save = (struct ip_set_save *) (data + *used);
2159 +
2160 + /* Get and ensure header size */
2161 + if (*used + sizeof(struct ip_set_save) > len)
2162 + goto not_enough_mem;
2163 + *used += sizeof(struct ip_set_save);
2164 +
2165 + set = ip_set_list[index];
2166 + DP("set: %s, used: %u(%u) %p %p", set->name, *used, len,
2167 + data, data + *used);
2168 +
2169 + read_lock_bh(&set->lock);
2170 + /* Get and ensure set specific header size */
2171 + set_save->header_size = set->type->header_size;
2172 + if (*used + set_save->header_size > len)
2173 + goto unlock_set;
2174 +
2175 + /* Fill in the header */
2176 + set_save->index = index;
2177 + set_save->binding = set->binding;
2178 +
2179 + /* Fill in set spefific header data */
2180 + set->type->list_header(set, data + *used);
2181 + *used += set_save->header_size;
2182 +
2183 + DP("set header filled: %s, used: %u %p %p", set->name, *used,
2184 + data, data + *used);
2185 + /* Get and ensure set specific members size */
2186 + set_save->members_size = set->type->list_members_size(set);
2187 + if (*used + set_save->members_size > len)
2188 + goto unlock_set;
2189 +
2190 + /* Fill in set spefific members data */
2191 + set->type->list_members(set, data + *used);
2192 + *used += set_save->members_size;
2193 + read_unlock_bh(&set->lock);
2194 + DP("set members filled: %s, used: %u %p %p", set->name, *used,
2195 + data, data + *used);
2196 + return 0;
2197 +
2198 + unlock_set:
2199 + read_unlock_bh(&set->lock);
2200 + not_enough_mem:
2201 + DP("not enough mem, try again");
2202 + return -EAGAIN;
2203 +}
2204 +
2205 +static inline void
2206 +__set_hash_save_bindings(struct ip_set_hash *set_hash,
2207 + ip_set_id_t id,
2208 + void *data,
2209 + int *used,
2210 + int len,
2211 + int *res)
2212 +{
2213 + if (*res == 0
2214 + && (id == IP_SET_INVALID_ID || set_hash->id == id)) {
2215 + struct ip_set_hash_save *hash_save =
2216 + (struct ip_set_hash_save *)(data + *used);
2217 + /* Ensure bindings size */
2218 + if (*used + sizeof(struct ip_set_hash_save) > len) {
2219 + *res = -ENOMEM;
2220 + return;
2221 + }
2222 + hash_save->id = set_hash->id;
2223 + hash_save->ip = set_hash->ip;
2224 + hash_save->binding = set_hash->binding;
2225 + *used += sizeof(struct ip_set_hash_save);
2226 + }
2227 +}
2228 +
2229 +static int ip_set_save_bindings(ip_set_id_t index,
2230 + void *data,
2231 + int *used,
2232 + int len)
2233 +{
2234 + int res = 0;
2235 + struct ip_set_save *set_save;
2236 +
2237 + DP("used %u, len %u", *used, len);
2238 + /* Get and ensure header size */
2239 + if (*used + sizeof(struct ip_set_save) > len)
2240 + return -ENOMEM;
2241 +
2242 + /* Marker */
2243 + set_save = (struct ip_set_save *) (data + *used);
2244 + set_save->index = IP_SET_INVALID_ID;
2245 + *used += sizeof(struct ip_set_save);
2246 +
2247 + DP("marker added used %u, len %u", *used, len);
2248 + /* Fill in bindings data */
2249 + if (index != IP_SET_INVALID_ID)
2250 + /* Sets are identified by id in hash */
2251 + index = ip_set_list[index]->id;
2252 + FOREACH_HASH_DO(__set_hash_save_bindings, index, data, used, len, &res);
2253 +
2254 + return res;
2255 +}
2256 +
2257 +/*
2258 + * Restore sets
2259 + */
2260 +static int ip_set_restore(void *data,
2261 + int len)
2262 +{
2263 + int res = 0;
2264 + int line = 0, used = 0, members_size;
2265 + struct ip_set *set;
2266 + struct ip_set_hash_save *hash_save;
2267 + struct ip_set_restore *set_restore;
2268 + ip_set_id_t index;
2269 +
2270 + /* Loop to restore sets */
2271 + while (1) {
2272 + line++;
2273 +
2274 + DP("%u %u %u", used, sizeof(struct ip_set_restore), len);
2275 + /* Get and ensure header size */
2276 + if (used + sizeof(struct ip_set_restore) > len)
2277 + return line;
2278 + set_restore = (struct ip_set_restore *) (data + used);
2279 + used += sizeof(struct ip_set_restore);
2280 +
2281 + /* Ensure data size */
2282 + if (used
2283 + + set_restore->header_size
2284 + + set_restore->members_size > len)
2285 + return line;
2286 +
2287 + /* Check marker */
2288 + if (set_restore->index == IP_SET_INVALID_ID) {
2289 + line--;
2290 + goto bindings;
2291 + }
2292 +
2293 + /* Try to create the set */
2294 + DP("restore %s %s", set_restore->name, set_restore->typename);
2295 + res = ip_set_create(set_restore->name,
2296 + set_restore->typename,
2297 + set_restore->index,
2298 + data + used,
2299 + set_restore->header_size);
2300 +
2301 + if (res != 0)
2302 + return line;
2303 + used += set_restore->header_size;
2304 +
2305 + index = ip_set_find_byindex(set_restore->index);
2306 + DP("index %u, restore_index %u", index, set_restore->index);
2307 + if (index != set_restore->index)
2308 + return line;
2309 + /* Try to restore members data */
2310 + set = ip_set_list[index];
2311 + members_size = 0;
2312 + DP("members_size %u reqsize %u",
2313 + set_restore->members_size, set->type->reqsize);
2314 + while (members_size + set->type->reqsize <=
2315 + set_restore->members_size) {
2316 + line++;
2317 + DP("members: %u, line %u", members_size, line);
2318 + res = __ip_set_addip(index,
2319 + data + used + members_size,
2320 + set->type->reqsize);
2321 + if (!(res == 0 || res == -EEXIST))
2322 + return line;
2323 + members_size += set->type->reqsize;
2324 + }
2325 +
2326 + DP("members_size %u %u",
2327 + set_restore->members_size, members_size);
2328 + if (members_size != set_restore->members_size)
2329 + return line++;
2330 + used += set_restore->members_size;
2331 + }
2332 +
2333 + bindings:
2334 + /* Loop to restore bindings */
2335 + while (used < len) {
2336 + line++;
2337 +
2338 + DP("restore binding, line %u", line);
2339 + /* Get and ensure size */
2340 + if (used + sizeof(struct ip_set_hash_save) > len)
2341 + return line;
2342 + hash_save = (struct ip_set_hash_save *) (data + used);
2343 + used += sizeof(struct ip_set_hash_save);
2344 +
2345 + /* hash_save->id is used to store the index */
2346 + index = ip_set_find_byindex(hash_save->id);
2347 + DP("restore binding index %u, id %u, %u -> %u",
2348 + index, hash_save->id, hash_save->ip, hash_save->binding);
2349 + if (index != hash_save->id)
2350 + return line;
2351 +
2352 + set = ip_set_list[hash_save->id];
2353 + /* Null valued IP means default binding */
2354 + if (hash_save->ip)
2355 + res = ip_set_hash_add(set->id,
2356 + hash_save->ip,
2357 + hash_save->binding);
2358 + else {
2359 + IP_SET_ASSERT(set->binding == IP_SET_INVALID_ID);
2360 + write_lock_bh(&ip_set_lock);
2361 + set->binding = hash_save->binding;
2362 + __ip_set_get(set->binding);
2363 + write_unlock_bh(&ip_set_lock);
2364 + DP("default binding: %u", set->binding);
2365 + }
2366 + if (res != 0)
2367 + return line;
2368 + }
2369 + if (used != len)
2370 + return line;
2371 +
2372 + return 0;
2373 +}
2374 +
2375 +static int
2376 +ip_set_sockfn_set(struct sock *sk, int optval, void *user, unsigned int len)
2377 +{
2378 + void *data;
2379 + int res = 0; /* Assume OK */
2380 + unsigned *op;
2381 + struct ip_set_req_adt *req_adt;
2382 + ip_set_id_t index = IP_SET_INVALID_ID;
2383 + int (*adtfn)(ip_set_id_t index,
2384 + const void *data, size_t size);
2385 + struct fn_table {
2386 + int (*fn)(ip_set_id_t index,
2387 + const void *data, size_t size);
2388 + } adtfn_table[] =
2389 + { { ip_set_addip }, { ip_set_delip }, { ip_set_testip},
2390 + { ip_set_bindip}, { ip_set_unbindip }, { ip_set_testbind },
2391 + };
2392 +
2393 + DP("optval=%d, user=%p, len=%d", optval, user, len);
2394 + if (!capable(CAP_NET_ADMIN))
2395 + return -EPERM;
2396 + if (optval != SO_IP_SET)
2397 + return -EBADF;
2398 + if (len <= sizeof(unsigned)) {
2399 + ip_set_printk("short userdata (want >%zu, got %u)",
2400 + sizeof(unsigned), len);
2401 + return -EINVAL;
2402 + }
2403 + data = vmalloc(len);
2404 + if (!data) {
2405 + DP("out of mem for %u bytes", len);
2406 + return -ENOMEM;
2407 + }
2408 + if (copy_from_user(data, user, len) != 0) {
2409 + res = -EFAULT;
2410 + goto done;
2411 + }
2412 + if (down_interruptible(&ip_set_app_mutex)) {
2413 + res = -EINTR;
2414 + goto done;
2415 + }
2416 +
2417 + op = (unsigned *)data;
2418 + DP("op=%x", *op);
2419 +
2420 + if (*op < IP_SET_OP_VERSION) {
2421 + /* Check the version at the beginning of operations */
2422 + struct ip_set_req_version *req_version =
2423 + (struct ip_set_req_version *) data;
2424 + if (req_version->version != IP_SET_PROTOCOL_VERSION) {
2425 + res = -EPROTO;
2426 + goto done;
2427 + }
2428 + }
2429 +
2430 + switch (*op) {
2431 + case IP_SET_OP_CREATE:{
2432 + struct ip_set_req_create *req_create
2433 + = (struct ip_set_req_create *) data;
2434 +
2435 + if (len <= sizeof(struct ip_set_req_create)) {
2436 + ip_set_printk("short CREATE data (want >%zu, got %u)",
2437 + sizeof(struct ip_set_req_create), len);
2438 + res = -EINVAL;
2439 + goto done;
2440 + }
2441 + req_create->name[IP_SET_MAXNAMELEN - 1] = '\0';
2442 + req_create->typename[IP_SET_MAXNAMELEN - 1] = '\0';
2443 + res = ip_set_create(req_create->name,
2444 + req_create->typename,
2445 + IP_SET_INVALID_ID,
2446 + data + sizeof(struct ip_set_req_create),
2447 + len - sizeof(struct ip_set_req_create));
2448 + goto done;
2449 + }
2450 + case IP_SET_OP_DESTROY:{
2451 + struct ip_set_req_std *req_destroy
2452 + = (struct ip_set_req_std *) data;
2453 +
2454 + if (len != sizeof(struct ip_set_req_std)) {
2455 + ip_set_printk("invalid DESTROY data (want %zu, got %u)",
2456 + sizeof(struct ip_set_req_std), len);
2457 + res = -EINVAL;
2458 + goto done;
2459 + }
2460 + if (strcmp(req_destroy->name, IPSET_TOKEN_ALL) == 0) {
2461 + /* Destroy all sets */
2462 + index = IP_SET_INVALID_ID;
2463 + } else {
2464 + req_destroy->name[IP_SET_MAXNAMELEN - 1] = '\0';
2465 + index = ip_set_find_byname(req_destroy->name);
2466 +
2467 + if (index == IP_SET_INVALID_ID) {
2468 + res = -ENOENT;
2469 + goto done;
2470 + }
2471 + }
2472 +
2473 + res = ip_set_destroy(index);
2474 + goto done;
2475 + }
2476 + case IP_SET_OP_FLUSH:{
2477 + struct ip_set_req_std *req_flush =
2478 + (struct ip_set_req_std *) data;
2479 +
2480 + if (len != sizeof(struct ip_set_req_std)) {
2481 + ip_set_printk("invalid FLUSH data (want %zu, got %u)",
2482 + sizeof(struct ip_set_req_std), len);
2483 + res = -EINVAL;
2484 + goto done;
2485 + }
2486 + if (strcmp(req_flush->name, IPSET_TOKEN_ALL) == 0) {
2487 + /* Flush all sets */
2488 + index = IP_SET_INVALID_ID;
2489 + } else {
2490 + req_flush->name[IP_SET_MAXNAMELEN - 1] = '\0';
2491 + index = ip_set_find_byname(req_flush->name);
2492 +
2493 + if (index == IP_SET_INVALID_ID) {
2494 + res = -ENOENT;
2495 + goto done;
2496 + }
2497 + }
2498 + res = ip_set_flush(index);
2499 + goto done;
2500 + }
2501 + case IP_SET_OP_RENAME:{
2502 + struct ip_set_req_create *req_rename
2503 + = (struct ip_set_req_create *) data;
2504 +
2505 + if (len != sizeof(struct ip_set_req_create)) {
2506 + ip_set_printk("invalid RENAME data (want %zu, got %u)",
2507 + sizeof(struct ip_set_req_create), len);
2508 + res = -EINVAL;
2509 + goto done;
2510 + }
2511 +
2512 + req_rename->name[IP_SET_MAXNAMELEN - 1] = '\0';
2513 + req_rename->typename[IP_SET_MAXNAMELEN - 1] = '\0';
2514 +
2515 + index = ip_set_find_byname(req_rename->name);
2516 + if (index == IP_SET_INVALID_ID) {
2517 + res = -ENOENT;
2518 + goto done;
2519 + }
2520 + res = ip_set_rename(index, req_rename->typename);
2521 + goto done;
2522 + }
2523 + case IP_SET_OP_SWAP:{
2524 + struct ip_set_req_create *req_swap
2525 + = (struct ip_set_req_create *) data;
2526 + ip_set_id_t to_index;
2527 +
2528 + if (len != sizeof(struct ip_set_req_create)) {
2529 + ip_set_printk("invalid SWAP data (want %zu, got %u)",
2530 + sizeof(struct ip_set_req_create), len);
2531 + res = -EINVAL;
2532 + goto done;
2533 + }
2534 +
2535 + req_swap->name[IP_SET_MAXNAMELEN - 1] = '\0';
2536 + req_swap->typename[IP_SET_MAXNAMELEN - 1] = '\0';
2537 +
2538 + index = ip_set_find_byname(req_swap->name);
2539 + if (index == IP_SET_INVALID_ID) {
2540 + res = -ENOENT;
2541 + goto done;
2542 + }
2543 + to_index = ip_set_find_byname(req_swap->typename);
2544 + if (to_index == IP_SET_INVALID_ID) {
2545 + res = -ENOENT;
2546 + goto done;
2547 + }
2548 + res = ip_set_swap(index, to_index);
2549 + goto done;
2550 + }
2551 + default:
2552 + break; /* Set identified by id */
2553 + }
2554 +
2555 + /* There we may have add/del/test/bind/unbind/test_bind operations */
2556 + if (*op < IP_SET_OP_ADD_IP || *op > IP_SET_OP_TEST_BIND_SET) {
2557 + res = -EBADMSG;
2558 + goto done;
2559 + }
2560 + adtfn = adtfn_table[*op - IP_SET_OP_ADD_IP].fn;
2561 +
2562 + if (len < sizeof(struct ip_set_req_adt)) {
2563 + ip_set_printk("short data in adt request (want >=%zu, got %u)",
2564 + sizeof(struct ip_set_req_adt), len);
2565 + res = -EINVAL;
2566 + goto done;
2567 + }
2568 + req_adt = (struct ip_set_req_adt *) data;
2569 +
2570 + /* -U :all: :all:|:default: uses IP_SET_INVALID_ID */
2571 + if (!(*op == IP_SET_OP_UNBIND_SET
2572 + && req_adt->index == IP_SET_INVALID_ID)) {
2573 + index = ip_set_find_byindex(req_adt->index);
2574 + if (index == IP_SET_INVALID_ID) {
2575 + res = -ENOENT;
2576 + goto done;
2577 + }
2578 + }
2579 + res = adtfn(index, data, len);
2580 +
2581 + done:
2582 + up(&ip_set_app_mutex);
2583 + vfree(data);
2584 + if (res > 0)
2585 + res = 0;
2586 + DP("final result %d", res);
2587 + return res;
2588 +}
2589 +
2590 +static int
2591 +ip_set_sockfn_get(struct sock *sk, int optval, void *user, int *len)
2592 +{
2593 + int res = 0;
2594 + unsigned *op;
2595 + ip_set_id_t index = IP_SET_INVALID_ID;
2596 + void *data;
2597 + int copylen = *len;
2598 +
2599 + DP("optval=%d, user=%p, len=%d", optval, user, *len);
2600 + if (!capable(CAP_NET_ADMIN))
2601 + return -EPERM;
2602 + if (optval != SO_IP_SET)
2603 + return -EBADF;
2604 + if (*len < sizeof(unsigned)) {
2605 + ip_set_printk("short userdata (want >=%zu, got %d)",
2606 + sizeof(unsigned), *len);
2607 + return -EINVAL;
2608 + }
2609 + data = vmalloc(*len);
2610 + if (!data) {
2611 + DP("out of mem for %d bytes", *len);
2612 + return -ENOMEM;
2613 + }
2614 + if (copy_from_user(data, user, *len) != 0) {
2615 + res = -EFAULT;
2616 + goto done;
2617 + }
2618 + if (down_interruptible(&ip_set_app_mutex)) {
2619 + res = -EINTR;
2620 + goto done;
2621 + }
2622 +
2623 + op = (unsigned *) data;
2624 + DP("op=%x", *op);
2625 +
2626 + if (*op < IP_SET_OP_VERSION) {
2627 + /* Check the version at the beginning of operations */
2628 + struct ip_set_req_version *req_version =
2629 + (struct ip_set_req_version *) data;
2630 + if (req_version->version != IP_SET_PROTOCOL_VERSION) {
2631 + res = -EPROTO;
2632 + goto done;
2633 + }
2634 + }
2635 +
2636 + switch (*op) {
2637 + case IP_SET_OP_VERSION: {
2638 + struct ip_set_req_version *req_version =
2639 + (struct ip_set_req_version *) data;
2640 +
2641 + if (*len != sizeof(struct ip_set_req_version)) {
2642 + ip_set_printk("invalid VERSION (want %zu, got %d)",
2643 + sizeof(struct ip_set_req_version),
2644 + *len);
2645 + res = -EINVAL;
2646 + goto done;
2647 + }
2648 +
2649 + req_version->version = IP_SET_PROTOCOL_VERSION;
2650 + res = copy_to_user(user, req_version,
2651 + sizeof(struct ip_set_req_version));
2652 + goto done;
2653 + }
2654 + case IP_SET_OP_GET_BYNAME: {
2655 + struct ip_set_req_get_set *req_get
2656 + = (struct ip_set_req_get_set *) data;
2657 +
2658 + if (*len != sizeof(struct ip_set_req_get_set)) {
2659 + ip_set_printk("invalid GET_BYNAME (want %zu, got %d)",
2660 + sizeof(struct ip_set_req_get_set), *len);
2661 + res = -EINVAL;
2662 + goto done;
2663 + }
2664 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2665 + index = ip_set_find_byname(req_get->set.name);
2666 + req_get->set.index = index;
2667 + goto copy;
2668 + }
2669 + case IP_SET_OP_GET_BYINDEX: {
2670 + struct ip_set_req_get_set *req_get
2671 + = (struct ip_set_req_get_set *) data;
2672 +
2673 + if (*len != sizeof(struct ip_set_req_get_set)) {
2674 + ip_set_printk("invalid GET_BYINDEX (want %zu, got %d)",
2675 + sizeof(struct ip_set_req_get_set), *len);
2676 + res = -EINVAL;
2677 + goto done;
2678 + }
2679 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2680 + index = ip_set_find_byindex(req_get->set.index);
2681 + strncpy(req_get->set.name,
2682 + index == IP_SET_INVALID_ID ? ""
2683 + : ip_set_list[index]->name, IP_SET_MAXNAMELEN);
2684 + goto copy;
2685 + }
2686 + case IP_SET_OP_ADT_GET: {
2687 + struct ip_set_req_adt_get *req_get
2688 + = (struct ip_set_req_adt_get *) data;
2689 +
2690 + if (*len != sizeof(struct ip_set_req_adt_get)) {
2691 + ip_set_printk("invalid ADT_GET (want %zu, got %d)",
2692 + sizeof(struct ip_set_req_adt_get), *len);
2693 + res = -EINVAL;
2694 + goto done;
2695 + }
2696 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2697 + index = ip_set_find_byname(req_get->set.name);
2698 + if (index != IP_SET_INVALID_ID) {
2699 + req_get->set.index = index;
2700 + strncpy(req_get->typename,
2701 + ip_set_list[index]->type->typename,
2702 + IP_SET_MAXNAMELEN - 1);
2703 + } else {
2704 + res = -ENOENT;
2705 + goto done;
2706 + }
2707 + goto copy;
2708 + }
2709 + case IP_SET_OP_MAX_SETS: {
2710 + struct ip_set_req_max_sets *req_max_sets
2711 + = (struct ip_set_req_max_sets *) data;
2712 + ip_set_id_t i;
2713 +
2714 + if (*len != sizeof(struct ip_set_req_max_sets)) {
2715 + ip_set_printk("invalid MAX_SETS (want %zu, got %d)",
2716 + sizeof(struct ip_set_req_max_sets), *len);
2717 + res = -EINVAL;
2718 + goto done;
2719 + }
2720 +
2721 + if (strcmp(req_max_sets->set.name, IPSET_TOKEN_ALL) == 0) {
2722 + req_max_sets->set.index = IP_SET_INVALID_ID;
2723 + } else {
2724 + req_max_sets->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2725 + req_max_sets->set.index =
2726 + ip_set_find_byname(req_max_sets->set.name);
2727 + if (req_max_sets->set.index == IP_SET_INVALID_ID) {
2728 + res = -ENOENT;
2729 + goto done;
2730 + }
2731 + }
2732 + req_max_sets->max_sets = ip_set_max;
2733 + req_max_sets->sets = 0;
2734 + for (i = 0; i < ip_set_max; i++) {
2735 + if (ip_set_list[i] != NULL)
2736 + req_max_sets->sets++;
2737 + }
2738 + goto copy;
2739 + }
2740 + case IP_SET_OP_LIST_SIZE:
2741 + case IP_SET_OP_SAVE_SIZE: {
2742 + struct ip_set_req_setnames *req_setnames
2743 + = (struct ip_set_req_setnames *) data;
2744 + struct ip_set_name_list *name_list;
2745 + struct ip_set *set;
2746 + ip_set_id_t i;
2747 + int used;
2748 +
2749 + if (*len < sizeof(struct ip_set_req_setnames)) {
2750 + ip_set_printk("short LIST_SIZE (want >=%zu, got %d)",
2751 + sizeof(struct ip_set_req_setnames), *len);
2752 + res = -EINVAL;
2753 + goto done;
2754 + }
2755 +
2756 + req_setnames->size = 0;
2757 + used = sizeof(struct ip_set_req_setnames);
2758 + for (i = 0; i < ip_set_max; i++) {
2759 + if (ip_set_list[i] == NULL)
2760 + continue;
2761 + name_list = (struct ip_set_name_list *)
2762 + (data + used);
2763 + used += sizeof(struct ip_set_name_list);
2764 + if (used > copylen) {
2765 + res = -EAGAIN;
2766 + goto done;
2767 + }
2768 + set = ip_set_list[i];
2769 + /* Fill in index, name, etc. */
2770 + name_list->index = i;
2771 + name_list->id = set->id;
2772 + strncpy(name_list->name,
2773 + set->name,
2774 + IP_SET_MAXNAMELEN - 1);
2775 + strncpy(name_list->typename,
2776 + set->type->typename,
2777 + IP_SET_MAXNAMELEN - 1);
2778 + DP("filled %s of type %s, index %u\n",
2779 + name_list->name, name_list->typename,
2780 + name_list->index);
2781 + if (!(req_setnames->index == IP_SET_INVALID_ID
2782 + || req_setnames->index == i))
2783 + continue;
2784 + /* Update size */
2785 + switch (*op) {
2786 + case IP_SET_OP_LIST_SIZE: {
2787 + req_setnames->size += sizeof(struct ip_set_list)
2788 + + set->type->header_size
2789 + + set->type->list_members_size(set);
2790 + FOREACH_HASH_DO(__set_hash_bindings_size_list,
2791 + i, &req_setnames->size);
2792 + break;
2793 + }
2794 + case IP_SET_OP_SAVE_SIZE: {
2795 + req_setnames->size += sizeof(struct ip_set_save)
2796 + + set->type->header_size
2797 + + set->type->list_members_size(set);
2798 + FOREACH_HASH_DO(__set_hash_bindings_size_save,
2799 + i, &req_setnames->size);
2800 + break;
2801 + }
2802 + default:
2803 + break;
2804 + }
2805 + }
2806 + if (copylen != used) {
2807 + res = -EAGAIN;
2808 + goto done;
2809 + }
2810 + goto copy;
2811 + }
2812 + case IP_SET_OP_LIST: {
2813 + struct ip_set_req_list *req_list
2814 + = (struct ip_set_req_list *) data;
2815 + ip_set_id_t i;
2816 + int used;
2817 +
2818 + if (*len < sizeof(struct ip_set_req_list)) {
2819 + ip_set_printk("short LIST (want >=%zu, got %d)",
2820 + sizeof(struct ip_set_req_list), *len);
2821 + res = -EINVAL;
2822 + goto done;
2823 + }
2824 + index = req_list->index;
2825 + if (index != IP_SET_INVALID_ID
2826 + && ip_set_find_byindex(index) != index) {
2827 + res = -ENOENT;
2828 + goto done;
2829 + }
2830 + used = 0;
2831 + if (index == IP_SET_INVALID_ID) {
2832 + /* List all sets */
2833 + for (i = 0; i < ip_set_max && res == 0; i++) {
2834 + if (ip_set_list[i] != NULL)
2835 + res = ip_set_list_set(i, data, &used, *len);
2836 + }
2837 + } else {
2838 + /* List an individual set */
2839 + res = ip_set_list_set(index, data, &used, *len);
2840 + }
2841 + if (res != 0)
2842 + goto done;
2843 + else if (copylen != used) {
2844 + res = -EAGAIN;
2845 + goto done;
2846 + }
2847 + goto copy;
2848 + }
2849 + case IP_SET_OP_SAVE: {
2850 + struct ip_set_req_list *req_save
2851 + = (struct ip_set_req_list *) data;
2852 + ip_set_id_t i;
2853 + int used;
2854 +
2855 + if (*len < sizeof(struct ip_set_req_list)) {
2856 + ip_set_printk("short SAVE (want >=%zu, got %d)",
2857 + sizeof(struct ip_set_req_list), *len);
2858 + res = -EINVAL;
2859 + goto done;
2860 + }
2861 + index = req_save->index;
2862 + if (index != IP_SET_INVALID_ID
2863 + && ip_set_find_byindex(index) != index) {
2864 + res = -ENOENT;
2865 + goto done;
2866 + }
2867 + used = 0;
2868 + if (index == IP_SET_INVALID_ID) {
2869 + /* Save all sets */
2870 + for (i = 0; i < ip_set_max && res == 0; i++) {
2871 + if (ip_set_list[i] != NULL)
2872 + res = ip_set_save_set(i, data, &used, *len);
2873 + }
2874 + } else {
2875 + /* Save an individual set */
2876 + res = ip_set_save_set(index, data, &used, *len);
2877 + }
2878 + if (res == 0)
2879 + res = ip_set_save_bindings(index, data, &used, *len);
2880 +
2881 + if (res != 0)
2882 + goto done;
2883 + else if (copylen != used) {
2884 + res = -EAGAIN;
2885 + goto done;
2886 + }
2887 + goto copy;
2888 + }
2889 + case IP_SET_OP_RESTORE: {
2890 + struct ip_set_req_setnames *req_restore
2891 + = (struct ip_set_req_setnames *) data;
2892 + int line;
2893 +
2894 + if (*len < sizeof(struct ip_set_req_setnames)
2895 + || *len != req_restore->size) {
2896 + ip_set_printk("invalid RESTORE (want =%zu, got %d)",
2897 + req_restore->size, *len);
2898 + res = -EINVAL;
2899 + goto done;
2900 + }
2901 + line = ip_set_restore(data + sizeof(struct ip_set_req_setnames),
2902 + req_restore->size - sizeof(struct ip_set_req_setnames));
2903 + DP("ip_set_restore: %u", line);
2904 + if (line != 0) {
2905 + res = -EAGAIN;
2906 + req_restore->size = line;
2907 + copylen = sizeof(struct ip_set_req_setnames);
2908 + goto copy;
2909 + }
2910 + goto done;
2911 + }
2912 + default:
2913 + res = -EBADMSG;
2914 + goto done;
2915 + } /* end of switch(op) */
2916 +
2917 + copy:
2918 + DP("set %s, copylen %u", index != IP_SET_INVALID_ID
2919 + && ip_set_list[index]
2920 + ? ip_set_list[index]->name
2921 + : ":all:", copylen);
2922 + if (res == 0)
2923 + res = copy_to_user(user, data, copylen);
2924 + else
2925 + copy_to_user(user, data, copylen);
2926 +
2927 + done:
2928 + up(&ip_set_app_mutex);
2929 + vfree(data);
2930 + if (res > 0)
2931 + res = 0;
2932 + DP("final result %d", res);
2933 + return res;
2934 +}
2935 +
2936 +static struct nf_sockopt_ops so_set = {
2937 + .pf = PF_INET,
2938 + .set_optmin = SO_IP_SET,
2939 + .set_optmax = SO_IP_SET + 1,
2940 + .set = &ip_set_sockfn_set,
2941 + .get_optmin = SO_IP_SET,
2942 + .get_optmax = SO_IP_SET + 1,
2943 + .get = &ip_set_sockfn_get,
2944 + .use = 0
2945 +};
2946 +
2947 +static int max_sets, hash_size;
2948 +module_param(max_sets, int, 0600);
2949 +MODULE_PARM_DESC(max_sets, "maximal number of sets");
2950 +module_param(hash_size, int, 0600);
2951 +MODULE_PARM_DESC(hash_size, "hash size for bindings");
2952 +MODULE_LICENSE("GPL");
2953 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
2954 +MODULE_DESCRIPTION("module implementing core IP set support");
2955 +
2956 +static int __init init(void)
2957 +{
2958 + int res;
2959 + ip_set_id_t i;
2960 +
2961 + get_random_bytes(&ip_set_hash_random, 4);
2962 + if (max_sets)
2963 + ip_set_max = max_sets;
2964 + ip_set_list = vmalloc(sizeof(struct ip_set *) * ip_set_max);
2965 + if (!ip_set_list) {
2966 + printk(KERN_ERR "Unable to create ip_set_list\n");
2967 + return -ENOMEM;
2968 + }
2969 + memset(ip_set_list, 0, sizeof(struct ip_set *) * ip_set_max);
2970 + if (hash_size)
2971 + ip_set_bindings_hash_size = hash_size;
2972 + ip_set_hash = vmalloc(sizeof(struct list_head) * ip_set_bindings_hash_size);
2973 + if (!ip_set_hash) {
2974 + printk(KERN_ERR "Unable to create ip_set_hash\n");
2975 + vfree(ip_set_list);
2976 + return -ENOMEM;
2977 + }
2978 + for (i = 0; i < ip_set_bindings_hash_size; i++)
2979 + INIT_LIST_HEAD(&ip_set_hash[i]);
2980 +
2981 + INIT_LIST_HEAD(&set_type_list);
2982 +
2983 + res = nf_register_sockopt(&so_set);
2984 + if (res != 0) {
2985 + ip_set_printk("SO_SET registry failed: %d", res);
2986 + vfree(ip_set_list);
2987 + vfree(ip_set_hash);
2988 + return res;
2989 + }
2990 + return 0;
2991 +}
2992 +
2993 +static void __exit fini(void)
2994 +{
2995 + /* There can't be any existing set or binding */
2996 + nf_unregister_sockopt(&so_set);
2997 + vfree(ip_set_list);
2998 + vfree(ip_set_hash);
2999 + DP("these are the famous last words");
3000 +}
3001 +
3002 +EXPORT_SYMBOL(ip_set_register_set_type);
3003 +EXPORT_SYMBOL(ip_set_unregister_set_type);
3004 +
3005 +EXPORT_SYMBOL(ip_set_get_byname);
3006 +EXPORT_SYMBOL(ip_set_get_byindex);
3007 +EXPORT_SYMBOL(ip_set_put);
3008 +
3009 +EXPORT_SYMBOL(ip_set_addip_kernel);
3010 +EXPORT_SYMBOL(ip_set_delip_kernel);
3011 +EXPORT_SYMBOL(ip_set_testip_kernel);
3012 +
3013 +module_init(init);
3014 +module_exit(fini);
3015 diff -Nur linux-2.6.16/net/ipv4/netfilter/ip_set_iphash.c linux-2.6.16-owrt/net/ipv4/netfilter/ip_set_iphash.c
3016 --- linux-2.6.16/net/ipv4/netfilter/ip_set_iphash.c 1970-01-01 01:00:00.000000000 +0100
3017 +++ linux-2.6.16-owrt/net/ipv4/netfilter/ip_set_iphash.c 2006-03-20 12:53:59.000000000 +0100
3018 @@ -0,0 +1,379 @@
3019 +/* Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
3020 + *
3021 + * This program is free software; you can redistribute it and/or modify
3022 + * it under the terms of the GNU General Public License version 2 as
3023 + * published by the Free Software Foundation.
3024 + */
3025 +
3026 +/* Kernel module implementing an ip hash set */
3027 +
3028 +#include <linux/module.h>
3029 +#include <linux/ip.h>
3030 +#include <linux/skbuff.h>
3031 +#include <linux/netfilter_ipv4/ip_tables.h>
3032 +#include <linux/netfilter_ipv4/ip_set.h>
3033 +#include <linux/errno.h>
3034 +#include <asm/uaccess.h>
3035 +#include <asm/bitops.h>
3036 +#include <linux/spinlock.h>
3037 +#include <linux/vmalloc.h>
3038 +#include <linux/random.h>
3039 +
3040 +#include <net/ip.h>
3041 +
3042 +#include <linux/netfilter_ipv4/ip_set_malloc.h>
3043 +#include <linux/netfilter_ipv4/ip_set_iphash.h>
3044 +#include <linux/netfilter_ipv4/ip_set_jhash.h>
3045 +#include <linux/netfilter_ipv4/ip_set_prime.h>
3046 +
3047 +static inline __u32
3048 +jhash_ip(const struct ip_set_iphash *map, ip_set_ip_t ip)
3049 +{
3050 + return jhash_1word(ip, map->initval);
3051 +}
3052 +
3053 +static inline __u32
3054 +randhash_ip(const struct ip_set_iphash *map, ip_set_ip_t ip)
3055 +{
3056 + return (1 + ip % map->prime);
3057 +}
3058 +
3059 +static inline __u32
3060 +hash_id(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3061 +{
3062 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3063 + __u32 jhash, randhash, id;
3064 + u_int16_t i;
3065 +
3066 + *hash_ip = ip & map->netmask;
3067 + jhash = jhash_ip(map, *hash_ip);
3068 + randhash = randhash_ip(map, *hash_ip);
3069 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u, %u.%u.%u.%u",
3070 + set->name, HIPQUAD(ip), HIPQUAD(*hash_ip), HIPQUAD(map->netmask));
3071 +
3072 + for (i = 0; i < map->probes; i++) {
3073 + id = (jhash + i * randhash) % map->hashsize;
3074 + DP("hash key: %u", id);
3075 + if (map->members[id] == *hash_ip)
3076 + return id;
3077 + /* No shortcut at testing - there can be deleted
3078 + * entries. */
3079 + }
3080 + return UINT_MAX;
3081 +}
3082 +
3083 +static inline int
3084 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3085 +{
3086 + return (hash_id(set, ip, hash_ip) != UINT_MAX);
3087 +}
3088 +
3089 +static int
3090 +testip(struct ip_set *set, const void *data, size_t size,
3091 + ip_set_ip_t *hash_ip)
3092 +{
3093 + struct ip_set_req_iphash *req =
3094 + (struct ip_set_req_iphash *) data;
3095 +
3096 + if (size != sizeof(struct ip_set_req_iphash)) {
3097 + ip_set_printk("data length wrong (want %zu, have %zu)",
3098 + sizeof(struct ip_set_req_iphash),
3099 + size);
3100 + return -EINVAL;
3101 + }
3102 + return __testip(set, req->ip, hash_ip);
3103 +}
3104 +
3105 +static int
3106 +testip_kernel(struct ip_set *set, const struct sk_buff *skb,
3107 + u_int32_t flags, ip_set_ip_t *hash_ip)
3108 +{
3109 + return __testip(set,
3110 + ntohl(flags & IPSET_SRC ? skb->nh.iph->saddr
3111 + : skb->nh.iph->daddr),
3112 + hash_ip);
3113 +}
3114 +
3115 +static inline int
3116 +__addip(struct ip_set_iphash *map, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3117 +{
3118 + __u32 jhash, randhash, probe;
3119 + u_int16_t i;
3120 +
3121 + *hash_ip = ip & map->netmask;
3122 + jhash = jhash_ip(map, *hash_ip);
3123 + randhash = randhash_ip(map, *hash_ip);
3124 +
3125 + for (i = 0; i < map->probes; i++) {
3126 + probe = (jhash + i * randhash) % map->hashsize;
3127 + if (map->members[probe] == *hash_ip)
3128 + return -EEXIST;
3129 + if (!map->members[probe]) {
3130 + map->members[probe] = *hash_ip;
3131 + return 0;
3132 + }
3133 + }
3134 + /* Trigger rehashing */
3135 + return -EAGAIN;
3136 +}
3137 +
3138 +static int
3139 +addip(struct ip_set *set, const void *data, size_t size,
3140 + ip_set_ip_t *hash_ip)
3141 +{
3142 + struct ip_set_req_iphash *req =
3143 + (struct ip_set_req_iphash *) data;
3144 +
3145 + if (size != sizeof(struct ip_set_req_iphash)) {
3146 + ip_set_printk("data length wrong (want %zu, have %zu)",
3147 + sizeof(struct ip_set_req_iphash),
3148 + size);
3149 + return -EINVAL;
3150 + }
3151 + return __addip((struct ip_set_iphash *) set->data, req->ip, hash_ip);
3152 +}
3153 +
3154 +static int
3155 +addip_kernel(struct ip_set *set, const struct sk_buff *skb,
3156 + u_int32_t flags, ip_set_ip_t *hash_ip)
3157 +{
3158 + return __addip((struct ip_set_iphash *) set->data,
3159 + ntohl(flags & IPSET_SRC ? skb->nh.iph->saddr
3160 + : skb->nh.iph->daddr),
3161 + hash_ip);
3162 +}
3163 +
3164 +static int retry(struct ip_set *set)
3165 +{
3166 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3167 + ip_set_ip_t hash_ip, *members;
3168 + u_int32_t i, hashsize;
3169 + unsigned newbytes;
3170 + int res;
3171 + struct ip_set_iphash tmp = {
3172 + .hashsize = map->hashsize,
3173 + .probes = map->probes,
3174 + .resize = map->resize,
3175 + .netmask = map->netmask,
3176 + };
3177 +
3178 + if (map->resize == 0)
3179 + return -ERANGE;
3180 +
3181 + again:
3182 + res = 0;
3183 +
3184 + /* Calculate new parameters */
3185 + get_random_bytes(&tmp.initval, 4);
3186 + hashsize = tmp.hashsize + (tmp.hashsize * map->resize)/100;
3187 + if (hashsize == tmp.hashsize)
3188 + hashsize++;
3189 + tmp.prime = make_prime(hashsize);
3190 +
3191 + ip_set_printk("rehashing of set %s triggered: "
3192 + "hashsize grows from %u to %u",
3193 + set->name, tmp.hashsize, hashsize);
3194 + tmp.hashsize = hashsize;
3195 +
3196 + newbytes = hashsize * sizeof(ip_set_ip_t);
3197 + tmp.members = ip_set_malloc_atomic(newbytes);
3198 + if (!tmp.members) {
3199 + DP("out of memory for %d bytes", newbytes);
3200 + return -ENOMEM;
3201 + }
3202 + memset(tmp.members, 0, newbytes);
3203 +
3204 + write_lock_bh(&set->lock);
3205 + map = (struct ip_set_iphash *) set->data; /* Play safe */
3206 + for (i = 0; i < map->hashsize && res == 0; i++) {
3207 + if (map->members[i])
3208 + res = __addip(&tmp, map->members[i], &hash_ip);
3209 + }
3210 + if (res) {
3211 + /* Failure, try again */
3212 + write_unlock_bh(&set->lock);
3213 + ip_set_free(tmp.members, newbytes);
3214 + goto again;
3215 + }
3216 +
3217 + /* Success at resizing! */
3218 + members = map->members;
3219 + hashsize = map->hashsize;
3220 +
3221 + map->initval = tmp.initval;
3222 + map->prime = tmp.prime;
3223 + map->hashsize = tmp.hashsize;
3224 + map->members = tmp.members;
3225 + write_unlock_bh(&set->lock);
3226 +
3227 + ip_set_free(members, hashsize * sizeof(ip_set_ip_t));
3228 +
3229 + return 0;
3230 +}
3231 +
3232 +static inline int
3233 +__delip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3234 +{
3235 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3236 + ip_set_ip_t id = hash_id(set, ip, hash_ip);
3237 +
3238 + if (id == UINT_MAX)
3239 + return -EEXIST;
3240 +
3241 + map->members[id] = 0;
3242 + return 0;
3243 +}
3244 +
3245 +static int
3246 +delip(struct ip_set *set, const void *data, size_t size,
3247 + ip_set_ip_t *hash_ip)
3248 +{
3249 + struct ip_set_req_iphash *req =
3250 + (struct ip_set_req_iphash *) data;
3251 +
3252 + if (size != sizeof(struct ip_set_req_iphash)) {
3253 + ip_set_printk("data length wrong (want %zu, have %zu)",
3254 + sizeof(struct ip_set_req_iphash),
3255 + size);
3256 + return -EINVAL;
3257 + }
3258 + return __delip(set, req->ip, hash_ip);
3259 +}
3260 +
3261 +static int
3262 +delip_kernel(struct ip_set *set, const struct sk_buff *skb,
3263 + u_int32_t flags, ip_set_ip_t *hash_ip)
3264 +{
3265 + return __delip(set,
3266 + ntohl(flags & IPSET_SRC ? skb->nh.iph->saddr
3267 + : skb->nh.iph->daddr),
3268 + hash_ip);
3269 +}
3270 +
3271 +static int create(struct ip_set *set, const void *data, size_t size)
3272 +{
3273 + unsigned newbytes;
3274 + struct ip_set_req_iphash_create *req =
3275 + (struct ip_set_req_iphash_create *) data;
3276 + struct ip_set_iphash *map;
3277 +
3278 + if (size != sizeof(struct ip_set_req_iphash_create)) {
3279 + ip_set_printk("data length wrong (want %zu, have %zu)",
3280 + sizeof(struct ip_set_req_iphash_create),
3281 + size);
3282 + return -EINVAL;
3283 + }
3284 +
3285 + if (req->hashsize < 1) {
3286 + ip_set_printk("hashsize too small");
3287 + return -ENOEXEC;
3288 + }
3289 +
3290 + map = kmalloc(sizeof(struct ip_set_iphash), GFP_KERNEL);
3291 + if (!map) {
3292 + DP("out of memory for %d bytes",
3293 + sizeof(struct ip_set_iphash));
3294 + return -ENOMEM;
3295 + }
3296 + get_random_bytes(&map->initval, 4);
3297 + map->prime = make_prime(req->hashsize);
3298 + map->hashsize = req->hashsize;
3299 + map->probes = req->probes;
3300 + map->resize = req->resize;
3301 + map->netmask = req->netmask;
3302 + newbytes = map->hashsize * sizeof(ip_set_ip_t);
3303 + map->members = ip_set_malloc(newbytes);
3304 + if (!map->members) {
3305 + DP("out of memory for %d bytes", newbytes);
3306 + kfree(map);
3307 + return -ENOMEM;
3308 + }
3309 + memset(map->members, 0, newbytes);
3310 +
3311 + set->data = map;
3312 + return 0;
3313 +}
3314 +
3315 +static void destroy(struct ip_set *set)
3316 +{
3317 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3318 +
3319 + ip_set_free(map->members, map->hashsize * sizeof(ip_set_ip_t));
3320 + kfree(map);
3321 +
3322 + set->data = NULL;
3323 +}
3324 +
3325 +static void flush(struct ip_set *set)
3326 +{
3327 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3328 + memset(map->members, 0, map->hashsize * sizeof(ip_set_ip_t));
3329 +}
3330 +
3331 +static void list_header(const struct ip_set *set, void *data)
3332 +{
3333 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3334 + struct ip_set_req_iphash_create *header =
3335 + (struct ip_set_req_iphash_create *) data;
3336 +
3337 + header->hashsize = map->hashsize;
3338 + header->probes = map->probes;
3339 + header->resize = map->resize;
3340 + header->netmask = map->netmask;
3341 +}
3342 +
3343 +static int list_members_size(const struct ip_set *set)
3344 +{
3345 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3346 +
3347 + return (map->hashsize * sizeof(ip_set_ip_t));
3348 +}
3349 +
3350 +static void list_members(const struct ip_set *set, void *data)
3351 +{
3352 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3353 + int bytes = map->hashsize * sizeof(ip_set_ip_t);
3354 +
3355 + memcpy(data, map->members, bytes);
3356 +}
3357 +
3358 +static struct ip_set_type ip_set_iphash = {
3359 + .typename = SETTYPE_NAME,
3360 + .typecode = IPSET_TYPE_IP,
3361 + .protocol_version = IP_SET_PROTOCOL_VERSION,
3362 + .create = &create,
3363 + .destroy = &destroy,
3364 + .flush = &flush,
3365 + .reqsize = sizeof(struct ip_set_req_iphash),
3366 + .addip = &addip,
3367 + .addip_kernel = &addip_kernel,
3368 + .retry = &retry,
3369 + .delip = &delip,
3370 + .delip_kernel = &delip_kernel,
3371 + .testip = &testip,
3372 + .testip_kernel = &testip_kernel,
3373 + .header_size = sizeof(struct ip_set_req_iphash_create),
3374 + .list_header = &list_header,
3375 + .list_members_size = &list_members_size,
3376 + .list_members = &list_members,
3377 + .me = THIS_MODULE,
3378 +};
3379 +
3380 +MODULE_LICENSE("GPL");
3381 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
3382 +MODULE_DESCRIPTION("iphash type of IP sets");
3383 +
3384 +static int __init init(void)
3385 +{
3386 + init_max_malloc_size();
3387 + return ip_set_register_set_type(&ip_set_iphash);
3388 +}
3389 +
3390 +static void __exit fini(void)
3391 +{
3392 + /* FIXME: possible race with ip_set_create() */
3393 + ip_set_unregister_set_type(&ip_set_iphash);
3394 +}
3395 +
3396 +module_init(init);
3397 +module_exit(fini);
3398 diff -Nur linux-2.6.16/net/ipv4/netfilter/ip_set_ipmap.c linux-2.6.16-owrt/net/ipv4/netfilter/ip_set_ipmap.c
3399 --- linux-2.6.16/net/ipv4/netfilter/ip_set_ipmap.c 1970-01-01 01:00:00.000000000 +0100
3400 +++ linux-2.6.16-owrt/net/ipv4/netfilter/ip_set_ipmap.c 2006-03-20 12:53:59.000000000 +0100
3401 @@ -0,0 +1,313 @@
3402 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
3403 + * Patrick Schaaf <bof@bof.de>
3404 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
3405 + *
3406 + * This program is free software; you can redistribute it and/or modify
3407 + * it under the terms of the GNU General Public License version 2 as
3408 + * published by the Free Software Foundation.
3409 + */
3410 +
3411 +/* Kernel module implementing an IP set type: the single bitmap type */
3412 +
3413 +#include <linux/module.h>
3414 +#include <linux/ip.h>
3415 +#include <linux/skbuff.h>
3416 +#include <linux/netfilter_ipv4/ip_tables.h>
3417 +#include <linux/netfilter_ipv4/ip_set.h>
3418 +#include <linux/errno.h>
3419 +#include <asm/uaccess.h>
3420 +#include <asm/bitops.h>
3421 +#include <linux/spinlock.h>
3422 +
3423 +#include <linux/netfilter_ipv4/ip_set_ipmap.h>
3424 +
3425 +static inline ip_set_ip_t
3426 +ip_to_id(const struct ip_set_ipmap *map, ip_set_ip_t ip)
3427 +{
3428 + return (ip - map->first_ip)/map->hosts;
3429 +}
3430 +
3431 +static inline int
3432 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3433 +{
3434 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3435 +
3436 + if (ip < map->first_ip || ip > map->last_ip)
3437 + return -ERANGE;
3438 +
3439 + *hash_ip = ip & map->netmask;
3440 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u",
3441 + set->name, HIPQUAD(ip), HIPQUAD(*hash_ip));
3442 + return !!test_bit(ip_to_id(map, *hash_ip), map->members);
3443 +}
3444 +
3445 +static int
3446 +testip(struct ip_set *set, const void *data, size_t size,
3447 + ip_set_ip_t *hash_ip)
3448 +{
3449 + struct ip_set_req_ipmap *req =
3450 + (struct ip_set_req_ipmap *) data;
3451 +
3452 + if (size != sizeof(struct ip_set_req_ipmap)) {
3453 + ip_set_printk("data length wrong (want %zu, have %zu)",
3454 + sizeof(struct ip_set_req_ipmap),
3455 + size);
3456 + return -EINVAL;
3457 + }
3458 + return __testip(set, req->ip, hash_ip);
3459 +}
3460 +
3461 +static int
3462 +testip_kernel(struct ip_set *set,
3463 + const struct sk_buff *skb,
3464 + u_int32_t flags,
3465 + ip_set_ip_t *hash_ip)
3466 +{
3467 + int res;
3468 +
3469 + DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
3470 + flags & IPSET_SRC ? "SRC" : "DST",
3471 + NIPQUAD(skb->nh.iph->saddr),
3472 + NIPQUAD(skb->nh.iph->daddr));
3473 +
3474 + res = __testip(set,
3475 + ntohl(flags & IPSET_SRC ? skb->nh.iph->saddr
3476 + : skb->nh.iph->daddr),
3477 + hash_ip);
3478 + return (res < 0 ? 0 : res);
3479 +}
3480 +
3481 +static inline int
3482 +__addip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3483 +{
3484 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3485 +
3486 + if (ip < map->first_ip || ip > map->last_ip)
3487 + return -ERANGE;
3488 +
3489 + *hash_ip = ip & map->netmask;
3490 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
3491 + if (test_and_set_bit(ip_to_id(map, *hash_ip), map->members))
3492 + return -EEXIST;
3493 +
3494 + return 0;
3495 +}
3496 +
3497 +static int
3498 +addip(struct ip_set *set, const void *data, size_t size,
3499 + ip_set_ip_t *hash_ip)
3500 +{
3501 + struct ip_set_req_ipmap *req =
3502 + (struct ip_set_req_ipmap *) data;
3503 +
3504 + if (size != sizeof(struct ip_set_req_ipmap)) {
3505 + ip_set_printk("data length wrong (want %zu, have %zu)",
3506 + sizeof(struct ip_set_req_ipmap),
3507 + size);
3508 + return -EINVAL;
3509 + }
3510 + DP("%u.%u.%u.%u", HIPQUAD(req->ip));
3511 + return __addip(set, req->ip, hash_ip);
3512 +}
3513 +
3514 +static int
3515 +addip_kernel(struct ip_set *set, const struct sk_buff *skb,
3516 + u_int32_t flags, ip_set_ip_t *hash_ip)
3517 +{
3518 + return __addip(set,
3519 + ntohl(flags & IPSET_SRC ? skb->nh.iph->saddr
3520 + : skb->nh.iph->daddr),
3521 + hash_ip);
3522 +}
3523 +
3524 +static inline int
3525 +__delip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3526 +{
3527 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3528 +
3529 + if (ip < map->first_ip || ip > map->last_ip)
3530 + return -ERANGE;
3531 +
3532 + *hash_ip = ip & map->netmask;
3533 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
3534 + if (!test_and_clear_bit(ip_to_id(map, *hash_ip), map->members))
3535 + return -EEXIST;
3536 +
3537 + return 0;
3538 +}
3539 +
3540 +static int
3541 +delip(struct ip_set *set, const void *data, size_t size,
3542 + ip_set_ip_t *hash_ip)
3543 +{
3544 + struct ip_set_req_ipmap *req =
3545 + (struct ip_set_req_ipmap *) data;
3546 +
3547 + if (size != sizeof(struct ip_set_req_ipmap)) {
3548 + ip_set_printk("data length wrong (want %zu, have %zu)",
3549 + sizeof(struct ip_set_req_ipmap),
3550 + size);
3551 + return -EINVAL;
3552 + }
3553 + return __delip(set, req->ip, hash_ip);
3554 +}
3555 +
3556 +static int
3557 +delip_kernel(struct ip_set *set, const struct sk_buff *skb,
3558 + u_int32_t flags, ip_set_ip_t *hash_ip)
3559 +{
3560 + return __delip(set,
3561 + ntohl(flags & IPSET_SRC ? skb->nh.iph->saddr
3562 + : skb->nh.iph->daddr),
3563 + hash_ip);
3564 +}
3565 +
3566 +static int create(struct ip_set *set, const void *data, size_t size)
3567 +{
3568 + int newbytes;
3569 + struct ip_set_req_ipmap_create *req =
3570 + (struct ip_set_req_ipmap_create *) data;
3571 + struct ip_set_ipmap *map;
3572 +
3573 + if (size != sizeof(struct ip_set_req_ipmap_create)) {
3574 + ip_set_printk("data length wrong (want %zu, have %zu)",
3575 + sizeof(struct ip_set_req_ipmap_create),
3576 + size);
3577 + return -EINVAL;
3578 + }
3579 +
3580 + DP("from %u.%u.%u.%u to %u.%u.%u.%u",
3581 + HIPQUAD(req->from), HIPQUAD(req->to));
3582 +
3583 + if (req->from > req->to) {
3584 + DP("bad ip range");
3585 + return -ENOEXEC;
3586 + }
3587 +
3588 + if (req->to - req->from > MAX_RANGE) {
3589 + ip_set_printk("range too big (max %d addresses)",
3590 + MAX_RANGE);
3591 + return -ENOEXEC;
3592 + }
3593 +
3594 + map = kmalloc(sizeof(struct ip_set_ipmap), GFP_KERNEL);
3595 + if (!map) {
3596 + DP("out of memory for %d bytes",
3597 + sizeof(struct ip_set_ipmap));
3598 + return -ENOMEM;
3599 + }
3600 + map->first_ip = req->from;
3601 + map->last_ip = req->to;
3602 + map->netmask = req->netmask;
3603 +
3604 + if (req->netmask == 0xFFFFFFFF) {
3605 + map->hosts = 1;
3606 + map->sizeid = map->last_ip - map->first_ip + 1;
3607 + } else {
3608 + unsigned int mask_bits, netmask_bits;
3609 + ip_set_ip_t mask;
3610 +
3611 + map->first_ip &= map->netmask; /* Should we better bark? */
3612 +
3613 + mask = range_to_mask(map->first_ip, map->last_ip, &mask_bits);
3614 + netmask_bits = mask_to_bits(map->netmask);
3615 +
3616 + if (!mask || netmask_bits <= mask_bits)
3617 + return -ENOEXEC;
3618 +
3619 + map->hosts = 2 << (32 - netmask_bits - 1);
3620 + map->sizeid = 2 << (netmask_bits - mask_bits - 1);
3621 + }
3622 + newbytes = bitmap_bytes(0, map->sizeid - 1);
3623 + map->members = kmalloc(newbytes, GFP_KERNEL);
3624 + if (!map->members) {
3625 + DP("out of memory for %d bytes", newbytes);
3626 + kfree(map);
3627 + return -ENOMEM;
3628 + }
3629 + memset(map->members, 0, newbytes);
3630 +
3631 + set->data = map;
3632 + return 0;
3633 +}
3634 +
3635 +static void destroy(struct ip_set *set)
3636 +{
3637 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3638 +
3639 + kfree(map->members);
3640 + kfree(map);
3641 +
3642 + set->data = NULL;
3643 +}
3644 +
3645 +static void flush(struct ip_set *set)
3646 +{
3647 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3648 + memset(map->members, 0, bitmap_bytes(0, map->sizeid - 1));
3649 +}
3650 +
3651 +static void list_header(const struct ip_set *set, void *data)
3652 +{
3653 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3654 + struct ip_set_req_ipmap_create *header =
3655 + (struct ip_set_req_ipmap_create *) data;
3656 +
3657 + header->from = map->first_ip;
3658 + header->to = map->last_ip;
3659 + header->netmask = map->netmask;
3660 +}
3661 +
3662 +static int list_members_size(const struct ip_set *set)
3663 +{
3664 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3665 +
3666 + return bitmap_bytes(0, map->sizeid - 1);
3667 +}
3668 +
3669 +static void list_members(const struct ip_set *set, void *data)
3670 +{
3671 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3672 + int bytes = bitmap_bytes(0, map->sizeid - 1);
3673 +
3674 + memcpy(data, map->members, bytes);
3675 +}
3676 +
3677 +static struct ip_set_type ip_set_ipmap = {
3678 + .typename = SETTYPE_NAME,
3679 + .typecode = IPSET_TYPE_IP,
3680 + .protocol_version = IP_SET_PROTOCOL_VERSION,
3681 + .create = &create,
3682 + .destroy = &destroy,
3683 + .flush = &flush,
3684 + .reqsize = sizeof(struct ip_set_req_ipmap),
3685 + .addip = &addip,
3686 + .addip_kernel = &addip_kernel,
3687 + .delip = &delip,
3688 + .delip_kernel = &delip_kernel,
3689 + .testip = &testip,
3690 + .testip_kernel = &testip_kernel,
3691 + .header_size = sizeof(struct ip_set_req_ipmap_create),
3692 + .list_header = &list_header,
3693 + .list_members_size = &list_members_size,
3694 + .list_members = &list_members,
3695 + .me = THIS_MODULE,
3696 +};
3697 +
3698 +MODULE_LICENSE("GPL");
3699 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
3700 +MODULE_DESCRIPTION("ipmap type of IP sets");
3701 +
3702 +static int __init init(void)
3703 +{
3704 + return ip_set_register_set_type(&ip_set_ipmap);
3705 +}
3706 +
3707 +static void __exit fini(void)
3708 +{
3709 + /* FIXME: possible race with ip_set_create() */
3710 + ip_set_unregister_set_type(&ip_set_ipmap);
3711 +}
3712 +
3713 +module_init(init);
3714 +module_exit(fini);
3715 diff -Nur linux-2.6.16/net/ipv4/netfilter/ip_set_iptree.c linux-2.6.16-owrt/net/ipv4/netfilter/ip_set_iptree.c
3716 --- linux-2.6.16/net/ipv4/netfilter/ip_set_iptree.c 1970-01-01 01:00:00.000000000 +0100
3717 +++ linux-2.6.16-owrt/net/ipv4/netfilter/ip_set_iptree.c 2006-03-20 12:53:59.000000000 +0100
3718 @@ -0,0 +1,510 @@
3719 +/* Copyright (C) 2005 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
3720 + *
3721 + * This program is free software; you can redistribute it and/or modify
3722 + * it under the terms of the GNU General Public License version 2 as
3723 + * published by the Free Software Foundation.
3724 + */
3725 +
3726 +/* Kernel module implementing an IP set type: the iptree type */
3727 +
3728 +#include <linux/module.h>
3729 +#include <linux/ip.h>
3730 +#include <linux/skbuff.h>
3731 +#include <linux/slab.h>
3732 +#include <linux/delay.h>
3733 +#include <linux/netfilter_ipv4/ip_tables.h>
3734 +#include <linux/netfilter_ipv4/ip_set.h>
3735 +#include <linux/errno.h>
3736 +#include <asm/uaccess.h>
3737 +#include <asm/bitops.h>
3738 +#include <linux/spinlock.h>
3739 +
3740 +#include <linux/netfilter_ipv4/ip_set_iptree.h>
3741 +
3742 +/* Garbage collection interval in seconds: */
3743 +#define IPTREE_GC_TIME 5*60
3744 +/* Sleep so many milliseconds before trying again
3745 + * to delete the gc timer at destroying a set */
3746 +#define IPTREE_DESTROY_SLEEP 100
3747 +
3748 +static kmem_cache_t *branch_cachep;
3749 +static kmem_cache_t *leaf_cachep;
3750 +
3751 +#define ABCD(a,b,c,d,addrp) do { \
3752 + a = ((unsigned char *)addrp)[3]; \
3753 + b = ((unsigned char *)addrp)[2]; \
3754 + c = ((unsigned char *)addrp)[1]; \
3755 + d = ((unsigned char *)addrp)[0]; \
3756 +} while (0)
3757 +
3758 +#define TESTIP_WALK(map, elem, branch) do { \
3759 + if ((map)->tree[elem]) { \
3760 + branch = (map)->tree[elem]; \
3761 + } else \
3762 + return 0; \
3763 +} while (0)
3764 +
3765 +static inline int
3766 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3767 +{
3768 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
3769 + struct ip_set_iptreeb *btree;
3770 + struct ip_set_iptreec *ctree;
3771 + struct ip_set_iptreed *dtree;
3772 + unsigned char a,b,c,d;
3773 +
3774 + *hash_ip = ip;
3775 + ABCD(a, b, c, d, hash_ip);
3776 + DP("%u %u %u %u timeout %u", a, b, c, d, map->timeout);
3777 + TESTIP_WALK(map, a, btree);
3778 + TESTIP_WALK(btree, b, ctree);
3779 + TESTIP_WALK(ctree, c, dtree);
3780 + DP("%lu %lu", dtree->expires[d], jiffies);
3781 + return !!(map->timeout ? (time_after(dtree->expires[d], jiffies))
3782 + : dtree->expires[d]);
3783 +}
3784 +
3785 +static int
3786 +testip(struct ip_set *set, const void *data, size_t size,
3787 + ip_set_ip_t *hash_ip)
3788 +{
3789 + struct ip_set_req_iptree *req =
3790 + (struct ip_set_req_iptree *) data;
3791 +
3792 + if (size != sizeof(struct ip_set_req_iptree)) {
3793 + ip_set_printk("data length wrong (want %zu, have %zu)",
3794 + sizeof(struct ip_set_req_iptree),
3795 + size);
3796 + return -EINVAL;
3797 + }
3798 + return __testip(set, req->ip, hash_ip);
3799 +}
3800 +
3801 +static int
3802 +testip_kernel(struct ip_set *set,
3803 + const struct sk_buff *skb,
3804 + u_int32_t flags,
3805 + ip_set_ip_t *hash_ip)
3806 +{
3807 + int res;
3808 +
3809 + DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
3810 + flags & IPSET_SRC ? "SRC" : "DST",
3811 + NIPQUAD(skb->nh.iph->saddr),
3812 + NIPQUAD(skb->nh.iph->daddr));
3813 +
3814 + res = __testip(set,
3815 + ntohl(flags & IPSET_SRC ? skb->nh.iph->saddr
3816 + : skb->nh.iph->daddr),
3817 + hash_ip);
3818 + return (res < 0 ? 0 : res);
3819 +}
3820 +
3821 +#define ADDIP_WALK(map, elem, branch, type, cachep) do { \
3822 + if ((map)->tree[elem]) { \
3823 + DP("found %u", elem); \
3824 + branch = (map)->tree[elem]; \
3825 + } else { \
3826 + branch = (type *) \
3827 + kmem_cache_alloc(cachep, GFP_KERNEL); \
3828 + if (branch == NULL) \
3829 + return -ENOMEM; \
3830 + memset(branch, 0, sizeof(*branch)); \
3831 + (map)->tree[elem] = branch; \
3832 + DP("alloc %u", elem); \
3833 + } \
3834 +} while (0)
3835 +
3836 +static inline int
3837 +__addip(struct ip_set *set, ip_set_ip_t ip, unsigned int timeout,
3838 + ip_set_ip_t *hash_ip)
3839 +{
3840 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
3841 + struct ip_set_iptreeb *btree;
3842 + struct ip_set_iptreec *ctree;
3843 + struct ip_set_iptreed *dtree;
3844 + unsigned char a,b,c,d;
3845 + int ret = 0;
3846 +
3847 + *hash_ip = ip;
3848 + ABCD(a, b, c, d, hash_ip);
3849 + DP("%u %u %u %u timeout %u", a, b, c, d, timeout);
3850 + ADDIP_WALK(map, a, btree, struct ip_set_iptreeb, branch_cachep);
3851 + ADDIP_WALK(btree, b, ctree, struct ip_set_iptreec, branch_cachep);
3852 + ADDIP_WALK(ctree, c, dtree, struct ip_set_iptreed, leaf_cachep);
3853 + if (dtree->expires[d]
3854 + && (!map->timeout || time_after(dtree->expires[d], jiffies)))
3855 + ret = -EEXIST;
3856 + dtree->expires[d] = map->timeout ? (timeout * HZ + jiffies) : 1;
3857 + DP("%u %lu", d, dtree->expires[d]);
3858 + return ret;
3859 +}
3860 +
3861 +static int
3862 +addip(struct ip_set *set, const void *data, size_t size,
3863 + ip_set_ip_t *hash_ip)
3864 +{
3865 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
3866 + struct ip_set_req_iptree *req =
3867 + (struct ip_set_req_iptree *) data;
3868 +
3869 + if (size != sizeof(struct ip_set_req_iptree)) {
3870 + ip_set_printk("data length wrong (want %zu, have %zu)",
3871 + sizeof(struct ip_set_req_iptree),
3872 + size);
3873 + return -EINVAL;
3874 + }
3875 + DP("%u.%u.%u.%u %u", HIPQUAD(req->ip), req->timeout);
3876 + return __addip(set, req->ip,
3877 + req->timeout ? req->timeout : map->timeout,
3878 + hash_ip);
3879 +}
3880 +
3881 +static int
3882 +addip_kernel(struct ip_set *set, const struct sk_buff *skb,
3883 + u_int32_t flags, ip_set_ip_t *hash_ip)
3884 +{
3885 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
3886 +
3887 + return __addip(set,
3888 + ntohl(flags & IPSET_SRC ? skb->nh.iph->saddr
3889 + : skb->nh.iph->daddr),
3890 + map->timeout,
3891 + hash_ip);
3892 +}
3893 +
3894 +#define DELIP_WALK(map, elem, branch) do { \
3895 + if ((map)->tree[elem]) { \
3896 + branch = (map)->tree[elem]; \
3897 + } else \
3898 + return -EEXIST; \
3899 +} while (0)
3900 +
3901 +static inline int
3902 +__delip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3903 +{
3904 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
3905 + struct ip_set_iptreeb *btree;
3906 + struct ip_set_iptreec *ctree;
3907 + struct ip_set_iptreed *dtree;
3908 + unsigned char a,b,c,d;
3909 +
3910 + *hash_ip = ip;
3911 + ABCD(a, b, c, d, hash_ip);
3912 + DELIP_WALK(map, a, btree);
3913 + DELIP_WALK(btree, b, ctree);
3914 + DELIP_WALK(ctree, c, dtree);
3915 +
3916 + if (dtree->expires[d]) {
3917 + dtree->expires[d] = 0;
3918 + return 0;
3919 + }
3920 + return -EEXIST;
3921 +}
3922 +
3923 +static int
3924 +delip(struct ip_set *set, const void *data, size_t size,
3925 + ip_set_ip_t *hash_ip)
3926 +{
3927 + struct ip_set_req_iptree *req =
3928 + (struct ip_set_req_iptree *) data;
3929 +
3930 + if (size != sizeof(struct ip_set_req_iptree)) {
3931 + ip_set_printk("data length wrong (want %zu, have %zu)",
3932 + sizeof(struct ip_set_req_iptree),
3933 + size);
3934 + return -EINVAL;
3935 + }
3936 + return __delip(set, req->ip, hash_ip);
3937 +}
3938 +
3939 +static int
3940 +delip_kernel(struct ip_set *set, const struct sk_buff *skb,
3941 + u_int32_t flags, ip_set_ip_t *hash_ip)
3942 +{
3943 + return __delip(set,
3944 + ntohl(flags & IPSET_SRC ? skb->nh.iph->saddr
3945 + : skb->nh.iph->daddr),
3946 + hash_ip);
3947 +}
3948 +
3949 +#define LOOP_WALK_BEGIN(map, i, branch) \
3950 + for (i = 0; i < 255; i++) { \
3951 + if (!(map)->tree[i]) \
3952 + continue; \
3953 + branch = (map)->tree[i]
3954 +
3955 +#define LOOP_WALK_END }
3956 +
3957 +static void ip_tree_gc(unsigned long ul_set)
3958 +{
3959 + struct ip_set *set = (void *) ul_set;
3960 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
3961 + struct ip_set_iptreeb *btree;
3962 + struct ip_set_iptreec *ctree;
3963 + struct ip_set_iptreed *dtree;
3964 + unsigned char a,b,c,d;
3965 + unsigned char i,j,k;
3966 +
3967 + i = j = k = 0;
3968 + DP("gc: %s", set->name);
3969 + write_lock_bh(&set->lock);
3970 + LOOP_WALK_BEGIN(map, a, btree);
3971 + LOOP_WALK_BEGIN(btree, b, ctree);
3972 + LOOP_WALK_BEGIN(ctree, c, dtree);
3973 + for (d = 0; d < 255; d++) {
3974 + if (dtree->expires[d]) {
3975 + DP("gc: %u %u %u %u: expires %lu jiffies %lu",
3976 + a, b, c, d,
3977 + dtree->expires[d], jiffies);
3978 + if (map->timeout
3979 + && time_before(dtree->expires[d], jiffies))
3980 + dtree->expires[d] = 0;
3981 + else
3982 + k = 1;
3983 + }
3984 + }
3985 + if (k == 0) {
3986 + DP("gc: %s: leaf %u %u %u empty",
3987 + set->name, a, b, c);
3988 + kmem_cache_free(leaf_cachep, dtree);
3989 + ctree->tree[c] = NULL;
3990 + } else {
3991 + DP("gc: %s: leaf %u %u %u not empty",
3992 + set->name, a, b, c);
3993 + j = 1;
3994 + k = 0;
3995 + }
3996 + LOOP_WALK_END;
3997 + if (j == 0) {
3998 + DP("gc: %s: branch %u %u empty",
3999 + set->name, a, b);
4000 + kmem_cache_free(branch_cachep, ctree);
4001 + btree->tree[b] = NULL;
4002 + } else {
4003 + DP("gc: %s: branch %u %u not empty",
4004 + set->name, a, b);
4005 + i = 1;
4006 + j = k = 0;
4007 + }
4008 + LOOP_WALK_END;
4009 + if (i == 0) {
4010 + DP("gc: %s: branch %u empty",
4011 + set->name, a);
4012 + kmem_cache_free(branch_cachep, btree);
4013 + map->tree[a] = NULL;
4014 + } else {
4015 + DP("gc: %s: branch %u not empty",
4016 + set->name, a);
4017 + i = j = k = 0;
4018 + }
4019 + LOOP_WALK_END;
4020 + write_unlock_bh(&set->lock);
4021 +
4022 + map->gc.expires = jiffies + map->gc_interval * HZ;
4023 + add_timer(&map->gc);
4024 +}
4025 +
4026 +static int create(struct ip_set *set, const void *data, size_t size)
4027 +{
4028 + struct ip_set_req_iptree_create *req =
4029 + (struct ip_set_req_iptree_create *) data;
4030 + struct ip_set_iptree *map;
4031 +
4032 + if (size != sizeof(struct ip_set_req_iptree_create)) {
4033 + ip_set_printk("data length wrong (want %zu, have %zu)",
4034 + sizeof(struct ip_set_req_iptree_create),
4035 + size);
4036 + return -EINVAL;
4037 + }
4038 +
4039 + map = kmalloc(sizeof(struct ip_set_iptree), GFP_KERNEL);
4040 + if (!map) {
4041 + DP("out of memory for %d bytes",
4042 + sizeof(struct ip_set_iptree));
4043 + return -ENOMEM;
4044 + }
4045 + memset(map, 0, sizeof(*map));
4046 + map->timeout = req->timeout;
4047 + set->data = map;
4048 +
4049 + /* If there is no timeout for the entries,
4050 + * we still have to call gc because delete
4051 + * do not clean up empty branches */
4052 + map->gc_interval = IPTREE_GC_TIME;
4053 + init_timer(&map->gc);
4054 + map->gc.data = (unsigned long) set;
4055 + map->gc.function = ip_tree_gc;
4056 + map->gc.expires = jiffies + map->gc_interval * HZ;
4057 + add_timer(&map->gc);
4058 +
4059 + return 0;
4060 +}
4061 +
4062 +static void __flush(struct ip_set_iptree *map)
4063 +{
4064 + struct ip_set_iptreeb *btree;
4065 + struct ip_set_iptreec *ctree;
4066 + struct ip_set_iptreed *dtree;
4067 + unsigned int a,b,c;
4068 +
4069 + LOOP_WALK_BEGIN(map, a, btree);
4070 + LOOP_WALK_BEGIN(btree, b, ctree);
4071 + LOOP_WALK_BEGIN(ctree, c, dtree);
4072 + kmem_cache_free(leaf_cachep, dtree);
4073 + LOOP_WALK_END;
4074 + kmem_cache_free(branch_cachep, ctree);
4075 + LOOP_WALK_END;
4076 + kmem_cache_free(branch_cachep, btree);
4077 + LOOP_WALK_END;
4078 +}
4079 +
4080 +static void destroy(struct ip_set *set)
4081 +{
4082 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4083 +
4084 + while (!del_timer(&map->gc))
4085 + msleep(IPTREE_DESTROY_SLEEP);
4086 + __flush(map);
4087 + kfree(map);
4088 + set->data = NULL;
4089 +}
4090 +
4091 +static void flush(struct ip_set *set)
4092 +{
4093 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4094 + unsigned int timeout = map->timeout;
4095 +
4096 + __flush(map);
4097 + memset(map, 0, sizeof(*map));
4098 + map->timeout = timeout;
4099 +}
4100 +
4101 +static void list_header(const struct ip_set *set, void *data)
4102 +{
4103 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4104 + struct ip_set_req_iptree_create *header =
4105 + (struct ip_set_req_iptree_create *) data;
4106 +
4107 + header->timeout = map->timeout;
4108 +}
4109 +
4110 +static int list_members_size(const struct ip_set *set)
4111 +{
4112 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4113 + struct ip_set_iptreeb *btree;
4114 + struct ip_set_iptreec *ctree;
4115 + struct ip_set_iptreed *dtree;
4116 + unsigned char a,b,c,d;
4117 + unsigned int count = 0;
4118 +
4119 + LOOP_WALK_BEGIN(map, a, btree);
4120 + LOOP_WALK_BEGIN(btree, b, ctree);
4121 + LOOP_WALK_BEGIN(ctree, c, dtree);
4122 + for (d = 0; d < 255; d++) {
4123 + if (dtree->expires[d]
4124 + && (!map->timeout || time_after(dtree->expires[d], jiffies)))
4125 + count++;
4126 + }
4127 + LOOP_WALK_END;
4128 + LOOP_WALK_END;
4129 + LOOP_WALK_END;
4130 +
4131 + DP("members %u", count);
4132 + return (count * sizeof(struct ip_set_req_iptree));
4133 +}
4134 +
4135 +static void list_members(const struct ip_set *set, void *data)
4136 +{
4137 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4138 + struct ip_set_iptreeb *btree;
4139 + struct ip_set_iptreec *ctree;
4140 + struct ip_set_iptreed *dtree;
4141 + unsigned char a,b,c,d;
4142 + size_t offset = 0;
4143 + struct ip_set_req_iptree *entry;
4144 +
4145 + LOOP_WALK_BEGIN(map, a, btree);
4146 + LOOP_WALK_BEGIN(btree, b, ctree);
4147 + LOOP_WALK_BEGIN(ctree, c, dtree);
4148 + for (d = 0; d < 255; d++) {
4149 + if (dtree->expires[d]
4150 + && (!map->timeout || time_after(dtree->expires[d], jiffies))) {
4151 + entry = (struct ip_set_req_iptree *)(data + offset);
4152 + entry->ip = ((a << 24) | (b << 16) | (c << 8) | d);
4153 + entry->timeout = !map->timeout ? 0
4154 + : (dtree->expires[d] - jiffies)/HZ;
4155 + offset += sizeof(struct ip_set_req_iptree);
4156 + }
4157 + }
4158 + LOOP_WALK_END;
4159 + LOOP_WALK_END;
4160 + LOOP_WALK_END;
4161 +}
4162 +
4163 +static struct ip_set_type ip_set_iptree = {
4164 + .typename = SETTYPE_NAME,
4165 + .typecode = IPSET_TYPE_IP,
4166 + .protocol_version = IP_SET_PROTOCOL_VERSION,
4167 + .create = &create,
4168 + .destroy = &destroy,
4169 + .flush = &flush,
4170 + .reqsize = sizeof(struct ip_set_req_iptree),
4171 + .addip = &addip,
4172 + .addip_kernel = &addip_kernel,
4173 + .delip = &delip,
4174 + .delip_kernel = &delip_kernel,
4175 + .testip = &testip,
4176 + .testip_kernel = &testip_kernel,
4177 + .header_size = sizeof(struct ip_set_req_iptree_create),
4178 + .list_header = &list_header,
4179 + .list_members_size = &list_members_size,
4180 + .list_members = &list_members,
4181 + .me = THIS_MODULE,
4182 +};
4183 +
4184 +MODULE_LICENSE("GPL");
4185 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
4186 +MODULE_DESCRIPTION("iptree type of IP sets");
4187 +
4188 +static int __init init(void)
4189 +{
4190 + int ret;
4191 +
4192 + branch_cachep = kmem_cache_create("ip_set_iptreeb",
4193 + sizeof(struct ip_set_iptreeb),
4194 + 0, 0, NULL, NULL);
4195 + if (!branch_cachep) {
4196 + printk(KERN_ERR "Unable to create ip_set_iptreeb slab cache\n");
4197 + ret = -ENOMEM;
4198 + goto out;
4199 + }
4200 + leaf_cachep = kmem_cache_create("ip_set_iptreed",
4201 + sizeof(struct ip_set_iptreed),
4202 + 0, 0, NULL, NULL);
4203 + if (!leaf_cachep) {
4204 + printk(KERN_ERR "Unable to create ip_set_iptreed slab cache\n");
4205 + ret = -ENOMEM;
4206 + goto free_branch;
4207 + }
4208 + ret = ip_set_register_set_type(&ip_set_iptree);
4209 + if (ret == 0)
4210 + goto out;
4211 +
4212 + kmem_cache_destroy(leaf_cachep);
4213 + free_branch:
4214 + kmem_cache_destroy(branch_cachep);
4215 + out:
4216 + return ret;
4217 +}
4218 +
4219 +static void __exit fini(void)
4220 +{
4221 + /* FIXME: possible race with ip_set_create() */
4222 + ip_set_unregister_set_type(&ip_set_iptree);
4223 + kmem_cache_destroy(leaf_cachep);
4224 + kmem_cache_destroy(branch_cachep);
4225 +}
4226 +
4227 +module_init(init);
4228 +module_exit(fini);
4229 diff -Nur linux-2.6.16/net/ipv4/netfilter/ip_set_macipmap.c linux-2.6.16-owrt/net/ipv4/netfilter/ip_set_macipmap.c
4230 --- linux-2.6.16/net/ipv4/netfilter/ip_set_macipmap.c 1970-01-01 01:00:00.000000000 +0100
4231 +++ linux-2.6.16-owrt/net/ipv4/netfilter/ip_set_macipmap.c 2006-03-20 12:53:59.000000000 +0100
4232 @@ -0,0 +1,338 @@
4233 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
4234 + * Patrick Schaaf <bof@bof.de>
4235 + * Martin Josefsson <gandalf@wlug.westbo.se>
4236 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
4237 + *
4238 + * This program is free software; you can redistribute it and/or modify
4239 + * it under the terms of the GNU General Public License version 2 as
4240 + * published by the Free Software Foundation.
4241 + */
4242 +
4243 +/* Kernel module implementing an IP set type: the macipmap type */
4244 +
4245 +#include <linux/module.h>
4246 +#include <linux/ip.h>
4247 +#include <linux/skbuff.h>
4248 +#include <linux/netfilter_ipv4/ip_tables.h>
4249 +#include <linux/netfilter_ipv4/ip_set.h>
4250 +#include <linux/errno.h>
4251 +#include <asm/uaccess.h>
4252 +#include <asm/bitops.h>
4253 +#include <linux/spinlock.h>
4254 +#include <linux/if_ether.h>
4255 +#include <linux/vmalloc.h>
4256 +
4257 +#include <linux/netfilter_ipv4/ip_set_malloc.h>
4258 +#include <linux/netfilter_ipv4/ip_set_macipmap.h>
4259 +
4260 +static int
4261 +testip(struct ip_set *set, const void *data, size_t size, ip_set_ip_t *hash_ip)
4262 +{
4263 + struct ip_set_macipmap *map = (struct ip_set_macipmap *) set->data;
4264 + struct ip_set_macip *table = (struct ip_set_macip *) map->members;
4265 + struct ip_set_req_macipmap *req = (struct ip_set_req_macipmap *) data;
4266 +
4267 + if (size != sizeof(struct ip_set_req_macipmap)) {
4268 + ip_set_printk("data length wrong (want %zu, have %zu)",
4269 + sizeof(struct ip_set_req_macipmap),
4270 + size);
4271 + return -EINVAL;
4272 + }
4273 +
4274 + if (req->ip < map->first_ip || req->ip > map->last_ip)
4275 + return -ERANGE;
4276 +
4277 + *hash_ip = req->ip;
4278 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u",
4279 + set->name, HIPQUAD(req->ip), HIPQUAD(*hash_ip));
4280 + if (test_bit(IPSET_MACIP_ISSET,
4281 + (void *) &table[req->ip - map->first_ip].flags)) {
4282 + return (memcmp(req->ethernet,
4283 + &table[req->ip - map->first_ip].ethernet,
4284 + ETH_ALEN) == 0);
4285 + } else {
4286 + return (map->flags & IPSET_MACIP_MATCHUNSET ? 1 : 0);
4287 + }
4288 +}
4289 +
4290 +static int
4291 +testip_kernel(struct ip_set *set, const struct sk_buff *skb,
4292 + u_int32_t flags, ip_set_ip_t *hash_ip)
4293 +{
4294 + struct ip_set_macipmap *map =
4295 + (struct ip_set_macipmap *) set->data;
4296 + struct ip_set_macip *table =
4297 + (struct ip_set_macip *) map->members;
4298 + ip_set_ip_t ip;
4299 +
4300 + ip = ntohl(flags & IPSET_SRC ? skb->nh.iph->saddr
4301 + : skb->nh.iph->daddr);
4302 + DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
4303 + flags & IPSET_SRC ? "SRC" : "DST",
4304 + NIPQUAD(skb->nh.iph->saddr),
4305 + NIPQUAD(skb->nh.iph->daddr));
4306 +
4307 + if (ip < map->first_ip || ip > map->last_ip)
4308 + return 0;
4309 +
4310 + *hash_ip = ip;
4311 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u",
4312 + set->name, HIPQUAD(ip), HIPQUAD(*hash_ip));
4313 + if (test_bit(IPSET_MACIP_ISSET,
4314 + (void *) &table[ip - map->first_ip].flags)) {
4315 + /* Is mac pointer valid?
4316 + * If so, compare... */
4317 + return (skb->mac.raw >= skb->head
4318 + && (skb->mac.raw + ETH_HLEN) <= skb->data
4319 + && (memcmp(eth_hdr(skb)->h_source,
4320 + &table[ip - map->first_ip].ethernet,
4321 + ETH_ALEN) == 0));
4322 + } else {
4323 + return (map->flags & IPSET_MACIP_MATCHUNSET ? 1 : 0);
4324 + }
4325 +}
4326 +
4327 +/* returns 0 on success */
4328 +static inline int
4329 +__addip(struct ip_set *set,
4330 + ip_set_ip_t ip, unsigned char *ethernet, ip_set_ip_t *hash_ip)
4331 +{
4332 + struct ip_set_macipmap *map =
4333 + (struct ip_set_macipmap *) set->data;
4334 + struct ip_set_macip *table =
4335 + (struct ip_set_macip *) map->members;
4336 +
4337 + if (ip < map->first_ip || ip > map->last_ip)
4338 + return -ERANGE;
4339 + if (test_and_set_bit(IPSET_MACIP_ISSET,
4340 + (void *) &table[ip - map->first_ip].flags))
4341 + return -EEXIST;
4342 +
4343 + *hash_ip = ip;
4344 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
4345 + memcpy(&table[ip - map->first_ip].ethernet, ethernet, ETH_ALEN);
4346 + return 0;
4347 +}
4348 +
4349 +static int
4350 +addip(struct ip_set *set, const void *data, size_t size,
4351 + ip_set_ip_t *hash_ip)
4352 +{
4353 + struct ip_set_req_macipmap *req =
4354 + (struct ip_set_req_macipmap *) data;
4355 +
4356 + if (size != sizeof(struct ip_set_req_macipmap)) {
4357 + ip_set_printk("data length wrong (want %zu, have %zu)",
4358 + sizeof(struct ip_set_req_macipmap),
4359 + size);
4360 + return -EINVAL;
4361 + }
4362 + return __addip(set, req->ip, req->ethernet, hash_ip);
4363 +}
4364 +
4365 +static int
4366 +addip_kernel(struct ip_set *set, const struct sk_buff *skb,
4367 + u_int32_t flags, ip_set_ip_t *hash_ip)
4368 +{
4369 + ip_set_ip_t ip;
4370 +
4371 + ip = ntohl(flags & IPSET_SRC ? skb->nh.iph->saddr
4372 + : skb->nh.iph->daddr);
4373 +
4374 + if (!(skb->mac.raw >= skb->head
4375 + && (skb->mac.raw + ETH_HLEN) <= skb->data))
4376 + return -EINVAL;
4377 +
4378 + return __addip(set, ip, eth_hdr(skb)->h_source, hash_ip);
4379 +}
4380 +
4381 +static inline int
4382 +__delip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
4383 +{
4384 + struct ip_set_macipmap *map =
4385 + (struct ip_set_macipmap *) set->data;
4386 + struct ip_set_macip *table =
4387 + (struct ip_set_macip *) map->members;
4388 +
4389 + if (ip < map->first_ip || ip > map->last_ip)
4390 + return -ERANGE;
4391 + if (!test_and_clear_bit(IPSET_MACIP_ISSET,
4392 + (void *)&table[ip - map->first_ip].flags))
4393 + return -EEXIST;
4394 +
4395 + *hash_ip = ip;
4396 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
4397 + return 0;
4398 +}
4399 +
4400 +static int
4401 +delip(struct ip_set *set, const void *data, size_t size,
4402 + ip_set_ip_t *hash_ip)
4403 +{
4404 + struct ip_set_req_macipmap *req =
4405 + (struct ip_set_req_macipmap *) data;
4406 +
4407 + if (size != sizeof(struct ip_set_req_macipmap)) {
4408 + ip_set_printk("data length wrong (want %zu, have %zu)",
4409 + sizeof(struct ip_set_req_macipmap),
4410 + size);
4411 + return -EINVAL;
4412 + }
4413 + return __delip(set, req->ip, hash_ip);
4414 +}
4415 +
4416 +static int
4417 +delip_kernel(struct ip_set *set, const struct sk_buff *skb,
4418 + u_int32_t flags, ip_set_ip_t *hash_ip)
4419 +{
4420 + return __delip(set,
4421 + ntohl(flags & IPSET_SRC ? skb->nh.iph->saddr
4422 + : skb->nh.iph->daddr),
4423 + hash_ip);
4424 +}
4425 +
4426 +static inline size_t members_size(ip_set_id_t from, ip_set_id_t to)
4427 +{
4428 + return (size_t)((to - from + 1) * sizeof(struct ip_set_macip));
4429 +}
4430 +
4431 +static int create(struct ip_set *set, const void *data, size_t size)
4432 +{
4433 + int newbytes;
4434 + struct ip_set_req_macipmap_create *req =
4435 + (struct ip_set_req_macipmap_create *) data;
4436 + struct ip_set_macipmap *map;
4437 +
4438 + if (size != sizeof(struct ip_set_req_macipmap_create)) {
4439 + ip_set_printk("data length wrong (want %zu, have %zu)",
4440 + sizeof(struct ip_set_req_macipmap_create),
4441 + size);
4442 + return -EINVAL;
4443 + }
4444 +
4445 + DP("from %u.%u.%u.%u to %u.%u.%u.%u",
4446 + HIPQUAD(req->from), HIPQUAD(req->to));
4447 +
4448 + if (req->from > req->to) {
4449 + DP("bad ip range");
4450 + return -ENOEXEC;
4451 + }
4452 +
4453 + if (req->to - req->from > MAX_RANGE) {
4454 + ip_set_printk("range too big (max %d addresses)",
4455 + MAX_RANGE);
4456 + return -ENOEXEC;
4457 + }
4458 +
4459 + map = kmalloc(sizeof(struct ip_set_macipmap), GFP_KERNEL);
4460 + if (!map) {
4461 + DP("out of memory for %d bytes",
4462 + sizeof(struct ip_set_macipmap));
4463 + return -ENOMEM;
4464 + }
4465 + map->flags = req->flags;
4466 + map->first_ip = req->from;
4467 + map->last_ip = req->to;
4468 + newbytes = members_size(map->first_ip, map->last_ip);
4469 + map->members = ip_set_malloc(newbytes);
4470 + if (!map->members) {
4471 + DP("out of memory for %d bytes", newbytes);
4472 + kfree(map);
4473 + return -ENOMEM;
4474 + }
4475 + memset(map->members, 0, newbytes);
4476 +
4477 + set->data = map;
4478 + return 0;
4479 +}
4480 +
4481 +static void destroy(struct ip_set *set)
4482 +{
4483 + struct ip_set_macipmap *map =
4484 + (struct ip_set_macipmap *) set->data;
4485 +
4486 + ip_set_free(map->members, members_size(map->first_ip, map->last_ip));
4487 + kfree(map);
4488 +
4489 + set->data = NULL;
4490 +}
4491 +
4492 +static void flush(struct ip_set *set)
4493 +{
4494 + struct ip_set_macipmap *map =
4495 + (struct ip_set_macipmap *) set->data;
4496 + memset(map->members, 0, members_size(map->first_ip, map->last_ip));
4497 +}
4498 +
4499 +static void list_header(const struct ip_set *set, void *data)
4500 +{
4501 + struct ip_set_macipmap *map =
4502 + (struct ip_set_macipmap *) set->data;
4503 + struct ip_set_req_macipmap_create *header =
4504 + (struct ip_set_req_macipmap_create *) data;
4505 +
4506 + DP("list_header %x %x %u", map->first_ip, map->last_ip,
4507 + map->flags);
4508 +
4509 + header->from = map->first_ip;
4510 + header->to = map->last_ip;
4511 + header->flags = map->flags;
4512 +}
4513 +
4514 +static int list_members_size(const struct ip_set *set)
4515 +{
4516 + struct ip_set_macipmap *map =
4517 + (struct ip_set_macipmap *) set->data;
4518 +
4519 + return members_size(map->first_ip, map->last_ip);
4520 +}
4521 +
4522 +static void list_members(const struct ip_set *set, void *data)
4523 +{
4524 + struct ip_set_macipmap *map =
4525 + (struct ip_set_macipmap *) set->data;
4526 +
4527 + int bytes = members_size(map->first_ip, map->last_ip);
4528 +
4529 + memcpy(data, map->members, bytes);
4530 +}
4531 +
4532 +static struct ip_set_type ip_set_macipmap = {
4533 + .typename = SETTYPE_NAME,
4534 + .typecode = IPSET_TYPE_IP,
4535 + .protocol_version = IP_SET_PROTOCOL_VERSION,
4536 + .create = &create,
4537 + .destroy = &destroy,
4538 + .flush = &flush,
4539 + .reqsize = sizeof(struct ip_set_req_macipmap),
4540 + .addip = &addip,
4541 + .addip_kernel = &addip_kernel,
4542 + .delip = &delip,
4543 + .delip_kernel = &delip_kernel,
4544 + .testip = &testip,
4545 + .testip_kernel = &testip_kernel,
4546 + .header_size = sizeof(struct ip_set_req_macipmap_create),
4547 + .list_header = &list_header,
4548 + .list_members_size = &list_members_size,
4549 + .list_members = &list_members,
4550 + .me = THIS_MODULE,
4551 +};
4552 +
4553 +MODULE_LICENSE("GPL");
4554 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
4555 +MODULE_DESCRIPTION("macipmap type of IP sets");
4556 +
4557 +static int __init init(void)
4558 +{
4559 + init_max_malloc_size();
4560 + return ip_set_register_set_type(&ip_set_macipmap);
4561 +}
4562 +
4563 +static void __exit fini(void)
4564 +{
4565 + /* FIXME: possible race with ip_set_create() */
4566 + ip_set_unregister_set_type(&ip_set_macipmap);
4567 +}
4568 +
4569 +module_init(init);
4570 +module_exit(fini);
4571 diff -Nur linux-2.6.16/net/ipv4/netfilter/ip_set_nethash.c linux-2.6.16-owrt/net/ipv4/netfilter/ip_set_nethash.c
4572 --- linux-2.6.16/net/ipv4/netfilter/ip_set_nethash.c 1970-01-01 01:00:00.000000000 +0100
4573 +++ linux-2.6.16-owrt/net/ipv4/netfilter/ip_set_nethash.c 2006-03-20 12:53:59.000000000 +0100
4574 @@ -0,0 +1,449 @@
4575 +/* Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
4576 + *
4577 + * This program is free software; you can redistribute it and/or modify
4578 + * it under the terms of the GNU General Public License version 2 as
4579 + * published by the Free Software Foundation.
4580 + */
4581 +
4582 +/* Kernel module implementing a cidr nethash set */
4583 +
4584 +#include <linux/module.h>
4585 +#include <linux/ip.h>
4586 +#include <linux/skbuff.h>
4587 +#include <linux/netfilter_ipv4/ip_tables.h>
4588 +#include <linux/netfilter_ipv4/ip_set.h>
4589 +#include <linux/errno.h>
4590 +#include <asm/uaccess.h>
4591 +#include <asm/bitops.h>
4592 +#include <linux/spinlock.h>
4593 +#include <linux/vmalloc.h>
4594 +#include <linux/random.h>
4595 +
4596 +#include <net/ip.h>
4597 +
4598 +#include <linux/netfilter_ipv4/ip_set_malloc.h>
4599 +#include <linux/netfilter_ipv4/ip_set_nethash.h>
4600 +#include <linux/netfilter_ipv4/ip_set_jhash.h>
4601 +#include <linux/netfilter_ipv4/ip_set_prime.h>
4602 +
4603 +static inline __u32
4604 +jhash_ip(const struct ip_set_nethash *map, ip_set_ip_t ip)
4605 +{
4606 + return jhash_1word(ip, map->initval);
4607 +}
4608 +
4609 +static inline __u32
4610 +randhash_ip(const struct ip_set_nethash *map, ip_set_ip_t ip)
4611 +{
4612 + return (1 + ip % map->prime);
4613 +}
4614 +
4615 +static inline __u32
4616 +hash_id_cidr(struct ip_set_nethash *map,
4617 + ip_set_ip_t ip,
4618 + unsigned char cidr,
4619 + ip_set_ip_t *hash_ip)
4620 +{
4621 + __u32 jhash, randhash, id;
4622 + u_int16_t i;
4623 +
4624 + *hash_ip = pack(ip, cidr);
4625 + jhash = jhash_ip(map, *hash_ip);
4626 + randhash = randhash_ip(map, *hash_ip);
4627 +
4628 + for (i = 0; i < map->probes; i++) {
4629 + id = (jhash + i * randhash) % map->hashsize;
4630 + DP("hash key: %u", id);
4631 + if (map->members[id] == *hash_ip)
4632 + return id;
4633 + }
4634 + return UINT_MAX;
4635 +}
4636 +
4637 +static inline __u32
4638 +hash_id(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
4639 +{
4640 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
4641 + __u32 id = UINT_MAX;
4642 + int i;
4643 +
4644 + for (i = 0; i < 30 && map->cidr[i]; i++) {
4645 + id = hash_id_cidr(map, ip, map->cidr[i], hash_ip);
4646 + if (id != UINT_MAX)
4647 + break;
4648 + }
4649 + return id;
4650 +}
4651 +
4652 +static inline int
4653 +__testip_cidr(struct ip_set *set, ip_set_ip_t ip, unsigned char cidr,
4654 + ip_set_ip_t *hash_ip)
4655 +{
4656 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
4657 +
4658 + return (hash_id_cidr(map, ip, cidr, hash_ip) != UINT_MAX);
4659 +}
4660 +
4661 +static inline int
4662 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
4663 +{
4664 + return (hash_id(set, ip, hash_ip) != UINT_MAX);
4665 +}
4666 +
4667 +static int
4668 +testip(struct ip_set *set, const void *data, size_t size,
4669 + ip_set_ip_t *hash_ip)
4670 +{
4671 + struct ip_set_req_nethash *req =
4672 + (struct ip_set_req_nethash *) data;
4673 +
4674 + if (size != sizeof(struct ip_set_req_nethash)) {
4675 + ip_set_printk("data length wrong (want %zu, have %zu)",
4676 + sizeof(struct ip_set_req_nethash),
4677 + size);
4678 + return -EINVAL;
4679 + }
4680 + return (req->cidr == 32 ? __testip(set, req->ip, hash_ip)
4681 + : __testip_cidr(set, req->ip, req->cidr, hash_ip));
4682 +}
4683 +
4684 +static int
4685 +testip_kernel(struct ip_set *set, const struct sk_buff *skb,
4686 + u_int32_t flags, ip_set_ip_t *hash_ip)
4687 +{
4688 + return __testip(set,
4689 + ntohl(flags & IPSET_SRC ? skb->nh.iph->saddr
4690 + : skb->nh.iph->daddr),
4691 + hash_ip);
4692 +}
4693 +
4694 +static inline int
4695 +__addip_base(struct ip_set_nethash *map, ip_set_ip_t ip)
4696 +{
4697 + __u32 jhash, randhash, probe;
4698 + u_int16_t i;
4699 +
4700 + jhash = jhash_ip(map, ip);
4701 + randhash = randhash_ip(map, ip);
4702 +
4703 + for (i = 0; i < map->probes; i++) {
4704 + probe = (jhash + i * randhash) % map->hashsize;
4705 + if (map->members[probe] == ip)
4706 + return -EEXIST;
4707 + if (!map->members[probe]) {
4708 + map->members[probe] = ip;
4709 + return 0;
4710 + }
4711 + }
4712 + /* Trigger rehashing */
4713 + return -EAGAIN;
4714 +}
4715 +
4716 +static inline int
4717 +__addip(struct ip_set_nethash *map, ip_set_ip_t ip, unsigned char cidr,
4718 + ip_set_ip_t *hash_ip)
4719 +{
4720 + *hash_ip = pack(ip, cidr);
4721 + DP("%u.%u.%u.%u/%u, %u.%u.%u.%u", HIPQUAD(ip), cidr, HIPQUAD(*hash_ip));
4722 +
4723 + return __addip_base(map, *hash_ip);
4724 +}
4725 +
4726 +static void
4727 +update_cidr_sizes(struct ip_set_nethash *map, unsigned char cidr)
4728 +{
4729 + unsigned char next;
4730 + int i;
4731 +
4732 + for (i = 0; i < 30 && map->cidr[i]; i++) {
4733 + if (map->cidr[i] == cidr) {
4734 + return;
4735 + } else if (map->cidr[i] < cidr) {
4736 + next = map->cidr[i];
4737 + map->cidr[i] = cidr;
4738 + cidr = next;
4739 + }
4740 + }
4741 + if (i < 30)
4742 + map->cidr[i] = cidr;
4743 +}
4744 +
4745 +static int
4746 +addip(struct ip_set *set, const void *data, size_t size,
4747 + ip_set_ip_t *hash_ip)
4748 +{
4749 + struct ip_set_req_nethash *req =
4750 + (struct ip_set_req_nethash *) data;
4751 + int ret;
4752 +
4753 + if (size != sizeof(struct ip_set_req_nethash)) {
4754 + ip_set_printk("data length wrong (want %zu, have %zu)",
4755 + sizeof(struct ip_set_req_nethash),
4756 + size);
4757 + return -EINVAL;
4758 + }
4759 + ret = __addip((struct ip_set_nethash *) set->data,
4760 + req->ip, req->cidr, hash_ip);
4761 +
4762 + if (ret == 0)
4763 + update_cidr_sizes((struct ip_set_nethash *) set->data,
4764 + req->cidr);
4765 +
4766 + return ret;
4767 +}
4768 +
4769 +static int
4770 +addip_kernel(struct ip_set *set, const struct sk_buff *skb,
4771 + u_int32_t flags, ip_set_ip_t *hash_ip)
4772 +{
4773 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
4774 + int ret = -ERANGE;
4775 + ip_set_ip_t ip = ntohl(flags & IPSET_SRC ? skb->nh.iph->saddr
4776 + : skb->nh.iph->daddr);
4777 +
4778 + if (map->cidr[0])
4779 + ret = __addip(map, ip, map->cidr[0], hash_ip);
4780 +
4781 + return ret;
4782 +}
4783 +
4784 +static int retry(struct ip_set *set)
4785 +{
4786 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
4787 + ip_set_ip_t *members;
4788 + u_int32_t i, hashsize;
4789 + unsigned newbytes;
4790 + int res;
4791 + struct ip_set_nethash tmp = {
4792 + .hashsize = map->hashsize,
4793 + .probes = map->probes,
4794 + .resize = map->resize
4795 + };
4796 +
4797 + if (map->resize == 0)
4798 + return -ERANGE;
4799 +
4800 + memcpy(tmp.cidr, map->cidr, 30 * sizeof(unsigned char));
4801 + again:
4802 + res = 0;
4803 +
4804 + /* Calculate new parameters */
4805 + get_random_bytes(&tmp.initval, 4);
4806 + hashsize = tmp.hashsize + (tmp.hashsize * map->resize)/100;
4807 + if (hashsize == tmp.hashsize)
4808 + hashsize++;
4809 + tmp.prime = make_prime(hashsize);
4810 +
4811 + ip_set_printk("rehashing of set %s triggered: "
4812 + "hashsize grows from %u to %u",
4813 + set->name, tmp.hashsize, hashsize);
4814 + tmp.hashsize = hashsize;
4815 +
4816 + newbytes = hashsize * sizeof(ip_set_ip_t);
4817 + tmp.members = ip_set_malloc_atomic(newbytes);
4818 + if (!tmp.members) {
4819 + DP("out of memory for %d bytes", newbytes);
4820 + return -ENOMEM;
4821 + }
4822 + memset(tmp.members, 0, newbytes);
4823 +
4824 + write_lock_bh(&set->lock);
4825 + map = (struct ip_set_nethash *) set->data; /* Play safe */
4826 + for (i = 0; i < map->hashsize && res == 0; i++) {
4827 + if (map->members[i])
4828 + res = __addip_base(&tmp, map->members[i]);
4829 + }
4830 + if (res) {
4831 + /* Failure, try again */
4832 + write_unlock_bh(&set->lock);
4833 + ip_set_free(tmp.members, newbytes);
4834 + goto again;
4835 + }
4836 +
4837 + /* Success at resizing! */
4838 + members = map->members;
4839 + hashsize = map->hashsize;
4840 +
4841 + map->initval = tmp.initval;
4842 + map->prime = tmp.prime;
4843 + map->hashsize = tmp.hashsize;
4844 + map->members = tmp.members;
4845 + write_unlock_bh(&set->lock);
4846 +
4847 + ip_set_free(members, hashsize * sizeof(ip_set_ip_t));
4848 +
4849 + return 0;
4850 +}
4851 +
4852 +static inline int
4853 +__delip(struct ip_set_nethash *map, ip_set_ip_t ip, unsigned char cidr,
4854 + ip_set_ip_t *hash_ip)
4855 +{
4856 + ip_set_ip_t id = hash_id_cidr(map, ip, cidr, hash_ip);
4857 +
4858 + if (id == UINT_MAX)
4859 + return -EEXIST;
4860 +
4861 + map->members[id] = 0;
4862 + return 0;
4863 +}
4864 +
4865 +static int
4866 +delip(struct ip_set *set, const void *data, size_t size,
4867 + ip_set_ip_t *hash_ip)
4868 +{
4869 + struct ip_set_req_nethash *req =
4870 + (struct ip_set_req_nethash *) data;
4871 +
4872 + if (size != sizeof(struct ip_set_req_nethash)) {
4873 + ip_set_printk("data length wrong (want %zu, have %zu)",
4874 + sizeof(struct ip_set_req_nethash),
4875 + size);
4876 + return -EINVAL;
4877 + }
4878 + /* TODO: no garbage collection in map->cidr */
4879 + return __delip((struct ip_set_nethash *) set->data,
4880 + req->ip, req->cidr, hash_ip);
4881 +}
4882 +
4883 +static int
4884 +delip_kernel(struct ip_set *set, const struct sk_buff *skb,
4885 + u_int32_t flags, ip_set_ip_t *hash_ip)
4886 +{
4887 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
4888 + int ret = -ERANGE;
4889 + ip_set_ip_t ip = ntohl(flags & IPSET_SRC ? skb->nh.iph->saddr
4890 + : skb->nh.iph->daddr);
4891 +
4892 + if (map->cidr[0])
4893 + ret = __delip(map, ip, map->cidr[0], hash_ip);
4894 +
4895 + return ret;
4896 +}
4897 +
4898 +static int create(struct ip_set *set, const void *data, size_t size)
4899 +{
4900 + unsigned newbytes;
4901 + struct ip_set_req_nethash_create *req =
4902 + (struct ip_set_req_nethash_create *) data;
4903 + struct ip_set_nethash *map;
4904 +
4905 + if (size != sizeof(struct ip_set_req_nethash_create)) {
4906 + ip_set_printk("data length wrong (want %zu, have %zu)",
4907 + sizeof(struct ip_set_req_nethash_create),
4908 + size);
4909 + return -EINVAL;
4910 + }
4911 +
4912 + if (req->hashsize < 1) {
4913 + ip_set_printk("hashsize too small");
4914 + return -ENOEXEC;
4915 + }
4916 +
4917 + map = kmalloc(sizeof(struct ip_set_nethash), GFP_KERNEL);
4918 + if (!map) {
4919 + DP("out of memory for %d bytes",
4920 + sizeof(struct ip_set_nethash));
4921 + return -ENOMEM;
4922 + }
4923 + get_random_bytes(&map->initval, 4);
4924 + map->prime = make_prime(req->hashsize);
4925 + map->hashsize = req->hashsize;
4926 + map->probes = req->probes;
4927 + map->resize = req->resize;
4928 + memset(map->cidr, 0, 30 * sizeof(unsigned char));
4929 + newbytes = map->hashsize * sizeof(ip_set_ip_t);
4930 + map->members = ip_set_malloc(newbytes);
4931 + if (!map->members) {
4932 + DP("out of memory for %d bytes", newbytes);
4933 + kfree(map);
4934 + return -ENOMEM;
4935 + }
4936 + memset(map->members, 0, newbytes);
4937 +
4938 + set->data = map;
4939 + return 0;
4940 +}
4941 +
4942 +static void destroy(struct ip_set *set)
4943 +{
4944 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
4945 +
4946 + ip_set_free(map->members, map->hashsize * sizeof(ip_set_ip_t));
4947 + kfree(map);
4948 +
4949 + set->data = NULL;
4950 +}
4951 +
4952 +static void flush(struct ip_set *set)
4953 +{
4954 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
4955 + memset(map->members, 0, map->hashsize * sizeof(ip_set_ip_t));
4956 + memset(map->cidr, 0, 30 * sizeof(unsigned char));
4957 +}
4958 +
4959 +static void list_header(const struct ip_set *set, void *data)
4960 +{
4961 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
4962 + struct ip_set_req_nethash_create *header =
4963 + (struct ip_set_req_nethash_create *) data;
4964 +
4965 + header->hashsize = map->hashsize;
4966 + header->probes = map->probes;
4967 + header->resize = map->resize;
4968 +}
4969 +
4970 +static int list_members_size(const struct ip_set *set)
4971 +{
4972 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
4973 +
4974 + return (map->hashsize * sizeof(ip_set_ip_t));
4975 +}
4976 +
4977 +static void list_members(const struct ip_set *set, void *data)
4978 +{
4979 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
4980 + int bytes = map->hashsize * sizeof(ip_set_ip_t);
4981 +
4982 + memcpy(data, map->members, bytes);
4983 +}
4984 +
4985 +static struct ip_set_type ip_set_nethash = {
4986 + .typename = SETTYPE_NAME,
4987 + .typecode = IPSET_TYPE_IP,
4988 + .protocol_version = IP_SET_PROTOCOL_VERSION,
4989 + .create = &create,
4990 + .destroy = &destroy,
4991 + .flush = &flush,
4992 + .reqsize = sizeof(struct ip_set_req_nethash),
4993 + .addip = &addip,
4994 + .addip_kernel = &addip_kernel,
4995 + .retry = &retry,
4996 + .delip = &delip,
4997 + .delip_kernel = &delip_kernel,
4998 + .testip = &testip,
4999 + .testip_kernel = &testip_kernel,
5000 + .header_size = sizeof(struct ip_set_req_nethash_create),
5001 + .list_header = &list_header,
5002 + .list_members_size = &list_members_size,
5003 + .list_members = &list_members,
5004 + .me = THIS_MODULE,
5005 +};
5006 +
5007 +MODULE_LICENSE("GPL");
5008 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
5009 +MODULE_DESCRIPTION("nethash type of IP sets");
5010 +
5011 +static int __init init(void)
5012 +{
5013 + return ip_set_register_set_type(&ip_set_nethash);
5014 +}
5015 +
5016 +static void __exit fini(void)
5017 +{
5018 + /* FIXME: possible race with ip_set_create() */
5019 + ip_set_unregister_set_type(&ip_set_nethash);
5020 +}
5021 +
5022 +module_init(init);
5023 +module_exit(fini);
5024 diff -Nur linux-2.6.16/net/ipv4/netfilter/ip_set_portmap.c linux-2.6.16-owrt/net/ipv4/netfilter/ip_set_portmap.c
5025 --- linux-2.6.16/net/ipv4/netfilter/ip_set_portmap.c 1970-01-01 01:00:00.000000000 +0100
5026 +++ linux-2.6.16-owrt/net/ipv4/netfilter/ip_set_portmap.c 2006-03-20 12:53:59.000000000 +0100
5027 @@ -0,0 +1,325 @@
5028 +/* Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
5029 + *
5030 + * This program is free software; you can redistribute it and/or modify
5031 + * it under the terms of the GNU General Public License version 2 as
5032 + * published by the Free Software Foundation.
5033 + */
5034 +
5035 +/* Kernel module implementing a port set type as a bitmap */
5036 +
5037 +#include <linux/module.h>
5038 +#include <linux/ip.h>
5039 +#include <linux/tcp.h>
5040 +#include <linux/udp.h>
5041 +#include <linux/skbuff.h>
5042 +#include <linux/netfilter_ipv4/ip_tables.h>
5043 +#include <linux/netfilter_ipv4/ip_set.h>
5044 +#include <linux/errno.h>
5045 +#include <asm/uaccess.h>
5046 +#include <asm/bitops.h>
5047 +#include <linux/spinlock.h>
5048 +
5049 +#include <net/ip.h>
5050 +
5051 +#include <linux/netfilter_ipv4/ip_set_portmap.h>
5052 +
5053 +/* We must handle non-linear skbs */
5054 +static inline ip_set_ip_t
5055 +get_port(const struct sk_buff *skb, u_int32_t flags)
5056 +{
5057 + struct iphdr *iph = skb->nh.iph;
5058 + u_int16_t offset = ntohs(iph->frag_off) & IP_OFFSET;
5059 +
5060 + switch (iph->protocol) {
5061 + case IPPROTO_TCP: {
5062 + struct tcphdr tcph;
5063 +
5064 + /* See comments at tcp_match in ip_tables.c */
5065 + if (offset)
5066 + return INVALID_PORT;
5067 +
5068 + if (skb_copy_bits(skb, skb->nh.iph->ihl*4, &tcph, sizeof(tcph)) < 0)
5069 + /* No choice either */
5070 + return INVALID_PORT;
5071 +
5072 + return ntohs(flags & IPSET_SRC ?
5073 + tcph.source : tcph.dest);
5074 + }
5075 + case IPPROTO_UDP: {
5076 + struct udphdr udph;
5077 +
5078 + if (offset)
5079 + return INVALID_PORT;
5080 +
5081 + if (skb_copy_bits(skb, skb->nh.iph->ihl*4, &udph, sizeof(udph)) < 0)
5082 + /* No choice either */
5083 + return INVALID_PORT;
5084 +
5085 + return ntohs(flags & IPSET_SRC ?
5086 + udph.source : udph.dest);
5087 + }
5088 + default:
5089 + return INVALID_PORT;
5090 + }
5091 +}
5092 +
5093 +static inline int
5094 +__testport(struct ip_set *set, ip_set_ip_t port, ip_set_ip_t *hash_port)
5095 +{
5096 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5097 +
5098 + if (port < map->first_port || port > map->last_port)
5099 + return -ERANGE;
5100 +
5101 + *hash_port = port;
5102 + DP("set: %s, port:%u, %u", set->name, port, *hash_port);
5103 + return !!test_bit(port - map->first_port, map->members);
5104 +}
5105 +
5106 +static int
5107 +testport(struct ip_set *set, const void *data, size_t size,
5108 + ip_set_ip_t *hash_port)
5109 +{
5110 + struct ip_set_req_portmap *req =
5111 + (struct ip_set_req_portmap *) data;
5112 +
5113 + if (size != sizeof(struct ip_set_req_portmap)) {
5114 + ip_set_printk("data length wrong (want %zu, have %zu)",
5115 + sizeof(struct ip_set_req_portmap),
5116 + size);
5117 + return -EINVAL;
5118 + }
5119 + return __testport(set, req->port, hash_port);
5120 +}
5121 +
5122 +static int
5123 +testport_kernel(struct ip_set *set, const struct sk_buff *skb,
5124 + u_int32_t flags, ip_set_ip_t *hash_port)
5125 +{
5126 + int res;
5127 + ip_set_ip_t port = get_port(skb, flags);
5128 +
5129 + DP("flag %s port %u", flags & IPSET_SRC ? "SRC" : "DST", port);
5130 + if (port == INVALID_PORT)
5131 + return 0;
5132 +
5133 + res = __testport(set, port, hash_port);
5134 +
5135 + return (res < 0 ? 0 : res);
5136 +}
5137 +
5138 +static inline int
5139 +__addport(struct ip_set *set, ip_set_ip_t port, ip_set_ip_t *hash_port)
5140 +{
5141 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5142 +
5143 + if (port < map->first_port || port > map->last_port)
5144 + return -ERANGE;
5145 + if (test_and_set_bit(port - map->first_port, map->members))
5146 + return -EEXIST;
5147 +
5148 + *hash_port = port;
5149 + DP("port %u", port);
5150 + return 0;
5151 +}
5152 +
5153 +static int
5154 +addport(struct ip_set *set, const void *data, size_t size,
5155 + ip_set_ip_t *hash_port)
5156 +{
5157 + struct ip_set_req_portmap *req =
5158 + (struct ip_set_req_portmap *) data;
5159 +
5160 + if (size != sizeof(struct ip_set_req_portmap)) {
5161 + ip_set_printk("data length wrong (want %zu, have %zu)",
5162 + sizeof(struct ip_set_req_portmap),
5163 + size);
5164 + return -EINVAL;
5165 + }
5166 + return __addport(set, req->port, hash_port);
5167 +}
5168 +
5169 +static int
5170 +addport_kernel(struct ip_set *set, const struct sk_buff *skb,
5171 + u_int32_t flags, ip_set_ip_t *hash_port)
5172 +{
5173 + ip_set_ip_t port = get_port(skb, flags);
5174 +
5175 + if (port == INVALID_PORT)
5176 + return -EINVAL;
5177 +
5178 + return __addport(set, port, hash_port);
5179 +}
5180 +
5181 +static inline int
5182 +__delport(struct ip_set *set, ip_set_ip_t port, ip_set_ip_t *hash_port)
5183 +{
5184 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5185 +
5186 + if (port < map->first_port || port > map->last_port)
5187 + return -ERANGE;
5188 + if (!test_and_clear_bit(port - map->first_port, map->members))
5189 + return -EEXIST;
5190 +
5191 + *hash_port = port;
5192 + DP("port %u", port);
5193 + return 0;
5194 +}
5195 +
5196 +static int
5197 +delport(struct ip_set *set, const void *data, size_t size,
5198 + ip_set_ip_t *hash_port)
5199 +{
5200 + struct ip_set_req_portmap *req =
5201 + (struct ip_set_req_portmap *) data;
5202 +
5203 + if (size != sizeof(struct ip_set_req_portmap)) {
5204 + ip_set_printk("data length wrong (want %zu, have %zu)",
5205 + sizeof(struct ip_set_req_portmap),
5206 + size);
5207 + return -EINVAL;
5208 + }
5209 + return __delport(set, req->port, hash_port);
5210 +}
5211 +
5212 +static int
5213 +delport_kernel(struct ip_set *set, const struct sk_buff *skb,
5214 + u_int32_t flags, ip_set_ip_t *hash_port)
5215 +{
5216 + ip_set_ip_t port = get_port(skb, flags);
5217 +
5218 + if (port == INVALID_PORT)
5219 + return -EINVAL;
5220 +
5221 + return __delport(set, port, hash_port);
5222 +}
5223 +
5224 +static int create(struct ip_set *set, const void *data, size_t size)
5225 +{
5226 + int newbytes;
5227 + struct ip_set_req_portmap_create *req =
5228 + (struct ip_set_req_portmap_create *) data;
5229 + struct ip_set_portmap *map;
5230 +
5231 + if (size != sizeof(struct ip_set_req_portmap_create)) {
5232 + ip_set_printk("data length wrong (want %zu, have %zu)",
5233 + sizeof(struct ip_set_req_portmap_create),
5234 + size);
5235 + return -EINVAL;
5236 + }
5237 +
5238 + DP("from %u to %u", req->from, req->to);
5239 +
5240 + if (req->from > req->to) {
5241 + DP("bad port range");
5242 + return -ENOEXEC;
5243 + }
5244 +
5245 + if (req->to - req->from > MAX_RANGE) {
5246 + ip_set_printk("range too big (max %d ports)",
5247 + MAX_RANGE);
5248 + return -ENOEXEC;
5249 + }
5250 +
5251 + map = kmalloc(sizeof(struct ip_set_portmap), GFP_KERNEL);
5252 + if (!map) {
5253 + DP("out of memory for %d bytes",
5254 + sizeof(struct ip_set_portmap));
5255 + return -ENOMEM;
5256 + }
5257 + map->first_port = req->from;
5258 + map->last_port = req->to;
5259 + newbytes = bitmap_bytes(req->from, req->to);
5260 + map->members = kmalloc(newbytes, GFP_KERNEL);
5261 + if (!map->members) {
5262 + DP("out of memory for %d bytes", newbytes);
5263 + kfree(map);
5264 + return -ENOMEM;
5265 + }
5266 + memset(map->members, 0, newbytes);
5267 +
5268 + set->data = map;
5269 + return 0;
5270 +}
5271 +
5272 +static void destroy(struct ip_set *set)
5273 +{
5274 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5275 +
5276 + kfree(map->members);
5277 + kfree(map);
5278 +
5279 + set->data = NULL;
5280 +}
5281 +
5282 +static void flush(struct ip_set *set)
5283 +{
5284 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5285 + memset(map->members, 0, bitmap_bytes(map->first_port, map->last_port));
5286 +}
5287 +
5288 +static void list_header(const struct ip_set *set, void *data)
5289 +{
5290 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5291 + struct ip_set_req_portmap_create *header =
5292 + (struct ip_set_req_portmap_create *) data;
5293 +
5294 + DP("list_header %u %u", map->first_port, map->last_port);
5295 +
5296 + header->from = map->first_port;
5297 + header->to = map->last_port;
5298 +}
5299 +
5300 +static int list_members_size(const struct ip_set *set)
5301 +{
5302 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5303 +
5304 + return bitmap_bytes(map->first_port, map->last_port);
5305 +}
5306 +
5307 +static void list_members(const struct ip_set *set, void *data)
5308 +{
5309 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5310 + int bytes = bitmap_bytes(map->first_port, map->last_port);
5311 +
5312 + memcpy(data, map->members, bytes);
5313 +}
5314 +
5315 +static struct ip_set_type ip_set_portmap = {
5316 + .typename = SETTYPE_NAME,
5317 + .typecode = IPSET_TYPE_PORT,
5318 + .protocol_version = IP_SET_PROTOCOL_VERSION,
5319 + .create = &create,
5320 + .destroy = &destroy,
5321 + .flush = &flush,
5322 + .reqsize = sizeof(struct ip_set_req_portmap),
5323 + .addip = &addport,
5324 + .addip_kernel = &addport_kernel,
5325 + .delip = &delport,
5326 + .delip_kernel = &delport_kernel,
5327 + .testip = &testport,
5328 + .testip_kernel = &testport_kernel,
5329 + .header_size = sizeof(struct ip_set_req_portmap_create),
5330 + .list_header = &list_header,
5331 + .list_members_size = &list_members_size,
5332 + .list_members = &list_members,
5333 + .me = THIS_MODULE,
5334 +};
5335 +
5336 +MODULE_LICENSE("GPL");
5337 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
5338 +MODULE_DESCRIPTION("portmap type of IP sets");
5339 +
5340 +static int __init init(void)
5341 +{
5342 + return ip_set_register_set_type(&ip_set_portmap);
5343 +}
5344 +
5345 +static void __exit fini(void)
5346 +{
5347 + /* FIXME: possible race with ip_set_create() */
5348 + ip_set_unregister_set_type(&ip_set_portmap);
5349 +}
5350 +
5351 +module_init(init);
5352 +module_exit(fini);
5353 diff -Nur linux-2.6.16/net/ipv4/netfilter/ipt_set.c linux-2.6.16-owrt/net/ipv4/netfilter/ipt_set.c
5354 --- linux-2.6.16/net/ipv4/netfilter/ipt_set.c 1970-01-01 01:00:00.000000000 +0100
5355 +++ linux-2.6.16-owrt/net/ipv4/netfilter/ipt_set.c 2006-03-20 12:53:59.000000000 +0100
5356 @@ -0,0 +1,112 @@
5357 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
5358 + * Patrick Schaaf <bof@bof.de>
5359 + * Martin Josefsson <gandalf@wlug.westbo.se>
5360 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
5361 + *
5362 + * This program is free software; you can redistribute it and/or modify
5363 + * it under the terms of the GNU General Public License version 2 as
5364 + * published by the Free Software Foundation.
5365 + */
5366 +
5367 +/* Kernel module to match an IP set. */
5368 +
5369 +#include <linux/module.h>
5370 +#include <linux/ip.h>
5371 +#include <linux/skbuff.h>
5372 +
5373 +#include <linux/netfilter_ipv4/ip_tables.h>
5374 +#include <linux/netfilter_ipv4/ip_set.h>
5375 +#include <linux/netfilter_ipv4/ipt_set.h>
5376 +
5377 +static inline int
5378 +match_set(const struct ipt_set_info *info,
5379 + const struct sk_buff *skb,
5380 + int inv)
5381 +{
5382 + if (ip_set_testip_kernel(info->index, skb, info->flags))
5383 + inv = !inv;
5384 + return inv;
5385 +}
5386 +
5387 +static int
5388 +match(const struct sk_buff *skb,
5389 + const struct net_device *in,
5390 + const struct net_device *out,
5391 + const void *matchinfo,
5392 + int offset,
5393 + int *hotdrop)
5394 +{
5395 + const struct ipt_set_info_match *info = matchinfo;
5396 +
5397 + return match_set(&info->match_set,
5398 + skb,
5399 + info->match_set.flags[0] & IPSET_MATCH_INV);
5400 +}
5401 +
5402 +static int
5403 +checkentry(const char *tablename,
5404 + const struct ipt_ip *ip,
5405 + void *matchinfo,
5406 + unsigned int matchsize,
5407 + unsigned int hook_mask)
5408 +{
5409 + struct ipt_set_info_match *info =
5410 + (struct ipt_set_info_match *) matchinfo;
5411 + ip_set_id_t index;
5412 +
5413 + if (matchsize != IPT_ALIGN(sizeof(struct ipt_set_info_match))) {
5414 + ip_set_printk("invalid matchsize %d", matchsize);
5415 + return 0;
5416 + }
5417 +
5418 + index = ip_set_get_byindex(info->match_set.index);
5419 +
5420 + if (index == IP_SET_INVALID_ID) {
5421 + ip_set_printk("Cannot find set indentified by id %u to match",
5422 + info->match_set.index);
5423 + return 0; /* error */
5424 + }
5425 + if (info->match_set.flags[IP_SET_MAX_BINDINGS] != 0) {
5426 + ip_set_printk("That's nasty!");
5427 + return 0; /* error */
5428 + }
5429 +
5430 + return 1;
5431 +}
5432 +
5433 +static void destroy(void *matchinfo, unsigned int matchsize)
5434 +{
5435 + struct ipt_set_info_match *info = matchinfo;
5436 +
5437 + if (matchsize != IPT_ALIGN(sizeof(struct ipt_set_info_match))) {
5438 + ip_set_printk("invalid matchsize %d", matchsize);
5439 + return;
5440 + }
5441 +
5442 + ip_set_put(info->match_set.index);
5443 +}
5444 +
5445 +static struct ipt_match set_match = {
5446 + .name = "set",
5447 + .match = &match,
5448 + .checkentry = &checkentry,
5449 + .destroy = &destroy,
5450 + .me = THIS_MODULE
5451 +};
5452 +
5453 +MODULE_LICENSE("GPL");
5454 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
5455 +MODULE_DESCRIPTION("iptables IP set match module");
5456 +
5457 +static int __init init(void)
5458 +{
5459 + return ipt_register_match(&set_match);
5460 +}
5461 +
5462 +static void __exit fini(void)
5463 +{
5464 + ipt_unregister_match(&set_match);
5465 +}
5466 +
5467 +module_init(init);
5468 +module_exit(fini);
5469 diff -Nur linux-2.6.16/net/ipv4/netfilter/ipt_SET.c linux-2.6.16-owrt/net/ipv4/netfilter/ipt_SET.c
5470 --- linux-2.6.16/net/ipv4/netfilter/ipt_SET.c 1970-01-01 01:00:00.000000000 +0100
5471 +++ linux-2.6.16-owrt/net/ipv4/netfilter/ipt_SET.c 2006-03-20 12:53:59.000000000 +0100
5472 @@ -0,0 +1,128 @@
5473 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
5474 + * Patrick Schaaf <bof@bof.de>
5475 + * Martin Josefsson <gandalf@wlug.westbo.se>
5476 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
5477 + *
5478 + * This program is free software; you can redistribute it and/or modify
5479 + * it under the terms of the GNU General Public License version 2 as
5480 + * published by the Free Software Foundation.
5481 + */
5482 +
5483 +/* ipt_SET.c - netfilter target to manipulate IP sets */
5484 +
5485 +#include <linux/types.h>
5486 +#include <linux/ip.h>
5487 +#include <linux/timer.h>
5488 +#include <linux/module.h>
5489 +#include <linux/netfilter.h>
5490 +#include <linux/netdevice.h>
5491 +#include <linux/if.h>
5492 +#include <linux/inetdevice.h>
5493 +#include <net/protocol.h>
5494 +#include <net/checksum.h>
5495 +#include <linux/netfilter_ipv4.h>
5496 +#include <linux/netfilter_ipv4/ip_nat_rule.h>
5497 +#include <linux/netfilter_ipv4/ipt_set.h>
5498 +
5499 +static unsigned int
5500 +target(struct sk_buff **pskb,
5501 + const struct net_device *in,
5502 + const struct net_device *out,
5503 + unsigned int hooknum,
5504 + const void *targinfo,
5505 + void *userinfo)
5506 +{
5507 + const struct ipt_set_info_target *info = targinfo;
5508 +
5509 + if (info->add_set.index != IP_SET_INVALID_ID)
5510 + ip_set_addip_kernel(info->add_set.index,
5511 + *pskb,
5512 + info->add_set.flags);
5513 + if (info->del_set.index != IP_SET_INVALID_ID)
5514 + ip_set_delip_kernel(info->del_set.index,
5515 + *pskb,
5516 + info->del_set.flags);
5517 +
5518 + return IPT_CONTINUE;
5519 +}
5520 +
5521 +static int
5522 +checkentry(const char *tablename,
5523 + const struct ipt_entry *e,
5524 + void *targinfo,
5525 + unsigned int targinfosize, unsigned int hook_mask)
5526 +{
5527 + struct ipt_set_info_target *info =
5528 + (struct ipt_set_info_target *) targinfo;
5529 + ip_set_id_t index;
5530 +
5531 + if (targinfosize != IPT_ALIGN(sizeof(*info))) {
5532 + DP("bad target info size %u", targinfosize);
5533 + return 0;
5534 + }
5535 +
5536 + if (info->add_set.index != IP_SET_INVALID_ID) {
5537 + index = ip_set_get_byindex(info->add_set.index);
5538 + if (index == IP_SET_INVALID_ID) {
5539 + ip_set_printk("cannot find add_set index %u as target",
5540 + info->add_set.index);
5541 + return 0; /* error */
5542 + }
5543 + }
5544 +
5545 + if (info->del_set.index != IP_SET_INVALID_ID) {
5546 + index = ip_set_get_byindex(info->del_set.index);
5547 + if (index == IP_SET_INVALID_ID) {
5548 + ip_set_printk("cannot find del_set index %u as target",
5549 + info->del_set.index);
5550 + return 0; /* error */
5551 + }
5552 + }
5553 + if (info->add_set.flags[IP_SET_MAX_BINDINGS] != 0
5554 + || info->del_set.flags[IP_SET_MAX_BINDINGS] != 0) {
5555 + ip_set_printk("That's nasty!");
5556 + return 0; /* error */
5557 + }
5558 +
5559 + return 1;
5560 +}
5561 +
5562 +static void destroy(void *targetinfo, unsigned int targetsize)
5563 +{
5564 + struct ipt_set_info_target *info = targetinfo;
5565 +
5566 + if (targetsize != IPT_ALIGN(sizeof(struct ipt_set_info_target))) {
5567 + ip_set_printk("invalid targetsize %d", targetsize);
5568 + return;
5569 + }
5570 +
5571 + if (info->add_set.index != IP_SET_INVALID_ID)
5572 + ip_set_put(info->add_set.index);
5573 + if (info->del_set.index != IP_SET_INVALID_ID)
5574 + ip_set_put(info->del_set.index);
5575 +}
5576 +
5577 +static struct ipt_target SET_target = {
5578 + .name = "SET",
5579 + .target = target,
5580 + .checkentry = checkentry,
5581 + .destroy = destroy,
5582 + .me = THIS_MODULE
5583 +};
5584 +
5585 +MODULE_LICENSE("GPL");
5586 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
5587 +MODULE_DESCRIPTION("iptables IP set target module");
5588 +
5589 +static int __init init(void)
5590 +{
5591 + return ipt_register_target(&SET_target);
5592 +}
5593 +
5594 +static void __exit fini(void)
5595 +{
5596 + ipt_unregister_target(&SET_target);
5597 +}
5598 +
5599 +module_init(init);
5600 +module_exit(fini);
5601 diff -Nur linux-2.6.16/net/ipv4/netfilter/Kconfig linux-2.6.16-owrt/net/ipv4/netfilter/Kconfig
5602 --- linux-2.6.16/net/ipv4/netfilter/Kconfig 2006-03-20 12:52:42.000000000 +0100
5603 +++ linux-2.6.16-owrt/net/ipv4/netfilter/Kconfig 2006-03-20 12:53:59.000000000 +0100
5604 @@ -623,5 +623,106 @@
5605 Allows altering the ARP packet payload: source and destination
5606 hardware and network addresses.
5607
5608 +config IP_NF_SET
5609 + tristate "IP set support"
5610 + depends on INET && NETFILTER
5611 + help
5612 + This option adds IP set support to the kernel.
5613 + In order to define and use sets, you need the userspace utility
5614 + ipset(8).
5615 +
5616 + To compile it as a module, choose M here. If unsure, say N.
5617 +
5618 +config IP_NF_SET_MAX
5619 + int "Maximum number of IP sets"
5620 + default 256
5621 + range 2 65534
5622 + depends on IP_NF_SET
5623 + help
5624 + You can define here default value of the maximum number
5625 + of IP sets for the kernel.
5626 +
5627 + The value can be overriden by the 'max_sets' module
5628 + parameter of the 'ip_set' module.
5629 +
5630 +config IP_NF_SET_HASHSIZE
5631 + int "Hash size for bindings of IP sets"
5632 + default 1024
5633 + depends on IP_NF_SET
5634 + help
5635 + You can define here default value of the hash size for
5636 + bindings of IP sets.
5637 +
5638 + The value can be overriden by the 'hash_size' module
5639 + parameter of the 'ip_set' module.
5640 +
5641 +config IP_NF_SET_IPMAP
5642 + tristate "ipmap set support"
5643 + depends on IP_NF_SET
5644 + help
5645 + This option adds the ipmap set type support.
5646 +
5647 + To compile it as a module, choose M here. If unsure, say N.
5648 +
5649 +config IP_NF_SET_MACIPMAP
5650 + tristate "macipmap set support"
5651 + depends on IP_NF_SET
5652 + help
5653 + This option adds the macipmap set type support.
5654 +
5655 + To compile it as a module, choose M here. If unsure, say N.
5656 +
5657 +config IP_NF_SET_PORTMAP
5658 + tristate "portmap set support"
5659 + depends on IP_NF_SET
5660 + help
5661 + This option adds the portmap set type support.
5662 +
5663 + To compile it as a module, choose M here. If unsure, say N.
5664 +
5665 +config IP_NF_SET_IPHASH
5666 + tristate "iphash set support"
5667 + depends on IP_NF_SET
5668 + help
5669 + This option adds the iphash set type support.
5670 +
5671 + To compile it as a module, choose M here. If unsure, say N.
5672 +
5673 +config IP_NF_SET_NETHASH
5674 + tristate "nethash set support"
5675 + depends on IP_NF_SET
5676 + help
5677 + This option adds the nethash set type support.
5678 +
5679 + To compile it as a module, choose M here. If unsure, say N.
5680 +
5681 +config IP_NF_SET_IPTREE
5682 + tristate "iptree set support"
5683 + depends on IP_NF_SET
5684 + help
5685 + This option adds the iptree set type support.
5686 +
5687 + To compile it as a module, choose M here. If unsure, say N.
5688 +
5689 +config IP_NF_MATCH_SET
5690 + tristate "set match support"
5691 + depends on IP_NF_SET
5692 + help
5693 + Set matching matches against given IP sets.
5694 + You need the ipset utility to create and set up the sets.
5695 +
5696 + To compile it as a module, choose M here. If unsure, say N.
5697 +
5698 +config IP_NF_TARGET_SET
5699 + tristate "SET target support"
5700 + depends on IP_NF_SET
5701 + help
5702 + The SET target makes possible to add/delete entries
5703 + in IP sets.
5704 + You need the ipset utility to create and set up the sets.
5705 +
5706 + To compile it as a module, choose M here. If unsure, say N.
5707 +
5708 +
5709 endmenu
5710
5711 diff -Nur linux-2.6.16/net/ipv4/netfilter/Makefile linux-2.6.16-owrt/net/ipv4/netfilter/Makefile
5712 --- linux-2.6.16/net/ipv4/netfilter/Makefile 2006-03-20 12:52:42.000000000 +0100
5713 +++ linux-2.6.16-owrt/net/ipv4/netfilter/Makefile 2006-03-20 12:56:30.000000000 +0100
5714 @@ -47,6 +47,7 @@
5715
5716 # matches
5717 obj-$(CONFIG_IP_NF_MATCH_HASHLIMIT) += ipt_hashlimit.o
5718 +obj-$(CONFIG_IP_NF_MATCH_SET) += ipt_set.o
5719 obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
5720 obj-$(CONFIG_IP_NF_MATCH_MULTIPORT) += ipt_multiport.o
5721 obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
5722 @@ -74,6 +75,17 @@
5723 obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
5724 obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
5725 obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
5726 +obj-$(CONFIG_IP_NF_TARGET_SET) += ipt_SET.o
5727 +
5728 +# sets
5729 +obj-$(CONFIG_IP_NF_SET) += ip_set.o
5730 +obj-$(CONFIG_IP_NF_SET_IPMAP) += ip_set_ipmap.o
5731 +obj-$(CONFIG_IP_NF_SET_PORTMAP) += ip_set_portmap.o
5732 +obj-$(CONFIG_IP_NF_SET_MACIPMAP) += ip_set_macipmap.o
5733 +obj-$(CONFIG_IP_NF_SET_IPHASH) += ip_set_iphash.o
5734 +obj-$(CONFIG_IP_NF_SET_NETHASH) += ip_set_nethash.o
5735 +obj-$(CONFIG_IP_NF_SET_IPTREE) += ip_set_iptree.o
5736 +
5737 obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o
5738 obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
5739
Personal OpenWRT clone
This page took 0.302975 seconds and 5 git commands to generate.