1 Index: linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set.h
2 ===================================================================
3 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
4 +++ linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set.h 2007-09-21 16:24:01.000000000 +0800
9 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
10 + * Patrick Schaaf <bof@bof.de>
11 + * Martin Josefsson <gandalf@wlug.westbo.se>
12 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
14 + * This program is free software; you can redistribute it and/or modify
15 + * it under the terms of the GNU General Public License version 2 as
16 + * published by the Free Software Foundation.
24 + * A sockopt of such quality has hardly ever been seen before on the open
25 + * market! This little beauty, hardly ever used: above 64, so it's
26 + * traditionally used for firewalling, not touched (even once!) by the
27 + * 2.0, 2.2 and 2.4 kernels!
29 + * Comes with its own certificate of authenticity, valid anywhere in the
37 + * Heavily modify by Joakim Axelsson 08.03.2002
38 + * - Made it more modulebased
40 + * Additional heavy modifications by Jozsef Kadlecsik 22.02.2004
42 + * - in order to "deal with" backward compatibility, renamed to ipset
46 + * Used so that the kernel module and ipset-binary can match their versions
48 +#define IP_SET_PROTOCOL_VERSION 2
50 +#define IP_SET_MAXNAMELEN 32 /* set names and set typenames */
52 +/* Lets work with our own typedef for representing an IP address.
53 + * We hope to make the code more portable, possibly to IPv6...
55 + * The representation works in HOST byte order, because most set types
56 + * will perform arithmetic operations and compare operations.
58 + * For now the type is an uint32_t.
60 + * Make sure to ONLY use the functions when translating and parsing
61 + * in order to keep the host byte order and make it more portable:
66 + * (Joakim: where are they???)
69 +typedef uint32_t ip_set_ip_t;
71 +/* Sets are identified by an id in kernel space. Tweak with ip_set_id_t
72 + * and IP_SET_INVALID_ID if you want to increase the max number of sets.
74 +typedef uint16_t ip_set_id_t;
76 +#define IP_SET_INVALID_ID 65535
78 +/* How deep we follow bindings */
79 +#define IP_SET_MAX_BINDINGS 6
82 + * Option flags for kernel operations (ipt_set_info)
84 +#define IPSET_SRC 0x01 /* Source match/add */
85 +#define IPSET_DST 0x02 /* Destination match/add */
86 +#define IPSET_MATCH_INV 0x04 /* Inverse matching */
91 +#define IPSET_TYPE_IP 0x01 /* IP address type of set */
92 +#define IPSET_TYPE_PORT 0x02 /* Port type of set */
93 +#define IPSET_DATA_SINGLE 0x04 /* Single data storage */
94 +#define IPSET_DATA_DOUBLE 0x08 /* Double data storage */
96 +/* Reserved keywords */
97 +#define IPSET_TOKEN_DEFAULT ":default:"
98 +#define IPSET_TOKEN_ALL ":all:"
100 +/* SO_IP_SET operation constants, and their request struct types.
103 + * 0-99: commands with version checking
104 + * 100-199: add/del/test/bind/unbind
105 + * 200-299: list, save, restore
108 +/* Single shot operations:
109 + * version, create, destroy, flush, rename and swap
111 + * Sets are identified by name.
114 +#define IP_SET_REQ_STD \
116 + unsigned version; \
117 + char name[IP_SET_MAXNAMELEN]
119 +#define IP_SET_OP_CREATE 0x00000001 /* Create a new (empty) set */
120 +struct ip_set_req_create {
122 + char typename[IP_SET_MAXNAMELEN];
125 +#define IP_SET_OP_DESTROY 0x00000002 /* Remove a (empty) set */
126 +struct ip_set_req_std {
130 +#define IP_SET_OP_FLUSH 0x00000003 /* Remove all IPs in a set */
131 +/* Uses ip_set_req_std */
133 +#define IP_SET_OP_RENAME 0x00000004 /* Rename a set */
134 +/* Uses ip_set_req_create */
136 +#define IP_SET_OP_SWAP 0x00000005 /* Swap two sets */
137 +/* Uses ip_set_req_create */
139 +union ip_set_name_index {
140 + char name[IP_SET_MAXNAMELEN];
144 +#define IP_SET_OP_GET_BYNAME 0x00000006 /* Get set index by name */
145 +struct ip_set_req_get_set {
148 + union ip_set_name_index set;
151 +#define IP_SET_OP_GET_BYINDEX 0x00000007 /* Get set name by index */
152 +/* Uses ip_set_req_get_set */
154 +#define IP_SET_OP_VERSION 0x00000100 /* Ask kernel version */
155 +struct ip_set_req_version {
160 +/* Double shots operations:
161 + * add, del, test, bind and unbind.
163 + * First we query the kernel to get the index and type of the target set,
164 + * then issue the command. Validity of IP is checked in kernel in order
165 + * to minimalize sockopt operations.
168 +/* Get minimal set data for add/del/test/bind/unbind IP */
169 +#define IP_SET_OP_ADT_GET 0x00000010 /* Get set and type */
170 +struct ip_set_req_adt_get {
173 + union ip_set_name_index set;
174 + char typename[IP_SET_MAXNAMELEN];
177 +#define IP_SET_REQ_BYINDEX \
181 +struct ip_set_req_adt {
182 + IP_SET_REQ_BYINDEX;
185 +#define IP_SET_OP_ADD_IP 0x00000101 /* Add an IP to a set */
186 +/* Uses ip_set_req_adt, with type specific addage */
188 +#define IP_SET_OP_DEL_IP 0x00000102 /* Remove an IP from a set */
189 +/* Uses ip_set_req_adt, with type specific addage */
191 +#define IP_SET_OP_TEST_IP 0x00000103 /* Test an IP in a set */
192 +/* Uses ip_set_req_adt, with type specific addage */
194 +#define IP_SET_OP_BIND_SET 0x00000104 /* Bind an IP to a set */
195 +/* Uses ip_set_req_bind, with type specific addage */
196 +struct ip_set_req_bind {
197 + IP_SET_REQ_BYINDEX;
198 + char binding[IP_SET_MAXNAMELEN];
201 +#define IP_SET_OP_UNBIND_SET 0x00000105 /* Unbind an IP from a set */
202 +/* Uses ip_set_req_bind, with type speficic addage
203 + * index = 0 means unbinding for all sets */
205 +#define IP_SET_OP_TEST_BIND_SET 0x00000106 /* Test binding an IP to a set */
206 +/* Uses ip_set_req_bind, with type specific addage */
208 +/* Multiple shots operations: list, save, restore.
210 + * - check kernel version and query the max number of sets
211 + * - get the basic information on all sets
212 + * and size required for the next step
213 + * - get actual set data: header, data, bindings
216 +/* Get max_sets and the index of a queried set
218 +#define IP_SET_OP_MAX_SETS 0x00000020
219 +struct ip_set_req_max_sets {
222 + ip_set_id_t max_sets; /* max_sets */
223 + ip_set_id_t sets; /* real number of sets */
224 + union ip_set_name_index set; /* index of set if name used */
227 +/* Get the id and name of the sets plus size for next step */
228 +#define IP_SET_OP_LIST_SIZE 0x00000201
229 +#define IP_SET_OP_SAVE_SIZE 0x00000202
230 +struct ip_set_req_setnames {
232 + ip_set_id_t index; /* set to list/save */
233 + size_t size; /* size to get setdata/bindings */
234 + /* followed by sets number of struct ip_set_name_list */
237 +struct ip_set_name_list {
238 + char name[IP_SET_MAXNAMELEN];
239 + char typename[IP_SET_MAXNAMELEN];
244 +/* The actual list operation */
245 +#define IP_SET_OP_LIST 0x00000203
246 +struct ip_set_req_list {
247 + IP_SET_REQ_BYINDEX;
248 + /* sets number of struct ip_set_list in reply */
251 +struct ip_set_list {
253 + ip_set_id_t binding;
255 + size_t header_size; /* Set header data of header_size */
256 + size_t members_size; /* Set members data of members_size */
257 + size_t bindings_size; /* Set bindings data of bindings_size */
260 +struct ip_set_hash_list {
262 + ip_set_id_t binding;
265 +/* The save operation */
266 +#define IP_SET_OP_SAVE 0x00000204
267 +/* Uses ip_set_req_list, in the reply replaced by
268 + * sets number of struct ip_set_save plus a marker
269 + * ip_set_save followed by ip_set_hash_save structures.
271 +struct ip_set_save {
273 + ip_set_id_t binding;
274 + size_t header_size; /* Set header data of header_size */
275 + size_t members_size; /* Set members data of members_size */
278 +/* At restoring, ip == 0 means default binding for the given set: */
279 +struct ip_set_hash_save {
282 + ip_set_id_t binding;
285 +/* The restore operation */
286 +#define IP_SET_OP_RESTORE 0x00000205
287 +/* Uses ip_set_req_setnames followed by ip_set_restore structures
288 + * plus a marker ip_set_restore, followed by ip_set_hash_save
291 +struct ip_set_restore {
292 + char name[IP_SET_MAXNAMELEN];
293 + char typename[IP_SET_MAXNAMELEN];
295 + size_t header_size; /* Create data of header_size */
296 + size_t members_size; /* Set members data of members_size */
299 +static inline int bitmap_bytes(ip_set_ip_t a, ip_set_ip_t b)
301 + return 4 * ((((b - a + 8) / 8) + 3) / 4);
306 +#define ip_set_printk(format, args...) \
308 + printk("%s: %s: ", __FILE__, __FUNCTION__); \
309 + printk(format "\n" , ## args); \
312 +#if defined(IP_SET_DEBUG)
313 +#define DP(format, args...) \
315 + printk("%s: %s (DBG): ", __FILE__, __FUNCTION__);\
316 + printk(format "\n" , ## args); \
318 +#define IP_SET_ASSERT(x) \
321 + printk("IP_SET_ASSERT: %s:%i(%s)\n", \
322 + __FILE__, __LINE__, __FUNCTION__); \
325 +#define DP(format, args...)
326 +#define IP_SET_ASSERT(x)
332 + * The ip_set_type definition - one per set type, e.g. "ipmap".
334 + * Each individual set has a pointer, set->type, going to one
335 + * of these structures. Function pointers inside the structure implement
336 + * the real behaviour of the sets.
338 + * If not mentioned differently, the implementation behind the function
339 + * pointers of a set_type, is expected to return 0 if ok, and a negative
340 + * errno (e.g. -EINVAL) on error.
342 +struct ip_set_type {
343 + struct list_head list; /* next in list of set types */
345 + /* test for IP in set (kernel: iptables -m set src|dst)
346 + * return 0 if not in set, 1 if in set.
348 + int (*testip_kernel) (struct ip_set *set,
349 + const struct sk_buff * skb,
351 + const u_int32_t *flags,
352 + unsigned char index);
354 + /* test for IP in set (userspace: ipset -T set IP)
355 + * return 0 if not in set, 1 if in set.
357 + int (*testip) (struct ip_set *set,
358 + const void *data, size_t size,
362 + * Size of the data structure passed by when
363 + * adding/deletin/testing an entry.
367 + /* Add IP into set (userspace: ipset -A set IP)
368 + * Return -EEXIST if the address is already in the set,
369 + * and -ERANGE if the address lies outside the set bounds.
370 + * If the address was not already in the set, 0 is returned.
372 + int (*addip) (struct ip_set *set,
373 + const void *data, size_t size,
376 + /* Add IP into set (kernel: iptables ... -j SET set src|dst)
377 + * Return -EEXIST if the address is already in the set,
378 + * and -ERANGE if the address lies outside the set bounds.
379 + * If the address was not already in the set, 0 is returned.
381 + int (*addip_kernel) (struct ip_set *set,
382 + const struct sk_buff * skb,
384 + const u_int32_t *flags,
385 + unsigned char index);
387 + /* remove IP from set (userspace: ipset -D set --entry x)
388 + * Return -EEXIST if the address is NOT in the set,
389 + * and -ERANGE if the address lies outside the set bounds.
390 + * If the address really was in the set, 0 is returned.
392 + int (*delip) (struct ip_set *set,
393 + const void *data, size_t size,
396 + /* remove IP from set (kernel: iptables ... -j SET --entry x)
397 + * Return -EEXIST if the address is NOT in the set,
398 + * and -ERANGE if the address lies outside the set bounds.
399 + * If the address really was in the set, 0 is returned.
401 + int (*delip_kernel) (struct ip_set *set,
402 + const struct sk_buff * skb,
404 + const u_int32_t *flags,
405 + unsigned char index);
407 + /* new set creation - allocated type specific items
409 + int (*create) (struct ip_set *set,
410 + const void *data, size_t size);
412 + /* retry the operation after successfully tweaking the set
414 + int (*retry) (struct ip_set *set);
416 + /* set destruction - free type specific items
417 + * There is no return value.
418 + * Can be called only when child sets are destroyed.
420 + void (*destroy) (struct ip_set *set);
422 + /* set flushing - reset all bits in the set, or something similar.
423 + * There is no return value.
425 + void (*flush) (struct ip_set *set);
427 + /* Listing: size needed for header
429 + size_t header_size;
431 + /* Listing: Get the header
433 + * Fill in the information in "data".
434 + * This function is always run after list_header_size() under a
435 + * writelock on the set. Therefor is the length of "data" always
438 + void (*list_header) (const struct ip_set *set,
441 + /* Listing: Get the size for the set members
443 + int (*list_members_size) (const struct ip_set *set);
445 + /* Listing: Get the set members
447 + * Fill in the information in "data".
448 + * This function is always run after list_member_size() under a
449 + * writelock on the set. Therefor is the length of "data" always
452 + void (*list_members) (const struct ip_set *set,
455 + char typename[IP_SET_MAXNAMELEN];
456 + unsigned char features;
457 + int protocol_version;
459 + /* Set this to THIS_MODULE if you are a module, otherwise NULL */
463 +extern int ip_set_register_set_type(struct ip_set_type *set_type);
464 +extern void ip_set_unregister_set_type(struct ip_set_type *set_type);
466 +/* A generic ipset */
468 + char name[IP_SET_MAXNAMELEN]; /* the name of the set */
469 + rwlock_t lock; /* lock for concurrency control */
470 + ip_set_id_t id; /* set id for swapping */
471 + ip_set_id_t binding; /* default binding for the set */
472 + atomic_t ref; /* in kernel and in hash references */
473 + struct ip_set_type *type; /* the set types */
474 + void *data; /* pooltype specific data */
477 +/* Structure to bind set elements to sets */
478 +struct ip_set_hash {
479 + struct list_head list; /* list of clashing entries in hash */
480 + ip_set_ip_t ip; /* ip from set */
481 + ip_set_id_t id; /* set id */
482 + ip_set_id_t binding; /* set we bind the element to */
485 +/* register and unregister set references */
486 +extern ip_set_id_t ip_set_get_byname(const char name[IP_SET_MAXNAMELEN]);
487 +extern ip_set_id_t ip_set_get_byindex(ip_set_id_t id);
488 +extern void ip_set_put(ip_set_id_t id);
490 +/* API for iptables set match, and SET target */
491 +extern void ip_set_addip_kernel(ip_set_id_t id,
492 + const struct sk_buff *skb,
493 + const u_int32_t *flags);
494 +extern void ip_set_delip_kernel(ip_set_id_t id,
495 + const struct sk_buff *skb,
496 + const u_int32_t *flags);
497 +extern int ip_set_testip_kernel(ip_set_id_t id,
498 + const struct sk_buff *skb,
499 + const u_int32_t *flags);
501 +#endif /* __KERNEL__ */
503 +#endif /*_IP_SET_H*/
504 Index: linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_iphash.h
505 ===================================================================
506 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
507 +++ linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_iphash.h 2007-09-21 16:24:01.000000000 +0800
509 +#ifndef __IP_SET_IPHASH_H
510 +#define __IP_SET_IPHASH_H
512 +#include <linux/netfilter_ipv4/ip_set.h>
514 +#define SETTYPE_NAME "iphash"
515 +#define MAX_RANGE 0x0000FFFF
517 +struct ip_set_iphash {
518 + ip_set_ip_t *members; /* the iphash proper */
519 + uint32_t elements; /* number of elements */
520 + uint32_t hashsize; /* hash size */
521 + uint16_t probes; /* max number of probes */
522 + uint16_t resize; /* resize factor in percent */
523 + ip_set_ip_t netmask; /* netmask */
524 + void *initval[0]; /* initvals for jhash_1word */
527 +struct ip_set_req_iphash_create {
531 + ip_set_ip_t netmask;
534 +struct ip_set_req_iphash {
538 +#endif /* __IP_SET_IPHASH_H */
539 Index: linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_ipmap.h
540 ===================================================================
541 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
542 +++ linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_ipmap.h 2007-09-21 16:24:01.000000000 +0800
544 +#ifndef __IP_SET_IPMAP_H
545 +#define __IP_SET_IPMAP_H
547 +#include <linux/netfilter_ipv4/ip_set.h>
549 +#define SETTYPE_NAME "ipmap"
550 +#define MAX_RANGE 0x0000FFFF
552 +struct ip_set_ipmap {
553 + void *members; /* the ipmap proper */
554 + ip_set_ip_t first_ip; /* host byte order, included in range */
555 + ip_set_ip_t last_ip; /* host byte order, included in range */
556 + ip_set_ip_t netmask; /* subnet netmask */
557 + ip_set_ip_t sizeid; /* size of set in IPs */
558 + ip_set_ip_t hosts; /* number of hosts in a subnet */
561 +struct ip_set_req_ipmap_create {
564 + ip_set_ip_t netmask;
567 +struct ip_set_req_ipmap {
572 +mask_to_bits(ip_set_ip_t mask)
574 + unsigned int bits = 32;
575 + ip_set_ip_t maskaddr;
577 + if (mask == 0xFFFFFFFF)
580 + maskaddr = 0xFFFFFFFE;
581 + while (--bits >= 0 && maskaddr != mask)
588 +range_to_mask(ip_set_ip_t from, ip_set_ip_t to, unsigned int *bits)
590 + ip_set_ip_t mask = 0xFFFFFFFE;
593 + while (--(*bits) >= 0 && mask && (to & mask) != from)
599 +#endif /* __IP_SET_IPMAP_H */
600 Index: linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_ipporthash.h
601 ===================================================================
602 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
603 +++ linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_ipporthash.h 2007-09-21 16:24:01.000000000 +0800
605 +#ifndef __IP_SET_IPPORTHASH_H
606 +#define __IP_SET_IPPORTHASH_H
608 +#include <linux/netfilter_ipv4/ip_set.h>
610 +#define SETTYPE_NAME "ipporthash"
611 +#define MAX_RANGE 0x0000FFFF
612 +#define INVALID_PORT (MAX_RANGE + 1)
614 +struct ip_set_ipporthash {
615 + ip_set_ip_t *members; /* the ipporthash proper */
616 + uint32_t elements; /* number of elements */
617 + uint32_t hashsize; /* hash size */
618 + uint16_t probes; /* max number of probes */
619 + uint16_t resize; /* resize factor in percent */
620 + ip_set_ip_t first_ip; /* host byte order, included in range */
621 + ip_set_ip_t last_ip; /* host byte order, included in range */
622 + void *initval[0]; /* initvals for jhash_1word */
625 +struct ip_set_req_ipporthash_create {
633 +struct ip_set_req_ipporthash {
638 +#endif /* __IP_SET_IPPORTHASH_H */
639 Index: linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_iptree.h
640 ===================================================================
641 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
642 +++ linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_iptree.h 2007-09-21 16:24:01.000000000 +0800
644 +#ifndef __IP_SET_IPTREE_H
645 +#define __IP_SET_IPTREE_H
647 +#include <linux/netfilter_ipv4/ip_set.h>
649 +#define SETTYPE_NAME "iptree"
650 +#define MAX_RANGE 0x0000FFFF
652 +struct ip_set_iptreed {
653 + unsigned long expires[256]; /* x.x.x.ADDR */
656 +struct ip_set_iptreec {
657 + struct ip_set_iptreed *tree[256]; /* x.x.ADDR.* */
660 +struct ip_set_iptreeb {
661 + struct ip_set_iptreec *tree[256]; /* x.ADDR.*.* */
664 +struct ip_set_iptree {
665 + unsigned int timeout;
666 + unsigned int gc_interval;
668 + uint32_t elements; /* number of elements */
669 + struct timer_list gc;
670 + struct ip_set_iptreeb *tree[256]; /* ADDR.*.*.* */
674 +struct ip_set_req_iptree_create {
675 + unsigned int timeout;
678 +struct ip_set_req_iptree {
680 + unsigned int timeout;
683 +#endif /* __IP_SET_IPTREE_H */
684 Index: linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_macipmap.h
685 ===================================================================
686 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
687 +++ linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_macipmap.h 2007-09-21 16:24:01.000000000 +0800
689 +#ifndef __IP_SET_MACIPMAP_H
690 +#define __IP_SET_MACIPMAP_H
692 +#include <linux/netfilter_ipv4/ip_set.h>
694 +#define SETTYPE_NAME "macipmap"
695 +#define MAX_RANGE 0x0000FFFF
698 +#define IPSET_MACIP_MATCHUNSET 1
701 +#define IPSET_MACIP_ISSET 1
703 +struct ip_set_macipmap {
704 + void *members; /* the macipmap proper */
705 + ip_set_ip_t first_ip; /* host byte order, included in range */
706 + ip_set_ip_t last_ip; /* host byte order, included in range */
710 +struct ip_set_req_macipmap_create {
716 +struct ip_set_req_macipmap {
718 + unsigned char ethernet[ETH_ALEN];
721 +struct ip_set_macip {
722 + unsigned short flags;
723 + unsigned char ethernet[ETH_ALEN];
726 +#endif /* __IP_SET_MACIPMAP_H */
727 Index: linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_malloc.h
728 ===================================================================
729 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
730 +++ linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_malloc.h 2007-09-21 16:24:01.000000000 +0800
732 +#ifndef _IP_SET_MALLOC_H
733 +#define _IP_SET_MALLOC_H
737 +/* Memory allocation and deallocation */
738 +static size_t max_malloc_size = 0;
740 +static inline void init_max_malloc_size(void)
742 +#define CACHE(x) max_malloc_size = x;
743 +#include <linux/kmalloc_sizes.h>
747 +static inline void * ip_set_malloc(size_t bytes)
749 + if (bytes > max_malloc_size)
750 + return vmalloc(bytes);
752 + return kmalloc(bytes, GFP_KERNEL);
755 +static inline void ip_set_free(void * data, size_t bytes)
757 + if (bytes > max_malloc_size)
764 + size_t max_elements;
768 +static inline void *
769 +harray_malloc(size_t hashsize, size_t typesize, int flags)
771 + struct harray *harray;
772 + size_t max_elements, size, i, j;
774 + if (!max_malloc_size)
775 + init_max_malloc_size();
777 + if (typesize > max_malloc_size)
780 + max_elements = max_malloc_size/typesize;
781 + size = hashsize/max_elements;
782 + if (hashsize % max_elements)
785 + /* Last pointer signals end of arrays */
786 + harray = kmalloc(sizeof(struct harray) + (size + 1) * sizeof(void *),
792 + for (i = 0; i < size - 1; i++) {
793 + harray->arrays[i] = kmalloc(max_elements * typesize, flags);
794 + if (!harray->arrays[i])
796 + memset(harray->arrays[i], 0, max_elements * typesize);
798 + harray->arrays[i] = kmalloc((hashsize - i * max_elements) * typesize,
800 + if (!harray->arrays[i])
802 + memset(harray->arrays[i], 0, (hashsize - i * max_elements) * typesize);
804 + harray->max_elements = max_elements;
805 + harray->arrays[size] = NULL;
807 + return (void *)harray;
810 + for (j = 0; j < i; j++) {
811 + kfree(harray->arrays[j]);
817 +static inline void harray_free(void *h)
819 + struct harray *harray = (struct harray *) h;
822 + for (i = 0; harray->arrays[i] != NULL; i++)
823 + kfree(harray->arrays[i]);
827 +static inline void harray_flush(void *h, size_t hashsize, size_t typesize)
829 + struct harray *harray = (struct harray *) h;
832 + for (i = 0; harray->arrays[i+1] != NULL; i++)
833 + memset(harray->arrays[i], 0, harray->max_elements * typesize);
834 + memset(harray->arrays[i], 0,
835 + (hashsize - i * harray->max_elements) * typesize);
838 +#define HARRAY_ELEM(h, type, which) \
840 + struct harray *__h = (struct harray *)(h); \
841 + ((type)((__h)->arrays[(which)/(__h)->max_elements]) \
842 + + (which)%(__h)->max_elements); \
845 +#endif /* __KERNEL__ */
847 +#endif /*_IP_SET_MALLOC_H*/
848 Index: linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_nethash.h
849 ===================================================================
850 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
851 +++ linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_nethash.h 2007-09-21 16:24:01.000000000 +0800
853 +#ifndef __IP_SET_NETHASH_H
854 +#define __IP_SET_NETHASH_H
856 +#include <linux/netfilter_ipv4/ip_set.h>
858 +#define SETTYPE_NAME "nethash"
859 +#define MAX_RANGE 0x0000FFFF
861 +struct ip_set_nethash {
862 + ip_set_ip_t *members; /* the nethash proper */
863 + uint32_t elements; /* number of elements */
864 + uint32_t hashsize; /* hash size */
865 + uint16_t probes; /* max number of probes */
866 + uint16_t resize; /* resize factor in percent */
867 + unsigned char cidr[30]; /* CIDR sizes */
868 + void *initval[0]; /* initvals for jhash_1word */
871 +struct ip_set_req_nethash_create {
877 +struct ip_set_req_nethash {
879 + unsigned char cidr;
882 +static unsigned char shifts[] = {255, 253, 249, 241, 225, 193, 129, 1};
884 +static inline ip_set_ip_t
885 +pack(ip_set_ip_t ip, unsigned char cidr)
887 + ip_set_ip_t addr, *paddr = &addr;
888 + unsigned char n, t, *a;
890 + addr = htonl(ip & (0xFFFFFFFF << (32 - (cidr))));
892 + DP("ip:%u.%u.%u.%u/%u", NIPQUAD(addr), cidr);
896 + a = &((unsigned char *)paddr)[n];
897 + *a = *a /(1 << (8 - t)) + shifts[t];
899 + DP("n: %u, t: %u, a: %u", n, t, *a);
900 + DP("ip:%u.%u.%u.%u/%u, %u.%u.%u.%u",
901 + HIPQUAD(ip), cidr, NIPQUAD(addr));
904 + return ntohl(addr);
907 +#endif /* __IP_SET_NETHASH_H */
908 Index: linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_portmap.h
909 ===================================================================
910 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
911 +++ linux-2.6.23-rc6/include/linux/netfilter_ipv4/ip_set_portmap.h 2007-09-21 16:24:01.000000000 +0800
913 +#ifndef __IP_SET_PORTMAP_H
914 +#define __IP_SET_PORTMAP_H
916 +#include <linux/netfilter_ipv4/ip_set.h>
918 +#define SETTYPE_NAME "portmap"
919 +#define MAX_RANGE 0x0000FFFF
920 +#define INVALID_PORT (MAX_RANGE + 1)
922 +struct ip_set_portmap {
923 + void *members; /* the portmap proper */
924 + ip_set_ip_t first_port; /* host byte order, included in range */
925 + ip_set_ip_t last_port; /* host byte order, included in range */
928 +struct ip_set_req_portmap_create {
933 +struct ip_set_req_portmap {
937 +#endif /* __IP_SET_PORTMAP_H */
938 Index: linux-2.6.23-rc6/include/linux/netfilter_ipv4/ipt_set.h
939 ===================================================================
940 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
941 +++ linux-2.6.23-rc6/include/linux/netfilter_ipv4/ipt_set.h 2007-09-21 16:24:01.000000000 +0800
946 +#include <linux/netfilter_ipv4/ip_set.h>
948 +struct ipt_set_info {
950 + u_int32_t flags[IP_SET_MAX_BINDINGS + 1];
954 +struct ipt_set_info_match {
955 + struct ipt_set_info match_set;
958 +struct ipt_set_info_target {
959 + struct ipt_set_info add_set;
960 + struct ipt_set_info del_set;
963 +#endif /*_IPT_SET_H*/
964 Index: linux-2.6.23-rc6/net/ipv4/netfilter/ip_set.c
965 ===================================================================
966 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
967 +++ linux-2.6.23-rc6/net/ipv4/netfilter/ip_set.c 2007-09-21 16:24:01.000000000 +0800
969 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
970 + * Patrick Schaaf <bof@bof.de>
971 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
973 + * This program is free software; you can redistribute it and/or modify
974 + * it under the terms of the GNU General Public License version 2 as
975 + * published by the Free Software Foundation.
978 +/* Kernel module for IP set management */
980 +#include <linux/version.h>
981 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
982 +#include <linux/config.h>
984 +#include <linux/module.h>
985 +#include <linux/moduleparam.h>
986 +#include <linux/kmod.h>
987 +#include <linux/ip.h>
988 +#include <linux/skbuff.h>
989 +#include <linux/random.h>
990 +#include <linux/jhash.h>
991 +#include <linux/netfilter_ipv4/ip_tables.h>
992 +#include <linux/errno.h>
993 +#include <asm/uaccess.h>
994 +#include <asm/bitops.h>
995 +#include <asm/semaphore.h>
996 +#include <linux/spinlock.h>
997 +#include <linux/vmalloc.h>
999 +#define ASSERT_READ_LOCK(x)
1000 +#define ASSERT_WRITE_LOCK(x)
1001 +#include <linux/netfilter_ipv4/ip_set.h>
1003 +static struct list_head set_type_list; /* all registered sets */
1004 +static struct ip_set **ip_set_list; /* all individual sets */
1005 +static DEFINE_RWLOCK(ip_set_lock); /* protects the lists and the hash */
1006 +static DECLARE_MUTEX(ip_set_app_mutex); /* serializes user access */
1007 +static ip_set_id_t ip_set_max = CONFIG_IP_NF_SET_MAX;
1008 +static ip_set_id_t ip_set_bindings_hash_size = CONFIG_IP_NF_SET_HASHSIZE;
1009 +static struct list_head *ip_set_hash; /* hash of bindings */
1010 +static unsigned int ip_set_hash_random; /* random seed */
1013 + * Sets are identified either by the index in ip_set_list or by id.
1014 + * The id never changes and is used to find a key in the hash.
1015 + * The index may change by swapping and used at all other places
1016 + * (set/SET netfilter modules, binding value, etc.)
1018 + * Userspace requests are serialized by ip_set_mutex and sets can
1019 + * be deleted only from userspace. Therefore ip_set_list locking
1020 + * must obey the following rules:
1022 + * - kernel requests: read and write locking mandatory
1023 + * - user requests: read locking optional, write locking mandatory
1027 +__ip_set_get(ip_set_id_t index)
1029 + atomic_inc(&ip_set_list[index]->ref);
1033 +__ip_set_put(ip_set_id_t index)
1035 + atomic_dec(&ip_set_list[index]->ref);
1039 + * Binding routines
1042 +static inline struct ip_set_hash *
1043 +__ip_set_find(u_int32_t key, ip_set_id_t id, ip_set_ip_t ip)
1045 + struct ip_set_hash *set_hash;
1047 + list_for_each_entry(set_hash, &ip_set_hash[key], list)
1048 + if (set_hash->id == id && set_hash->ip == ip)
1055 +ip_set_find_in_hash(ip_set_id_t id, ip_set_ip_t ip)
1057 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
1058 + % ip_set_bindings_hash_size;
1059 + struct ip_set_hash *set_hash;
1061 + ASSERT_READ_LOCK(&ip_set_lock);
1062 + IP_SET_ASSERT(ip_set_list[id]);
1063 + DP("set: %s, ip: %u.%u.%u.%u", ip_set_list[id]->name, HIPQUAD(ip));
1065 + set_hash = __ip_set_find(key, id, ip);
1067 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
1069 + set_hash != NULL ? ip_set_list[set_hash->binding]->name : "");
1071 + return (set_hash != NULL ? set_hash->binding : IP_SET_INVALID_ID);
1075 +__set_hash_del(struct ip_set_hash *set_hash)
1077 + ASSERT_WRITE_LOCK(&ip_set_lock);
1078 + IP_SET_ASSERT(ip_set_list[set_hash->binding]);
1080 + __ip_set_put(set_hash->binding);
1081 + list_del(&set_hash->list);
1086 +ip_set_hash_del(ip_set_id_t id, ip_set_ip_t ip)
1088 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
1089 + % ip_set_bindings_hash_size;
1090 + struct ip_set_hash *set_hash;
1092 + IP_SET_ASSERT(ip_set_list[id]);
1093 + DP("set: %s, ip: %u.%u.%u.%u", ip_set_list[id]->name, HIPQUAD(ip));
1094 + write_lock_bh(&ip_set_lock);
1095 + set_hash = __ip_set_find(key, id, ip);
1096 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
1098 + set_hash != NULL ? ip_set_list[set_hash->binding]->name : "");
1100 + if (set_hash != NULL)
1101 + __set_hash_del(set_hash);
1102 + write_unlock_bh(&ip_set_lock);
1107 +ip_set_hash_add(ip_set_id_t id, ip_set_ip_t ip, ip_set_id_t binding)
1109 + u_int32_t key = jhash_2words(id, ip, ip_set_hash_random)
1110 + % ip_set_bindings_hash_size;
1111 + struct ip_set_hash *set_hash;
1114 + IP_SET_ASSERT(ip_set_list[id]);
1115 + IP_SET_ASSERT(ip_set_list[binding]);
1116 + DP("set: %s, ip: %u.%u.%u.%u, binding: %s", ip_set_list[id]->name,
1117 + HIPQUAD(ip), ip_set_list[binding]->name);
1118 + write_lock_bh(&ip_set_lock);
1119 + set_hash = __ip_set_find(key, id, ip);
1121 + set_hash = kmalloc(sizeof(struct ip_set_hash), GFP_ATOMIC);
1126 + INIT_LIST_HEAD(&set_hash->list);
1127 + set_hash->id = id;
1128 + set_hash->ip = ip;
1129 + list_add(&set_hash->list, &ip_set_hash[key]);
1131 + IP_SET_ASSERT(ip_set_list[set_hash->binding]);
1132 + DP("overwrite binding: %s",
1133 + ip_set_list[set_hash->binding]->name);
1134 + __ip_set_put(set_hash->binding);
1136 + set_hash->binding = binding;
1137 + __ip_set_get(set_hash->binding);
1138 + DP("stored: key %u, id %u (%s), ip %u.%u.%u.%u, binding %u (%s)",
1139 + key, id, ip_set_list[id]->name,
1140 + HIPQUAD(ip), binding, ip_set_list[binding]->name);
1142 + write_unlock_bh(&ip_set_lock);
1146 +#define FOREACH_HASH_DO(fn, args...) \
1148 + ip_set_id_t __key; \
1149 + struct ip_set_hash *__set_hash; \
1151 + for (__key = 0; __key < ip_set_bindings_hash_size; __key++) { \
1152 + list_for_each_entry(__set_hash, &ip_set_hash[__key], list) \
1153 + fn(__set_hash , ## args); \
1157 +#define FOREACH_HASH_RW_DO(fn, args...) \
1159 + ip_set_id_t __key; \
1160 + struct ip_set_hash *__set_hash, *__n; \
1162 + ASSERT_WRITE_LOCK(&ip_set_lock); \
1163 + for (__key = 0; __key < ip_set_bindings_hash_size; __key++) { \
1164 + list_for_each_entry_safe(__set_hash, __n, &ip_set_hash[__key], list)\
1165 + fn(__set_hash , ## args); \
1169 +/* Add, del and test set entries from kernel */
1171 +#define follow_bindings(index, set, ip) \
1172 +((index = ip_set_find_in_hash((set)->id, ip)) != IP_SET_INVALID_ID \
1173 + || (index = (set)->binding) != IP_SET_INVALID_ID)
1176 +ip_set_testip_kernel(ip_set_id_t index,
1177 + const struct sk_buff *skb,
1178 + const u_int32_t *flags)
1180 + struct ip_set *set;
1183 + unsigned char i = 0;
1185 + IP_SET_ASSERT(flags[i]);
1186 + read_lock_bh(&ip_set_lock);
1188 + set = ip_set_list[index];
1189 + IP_SET_ASSERT(set);
1190 + DP("set %s, index %u", set->name, index);
1191 + read_lock_bh(&set->lock);
1192 + res = set->type->testip_kernel(set, skb, &ip, flags, i++);
1193 + read_unlock_bh(&set->lock);
1194 + i += !!(set->type->features & IPSET_DATA_DOUBLE);
1197 + && follow_bindings(index, set, ip));
1198 + read_unlock_bh(&ip_set_lock);
1204 +ip_set_addip_kernel(ip_set_id_t index,
1205 + const struct sk_buff *skb,
1206 + const u_int32_t *flags)
1208 + struct ip_set *set;
1211 + unsigned char i = 0;
1213 + IP_SET_ASSERT(flags[i]);
1215 + read_lock_bh(&ip_set_lock);
1217 + set = ip_set_list[index];
1218 + IP_SET_ASSERT(set);
1219 + DP("set %s, index %u", set->name, index);
1220 + write_lock_bh(&set->lock);
1221 + res = set->type->addip_kernel(set, skb, &ip, flags, i++);
1222 + write_unlock_bh(&set->lock);
1223 + i += !!(set->type->features & IPSET_DATA_DOUBLE);
1224 + } while ((res == 0 || res == -EEXIST)
1226 + && follow_bindings(index, set, ip));
1227 + read_unlock_bh(&ip_set_lock);
1229 + if (res == -EAGAIN
1230 + && set->type->retry
1231 + && (res = set->type->retry(set)) == 0)
1236 +ip_set_delip_kernel(ip_set_id_t index,
1237 + const struct sk_buff *skb,
1238 + const u_int32_t *flags)
1240 + struct ip_set *set;
1243 + unsigned char i = 0;
1245 + IP_SET_ASSERT(flags[i]);
1246 + read_lock_bh(&ip_set_lock);
1248 + set = ip_set_list[index];
1249 + IP_SET_ASSERT(set);
1250 + DP("set %s, index %u", set->name, index);
1251 + write_lock_bh(&set->lock);
1252 + res = set->type->delip_kernel(set, skb, &ip, flags, i++);
1253 + write_unlock_bh(&set->lock);
1254 + i += !!(set->type->features & IPSET_DATA_DOUBLE);
1255 + } while ((res == 0 || res == -EEXIST)
1257 + && follow_bindings(index, set, ip));
1258 + read_unlock_bh(&ip_set_lock);
1261 +/* Register and deregister settype */
1263 +static inline struct ip_set_type *
1264 +find_set_type(const char *name)
1266 + struct ip_set_type *set_type;
1268 + list_for_each_entry(set_type, &set_type_list, list)
1269 + if (!strncmp(set_type->typename, name, IP_SET_MAXNAMELEN - 1))
1275 +ip_set_register_set_type(struct ip_set_type *set_type)
1279 + if (set_type->protocol_version != IP_SET_PROTOCOL_VERSION) {
1280 + ip_set_printk("'%s' uses wrong protocol version %u (want %u)",
1281 + set_type->typename,
1282 + set_type->protocol_version,
1283 + IP_SET_PROTOCOL_VERSION);
1287 + write_lock_bh(&ip_set_lock);
1288 + if (find_set_type(set_type->typename)) {
1290 + ip_set_printk("'%s' already registered!",
1291 + set_type->typename);
1295 + if (!try_module_get(THIS_MODULE)) {
1299 + list_add(&set_type->list, &set_type_list);
1300 + DP("'%s' registered.", set_type->typename);
1302 + write_unlock_bh(&ip_set_lock);
1307 +ip_set_unregister_set_type(struct ip_set_type *set_type)
1309 + write_lock_bh(&ip_set_lock);
1310 + if (!find_set_type(set_type->typename)) {
1311 + ip_set_printk("'%s' not registered?",
1312 + set_type->typename);
1315 + list_del(&set_type->list);
1316 + module_put(THIS_MODULE);
1317 + DP("'%s' unregistered.", set_type->typename);
1319 + write_unlock_bh(&ip_set_lock);
1324 + * Userspace routines
1328 + * Find set by name, reference it once. The reference makes sure the
1329 + * thing pointed to, does not go away under our feet. Drop the reference
1330 + * later, using ip_set_put().
1333 +ip_set_get_byname(const char *name)
1335 + ip_set_id_t i, index = IP_SET_INVALID_ID;
1337 + down(&ip_set_app_mutex);
1338 + for (i = 0; i < ip_set_max; i++) {
1339 + if (ip_set_list[i] != NULL
1340 + && strcmp(ip_set_list[i]->name, name) == 0) {
1346 + up(&ip_set_app_mutex);
1351 + * Find set by index, reference it once. The reference makes sure the
1352 + * thing pointed to, does not go away under our feet. Drop the reference
1353 + * later, using ip_set_put().
1356 +ip_set_get_byindex(ip_set_id_t index)
1358 + down(&ip_set_app_mutex);
1360 + if (index >= ip_set_max)
1361 + return IP_SET_INVALID_ID;
1363 + if (ip_set_list[index])
1364 + __ip_set_get(index);
1366 + index = IP_SET_INVALID_ID;
1368 + up(&ip_set_app_mutex);
1373 + * If the given set pointer points to a valid set, decrement
1374 + * reference count by 1. The caller shall not assume the index
1375 + * to be valid, after calling this function.
1377 +void ip_set_put(ip_set_id_t index)
1379 + down(&ip_set_app_mutex);
1380 + if (ip_set_list[index])
1381 + __ip_set_put(index);
1382 + up(&ip_set_app_mutex);
1385 +/* Find a set by name or index */
1387 +ip_set_find_byname(const char *name)
1389 + ip_set_id_t i, index = IP_SET_INVALID_ID;
1391 + for (i = 0; i < ip_set_max; i++) {
1392 + if (ip_set_list[i] != NULL
1393 + && strcmp(ip_set_list[i]->name, name) == 0) {
1402 +ip_set_find_byindex(ip_set_id_t index)
1404 + if (index >= ip_set_max || ip_set_list[index] == NULL)
1405 + index = IP_SET_INVALID_ID;
1411 + * Add, del, test, bind and unbind
1415 +__ip_set_testip(struct ip_set *set,
1422 + read_lock_bh(&set->lock);
1423 + res = set->type->testip(set, data, size, ip);
1424 + read_unlock_bh(&set->lock);
1430 +__ip_set_addip(ip_set_id_t index,
1434 + struct ip_set *set = ip_set_list[index];
1438 + IP_SET_ASSERT(set);
1440 + write_lock_bh(&set->lock);
1441 + res = set->type->addip(set, data, size, &ip);
1442 + write_unlock_bh(&set->lock);
1443 + } while (res == -EAGAIN
1444 + && set->type->retry
1445 + && (res = set->type->retry(set)) == 0);
1451 +ip_set_addip(ip_set_id_t index,
1456 + return __ip_set_addip(index,
1457 + data + sizeof(struct ip_set_req_adt),
1458 + size - sizeof(struct ip_set_req_adt));
1462 +ip_set_delip(ip_set_id_t index,
1466 + struct ip_set *set = ip_set_list[index];
1470 + IP_SET_ASSERT(set);
1471 + write_lock_bh(&set->lock);
1472 + res = set->type->delip(set,
1473 + data + sizeof(struct ip_set_req_adt),
1474 + size - sizeof(struct ip_set_req_adt),
1476 + write_unlock_bh(&set->lock);
1482 +ip_set_testip(ip_set_id_t index,
1486 + struct ip_set *set = ip_set_list[index];
1490 + IP_SET_ASSERT(set);
1491 + res = __ip_set_testip(set,
1492 + data + sizeof(struct ip_set_req_adt),
1493 + size - sizeof(struct ip_set_req_adt),
1496 + return (res > 0 ? -EEXIST : res);
1500 +ip_set_bindip(ip_set_id_t index,
1504 + struct ip_set *set = ip_set_list[index];
1505 + struct ip_set_req_bind *req_bind;
1506 + ip_set_id_t binding;
1510 + IP_SET_ASSERT(set);
1511 + if (size < sizeof(struct ip_set_req_bind))
1514 + req_bind = (struct ip_set_req_bind *) data;
1515 + req_bind->binding[IP_SET_MAXNAMELEN - 1] = '\0';
1517 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1518 + /* Default binding of a set */
1519 + char *binding_name;
1521 + if (size != sizeof(struct ip_set_req_bind) + IP_SET_MAXNAMELEN)
1524 + binding_name = (char *)(data + sizeof(struct ip_set_req_bind));
1525 + binding_name[IP_SET_MAXNAMELEN - 1] = '\0';
1527 + binding = ip_set_find_byname(binding_name);
1528 + if (binding == IP_SET_INVALID_ID)
1531 + write_lock_bh(&ip_set_lock);
1532 + /* Sets as binding values are referenced */
1533 + if (set->binding != IP_SET_INVALID_ID)
1534 + __ip_set_put(set->binding);
1535 + set->binding = binding;
1536 + __ip_set_get(set->binding);
1537 + write_unlock_bh(&ip_set_lock);
1541 + binding = ip_set_find_byname(req_bind->binding);
1542 + if (binding == IP_SET_INVALID_ID)
1545 + res = __ip_set_testip(set,
1546 + data + sizeof(struct ip_set_req_bind),
1547 + size - sizeof(struct ip_set_req_bind),
1549 + DP("set %s, ip: %u.%u.%u.%u, binding %s",
1550 + set->name, HIPQUAD(ip), ip_set_list[binding]->name);
1553 + res = ip_set_hash_add(set->id, ip, binding);
1558 +#define FOREACH_SET_DO(fn, args...) \
1560 + ip_set_id_t __i; \
1561 + struct ip_set *__set; \
1563 + for (__i = 0; __i < ip_set_max; __i++) { \
1564 + __set = ip_set_list[__i]; \
1565 + if (__set != NULL) \
1566 + fn(__set , ##args); \
1571 +__set_hash_del_byid(struct ip_set_hash *set_hash, ip_set_id_t id)
1573 + if (set_hash->id == id)
1574 + __set_hash_del(set_hash);
1578 +__unbind_default(struct ip_set *set)
1580 + if (set->binding != IP_SET_INVALID_ID) {
1581 + /* Sets as binding values are referenced */
1582 + __ip_set_put(set->binding);
1583 + set->binding = IP_SET_INVALID_ID;
1588 +ip_set_unbindip(ip_set_id_t index,
1592 + struct ip_set *set;
1593 + struct ip_set_req_bind *req_bind;
1598 + if (size < sizeof(struct ip_set_req_bind))
1601 + req_bind = (struct ip_set_req_bind *) data;
1602 + req_bind->binding[IP_SET_MAXNAMELEN - 1] = '\0';
1604 + DP("%u %s", index, req_bind->binding);
1605 + if (index == IP_SET_INVALID_ID) {
1606 + /* unbind :all: */
1607 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1608 + /* Default binding of sets */
1609 + write_lock_bh(&ip_set_lock);
1610 + FOREACH_SET_DO(__unbind_default);
1611 + write_unlock_bh(&ip_set_lock);
1613 + } else if (strcmp(req_bind->binding, IPSET_TOKEN_ALL) == 0) {
1614 + /* Flush all bindings of all sets*/
1615 + write_lock_bh(&ip_set_lock);
1616 + FOREACH_HASH_RW_DO(__set_hash_del);
1617 + write_unlock_bh(&ip_set_lock);
1620 + DP("unreachable reached!");
1624 + set = ip_set_list[index];
1625 + IP_SET_ASSERT(set);
1626 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1627 + /* Default binding of set */
1628 + ip_set_id_t binding = ip_set_find_byindex(set->binding);
1630 + if (binding == IP_SET_INVALID_ID)
1633 + write_lock_bh(&ip_set_lock);
1634 + /* Sets in hash values are referenced */
1635 + __ip_set_put(set->binding);
1636 + set->binding = IP_SET_INVALID_ID;
1637 + write_unlock_bh(&ip_set_lock);
1640 + } else if (strcmp(req_bind->binding, IPSET_TOKEN_ALL) == 0) {
1641 + /* Flush all bindings */
1643 + write_lock_bh(&ip_set_lock);
1644 + FOREACH_HASH_RW_DO(__set_hash_del_byid, set->id);
1645 + write_unlock_bh(&ip_set_lock);
1649 + res = __ip_set_testip(set,
1650 + data + sizeof(struct ip_set_req_bind),
1651 + size - sizeof(struct ip_set_req_bind),
1654 + DP("set %s, ip: %u.%u.%u.%u", set->name, HIPQUAD(ip));
1656 + res = ip_set_hash_del(set->id, ip);
1662 +ip_set_testbind(ip_set_id_t index,
1666 + struct ip_set *set = ip_set_list[index];
1667 + struct ip_set_req_bind *req_bind;
1668 + ip_set_id_t binding;
1672 + IP_SET_ASSERT(set);
1673 + if (size < sizeof(struct ip_set_req_bind))
1676 + req_bind = (struct ip_set_req_bind *) data;
1677 + req_bind->binding[IP_SET_MAXNAMELEN - 1] = '\0';
1679 + if (strcmp(req_bind->binding, IPSET_TOKEN_DEFAULT) == 0) {
1680 + /* Default binding of set */
1681 + char *binding_name;
1683 + if (size != sizeof(struct ip_set_req_bind) + IP_SET_MAXNAMELEN)
1686 + binding_name = (char *)(data + sizeof(struct ip_set_req_bind));
1687 + binding_name[IP_SET_MAXNAMELEN - 1] = '\0';
1689 + binding = ip_set_find_byname(binding_name);
1690 + if (binding == IP_SET_INVALID_ID)
1693 + res = (set->binding == binding) ? -EEXIST : 0;
1697 + binding = ip_set_find_byname(req_bind->binding);
1698 + if (binding == IP_SET_INVALID_ID)
1702 + res = __ip_set_testip(set,
1703 + data + sizeof(struct ip_set_req_bind),
1704 + size - sizeof(struct ip_set_req_bind),
1706 + DP("set %s, ip: %u.%u.%u.%u, binding %s",
1707 + set->name, HIPQUAD(ip), ip_set_list[binding]->name);
1710 + res = (ip_set_find_in_hash(set->id, ip) == binding)
1716 +static struct ip_set_type *
1717 +find_set_type_rlock(const char *typename)
1719 + struct ip_set_type *type;
1721 + read_lock_bh(&ip_set_lock);
1722 + type = find_set_type(typename);
1724 + read_unlock_bh(&ip_set_lock);
1730 +find_free_id(const char *name,
1731 + ip_set_id_t *index,
1736 + *id = IP_SET_INVALID_ID;
1737 + for (i = 0; i < ip_set_max; i++) {
1738 + if (ip_set_list[i] == NULL) {
1739 + if (*id == IP_SET_INVALID_ID)
1741 + } else if (strcmp(name, ip_set_list[i]->name) == 0)
1745 + if (*id == IP_SET_INVALID_ID)
1746 + /* No free slot remained */
1748 + /* Check that index is usable as id (swapping) */
1750 + for (i = 0; i < ip_set_max; i++) {
1751 + if (ip_set_list[i] != NULL
1752 + && ip_set_list[i]->id == *id) {
1764 +ip_set_create(const char *name,
1765 + const char *typename,
1766 + ip_set_id_t restore,
1770 + struct ip_set *set;
1771 + ip_set_id_t index = 0, id;
1774 + DP("setname: %s, typename: %s, id: %u", name, typename, restore);
1776 + * First, and without any locks, allocate and initialize
1777 + * a normal base set structure.
1779 + set = kmalloc(sizeof(struct ip_set), GFP_KERNEL);
1782 + set->lock = RW_LOCK_UNLOCKED;
1783 + strncpy(set->name, name, IP_SET_MAXNAMELEN);
1784 + set->binding = IP_SET_INVALID_ID;
1785 + atomic_set(&set->ref, 0);
1788 + * Next, take the &ip_set_lock, check that we know the type,
1789 + * and take a reference on the type, to make sure it
1790 + * stays available while constructing our new set.
1792 + * After referencing the type, we drop the &ip_set_lock,
1793 + * and let the new set construction run without locks.
1795 + set->type = find_set_type_rlock(typename);
1796 + if (set->type == NULL) {
1797 + /* Try loading the module */
1798 + char modulename[IP_SET_MAXNAMELEN + strlen("ip_set_") + 1];
1799 + strcpy(modulename, "ip_set_");
1800 + strcat(modulename, typename);
1801 + DP("try to load %s", modulename);
1802 + request_module(modulename);
1803 + set->type = find_set_type_rlock(typename);
1805 + if (set->type == NULL) {
1806 + ip_set_printk("no set type '%s', set '%s' not created",
1811 + if (!try_module_get(set->type->me)) {
1812 + read_unlock_bh(&ip_set_lock);
1816 + read_unlock_bh(&ip_set_lock);
1819 + * Without holding any locks, create private part.
1821 + res = set->type->create(set, data, size);
1825 + /* BTW, res==0 here. */
1828 + * Here, we have a valid, constructed set. &ip_set_lock again,
1829 + * find free id/index and check that it is not already in
1832 + write_lock_bh(&ip_set_lock);
1833 + if ((res = find_free_id(set->name, &index, &id)) != 0) {
1834 + DP("no free id!");
1838 + /* Make sure restore gets the same index */
1839 + if (restore != IP_SET_INVALID_ID && index != restore) {
1840 + DP("Can't restore, sets are screwed up");
1846 + * Finally! Add our shiny new set to the list, and be done.
1848 + DP("create: '%s' created with index %u, id %u!", set->name, index, id);
1850 + ip_set_list[index] = set;
1851 + write_unlock_bh(&ip_set_lock);
1855 + write_unlock_bh(&ip_set_lock);
1856 + set->type->destroy(set);
1858 + module_put(set->type->me);
1865 + * Destroy a given existing set
1868 +ip_set_destroy_set(ip_set_id_t index)
1870 + struct ip_set *set = ip_set_list[index];
1872 + IP_SET_ASSERT(set);
1873 + DP("set: %s", set->name);
1874 + write_lock_bh(&ip_set_lock);
1875 + FOREACH_HASH_RW_DO(__set_hash_del_byid, set->id);
1876 + if (set->binding != IP_SET_INVALID_ID)
1877 + __ip_set_put(set->binding);
1878 + ip_set_list[index] = NULL;
1879 + write_unlock_bh(&ip_set_lock);
1881 + /* Must call it without holding any lock */
1882 + set->type->destroy(set);
1883 + module_put(set->type->me);
1888 + * Destroy a set - or all sets
1889 + * Sets must not be referenced/used.
1892 +ip_set_destroy(ip_set_id_t index)
1896 + /* ref modification always protected by the mutex */
1897 + if (index != IP_SET_INVALID_ID) {
1898 + if (atomic_read(&ip_set_list[index]->ref))
1900 + ip_set_destroy_set(index);
1902 + for (i = 0; i < ip_set_max; i++) {
1903 + if (ip_set_list[i] != NULL
1904 + && (atomic_read(&ip_set_list[i]->ref)))
1908 + for (i = 0; i < ip_set_max; i++) {
1909 + if (ip_set_list[i] != NULL)
1910 + ip_set_destroy_set(i);
1917 +ip_set_flush_set(struct ip_set *set)
1919 + DP("set: %s %u", set->name, set->id);
1921 + write_lock_bh(&set->lock);
1922 + set->type->flush(set);
1923 + write_unlock_bh(&set->lock);
1927 + * Flush data in a set - or in all sets
1930 +ip_set_flush(ip_set_id_t index)
1932 + if (index != IP_SET_INVALID_ID) {
1933 + IP_SET_ASSERT(ip_set_list[index]);
1934 + ip_set_flush_set(ip_set_list[index]);
1936 + FOREACH_SET_DO(ip_set_flush_set);
1943 +ip_set_rename(ip_set_id_t index, const char *name)
1945 + struct ip_set *set = ip_set_list[index];
1949 + DP("set: %s to %s", set->name, name);
1950 + write_lock_bh(&ip_set_lock);
1951 + for (i = 0; i < ip_set_max; i++) {
1952 + if (ip_set_list[i] != NULL
1953 + && strncmp(ip_set_list[i]->name,
1955 + IP_SET_MAXNAMELEN - 1) == 0) {
1960 + strncpy(set->name, name, IP_SET_MAXNAMELEN);
1962 + write_unlock_bh(&ip_set_lock);
1967 + * Swap two sets so that name/index points to the other.
1968 + * References are also swapped.
1971 +ip_set_swap(ip_set_id_t from_index, ip_set_id_t to_index)
1973 + struct ip_set *from = ip_set_list[from_index];
1974 + struct ip_set *to = ip_set_list[to_index];
1975 + char from_name[IP_SET_MAXNAMELEN];
1976 + u_int32_t from_ref;
1978 + DP("set: %s to %s", from->name, to->name);
1979 + /* Features must not change. Artifical restriction. */
1980 + if (from->type->features != to->type->features)
1983 + /* No magic here: ref munging protected by the mutex */
1984 + write_lock_bh(&ip_set_lock);
1985 + strncpy(from_name, from->name, IP_SET_MAXNAMELEN);
1986 + from_ref = atomic_read(&from->ref);
1988 + strncpy(from->name, to->name, IP_SET_MAXNAMELEN);
1989 + atomic_set(&from->ref, atomic_read(&to->ref));
1990 + strncpy(to->name, from_name, IP_SET_MAXNAMELEN);
1991 + atomic_set(&to->ref, from_ref);
1993 + ip_set_list[from_index] = to;
1994 + ip_set_list[to_index] = from;
1996 + write_unlock_bh(&ip_set_lock);
2005 +__set_hash_bindings_size_list(struct ip_set_hash *set_hash,
2006 + ip_set_id_t id, size_t *size)
2008 + if (set_hash->id == id)
2009 + *size += sizeof(struct ip_set_hash_list);
2013 +__set_hash_bindings_size_save(struct ip_set_hash *set_hash,
2014 + ip_set_id_t id, size_t *size)
2016 + if (set_hash->id == id)
2017 + *size += sizeof(struct ip_set_hash_save);
2021 +__set_hash_bindings(struct ip_set_hash *set_hash,
2022 + ip_set_id_t id, void *data, int *used)
2024 + if (set_hash->id == id) {
2025 + struct ip_set_hash_list *hash_list =
2026 + (struct ip_set_hash_list *)(data + *used);
2028 + hash_list->ip = set_hash->ip;
2029 + hash_list->binding = set_hash->binding;
2030 + *used += sizeof(struct ip_set_hash_list);
2034 +static int ip_set_list_set(ip_set_id_t index,
2039 + struct ip_set *set = ip_set_list[index];
2040 + struct ip_set_list *set_list;
2042 + /* Pointer to our header */
2043 + set_list = (struct ip_set_list *) (data + *used);
2045 + DP("set: %s, used: %d %p %p", set->name, *used, data, data + *used);
2047 + /* Get and ensure header size */
2048 + if (*used + sizeof(struct ip_set_list) > len)
2049 + goto not_enough_mem;
2050 + *used += sizeof(struct ip_set_list);
2052 + read_lock_bh(&set->lock);
2053 + /* Get and ensure set specific header size */
2054 + set_list->header_size = set->type->header_size;
2055 + if (*used + set_list->header_size > len)
2058 + /* Fill in the header */
2059 + set_list->index = index;
2060 + set_list->binding = set->binding;
2061 + set_list->ref = atomic_read(&set->ref);
2063 + /* Fill in set spefific header data */
2064 + set->type->list_header(set, data + *used);
2065 + *used += set_list->header_size;
2067 + /* Get and ensure set specific members size */
2068 + set_list->members_size = set->type->list_members_size(set);
2069 + if (*used + set_list->members_size > len)
2072 + /* Fill in set spefific members data */
2073 + set->type->list_members(set, data + *used);
2074 + *used += set_list->members_size;
2075 + read_unlock_bh(&set->lock);
2079 + /* Get and ensure set specific bindings size */
2080 + set_list->bindings_size = 0;
2081 + FOREACH_HASH_DO(__set_hash_bindings_size_list,
2082 + set->id, &set_list->bindings_size);
2083 + if (*used + set_list->bindings_size > len)
2084 + goto not_enough_mem;
2086 + /* Fill in set spefific bindings data */
2087 + FOREACH_HASH_DO(__set_hash_bindings, set->id, data, used);
2092 + read_unlock_bh(&set->lock);
2094 + DP("not enough mem, try again");
2101 +static int ip_set_save_set(ip_set_id_t index,
2106 + struct ip_set *set;
2107 + struct ip_set_save *set_save;
2109 + /* Pointer to our header */
2110 + set_save = (struct ip_set_save *) (data + *used);
2112 + /* Get and ensure header size */
2113 + if (*used + sizeof(struct ip_set_save) > len)
2114 + goto not_enough_mem;
2115 + *used += sizeof(struct ip_set_save);
2117 + set = ip_set_list[index];
2118 + DP("set: %s, used: %u(%u) %p %p", set->name, *used, len,
2119 + data, data + *used);
2121 + read_lock_bh(&set->lock);
2122 + /* Get and ensure set specific header size */
2123 + set_save->header_size = set->type->header_size;
2124 + if (*used + set_save->header_size > len)
2127 + /* Fill in the header */
2128 + set_save->index = index;
2129 + set_save->binding = set->binding;
2131 + /* Fill in set spefific header data */
2132 + set->type->list_header(set, data + *used);
2133 + *used += set_save->header_size;
2135 + DP("set header filled: %s, used: %u(%u) %p %p", set->name, *used,
2136 + set_save->header_size, data, data + *used);
2137 + /* Get and ensure set specific members size */
2138 + set_save->members_size = set->type->list_members_size(set);
2139 + if (*used + set_save->members_size > len)
2142 + /* Fill in set spefific members data */
2143 + set->type->list_members(set, data + *used);
2144 + *used += set_save->members_size;
2145 + read_unlock_bh(&set->lock);
2146 + DP("set members filled: %s, used: %u(%u) %p %p", set->name, *used,
2147 + set_save->members_size, data, data + *used);
2151 + read_unlock_bh(&set->lock);
2153 + DP("not enough mem, try again");
2158 +__set_hash_save_bindings(struct ip_set_hash *set_hash,
2166 + && (id == IP_SET_INVALID_ID || set_hash->id == id)) {
2167 + struct ip_set_hash_save *hash_save =
2168 + (struct ip_set_hash_save *)(data + *used);
2169 + /* Ensure bindings size */
2170 + if (*used + sizeof(struct ip_set_hash_save) > len) {
2174 + hash_save->id = set_hash->id;
2175 + hash_save->ip = set_hash->ip;
2176 + hash_save->binding = set_hash->binding;
2177 + *used += sizeof(struct ip_set_hash_save);
2181 +static int ip_set_save_bindings(ip_set_id_t index,
2187 + struct ip_set_save *set_save;
2189 + DP("used %u, len %u", *used, len);
2190 + /* Get and ensure header size */
2191 + if (*used + sizeof(struct ip_set_save) > len)
2195 + set_save = (struct ip_set_save *) (data + *used);
2196 + set_save->index = IP_SET_INVALID_ID;
2197 + set_save->header_size = 0;
2198 + set_save->members_size = 0;
2199 + *used += sizeof(struct ip_set_save);
2201 + DP("marker added used %u, len %u", *used, len);
2202 + /* Fill in bindings data */
2203 + if (index != IP_SET_INVALID_ID)
2204 + /* Sets are identified by id in hash */
2205 + index = ip_set_list[index]->id;
2206 + FOREACH_HASH_DO(__set_hash_save_bindings, index, data, used, len, &res);
2214 +static int ip_set_restore(void *data,
2218 + int line = 0, used = 0, members_size;
2219 + struct ip_set *set;
2220 + struct ip_set_hash_save *hash_save;
2221 + struct ip_set_restore *set_restore;
2222 + ip_set_id_t index;
2224 + /* Loop to restore sets */
2228 + DP("%u %u %u", used, sizeof(struct ip_set_restore), len);
2229 + /* Get and ensure header size */
2230 + if (used + sizeof(struct ip_set_restore) > len)
2232 + set_restore = (struct ip_set_restore *) (data + used);
2233 + used += sizeof(struct ip_set_restore);
2235 + /* Ensure data size */
2237 + + set_restore->header_size
2238 + + set_restore->members_size > len)
2241 + /* Check marker */
2242 + if (set_restore->index == IP_SET_INVALID_ID) {
2247 + /* Try to create the set */
2248 + DP("restore %s %s", set_restore->name, set_restore->typename);
2249 + res = ip_set_create(set_restore->name,
2250 + set_restore->typename,
2251 + set_restore->index,
2253 + set_restore->header_size);
2257 + used += set_restore->header_size;
2259 + index = ip_set_find_byindex(set_restore->index);
2260 + DP("index %u, restore_index %u", index, set_restore->index);
2261 + if (index != set_restore->index)
2263 + /* Try to restore members data */
2264 + set = ip_set_list[index];
2266 + DP("members_size %u reqsize %u",
2267 + set_restore->members_size, set->type->reqsize);
2268 + while (members_size + set->type->reqsize <=
2269 + set_restore->members_size) {
2271 + DP("members: %u, line %u", members_size, line);
2272 + res = __ip_set_addip(index,
2273 + data + used + members_size,
2274 + set->type->reqsize);
2275 + if (!(res == 0 || res == -EEXIST))
2277 + members_size += set->type->reqsize;
2280 + DP("members_size %u %u",
2281 + set_restore->members_size, members_size);
2282 + if (members_size != set_restore->members_size)
2284 + used += set_restore->members_size;
2288 + /* Loop to restore bindings */
2289 + while (used < len) {
2292 + DP("restore binding, line %u", line);
2293 + /* Get and ensure size */
2294 + if (used + sizeof(struct ip_set_hash_save) > len)
2296 + hash_save = (struct ip_set_hash_save *) (data + used);
2297 + used += sizeof(struct ip_set_hash_save);
2299 + /* hash_save->id is used to store the index */
2300 + index = ip_set_find_byindex(hash_save->id);
2301 + DP("restore binding index %u, id %u, %u -> %u",
2302 + index, hash_save->id, hash_save->ip, hash_save->binding);
2303 + if (index != hash_save->id)
2305 + if (ip_set_find_byindex(hash_save->binding) == IP_SET_INVALID_ID) {
2306 + DP("corrupt binding set index %u", hash_save->binding);
2309 + set = ip_set_list[hash_save->id];
2310 + /* Null valued IP means default binding */
2311 + if (hash_save->ip)
2312 + res = ip_set_hash_add(set->id,
2314 + hash_save->binding);
2316 + IP_SET_ASSERT(set->binding == IP_SET_INVALID_ID);
2317 + write_lock_bh(&ip_set_lock);
2318 + set->binding = hash_save->binding;
2319 + __ip_set_get(set->binding);
2320 + write_unlock_bh(&ip_set_lock);
2321 + DP("default binding: %u", set->binding);
2333 +ip_set_sockfn_set(struct sock *sk, int optval, void *user, unsigned int len)
2336 + int res = 0; /* Assume OK */
2338 + struct ip_set_req_adt *req_adt;
2339 + ip_set_id_t index = IP_SET_INVALID_ID;
2340 + int (*adtfn)(ip_set_id_t index,
2341 + const void *data, size_t size);
2343 + int (*fn)(ip_set_id_t index,
2344 + const void *data, size_t size);
2346 + { { ip_set_addip }, { ip_set_delip }, { ip_set_testip},
2347 + { ip_set_bindip}, { ip_set_unbindip }, { ip_set_testbind },
2350 + DP("optval=%d, user=%p, len=%d", optval, user, len);
2351 + if (!capable(CAP_NET_ADMIN))
2353 + if (optval != SO_IP_SET)
2355 + if (len <= sizeof(unsigned)) {
2356 + ip_set_printk("short userdata (want >%zu, got %u)",
2357 + sizeof(unsigned), len);
2360 + data = vmalloc(len);
2362 + DP("out of mem for %u bytes", len);
2365 + if (copy_from_user(data, user, len) != 0) {
2369 + if (down_interruptible(&ip_set_app_mutex)) {
2374 + op = (unsigned *)data;
2377 + if (*op < IP_SET_OP_VERSION) {
2378 + /* Check the version at the beginning of operations */
2379 + struct ip_set_req_version *req_version =
2380 + (struct ip_set_req_version *) data;
2381 + if (req_version->version != IP_SET_PROTOCOL_VERSION) {
2388 + case IP_SET_OP_CREATE:{
2389 + struct ip_set_req_create *req_create
2390 + = (struct ip_set_req_create *) data;
2392 + if (len < sizeof(struct ip_set_req_create)) {
2393 + ip_set_printk("short CREATE data (want >=%zu, got %u)",
2394 + sizeof(struct ip_set_req_create), len);
2398 + req_create->name[IP_SET_MAXNAMELEN - 1] = '\0';
2399 + req_create->typename[IP_SET_MAXNAMELEN - 1] = '\0';
2400 + res = ip_set_create(req_create->name,
2401 + req_create->typename,
2402 + IP_SET_INVALID_ID,
2403 + data + sizeof(struct ip_set_req_create),
2404 + len - sizeof(struct ip_set_req_create));
2407 + case IP_SET_OP_DESTROY:{
2408 + struct ip_set_req_std *req_destroy
2409 + = (struct ip_set_req_std *) data;
2411 + if (len != sizeof(struct ip_set_req_std)) {
2412 + ip_set_printk("invalid DESTROY data (want %zu, got %u)",
2413 + sizeof(struct ip_set_req_std), len);
2417 + if (strcmp(req_destroy->name, IPSET_TOKEN_ALL) == 0) {
2418 + /* Destroy all sets */
2419 + index = IP_SET_INVALID_ID;
2421 + req_destroy->name[IP_SET_MAXNAMELEN - 1] = '\0';
2422 + index = ip_set_find_byname(req_destroy->name);
2424 + if (index == IP_SET_INVALID_ID) {
2430 + res = ip_set_destroy(index);
2433 + case IP_SET_OP_FLUSH:{
2434 + struct ip_set_req_std *req_flush =
2435 + (struct ip_set_req_std *) data;
2437 + if (len != sizeof(struct ip_set_req_std)) {
2438 + ip_set_printk("invalid FLUSH data (want %zu, got %u)",
2439 + sizeof(struct ip_set_req_std), len);
2443 + if (strcmp(req_flush->name, IPSET_TOKEN_ALL) == 0) {
2444 + /* Flush all sets */
2445 + index = IP_SET_INVALID_ID;
2447 + req_flush->name[IP_SET_MAXNAMELEN - 1] = '\0';
2448 + index = ip_set_find_byname(req_flush->name);
2450 + if (index == IP_SET_INVALID_ID) {
2455 + res = ip_set_flush(index);
2458 + case IP_SET_OP_RENAME:{
2459 + struct ip_set_req_create *req_rename
2460 + = (struct ip_set_req_create *) data;
2462 + if (len != sizeof(struct ip_set_req_create)) {
2463 + ip_set_printk("invalid RENAME data (want %zu, got %u)",
2464 + sizeof(struct ip_set_req_create), len);
2469 + req_rename->name[IP_SET_MAXNAMELEN - 1] = '\0';
2470 + req_rename->typename[IP_SET_MAXNAMELEN - 1] = '\0';
2472 + index = ip_set_find_byname(req_rename->name);
2473 + if (index == IP_SET_INVALID_ID) {
2477 + res = ip_set_rename(index, req_rename->typename);
2480 + case IP_SET_OP_SWAP:{
2481 + struct ip_set_req_create *req_swap
2482 + = (struct ip_set_req_create *) data;
2483 + ip_set_id_t to_index;
2485 + if (len != sizeof(struct ip_set_req_create)) {
2486 + ip_set_printk("invalid SWAP data (want %zu, got %u)",
2487 + sizeof(struct ip_set_req_create), len);
2492 + req_swap->name[IP_SET_MAXNAMELEN - 1] = '\0';
2493 + req_swap->typename[IP_SET_MAXNAMELEN - 1] = '\0';
2495 + index = ip_set_find_byname(req_swap->name);
2496 + if (index == IP_SET_INVALID_ID) {
2500 + to_index = ip_set_find_byname(req_swap->typename);
2501 + if (to_index == IP_SET_INVALID_ID) {
2505 + res = ip_set_swap(index, to_index);
2509 + break; /* Set identified by id */
2512 + /* There we may have add/del/test/bind/unbind/test_bind operations */
2513 + if (*op < IP_SET_OP_ADD_IP || *op > IP_SET_OP_TEST_BIND_SET) {
2517 + adtfn = adtfn_table[*op - IP_SET_OP_ADD_IP].fn;
2519 + if (len < sizeof(struct ip_set_req_adt)) {
2520 + ip_set_printk("short data in adt request (want >=%zu, got %u)",
2521 + sizeof(struct ip_set_req_adt), len);
2525 + req_adt = (struct ip_set_req_adt *) data;
2527 + /* -U :all: :all:|:default: uses IP_SET_INVALID_ID */
2528 + if (!(*op == IP_SET_OP_UNBIND_SET
2529 + && req_adt->index == IP_SET_INVALID_ID)) {
2530 + index = ip_set_find_byindex(req_adt->index);
2531 + if (index == IP_SET_INVALID_ID) {
2536 + res = adtfn(index, data, len);
2539 + up(&ip_set_app_mutex);
2543 + DP("final result %d", res);
2548 +ip_set_sockfn_get(struct sock *sk, int optval, void *user, int *len)
2552 + ip_set_id_t index = IP_SET_INVALID_ID;
2554 + int copylen = *len;
2556 + DP("optval=%d, user=%p, len=%d", optval, user, *len);
2557 + if (!capable(CAP_NET_ADMIN))
2559 + if (optval != SO_IP_SET)
2561 + if (*len < sizeof(unsigned)) {
2562 + ip_set_printk("short userdata (want >=%zu, got %d)",
2563 + sizeof(unsigned), *len);
2566 + data = vmalloc(*len);
2568 + DP("out of mem for %d bytes", *len);
2571 + if (copy_from_user(data, user, *len) != 0) {
2575 + if (down_interruptible(&ip_set_app_mutex)) {
2580 + op = (unsigned *) data;
2583 + if (*op < IP_SET_OP_VERSION) {
2584 + /* Check the version at the beginning of operations */
2585 + struct ip_set_req_version *req_version =
2586 + (struct ip_set_req_version *) data;
2587 + if (req_version->version != IP_SET_PROTOCOL_VERSION) {
2594 + case IP_SET_OP_VERSION: {
2595 + struct ip_set_req_version *req_version =
2596 + (struct ip_set_req_version *) data;
2598 + if (*len != sizeof(struct ip_set_req_version)) {
2599 + ip_set_printk("invalid VERSION (want %zu, got %d)",
2600 + sizeof(struct ip_set_req_version),
2606 + req_version->version = IP_SET_PROTOCOL_VERSION;
2607 + res = copy_to_user(user, req_version,
2608 + sizeof(struct ip_set_req_version));
2611 + case IP_SET_OP_GET_BYNAME: {
2612 + struct ip_set_req_get_set *req_get
2613 + = (struct ip_set_req_get_set *) data;
2615 + if (*len != sizeof(struct ip_set_req_get_set)) {
2616 + ip_set_printk("invalid GET_BYNAME (want %zu, got %d)",
2617 + sizeof(struct ip_set_req_get_set), *len);
2621 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2622 + index = ip_set_find_byname(req_get->set.name);
2623 + req_get->set.index = index;
2626 + case IP_SET_OP_GET_BYINDEX: {
2627 + struct ip_set_req_get_set *req_get
2628 + = (struct ip_set_req_get_set *) data;
2630 + if (*len != sizeof(struct ip_set_req_get_set)) {
2631 + ip_set_printk("invalid GET_BYINDEX (want %zu, got %d)",
2632 + sizeof(struct ip_set_req_get_set), *len);
2636 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2637 + index = ip_set_find_byindex(req_get->set.index);
2638 + strncpy(req_get->set.name,
2639 + index == IP_SET_INVALID_ID ? ""
2640 + : ip_set_list[index]->name, IP_SET_MAXNAMELEN);
2643 + case IP_SET_OP_ADT_GET: {
2644 + struct ip_set_req_adt_get *req_get
2645 + = (struct ip_set_req_adt_get *) data;
2647 + if (*len != sizeof(struct ip_set_req_adt_get)) {
2648 + ip_set_printk("invalid ADT_GET (want %zu, got %d)",
2649 + sizeof(struct ip_set_req_adt_get), *len);
2653 + req_get->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2654 + index = ip_set_find_byname(req_get->set.name);
2655 + if (index != IP_SET_INVALID_ID) {
2656 + req_get->set.index = index;
2657 + strncpy(req_get->typename,
2658 + ip_set_list[index]->type->typename,
2659 + IP_SET_MAXNAMELEN - 1);
2666 + case IP_SET_OP_MAX_SETS: {
2667 + struct ip_set_req_max_sets *req_max_sets
2668 + = (struct ip_set_req_max_sets *) data;
2671 + if (*len != sizeof(struct ip_set_req_max_sets)) {
2672 + ip_set_printk("invalid MAX_SETS (want %zu, got %d)",
2673 + sizeof(struct ip_set_req_max_sets), *len);
2678 + if (strcmp(req_max_sets->set.name, IPSET_TOKEN_ALL) == 0) {
2679 + req_max_sets->set.index = IP_SET_INVALID_ID;
2681 + req_max_sets->set.name[IP_SET_MAXNAMELEN - 1] = '\0';
2682 + req_max_sets->set.index =
2683 + ip_set_find_byname(req_max_sets->set.name);
2684 + if (req_max_sets->set.index == IP_SET_INVALID_ID) {
2689 + req_max_sets->max_sets = ip_set_max;
2690 + req_max_sets->sets = 0;
2691 + for (i = 0; i < ip_set_max; i++) {
2692 + if (ip_set_list[i] != NULL)
2693 + req_max_sets->sets++;
2697 + case IP_SET_OP_LIST_SIZE:
2698 + case IP_SET_OP_SAVE_SIZE: {
2699 + struct ip_set_req_setnames *req_setnames
2700 + = (struct ip_set_req_setnames *) data;
2701 + struct ip_set_name_list *name_list;
2702 + struct ip_set *set;
2706 + if (*len < sizeof(struct ip_set_req_setnames)) {
2707 + ip_set_printk("short LIST_SIZE (want >=%zu, got %d)",
2708 + sizeof(struct ip_set_req_setnames), *len);
2713 + req_setnames->size = 0;
2714 + used = sizeof(struct ip_set_req_setnames);
2715 + for (i = 0; i < ip_set_max; i++) {
2716 + if (ip_set_list[i] == NULL)
2718 + name_list = (struct ip_set_name_list *)
2720 + used += sizeof(struct ip_set_name_list);
2721 + if (used > copylen) {
2725 + set = ip_set_list[i];
2726 + /* Fill in index, name, etc. */
2727 + name_list->index = i;
2728 + name_list->id = set->id;
2729 + strncpy(name_list->name,
2731 + IP_SET_MAXNAMELEN - 1);
2732 + strncpy(name_list->typename,
2733 + set->type->typename,
2734 + IP_SET_MAXNAMELEN - 1);
2735 + DP("filled %s of type %s, index %u\n",
2736 + name_list->name, name_list->typename,
2737 + name_list->index);
2738 + if (!(req_setnames->index == IP_SET_INVALID_ID
2739 + || req_setnames->index == i))
2743 + case IP_SET_OP_LIST_SIZE: {
2744 + req_setnames->size += sizeof(struct ip_set_list)
2745 + + set->type->header_size
2746 + + set->type->list_members_size(set);
2747 + /* Sets are identified by id in the hash */
2748 + FOREACH_HASH_DO(__set_hash_bindings_size_list,
2749 + set->id, &req_setnames->size);
2752 + case IP_SET_OP_SAVE_SIZE: {
2753 + req_setnames->size += sizeof(struct ip_set_save)
2754 + + set->type->header_size
2755 + + set->type->list_members_size(set);
2756 + FOREACH_HASH_DO(__set_hash_bindings_size_save,
2757 + set->id, &req_setnames->size);
2764 + if (copylen != used) {
2770 + case IP_SET_OP_LIST: {
2771 + struct ip_set_req_list *req_list
2772 + = (struct ip_set_req_list *) data;
2776 + if (*len < sizeof(struct ip_set_req_list)) {
2777 + ip_set_printk("short LIST (want >=%zu, got %d)",
2778 + sizeof(struct ip_set_req_list), *len);
2782 + index = req_list->index;
2783 + if (index != IP_SET_INVALID_ID
2784 + && ip_set_find_byindex(index) != index) {
2789 + if (index == IP_SET_INVALID_ID) {
2790 + /* List all sets */
2791 + for (i = 0; i < ip_set_max && res == 0; i++) {
2792 + if (ip_set_list[i] != NULL)
2793 + res = ip_set_list_set(i, data, &used, *len);
2796 + /* List an individual set */
2797 + res = ip_set_list_set(index, data, &used, *len);
2801 + else if (copylen != used) {
2807 + case IP_SET_OP_SAVE: {
2808 + struct ip_set_req_list *req_save
2809 + = (struct ip_set_req_list *) data;
2813 + if (*len < sizeof(struct ip_set_req_list)) {
2814 + ip_set_printk("short SAVE (want >=%zu, got %d)",
2815 + sizeof(struct ip_set_req_list), *len);
2819 + index = req_save->index;
2820 + if (index != IP_SET_INVALID_ID
2821 + && ip_set_find_byindex(index) != index) {
2826 + if (index == IP_SET_INVALID_ID) {
2827 + /* Save all sets */
2828 + for (i = 0; i < ip_set_max && res == 0; i++) {
2829 + if (ip_set_list[i] != NULL)
2830 + res = ip_set_save_set(i, data, &used, *len);
2833 + /* Save an individual set */
2834 + res = ip_set_save_set(index, data, &used, *len);
2837 + res = ip_set_save_bindings(index, data, &used, *len);
2841 + else if (copylen != used) {
2847 + case IP_SET_OP_RESTORE: {
2848 + struct ip_set_req_setnames *req_restore
2849 + = (struct ip_set_req_setnames *) data;
2852 + if (*len < sizeof(struct ip_set_req_setnames)
2853 + || *len != req_restore->size) {
2854 + ip_set_printk("invalid RESTORE (want =%zu, got %d)",
2855 + req_restore->size, *len);
2859 + line = ip_set_restore(data + sizeof(struct ip_set_req_setnames),
2860 + req_restore->size - sizeof(struct ip_set_req_setnames));
2861 + DP("ip_set_restore: %u", line);
2864 + req_restore->size = line;
2865 + copylen = sizeof(struct ip_set_req_setnames);
2873 + } /* end of switch(op) */
2876 + DP("set %s, copylen %u", index != IP_SET_INVALID_ID
2877 + && ip_set_list[index]
2878 + ? ip_set_list[index]->name
2879 + : ":all:", copylen);
2880 + res = copy_to_user(user, data, copylen);
2883 + up(&ip_set_app_mutex);
2887 + DP("final result %d", res);
2891 +static struct nf_sockopt_ops so_set = {
2893 + .set_optmin = SO_IP_SET,
2894 + .set_optmax = SO_IP_SET + 1,
2895 + .set = &ip_set_sockfn_set,
2896 + .get_optmin = SO_IP_SET,
2897 + .get_optmax = SO_IP_SET + 1,
2898 + .get = &ip_set_sockfn_get,
2902 +static int max_sets, hash_size;
2903 +module_param(max_sets, int, 0600);
2904 +MODULE_PARM_DESC(max_sets, "maximal number of sets");
2905 +module_param(hash_size, int, 0600);
2906 +MODULE_PARM_DESC(hash_size, "hash size for bindings");
2907 +MODULE_LICENSE("GPL");
2908 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
2909 +MODULE_DESCRIPTION("module implementing core IP set support");
2911 +static int __init init(void)
2916 + get_random_bytes(&ip_set_hash_random, 4);
2918 + ip_set_max = max_sets;
2919 + ip_set_list = vmalloc(sizeof(struct ip_set *) * ip_set_max);
2920 + if (!ip_set_list) {
2921 + printk(KERN_ERR "Unable to create ip_set_list\n");
2924 + memset(ip_set_list, 0, sizeof(struct ip_set *) * ip_set_max);
2926 + ip_set_bindings_hash_size = hash_size;
2927 + ip_set_hash = vmalloc(sizeof(struct list_head) * ip_set_bindings_hash_size);
2928 + if (!ip_set_hash) {
2929 + printk(KERN_ERR "Unable to create ip_set_hash\n");
2930 + vfree(ip_set_list);
2933 + for (i = 0; i < ip_set_bindings_hash_size; i++)
2934 + INIT_LIST_HEAD(&ip_set_hash[i]);
2936 + INIT_LIST_HEAD(&set_type_list);
2938 + res = nf_register_sockopt(&so_set);
2940 + ip_set_printk("SO_SET registry failed: %d", res);
2941 + vfree(ip_set_list);
2942 + vfree(ip_set_hash);
2948 +static void __exit fini(void)
2950 + /* There can't be any existing set or binding */
2951 + nf_unregister_sockopt(&so_set);
2952 + vfree(ip_set_list);
2953 + vfree(ip_set_hash);
2954 + DP("these are the famous last words");
2957 +EXPORT_SYMBOL(ip_set_register_set_type);
2958 +EXPORT_SYMBOL(ip_set_unregister_set_type);
2960 +EXPORT_SYMBOL(ip_set_get_byname);
2961 +EXPORT_SYMBOL(ip_set_get_byindex);
2962 +EXPORT_SYMBOL(ip_set_put);
2964 +EXPORT_SYMBOL(ip_set_addip_kernel);
2965 +EXPORT_SYMBOL(ip_set_delip_kernel);
2966 +EXPORT_SYMBOL(ip_set_testip_kernel);
2970 Index: linux-2.6.23-rc6/net/ipv4/netfilter/ip_set_iphash.c
2971 ===================================================================
2972 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
2973 +++ linux-2.6.23-rc6/net/ipv4/netfilter/ip_set_iphash.c 2007-09-21 16:24:01.000000000 +0800
2975 +/* Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
2977 + * This program is free software; you can redistribute it and/or modify
2978 + * it under the terms of the GNU General Public License version 2 as
2979 + * published by the Free Software Foundation.
2982 +/* Kernel module implementing an ip hash set */
2984 +#include <linux/module.h>
2985 +#include <linux/ip.h>
2986 +#include <linux/skbuff.h>
2987 +#include <linux/netfilter_ipv4/ip_tables.h>
2988 +#include <linux/netfilter_ipv4/ip_set.h>
2989 +#include <linux/errno.h>
2990 +#include <asm/uaccess.h>
2991 +#include <asm/bitops.h>
2992 +#include <linux/spinlock.h>
2993 +#include <linux/vmalloc.h>
2994 +#include <linux/random.h>
2995 +#include <linux/jhash.h>
2997 +#include <net/ip.h>
2999 +#include <linux/netfilter_ipv4/ip_set_malloc.h>
3000 +#include <linux/netfilter_ipv4/ip_set_iphash.h>
3002 +static int limit = MAX_RANGE;
3004 +static inline __u32
3005 +jhash_ip(const struct ip_set_iphash *map, uint16_t i, ip_set_ip_t ip)
3007 + return jhash_1word(ip, *(((uint32_t *) map->initval) + i));
3010 +static inline __u32
3011 +hash_id(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3013 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3016 + ip_set_ip_t *elem;
3018 + *hash_ip = ip & map->netmask;
3019 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u, %u.%u.%u.%u",
3020 + set->name, HIPQUAD(ip), HIPQUAD(*hash_ip), HIPQUAD(map->netmask));
3022 + for (i = 0; i < map->probes; i++) {
3023 + id = jhash_ip(map, i, *hash_ip) % map->hashsize;
3024 + DP("hash key: %u", id);
3025 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
3026 + if (*elem == *hash_ip)
3028 + /* No shortcut at testing - there can be deleted
3035 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3037 + return (ip && hash_id(set, ip, hash_ip) != UINT_MAX);
3041 +testip(struct ip_set *set, const void *data, size_t size,
3042 + ip_set_ip_t *hash_ip)
3044 + struct ip_set_req_iphash *req =
3045 + (struct ip_set_req_iphash *) data;
3047 + if (size != sizeof(struct ip_set_req_iphash)) {
3048 + ip_set_printk("data length wrong (want %zu, have %zu)",
3049 + sizeof(struct ip_set_req_iphash),
3053 + return __testip(set, req->ip, hash_ip);
3057 +testip_kernel(struct ip_set *set,
3058 + const struct sk_buff *skb,
3059 + ip_set_ip_t *hash_ip,
3060 + const u_int32_t *flags,
3061 + unsigned char index)
3063 + return __testip(set,
3064 + ntohl(flags[index] & IPSET_SRC
3065 + ? ip_hdr(skb)->saddr
3066 + : ip_hdr(skb)->daddr),
3071 +__addip(struct ip_set_iphash *map, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3075 + ip_set_ip_t *elem;
3077 + if (!ip || map->elements > limit)
3080 + *hash_ip = ip & map->netmask;
3082 + for (i = 0; i < map->probes; i++) {
3083 + probe = jhash_ip(map, i, *hash_ip) % map->hashsize;
3084 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, probe);
3085 + if (*elem == *hash_ip)
3093 + /* Trigger rehashing */
3098 +addip(struct ip_set *set, const void *data, size_t size,
3099 + ip_set_ip_t *hash_ip)
3101 + struct ip_set_req_iphash *req =
3102 + (struct ip_set_req_iphash *) data;
3104 + if (size != sizeof(struct ip_set_req_iphash)) {
3105 + ip_set_printk("data length wrong (want %zu, have %zu)",
3106 + sizeof(struct ip_set_req_iphash),
3110 + return __addip((struct ip_set_iphash *) set->data, req->ip, hash_ip);
3114 +addip_kernel(struct ip_set *set,
3115 + const struct sk_buff *skb,
3116 + ip_set_ip_t *hash_ip,
3117 + const u_int32_t *flags,
3118 + unsigned char index)
3120 + return __addip((struct ip_set_iphash *) set->data,
3121 + ntohl(flags[index] & IPSET_SRC
3122 + ? ip_hdr(skb)->saddr
3123 + : ip_hdr(skb)->daddr),
3127 +static int retry(struct ip_set *set)
3129 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3130 + ip_set_ip_t hash_ip, *elem;
3132 + u_int32_t i, hashsize = map->hashsize;
3134 + struct ip_set_iphash *tmp;
3136 + if (map->resize == 0)
3142 + /* Calculate new hash size */
3143 + hashsize += (hashsize * map->resize)/100;
3144 + if (hashsize == map->hashsize)
3147 + ip_set_printk("rehashing of set %s triggered: "
3148 + "hashsize grows from %u to %u",
3149 + set->name, map->hashsize, hashsize);
3151 + tmp = kmalloc(sizeof(struct ip_set_iphash)
3152 + + map->probes * sizeof(uint32_t), GFP_ATOMIC);
3154 + DP("out of memory for %d bytes",
3155 + sizeof(struct ip_set_iphash)
3156 + + map->probes * sizeof(uint32_t));
3159 + tmp->members = harray_malloc(hashsize, sizeof(ip_set_ip_t), GFP_ATOMIC);
3160 + if (!tmp->members) {
3161 + DP("out of memory for %d bytes", hashsize * sizeof(ip_set_ip_t));
3165 + tmp->hashsize = hashsize;
3166 + tmp->elements = 0;
3167 + tmp->probes = map->probes;
3168 + tmp->resize = map->resize;
3169 + tmp->netmask = map->netmask;
3170 + memcpy(tmp->initval, map->initval, map->probes * sizeof(uint32_t));
3172 + write_lock_bh(&set->lock);
3173 + map = (struct ip_set_iphash *) set->data; /* Play safe */
3174 + for (i = 0; i < map->hashsize && res == 0; i++) {
3175 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, i);
3177 + res = __addip(tmp, *elem, &hash_ip);
3180 + /* Failure, try again */
3181 + write_unlock_bh(&set->lock);
3182 + harray_free(tmp->members);
3187 + /* Success at resizing! */
3188 + members = map->members;
3190 + map->hashsize = tmp->hashsize;
3191 + map->members = tmp->members;
3192 + write_unlock_bh(&set->lock);
3194 + harray_free(members);
3201 +__delip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3203 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3204 + ip_set_ip_t id, *elem;
3209 + id = hash_id(set, ip, hash_ip);
3210 + if (id == UINT_MAX)
3213 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
3221 +delip(struct ip_set *set, const void *data, size_t size,
3222 + ip_set_ip_t *hash_ip)
3224 + struct ip_set_req_iphash *req =
3225 + (struct ip_set_req_iphash *) data;
3227 + if (size != sizeof(struct ip_set_req_iphash)) {
3228 + ip_set_printk("data length wrong (want %zu, have %zu)",
3229 + sizeof(struct ip_set_req_iphash),
3233 + return __delip(set, req->ip, hash_ip);
3237 +delip_kernel(struct ip_set *set,
3238 + const struct sk_buff *skb,
3239 + ip_set_ip_t *hash_ip,
3240 + const u_int32_t *flags,
3241 + unsigned char index)
3243 + return __delip(set,
3244 + ntohl(flags[index] & IPSET_SRC
3245 + ? ip_hdr(skb)->saddr
3246 + : ip_hdr(skb)->daddr),
3250 +static int create(struct ip_set *set, const void *data, size_t size)
3252 + struct ip_set_req_iphash_create *req =
3253 + (struct ip_set_req_iphash_create *) data;
3254 + struct ip_set_iphash *map;
3257 + if (size != sizeof(struct ip_set_req_iphash_create)) {
3258 + ip_set_printk("data length wrong (want %zu, have %zu)",
3259 + sizeof(struct ip_set_req_iphash_create),
3264 + if (req->hashsize < 1) {
3265 + ip_set_printk("hashsize too small");
3269 + if (req->probes < 1) {
3270 + ip_set_printk("probes too small");
3274 + map = kmalloc(sizeof(struct ip_set_iphash)
3275 + + req->probes * sizeof(uint32_t), GFP_KERNEL);
3277 + DP("out of memory for %d bytes",
3278 + sizeof(struct ip_set_iphash)
3279 + + req->probes * sizeof(uint32_t));
3282 + for (i = 0; i < req->probes; i++)
3283 + get_random_bytes(((uint32_t *) map->initval)+i, 4);
3284 + map->elements = 0;
3285 + map->hashsize = req->hashsize;
3286 + map->probes = req->probes;
3287 + map->resize = req->resize;
3288 + map->netmask = req->netmask;
3289 + map->members = harray_malloc(map->hashsize, sizeof(ip_set_ip_t), GFP_KERNEL);
3290 + if (!map->members) {
3291 + DP("out of memory for %d bytes", map->hashsize * sizeof(ip_set_ip_t));
3300 +static void destroy(struct ip_set *set)
3302 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3304 + harray_free(map->members);
3310 +static void flush(struct ip_set *set)
3312 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3313 + harray_flush(map->members, map->hashsize, sizeof(ip_set_ip_t));
3314 + map->elements = 0;
3317 +static void list_header(const struct ip_set *set, void *data)
3319 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3320 + struct ip_set_req_iphash_create *header =
3321 + (struct ip_set_req_iphash_create *) data;
3323 + header->hashsize = map->hashsize;
3324 + header->probes = map->probes;
3325 + header->resize = map->resize;
3326 + header->netmask = map->netmask;
3329 +static int list_members_size(const struct ip_set *set)
3331 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3333 + return (map->hashsize * sizeof(ip_set_ip_t));
3336 +static void list_members(const struct ip_set *set, void *data)
3338 + struct ip_set_iphash *map = (struct ip_set_iphash *) set->data;
3339 + ip_set_ip_t i, *elem;
3341 + for (i = 0; i < map->hashsize; i++) {
3342 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, i);
3343 + ((ip_set_ip_t *)data)[i] = *elem;
3347 +static struct ip_set_type ip_set_iphash = {
3348 + .typename = SETTYPE_NAME,
3349 + .features = IPSET_TYPE_IP | IPSET_DATA_SINGLE,
3350 + .protocol_version = IP_SET_PROTOCOL_VERSION,
3351 + .create = &create,
3352 + .destroy = &destroy,
3354 + .reqsize = sizeof(struct ip_set_req_iphash),
3356 + .addip_kernel = &addip_kernel,
3359 + .delip_kernel = &delip_kernel,
3360 + .testip = &testip,
3361 + .testip_kernel = &testip_kernel,
3362 + .header_size = sizeof(struct ip_set_req_iphash_create),
3363 + .list_header = &list_header,
3364 + .list_members_size = &list_members_size,
3365 + .list_members = &list_members,
3366 + .me = THIS_MODULE,
3369 +MODULE_LICENSE("GPL");
3370 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
3371 +MODULE_DESCRIPTION("iphash type of IP sets");
3372 +module_param(limit, int, 0600);
3373 +MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
3375 +static int __init init(void)
3377 + return ip_set_register_set_type(&ip_set_iphash);
3380 +static void __exit fini(void)
3382 + /* FIXME: possible race with ip_set_create() */
3383 + ip_set_unregister_set_type(&ip_set_iphash);
3388 Index: linux-2.6.23-rc6/net/ipv4/netfilter/ip_set_ipmap.c
3389 ===================================================================
3390 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
3391 +++ linux-2.6.23-rc6/net/ipv4/netfilter/ip_set_ipmap.c 2007-09-21 16:24:01.000000000 +0800
3393 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
3394 + * Patrick Schaaf <bof@bof.de>
3395 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
3397 + * This program is free software; you can redistribute it and/or modify
3398 + * it under the terms of the GNU General Public License version 2 as
3399 + * published by the Free Software Foundation.
3402 +/* Kernel module implementing an IP set type: the single bitmap type */
3404 +#include <linux/module.h>
3405 +#include <linux/ip.h>
3406 +#include <linux/skbuff.h>
3407 +#include <linux/netfilter_ipv4/ip_tables.h>
3408 +#include <linux/netfilter_ipv4/ip_set.h>
3409 +#include <linux/errno.h>
3410 +#include <asm/uaccess.h>
3411 +#include <asm/bitops.h>
3412 +#include <linux/spinlock.h>
3413 +#include <linux/skbuff.h>
3414 +#include <linux/netfilter_ipv4/ip_set_ipmap.h>
3416 +static inline ip_set_ip_t
3417 +ip_to_id(const struct ip_set_ipmap *map, ip_set_ip_t ip)
3419 + return (ip - map->first_ip)/map->hosts;
3423 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3425 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3427 + if (ip < map->first_ip || ip > map->last_ip)
3430 + *hash_ip = ip & map->netmask;
3431 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u",
3432 + set->name, HIPQUAD(ip), HIPQUAD(*hash_ip));
3433 + return !!test_bit(ip_to_id(map, *hash_ip), map->members);
3437 +testip(struct ip_set *set, const void *data, size_t size,
3438 + ip_set_ip_t *hash_ip)
3440 + struct ip_set_req_ipmap *req =
3441 + (struct ip_set_req_ipmap *) data;
3443 + if (size != sizeof(struct ip_set_req_ipmap)) {
3444 + ip_set_printk("data length wrong (want %zu, have %zu)",
3445 + sizeof(struct ip_set_req_ipmap),
3449 + return __testip(set, req->ip, hash_ip);
3453 +testip_kernel(struct ip_set *set,
3454 + const struct sk_buff *skb,
3455 + ip_set_ip_t *hash_ip,
3456 + const u_int32_t *flags,
3457 + unsigned char index)
3461 + DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
3462 + flags[index] & IPSET_SRC ? "SRC" : "DST",
3463 + NIPQUAD(ip_hdr(skb)->saddr),
3464 + NIPQUAD(ip_hdr(skb)->daddr));
3466 + res = __testip(set,
3467 + ntohl(flags[index] & IPSET_SRC
3468 + ? ip_hdr(skb)->saddr
3469 + : ip_hdr(skb)->daddr),
3471 + return (res < 0 ? 0 : res);
3475 +__addip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3477 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3479 + if (ip < map->first_ip || ip > map->last_ip)
3482 + *hash_ip = ip & map->netmask;
3483 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
3484 + if (test_and_set_bit(ip_to_id(map, *hash_ip), map->members))
3491 +addip(struct ip_set *set, const void *data, size_t size,
3492 + ip_set_ip_t *hash_ip)
3494 + struct ip_set_req_ipmap *req =
3495 + (struct ip_set_req_ipmap *) data;
3497 + if (size != sizeof(struct ip_set_req_ipmap)) {
3498 + ip_set_printk("data length wrong (want %zu, have %zu)",
3499 + sizeof(struct ip_set_req_ipmap),
3503 + DP("%u.%u.%u.%u", HIPQUAD(req->ip));
3504 + return __addip(set, req->ip, hash_ip);
3508 +addip_kernel(struct ip_set *set,
3509 + const struct sk_buff *skb,
3510 + ip_set_ip_t *hash_ip,
3511 + const u_int32_t *flags,
3512 + unsigned char index)
3514 + return __addip(set,
3515 + ntohl(flags[index] & IPSET_SRC
3516 + ? ip_hdr(skb)->saddr
3517 + : ip_hdr(skb)->daddr),
3522 +__delip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
3524 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3526 + if (ip < map->first_ip || ip > map->last_ip)
3529 + *hash_ip = ip & map->netmask;
3530 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
3531 + if (!test_and_clear_bit(ip_to_id(map, *hash_ip), map->members))
3538 +delip(struct ip_set *set, const void *data, size_t size,
3539 + ip_set_ip_t *hash_ip)
3541 + struct ip_set_req_ipmap *req =
3542 + (struct ip_set_req_ipmap *) data;
3544 + if (size != sizeof(struct ip_set_req_ipmap)) {
3545 + ip_set_printk("data length wrong (want %zu, have %zu)",
3546 + sizeof(struct ip_set_req_ipmap),
3550 + return __delip(set, req->ip, hash_ip);
3554 +delip_kernel(struct ip_set *set,
3555 + const struct sk_buff *skb,
3556 + ip_set_ip_t *hash_ip,
3557 + const u_int32_t *flags,
3558 + unsigned char index)
3560 + return __delip(set,
3561 + ntohl(flags[index] & IPSET_SRC
3562 + ? ip_hdr(skb)->saddr
3563 + : ip_hdr(skb)->daddr),
3567 +static int create(struct ip_set *set, const void *data, size_t size)
3570 + struct ip_set_req_ipmap_create *req =
3571 + (struct ip_set_req_ipmap_create *) data;
3572 + struct ip_set_ipmap *map;
3574 + if (size != sizeof(struct ip_set_req_ipmap_create)) {
3575 + ip_set_printk("data length wrong (want %zu, have %zu)",
3576 + sizeof(struct ip_set_req_ipmap_create),
3581 + DP("from %u.%u.%u.%u to %u.%u.%u.%u",
3582 + HIPQUAD(req->from), HIPQUAD(req->to));
3584 + if (req->from > req->to) {
3585 + DP("bad ip range");
3589 + map = kmalloc(sizeof(struct ip_set_ipmap), GFP_KERNEL);
3591 + DP("out of memory for %d bytes",
3592 + sizeof(struct ip_set_ipmap));
3595 + map->first_ip = req->from;
3596 + map->last_ip = req->to;
3597 + map->netmask = req->netmask;
3599 + if (req->netmask == 0xFFFFFFFF) {
3601 + map->sizeid = map->last_ip - map->first_ip + 1;
3603 + unsigned int mask_bits, netmask_bits;
3606 + map->first_ip &= map->netmask; /* Should we better bark? */
3608 + mask = range_to_mask(map->first_ip, map->last_ip, &mask_bits);
3609 + netmask_bits = mask_to_bits(map->netmask);
3611 + if ((!mask && (map->first_ip || map->last_ip != 0xFFFFFFFF))
3612 + || netmask_bits <= mask_bits)
3615 + DP("mask_bits %u, netmask_bits %u",
3616 + mask_bits, netmask_bits);
3617 + map->hosts = 2 << (32 - netmask_bits - 1);
3618 + map->sizeid = 2 << (netmask_bits - mask_bits - 1);
3620 + if (map->sizeid > MAX_RANGE + 1) {
3621 + ip_set_printk("range too big (max %d addresses)",
3626 + DP("hosts %u, sizeid %u", map->hosts, map->sizeid);
3627 + newbytes = bitmap_bytes(0, map->sizeid - 1);
3628 + map->members = kmalloc(newbytes, GFP_KERNEL);
3629 + if (!map->members) {
3630 + DP("out of memory for %d bytes", newbytes);
3634 + memset(map->members, 0, newbytes);
3640 +static void destroy(struct ip_set *set)
3642 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3644 + kfree(map->members);
3650 +static void flush(struct ip_set *set)
3652 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3653 + memset(map->members, 0, bitmap_bytes(0, map->sizeid - 1));
3656 +static void list_header(const struct ip_set *set, void *data)
3658 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3659 + struct ip_set_req_ipmap_create *header =
3660 + (struct ip_set_req_ipmap_create *) data;
3662 + header->from = map->first_ip;
3663 + header->to = map->last_ip;
3664 + header->netmask = map->netmask;
3667 +static int list_members_size(const struct ip_set *set)
3669 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3671 + return bitmap_bytes(0, map->sizeid - 1);
3674 +static void list_members(const struct ip_set *set, void *data)
3676 + struct ip_set_ipmap *map = (struct ip_set_ipmap *) set->data;
3677 + int bytes = bitmap_bytes(0, map->sizeid - 1);
3679 + memcpy(data, map->members, bytes);
3682 +static struct ip_set_type ip_set_ipmap = {
3683 + .typename = SETTYPE_NAME,
3684 + .features = IPSET_TYPE_IP | IPSET_DATA_SINGLE,
3685 + .protocol_version = IP_SET_PROTOCOL_VERSION,
3686 + .create = &create,
3687 + .destroy = &destroy,
3689 + .reqsize = sizeof(struct ip_set_req_ipmap),
3691 + .addip_kernel = &addip_kernel,
3693 + .delip_kernel = &delip_kernel,
3694 + .testip = &testip,
3695 + .testip_kernel = &testip_kernel,
3696 + .header_size = sizeof(struct ip_set_req_ipmap_create),
3697 + .list_header = &list_header,
3698 + .list_members_size = &list_members_size,
3699 + .list_members = &list_members,
3700 + .me = THIS_MODULE,
3703 +MODULE_LICENSE("GPL");
3704 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
3705 +MODULE_DESCRIPTION("ipmap type of IP sets");
3707 +static int __init init(void)
3709 + return ip_set_register_set_type(&ip_set_ipmap);
3712 +static void __exit fini(void)
3714 + /* FIXME: possible race with ip_set_create() */
3715 + ip_set_unregister_set_type(&ip_set_ipmap);
3720 Index: linux-2.6.23-rc6/net/ipv4/netfilter/ip_set_ipporthash.c
3721 ===================================================================
3722 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
3723 +++ linux-2.6.23-rc6/net/ipv4/netfilter/ip_set_ipporthash.c 2007-09-21 16:24:01.000000000 +0800
3725 +/* Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
3727 + * This program is free software; you can redistribute it and/or modify
3728 + * it under the terms of the GNU General Public License version 2 as
3729 + * published by the Free Software Foundation.
3732 +/* Kernel module implementing an ip+port hash set */
3734 +#include <linux/module.h>
3735 +#include <linux/ip.h>
3736 +#include <linux/tcp.h>
3737 +#include <linux/udp.h>
3738 +#include <linux/skbuff.h>
3739 +#include <linux/netfilter_ipv4/ip_tables.h>
3740 +#include <linux/netfilter_ipv4/ip_set.h>
3741 +#include <linux/errno.h>
3742 +#include <asm/uaccess.h>
3743 +#include <asm/bitops.h>
3744 +#include <linux/spinlock.h>
3745 +#include <linux/vmalloc.h>
3746 +#include <linux/random.h>
3747 +#include <linux/jhash.h>
3749 +#include <net/ip.h>
3751 +#include <linux/netfilter_ipv4/ip_set_malloc.h>
3752 +#include <linux/netfilter_ipv4/ip_set_ipporthash.h>
3754 +static int limit = MAX_RANGE;
3756 +/* We must handle non-linear skbs */
3757 +static inline ip_set_ip_t
3758 +get_port(const struct sk_buff *skb, u_int32_t flags)
3760 + struct iphdr *iph = ip_hdr(skb);
3761 + u_int16_t offset = ntohs(iph->frag_off) & IP_OFFSET;
3763 + switch (iph->protocol) {
3764 + case IPPROTO_TCP: {
3765 + struct tcphdr tcph;
3767 + /* See comments at tcp_match in ip_tables.c */
3769 + return INVALID_PORT;
3771 + if (skb_copy_bits(skb, ip_hdrlen(skb), &tcph, sizeof(tcph)) < 0)
3772 + /* No choice either */
3773 + return INVALID_PORT;
3775 + return ntohs(flags & IPSET_SRC ?
3776 + tcph.source : tcph.dest);
3778 + case IPPROTO_UDP: {
3779 + struct udphdr udph;
3782 + return INVALID_PORT;
3784 + if (skb_copy_bits(skb, ip_hdrlen(skb), &udph, sizeof(udph)) < 0)
3785 + /* No choice either */
3786 + return INVALID_PORT;
3788 + return ntohs(flags & IPSET_SRC ?
3789 + udph.source : udph.dest);
3792 + return INVALID_PORT;
3796 +static inline __u32
3797 +jhash_ip(const struct ip_set_ipporthash *map, uint16_t i, ip_set_ip_t ip)
3799 + return jhash_1word(ip, *(((uint32_t *) map->initval) + i));
3802 +#define HASH_IP(map, ip, port) (port + ((ip - ((map)->first_ip)) << 16))
3804 +static inline __u32
3805 +hash_id(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t port,
3806 + ip_set_ip_t *hash_ip)
3808 + struct ip_set_ipporthash *map =
3809 + (struct ip_set_ipporthash *) set->data;
3812 + ip_set_ip_t *elem;
3814 + *hash_ip = HASH_IP(map, ip, port);
3815 + DP("set: %s, ipport:%u.%u.%u.%u:%u, %u.%u.%u.%u",
3816 + set->name, HIPQUAD(ip), port, HIPQUAD(*hash_ip));
3818 + for (i = 0; i < map->probes; i++) {
3819 + id = jhash_ip(map, i, *hash_ip) % map->hashsize;
3820 + DP("hash key: %u", id);
3821 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
3822 + if (*elem == *hash_ip)
3824 + /* No shortcut at testing - there can be deleted
3831 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t port,
3832 + ip_set_ip_t *hash_ip)
3834 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
3836 + if (ip < map->first_ip || ip > map->last_ip)
3839 + return (hash_id(set, ip, port, hash_ip) != UINT_MAX);
3843 +testip(struct ip_set *set, const void *data, size_t size,
3844 + ip_set_ip_t *hash_ip)
3846 + struct ip_set_req_ipporthash *req =
3847 + (struct ip_set_req_ipporthash *) data;
3849 + if (size != sizeof(struct ip_set_req_ipporthash)) {
3850 + ip_set_printk("data length wrong (want %zu, have %zu)",
3851 + sizeof(struct ip_set_req_ipporthash),
3855 + return __testip(set, req->ip, req->port, hash_ip);
3859 +testip_kernel(struct ip_set *set,
3860 + const struct sk_buff *skb,
3861 + ip_set_ip_t *hash_ip,
3862 + const u_int32_t *flags,
3863 + unsigned char index)
3867 + if (flags[index+1] == 0)
3870 + port = get_port(skb, flags[index+1]);
3872 + DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
3873 + flags[index] & IPSET_SRC ? "SRC" : "DST",
3874 + NIPQUAD(ip_hdr(skb)->saddr),
3875 + NIPQUAD(ip_hdr(skb)->daddr));
3876 + DP("flag %s port %u",
3877 + flags[index+1] & IPSET_SRC ? "SRC" : "DST",
3879 + if (port == INVALID_PORT)
3882 + return __testip(set,
3883 + ntohl(flags[index] & IPSET_SRC
3884 + ? ip_hdr(skb)->saddr
3885 + : ip_hdr(skb)->daddr),
3891 +__add_haship(struct ip_set_ipporthash *map, ip_set_ip_t hash_ip)
3895 + ip_set_ip_t *elem;
3897 + for (i = 0; i < map->probes; i++) {
3898 + probe = jhash_ip(map, i, hash_ip) % map->hashsize;
3899 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, probe);
3900 + if (*elem == hash_ip)
3908 + /* Trigger rehashing */
3913 +__addip(struct ip_set_ipporthash *map, ip_set_ip_t ip, ip_set_ip_t port,
3914 + ip_set_ip_t *hash_ip)
3916 + if (map->elements > limit)
3918 + if (ip < map->first_ip || ip > map->last_ip)
3921 + *hash_ip = HASH_IP(map, ip, port);
3923 + return __add_haship(map, *hash_ip);
3927 +addip(struct ip_set *set, const void *data, size_t size,
3928 + ip_set_ip_t *hash_ip)
3930 + struct ip_set_req_ipporthash *req =
3931 + (struct ip_set_req_ipporthash *) data;
3933 + if (size != sizeof(struct ip_set_req_ipporthash)) {
3934 + ip_set_printk("data length wrong (want %zu, have %zu)",
3935 + sizeof(struct ip_set_req_ipporthash),
3939 + return __addip((struct ip_set_ipporthash *) set->data,
3940 + req->ip, req->port, hash_ip);
3944 +addip_kernel(struct ip_set *set,
3945 + const struct sk_buff *skb,
3946 + ip_set_ip_t *hash_ip,
3947 + const u_int32_t *flags,
3948 + unsigned char index)
3952 + if (flags[index+1] == 0)
3955 + port = get_port(skb, flags[index+1]);
3957 + DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
3958 + flags[index] & IPSET_SRC ? "SRC" : "DST",
3959 + NIPQUAD(ip_hdr(skb)->saddr),
3960 + NIPQUAD(ip_hdr(skb)->daddr));
3961 + DP("flag %s port %u",
3962 + flags[index+1] & IPSET_SRC ? "SRC" : "DST",
3964 + if (port == INVALID_PORT)
3967 + return __addip((struct ip_set_ipporthash *) set->data,
3968 + ntohl(flags[index] & IPSET_SRC
3969 + ? ip_hdr(skb)->saddr
3970 + : ip_hdr(skb)->daddr),
3975 +static int retry(struct ip_set *set)
3977 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
3978 + ip_set_ip_t *elem;
3980 + u_int32_t i, hashsize = map->hashsize;
3982 + struct ip_set_ipporthash *tmp;
3984 + if (map->resize == 0)
3990 + /* Calculate new hash size */
3991 + hashsize += (hashsize * map->resize)/100;
3992 + if (hashsize == map->hashsize)
3995 + ip_set_printk("rehashing of set %s triggered: "
3996 + "hashsize grows from %u to %u",
3997 + set->name, map->hashsize, hashsize);
3999 + tmp = kmalloc(sizeof(struct ip_set_ipporthash)
4000 + + map->probes * sizeof(uint32_t), GFP_ATOMIC);
4002 + DP("out of memory for %d bytes",
4003 + sizeof(struct ip_set_ipporthash)
4004 + + map->probes * sizeof(uint32_t));
4007 + tmp->members = harray_malloc(hashsize, sizeof(ip_set_ip_t), GFP_ATOMIC);
4008 + if (!tmp->members) {
4009 + DP("out of memory for %d bytes", hashsize * sizeof(ip_set_ip_t));
4013 + tmp->hashsize = hashsize;
4014 + tmp->elements = 0;
4015 + tmp->probes = map->probes;
4016 + tmp->resize = map->resize;
4017 + tmp->first_ip = map->first_ip;
4018 + tmp->last_ip = map->last_ip;
4019 + memcpy(tmp->initval, map->initval, map->probes * sizeof(uint32_t));
4021 + write_lock_bh(&set->lock);
4022 + map = (struct ip_set_ipporthash *) set->data; /* Play safe */
4023 + for (i = 0; i < map->hashsize && res == 0; i++) {
4024 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, i);
4026 + res = __add_haship(tmp, *elem);
4029 + /* Failure, try again */
4030 + write_unlock_bh(&set->lock);
4031 + harray_free(tmp->members);
4036 + /* Success at resizing! */
4037 + members = map->members;
4039 + map->hashsize = tmp->hashsize;
4040 + map->members = tmp->members;
4041 + write_unlock_bh(&set->lock);
4043 + harray_free(members);
4050 +__delip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t port,
4051 + ip_set_ip_t *hash_ip)
4053 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
4055 + ip_set_ip_t *elem;
4057 + if (ip < map->first_ip || ip > map->last_ip)
4060 + id = hash_id(set, ip, port, hash_ip);
4062 + if (id == UINT_MAX)
4065 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
4073 +delip(struct ip_set *set, const void *data, size_t size,
4074 + ip_set_ip_t *hash_ip)
4076 + struct ip_set_req_ipporthash *req =
4077 + (struct ip_set_req_ipporthash *) data;
4079 + if (size != sizeof(struct ip_set_req_ipporthash)) {
4080 + ip_set_printk("data length wrong (want %zu, have %zu)",
4081 + sizeof(struct ip_set_req_ipporthash),
4085 + return __delip(set, req->ip, req->port, hash_ip);
4089 +delip_kernel(struct ip_set *set,
4090 + const struct sk_buff *skb,
4091 + ip_set_ip_t *hash_ip,
4092 + const u_int32_t *flags,
4093 + unsigned char index)
4097 + if (flags[index+1] == 0)
4100 + port = get_port(skb, flags[index+1]);
4102 + DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
4103 + flags[index] & IPSET_SRC ? "SRC" : "DST",
4104 + NIPQUAD(ip_hdr(skb)->saddr),
4105 + NIPQUAD(ip_hdr(skb)->daddr));
4106 + DP("flag %s port %u",
4107 + flags[index+1] & IPSET_SRC ? "SRC" : "DST",
4109 + if (port == INVALID_PORT)
4112 + return __delip(set,
4113 + ntohl(flags[index] & IPSET_SRC
4114 + ? ip_hdr(skb)->saddr
4115 + : ip_hdr(skb)->daddr),
4120 +static int create(struct ip_set *set, const void *data, size_t size)
4122 + struct ip_set_req_ipporthash_create *req =
4123 + (struct ip_set_req_ipporthash_create *) data;
4124 + struct ip_set_ipporthash *map;
4127 + if (size != sizeof(struct ip_set_req_ipporthash_create)) {
4128 + ip_set_printk("data length wrong (want %zu, have %zu)",
4129 + sizeof(struct ip_set_req_ipporthash_create),
4134 + if (req->hashsize < 1) {
4135 + ip_set_printk("hashsize too small");
4139 + if (req->probes < 1) {
4140 + ip_set_printk("probes too small");
4144 + map = kmalloc(sizeof(struct ip_set_ipporthash)
4145 + + req->probes * sizeof(uint32_t), GFP_KERNEL);
4147 + DP("out of memory for %d bytes",
4148 + sizeof(struct ip_set_ipporthash)
4149 + + req->probes * sizeof(uint32_t));
4152 + for (i = 0; i < req->probes; i++)
4153 + get_random_bytes(((uint32_t *) map->initval)+i, 4);
4154 + map->elements = 0;
4155 + map->hashsize = req->hashsize;
4156 + map->probes = req->probes;
4157 + map->resize = req->resize;
4158 + map->first_ip = req->from;
4159 + map->last_ip = req->to;
4160 + map->members = harray_malloc(map->hashsize, sizeof(ip_set_ip_t), GFP_KERNEL);
4161 + if (!map->members) {
4162 + DP("out of memory for %d bytes", map->hashsize * sizeof(ip_set_ip_t));
4171 +static void destroy(struct ip_set *set)
4173 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
4175 + harray_free(map->members);
4181 +static void flush(struct ip_set *set)
4183 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
4184 + harray_flush(map->members, map->hashsize, sizeof(ip_set_ip_t));
4185 + map->elements = 0;
4188 +static void list_header(const struct ip_set *set, void *data)
4190 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
4191 + struct ip_set_req_ipporthash_create *header =
4192 + (struct ip_set_req_ipporthash_create *) data;
4194 + header->hashsize = map->hashsize;
4195 + header->probes = map->probes;
4196 + header->resize = map->resize;
4197 + header->from = map->first_ip;
4198 + header->to = map->last_ip;
4201 +static int list_members_size(const struct ip_set *set)
4203 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
4205 + return (map->hashsize * sizeof(ip_set_ip_t));
4208 +static void list_members(const struct ip_set *set, void *data)
4210 + struct ip_set_ipporthash *map = (struct ip_set_ipporthash *) set->data;
4211 + ip_set_ip_t i, *elem;
4213 + for (i = 0; i < map->hashsize; i++) {
4214 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, i);
4215 + ((ip_set_ip_t *)data)[i] = *elem;
4219 +static struct ip_set_type ip_set_ipporthash = {
4220 + .typename = SETTYPE_NAME,
4221 + .features = IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_DATA_DOUBLE,
4222 + .protocol_version = IP_SET_PROTOCOL_VERSION,
4223 + .create = &create,
4224 + .destroy = &destroy,
4226 + .reqsize = sizeof(struct ip_set_req_ipporthash),
4228 + .addip_kernel = &addip_kernel,
4231 + .delip_kernel = &delip_kernel,
4232 + .testip = &testip,
4233 + .testip_kernel = &testip_kernel,
4234 + .header_size = sizeof(struct ip_set_req_ipporthash_create),
4235 + .list_header = &list_header,
4236 + .list_members_size = &list_members_size,
4237 + .list_members = &list_members,
4238 + .me = THIS_MODULE,
4241 +MODULE_LICENSE("GPL");
4242 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
4243 +MODULE_DESCRIPTION("ipporthash type of IP sets");
4244 +module_param(limit, int, 0600);
4245 +MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
4247 +static int __init init(void)
4249 + return ip_set_register_set_type(&ip_set_ipporthash);
4252 +static void __exit fini(void)
4254 + /* FIXME: possible race with ip_set_create() */
4255 + ip_set_unregister_set_type(&ip_set_ipporthash);
4260 Index: linux-2.6.23-rc6/net/ipv4/netfilter/ip_set_iptree.c
4261 ===================================================================
4262 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
4263 +++ linux-2.6.23-rc6/net/ipv4/netfilter/ip_set_iptree.c 2007-09-21 16:24:01.000000000 +0800
4265 +/* Copyright (C) 2005 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
4267 + * This program is free software; you can redistribute it and/or modify
4268 + * it under the terms of the GNU General Public License version 2 as
4269 + * published by the Free Software Foundation.
4272 +/* Kernel module implementing an IP set type: the iptree type */
4274 +#include <linux/version.h>
4275 +#include <linux/module.h>
4276 +#include <linux/ip.h>
4277 +#include <linux/skbuff.h>
4278 +#include <linux/slab.h>
4279 +#include <linux/delay.h>
4280 +#include <linux/netfilter_ipv4/ip_tables.h>
4281 +#include <linux/netfilter_ipv4/ip_set.h>
4282 +#include <linux/errno.h>
4283 +#include <asm/uaccess.h>
4284 +#include <asm/bitops.h>
4285 +#include <linux/spinlock.h>
4287 +/* Backward compatibility */
4292 +#include <linux/netfilter_ipv4/ip_set_iptree.h>
4294 +static int limit = MAX_RANGE;
4296 +/* Garbage collection interval in seconds: */
4297 +#define IPTREE_GC_TIME 5*60
4298 +/* Sleep so many milliseconds before trying again
4299 + * to delete the gc timer at destroying/flushing a set */
4300 +#define IPTREE_DESTROY_SLEEP 100
4302 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
4303 +static struct kmem_cache *branch_cachep;
4304 +static struct kmem_cache *leaf_cachep;
4306 +static kmem_cache_t *branch_cachep;
4307 +static kmem_cache_t *leaf_cachep;
4310 +#define ABCD(a,b,c,d,addrp) do { \
4311 + a = ((unsigned char *)addrp)[3]; \
4312 + b = ((unsigned char *)addrp)[2]; \
4313 + c = ((unsigned char *)addrp)[1]; \
4314 + d = ((unsigned char *)addrp)[0]; \
4317 +#define TESTIP_WALK(map, elem, branch) do { \
4318 + if ((map)->tree[elem]) { \
4319 + branch = (map)->tree[elem]; \
4325 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
4327 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4328 + struct ip_set_iptreeb *btree;
4329 + struct ip_set_iptreec *ctree;
4330 + struct ip_set_iptreed *dtree;
4331 + unsigned char a,b,c,d;
4337 + ABCD(a, b, c, d, hash_ip);
4338 + DP("%u %u %u %u timeout %u", a, b, c, d, map->timeout);
4339 + TESTIP_WALK(map, a, btree);
4340 + TESTIP_WALK(btree, b, ctree);
4341 + TESTIP_WALK(ctree, c, dtree);
4342 + DP("%lu %lu", dtree->expires[d], jiffies);
4343 + return !!(map->timeout ? (time_after(dtree->expires[d], jiffies))
4344 + : dtree->expires[d]);
4348 +testip(struct ip_set *set, const void *data, size_t size,
4349 + ip_set_ip_t *hash_ip)
4351 + struct ip_set_req_iptree *req =
4352 + (struct ip_set_req_iptree *) data;
4354 + if (size != sizeof(struct ip_set_req_iptree)) {
4355 + ip_set_printk("data length wrong (want %zu, have %zu)",
4356 + sizeof(struct ip_set_req_iptree),
4360 + return __testip(set, req->ip, hash_ip);
4364 +testip_kernel(struct ip_set *set,
4365 + const struct sk_buff *skb,
4366 + ip_set_ip_t *hash_ip,
4367 + const u_int32_t *flags,
4368 + unsigned char index)
4372 + DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
4373 + flags[index] & IPSET_SRC ? "SRC" : "DST",
4374 + NIPQUAD(ip_hdr(skb)->saddr),
4375 + NIPQUAD(ip_hdr(skb)->daddr));
4377 + res = __testip(set,
4378 + ntohl(flags[index] & IPSET_SRC
4379 + ? ip_hdr(skb)->saddr
4380 + : ip_hdr(skb)->daddr),
4382 + return (res < 0 ? 0 : res);
4385 +#define ADDIP_WALK(map, elem, branch, type, cachep, flags) do { \
4386 + if ((map)->tree[elem]) { \
4387 + DP("found %u", elem); \
4388 + branch = (map)->tree[elem]; \
4390 + branch = (type *) \
4391 + kmem_cache_alloc(cachep, flags); \
4392 + if (branch == NULL) \
4394 + memset(branch, 0, sizeof(*branch)); \
4395 + (map)->tree[elem] = branch; \
4396 + DP("alloc %u", elem); \
4401 +__addip(struct ip_set *set, ip_set_ip_t ip, unsigned int timeout,
4402 + ip_set_ip_t *hash_ip,
4403 + unsigned int __nocast flags)
4405 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4406 + struct ip_set_iptreeb *btree;
4407 + struct ip_set_iptreec *ctree;
4408 + struct ip_set_iptreed *dtree;
4409 + unsigned char a,b,c,d;
4412 + if (!ip || map->elements > limit)
4413 + /* We could call the garbage collector
4414 + * but it's probably overkill */
4418 + ABCD(a, b, c, d, hash_ip);
4419 + DP("%u %u %u %u timeout %u", a, b, c, d, timeout);
4420 + ADDIP_WALK(map, a, btree, struct ip_set_iptreeb, branch_cachep, flags);
4421 + ADDIP_WALK(btree, b, ctree, struct ip_set_iptreec, branch_cachep, flags);
4422 + ADDIP_WALK(ctree, c, dtree, struct ip_set_iptreed, leaf_cachep, flags);
4423 + if (dtree->expires[d]
4424 + && (!map->timeout || time_after(dtree->expires[d], jiffies)))
4426 + dtree->expires[d] = map->timeout ? (timeout * HZ + jiffies) : 1;
4428 + if (dtree->expires[d] == 0)
4429 + dtree->expires[d] = 1;
4430 + DP("%u %lu", d, dtree->expires[d]);
4437 +addip(struct ip_set *set, const void *data, size_t size,
4438 + ip_set_ip_t *hash_ip)
4440 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4441 + struct ip_set_req_iptree *req =
4442 + (struct ip_set_req_iptree *) data;
4444 + if (size != sizeof(struct ip_set_req_iptree)) {
4445 + ip_set_printk("data length wrong (want %zu, have %zu)",
4446 + sizeof(struct ip_set_req_iptree),
4450 + DP("%u.%u.%u.%u %u", HIPQUAD(req->ip), req->timeout);
4451 + return __addip(set, req->ip,
4452 + req->timeout ? req->timeout : map->timeout,
4458 +addip_kernel(struct ip_set *set,
4459 + const struct sk_buff *skb,
4460 + ip_set_ip_t *hash_ip,
4461 + const u_int32_t *flags,
4462 + unsigned char index)
4464 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4466 + return __addip(set,
4467 + ntohl(flags[index] & IPSET_SRC
4468 + ? ip_hdr(skb)->saddr
4469 + : ip_hdr(skb)->daddr),
4475 +#define DELIP_WALK(map, elem, branch) do { \
4476 + if ((map)->tree[elem]) { \
4477 + branch = (map)->tree[elem]; \
4483 +__delip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
4485 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4486 + struct ip_set_iptreeb *btree;
4487 + struct ip_set_iptreec *ctree;
4488 + struct ip_set_iptreed *dtree;
4489 + unsigned char a,b,c,d;
4495 + ABCD(a, b, c, d, hash_ip);
4496 + DELIP_WALK(map, a, btree);
4497 + DELIP_WALK(btree, b, ctree);
4498 + DELIP_WALK(ctree, c, dtree);
4500 + if (dtree->expires[d]) {
4501 + dtree->expires[d] = 0;
4509 +delip(struct ip_set *set, const void *data, size_t size,
4510 + ip_set_ip_t *hash_ip)
4512 + struct ip_set_req_iptree *req =
4513 + (struct ip_set_req_iptree *) data;
4515 + if (size != sizeof(struct ip_set_req_iptree)) {
4516 + ip_set_printk("data length wrong (want %zu, have %zu)",
4517 + sizeof(struct ip_set_req_iptree),
4521 + return __delip(set, req->ip, hash_ip);
4525 +delip_kernel(struct ip_set *set,
4526 + const struct sk_buff *skb,
4527 + ip_set_ip_t *hash_ip,
4528 + const u_int32_t *flags,
4529 + unsigned char index)
4531 + return __delip(set,
4532 + ntohl(flags[index] & IPSET_SRC
4533 + ? ip_hdr(skb)->saddr
4534 + : ip_hdr(skb)->daddr),
4538 +#define LOOP_WALK_BEGIN(map, i, branch) \
4539 + for (i = 0; i < 256; i++) { \
4540 + if (!(map)->tree[i]) \
4542 + branch = (map)->tree[i]
4544 +#define LOOP_WALK_END }
4546 +static void ip_tree_gc(unsigned long ul_set)
4548 + struct ip_set *set = (void *) ul_set;
4549 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4550 + struct ip_set_iptreeb *btree;
4551 + struct ip_set_iptreec *ctree;
4552 + struct ip_set_iptreed *dtree;
4553 + unsigned int a,b,c,d;
4554 + unsigned char i,j,k;
4557 + DP("gc: %s", set->name);
4558 + write_lock_bh(&set->lock);
4559 + LOOP_WALK_BEGIN(map, a, btree);
4560 + LOOP_WALK_BEGIN(btree, b, ctree);
4561 + LOOP_WALK_BEGIN(ctree, c, dtree);
4562 + for (d = 0; d < 256; d++) {
4563 + if (dtree->expires[d]) {
4564 + DP("gc: %u %u %u %u: expires %lu jiffies %lu",
4566 + dtree->expires[d], jiffies);
4568 + && time_before(dtree->expires[d], jiffies)) {
4569 + dtree->expires[d] = 0;
4576 + DP("gc: %s: leaf %u %u %u empty",
4577 + set->name, a, b, c);
4578 + kmem_cache_free(leaf_cachep, dtree);
4579 + ctree->tree[c] = NULL;
4581 + DP("gc: %s: leaf %u %u %u not empty",
4582 + set->name, a, b, c);
4588 + DP("gc: %s: branch %u %u empty",
4590 + kmem_cache_free(branch_cachep, ctree);
4591 + btree->tree[b] = NULL;
4593 + DP("gc: %s: branch %u %u not empty",
4600 + DP("gc: %s: branch %u empty",
4602 + kmem_cache_free(branch_cachep, btree);
4603 + map->tree[a] = NULL;
4605 + DP("gc: %s: branch %u not empty",
4610 + write_unlock_bh(&set->lock);
4612 + map->gc.expires = jiffies + map->gc_interval * HZ;
4613 + add_timer(&map->gc);
4616 +static inline void init_gc_timer(struct ip_set *set)
4618 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4620 + /* Even if there is no timeout for the entries,
4621 + * we still have to call gc because delete
4622 + * do not clean up empty branches */
4623 + map->gc_interval = IPTREE_GC_TIME;
4624 + init_timer(&map->gc);
4625 + map->gc.data = (unsigned long) set;
4626 + map->gc.function = ip_tree_gc;
4627 + map->gc.expires = jiffies + map->gc_interval * HZ;
4628 + add_timer(&map->gc);
4631 +static int create(struct ip_set *set, const void *data, size_t size)
4633 + struct ip_set_req_iptree_create *req =
4634 + (struct ip_set_req_iptree_create *) data;
4635 + struct ip_set_iptree *map;
4637 + if (size != sizeof(struct ip_set_req_iptree_create)) {
4638 + ip_set_printk("data length wrong (want %zu, have %zu)",
4639 + sizeof(struct ip_set_req_iptree_create),
4644 + map = kmalloc(sizeof(struct ip_set_iptree), GFP_KERNEL);
4646 + DP("out of memory for %d bytes",
4647 + sizeof(struct ip_set_iptree));
4650 + memset(map, 0, sizeof(*map));
4651 + map->timeout = req->timeout;
4652 + map->elements = 0;
4655 + init_gc_timer(set);
4660 +static void __flush(struct ip_set_iptree *map)
4662 + struct ip_set_iptreeb *btree;
4663 + struct ip_set_iptreec *ctree;
4664 + struct ip_set_iptreed *dtree;
4665 + unsigned int a,b,c;
4667 + LOOP_WALK_BEGIN(map, a, btree);
4668 + LOOP_WALK_BEGIN(btree, b, ctree);
4669 + LOOP_WALK_BEGIN(ctree, c, dtree);
4670 + kmem_cache_free(leaf_cachep, dtree);
4672 + kmem_cache_free(branch_cachep, ctree);
4674 + kmem_cache_free(branch_cachep, btree);
4676 + map->elements = 0;
4679 +static void destroy(struct ip_set *set)
4681 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4683 + /* gc might be running */
4684 + while (!del_timer(&map->gc))
4685 + msleep(IPTREE_DESTROY_SLEEP);
4691 +static void flush(struct ip_set *set)
4693 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4694 + unsigned int timeout = map->timeout;
4696 + /* gc might be running */
4697 + while (!del_timer(&map->gc))
4698 + msleep(IPTREE_DESTROY_SLEEP);
4700 + memset(map, 0, sizeof(*map));
4701 + map->timeout = timeout;
4703 + init_gc_timer(set);
4706 +static void list_header(const struct ip_set *set, void *data)
4708 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4709 + struct ip_set_req_iptree_create *header =
4710 + (struct ip_set_req_iptree_create *) data;
4712 + header->timeout = map->timeout;
4715 +static int list_members_size(const struct ip_set *set)
4717 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4718 + struct ip_set_iptreeb *btree;
4719 + struct ip_set_iptreec *ctree;
4720 + struct ip_set_iptreed *dtree;
4721 + unsigned int a,b,c,d;
4722 + unsigned int count = 0;
4724 + LOOP_WALK_BEGIN(map, a, btree);
4725 + LOOP_WALK_BEGIN(btree, b, ctree);
4726 + LOOP_WALK_BEGIN(ctree, c, dtree);
4727 + for (d = 0; d < 256; d++) {
4728 + if (dtree->expires[d]
4729 + && (!map->timeout || time_after(dtree->expires[d], jiffies)))
4736 + DP("members %u", count);
4737 + return (count * sizeof(struct ip_set_req_iptree));
4740 +static void list_members(const struct ip_set *set, void *data)
4742 + struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
4743 + struct ip_set_iptreeb *btree;
4744 + struct ip_set_iptreec *ctree;
4745 + struct ip_set_iptreed *dtree;
4746 + unsigned int a,b,c,d;
4747 + size_t offset = 0;
4748 + struct ip_set_req_iptree *entry;
4750 + LOOP_WALK_BEGIN(map, a, btree);
4751 + LOOP_WALK_BEGIN(btree, b, ctree);
4752 + LOOP_WALK_BEGIN(ctree, c, dtree);
4753 + for (d = 0; d < 256; d++) {
4754 + if (dtree->expires[d]
4755 + && (!map->timeout || time_after(dtree->expires[d], jiffies))) {
4756 + entry = (struct ip_set_req_iptree *)(data + offset);
4757 + entry->ip = ((a << 24) | (b << 16) | (c << 8) | d);
4758 + entry->timeout = !map->timeout ? 0
4759 + : (dtree->expires[d] - jiffies)/HZ;
4760 + offset += sizeof(struct ip_set_req_iptree);
4768 +static struct ip_set_type ip_set_iptree = {
4769 + .typename = SETTYPE_NAME,
4770 + .features = IPSET_TYPE_IP | IPSET_DATA_SINGLE,
4771 + .protocol_version = IP_SET_PROTOCOL_VERSION,
4772 + .create = &create,
4773 + .destroy = &destroy,
4775 + .reqsize = sizeof(struct ip_set_req_iptree),
4777 + .addip_kernel = &addip_kernel,
4779 + .delip_kernel = &delip_kernel,
4780 + .testip = &testip,
4781 + .testip_kernel = &testip_kernel,
4782 + .header_size = sizeof(struct ip_set_req_iptree_create),
4783 + .list_header = &list_header,
4784 + .list_members_size = &list_members_size,
4785 + .list_members = &list_members,
4786 + .me = THIS_MODULE,
4789 +MODULE_LICENSE("GPL");
4790 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
4791 +MODULE_DESCRIPTION("iptree type of IP sets");
4792 +module_param(limit, int, 0600);
4793 +MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
4795 +static int __init init(void)
4799 + branch_cachep = kmem_cache_create("ip_set_iptreeb",
4800 + sizeof(struct ip_set_iptreeb),
4801 + 0, 0, NULL, NULL);
4802 + if (!branch_cachep) {
4803 + printk(KERN_ERR "Unable to create ip_set_iptreeb slab cache\n");
4807 + leaf_cachep = kmem_cache_create("ip_set_iptreed",
4808 + sizeof(struct ip_set_iptreed),
4809 + 0, 0, NULL, NULL);
4810 + if (!leaf_cachep) {
4811 + printk(KERN_ERR "Unable to create ip_set_iptreed slab cache\n");
4815 + ret = ip_set_register_set_type(&ip_set_iptree);
4819 + kmem_cache_destroy(leaf_cachep);
4821 + kmem_cache_destroy(branch_cachep);
4826 +static void __exit fini(void)
4828 + /* FIXME: possible race with ip_set_create() */
4829 + ip_set_unregister_set_type(&ip_set_iptree);
4830 + kmem_cache_destroy(leaf_cachep);
4831 + kmem_cache_destroy(branch_cachep);
4836 Index: linux-2.6.23-rc6/net/ipv4/netfilter/ip_set_macipmap.c
4837 ===================================================================
4838 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
4839 +++ linux-2.6.23-rc6/net/ipv4/netfilter/ip_set_macipmap.c 2007-09-21 16:24:01.000000000 +0800
4841 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
4842 + * Patrick Schaaf <bof@bof.de>
4843 + * Martin Josefsson <gandalf@wlug.westbo.se>
4844 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
4846 + * This program is free software; you can redistribute it and/or modify
4847 + * it under the terms of the GNU General Public License version 2 as
4848 + * published by the Free Software Foundation.
4851 +/* Kernel module implementing an IP set type: the macipmap type */
4853 +#include <linux/module.h>
4854 +#include <linux/ip.h>
4855 +#include <linux/skbuff.h>
4856 +#include <linux/netfilter_ipv4/ip_tables.h>
4857 +#include <linux/netfilter_ipv4/ip_set.h>
4858 +#include <linux/errno.h>
4859 +#include <asm/uaccess.h>
4860 +#include <asm/bitops.h>
4861 +#include <linux/spinlock.h>
4862 +#include <linux/if_ether.h>
4863 +#include <linux/vmalloc.h>
4865 +#include <linux/netfilter_ipv4/ip_set_malloc.h>
4866 +#include <linux/netfilter_ipv4/ip_set_macipmap.h>
4869 +testip(struct ip_set *set, const void *data, size_t size, ip_set_ip_t *hash_ip)
4871 + struct ip_set_macipmap *map = (struct ip_set_macipmap *) set->data;
4872 + struct ip_set_macip *table = (struct ip_set_macip *) map->members;
4873 + struct ip_set_req_macipmap *req = (struct ip_set_req_macipmap *) data;
4875 + if (size != sizeof(struct ip_set_req_macipmap)) {
4876 + ip_set_printk("data length wrong (want %zu, have %zu)",
4877 + sizeof(struct ip_set_req_macipmap),
4882 + if (req->ip < map->first_ip || req->ip > map->last_ip)
4885 + *hash_ip = req->ip;
4886 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u",
4887 + set->name, HIPQUAD(req->ip), HIPQUAD(*hash_ip));
4888 + if (test_bit(IPSET_MACIP_ISSET,
4889 + (void *) &table[req->ip - map->first_ip].flags)) {
4890 + return (memcmp(req->ethernet,
4891 + &table[req->ip - map->first_ip].ethernet,
4894 + return (map->flags & IPSET_MACIP_MATCHUNSET ? 1 : 0);
4899 +testip_kernel(struct ip_set *set,
4900 + const struct sk_buff *skb,
4901 + ip_set_ip_t *hash_ip,
4902 + const u_int32_t *flags,
4903 + unsigned char index)
4905 + struct ip_set_macipmap *map =
4906 + (struct ip_set_macipmap *) set->data;
4907 + struct ip_set_macip *table =
4908 + (struct ip_set_macip *) map->members;
4911 + ip = ntohl(flags[index] & IPSET_SRC
4912 + ? ip_hdr(skb)->saddr
4913 + : ip_hdr(skb)->daddr);
4914 + DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
4915 + flags[index] & IPSET_SRC ? "SRC" : "DST",
4916 + NIPQUAD(ip_hdr(skb)->saddr),
4917 + NIPQUAD(ip_hdr(skb)->daddr));
4919 + if (ip < map->first_ip || ip > map->last_ip)
4923 + DP("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u",
4924 + set->name, HIPQUAD(ip), HIPQUAD(*hash_ip));
4925 + if (test_bit(IPSET_MACIP_ISSET,
4926 + (void *) &table[ip - map->first_ip].flags)) {
4927 + /* Is mac pointer valid?
4928 + * If so, compare... */
4929 + return (skb_mac_header(skb) >= skb->head
4930 + && (skb_mac_header(skb) + ETH_HLEN) <= skb->data
4931 + && (memcmp(eth_hdr(skb)->h_source,
4932 + &table[ip - map->first_ip].ethernet,
4935 + return (map->flags & IPSET_MACIP_MATCHUNSET ? 1 : 0);
4939 +/* returns 0 on success */
4941 +__addip(struct ip_set *set,
4942 + ip_set_ip_t ip, unsigned char *ethernet, ip_set_ip_t *hash_ip)
4944 + struct ip_set_macipmap *map =
4945 + (struct ip_set_macipmap *) set->data;
4946 + struct ip_set_macip *table =
4947 + (struct ip_set_macip *) map->members;
4949 + if (ip < map->first_ip || ip > map->last_ip)
4951 + if (test_and_set_bit(IPSET_MACIP_ISSET,
4952 + (void *) &table[ip - map->first_ip].flags))
4956 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
4957 + memcpy(&table[ip - map->first_ip].ethernet, ethernet, ETH_ALEN);
4962 +addip(struct ip_set *set, const void *data, size_t size,
4963 + ip_set_ip_t *hash_ip)
4965 + struct ip_set_req_macipmap *req =
4966 + (struct ip_set_req_macipmap *) data;
4968 + if (size != sizeof(struct ip_set_req_macipmap)) {
4969 + ip_set_printk("data length wrong (want %zu, have %zu)",
4970 + sizeof(struct ip_set_req_macipmap),
4974 + return __addip(set, req->ip, req->ethernet, hash_ip);
4978 +addip_kernel(struct ip_set *set,
4979 + const struct sk_buff *skb,
4980 + ip_set_ip_t *hash_ip,
4981 + const u_int32_t *flags,
4982 + unsigned char index)
4986 + ip = ntohl(flags[index] & IPSET_SRC
4987 + ? ip_hdr(skb)->saddr
4988 + : ip_hdr(skb)->daddr);
4990 + if (!(skb_mac_header(skb) >= skb->head
4991 + && (skb_mac_header(skb) + ETH_HLEN) <= skb->data))
4994 + return __addip(set, ip, eth_hdr(skb)->h_source, hash_ip);
4998 +__delip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
5000 + struct ip_set_macipmap *map =
5001 + (struct ip_set_macipmap *) set->data;
5002 + struct ip_set_macip *table =
5003 + (struct ip_set_macip *) map->members;
5005 + if (ip < map->first_ip || ip > map->last_ip)
5007 + if (!test_and_clear_bit(IPSET_MACIP_ISSET,
5008 + (void *)&table[ip - map->first_ip].flags))
5012 + DP("%u.%u.%u.%u, %u.%u.%u.%u", HIPQUAD(ip), HIPQUAD(*hash_ip));
5017 +delip(struct ip_set *set, const void *data, size_t size,
5018 + ip_set_ip_t *hash_ip)
5020 + struct ip_set_req_macipmap *req =
5021 + (struct ip_set_req_macipmap *) data;
5023 + if (size != sizeof(struct ip_set_req_macipmap)) {
5024 + ip_set_printk("data length wrong (want %zu, have %zu)",
5025 + sizeof(struct ip_set_req_macipmap),
5029 + return __delip(set, req->ip, hash_ip);
5033 +delip_kernel(struct ip_set *set,
5034 + const struct sk_buff *skb,
5035 + ip_set_ip_t *hash_ip,
5036 + const u_int32_t *flags,
5037 + unsigned char index)
5039 + return __delip(set,
5040 + ntohl(flags[index] & IPSET_SRC
5041 + ? ip_hdr(skb)->saddr
5042 + : ip_hdr(skb)->daddr),
5046 +static inline size_t members_size(ip_set_id_t from, ip_set_id_t to)
5048 + return (size_t)((to - from + 1) * sizeof(struct ip_set_macip));
5051 +static int create(struct ip_set *set, const void *data, size_t size)
5054 + struct ip_set_req_macipmap_create *req =
5055 + (struct ip_set_req_macipmap_create *) data;
5056 + struct ip_set_macipmap *map;
5058 + if (size != sizeof(struct ip_set_req_macipmap_create)) {
5059 + ip_set_printk("data length wrong (want %zu, have %zu)",
5060 + sizeof(struct ip_set_req_macipmap_create),
5065 + DP("from %u.%u.%u.%u to %u.%u.%u.%u",
5066 + HIPQUAD(req->from), HIPQUAD(req->to));
5068 + if (req->from > req->to) {
5069 + DP("bad ip range");
5073 + if (req->to - req->from > MAX_RANGE) {
5074 + ip_set_printk("range too big (max %d addresses)",
5079 + map = kmalloc(sizeof(struct ip_set_macipmap), GFP_KERNEL);
5081 + DP("out of memory for %d bytes",
5082 + sizeof(struct ip_set_macipmap));
5085 + map->flags = req->flags;
5086 + map->first_ip = req->from;
5087 + map->last_ip = req->to;
5088 + newbytes = members_size(map->first_ip, map->last_ip);
5089 + map->members = ip_set_malloc(newbytes);
5090 + DP("members: %u %p", newbytes, map->members);
5091 + if (!map->members) {
5092 + DP("out of memory for %d bytes", newbytes);
5096 + memset(map->members, 0, newbytes);
5102 +static void destroy(struct ip_set *set)
5104 + struct ip_set_macipmap *map =
5105 + (struct ip_set_macipmap *) set->data;
5107 + ip_set_free(map->members, members_size(map->first_ip, map->last_ip));
5113 +static void flush(struct ip_set *set)
5115 + struct ip_set_macipmap *map =
5116 + (struct ip_set_macipmap *) set->data;
5117 + memset(map->members, 0, members_size(map->first_ip, map->last_ip));
5120 +static void list_header(const struct ip_set *set, void *data)
5122 + struct ip_set_macipmap *map =
5123 + (struct ip_set_macipmap *) set->data;
5124 + struct ip_set_req_macipmap_create *header =
5125 + (struct ip_set_req_macipmap_create *) data;
5127 + DP("list_header %x %x %u", map->first_ip, map->last_ip,
5130 + header->from = map->first_ip;
5131 + header->to = map->last_ip;
5132 + header->flags = map->flags;
5135 +static int list_members_size(const struct ip_set *set)
5137 + struct ip_set_macipmap *map =
5138 + (struct ip_set_macipmap *) set->data;
5140 + DP("%u", members_size(map->first_ip, map->last_ip));
5141 + return members_size(map->first_ip, map->last_ip);
5144 +static void list_members(const struct ip_set *set, void *data)
5146 + struct ip_set_macipmap *map =
5147 + (struct ip_set_macipmap *) set->data;
5149 + int bytes = members_size(map->first_ip, map->last_ip);
5151 + DP("members: %u %p", bytes, map->members);
5152 + memcpy(data, map->members, bytes);
5155 +static struct ip_set_type ip_set_macipmap = {
5156 + .typename = SETTYPE_NAME,
5157 + .features = IPSET_TYPE_IP | IPSET_DATA_SINGLE,
5158 + .protocol_version = IP_SET_PROTOCOL_VERSION,
5159 + .create = &create,
5160 + .destroy = &destroy,
5162 + .reqsize = sizeof(struct ip_set_req_macipmap),
5164 + .addip_kernel = &addip_kernel,
5166 + .delip_kernel = &delip_kernel,
5167 + .testip = &testip,
5168 + .testip_kernel = &testip_kernel,
5169 + .header_size = sizeof(struct ip_set_req_macipmap_create),
5170 + .list_header = &list_header,
5171 + .list_members_size = &list_members_size,
5172 + .list_members = &list_members,
5173 + .me = THIS_MODULE,
5176 +MODULE_LICENSE("GPL");
5177 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
5178 +MODULE_DESCRIPTION("macipmap type of IP sets");
5180 +static int __init init(void)
5182 + init_max_malloc_size();
5183 + return ip_set_register_set_type(&ip_set_macipmap);
5186 +static void __exit fini(void)
5188 + /* FIXME: possible race with ip_set_create() */
5189 + ip_set_unregister_set_type(&ip_set_macipmap);
5194 Index: linux-2.6.23-rc6/net/ipv4/netfilter/ip_set_nethash.c
5195 ===================================================================
5196 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
5197 +++ linux-2.6.23-rc6/net/ipv4/netfilter/ip_set_nethash.c 2007-09-21 16:24:01.000000000 +0800
5199 +/* Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
5201 + * This program is free software; you can redistribute it and/or modify
5202 + * it under the terms of the GNU General Public License version 2 as
5203 + * published by the Free Software Foundation.
5206 +/* Kernel module implementing a cidr nethash set */
5208 +#include <linux/module.h>
5209 +#include <linux/ip.h>
5210 +#include <linux/skbuff.h>
5211 +#include <linux/netfilter_ipv4/ip_tables.h>
5212 +#include <linux/netfilter_ipv4/ip_set.h>
5213 +#include <linux/errno.h>
5214 +#include <asm/uaccess.h>
5215 +#include <asm/bitops.h>
5216 +#include <linux/spinlock.h>
5217 +#include <linux/vmalloc.h>
5218 +#include <linux/random.h>
5219 +#include <linux/jhash.h>
5221 +#include <net/ip.h>
5223 +#include <linux/netfilter_ipv4/ip_set_malloc.h>
5224 +#include <linux/netfilter_ipv4/ip_set_nethash.h>
5226 +static int limit = MAX_RANGE;
5228 +static inline __u32
5229 +jhash_ip(const struct ip_set_nethash *map, uint16_t i, ip_set_ip_t ip)
5231 + return jhash_1word(ip, *(((uint32_t *) map->initval) + i));
5234 +static inline __u32
5235 +hash_id_cidr(struct ip_set_nethash *map,
5237 + unsigned char cidr,
5238 + ip_set_ip_t *hash_ip)
5242 + ip_set_ip_t *elem;
5244 + *hash_ip = pack(ip, cidr);
5246 + for (i = 0; i < map->probes; i++) {
5247 + id = jhash_ip(map, i, *hash_ip) % map->hashsize;
5248 + DP("hash key: %u", id);
5249 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
5250 + if (*elem == *hash_ip)
5256 +static inline __u32
5257 +hash_id(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
5259 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5260 + __u32 id = UINT_MAX;
5263 + for (i = 0; i < 30 && map->cidr[i]; i++) {
5264 + id = hash_id_cidr(map, ip, map->cidr[i], hash_ip);
5265 + if (id != UINT_MAX)
5272 +__testip_cidr(struct ip_set *set, ip_set_ip_t ip, unsigned char cidr,
5273 + ip_set_ip_t *hash_ip)
5275 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5277 + return (ip && hash_id_cidr(map, ip, cidr, hash_ip) != UINT_MAX);
5281 +__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
5283 + return (ip && hash_id(set, ip, hash_ip) != UINT_MAX);
5287 +testip(struct ip_set *set, const void *data, size_t size,
5288 + ip_set_ip_t *hash_ip)
5290 + struct ip_set_req_nethash *req =
5291 + (struct ip_set_req_nethash *) data;
5293 + if (size != sizeof(struct ip_set_req_nethash)) {
5294 + ip_set_printk("data length wrong (want %zu, have %zu)",
5295 + sizeof(struct ip_set_req_nethash),
5299 + return (req->cidr == 32 ? __testip(set, req->ip, hash_ip)
5300 + : __testip_cidr(set, req->ip, req->cidr, hash_ip));
5304 +testip_kernel(struct ip_set *set,
5305 + const struct sk_buff *skb,
5306 + ip_set_ip_t *hash_ip,
5307 + const u_int32_t *flags,
5308 + unsigned char index)
5310 + return __testip(set,
5311 + ntohl(flags[index] & IPSET_SRC
5312 + ? ip_hdr(skb)->saddr
5313 + : ip_hdr(skb)->daddr),
5318 +__addip_base(struct ip_set_nethash *map, ip_set_ip_t ip)
5322 + ip_set_ip_t *elem;
5324 + for (i = 0; i < map->probes; i++) {
5325 + probe = jhash_ip(map, i, ip) % map->hashsize;
5326 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, probe);
5335 + /* Trigger rehashing */
5340 +__addip(struct ip_set_nethash *map, ip_set_ip_t ip, unsigned char cidr,
5341 + ip_set_ip_t *hash_ip)
5343 + if (!ip || map->elements > limit)
5346 + *hash_ip = pack(ip, cidr);
5347 + DP("%u.%u.%u.%u/%u, %u.%u.%u.%u", HIPQUAD(ip), cidr, HIPQUAD(*hash_ip));
5349 + return __addip_base(map, *hash_ip);
5353 +update_cidr_sizes(struct ip_set_nethash *map, unsigned char cidr)
5355 + unsigned char next;
5358 + for (i = 0; i < 30 && map->cidr[i]; i++) {
5359 + if (map->cidr[i] == cidr) {
5361 + } else if (map->cidr[i] < cidr) {
5362 + next = map->cidr[i];
5363 + map->cidr[i] = cidr;
5368 + map->cidr[i] = cidr;
5372 +addip(struct ip_set *set, const void *data, size_t size,
5373 + ip_set_ip_t *hash_ip)
5375 + struct ip_set_req_nethash *req =
5376 + (struct ip_set_req_nethash *) data;
5379 + if (size != sizeof(struct ip_set_req_nethash)) {
5380 + ip_set_printk("data length wrong (want %zu, have %zu)",
5381 + sizeof(struct ip_set_req_nethash),
5385 + ret = __addip((struct ip_set_nethash *) set->data,
5386 + req->ip, req->cidr, hash_ip);
5389 + update_cidr_sizes((struct ip_set_nethash *) set->data,
5396 +addip_kernel(struct ip_set *set,
5397 + const struct sk_buff *skb,
5398 + ip_set_ip_t *hash_ip,
5399 + const u_int32_t *flags,
5400 + unsigned char index)
5402 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5403 + int ret = -ERANGE;
5404 + ip_set_ip_t ip = ntohl(flags[index] & IPSET_SRC
5405 + ? ip_hdr(skb)->saddr
5406 + : ip_hdr(skb)->daddr);
5409 + ret = __addip(map, ip, map->cidr[0], hash_ip);
5414 +static int retry(struct ip_set *set)
5416 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5417 + ip_set_ip_t *elem;
5419 + u_int32_t i, hashsize = map->hashsize;
5421 + struct ip_set_nethash *tmp;
5423 + if (map->resize == 0)
5429 + /* Calculate new parameters */
5430 + hashsize += (hashsize * map->resize)/100;
5431 + if (hashsize == map->hashsize)
5434 + ip_set_printk("rehashing of set %s triggered: "
5435 + "hashsize grows from %u to %u",
5436 + set->name, map->hashsize, hashsize);
5438 + tmp = kmalloc(sizeof(struct ip_set_nethash)
5439 + + map->probes * sizeof(uint32_t), GFP_ATOMIC);
5441 + DP("out of memory for %d bytes",
5442 + sizeof(struct ip_set_nethash)
5443 + + map->probes * sizeof(uint32_t));
5446 + tmp->members = harray_malloc(hashsize, sizeof(ip_set_ip_t), GFP_ATOMIC);
5447 + if (!tmp->members) {
5448 + DP("out of memory for %d bytes", hashsize * sizeof(ip_set_ip_t));
5452 + tmp->hashsize = hashsize;
5453 + tmp->elements = 0;
5454 + tmp->probes = map->probes;
5455 + tmp->resize = map->resize;
5456 + memcpy(tmp->initval, map->initval, map->probes * sizeof(uint32_t));
5457 + memcpy(tmp->cidr, map->cidr, 30 * sizeof(unsigned char));
5459 + write_lock_bh(&set->lock);
5460 + map = (struct ip_set_nethash *) set->data; /* Play safe */
5461 + for (i = 0; i < map->hashsize && res == 0; i++) {
5462 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, i);
5464 + res = __addip_base(tmp, *elem);
5467 + /* Failure, try again */
5468 + write_unlock_bh(&set->lock);
5469 + harray_free(tmp->members);
5474 + /* Success at resizing! */
5475 + members = map->members;
5477 + map->hashsize = tmp->hashsize;
5478 + map->members = tmp->members;
5479 + write_unlock_bh(&set->lock);
5481 + harray_free(members);
5488 +__delip(struct ip_set_nethash *map, ip_set_ip_t ip, unsigned char cidr,
5489 + ip_set_ip_t *hash_ip)
5491 + ip_set_ip_t id, *elem;
5496 + id = hash_id_cidr(map, ip, cidr, hash_ip);
5497 + if (id == UINT_MAX)
5500 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
5507 +delip(struct ip_set *set, const void *data, size_t size,
5508 + ip_set_ip_t *hash_ip)
5510 + struct ip_set_req_nethash *req =
5511 + (struct ip_set_req_nethash *) data;
5513 + if (size != sizeof(struct ip_set_req_nethash)) {
5514 + ip_set_printk("data length wrong (want %zu, have %zu)",
5515 + sizeof(struct ip_set_req_nethash),
5519 + /* TODO: no garbage collection in map->cidr */
5520 + return __delip((struct ip_set_nethash *) set->data,
5521 + req->ip, req->cidr, hash_ip);
5525 +delip_kernel(struct ip_set *set,
5526 + const struct sk_buff *skb,
5527 + ip_set_ip_t *hash_ip,
5528 + const u_int32_t *flags,
5529 + unsigned char index)
5531 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5532 + int ret = -ERANGE;
5533 + ip_set_ip_t ip = ntohl(flags[index] & IPSET_SRC
5534 + ? ip_hdr(skb)->saddr
5535 + : ip_hdr(skb)->daddr);
5538 + ret = __delip(map, ip, map->cidr[0], hash_ip);
5543 +static int create(struct ip_set *set, const void *data, size_t size)
5545 + struct ip_set_req_nethash_create *req =
5546 + (struct ip_set_req_nethash_create *) data;
5547 + struct ip_set_nethash *map;
5550 + if (size != sizeof(struct ip_set_req_nethash_create)) {
5551 + ip_set_printk("data length wrong (want %zu, have %zu)",
5552 + sizeof(struct ip_set_req_nethash_create),
5557 + if (req->hashsize < 1) {
5558 + ip_set_printk("hashsize too small");
5561 + if (req->probes < 1) {
5562 + ip_set_printk("probes too small");
5566 + map = kmalloc(sizeof(struct ip_set_nethash)
5567 + + req->probes * sizeof(uint32_t), GFP_KERNEL);
5569 + DP("out of memory for %d bytes",
5570 + sizeof(struct ip_set_nethash)
5571 + + req->probes * sizeof(uint32_t));
5574 + for (i = 0; i < req->probes; i++)
5575 + get_random_bytes(((uint32_t *) map->initval)+i, 4);
5576 + map->elements = 0;
5577 + map->hashsize = req->hashsize;
5578 + map->probes = req->probes;
5579 + map->resize = req->resize;
5580 + memset(map->cidr, 0, 30 * sizeof(unsigned char));
5581 + map->members = harray_malloc(map->hashsize, sizeof(ip_set_ip_t), GFP_KERNEL);
5582 + if (!map->members) {
5583 + DP("out of memory for %d bytes", map->hashsize * sizeof(ip_set_ip_t));
5592 +static void destroy(struct ip_set *set)
5594 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5596 + harray_free(map->members);
5602 +static void flush(struct ip_set *set)
5604 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5605 + harray_flush(map->members, map->hashsize, sizeof(ip_set_ip_t));
5606 + memset(map->cidr, 0, 30 * sizeof(unsigned char));
5607 + map->elements = 0;
5610 +static void list_header(const struct ip_set *set, void *data)
5612 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5613 + struct ip_set_req_nethash_create *header =
5614 + (struct ip_set_req_nethash_create *) data;
5616 + header->hashsize = map->hashsize;
5617 + header->probes = map->probes;
5618 + header->resize = map->resize;
5621 +static int list_members_size(const struct ip_set *set)
5623 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5625 + return (map->hashsize * sizeof(ip_set_ip_t));
5628 +static void list_members(const struct ip_set *set, void *data)
5630 + struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
5631 + ip_set_ip_t i, *elem;
5633 + for (i = 0; i < map->hashsize; i++) {
5634 + elem = HARRAY_ELEM(map->members, ip_set_ip_t *, i);
5635 + ((ip_set_ip_t *)data)[i] = *elem;
5639 +static struct ip_set_type ip_set_nethash = {
5640 + .typename = SETTYPE_NAME,
5641 + .features = IPSET_TYPE_IP | IPSET_DATA_SINGLE,
5642 + .protocol_version = IP_SET_PROTOCOL_VERSION,
5643 + .create = &create,
5644 + .destroy = &destroy,
5646 + .reqsize = sizeof(struct ip_set_req_nethash),
5648 + .addip_kernel = &addip_kernel,
5651 + .delip_kernel = &delip_kernel,
5652 + .testip = &testip,
5653 + .testip_kernel = &testip_kernel,
5654 + .header_size = sizeof(struct ip_set_req_nethash_create),
5655 + .list_header = &list_header,
5656 + .list_members_size = &list_members_size,
5657 + .list_members = &list_members,
5658 + .me = THIS_MODULE,
5661 +MODULE_LICENSE("GPL");
5662 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
5663 +MODULE_DESCRIPTION("nethash type of IP sets");
5664 +module_param(limit, int, 0600);
5665 +MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
5667 +static int __init init(void)
5669 + return ip_set_register_set_type(&ip_set_nethash);
5672 +static void __exit fini(void)
5674 + /* FIXME: possible race with ip_set_create() */
5675 + ip_set_unregister_set_type(&ip_set_nethash);
5680 Index: linux-2.6.23-rc6/net/ipv4/netfilter/ip_set_portmap.c
5681 ===================================================================
5682 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
5683 +++ linux-2.6.23-rc6/net/ipv4/netfilter/ip_set_portmap.c 2007-09-21 16:24:01.000000000 +0800
5685 +/* Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
5687 + * This program is free software; you can redistribute it and/or modify
5688 + * it under the terms of the GNU General Public License version 2 as
5689 + * published by the Free Software Foundation.
5692 +/* Kernel module implementing a port set type as a bitmap */
5694 +#include <linux/module.h>
5695 +#include <linux/ip.h>
5696 +#include <linux/tcp.h>
5697 +#include <linux/udp.h>
5698 +#include <linux/skbuff.h>
5699 +#include <linux/netfilter_ipv4/ip_tables.h>
5700 +#include <linux/netfilter_ipv4/ip_set.h>
5701 +#include <linux/errno.h>
5702 +#include <asm/uaccess.h>
5703 +#include <asm/bitops.h>
5704 +#include <linux/spinlock.h>
5706 +#include <net/ip.h>
5708 +#include <linux/netfilter_ipv4/ip_set_portmap.h>
5710 +/* We must handle non-linear skbs */
5711 +static inline ip_set_ip_t
5712 +get_port(const struct sk_buff *skb, u_int32_t flags)
5714 + struct iphdr *iph = ip_hdr(skb);
5715 + u_int16_t offset = ntohs(iph->frag_off) & IP_OFFSET;
5717 + switch (iph->protocol) {
5718 + case IPPROTO_TCP: {
5719 + struct tcphdr tcph;
5721 + /* See comments at tcp_match in ip_tables.c */
5723 + return INVALID_PORT;
5725 + if (skb_copy_bits(skb, ip_hdr(skb)->ihl*4, &tcph, sizeof(tcph)) < 0)
5726 + /* No choice either */
5727 + return INVALID_PORT;
5729 + return ntohs(flags & IPSET_SRC ?
5730 + tcph.source : tcph.dest);
5732 + case IPPROTO_UDP: {
5733 + struct udphdr udph;
5736 + return INVALID_PORT;
5738 + if (skb_copy_bits(skb, ip_hdr(skb)->ihl*4, &udph, sizeof(udph)) < 0)
5739 + /* No choice either */
5740 + return INVALID_PORT;
5742 + return ntohs(flags & IPSET_SRC ?
5743 + udph.source : udph.dest);
5746 + return INVALID_PORT;
5751 +__testport(struct ip_set *set, ip_set_ip_t port, ip_set_ip_t *hash_port)
5753 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5755 + if (port < map->first_port || port > map->last_port)
5758 + *hash_port = port;
5759 + DP("set: %s, port:%u, %u", set->name, port, *hash_port);
5760 + return !!test_bit(port - map->first_port, map->members);
5764 +testport(struct ip_set *set, const void *data, size_t size,
5765 + ip_set_ip_t *hash_port)
5767 + struct ip_set_req_portmap *req =
5768 + (struct ip_set_req_portmap *) data;
5770 + if (size != sizeof(struct ip_set_req_portmap)) {
5771 + ip_set_printk("data length wrong (want %zu, have %zu)",
5772 + sizeof(struct ip_set_req_portmap),
5776 + return __testport(set, req->port, hash_port);
5780 +testport_kernel(struct ip_set *set,
5781 + const struct sk_buff *skb,
5782 + ip_set_ip_t *hash_port,
5783 + const u_int32_t *flags,
5784 + unsigned char index)
5787 + ip_set_ip_t port = get_port(skb, flags[index]);
5789 + DP("flag %s port %u", flags[index] & IPSET_SRC ? "SRC" : "DST", port);
5790 + if (port == INVALID_PORT)
5793 + res = __testport(set, port, hash_port);
5795 + return (res < 0 ? 0 : res);
5799 +__addport(struct ip_set *set, ip_set_ip_t port, ip_set_ip_t *hash_port)
5801 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5803 + if (port < map->first_port || port > map->last_port)
5805 + if (test_and_set_bit(port - map->first_port, map->members))
5808 + *hash_port = port;
5809 + DP("port %u", port);
5814 +addport(struct ip_set *set, const void *data, size_t size,
5815 + ip_set_ip_t *hash_port)
5817 + struct ip_set_req_portmap *req =
5818 + (struct ip_set_req_portmap *) data;
5820 + if (size != sizeof(struct ip_set_req_portmap)) {
5821 + ip_set_printk("data length wrong (want %zu, have %zu)",
5822 + sizeof(struct ip_set_req_portmap),
5826 + return __addport(set, req->port, hash_port);
5830 +addport_kernel(struct ip_set *set,
5831 + const struct sk_buff *skb,
5832 + ip_set_ip_t *hash_port,
5833 + const u_int32_t *flags,
5834 + unsigned char index)
5836 + ip_set_ip_t port = get_port(skb, flags[index]);
5838 + if (port == INVALID_PORT)
5841 + return __addport(set, port, hash_port);
5845 +__delport(struct ip_set *set, ip_set_ip_t port, ip_set_ip_t *hash_port)
5847 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5849 + if (port < map->first_port || port > map->last_port)
5851 + if (!test_and_clear_bit(port - map->first_port, map->members))
5854 + *hash_port = port;
5855 + DP("port %u", port);
5860 +delport(struct ip_set *set, const void *data, size_t size,
5861 + ip_set_ip_t *hash_port)
5863 + struct ip_set_req_portmap *req =
5864 + (struct ip_set_req_portmap *) data;
5866 + if (size != sizeof(struct ip_set_req_portmap)) {
5867 + ip_set_printk("data length wrong (want %zu, have %zu)",
5868 + sizeof(struct ip_set_req_portmap),
5872 + return __delport(set, req->port, hash_port);
5876 +delport_kernel(struct ip_set *set,
5877 + const struct sk_buff *skb,
5878 + ip_set_ip_t *hash_port,
5879 + const u_int32_t *flags,
5880 + unsigned char index)
5882 + ip_set_ip_t port = get_port(skb, flags[index]);
5884 + if (port == INVALID_PORT)
5887 + return __delport(set, port, hash_port);
5890 +static int create(struct ip_set *set, const void *data, size_t size)
5893 + struct ip_set_req_portmap_create *req =
5894 + (struct ip_set_req_portmap_create *) data;
5895 + struct ip_set_portmap *map;
5897 + if (size != sizeof(struct ip_set_req_portmap_create)) {
5898 + ip_set_printk("data length wrong (want %zu, have %zu)",
5899 + sizeof(struct ip_set_req_portmap_create),
5904 + DP("from %u to %u", req->from, req->to);
5906 + if (req->from > req->to) {
5907 + DP("bad port range");
5911 + if (req->to - req->from > MAX_RANGE) {
5912 + ip_set_printk("range too big (max %d ports)",
5917 + map = kmalloc(sizeof(struct ip_set_portmap), GFP_KERNEL);
5919 + DP("out of memory for %d bytes",
5920 + sizeof(struct ip_set_portmap));
5923 + map->first_port = req->from;
5924 + map->last_port = req->to;
5925 + newbytes = bitmap_bytes(req->from, req->to);
5926 + map->members = kmalloc(newbytes, GFP_KERNEL);
5927 + if (!map->members) {
5928 + DP("out of memory for %d bytes", newbytes);
5932 + memset(map->members, 0, newbytes);
5938 +static void destroy(struct ip_set *set)
5940 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5942 + kfree(map->members);
5948 +static void flush(struct ip_set *set)
5950 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5951 + memset(map->members, 0, bitmap_bytes(map->first_port, map->last_port));
5954 +static void list_header(const struct ip_set *set, void *data)
5956 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5957 + struct ip_set_req_portmap_create *header =
5958 + (struct ip_set_req_portmap_create *) data;
5960 + DP("list_header %u %u", map->first_port, map->last_port);
5962 + header->from = map->first_port;
5963 + header->to = map->last_port;
5966 +static int list_members_size(const struct ip_set *set)
5968 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5970 + return bitmap_bytes(map->first_port, map->last_port);
5973 +static void list_members(const struct ip_set *set, void *data)
5975 + struct ip_set_portmap *map = (struct ip_set_portmap *) set->data;
5976 + int bytes = bitmap_bytes(map->first_port, map->last_port);
5978 + memcpy(data, map->members, bytes);
5981 +static struct ip_set_type ip_set_portmap = {
5982 + .typename = SETTYPE_NAME,
5983 + .features = IPSET_TYPE_PORT | IPSET_DATA_SINGLE,
5984 + .protocol_version = IP_SET_PROTOCOL_VERSION,
5985 + .create = &create,
5986 + .destroy = &destroy,
5988 + .reqsize = sizeof(struct ip_set_req_portmap),
5989 + .addip = &addport,
5990 + .addip_kernel = &addport_kernel,
5991 + .delip = &delport,
5992 + .delip_kernel = &delport_kernel,
5993 + .testip = &testport,
5994 + .testip_kernel = &testport_kernel,
5995 + .header_size = sizeof(struct ip_set_req_portmap_create),
5996 + .list_header = &list_header,
5997 + .list_members_size = &list_members_size,
5998 + .list_members = &list_members,
5999 + .me = THIS_MODULE,
6002 +MODULE_LICENSE("GPL");
6003 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
6004 +MODULE_DESCRIPTION("portmap type of IP sets");
6006 +static int __init init(void)
6008 + return ip_set_register_set_type(&ip_set_portmap);
6011 +static void __exit fini(void)
6013 + /* FIXME: possible race with ip_set_create() */
6014 + ip_set_unregister_set_type(&ip_set_portmap);
6019 Index: linux-2.6.23-rc6/net/ipv4/netfilter/ipt_set.c
6020 ===================================================================
6021 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
6022 +++ linux-2.6.23-rc6/net/ipv4/netfilter/ipt_set.c 2007-09-21 16:24:01.000000000 +0800
6024 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
6025 + * Patrick Schaaf <bof@bof.de>
6026 + * Martin Josefsson <gandalf@wlug.westbo.se>
6027 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
6029 + * This program is free software; you can redistribute it and/or modify
6030 + * it under the terms of the GNU General Public License version 2 as
6031 + * published by the Free Software Foundation.
6034 +/* Kernel module to match an IP set. */
6036 +#include <linux/module.h>
6037 +#include <linux/ip.h>
6038 +#include <linux/skbuff.h>
6039 +#include <linux/version.h>
6041 +#include <linux/netfilter_ipv4/ip_tables.h>
6042 +#include <linux/netfilter_ipv4/ip_set.h>
6043 +#include <linux/netfilter_ipv4/ipt_set.h>
6046 +match_set(const struct ipt_set_info *info,
6047 + const struct sk_buff *skb,
6050 + if (ip_set_testip_kernel(info->index, skb, info->flags))
6056 +match(const struct sk_buff *skb,
6057 + const struct net_device *in,
6058 + const struct net_device *out,
6059 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6060 + const struct xt_match *match,
6062 + const void *matchinfo,
6063 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
6064 + int offset, unsigned int protoff, int *hotdrop)
6066 + int offset, int *hotdrop)
6069 + const struct ipt_set_info_match *info = matchinfo;
6071 + return match_set(&info->match_set,
6073 + info->match_set.flags[0] & IPSET_MATCH_INV);
6077 +checkentry(const char *tablename,
6078 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
6081 + const struct ipt_ip *ip,
6083 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6084 + const struct xt_match *match,
6087 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6088 + unsigned int matchsize,
6090 + unsigned int hook_mask)
6092 + struct ipt_set_info_match *info =
6093 + (struct ipt_set_info_match *) matchinfo;
6094 + ip_set_id_t index;
6096 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6097 + if (matchsize != IPT_ALIGN(sizeof(struct ipt_set_info_match))) {
6098 + ip_set_printk("invalid matchsize %d", matchsize);
6103 + index = ip_set_get_byindex(info->match_set.index);
6105 + if (index == IP_SET_INVALID_ID) {
6106 + ip_set_printk("Cannot find set indentified by id %u to match",
6107 + info->match_set.index);
6108 + return 0; /* error */
6110 + if (info->match_set.flags[IP_SET_MAX_BINDINGS] != 0) {
6111 + ip_set_printk("That's nasty!");
6112 + return 0; /* error */
6118 +static void destroy(
6119 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6120 + const struct xt_match *match,
6122 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6123 + void *matchinfo, unsigned int matchsize)
6128 + struct ipt_set_info_match *info = matchinfo;
6130 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6131 + if (matchsize != IPT_ALIGN(sizeof(struct ipt_set_info_match))) {
6132 + ip_set_printk("invalid matchsize %d", matchsize);
6136 + ip_set_put(info->match_set.index);
6139 +static struct ipt_match set_match = {
6141 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
6142 + .family = AF_INET,
6145 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6146 + .matchsize = sizeof(struct ipt_set_info_match),
6148 + .checkentry = &checkentry,
6149 + .destroy = &destroy,
6153 +MODULE_LICENSE("GPL");
6154 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
6155 +MODULE_DESCRIPTION("iptables IP set match module");
6157 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
6158 +#define ipt_register_match xt_register_match
6159 +#define ipt_unregister_match xt_unregister_match
6162 +static int __init ipt_ipset_init(void)
6164 + return ipt_register_match(&set_match);
6167 +static void __exit ipt_ipset_fini(void)
6169 + ipt_unregister_match(&set_match);
6172 +module_init(ipt_ipset_init);
6173 +module_exit(ipt_ipset_fini);
6174 Index: linux-2.6.23-rc6/net/ipv4/netfilter/ipt_SET.c
6175 ===================================================================
6176 --- /dev/null 1970-01-01 00:00:00.000000000 +0000
6177 +++ linux-2.6.23-rc6/net/ipv4/netfilter/ipt_SET.c 2007-09-21 16:24:01.000000000 +0800
6179 +/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
6180 + * Patrick Schaaf <bof@bof.de>
6181 + * Martin Josefsson <gandalf@wlug.westbo.se>
6182 + * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
6184 + * This program is free software; you can redistribute it and/or modify
6185 + * it under the terms of the GNU General Public License version 2 as
6186 + * published by the Free Software Foundation.
6189 +/* ipt_SET.c - netfilter target to manipulate IP sets */
6191 +#include <linux/types.h>
6192 +#include <linux/ip.h>
6193 +#include <linux/timer.h>
6194 +#include <linux/module.h>
6195 +#include <linux/netfilter.h>
6196 +#include <linux/netdevice.h>
6197 +#include <linux/if.h>
6198 +#include <linux/inetdevice.h>
6199 +#include <linux/version.h>
6200 +#include <linux/skbuff.h>
6201 +#include <net/protocol.h>
6202 +#include <net/checksum.h>
6203 +#include <linux/netfilter_ipv4.h>
6204 +#include <linux/netfilter_ipv4/ip_tables.h>
6205 +#include <linux/netfilter_ipv4/ipt_set.h>
6207 +static unsigned int
6208 +target(struct sk_buff **pskb,
6209 + const struct net_device *in,
6210 + const struct net_device *out,
6211 + unsigned int hooknum,
6212 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6213 + const struct xt_target *target,
6215 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6216 + const void *targinfo,
6219 + const void *targinfo)
6222 + const struct ipt_set_info_target *info = targinfo;
6224 + if (info->add_set.index != IP_SET_INVALID_ID)
6225 + ip_set_addip_kernel(info->add_set.index,
6227 + info->add_set.flags);
6228 + if (info->del_set.index != IP_SET_INVALID_ID)
6229 + ip_set_delip_kernel(info->del_set.index,
6231 + info->del_set.flags);
6233 + return IPT_CONTINUE;
6237 +checkentry(const char *tablename,
6238 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
6241 + const struct ipt_entry *e,
6243 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6244 + const struct xt_target *target,
6247 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6248 + unsigned int targinfosize,
6250 + unsigned int hook_mask)
6252 + struct ipt_set_info_target *info =
6253 + (struct ipt_set_info_target *) targinfo;
6254 + ip_set_id_t index;
6256 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6257 + if (targinfosize != IPT_ALIGN(sizeof(*info))) {
6258 + DP("bad target info size %u", targinfosize);
6263 + if (info->add_set.index != IP_SET_INVALID_ID) {
6264 + index = ip_set_get_byindex(info->add_set.index);
6265 + if (index == IP_SET_INVALID_ID) {
6266 + ip_set_printk("cannot find add_set index %u as target",
6267 + info->add_set.index);
6268 + return 0; /* error */
6272 + if (info->del_set.index != IP_SET_INVALID_ID) {
6273 + index = ip_set_get_byindex(info->del_set.index);
6274 + if (index == IP_SET_INVALID_ID) {
6275 + ip_set_printk("cannot find del_set index %u as target",
6276 + info->del_set.index);
6277 + return 0; /* error */
6280 + if (info->add_set.flags[IP_SET_MAX_BINDINGS] != 0
6281 + || info->del_set.flags[IP_SET_MAX_BINDINGS] != 0) {
6282 + ip_set_printk("That's nasty!");
6283 + return 0; /* error */
6289 +static void destroy(
6290 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6291 + const struct xt_target *target,
6293 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6294 + void *targetinfo, unsigned int targetsize)
6299 + struct ipt_set_info_target *info = targetinfo;
6301 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
6302 + if (targetsize != IPT_ALIGN(sizeof(struct ipt_set_info_target))) {
6303 + ip_set_printk("invalid targetsize %d", targetsize);
6307 + if (info->add_set.index != IP_SET_INVALID_ID)
6308 + ip_set_put(info->add_set.index);
6309 + if (info->del_set.index != IP_SET_INVALID_ID)
6310 + ip_set_put(info->del_set.index);
6313 +static struct ipt_target SET_target = {
6315 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
6316 + .family = AF_INET,
6319 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17)
6320 + .targetsize = sizeof(struct ipt_set_info_target),
6322 + .checkentry = checkentry,
6323 + .destroy = destroy,
6327 +MODULE_LICENSE("GPL");
6328 +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
6329 +MODULE_DESCRIPTION("iptables IP set target module");
6331 +#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
6332 +#define ipt_register_target xt_register_target
6333 +#define ipt_unregister_target xt_unregister_target
6336 +static int __init ipt_SET_init(void)
6338 + return ipt_register_target(&SET_target);
6341 +static void __exit ipt_SET_fini(void)
6343 + ipt_unregister_target(&SET_target);
6346 +module_init(ipt_SET_init);
6347 +module_exit(ipt_SET_fini);
6348 Index: linux-2.6.23-rc6/net/ipv4/netfilter/Kconfig
6349 ===================================================================
6350 --- linux-2.6.23-rc6.orig/net/ipv4/netfilter/Kconfig 2007-09-21 16:24:00.000000000 +0800
6351 +++ linux-2.6.23-rc6/net/ipv4/netfilter/Kconfig 2007-09-21 16:24:01.000000000 +0800
6352 @@ -426,5 +426,114 @@
6353 Allows altering the ARP packet payload: source and destination
6354 hardware and network addresses.
6357 + tristate "IP set support"
6358 + depends on INET && NETFILTER
6360 + This option adds IP set support to the kernel.
6361 + In order to define and use sets, you need the userspace utility
6364 + To compile it as a module, choose M here. If unsure, say N.
6366 +config IP_NF_SET_MAX
6367 + int "Maximum number of IP sets"
6370 + depends on IP_NF_SET
6372 + You can define here default value of the maximum number
6373 + of IP sets for the kernel.
6375 + The value can be overriden by the 'max_sets' module
6376 + parameter of the 'ip_set' module.
6378 +config IP_NF_SET_HASHSIZE
6379 + int "Hash size for bindings of IP sets"
6381 + depends on IP_NF_SET
6383 + You can define here default value of the hash size for
6384 + bindings of IP sets.
6386 + The value can be overriden by the 'hash_size' module
6387 + parameter of the 'ip_set' module.
6389 +config IP_NF_SET_IPMAP
6390 + tristate "ipmap set support"
6391 + depends on IP_NF_SET
6393 + This option adds the ipmap set type support.
6395 + To compile it as a module, choose M here. If unsure, say N.
6397 +config IP_NF_SET_MACIPMAP
6398 + tristate "macipmap set support"
6399 + depends on IP_NF_SET
6401 + This option adds the macipmap set type support.
6403 + To compile it as a module, choose M here. If unsure, say N.
6405 +config IP_NF_SET_PORTMAP
6406 + tristate "portmap set support"
6407 + depends on IP_NF_SET
6409 + This option adds the portmap set type support.
6411 + To compile it as a module, choose M here. If unsure, say N.
6413 +config IP_NF_SET_IPHASH
6414 + tristate "iphash set support"
6415 + depends on IP_NF_SET
6417 + This option adds the iphash set type support.
6419 + To compile it as a module, choose M here. If unsure, say N.
6421 +config IP_NF_SET_NETHASH
6422 + tristate "nethash set support"
6423 + depends on IP_NF_SET
6425 + This option adds the nethash set type support.
6427 + To compile it as a module, choose M here. If unsure, say N.
6429 +config IP_NF_SET_IPPORTHASH
6430 + tristate "ipporthash set support"
6431 + depends on IP_NF_SET
6433 + This option adds the ipporthash set type support.
6435 + To compile it as a module, choose M here. If unsure, say N.
6437 +config IP_NF_SET_IPTREE
6438 + tristate "iptree set support"
6439 + depends on IP_NF_SET
6441 + This option adds the iptree set type support.
6443 + To compile it as a module, choose M here. If unsure, say N.
6445 +config IP_NF_MATCH_SET
6446 + tristate "set match support"
6447 + depends on IP_NF_SET
6449 + Set matching matches against given IP sets.
6450 + You need the ipset utility to create and set up the sets.
6452 + To compile it as a module, choose M here. If unsure, say N.
6454 +config IP_NF_TARGET_SET
6455 + tristate "SET target support"
6456 + depends on IP_NF_SET
6458 + The SET target makes possible to add/delete entries
6460 + You need the ipset utility to create and set up the sets.
6462 + To compile it as a module, choose M here. If unsure, say N.
6467 Index: linux-2.6.23-rc6/net/ipv4/netfilter/Makefile
6468 ===================================================================
6469 --- linux-2.6.23-rc6.orig/net/ipv4/netfilter/Makefile 2007-09-21 16:24:00.000000000 +0800
6470 +++ linux-2.6.23-rc6/net/ipv4/netfilter/Makefile 2007-09-21 16:24:01.000000000 +0800
6472 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
6473 obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
6474 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
6475 +obj-$(CONFIG_IP_NF_MATCH_SET) += ipt_set.o
6476 obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o
6477 obj-$(CONFIG_IP_NF_MATCH_IPP2P) += ipt_ipp2p.o
6478 obj-$(CONFIG_IP_NF_MATCH_LAYER7) += ipt_layer7.o
6480 obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
6481 obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o
6482 obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
6483 +obj-$(CONFIG_IP_NF_TARGET_SET) += ipt_SET.o
6486 +obj-$(CONFIG_IP_NF_SET) += ip_set.o
6487 +obj-$(CONFIG_IP_NF_SET_IPMAP) += ip_set_ipmap.o
6488 +obj-$(CONFIG_IP_NF_SET_PORTMAP) += ip_set_portmap.o
6489 +obj-$(CONFIG_IP_NF_SET_MACIPMAP) += ip_set_macipmap.o
6490 +obj-$(CONFIG_IP_NF_SET_IPHASH) += ip_set_iphash.o
6491 +obj-$(CONFIG_IP_NF_SET_NETHASH) += ip_set_nethash.o
6492 +obj-$(CONFIG_IP_NF_SET_IPPORTHASH) += ip_set_ipporthash.o
6493 +obj-$(CONFIG_IP_NF_SET_IPTREE) += ip_set_iptree.o
6495 # generic ARP tables
6496 obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o