[mirror_ubuntu-artful-kernel.git] / net / netfilter / ipset / ip_set_hash_ipportnet.c

/* Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

/* Kernel module implementing an IP set type: the hash:ip,port,net type */

#include <linux/jhash.h>
#include <linux/module.h>
#include <linux/ip.h>
#include <linux/skbuff.h>
#include <linux/errno.h>
#include <linux/random.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/netlink.h>
#include <net/tcp.h>

#include <linux/netfilter.h>
#include <linux/netfilter/ipset/pfxlen.h>
#include <linux/netfilter/ipset/ip_set.h>
#include <linux/netfilter/ipset/ip_set_timeout.h>
#include <linux/netfilter/ipset/ip_set_getport.h>
#include <linux/netfilter/ipset/ip_set_hash.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
MODULE_DESCRIPTION("hash:ip,port,net type of IP sets");
MODULE_ALIAS("ip_set_hash:ip,port,net");

/* Type specific function prefix */
#define TYPE		hash_ipportnet

static bool
hash_ipportnet_same_set(const struct ip_set *a, const struct ip_set *b);

#define hash_ipportnet4_same_set	hash_ipportnet_same_set
#define hash_ipportnet6_same_set	hash_ipportnet_same_set

/* The type variant functions: IPv4 */

/* Member elements without timeout */
struct hash_ipportnet4_elem {
	__be32 ip;
	__be32 ip2;
	__be16 port;
	u8 cidr;
	u8 proto;
};

/* Member elements with timeout support */
struct hash_ipportnet4_telem {
	__be32 ip;
	__be32 ip2;
	__be16 port;
	u8 cidr;
	u8 proto;
	unsigned long timeout;
};

static inline bool
hash_ipportnet4_data_equal(const struct hash_ipportnet4_elem *ip1,
			   const struct hash_ipportnet4_elem *ip2)
{
	return ip1->ip == ip2->ip &&
	       ip1->ip2 == ip2->ip2 &&
	       ip1->cidr == ip2->cidr &&
	       ip1->port == ip2->port &&
	       ip1->proto == ip2->proto;
}

static inline bool
hash_ipportnet4_data_isnull(const struct hash_ipportnet4_elem *elem)
{
	return elem->proto == 0;
}

static inline void
hash_ipportnet4_data_copy(struct hash_ipportnet4_elem *dst,
			  const struct hash_ipportnet4_elem *src)
{
	memcpy(dst, src, sizeof(*dst));
}

static inline void
hash_ipportnet4_data_netmask(struct hash_ipportnet4_elem *elem, u8 cidr)
{
	elem->ip2 &= ip_set_netmask(cidr);
	elem->cidr = cidr;
}

static inline void
hash_ipportnet4_data_zero_out(struct hash_ipportnet4_elem *elem)
{
	elem->proto = 0;
}

static bool
hash_ipportnet4_data_list(struct sk_buff *skb,
			  const struct hash_ipportnet4_elem *data)
{
	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP2, data->ip2);
	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
	return 0;

nla_put_failure:
	return 1;
}

static bool
hash_ipportnet4_data_tlist(struct sk_buff *skb,
			   const struct hash_ipportnet4_elem *data)
{
	const struct hash_ipportnet4_telem *tdata =
		(const struct hash_ipportnet4_telem *)data;

	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, tdata->ip);
	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP2, tdata->ip2);
	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, tdata->port);
	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
		      htonl(ip_set_timeout_get(tdata->timeout)));

	return 0;

nla_put_failure:
	return 1;
}

#define IP_SET_HASH_WITH_PROTO
#define IP_SET_HASH_WITH_NETS

#define PF		4
#define HOST_MASK	32
#include <linux/netfilter/ipset/ip_set_ahash.h>

static inline void
hash_ipportnet4_data_next(struct ip_set_hash *h,
			  const struct hash_ipportnet4_elem *d)
{
	h->next.ip = ntohl(d->ip);
	h->next.port = ntohs(d->port);
	h->next.ip2 = ntohl(d->ip2);
}

static int
hash_ipportnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
		     enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{
	const struct ip_set_hash *h = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_ipportnet4_elem data =
		{ .cidr = h->nets[0].cidr || HOST_MASK };

	if (data.cidr == 0)
		return -EINVAL;
	if (adt == IPSET_TEST)
		data.cidr = HOST_MASK;

	if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
				 &data.port, &data.proto))
		return -EINVAL;

	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip);
	ip4addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &data.ip2);
	data.ip2 &= ip_set_netmask(data.cidr);

	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
}

static int
hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
		     enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
{
	const struct ip_set_hash *h = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_ipportnet4_elem data = { .cidr = HOST_MASK };
	u32 ip, ip_to, p = 0, port, port_to;
	u32 ip2_from = 0, ip2_to, ip2_last, ip2;
	u32 timeout = h->timeout;
	bool with_ports = false;
	int ret;

	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
		return -IPSET_ERR_PROTOCOL;

	if (tb[IPSET_ATTR_LINENO])
		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);

	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
	if (ret)
		return ret;

	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2], &ip2_from);
	if (ret)
		return ret;

	if (tb[IPSET_ATTR_CIDR2]) {
		data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
		if (!data.cidr)
			return -IPSET_ERR_INVALID_CIDR;
	}

	if (tb[IPSET_ATTR_PORT])
		data.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
	else
		return -IPSET_ERR_PROTOCOL;

	if (tb[IPSET_ATTR_PROTO]) {
		data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
		with_ports = ip_set_proto_with_ports(data.proto);

		if (data.proto == 0)
			return -IPSET_ERR_INVALID_PROTO;
	} else
		return -IPSET_ERR_MISSING_PROTO;

	if (!(with_ports || data.proto == IPPROTO_ICMP))
		data.port = 0;

	if (tb[IPSET_ATTR_TIMEOUT]) {
		if (!with_timeout(h->timeout))
			return -IPSET_ERR_TIMEOUT;
		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
	}

	with_ports = with_ports && tb[IPSET_ATTR_PORT_TO];
	if (adt == IPSET_TEST ||
	    !(tb[IPSET_ATTR_CIDR] || tb[IPSET_ATTR_IP_TO] || with_ports ||
	      tb[IPSET_ATTR_IP2_TO])) {
		data.ip = htonl(ip);
		data.ip2 = htonl(ip2_from & ip_set_hostmask(data.cidr));
		ret = adtfn(set, &data, timeout, flags);
		return ip_set_eexist(ret, flags) ? 0 : ret;
	}

	if (tb[IPSET_ATTR_IP_TO]) {
		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
		if (ret)
			return ret;
		if (ip > ip_to)
			swap(ip, ip_to);
	} else if (tb[IPSET_ATTR_CIDR]) {
		u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);

		if (cidr > 32)
			return -IPSET_ERR_INVALID_CIDR;
		ip_set_mask_from_to(ip, ip_to, cidr);
	}

	port_to = port = ntohs(data.port);
	if (tb[IPSET_ATTR_PORT_TO]) {
		port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
		if (port > port_to)
			swap(port, port_to);
	}
	if (tb[IPSET_ATTR_IP2_TO]) {
		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2_TO], &ip2_to);
		if (ret)
			return ret;
		if (ip2_from > ip2_to)
			swap(ip2_from, ip2_to);
		if (ip2_from + UINT_MAX == ip2_to)
			return -IPSET_ERR_HASH_RANGE;
	} else {
		ip_set_mask_from_to(ip2_from, ip2_to, data.cidr);
	}

	if (retried)
		ip = h->next.ip;
	for (; !before(ip_to, ip); ip++) {
		data.ip = htonl(ip);
		p = retried && ip == h->next.ip ? h->next.port : port;
		for (; p <= port_to; p++) {
			data.port = htons(p);
			ip2 = retried && ip == h->next.ip && p == h->next.port
				? h->next.ip2 : ip2_from;
			while (!after(ip2, ip2_to)) {
				data.ip2 = htonl(ip2);
				ip2_last = ip_set_range_to_cidr(ip2, ip2_to,
								&data.cidr);
				ret = adtfn(set, &data, timeout, flags);

				if (ret && !ip_set_eexist(ret, flags))
					return ret;
				else
					ret = 0;
				ip2 = ip2_last + 1;
			}
		}
	}
	return ret;
}

static bool
hash_ipportnet_same_set(const struct ip_set *a, const struct ip_set *b)
{
	const struct ip_set_hash *x = a->data;
	const struct ip_set_hash *y = b->data;

	/* Resizing changes htable_bits, so we ignore it */
	return x->maxelem == y->maxelem &&
	       x->timeout == y->timeout;
}

/* The type variant functions: IPv6 */

struct hash_ipportnet6_elem {
	union nf_inet_addr ip;
	union nf_inet_addr ip2;
	__be16 port;
	u8 cidr;
	u8 proto;
};

struct hash_ipportnet6_telem {
	union nf_inet_addr ip;
	union nf_inet_addr ip2;
	__be16 port;
	u8 cidr;
	u8 proto;
	unsigned long timeout;
};

static inline bool
hash_ipportnet6_data_equal(const struct hash_ipportnet6_elem *ip1,
			   const struct hash_ipportnet6_elem *ip2)
{
	return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 &&
	       ipv6_addr_cmp(&ip1->ip2.in6, &ip2->ip2.in6) == 0 &&
	       ip1->cidr == ip2->cidr &&
	       ip1->port == ip2->port &&
	       ip1->proto == ip2->proto;
}

static inline bool
hash_ipportnet6_data_isnull(const struct hash_ipportnet6_elem *elem)
{
	return elem->proto == 0;
}

static inline void
hash_ipportnet6_data_copy(struct hash_ipportnet6_elem *dst,
			  const struct hash_ipportnet6_elem *src)
{
	memcpy(dst, src, sizeof(*dst));
}

static inline void
hash_ipportnet6_data_zero_out(struct hash_ipportnet6_elem *elem)
{
	elem->proto = 0;
}

static inline void
ip6_netmask(union nf_inet_addr *ip, u8 prefix)
{
	ip->ip6[0] &= ip_set_netmask6(prefix)[0];
	ip->ip6[1] &= ip_set_netmask6(prefix)[1];
	ip->ip6[2] &= ip_set_netmask6(prefix)[2];
	ip->ip6[3] &= ip_set_netmask6(prefix)[3];
}

static inline void
hash_ipportnet6_data_netmask(struct hash_ipportnet6_elem *elem, u8 cidr)
{
	ip6_netmask(&elem->ip2, cidr);
	elem->cidr = cidr;
}

static bool
hash_ipportnet6_data_list(struct sk_buff *skb,
			  const struct hash_ipportnet6_elem *data)
{
	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &data->ip);
	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP2, &data->ip2);
	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
	return 0;

nla_put_failure:
	return 1;
}

static bool
hash_ipportnet6_data_tlist(struct sk_buff *skb,
			   const struct hash_ipportnet6_elem *data)
{
	const struct hash_ipportnet6_telem *e =
		(const struct hash_ipportnet6_telem *)data;

	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &e->ip);
	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP2, &data->ip2);
	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
		      htonl(ip_set_timeout_get(e->timeout)));
	return 0;

nla_put_failure:
	return 1;
}

#undef PF
#undef HOST_MASK

#define PF		6
#define HOST_MASK	128
#include <linux/netfilter/ipset/ip_set_ahash.h>

static inline void
hash_ipportnet6_data_next(struct ip_set_hash *h,
			  const struct hash_ipportnet6_elem *d)
{
	h->next.port = ntohs(d->port);
}

static int
hash_ipportnet6_kadt(struct ip_set *set, const struct sk_buff *skb,
		     enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{
	const struct ip_set_hash *h = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_ipportnet6_elem data =
		{ .cidr = h->nets[0].cidr || HOST_MASK };

	if (data.cidr == 0)
		return -EINVAL;
	if (adt == IPSET_TEST)
		data.cidr = HOST_MASK;

	if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
				 &data.port, &data.proto))
		return -EINVAL;

	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
	ip6addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &data.ip2.in6);
	ip6_netmask(&data.ip2, data.cidr);

	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
}

static int
hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
		     enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
{
	const struct ip_set_hash *h = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_ipportnet6_elem data = { .cidr = HOST_MASK };
	u32 port, port_to;
	u32 timeout = h->timeout;
	bool with_ports = false;
	int ret;

	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
		     tb[IPSET_ATTR_IP_TO] ||
		     tb[IPSET_ATTR_CIDR]))
		return -IPSET_ERR_PROTOCOL;
	if (unlikely(tb[IPSET_ATTR_IP_TO]))
		return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;

	if (tb[IPSET_ATTR_LINENO])
		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);

	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &data.ip);
	if (ret)
		return ret;

	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP2], &data.ip2);
	if (ret)
		return ret;

	if (tb[IPSET_ATTR_CIDR2])
		data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR2]);

	if (!data.cidr)
		return -IPSET_ERR_INVALID_CIDR;

	ip6_netmask(&data.ip2, data.cidr);

	if (tb[IPSET_ATTR_PORT])
		data.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
	else
		return -IPSET_ERR_PROTOCOL;

	if (tb[IPSET_ATTR_PROTO]) {
		data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
		with_ports = ip_set_proto_with_ports(data.proto);

		if (data.proto == 0)
			return -IPSET_ERR_INVALID_PROTO;
	} else
		return -IPSET_ERR_MISSING_PROTO;

	if (!(with_ports || data.proto == IPPROTO_ICMPV6))
		data.port = 0;

	if (tb[IPSET_ATTR_TIMEOUT]) {
		if (!with_timeout(h->timeout))
			return -IPSET_ERR_TIMEOUT;
		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
	}

	if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
		ret = adtfn(set, &data, timeout, flags);
		return ip_set_eexist(ret, flags) ? 0 : ret;
	}

	port = ntohs(data.port);
	port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
	if (port > port_to)
		swap(port, port_to);

	if (retried)
		port = h->next.port;
	for (; port <= port_to; port++) {
		data.port = htons(port);
		ret = adtfn(set, &data, timeout, flags);

		if (ret && !ip_set_eexist(ret, flags))
			return ret;
		else
			ret = 0;
	}
	return ret;
}

/* Create hash:ip type of sets */

static int
hash_ipportnet_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
{
	struct ip_set_hash *h;
	u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
	u8 hbits;

	if (!(set->family == AF_INET || set->family == AF_INET6))
		return -IPSET_ERR_INVALID_FAMILY;

	if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
		return -IPSET_ERR_PROTOCOL;

	if (tb[IPSET_ATTR_HASHSIZE]) {
		hashsize = ip_set_get_h32(tb[IPSET_ATTR_HASHSIZE]);
		if (hashsize < IPSET_MIMINAL_HASHSIZE)
			hashsize = IPSET_MIMINAL_HASHSIZE;
	}

	if (tb[IPSET_ATTR_MAXELEM])
		maxelem = ip_set_get_h32(tb[IPSET_ATTR_MAXELEM]);

	h = kzalloc(sizeof(*h)
		    + sizeof(struct ip_set_hash_nets)
		      * (set->family == AF_INET ? 32 : 128), GFP_KERNEL);
	if (!h)
		return -ENOMEM;

	h->maxelem = maxelem;
	get_random_bytes(&h->initval, sizeof(h->initval));
	h->timeout = IPSET_NO_TIMEOUT;

	hbits = htable_bits(hashsize);
	h->table = ip_set_alloc(
			sizeof(struct htable)
			+ jhash_size(hbits) * sizeof(struct hbucket));
	if (!h->table) {
		kfree(h);
		return -ENOMEM;
	}
	h->table->htable_bits = hbits;

	set->data = h;

	if (tb[IPSET_ATTR_TIMEOUT]) {
		h->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);

		set->variant = set->family == AF_INET
			? &hash_ipportnet4_tvariant
			: &hash_ipportnet6_tvariant;

		if (set->family == AF_INET)
			hash_ipportnet4_gc_init(set);
		else
			hash_ipportnet6_gc_init(set);
	} else {
		set->variant = set->family == AF_INET
			? &hash_ipportnet4_variant : &hash_ipportnet6_variant;
	}

	pr_debug("create %s hashsize %u (%u) maxelem %u: %p(%p)\n",
		 set->name, jhash_size(h->table->htable_bits),
		 h->table->htable_bits, h->maxelem, set->data, h->table);

	return 0;
}

static struct ip_set_type hash_ipportnet_type __read_mostly = {
	.name		= "hash:ip,port,net",
	.protocol	= IPSET_PROTOCOL,
	.features	= IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_TYPE_IP2,
	.dimension	= IPSET_DIM_THREE,
	.family		= AF_UNSPEC,
	.revision_min	= 0,
	/*		  1	   SCTP and UDPLITE support added */
	.revision_max	= 2,	/* Range as input support for IPv4 added */
	.create		= hash_ipportnet_create,
	.create_policy	= {
		[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
		[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
		[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
		[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
	},
	.adt_policy	= {
		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
		[IPSET_ATTR_IP2]	= { .type = NLA_NESTED },
		[IPSET_ATTR_IP2_TO]	= { .type = NLA_NESTED },
		[IPSET_ATTR_PORT]	= { .type = NLA_U16 },
		[IPSET_ATTR_PORT_TO]	= { .type = NLA_U16 },
		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
		[IPSET_ATTR_CIDR2]	= { .type = NLA_U8 },
		[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
	},
	.me		= THIS_MODULE,
};

static int __init
hash_ipportnet_init(void)
{
	return ip_set_type_register(&hash_ipportnet_type);
}

static void __exit
hash_ipportnet_fini(void)
{
	ip_set_type_unregister(&hash_ipportnet_type);
}

module_init(hash_ipportnet_init);
module_exit(hash_ipportnet_fini);
Commit	Line	Data
41d22f7b JK	1	/* Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
	2	*
	3	* This program is free software; you can redistribute it and/or modify
	4	* it under the terms of the GNU General Public License version 2 as
	5	* published by the Free Software Foundation.
	6	*/
	7
	8	/* Kernel module implementing an IP set type: the hash:ip,port,net type */
	9
	10	#include <linux/jhash.h>
	11	#include <linux/module.h>
	12	#include <linux/ip.h>
	13	#include <linux/skbuff.h>
	14	#include <linux/errno.h>
41d22f7b JK	15	#include <linux/random.h>
	16	#include <net/ip.h>
	17	#include <net/ipv6.h>
	18	#include <net/netlink.h>
	19	#include <net/tcp.h>
	20
	21	#include <linux/netfilter.h>
	22	#include <linux/netfilter/ipset/pfxlen.h>
	23	#include <linux/netfilter/ipset/ip_set.h>
	24	#include <linux/netfilter/ipset/ip_set_timeout.h>
	25	#include <linux/netfilter/ipset/ip_set_getport.h>
	26	#include <linux/netfilter/ipset/ip_set_hash.h>
	27
	28	MODULE_LICENSE("GPL");
	29	MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
	30	MODULE_DESCRIPTION("hash:ip,port,net type of IP sets");
	31	MODULE_ALIAS("ip_set_hash:ip,port,net");
	32
	33	/* Type specific function prefix */
	34	#define TYPE hash_ipportnet
	35
	36	static bool
	37	hash_ipportnet_same_set(const struct ip_set a, const struct ip_set b);
	38
	39	#define hash_ipportnet4_same_set hash_ipportnet_same_set
	40	#define hash_ipportnet6_same_set hash_ipportnet_same_set
	41
	42	/* The type variant functions: IPv4 */
	43
	44	/* Member elements without timeout */
	45	struct hash_ipportnet4_elem {
	46	__be32 ip;
	47	__be32 ip2;
	48	__be16 port;
	49	u8 cidr;
	50	u8 proto;
	51	};
	52
	53	/* Member elements with timeout support */
	54	struct hash_ipportnet4_telem {
	55	__be32 ip;
	56	__be32 ip2;
	57	__be16 port;
	58	u8 cidr;
	59	u8 proto;
	60	unsigned long timeout;
	61	};
	62
	63	static inline bool
	64	hash_ipportnet4_data_equal(const struct hash_ipportnet4_elem *ip1,
	65	const struct hash_ipportnet4_elem *ip2)
	66	{
	67	return ip1->ip == ip2->ip &&
	68	ip1->ip2 == ip2->ip2 &&
	69	ip1->cidr == ip2->cidr &&
	70	ip1->port == ip2->port &&
	71	ip1->proto == ip2->proto;
	72	}
	73
	74	static inline bool
	75	hash_ipportnet4_data_isnull(const struct hash_ipportnet4_elem *elem)
	76	{
	77	return elem->proto == 0;
	78	}
79
80	static inline void
81	hash_ipportnet4_data_copy(struct hash_ipportnet4_elem *dst,
82	const struct hash_ipportnet4_elem *src)
83	{
84	memcpy(dst, src, sizeof(*dst));
85	}
86
87	static inline void
88	hash_ipportnet4_data_netmask(struct hash_ipportnet4_elem *elem, u8 cidr)
89	{
90	elem->ip2 &= ip_set_netmask(cidr);
91	elem->cidr = cidr;
92	}
93
94	static inline void
95	hash_ipportnet4_data_zero_out(struct hash_ipportnet4_elem *elem)
96	{
97	elem->proto = 0;
98	}
99
100	static bool
101	hash_ipportnet4_data_list(struct sk_buff *skb,
102	const struct hash_ipportnet4_elem *data)
103	{
104	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
105	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP2, data->ip2);
106	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
107	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
108	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
109	return 0;
110
111	nla_put_failure:
112	return 1;
113	}
114
115	static bool
116	hash_ipportnet4_data_tlist(struct sk_buff *skb,
117	const struct hash_ipportnet4_elem *data)
118	{
119	const struct hash_ipportnet4_telem *tdata =
120	(const struct hash_ipportnet4_telem *)data;
121
122	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, tdata->ip);
123	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP2, tdata->ip2);
124	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, tdata->port);
125	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
126	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
127	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
128	htonl(ip_set_timeout_get(tdata->timeout)));
129
130	return 0;
131
132	nla_put_failure:
133	return 1;
134	}
135
136	#define IP_SET_HASH_WITH_PROTO
137	#define IP_SET_HASH_WITH_NETS
138
139	#define PF 4
140	#define HOST_MASK 32
141	#include <linux/netfilter/ipset/ip_set_ahash.h>
142
3d14b171 JK	143	static inline void
	144	hash_ipportnet4_data_next(struct ip_set_hash *h,
	145	const struct hash_ipportnet4_elem *d)
	146	{
	147	h->next.ip = ntohl(d->ip);
	148	h->next.port = ntohs(d->port);
d0d9e0a5	149	h->next.ip2 = ntohl(d->ip2);
3d14b171 JK	150	}
3d14b171 JK	151
41d22f7b JK	152	static int
41d22f7b JK	153	hash_ipportnet4_kadt(struct ip_set set, const struct sk_buff skb,
ac8cc925	154	enum ipset_adt adt, const struct ip_set_adt_opt *opt)
41d22f7b JK	155	{
	156	const struct ip_set_hash *h = set->data;
	157	ipset_adtfn adtfn = set->variant->adt[adt];
	158	struct hash_ipportnet4_elem data =
	159	{ .cidr = h->nets[0].cidr \|\| HOST_MASK };
	160
	161	if (data.cidr == 0)
	162	return -EINVAL;
	163	if (adt == IPSET_TEST)
	164	data.cidr = HOST_MASK;
	165
ac8cc925	166	if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
41d22f7b JK	167	&data.port, &data.proto))
	168	return -EINVAL;
	169
ac8cc925 JK	170	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip);
ac8cc925 JK	171	ip4addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &data.ip2);
41d22f7b JK	172	data.ip2 &= ip_set_netmask(data.cidr);
41d22f7b JK	173
ac8cc925	174	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
41d22f7b JK	175	}
	176
	177	static int
	178	hash_ipportnet4_uadt(struct ip_set set, struct nlattr tb[],
3d14b171	179	enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
41d22f7b JK	180	{
	181	const struct ip_set_hash *h = set->data;
	182	ipset_adtfn adtfn = set->variant->adt[adt];
	183	struct hash_ipportnet4_elem data = { .cidr = HOST_MASK };
3d14b171	184	u32 ip, ip_to, p = 0, port, port_to;
d0d9e0a5	185	u32 ip2_from = 0, ip2_to, ip2_last, ip2;
41d22f7b	186	u32 timeout = h->timeout;
5e0c1eb7	187	bool with_ports = false;
41d22f7b JK	188	int ret;
	189
	190	if (unlikely(!tb[IPSET_ATTR_IP] \|\| !tb[IPSET_ATTR_IP2] \|\|
	191	!ip_set_attr_netorder(tb, IPSET_ATTR_PORT) \|\|
	192	!ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) \|\|
	193	!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
	194	return -IPSET_ERR_PROTOCOL;
	195
	196	if (tb[IPSET_ATTR_LINENO])
	197	*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
	198
d0d9e0a5	199	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
41d22f7b JK	200	if (ret)
	201	return ret;
	202
d0d9e0a5	203	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2], &ip2_from);
41d22f7b JK	204	if (ret)
	205	return ret;
	206
d0d9e0a5	207	if (tb[IPSET_ATTR_CIDR2]) {
41d22f7b	208	data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
d0d9e0a5 JK	209	if (!data.cidr)
	210	return -IPSET_ERR_INVALID_CIDR;
	211	}
41d22f7b JK	212
	213	if (tb[IPSET_ATTR_PORT])
	214	data.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
	215	else
	216	return -IPSET_ERR_PROTOCOL;
	217
	218	if (tb[IPSET_ATTR_PROTO]) {
	219	data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
5e0c1eb7	220	with_ports = ip_set_proto_with_ports(data.proto);
41d22f7b JK	221
	222	if (data.proto == 0)
	223	return -IPSET_ERR_INVALID_PROTO;
	224	} else
	225	return -IPSET_ERR_MISSING_PROTO;
	226
5e0c1eb7	227	if (!(with_ports \|\| data.proto == IPPROTO_ICMP))
41d22f7b	228	data.port = 0;
41d22f7b JK	229
	230	if (tb[IPSET_ATTR_TIMEOUT]) {
	231	if (!with_timeout(h->timeout))
	232	return -IPSET_ERR_TIMEOUT;
	233	timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
	234	}
	235
d0d9e0a5	236	with_ports = with_ports && tb[IPSET_ATTR_PORT_TO];
41d22f7b	237	if (adt == IPSET_TEST \|\|
d0d9e0a5 JK	238	!(tb[IPSET_ATTR_CIDR] \|\| tb[IPSET_ATTR_IP_TO] \|\| with_ports \|\|
	239	tb[IPSET_ATTR_IP2_TO])) {
	240	data.ip = htonl(ip);
	241	data.ip2 = htonl(ip2_from & ip_set_hostmask(data.cidr));
5416219e	242	ret = adtfn(set, &data, timeout, flags);
41d22f7b JK	243	return ip_set_eexist(ret, flags) ? 0 : ret;
	244	}
	245
41d22f7b JK	246	if (tb[IPSET_ATTR_IP_TO]) {
	247	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
	248	if (ret)
	249	return ret;
	250	if (ip > ip_to)
	251	swap(ip, ip_to);
	252	} else if (tb[IPSET_ATTR_CIDR]) {
	253	u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
	254
	255	if (cidr > 32)
	256	return -IPSET_ERR_INVALID_CIDR;
e6146e86	257	ip_set_mask_from_to(ip, ip_to, cidr);
d0d9e0a5	258	}
41d22f7b	259
5e0c1eb7	260	port_to = port = ntohs(data.port);
d0d9e0a5	261	if (tb[IPSET_ATTR_PORT_TO]) {
41d22f7b JK	262	port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
	263	if (port > port_to)
	264	swap(port, port_to);
5e0c1eb7	265	}
d0d9e0a5 JK	266	if (tb[IPSET_ATTR_IP2_TO]) {
	267	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2_TO], &ip2_to);
	268	if (ret)
	269	return ret;
	270	if (ip2_from > ip2_to)
	271	swap(ip2_from, ip2_to);
	272	if (ip2_from + UINT_MAX == ip2_to)
	273	return -IPSET_ERR_HASH_RANGE;
	274	} else {
e6146e86	275	ip_set_mask_from_to(ip2_from, ip2_to, data.cidr);
d0d9e0a5	276	}
41d22f7b	277
3d14b171 JK	278	if (retried)
	279	ip = h->next.ip;
	280	for (; !before(ip_to, ip); ip++) {
d0d9e0a5	281	data.ip = htonl(ip);
3d14b171 JK	282	p = retried && ip == h->next.ip ? h->next.port : port;
3d14b171 JK	283	for (; p <= port_to; p++) {
41d22f7b	284	data.port = htons(p);
d0d9e0a5 JK	285	ip2 = retried && ip == h->next.ip && p == h->next.port
	286	? h->next.ip2 : ip2_from;
	287	while (!after(ip2, ip2_to)) {
	288	data.ip2 = htonl(ip2);
	289	ip2_last = ip_set_range_to_cidr(ip2, ip2_to,
	290	&data.cidr);
	291	ret = adtfn(set, &data, timeout, flags);
	292
	293	if (ret && !ip_set_eexist(ret, flags))
	294	return ret;
	295	else
	296	ret = 0;
	297	ip2 = ip2_last + 1;
	298	}
41d22f7b	299	}
3d14b171	300	}
41d22f7b JK	301	return ret;
	302	}
	303
	304	static bool
	305	hash_ipportnet_same_set(const struct ip_set a, const struct ip_set b)
	306	{
	307	const struct ip_set_hash *x = a->data;
	308	const struct ip_set_hash *y = b->data;
	309
	310	/* Resizing changes htable_bits, so we ignore it */
	311	return x->maxelem == y->maxelem &&
	312	x->timeout == y->timeout;
	313	}
	314
	315	/* The type variant functions: IPv6 */
	316
	317	struct hash_ipportnet6_elem {
	318	union nf_inet_addr ip;
	319	union nf_inet_addr ip2;
	320	__be16 port;
	321	u8 cidr;
	322	u8 proto;
	323	};
	324
	325	struct hash_ipportnet6_telem {
	326	union nf_inet_addr ip;
	327	union nf_inet_addr ip2;
	328	__be16 port;
	329	u8 cidr;
	330	u8 proto;
	331	unsigned long timeout;
	332	};
	333
	334	static inline bool
	335	hash_ipportnet6_data_equal(const struct hash_ipportnet6_elem *ip1,
	336	const struct hash_ipportnet6_elem *ip2)
	337	{
	338	return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 &&
	339	ipv6_addr_cmp(&ip1->ip2.in6, &ip2->ip2.in6) == 0 &&
	340	ip1->cidr == ip2->cidr &&
	341	ip1->port == ip2->port &&
	342	ip1->proto == ip2->proto;
	343	}
	344
	345	static inline bool
	346	hash_ipportnet6_data_isnull(const struct hash_ipportnet6_elem *elem)
	347	{
	348	return elem->proto == 0;
	349	}
	350
	351	static inline void
	352	hash_ipportnet6_data_copy(struct hash_ipportnet6_elem *dst,
	353	const struct hash_ipportnet6_elem *src)
	354	{
	355	memcpy(dst, src, sizeof(*dst));
	356	}
	357
	358	static inline void
	359	hash_ipportnet6_data_zero_out(struct hash_ipportnet6_elem *elem)
	360	{
	361	elem->proto = 0;
	362	}
	363
	364	static inline void
365	ip6_netmask(union nf_inet_addr *ip, u8 prefix)
366	{
367	ip->ip6[0] &= ip_set_netmask6(prefix)[0];
368	ip->ip6[1] &= ip_set_netmask6(prefix)[1];
369	ip->ip6[2] &= ip_set_netmask6(prefix)[2];
370	ip->ip6[3] &= ip_set_netmask6(prefix)[3];
371	}
372
373	static inline void
374	hash_ipportnet6_data_netmask(struct hash_ipportnet6_elem *elem, u8 cidr)
375	{
376	ip6_netmask(&elem->ip2, cidr);
377	elem->cidr = cidr;
378	}
379
380	static bool
381	hash_ipportnet6_data_list(struct sk_buff *skb,
382	const struct hash_ipportnet6_elem *data)
383	{
384	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &data->ip);
385	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP2, &data->ip2);
386	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
387	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
388	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
389	return 0;
390
391	nla_put_failure:
392	return 1;
393	}
394
395	static bool
396	hash_ipportnet6_data_tlist(struct sk_buff *skb,
397	const struct hash_ipportnet6_elem *data)
398	{
399	const struct hash_ipportnet6_telem *e =
400	(const struct hash_ipportnet6_telem *)data;
401
402	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &e->ip);
403	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP2, &data->ip2);
404	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
405	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
406	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
407	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
408	htonl(ip_set_timeout_get(e->timeout)));
409	return 0;
410
411	nla_put_failure:
412	return 1;
413	}
414
415	#undef PF
416	#undef HOST_MASK
417
418	#define PF 6
419	#define HOST_MASK 128
420	#include <linux/netfilter/ipset/ip_set_ahash.h>
421
3d14b171 JK	422	static inline void
	423	hash_ipportnet6_data_next(struct ip_set_hash *h,
	424	const struct hash_ipportnet6_elem *d)
	425	{
	426	h->next.port = ntohs(d->port);
	427	}
	428
41d22f7b JK	429	static int
41d22f7b JK	430	hash_ipportnet6_kadt(struct ip_set set, const struct sk_buff skb,
ac8cc925	431	enum ipset_adt adt, const struct ip_set_adt_opt *opt)
41d22f7b JK	432	{
	433	const struct ip_set_hash *h = set->data;
	434	ipset_adtfn adtfn = set->variant->adt[adt];
	435	struct hash_ipportnet6_elem data =
	436	{ .cidr = h->nets[0].cidr \|\| HOST_MASK };
	437
	438	if (data.cidr == 0)
	439	return -EINVAL;
	440	if (adt == IPSET_TEST)
	441	data.cidr = HOST_MASK;
	442
ac8cc925	443	if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
41d22f7b JK	444	&data.port, &data.proto))
	445	return -EINVAL;
	446
ac8cc925 JK	447	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
ac8cc925 JK	448	ip6addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &data.ip2.in6);
41d22f7b JK	449	ip6_netmask(&data.ip2, data.cidr);
41d22f7b JK	450
ac8cc925	451	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
41d22f7b JK	452	}
	453
	454	static int
	455	hash_ipportnet6_uadt(struct ip_set set, struct nlattr tb[],
3d14b171	456	enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
41d22f7b JK	457	{
	458	const struct ip_set_hash *h = set->data;
	459	ipset_adtfn adtfn = set->variant->adt[adt];
	460	struct hash_ipportnet6_elem data = { .cidr = HOST_MASK };
	461	u32 port, port_to;
	462	u32 timeout = h->timeout;
5e0c1eb7	463	bool with_ports = false;
41d22f7b JK	464	int ret;
	465
	466	if (unlikely(!tb[IPSET_ATTR_IP] \|\| !tb[IPSET_ATTR_IP2] \|\|
	467	!ip_set_attr_netorder(tb, IPSET_ATTR_PORT) \|\|
	468	!ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) \|\|
	469	!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) \|\|
	470	tb[IPSET_ATTR_IP_TO] \|\|
	471	tb[IPSET_ATTR_CIDR]))
	472	return -IPSET_ERR_PROTOCOL;
d0d9e0a5 JK	473	if (unlikely(tb[IPSET_ATTR_IP_TO]))
d0d9e0a5 JK	474	return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
41d22f7b JK	475
	476	if (tb[IPSET_ATTR_LINENO])
	477	*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
	478
	479	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &data.ip);
	480	if (ret)
	481	return ret;
	482
	483	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP2], &data.ip2);
	484	if (ret)
	485	return ret;
	486
	487	if (tb[IPSET_ATTR_CIDR2])
	488	data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
	489
	490	if (!data.cidr)
	491	return -IPSET_ERR_INVALID_CIDR;
	492
	493	ip6_netmask(&data.ip2, data.cidr);
	494
	495	if (tb[IPSET_ATTR_PORT])
	496	data.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
	497	else
	498	return -IPSET_ERR_PROTOCOL;
	499
	500	if (tb[IPSET_ATTR_PROTO]) {
	501	data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
5e0c1eb7	502	with_ports = ip_set_proto_with_ports(data.proto);
41d22f7b JK	503
	504	if (data.proto == 0)
	505	return -IPSET_ERR_INVALID_PROTO;
	506	} else
	507	return -IPSET_ERR_MISSING_PROTO;
	508
5e0c1eb7	509	if (!(with_ports \|\| data.proto == IPPROTO_ICMPV6))
41d22f7b	510	data.port = 0;
41d22f7b JK	511
	512	if (tb[IPSET_ATTR_TIMEOUT]) {
	513	if (!with_timeout(h->timeout))
	514	return -IPSET_ERR_TIMEOUT;
	515	timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
	516	}
	517
5e0c1eb7	518	if (adt == IPSET_TEST \|\| !with_ports \|\| !tb[IPSET_ATTR_PORT_TO]) {
5416219e	519	ret = adtfn(set, &data, timeout, flags);
41d22f7b JK	520	return ip_set_eexist(ret, flags) ? 0 : ret;
	521	}
	522
	523	port = ntohs(data.port);
	524	port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
	525	if (port > port_to)
	526	swap(port, port_to);
	527
3d14b171 JK	528	if (retried)
3d14b171 JK	529	port = h->next.port;
41d22f7b JK	530	for (; port <= port_to; port++) {
41d22f7b JK	531	data.port = htons(port);
5416219e	532	ret = adtfn(set, &data, timeout, flags);
41d22f7b JK	533
	534	if (ret && !ip_set_eexist(ret, flags))
	535	return ret;
	536	else
	537	ret = 0;
	538	}
	539	return ret;
	540	}
	541
	542	/* Create hash:ip type of sets */
	543
	544	static int
	545	hash_ipportnet_create(struct ip_set set, struct nlattr tb[], u32 flags)
	546	{
	547	struct ip_set_hash *h;
	548	u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
	549	u8 hbits;
	550
	551	if (!(set->family == AF_INET \|\| set->family == AF_INET6))
	552	return -IPSET_ERR_INVALID_FAMILY;
	553
	554	if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) \|\|
	555	!ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) \|\|
	556	!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
	557	return -IPSET_ERR_PROTOCOL;
	558
	559	if (tb[IPSET_ATTR_HASHSIZE]) {
	560	hashsize = ip_set_get_h32(tb[IPSET_ATTR_HASHSIZE]);
	561	if (hashsize < IPSET_MIMINAL_HASHSIZE)
	562	hashsize = IPSET_MIMINAL_HASHSIZE;
	563	}
	564
	565	if (tb[IPSET_ATTR_MAXELEM])
	566	maxelem = ip_set_get_h32(tb[IPSET_ATTR_MAXELEM]);
	567
	568	h = kzalloc(sizeof(*h)
	569	+ sizeof(struct ip_set_hash_nets)
	570	* (set->family == AF_INET ? 32 : 128), GFP_KERNEL);
	571	if (!h)
	572	return -ENOMEM;
	573
	574	h->maxelem = maxelem;
	575	get_random_bytes(&h->initval, sizeof(h->initval));
	576	h->timeout = IPSET_NO_TIMEOUT;
	577
	578	hbits = htable_bits(hashsize);
	579	h->table = ip_set_alloc(
	580	sizeof(struct htable)
	581	+ jhash_size(hbits) * sizeof(struct hbucket));
	582	if (!h->table) {
	583	kfree(h);
	584	return -ENOMEM;
	585	}
	586	h->table->htable_bits = hbits;
	587
	588	set->data = h;
	589
	590	if (tb[IPSET_ATTR_TIMEOUT]) {
	591	h->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
	592
	593	set->variant = set->family == AF_INET
	594	? &hash_ipportnet4_tvariant
	595	: &hash_ipportnet6_tvariant;
	596
597	if (set->family == AF_INET)
598	hash_ipportnet4_gc_init(set);
599	else
600	hash_ipportnet6_gc_init(set);
601	} else {
602	set->variant = set->family == AF_INET
603	? &hash_ipportnet4_variant : &hash_ipportnet6_variant;
604	}
605
606	pr_debug("create %s hashsize %u (%u) maxelem %u: %p(%p)\n",
607	set->name, jhash_size(h->table->htable_bits),
608	h->table->htable_bits, h->maxelem, set->data, h->table);
609
610	return 0;
611	}
612
613	static struct ip_set_type hash_ipportnet_type __read_mostly = {
614	.name = "hash:ip,port,net",
615	.protocol = IPSET_PROTOCOL,
616	.features = IPSET_TYPE_IP \| IPSET_TYPE_PORT \| IPSET_TYPE_IP2,
617	.dimension = IPSET_DIM_THREE,
618	.family = AF_UNSPEC,
f1e00b39	619	.revision_min = 0,
d0d9e0a5 JK	620	/* 1 SCTP and UDPLITE support added */
d0d9e0a5 JK	621	.revision_max = 2, /* Range as input support for IPv4 added */
41d22f7b JK	622	.create = hash_ipportnet_create,
	623	.create_policy = {
	624	[IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
	625	[IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
	626	[IPSET_ATTR_PROBES] = { .type = NLA_U8 },
	627	[IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
	628	[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
	629	},
	630	.adt_policy = {
	631	[IPSET_ATTR_IP] = { .type = NLA_NESTED },
	632	[IPSET_ATTR_IP_TO] = { .type = NLA_NESTED },
	633	[IPSET_ATTR_IP2] = { .type = NLA_NESTED },
d0d9e0a5	634	[IPSET_ATTR_IP2_TO] = { .type = NLA_NESTED },
41d22f7b JK	635	[IPSET_ATTR_PORT] = { .type = NLA_U16 },
	636	[IPSET_ATTR_PORT_TO] = { .type = NLA_U16 },
	637	[IPSET_ATTR_CIDR] = { .type = NLA_U8 },
	638	[IPSET_ATTR_CIDR2] = { .type = NLA_U8 },
	639	[IPSET_ATTR_PROTO] = { .type = NLA_U8 },
	640	[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
	641	[IPSET_ATTR_LINENO] = { .type = NLA_U32 },
	642	},
	643	.me = THIS_MODULE,
	644	};
	645
	646	static int __init
	647	hash_ipportnet_init(void)
	648	{
	649	return ip_set_type_register(&hash_ipportnet_type);
	650	}
	651
	652	static void __exit
	653	hash_ipportnet_fini(void)
	654	{
	655	ip_set_type_unregister(&hash_ipportnet_type);
	656	}
	657
	658	module_init(hash_ipportnet_init);
	659	module_exit(hash_ipportnet_fini);