[mirror_ubuntu-hirsute-kernel.git] / net / netfilter / ipset / ip_set_hash_ipportnet.c

/* Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

/* Kernel module implementing an IP set type: the hash:ip,port,net type */

#include <linux/jhash.h>
#include <linux/module.h>
#include <linux/ip.h>
#include <linux/skbuff.h>
#include <linux/errno.h>
#include <linux/random.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/netlink.h>
#include <net/tcp.h>

#include <linux/netfilter.h>
#include <linux/netfilter/ipset/pfxlen.h>
#include <linux/netfilter/ipset/ip_set.h>
#include <linux/netfilter/ipset/ip_set_timeout.h>
#include <linux/netfilter/ipset/ip_set_getport.h>
#include <linux/netfilter/ipset/ip_set_hash.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
MODULE_DESCRIPTION("hash:ip,port,net type of IP sets");
MODULE_ALIAS("ip_set_hash:ip,port,net");

/* Type specific function prefix */
#define TYPE		hash_ipportnet

static bool
hash_ipportnet_same_set(const struct ip_set *a, const struct ip_set *b);

#define hash_ipportnet4_same_set	hash_ipportnet_same_set
#define hash_ipportnet6_same_set	hash_ipportnet_same_set

/* The type variant functions: IPv4 */

/* Member elements without timeout */
struct hash_ipportnet4_elem {
	__be32 ip;
	__be32 ip2;
	__be16 port;
	u8 cidr;
	u8 proto;
};

/* Member elements with timeout support */
struct hash_ipportnet4_telem {
	__be32 ip;
	__be32 ip2;
	__be16 port;
	u8 cidr;
	u8 proto;
	unsigned long timeout;
};

static inline bool
hash_ipportnet4_data_equal(const struct hash_ipportnet4_elem *ip1,
			   const struct hash_ipportnet4_elem *ip2)
{
	return ip1->ip == ip2->ip &&
	       ip1->ip2 == ip2->ip2 &&
	       ip1->cidr == ip2->cidr &&
	       ip1->port == ip2->port &&
	       ip1->proto == ip2->proto;
}

static inline bool
hash_ipportnet4_data_isnull(const struct hash_ipportnet4_elem *elem)
{
	return elem->proto == 0;
}

static inline void
hash_ipportnet4_data_copy(struct hash_ipportnet4_elem *dst,
			  const struct hash_ipportnet4_elem *src)
{
	memcpy(dst, src, sizeof(*dst));
}

static inline void
hash_ipportnet4_data_netmask(struct hash_ipportnet4_elem *elem, u8 cidr)
{
	elem->ip2 &= ip_set_netmask(cidr);
	elem->cidr = cidr;
}

static inline void
hash_ipportnet4_data_zero_out(struct hash_ipportnet4_elem *elem)
{
	elem->proto = 0;
}

static bool
hash_ipportnet4_data_list(struct sk_buff *skb,
			  const struct hash_ipportnet4_elem *data)
{
	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP2, data->ip2);
	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
	return 0;

nla_put_failure:
	return 1;
}

static bool
hash_ipportnet4_data_tlist(struct sk_buff *skb,
			   const struct hash_ipportnet4_elem *data)
{
	const struct hash_ipportnet4_telem *tdata =
		(const struct hash_ipportnet4_telem *)data;

	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, tdata->ip);
	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP2, tdata->ip2);
	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, tdata->port);
	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
		      htonl(ip_set_timeout_get(tdata->timeout)));

	return 0;

nla_put_failure:
	return 1;
}

#define IP_SET_HASH_WITH_PROTO
#define IP_SET_HASH_WITH_NETS

#define PF		4
#define HOST_MASK	32
#include <linux/netfilter/ipset/ip_set_ahash.h>

static inline void
hash_ipportnet4_data_next(struct ip_set_hash *h,
			  const struct hash_ipportnet4_elem *d)
{
	h->next.ip = ntohl(d->ip);
	h->next.port = ntohs(d->port);
}

static int
hash_ipportnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
		     enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{
	const struct ip_set_hash *h = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_ipportnet4_elem data =
		{ .cidr = h->nets[0].cidr || HOST_MASK };

	if (data.cidr == 0)
		return -EINVAL;
	if (adt == IPSET_TEST)
		data.cidr = HOST_MASK;

	if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
				 &data.port, &data.proto))
		return -EINVAL;

	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip);
	ip4addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &data.ip2);
	data.ip2 &= ip_set_netmask(data.cidr);

	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
}

static int
hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
		     enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
{
	const struct ip_set_hash *h = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_ipportnet4_elem data = { .cidr = HOST_MASK };
	u32 ip, ip_to, p = 0, port, port_to;
	u32 timeout = h->timeout;
	bool with_ports = false;
	int ret;

	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
		return -IPSET_ERR_PROTOCOL;

	if (tb[IPSET_ATTR_LINENO])
		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);

	ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP], &data.ip);
	if (ret)
		return ret;

	ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP2], &data.ip2);
	if (ret)
		return ret;

	if (tb[IPSET_ATTR_CIDR2])
		data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR2]);

	if (!data.cidr)
		return -IPSET_ERR_INVALID_CIDR;

	data.ip2 &= ip_set_netmask(data.cidr);

	if (tb[IPSET_ATTR_PORT])
		data.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
	else
		return -IPSET_ERR_PROTOCOL;

	if (tb[IPSET_ATTR_PROTO]) {
		data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
		with_ports = ip_set_proto_with_ports(data.proto);

		if (data.proto == 0)
			return -IPSET_ERR_INVALID_PROTO;
	} else
		return -IPSET_ERR_MISSING_PROTO;

	if (!(with_ports || data.proto == IPPROTO_ICMP))
		data.port = 0;

	if (tb[IPSET_ATTR_TIMEOUT]) {
		if (!with_timeout(h->timeout))
			return -IPSET_ERR_TIMEOUT;
		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
	}

	if (adt == IPSET_TEST ||
	    !(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_CIDR] ||
	      tb[IPSET_ATTR_PORT_TO])) {
		ret = adtfn(set, &data, timeout, flags);
		return ip_set_eexist(ret, flags) ? 0 : ret;
	}

	ip = ntohl(data.ip);
	if (tb[IPSET_ATTR_IP_TO]) {
		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
		if (ret)
			return ret;
		if (ip > ip_to)
			swap(ip, ip_to);
	} else if (tb[IPSET_ATTR_CIDR]) {
		u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);

		if (cidr > 32)
			return -IPSET_ERR_INVALID_CIDR;
		ip &= ip_set_hostmask(cidr);
		ip_to = ip | ~ip_set_hostmask(cidr);
	} else
		ip_to = ip;

	port_to = port = ntohs(data.port);
	if (with_ports && tb[IPSET_ATTR_PORT_TO]) {
		port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
		if (port > port_to)
			swap(port, port_to);
	}

	if (retried)
		ip = h->next.ip;
	for (; !before(ip_to, ip); ip++) {
		p = retried && ip == h->next.ip ? h->next.port : port;
		for (; p <= port_to; p++) {
			data.ip = htonl(ip);
			data.port = htons(p);
			ret = adtfn(set, &data, timeout, flags);

			if (ret && !ip_set_eexist(ret, flags))
				return ret;
			else
				ret = 0;
		}
	}
	return ret;
}

static bool
hash_ipportnet_same_set(const struct ip_set *a, const struct ip_set *b)
{
	const struct ip_set_hash *x = a->data;
	const struct ip_set_hash *y = b->data;

	/* Resizing changes htable_bits, so we ignore it */
	return x->maxelem == y->maxelem &&
	       x->timeout == y->timeout;
}

/* The type variant functions: IPv6 */

struct hash_ipportnet6_elem {
	union nf_inet_addr ip;
	union nf_inet_addr ip2;
	__be16 port;
	u8 cidr;
	u8 proto;
};

struct hash_ipportnet6_telem {
	union nf_inet_addr ip;
	union nf_inet_addr ip2;
	__be16 port;
	u8 cidr;
	u8 proto;
	unsigned long timeout;
};

static inline bool
hash_ipportnet6_data_equal(const struct hash_ipportnet6_elem *ip1,
			   const struct hash_ipportnet6_elem *ip2)
{
	return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 &&
	       ipv6_addr_cmp(&ip1->ip2.in6, &ip2->ip2.in6) == 0 &&
	       ip1->cidr == ip2->cidr &&
	       ip1->port == ip2->port &&
	       ip1->proto == ip2->proto;
}

static inline bool
hash_ipportnet6_data_isnull(const struct hash_ipportnet6_elem *elem)
{
	return elem->proto == 0;
}

static inline void
hash_ipportnet6_data_copy(struct hash_ipportnet6_elem *dst,
			  const struct hash_ipportnet6_elem *src)
{
	memcpy(dst, src, sizeof(*dst));
}

static inline void
hash_ipportnet6_data_zero_out(struct hash_ipportnet6_elem *elem)
{
	elem->proto = 0;
}

static inline void
ip6_netmask(union nf_inet_addr *ip, u8 prefix)
{
	ip->ip6[0] &= ip_set_netmask6(prefix)[0];
	ip->ip6[1] &= ip_set_netmask6(prefix)[1];
	ip->ip6[2] &= ip_set_netmask6(prefix)[2];
	ip->ip6[3] &= ip_set_netmask6(prefix)[3];
}

static inline void
hash_ipportnet6_data_netmask(struct hash_ipportnet6_elem *elem, u8 cidr)
{
	ip6_netmask(&elem->ip2, cidr);
	elem->cidr = cidr;
}

static bool
hash_ipportnet6_data_list(struct sk_buff *skb,
			  const struct hash_ipportnet6_elem *data)
{
	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &data->ip);
	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP2, &data->ip2);
	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
	return 0;

nla_put_failure:
	return 1;
}

static bool
hash_ipportnet6_data_tlist(struct sk_buff *skb,
			   const struct hash_ipportnet6_elem *data)
{
	const struct hash_ipportnet6_telem *e =
		(const struct hash_ipportnet6_telem *)data;

	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &e->ip);
	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP2, &data->ip2);
	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
		      htonl(ip_set_timeout_get(e->timeout)));
	return 0;

nla_put_failure:
	return 1;
}

#undef PF
#undef HOST_MASK

#define PF		6
#define HOST_MASK	128
#include <linux/netfilter/ipset/ip_set_ahash.h>

static inline void
hash_ipportnet6_data_next(struct ip_set_hash *h,
			  const struct hash_ipportnet6_elem *d)
{
	h->next.port = ntohs(d->port);
}

static int
hash_ipportnet6_kadt(struct ip_set *set, const struct sk_buff *skb,
		     enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{
	const struct ip_set_hash *h = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_ipportnet6_elem data =
		{ .cidr = h->nets[0].cidr || HOST_MASK };

	if (data.cidr == 0)
		return -EINVAL;
	if (adt == IPSET_TEST)
		data.cidr = HOST_MASK;

	if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
				 &data.port, &data.proto))
		return -EINVAL;

	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
	ip6addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &data.ip2.in6);
	ip6_netmask(&data.ip2, data.cidr);

	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
}

static int
hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
		     enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
{
	const struct ip_set_hash *h = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_ipportnet6_elem data = { .cidr = HOST_MASK };
	u32 port, port_to;
	u32 timeout = h->timeout;
	bool with_ports = false;
	int ret;

	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
		     tb[IPSET_ATTR_IP_TO] ||
		     tb[IPSET_ATTR_CIDR]))
		return -IPSET_ERR_PROTOCOL;

	if (tb[IPSET_ATTR_LINENO])
		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);

	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &data.ip);
	if (ret)
		return ret;

	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP2], &data.ip2);
	if (ret)
		return ret;

	if (tb[IPSET_ATTR_CIDR2])
		data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR2]);

	if (!data.cidr)
		return -IPSET_ERR_INVALID_CIDR;

	ip6_netmask(&data.ip2, data.cidr);

	if (tb[IPSET_ATTR_PORT])
		data.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
	else
		return -IPSET_ERR_PROTOCOL;

	if (tb[IPSET_ATTR_PROTO]) {
		data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
		with_ports = ip_set_proto_with_ports(data.proto);

		if (data.proto == 0)
			return -IPSET_ERR_INVALID_PROTO;
	} else
		return -IPSET_ERR_MISSING_PROTO;

	if (!(with_ports || data.proto == IPPROTO_ICMPV6))
		data.port = 0;

	if (tb[IPSET_ATTR_TIMEOUT]) {
		if (!with_timeout(h->timeout))
			return -IPSET_ERR_TIMEOUT;
		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
	}

	if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
		ret = adtfn(set, &data, timeout, flags);
		return ip_set_eexist(ret, flags) ? 0 : ret;
	}

	port = ntohs(data.port);
	port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
	if (port > port_to)
		swap(port, port_to);

	if (retried)
		port = h->next.port;
	for (; port <= port_to; port++) {
		data.port = htons(port);
		ret = adtfn(set, &data, timeout, flags);

		if (ret && !ip_set_eexist(ret, flags))
			return ret;
		else
			ret = 0;
	}
	return ret;
}

/* Create hash:ip type of sets */

static int
hash_ipportnet_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
{
	struct ip_set_hash *h;
	u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
	u8 hbits;

	if (!(set->family == AF_INET || set->family == AF_INET6))
		return -IPSET_ERR_INVALID_FAMILY;

	if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
		return -IPSET_ERR_PROTOCOL;

	if (tb[IPSET_ATTR_HASHSIZE]) {
		hashsize = ip_set_get_h32(tb[IPSET_ATTR_HASHSIZE]);
		if (hashsize < IPSET_MIMINAL_HASHSIZE)
			hashsize = IPSET_MIMINAL_HASHSIZE;
	}

	if (tb[IPSET_ATTR_MAXELEM])
		maxelem = ip_set_get_h32(tb[IPSET_ATTR_MAXELEM]);

	h = kzalloc(sizeof(*h)
		    + sizeof(struct ip_set_hash_nets)
		      * (set->family == AF_INET ? 32 : 128), GFP_KERNEL);
	if (!h)
		return -ENOMEM;

	h->maxelem = maxelem;
	get_random_bytes(&h->initval, sizeof(h->initval));
	h->timeout = IPSET_NO_TIMEOUT;

	hbits = htable_bits(hashsize);
	h->table = ip_set_alloc(
			sizeof(struct htable)
			+ jhash_size(hbits) * sizeof(struct hbucket));
	if (!h->table) {
		kfree(h);
		return -ENOMEM;
	}
	h->table->htable_bits = hbits;

	set->data = h;

	if (tb[IPSET_ATTR_TIMEOUT]) {
		h->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);

		set->variant = set->family == AF_INET
			? &hash_ipportnet4_tvariant
			: &hash_ipportnet6_tvariant;

		if (set->family == AF_INET)
			hash_ipportnet4_gc_init(set);
		else
			hash_ipportnet6_gc_init(set);
	} else {
		set->variant = set->family == AF_INET
			? &hash_ipportnet4_variant : &hash_ipportnet6_variant;
	}

	pr_debug("create %s hashsize %u (%u) maxelem %u: %p(%p)\n",
		 set->name, jhash_size(h->table->htable_bits),
		 h->table->htable_bits, h->maxelem, set->data, h->table);

	return 0;
}

static struct ip_set_type hash_ipportnet_type __read_mostly = {
	.name		= "hash:ip,port,net",
	.protocol	= IPSET_PROTOCOL,
	.features	= IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_TYPE_IP2,
	.dimension	= IPSET_DIM_THREE,
	.family		= AF_UNSPEC,
	.revision_min	= 0,
	.revision_max	= 1,	/* SCTP and UDPLITE support added */
	.create		= hash_ipportnet_create,
	.create_policy	= {
		[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
		[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
		[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
		[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
	},
	.adt_policy	= {
		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
		[IPSET_ATTR_IP2]	= { .type = NLA_NESTED },
		[IPSET_ATTR_PORT]	= { .type = NLA_U16 },
		[IPSET_ATTR_PORT_TO]	= { .type = NLA_U16 },
		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
		[IPSET_ATTR_CIDR2]	= { .type = NLA_U8 },
		[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
	},
	.me		= THIS_MODULE,
};

static int __init
hash_ipportnet_init(void)
{
	return ip_set_type_register(&hash_ipportnet_type);
}

static void __exit
hash_ipportnet_fini(void)
{
	ip_set_type_unregister(&hash_ipportnet_type);
}

module_init(hash_ipportnet_init);
module_exit(hash_ipportnet_fini);
Commit	Line	Data
41d22f7b JK	1	/* Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
	2	*
	3	* This program is free software; you can redistribute it and/or modify
	4	* it under the terms of the GNU General Public License version 2 as
	5	* published by the Free Software Foundation.
	6	*/
	7
	8	/* Kernel module implementing an IP set type: the hash:ip,port,net type */
	9
	10	#include <linux/jhash.h>
	11	#include <linux/module.h>
	12	#include <linux/ip.h>
	13	#include <linux/skbuff.h>
	14	#include <linux/errno.h>
41d22f7b JK	15	#include <linux/random.h>
	16	#include <net/ip.h>
	17	#include <net/ipv6.h>
	18	#include <net/netlink.h>
	19	#include <net/tcp.h>
	20
	21	#include <linux/netfilter.h>
	22	#include <linux/netfilter/ipset/pfxlen.h>
	23	#include <linux/netfilter/ipset/ip_set.h>
	24	#include <linux/netfilter/ipset/ip_set_timeout.h>
	25	#include <linux/netfilter/ipset/ip_set_getport.h>
	26	#include <linux/netfilter/ipset/ip_set_hash.h>
	27
	28	MODULE_LICENSE("GPL");
	29	MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
	30	MODULE_DESCRIPTION("hash:ip,port,net type of IP sets");
	31	MODULE_ALIAS("ip_set_hash:ip,port,net");
	32
	33	/* Type specific function prefix */
	34	#define TYPE hash_ipportnet
	35
	36	static bool
	37	hash_ipportnet_same_set(const struct ip_set a, const struct ip_set b);
	38
	39	#define hash_ipportnet4_same_set hash_ipportnet_same_set
	40	#define hash_ipportnet6_same_set hash_ipportnet_same_set
	41
	42	/* The type variant functions: IPv4 */
	43
	44	/* Member elements without timeout */
	45	struct hash_ipportnet4_elem {
	46	__be32 ip;
	47	__be32 ip2;
	48	__be16 port;
	49	u8 cidr;
	50	u8 proto;
	51	};
	52
	53	/* Member elements with timeout support */
	54	struct hash_ipportnet4_telem {
	55	__be32 ip;
	56	__be32 ip2;
	57	__be16 port;
	58	u8 cidr;
	59	u8 proto;
	60	unsigned long timeout;
	61	};
	62
	63	static inline bool
	64	hash_ipportnet4_data_equal(const struct hash_ipportnet4_elem *ip1,
	65	const struct hash_ipportnet4_elem *ip2)
	66	{
	67	return ip1->ip == ip2->ip &&
	68	ip1->ip2 == ip2->ip2 &&
	69	ip1->cidr == ip2->cidr &&
	70	ip1->port == ip2->port &&
	71	ip1->proto == ip2->proto;
	72	}
	73
	74	static inline bool
	75	hash_ipportnet4_data_isnull(const struct hash_ipportnet4_elem *elem)
	76	{
	77	return elem->proto == 0;
	78	}
79
80	static inline void
81	hash_ipportnet4_data_copy(struct hash_ipportnet4_elem *dst,
82	const struct hash_ipportnet4_elem *src)
83	{
84	memcpy(dst, src, sizeof(*dst));
85	}
86
87	static inline void
88	hash_ipportnet4_data_netmask(struct hash_ipportnet4_elem *elem, u8 cidr)
89	{
90	elem->ip2 &= ip_set_netmask(cidr);
91	elem->cidr = cidr;
92	}
93
94	static inline void
95	hash_ipportnet4_data_zero_out(struct hash_ipportnet4_elem *elem)
96	{
97	elem->proto = 0;
98	}
99
100	static bool
101	hash_ipportnet4_data_list(struct sk_buff *skb,
102	const struct hash_ipportnet4_elem *data)
103	{
104	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
105	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP2, data->ip2);
106	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
107	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
108	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
109	return 0;
110
111	nla_put_failure:
112	return 1;
113	}
114
115	static bool
116	hash_ipportnet4_data_tlist(struct sk_buff *skb,
117	const struct hash_ipportnet4_elem *data)
118	{
119	const struct hash_ipportnet4_telem *tdata =
120	(const struct hash_ipportnet4_telem *)data;
121
122	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, tdata->ip);
123	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP2, tdata->ip2);
124	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, tdata->port);
125	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
126	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
127	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
128	htonl(ip_set_timeout_get(tdata->timeout)));
129
130	return 0;
131
132	nla_put_failure:
133	return 1;
134	}
135
136	#define IP_SET_HASH_WITH_PROTO
137	#define IP_SET_HASH_WITH_NETS
138
139	#define PF 4
140	#define HOST_MASK 32
141	#include <linux/netfilter/ipset/ip_set_ahash.h>
142
3d14b171 JK	143	static inline void
	144	hash_ipportnet4_data_next(struct ip_set_hash *h,
	145	const struct hash_ipportnet4_elem *d)
	146	{
	147	h->next.ip = ntohl(d->ip);
	148	h->next.port = ntohs(d->port);
	149	}
	150
41d22f7b JK	151	static int
41d22f7b JK	152	hash_ipportnet4_kadt(struct ip_set set, const struct sk_buff skb,
ac8cc925	153	enum ipset_adt adt, const struct ip_set_adt_opt *opt)
41d22f7b JK	154	{
	155	const struct ip_set_hash *h = set->data;
	156	ipset_adtfn adtfn = set->variant->adt[adt];
	157	struct hash_ipportnet4_elem data =
	158	{ .cidr = h->nets[0].cidr \|\| HOST_MASK };
	159
	160	if (data.cidr == 0)
	161	return -EINVAL;
	162	if (adt == IPSET_TEST)
	163	data.cidr = HOST_MASK;
	164
ac8cc925	165	if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
41d22f7b JK	166	&data.port, &data.proto))
	167	return -EINVAL;
	168
ac8cc925 JK	169	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip);
ac8cc925 JK	170	ip4addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &data.ip2);
41d22f7b JK	171	data.ip2 &= ip_set_netmask(data.cidr);
41d22f7b JK	172
ac8cc925	173	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
41d22f7b JK	174	}
	175
	176	static int
	177	hash_ipportnet4_uadt(struct ip_set set, struct nlattr tb[],
3d14b171	178	enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
41d22f7b JK	179	{
	180	const struct ip_set_hash *h = set->data;
	181	ipset_adtfn adtfn = set->variant->adt[adt];
	182	struct hash_ipportnet4_elem data = { .cidr = HOST_MASK };
3d14b171	183	u32 ip, ip_to, p = 0, port, port_to;
41d22f7b	184	u32 timeout = h->timeout;
5e0c1eb7	185	bool with_ports = false;
41d22f7b JK	186	int ret;
	187
	188	if (unlikely(!tb[IPSET_ATTR_IP] \|\| !tb[IPSET_ATTR_IP2] \|\|
	189	!ip_set_attr_netorder(tb, IPSET_ATTR_PORT) \|\|
	190	!ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) \|\|
	191	!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
	192	return -IPSET_ERR_PROTOCOL;
	193
	194	if (tb[IPSET_ATTR_LINENO])
	195	*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
	196
	197	ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP], &data.ip);
	198	if (ret)
	199	return ret;
	200
	201	ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP2], &data.ip2);
	202	if (ret)
	203	return ret;
	204
	205	if (tb[IPSET_ATTR_CIDR2])
	206	data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
	207
	208	if (!data.cidr)
	209	return -IPSET_ERR_INVALID_CIDR;
	210
	211	data.ip2 &= ip_set_netmask(data.cidr);
	212
	213	if (tb[IPSET_ATTR_PORT])
	214	data.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
	215	else
	216	return -IPSET_ERR_PROTOCOL;
	217
	218	if (tb[IPSET_ATTR_PROTO]) {
	219	data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
5e0c1eb7	220	with_ports = ip_set_proto_with_ports(data.proto);
41d22f7b JK	221
	222	if (data.proto == 0)
	223	return -IPSET_ERR_INVALID_PROTO;
	224	} else
	225	return -IPSET_ERR_MISSING_PROTO;
	226
5e0c1eb7	227	if (!(with_ports \|\| data.proto == IPPROTO_ICMP))
41d22f7b	228	data.port = 0;
41d22f7b JK	229
	230	if (tb[IPSET_ATTR_TIMEOUT]) {
	231	if (!with_timeout(h->timeout))
	232	return -IPSET_ERR_TIMEOUT;
	233	timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
	234	}
	235
	236	if (adt == IPSET_TEST \|\|
41d22f7b JK	237	!(tb[IPSET_ATTR_IP_TO] \|\| tb[IPSET_ATTR_CIDR] \|\|
41d22f7b JK	238	tb[IPSET_ATTR_PORT_TO])) {
5416219e	239	ret = adtfn(set, &data, timeout, flags);
41d22f7b JK	240	return ip_set_eexist(ret, flags) ? 0 : ret;
	241	}
	242
	243	ip = ntohl(data.ip);
	244	if (tb[IPSET_ATTR_IP_TO]) {
	245	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
	246	if (ret)
	247	return ret;
	248	if (ip > ip_to)
	249	swap(ip, ip_to);
	250	} else if (tb[IPSET_ATTR_CIDR]) {
	251	u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
	252
	253	if (cidr > 32)
	254	return -IPSET_ERR_INVALID_CIDR;
	255	ip &= ip_set_hostmask(cidr);
	256	ip_to = ip \| ~ip_set_hostmask(cidr);
	257	} else
	258	ip_to = ip;
	259
5e0c1eb7 JK	260	port_to = port = ntohs(data.port);
5e0c1eb7 JK	261	if (with_ports && tb[IPSET_ATTR_PORT_TO]) {
41d22f7b JK	262	port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
	263	if (port > port_to)
	264	swap(port, port_to);
5e0c1eb7	265	}
41d22f7b	266
3d14b171 JK	267	if (retried)
	268	ip = h->next.ip;
	269	for (; !before(ip_to, ip); ip++) {
	270	p = retried && ip == h->next.ip ? h->next.port : port;
	271	for (; p <= port_to; p++) {
41d22f7b JK	272	data.ip = htonl(ip);
41d22f7b JK	273	data.port = htons(p);
5416219e	274	ret = adtfn(set, &data, timeout, flags);
41d22f7b JK	275
	276	if (ret && !ip_set_eexist(ret, flags))
	277	return ret;
	278	else
	279	ret = 0;
	280	}
3d14b171	281	}
41d22f7b JK	282	return ret;
	283	}
	284
	285	static bool
	286	hash_ipportnet_same_set(const struct ip_set a, const struct ip_set b)
	287	{
	288	const struct ip_set_hash *x = a->data;
	289	const struct ip_set_hash *y = b->data;
	290
	291	/* Resizing changes htable_bits, so we ignore it */
	292	return x->maxelem == y->maxelem &&
	293	x->timeout == y->timeout;
	294	}
	295
	296	/* The type variant functions: IPv6 */
	297
	298	struct hash_ipportnet6_elem {
	299	union nf_inet_addr ip;
	300	union nf_inet_addr ip2;
	301	__be16 port;
	302	u8 cidr;
	303	u8 proto;
	304	};
	305
	306	struct hash_ipportnet6_telem {
	307	union nf_inet_addr ip;
	308	union nf_inet_addr ip2;
	309	__be16 port;
	310	u8 cidr;
	311	u8 proto;
	312	unsigned long timeout;
	313	};
	314
	315	static inline bool
	316	hash_ipportnet6_data_equal(const struct hash_ipportnet6_elem *ip1,
	317	const struct hash_ipportnet6_elem *ip2)
	318	{
	319	return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 &&
	320	ipv6_addr_cmp(&ip1->ip2.in6, &ip2->ip2.in6) == 0 &&
	321	ip1->cidr == ip2->cidr &&
	322	ip1->port == ip2->port &&
	323	ip1->proto == ip2->proto;
	324	}
	325
	326	static inline bool
	327	hash_ipportnet6_data_isnull(const struct hash_ipportnet6_elem *elem)
	328	{
	329	return elem->proto == 0;
	330	}
	331
	332	static inline void
	333	hash_ipportnet6_data_copy(struct hash_ipportnet6_elem *dst,
	334	const struct hash_ipportnet6_elem *src)
	335	{
	336	memcpy(dst, src, sizeof(*dst));
	337	}
	338
	339	static inline void
	340	hash_ipportnet6_data_zero_out(struct hash_ipportnet6_elem *elem)
	341	{
	342	elem->proto = 0;
	343	}
	344
	345	static inline void
346	ip6_netmask(union nf_inet_addr *ip, u8 prefix)
347	{
348	ip->ip6[0] &= ip_set_netmask6(prefix)[0];
349	ip->ip6[1] &= ip_set_netmask6(prefix)[1];
350	ip->ip6[2] &= ip_set_netmask6(prefix)[2];
351	ip->ip6[3] &= ip_set_netmask6(prefix)[3];
352	}
353
354	static inline void
355	hash_ipportnet6_data_netmask(struct hash_ipportnet6_elem *elem, u8 cidr)
356	{
357	ip6_netmask(&elem->ip2, cidr);
358	elem->cidr = cidr;
359	}
360
361	static bool
362	hash_ipportnet6_data_list(struct sk_buff *skb,
363	const struct hash_ipportnet6_elem *data)
364	{
365	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &data->ip);
366	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP2, &data->ip2);
367	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
368	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
369	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
370	return 0;
371
372	nla_put_failure:
373	return 1;
374	}
375
376	static bool
377	hash_ipportnet6_data_tlist(struct sk_buff *skb,
378	const struct hash_ipportnet6_elem *data)
379	{
380	const struct hash_ipportnet6_telem *e =
381	(const struct hash_ipportnet6_telem *)data;
382
383	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &e->ip);
384	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP2, &data->ip2);
385	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port);
386	NLA_PUT_U8(skb, IPSET_ATTR_CIDR2, data->cidr);
387	NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto);
388	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
389	htonl(ip_set_timeout_get(e->timeout)));
390	return 0;
391
392	nla_put_failure:
393	return 1;
394	}
395
396	#undef PF
397	#undef HOST_MASK
398
399	#define PF 6
400	#define HOST_MASK 128
401	#include <linux/netfilter/ipset/ip_set_ahash.h>
402
3d14b171 JK	403	static inline void
	404	hash_ipportnet6_data_next(struct ip_set_hash *h,
	405	const struct hash_ipportnet6_elem *d)
	406	{
	407	h->next.port = ntohs(d->port);
	408	}
	409
41d22f7b JK	410	static int
41d22f7b JK	411	hash_ipportnet6_kadt(struct ip_set set, const struct sk_buff skb,
ac8cc925	412	enum ipset_adt adt, const struct ip_set_adt_opt *opt)
41d22f7b JK	413	{
	414	const struct ip_set_hash *h = set->data;
	415	ipset_adtfn adtfn = set->variant->adt[adt];
	416	struct hash_ipportnet6_elem data =
	417	{ .cidr = h->nets[0].cidr \|\| HOST_MASK };
	418
	419	if (data.cidr == 0)
	420	return -EINVAL;
	421	if (adt == IPSET_TEST)
	422	data.cidr = HOST_MASK;
	423
ac8cc925	424	if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
41d22f7b JK	425	&data.port, &data.proto))
	426	return -EINVAL;
	427
ac8cc925 JK	428	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
ac8cc925 JK	429	ip6addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &data.ip2.in6);
41d22f7b JK	430	ip6_netmask(&data.ip2, data.cidr);
41d22f7b JK	431
ac8cc925	432	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
41d22f7b JK	433	}
	434
	435	static int
	436	hash_ipportnet6_uadt(struct ip_set set, struct nlattr tb[],
3d14b171	437	enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
41d22f7b JK	438	{
	439	const struct ip_set_hash *h = set->data;
	440	ipset_adtfn adtfn = set->variant->adt[adt];
	441	struct hash_ipportnet6_elem data = { .cidr = HOST_MASK };
	442	u32 port, port_to;
	443	u32 timeout = h->timeout;
5e0c1eb7	444	bool with_ports = false;
41d22f7b JK	445	int ret;
	446
	447	if (unlikely(!tb[IPSET_ATTR_IP] \|\| !tb[IPSET_ATTR_IP2] \|\|
	448	!ip_set_attr_netorder(tb, IPSET_ATTR_PORT) \|\|
	449	!ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) \|\|
	450	!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) \|\|
	451	tb[IPSET_ATTR_IP_TO] \|\|
	452	tb[IPSET_ATTR_CIDR]))
	453	return -IPSET_ERR_PROTOCOL;
	454
	455	if (tb[IPSET_ATTR_LINENO])
	456	*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
	457
	458	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &data.ip);
	459	if (ret)
	460	return ret;
	461
	462	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP2], &data.ip2);
	463	if (ret)
	464	return ret;
	465
	466	if (tb[IPSET_ATTR_CIDR2])
	467	data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
	468
	469	if (!data.cidr)
	470	return -IPSET_ERR_INVALID_CIDR;
	471
	472	ip6_netmask(&data.ip2, data.cidr);
	473
	474	if (tb[IPSET_ATTR_PORT])
	475	data.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
	476	else
	477	return -IPSET_ERR_PROTOCOL;
	478
	479	if (tb[IPSET_ATTR_PROTO]) {
	480	data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
5e0c1eb7	481	with_ports = ip_set_proto_with_ports(data.proto);
41d22f7b JK	482
	483	if (data.proto == 0)
	484	return -IPSET_ERR_INVALID_PROTO;
	485	} else
	486	return -IPSET_ERR_MISSING_PROTO;
	487
5e0c1eb7	488	if (!(with_ports \|\| data.proto == IPPROTO_ICMPV6))
41d22f7b	489	data.port = 0;
41d22f7b JK	490
	491	if (tb[IPSET_ATTR_TIMEOUT]) {
	492	if (!with_timeout(h->timeout))
	493	return -IPSET_ERR_TIMEOUT;
	494	timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
	495	}
	496
5e0c1eb7	497	if (adt == IPSET_TEST \|\| !with_ports \|\| !tb[IPSET_ATTR_PORT_TO]) {
5416219e	498	ret = adtfn(set, &data, timeout, flags);
41d22f7b JK	499	return ip_set_eexist(ret, flags) ? 0 : ret;
	500	}
	501
	502	port = ntohs(data.port);
	503	port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
	504	if (port > port_to)
	505	swap(port, port_to);
	506
3d14b171 JK	507	if (retried)
3d14b171 JK	508	port = h->next.port;
41d22f7b JK	509	for (; port <= port_to; port++) {
41d22f7b JK	510	data.port = htons(port);
5416219e	511	ret = adtfn(set, &data, timeout, flags);
41d22f7b JK	512
	513	if (ret && !ip_set_eexist(ret, flags))
	514	return ret;
	515	else
	516	ret = 0;
	517	}
	518	return ret;
	519	}
	520
	521	/* Create hash:ip type of sets */
	522
	523	static int
	524	hash_ipportnet_create(struct ip_set set, struct nlattr tb[], u32 flags)
	525	{
	526	struct ip_set_hash *h;
	527	u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
	528	u8 hbits;
	529
	530	if (!(set->family == AF_INET \|\| set->family == AF_INET6))
	531	return -IPSET_ERR_INVALID_FAMILY;
	532
	533	if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) \|\|
	534	!ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) \|\|
	535	!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
	536	return -IPSET_ERR_PROTOCOL;
	537
	538	if (tb[IPSET_ATTR_HASHSIZE]) {
	539	hashsize = ip_set_get_h32(tb[IPSET_ATTR_HASHSIZE]);
	540	if (hashsize < IPSET_MIMINAL_HASHSIZE)
	541	hashsize = IPSET_MIMINAL_HASHSIZE;
	542	}
	543
	544	if (tb[IPSET_ATTR_MAXELEM])
	545	maxelem = ip_set_get_h32(tb[IPSET_ATTR_MAXELEM]);
	546
	547	h = kzalloc(sizeof(*h)
	548	+ sizeof(struct ip_set_hash_nets)
	549	* (set->family == AF_INET ? 32 : 128), GFP_KERNEL);
	550	if (!h)
	551	return -ENOMEM;
	552
	553	h->maxelem = maxelem;
	554	get_random_bytes(&h->initval, sizeof(h->initval));
	555	h->timeout = IPSET_NO_TIMEOUT;
	556
	557	hbits = htable_bits(hashsize);
	558	h->table = ip_set_alloc(
	559	sizeof(struct htable)
	560	+ jhash_size(hbits) * sizeof(struct hbucket));
	561	if (!h->table) {
	562	kfree(h);
	563	return -ENOMEM;
	564	}
	565	h->table->htable_bits = hbits;
	566
	567	set->data = h;
	568
	569	if (tb[IPSET_ATTR_TIMEOUT]) {
	570	h->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
	571
	572	set->variant = set->family == AF_INET
	573	? &hash_ipportnet4_tvariant
	574	: &hash_ipportnet6_tvariant;
	575
576	if (set->family == AF_INET)
577	hash_ipportnet4_gc_init(set);
578	else
579	hash_ipportnet6_gc_init(set);
580	} else {
581	set->variant = set->family == AF_INET
582	? &hash_ipportnet4_variant : &hash_ipportnet6_variant;
583	}
584
585	pr_debug("create %s hashsize %u (%u) maxelem %u: %p(%p)\n",
586	set->name, jhash_size(h->table->htable_bits),
587	h->table->htable_bits, h->maxelem, set->data, h->table);
588
589	return 0;
590	}
591
592	static struct ip_set_type hash_ipportnet_type __read_mostly = {
593	.name = "hash:ip,port,net",
594	.protocol = IPSET_PROTOCOL,
595	.features = IPSET_TYPE_IP \| IPSET_TYPE_PORT \| IPSET_TYPE_IP2,
596	.dimension = IPSET_DIM_THREE,
597	.family = AF_UNSPEC,
f1e00b39 JK	598	.revision_min = 0,
f1e00b39 JK	599	.revision_max = 1, /* SCTP and UDPLITE support added */
41d22f7b JK	600	.create = hash_ipportnet_create,
	601	.create_policy = {
	602	[IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
	603	[IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
	604	[IPSET_ATTR_PROBES] = { .type = NLA_U8 },
	605	[IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
	606	[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
	607	},
	608	.adt_policy = {
	609	[IPSET_ATTR_IP] = { .type = NLA_NESTED },
	610	[IPSET_ATTR_IP_TO] = { .type = NLA_NESTED },
	611	[IPSET_ATTR_IP2] = { .type = NLA_NESTED },
	612	[IPSET_ATTR_PORT] = { .type = NLA_U16 },
	613	[IPSET_ATTR_PORT_TO] = { .type = NLA_U16 },
	614	[IPSET_ATTR_CIDR] = { .type = NLA_U8 },
	615	[IPSET_ATTR_CIDR2] = { .type = NLA_U8 },
	616	[IPSET_ATTR_PROTO] = { .type = NLA_U8 },
	617	[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
	618	[IPSET_ATTR_LINENO] = { .type = NLA_U32 },
	619	},
	620	.me = THIS_MODULE,
	621	};
	622
	623	static int __init
	624	hash_ipportnet_init(void)
	625	{
	626	return ip_set_type_register(&hash_ipportnet_type);
	627	}
	628
	629	static void __exit
	630	hash_ipportnet_fini(void)
	631	{
	632	ip_set_type_unregister(&hash_ipportnet_type);
	633	}
	634
	635	module_init(hash_ipportnet_init);
	636	module_exit(hash_ipportnet_fini);