1
2
3
4
5
6
7
8
9
10#ifndef _IP_SET_H
11#define _IP_SET_H
12
13#include <linux/ip.h>
14#include <linux/ipv6.h>
15#include <linux/netlink.h>
16#include <linux/netfilter.h>
17#include <linux/netfilter/x_tables.h>
18#include <linux/stringify.h>
19#include <linux/vmalloc.h>
20#include <net/netlink.h>
21#include <uapi/linux/netfilter/ipset/ip_set.h>
22
23#define _IP_SET_MODULE_DESC(a, b, c) \
24 MODULE_DESCRIPTION(a " type of IP sets, revisions " b "-" c)
25#define IP_SET_MODULE_DESC(a, b, c) \
26 _IP_SET_MODULE_DESC(a, __stringify(b), __stringify(c))
27
28
29enum ip_set_feature {
30 IPSET_TYPE_IP_FLAG = 0,
31 IPSET_TYPE_IP = (1 << IPSET_TYPE_IP_FLAG),
32 IPSET_TYPE_PORT_FLAG = 1,
33 IPSET_TYPE_PORT = (1 << IPSET_TYPE_PORT_FLAG),
34 IPSET_TYPE_MAC_FLAG = 2,
35 IPSET_TYPE_MAC = (1 << IPSET_TYPE_MAC_FLAG),
36 IPSET_TYPE_IP2_FLAG = 3,
37 IPSET_TYPE_IP2 = (1 << IPSET_TYPE_IP2_FLAG),
38 IPSET_TYPE_NAME_FLAG = 4,
39 IPSET_TYPE_NAME = (1 << IPSET_TYPE_NAME_FLAG),
40 IPSET_TYPE_IFACE_FLAG = 5,
41 IPSET_TYPE_IFACE = (1 << IPSET_TYPE_IFACE_FLAG),
42 IPSET_TYPE_NOMATCH_FLAG = 6,
43 IPSET_TYPE_NOMATCH = (1 << IPSET_TYPE_NOMATCH_FLAG),
44
45
46 IPSET_DUMP_LAST_FLAG = 7,
47 IPSET_DUMP_LAST = (1 << IPSET_DUMP_LAST_FLAG),
48};
49
50
51enum ip_set_extension {
52 IPSET_EXT_NONE = 0,
53 IPSET_EXT_BIT_TIMEOUT = 1,
54 IPSET_EXT_TIMEOUT = (1 << IPSET_EXT_BIT_TIMEOUT),
55 IPSET_EXT_BIT_COUNTER = 2,
56 IPSET_EXT_COUNTER = (1 << IPSET_EXT_BIT_COUNTER),
57};
58
59
60enum ip_set_offset {
61 IPSET_OFFSET_TIMEOUT = 0,
62 IPSET_OFFSET_COUNTER,
63 IPSET_OFFSET_MAX,
64};
65
66#define SET_WITH_TIMEOUT(s) ((s)->extensions & IPSET_EXT_TIMEOUT)
67#define SET_WITH_COUNTER(s) ((s)->extensions & IPSET_EXT_COUNTER)
68
69struct ip_set_ext {
70 unsigned long timeout;
71 u64 packets;
72 u64 bytes;
73};
74
75struct ip_set;
76
77typedef int (*ipset_adtfn)(struct ip_set *set, void *value,
78 const struct ip_set_ext *ext,
79 struct ip_set_ext *mext, u32 cmdflags);
80
81
82struct ip_set_adt_opt {
83 u8 family;
84 u8 dim;
85 u8 flags;
86 u32 cmdflags;
87 struct ip_set_ext ext;
88};
89
90
91struct ip_set_type_variant {
92
93
94
95
96 int (*kadt)(struct ip_set *set, const struct sk_buff *skb,
97 const struct xt_action_param *par,
98 enum ipset_adt adt, struct ip_set_adt_opt *opt);
99
100
101
102
103
104 int (*uadt)(struct ip_set *set, struct nlattr *tb[],
105 enum ipset_adt adt, u32 *lineno, u32 flags, bool retried);
106
107
108 ipset_adtfn adt[IPSET_ADT_MAX];
109
110
111 int (*resize)(struct ip_set *set, bool retried);
112
113 void (*destroy)(struct ip_set *set);
114
115 void (*flush)(struct ip_set *set);
116
117 void (*expire)(struct ip_set *set);
118
119 int (*head)(struct ip_set *set, struct sk_buff *skb);
120
121 int (*list)(const struct ip_set *set, struct sk_buff *skb,
122 struct netlink_callback *cb);
123
124
125
126 bool (*same_set)(const struct ip_set *a, const struct ip_set *b);
127};
128
129
130struct ip_set_type {
131 struct list_head list;
132
133
134 char name[IPSET_MAXNAMELEN];
135
136 u8 protocol;
137
138 u8 features;
139
140 u8 dimension;
141
142
143
144
145 u8 family;
146
147 u8 revision_min, revision_max;
148
149
150 int (*create)(struct ip_set *set, struct nlattr *tb[], u32 flags);
151
152
153 const struct nla_policy create_policy[IPSET_ATTR_CREATE_MAX + 1];
154 const struct nla_policy adt_policy[IPSET_ATTR_ADT_MAX + 1];
155
156
157 struct module *me;
158};
159
160
161extern int ip_set_type_register(struct ip_set_type *set_type);
162extern void ip_set_type_unregister(struct ip_set_type *set_type);
163
164
165struct ip_set {
166
167 char name[IPSET_MAXNAMELEN];
168
169 rwlock_t lock;
170
171 u32 ref;
172
173 struct ip_set_type *type;
174
175 const struct ip_set_type_variant *variant;
176
177 u8 family;
178
179 u8 revision;
180
181 u8 extensions;
182
183 void *data;
184};
185
186struct ip_set_counter {
187 atomic64_t bytes;
188 atomic64_t packets;
189};
190
191static inline void
192ip_set_add_bytes(u64 bytes, struct ip_set_counter *counter)
193{
194 atomic64_add((long long)bytes, &(counter)->bytes);
195}
196
197static inline void
198ip_set_add_packets(u64 packets, struct ip_set_counter *counter)
199{
200 atomic64_add((long long)packets, &(counter)->packets);
201}
202
203static inline u64
204ip_set_get_bytes(const struct ip_set_counter *counter)
205{
206 return (u64)atomic64_read(&(counter)->bytes);
207}
208
209static inline u64
210ip_set_get_packets(const struct ip_set_counter *counter)
211{
212 return (u64)atomic64_read(&(counter)->packets);
213}
214
215static inline void
216ip_set_update_counter(struct ip_set_counter *counter,
217 const struct ip_set_ext *ext,
218 struct ip_set_ext *mext, u32 flags)
219{
220 if (ext->packets != ULLONG_MAX &&
221 !(flags & IPSET_FLAG_SKIP_COUNTER_UPDATE)) {
222 ip_set_add_bytes(ext->bytes, counter);
223 ip_set_add_packets(ext->packets, counter);
224 }
225 if (flags & IPSET_FLAG_MATCH_COUNTERS) {
226 mext->packets = ip_set_get_packets(counter);
227 mext->bytes = ip_set_get_bytes(counter);
228 }
229}
230
231static inline bool
232ip_set_put_counter(struct sk_buff *skb, struct ip_set_counter *counter)
233{
234 return nla_put_net64(skb, IPSET_ATTR_BYTES,
235 cpu_to_be64(ip_set_get_bytes(counter))) ||
236 nla_put_net64(skb, IPSET_ATTR_PACKETS,
237 cpu_to_be64(ip_set_get_packets(counter)));
238}
239
240static inline void
241ip_set_init_counter(struct ip_set_counter *counter,
242 const struct ip_set_ext *ext)
243{
244 if (ext->bytes != ULLONG_MAX)
245 atomic64_set(&(counter)->bytes, (long long)(ext->bytes));
246 if (ext->packets != ULLONG_MAX)
247 atomic64_set(&(counter)->packets, (long long)(ext->packets));
248}
249
250
251extern ip_set_id_t ip_set_get_byname(const char *name, struct ip_set **set);
252extern void ip_set_put_byindex(ip_set_id_t index);
253extern const char *ip_set_name_byindex(ip_set_id_t index);
254extern ip_set_id_t ip_set_nfnl_get(const char *name);
255extern ip_set_id_t ip_set_nfnl_get_byindex(ip_set_id_t index);
256extern void ip_set_nfnl_put(ip_set_id_t index);
257
258
259
260extern int ip_set_add(ip_set_id_t id, const struct sk_buff *skb,
261 const struct xt_action_param *par,
262 struct ip_set_adt_opt *opt);
263extern int ip_set_del(ip_set_id_t id, const struct sk_buff *skb,
264 const struct xt_action_param *par,
265 struct ip_set_adt_opt *opt);
266extern int ip_set_test(ip_set_id_t id, const struct sk_buff *skb,
267 const struct xt_action_param *par,
268 struct ip_set_adt_opt *opt);
269
270
271extern void *ip_set_alloc(size_t size);
272extern void ip_set_free(void *members);
273extern int ip_set_get_ipaddr4(struct nlattr *nla, __be32 *ipaddr);
274extern int ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr);
275extern int ip_set_get_extensions(struct ip_set *set, struct nlattr *tb[],
276 struct ip_set_ext *ext);
277
278static inline int
279ip_set_get_hostipaddr4(struct nlattr *nla, u32 *ipaddr)
280{
281 __be32 ip;
282 int ret = ip_set_get_ipaddr4(nla, &ip);
283
284 if (ret)
285 return ret;
286 *ipaddr = ntohl(ip);
287 return 0;
288}
289
290
291static inline bool
292ip_set_eexist(int ret, u32 flags)
293{
294 return ret == -IPSET_ERR_EXIST && (flags & IPSET_FLAG_EXIST);
295}
296
297
298static inline bool
299ip_set_enomatch(int ret, u32 flags, enum ipset_adt adt, struct ip_set *set)
300{
301 return adt == IPSET_TEST &&
302 (set->type->features & IPSET_TYPE_NOMATCH) &&
303 ((flags >> 16) & IPSET_FLAG_NOMATCH) &&
304 (ret > 0 || ret == -ENOTEMPTY);
305}
306
307
308static inline bool
309ip_set_attr_netorder(struct nlattr *tb[], int type)
310{
311 return tb[type] && (tb[type]->nla_type & NLA_F_NET_BYTEORDER);
312}
313
314static inline bool
315ip_set_optattr_netorder(struct nlattr *tb[], int type)
316{
317 return !tb[type] || (tb[type]->nla_type & NLA_F_NET_BYTEORDER);
318}
319
320
321static inline u32
322ip_set_get_h32(const struct nlattr *attr)
323{
324 return ntohl(nla_get_be32(attr));
325}
326
327static inline u16
328ip_set_get_h16(const struct nlattr *attr)
329{
330 return ntohs(nla_get_be16(attr));
331}
332
333#define ipset_nest_start(skb, attr) nla_nest_start(skb, attr | NLA_F_NESTED)
334#define ipset_nest_end(skb, start) nla_nest_end(skb, start)
335
336static inline int nla_put_ipaddr4(struct sk_buff *skb, int type, __be32 ipaddr)
337{
338 struct nlattr *__nested = ipset_nest_start(skb, type);
339 int ret;
340
341 if (!__nested)
342 return -EMSGSIZE;
343 ret = nla_put_net32(skb, IPSET_ATTR_IPADDR_IPV4, ipaddr);
344 if (!ret)
345 ipset_nest_end(skb, __nested);
346 return ret;
347}
348
349static inline int nla_put_ipaddr6(struct sk_buff *skb, int type,
350 const struct in6_addr *ipaddrptr)
351{
352 struct nlattr *__nested = ipset_nest_start(skb, type);
353 int ret;
354
355 if (!__nested)
356 return -EMSGSIZE;
357 ret = nla_put(skb, IPSET_ATTR_IPADDR_IPV6,
358 sizeof(struct in6_addr), ipaddrptr);
359 if (!ret)
360 ipset_nest_end(skb, __nested);
361 return ret;
362}
363
364
365static inline __be32
366ip4addr(const struct sk_buff *skb, bool src)
367{
368 return src ? ip_hdr(skb)->saddr : ip_hdr(skb)->daddr;
369}
370
371static inline void
372ip4addrptr(const struct sk_buff *skb, bool src, __be32 *addr)
373{
374 *addr = src ? ip_hdr(skb)->saddr : ip_hdr(skb)->daddr;
375}
376
377static inline void
378ip6addrptr(const struct sk_buff *skb, bool src, struct in6_addr *addr)
379{
380 memcpy(addr, src ? &ipv6_hdr(skb)->saddr : &ipv6_hdr(skb)->daddr,
381 sizeof(*addr));
382}
383
384
385static inline int
386bitmap_bytes(u32 a, u32 b)
387{
388 return 4 * ((((b - a + 8) / 8) + 3) / 4);
389}
390
391#include <linux/netfilter/ipset/ip_set_timeout.h>
392
393#define IP_SET_INIT_KEXT(skb, opt, map) \
394 { .bytes = (skb)->len, .packets = 1, \
395 .timeout = ip_set_adt_opt_timeout(opt, map) }
396
397#define IP_SET_INIT_UEXT(map) \
398 { .bytes = ULLONG_MAX, .packets = ULLONG_MAX, \
399 .timeout = (map)->timeout }
400
401#endif
402