LXR linux/include/linux/netfilter/ipset/ip

   1#ifndef _IP_SET_H
   2#define _IP_SET_H
   3
   4/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
   5 *                         Patrick Schaaf <bof@bof.de>
   6 *                         Martin Josefsson <gandalf@wlug.westbo.se>
   7 * Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
   8 *
   9 * This program is free software; you can redistribute it and/or modify
  10 * it under the terms of the GNU General Public License version 2 as
  11 * published by the Free Software Foundation.
  12 */
  13
  14#include <linux/types.h>
  15
  16/* The protocol version */
  17#define IPSET_PROTOCOL          6
  18
  19/* The max length of strings including NUL: set and type identifiers */
  20#define IPSET_MAXNAMELEN        32
  21
  22/* Message types and commands */
  23enum ipset_cmd {
  24        IPSET_CMD_NONE,
  25        IPSET_CMD_PROTOCOL,     /* 1: Return protocol version */
  26        IPSET_CMD_CREATE,       /* 2: Create a new (empty) set */
  27        IPSET_CMD_DESTROY,      /* 3: Destroy a (empty) set */
  28        IPSET_CMD_FLUSH,        /* 4: Remove all elements from a set */
  29        IPSET_CMD_RENAME,       /* 5: Rename a set */
  30        IPSET_CMD_SWAP,         /* 6: Swap two sets */
  31        IPSET_CMD_LIST,         /* 7: List sets */
  32        IPSET_CMD_SAVE,         /* 8: Save sets */
  33        IPSET_CMD_ADD,          /* 9: Add an element to a set */
  34        IPSET_CMD_DEL,          /* 10: Delete an element from a set */
  35        IPSET_CMD_TEST,         /* 11: Test an element in a set */
  36        IPSET_CMD_HEADER,       /* 12: Get set header data only */
  37        IPSET_CMD_TYPE,         /* 13: Get set type */
  38        IPSET_MSG_MAX,          /* Netlink message commands */
  39
  40        /* Commands in userspace: */
  41        IPSET_CMD_RESTORE = IPSET_MSG_MAX, /* 14: Enter restore mode */
  42        IPSET_CMD_HELP,         /* 15: Get help */
  43        IPSET_CMD_VERSION,      /* 16: Get program version */
  44        IPSET_CMD_QUIT,         /* 17: Quit from interactive mode */
  45
  46        IPSET_CMD_MAX,
  47
  48        IPSET_CMD_COMMIT = IPSET_CMD_MAX, /* 18: Commit buffered commands */
  49};
  50
  51/* Attributes at command level */
  52enum {
  53        IPSET_ATTR_UNSPEC,
  54        IPSET_ATTR_PROTOCOL,    /* 1: Protocol version */
  55        IPSET_ATTR_SETNAME,     /* 2: Name of the set */
  56        IPSET_ATTR_TYPENAME,    /* 3: Typename */
  57        IPSET_ATTR_SETNAME2 = IPSET_ATTR_TYPENAME, /* Setname at rename/swap */
  58        IPSET_ATTR_REVISION,    /* 4: Settype revision */
  59        IPSET_ATTR_FAMILY,      /* 5: Settype family */
  60        IPSET_ATTR_FLAGS,       /* 6: Flags at command level */
  61        IPSET_ATTR_DATA,        /* 7: Nested attributes */
  62        IPSET_ATTR_ADT,         /* 8: Multiple data containers */
  63        IPSET_ATTR_LINENO,      /* 9: Restore lineno */
  64        IPSET_ATTR_PROTOCOL_MIN, /* 10: Minimal supported version number */
  65        IPSET_ATTR_REVISION_MIN = IPSET_ATTR_PROTOCOL_MIN, /* type rev min */
  66        __IPSET_ATTR_CMD_MAX,
  67};
  68#define IPSET_ATTR_CMD_MAX      (__IPSET_ATTR_CMD_MAX - 1)
  69
  70/* CADT specific attributes */
  71enum {
  72        IPSET_ATTR_IP = IPSET_ATTR_UNSPEC + 1,
  73        IPSET_ATTR_IP_FROM = IPSET_ATTR_IP,
  74        IPSET_ATTR_IP_TO,       /* 2 */
  75        IPSET_ATTR_CIDR,        /* 3 */
  76        IPSET_ATTR_PORT,        /* 4 */
  77        IPSET_ATTR_PORT_FROM = IPSET_ATTR_PORT,
  78        IPSET_ATTR_PORT_TO,     /* 5 */
  79        IPSET_ATTR_TIMEOUT,     /* 6 */
  80        IPSET_ATTR_PROTO,       /* 7 */
  81        IPSET_ATTR_CADT_FLAGS,  /* 8 */
  82        IPSET_ATTR_CADT_LINENO = IPSET_ATTR_LINENO,     /* 9 */
  83        /* Reserve empty slots */
  84        IPSET_ATTR_CADT_MAX = 16,
  85        /* Create-only specific attributes */
  86        IPSET_ATTR_GC,
  87        IPSET_ATTR_HASHSIZE,
  88        IPSET_ATTR_MAXELEM,
  89        IPSET_ATTR_NETMASK,
  90        IPSET_ATTR_PROBES,
  91        IPSET_ATTR_RESIZE,
  92        IPSET_ATTR_SIZE,
  93        /* Kernel-only */
  94        IPSET_ATTR_ELEMENTS,
  95        IPSET_ATTR_REFERENCES,
  96        IPSET_ATTR_MEMSIZE,
  97
  98        __IPSET_ATTR_CREATE_MAX,
  99};
 100#define IPSET_ATTR_CREATE_MAX   (__IPSET_ATTR_CREATE_MAX - 1)
 101
 102/* ADT specific attributes */
 103enum {
 104        IPSET_ATTR_ETHER = IPSET_ATTR_CADT_MAX + 1,
 105        IPSET_ATTR_NAME,
 106        IPSET_ATTR_NAMEREF,
 107        IPSET_ATTR_IP2,
 108        IPSET_ATTR_CIDR2,
 109        IPSET_ATTR_IP2_TO,
 110        IPSET_ATTR_IFACE,
 111        __IPSET_ATTR_ADT_MAX,
 112};
 113#define IPSET_ATTR_ADT_MAX      (__IPSET_ATTR_ADT_MAX - 1)
 114
 115/* IP specific attributes */
 116enum {
 117        IPSET_ATTR_IPADDR_IPV4 = IPSET_ATTR_UNSPEC + 1,
 118        IPSET_ATTR_IPADDR_IPV6,
 119        __IPSET_ATTR_IPADDR_MAX,
 120};
 121#define IPSET_ATTR_IPADDR_MAX   (__IPSET_ATTR_IPADDR_MAX - 1)
 122
 123/* Error codes */
 124enum ipset_errno {
 125        IPSET_ERR_PRIVATE = 4096,
 126        IPSET_ERR_PROTOCOL,
 127        IPSET_ERR_FIND_TYPE,
 128        IPSET_ERR_MAX_SETS,
 129        IPSET_ERR_BUSY,
 130        IPSET_ERR_EXIST_SETNAME2,
 131        IPSET_ERR_TYPE_MISMATCH,
 132        IPSET_ERR_EXIST,
 133        IPSET_ERR_INVALID_CIDR,
 134        IPSET_ERR_INVALID_NETMASK,
 135        IPSET_ERR_INVALID_FAMILY,
 136        IPSET_ERR_TIMEOUT,
 137        IPSET_ERR_REFERENCED,
 138        IPSET_ERR_IPADDR_IPV4,
 139        IPSET_ERR_IPADDR_IPV6,
 140
 141        /* Type specific error codes */
 142        IPSET_ERR_TYPE_SPECIFIC = 4352,
 143};
 144
 145/* Flags at command level */
 146enum ipset_cmd_flags {
 147        IPSET_FLAG_BIT_EXIST    = 0,
 148        IPSET_FLAG_EXIST        = (1 << IPSET_FLAG_BIT_EXIST),
 149        IPSET_FLAG_BIT_LIST_SETNAME = 1,
 150        IPSET_FLAG_LIST_SETNAME = (1 << IPSET_FLAG_BIT_LIST_SETNAME),
 151        IPSET_FLAG_BIT_LIST_HEADER = 2,
 152        IPSET_FLAG_LIST_HEADER  = (1 << IPSET_FLAG_BIT_LIST_HEADER),
 153        IPSET_FLAG_CMD_MAX = 15,        /* Lower half */
 154};
 155
 156/* Flags at CADT attribute level */
 157enum ipset_cadt_flags {
 158        IPSET_FLAG_BIT_BEFORE   = 0,
 159        IPSET_FLAG_BEFORE       = (1 << IPSET_FLAG_BIT_BEFORE),
 160        IPSET_FLAG_BIT_PHYSDEV  = 1,
 161        IPSET_FLAG_PHYSDEV      = (1 << IPSET_FLAG_BIT_PHYSDEV),
 162        IPSET_FLAG_BIT_NOMATCH  = 2,
 163        IPSET_FLAG_NOMATCH      = (1 << IPSET_FLAG_BIT_NOMATCH),
 164        IPSET_FLAG_CADT_MAX     = 15,   /* Upper half */
 165};
 166
 167/* Commands with settype-specific attributes */
 168enum ipset_adt {
 169        IPSET_ADD,
 170        IPSET_DEL,
 171        IPSET_TEST,
 172        IPSET_ADT_MAX,
 173        IPSET_CREATE = IPSET_ADT_MAX,
 174        IPSET_CADT_MAX,
 175};
 176
 177/* Sets are identified by an index in kernel space. Tweak with ip_set_id_t
 178 * and IPSET_INVALID_ID if you want to increase the max number of sets.
 179 */
 180typedef __u16 ip_set_id_t;
 181
 182#define IPSET_INVALID_ID                65535
 183
 184enum ip_set_dim {
 185        IPSET_DIM_ZERO = 0,
 186        IPSET_DIM_ONE,
 187        IPSET_DIM_TWO,
 188        IPSET_DIM_THREE,
 189        /* Max dimension in elements.
 190         * If changed, new revision of iptables match/target is required.
 191         */
 192        IPSET_DIM_MAX = 6,
 193};
 194
 195/* Option flags for kernel operations */
 196enum ip_set_kopt {
 197        IPSET_INV_MATCH = (1 << IPSET_DIM_ZERO),
 198        IPSET_DIM_ONE_SRC = (1 << IPSET_DIM_ONE),
 199        IPSET_DIM_TWO_SRC = (1 << IPSET_DIM_TWO),
 200        IPSET_DIM_THREE_SRC = (1 << IPSET_DIM_THREE),
 201};
 202
 203#ifdef __KERNEL__
 204#include <linux/ip.h>
 205#include <linux/ipv6.h>
 206#include <linux/netlink.h>
 207#include <linux/netfilter.h>
 208#include <linux/netfilter/x_tables.h>
 209#include <linux/vmalloc.h>
 210#include <net/netlink.h>
 211
 212/* Set features */
 213enum ip_set_feature {
 214        IPSET_TYPE_IP_FLAG = 0,
 215        IPSET_TYPE_IP = (1 << IPSET_TYPE_IP_FLAG),
 216        IPSET_TYPE_PORT_FLAG = 1,
 217        IPSET_TYPE_PORT = (1 << IPSET_TYPE_PORT_FLAG),
 218        IPSET_TYPE_MAC_FLAG = 2,
 219        IPSET_TYPE_MAC = (1 << IPSET_TYPE_MAC_FLAG),
 220        IPSET_TYPE_IP2_FLAG = 3,
 221        IPSET_TYPE_IP2 = (1 << IPSET_TYPE_IP2_FLAG),
 222        IPSET_TYPE_NAME_FLAG = 4,
 223        IPSET_TYPE_NAME = (1 << IPSET_TYPE_NAME_FLAG),
 224        IPSET_TYPE_IFACE_FLAG = 5,
 225        IPSET_TYPE_IFACE = (1 << IPSET_TYPE_IFACE_FLAG),
 226        /* Strictly speaking not a feature, but a flag for dumping:
 227         * this settype must be dumped last */
 228        IPSET_DUMP_LAST_FLAG = 7,
 229        IPSET_DUMP_LAST = (1 << IPSET_DUMP_LAST_FLAG),
 230};
 231
 232struct ip_set;
 233
 234typedef int (*ipset_adtfn)(struct ip_set *set, void *value,
 235                           u32 timeout, u32 flags);
 236
 237/* Kernel API function options */
 238struct ip_set_adt_opt {
 239        u8 family;              /* Actual protocol family */
 240        u8 dim;                 /* Dimension of match/target */
 241        u8 flags;               /* Direction and negation flags */
 242        u32 cmdflags;           /* Command-like flags */
 243        u32 timeout;            /* Timeout value */
 244};
 245
 246/* Set type, variant-specific part */
 247struct ip_set_type_variant {
 248        /* Kernelspace: test/add/del entries
 249         *              returns negative error code,
 250         *                      zero for no match/success to add/delete
 251         *                      positive for matching element */
 252        int (*kadt)(struct ip_set *set, const struct sk_buff * skb,
 253                    const struct xt_action_param *par,
 254                    enum ipset_adt adt, const struct ip_set_adt_opt *opt);
 255
 256        /* Userspace: test/add/del entries
 257         *              returns negative error code,
 258         *                      zero for no match/success to add/delete
 259         *                      positive for matching element */
 260        int (*uadt)(struct ip_set *set, struct nlattr *tb[],
 261                    enum ipset_adt adt, u32 *lineno, u32 flags, bool retried);
 262
 263        /* Low level add/del/test functions */
 264        ipset_adtfn adt[IPSET_ADT_MAX];
 265
 266        /* When adding entries and set is full, try to resize the set */
 267        int (*resize)(struct ip_set *set, bool retried);
 268        /* Destroy the set */
 269        void (*destroy)(struct ip_set *set);
 270        /* Flush the elements */
 271        void (*flush)(struct ip_set *set);
 272        /* Expire entries before listing */
 273        void (*expire)(struct ip_set *set);
 274        /* List set header data */
 275        int (*head)(struct ip_set *set, struct sk_buff *skb);
 276        /* List elements */
 277        int (*list)(const struct ip_set *set, struct sk_buff *skb,
 278                    struct netlink_callback *cb);
 279
 280        /* Return true if "b" set is the same as "a"
 281         * according to the create set parameters */
 282        bool (*same_set)(const struct ip_set *a, const struct ip_set *b);
 283};
 284
 285/* The core set type structure */
 286struct ip_set_type {
 287        struct list_head list;
 288
 289        /* Typename */
 290        char name[IPSET_MAXNAMELEN];
 291        /* Protocol version */
 292        u8 protocol;
 293        /* Set features to control swapping */
 294        u8 features;
 295        /* Set type dimension */
 296        u8 dimension;
 297        /*
 298         * Supported family: may be NFPROTO_UNSPEC for both
 299         * NFPROTO_IPV4/NFPROTO_IPV6.
 300         */
 301        u8 family;
 302        /* Type revisions */
 303        u8 revision_min, revision_max;
 304
 305        /* Create set */
 306        int (*create)(struct ip_set *set, struct nlattr *tb[], u32 flags);
 307
 308        /* Attribute policies */
 309        const struct nla_policy create_policy[IPSET_ATTR_CREATE_MAX + 1];
 310        const struct nla_policy adt_policy[IPSET_ATTR_ADT_MAX + 1];
 311
 312        /* Set this to THIS_MODULE if you are a module, otherwise NULL */
 313        struct module *me;
 314};
 315
 316/* register and unregister set type */
 317extern int ip_set_type_register(struct ip_set_type *set_type);
 318extern void ip_set_type_unregister(struct ip_set_type *set_type);
 319
 320/* A generic IP set */
 321struct ip_set {
 322        /* The name of the set */
 323        char name[IPSET_MAXNAMELEN];
 324        /* Lock protecting the set data */
 325        rwlock_t lock;
 326        /* References to the set */
 327        u32 ref;
 328        /* The core set type */
 329        struct ip_set_type *type;
 330        /* The type variant doing the real job */
 331        const struct ip_set_type_variant *variant;
 332        /* The actual INET family of the set */
 333        u8 family;
 334        /* The type revision */
 335        u8 revision;
 336        /* The type specific data */
 337        void *data;
 338};
 339
 340/* register and unregister set references */
 341extern ip_set_id_t ip_set_get_byname(const char *name, struct ip_set **set);
 342extern void ip_set_put_byindex(ip_set_id_t index);
 343extern const char *ip_set_name_byindex(ip_set_id_t index);
 344extern ip_set_id_t ip_set_nfnl_get(const char *name);
 345extern ip_set_id_t ip_set_nfnl_get_byindex(ip_set_id_t index);
 346extern void ip_set_nfnl_put(ip_set_id_t index);
 347
 348/* API for iptables set match, and SET target */
 349
 350extern int ip_set_add(ip_set_id_t id, const struct sk_buff *skb,
 351                      const struct xt_action_param *par,
 352                      const struct ip_set_adt_opt *opt);
 353extern int ip_set_del(ip_set_id_t id, const struct sk_buff *skb,
 354                      const struct xt_action_param *par,
 355                      const struct ip_set_adt_opt *opt);
 356extern int ip_set_test(ip_set_id_t id, const struct sk_buff *skb,
 357                       const struct xt_action_param *par,
 358                       const struct ip_set_adt_opt *opt);
 359
 360/* Utility functions */
 361extern void *ip_set_alloc(size_t size);
 362extern void ip_set_free(void *members);
 363extern int ip_set_get_ipaddr4(struct nlattr *nla,  __be32 *ipaddr);
 364extern int ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr);
 365
 366static inline int
 367ip_set_get_hostipaddr4(struct nlattr *nla, u32 *ipaddr)
 368{
 369        __be32 ip;
 370        int ret = ip_set_get_ipaddr4(nla, &ip);
 371
 372        if (ret)
 373                return ret;
 374        *ipaddr = ntohl(ip);
 375        return 0;
 376}
 377
 378/* Ignore IPSET_ERR_EXIST errors if asked to do so? */
 379static inline bool
 380ip_set_eexist(int ret, u32 flags)
 381{
 382        return ret == -IPSET_ERR_EXIST && (flags & IPSET_FLAG_EXIST);
 383}
 384
 385/* Check the NLA_F_NET_BYTEORDER flag */
 386static inline bool
 387ip_set_attr_netorder(struct nlattr *tb[], int type)
 388{
 389        return tb[type] && (tb[type]->nla_type & NLA_F_NET_BYTEORDER);
 390}
 391
 392static inline bool
 393ip_set_optattr_netorder(struct nlattr *tb[], int type)
 394{
 395        return !tb[type] || (tb[type]->nla_type & NLA_F_NET_BYTEORDER);
 396}
 397
 398/* Useful converters */
 399static inline u32
 400ip_set_get_h32(const struct nlattr *attr)
 401{
 402        return ntohl(nla_get_be32(attr));
 403}
 404
 405static inline u16
 406ip_set_get_h16(const struct nlattr *attr)
 407{
 408        return ntohs(nla_get_be16(attr));
 409}
 410
 411#define ipset_nest_start(skb, attr) nla_nest_start(skb, attr | NLA_F_NESTED)
 412#define ipset_nest_end(skb, start)  nla_nest_end(skb, start)
 413
 414static inline int nla_put_ipaddr4(struct sk_buff *skb, int type, __be32 ipaddr)
 415{
 416        struct nlattr *__nested = ipset_nest_start(skb, type);
 417        int ret;
 418
 419        if (!__nested)
 420                return -EMSGSIZE;
 421        ret = nla_put_net32(skb, IPSET_ATTR_IPADDR_IPV4, ipaddr);
 422        if (!ret)
 423                ipset_nest_end(skb, __nested);
 424        return ret;
 425}
 426
 427static inline int nla_put_ipaddr6(struct sk_buff *skb, int type, const struct in6_addr *ipaddrptr)
 428{
 429        struct nlattr *__nested = ipset_nest_start(skb, type);
 430        int ret;
 431
 432        if (!__nested)
 433                return -EMSGSIZE;
 434        ret = nla_put(skb, IPSET_ATTR_IPADDR_IPV6,
 435                      sizeof(struct in6_addr), ipaddrptr);
 436        if (!ret)
 437                ipset_nest_end(skb, __nested);
 438        return ret;
 439}
 440
 441/* Get address from skbuff */
 442static inline __be32
 443ip4addr(const struct sk_buff *skb, bool src)
 444{
 445        return src ? ip_hdr(skb)->saddr : ip_hdr(skb)->daddr;
 446}
 447
 448static inline void
 449ip4addrptr(const struct sk_buff *skb, bool src, __be32 *addr)
 450{
 451        *addr = src ? ip_hdr(skb)->saddr : ip_hdr(skb)->daddr;
 452}
 453
 454static inline void
 455ip6addrptr(const struct sk_buff *skb, bool src, struct in6_addr *addr)
 456{
 457        memcpy(addr, src ? &ipv6_hdr(skb)->saddr : &ipv6_hdr(skb)->daddr,
 458               sizeof(*addr));
 459}
 460
 461/* Calculate the bytes required to store the inclusive range of a-b */
 462static inline int
 463bitmap_bytes(u32 a, u32 b)
 464{
 465        return 4 * ((((b - a + 8) / 8) + 3) / 4);
 466}
 467
 468#endif /* __KERNEL__ */
 469
 470/* Interface to iptables/ip6tables */
 471
 472#define SO_IP_SET               83
 473
 474union ip_set_name_index {
 475        char name[IPSET_MAXNAMELEN];
 476        ip_set_id_t index;
 477};
 478
 479#define IP_SET_OP_GET_BYNAME    0x00000006      /* Get set index by name */
 480struct ip_set_req_get_set {
 481        unsigned int op;
 482        unsigned int version;
 483        union ip_set_name_index set;
 484};
 485
 486#define IP_SET_OP_GET_BYINDEX   0x00000007      /* Get set name by index */
 487/* Uses ip_set_req_get_set */
 488
 489#define IP_SET_OP_VERSION       0x00000100      /* Ask kernel version */
 490struct ip_set_req_version {
 491        unsigned int op;
 492        unsigned int version;
 493};
 494
 495#endif /*_IP_SET_H */
 496