[thirdparty/kernel/stable.git] / net / netfilter / ipset / ip_set_hash_net.c

/* Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

/* Kernel module implementing an IP set type: the hash:net type */

#include <linux/jhash.h>
#include <linux/module.h>
#include <linux/ip.h>
#include <linux/skbuff.h>
#include <linux/errno.h>
#include <linux/random.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/netlink.h>

#include <linux/netfilter.h>
#include <linux/netfilter/ipset/pfxlen.h>
#include <linux/netfilter/ipset/ip_set.h>
#include <linux/netfilter/ipset/ip_set_timeout.h>
#include <linux/netfilter/ipset/ip_set_hash.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
MODULE_DESCRIPTION("hash:net type of IP sets");
MODULE_ALIAS("ip_set_hash:net");

/* Type specific function prefix */
#define TYPE		hash_net

static bool
hash_net_same_set(const struct ip_set *a, const struct ip_set *b);

#define hash_net4_same_set	hash_net_same_set
#define hash_net6_same_set	hash_net_same_set

/* The type variant functions: IPv4 */

/* Member elements without timeout */
struct hash_net4_elem {
	__be32 ip;
	u16 padding0;
	u8 nomatch;
	u8 cidr;
};

/* Member elements with timeout support */
struct hash_net4_telem {
	__be32 ip;
	u16 padding0;
	u8 nomatch;
	u8 cidr;
	unsigned long timeout;
};

static inline bool
hash_net4_data_equal(const struct hash_net4_elem *ip1,
		     const struct hash_net4_elem *ip2,
		     u32 *multi)
{
	return ip1->ip == ip2->ip &&
	       ip1->cidr == ip2->cidr;
}

static inline bool
hash_net4_data_isnull(const struct hash_net4_elem *elem)
{
	return elem->cidr == 0;
}

static inline void
hash_net4_data_copy(struct hash_net4_elem *dst,
		    const struct hash_net4_elem *src)
{
	dst->ip = src->ip;
	dst->cidr = src->cidr;
	dst->nomatch = src->nomatch;
}

static inline void
hash_net4_data_flags(struct hash_net4_elem *dst, u32 flags)
{
	dst->nomatch = flags & IPSET_FLAG_NOMATCH;
}

static inline bool
hash_net4_data_match(const struct hash_net4_elem *elem)
{
	return !elem->nomatch;
}

static inline void
hash_net4_data_netmask(struct hash_net4_elem *elem, u8 cidr)
{
	elem->ip &= ip_set_netmask(cidr);
	elem->cidr = cidr;
}

/* Zero CIDR values cannot be stored */
static inline void
hash_net4_data_zero_out(struct hash_net4_elem *elem)
{
	elem->cidr = 0;
}

static bool
hash_net4_data_list(struct sk_buff *skb, const struct hash_net4_elem *data)
{
	u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;

	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
	NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
	if (flags)
		NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags));
	return 0;

nla_put_failure:
	return 1;
}

static bool
hash_net4_data_tlist(struct sk_buff *skb, const struct hash_net4_elem *data)
{
	const struct hash_net4_telem *tdata =
		(const struct hash_net4_telem *)data;
	u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;

	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, tdata->ip);
	NLA_PUT_U8(skb, IPSET_ATTR_CIDR, tdata->cidr);
	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
		      htonl(ip_set_timeout_get(tdata->timeout)));
	if (flags)
		NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags));

	return 0;

nla_put_failure:
	return 1;
}

#define IP_SET_HASH_WITH_NETS

#define PF		4
#define HOST_MASK	32
#include <linux/netfilter/ipset/ip_set_ahash.h>

static inline void
hash_net4_data_next(struct ip_set_hash *h,
		    const struct hash_net4_elem *d)
{
	h->next.ip = ntohl(d->ip);
}

static int
hash_net4_kadt(struct ip_set *set, const struct sk_buff *skb,
	       const struct xt_action_param *par,
	       enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{
	const struct ip_set_hash *h = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_net4_elem data = {
		.cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
	};

	if (data.cidr == 0)
		return -EINVAL;
	if (adt == IPSET_TEST)
		data.cidr = HOST_MASK;

	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip);
	data.ip &= ip_set_netmask(data.cidr);

	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
}

static int
hash_net4_uadt(struct ip_set *set, struct nlattr *tb[],
	       enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
{
	const struct ip_set_hash *h = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_net4_elem data = { .cidr = HOST_MASK };
	u32 timeout = h->timeout;
	u32 ip = 0, ip_to, last;
	int ret;

	if (unlikely(!tb[IPSET_ATTR_IP] ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
		return -IPSET_ERR_PROTOCOL;

	if (tb[IPSET_ATTR_LINENO])
		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);

	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
	if (ret)
		return ret;

	if (tb[IPSET_ATTR_CIDR]) {
		data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
		if (!data.cidr || data.cidr > HOST_MASK)
			return -IPSET_ERR_INVALID_CIDR;
	}

	if (tb[IPSET_ATTR_TIMEOUT]) {
		if (!with_timeout(h->timeout))
			return -IPSET_ERR_TIMEOUT;
		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
	}

	if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
		u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
		if (cadt_flags & IPSET_FLAG_NOMATCH)
			flags |= (cadt_flags << 16);
	}

	if (adt == IPSET_TEST || !tb[IPSET_ATTR_IP_TO]) {
		data.ip = htonl(ip & ip_set_hostmask(data.cidr));
		ret = adtfn(set, &data, timeout, flags);
		return ip_set_eexist(ret, flags) ? 0 : ret;
	}

	ip_to = ip;
	if (tb[IPSET_ATTR_IP_TO]) {
		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
		if (ret)
			return ret;
		if (ip_to < ip)
			swap(ip, ip_to);
		if (ip + UINT_MAX == ip_to)
			return -IPSET_ERR_HASH_RANGE;
	}
	if (retried)
		ip = h->next.ip;
	while (!after(ip, ip_to)) {
		data.ip = htonl(ip);
		last = ip_set_range_to_cidr(ip, ip_to, &data.cidr);
		ret = adtfn(set, &data, timeout, flags);
		if (ret && !ip_set_eexist(ret, flags))
			return ret;
		else
			ret = 0;
		ip = last + 1;
	}
	return ret;
}

static bool
hash_net_same_set(const struct ip_set *a, const struct ip_set *b)
{
	const struct ip_set_hash *x = a->data;
	const struct ip_set_hash *y = b->data;

	/* Resizing changes htable_bits, so we ignore it */
	return x->maxelem == y->maxelem &&
	       x->timeout == y->timeout;
}

/* The type variant functions: IPv6 */

struct hash_net6_elem {
	union nf_inet_addr ip;
	u16 padding0;
	u8 nomatch;
	u8 cidr;
};

struct hash_net6_telem {
	union nf_inet_addr ip;
	u16 padding0;
	u8 nomatch;
	u8 cidr;
	unsigned long timeout;
};

static inline bool
hash_net6_data_equal(const struct hash_net6_elem *ip1,
		     const struct hash_net6_elem *ip2,
		     u32 *multi)
{
	return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 &&
	       ip1->cidr == ip2->cidr;
}

static inline bool
hash_net6_data_isnull(const struct hash_net6_elem *elem)
{
	return elem->cidr == 0;
}

static inline void
hash_net6_data_copy(struct hash_net6_elem *dst,
		    const struct hash_net6_elem *src)
{
	dst->ip.in6 = src->ip.in6;
	dst->cidr = src->cidr;
	dst->nomatch = src->nomatch;
}

static inline void
hash_net6_data_flags(struct hash_net6_elem *dst, u32 flags)
{
	dst->nomatch = flags & IPSET_FLAG_NOMATCH;
}

static inline bool
hash_net6_data_match(const struct hash_net6_elem *elem)
{
	return !elem->nomatch;
}

static inline void
hash_net6_data_zero_out(struct hash_net6_elem *elem)
{
	elem->cidr = 0;
}

static inline void
ip6_netmask(union nf_inet_addr *ip, u8 prefix)
{
	ip->ip6[0] &= ip_set_netmask6(prefix)[0];
	ip->ip6[1] &= ip_set_netmask6(prefix)[1];
	ip->ip6[2] &= ip_set_netmask6(prefix)[2];
	ip->ip6[3] &= ip_set_netmask6(prefix)[3];
}

static inline void
hash_net6_data_netmask(struct hash_net6_elem *elem, u8 cidr)
{
	ip6_netmask(&elem->ip, cidr);
	elem->cidr = cidr;
}

static bool
hash_net6_data_list(struct sk_buff *skb, const struct hash_net6_elem *data)
{
	u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;

	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &data->ip);
	NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
	if (flags)
		NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags));
	return 0;

nla_put_failure:
	return 1;
}

static bool
hash_net6_data_tlist(struct sk_buff *skb, const struct hash_net6_elem *data)
{
	const struct hash_net6_telem *e =
		(const struct hash_net6_telem *)data;
	u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;

	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &e->ip);
	NLA_PUT_U8(skb, IPSET_ATTR_CIDR, e->cidr);
	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
		      htonl(ip_set_timeout_get(e->timeout)));
	if (flags)
		NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags));
	return 0;

nla_put_failure:
	return 1;
}

#undef PF
#undef HOST_MASK

#define PF		6
#define HOST_MASK	128
#include <linux/netfilter/ipset/ip_set_ahash.h>

static inline void
hash_net6_data_next(struct ip_set_hash *h,
		    const struct hash_net6_elem *d)
{
}

static int
hash_net6_kadt(struct ip_set *set, const struct sk_buff *skb,
	       const struct xt_action_param *par,
	       enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{
	const struct ip_set_hash *h = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_net6_elem data = {
		.cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
	};

	if (data.cidr == 0)
		return -EINVAL;
	if (adt == IPSET_TEST)
		data.cidr = HOST_MASK;

	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
	ip6_netmask(&data.ip, data.cidr);

	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
}

static int
hash_net6_uadt(struct ip_set *set, struct nlattr *tb[],
	       enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
{
	const struct ip_set_hash *h = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_net6_elem data = { .cidr = HOST_MASK };
	u32 timeout = h->timeout;
	int ret;

	if (unlikely(!tb[IPSET_ATTR_IP] ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
		return -IPSET_ERR_PROTOCOL;
	if (unlikely(tb[IPSET_ATTR_IP_TO]))
		return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;

	if (tb[IPSET_ATTR_LINENO])
		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);

	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &data.ip);
	if (ret)
		return ret;

	if (tb[IPSET_ATTR_CIDR])
		data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);

	if (!data.cidr || data.cidr > HOST_MASK)
		return -IPSET_ERR_INVALID_CIDR;

	ip6_netmask(&data.ip, data.cidr);

	if (tb[IPSET_ATTR_TIMEOUT]) {
		if (!with_timeout(h->timeout))
			return -IPSET_ERR_TIMEOUT;
		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
	}

	if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
		u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
		if (cadt_flags & IPSET_FLAG_NOMATCH)
			flags |= (cadt_flags << 16);
	}

	ret = adtfn(set, &data, timeout, flags);

	return ip_set_eexist(ret, flags) ? 0 : ret;
}

/* Create hash:ip type of sets */

static int
hash_net_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
{
	u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
	struct ip_set_hash *h;
	u8 hbits;

	if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
		return -IPSET_ERR_INVALID_FAMILY;

	if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
		return -IPSET_ERR_PROTOCOL;

	if (tb[IPSET_ATTR_HASHSIZE]) {
		hashsize = ip_set_get_h32(tb[IPSET_ATTR_HASHSIZE]);
		if (hashsize < IPSET_MIMINAL_HASHSIZE)
			hashsize = IPSET_MIMINAL_HASHSIZE;
	}

	if (tb[IPSET_ATTR_MAXELEM])
		maxelem = ip_set_get_h32(tb[IPSET_ATTR_MAXELEM]);

	h = kzalloc(sizeof(*h)
		    + sizeof(struct ip_set_hash_nets)
		      * (set->family == NFPROTO_IPV4 ? 32 : 128), GFP_KERNEL);
	if (!h)
		return -ENOMEM;

	h->maxelem = maxelem;
	get_random_bytes(&h->initval, sizeof(h->initval));
	h->timeout = IPSET_NO_TIMEOUT;

	hbits = htable_bits(hashsize);
	h->table = ip_set_alloc(
			sizeof(struct htable)
			+ jhash_size(hbits) * sizeof(struct hbucket));
	if (!h->table) {
		kfree(h);
		return -ENOMEM;
	}
	h->table->htable_bits = hbits;

	set->data = h;

	if (tb[IPSET_ATTR_TIMEOUT]) {
		h->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);

		set->variant = set->family == NFPROTO_IPV4
			? &hash_net4_tvariant : &hash_net6_tvariant;

		if (set->family == NFPROTO_IPV4)
			hash_net4_gc_init(set);
		else
			hash_net6_gc_init(set);
	} else {
		set->variant = set->family == NFPROTO_IPV4
			? &hash_net4_variant : &hash_net6_variant;
	}

	pr_debug("create %s hashsize %u (%u) maxelem %u: %p(%p)\n",
		 set->name, jhash_size(h->table->htable_bits),
		 h->table->htable_bits, h->maxelem, set->data, h->table);

	return 0;
}

static struct ip_set_type hash_net_type __read_mostly = {
	.name		= "hash:net",
	.protocol	= IPSET_PROTOCOL,
	.features	= IPSET_TYPE_IP,
	.dimension	= IPSET_DIM_ONE,
	.family		= NFPROTO_UNSPEC,
	.revision_min	= 0,
	/*		= 1 	   Range as input support for IPv4 added */
	.revision_max	= 2,	/* nomatch flag support added */
	.create		= hash_net_create,
	.create_policy	= {
		[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
		[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
		[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
		[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
	},
	.adt_policy	= {
		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
		[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },
	},
	.me		= THIS_MODULE,
};

static int __init
hash_net_init(void)
{
	return ip_set_type_register(&hash_net_type);
}

static void __exit
hash_net_fini(void)
{
	ip_set_type_unregister(&hash_net_type);
}

module_init(hash_net_init);
module_exit(hash_net_fini);
Commit	Line	Data
b3837029 JK	1	/* Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
	2	*
	3	* This program is free software; you can redistribute it and/or modify
	4	* it under the terms of the GNU General Public License version 2 as
	5	* published by the Free Software Foundation.
	6	*/
	7
	8	/* Kernel module implementing an IP set type: the hash:net type */
	9
	10	#include <linux/jhash.h>
	11	#include <linux/module.h>
	12	#include <linux/ip.h>
	13	#include <linux/skbuff.h>
	14	#include <linux/errno.h>
b3837029 JK	15	#include <linux/random.h>
	16	#include <net/ip.h>
	17	#include <net/ipv6.h>
	18	#include <net/netlink.h>
	19
	20	#include <linux/netfilter.h>
	21	#include <linux/netfilter/ipset/pfxlen.h>
	22	#include <linux/netfilter/ipset/ip_set.h>
	23	#include <linux/netfilter/ipset/ip_set_timeout.h>
	24	#include <linux/netfilter/ipset/ip_set_hash.h>
	25
	26	MODULE_LICENSE("GPL");
	27	MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
	28	MODULE_DESCRIPTION("hash:net type of IP sets");
	29	MODULE_ALIAS("ip_set_hash:net");
	30
	31	/* Type specific function prefix */
	32	#define TYPE hash_net
	33
	34	static bool
	35	hash_net_same_set(const struct ip_set a, const struct ip_set b);
	36
	37	#define hash_net4_same_set hash_net_same_set
	38	#define hash_net6_same_set hash_net_same_set
	39
	40	/* The type variant functions: IPv4 */
	41
	42	/* Member elements without timeout */
	43	struct hash_net4_elem {
	44	__be32 ip;
	45	u16 padding0;
2a7cef2a	46	u8 nomatch;
b3837029 JK	47	u8 cidr;
	48	};
	49
	50	/* Member elements with timeout support */
	51	struct hash_net4_telem {
	52	__be32 ip;
	53	u16 padding0;
2a7cef2a	54	u8 nomatch;
b3837029 JK	55	u8 cidr;
	56	unsigned long timeout;
	57	};
	58
	59	static inline bool
	60	hash_net4_data_equal(const struct hash_net4_elem *ip1,
89dc79b7 JK	61	const struct hash_net4_elem *ip2,
89dc79b7 JK	62	u32 *multi)
b3837029	63	{
2a7cef2a JK	64	return ip1->ip == ip2->ip &&
2a7cef2a JK	65	ip1->cidr == ip2->cidr;
b3837029 JK	66	}
	67
	68	static inline bool
	69	hash_net4_data_isnull(const struct hash_net4_elem *elem)
	70	{
	71	return elem->cidr == 0;
	72	}
	73
	74	static inline void
	75	hash_net4_data_copy(struct hash_net4_elem *dst,
	76	const struct hash_net4_elem *src)
	77	{
	78	dst->ip = src->ip;
	79	dst->cidr = src->cidr;
2a7cef2a JK	80	dst->nomatch = src->nomatch;
	81	}
	82
	83	static inline void
	84	hash_net4_data_flags(struct hash_net4_elem *dst, u32 flags)
	85	{
	86	dst->nomatch = flags & IPSET_FLAG_NOMATCH;
	87	}
	88
	89	static inline bool
	90	hash_net4_data_match(const struct hash_net4_elem *elem)
	91	{
	92	return !elem->nomatch;
b3837029 JK	93	}
	94
	95	static inline void
	96	hash_net4_data_netmask(struct hash_net4_elem *elem, u8 cidr)
	97	{
	98	elem->ip &= ip_set_netmask(cidr);
	99	elem->cidr = cidr;
	100	}
	101
	102	/* Zero CIDR values cannot be stored */
	103	static inline void
	104	hash_net4_data_zero_out(struct hash_net4_elem *elem)
	105	{
	106	elem->cidr = 0;
	107	}
	108
	109	static bool
	110	hash_net4_data_list(struct sk_buff skb, const struct hash_net4_elem data)
	111	{
2a7cef2a JK	112	u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
2a7cef2a JK	113
b3837029 JK	114	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
b3837029 JK	115	NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
2a7cef2a JK	116	if (flags)
2a7cef2a JK	117	NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags));
b3837029 JK	118	return 0;
	119
	120	nla_put_failure:
	121	return 1;
	122	}
	123
	124	static bool
	125	hash_net4_data_tlist(struct sk_buff skb, const struct hash_net4_elem data)
	126	{
	127	const struct hash_net4_telem *tdata =
	128	(const struct hash_net4_telem *)data;
2a7cef2a	129	u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
b3837029 JK	130
	131	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, tdata->ip);
	132	NLA_PUT_U8(skb, IPSET_ATTR_CIDR, tdata->cidr);
	133	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
	134	htonl(ip_set_timeout_get(tdata->timeout)));
2a7cef2a JK	135	if (flags)
2a7cef2a JK	136	NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags));
b3837029 JK	137
	138	return 0;
	139
	140	nla_put_failure:
	141	return 1;
	142	}
	143
	144	#define IP_SET_HASH_WITH_NETS
	145
	146	#define PF 4
	147	#define HOST_MASK 32
	148	#include <linux/netfilter/ipset/ip_set_ahash.h>
	149
3d14b171 JK	150	static inline void
	151	hash_net4_data_next(struct ip_set_hash *h,
	152	const struct hash_net4_elem *d)
	153	{
d0d9e0a5	154	h->next.ip = ntohl(d->ip);
3d14b171 JK	155	}
3d14b171 JK	156
b3837029 JK	157	static int
b3837029 JK	158	hash_net4_kadt(struct ip_set set, const struct sk_buff skb,
b66554cf	159	const struct xt_action_param *par,
ac8cc925	160	enum ipset_adt adt, const struct ip_set_adt_opt *opt)
b3837029 JK	161	{
	162	const struct ip_set_hash *h = set->data;
	163	ipset_adtfn adtfn = set->variant->adt[adt];
9b03a5ef JK	164	struct hash_net4_elem data = {
	165	.cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
	166	};
b3837029 JK	167
	168	if (data.cidr == 0)
	169	return -EINVAL;
	170	if (adt == IPSET_TEST)
	171	data.cidr = HOST_MASK;
	172
ac8cc925	173	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip);
b3837029 JK	174	data.ip &= ip_set_netmask(data.cidr);
b3837029 JK	175
ac8cc925	176	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
b3837029 JK	177	}
	178
	179	static int
	180	hash_net4_uadt(struct ip_set set, struct nlattr tb[],
3d14b171	181	enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
b3837029 JK	182	{
	183	const struct ip_set_hash *h = set->data;
	184	ipset_adtfn adtfn = set->variant->adt[adt];
	185	struct hash_net4_elem data = { .cidr = HOST_MASK };
	186	u32 timeout = h->timeout;
d0d9e0a5	187	u32 ip = 0, ip_to, last;
b3837029 JK	188	int ret;
	189
	190	if (unlikely(!tb[IPSET_ATTR_IP] \|\|
2a7cef2a JK	191	!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) \|\|
2a7cef2a JK	192	!ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
b3837029 JK	193	return -IPSET_ERR_PROTOCOL;
	194
	195	if (tb[IPSET_ATTR_LINENO])
	196	*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
	197
d0d9e0a5	198	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
b3837029 JK	199	if (ret)
	200	return ret;
	201
d0d9e0a5	202	if (tb[IPSET_ATTR_CIDR]) {
b3837029	203	data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
2a7cef2a	204	if (!data.cidr \|\| data.cidr > HOST_MASK)
d0d9e0a5 JK	205	return -IPSET_ERR_INVALID_CIDR;
d0d9e0a5 JK	206	}
b3837029 JK	207
	208	if (tb[IPSET_ATTR_TIMEOUT]) {
	209	if (!with_timeout(h->timeout))
	210	return -IPSET_ERR_TIMEOUT;
	211	timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
	212	}
15b4d93f	213
2a7cef2a JK	214	if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
	215	u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
	216	if (cadt_flags & IPSET_FLAG_NOMATCH)
	217	flags \|= (cadt_flags << 16);
	218	}
	219
d0d9e0a5 JK	220	if (adt == IPSET_TEST \|\| !tb[IPSET_ATTR_IP_TO]) {
	221	data.ip = htonl(ip & ip_set_hostmask(data.cidr));
	222	ret = adtfn(set, &data, timeout, flags);
	223	return ip_set_eexist(ret, flags) ? 0 : ret;
	224	}
b3837029	225
d0d9e0a5 JK	226	ip_to = ip;
	227	if (tb[IPSET_ATTR_IP_TO]) {
	228	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
	229	if (ret)
	230	return ret;
	231	if (ip_to < ip)
	232	swap(ip, ip_to);
	233	if (ip + UINT_MAX == ip_to)
	234	return -IPSET_ERR_HASH_RANGE;
	235	}
	236	if (retried)
15b4d93f	237	ip = h->next.ip;
d0d9e0a5 JK	238	while (!after(ip, ip_to)) {
	239	data.ip = htonl(ip);
	240	last = ip_set_range_to_cidr(ip, ip_to, &data.cidr);
	241	ret = adtfn(set, &data, timeout, flags);
	242	if (ret && !ip_set_eexist(ret, flags))
	243	return ret;
	244	else
	245	ret = 0;
	246	ip = last + 1;
	247	}
	248	return ret;
b3837029 JK	249	}
	250
	251	static bool
	252	hash_net_same_set(const struct ip_set a, const struct ip_set b)
	253	{
	254	const struct ip_set_hash *x = a->data;
	255	const struct ip_set_hash *y = b->data;
	256
	257	/* Resizing changes htable_bits, so we ignore it */
	258	return x->maxelem == y->maxelem &&
	259	x->timeout == y->timeout;
	260	}
	261
	262	/* The type variant functions: IPv6 */
	263
	264	struct hash_net6_elem {
	265	union nf_inet_addr ip;
	266	u16 padding0;
2a7cef2a	267	u8 nomatch;
b3837029 JK	268	u8 cidr;
	269	};
	270
	271	struct hash_net6_telem {
	272	union nf_inet_addr ip;
	273	u16 padding0;
2a7cef2a	274	u8 nomatch;
b3837029 JK	275	u8 cidr;
	276	unsigned long timeout;
	277	};
	278
	279	static inline bool
	280	hash_net6_data_equal(const struct hash_net6_elem *ip1,
89dc79b7 JK	281	const struct hash_net6_elem *ip2,
89dc79b7 JK	282	u32 *multi)
b3837029 JK	283	{
	284	return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 &&
	285	ip1->cidr == ip2->cidr;
	286	}
	287
	288	static inline bool
	289	hash_net6_data_isnull(const struct hash_net6_elem *elem)
	290	{
	291	return elem->cidr == 0;
	292	}
	293
	294	static inline void
	295	hash_net6_data_copy(struct hash_net6_elem *dst,
	296	const struct hash_net6_elem *src)
	297	{
4e3fd7a0	298	dst->ip.in6 = src->ip.in6;
b3837029	299	dst->cidr = src->cidr;
2a7cef2a JK	300	dst->nomatch = src->nomatch;
	301	}
	302
	303	static inline void
	304	hash_net6_data_flags(struct hash_net6_elem *dst, u32 flags)
	305	{
	306	dst->nomatch = flags & IPSET_FLAG_NOMATCH;
	307	}
	308
	309	static inline bool
	310	hash_net6_data_match(const struct hash_net6_elem *elem)
	311	{
	312	return !elem->nomatch;
b3837029 JK	313	}
	314
	315	static inline void
	316	hash_net6_data_zero_out(struct hash_net6_elem *elem)
	317	{
	318	elem->cidr = 0;
	319	}
	320
	321	static inline void
	322	ip6_netmask(union nf_inet_addr *ip, u8 prefix)
	323	{
	324	ip->ip6[0] &= ip_set_netmask6(prefix)[0];
	325	ip->ip6[1] &= ip_set_netmask6(prefix)[1];
	326	ip->ip6[2] &= ip_set_netmask6(prefix)[2];
	327	ip->ip6[3] &= ip_set_netmask6(prefix)[3];
	328	}
	329
	330	static inline void
	331	hash_net6_data_netmask(struct hash_net6_elem *elem, u8 cidr)
	332	{
	333	ip6_netmask(&elem->ip, cidr);
	334	elem->cidr = cidr;
	335	}
	336
	337	static bool
	338	hash_net6_data_list(struct sk_buff skb, const struct hash_net6_elem data)
	339	{
2a7cef2a JK	340	u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
2a7cef2a JK	341
b3837029 JK	342	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &data->ip);
b3837029 JK	343	NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
2a7cef2a JK	344	if (flags)
2a7cef2a JK	345	NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags));
b3837029 JK	346	return 0;
	347
	348	nla_put_failure:
	349	return 1;
	350	}
	351
	352	static bool
	353	hash_net6_data_tlist(struct sk_buff skb, const struct hash_net6_elem data)
	354	{
	355	const struct hash_net6_telem *e =
	356	(const struct hash_net6_telem *)data;
2a7cef2a	357	u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
b3837029 JK	358
	359	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &e->ip);
	360	NLA_PUT_U8(skb, IPSET_ATTR_CIDR, e->cidr);
	361	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
	362	htonl(ip_set_timeout_get(e->timeout)));
2a7cef2a JK	363	if (flags)
2a7cef2a JK	364	NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags));
b3837029 JK	365	return 0;
	366
	367	nla_put_failure:
	368	return 1;
	369	}
	370
	371	#undef PF
	372	#undef HOST_MASK
	373
	374	#define PF 6
	375	#define HOST_MASK 128
	376	#include <linux/netfilter/ipset/ip_set_ahash.h>
	377
3d14b171 JK	378	static inline void
	379	hash_net6_data_next(struct ip_set_hash *h,
	380	const struct hash_net6_elem *d)
	381	{
	382	}
	383
b3837029 JK	384	static int
b3837029 JK	385	hash_net6_kadt(struct ip_set set, const struct sk_buff skb,
b66554cf	386	const struct xt_action_param *par,
ac8cc925	387	enum ipset_adt adt, const struct ip_set_adt_opt *opt)
b3837029 JK	388	{
	389	const struct ip_set_hash *h = set->data;
	390	ipset_adtfn adtfn = set->variant->adt[adt];
9b03a5ef JK	391	struct hash_net6_elem data = {
	392	.cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
	393	};
b3837029 JK	394
	395	if (data.cidr == 0)
	396	return -EINVAL;
	397	if (adt == IPSET_TEST)
	398	data.cidr = HOST_MASK;
	399
ac8cc925	400	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
b3837029 JK	401	ip6_netmask(&data.ip, data.cidr);
b3837029 JK	402
ac8cc925	403	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
b3837029 JK	404	}
	405
	406	static int
	407	hash_net6_uadt(struct ip_set set, struct nlattr tb[],
3d14b171	408	enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
b3837029 JK	409	{
	410	const struct ip_set_hash *h = set->data;
	411	ipset_adtfn adtfn = set->variant->adt[adt];
	412	struct hash_net6_elem data = { .cidr = HOST_MASK };
	413	u32 timeout = h->timeout;
	414	int ret;
	415
	416	if (unlikely(!tb[IPSET_ATTR_IP] \|\|
2a7cef2a JK	417	!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) \|\|
2a7cef2a JK	418	!ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
b3837029	419	return -IPSET_ERR_PROTOCOL;
d0d9e0a5 JK	420	if (unlikely(tb[IPSET_ATTR_IP_TO]))
d0d9e0a5 JK	421	return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
b3837029 JK	422
	423	if (tb[IPSET_ATTR_LINENO])
	424	*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
	425
	426	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &data.ip);
	427	if (ret)
	428	return ret;
	429
	430	if (tb[IPSET_ATTR_CIDR])
	431	data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
	432
2a7cef2a	433	if (!data.cidr \|\| data.cidr > HOST_MASK)
b3837029 JK	434	return -IPSET_ERR_INVALID_CIDR;
	435
	436	ip6_netmask(&data.ip, data.cidr);
	437
	438	if (tb[IPSET_ATTR_TIMEOUT]) {
	439	if (!with_timeout(h->timeout))
	440	return -IPSET_ERR_TIMEOUT;
	441	timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
	442	}
	443
2a7cef2a JK	444	if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
	445	u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
	446	if (cadt_flags & IPSET_FLAG_NOMATCH)
	447	flags \|= (cadt_flags << 16);
	448	}
	449
5416219e	450	ret = adtfn(set, &data, timeout, flags);
b3837029 JK	451
	452	return ip_set_eexist(ret, flags) ? 0 : ret;
	453	}
	454
	455	/* Create hash:ip type of sets */
	456
	457	static int
	458	hash_net_create(struct ip_set set, struct nlattr tb[], u32 flags)
	459	{
	460	u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
	461	struct ip_set_hash *h;
	462	u8 hbits;
	463
c15f1c83	464	if (!(set->family == NFPROTO_IPV4 \|\| set->family == NFPROTO_IPV6))
b3837029 JK	465	return -IPSET_ERR_INVALID_FAMILY;
	466
	467	if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) \|\|
	468	!ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) \|\|
	469	!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
	470	return -IPSET_ERR_PROTOCOL;
	471
	472	if (tb[IPSET_ATTR_HASHSIZE]) {
	473	hashsize = ip_set_get_h32(tb[IPSET_ATTR_HASHSIZE]);
	474	if (hashsize < IPSET_MIMINAL_HASHSIZE)
	475	hashsize = IPSET_MIMINAL_HASHSIZE;
	476	}
	477
	478	if (tb[IPSET_ATTR_MAXELEM])
	479	maxelem = ip_set_get_h32(tb[IPSET_ATTR_MAXELEM]);
	480
	481	h = kzalloc(sizeof(*h)
	482	+ sizeof(struct ip_set_hash_nets)
c15f1c83	483	* (set->family == NFPROTO_IPV4 ? 32 : 128), GFP_KERNEL);
b3837029 JK	484	if (!h)
	485	return -ENOMEM;
	486
	487	h->maxelem = maxelem;
	488	get_random_bytes(&h->initval, sizeof(h->initval));
	489	h->timeout = IPSET_NO_TIMEOUT;
	490
	491	hbits = htable_bits(hashsize);
	492	h->table = ip_set_alloc(
	493	sizeof(struct htable)
	494	+ jhash_size(hbits) * sizeof(struct hbucket));
	495	if (!h->table) {
	496	kfree(h);
	497	return -ENOMEM;
	498	}
	499	h->table->htable_bits = hbits;
	500
	501	set->data = h;
	502
	503	if (tb[IPSET_ATTR_TIMEOUT]) {
	504	h->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
	505
c15f1c83	506	set->variant = set->family == NFPROTO_IPV4
b3837029 JK	507	? &hash_net4_tvariant : &hash_net6_tvariant;
b3837029 JK	508
c15f1c83	509	if (set->family == NFPROTO_IPV4)
b3837029 JK	510	hash_net4_gc_init(set);
	511	else
	512	hash_net6_gc_init(set);
	513	} else {
c15f1c83	514	set->variant = set->family == NFPROTO_IPV4
b3837029 JK	515	? &hash_net4_variant : &hash_net6_variant;
	516	}
	517
	518	pr_debug("create %s hashsize %u (%u) maxelem %u: %p(%p)\n",
	519	set->name, jhash_size(h->table->htable_bits),
	520	h->table->htable_bits, h->maxelem, set->data, h->table);
	521
	522	return 0;
	523	}
	524
	525	static struct ip_set_type hash_net_type __read_mostly = {
	526	.name = "hash:net",
	527	.protocol = IPSET_PROTOCOL,
	528	.features = IPSET_TYPE_IP,
	529	.dimension = IPSET_DIM_ONE,
c15f1c83	530	.family = NFPROTO_UNSPEC,
f1e00b39	531	.revision_min = 0,
2a7cef2a JK	532	/* = 1 Range as input support for IPv4 added */
2a7cef2a JK	533	.revision_max = 2, /* nomatch flag support added */
b3837029 JK	534	.create = hash_net_create,
	535	.create_policy = {
	536	[IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
	537	[IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
	538	[IPSET_ATTR_PROBES] = { .type = NLA_U8 },
	539	[IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
	540	[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
	541	},
	542	.adt_policy = {
	543	[IPSET_ATTR_IP] = { .type = NLA_NESTED },
d0d9e0a5	544	[IPSET_ATTR_IP_TO] = { .type = NLA_NESTED },
b3837029 JK	545	[IPSET_ATTR_CIDR] = { .type = NLA_U8 },
b3837029 JK	546	[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
2a7cef2a	547	[IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
b3837029 JK	548	},
	549	.me = THIS_MODULE,
	550	};
	551
	552	static int __init
	553	hash_net_init(void)
	554	{
	555	return ip_set_type_register(&hash_net_type);
	556	}
	557
	558	static void __exit
	559	hash_net_fini(void)
	560	{
	561	ip_set_type_unregister(&hash_net_type);
	562	}
	563
	564	module_init(hash_net_init);
	565	module_exit(hash_net_fini);