~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/include/linux/netfilter/ipset/ip_set.h

Version: ~ [ linux-5.12-rc7 ] ~ [ linux-5.11.13 ] ~ [ linux-5.10.29 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.111 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.186 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.230 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.266 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.266 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
  2  *                         Patrick Schaaf <bof@bof.de>
  3  *                         Martin Josefsson <gandalf@wlug.westbo.se>
  4  * Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  5  *
  6  * This program is free software; you can redistribute it and/or modify
  7  * it under the terms of the GNU General Public License version 2 as
  8  * published by the Free Software Foundation.
  9  */
 10 #ifndef _IP_SET_H
 11 #define _IP_SET_H
 12 
 13 #include <linux/ip.h>
 14 #include <linux/ipv6.h>
 15 #include <linux/netlink.h>
 16 #include <linux/netfilter.h>
 17 #include <linux/netfilter/x_tables.h>
 18 #include <linux/stringify.h>
 19 #include <linux/vmalloc.h>
 20 #include <net/netlink.h>
 21 #include <uapi/linux/netfilter/ipset/ip_set.h>
 22 
 23 #define _IP_SET_MODULE_DESC(a, b, c)            \
 24         MODULE_DESCRIPTION(a " type of IP sets, revisions " b "-" c)
 25 #define IP_SET_MODULE_DESC(a, b, c)             \
 26         _IP_SET_MODULE_DESC(a, __stringify(b), __stringify(c))
 27 
 28 /* Set features */
 29 enum ip_set_feature {
 30         IPSET_TYPE_IP_FLAG = 0,
 31         IPSET_TYPE_IP = (1 << IPSET_TYPE_IP_FLAG),
 32         IPSET_TYPE_PORT_FLAG = 1,
 33         IPSET_TYPE_PORT = (1 << IPSET_TYPE_PORT_FLAG),
 34         IPSET_TYPE_MAC_FLAG = 2,
 35         IPSET_TYPE_MAC = (1 << IPSET_TYPE_MAC_FLAG),
 36         IPSET_TYPE_IP2_FLAG = 3,
 37         IPSET_TYPE_IP2 = (1 << IPSET_TYPE_IP2_FLAG),
 38         IPSET_TYPE_NAME_FLAG = 4,
 39         IPSET_TYPE_NAME = (1 << IPSET_TYPE_NAME_FLAG),
 40         IPSET_TYPE_IFACE_FLAG = 5,
 41         IPSET_TYPE_IFACE = (1 << IPSET_TYPE_IFACE_FLAG),
 42         IPSET_TYPE_MARK_FLAG = 6,
 43         IPSET_TYPE_MARK = (1 << IPSET_TYPE_MARK_FLAG),
 44         IPSET_TYPE_NOMATCH_FLAG = 7,
 45         IPSET_TYPE_NOMATCH = (1 << IPSET_TYPE_NOMATCH_FLAG),
 46         /* Strictly speaking not a feature, but a flag for dumping:
 47          * this settype must be dumped last */
 48         IPSET_DUMP_LAST_FLAG = 8,
 49         IPSET_DUMP_LAST = (1 << IPSET_DUMP_LAST_FLAG),
 50 };
 51 
 52 /* Set extensions */
 53 enum ip_set_extension {
 54         IPSET_EXT_BIT_TIMEOUT = 0,
 55         IPSET_EXT_TIMEOUT = (1 << IPSET_EXT_BIT_TIMEOUT),
 56         IPSET_EXT_BIT_COUNTER = 1,
 57         IPSET_EXT_COUNTER = (1 << IPSET_EXT_BIT_COUNTER),
 58         IPSET_EXT_BIT_COMMENT = 2,
 59         IPSET_EXT_COMMENT = (1 << IPSET_EXT_BIT_COMMENT),
 60         IPSET_EXT_BIT_SKBINFO = 3,
 61         IPSET_EXT_SKBINFO = (1 << IPSET_EXT_BIT_SKBINFO),
 62         /* Mark set with an extension which needs to call destroy */
 63         IPSET_EXT_BIT_DESTROY = 7,
 64         IPSET_EXT_DESTROY = (1 << IPSET_EXT_BIT_DESTROY),
 65 };
 66 
 67 #define SET_WITH_TIMEOUT(s)     ((s)->extensions & IPSET_EXT_TIMEOUT)
 68 #define SET_WITH_COUNTER(s)     ((s)->extensions & IPSET_EXT_COUNTER)
 69 #define SET_WITH_COMMENT(s)     ((s)->extensions & IPSET_EXT_COMMENT)
 70 #define SET_WITH_SKBINFO(s)     ((s)->extensions & IPSET_EXT_SKBINFO)
 71 #define SET_WITH_FORCEADD(s)    ((s)->flags & IPSET_CREATE_FLAG_FORCEADD)
 72 
 73 /* Extension id, in size order */
 74 enum ip_set_ext_id {
 75         IPSET_EXT_ID_COUNTER = 0,
 76         IPSET_EXT_ID_TIMEOUT,
 77         IPSET_EXT_ID_SKBINFO,
 78         IPSET_EXT_ID_COMMENT,
 79         IPSET_EXT_ID_MAX,
 80 };
 81 
 82 struct ip_set;
 83 
 84 /* Extension type */
 85 struct ip_set_ext_type {
 86         /* Destroy extension private data (can be NULL) */
 87         void (*destroy)(struct ip_set *set, void *ext);
 88         enum ip_set_extension type;
 89         enum ipset_cadt_flags flag;
 90         /* Size and minimal alignment */
 91         u8 len;
 92         u8 align;
 93 };
 94 
 95 extern const struct ip_set_ext_type ip_set_extensions[];
 96 
 97 struct ip_set_counter {
 98         atomic64_t bytes;
 99         atomic64_t packets;
100 };
101 
102 struct ip_set_comment_rcu {
103         struct rcu_head rcu;
104         char str[0];
105 };
106 
107 struct ip_set_comment {
108         struct ip_set_comment_rcu __rcu *c;
109 };
110 
111 struct ip_set_skbinfo {
112         u32 skbmark;
113         u32 skbmarkmask;
114         u32 skbprio;
115         u16 skbqueue;
116         u16 __pad;
117 };
118 
119 struct ip_set_ext {
120         struct ip_set_skbinfo skbinfo;
121         u64 packets;
122         u64 bytes;
123         char *comment;
124         u32 timeout;
125         u8 packets_op;
126         u8 bytes_op;
127 };
128 
129 struct ip_set;
130 
131 #define ext_timeout(e, s)       \
132 ((unsigned long *)(((void *)(e)) + (s)->offset[IPSET_EXT_ID_TIMEOUT]))
133 #define ext_counter(e, s)       \
134 ((struct ip_set_counter *)(((void *)(e)) + (s)->offset[IPSET_EXT_ID_COUNTER]))
135 #define ext_comment(e, s)       \
136 ((struct ip_set_comment *)(((void *)(e)) + (s)->offset[IPSET_EXT_ID_COMMENT]))
137 #define ext_skbinfo(e, s)       \
138 ((struct ip_set_skbinfo *)(((void *)(e)) + (s)->offset[IPSET_EXT_ID_SKBINFO]))
139 
140 typedef int (*ipset_adtfn)(struct ip_set *set, void *value,
141                            const struct ip_set_ext *ext,
142                            struct ip_set_ext *mext, u32 cmdflags);
143 
144 /* Kernel API function options */
145 struct ip_set_adt_opt {
146         u8 family;              /* Actual protocol family */
147         u8 dim;                 /* Dimension of match/target */
148         u8 flags;               /* Direction and negation flags */
149         u32 cmdflags;           /* Command-like flags */
150         struct ip_set_ext ext;  /* Extensions */
151 };
152 
153 /* Set type, variant-specific part */
154 struct ip_set_type_variant {
155         /* Kernelspace: test/add/del entries
156          *              returns negative error code,
157          *                      zero for no match/success to add/delete
158          *                      positive for matching element */
159         int (*kadt)(struct ip_set *set, const struct sk_buff *skb,
160                     const struct xt_action_param *par,
161                     enum ipset_adt adt, struct ip_set_adt_opt *opt);
162 
163         /* Userspace: test/add/del entries
164          *              returns negative error code,
165          *                      zero for no match/success to add/delete
166          *                      positive for matching element */
167         int (*uadt)(struct ip_set *set, struct nlattr *tb[],
168                     enum ipset_adt adt, u32 *lineno, u32 flags, bool retried);
169 
170         /* Low level add/del/test functions */
171         ipset_adtfn adt[IPSET_ADT_MAX];
172 
173         /* When adding entries and set is full, try to resize the set */
174         int (*resize)(struct ip_set *set, bool retried);
175         /* Destroy the set */
176         void (*destroy)(struct ip_set *set);
177         /* Flush the elements */
178         void (*flush)(struct ip_set *set);
179         /* Expire entries before listing */
180         void (*expire)(struct ip_set *set);
181         /* List set header data */
182         int (*head)(struct ip_set *set, struct sk_buff *skb);
183         /* List elements */
184         int (*list)(const struct ip_set *set, struct sk_buff *skb,
185                     struct netlink_callback *cb);
186         /* Keep listing private when resizing runs parallel */
187         void (*uref)(struct ip_set *set, struct netlink_callback *cb,
188                      bool start);
189 
190         /* Return true if "b" set is the same as "a"
191          * according to the create set parameters */
192         bool (*same_set)(const struct ip_set *a, const struct ip_set *b);
193 };
194 
195 /* The core set type structure */
196 struct ip_set_type {
197         struct list_head list;
198 
199         /* Typename */
200         char name[IPSET_MAXNAMELEN];
201         /* Protocol version */
202         u8 protocol;
203         /* Set type dimension */
204         u8 dimension;
205         /*
206          * Supported family: may be NFPROTO_UNSPEC for both
207          * NFPROTO_IPV4/NFPROTO_IPV6.
208          */
209         u8 family;
210         /* Type revisions */
211         u8 revision_min, revision_max;
212         /* Set features to control swapping */
213         u16 features;
214 
215         /* Create set */
216         int (*create)(struct net *net, struct ip_set *set,
217                       struct nlattr *tb[], u32 flags);
218 
219         /* Attribute policies */
220         const struct nla_policy create_policy[IPSET_ATTR_CREATE_MAX + 1];
221         const struct nla_policy adt_policy[IPSET_ATTR_ADT_MAX + 1];
222 
223         /* Set this to THIS_MODULE if you are a module, otherwise NULL */
224         struct module *me;
225 };
226 
227 /* register and unregister set type */
228 extern int ip_set_type_register(struct ip_set_type *set_type);
229 extern void ip_set_type_unregister(struct ip_set_type *set_type);
230 
231 /* A generic IP set */
232 struct ip_set {
233         /* The name of the set */
234         char name[IPSET_MAXNAMELEN];
235         /* Lock protecting the set data */
236         spinlock_t lock;
237         /* References to the set */
238         u32 ref;
239         /* References to the set for netlink events like dump,
240          * ref can be swapped out by ip_set_swap
241          */
242         u32 ref_netlink;
243         /* The core set type */
244         struct ip_set_type *type;
245         /* The type variant doing the real job */
246         const struct ip_set_type_variant *variant;
247         /* The actual INET family of the set */
248         u8 family;
249         /* The type revision */
250         u8 revision;
251         /* Extensions */
252         u8 extensions;
253         /* Create flags */
254         u8 flags;
255         /* Default timeout value, if enabled */
256         u32 timeout;
257         /* Number of elements (vs timeout) */
258         u32 elements;
259         /* Size of the dynamic extensions (vs timeout) */
260         size_t ext_size;
261         /* Element data size */
262         size_t dsize;
263         /* Offsets to extensions in elements */
264         size_t offset[IPSET_EXT_ID_MAX];
265         /* The type specific data */
266         void *data;
267 };
268 
269 static inline void
270 ip_set_ext_destroy(struct ip_set *set, void *data)
271 {
272         /* Check that the extension is enabled for the set and
273          * call it's destroy function for its extension part in data.
274          */
275         if (SET_WITH_COMMENT(set))
276                 ip_set_extensions[IPSET_EXT_ID_COMMENT].destroy(
277                         set, ext_comment(data, set));
278 }
279 
280 static inline int
281 ip_set_put_flags(struct sk_buff *skb, struct ip_set *set)
282 {
283         u32 cadt_flags = 0;
284 
285         if (SET_WITH_TIMEOUT(set))
286                 if (unlikely(nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
287                                            htonl(set->timeout))))
288                         return -EMSGSIZE;
289         if (SET_WITH_COUNTER(set))
290                 cadt_flags |= IPSET_FLAG_WITH_COUNTERS;
291         if (SET_WITH_COMMENT(set))
292                 cadt_flags |= IPSET_FLAG_WITH_COMMENT;
293         if (SET_WITH_SKBINFO(set))
294                 cadt_flags |= IPSET_FLAG_WITH_SKBINFO;
295         if (SET_WITH_FORCEADD(set))
296                 cadt_flags |= IPSET_FLAG_WITH_FORCEADD;
297 
298         if (!cadt_flags)
299                 return 0;
300         return nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(cadt_flags));
301 }
302 
303 /* Netlink CB args */
304 enum {
305         IPSET_CB_NET = 0,       /* net namespace */
306         IPSET_CB_DUMP,          /* dump single set/all sets */
307         IPSET_CB_INDEX,         /* set index */
308         IPSET_CB_PRIVATE,       /* set private data */
309         IPSET_CB_ARG0,          /* type specific */
310         IPSET_CB_ARG1,
311 };
312 
313 /* register and unregister set references */
314 extern ip_set_id_t ip_set_get_byname(struct net *net,
315                                      const char *name, struct ip_set **set);
316 extern void ip_set_put_byindex(struct net *net, ip_set_id_t index);
317 extern const char *ip_set_name_byindex(struct net *net, ip_set_id_t index);
318 extern ip_set_id_t ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index);
319 extern void ip_set_nfnl_put(struct net *net, ip_set_id_t index);
320 
321 /* API for iptables set match, and SET target */
322 
323 extern int ip_set_add(ip_set_id_t id, const struct sk_buff *skb,
324                       const struct xt_action_param *par,
325                       struct ip_set_adt_opt *opt);
326 extern int ip_set_del(ip_set_id_t id, const struct sk_buff *skb,
327                       const struct xt_action_param *par,
328                       struct ip_set_adt_opt *opt);
329 extern int ip_set_test(ip_set_id_t id, const struct sk_buff *skb,
330                        const struct xt_action_param *par,
331                        struct ip_set_adt_opt *opt);
332 
333 /* Utility functions */
334 extern void *ip_set_alloc(size_t size);
335 extern void ip_set_free(void *members);
336 extern int ip_set_get_ipaddr4(struct nlattr *nla,  __be32 *ipaddr);
337 extern int ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr);
338 extern size_t ip_set_elem_len(struct ip_set *set, struct nlattr *tb[],
339                               size_t len, size_t align);
340 extern int ip_set_get_extensions(struct ip_set *set, struct nlattr *tb[],
341                                  struct ip_set_ext *ext);
342 extern int ip_set_put_extensions(struct sk_buff *skb, const struct ip_set *set,
343                                  const void *e, bool active);
344 extern bool ip_set_match_extensions(struct ip_set *set,
345                                     const struct ip_set_ext *ext,
346                                     struct ip_set_ext *mext,
347                                     u32 flags, void *data);
348 
349 static inline int
350 ip_set_get_hostipaddr4(struct nlattr *nla, u32 *ipaddr)
351 {
352         __be32 ip;
353         int ret = ip_set_get_ipaddr4(nla, &ip);
354 
355         if (ret)
356                 return ret;
357         *ipaddr = ntohl(ip);
358         return 0;
359 }
360 
361 /* Ignore IPSET_ERR_EXIST errors if asked to do so? */
362 static inline bool
363 ip_set_eexist(int ret, u32 flags)
364 {
365         return ret == -IPSET_ERR_EXIST && (flags & IPSET_FLAG_EXIST);
366 }
367 
368 /* Match elements marked with nomatch */
369 static inline bool
370 ip_set_enomatch(int ret, u32 flags, enum ipset_adt adt, struct ip_set *set)
371 {
372         return adt == IPSET_TEST &&
373                (set->type->features & IPSET_TYPE_NOMATCH) &&
374                ((flags >> 16) & IPSET_FLAG_NOMATCH) &&
375                (ret > 0 || ret == -ENOTEMPTY);
376 }
377 
378 /* Check the NLA_F_NET_BYTEORDER flag */
379 static inline bool
380 ip_set_attr_netorder(struct nlattr *tb[], int type)
381 {
382         return tb[type] && (tb[type]->nla_type & NLA_F_NET_BYTEORDER);
383 }
384 
385 static inline bool
386 ip_set_optattr_netorder(struct nlattr *tb[], int type)
387 {
388         return !tb[type] || (tb[type]->nla_type & NLA_F_NET_BYTEORDER);
389 }
390 
391 /* Useful converters */
392 static inline u32
393 ip_set_get_h32(const struct nlattr *attr)
394 {
395         return ntohl(nla_get_be32(attr));
396 }
397 
398 static inline u16
399 ip_set_get_h16(const struct nlattr *attr)
400 {
401         return ntohs(nla_get_be16(attr));
402 }
403 
404 #define ipset_nest_start(skb, attr) nla_nest_start(skb, attr | NLA_F_NESTED)
405 #define ipset_nest_end(skb, start)  nla_nest_end(skb, start)
406 
407 static inline int nla_put_ipaddr4(struct sk_buff *skb, int type, __be32 ipaddr)
408 {
409         struct nlattr *__nested = ipset_nest_start(skb, type);
410         int ret;
411 
412         if (!__nested)
413                 return -EMSGSIZE;
414         ret = nla_put_in_addr(skb, IPSET_ATTR_IPADDR_IPV4, ipaddr);
415         if (!ret)
416                 ipset_nest_end(skb, __nested);
417         return ret;
418 }
419 
420 static inline int nla_put_ipaddr6(struct sk_buff *skb, int type,
421                                   const struct in6_addr *ipaddrptr)
422 {
423         struct nlattr *__nested = ipset_nest_start(skb, type);
424         int ret;
425 
426         if (!__nested)
427                 return -EMSGSIZE;
428         ret = nla_put_in6_addr(skb, IPSET_ATTR_IPADDR_IPV6, ipaddrptr);
429         if (!ret)
430                 ipset_nest_end(skb, __nested);
431         return ret;
432 }
433 
434 /* Get address from skbuff */
435 static inline __be32
436 ip4addr(const struct sk_buff *skb, bool src)
437 {
438         return src ? ip_hdr(skb)->saddr : ip_hdr(skb)->daddr;
439 }
440 
441 static inline void
442 ip4addrptr(const struct sk_buff *skb, bool src, __be32 *addr)
443 {
444         *addr = src ? ip_hdr(skb)->saddr : ip_hdr(skb)->daddr;
445 }
446 
447 static inline void
448 ip6addrptr(const struct sk_buff *skb, bool src, struct in6_addr *addr)
449 {
450         memcpy(addr, src ? &ipv6_hdr(skb)->saddr : &ipv6_hdr(skb)->daddr,
451                sizeof(*addr));
452 }
453 
454 /* Calculate the bytes required to store the inclusive range of a-b */
455 static inline int
456 bitmap_bytes(u32 a, u32 b)
457 {
458         return 4 * ((((b - a + 8) / 8) + 3) / 4);
459 }
460 
461 #include <linux/netfilter/ipset/ip_set_timeout.h>
462 #include <linux/netfilter/ipset/ip_set_comment.h>
463 #include <linux/netfilter/ipset/ip_set_counter.h>
464 #include <linux/netfilter/ipset/ip_set_skbinfo.h>
465 
466 #define IP_SET_INIT_KEXT(skb, opt, set)                 \
467         { .bytes = (skb)->len, .packets = 1,            \
468           .timeout = ip_set_adt_opt_timeout(opt, set) }
469 
470 #define IP_SET_INIT_UEXT(set)                           \
471         { .bytes = ULLONG_MAX, .packets = ULLONG_MAX,   \
472           .timeout = (set)->timeout }
473 
474 #define IPSET_CONCAT(a, b)              a##b
475 #define IPSET_TOKEN(a, b)               IPSET_CONCAT(a, b)
476 
477 #endif /*_IP_SET_H */
478 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp