2011-07-15 09:47:34 -06:00
|
|
|
#include <linux/export.h>
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
#include <linux/netfilter/ipset/pfxlen.h>
|
|
|
|
|
2015-06-13 11:45:33 -06:00
|
|
|
/* Prefixlen maps for fast conversions, by Jan Engelhardt. */
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
|
|
|
|
#define E(a, b, c, d) \
|
|
|
|
{.ip6 = { \
|
2014-03-12 11:04:19 -06:00
|
|
|
htonl(a), htonl(b), \
|
|
|
|
htonl(c), htonl(d), \
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
} }
|
|
|
|
|
2015-06-13 11:45:33 -06:00
|
|
|
/* This table works for both IPv4 and IPv6;
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
* just use prefixlen_netmask_map[prefixlength].ip.
|
|
|
|
*/
|
|
|
|
const union nf_inet_addr ip_set_netmask_map[] = {
|
|
|
|
E(0x00000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0x80000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xC0000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xE0000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xF0000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xF8000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFC000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFE000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFF000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFF800000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFC00000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFE00000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFF00000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFF80000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFC0000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFE0000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFF0000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFF8000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFC000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFE000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFF000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFF800, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFC00, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFE00, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFF00, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFF80, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFC0, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFE0, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFF0, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFF8, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFC, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFE, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0x80000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xC0000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xE0000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xF0000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xF8000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFC000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFE000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFF000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFF800000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFC00000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFE00000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFF00000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFF80000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFC0000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFE0000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFF0000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFF8000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFC000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFE000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFF000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFF800, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFC00, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFE00, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFF00, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFF80, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFC0, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFE0, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFF0, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFF8, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFC, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFE, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0x80000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xC0000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xE0000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xF0000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xF8000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFC000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFE000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFF000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFF800000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFC00000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFE00000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFF00000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFF80000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFC0000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFE0000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF0000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF8000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFC000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFE000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF800, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFC00, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFE00, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF00, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF80, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFC0, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFE0, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF0, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF8, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFC, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x80000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xC0000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xE0000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xF0000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xF8000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFC000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFE000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFF000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFF800000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFC00000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFE00000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFF00000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFF80000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFC0000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFE0000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF0000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF8000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFC000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFE000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF800),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFC00),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFE00),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF00),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF80),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFC0),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFE0),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF0),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF8),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFC),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF),
|
|
|
|
};
|
|
|
|
EXPORT_SYMBOL_GPL(ip_set_netmask_map);
|
|
|
|
|
|
|
|
#undef E
|
2015-06-13 11:45:33 -06:00
|
|
|
#define E(a, b, c, d) \
|
|
|
|
{.ip6 = { (__force __be32)a, (__force __be32)b, \
|
|
|
|
(__force __be32)c, (__force __be32)d, \
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
} }
|
|
|
|
|
2015-06-13 11:45:33 -06:00
|
|
|
/* This table works for both IPv4 and IPv6;
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
* just use prefixlen_hostmask_map[prefixlength].ip.
|
|
|
|
*/
|
|
|
|
const union nf_inet_addr ip_set_hostmask_map[] = {
|
|
|
|
E(0x00000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0x80000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xC0000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xE0000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xF0000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xF8000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFC000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFE000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFF000000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFF800000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFC00000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFE00000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFF00000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFF80000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFC0000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFE0000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFF0000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFF8000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFC000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFE000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFF000, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFF800, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFC00, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFE00, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFF00, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFF80, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFC0, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFE0, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFF0, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFF8, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFC, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFE, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0x00000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0x80000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xC0000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xE0000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xF0000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xF8000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFC000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFE000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFF000000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFF800000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFC00000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFE00000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFF00000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFF80000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFC0000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFE0000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFF0000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFF8000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFC000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFE000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFF000, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFF800, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFC00, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFE00, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFF00, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFF80, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFC0, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFE0, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFF0, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFF8, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFC, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFE, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0x00000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0x80000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xC0000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xE0000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xF0000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xF8000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFC000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFE000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFF000000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFF800000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFC00000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFE00000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFF00000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFF80000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFC0000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFE0000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF0000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF8000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFC000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFE000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF000, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF800, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFC00, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFE00, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF00, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF80, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFC0, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFE0, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF0, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF8, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFC, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x80000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xC0000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xE0000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xF0000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xF8000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFC000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFE000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFF000000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFF800000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFC00000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFE00000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFF00000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFF80000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFC0000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFE0000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF0000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFF8000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFC000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFE000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF000),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFF800),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFC00),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFE00),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF00),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFF80),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFC0),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFE0),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF0),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFF8),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFC),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE),
|
|
|
|
E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF),
|
|
|
|
};
|
|
|
|
EXPORT_SYMBOL_GPL(ip_set_hostmask_map);
|
2011-06-16 10:52:41 -06:00
|
|
|
|
|
|
|
/* Find the largest network which matches the range from left, in host order. */
|
|
|
|
u32
|
|
|
|
ip_set_range_to_cidr(u32 from, u32 to, u8 *cidr)
|
|
|
|
{
|
|
|
|
u32 last;
|
|
|
|
u8 i;
|
|
|
|
|
|
|
|
for (i = 1; i < 32; i++) {
|
|
|
|
if ((from & ip_set_hostmask(i)) != from)
|
|
|
|
continue;
|
|
|
|
last = from | ~ip_set_hostmask(i);
|
|
|
|
if (!after(last, to)) {
|
|
|
|
*cidr = i;
|
|
|
|
return last;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
*cidr = 32;
|
|
|
|
return from;
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL_GPL(ip_set_range_to_cidr);
|