netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
|
|
|
|
|
* Patrick Schaaf <bof@bof.de>
|
|
|
|
|
* Martin Josefsson <gandalf@wlug.westbo.se>
|
2019-06-10 05:00:24 -06:00
|
|
|
* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@netfilter.org>
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
*
|
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
|
|
|
* published by the Free Software Foundation.
|
|
|
|
|
*/
|
2012-10-09 02:48:55 -06:00
|
|
|
#ifndef _IP_SET_H
|
|
|
|
|
#define _IP_SET_H
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
|
2012-01-14 08:26:20 -07:00
|
|
|
#include <linux/ip.h>
|
|
|
|
|
#include <linux/ipv6.h>
|
|
|
|
|
#include <linux/netlink.h>
|
|
|
|
|
#include <linux/netfilter.h>
|
|
|
|
|
#include <linux/netfilter/x_tables.h>
|
2012-09-21 13:59:32 -06:00
|
|
|
#include <linux/stringify.h>
|
2012-01-14 08:26:20 -07:00
|
|
|
#include <linux/vmalloc.h>
|
|
|
|
|
#include <net/netlink.h>
|
2012-10-09 02:48:55 -06:00
|
|
|
#include <uapi/linux/netfilter/ipset/ip_set.h>
|
2012-01-14 08:26:20 -07:00
|
|
|
|
2012-09-21 13:59:32 -06:00
|
|
|
#define _IP_SET_MODULE_DESC(a, b, c) \
|
|
|
|
|
MODULE_DESCRIPTION(a " type of IP sets, revisions " b "-" c)
|
|
|
|
|
#define IP_SET_MODULE_DESC(a, b, c) \
|
|
|
|
|
_IP_SET_MODULE_DESC(a, __stringify(b), __stringify(c))
|
|
|
|
|
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
/* Set features */
|
|
|
|
|
enum ip_set_feature {
|
|
|
|
|
IPSET_TYPE_IP_FLAG = 0,
|
|
|
|
|
IPSET_TYPE_IP = (1 << IPSET_TYPE_IP_FLAG),
|
|
|
|
|
IPSET_TYPE_PORT_FLAG = 1,
|
|
|
|
|
IPSET_TYPE_PORT = (1 << IPSET_TYPE_PORT_FLAG),
|
|
|
|
|
IPSET_TYPE_MAC_FLAG = 2,
|
|
|
|
|
IPSET_TYPE_MAC = (1 << IPSET_TYPE_MAC_FLAG),
|
|
|
|
|
IPSET_TYPE_IP2_FLAG = 3,
|
|
|
|
|
IPSET_TYPE_IP2 = (1 << IPSET_TYPE_IP2_FLAG),
|
|
|
|
|
IPSET_TYPE_NAME_FLAG = 4,
|
|
|
|
|
IPSET_TYPE_NAME = (1 << IPSET_TYPE_NAME_FLAG),
|
2011-06-16 11:00:48 -06:00
|
|
|
IPSET_TYPE_IFACE_FLAG = 5,
|
|
|
|
|
IPSET_TYPE_IFACE = (1 << IPSET_TYPE_IFACE_FLAG),
|
2013-12-17 07:01:43 -07:00
|
|
|
IPSET_TYPE_MARK_FLAG = 6,
|
|
|
|
|
IPSET_TYPE_MARK = (1 << IPSET_TYPE_MARK_FLAG),
|
|
|
|
|
IPSET_TYPE_NOMATCH_FLAG = 7,
|
2012-09-21 14:02:36 -06:00
|
|
|
IPSET_TYPE_NOMATCH = (1 << IPSET_TYPE_NOMATCH_FLAG),
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
/* Strictly speaking not a feature, but a flag for dumping:
|
|
|
|
|
* this settype must be dumped last */
|
2013-12-17 07:01:43 -07:00
|
|
|
IPSET_DUMP_LAST_FLAG = 8,
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
IPSET_DUMP_LAST = (1 << IPSET_DUMP_LAST_FLAG),
|
|
|
|
|
};
|
|
|
|
|
|
2013-04-27 06:28:55 -06:00
|
|
|
/* Set extensions */
|
|
|
|
|
enum ip_set_extension {
|
2013-09-09 06:44:29 -06:00
|
|
|
IPSET_EXT_BIT_TIMEOUT = 0,
|
2013-04-27 06:28:55 -06:00
|
|
|
IPSET_EXT_TIMEOUT = (1 << IPSET_EXT_BIT_TIMEOUT),
|
2013-09-09 06:44:29 -06:00
|
|
|
IPSET_EXT_BIT_COUNTER = 1,
|
2013-04-27 06:38:56 -06:00
|
|
|
IPSET_EXT_COUNTER = (1 << IPSET_EXT_BIT_COUNTER),
|
2013-09-22 12:56:30 -06:00
|
|
|
IPSET_EXT_BIT_COMMENT = 2,
|
|
|
|
|
IPSET_EXT_COMMENT = (1 << IPSET_EXT_BIT_COMMENT),
|
2014-08-28 00:11:27 -06:00
|
|
|
IPSET_EXT_BIT_SKBINFO = 3,
|
|
|
|
|
IPSET_EXT_SKBINFO = (1 << IPSET_EXT_BIT_SKBINFO),
|
2013-09-09 06:44:29 -06:00
|
|
|
/* Mark set with an extension which needs to call destroy */
|
|
|
|
|
IPSET_EXT_BIT_DESTROY = 7,
|
|
|
|
|
IPSET_EXT_DESTROY = (1 << IPSET_EXT_BIT_DESTROY),
|
2013-04-27 06:28:55 -06:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
#define SET_WITH_TIMEOUT(s) ((s)->extensions & IPSET_EXT_TIMEOUT)
|
2013-04-27 06:38:56 -06:00
|
|
|
#define SET_WITH_COUNTER(s) ((s)->extensions & IPSET_EXT_COUNTER)
|
2013-09-22 12:56:30 -06:00
|
|
|
#define SET_WITH_COMMENT(s) ((s)->extensions & IPSET_EXT_COMMENT)
|
2014-08-28 00:11:27 -06:00
|
|
|
#define SET_WITH_SKBINFO(s) ((s)->extensions & IPSET_EXT_SKBINFO)
|
2014-02-28 20:14:57 -07:00
|
|
|
#define SET_WITH_FORCEADD(s) ((s)->flags & IPSET_CREATE_FLAG_FORCEADD)
|
2013-04-27 06:28:55 -06:00
|
|
|
|
2013-09-06 14:31:40 -06:00
|
|
|
/* Extension id, in size order */
|
|
|
|
|
enum ip_set_ext_id {
|
|
|
|
|
IPSET_EXT_ID_COUNTER = 0,
|
|
|
|
|
IPSET_EXT_ID_TIMEOUT,
|
2014-08-28 00:11:27 -06:00
|
|
|
IPSET_EXT_ID_SKBINFO,
|
2013-09-22 12:56:30 -06:00
|
|
|
IPSET_EXT_ID_COMMENT,
|
2013-09-06 14:31:40 -06:00
|
|
|
IPSET_EXT_ID_MAX,
|
|
|
|
|
};
|
|
|
|
|
|
2016-11-10 04:05:34 -07:00
|
|
|
struct ip_set;
|
|
|
|
|
|
2013-09-06 16:43:52 -06:00
|
|
|
/* Extension type */
|
|
|
|
|
struct ip_set_ext_type {
|
2013-09-09 06:44:29 -06:00
|
|
|
/* Destroy extension private data (can be NULL) */
|
2016-11-10 04:05:34 -07:00
|
|
|
void (*destroy)(struct ip_set *set, void *ext);
|
2013-09-06 16:43:52 -06:00
|
|
|
enum ip_set_extension type;
|
|
|
|
|
enum ipset_cadt_flags flag;
|
|
|
|
|
/* Size and minimal alignment */
|
|
|
|
|
u8 len;
|
|
|
|
|
u8 align;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
extern const struct ip_set_ext_type ip_set_extensions[];
|
|
|
|
|
|
2013-09-06 16:10:07 -06:00
|
|
|
struct ip_set_counter {
|
|
|
|
|
atomic64_t bytes;
|
|
|
|
|
atomic64_t packets;
|
|
|
|
|
};
|
|
|
|
|
|
2015-06-13 06:22:25 -06:00
|
|
|
struct ip_set_comment_rcu {
|
|
|
|
|
struct rcu_head rcu;
|
|
|
|
|
char str[0];
|
|
|
|
|
};
|
|
|
|
|
|
2013-09-22 12:56:30 -06:00
|
|
|
struct ip_set_comment {
|
2015-06-13 06:22:25 -06:00
|
|
|
struct ip_set_comment_rcu __rcu *c;
|
2013-09-22 12:56:30 -06:00
|
|
|
};
|
2013-09-09 06:44:29 -06:00
|
|
|
|
2014-08-28 00:11:27 -06:00
|
|
|
struct ip_set_skbinfo {
|
|
|
|
|
u32 skbmark;
|
|
|
|
|
u32 skbmarkmask;
|
|
|
|
|
u32 skbprio;
|
|
|
|
|
u16 skbqueue;
|
2015-05-05 09:13:28 -06:00
|
|
|
u16 __pad;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct ip_set_ext {
|
|
|
|
|
struct ip_set_skbinfo skbinfo;
|
|
|
|
|
u64 packets;
|
|
|
|
|
u64 bytes;
|
|
|
|
|
char *comment;
|
|
|
|
|
u32 timeout;
|
2018-01-06 07:22:01 -07:00
|
|
|
u8 packets_op;
|
|
|
|
|
u8 bytes_op;
|
2014-08-28 00:11:27 -06:00
|
|
|
};
|
|
|
|
|
|
2013-09-22 12:56:30 -06:00
|
|
|
struct ip_set;
|
2013-09-09 06:44:29 -06:00
|
|
|
|
2013-09-06 16:10:07 -06:00
|
|
|
#define ext_timeout(e, s) \
|
2015-05-02 11:28:17 -06:00
|
|
|
((unsigned long *)(((void *)(e)) + (s)->offset[IPSET_EXT_ID_TIMEOUT]))
|
2013-09-06 16:10:07 -06:00
|
|
|
#define ext_counter(e, s) \
|
2015-05-02 11:28:17 -06:00
|
|
|
((struct ip_set_counter *)(((void *)(e)) + (s)->offset[IPSET_EXT_ID_COUNTER]))
|
2013-09-22 12:56:30 -06:00
|
|
|
#define ext_comment(e, s) \
|
2015-05-02 11:28:17 -06:00
|
|
|
((struct ip_set_comment *)(((void *)(e)) + (s)->offset[IPSET_EXT_ID_COMMENT]))
|
2014-08-28 00:11:27 -06:00
|
|
|
#define ext_skbinfo(e, s) \
|
2015-05-02 11:28:17 -06:00
|
|
|
((struct ip_set_skbinfo *)(((void *)(e)) + (s)->offset[IPSET_EXT_ID_SKBINFO]))
|
2013-09-06 16:10:07 -06:00
|
|
|
|
2011-06-16 10:40:55 -06:00
|
|
|
typedef int (*ipset_adtfn)(struct ip_set *set, void *value,
|
2013-04-27 06:28:55 -06:00
|
|
|
const struct ip_set_ext *ext,
|
2013-04-27 06:40:50 -06:00
|
|
|
struct ip_set_ext *mext, u32 cmdflags);
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
|
2011-06-16 10:42:40 -06:00
|
|
|
/* Kernel API function options */
|
|
|
|
|
struct ip_set_adt_opt {
|
|
|
|
|
u8 family; /* Actual protocol family */
|
|
|
|
|
u8 dim; /* Dimension of match/target */
|
|
|
|
|
u8 flags; /* Direction and negation flags */
|
|
|
|
|
u32 cmdflags; /* Command-like flags */
|
2013-04-27 06:28:55 -06:00
|
|
|
struct ip_set_ext ext; /* Extensions */
|
2011-06-16 10:42:40 -06:00
|
|
|
};
|
|
|
|
|
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
/* Set type, variant-specific part */
|
|
|
|
|
struct ip_set_type_variant {
|
|
|
|
|
/* Kernelspace: test/add/del entries
|
|
|
|
|
* returns negative error code,
|
|
|
|
|
* zero for no match/success to add/delete
|
|
|
|
|
* positive for matching element */
|
2012-09-21 14:01:45 -06:00
|
|
|
int (*kadt)(struct ip_set *set, const struct sk_buff *skb,
|
2011-06-16 10:56:47 -06:00
|
|
|
const struct xt_action_param *par,
|
2013-04-27 06:28:55 -06:00
|
|
|
enum ipset_adt adt, struct ip_set_adt_opt *opt);
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
|
|
|
|
|
/* Userspace: test/add/del entries
|
|
|
|
|
* returns negative error code,
|
|
|
|
|
* zero for no match/success to add/delete
|
|
|
|
|
* positive for matching element */
|
|
|
|
|
int (*uadt)(struct ip_set *set, struct nlattr *tb[],
|
2011-06-16 10:49:17 -06:00
|
|
|
enum ipset_adt adt, u32 *lineno, u32 flags, bool retried);
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
|
|
|
|
|
/* Low level add/del/test functions */
|
|
|
|
|
ipset_adtfn adt[IPSET_ADT_MAX];
|
|
|
|
|
|
|
|
|
|
/* When adding entries and set is full, try to resize the set */
|
|
|
|
|
int (*resize)(struct ip_set *set, bool retried);
|
|
|
|
|
/* Destroy the set */
|
|
|
|
|
void (*destroy)(struct ip_set *set);
|
|
|
|
|
/* Flush the elements */
|
|
|
|
|
void (*flush)(struct ip_set *set);
|
|
|
|
|
/* Expire entries before listing */
|
|
|
|
|
void (*expire)(struct ip_set *set);
|
|
|
|
|
/* List set header data */
|
|
|
|
|
int (*head)(struct ip_set *set, struct sk_buff *skb);
|
|
|
|
|
/* List elements */
|
|
|
|
|
int (*list)(const struct ip_set *set, struct sk_buff *skb,
|
|
|
|
|
struct netlink_callback *cb);
|
2015-06-13 03:59:45 -06:00
|
|
|
/* Keep listing private when resizing runs parallel */
|
|
|
|
|
void (*uref)(struct ip_set *set, struct netlink_callback *cb,
|
|
|
|
|
bool start);
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
|
|
|
|
|
/* Return true if "b" set is the same as "a"
|
|
|
|
|
* according to the create set parameters */
|
|
|
|
|
bool (*same_set)(const struct ip_set *a, const struct ip_set *b);
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
/* The core set type structure */
|
|
|
|
|
struct ip_set_type {
|
|
|
|
|
struct list_head list;
|
|
|
|
|
|
|
|
|
|
/* Typename */
|
|
|
|
|
char name[IPSET_MAXNAMELEN];
|
|
|
|
|
/* Protocol version */
|
|
|
|
|
u8 protocol;
|
|
|
|
|
/* Set type dimension */
|
|
|
|
|
u8 dimension;
|
2012-02-13 16:24:10 -07:00
|
|
|
/*
|
|
|
|
|
* Supported family: may be NFPROTO_UNSPEC for both
|
|
|
|
|
* NFPROTO_IPV4/NFPROTO_IPV6.
|
|
|
|
|
*/
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
u8 family;
|
2011-06-16 10:51:41 -06:00
|
|
|
/* Type revisions */
|
|
|
|
|
u8 revision_min, revision_max;
|
2013-12-17 07:01:43 -07:00
|
|
|
/* Set features to control swapping */
|
|
|
|
|
u16 features;
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
|
|
|
|
|
/* Create set */
|
2013-09-30 09:07:02 -06:00
|
|
|
int (*create)(struct net *net, struct ip_set *set,
|
|
|
|
|
struct nlattr *tb[], u32 flags);
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
|
|
|
|
|
/* Attribute policies */
|
|
|
|
|
const struct nla_policy create_policy[IPSET_ATTR_CREATE_MAX + 1];
|
|
|
|
|
const struct nla_policy adt_policy[IPSET_ATTR_ADT_MAX + 1];
|
|
|
|
|
|
|
|
|
|
/* Set this to THIS_MODULE if you are a module, otherwise NULL */
|
|
|
|
|
struct module *me;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
/* register and unregister set type */
|
|
|
|
|
extern int ip_set_type_register(struct ip_set_type *set_type);
|
|
|
|
|
extern void ip_set_type_unregister(struct ip_set_type *set_type);
|
|
|
|
|
|
|
|
|
|
/* A generic IP set */
|
|
|
|
|
struct ip_set {
|
|
|
|
|
/* The name of the set */
|
|
|
|
|
char name[IPSET_MAXNAMELEN];
|
|
|
|
|
/* Lock protecting the set data */
|
2015-06-13 06:22:25 -06:00
|
|
|
spinlock_t lock;
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
/* References to the set */
|
2011-04-04 07:19:25 -06:00
|
|
|
u32 ref;
|
2016-03-16 14:49:00 -06:00
|
|
|
/* References to the set for netlink events like dump,
|
|
|
|
|
* ref can be swapped out by ip_set_swap
|
|
|
|
|
*/
|
|
|
|
|
u32 ref_netlink;
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
/* The core set type */
|
|
|
|
|
struct ip_set_type *type;
|
|
|
|
|
/* The type variant doing the real job */
|
|
|
|
|
const struct ip_set_type_variant *variant;
|
|
|
|
|
/* The actual INET family of the set */
|
|
|
|
|
u8 family;
|
2011-06-16 10:51:41 -06:00
|
|
|
/* The type revision */
|
|
|
|
|
u8 revision;
|
2013-04-27 06:28:55 -06:00
|
|
|
/* Extensions */
|
|
|
|
|
u8 extensions;
|
2014-02-13 04:19:56 -07:00
|
|
|
/* Create flags */
|
|
|
|
|
u8 flags;
|
2013-09-06 16:10:07 -06:00
|
|
|
/* Default timeout value, if enabled */
|
|
|
|
|
u32 timeout;
|
2016-10-10 14:07:41 -06:00
|
|
|
/* Number of elements (vs timeout) */
|
|
|
|
|
u32 elements;
|
2016-11-10 04:05:34 -07:00
|
|
|
/* Size of the dynamic extensions (vs timeout) */
|
|
|
|
|
size_t ext_size;
|
2013-09-06 16:10:07 -06:00
|
|
|
/* Element data size */
|
|
|
|
|
size_t dsize;
|
|
|
|
|
/* Offsets to extensions in elements */
|
|
|
|
|
size_t offset[IPSET_EXT_ID_MAX];
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
/* The type specific data */
|
|
|
|
|
void *data;
|
|
|
|
|
};
|
|
|
|
|
|
2013-09-22 12:56:30 -06:00
|
|
|
static inline void
|
|
|
|
|
ip_set_ext_destroy(struct ip_set *set, void *data)
|
|
|
|
|
{
|
|
|
|
|
/* Check that the extension is enabled for the set and
|
|
|
|
|
* call it's destroy function for its extension part in data.
|
|
|
|
|
*/
|
|
|
|
|
if (SET_WITH_COMMENT(set))
|
|
|
|
|
ip_set_extensions[IPSET_EXT_ID_COMMENT].destroy(
|
2016-11-10 04:05:34 -07:00
|
|
|
set, ext_comment(data, set));
|
2013-09-22 12:56:30 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static inline int
|
|
|
|
|
ip_set_put_flags(struct sk_buff *skb, struct ip_set *set)
|
|
|
|
|
{
|
|
|
|
|
u32 cadt_flags = 0;
|
|
|
|
|
|
|
|
|
|
if (SET_WITH_TIMEOUT(set))
|
|
|
|
|
if (unlikely(nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
|
|
|
|
|
htonl(set->timeout))))
|
|
|
|
|
return -EMSGSIZE;
|
|
|
|
|
if (SET_WITH_COUNTER(set))
|
|
|
|
|
cadt_flags |= IPSET_FLAG_WITH_COUNTERS;
|
|
|
|
|
if (SET_WITH_COMMENT(set))
|
|
|
|
|
cadt_flags |= IPSET_FLAG_WITH_COMMENT;
|
2014-08-28 00:11:27 -06:00
|
|
|
if (SET_WITH_SKBINFO(set))
|
|
|
|
|
cadt_flags |= IPSET_FLAG_WITH_SKBINFO;
|
2014-02-28 20:14:57 -07:00
|
|
|
if (SET_WITH_FORCEADD(set))
|
|
|
|
|
cadt_flags |= IPSET_FLAG_WITH_FORCEADD;
|
2013-09-22 12:56:30 -06:00
|
|
|
|
|
|
|
|
if (!cadt_flags)
|
|
|
|
|
return 0;
|
|
|
|
|
return nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(cadt_flags));
|
|
|
|
|
}
|
|
|
|
|
|
2013-10-18 03:41:55 -06:00
|
|
|
/* Netlink CB args */
|
|
|
|
|
enum {
|
2015-06-13 03:59:45 -06:00
|
|
|
IPSET_CB_NET = 0, /* net namespace */
|
2018-10-27 07:07:40 -06:00
|
|
|
IPSET_CB_PROTO, /* ipset protocol */
|
2015-06-13 03:59:45 -06:00
|
|
|
IPSET_CB_DUMP, /* dump single set/all sets */
|
|
|
|
|
IPSET_CB_INDEX, /* set index */
|
|
|
|
|
IPSET_CB_PRIVATE, /* set private data */
|
|
|
|
|
IPSET_CB_ARG0, /* type specific */
|
2013-10-18 03:41:55 -06:00
|
|
|
};
|
|
|
|
|
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
/* register and unregister set references */
|
2013-09-30 09:07:02 -06:00
|
|
|
extern ip_set_id_t ip_set_get_byname(struct net *net,
|
|
|
|
|
const char *name, struct ip_set **set);
|
|
|
|
|
extern void ip_set_put_byindex(struct net *net, ip_set_id_t index);
|
2018-07-14 13:59:43 -06:00
|
|
|
extern void ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name);
|
2013-09-30 09:07:02 -06:00
|
|
|
extern ip_set_id_t ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index);
|
|
|
|
|
extern void ip_set_nfnl_put(struct net *net, ip_set_id_t index);
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
|
|
|
|
|
/* API for iptables set match, and SET target */
|
2011-06-16 10:42:40 -06:00
|
|
|
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
extern int ip_set_add(ip_set_id_t id, const struct sk_buff *skb,
|
2011-06-16 10:56:47 -06:00
|
|
|
const struct xt_action_param *par,
|
2013-04-27 06:28:55 -06:00
|
|
|
struct ip_set_adt_opt *opt);
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
extern int ip_set_del(ip_set_id_t id, const struct sk_buff *skb,
|
2011-06-16 10:56:47 -06:00
|
|
|
const struct xt_action_param *par,
|
2013-04-27 06:28:55 -06:00
|
|
|
struct ip_set_adt_opt *opt);
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
extern int ip_set_test(ip_set_id_t id, const struct sk_buff *skb,
|
2011-06-16 10:56:47 -06:00
|
|
|
const struct xt_action_param *par,
|
2013-04-27 06:28:55 -06:00
|
|
|
struct ip_set_adt_opt *opt);
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
|
|
|
|
|
/* Utility functions */
|
2011-06-16 11:01:26 -06:00
|
|
|
extern void *ip_set_alloc(size_t size);
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
extern void ip_set_free(void *members);
|
|
|
|
|
extern int ip_set_get_ipaddr4(struct nlattr *nla, __be32 *ipaddr);
|
|
|
|
|
extern int ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr);
|
2013-09-06 16:43:52 -06:00
|
|
|
extern size_t ip_set_elem_len(struct ip_set *set, struct nlattr *tb[],
|
2015-11-07 03:21:47 -07:00
|
|
|
size_t len, size_t align);
|
2013-04-27 06:28:55 -06:00
|
|
|
extern int ip_set_get_extensions(struct ip_set *set, struct nlattr *tb[],
|
|
|
|
|
struct ip_set_ext *ext);
|
2016-10-10 13:52:51 -06:00
|
|
|
extern int ip_set_put_extensions(struct sk_buff *skb, const struct ip_set *set,
|
|
|
|
|
const void *e, bool active);
|
2018-01-06 07:22:01 -07:00
|
|
|
extern bool ip_set_match_extensions(struct ip_set *set,
|
|
|
|
|
const struct ip_set_ext *ext,
|
|
|
|
|
struct ip_set_ext *mext,
|
|
|
|
|
u32 flags, void *data);
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
|
|
|
|
|
static inline int
|
|
|
|
|
ip_set_get_hostipaddr4(struct nlattr *nla, u32 *ipaddr)
|
|
|
|
|
{
|
|
|
|
|
__be32 ip;
|
|
|
|
|
int ret = ip_set_get_ipaddr4(nla, &ip);
|
2011-06-16 11:01:26 -06:00
|
|
|
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
if (ret)
|
|
|
|
|
return ret;
|
|
|
|
|
*ipaddr = ntohl(ip);
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Ignore IPSET_ERR_EXIST errors if asked to do so? */
|
|
|
|
|
static inline bool
|
|
|
|
|
ip_set_eexist(int ret, u32 flags)
|
|
|
|
|
{
|
|
|
|
|
return ret == -IPSET_ERR_EXIST && (flags & IPSET_FLAG_EXIST);
|
|
|
|
|
}
|
|
|
|
|
|
2013-04-08 13:51:25 -06:00
|
|
|
/* Match elements marked with nomatch */
|
|
|
|
|
static inline bool
|
2013-09-16 12:04:53 -06:00
|
|
|
ip_set_enomatch(int ret, u32 flags, enum ipset_adt adt, struct ip_set *set)
|
2013-04-08 13:51:25 -06:00
|
|
|
{
|
|
|
|
|
return adt == IPSET_TEST &&
|
2013-09-16 12:04:53 -06:00
|
|
|
(set->type->features & IPSET_TYPE_NOMATCH) &&
|
|
|
|
|
((flags >> 16) & IPSET_FLAG_NOMATCH) &&
|
|
|
|
|
(ret > 0 || ret == -ENOTEMPTY);
|
2013-04-08 13:51:25 -06:00
|
|
|
}
|
|
|
|
|
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
/* Check the NLA_F_NET_BYTEORDER flag */
|
|
|
|
|
static inline bool
|
|
|
|
|
ip_set_attr_netorder(struct nlattr *tb[], int type)
|
|
|
|
|
{
|
|
|
|
|
return tb[type] && (tb[type]->nla_type & NLA_F_NET_BYTEORDER);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static inline bool
|
|
|
|
|
ip_set_optattr_netorder(struct nlattr *tb[], int type)
|
|
|
|
|
{
|
|
|
|
|
return !tb[type] || (tb[type]->nla_type & NLA_F_NET_BYTEORDER);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Useful converters */
|
|
|
|
|
static inline u32
|
|
|
|
|
ip_set_get_h32(const struct nlattr *attr)
|
|
|
|
|
{
|
|
|
|
|
return ntohl(nla_get_be32(attr));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static inline u16
|
|
|
|
|
ip_set_get_h16(const struct nlattr *attr)
|
|
|
|
|
{
|
|
|
|
|
return ntohs(nla_get_be16(attr));
|
|
|
|
|
}
|
|
|
|
|
|
2012-04-01 17:54:46 -06:00
|
|
|
static inline int nla_put_ipaddr4(struct sk_buff *skb, int type, __be32 ipaddr)
|
|
|
|
|
{
|
2019-04-26 03:13:09 -06:00
|
|
|
struct nlattr *__nested = nla_nest_start(skb, type);
|
2012-04-01 17:54:46 -06:00
|
|
|
int ret;
|
|
|
|
|
|
|
|
|
|
if (!__nested)
|
|
|
|
|
return -EMSGSIZE;
|
2015-03-29 08:59:25 -06:00
|
|
|
ret = nla_put_in_addr(skb, IPSET_ATTR_IPADDR_IPV4, ipaddr);
|
2012-04-01 17:54:46 -06:00
|
|
|
if (!ret)
|
2019-04-26 03:13:09 -06:00
|
|
|
nla_nest_end(skb, __nested);
|
2012-04-01 17:54:46 -06:00
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
2012-09-21 14:01:45 -06:00
|
|
|
static inline int nla_put_ipaddr6(struct sk_buff *skb, int type,
|
|
|
|
|
const struct in6_addr *ipaddrptr)
|
2012-04-01 17:54:46 -06:00
|
|
|
{
|
2019-04-26 03:13:09 -06:00
|
|
|
struct nlattr *__nested = nla_nest_start(skb, type);
|
2012-04-01 17:54:46 -06:00
|
|
|
int ret;
|
|
|
|
|
|
|
|
|
|
if (!__nested)
|
|
|
|
|
return -EMSGSIZE;
|
2015-03-29 08:59:25 -06:00
|
|
|
ret = nla_put_in6_addr(skb, IPSET_ATTR_IPADDR_IPV6, ipaddrptr);
|
2012-04-01 17:54:46 -06:00
|
|
|
if (!ret)
|
2019-04-26 03:13:09 -06:00
|
|
|
nla_nest_end(skb, __nested);
|
2012-04-01 17:54:46 -06:00
|
|
|
return ret;
|
|
|
|
|
}
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
|
|
|
|
|
/* Get address from skbuff */
|
|
|
|
|
static inline __be32
|
|
|
|
|
ip4addr(const struct sk_buff *skb, bool src)
|
|
|
|
|
{
|
|
|
|
|
return src ? ip_hdr(skb)->saddr : ip_hdr(skb)->daddr;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static inline void
|
|
|
|
|
ip4addrptr(const struct sk_buff *skb, bool src, __be32 *addr)
|
|
|
|
|
{
|
|
|
|
|
*addr = src ? ip_hdr(skb)->saddr : ip_hdr(skb)->daddr;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static inline void
|
|
|
|
|
ip6addrptr(const struct sk_buff *skb, bool src, struct in6_addr *addr)
|
|
|
|
|
{
|
|
|
|
|
memcpy(addr, src ? &ipv6_hdr(skb)->saddr : &ipv6_hdr(skb)->daddr,
|
|
|
|
|
sizeof(*addr));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Calculate the bytes required to store the inclusive range of a-b */
|
|
|
|
|
static inline int
|
|
|
|
|
bitmap_bytes(u32 a, u32 b)
|
|
|
|
|
{
|
|
|
|
|
return 4 * ((((b - a + 8) / 8) + 3) / 4);
|
|
|
|
|
}
|
|
|
|
|
|
2013-04-27 06:28:55 -06:00
|
|
|
#include <linux/netfilter/ipset/ip_set_timeout.h>
|
2013-09-22 12:56:30 -06:00
|
|
|
#include <linux/netfilter/ipset/ip_set_comment.h>
|
2016-10-10 13:34:56 -06:00
|
|
|
#include <linux/netfilter/ipset/ip_set_counter.h>
|
|
|
|
|
#include <linux/netfilter/ipset/ip_set_skbinfo.h>
|
2013-04-27 06:28:55 -06:00
|
|
|
|
2013-09-06 16:10:07 -06:00
|
|
|
#define IP_SET_INIT_KEXT(skb, opt, set) \
|
2013-04-27 06:38:56 -06:00
|
|
|
{ .bytes = (skb)->len, .packets = 1, \
|
2013-09-06 16:10:07 -06:00
|
|
|
.timeout = ip_set_adt_opt_timeout(opt, set) }
|
2013-04-27 06:28:55 -06:00
|
|
|
|
2013-09-06 16:10:07 -06:00
|
|
|
#define IP_SET_INIT_UEXT(set) \
|
2013-04-27 06:38:56 -06:00
|
|
|
{ .bytes = ULLONG_MAX, .packets = ULLONG_MAX, \
|
2013-09-06 16:10:07 -06:00
|
|
|
.timeout = (set)->timeout }
|
2013-04-27 06:28:55 -06:00
|
|
|
|
2013-04-30 15:02:43 -06:00
|
|
|
#define IPSET_CONCAT(a, b) a##b
|
|
|
|
|
#define IPSET_TOKEN(a, b) IPSET_CONCAT(a, b)
|
|
|
|
|
|
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel.
The IP set core implements a netlink (nfnetlink) based protocol by which
one can create, destroy, flush, rename, swap, list, save, restore sets,
and add, delete, test elements from userspace. For simplicity (and backward
compatibilty and for not to force ip(6)tables to be linked with a netlink
library) reasons a small getsockopt-based protocol is also kept in order
to communicate with the ip(6)tables match and target.
The netlink protocol passes all u16, etc values in network order with
NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the
NLA_F_NESTED and NLA_F_NET_BYTEORDER flags.
For other kernel subsystems (netfilter match and target) the API contains
the functions to add, delete and test elements in sets and the required calls
to get/put refereces to the sets before those operations can be performed.
The set types (which are implemented in independent modules) are stored
in a simple RCU protected list. A set type may have variants: for example
without timeout or with timeout support, for IPv4 or for IPv6. The sets
(i.e. the pointers to the sets) are stored in an array. The sets are
identified by their index in the array, which makes possible easy and
fast swapping of sets. The array is protected indirectly by the nfnl
mutex from nfnetlink. The content of the sets are protected by the rwlock
of the set.
There are functional differences between the add/del/test functions
for the kernel and userspace:
- kernel add/del/test: works on the current packet (i.e. one element)
- kernel test: may trigger an "add" operation in order to fill
out unspecified parts of the element from the packet (like MAC address)
- userspace add/del: works on the netlink message and thus possibly
on multiple elements from the IPSET_ATTR_ADT container attribute.
- userspace add: may trigger resizing of a set
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2011-02-01 07:28:35 -07:00
|
|
|
#endif /*_IP_SET_H */
|