diff options
author | Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> | 2010-04-22 17:09:18 +0200 |
---|---|---|
committer | Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> | 2010-04-22 17:09:18 +0200 |
commit | 456b1d993711eb4297012ad4a881c459c0511358 (patch) | |
tree | 518bb02b7cf25ed6f338e96969efe96b642f8bf2 /kernel/ip_set_bitmap_ip.c | |
parent | ac0e5da3166da201ea00fd7f3cd927b0a49d8fef (diff) |
Eight stage to ipset-5
Commit changed files in kernel/...
Diffstat (limited to 'kernel/ip_set_bitmap_ip.c')
-rw-r--r-- | kernel/ip_set_bitmap_ip.c | 732 |
1 files changed, 644 insertions, 88 deletions
diff --git a/kernel/ip_set_bitmap_ip.c b/kernel/ip_set_bitmap_ip.c index be3c538..ccb5473 100644 --- a/kernel/ip_set_bitmap_ip.c +++ b/kernel/ip_set_bitmap_ip.c @@ -1,13 +1,13 @@ /* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu> * Patrick Schaaf <bof@bof.de> - * Copyright (C) 2003-2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> + * Copyright (C) 2003-2010 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. */ -/* Kernel module implementing an IP set type: the single bitmap type */ +/* Kernel module implementing an IP set type: the bitmap:ip type */ #include <linux/module.h> #include <linux/ip.h> @@ -16,143 +16,699 @@ #include <asm/uaccess.h> #include <asm/bitops.h> #include <linux/spinlock.h> +#include <linux/netlink.h> +#include <linux/delay.h> +#include <linux/jiffies.h> +#include <linux/timer.h> +#include <net/netlink.h> +#include <net/pfxlen.h> +#include <net/tcp.h> -#include <linux/netfilter_ipv4/ip_set_ipmap.h> +#include <linux/netfilter/ip_set.h> +#include <linux/netfilter/ip_set_bitmap.h> +#define IP_SET_BITMAP_TIMEOUT +#include <linux/netfilter/ip_set_timeout.h> -static inline ip_set_ip_t -ip_to_id(const struct ip_set_ipmap *map, ip_set_ip_t ip) +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>"); +MODULE_DESCRIPTION("bitmap:ip type of IP sets"); +MODULE_ALIAS("ip_set_bitmap:ip"); + +/* Base variant */ + +struct bitmap_ip { + void *members; /* the set members */ + uint32_t first_ip; /* host byte order, included in range */ + uint32_t last_ip; /* host byte order, included in range */ + uint32_t elements; /* number of max elements in the set */ + uint32_t hosts; /* number of hosts in a subnet */ + size_t memsize; /* members size */ + uint8_t netmask; /* subnet netmask */ +}; + +static inline uint32_t +ip_to_id(const struct bitmap_ip *map, uint32_t ip) { - return ((ip & map->netmask) - map->first_ip)/map->hosts; + return ((ip & HOSTMASK(map->netmask)) - map->first_ip)/map->hosts; } static inline int -ipmap_test(const struct ip_set *set, ip_set_ip_t ip) +bitmap_ip_test(const struct bitmap_ip *map, uint32_t id) { - const struct ip_set_ipmap *map = set->data; - - if (ip < map->first_ip || ip > map->last_ip) - return -ERANGE; - - DP("set: %s, ip:%u.%u.%u.%u", set->name, HIPQUAD(ip)); - return !!test_bit(ip_to_id(map, ip), map->members); + return !!test_bit(id, map->members); } -#define KADT_CONDITION +static inline int +bitmap_ip_add(struct bitmap_ip *map, uint32_t id) +{ + if (test_and_set_bit(id, map->members)) + return -IPSET_ERR_EXIST; -UADT(ipmap, test) -KADT(ipmap, test, ipaddr) + return 0; +} static inline int -ipmap_add(struct ip_set *set, ip_set_ip_t ip) +bitmap_ip_del(struct bitmap_ip *map, uint32_t id) +{ + if (!test_and_clear_bit(id, map->members)) + return -IPSET_ERR_EXIST; + + return 0; +} + +static int +bitmap_ip_kadt(struct ip_set *set, const struct sk_buff *skb, + enum ipset_adt adt, uint8_t pf, const uint8_t *flags) { - struct ip_set_ipmap *map = set->data; + struct bitmap_ip *map = set->data; + uint32_t ip = ntohl(ip4addr(skb, flags)); + + if (pf != AF_INET) + return -EINVAL; if (ip < map->first_ip || ip > map->last_ip) - return -ERANGE; + return -IPSET_ERR_BITMAP_RANGE; - DP("set: %s, ip:%u.%u.%u.%u", set->name, HIPQUAD(ip)); - if (test_and_set_bit(ip_to_id(map, ip), map->members)) - return -EEXIST; + ip = ip_to_id(map, ip); - return 0; + switch (adt) { + case IPSET_TEST: + return bitmap_ip_test(map, ip); + case IPSET_ADD: + return bitmap_ip_add(map, ip); + case IPSET_DEL: + return bitmap_ip_del(map, ip); + default: + return -EINVAL; + } } -UADT(ipmap, add) -KADT(ipmap, add, ipaddr) +static const struct nla_policy +bitmap_ip_adt_policy[IPSET_ATTR_ADT_MAX+1] __read_mostly = { + [IPSET_ATTR_IP] = { .type = NLA_U32 }, + [IPSET_ATTR_IP_TO] = { .type = NLA_U32 }, + [IPSET_ATTR_CIDR] = { .type = NLA_U8 }, + [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, +}; -static inline int -ipmap_del(struct ip_set *set, ip_set_ip_t ip) +static int +bitmap_ip_uadt(struct ip_set *set, struct nlattr *head, int len, + enum ipset_adt adt, uint32_t *lineno, uint32_t flags) { - struct ip_set_ipmap *map = set->data; + struct bitmap_ip *map = set->data; + struct nlattr *tb[IPSET_ATTR_ADT_MAX]; + bool eexist = flags & IPSET_FLAG_EXIST; + uint32_t ip, ip_to, id; + int ret = 0; + + if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len, + bitmap_ip_adt_policy)) + return -IPSET_ERR_PROTOCOL; + + if (tb[IPSET_ATTR_IP]) + ip = ip_set_get_h32(tb[IPSET_ATTR_IP]); + else + return -IPSET_ERR_PROTOCOL; if (ip < map->first_ip || ip > map->last_ip) - return -ERANGE; + return -IPSET_ERR_BITMAP_RANGE; + + if (tb[IPSET_ATTR_TIMEOUT]) + return -IPSET_ERR_TIMEOUT; + + if (adt == IPSET_TEST) + return bitmap_ip_test(map, ip_to_id(map, ip)); + + if (tb[IPSET_ATTR_IP_TO]) { + ip_to = ip_set_get_h32(tb[IPSET_ATTR_IP_TO]); + if (ip > ip_to) { + swap(ip, ip_to); + if (ip < map->first_ip) + return -IPSET_ERR_BITMAP_RANGE; + } + } else if (tb[IPSET_ATTR_CIDR]) { + uint8_t cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]); + + if (cidr > 32) + return -IPSET_ERR_INVALID_CIDR; + ip_to = ip | ~HOSTMASK(cidr); + } else + ip_to = ip; + + if (ip_to > map->last_ip) + return -IPSET_ERR_BITMAP_RANGE; + + for (; !before(ip_to, ip); ip += map->hosts) { + id = ip_to_id(map, ip); + ret = adt == IPSET_ADD ? bitmap_ip_add(map, id) + : bitmap_ip_del(map, id); + + if (ret && !(ret == -IPSET_ERR_EXIST && eexist)) { + if (tb[IPSET_ATTR_LINENO]) + *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); + return ret; + } + }; + return ret; +} + +static void +bitmap_ip_destroy(struct ip_set *set) +{ + struct bitmap_ip *map = set->data; + + ip_set_free(map->members, set->flags); + kfree(map); + + set->data = NULL; +} - DP("set: %s, ip:%u.%u.%u.%u", set->name, HIPQUAD(ip)); - if (!test_and_clear_bit(ip_to_id(map, ip), map->members)) - return -EEXIST; +static void +bitmap_ip_flush(struct ip_set *set) +{ + struct bitmap_ip *map = set->data; + + memset(map->members, 0, map->memsize); +} + +static int +bitmap_ip_head(struct ip_set *set, struct sk_buff *skb) +{ + const struct bitmap_ip *map = set->data; + struct nlattr *nested; + uint32_t id, elements; + + for (id = 0, elements = 0; id < map->elements; id++) + if (bitmap_ip_test(map, id)) + elements++; + + nested = ipset_nest_start(skb, IPSET_ATTR_DATA); + if (!nested) + goto nla_put_failure; + NLA_PUT_NET32(skb, IPSET_ATTR_IP, htonl(map->first_ip)); + NLA_PUT_NET32(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip)); + if (map->netmask != 32) + NLA_PUT_U8(skb, IPSET_ATTR_NETMASK, map->netmask); + NLA_PUT_NET32(skb, IPSET_ATTR_ELEMENTS, htonl(elements)); + NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, + htonl(atomic_read(&set->ref) - 1)); + NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE, htonl(map->memsize)); + ipset_nest_end(skb, nested); return 0; +nla_put_failure: + return -EFAULT; } -UADT(ipmap, del) -KADT(ipmap, del, ipaddr) +static int +bitmap_ip_list(struct ip_set *set, + struct sk_buff *skb, struct netlink_callback *cb) +{ + const struct bitmap_ip *map = set->data; + struct nlattr *atd, *nested; + uint32_t id, first = cb->args[2]; -static inline int -__ipmap_create(const struct ip_set_req_ipmap_create *req, - struct ip_set_ipmap *map) + atd = ipset_nest_start(skb, IPSET_ATTR_ADT); + if (!atd) + return -EFAULT; + for (; cb->args[2] < map->elements; cb->args[2]++) { + id = cb->args[2]; + if (!bitmap_ip_test(map, id)) + continue; + nested = ipset_nest_start(skb, IPSET_ATTR_DATA); + if (!nested) { + if (id == first) { + nla_nest_cancel(skb, atd); + return -EFAULT; + } else + goto nla_put_failure; + } + NLA_PUT_NET32(skb, IPSET_ATTR_IP, + htonl(map->first_ip + id * map->hosts)); + if (map->netmask != 32) + NLA_PUT_U8(skb, IPSET_ATTR_CIDR, map->netmask); + ipset_nest_end(skb, nested); + } + ipset_nest_end(skb, atd); + /* Set listing finished */ + cb->args[2] = 0; + return 0; + +nla_put_failure: + nla_nest_cancel(skb, nested); + ipset_nest_end(skb, atd); + return 0; +} + +static const struct ip_set_type_variant bitmap_ip __read_mostly = { + .kadt = bitmap_ip_kadt, + .uadt = bitmap_ip_uadt, + .destroy = bitmap_ip_destroy, + .flush = bitmap_ip_flush, + .head = bitmap_ip_head, + .list = bitmap_ip_list, +}; + +/* Timeout variant */ + +struct bitmap_ip_timeout { + void *members; /* the set members */ + uint32_t first_ip; /* host byte order, included in range */ + uint32_t last_ip; /* host byte order, included in range */ + uint32_t elements; /* number of max elements in the set */ + uint32_t hosts; /* number of hosts in a subnet */ + size_t memsize; /* members size */ + uint8_t netmask; /* subnet netmask */ + + uint32_t timeout; /* timeout parameter */ + struct timer_list gc; /* garbage collection */ +}; + +static inline bool +bitmap_ip_timeout_test(const struct bitmap_ip_timeout *map, uint32_t id) { - map->netmask = req->netmask; + unsigned long *table = map->members; - if (req->netmask == 0xFFFFFFFF) { - map->hosts = 1; - map->sizeid = map->last_ip - map->first_ip + 1; - } else { - unsigned int mask_bits, netmask_bits; - ip_set_ip_t mask; + return ip_set_timeout_test(table[id]); +} + +static int +bitmap_ip_timeout_add(struct bitmap_ip_timeout *map, + uint32_t id, uint32_t timeout) +{ + unsigned long *table = map->members; + + if (bitmap_ip_timeout_test(map, id)) + return -IPSET_ERR_EXIST; + + table[id] = ip_set_timeout_set(timeout); + + return 0; +} + +static int +bitmap_ip_timeout_del(struct bitmap_ip_timeout *map, uint32_t id) +{ + unsigned long *table = map->members; + int ret = -IPSET_ERR_EXIST; + + if (bitmap_ip_timeout_test(map, id)) + ret = 0; + + table[id] = IPSET_ELEM_UNSET; + return ret; +} + +static int +bitmap_ip_timeout_kadt(struct ip_set *set, const struct sk_buff *skb, + enum ipset_adt adt, uint8_t pf, const uint8_t *flags) +{ + struct bitmap_ip_timeout *map = set->data; + uint32_t ip = ntohl(ip4addr(skb, flags)); + + if (pf != AF_INET) + return -EINVAL; + + if (ip < map->first_ip || ip > map->last_ip) + return -IPSET_ERR_BITMAP_RANGE; + + ip = ip_to_id((const struct bitmap_ip *)map, ip); + + switch (adt) { + case IPSET_TEST: + return bitmap_ip_timeout_test(map, ip); + case IPSET_ADD: + return bitmap_ip_timeout_add(map, ip, map->timeout); + case IPSET_DEL: + return bitmap_ip_timeout_del(map, ip); + default: + return -EINVAL; + } +} + +static int +bitmap_ip_timeout_uadt(struct ip_set *set, struct nlattr *head, int len, + enum ipset_adt adt, uint32_t *lineno, uint32_t flags) +{ + struct bitmap_ip_timeout *map = set->data; + struct nlattr *tb[IPSET_ATTR_ADT_MAX]; + bool eexist = flags & IPSET_FLAG_EXIST; + uint32_t ip, ip_to, id, timeout = map->timeout; + int ret = 0; - map->first_ip &= map->netmask; /* Should we better bark? */ + if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len, + bitmap_ip_adt_policy)) + return -IPSET_ERR_PROTOCOL; - mask = range_to_mask(map->first_ip, map->last_ip, &mask_bits); - netmask_bits = mask_to_bits(map->netmask); + if (tb[IPSET_ATTR_IP]) + ip = ip_set_get_h32(tb[IPSET_ATTR_IP]); + else + return -IPSET_ERR_PROTOCOL; - if ((!mask && (map->first_ip || map->last_ip != 0xFFFFFFFF)) - || netmask_bits <= mask_bits) - return -ENOEXEC; + if (ip < map->first_ip || ip > map->last_ip) + return -IPSET_ERR_BITMAP_RANGE; + + if (adt == IPSET_TEST) + return bitmap_ip_timeout_test(map, + ip_to_id((const struct bitmap_ip *)map, ip)); - DP("mask_bits %u, netmask_bits %u", - mask_bits, netmask_bits); - map->hosts = 2 << (32 - netmask_bits - 1); - map->sizeid = 2 << (netmask_bits - mask_bits - 1); + if (tb[IPSET_ATTR_IP_TO]) { + ip_to = ip_set_get_h32(tb[IPSET_ATTR_IP_TO]); + if (ip > ip_to) { + swap(ip, ip_to); + if (ip < map->first_ip) + return -IPSET_ERR_BITMAP_RANGE; + } + } else if (tb[IPSET_ATTR_CIDR]) { + uint8_t cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]); + + if (cidr > 32) + return -IPSET_ERR_INVALID_CIDR; + ip_to = ip | ~HOSTMASK(cidr); + } else + ip_to = ip; + + if (ip_to > map->last_ip) + return -IPSET_ERR_BITMAP_RANGE; + + if (tb[IPSET_ATTR_TIMEOUT]) { + timeout = ip_set_get_h32(tb[IPSET_ATTR_TIMEOUT]); } - if (map->sizeid > MAX_RANGE + 1) { - ip_set_printk("range too big, %d elements (max %d)", - map->sizeid, MAX_RANGE+1); - return -ENOEXEC; + + for (; !before(ip_to, ip); ip += map->hosts) { + id = ip_to_id((const struct bitmap_ip *)map, ip); + ret = adt == IPSET_ADD + ? bitmap_ip_timeout_add(map, id, timeout) + : bitmap_ip_timeout_del(map, id); + + if (ret && !(ret == -IPSET_ERR_EXIST && eexist)) { + if (tb[IPSET_ATTR_LINENO]) + *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); + return ret; + } } - DP("hosts %u, sizeid %u", map->hosts, map->sizeid); - return bitmap_bytes(0, map->sizeid - 1); + return ret; } -BITMAP_CREATE(ipmap) -BITMAP_DESTROY(ipmap) -BITMAP_FLUSH(ipmap) +static void +bitmap_ip_timeout_destroy(struct ip_set *set) +{ + struct bitmap_ip_timeout *map = set->data; -static inline void -__ipmap_list_header(const struct ip_set_ipmap *map, - struct ip_set_req_ipmap_create *header) + /* gc might be running: del_timer_sync can't be used */ + while (!del_timer(&map->gc)) + msleep(IPSET_DESTROY_TIMER_SLEEP); + + ip_set_free(map->members, set->flags); + kfree(map); + + set->data = NULL; +} + +static void +bitmap_ip_timeout_flush(struct ip_set *set) { - header->netmask = map->netmask; + struct bitmap_ip_timeout *map = set->data; + + memset(map->members, 0, map->memsize); } -BITMAP_LIST_HEADER(ipmap) -BITMAP_LIST_MEMBERS_SIZE(ipmap, ip_set_ip_t, map->sizeid, - test_bit(i, map->members)) +static int +bitmap_ip_timeout_head(struct ip_set *set, struct sk_buff *skb) +{ + const struct bitmap_ip_timeout *map = set->data; + struct nlattr *nested; + uint32_t id, elements; + + for (id = 0, elements = 0; id < map->elements; id++) + if (bitmap_ip_timeout_test(map, id)) + elements++; + + nested = ipset_nest_start(skb, IPSET_ATTR_DATA); + if (!nested) + goto nla_put_failure; + NLA_PUT_NET32(skb, IPSET_ATTR_IP, htonl(map->first_ip)); + NLA_PUT_NET32(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip)); + if (map->netmask != 32) + NLA_PUT_U8(skb, IPSET_ATTR_NETMASK, map->netmask); + NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT , htonl(map->timeout)); + NLA_PUT_NET32(skb, IPSET_ATTR_ELEMENTS, htonl(elements)); + NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, + htonl(atomic_read(&set->ref) - 1)); + NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE, htonl(map->memsize)); + ipset_nest_end(skb, nested); + + return 0; +nla_put_failure: + return -EFAULT; +} + +static int +bitmap_ip_timeout_list(struct ip_set *set, + struct sk_buff *skb, struct netlink_callback *cb) +{ + const struct bitmap_ip_timeout *map = set->data; + struct nlattr *adt, *nested; + uint32_t id, first = cb->args[2]; + unsigned long *table = map->members; + + adt = ipset_nest_start(skb, IPSET_ATTR_ADT); + if (!adt) + return -EFAULT; + for (; cb->args[2] < map->elements; cb->args[2]++) { + id = cb->args[2]; + if (!bitmap_ip_timeout_test(map, id)) + continue; + nested = ipset_nest_start(skb, IPSET_ATTR_DATA); + if (!nested) { + if (id == first) { + nla_nest_cancel(skb, adt); + return -EFAULT; + } else + goto nla_put_failure; + } + NLA_PUT_NET32(skb, IPSET_ATTR_IP, + htonl(map->first_ip + id * map->hosts)); + if (map->netmask != 32) + NLA_PUT_U8(skb, IPSET_ATTR_CIDR, map->netmask); + NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, + htonl(ip_set_timeout_get(table[id]))); + ipset_nest_end(skb, nested); + } + ipset_nest_end(skb, adt); + + /* Set listing finished */ + cb->args[2] = 0; + + return 0; + +nla_put_failure: + nla_nest_cancel(skb, nested); + ipset_nest_end(skb, adt); + return 0; +} + +static const struct ip_set_type_variant bitmap_ip_timeout __read_mostly = { + .kadt = bitmap_ip_timeout_kadt, + .uadt = bitmap_ip_timeout_uadt, + .destroy = bitmap_ip_timeout_destroy, + .flush = bitmap_ip_timeout_flush, + .head = bitmap_ip_timeout_head, + .list = bitmap_ip_timeout_list, +}; static void -ipmap_list_members(const struct ip_set *set, void *data, char dont_align) +bitmap_ip_timeout_gc(unsigned long ul_set) { - const struct ip_set_ipmap *map = set->data; - uint32_t i, n = 0; - ip_set_ip_t *d; + struct ip_set *set = (struct ip_set *) ul_set; + struct bitmap_ip_timeout *map = set->data; + unsigned long *table = map->members; + uint32_t id; + + /* We run parallel with other readers (test element) + * but adding/deleting new entries is locked out */ + read_lock_bh(&set->lock); + for (id = 0; id < map->elements; id++) + if (ip_set_timeout_expired(table[id])) + table[id] = IPSET_ELEM_UNSET; + read_unlock_bh(&set->lock); + + map->gc.expires = jiffies + IPSET_GC_PERIOD(map->timeout) * HZ; + add_timer(&map->gc); +} + +static inline void +bitmap_ip_gc_init(struct ip_set *set) +{ + struct bitmap_ip_timeout *map = set->data; + + init_timer(&map->gc); + map->gc.data = (unsigned long) set; + map->gc.function = bitmap_ip_timeout_gc; + map->gc.expires = jiffies + IPSET_GC_PERIOD(map->timeout) * HZ; + add_timer(&map->gc); +} + +/* Create bitmap:ip type of sets */ + +static const struct nla_policy +bitmap_ip_create_policy[IPSET_ATTR_CREATE_MAX+1] __read_mostly = { + [IPSET_ATTR_IP] = { .type = NLA_U32 }, + [IPSET_ATTR_IP_TO] = { .type = NLA_U32 }, + [IPSET_ATTR_CIDR] = { .type = NLA_U8 }, + [IPSET_ATTR_NETMASK] = { .type = NLA_U8 }, + [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, +}; + +static bool +init_map_ip(struct ip_set *set, struct bitmap_ip *map, + uint32_t first_ip, uint32_t last_ip, + uint32_t elements, uint32_t hosts, uint8_t netmask) +{ + map->members = ip_set_alloc(map->memsize, GFP_KERNEL, &set->flags); + if (!map->members) + return false; + map->first_ip = first_ip; + map->last_ip = last_ip; + map->elements = elements; + map->hosts = hosts; + map->netmask = netmask; + + set->data = map; + set->family = AF_INET; - if (dont_align) { - memcpy(data, map->members, map->size); - return; + return true; +} + +static int +bitmap_ip_create(struct ip_set *set, struct nlattr *head, int len, + uint32_t flags) +{ + struct nlattr *tb[IPSET_ATTR_CREATE_MAX]; + uint32_t first_ip, last_ip, hosts, elements; + uint8_t netmask = 32; + + if (nla_parse(tb, IPSET_ATTR_CREATE_MAX, head, len, + bitmap_ip_create_policy)) + return -IPSET_ERR_PROTOCOL; + + if (tb[IPSET_ATTR_IP]) + first_ip = ip_set_get_h32(tb[IPSET_ATTR_IP]); + else + return -IPSET_ERR_PROTOCOL; + + if (tb[IPSET_ATTR_IP_TO]) { + last_ip = ip_set_get_h32(tb[IPSET_ATTR_IP_TO]); + if (first_ip > last_ip) { + uint32_t tmp = first_ip; + + first_ip = last_ip; + last_ip = tmp; + } + } else if (tb[IPSET_ATTR_CIDR]) { + uint8_t cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]); + + if (cidr >= 32) + return -IPSET_ERR_INVALID_CIDR; + last_ip = first_ip | ~HOSTMASK(cidr); + } else + return -IPSET_ERR_PROTOCOL; + + if (tb[IPSET_ATTR_NETMASK]) { + netmask = nla_get_u8(tb[IPSET_ATTR_NETMASK]); + + if (netmask > 32) + return -IPSET_ERR_INVALID_NETMASK; + + first_ip &= HOSTMASK(netmask); + last_ip |= ~HOSTMASK(netmask); } - for (i = 0; i < map->sizeid; i++) - if (test_bit(i, map->members)) { - d = data + n * IPSET_ALIGN(sizeof(ip_set_ip_t)); - *d = map->first_ip + i * map->hosts; - n++; + if (netmask == 32) { + hosts = 1; + elements = last_ip - first_ip + 1; + } else { + uint8_t mask_bits; + uint32_t mask; + + mask = range_to_mask(first_ip, last_ip, &mask_bits); + + if ((!mask && (first_ip || last_ip != 0xFFFFFFFF)) + || netmask <= mask_bits) + return -IPSET_ERR_BITMAP_RANGE; + + D("mask_bits %u, netmask %u", mask_bits, netmask); + hosts = 2 << (32 - netmask - 1); + elements = 2 << (netmask - mask_bits - 1); + } + if (elements > IPSET_BITMAP_MAX_RANGE + 1) { + return -IPSET_ERR_BITMAP_RANGE_SIZE; + } + D("hosts %u, elements %u", hosts, elements); + + if (tb[IPSET_ATTR_TIMEOUT]) { + struct bitmap_ip_timeout *map; + + map = kzalloc(sizeof(*map), GFP_KERNEL); + if (!map) + return -ENOMEM; + + map->memsize = elements * sizeof(unsigned long); + + if (!init_map_ip(set, (struct bitmap_ip *)map, + first_ip, last_ip, + elements, hosts, netmask)) { + kfree(map); + return -ENOMEM; + } + + map->timeout = ip_set_get_h32(tb[IPSET_ATTR_TIMEOUT]); + set->flags |= IP_SET_FLAG_TIMEOUT; + set->variant = &bitmap_ip_timeout; + + bitmap_ip_gc_init(set); + } else { + struct bitmap_ip *map; + + map = kzalloc(sizeof(*map), GFP_KERNEL); + if (!map) + return -ENOMEM; + + map->memsize = bitmap_bytes(0, elements - 1); + + if (!init_map_ip(set, map, + first_ip, last_ip, + elements, hosts, netmask)) { + kfree(map); + return -ENOMEM; } + + set->variant = &bitmap_ip; + } + return 0; } -IP_SET_TYPE(ipmap, IPSET_TYPE_IP | IPSET_DATA_SINGLE) +static struct ip_set_type bitmap_ip_type = { + .name = "bitmap:ip", + .protocol = IPSET_PROTOCOL, + .features = IPSET_TYPE_IP, + .family = AF_INET, + .revision = 0, + .create = bitmap_ip_create, + .me = THIS_MODULE, +}; -MODULE_LICENSE("GPL"); -MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>"); -MODULE_DESCRIPTION("ipmap type of IP sets"); +static int __init +bitmap_ip_init(void) +{ + return ip_set_type_register(&bitmap_ip_type); +} + +static void __exit +bitmap_ip_fini(void) +{ + ip_set_type_unregister(&bitmap_ip_type); +} -REGISTER_MODULE(ipmap) +module_init(bitmap_ip_init); +module_exit(bitmap_ip_fini); |