From 020936c8c3375e1efe44a3087c891a4b2cbfe044 Mon Sep 17 00:00:00 2001 From: Jozsef Kadlecsik Date: Tue, 22 Jun 2010 10:49:41 +0200 Subject: ipset 5: last new feature added - the hash types can now store protocol together port, not only port - lots of fixes everywhere: parser, error reporting, manpage The last bits on the todo list before announcing ipset 5: - recheck all the error messages - add possibly more tests - polish manpage --- kernel/ip_set_hash_ipport.c | 131 ++++++++++++++++++++++++++++++++++---------- 1 file changed, 103 insertions(+), 28 deletions(-) (limited to 'kernel/ip_set_hash_ipport.c') diff --git a/kernel/ip_set_hash_ipport.c b/kernel/ip_set_hash_ipport.c index 8210f67..cb319d2 100644 --- a/kernel/ip_set_hash_ipport.c +++ b/kernel/ip_set_hash_ipport.c @@ -48,14 +48,16 @@ hash_ipport_same_set(const struct ip_set *a, const struct ip_set *b); struct hash_ipport4_elem { u32 ip; u16 port; - u16 match; + u8 proto; + u8 padding; }; /* Member elements with timeout support */ struct hash_ipport4_telem { u32 ip; u16 port; - u16 match; + u8 proto; + u8 padding; unsigned long timeout; }; @@ -63,13 +65,15 @@ static inline bool hash_ipport4_data_equal(const struct hash_ipport4_elem *ip1, const struct hash_ipport4_elem *ip2) { - return ip1->ip == ip2->ip && ip1->port == ip2->port; + return ip1->ip == ip2->ip + && ip1->port == ip2->port + && ip1->proto == ip2->proto; } static inline bool hash_ipport4_data_isnull(const struct hash_ipport4_elem *elem) { - return elem->match == 0; + return elem->proto == 0; } static inline void @@ -78,7 +82,7 @@ hash_ipport4_data_copy(struct hash_ipport4_elem *dst, { dst->ip = src->ip; dst->port = src->port; - dst->match = 1; + dst->proto = src->proto; } static inline void @@ -87,12 +91,13 @@ hash_ipport4_data_swap(struct hash_ipport4_elem *dst, { swap(dst->ip, src->ip); swap(dst->port, src->port); + swap(dst->proto, src->proto); } static inline void hash_ipport4_data_zero_out(struct hash_ipport4_elem *elem) { - elem->match = 0; + elem->proto = 0; } static inline bool @@ -101,6 +106,8 @@ hash_ipport4_data_list(struct sk_buff *skb, { NLA_PUT_NET32(skb, IPSET_ATTR_IP, data->ip); NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port); + if (data->proto != IPSET_IPPROTO_TCPUDP) + NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto); return 0; nla_put_failure: @@ -116,6 +123,8 @@ hash_ipport4_data_tlist(struct sk_buff *skb, NLA_PUT_NET32(skb, IPSET_ATTR_IP, tdata->ip); NLA_PUT_NET16(skb, IPSET_ATTR_PORT, tdata->port); + if (data->proto != IPSET_IPPROTO_TCPUDP) + NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto); NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(ip_set_timeout_get(tdata->timeout))); @@ -125,6 +134,8 @@ nla_put_failure: return 1; } +#define IP_SET_HASH_WITH_PROTO + #define PF 4 #define HOST_MASK 32 #include @@ -135,12 +146,14 @@ hash_ipport4_kadt(struct ip_set *set, const struct sk_buff *skb, { struct chash *h = set->data; ipset_adtfn adtfn = set->variant->adt[adt]; - struct hash_ipport4_elem data = {}; + struct hash_ipport4_elem data = { .proto = h->proto }; - ip4addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip); - if (!get_port(AF_INET, skb, flags & IPSET_DIM_TWO_SRC, &data.port)) + if (!get_ip4_port(skb, flags & IPSET_DIM_ONE_SRC, + &data.port, &data.proto)) return -EINVAL; + ip4addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip); + return adtfn(set, &data, GFP_ATOMIC, h->timeout); } @@ -148,7 +161,9 @@ static const struct nla_policy hash_ipport4_adt_policy[IPSET_ATTR_ADT_MAX + 1] __read_mostly = { [IPSET_ATTR_IP] = { .type = NLA_U32 }, [IPSET_ATTR_PORT] = { .type = NLA_U16 }, + [IPSET_ATTR_PROTO] = { .type = NLA_U8 }, [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, + [IPSET_ATTR_LINENO] = { .type = NLA_U32 }, }; static int @@ -157,9 +172,8 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *head, int len, { struct chash *h = set->data; struct nlattr *tb[IPSET_ATTR_ADT_MAX]; - bool eexist = flags & IPSET_FLAG_EXIST; ipset_adtfn adtfn = set->variant->adt[adt]; - struct hash_ipport4_elem data = {}; + struct hash_ipport4_elem data = { .proto = h->proto }; u32 timeout = h->timeout; int ret; @@ -167,6 +181,9 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *head, int len, hash_ipport4_adt_policy)) return -IPSET_ERR_PROTOCOL; + if (tb[IPSET_ATTR_LINENO]) + *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); + if (tb[IPSET_ATTR_IP]) data.ip = ip_set_get_n32(tb[IPSET_ATTR_IP]); else @@ -177,6 +194,24 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *head, int len, else return -IPSET_ERR_PROTOCOL; + if (tb[IPSET_ATTR_PROTO]) { + data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]); + + if (data.proto == 0 || data.proto >= IPSET_IPPROTO_TCPUDP) + return -IPSET_ERR_INVALID_PROTO; + } else if (data.proto == IPSET_IPPROTO_ANY) + return -IPSET_ERR_MISSING_PROTO; + + switch (data.proto) { + case IPPROTO_UDP: + case IPPROTO_TCP: + case IPSET_IPPROTO_TCPUDP: + break; + default: + data.port = 0; + break; + } + if (tb[IPSET_ATTR_TIMEOUT]) { if (!with_timeout(h->timeout)) return -IPSET_ERR_TIMEOUT; @@ -185,11 +220,7 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *head, int len, ret = adtfn(set, &data, GFP_KERNEL, timeout); - if (ret && !(ret == -IPSET_ERR_EXIST && eexist)) { - if (tb[IPSET_ATTR_LINENO]) - *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); - } - return ret; + return ip_set_eexist(ret, flags) ? 0 : ret; } static bool @@ -200,6 +231,7 @@ hash_ipport_same_set(const struct ip_set *a, const struct ip_set *b) return x->maxelem == y->maxelem && x->timeout == y->timeout + && x->proto == y->proto && x->htable_bits == y->htable_bits /* resizing ? */ && x->array_size == y->array_size && x->chain_limit == y->chain_limit; @@ -210,13 +242,15 @@ hash_ipport_same_set(const struct ip_set *a, const struct ip_set *b) struct hash_ipport6_elem { union nf_inet_addr ip; u16 port; - u16 match; + u8 proto; + u8 padding; }; struct hash_ipport6_telem { union nf_inet_addr ip; u16 port; - u16 match; + u8 proto; + u8 padding; unsigned long timeout; }; @@ -225,13 +259,14 @@ hash_ipport6_data_equal(const struct hash_ipport6_elem *ip1, const struct hash_ipport6_elem *ip2) { return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 - && ip1->port == ip2->port; + && ip1->port == ip2->port + && ip1->proto == ip2->proto; } static inline bool hash_ipport6_data_isnull(const struct hash_ipport6_elem *elem) { - return elem->match == 0; + return elem->proto == 0; } static inline void @@ -239,7 +274,6 @@ hash_ipport6_data_copy(struct hash_ipport6_elem *dst, const struct hash_ipport6_elem *src) { memcpy(dst, src, sizeof(*dst)); - dst->match = 1; } static inline void @@ -256,7 +290,7 @@ hash_ipport6_data_swap(struct hash_ipport6_elem *dst, static inline void hash_ipport6_data_zero_out(struct hash_ipport6_elem *elem) { - elem->match = 0; + elem->proto = 0; } static inline bool @@ -265,6 +299,8 @@ hash_ipport6_data_list(struct sk_buff *skb, { NLA_PUT(skb, IPSET_ATTR_IP, sizeof(struct in6_addr), &data->ip); NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port); + if (data->proto != IPSET_IPPROTO_TCPUDP) + NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto); return 0; nla_put_failure: @@ -280,6 +316,8 @@ hash_ipport6_data_tlist(struct sk_buff *skb, NLA_PUT(skb, IPSET_ATTR_IP, sizeof(struct in6_addr), &e->ip); NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port); + if (data->proto != IPSET_IPPROTO_TCPUDP) + NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto); NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(ip_set_timeout_get(e->timeout))); return 0; @@ -301,12 +339,14 @@ hash_ipport6_kadt(struct ip_set *set, const struct sk_buff *skb, { struct chash *h = set->data; ipset_adtfn adtfn = set->variant->adt[adt]; - struct hash_ipport6_elem data = {}; + struct hash_ipport6_elem data = { .proto = h->proto }; - ip6addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip.in6); - if (!get_port(AF_INET, skb, flags & IPSET_DIM_TWO_SRC, &data.port)) + if (!get_ip6_port(skb, flags & IPSET_DIM_ONE_SRC, + &data.port, &data.proto)) return -EINVAL; + ip6addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip.in6); + return adtfn(set, &data, GFP_ATOMIC, h->timeout); } @@ -315,7 +355,9 @@ hash_ipport6_adt_policy[IPSET_ATTR_ADT_MAX + 1] __read_mostly = { [IPSET_ATTR_IP] = { .type = NLA_BINARY, .len = sizeof(struct in6_addr) }, [IPSET_ATTR_PORT] = { .type = NLA_U16 }, + [IPSET_ATTR_PROTO] = { .type = NLA_U8 }, [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, + [IPSET_ATTR_LINENO] = { .type = NLA_U32 }, }; static int @@ -325,13 +367,17 @@ hash_ipport6_uadt(struct ip_set *set, struct nlattr *head, int len, struct chash *h = set->data; struct nlattr *tb[IPSET_ATTR_ADT_MAX]; ipset_adtfn adtfn = set->variant->adt[adt]; - struct hash_ipport6_elem data = {}; + struct hash_ipport6_elem data = { .proto = h->proto }; u32 timeout = h->timeout; + int ret; if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len, hash_ipport6_adt_policy)) return -IPSET_ERR_PROTOCOL; + if (tb[IPSET_ATTR_LINENO]) + *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); + if (tb[IPSET_ATTR_IP]) memcpy(&data.ip, nla_data(tb[IPSET_ATTR_IP]), sizeof(struct in6_addr)); @@ -343,13 +389,33 @@ hash_ipport6_uadt(struct ip_set *set, struct nlattr *head, int len, else return -IPSET_ERR_PROTOCOL; + if (tb[IPSET_ATTR_PROTO]) { + data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]); + + if (data.proto == 0 || data.proto >= IPSET_IPPROTO_TCPUDP) + return -IPSET_ERR_INVALID_PROTO; + } else if (data.proto == IPSET_IPPROTO_ANY) + return -IPSET_ERR_MISSING_PROTO; + + switch (data.proto) { + case IPPROTO_UDP: + case IPPROTO_TCP: + case IPSET_IPPROTO_TCPUDP: + break; + default: + data.port = 0; + break; + } + if (tb[IPSET_ATTR_TIMEOUT]) { if (!with_timeout(h->timeout)) return -IPSET_ERR_TIMEOUT; timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]); } - return adtfn(set, &data, GFP_KERNEL, timeout); + ret = adtfn(set, &data, GFP_KERNEL, timeout); + + return ip_set_eexist(ret, flags) ? 0 : ret; } /* Create hash:ip type of sets */ @@ -360,6 +426,7 @@ hash_ipport_create_policy[IPSET_ATTR_CREATE_MAX+1] __read_mostly = { [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 }, [IPSET_ATTR_PROBES] = { .type = NLA_U8 }, [IPSET_ATTR_RESIZE] = { .type = NLA_U8 }, + [IPSET_ATTR_PROTO] = { .type = NLA_U8 }, [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, }; @@ -367,8 +434,9 @@ static int hash_ipport_create(struct ip_set *set, struct nlattr *head, int len, u32 flags) { struct nlattr *tb[IPSET_ATTR_CREATE_MAX]; - u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM; struct chash *h; + u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM; + u8 proto = IPSET_IPPROTO_TCPUDP; /* Backward compatibility */ if (!(set->family == AF_INET || set->family == AF_INET6)) return -IPSET_ERR_INVALID_FAMILY; @@ -386,6 +454,12 @@ hash_ipport_create(struct ip_set *set, struct nlattr *head, int len, u32 flags) if (tb[IPSET_ATTR_MAXELEM]) maxelem = ip_set_get_h32(tb[IPSET_ATTR_MAXELEM]); + if (tb[IPSET_ATTR_PROTO]) { + proto = nla_get_u8(tb[IPSET_ATTR_PROTO]); + if (!proto) + return -IPSET_ERR_INVALID_PROTO; + } + h = kzalloc(sizeof(*h), GFP_KERNEL); if (!h) return -ENOMEM; @@ -395,6 +469,7 @@ hash_ipport_create(struct ip_set *set, struct nlattr *head, int len, u32 flags) h->array_size = CHASH_DEFAULT_ARRAY_SIZE; h->chain_limit = CHASH_DEFAULT_CHAIN_LIMIT; get_random_bytes(&h->initval, sizeof(h->initval)); + h->proto = proto; h->timeout = IPSET_NO_TIMEOUT; h->htable = ip_set_alloc(jhash_size(h->htable_bits) * sizeof(struct slist), -- cgit v1.2.3