From 020936c8c3375e1efe44a3087c891a4b2cbfe044 Mon Sep 17 00:00:00 2001 From: Jozsef Kadlecsik Date: Tue, 22 Jun 2010 10:49:41 +0200 Subject: ipset 5: last new feature added - the hash types can now store protocol together port, not only port - lots of fixes everywhere: parser, error reporting, manpage The last bits on the todo list before announcing ipset 5: - recheck all the error messages - add possibly more tests - polish manpage --- kernel/ip_set_hash_ipportip.c | 128 +++++++++++++++++++++++++++++++++--------- 1 file changed, 100 insertions(+), 28 deletions(-) (limited to 'kernel/ip_set_hash_ipportip.c') diff --git a/kernel/ip_set_hash_ipportip.c b/kernel/ip_set_hash_ipportip.c index fbf2780..2c3cf9b 100644 --- a/kernel/ip_set_hash_ipportip.c +++ b/kernel/ip_set_hash_ipportip.c @@ -49,7 +49,8 @@ struct hash_ipportip4_elem { u32 ip; u32 ip2; u16 port; - u16 match; + u8 proto; + u8 padding; }; /* Member elements with timeout support */ @@ -57,7 +58,8 @@ struct hash_ipportip4_telem { u32 ip; u32 ip2; u16 port; - u16 match; + u8 proto; + u8 padding; unsigned long timeout; }; @@ -67,13 +69,14 @@ hash_ipportip4_data_equal(const struct hash_ipportip4_elem *ip1, { return ip1->ip == ip2->ip && ip1->ip2 == ip2->ip2 - && ip1->port == ip2->port; + && ip1->port == ip2->port + && ip1->proto == ip2->proto; } static inline bool hash_ipportip4_data_isnull(const struct hash_ipportip4_elem *elem) { - return elem->match == 0; + return elem->proto == 0; } static inline void @@ -81,7 +84,6 @@ hash_ipportip4_data_copy(struct hash_ipportip4_elem *dst, const struct hash_ipportip4_elem *src) { memcpy(dst, src, sizeof(*dst)); - dst->match = 1; } static inline void @@ -98,7 +100,7 @@ hash_ipportip4_data_swap(struct hash_ipportip4_elem *dst, static inline void hash_ipportip4_data_zero_out(struct hash_ipportip4_elem *elem) { - elem->match = 0; + elem->proto = 0; } static inline bool @@ -108,6 +110,8 @@ hash_ipportip4_data_list(struct sk_buff *skb, NLA_PUT_NET32(skb, IPSET_ATTR_IP, data->ip); NLA_PUT_NET32(skb, IPSET_ATTR_IP2, data->ip2); NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port); + if (data->proto != IPSET_IPPROTO_TCPUDP) + NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto); return 0; nla_put_failure: @@ -124,6 +128,8 @@ hash_ipportip4_data_tlist(struct sk_buff *skb, NLA_PUT_NET32(skb, IPSET_ATTR_IP, tdata->ip); NLA_PUT_NET32(skb, IPSET_ATTR_IP2, tdata->ip2); NLA_PUT_NET16(skb, IPSET_ATTR_PORT, tdata->port); + if (data->proto != IPSET_IPPROTO_TCPUDP) + NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto); NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(ip_set_timeout_get(tdata->timeout))); @@ -133,6 +139,8 @@ nla_put_failure: return 1; } +#define IP_SET_HASH_WITH_PROTO + #define PF 4 #define HOST_MASK 32 #include @@ -143,11 +151,13 @@ hash_ipportip4_kadt(struct ip_set *set, const struct sk_buff *skb, { struct chash *h = set->data; ipset_adtfn adtfn = set->variant->adt[adt]; - struct hash_ipportip4_elem data = {}; + struct hash_ipportip4_elem data = { .proto = h->proto }; - ip4addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip); - if (!get_port(AF_INET, skb, flags & IPSET_DIM_TWO_SRC, &data.port)) + if (!get_ip4_port(skb, flags & IPSET_DIM_TWO_SRC, + &data.port, &data.proto)) return -EINVAL; + + ip4addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip); ip4addrptr(skb, flags & IPSET_DIM_THREE_SRC, &data.ip2); return adtfn(set, &data, GFP_ATOMIC, h->timeout); @@ -158,7 +168,9 @@ hash_ipportip4_adt_policy[IPSET_ATTR_ADT_MAX + 1] __read_mostly = { [IPSET_ATTR_IP] = { .type = NLA_U32 }, [IPSET_ATTR_IP2] = { .type = NLA_U32 }, [IPSET_ATTR_PORT] = { .type = NLA_U16 }, + [IPSET_ATTR_PROTO] = { .type = NLA_U8 }, [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, + [IPSET_ATTR_LINENO] = { .type = NLA_U32 }, }; static int @@ -167,9 +179,8 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *head, int len, { struct chash *h = set->data; struct nlattr *tb[IPSET_ATTR_ADT_MAX]; - bool eexist = flags & IPSET_FLAG_EXIST; ipset_adtfn adtfn = set->variant->adt[adt]; - struct hash_ipportip4_elem data = {}; + struct hash_ipportip4_elem data = { .proto = h->proto }; u32 timeout = h->timeout; int ret; @@ -177,6 +188,9 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *head, int len, hash_ipportip4_adt_policy)) return -IPSET_ERR_PROTOCOL; + if (tb[IPSET_ATTR_LINENO]) + *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); + if (tb[IPSET_ATTR_IP]) data.ip = ip_set_get_n32(tb[IPSET_ATTR_IP]); else @@ -192,6 +206,24 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *head, int len, else return -IPSET_ERR_PROTOCOL; + if (tb[IPSET_ATTR_PROTO]) { + data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]); + + if (data.proto == 0 || data.proto >= IPSET_IPPROTO_TCPUDP) + return -IPSET_ERR_INVALID_PROTO; + } else if (data.proto == IPSET_IPPROTO_ANY) + return -IPSET_ERR_MISSING_PROTO; + + switch (data.proto) { + case IPPROTO_UDP: + case IPPROTO_TCP: + case IPSET_IPPROTO_TCPUDP: + break; + default: + data.port = 0; + break; + } + if (tb[IPSET_ATTR_TIMEOUT]) { if (!with_timeout(h->timeout)) return -IPSET_ERR_TIMEOUT; @@ -200,11 +232,7 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *head, int len, ret = adtfn(set, &data, GFP_KERNEL, timeout); - if (ret && !(ret == -IPSET_ERR_EXIST && eexist)) { - if (tb[IPSET_ATTR_LINENO]) - *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); - } - return ret; + return ip_set_eexist(ret, flags) ? 0 : ret; } static bool @@ -215,6 +243,7 @@ hash_ipportip_same_set(const struct ip_set *a, const struct ip_set *b) return x->maxelem == y->maxelem && x->timeout == y->timeout + && x->proto == y->proto && x->htable_bits == y->htable_bits /* resizing ? */ && x->array_size == y->array_size && x->chain_limit == y->chain_limit; @@ -226,14 +255,16 @@ struct hash_ipportip6_elem { union nf_inet_addr ip; union nf_inet_addr ip2; u16 port; - u16 match; + u8 proto; + u8 padding; }; struct hash_ipportip6_telem { union nf_inet_addr ip; union nf_inet_addr ip2; u16 port; - u16 match; + u8 proto; + u8 padding; unsigned long timeout; }; @@ -243,13 +274,14 @@ hash_ipportip6_data_equal(const struct hash_ipportip6_elem *ip1, { return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 && ipv6_addr_cmp(&ip1->ip2.in6, &ip2->ip2.in6) == 0 - && ip1->port == ip2->port; + && ip1->port == ip2->port + && ip1->proto == ip2->proto; } static inline bool hash_ipportip6_data_isnull(const struct hash_ipportip6_elem *elem) { - return elem->match == 0; + return elem->proto == 0; } static inline void @@ -257,7 +289,6 @@ hash_ipportip6_data_copy(struct hash_ipportip6_elem *dst, const struct hash_ipportip6_elem *src) { memcpy(dst, src, sizeof(*dst)); - dst->match = 1; } static inline void @@ -274,7 +305,7 @@ hash_ipportip6_data_swap(struct hash_ipportip6_elem *dst, static inline void hash_ipportip6_data_zero_out(struct hash_ipportip6_elem *elem) { - elem->match = 0; + elem->proto = 0; } static inline bool @@ -284,6 +315,8 @@ hash_ipportip6_data_list(struct sk_buff *skb, NLA_PUT(skb, IPSET_ATTR_IP, sizeof(struct in6_addr), &data->ip); NLA_PUT(skb, IPSET_ATTR_IP2, sizeof(struct in6_addr), &data->ip2); NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port); + if (data->proto != IPSET_IPPROTO_TCPUDP) + NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto); return 0; nla_put_failure: @@ -300,6 +333,8 @@ hash_ipportip6_data_tlist(struct sk_buff *skb, NLA_PUT(skb, IPSET_ATTR_IP, sizeof(struct in6_addr), &e->ip); NLA_PUT(skb, IPSET_ATTR_IP2, sizeof(struct in6_addr), &data->ip2); NLA_PUT_NET16(skb, IPSET_ATTR_PORT, data->port); + if (data->proto != IPSET_IPPROTO_TCPUDP) + NLA_PUT_U8(skb, IPSET_ATTR_PROTO, data->proto); NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(ip_set_timeout_get(e->timeout))); return 0; @@ -321,11 +356,13 @@ hash_ipportip6_kadt(struct ip_set *set, const struct sk_buff *skb, { struct chash *h = set->data; ipset_adtfn adtfn = set->variant->adt[adt]; - struct hash_ipportip6_elem data = {}; + struct hash_ipportip6_elem data = { .proto = h->proto }; - ip6addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip.in6); - if (!get_port(AF_INET, skb, flags & IPSET_DIM_TWO_SRC, &data.port)) + if (!get_ip6_port(skb, flags & IPSET_DIM_TWO_SRC, + &data.port, &data.proto)) return -EINVAL; + + ip6addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip.in6); ip6addrptr(skb, flags & IPSET_DIM_THREE_SRC, &data.ip2.in6); return adtfn(set, &data, GFP_ATOMIC, h->timeout); @@ -338,7 +375,9 @@ hash_ipportip6_adt_policy[IPSET_ATTR_ADT_MAX + 1] __read_mostly = { [IPSET_ATTR_IP2] = { .type = NLA_BINARY, .len = sizeof(struct in6_addr) }, [IPSET_ATTR_PORT] = { .type = NLA_U16 }, + [IPSET_ATTR_PROTO] = { .type = NLA_U8 }, [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, + [IPSET_ATTR_LINENO] = { .type = NLA_U32 }, }; static int @@ -348,13 +387,17 @@ hash_ipportip6_uadt(struct ip_set *set, struct nlattr *head, int len, struct chash *h = set->data; struct nlattr *tb[IPSET_ATTR_ADT_MAX]; ipset_adtfn adtfn = set->variant->adt[adt]; - struct hash_ipportip6_elem data = {}; + struct hash_ipportip6_elem data = { .proto = h->proto }; u32 timeout = h->timeout; + int ret; if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len, hash_ipportip6_adt_policy)) return -IPSET_ERR_PROTOCOL; + if (tb[IPSET_ATTR_LINENO]) + *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); + if (tb[IPSET_ATTR_IP]) memcpy(&data.ip, nla_data(tb[IPSET_ATTR_IP]), sizeof(struct in6_addr)); @@ -372,13 +415,33 @@ hash_ipportip6_uadt(struct ip_set *set, struct nlattr *head, int len, else return -IPSET_ERR_PROTOCOL; + if (tb[IPSET_ATTR_PROTO]) { + data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]); + + if (data.proto == 0 || data.proto >= IPSET_IPPROTO_TCPUDP) + return -IPSET_ERR_INVALID_PROTO; + } else if (data.proto == IPSET_IPPROTO_ANY) + return -IPSET_ERR_MISSING_PROTO; + + switch (data.proto) { + case IPPROTO_UDP: + case IPPROTO_TCP: + case IPSET_IPPROTO_TCPUDP: + break; + default: + data.port = 0; + break; + } + if (tb[IPSET_ATTR_TIMEOUT]) { if (!with_timeout(h->timeout)) return -IPSET_ERR_TIMEOUT; timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]); } - return adtfn(set, &data, GFP_KERNEL, timeout); + ret = adtfn(set, &data, GFP_KERNEL, timeout); + + return ip_set_eexist(ret, flags) ? 0 : ret; } /* Create hash:ip type of sets */ @@ -389,6 +452,7 @@ hash_ipportip_create_policy[IPSET_ATTR_CREATE_MAX+1] __read_mostly = { [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 }, [IPSET_ATTR_PROBES] = { .type = NLA_U8 }, [IPSET_ATTR_RESIZE] = { .type = NLA_U8 }, + [IPSET_ATTR_PROTO] = { .type = NLA_U8 }, [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, }; @@ -397,8 +461,9 @@ hash_ipportip_create(struct ip_set *set, struct nlattr *head, int len, u32 flags) { struct nlattr *tb[IPSET_ATTR_CREATE_MAX]; - u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM; struct chash *h; + u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM; + u8 proto = IPSET_IPPROTO_TCPUDP; /* Backward compatibility */ if (!(set->family == AF_INET || set->family == AF_INET6)) return -IPSET_ERR_INVALID_FAMILY; @@ -416,6 +481,12 @@ hash_ipportip_create(struct ip_set *set, struct nlattr *head, if (tb[IPSET_ATTR_MAXELEM]) maxelem = ip_set_get_h32(tb[IPSET_ATTR_MAXELEM]); + if (tb[IPSET_ATTR_PROTO]) { + proto = nla_get_u8(tb[IPSET_ATTR_PROTO]); + if (!proto) + return -IPSET_ERR_INVALID_PROTO; + } + h = kzalloc(sizeof(*h), GFP_KERNEL); if (!h) return -ENOMEM; @@ -425,6 +496,7 @@ hash_ipportip_create(struct ip_set *set, struct nlattr *head, h->array_size = CHASH_DEFAULT_ARRAY_SIZE; h->chain_limit = CHASH_DEFAULT_CHAIN_LIMIT; get_random_bytes(&h->initval, sizeof(h->initval)); + h->proto = proto; h->timeout = IPSET_NO_TIMEOUT; h->htable = ip_set_alloc(jhash_size(h->htable_bits) * sizeof(struct slist), -- cgit v1.2.3