[linux-2.6-block.git] / net / netfilter / ipset / ip_set_bitmap_ipmac.c

/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
 *                         Patrick Schaaf <bof@bof.de>
 *			   Martin Josefsson <gandalf@wlug.westbo.se>
 * Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

/* Kernel module implementing an IP set type: the bitmap:ip,mac type */

#include <linux/module.h>
#include <linux/ip.h>
#include <linux/etherdevice.h>
#include <linux/skbuff.h>
#include <linux/errno.h>
#include <linux/if_ether.h>
#include <linux/netlink.h>
#include <linux/jiffies.h>
#include <linux/timer.h>
#include <net/netlink.h>

#include <linux/netfilter/ipset/pfxlen.h>
#include <linux/netfilter/ipset/ip_set.h>
#include <linux/netfilter/ipset/ip_set_bitmap.h>

#define IPSET_TYPE_REV_MIN	0
/*				1	   Counter support added */
/*				2	   Comment support added */
#define IPSET_TYPE_REV_MAX	3	/* skbinfo support added */

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
IP_SET_MODULE_DESC("bitmap:ip,mac", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
MODULE_ALIAS("ip_set_bitmap:ip,mac");

#define MTYPE		bitmap_ipmac
#define HOST_MASK	32
#define IP_SET_BITMAP_STORED_TIMEOUT

enum {
	MAC_UNSET,		/* element is set, without MAC */
	MAC_FILLED,		/* element is set with MAC */
};

/* Type structure */
struct bitmap_ipmac {
	void *members;		/* the set members */
	u32 first_ip;		/* host byte order, included in range */
	u32 last_ip;		/* host byte order, included in range */
	u32 elements;		/* number of max elements in the set */
	size_t memsize;		/* members size */
	struct timer_list gc;	/* garbage collector */
	unsigned char extensions[0]	/* MAC + data extensions */
		__aligned(__alignof__(u64));
};

/* ADT structure for generic function args */
struct bitmap_ipmac_adt_elem {
	unsigned char ether[ETH_ALEN] __aligned(2);
	u16 id;
	u16 add_mac;
};

struct bitmap_ipmac_elem {
	unsigned char ether[ETH_ALEN];
	unsigned char filled;
} __aligned(__alignof__(u64));

static inline u32
ip_to_id(const struct bitmap_ipmac *m, u32 ip)
{
	return ip - m->first_ip;
}

#define get_elem(extensions, id, dsize)		\
	(struct bitmap_ipmac_elem *)(extensions + (id) * (dsize))

#define get_const_elem(extensions, id, dsize)	\
	(const struct bitmap_ipmac_elem *)(extensions + (id) * (dsize))

/* Common functions */

static inline int
bitmap_ipmac_do_test(const struct bitmap_ipmac_adt_elem *e,
		     const struct bitmap_ipmac *map, size_t dsize)
{
	const struct bitmap_ipmac_elem *elem;

	if (!test_bit(e->id, map->members))
		return 0;
	elem = get_const_elem(map->extensions, e->id, dsize);
	if (e->add_mac && elem->filled == MAC_FILLED)
		return ether_addr_equal(e->ether, elem->ether);
	/* Trigger kernel to fill out the ethernet address */
	return -EAGAIN;
}

static inline int
bitmap_ipmac_gc_test(u16 id, const struct bitmap_ipmac *map, size_t dsize)
{
	const struct bitmap_ipmac_elem *elem;

	if (!test_bit(id, map->members))
		return 0;
	elem = get_const_elem(map->extensions, id, dsize);
	/* Timer not started for the incomplete elements */
	return elem->filled == MAC_FILLED;
}

static inline int
bitmap_ipmac_is_filled(const struct bitmap_ipmac_elem *elem)
{
	return elem->filled == MAC_FILLED;
}

static inline int
bitmap_ipmac_add_timeout(unsigned long *timeout,
			 const struct bitmap_ipmac_adt_elem *e,
			 const struct ip_set_ext *ext, struct ip_set *set,
			 struct bitmap_ipmac *map, int mode)
{
	u32 t = ext->timeout;

	if (mode == IPSET_ADD_START_STORED_TIMEOUT) {
		if (t == set->timeout)
			/* Timeout was not specified, get stored one */
			t = *timeout;
		ip_set_timeout_set(timeout, t);
	} else {
		/* If MAC is unset yet, we store plain timeout value
		 * because the timer is not activated yet
		 * and we can reuse it later when MAC is filled out,
		 * possibly by the kernel
		 */
		if (e->add_mac)
			ip_set_timeout_set(timeout, t);
		else
			*timeout = t;
	}
	return 0;
}

static inline int
bitmap_ipmac_do_add(const struct bitmap_ipmac_adt_elem *e,
		    struct bitmap_ipmac *map, u32 flags, size_t dsize)
{
	struct bitmap_ipmac_elem *elem;

	elem = get_elem(map->extensions, e->id, dsize);
	if (test_bit(e->id, map->members)) {
		if (elem->filled == MAC_FILLED) {
			if (e->add_mac &&
			    (flags & IPSET_FLAG_EXIST) &&
			    !ether_addr_equal(e->ether, elem->ether)) {
				/* memcpy isn't atomic */
				clear_bit(e->id, map->members);
				smp_mb__after_atomic();
				ether_addr_copy(elem->ether, e->ether);
			}
			return IPSET_ADD_FAILED;
		} else if (!e->add_mac)
			/* Already added without ethernet address */
			return IPSET_ADD_FAILED;
		/* Fill the MAC address and trigger the timer activation */
		clear_bit(e->id, map->members);
		smp_mb__after_atomic();
		ether_addr_copy(elem->ether, e->ether);
		elem->filled = MAC_FILLED;
		return IPSET_ADD_START_STORED_TIMEOUT;
	} else if (e->add_mac) {
		/* We can store MAC too */
		ether_addr_copy(elem->ether, e->ether);
		elem->filled = MAC_FILLED;
		return 0;
	}
	elem->filled = MAC_UNSET;
	/* MAC is not stored yet, don't start timer */
	return IPSET_ADD_STORE_PLAIN_TIMEOUT;
}

static inline int
bitmap_ipmac_do_del(const struct bitmap_ipmac_adt_elem *e,
		    struct bitmap_ipmac *map)
{
	return !test_and_clear_bit(e->id, map->members);
}

static inline int
bitmap_ipmac_do_list(struct sk_buff *skb, const struct bitmap_ipmac *map,
		     u32 id, size_t dsize)
{
	const struct bitmap_ipmac_elem *elem =
		get_const_elem(map->extensions, id, dsize);

	return nla_put_ipaddr4(skb, IPSET_ATTR_IP,
			       htonl(map->first_ip + id)) ||
	       (elem->filled == MAC_FILLED &&
		nla_put(skb, IPSET_ATTR_ETHER, ETH_ALEN, elem->ether));
}

static inline int
bitmap_ipmac_do_head(struct sk_buff *skb, const struct bitmap_ipmac *map)
{
	return nla_put_ipaddr4(skb, IPSET_ATTR_IP, htonl(map->first_ip)) ||
	       nla_put_ipaddr4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
}

static int
bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
		  const struct xt_action_param *par,
		  enum ipset_adt adt, struct ip_set_adt_opt *opt)
{
	struct bitmap_ipmac *map = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct bitmap_ipmac_adt_elem e = { .id = 0, .add_mac = 1 };
	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
	u32 ip;

	/* MAC can be src only */
	if (!(opt->flags & IPSET_DIM_TWO_SRC))
		return 0;

	ip = ntohl(ip4addr(skb, opt->flags & IPSET_DIM_ONE_SRC));
	if (ip < map->first_ip || ip > map->last_ip)
		return -IPSET_ERR_BITMAP_RANGE;

	/* Backward compatibility: we don't check the second flag */
	if (skb_mac_header(skb) < skb->head ||
	    (skb_mac_header(skb) + ETH_HLEN) > skb->data)
		return -EINVAL;

	e.id = ip_to_id(map, ip);
	memcpy(e.ether, eth_hdr(skb)->h_source, ETH_ALEN);

	return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
}

static int
bitmap_ipmac_uadt(struct ip_set *set, struct nlattr *tb[],
		  enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
{
	const struct bitmap_ipmac *map = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct bitmap_ipmac_adt_elem e = { .id = 0 };
	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
	u32 ip = 0;
	int ret = 0;

	if (tb[IPSET_ATTR_LINENO])
		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);

	if (unlikely(!tb[IPSET_ATTR_IP]))
		return -IPSET_ERR_PROTOCOL;

	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
	if (ret)
		return ret;

	ret = ip_set_get_extensions(set, tb, &ext);
	if (ret)
		return ret;

	if (ip < map->first_ip || ip > map->last_ip)
		return -IPSET_ERR_BITMAP_RANGE;

	e.id = ip_to_id(map, ip);
	if (tb[IPSET_ATTR_ETHER]) {
		if (nla_len(tb[IPSET_ATTR_ETHER]) != ETH_ALEN)
			return -IPSET_ERR_PROTOCOL;
		memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN);
		e.add_mac = 1;
	}
	ret = adtfn(set, &e, &ext, &ext, flags);

	return ip_set_eexist(ret, flags) ? 0 : ret;
}

static bool
bitmap_ipmac_same_set(const struct ip_set *a, const struct ip_set *b)
{
	const struct bitmap_ipmac *x = a->data;
	const struct bitmap_ipmac *y = b->data;

	return x->first_ip == y->first_ip &&
	       x->last_ip == y->last_ip &&
	       a->timeout == b->timeout &&
	       a->extensions == b->extensions;
}

/* Plain variant */

#include "ip_set_bitmap_gen.h"

/* Create bitmap:ip,mac type of sets */

static bool
init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,
	       u32 first_ip, u32 last_ip, u32 elements)
{
	map->members = ip_set_alloc(map->memsize);
	if (!map->members)
		return false;
	map->first_ip = first_ip;
	map->last_ip = last_ip;
	map->elements = elements;
	set->timeout = IPSET_NO_TIMEOUT;

	set->data = map;
	set->family = NFPROTO_IPV4;

	return true;
}

static int
bitmap_ipmac_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
		    u32 flags)
{
	u32 first_ip = 0, last_ip = 0;
	u64 elements;
	struct bitmap_ipmac *map;
	int ret;

	if (unlikely(!tb[IPSET_ATTR_IP] ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
		return -IPSET_ERR_PROTOCOL;

	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &first_ip);
	if (ret)
		return ret;

	if (tb[IPSET_ATTR_IP_TO]) {
		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &last_ip);
		if (ret)
			return ret;
		if (first_ip > last_ip) {
			u32 tmp = first_ip;

			first_ip = last_ip;
			last_ip = tmp;
		}
	} else if (tb[IPSET_ATTR_CIDR]) {
		u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);

		if (cidr >= HOST_MASK)
			return -IPSET_ERR_INVALID_CIDR;
		ip_set_mask_from_to(first_ip, last_ip, cidr);
	} else {
		return -IPSET_ERR_PROTOCOL;
	}

	elements = (u64)last_ip - first_ip + 1;

	if (elements > IPSET_BITMAP_MAX_RANGE + 1)
		return -IPSET_ERR_BITMAP_RANGE_SIZE;

	set->dsize = ip_set_elem_len(set, tb,
				     sizeof(struct bitmap_ipmac_elem),
				     __alignof__(struct bitmap_ipmac_elem));
	map = ip_set_alloc(sizeof(*map) + elements * set->dsize);
	if (!map)
		return -ENOMEM;

	map->memsize = bitmap_bytes(0, elements - 1);
	set->variant = &bitmap_ipmac;
	if (!init_map_ipmac(set, map, first_ip, last_ip, elements)) {
		kfree(map);
		return -ENOMEM;
	}
	if (tb[IPSET_ATTR_TIMEOUT]) {
		set->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
		bitmap_ipmac_gc_init(set, bitmap_ipmac_gc);
	}
	return 0;
}

static struct ip_set_type bitmap_ipmac_type = {
	.name		= "bitmap:ip,mac",
	.protocol	= IPSET_PROTOCOL,
	.features	= IPSET_TYPE_IP | IPSET_TYPE_MAC,
	.dimension	= IPSET_DIM_TWO,
	.family		= NFPROTO_IPV4,
	.revision_min	= IPSET_TYPE_REV_MIN,
	.revision_max	= IPSET_TYPE_REV_MAX,
	.create		= bitmap_ipmac_create,
	.create_policy	= {
		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
		[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },
	},
	.adt_policy	= {
		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
		[IPSET_ATTR_ETHER]	= { .type = NLA_BINARY,
					    .len  = ETH_ALEN },
		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },
		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },
		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING,
					    .len  = IPSET_MAX_COMMENT_SIZE },
		[IPSET_ATTR_SKBMARK]	= { .type = NLA_U64 },
		[IPSET_ATTR_SKBPRIO]	= { .type = NLA_U32 },
		[IPSET_ATTR_SKBQUEUE]	= { .type = NLA_U16 },
	},
	.me		= THIS_MODULE,
};

static int __init
bitmap_ipmac_init(void)
{
	return ip_set_type_register(&bitmap_ipmac_type);
}

static void __exit
bitmap_ipmac_fini(void)
{
	rcu_barrier();
	ip_set_type_unregister(&bitmap_ipmac_type);
}

module_init(bitmap_ipmac_init);
module_exit(bitmap_ipmac_fini);
Commit	Line	Data
de76021a JK	1	/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
	2	* Patrick Schaaf <bof@bof.de>
	3	* Martin Josefsson <gandalf@wlug.westbo.se>
b0da3905	4	* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
de76021a JK	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*/
	10
	11	/* Kernel module implementing an IP set type: the bitmap:ip,mac type */
	12
	13	#include <linux/module.h>
	14	#include <linux/ip.h>
	15	#include <linux/etherdevice.h>
	16	#include <linux/skbuff.h>
	17	#include <linux/errno.h>
de76021a JK	18	#include <linux/if_ether.h>
	19	#include <linux/netlink.h>
	20	#include <linux/jiffies.h>
	21	#include <linux/timer.h>
	22	#include <net/netlink.h>
	23
	24	#include <linux/netfilter/ipset/pfxlen.h>
	25	#include <linux/netfilter/ipset/ip_set.h>
de76021a JK	26	#include <linux/netfilter/ipset/ip_set_bitmap.h>
de76021a JK	27
35b8dcf8	28	#define IPSET_TYPE_REV_MIN 0
b90cb8ba	29	/* 1 Counter support added */
39d1ecf1 AD	30	/* 2 Comment support added */
39d1ecf1 AD	31	#define IPSET_TYPE_REV_MAX 3 /* skbinfo support added */
10111a6e	32
de76021a JK	33	MODULE_LICENSE("GPL");
de76021a JK	34	MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
35b8dcf8	35	IP_SET_MODULE_DESC("bitmap:ip,mac", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
de76021a JK	36	MODULE_ALIAS("ip_set_bitmap:ip,mac");
de76021a JK	37
b0da3905	38	#define MTYPE bitmap_ipmac
cabfd139	39	#define HOST_MASK 32
b0da3905 JK	40	#define IP_SET_BITMAP_STORED_TIMEOUT
b0da3905 JK	41
de76021a	42	enum {
de76021a	43	MAC_UNSET, /* element is set, without MAC */
b0da3905	44	MAC_FILLED, /* element is set with MAC */
de76021a JK	45	};
	46
	47	/* Type structure */
	48	struct bitmap_ipmac {
	49	void members; / the set members */
	50	u32 first_ip; /* host byte order, included in range */
	51	u32 last_ip; /* host byte order, included in range */
b0da3905	52	u32 elements; /* number of max elements in the set */
b0da3905	53	size_t memsize; /* members size */
ca134ce8	54	struct timer_list gc; /* garbage collector */
95ad1f4a JK	55	unsigned char extensions[0] /* MAC + data extensions */
95ad1f4a JK	56	__aligned(__alignof__(u64));
de76021a JK	57	};
	58
	59	/* ADT structure for generic function args */
b0da3905	60	struct bitmap_ipmac_adt_elem {
95ad1f4a	61	unsigned char ether[ETH_ALEN] __aligned(2);
b0da3905	62	u16 id;
95ad1f4a	63	u16 add_mac;
de76021a JK	64	};
de76021a JK	65
b0da3905	66	struct bitmap_ipmac_elem {
de76021a	67	unsigned char ether[ETH_ALEN];
b0da3905	68	unsigned char filled;
95ad1f4a	69	} __aligned(__alignof__(u64));
de76021a	70
b0da3905 JK	71	static inline u32
b0da3905 JK	72	ip_to_id(const struct bitmap_ipmac *m, u32 ip)
de76021a	73	{
b0da3905	74	return ip - m->first_ip;
de76021a JK	75	}
de76021a JK	76
95ad1f4a JK	77	#define get_elem(extensions, id, dsize) \
	78	(struct bitmap_ipmac_elem )(extensions + (id) (dsize))
	79
	80	#define get_const_elem(extensions, id, dsize) \
	81	(const struct bitmap_ipmac_elem )(extensions + (id) (dsize))
de76021a	82
b0da3905	83	/* Common functions */
de76021a JK	84
de76021a JK	85	static inline int
b0da3905	86	bitmap_ipmac_do_test(const struct bitmap_ipmac_adt_elem *e,
ca134ce8	87	const struct bitmap_ipmac *map, size_t dsize)
de76021a	88	{
b0da3905	89	const struct bitmap_ipmac_elem *elem;
de76021a	90
b0da3905 JK	91	if (!test_bit(e->id, map->members))
b0da3905 JK	92	return 0;
95ad1f4a JK	93	elem = get_const_elem(map->extensions, e->id, dsize);
	94	if (e->add_mac && elem->filled == MAC_FILLED)
	95	return ether_addr_equal(e->ether, elem->ether);
b0da3905 JK	96	/* Trigger kernel to fill out the ethernet address */
b0da3905 JK	97	return -EAGAIN;
de76021a JK	98	}
de76021a JK	99
b0da3905	100	static inline int
ca134ce8	101	bitmap_ipmac_gc_test(u16 id, const struct bitmap_ipmac *map, size_t dsize)
de76021a	102	{
b0da3905	103	const struct bitmap_ipmac_elem *elem;
de76021a	104
b0da3905 JK	105	if (!test_bit(id, map->members))
b0da3905 JK	106	return 0;
95ad1f4a	107	elem = get_const_elem(map->extensions, id, dsize);
b0da3905 JK	108	/* Timer not started for the incomplete elements */
b0da3905 JK	109	return elem->filled == MAC_FILLED;
de76021a JK	110	}
de76021a JK	111
b0da3905 JK	112	static inline int
b0da3905 JK	113	bitmap_ipmac_is_filled(const struct bitmap_ipmac_elem *elem)
de76021a	114	{
b0da3905	115	return elem->filled == MAC_FILLED;
de76021a JK	116	}
de76021a JK	117
b0da3905 JK	118	static inline int
	119	bitmap_ipmac_add_timeout(unsigned long *timeout,
	120	const struct bitmap_ipmac_adt_elem *e,
ca134ce8	121	const struct ip_set_ext ext, struct ip_set set,
b0da3905	122	struct bitmap_ipmac *map, int mode)
de76021a	123	{
b0da3905	124	u32 t = ext->timeout;
de76021a	125
b0da3905	126	if (mode == IPSET_ADD_START_STORED_TIMEOUT) {
ca134ce8	127	if (t == set->timeout)
de76021a	128	/* Timeout was not specified, get stored one */
b0da3905 JK	129	t = *timeout;
	130	ip_set_timeout_set(timeout, t);
	131	} else {
de76021a JK	132	/* If MAC is unset yet, we store plain timeout value
	133	* because the timer is not activated yet
	134	* and we can reuse it later when MAC is filled out,
ca0f6a5c JK	135	* possibly by the kernel
ca0f6a5c JK	136	*/
95ad1f4a	137	if (e->add_mac)
b0da3905 JK	138	ip_set_timeout_set(timeout, t);
	139	else
	140	*timeout = t;
de76021a	141	}
de76021a JK	142	return 0;
	143	}
	144
b0da3905 JK	145	static inline int
b0da3905 JK	146	bitmap_ipmac_do_add(const struct bitmap_ipmac_adt_elem *e,
ca134ce8	147	struct bitmap_ipmac *map, u32 flags, size_t dsize)
de76021a	148	{
b0da3905 JK	149	struct bitmap_ipmac_elem *elem;
b0da3905 JK	150
ca134ce8	151	elem = get_elem(map->extensions, e->id, dsize);
96f51428	152	if (test_bit(e->id, map->members)) {
b0da3905	153	if (elem->filled == MAC_FILLED) {
95ad1f4a	154	if (e->add_mac &&
96f51428 JK	155	(flags & IPSET_FLAG_EXIST) &&
	156	!ether_addr_equal(e->ether, elem->ether)) {
	157	/* memcpy isn't atomic */
	158	clear_bit(e->id, map->members);
	159	smp_mb__after_atomic();
ca0f6a5c	160	ether_addr_copy(elem->ether, e->ether);
96f51428	161	}
b0da3905	162	return IPSET_ADD_FAILED;
95ad1f4a	163	} else if (!e->add_mac)
b0da3905 JK	164	/* Already added without ethernet address */
	165	return IPSET_ADD_FAILED;
	166	/* Fill the MAC address and trigger the timer activation */
96f51428 JK	167	clear_bit(e->id, map->members);
96f51428 JK	168	smp_mb__after_atomic();
ca0f6a5c	169	ether_addr_copy(elem->ether, e->ether);
b0da3905 JK	170	elem->filled = MAC_FILLED;
b0da3905 JK	171	return IPSET_ADD_START_STORED_TIMEOUT;
95ad1f4a	172	} else if (e->add_mac) {
b0da3905	173	/* We can store MAC too */
ca0f6a5c	174	ether_addr_copy(elem->ether, e->ether);
b0da3905 JK	175	elem->filled = MAC_FILLED;
b0da3905 JK	176	return 0;
b0da3905	177	}
ca0f6a5c JK	178	elem->filled = MAC_UNSET;
	179	/* MAC is not stored yet, don't start timer */
	180	return IPSET_ADD_STORE_PLAIN_TIMEOUT;
b0da3905	181	}
de76021a	182
b0da3905 JK	183	static inline int
	184	bitmap_ipmac_do_del(const struct bitmap_ipmac_adt_elem *e,
	185	struct bitmap_ipmac *map)
	186	{
	187	return !test_and_clear_bit(e->id, map->members);
	188	}
de76021a	189
b0da3905 JK	190	static inline int
b0da3905 JK	191	bitmap_ipmac_do_list(struct sk_buff skb, const struct bitmap_ipmac map,
ca134ce8	192	u32 id, size_t dsize)
de76021a	193	{
b0da3905	194	const struct bitmap_ipmac_elem *elem =
95ad1f4a	195	get_const_elem(map->extensions, id, dsize);
de76021a	196
b0da3905 JK	197	return nla_put_ipaddr4(skb, IPSET_ATTR_IP,
	198	htonl(map->first_ip + id)) \|\|
	199	(elem->filled == MAC_FILLED &&
	200	nla_put(skb, IPSET_ATTR_ETHER, ETH_ALEN, elem->ether));
	201	}
de76021a	202
b0da3905 JK	203	static inline int
	204	bitmap_ipmac_do_head(struct sk_buff skb, const struct bitmap_ipmac map)
	205	{
	206	return nla_put_ipaddr4(skb, IPSET_ATTR_IP, htonl(map->first_ip)) \|\|
	207	nla_put_ipaddr4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
de76021a JK	208	}
	209
	210	static int
	211	bitmap_ipmac_kadt(struct ip_set set, const struct sk_buff skb,
b66554cf	212	const struct xt_action_param *par,
b0da3905	213	enum ipset_adt adt, struct ip_set_adt_opt *opt)
de76021a JK	214	{
	215	struct bitmap_ipmac *map = set->data;
	216	ipset_adtfn adtfn = set->variant->adt[adt];
95ad1f4a	217	struct bitmap_ipmac_adt_elem e = { .id = 0, .add_mac = 1 };
ca134ce8	218	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
b0da3905	219	u32 ip;
de76021a	220
0e8a835a	221	/* MAC can be src only */
ac8cc925	222	if (!(opt->flags & IPSET_DIM_TWO_SRC))
0e8a835a JK	223	return 0;
0e8a835a JK	224
b0da3905 JK	225	ip = ntohl(ip4addr(skb, opt->flags & IPSET_DIM_ONE_SRC));
b0da3905 JK	226	if (ip < map->first_ip \|\| ip > map->last_ip)
de76021a JK	227	return -IPSET_ERR_BITMAP_RANGE;
	228
	229	/* Backward compatibility: we don't check the second flag */
	230	if (skb_mac_header(skb) < skb->head \|\|
	231	(skb_mac_header(skb) + ETH_HLEN) > skb->data)
	232	return -EINVAL;
	233
b0da3905	234	e.id = ip_to_id(map, ip);
95ad1f4a	235	memcpy(e.ether, eth_hdr(skb)->h_source, ETH_ALEN);
de76021a	236
b0da3905	237	return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
de76021a JK	238	}
	239
	240	static int
	241	bitmap_ipmac_uadt(struct ip_set set, struct nlattr tb[],
3d14b171	242	enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
de76021a JK	243	{
	244	const struct bitmap_ipmac *map = set->data;
	245	ipset_adtfn adtfn = set->variant->adt[adt];
94729f8a	246	struct bitmap_ipmac_adt_elem e = { .id = 0 };
ca134ce8	247	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
20b2fab4	248	u32 ip = 0;
de76021a JK	249	int ret = 0;
de76021a JK	250
de76021a JK	251	if (tb[IPSET_ATTR_LINENO])
	252	*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
	253
a212e08e SP	254	if (unlikely(!tb[IPSET_ATTR_IP]))
	255	return -IPSET_ERR_PROTOCOL;
	256
8e55d2e5 SP	257	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
	258	if (ret)
	259	return ret;
	260
	261	ret = ip_set_get_extensions(set, tb, &ext);
de76021a JK	262	if (ret)
	263	return ret;
	264
b0da3905	265	if (ip < map->first_ip \|\| ip > map->last_ip)
de76021a JK	266	return -IPSET_ERR_BITMAP_RANGE;
de76021a JK	267
b0da3905	268	e.id = ip_to_id(map, ip);
95ad1f4a	269	if (tb[IPSET_ATTR_ETHER]) {
d8aacd87 JK	270	if (nla_len(tb[IPSET_ATTR_ETHER]) != ETH_ALEN)
d8aacd87 JK	271	return -IPSET_ERR_PROTOCOL;
95ad1f4a JK	272	memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN);
	273	e.add_mac = 1;
	274	}
b0da3905	275	ret = adtfn(set, &e, &ext, &ext, flags);
de76021a JK	276
	277	return ip_set_eexist(ret, flags) ? 0 : ret;
	278	}
	279
de76021a JK	280	static bool
	281	bitmap_ipmac_same_set(const struct ip_set a, const struct ip_set b)
	282	{
	283	const struct bitmap_ipmac *x = a->data;
	284	const struct bitmap_ipmac *y = b->data;
	285
	286	return x->first_ip == y->first_ip &&
	287	x->last_ip == y->last_ip &&
ca134ce8	288	a->timeout == b->timeout &&
b0da3905	289	a->extensions == b->extensions;
de76021a JK	290	}
de76021a JK	291
b0da3905	292	/* Plain variant */
de76021a	293
b0da3905	294	#include "ip_set_bitmap_gen.h"
de76021a JK	295
	296	/* Create bitmap:ip,mac type of sets */
	297
	298	static bool
	299	init_map_ipmac(struct ip_set set, struct bitmap_ipmac map,
b0da3905	300	u32 first_ip, u32 last_ip, u32 elements)
de76021a	301	{
03c8b234	302	map->members = ip_set_alloc(map->memsize);
de76021a JK	303	if (!map->members)
	304	return false;
	305	map->first_ip = first_ip;
	306	map->last_ip = last_ip;
b0da3905	307	map->elements = elements;
ca134ce8	308	set->timeout = IPSET_NO_TIMEOUT;
de76021a JK	309
de76021a JK	310	set->data = map;
c15f1c83	311	set->family = NFPROTO_IPV4;
de76021a JK	312
	313	return true;
	314	}
	315
	316	static int
1785e8f4	317	bitmap_ipmac_create(struct net net, struct ip_set set, struct nlattr *tb[],
de76021a JK	318	u32 flags)
de76021a JK	319	{
03c8b234	320	u32 first_ip = 0, last_ip = 0;
b9fed748	321	u64 elements;
de76021a JK	322	struct bitmap_ipmac *map;
	323	int ret;
	324
	325	if (unlikely(!tb[IPSET_ATTR_IP] \|\|
f48d19db JK	326	!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) \|\|
f48d19db JK	327	!ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
de76021a JK	328	return -IPSET_ERR_PROTOCOL;
	329
	330	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &first_ip);
	331	if (ret)
	332	return ret;
	333
	334	if (tb[IPSET_ATTR_IP_TO]) {
	335	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &last_ip);
	336	if (ret)
	337	return ret;
	338	if (first_ip > last_ip) {
	339	u32 tmp = first_ip;
	340
	341	first_ip = last_ip;
	342	last_ip = tmp;
	343	}
	344	} else if (tb[IPSET_ATTR_CIDR]) {
	345	u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
	346
cabfd139	347	if (cidr >= HOST_MASK)
de76021a	348	return -IPSET_ERR_INVALID_CIDR;
e6146e86	349	ip_set_mask_from_to(first_ip, last_ip, cidr);
ca0f6a5c	350	} else {
de76021a	351	return -IPSET_ERR_PROTOCOL;
ca0f6a5c	352	}
de76021a	353
b9fed748	354	elements = (u64)last_ip - first_ip + 1;
de76021a JK	355
	356	if (elements > IPSET_BITMAP_MAX_RANGE + 1)
	357	return -IPSET_ERR_BITMAP_RANGE_SIZE;
	358
95ad1f4a JK	359	set->dsize = ip_set_elem_len(set, tb,
	360	sizeof(struct bitmap_ipmac_elem),
	361	__alignof__(struct bitmap_ipmac_elem));
	362	map = ip_set_alloc(sizeof(map) + elements set->dsize);
de76021a JK	363	if (!map)
	364	return -ENOMEM;
	365
b0da3905 JK	366	map->memsize = bitmap_bytes(0, elements - 1);
b0da3905 JK	367	set->variant = &bitmap_ipmac;
03c8b234 JK	368	if (!init_map_ipmac(set, map, first_ip, last_ip, elements)) {
	369	kfree(map);
	370	return -ENOMEM;
	371	}
	372	if (tb[IPSET_ATTR_TIMEOUT]) {
ca134ce8	373	set->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
b0da3905	374	bitmap_ipmac_gc_init(set, bitmap_ipmac_gc);
de76021a JK	375	}
	376	return 0;
	377	}
	378
	379	static struct ip_set_type bitmap_ipmac_type = {
	380	.name = "bitmap:ip,mac",
	381	.protocol = IPSET_PROTOCOL,
	382	.features = IPSET_TYPE_IP \| IPSET_TYPE_MAC,
	383	.dimension = IPSET_DIM_TWO,
c15f1c83	384	.family = NFPROTO_IPV4,
35b8dcf8 JK	385	.revision_min = IPSET_TYPE_REV_MIN,
35b8dcf8 JK	386	.revision_max = IPSET_TYPE_REV_MAX,
de76021a JK	387	.create = bitmap_ipmac_create,
	388	.create_policy = {
	389	[IPSET_ATTR_IP] = { .type = NLA_NESTED },
	390	[IPSET_ATTR_IP_TO] = { .type = NLA_NESTED },
	391	[IPSET_ATTR_CIDR] = { .type = NLA_U8 },
	392	[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
f48d19db	393	[IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
de76021a JK	394	},
	395	.adt_policy = {
	396	[IPSET_ATTR_IP] = { .type = NLA_NESTED },
15b4d93f JK	397	[IPSET_ATTR_ETHER] = { .type = NLA_BINARY,
15b4d93f JK	398	.len = ETH_ALEN },
de76021a JK	399	[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
de76021a JK	400	[IPSET_ATTR_LINENO] = { .type = NLA_U32 },
f48d19db JK	401	[IPSET_ATTR_BYTES] = { .type = NLA_U64 },
f48d19db JK	402	[IPSET_ATTR_PACKETS] = { .type = NLA_U64 },
03726186 SP	403	[IPSET_ATTR_COMMENT] = { .type = NLA_NUL_STRING,
03726186 SP	404	.len = IPSET_MAX_COMMENT_SIZE },
39d1ecf1 AD	405	[IPSET_ATTR_SKBMARK] = { .type = NLA_U64 },
	406	[IPSET_ATTR_SKBPRIO] = { .type = NLA_U32 },
	407	[IPSET_ATTR_SKBQUEUE] = { .type = NLA_U16 },
de76021a JK	408	},
	409	.me = THIS_MODULE,
	410	};
	411
	412	static int __init
	413	bitmap_ipmac_init(void)
	414	{
	415	return ip_set_type_register(&bitmap_ipmac_type);
	416	}
	417
	418	static void __exit
	419	bitmap_ipmac_fini(void)
	420	{
96f51428	421	rcu_barrier();
de76021a JK	422	ip_set_type_unregister(&bitmap_ipmac_type);
	423	}
	424
	425	module_init(bitmap_ipmac_init);
	426	module_exit(bitmap_ipmac_fini);