[linux-2.6-block.git] / net / netfilter / ipset / ip_set_hash_netnet.c

/* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
 * Copyright (C) 2013 Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

/* Kernel module implementing an IP set type: the hash:net type */

#include <linux/jhash.h>
#include <linux/module.h>
#include <linux/ip.h>
#include <linux/skbuff.h>
#include <linux/errno.h>
#include <linux/random.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/netlink.h>

#include <linux/netfilter.h>
#include <linux/netfilter/ipset/pfxlen.h>
#include <linux/netfilter/ipset/ip_set.h>
#include <linux/netfilter/ipset/ip_set_hash.h>

#define IPSET_TYPE_REV_MIN	0
#define IPSET_TYPE_REV_MAX	1	/* Forceadd support added */

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>");
IP_SET_MODULE_DESC("hash:net,net", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
MODULE_ALIAS("ip_set_hash:net,net");

/* Type specific function prefix */
#define HTYPE		hash_netnet
#define IP_SET_HASH_WITH_NETS
#define IPSET_NET_COUNT 2

/* IPv4 variants */

/* Member elements  */
struct hash_netnet4_elem {
	union {
		__be32 ip[2];
		__be64 ipcmp;
	};
	u8 nomatch;
	union {
		u8 cidr[2];
		u16 ccmp;
	};
};

/* Common functions */

static inline bool
hash_netnet4_data_equal(const struct hash_netnet4_elem *ip1,
		     const struct hash_netnet4_elem *ip2,
		     u32 *multi)
{
	return ip1->ipcmp == ip2->ipcmp &&
	       ip1->ccmp == ip2->ccmp;
}

static inline int
hash_netnet4_do_data_match(const struct hash_netnet4_elem *elem)
{
	return elem->nomatch ? -ENOTEMPTY : 1;
}

static inline void
hash_netnet4_data_set_flags(struct hash_netnet4_elem *elem, u32 flags)
{
	elem->nomatch = (flags >> 16) & IPSET_FLAG_NOMATCH;
}

static inline void
hash_netnet4_data_reset_flags(struct hash_netnet4_elem *elem, u8 *flags)
{
	swap(*flags, elem->nomatch);
}

static inline void
hash_netnet4_data_reset_elem(struct hash_netnet4_elem *elem,
			  struct hash_netnet4_elem *orig)
{
	elem->ip[1] = orig->ip[1];
}

static inline void
hash_netnet4_data_netmask(struct hash_netnet4_elem *elem, u8 cidr, bool inner)
{
	if (inner) {
		elem->ip[1] &= ip_set_netmask(cidr);
		elem->cidr[1] = cidr;
	} else {
		elem->ip[0] &= ip_set_netmask(cidr);
		elem->cidr[0] = cidr;
	}
}

static bool
hash_netnet4_data_list(struct sk_buff *skb,
		    const struct hash_netnet4_elem *data)
{
	u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;

	if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip[0]) ||
	    nla_put_ipaddr4(skb, IPSET_ATTR_IP2, data->ip[1]) ||
	    nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr[0]) ||
	    nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr[1]) ||
	    (flags &&
	     nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
		goto nla_put_failure;
	return false;

nla_put_failure:
	return true;
}

static inline void
hash_netnet4_data_next(struct hash_netnet4_elem *next,
		    const struct hash_netnet4_elem *d)
{
	next->ipcmp = d->ipcmp;
}

#define MTYPE		hash_netnet4
#define PF		4
#define HOST_MASK	32
#include "ip_set_hash_gen.h"

static int
hash_netnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
	       const struct xt_action_param *par,
	       enum ipset_adt adt, struct ip_set_adt_opt *opt)
{
	const struct hash_netnet *h = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_netnet4_elem e = { };
	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);

	e.cidr[0] = IP_SET_INIT_CIDR(h->nets[0].cidr[0], HOST_MASK);
	e.cidr[1] = IP_SET_INIT_CIDR(h->nets[0].cidr[1], HOST_MASK);
	if (adt == IPSET_TEST)
		e.ccmp = (HOST_MASK << (sizeof(e.cidr[0]) * 8)) | HOST_MASK;

	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip[0]);
	ip4addrptr(skb, opt->flags & IPSET_DIM_TWO_SRC, &e.ip[1]);
	e.ip[0] &= ip_set_netmask(e.cidr[0]);
	e.ip[1] &= ip_set_netmask(e.cidr[1]);

	return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
}

static int
hash_netnet4_uadt(struct ip_set *set, struct nlattr *tb[],
	       enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
{
	const struct hash_netnet *h = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_netnet4_elem e = { };
	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
	u32 ip = 0, ip_to = 0, last;
	u32 ip2 = 0, ip2_from = 0, ip2_to = 0, last2;
	u8 cidr, cidr2;
	int ret;

	e.cidr[0] = e.cidr[1] = HOST_MASK;
	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES)))
		return -IPSET_ERR_PROTOCOL;

	if (tb[IPSET_ATTR_LINENO])
		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);

	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip) ||
	      ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2], &ip2_from) ||
	      ip_set_get_extensions(set, tb, &ext);
	if (ret)
		return ret;

	if (tb[IPSET_ATTR_CIDR]) {
		cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
		if (!cidr || cidr > HOST_MASK)
			return -IPSET_ERR_INVALID_CIDR;
		e.cidr[0] = cidr;
	}

	if (tb[IPSET_ATTR_CIDR2]) {
		cidr2 = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
		if (!cidr2 || cidr2 > HOST_MASK)
			return -IPSET_ERR_INVALID_CIDR;
		e.cidr[1] = cidr2;
	}

	if (tb[IPSET_ATTR_CADT_FLAGS]) {
		u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
		if (cadt_flags & IPSET_FLAG_NOMATCH)
			flags |= (IPSET_FLAG_NOMATCH << 16);
	}

	if (adt == IPSET_TEST || !(tb[IPSET_ATTR_IP_TO] &&
				   tb[IPSET_ATTR_IP2_TO])) {
		e.ip[0] = htonl(ip & ip_set_hostmask(e.cidr[0]));
		e.ip[1] = htonl(ip2_from & ip_set_hostmask(e.cidr[1]));
		ret = adtfn(set, &e, &ext, &ext, flags);
		return ip_set_enomatch(ret, flags, adt, set) ? -ret :
		       ip_set_eexist(ret, flags) ? 0 : ret;
	}

	ip_to = ip;
	if (tb[IPSET_ATTR_IP_TO]) {
		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
		if (ret)
			return ret;
		if (ip_to < ip)
			swap(ip, ip_to);
		if (ip + UINT_MAX == ip_to)
			return -IPSET_ERR_HASH_RANGE;
	}

	ip2_to = ip2_from;
	if (tb[IPSET_ATTR_IP2_TO]) {
		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2_TO], &ip2_to);
		if (ret)
			return ret;
		if (ip2_to < ip2_from)
			swap(ip2_from, ip2_to);
		if (ip2_from + UINT_MAX == ip2_to)
			return -IPSET_ERR_HASH_RANGE;

	}

	if (retried)
		ip = ntohl(h->next.ip[0]);

	while (!after(ip, ip_to)) {
		e.ip[0] = htonl(ip);
		last = ip_set_range_to_cidr(ip, ip_to, &cidr);
		e.cidr[0] = cidr;
		ip2 = (retried &&
		       ip == ntohl(h->next.ip[0])) ? ntohl(h->next.ip[1])
						   : ip2_from;
		while (!after(ip2, ip2_to)) {
			e.ip[1] = htonl(ip2);
			last2 = ip_set_range_to_cidr(ip2, ip2_to, &cidr2);
			e.cidr[1] = cidr2;
			ret = adtfn(set, &e, &ext, &ext, flags);
			if (ret && !ip_set_eexist(ret, flags))
				return ret;
			else
				ret = 0;
			ip2 = last2 + 1;
		}
		ip = last + 1;
	}
	return ret;
}

/* IPv6 variants */

struct hash_netnet6_elem {
	union nf_inet_addr ip[2];
	u8 nomatch;
	union {
		u8 cidr[2];
		u16 ccmp;
	};
};

/* Common functions */

static inline bool
hash_netnet6_data_equal(const struct hash_netnet6_elem *ip1,
		     const struct hash_netnet6_elem *ip2,
		     u32 *multi)
{
	return ipv6_addr_equal(&ip1->ip[0].in6, &ip2->ip[0].in6) &&
	       ipv6_addr_equal(&ip1->ip[1].in6, &ip2->ip[1].in6) &&
	       ip1->ccmp == ip2->ccmp;
}

static inline int
hash_netnet6_do_data_match(const struct hash_netnet6_elem *elem)
{
	return elem->nomatch ? -ENOTEMPTY : 1;
}

static inline void
hash_netnet6_data_set_flags(struct hash_netnet6_elem *elem, u32 flags)
{
	elem->nomatch = (flags >> 16) & IPSET_FLAG_NOMATCH;
}

static inline void
hash_netnet6_data_reset_flags(struct hash_netnet6_elem *elem, u8 *flags)
{
	swap(*flags, elem->nomatch);
}

static inline void
hash_netnet6_data_reset_elem(struct hash_netnet6_elem *elem,
			  struct hash_netnet6_elem *orig)
{
	elem->ip[1] = orig->ip[1];
}

static inline void
hash_netnet6_data_netmask(struct hash_netnet6_elem *elem, u8 cidr, bool inner)
{
	if (inner) {
		ip6_netmask(&elem->ip[1], cidr);
		elem->cidr[1] = cidr;
	} else {
		ip6_netmask(&elem->ip[0], cidr);
		elem->cidr[0] = cidr;
	}
}

static bool
hash_netnet6_data_list(struct sk_buff *skb,
		    const struct hash_netnet6_elem *data)
{
	u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;

	if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip[0].in6) ||
	    nla_put_ipaddr6(skb, IPSET_ATTR_IP2, &data->ip[1].in6) ||
	    nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr[0]) ||
	    nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr[1]) ||
	    (flags &&
	     nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
		goto nla_put_failure;
	return false;

nla_put_failure:
	return true;
}

static inline void
hash_netnet6_data_next(struct hash_netnet4_elem *next,
		    const struct hash_netnet6_elem *d)
{
}

#undef MTYPE
#undef PF
#undef HOST_MASK

#define MTYPE		hash_netnet6
#define PF		6
#define HOST_MASK	128
#define IP_SET_EMIT_CREATE
#include "ip_set_hash_gen.h"

static int
hash_netnet6_kadt(struct ip_set *set, const struct sk_buff *skb,
	       const struct xt_action_param *par,
	       enum ipset_adt adt, struct ip_set_adt_opt *opt)
{
	const struct hash_netnet *h = set->data;
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_netnet6_elem e = { };
	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);

	e.cidr[0] = IP_SET_INIT_CIDR(h->nets[0].cidr[0], HOST_MASK);
	e.cidr[1] = IP_SET_INIT_CIDR(h->nets[0].cidr[1], HOST_MASK);
	if (adt == IPSET_TEST)
		e.ccmp = (HOST_MASK << (sizeof(u8)*8)) | HOST_MASK;

	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip[0].in6);
	ip6addrptr(skb, opt->flags & IPSET_DIM_TWO_SRC, &e.ip[1].in6);
	ip6_netmask(&e.ip[0], e.cidr[0]);
	ip6_netmask(&e.ip[1], e.cidr[1]);

	return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
}

static int
hash_netnet6_uadt(struct ip_set *set, struct nlattr *tb[],
	       enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
{
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_netnet6_elem e = { };
	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
	int ret;

	e.cidr[0] = e.cidr[1] = HOST_MASK;
	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES)))
		return -IPSET_ERR_PROTOCOL;
	if (unlikely(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_IP2_TO]))
		return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;

	if (tb[IPSET_ATTR_LINENO])
		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);

	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip[0]) ||
	      ip_set_get_ipaddr6(tb[IPSET_ATTR_IP2], &e.ip[1]) ||
	      ip_set_get_extensions(set, tb, &ext);
	if (ret)
		return ret;

	if (tb[IPSET_ATTR_CIDR])
		e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);

	if (tb[IPSET_ATTR_CIDR2])
		e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);

	if (!e.cidr[0] || e.cidr[0] > HOST_MASK || !e.cidr[1] ||
	    e.cidr[1] > HOST_MASK)
		return -IPSET_ERR_INVALID_CIDR;

	ip6_netmask(&e.ip[0], e.cidr[0]);
	ip6_netmask(&e.ip[1], e.cidr[1]);

	if (tb[IPSET_ATTR_CADT_FLAGS]) {
		u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
		if (cadt_flags & IPSET_FLAG_NOMATCH)
			flags |= (IPSET_FLAG_NOMATCH << 16);
	}

	ret = adtfn(set, &e, &ext, &ext, flags);

	return ip_set_enomatch(ret, flags, adt, set) ? -ret :
	       ip_set_eexist(ret, flags) ? 0 : ret;
}

static struct ip_set_type hash_netnet_type __read_mostly = {
	.name		= "hash:net,net",
	.protocol	= IPSET_PROTOCOL,
	.features	= IPSET_TYPE_IP | IPSET_TYPE_IP2 | IPSET_TYPE_NOMATCH,
	.dimension	= IPSET_DIM_TWO,
	.family		= NFPROTO_UNSPEC,
	.revision_min	= IPSET_TYPE_REV_MIN,
	.revision_max	= IPSET_TYPE_REV_MAX,
	.create		= hash_netnet_create,
	.create_policy	= {
		[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
		[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
		[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
		[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
		[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },
	},
	.adt_policy	= {
		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
		[IPSET_ATTR_IP2]	= { .type = NLA_NESTED },
		[IPSET_ATTR_IP2_TO]	= { .type = NLA_NESTED },
		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
		[IPSET_ATTR_CIDR2]	= { .type = NLA_U8 },
		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
		[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },
		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },
		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },
		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING },
	},
	.me		= THIS_MODULE,
};

static int __init
hash_netnet_init(void)
{
	return ip_set_type_register(&hash_netnet_type);
}

static void __exit
hash_netnet_fini(void)
{
	ip_set_type_unregister(&hash_netnet_type);
}

module_init(hash_netnet_init);
module_exit(hash_netnet_fini);
Commit	Line	Data
ea53ac5b OS	1	/* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
	2	* Copyright (C) 2013 Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
	8
	9	/* Kernel module implementing an IP set type: the hash:net type */
	10
	11	#include <linux/jhash.h>
	12	#include <linux/module.h>
	13	#include <linux/ip.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/errno.h>
	16	#include <linux/random.h>
	17	#include <net/ip.h>
	18	#include <net/ipv6.h>
	19	#include <net/netlink.h>
	20
	21	#include <linux/netfilter.h>
	22	#include <linux/netfilter/ipset/pfxlen.h>
	23	#include <linux/netfilter/ipset/ip_set.h>
	24	#include <linux/netfilter/ipset/ip_set_hash.h>
	25
	26	#define IPSET_TYPE_REV_MIN 0
07cf8f5a	27	#define IPSET_TYPE_REV_MAX 1 /* Forceadd support added */
ea53ac5b OS	28
	29	MODULE_LICENSE("GPL");
	30	MODULE_AUTHOR("Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>");
	31	IP_SET_MODULE_DESC("hash:net,net", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
	32	MODULE_ALIAS("ip_set_hash:net,net");
	33
	34	/* Type specific function prefix */
	35	#define HTYPE hash_netnet
	36	#define IP_SET_HASH_WITH_NETS
	37	#define IPSET_NET_COUNT 2
	38
	39	/* IPv4 variants */
	40
	41	/* Member elements */
	42	struct hash_netnet4_elem {
	43	union {
	44	__be32 ip[2];
	45	__be64 ipcmp;
	46	};
	47	u8 nomatch;
	48	union {
	49	u8 cidr[2];
	50	u16 ccmp;
	51	};
	52	};
	53
	54	/* Common functions */
	55
	56	static inline bool
	57	hash_netnet4_data_equal(const struct hash_netnet4_elem *ip1,
	58	const struct hash_netnet4_elem *ip2,
	59	u32 *multi)
	60	{
	61	return ip1->ipcmp == ip2->ipcmp &&
b49faea7	62	ip1->ccmp == ip2->ccmp;
ea53ac5b OS	63	}
	64
	65	static inline int
	66	hash_netnet4_do_data_match(const struct hash_netnet4_elem *elem)
	67	{
	68	return elem->nomatch ? -ENOTEMPTY : 1;
	69	}
	70
	71	static inline void
	72	hash_netnet4_data_set_flags(struct hash_netnet4_elem *elem, u32 flags)
	73	{
	74	elem->nomatch = (flags >> 16) & IPSET_FLAG_NOMATCH;
	75	}
	76
	77	static inline void
	78	hash_netnet4_data_reset_flags(struct hash_netnet4_elem elem, u8 flags)
	79	{
	80	swap(*flags, elem->nomatch);
	81	}
	82
	83	static inline void
	84	hash_netnet4_data_reset_elem(struct hash_netnet4_elem *elem,
	85	struct hash_netnet4_elem *orig)
	86	{
	87	elem->ip[1] = orig->ip[1];
	88	}
	89
	90	static inline void
	91	hash_netnet4_data_netmask(struct hash_netnet4_elem *elem, u8 cidr, bool inner)
	92	{
	93	if (inner) {
	94	elem->ip[1] &= ip_set_netmask(cidr);
	95	elem->cidr[1] = cidr;
	96	} else {
	97	elem->ip[0] &= ip_set_netmask(cidr);
	98	elem->cidr[0] = cidr;
	99	}
	100	}
	101
	102	static bool
	103	hash_netnet4_data_list(struct sk_buff *skb,
	104	const struct hash_netnet4_elem *data)
	105	{
	106	u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
	107
	108	if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip[0]) \|\|
	109	nla_put_ipaddr4(skb, IPSET_ATTR_IP2, data->ip[1]) \|\|
	110	nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr[0]) \|\|
	111	nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr[1]) \|\|
	112	(flags &&
	113	nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
	114	goto nla_put_failure;
9562cf28	115	return false;
ea53ac5b OS	116
ea53ac5b OS	117	nla_put_failure:
9562cf28	118	return true;
ea53ac5b OS	119	}
	120
	121	static inline void
	122	hash_netnet4_data_next(struct hash_netnet4_elem *next,
	123	const struct hash_netnet4_elem *d)
	124	{
	125	next->ipcmp = d->ipcmp;
	126	}
	127
	128	#define MTYPE hash_netnet4
	129	#define PF 4
	130	#define HOST_MASK 32
	131	#include "ip_set_hash_gen.h"
	132
	133	static int
	134	hash_netnet4_kadt(struct ip_set set, const struct sk_buff skb,
	135	const struct xt_action_param *par,
	136	enum ipset_adt adt, struct ip_set_adt_opt *opt)
	137	{
	138	const struct hash_netnet *h = set->data;
	139	ipset_adtfn adtfn = set->variant->adt[adt];
1a869205	140	struct hash_netnet4_elem e = { };
ea53ac5b OS	141	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
ea53ac5b OS	142
1a869205 JK	143	e.cidr[0] = IP_SET_INIT_CIDR(h->nets[0].cidr[0], HOST_MASK);
1a869205 JK	144	e.cidr[1] = IP_SET_INIT_CIDR(h->nets[0].cidr[1], HOST_MASK);
ea53ac5b OS	145	if (adt == IPSET_TEST)
	146	e.ccmp = (HOST_MASK << (sizeof(e.cidr[0]) * 8)) \| HOST_MASK;
	147
	148	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip[0]);
	149	ip4addrptr(skb, opt->flags & IPSET_DIM_TWO_SRC, &e.ip[1]);
	150	e.ip[0] &= ip_set_netmask(e.cidr[0]);
	151	e.ip[1] &= ip_set_netmask(e.cidr[1]);
	152
	153	return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
	154	}
	155
	156	static int
	157	hash_netnet4_uadt(struct ip_set set, struct nlattr tb[],
	158	enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
	159	{
	160	const struct hash_netnet *h = set->data;
	161	ipset_adtfn adtfn = set->variant->adt[adt];
1a869205	162	struct hash_netnet4_elem e = { };
ea53ac5b OS	163	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
	164	u32 ip = 0, ip_to = 0, last;
	165	u32 ip2 = 0, ip2_from = 0, ip2_to = 0, last2;
	166	u8 cidr, cidr2;
	167	int ret;
	168
1a869205	169	e.cidr[0] = e.cidr[1] = HOST_MASK;
ea53ac5b OS	170	if (unlikely(!tb[IPSET_ATTR_IP] \|\| !tb[IPSET_ATTR_IP2] \|\|
	171	!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) \|\|
	172	!ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS) \|\|
	173	!ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) \|\|
	174	!ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES)))
	175	return -IPSET_ERR_PROTOCOL;
	176
	177	if (tb[IPSET_ATTR_LINENO])
	178	*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
	179
	180	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip) \|\|
	181	ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2], &ip2_from) \|\|
	182	ip_set_get_extensions(set, tb, &ext);
	183	if (ret)
	184	return ret;
	185
	186	if (tb[IPSET_ATTR_CIDR]) {
	187	cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
	188	if (!cidr \|\| cidr > HOST_MASK)
	189	return -IPSET_ERR_INVALID_CIDR;
	190	e.cidr[0] = cidr;
	191	}
	192
	193	if (tb[IPSET_ATTR_CIDR2]) {
	194	cidr2 = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
	195	if (!cidr2 \|\| cidr2 > HOST_MASK)
	196	return -IPSET_ERR_INVALID_CIDR;
	197	e.cidr[1] = cidr2;
	198	}
	199
	200	if (tb[IPSET_ATTR_CADT_FLAGS]) {
	201	u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
	202	if (cadt_flags & IPSET_FLAG_NOMATCH)
	203	flags \|= (IPSET_FLAG_NOMATCH << 16);
	204	}
	205
	206	if (adt == IPSET_TEST \|\| !(tb[IPSET_ATTR_IP_TO] &&
	207	tb[IPSET_ATTR_IP2_TO])) {
	208	e.ip[0] = htonl(ip & ip_set_hostmask(e.cidr[0]));
	209	e.ip[1] = htonl(ip2_from & ip_set_hostmask(e.cidr[1]));
	210	ret = adtfn(set, &e, &ext, &ext, flags);
	211	return ip_set_enomatch(ret, flags, adt, set) ? -ret :
	212	ip_set_eexist(ret, flags) ? 0 : ret;
	213	}
	214
	215	ip_to = ip;
	216	if (tb[IPSET_ATTR_IP_TO]) {
	217	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
	218	if (ret)
	219	return ret;
	220	if (ip_to < ip)
	221	swap(ip, ip_to);
	222	if (ip + UINT_MAX == ip_to)
	223	return -IPSET_ERR_HASH_RANGE;
	224	}
	225
	226	ip2_to = ip2_from;
	227	if (tb[IPSET_ATTR_IP2_TO]) {
	228	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2_TO], &ip2_to);
	229	if (ret)
	230	return ret;
	231	if (ip2_to < ip2_from)
	232	swap(ip2_from, ip2_to);
	233	if (ip2_from + UINT_MAX == ip2_to)
234	return -IPSET_ERR_HASH_RANGE;
235
236	}
237
238	if (retried)
239	ip = ntohl(h->next.ip[0]);
240
241	while (!after(ip, ip_to)) {
242	e.ip[0] = htonl(ip);
243	last = ip_set_range_to_cidr(ip, ip_to, &cidr);
244	e.cidr[0] = cidr;
245	ip2 = (retried &&
246	ip == ntohl(h->next.ip[0])) ? ntohl(h->next.ip[1])
247	: ip2_from;
248	while (!after(ip2, ip2_to)) {
249	e.ip[1] = htonl(ip2);
250	last2 = ip_set_range_to_cidr(ip2, ip2_to, &cidr2);
251	e.cidr[1] = cidr2;
252	ret = adtfn(set, &e, &ext, &ext, flags);
253	if (ret && !ip_set_eexist(ret, flags))
254	return ret;
255	else
256	ret = 0;
257	ip2 = last2 + 1;
258	}
259	ip = last + 1;
260	}
261	return ret;
262	}
263
264	/* IPv6 variants */
265
266	struct hash_netnet6_elem {
267	union nf_inet_addr ip[2];
268	u8 nomatch;
269	union {
270	u8 cidr[2];
271	u16 ccmp;
272	};
273	};
274
275	/* Common functions */
276
277	static inline bool
278	hash_netnet6_data_equal(const struct hash_netnet6_elem *ip1,
279	const struct hash_netnet6_elem *ip2,
280	u32 *multi)
281	{
282	return ipv6_addr_equal(&ip1->ip[0].in6, &ip2->ip[0].in6) &&
283	ipv6_addr_equal(&ip1->ip[1].in6, &ip2->ip[1].in6) &&
284	ip1->ccmp == ip2->ccmp;
285	}
286
287	static inline int
288	hash_netnet6_do_data_match(const struct hash_netnet6_elem *elem)
289	{
290	return elem->nomatch ? -ENOTEMPTY : 1;
291	}
292
293	static inline void
294	hash_netnet6_data_set_flags(struct hash_netnet6_elem *elem, u32 flags)
295	{
296	elem->nomatch = (flags >> 16) & IPSET_FLAG_NOMATCH;
297	}
298
299	static inline void
300	hash_netnet6_data_reset_flags(struct hash_netnet6_elem elem, u8 flags)
301	{
302	swap(*flags, elem->nomatch);
303	}
304
305	static inline void
306	hash_netnet6_data_reset_elem(struct hash_netnet6_elem *elem,
307	struct hash_netnet6_elem *orig)
308	{
309	elem->ip[1] = orig->ip[1];
310	}
311
312	static inline void
313	hash_netnet6_data_netmask(struct hash_netnet6_elem *elem, u8 cidr, bool inner)
314	{
315	if (inner) {
316	ip6_netmask(&elem->ip[1], cidr);
317	elem->cidr[1] = cidr;
318	} else {
319	ip6_netmask(&elem->ip[0], cidr);
320	elem->cidr[0] = cidr;
321	}
322	}
323
324	static bool
325	hash_netnet6_data_list(struct sk_buff *skb,
326	const struct hash_netnet6_elem *data)
327	{
328	u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
329
330	if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip[0].in6) \|\|
331	nla_put_ipaddr6(skb, IPSET_ATTR_IP2, &data->ip[1].in6) \|\|
332	nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr[0]) \|\|
333	nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr[1]) \|\|
334	(flags &&
335	nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
336	goto nla_put_failure;
9562cf28	337	return false;
ea53ac5b OS	338
ea53ac5b OS	339	nla_put_failure:
9562cf28	340	return true;
ea53ac5b OS	341	}
	342
	343	static inline void
	344	hash_netnet6_data_next(struct hash_netnet4_elem *next,
	345	const struct hash_netnet6_elem *d)
	346	{
	347	}
	348
	349	#undef MTYPE
	350	#undef PF
	351	#undef HOST_MASK
	352
	353	#define MTYPE hash_netnet6
	354	#define PF 6
	355	#define HOST_MASK 128
	356	#define IP_SET_EMIT_CREATE
	357	#include "ip_set_hash_gen.h"
	358
	359	static int
	360	hash_netnet6_kadt(struct ip_set set, const struct sk_buff skb,
	361	const struct xt_action_param *par,
	362	enum ipset_adt adt, struct ip_set_adt_opt *opt)
	363	{
	364	const struct hash_netnet *h = set->data;
	365	ipset_adtfn adtfn = set->variant->adt[adt];
1a869205	366	struct hash_netnet6_elem e = { };
ea53ac5b OS	367	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
ea53ac5b OS	368
1a869205 JK	369	e.cidr[0] = IP_SET_INIT_CIDR(h->nets[0].cidr[0], HOST_MASK);
1a869205 JK	370	e.cidr[1] = IP_SET_INIT_CIDR(h->nets[0].cidr[1], HOST_MASK);
ea53ac5b OS	371	if (adt == IPSET_TEST)
	372	e.ccmp = (HOST_MASK << (sizeof(u8)*8)) \| HOST_MASK;
	373
	374	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip[0].in6);
	375	ip6addrptr(skb, opt->flags & IPSET_DIM_TWO_SRC, &e.ip[1].in6);
	376	ip6_netmask(&e.ip[0], e.cidr[0]);
	377	ip6_netmask(&e.ip[1], e.cidr[1]);
	378
	379	return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
	380	}
	381
	382	static int
	383	hash_netnet6_uadt(struct ip_set set, struct nlattr tb[],
	384	enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
	385	{
	386	ipset_adtfn adtfn = set->variant->adt[adt];
1a869205	387	struct hash_netnet6_elem e = { };
ea53ac5b OS	388	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
	389	int ret;
	390
1a869205	391	e.cidr[0] = e.cidr[1] = HOST_MASK;
ea53ac5b OS	392	if (unlikely(!tb[IPSET_ATTR_IP] \|\| !tb[IPSET_ATTR_IP2] \|\|
	393	!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) \|\|
	394	!ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS) \|\|
	395	!ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) \|\|
	396	!ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES)))
	397	return -IPSET_ERR_PROTOCOL;
	398	if (unlikely(tb[IPSET_ATTR_IP_TO] \|\| tb[IPSET_ATTR_IP2_TO]))
	399	return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
	400
	401	if (tb[IPSET_ATTR_LINENO])
	402	*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
	403
	404	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip[0]) \|\|
	405	ip_set_get_ipaddr6(tb[IPSET_ATTR_IP2], &e.ip[1]) \|\|
	406	ip_set_get_extensions(set, tb, &ext);
	407	if (ret)
	408	return ret;
	409
	410	if (tb[IPSET_ATTR_CIDR])
	411	e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
	412
	413	if (tb[IPSET_ATTR_CIDR2])
	414	e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
	415
	416	if (!e.cidr[0] \|\| e.cidr[0] > HOST_MASK \|\| !e.cidr[1] \|\|
	417	e.cidr[1] > HOST_MASK)
	418	return -IPSET_ERR_INVALID_CIDR;
	419
	420	ip6_netmask(&e.ip[0], e.cidr[0]);
	421	ip6_netmask(&e.ip[1], e.cidr[1]);
	422
	423	if (tb[IPSET_ATTR_CADT_FLAGS]) {
	424	u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
	425	if (cadt_flags & IPSET_FLAG_NOMATCH)
	426	flags \|= (IPSET_FLAG_NOMATCH << 16);
	427	}
	428
	429	ret = adtfn(set, &e, &ext, &ext, flags);
	430
	431	return ip_set_enomatch(ret, flags, adt, set) ? -ret :
	432	ip_set_eexist(ret, flags) ? 0 : ret;
	433	}
	434
	435	static struct ip_set_type hash_netnet_type __read_mostly = {
	436	.name = "hash:net,net",
	437	.protocol = IPSET_PROTOCOL,
	438	.features = IPSET_TYPE_IP \| IPSET_TYPE_IP2 \| IPSET_TYPE_NOMATCH,
	439	.dimension = IPSET_DIM_TWO,
	440	.family = NFPROTO_UNSPEC,
	441	.revision_min = IPSET_TYPE_REV_MIN,
	442	.revision_max = IPSET_TYPE_REV_MAX,
	443	.create = hash_netnet_create,
	444	.create_policy = {
	445	[IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
	446	[IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
	447	[IPSET_ATTR_PROBES] = { .type = NLA_U8 },
	448	[IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
	449	[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
	450	[IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
	451	},
	452	.adt_policy = {
	453	[IPSET_ATTR_IP] = { .type = NLA_NESTED },
	454	[IPSET_ATTR_IP_TO] = { .type = NLA_NESTED },
	455	[IPSET_ATTR_IP2] = { .type = NLA_NESTED },
456	[IPSET_ATTR_IP2_TO] = { .type = NLA_NESTED },
457	[IPSET_ATTR_CIDR] = { .type = NLA_U8 },
458	[IPSET_ATTR_CIDR2] = { .type = NLA_U8 },
459	[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
460	[IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
461	[IPSET_ATTR_BYTES] = { .type = NLA_U64 },
462	[IPSET_ATTR_PACKETS] = { .type = NLA_U64 },
fda75c6d	463	[IPSET_ATTR_COMMENT] = { .type = NLA_NUL_STRING },
ea53ac5b OS	464	},
	465	.me = THIS_MODULE,
	466	};
	467
	468	static int __init
	469	hash_netnet_init(void)
	470	{
	471	return ip_set_type_register(&hash_netnet_type);
	472	}
	473
	474	static void __exit
	475	hash_netnet_fini(void)
	476	{
	477	ip_set_type_unregister(&hash_netnet_type);
	478	}
	479
	480	module_init(hash_netnet_init);
	481	module_exit(hash_netnet_fini);