Linux Kernel  3.7.1
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
ip_set.h
Go to the documentation of this file.
1 /* Copyright (C) 2000-2002 Joakim Axelsson <[email protected]>
2  * Patrick Schaaf <[email protected]>
3  * Martin Josefsson <[email protected]>
4  * Copyright (C) 2003-2011 Jozsef Kadlecsik <[email protected]>
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License version 2 as
8  * published by the Free Software Foundation.
9  */
10 #ifndef _IP_SET_H
11 #define _IP_SET_H
12 
13 #include <linux/ip.h>
14 #include <linux/ipv6.h>
15 #include <linux/netlink.h>
16 #include <linux/netfilter.h>
17 #include <linux/netfilter/x_tables.h>
18 #include <linux/stringify.h>
19 #include <linux/vmalloc.h>
20 #include <net/netlink.h>
22 
23 #define _IP_SET_MODULE_DESC(a, b, c) \
24  MODULE_DESCRIPTION(a " type of IP sets, revisions " b "-" c)
25 #define IP_SET_MODULE_DESC(a, b, c) \
26  _IP_SET_MODULE_DESC(a, __stringify(b), __stringify(c))
27 
28 /* Set features */
44  /* Strictly speaking not a feature, but a flag for dumping:
45  * this settype must be dumped last */
48 };
49 
50 struct ip_set;
51 
52 typedef int (*ipset_adtfn)(struct ip_set *set, void *value,
53  u32 timeout, u32 flags);
54 
55 /* Kernel API function options */
57  u8 family; /* Actual protocol family */
58  u8 dim; /* Dimension of match/target */
59  u8 flags; /* Direction and negation flags */
60  u32 cmdflags; /* Command-like flags */
61  u32 timeout; /* Timeout value */
62 };
63 
64 /* Set type, variant-specific part */
66  /* Kernelspace: test/add/del entries
67  * returns negative error code,
68  * zero for no match/success to add/delete
69  * positive for matching element */
70  int (*kadt)(struct ip_set *set, const struct sk_buff *skb,
71  const struct xt_action_param *par,
72  enum ipset_adt adt, const struct ip_set_adt_opt *opt);
73 
74  /* Userspace: test/add/del entries
75  * returns negative error code,
76  * zero for no match/success to add/delete
77  * positive for matching element */
78  int (*uadt)(struct ip_set *set, struct nlattr *tb[],
79  enum ipset_adt adt, u32 *lineno, u32 flags, bool retried);
80 
81  /* Low level add/del/test functions */
83 
84  /* When adding entries and set is full, try to resize the set */
85  int (*resize)(struct ip_set *set, bool retried);
86  /* Destroy the set */
87  void (*destroy)(struct ip_set *set);
88  /* Flush the elements */
89  void (*flush)(struct ip_set *set);
90  /* Expire entries before listing */
91  void (*expire)(struct ip_set *set);
92  /* List set header data */
93  int (*head)(struct ip_set *set, struct sk_buff *skb);
94  /* List elements */
95  int (*list)(const struct ip_set *set, struct sk_buff *skb,
96  struct netlink_callback *cb);
97 
98  /* Return true if "b" set is the same as "a"
99  * according to the create set parameters */
100  bool (*same_set)(const struct ip_set *a, const struct ip_set *b);
101 };
102 
103 /* The core set type structure */
104 struct ip_set_type {
105  struct list_head list;
106 
107  /* Typename */
109  /* Protocol version */
111  /* Set features to control swapping */
113  /* Set type dimension */
115  /*
116  * Supported family: may be NFPROTO_UNSPEC for both
117  * NFPROTO_IPV4/NFPROTO_IPV6.
118  */
120  /* Type revisions */
122 
123  /* Create set */
124  int (*create)(struct ip_set *set, struct nlattr *tb[], u32 flags);
125 
126  /* Attribute policies */
129 
130  /* Set this to THIS_MODULE if you are a module, otherwise NULL */
131  struct module *me;
132 };
133 
134 /* register and unregister set type */
135 extern int ip_set_type_register(struct ip_set_type *set_type);
136 extern void ip_set_type_unregister(struct ip_set_type *set_type);
137 
138 /* A generic IP set */
139 struct ip_set {
140  /* The name of the set */
142  /* Lock protecting the set data */
144  /* References to the set */
146  /* The core set type */
147  struct ip_set_type *type;
148  /* The type variant doing the real job */
150  /* The actual INET family of the set */
152  /* The type revision */
154  /* The type specific data */
155  void *data;
156 };
157 
158 /* register and unregister set references */
159 extern ip_set_id_t ip_set_get_byname(const char *name, struct ip_set **set);
161 extern const char *ip_set_name_byindex(ip_set_id_t index);
162 extern ip_set_id_t ip_set_nfnl_get(const char *name);
164 extern void ip_set_nfnl_put(ip_set_id_t index);
165 
166 /* API for iptables set match, and SET target */
167 
168 extern int ip_set_add(ip_set_id_t id, const struct sk_buff *skb,
169  const struct xt_action_param *par,
170  const struct ip_set_adt_opt *opt);
171 extern int ip_set_del(ip_set_id_t id, const struct sk_buff *skb,
172  const struct xt_action_param *par,
173  const struct ip_set_adt_opt *opt);
174 extern int ip_set_test(ip_set_id_t id, const struct sk_buff *skb,
175  const struct xt_action_param *par,
176  const struct ip_set_adt_opt *opt);
177 
178 /* Utility functions */
179 extern void *ip_set_alloc(size_t size);
180 extern void ip_set_free(void *members);
181 extern int ip_set_get_ipaddr4(struct nlattr *nla, __be32 *ipaddr);
182 extern int ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr);
183 
184 static inline int
185 ip_set_get_hostipaddr4(struct nlattr *nla, u32 *ipaddr)
186 {
187  __be32 ip;
188  int ret = ip_set_get_ipaddr4(nla, &ip);
189 
190  if (ret)
191  return ret;
192  *ipaddr = ntohl(ip);
193  return 0;
194 }
195 
196 /* Ignore IPSET_ERR_EXIST errors if asked to do so? */
197 static inline bool
198 ip_set_eexist(int ret, u32 flags)
199 {
200  return ret == -IPSET_ERR_EXIST && (flags & IPSET_FLAG_EXIST);
201 }
202 
203 /* Check the NLA_F_NET_BYTEORDER flag */
204 static inline bool
205 ip_set_attr_netorder(struct nlattr *tb[], int type)
206 {
207  return tb[type] && (tb[type]->nla_type & NLA_F_NET_BYTEORDER);
208 }
209 
210 static inline bool
211 ip_set_optattr_netorder(struct nlattr *tb[], int type)
212 {
213  return !tb[type] || (tb[type]->nla_type & NLA_F_NET_BYTEORDER);
214 }
215 
216 /* Useful converters */
217 static inline u32
218 ip_set_get_h32(const struct nlattr *attr)
219 {
220  return ntohl(nla_get_be32(attr));
221 }
222 
223 static inline u16
224 ip_set_get_h16(const struct nlattr *attr)
225 {
226  return ntohs(nla_get_be16(attr));
227 }
228 
229 #define ipset_nest_start(skb, attr) nla_nest_start(skb, attr | NLA_F_NESTED)
230 #define ipset_nest_end(skb, start) nla_nest_end(skb, start)
231 
232 static inline int nla_put_ipaddr4(struct sk_buff *skb, int type, __be32 ipaddr)
233 {
234  struct nlattr *__nested = ipset_nest_start(skb, type);
235  int ret;
236 
237  if (!__nested)
238  return -EMSGSIZE;
239  ret = nla_put_net32(skb, IPSET_ATTR_IPADDR_IPV4, ipaddr);
240  if (!ret)
241  ipset_nest_end(skb, __nested);
242  return ret;
243 }
244 
245 static inline int nla_put_ipaddr6(struct sk_buff *skb, int type,
246  const struct in6_addr *ipaddrptr)
247 {
248  struct nlattr *__nested = ipset_nest_start(skb, type);
249  int ret;
250 
251  if (!__nested)
252  return -EMSGSIZE;
253  ret = nla_put(skb, IPSET_ATTR_IPADDR_IPV6,
254  sizeof(struct in6_addr), ipaddrptr);
255  if (!ret)
256  ipset_nest_end(skb, __nested);
257  return ret;
258 }
259 
260 /* Get address from skbuff */
261 static inline __be32
262 ip4addr(const struct sk_buff *skb, bool src)
263 {
264  return src ? ip_hdr(skb)->saddr : ip_hdr(skb)->daddr;
265 }
266 
267 static inline void
268 ip4addrptr(const struct sk_buff *skb, bool src, __be32 *addr)
269 {
270  *addr = src ? ip_hdr(skb)->saddr : ip_hdr(skb)->daddr;
271 }
272 
273 static inline void
274 ip6addrptr(const struct sk_buff *skb, bool src, struct in6_addr *addr)
275 {
276  memcpy(addr, src ? &ipv6_hdr(skb)->saddr : &ipv6_hdr(skb)->daddr,
277  sizeof(*addr));
278 }
279 
280 /* Calculate the bytes required to store the inclusive range of a-b */
281 static inline int
282 bitmap_bytes(u32 a, u32 b)
283 {
284  return 4 * ((((b - a + 8) / 8) + 3) / 4);
285 }
286 
287 #endif /*_IP_SET_H */