lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

netfilter: ipset: add xt_action_param to the variant level kadt functions, ipset API change

Browse Source 
With the change the sets can use any parameter available for the match
and target extensions, like input/output interface. It's required for
the hash:net,iface set type.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
Jozsef Kadlecsik
2011-06-16 18:56:47 +02:00
committed by Patrick McHardy
parent e6146e8684
commit b66554cf03
14 changed files with 43 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
include/linux/netfilter/ipset/ip_set.h
View File

@@ -170,6 +170,7 @@ enum ipset_adt {
#include <linux/ipv6.h> #include <linux/ipv6.h>
#include <linux/netlink.h> #include <linux/netlink.h>
#include <linux/netfilter.h> #include <linux/netfilter.h>
#include <linux/netfilter/x_tables.h>
#include <linux/vmalloc.h> #include <linux/vmalloc.h>
#include <net/netlink.h> #include <net/netlink.h>
@@ -238,6 +239,7 @@ struct ip_set_type_variant {
* zero for no match/success to add/delete * zero for no match/success to add/delete
* positive for matching element */ * positive for matching element */
int (*kadt)(struct ip_set *set, const struct sk_buff * skb, int (*kadt)(struct ip_set *set, const struct sk_buff * skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt); enum ipset_adt adt, const struct ip_set_adt_opt *opt);
/* Userspace: test/add/del entries /* Userspace: test/add/del entries
@@ -332,10 +334,13 @@ extern void ip_set_nfnl_put(ip_set_id_t index);
/* API for iptables set match, and SET target */ /* API for iptables set match, and SET target */
extern int ip_set_add(ip_set_id_t id, const struct sk_buff *skb, extern int ip_set_add(ip_set_id_t id, const struct sk_buff *skb,
const struct xt_action_param *par,
const struct ip_set_adt_opt *opt); const struct ip_set_adt_opt *opt);
extern int ip_set_del(ip_set_id_t id, const struct sk_buff *skb, extern int ip_set_del(ip_set_id_t id, const struct sk_buff *skb,
const struct xt_action_param *par,
const struct ip_set_adt_opt *opt); const struct ip_set_adt_opt *opt);
extern int ip_set_test(ip_set_id_t id, const struct sk_buff *skb, extern int ip_set_test(ip_set_id_t id, const struct sk_buff *skb,
const struct xt_action_param *par,
const struct ip_set_adt_opt *opt); const struct ip_set_adt_opt *opt);
/* Utility functions */ /* Utility functions */

1
include/linux/netfilter/ipset/ip_set_ahash.h
View File

@@ -599,6 +599,7 @@ nla_put_failure:
static int static int
type_pf_kadt(struct ip_set *set, const struct sk_buff * skb, type_pf_kadt(struct ip_set *set, const struct sk_buff * skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt); enum ipset_adt adt, const struct ip_set_adt_opt *opt);
static int static int
type_pf_uadt(struct ip_set *set, struct nlattr *tb[], type_pf_uadt(struct ip_set *set, struct nlattr *tb[],

1
net/netfilter/ipset/ip_set_bitmap_ip.c
View File

@@ -219,6 +219,7 @@ nla_put_failure:
static int static int
bitmap_ip_kadt(struct ip_set *set, const struct sk_buff *skb, bitmap_ip_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
struct bitmap_ip *map = set->data; struct bitmap_ip *map = set->data;

1
net/netfilter/ipset/ip_set_bitmap_ipmac.c
View File

@@ -338,6 +338,7 @@ nla_put_failure:
static int static int
bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb, bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
struct bitmap_ipmac *map = set->data; struct bitmap_ipmac *map = set->data;

1
net/netfilter/ipset/ip_set_bitmap_port.c
View File

@@ -208,6 +208,7 @@ nla_put_failure:
static int static int
bitmap_port_kadt(struct ip_set *set, const struct sk_buff *skb, bitmap_port_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
struct bitmap_port *map = set->data; struct bitmap_port *map = set->data;

12
net/netfilter/ipset/ip_set_core.c
View File

@@ -21,6 +21,7 @@
#include <net/netlink.h> #include <net/netlink.h>
#include <linux/netfilter.h> #include <linux/netfilter.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/nfnetlink.h> #include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/ipset/ip_set.h> #include <linux/netfilter/ipset/ip_set.h>
@@ -328,6 +329,7 @@ __ip_set_put(ip_set_id_t index)
int int
ip_set_test(ip_set_id_t index, const struct sk_buff *skb, ip_set_test(ip_set_id_t index, const struct sk_buff *skb,
const struct xt_action_param *par,
const struct ip_set_adt_opt *opt) const struct ip_set_adt_opt *opt)
{ {
struct ip_set *set = ip_set_list[index]; struct ip_set *set = ip_set_list[index];
@@ -341,14 +343,14 @@ ip_set_test(ip_set_id_t index, const struct sk_buff *skb,
return 0; return 0;
read_lock_bh(&set->lock); read_lock_bh(&set->lock);
ret = set->variant->kadt(set, skb, IPSET_TEST, opt); ret = set->variant->kadt(set, skb, par, IPSET_TEST, opt);
read_unlock_bh(&set->lock); read_unlock_bh(&set->lock);
if (ret == -EAGAIN) { if (ret == -EAGAIN) {
/* Type requests element to be completed */ /* Type requests element to be completed */
pr_debug("element must be competed, ADD is triggered\n"); pr_debug("element must be competed, ADD is triggered\n");
write_lock_bh(&set->lock); write_lock_bh(&set->lock);
set->variant->kadt(set, skb, IPSET_ADD, opt); set->variant->kadt(set, skb, par, IPSET_ADD, opt);
write_unlock_bh(&set->lock); write_unlock_bh(&set->lock);
ret = 1; ret = 1;
} }
@@ -360,6 +362,7 @@ EXPORT_SYMBOL_GPL(ip_set_test);
int int
ip_set_add(ip_set_id_t index, const struct sk_buff *skb, ip_set_add(ip_set_id_t index, const struct sk_buff *skb,
const struct xt_action_param *par,
const struct ip_set_adt_opt *opt) const struct ip_set_adt_opt *opt)
{ {
struct ip_set *set = ip_set_list[index]; struct ip_set *set = ip_set_list[index];
@@ -373,7 +376,7 @@ ip_set_add(ip_set_id_t index, const struct sk_buff *skb,
return 0; return 0;
write_lock_bh(&set->lock); write_lock_bh(&set->lock);
ret = set->variant->kadt(set, skb, IPSET_ADD, opt); ret = set->variant->kadt(set, skb, par, IPSET_ADD, opt);
write_unlock_bh(&set->lock); write_unlock_bh(&set->lock);
return ret; return ret;
@@ -382,6 +385,7 @@ EXPORT_SYMBOL_GPL(ip_set_add);
int int
ip_set_del(ip_set_id_t index, const struct sk_buff *skb, ip_set_del(ip_set_id_t index, const struct sk_buff *skb,
const struct xt_action_param *par,
const struct ip_set_adt_opt *opt) const struct ip_set_adt_opt *opt)
{ {
struct ip_set *set = ip_set_list[index]; struct ip_set *set = ip_set_list[index];
@@ -395,7 +399,7 @@ ip_set_del(ip_set_id_t index, const struct sk_buff *skb,
return 0; return 0;
write_lock_bh(&set->lock); write_lock_bh(&set->lock);
ret = set->variant->kadt(set, skb, IPSET_DEL, opt); ret = set->variant->kadt(set, skb, par, IPSET_DEL, opt);
write_unlock_bh(&set->lock); write_unlock_bh(&set->lock);
return ret; return ret;

2
net/netfilter/ipset/ip_set_hash_ip.c
View File

@@ -116,6 +116,7 @@ hash_ip4_data_next(struct ip_set_hash *h, const struct hash_ip4_elem *d)
static int static int
hash_ip4_kadt(struct ip_set *set, const struct sk_buff *skb, hash_ip4_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
const struct ip_set_hash *h = set->data; const struct ip_set_hash *h = set->data;
@@ -295,6 +296,7 @@ hash_ip6_data_next(struct ip_set_hash *h, const struct hash_ip6_elem *d)
static int static int
hash_ip6_kadt(struct ip_set *set, const struct sk_buff *skb, hash_ip6_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
const struct ip_set_hash *h = set->data; const struct ip_set_hash *h = set->data;

2
net/netfilter/ipset/ip_set_hash_ipport.c
View File

@@ -134,6 +134,7 @@ hash_ipport4_data_next(struct ip_set_hash *h,
static int static int
hash_ipport4_kadt(struct ip_set *set, const struct sk_buff *skb, hash_ipport4_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
const struct ip_set_hash *h = set->data; const struct ip_set_hash *h = set->data;
@@ -348,6 +349,7 @@ hash_ipport6_data_next(struct ip_set_hash *h,
static int static int
hash_ipport6_kadt(struct ip_set *set, const struct sk_buff *skb, hash_ipport6_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
const struct ip_set_hash *h = set->data; const struct ip_set_hash *h = set->data;

2
net/netfilter/ipset/ip_set_hash_ipportip.c
View File

@@ -137,6 +137,7 @@ hash_ipportip4_data_next(struct ip_set_hash *h,
static int static int
hash_ipportip4_kadt(struct ip_set *set, const struct sk_buff *skb, hash_ipportip4_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
const struct ip_set_hash *h = set->data; const struct ip_set_hash *h = set->data;
@@ -361,6 +362,7 @@ hash_ipportip6_data_next(struct ip_set_hash *h,
static int static int
hash_ipportip6_kadt(struct ip_set *set, const struct sk_buff *skb, hash_ipportip6_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
const struct ip_set_hash *h = set->data; const struct ip_set_hash *h = set->data;

2
net/netfilter/ipset/ip_set_hash_ipportnet.c
View File

@@ -151,6 +151,7 @@ hash_ipportnet4_data_next(struct ip_set_hash *h,
static int static int
hash_ipportnet4_kadt(struct ip_set *set, const struct sk_buff *skb, hash_ipportnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
const struct ip_set_hash *h = set->data; const struct ip_set_hash *h = set->data;
@@ -428,6 +429,7 @@ hash_ipportnet6_data_next(struct ip_set_hash *h,
static int static int
hash_ipportnet6_kadt(struct ip_set *set, const struct sk_buff *skb, hash_ipportnet6_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
const struct ip_set_hash *h = set->data; const struct ip_set_hash *h = set->data;

2
net/netfilter/ipset/ip_set_hash_net.c
View File

@@ -134,6 +134,7 @@ hash_net4_data_next(struct ip_set_hash *h,
static int static int
hash_net4_kadt(struct ip_set *set, const struct sk_buff *skb, hash_net4_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
const struct ip_set_hash *h = set->data; const struct ip_set_hash *h = set->data;
@@ -330,6 +331,7 @@ hash_net6_data_next(struct ip_set_hash *h,
static int static int
hash_net6_kadt(struct ip_set *set, const struct sk_buff *skb, hash_net6_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
const struct ip_set_hash *h = set->data; const struct ip_set_hash *h = set->data;

2
net/netfilter/ipset/ip_set_hash_netport.c
View File

@@ -147,6 +147,7 @@ hash_netport4_data_next(struct ip_set_hash *h,
static int static int
hash_netport4_kadt(struct ip_set *set, const struct sk_buff *skb, hash_netport4_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
const struct ip_set_hash *h = set->data; const struct ip_set_hash *h = set->data;
@@ -390,6 +391,7 @@ hash_netport6_data_next(struct ip_set_hash *h,
static int static int
hash_netport6_kadt(struct ip_set *set, const struct sk_buff *skb, hash_netport6_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
const struct ip_set_hash *h = set->data; const struct ip_set_hash *h = set->data;

7
net/netfilter/ipset/ip_set_list_set.c
View File

@@ -72,6 +72,7 @@ list_set_expired(const struct list_set *map, u32 id)
static int static int
list_set_kadt(struct ip_set *set, const struct sk_buff *skb, list_set_kadt(struct ip_set *set, const struct sk_buff *skb,
const struct xt_action_param *par,
enum ipset_adt adt, const struct ip_set_adt_opt *opt) enum ipset_adt adt, const struct ip_set_adt_opt *opt)
{ {
struct list_set *map = set->data; struct list_set *map = set->data;
@@ -87,17 +88,17 @@ list_set_kadt(struct ip_set *set, const struct sk_buff *skb,
continue; continue;
switch (adt) { switch (adt) {
case IPSET_TEST: case IPSET_TEST:
ret = ip_set_test(elem->id, skb, opt); ret = ip_set_test(elem->id, skb, par, opt);
if (ret > 0) if (ret > 0)
return ret; return ret;
break; break;
case IPSET_ADD: case IPSET_ADD:
ret = ip_set_add(elem->id, skb, opt); ret = ip_set_add(elem->id, skb, par, opt);
if (ret == 0) if (ret == 0)
return ret; return ret;
break; break;
case IPSET_DEL: case IPSET_DEL:
ret = ip_set_del(elem->id, skb, opt); ret = ip_set_del(elem->id, skb, par, opt);
if (ret == 0) if (ret == 0)
return ret; return ret;
break; break;

19
net/netfilter/xt_set.c
View File

@@ -29,9 +29,10 @@ MODULE_ALIAS("ip6t_SET");
static inline int static inline int
match_set(ip_set_id_t index, const struct sk_buff *skb, match_set(ip_set_id_t index, const struct sk_buff *skb,
const struct xt_action_param *par,
const struct ip_set_adt_opt *opt, int inv) const struct ip_set_adt_opt *opt, int inv)
{ {
if (ip_set_test(index, skb, opt)) if (ip_set_test(index, skb, par, opt))
inv = !inv; inv = !inv;
return inv; return inv;
} }
@@ -54,7 +55,7 @@ set_match_v0(const struct sk_buff *skb, struct xt_action_param *par)
ADT_OPT(opt, par->family, info->match_set.u.compat.dim, ADT_OPT(opt, par->family, info->match_set.u.compat.dim,
info->match_set.u.compat.flags, 0, UINT_MAX); info->match_set.u.compat.flags, 0, UINT_MAX);
return match_set(info->match_set.index, skb, &opt, return match_set(info->match_set.index, skb, par, &opt,
info->match_set.u.compat.flags & IPSET_INV_MATCH); info->match_set.u.compat.flags & IPSET_INV_MATCH);
} }
@@ -118,9 +119,9 @@ set_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
info->del_set.u.compat.flags, 0, UINT_MAX); info->del_set.u.compat.flags, 0, UINT_MAX);
if (info->add_set.index != IPSET_INVALID_ID) if (info->add_set.index != IPSET_INVALID_ID)
ip_set_add(info->add_set.index, skb, &add_opt); ip_set_add(info->add_set.index, skb, par, &add_opt);
if (info->del_set.index != IPSET_INVALID_ID) if (info->del_set.index != IPSET_INVALID_ID)
ip_set_del(info->del_set.index, skb, &del_opt); ip_set_del(info->del_set.index, skb, par, &del_opt);
return XT_CONTINUE; return XT_CONTINUE;
} }
@@ -188,7 +189,7 @@ set_match_v1(const struct sk_buff *skb, struct xt_action_param *par)
ADT_OPT(opt, par->family, info->match_set.dim, ADT_OPT(opt, par->family, info->match_set.dim,
info->match_set.flags, 0, UINT_MAX); info->match_set.flags, 0, UINT_MAX);
return match_set(info->match_set.index, skb, &opt, return match_set(info->match_set.index, skb, par, &opt,
info->match_set.flags & IPSET_INV_MATCH); info->match_set.flags & IPSET_INV_MATCH);
} }
@@ -233,9 +234,9 @@ set_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
info->del_set.flags, 0, UINT_MAX); info->del_set.flags, 0, UINT_MAX);
if (info->add_set.index != IPSET_INVALID_ID) if (info->add_set.index != IPSET_INVALID_ID)
ip_set_add(info->add_set.index, skb, &add_opt); ip_set_add(info->add_set.index, skb, par, &add_opt);
if (info->del_set.index != IPSET_INVALID_ID) if (info->del_set.index != IPSET_INVALID_ID)
ip_set_del(info->del_set.index, skb, &del_opt); ip_set_del(info->del_set.index, skb, par, &del_opt);
return XT_CONTINUE; return XT_CONTINUE;
} }
@@ -302,9 +303,9 @@ set_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
info->del_set.flags, 0, UINT_MAX); info->del_set.flags, 0, UINT_MAX);
if (info->add_set.index != IPSET_INVALID_ID) if (info->add_set.index != IPSET_INVALID_ID)
ip_set_add(info->add_set.index, skb, &add_opt); ip_set_add(info->add_set.index, skb, par, &add_opt);
if (info->del_set.index != IPSET_INVALID_ID) if (info->del_set.index != IPSET_INVALID_ID)
ip_set_del(info->del_set.index, skb, &del_opt); ip_set_del(info->del_set.index, skb, par, &del_opt);
return XT_CONTINUE; return XT_CONTINUE;
} }