1d2912cb1SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
21c5ba67dSPablo Neira Ayuso /* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@netfilter.org> */
35663bc30SJozsef Kadlecsik
45663bc30SJozsef Kadlecsik /* Kernel module implementing an IP set type: the hash:ip,port,ip type */
55663bc30SJozsef Kadlecsik
65663bc30SJozsef Kadlecsik #include <linux/jhash.h>
75663bc30SJozsef Kadlecsik #include <linux/module.h>
85663bc30SJozsef Kadlecsik #include <linux/ip.h>
95663bc30SJozsef Kadlecsik #include <linux/skbuff.h>
105663bc30SJozsef Kadlecsik #include <linux/errno.h>
115663bc30SJozsef Kadlecsik #include <linux/random.h>
125663bc30SJozsef Kadlecsik #include <net/ip.h>
135663bc30SJozsef Kadlecsik #include <net/ipv6.h>
145663bc30SJozsef Kadlecsik #include <net/netlink.h>
155663bc30SJozsef Kadlecsik #include <net/tcp.h>
165663bc30SJozsef Kadlecsik
175663bc30SJozsef Kadlecsik #include <linux/netfilter.h>
185663bc30SJozsef Kadlecsik #include <linux/netfilter/ipset/pfxlen.h>
195663bc30SJozsef Kadlecsik #include <linux/netfilter/ipset/ip_set.h>
205663bc30SJozsef Kadlecsik #include <linux/netfilter/ipset/ip_set_getport.h>
215663bc30SJozsef Kadlecsik #include <linux/netfilter/ipset/ip_set_hash.h>
225663bc30SJozsef Kadlecsik
2335b8dcf8SJozsef Kadlecsik #define IPSET_TYPE_REV_MIN 0
2400d71b27SJozsef Kadlecsik /* 1 SCTP and UDPLITE support added */
25fda75c6dSOliver Smith /* 2 Counters support added */
2607cf8f5aSJosh Hunt /* 3 Comments support added */
27af331419SAnton Danilov /* 4 Forceadd support added */
28ccf0a4b7SJozsef Kadlecsik /* 5 skbinfo support added */
293976ca10SJozsef Kadlecsik #define IPSET_TYPE_REV_MAX 6 /* bucketsize, initval support added */
3010111a6eSJozsef Kadlecsik
315663bc30SJozsef Kadlecsik MODULE_LICENSE("GPL");
32fe03d474SJozsef Kadlecsik MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
3335b8dcf8SJozsef Kadlecsik IP_SET_MODULE_DESC("hash:ip,port,ip", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
345663bc30SJozsef Kadlecsik MODULE_ALIAS("ip_set_hash:ip,port,ip");
355663bc30SJozsef Kadlecsik
365663bc30SJozsef Kadlecsik /* Type specific function prefix */
375d50e1d8SJozsef Kadlecsik #define HTYPE hash_ipportip
385663bc30SJozsef Kadlecsik
3903c8b234SJozsef Kadlecsik /* IPv4 variant */
405663bc30SJozsef Kadlecsik
415d50e1d8SJozsef Kadlecsik /* Member elements */
425663bc30SJozsef Kadlecsik struct hash_ipportip4_elem {
435663bc30SJozsef Kadlecsik __be32 ip;
445663bc30SJozsef Kadlecsik __be32 ip2;
455663bc30SJozsef Kadlecsik __be16 port;
465663bc30SJozsef Kadlecsik u8 proto;
475663bc30SJozsef Kadlecsik u8 padding;
485663bc30SJozsef Kadlecsik };
495663bc30SJozsef Kadlecsik
508dea982aSJeremy Sowden static bool
hash_ipportip4_data_equal(const struct hash_ipportip4_elem * ip1,const struct hash_ipportip4_elem * ip2,u32 * multi)515663bc30SJozsef Kadlecsik hash_ipportip4_data_equal(const struct hash_ipportip4_elem *ip1,
5289dc79b7SJozsef Kadlecsik const struct hash_ipportip4_elem *ip2,
5389dc79b7SJozsef Kadlecsik u32 *multi)
545663bc30SJozsef Kadlecsik {
555663bc30SJozsef Kadlecsik return ip1->ip == ip2->ip &&
565663bc30SJozsef Kadlecsik ip1->ip2 == ip2->ip2 &&
575663bc30SJozsef Kadlecsik ip1->port == ip2->port &&
585663bc30SJozsef Kadlecsik ip1->proto == ip2->proto;
595663bc30SJozsef Kadlecsik }
605663bc30SJozsef Kadlecsik
615663bc30SJozsef Kadlecsik static bool
hash_ipportip4_data_list(struct sk_buff * skb,const struct hash_ipportip4_elem * data)625663bc30SJozsef Kadlecsik hash_ipportip4_data_list(struct sk_buff *skb,
635663bc30SJozsef Kadlecsik const struct hash_ipportip4_elem *data)
645663bc30SJozsef Kadlecsik {
657cf7899dSDavid S. Miller if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip) ||
667cf7899dSDavid S. Miller nla_put_ipaddr4(skb, IPSET_ATTR_IP2, data->ip2) ||
677cf7899dSDavid S. Miller nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
687cf7899dSDavid S. Miller nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto))
697cf7899dSDavid S. Miller goto nla_put_failure;
70728a7e69SSergey Popovich return false;
715663bc30SJozsef Kadlecsik
725663bc30SJozsef Kadlecsik nla_put_failure:
73728a7e69SSergey Popovich return true;
745663bc30SJozsef Kadlecsik }
755663bc30SJozsef Kadlecsik
768dea982aSJeremy Sowden static void
hash_ipportip4_data_next(struct hash_ipportip4_elem * next,const struct hash_ipportip4_elem * d)775d50e1d8SJozsef Kadlecsik hash_ipportip4_data_next(struct hash_ipportip4_elem *next,
783d14b171SJozsef Kadlecsik const struct hash_ipportip4_elem *d)
793d14b171SJozsef Kadlecsik {
805d50e1d8SJozsef Kadlecsik next->ip = d->ip;
815d50e1d8SJozsef Kadlecsik next->port = d->port;
823d14b171SJozsef Kadlecsik }
833d14b171SJozsef Kadlecsik
845d50e1d8SJozsef Kadlecsik /* Common functions */
855d50e1d8SJozsef Kadlecsik #define MTYPE hash_ipportip4
865d50e1d8SJozsef Kadlecsik #define HOST_MASK 32
875d50e1d8SJozsef Kadlecsik #include "ip_set_hash_gen.h"
885d50e1d8SJozsef Kadlecsik
895663bc30SJozsef Kadlecsik static int
hash_ipportip4_kadt(struct ip_set * set,const struct sk_buff * skb,const struct xt_action_param * par,enum ipset_adt adt,struct ip_set_adt_opt * opt)905663bc30SJozsef Kadlecsik hash_ipportip4_kadt(struct ip_set *set, const struct sk_buff *skb,
91b66554cfSJozsef Kadlecsik const struct xt_action_param *par,
925d50e1d8SJozsef Kadlecsik enum ipset_adt adt, struct ip_set_adt_opt *opt)
935663bc30SJozsef Kadlecsik {
945663bc30SJozsef Kadlecsik ipset_adtfn adtfn = set->variant->adt[adt];
9594729f8aSMark Rustad struct hash_ipportip4_elem e = { .ip = 0 };
96ca134ce8SJozsef Kadlecsik struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
975663bc30SJozsef Kadlecsik
98ac8cc925SJozsef Kadlecsik if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
995d50e1d8SJozsef Kadlecsik &e.port, &e.proto))
1005663bc30SJozsef Kadlecsik return -EINVAL;
1015663bc30SJozsef Kadlecsik
1025d50e1d8SJozsef Kadlecsik ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip);
1035d50e1d8SJozsef Kadlecsik ip4addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &e.ip2);
1045d50e1d8SJozsef Kadlecsik return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
1055663bc30SJozsef Kadlecsik }
1065663bc30SJozsef Kadlecsik
1075663bc30SJozsef Kadlecsik static int
hash_ipportip4_uadt(struct ip_set * set,struct nlattr * tb[],enum ipset_adt adt,u32 * lineno,u32 flags,bool retried)1085663bc30SJozsef Kadlecsik hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[],
1093d14b171SJozsef Kadlecsik enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
1105663bc30SJozsef Kadlecsik {
111*5e29dc36SJozsef Kadlecsik struct hash_ipportip4 *h = set->data;
1125663bc30SJozsef Kadlecsik ipset_adtfn adtfn = set->variant->adt[adt];
11394729f8aSMark Rustad struct hash_ipportip4_elem e = { .ip = 0 };
114ca134ce8SJozsef Kadlecsik struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
115*5e29dc36SJozsef Kadlecsik u32 ip, ip_to = 0, p = 0, port, port_to, i = 0;
1165e0c1eb7SJozsef Kadlecsik bool with_ports = false;
1175663bc30SJozsef Kadlecsik int ret;
1185663bc30SJozsef Kadlecsik
119a212e08eSSergey Popovich if (tb[IPSET_ATTR_LINENO])
120a212e08eSSergey Popovich *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
121a212e08eSSergey Popovich
1225663bc30SJozsef Kadlecsik if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
1235663bc30SJozsef Kadlecsik !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
1247dd37bc8SSergey Popovich !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO)))
1255663bc30SJozsef Kadlecsik return -IPSET_ERR_PROTOCOL;
1265663bc30SJozsef Kadlecsik
1278e55d2e5SSergey Popovich ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP], &e.ip);
1288e55d2e5SSergey Popovich if (ret)
1298e55d2e5SSergey Popovich return ret;
1308e55d2e5SSergey Popovich
1318e55d2e5SSergey Popovich ret = ip_set_get_extensions(set, tb, &ext);
1325663bc30SJozsef Kadlecsik if (ret)
1335663bc30SJozsef Kadlecsik return ret;
1345663bc30SJozsef Kadlecsik
1355d50e1d8SJozsef Kadlecsik ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP2], &e.ip2);
1365663bc30SJozsef Kadlecsik if (ret)
1375663bc30SJozsef Kadlecsik return ret;
1385663bc30SJozsef Kadlecsik
1395d50e1d8SJozsef Kadlecsik e.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
1405663bc30SJozsef Kadlecsik
1415663bc30SJozsef Kadlecsik if (tb[IPSET_ATTR_PROTO]) {
1425d50e1d8SJozsef Kadlecsik e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
1435d50e1d8SJozsef Kadlecsik with_ports = ip_set_proto_with_ports(e.proto);
1445663bc30SJozsef Kadlecsik
1455d50e1d8SJozsef Kadlecsik if (e.proto == 0)
1465663bc30SJozsef Kadlecsik return -IPSET_ERR_INVALID_PROTO;
147ca0f6a5cSJozsef Kadlecsik } else {
1485663bc30SJozsef Kadlecsik return -IPSET_ERR_MISSING_PROTO;
149ca0f6a5cSJozsef Kadlecsik }
1505663bc30SJozsef Kadlecsik
1515d50e1d8SJozsef Kadlecsik if (!(with_ports || e.proto == IPPROTO_ICMP))
1525d50e1d8SJozsef Kadlecsik e.port = 0;
1535663bc30SJozsef Kadlecsik
1545663bc30SJozsef Kadlecsik if (adt == IPSET_TEST ||
1555663bc30SJozsef Kadlecsik !(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_CIDR] ||
1565663bc30SJozsef Kadlecsik tb[IPSET_ATTR_PORT_TO])) {
1575d50e1d8SJozsef Kadlecsik ret = adtfn(set, &e, &ext, &ext, flags);
1585663bc30SJozsef Kadlecsik return ip_set_eexist(ret, flags) ? 0 : ret;
1595663bc30SJozsef Kadlecsik }
1605663bc30SJozsef Kadlecsik
1615d50e1d8SJozsef Kadlecsik ip_to = ip = ntohl(e.ip);
1625663bc30SJozsef Kadlecsik if (tb[IPSET_ATTR_IP_TO]) {
1635663bc30SJozsef Kadlecsik ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
1645663bc30SJozsef Kadlecsik if (ret)
1655663bc30SJozsef Kadlecsik return ret;
1665663bc30SJozsef Kadlecsik if (ip > ip_to)
1675663bc30SJozsef Kadlecsik swap(ip, ip_to);
1685663bc30SJozsef Kadlecsik } else if (tb[IPSET_ATTR_CIDR]) {
1695663bc30SJozsef Kadlecsik u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
1705663bc30SJozsef Kadlecsik
171cabfd139SSergey Popovich if (!cidr || cidr > HOST_MASK)
1725663bc30SJozsef Kadlecsik return -IPSET_ERR_INVALID_CIDR;
173e6146e86SJozsef Kadlecsik ip_set_mask_from_to(ip, ip_to, cidr);
1744fe198e6SJozsef Kadlecsik }
1755663bc30SJozsef Kadlecsik
1765d50e1d8SJozsef Kadlecsik port_to = port = ntohs(e.port);
1775e0c1eb7SJozsef Kadlecsik if (with_ports && tb[IPSET_ATTR_PORT_TO]) {
1785663bc30SJozsef Kadlecsik port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
1795663bc30SJozsef Kadlecsik if (port > port_to)
1805663bc30SJozsef Kadlecsik swap(port, port_to);
1815e0c1eb7SJozsef Kadlecsik }
1825663bc30SJozsef Kadlecsik
1833d14b171SJozsef Kadlecsik if (retried)
1846e27c9b4SJozsef Kadlecsik ip = ntohl(h->next.ip);
18548596a8dSJozsef Kadlecsik for (; ip <= ip_to; ip++) {
1866e27c9b4SJozsef Kadlecsik p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
1876e27c9b4SJozsef Kadlecsik : port;
188*5e29dc36SJozsef Kadlecsik for (; p <= port_to; p++, i++) {
1895d50e1d8SJozsef Kadlecsik e.ip = htonl(ip);
1905d50e1d8SJozsef Kadlecsik e.port = htons(p);
191*5e29dc36SJozsef Kadlecsik if (i > IPSET_MAX_RANGE) {
192*5e29dc36SJozsef Kadlecsik hash_ipportip4_data_next(&h->next, &e);
193*5e29dc36SJozsef Kadlecsik return -ERANGE;
194*5e29dc36SJozsef Kadlecsik }
1955d50e1d8SJozsef Kadlecsik ret = adtfn(set, &e, &ext, &ext, flags);
1965663bc30SJozsef Kadlecsik
1975663bc30SJozsef Kadlecsik if (ret && !ip_set_eexist(ret, flags))
1985663bc30SJozsef Kadlecsik return ret;
199ca0f6a5cSJozsef Kadlecsik
2005663bc30SJozsef Kadlecsik ret = 0;
2015663bc30SJozsef Kadlecsik }
2023d14b171SJozsef Kadlecsik }
2035663bc30SJozsef Kadlecsik return ret;
2045663bc30SJozsef Kadlecsik }
2055663bc30SJozsef Kadlecsik
20603c8b234SJozsef Kadlecsik /* IPv6 variant */
2075663bc30SJozsef Kadlecsik
2085663bc30SJozsef Kadlecsik struct hash_ipportip6_elem {
2095663bc30SJozsef Kadlecsik union nf_inet_addr ip;
2105663bc30SJozsef Kadlecsik union nf_inet_addr ip2;
2115663bc30SJozsef Kadlecsik __be16 port;
2125663bc30SJozsef Kadlecsik u8 proto;
2135663bc30SJozsef Kadlecsik u8 padding;
2145663bc30SJozsef Kadlecsik };
2155663bc30SJozsef Kadlecsik
2165d50e1d8SJozsef Kadlecsik /* Common functions */
2175d50e1d8SJozsef Kadlecsik
2188dea982aSJeremy Sowden static bool
hash_ipportip6_data_equal(const struct hash_ipportip6_elem * ip1,const struct hash_ipportip6_elem * ip2,u32 * multi)2195663bc30SJozsef Kadlecsik hash_ipportip6_data_equal(const struct hash_ipportip6_elem *ip1,
22089dc79b7SJozsef Kadlecsik const struct hash_ipportip6_elem *ip2,
22189dc79b7SJozsef Kadlecsik u32 *multi)
2225663bc30SJozsef Kadlecsik {
22329e3b160SYOSHIFUJI Hideaki / 吉藤英明 return ipv6_addr_equal(&ip1->ip.in6, &ip2->ip.in6) &&
22429e3b160SYOSHIFUJI Hideaki / 吉藤英明 ipv6_addr_equal(&ip1->ip2.in6, &ip2->ip2.in6) &&
2255663bc30SJozsef Kadlecsik ip1->port == ip2->port &&
2265663bc30SJozsef Kadlecsik ip1->proto == ip2->proto;
2275663bc30SJozsef Kadlecsik }
2285663bc30SJozsef Kadlecsik
2295663bc30SJozsef Kadlecsik static bool
hash_ipportip6_data_list(struct sk_buff * skb,const struct hash_ipportip6_elem * data)2305663bc30SJozsef Kadlecsik hash_ipportip6_data_list(struct sk_buff *skb,
2315663bc30SJozsef Kadlecsik const struct hash_ipportip6_elem *data)
2325663bc30SJozsef Kadlecsik {
2337cf7899dSDavid S. Miller if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip.in6) ||
2347cf7899dSDavid S. Miller nla_put_ipaddr6(skb, IPSET_ATTR_IP2, &data->ip2.in6) ||
2357cf7899dSDavid S. Miller nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
2367cf7899dSDavid S. Miller nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto))
2377cf7899dSDavid S. Miller goto nla_put_failure;
238728a7e69SSergey Popovich return false;
2395663bc30SJozsef Kadlecsik
2405663bc30SJozsef Kadlecsik nla_put_failure:
241728a7e69SSergey Popovich return true;
2425663bc30SJozsef Kadlecsik }
2435663bc30SJozsef Kadlecsik
2448dea982aSJeremy Sowden static void
hash_ipportip6_data_next(struct hash_ipportip6_elem * next,const struct hash_ipportip6_elem * d)24521956ab2SJozsef Kadlecsik hash_ipportip6_data_next(struct hash_ipportip6_elem *next,
2465d50e1d8SJozsef Kadlecsik const struct hash_ipportip6_elem *d)
2475663bc30SJozsef Kadlecsik {
2485d50e1d8SJozsef Kadlecsik next->port = d->port;
2495663bc30SJozsef Kadlecsik }
2505663bc30SJozsef Kadlecsik
2515d50e1d8SJozsef Kadlecsik #undef MTYPE
2525663bc30SJozsef Kadlecsik #undef HOST_MASK
2535663bc30SJozsef Kadlecsik
2545d50e1d8SJozsef Kadlecsik #define MTYPE hash_ipportip6
2555663bc30SJozsef Kadlecsik #define HOST_MASK 128
2565d50e1d8SJozsef Kadlecsik #define IP_SET_EMIT_CREATE
2575d50e1d8SJozsef Kadlecsik #include "ip_set_hash_gen.h"
2583d14b171SJozsef Kadlecsik
2595663bc30SJozsef Kadlecsik static int
hash_ipportip6_kadt(struct ip_set * set,const struct sk_buff * skb,const struct xt_action_param * par,enum ipset_adt adt,struct ip_set_adt_opt * opt)2605663bc30SJozsef Kadlecsik hash_ipportip6_kadt(struct ip_set *set, const struct sk_buff *skb,
261b66554cfSJozsef Kadlecsik const struct xt_action_param *par,
2625d50e1d8SJozsef Kadlecsik enum ipset_adt adt, struct ip_set_adt_opt *opt)
2635663bc30SJozsef Kadlecsik {
2645663bc30SJozsef Kadlecsik ipset_adtfn adtfn = set->variant->adt[adt];
26594729f8aSMark Rustad struct hash_ipportip6_elem e = { .ip = { .all = { 0 } } };
266ca134ce8SJozsef Kadlecsik struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
2675663bc30SJozsef Kadlecsik
268ac8cc925SJozsef Kadlecsik if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
2695d50e1d8SJozsef Kadlecsik &e.port, &e.proto))
2705663bc30SJozsef Kadlecsik return -EINVAL;
2715663bc30SJozsef Kadlecsik
2725d50e1d8SJozsef Kadlecsik ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip.in6);
2735d50e1d8SJozsef Kadlecsik ip6addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &e.ip2.in6);
2745d50e1d8SJozsef Kadlecsik return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
2755663bc30SJozsef Kadlecsik }
2765663bc30SJozsef Kadlecsik
2775663bc30SJozsef Kadlecsik static int
hash_ipportip6_uadt(struct ip_set * set,struct nlattr * tb[],enum ipset_adt adt,u32 * lineno,u32 flags,bool retried)2785663bc30SJozsef Kadlecsik hash_ipportip6_uadt(struct ip_set *set, struct nlattr *tb[],
2793d14b171SJozsef Kadlecsik enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
2805663bc30SJozsef Kadlecsik {
28121956ab2SJozsef Kadlecsik const struct hash_ipportip6 *h = set->data;
2825663bc30SJozsef Kadlecsik ipset_adtfn adtfn = set->variant->adt[adt];
28394729f8aSMark Rustad struct hash_ipportip6_elem e = { .ip = { .all = { 0 } } };
284ca134ce8SJozsef Kadlecsik struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
2855663bc30SJozsef Kadlecsik u32 port, port_to;
2865e0c1eb7SJozsef Kadlecsik bool with_ports = false;
2875663bc30SJozsef Kadlecsik int ret;
2885663bc30SJozsef Kadlecsik
289a212e08eSSergey Popovich if (tb[IPSET_ATTR_LINENO])
290a212e08eSSergey Popovich *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
291a212e08eSSergey Popovich
2925663bc30SJozsef Kadlecsik if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
2935663bc30SJozsef Kadlecsik !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
2942c227f27SSergey Popovich !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO)))
2955663bc30SJozsef Kadlecsik return -IPSET_ERR_PROTOCOL;
2962c227f27SSergey Popovich if (unlikely(tb[IPSET_ATTR_IP_TO]))
2972c227f27SSergey Popovich return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
2982c227f27SSergey Popovich if (unlikely(tb[IPSET_ATTR_CIDR])) {
2992c227f27SSergey Popovich u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
3002c227f27SSergey Popovich
3012c227f27SSergey Popovich if (cidr != HOST_MASK)
3022c227f27SSergey Popovich return -IPSET_ERR_INVALID_CIDR;
3032c227f27SSergey Popovich }
3045663bc30SJozsef Kadlecsik
3058e55d2e5SSergey Popovich ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip);
3068e55d2e5SSergey Popovich if (ret)
3078e55d2e5SSergey Popovich return ret;
3088e55d2e5SSergey Popovich
3098e55d2e5SSergey Popovich ret = ip_set_get_extensions(set, tb, &ext);
3105663bc30SJozsef Kadlecsik if (ret)
3115663bc30SJozsef Kadlecsik return ret;
3125663bc30SJozsef Kadlecsik
3135d50e1d8SJozsef Kadlecsik ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP2], &e.ip2);
3145663bc30SJozsef Kadlecsik if (ret)
3155663bc30SJozsef Kadlecsik return ret;
3165663bc30SJozsef Kadlecsik
3175d50e1d8SJozsef Kadlecsik e.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
3185663bc30SJozsef Kadlecsik
3195663bc30SJozsef Kadlecsik if (tb[IPSET_ATTR_PROTO]) {
3205d50e1d8SJozsef Kadlecsik e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
3215d50e1d8SJozsef Kadlecsik with_ports = ip_set_proto_with_ports(e.proto);
3225663bc30SJozsef Kadlecsik
3235d50e1d8SJozsef Kadlecsik if (e.proto == 0)
3245663bc30SJozsef Kadlecsik return -IPSET_ERR_INVALID_PROTO;
325ca0f6a5cSJozsef Kadlecsik } else {
3265663bc30SJozsef Kadlecsik return -IPSET_ERR_MISSING_PROTO;
327ca0f6a5cSJozsef Kadlecsik }
3285663bc30SJozsef Kadlecsik
3295d50e1d8SJozsef Kadlecsik if (!(with_ports || e.proto == IPPROTO_ICMPV6))
3305d50e1d8SJozsef Kadlecsik e.port = 0;
3315663bc30SJozsef Kadlecsik
3325e0c1eb7SJozsef Kadlecsik if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
3335d50e1d8SJozsef Kadlecsik ret = adtfn(set, &e, &ext, &ext, flags);
3345663bc30SJozsef Kadlecsik return ip_set_eexist(ret, flags) ? 0 : ret;
3355663bc30SJozsef Kadlecsik }
3365663bc30SJozsef Kadlecsik
3375d50e1d8SJozsef Kadlecsik port = ntohs(e.port);
3385663bc30SJozsef Kadlecsik port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
3395663bc30SJozsef Kadlecsik if (port > port_to)
3405663bc30SJozsef Kadlecsik swap(port, port_to);
3415663bc30SJozsef Kadlecsik
3423d14b171SJozsef Kadlecsik if (retried)
3436e27c9b4SJozsef Kadlecsik port = ntohs(h->next.port);
3445663bc30SJozsef Kadlecsik for (; port <= port_to; port++) {
3455d50e1d8SJozsef Kadlecsik e.port = htons(port);
3465d50e1d8SJozsef Kadlecsik ret = adtfn(set, &e, &ext, &ext, flags);
3475663bc30SJozsef Kadlecsik
3485663bc30SJozsef Kadlecsik if (ret && !ip_set_eexist(ret, flags))
3495663bc30SJozsef Kadlecsik return ret;
350ca0f6a5cSJozsef Kadlecsik
3515663bc30SJozsef Kadlecsik ret = 0;
3525663bc30SJozsef Kadlecsik }
3535663bc30SJozsef Kadlecsik return ret;
3545663bc30SJozsef Kadlecsik }
3555663bc30SJozsef Kadlecsik
3565663bc30SJozsef Kadlecsik static struct ip_set_type hash_ipportip_type __read_mostly = {
3575663bc30SJozsef Kadlecsik .name = "hash:ip,port,ip",
3585663bc30SJozsef Kadlecsik .protocol = IPSET_PROTOCOL,
3595663bc30SJozsef Kadlecsik .features = IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_TYPE_IP2,
3605663bc30SJozsef Kadlecsik .dimension = IPSET_DIM_THREE,
361c15f1c83SJan Engelhardt .family = NFPROTO_UNSPEC,
36235b8dcf8SJozsef Kadlecsik .revision_min = IPSET_TYPE_REV_MIN,
36335b8dcf8SJozsef Kadlecsik .revision_max = IPSET_TYPE_REV_MAX,
364ccf0a4b7SJozsef Kadlecsik .create_flags[IPSET_TYPE_REV_MAX] = IPSET_CREATE_FLAG_BUCKETSIZE,
3655663bc30SJozsef Kadlecsik .create = hash_ipportip_create,
3665663bc30SJozsef Kadlecsik .create_policy = {
3675663bc30SJozsef Kadlecsik [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
3685663bc30SJozsef Kadlecsik [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
3693976ca10SJozsef Kadlecsik [IPSET_ATTR_INITVAL] = { .type = NLA_U32 },
370ccf0a4b7SJozsef Kadlecsik [IPSET_ATTR_BUCKETSIZE] = { .type = NLA_U8 },
3715663bc30SJozsef Kadlecsik [IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
3725663bc30SJozsef Kadlecsik [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
37300d71b27SJozsef Kadlecsik [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
3745663bc30SJozsef Kadlecsik },
3755663bc30SJozsef Kadlecsik .adt_policy = {
3765663bc30SJozsef Kadlecsik [IPSET_ATTR_IP] = { .type = NLA_NESTED },
3775663bc30SJozsef Kadlecsik [IPSET_ATTR_IP_TO] = { .type = NLA_NESTED },
3785663bc30SJozsef Kadlecsik [IPSET_ATTR_IP2] = { .type = NLA_NESTED },
3795663bc30SJozsef Kadlecsik [IPSET_ATTR_PORT] = { .type = NLA_U16 },
3805663bc30SJozsef Kadlecsik [IPSET_ATTR_PORT_TO] = { .type = NLA_U16 },
3815663bc30SJozsef Kadlecsik [IPSET_ATTR_CIDR] = { .type = NLA_U8 },
3825663bc30SJozsef Kadlecsik [IPSET_ATTR_PROTO] = { .type = NLA_U8 },
3835663bc30SJozsef Kadlecsik [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
3845663bc30SJozsef Kadlecsik [IPSET_ATTR_LINENO] = { .type = NLA_U32 },
38500d71b27SJozsef Kadlecsik [IPSET_ATTR_BYTES] = { .type = NLA_U64 },
38600d71b27SJozsef Kadlecsik [IPSET_ATTR_PACKETS] = { .type = NLA_U64 },
38703726186SSergey Popovich [IPSET_ATTR_COMMENT] = { .type = NLA_NUL_STRING,
38803726186SSergey Popovich .len = IPSET_MAX_COMMENT_SIZE },
389af331419SAnton Danilov [IPSET_ATTR_SKBMARK] = { .type = NLA_U64 },
390af331419SAnton Danilov [IPSET_ATTR_SKBPRIO] = { .type = NLA_U32 },
391af331419SAnton Danilov [IPSET_ATTR_SKBQUEUE] = { .type = NLA_U16 },
3925663bc30SJozsef Kadlecsik },
3935663bc30SJozsef Kadlecsik .me = THIS_MODULE,
3945663bc30SJozsef Kadlecsik };
3955663bc30SJozsef Kadlecsik
3965663bc30SJozsef Kadlecsik static int __init
hash_ipportip_init(void)3975663bc30SJozsef Kadlecsik hash_ipportip_init(void)
3985663bc30SJozsef Kadlecsik {
3995663bc30SJozsef Kadlecsik return ip_set_type_register(&hash_ipportip_type);
4005663bc30SJozsef Kadlecsik }
4015663bc30SJozsef Kadlecsik
4025663bc30SJozsef Kadlecsik static void __exit
hash_ipportip_fini(void)4035663bc30SJozsef Kadlecsik hash_ipportip_fini(void)
4045663bc30SJozsef Kadlecsik {
40518f84d41SJozsef Kadlecsik rcu_barrier();
4065663bc30SJozsef Kadlecsik ip_set_type_unregister(&hash_ipportip_type);
4075663bc30SJozsef Kadlecsik }
4085663bc30SJozsef Kadlecsik
4095663bc30SJozsef Kadlecsik module_init(hash_ipportip_init);
4105663bc30SJozsef Kadlecsik module_exit(hash_ipportip_fini);
411