forked from AgentFabulous/begonia
-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
netfilter: ipset: IP set core support
The patch adds the IP set core support to the kernel. The IP set core implements a netlink (nfnetlink) based protocol by which one can create, destroy, flush, rename, swap, list, save, restore sets, and add, delete, test elements from userspace. For simplicity (and backward compatibilty and for not to force ip(6)tables to be linked with a netlink library) reasons a small getsockopt-based protocol is also kept in order to communicate with the ip(6)tables match and target. The netlink protocol passes all u16, etc values in network order with NLA_F_NET_BYTEORDER flag. The protocol enforces the proper use of the NLA_F_NESTED and NLA_F_NET_BYTEORDER flags. For other kernel subsystems (netfilter match and target) the API contains the functions to add, delete and test elements in sets and the required calls to get/put refereces to the sets before those operations can be performed. The set types (which are implemented in independent modules) are stored in a simple RCU protected list. A set type may have variants: for example without timeout or with timeout support, for IPv4 or for IPv6. The sets (i.e. the pointers to the sets) are stored in an array. The sets are identified by their index in the array, which makes possible easy and fast swapping of sets. The array is protected indirectly by the nfnl mutex from nfnetlink. The content of the sets are protected by the rwlock of the set. There are functional differences between the add/del/test functions for the kernel and userspace: - kernel add/del/test: works on the current packet (i.e. one element) - kernel test: may trigger an "add" operation in order to fill out unspecified parts of the element from the packet (like MAC address) - userspace add/del: works on the netlink message and thus possibly on multiple elements from the IPSET_ATTR_ADT container attribute. - userspace add: may trigger resizing of a set Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Patrick McHardy <kaber@trash.net>
- Loading branch information
Showing
10 changed files
with
2,626 additions
and
0 deletions.
There are no files selected for viewing
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,11 @@ | ||
#ifndef _IP_SET_GETPORT_H | ||
#define _IP_SET_GETPORT_H | ||
|
||
extern bool ip_set_get_ip4_port(const struct sk_buff *skb, bool src, | ||
__be16 *port, u8 *proto); | ||
extern bool ip_set_get_ip6_port(const struct sk_buff *skb, bool src, | ||
__be16 *port, u8 *proto); | ||
extern bool ip_set_get_ip_port(const struct sk_buff *skb, u8 pf, bool src, | ||
__be16 *port); | ||
|
||
#endif /*_IP_SET_GETPORT_H*/ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,35 @@ | ||
#ifndef _PFXLEN_H | ||
#define _PFXLEN_H | ||
|
||
#include <asm/byteorder.h> | ||
#include <linux/netfilter.h> | ||
|
||
/* Prefixlen maps, by Jan Engelhardt */ | ||
extern const union nf_inet_addr ip_set_netmask_map[]; | ||
extern const union nf_inet_addr ip_set_hostmask_map[]; | ||
|
||
static inline __be32 | ||
ip_set_netmask(u8 pfxlen) | ||
{ | ||
return ip_set_netmask_map[pfxlen].ip; | ||
} | ||
|
||
static inline const __be32 * | ||
ip_set_netmask6(u8 pfxlen) | ||
{ | ||
return &ip_set_netmask_map[pfxlen].ip6[0]; | ||
} | ||
|
||
static inline u32 | ||
ip_set_hostmask(u8 pfxlen) | ||
{ | ||
return (__force u32) ip_set_hostmask_map[pfxlen].ip; | ||
} | ||
|
||
static inline const __be32 * | ||
ip_set_hostmask6(u8 pfxlen) | ||
{ | ||
return &ip_set_hostmask_map[pfxlen].ip6[0]; | ||
} | ||
|
||
#endif /*_PFXLEN_H */ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -1052,4 +1052,6 @@ endif # NETFILTER_XTABLES | |
|
||
endmenu | ||
|
||
source "net/netfilter/ipset/Kconfig" | ||
|
||
source "net/netfilter/ipvs/Kconfig" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,26 @@ | ||
menuconfig IP_SET | ||
tristate "IP set support" | ||
depends on INET && NETFILTER | ||
help | ||
This option adds IP set support to the kernel. | ||
In order to define and use the sets, you need the userspace utility | ||
ipset(8). You can use the sets in netfilter via the "set" match | ||
and "SET" target. | ||
|
||
To compile it as a module, choose M here. If unsure, say N. | ||
|
||
if IP_SET | ||
|
||
config IP_SET_MAX | ||
int "Maximum number of IP sets" | ||
default 256 | ||
range 2 65534 | ||
depends on IP_SET | ||
help | ||
You can define here default value of the maximum number | ||
of IP sets for the kernel. | ||
|
||
The value can be overriden by the 'max_sets' module | ||
parameter of the 'ip_set' module. | ||
|
||
endif # IP_SET |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,8 @@ | ||
# | ||
# Makefile for the ipset modules | ||
# | ||
|
||
ip_set-y := ip_set_core.o ip_set_getport.o pfxlen.o | ||
|
||
# ipset core | ||
obj-$(CONFIG_IP_SET) += ip_set.o |
Oops, something went wrong.