Xtables-addons 1.43

xt_DNETMAP.c: In function 'dnetmap_tg_proc_write':
xt_DNETMAP.c:703:3: error: implicit declaration of function 'in4_pton'
[-Werror=implicit-function-declaration]

.gitignore

@@ -2,8 +2,9 @@
 *.lo
 *.loT
 *.o
-.deps
-.libs
+.deps/
+.dirstamp
+.libs/
 Makefile
 Makefile.in
 
@@ -16,14 +17,10 @@ Makefile.in
 /targets.man
 
 /aclocal.m4
-/autom4te*.cache
-/compile
+/autom4te.cache/
+/build-aux/
 /config.*
 /configure
-/depcomp
-/install-sh
 /libtool
-/ltmain.sh
-/missing
 /stamp-h1
 /xtables-addons.8

INSTALL

@@ -4,7 +4,7 @@ Installation instructions for Xtables-addons
 Xtables-addons uses the well-known configure(autotools) infrastructure
 in combination with the kernel's Kbuild system.
 
-	$ ./configure --with-xtlibdir=SEE_BELOW
+	$ ./configure
 	$ make
 	# make install
 
@@ -12,9 +12,9 @@ in combination with the kernel's Kbuild system.
 Supported configurations for this release
 =========================================
 
-	* iptables >= 1.4.3
+	* iptables >= 1.4.5
 
-	* kernel-source >= 2.6.17, no upper bound known
+	* kernel-devel >= 2.6.32
 	  with prepared build/output directory
 	  - CONFIG_NF_CONNTRACK or CONFIG_IP_NF_CONNTRACK
 	  - CONFIG_NF_CONNTRACK_MARK or CONFIG_IP_NF_CONNTRACK_MARK
@@ -22,12 +22,6 @@ Supported configurations for this release
 	  - CONFIG_CONNECTOR y/m if you wish to receive userspace
 	    notifications from pknock through netlink/connector
 
-Extra notes:
-
-	* in the kernel 2.6.18.x series, >= 2.6.18.5 is required
-
-	* requires that no vendor backports interfere
-
 
 Selecting extensions
 ====================
@@ -41,6 +35,10 @@ Configuring and compiling
 
 ./configure [options]
 
+--without-kbuild
+
+	Deactivate building kernel modules, and just do userspace parts.
+
 --with-kbuild=
 
 	Specifies the path to the kernel build output directory. We need
@@ -54,11 +52,12 @@ Configuring and compiling
 --with-xtlibdir=
 
 	Specifies the path to where the newly built extensions should
-	be installed when `make install` is run. It uses the same
-	default as the Xtables/iptables package, ${libexecdir}/xtables,
-	but you may need to specify this nevertheless, as autotools
-	defaults to using /usr/local as prefix, and distributions put
-	the files in differing locations.
+	be installed when `make install` is run. The default is to
+	use the same path that Xtables/iptables modules use, as
+	determined by `pkg-config xtables --variable xtlibdir`.
+	Thus, this option normally does NOT need to be specified
+	anymore, even if your distribution put modules in a strange
+	location.
 
 If you want to enable debugging, use
 

Makefile.extra

@@ -1,6 +1,8 @@
 # -*- Makefile -*-
 # AUTOMAKE
 
+export AM_CPPFLAGS
+export AM_CFLAGS
 XA_SRCDIR = ${srcdir}
 XA_TOPSRCDIR = ${top_srcdir}
 XA_ABSTOPSRCDIR = ${abs_top_srcdir}

Makefile.iptrules.in

@@ -11,11 +11,10 @@ xtlibdir        = @xtlibdir@
 CC              = @CC@
 CCLD            = ${CC}
 CFLAGS          = @CFLAGS@
+LDFLAGS         = @LDFLAGS@
 
-regular_CFLAGS  = @regular_CFLAGS@
 libxtables_CFLAGS = @libxtables_CFLAGS@
 libxtables_LIBS   = @libxtables_LIBS@
-AM_CFLAGS         = ${regular_CFLAGS} ${libxtables_CFLAGS} -I${abs_top_srcdir}/extensions
 AM_DEPFLAGS     = -Wp,-MMD,$(@D)/.$(@F).d,-MT,$@
 
 AM_DEFAULT_VERBOSITY = 0
@@ -45,19 +44,19 @@ subdirs_list := $(filter %/,${obj-m})
 .PHONY: all install clean
 
 all: ${targets}
-	@for i in ${subdirs_list}; do ${MAKE} -C $$i; done;
+	@for i in ${subdirs_list}; do ${MAKE} -C $$i || exit $$?; done;
 
 install: ${targets}
-	@for i in ${subdirs_list}; do ${MAKE} -C $$i $@; done;
+	@for i in ${subdirs_list}; do ${MAKE} -C $$i $@ || exit $$?; done;
 	install -dm0755 "${DESTDIR}/${xtlibdir}";
 	@for i in $^; do install -pm0755 $$i "${DESTDIR}/${xtlibdir}"; done;
 
 clean:
-	@for i in ${subdirs_list}; do ${MAKE} -C $$i $@; done;
+	@for i in ${subdirs_list}; do ${MAKE} -C $$i $@ || exit $$?; done;
 	rm -f *.oo *.so;
 
 lib%.so: lib%.oo
 	${AM_V_CCLD}${CCLD} ${AM_LDFLAGS} -shared ${LDFLAGS} -o $@ $< ${libxtables_LIBS} ${LDLIBS};
 
 %.oo: ${XA_SRCDIR}/%.c
-	${AM_V_CC}${CC} ${AM_DEPFLAGS} ${AM_CFLAGS} -DPIC -fPIC ${CFLAGS} -o $@ -c $<;
+	${AM_V_CC}${CC} ${AM_DEPFLAGS} ${AM_CPPFLAGS} ${AM_CFLAGS} -DPIC -fPIC ${CPPFLAGS} ${CFLAGS} -o $@ -c $<;

Makefile.mans.in

@@ -23,7 +23,7 @@ man_run = \
 		name="$${name\#\#*/libxt_}"; \
 		if [ -f "$$ext" ]; then \
 			echo ".SS $$name"; \
-			cat "$$ext"; \
+			cat "$$ext" || exit $$?; \
 			continue; \
 		fi; \
 	done >$@;

README

@@ -16,6 +16,11 @@ sanity checks and incorrect endianess handling have been fixed,
 simplified, and sped up.
 
 
+Included in this package
+========================
+- xt_ACCOUNT 1.16, libxt_ACCOUNT 1.3
+
+
 Inclusion into a kernel tree
 ============================
 

configure.ac

@@ -1,17 +1,20 @@
-
-AC_INIT([xtables-addons], [1.29])
+AC_INIT([xtables-addons], [1.43])
+AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
 AC_PROG_INSTALL
-AM_INIT_AUTOMAKE([1.10.2 -Wall foreign subdir-objects])
+AM_INIT_AUTOMAKE([1.10b -Wall foreign subdir-objects])
 AC_PROG_CC
 AM_PROG_CC_C_O
+m4_ifdef([AM_PROG_AR], [AM_PROG_AR])
 AC_DISABLE_STATIC
 AC_PROG_LIBTOOL
 
 AC_ARG_WITH([kbuild],
 	AS_HELP_STRING([--with-kbuild=PATH],
-	[Path to kernel build directory [[/lib/modules/CURRENT/build]]]),
+	[Path to kernel build directory [[/lib/modules/CURRENT/build]]])
+AS_HELP_STRING([--without-kbuild],
+	[Build only userspace tools]),
 	[kbuilddir="$withval"],
 	[kbuilddir="/lib/modules/$(uname -r)/build"])
 #
@@ -21,60 +24,62 @@ if [[ "$kbuilddir" == no ]]; then
 	kbuilddir="";
 fi
 
-AC_ARG_WITH([xtlibdir],
-	AS_HELP_STRING([--with-xtlibdir=PATH],
-	[Path where to install Xtables extensions [[LIBEXECDIR/xtables]]]),
-	[xtlibdir="$withval"],
-	[xtlibdir='${libexecdir}/xtables'])
-
-PKG_CHECK_MODULES([libxtables], [xtables >= 1.4.3])
 AC_CHECK_HEADERS([linux/netfilter/x_tables.h], [],
 	[AC_MSG_ERROR([You need to have linux/netfilter/x_tables.h, see INSTALL file for details])])
+PKG_CHECK_MODULES([libxtables], [xtables >= 1.4.5])
+xtlibdir="$(pkg-config --variable=xtlibdir xtables)"
 
-regular_CFLAGS="-D_LARGEFILE_SOURCE=1 -D_LARGE_FILES -D_FILE_OFFSET_BITS=64 \
-	-D_REENTRANT -Wall -Waggregate-return -Wmissing-declarations \
+AC_ARG_WITH([xtlibdir],
+	AS_HELP_STRING([--with-xtlibdir=PATH],
+	[Path where to install Xtables extensions [[autodetect]]]]),
+	[xtlibdir="$withval"])
+AC_MSG_CHECKING([Xtables module directory])
+AC_MSG_RESULT([$xtlibdir])
+
+regular_CPPFLAGS="-D_LARGEFILE_SOURCE=1 -D_LARGE_FILES -D_FILE_OFFSET_BITS=64 \
+	-D_REENTRANT -I\${XA_TOPSRCDIR}/include"
+regular_CFLAGS="-Wall -Waggregate-return -Wmissing-declarations \
 	-Wmissing-prototypes -Wredundant-decls -Wshadow -Wstrict-prototypes \
-	-Winline -pipe -DXTABLES_LIBDIR=\\\"\${xtlibdir}\\\" \
-	-I\${XA_TOPSRCDIR}/include";
+	-Winline -pipe";
 
-#
-# check kernel version
-#
-if grep -q "CentOS release 5\." /etc/redhat-release 2>/dev/null ||
-    grep -q "Red Hat Enterprise Linux Server release 5" /etc/redhat-release 2>/dev/null; then
-	# しまった!
-	# Well, just a warning. Maybe the admin updated the kernel.
-	echo "WARNING: This distribution's shipped kernel is not supported.";
-fi;
-krel="$(make -sC ${kbuilddir} kernelrelease)";
-krel="${krel%%-*}";
-kmajor="${krel%%.*}";
-krel="${krel#*.}";
-kminor="${krel%%.*}";
-krel="${krel#*.}";
-kmicro="${krel%%.*}";
-if test "$kmicro" = "$krel"; then
-	kstable=0;
-else
-	kstable="${krel#*.}";
-	if test -z "$kstable"; then
-		kstable=0;
+if test -n "$kbuilddir"; then
+	AC_MSG_CHECKING([kernel version that we will build against])
+	krel="$(make -sC "$kbuilddir" M=$PWD kernelrelease)";
+	kmajor="${krel%%[[^0-9]]*}";
+	kmajor="$(($kmajor+0))";
+	krel="${krel:${#kmajor}}";
+	krel="${krel#.}";
+	kminor="${krel%%[[^0-9]]*}";
+	kminor="$(($kminor+0))";
+	krel="${krel:${#kminor}}";
+	krel="${krel#.}";
+	kmicro="${krel%%[[^0-9]]*}";
+	kmicro="$(($kmicro+0))";
+	krel="${krel:${#kmicro}}";
+	krel="${krel#.}";
+	kstable="${krel%%[[^0-9]]*}";
+	kstable="$(($kstable+0))";
+	if test -z "$kmajor" -o -z "$kminor" -o -z "$kmicro"; then
+		echo "WARNING: Version detection did not succeed. Continue at own luck.";
+	else
+		echo "$kmajor.$kminor.$kmicro.$kstable in $kbuilddir";
+		if test "$kmajor" -gt 3 -o "$kmajor" -eq 3 -a "$kminor" -gt 4; then
+			echo "WARNING: You are trying a newer kernel. Results may vary. :-)";
+		elif test "$kmajor" -eq 3; then
+			:;
+		elif test "$kmajor" -eq 2 -a "$kminor" -eq 6 -a "$kmicro" -ge 32; then
+			:;
+		else
+			echo "WARNING: That kernel version is not officially supported.";
+		fi;
 	fi;
 fi;
-echo "Found kernel version $kmajor.$kminor.$kmicro.$kstable in $kbuilddir";
-if test "$kmajor" -gt 2 -o "$kminor" -gt 6 -o "$kmicro" -gt 36; then
-	echo "WARNING: You are trying a newer kernel. Results may vary. :-)";
-elif test \( "$kmajor" -lt 2 -o "$kminor" -lt 6 -o "$kmicro" -lt 17 \) -o \
-    \( "$kmajor" -eq 2 -a "$kminor" -eq 6 -a "$kmicro" -eq 18 -a \
-    "$kstable" -lt 5 \); then
-	echo "ERROR: That kernel version is not supported. Please see INSTALL for minimum configuration.";
-	exit 1;
-fi;
 
+AC_SUBST([regular_CPPFLAGS])
 AC_SUBST([regular_CFLAGS])
 AC_SUBST([kbuilddir])
 AC_SUBST([xtlibdir])
 AC_CONFIG_FILES([Makefile Makefile.iptrules Makefile.mans geoip/Makefile
 	extensions/Makefile extensions/ACCOUNT/Makefile
-	extensions/ipset/Makefile extensions/pknock/Makefile])
+	extensions/pknock/Makefile])
 AC_OUTPUT

doc/api/2.6.17.c

@@ -13,7 +13,7 @@ match:
 		int *hotdrop,
 	);
 
-	/* error code */
+	/* true/false */
 	int
 	(*checkentry)(
 		const char *tablename,
@@ -45,7 +45,7 @@ target:
 		void *userdata,
 	);
 
-	/* error code */
+	/* true/false */
 	int
 	(*checkentry)(
 		const char *tablename,

doc/api/2.6.19.c

@@ -13,7 +13,7 @@ match:
 		int *hotdrop,
 	);
 
-	/* error code */
+	/* true/false */
 	int
 	(*checkentry)(
 		const char *tablename,
@@ -42,7 +42,7 @@ target:
 		const void *targinfo,
 	);
 
-	/* error code */
+	/* true/false */
 	int
 	(*checkentry)(
 		const char *tablename,

doc/changelog.txt

@@ -3,8 +3,189 @@ HEAD
 ====
 
 
-v1.29 (September 29 2010)
-=========================
+v1.43 (2012-06-30)
+==================
+Fixes:
+- xt_psd: avoid crash due to curr->next corruption
+Changes:
+- xt_psd: reject invalid match options
+Enhancements:
+- Support for Linux 3.5
+- DNETMAP: new type: static binding
+- DNETMAP: new persistent flag option for prefix
+- DNETMAP: add write support to procfs interface
+
+
+v1.42 (2012-04-05)
+==================
+Fixes:
+- compat_xtables: fixed mistranslation of checkentry return values
+  (affected kernels < 2.6.23)
+- xt_SYSRQ: fix compile error when crypto is turned off
+Changes:
+- ipset6-genl has been dropped from the tree;
+  the libmnl build-time dependency is thus no longer needed
+Enhancements:
+- Support for Linux 3.3, 3.4
+
+
+v1.41 (2012-01-04)
+==================
+Changes:
+- Deactivate build of ipset-genl by default.
+  I think the original ipset package can now take over, given there are
+  a handful of kernels (2.6.39 onwards) that do not need patching.
+Enhancements:
+- Support for Linux 3.2
+
+
+v1.40 (2011-11-30)
+==================
+Fixes:
+- build: the code actually requires at least iptables 1.4.5 (would yield a
+  compile error otherwise), make sure configure checks for it; update INSTALL
+- xt_ECHO: fix kernel warning about RTAX_HOPLIMIT being used
+- xt_ipv4options: fix an infinite loop
+Changes:
+- xt_ECHO: now calculates UDP checksum
+- Linux kernel versions below 2.6.32 are no longer officially
+  supported, and will not be part of compilation testing.
+- update to ipset 6.10
+Enhancements:
+- xt_ECHO: IPv6 support
+
+
+v1.39 (2011-09-21)
+==================
+Fixes:
+- libxt_ACCOUNT: fix compilation after missing libxtables_CFLAGS
+- build: fix compilation after missing libxtables_CFLAGS in submodules
+- build: add missing linux/version.h includes where needed
+Changes:
+- Remove unsupported ipset 4.x from the Xtables-addons distribution
+- ipset: move ipset_errcode from src to library to avoid undefined reference
+- update to ipset 6.9.1
+
+
+v1.38 (2011-08-20)
+==================
+- xt_CHECKSUM: abort build when the feature is already provided by mainline
+- xt_SYSRQ: fix UDPLITE header lookup in IPv6
+- xt_TARPIT: fix kernel warning about RTAX_HOPLIMIT being used
+- xt_TEE: abort build when the feature is already provided by mainline
+- xt_ipp2p: support UDPLITE
+- xt_pknock: support UDPLITE
+- xt_psd: restore functionality with UDP
+- xt_psd: support UDPLITE
+- update to ipset 6.8
+- support for Linux 3.1
+
+
+v1.37 (2011-06-25)
+==================
+Fixes:
+- xt_SYSRQ: make IPv6 trigger work again
+- xt_SYSRQ: improve security: include host address in digest
+- xt_TARPIT: fix a kernel oops in --reset mode
+
+
+v1.36 (2011-06-03)
+==================
+Changes:
+- xt_geoip: avoid recursive function calls
+- xt_TARPIT: unlock for use in all tables
+- xt_TARPIT: honeypot and reset modes
+- update to ipset 6.7
+- support for Linux 3.0
+
+
+v1.35 (2011-04-11)
+==================
+Enhancements:
+- update to ipset 6.3
+  * allow "new" as a commad alias to "create"
+  * resolving IP addresses did not work at listing/saving sets, fixed
+  * check ICMP and ICMPv6 with the set match and target in the testsuite
+  * avoid possible syntax clashing at saving hostnames
+  * fix linking with CONFIG_IPV6=n
+  * sctp, udplite support for the hash:*port* types
+- ipset-genl: handle EAGAIN return value emitted from autoloader
+- ipset-genl: resolve nfgenmsg remains and fix spurious protocol abort
+
+
+v1.34 (2011-04-07)
+==================
+Fixes:
+- xt_pknock: avoid crash when hash TFM could not be allocated
+- xt_pknock: avoid inversion of rule lookup that led to warnings
+- xt_DNETMAP: add missing module alias
+- xt_DNETMAP: support for kernels below 2.6.34
+Changes:
+- Linux kernel versions below 2.6.29 are no longer officially
+  supported, and will not be part of compilation testing.
+
+
+v1.33 (2011-02-02)
+==================
+Fixes:
+- build: restore functionality of `configure --without-kbuild`
+- build: fix objdir builds for ipset-5 (xt-a specific)
+- build: fix missing inclusion of dependency rules
+- xt_LOGMARK: fix detection of untracked connection for Linux >= 2.6.36
+Enhancements:
+- IPv6 support for xt_geoip
+- Update to ipset 5.3
+  * make IPv4 and IPv6 address handling similar
+  * show correct line numbers in restore output for parser errors
+- Update to ipset 5.4
+  * fixed ICMP and ICMPv6 handling
+  * fixed trailing whitespaces and pr_* messages
+  * fixed module loading at create/header commands
+- build: support for Linux up to 2.6.38
+- build: preliminary support for iptables 1.4.11
+
+
+v1.32 (2011-01-04)
+==================
+Fixes:
+- Update to ipset 4.5
+  * the iptreemap type used wrong gfp flags when deleting entries
+- Include ipset 5.2 with genetlink patch (beta)
+  * no kernel patch needed, but requires Linux >= 2.6.35
+    and thus needs to be manually enabled in mconfig
+
+
+v1.31 (2010-11-05)
+==================
+Fixes:
+- build: improve detection of kernel version and error handling
+Changes:
+- build: automatically derive Xtables module directory, thus
+  --with-xtlibdir is no longer needed for ./configure in most cases
+  (If I still see a distro using it, I will scold you for not
+  reading this changelog.)
+Enhancements:
+- LOGMARK: print remaining lifetime of cts
+- xt_iface: allow matching against incoming/outgoing interface
+- libxt_gradm: match packets based on status of grsecurity RBAC
+  (userspace part only - xt_gradm is in the grsec patch)
+
+
+v1.30 (2010-010-02)
+===================
+Fixes:
+- update to ipset 4.4
+  * ipport{,ip,net}hash did not work with mixed "src" and "dst"
+    destination parameters
+Changes:
+- deactivate building xt_TEE and xt_CHECKSUM by default, as these have been
+  merged upstream in Linux 2.6.35 and 2.6.36, respectively.
+  Distros still wishing to build this need to enable it in their build
+  script, e.g. perl -i -pe 's{^build_TEE=.*}{build_TEE=m}' mconfig;
+
+
+v1.29 (2010-09-29)
+==================
 - compat_xtables: return bool for match_check and target_check in 2.6.23..34
 - ipset: enable building of ip_set_ipport{ip,net}hash.ko
 - support for Linux 2.6.36
@@ -14,8 +195,8 @@ v1.29 (September 29 2010)
   ("implicit declaration of function 'ALIGN'")
 
 
-Xtables-addons 1.28 (July 24 2010)
-==================================
+v1.28 (2010-07-24)
+==================
 - RAWNAT: IPv6 variants erroneously rejected masks /33-/128
 - new target xt_CHECKSUM
 - xt_length2: add support for IPv6 jumbograms
@@ -23,18 +204,18 @@ Xtables-addons 1.28 (July 24 2010)
 - import xt_geoip database scripts
 
 
-Xtables-addons 1.27 (May 16 2010)
-=================================
+v1.27 (2010-05-16)
+==================
 - further updates for the upcoming 2.6.35 changes
 
 
-Xtables-addons 1.26 (April 30 2010)
-===================================
+v1.26 (2010-04-30)
+==================
 - compat_xtables: fix 2.6.34 compile error due to a typo
 
 
-Xtables-addons 1.25 (April 26 2010)
-===================================
+v1.25 (2010-04-26)
+==================
 - TEE: do rechecksumming in PREROUTING too
 - TEE: decrease TTL on cloned packet
 - TEE: set dont-fragment on cloned packets
@@ -46,8 +227,8 @@ Xtables-addons 1.25 (April 26 2010)
 - condition: remove unnecessary RCU protection
 
 
-Xtables-addons 1.24 (March 17 2010)
-===================================
+v1.24 (2010-03-17)
+==================
 - build: fix build of userspace modules against old (pre-2.6.25)
   headers from linux-glibc-devel (/usr/include/linux)
 - ipp2p: updated bittorent command recognition
@@ -55,8 +236,8 @@ Xtables-addons 1.24 (March 17 2010)
 - SYSRQ: allow processing of UDP-Lite
 
 
-Xtables-addons 1.23 (February 24 2010)
-======================================
+v1.23 (2010-02-24)
+==================
 - build: support for Linux 2.6.34
 - build: remove unused --with-ksource option
 - build: remove unneeded --with-xtables option
@@ -65,22 +246,22 @@ Xtables-addons 1.23 (February 24 2010)
 - ECHO: fix compilation w.r.t. skb_dst
 
 
-Xtables-addons 1.22 (January 22 2010)
-=====================================
+v1.22 (2010-01-22)
+==================
 - compat_xtables: support for 2.6.33 skb_iif changes
 - geoip: for FHS compliance use /usr/share/xt_geoip instead of /var/geoip
 - ipset: enable build of ip_set_setlist.ko
 - quota2: add the --no-change mode
 
 
-Xtables-addons 1.21 (December 09 2009)
-======================================
+v1.21 (2009-12-09)
+==================
 - ACCOUNT: avoid collision with arp_tables setsockopt numbers
 - doc: fix option mismatch --gw/--gateway in libxt_TEE.man
 
 
-Xtables-addons 1.20 (November 19 2009)
-======================================
+v1.20 (2009-11-19)
+==================
 - ipp2p: add more boundary checks
 - ipp2p: fix Gnutelle line ending detection
 - LOGMARK: remove unknown options from manpage
@@ -89,8 +270,8 @@ Xtables-addons 1.20 (November 19 2009)
 - ipset: fast forward to v4.1
 
 
-Xtables-addons 1.19 (October 12 2009)
-=====================================
+v1.19 (2009-10-12)
+==================
 - build: compile fixes for 2.6.31-rt
 - build: support for Linux 2.6.32
 - ipp2p: try to address underflows
@@ -112,8 +293,8 @@ Xtables-addons 1.19 (October 12 2009)
   - pknock: add a manpage
 
 
-Xtables-addons 1.18 (September 09 2009)
-=======================================
+v1.18 (2009-09-09)
+==================
 - build: support for Linux 2.6.31
 - ipset: fast forward to v3.2
 - quota2: support anonymous counters
@@ -124,21 +305,21 @@ Xtables-addons 1.18 (September 09 2009)
 - merged xt_psd module
 
 
-Xtables-addons 1.17 (June 16 2009)
-==================================
+v1.17 (2009-06-16)
+==================
 - IPMARK: print missing --shift parameter
 - build: use readlink -f in extensions/ipset/
 - build: support for Linux 2.6.30
 
 
-Xtables-addons 1.16 (May 27 2009)
-=================================
+v1.16 (2009-05-27)
+==================
 - RAWNAT: make iptable_rawpost compile with 2.6.30-rc5
 - ipset: fast forward to 3.0
 
 
-Xtables-addons 1.15 (April 30 2009)
-===================================
+v1.15 (2009-04-30)
+==================
 - build: add kernel version check to configure
 - condition: compile fix for 2.6.30-rc
 - condition: fix intrapositional negation sign
@@ -150,8 +331,8 @@ Xtables-addons 1.15 (April 30 2009)
 - added RAWSNAT/RAWDNAT targets
 
 
-Xtables-addons 1.14 (March 31 2009)
-===================================
+v1.14 (2009-03-31)
+==================
 - fuzzy: need to account for kernel-level modified variables in .userspacesize
 - geoip: remove XT_ALIGN from .userspacesize when used with offsetof
 - SYSRQ: ignore non-UDP packets
@@ -161,14 +342,14 @@ Xtables-addons 1.14 (March 31 2009)
 - dhcpmac: rename from dhcpaddr
 
 
-Xtables-addons 1.13 (March 23 2009)
-===================================
+v1.13 (2009-03-23)
+==================
 - added a reworked ipv4options match
 - upgrade to iptables 1.4.3 API
 
 
-Xtables-addons 1.12 (March 07 2009)
-===================================
+v1.12 (2009-03-07)
+==================
 - ipset: fix for compilation with 2.6.29-rt
 - ipset: fast forward to 2.5.0
 - rename xt_portscan to xt_lscan ("low-level scan") because
@@ -179,21 +360,21 @@ Xtables-addons 1.12 (March 07 2009)
 - xt_TEE: enable routing by iif, nfmark and flowlabel
 
 
-Xtables-addons 1.10 (February 18 2009)
-======================================
+v1.10 (2009-02-18)
+==================
 - compat: compile fixes for 2.6.29
 - ipset: upgrade to ipset 2.4.9
 
 
-Xtables-addons 1.9 (January 30 2009)
-====================================
+v1.9 (2009-01-30)
+=================
 - add the xt_length2 extension
 - xt_TEE: remove intrapositional '!' support
 - ipset: upgrade to ipset 2.4.7
 
 
-Xtables-addons 1.8 (January 10 2009)
-====================================
+v1.8 (2009-01-10)
+=================
 - xt_TEE: IPv6 support
 - xt_TEE: do not include TOS value in routing decision
 - xt_TEE: fix switch-case inversion for name/IP display
@@ -202,8 +383,8 @@ Xtables-addons 1.8 (January 10 2009)
 - xt_portscan: update manpage about --grscan option caveats
 
 
-Xtables-addons 1.7 (December 25 2008)
-=====================================
+v1.7 (2008-12-25)
+=================
 - xt_ECHO: compile fix
 - avoid the use of "_init" which led to compile errors on some installations
 - build: do not unconditionally install ipset
@@ -214,16 +395,16 @@ Xtables-addons 1.7 (December 25 2008)
 - xt_SYSRQ: improve security by hashing password
 
 
-Xtables-addons 1.6 (November 18 2008)
-=====================================
+v1.6 (2008-11-18)
+=================
 - build: support for Linux 2.6.17
 - build: compile fixes for 2.6.18 and 2.6.19
 - xt_ECHO: resolve compile errors in xt_ECHO
 - xt_ipp2p: parenthesize unaligned-access macros
 
 
-Xtables-addons 1.5.7 (September 01 2008)
-========================================
+v1.5.7 (2008-09-01)
+===================
 - API layer: fix use of uninitialized 'hotdrop' variable
 - API layer: move to pskb-based signatures
 - xt_SYSRQ: compile fixes for Linux <= 2.6.19
@@ -235,8 +416,8 @@ Xtables-addons 1.5.7 (September 01 2008)
 - xt_SYSRQ: add missing module aliases
 
 
-Xtables-addons 1.5.5 (August 03 2008)
-=====================================
+v1.5.5 (2008-08-03)
+===================
 - manpage updates for xt_CHAOS, xt_IPMARK; README updates
 - build: properly recognize external Kbuild/Mbuild files
 - build: remove dependency on CONFIG_NETWORK_SECMARK
@@ -245,13 +426,13 @@ Xtables-addons 1.5.5 (August 03 2008)
 - import ipset extension group
 
 
-Xtables-addons 1.5.4.1 (April 26 2008)
-======================================
+v1.5.4.1 (2008-04-26)
+=====================
 - build: fix compile error for 2.6.18-stable
 
 
-Xtables-addons 1.5.4 (April 09 2008)
-====================================
+v1.5.4 (2008-04-09)
+===================
 - build: support building multiple files with one config option
 - API layer: add check for pskb relocation
 - doc: generate manpages
@@ -265,28 +446,28 @@ Xtables-addons 1.5.4 (April 09 2008)
 - add reworked xt_IPMARK target
 
 
-Xtables-addons 1.5.3 (March 22 2008)
-====================================
+v1.5.3 (2008-03-22)
+===================
 - support for Linux 2.6.18
 - add xt_ECHO sample target
 - add reworked xt_geoip match
 
 
-Xtables-addons 1.5.2 (March 04 2008)
-====================================
+v1.5.2 (2008-03-04)
+===================
 - build: support for GNU make < 3.81 which does not have $(realpath)
 
 
-Xtables-addons 1.5.1 (February 21 2008)
-=======================================
+v1.5.1 (2008-02-21)
+===================
 - build: allow user to select what extensions to compile and install
 - build: allow external proejcts to be downloaded into the tree
 - xt_LOGMARK: dump classify mark, ctstate and ctstatus
 - add xt_CHAOS, xt_DELUDE and xt_portscan from Chaostables
 
 
-Xtables-addons 1.5.0 (February 11 2008)
-=======================================
+v1.5.0 (2008-02-11)
+===================
 Initial release with:
 - extensions: xt_LOGMARK, xt_TARPIT, xt_TEE
 - support for Linux >= 2.6.19

extensions/.gitignore

@@ -1,6 +1,6 @@
 .*.cmd
 .*.d
-.tmp_versions
+.tmp_versions/
 *.ko
 *.mod.c
 Module.markers

extensions/ACCOUNT/Makefile.am

@@ -1,8 +1,13 @@
 # -*- Makefile -*-
 
+AM_CPPFLAGS = ${regular_CPPFLAGS} -I${abs_top_srcdir}/extensions
+AM_CFLAGS   = ${regular_CFLAGS} ${libxtables_CFLAGS}
+
 include ../../Makefile.extra
 
 sbin_PROGRAMS = iptaccount
 iptaccount_LDADD = libxt_ACCOUNT_cl.la
 
 lib_LTLIBRARIES = libxt_ACCOUNT_cl.la
+
+man_MANS = iptaccount.8

extensions/ACCOUNT/VERSION.txt

@@ -0,0 +1 @@
+1.16

extensions/ACCOUNT/iptaccount.8

@@ -0,0 +1,26 @@
+.TH iptaccount 8 "v1.16" "" "v1.16"
+.SH Name
+iptaccount \(em administrative utility to access xt_ACCOUNT statistics
+.SH Syntax
+\fBiptaccount\fP [\fB\-acfhu\fP] [\fB\-l\fP \fIname\fP]
+.SH Options
+.PP
+\fB\-a\fP
+List all (accounting) table names.
+.PP
+\fB\-c\fP
+Loop every second (abort with CTRL+C).
+.PP
+\fB\-f\fP
+Flush data after display.
+.PP
+\fB\-h\fP
+Free all kernel handles. (Experts only!)
+.PP
+\fB\-l\fP \fIname\fP
+Show data in accounting table called by \fIname\fP.
+.TP
+\fB\-u\fP
+Show kernel handle usage.
+.SH "See also"
+\fBxtables-addons\fP(8)

extensions/ACCOUNT/libxt_ACCOUNT.c

@@ -105,11 +105,11 @@ static void account_tg_print_it(const void *ip,
 	struct in_addr a;
 
 	if (!do_prefix)
-		printf("ACCOUNT ");
+		printf(" ACCOUNT ");
 
 	// Network information
 	if (do_prefix)
-		printf("--");
+		printf(" --");
 	printf("%s ", account_tg_opts[0].name);
 
 	a.s_addr = accountinfo->net_ip;
@@ -119,7 +119,7 @@ static void account_tg_print_it(const void *ip,
 
 	printf(" ");
 	if (do_prefix)
-		printf("--");
+		printf(" --");
 
 	printf("%s %s", account_tg_opts[1].name, accountinfo->table_name);
 }

extensions/ACCOUNT/libxt_ACCOUNT.man

@@ -40,19 +40,7 @@ to account the overall traffic to/from your internet provider.
 .PP
 The data can be queried using the userspace libxt_ACCOUNT_cl library,
 and by the reference implementation to show usage of this library,
-the \fBiptaccount\fP(8) tool, which features following options:
-.PP
-[\fB\-u\fP] show kernel handle usage
-.PP
-[\fB\-h\fP] free all kernel handles (experts only!)
-.PP
-[\fB\-a\fP] list all table names
-.PP
-[\fB\-l\fP \fIname\fP] show data in table \fIname\fP
-.PP
-[\fB\-f\fP] flush data after showing
-.PP
-[\fB\-c\fP] loop every second (abort with CTRL+C)
+the \fBiptaccount\fP(8) tool.
 .PP
 Here is an example of use:
 .PP

extensions/ACCOUNT/xt_ACCOUNT.Kconfig

@@ -1,13 +0,0 @@
-config NETFILTER_XT_TARGET_ACCOUNT
-	tristate "ACCOUNT target support"
-	depends on NETFILTER_XTABLES
-	---help---
-	This module implements an ACCOUNT target
-
-	The ACCOUNT target is a high performance accounting system for large
-	local networks. It allows per-IP accounting in whole prefixes of IPv4
-	addresses with size of up to /8 without the need to add individual
-	accouting rule for each IP address.
-
-	For more information go to:
-	http://www.intra2net.com/de/produkte/opensource/ipt_account/

extensions/ACCOUNT/xt_ACCOUNT.c

@@ -3,7 +3,7 @@
  *   See http://www.intra2net.com/opensource/ipt_account                   *
  *   for further information                                               *
  *                                                                         *
- *   Copyright (C) 2004-2008 by Intra2net AG                               *
+ *   Copyright (C) 2004-2011 by Intra2net AG                               *
  *   opensource@intra2net.com                                              *
  *                                                                         *
  *   This program is free software; you can redistribute it and/or modify  *
@@ -494,7 +494,7 @@ static unsigned int ipt_acc_target(struct sk_buff **pskb, const struct xt_action
 			"IPs %u.%u.%u.%u/%u.%u.%u.%u\n", info->table_nr,
 			NIPQUAD(src_ip), NIPQUAD(dst_ip));
 		spin_unlock_bh(&ipt_acc_lock);
-		return IPT_CONTINUE;
+		return XT_CONTINUE;
 	}
 
 	/* 8 bit network or "any" network */
@@ -506,7 +506,7 @@ static unsigned int ipt_acc_target(struct sk_buff **pskb, const struct xt_action
 			ipt_acc_tables[info->table_nr].netmask,
 			src_ip, dst_ip, size, &ipt_acc_tables[info->table_nr].itemcount);
 		spin_unlock_bh(&ipt_acc_lock);
-		return IPT_CONTINUE;
+		return XT_CONTINUE;
 	}
 
 	/* 16 bit network */
@@ -517,7 +517,7 @@ static unsigned int ipt_acc_target(struct sk_buff **pskb, const struct xt_action
 			ipt_acc_tables[info->table_nr].netmask,
 			src_ip, dst_ip, size, &ipt_acc_tables[info->table_nr].itemcount);
 		spin_unlock_bh(&ipt_acc_lock);
-		return IPT_CONTINUE;
+		return XT_CONTINUE;
 	}
 
 	/* 24 bit network */
@@ -528,7 +528,7 @@ static unsigned int ipt_acc_target(struct sk_buff **pskb, const struct xt_action
 			ipt_acc_tables[info->table_nr].netmask,
 			src_ip, dst_ip, size, &ipt_acc_tables[info->table_nr].itemcount);
 		spin_unlock_bh(&ipt_acc_lock);
-		return IPT_CONTINUE;
+		return XT_CONTINUE;
 	}
 
 	printk("ACCOUNT: ipt_acc_target: Unable to process packet. "
@@ -536,7 +536,7 @@ static unsigned int ipt_acc_target(struct sk_buff **pskb, const struct xt_action
 		info->table_nr, NIPQUAD(src_ip), NIPQUAD(dst_ip));
 
 	spin_unlock_bh(&ipt_acc_lock);
-	return IPT_CONTINUE;
+	return XT_CONTINUE;
 }
 
 /*

extensions/Kbuild

@@ -10,7 +10,10 @@ obj-${build_CHAOS}       += xt_CHAOS.o
 obj-${build_CHECKSUM}    += xt_CHECKSUM.o
 obj-${build_DELUDE}      += xt_DELUDE.o
 obj-${build_DHCPMAC}     += xt_DHCPMAC.o
+obj-${build_DNETMAP}     += xt_DNETMAP.o
+ifeq (${VERSION},3)
 obj-${build_ECHO}        += xt_ECHO.o
+endif
 obj-${build_IPMARK}      += xt_IPMARK.o
 obj-${build_LOGMARK}     += xt_LOGMARK.o
 obj-${build_RAWNAT}      += xt_RAWNAT.o iptable_rawpost.o
@@ -26,7 +29,6 @@ obj-${build_fuzzy}       += xt_fuzzy.o
 obj-${build_geoip}       += xt_geoip.o
 obj-${build_iface}       += xt_iface.o
 obj-${build_ipp2p}       += xt_ipp2p.o
-obj-${build_ipset}       += ipset/
 obj-${build_ipv4options} += xt_ipv4options.o
 obj-${build_length2}     += xt_length2.o
 obj-${build_lscan}       += xt_lscan.o

extensions/Makefile.am

@@ -1,6 +1,9 @@
 # -*- Makefile -*-
 # AUTOMAKE
 
+AM_CPPFLAGS = ${regular_CPPFLAGS} -I${abs_top_srcdir}/extensions
+AM_CFLAGS = ${regular_CFLAGS} ${libxtables_CFLAGS}
+
 # Not having Kbuild in Makefile.extra because it will already recurse
 .PHONY: modules modules_install clean_modules
 

extensions/Mbuild

@@ -5,6 +5,7 @@ obj-${build_CHAOS}       += libxt_CHAOS.so
 obj-${build_CHECKSUM}    += libxt_CHECKSUM.so
 obj-${build_DELUDE}      += libxt_DELUDE.so
 obj-${build_DHCPMAC}     += libxt_DHCPMAC.so libxt_dhcpmac.so
+obj-${build_DNETMAP}     += libxt_DNETMAP.so
 obj-${build_ECHO}        += libxt_ECHO.so
 obj-${build_IPMARK}      += libxt_IPMARK.so
 obj-${build_LOGMARK}     += libxt_LOGMARK.so
@@ -18,10 +19,10 @@ obj-${build_fuzzy}       += libxt_fuzzy.so
 obj-${build_geoip}       += libxt_geoip.so
 obj-${build_iface}       += libxt_iface.so
 obj-${build_ipp2p}       += libxt_ipp2p.so
-obj-${build_ipset}       += ipset/
 obj-${build_ipv4options} += libxt_ipv4options.so
 obj-${build_length2}     += libxt_length2.so
 obj-${build_lscan}       += libxt_lscan.so
 obj-${build_pknock}      += pknock/
 obj-${build_psd}         += libxt_psd.so
 obj-${build_quota2}      += libxt_quota2.so
+obj-${build_gradm}       += libxt_gradm.so

extensions/compat_xtables.c

@@ -8,15 +8,21 @@
  */
 #include <linux/ip.h>
 #include <linux/kernel.h>
+#include <linux/kmod.h>
 #include <linux/list.h>
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/version.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter_arp.h>
 #include <net/ip.h>
 #include <net/route.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
+#	include <linux/export.h>
+#endif
 #include "compat_skbuff.h"
 #include "compat_xtnu.h"
 
@@ -105,11 +111,7 @@ static bool xtnu_match_check(const char *table, const void *entry,
 		return false;
 	if (nm->checkentry == NULL)
 		return true;
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
-	return nm->checkentry(&local_par);
-#else
 	return nm->checkentry(&local_par) == 0;
-#endif
 }
 #endif
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28) && \
@@ -317,11 +319,7 @@ static bool xtnu_target_check(const char *table, const void *entry,
 	if (nt->checkentry == NULL)
 		/* this is valid, just like if there was no function */
 		return true;
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
-	return nt->checkentry(&local_par);
-#else
 	return nt->checkentry(&local_par) == 0;
-#endif
 }
 #endif
 
@@ -615,4 +613,12 @@ void *HX_memmem(const void *space, size_t spacesize,
 }
 EXPORT_SYMBOL_GPL(HX_memmem);
 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 5, 0)
+int xtnu_ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
+    int target, unsigned short *fragoff, int *fragflg)
+{
+	return ipv6_find_hdr(skb, offset, target, fragoff);
+}
+#endif
+
 MODULE_LICENSE("GPL");

extensions/compat_xtables.h

@@ -92,6 +92,12 @@
 #	define rt_dst(rt)	(&(rt)->u.dst)
 #endif
 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 3, 0)
+#	define nf_nat_ipv4_multi_range_compat nf_nat_multi_range_compat
+#	define nf_nat_ipv4_range nf_nat_range
+#	define NF_NAT_RANGE_MAP_IPS IP_NAT_RANGE_MAP_IPS
+#endif
+
 #if !defined(NIP6) && !defined(NIP6_FMT)
 #	define NIP6(addr) \
 		ntohs((addr).s6_addr16[0]), \
@@ -113,6 +119,10 @@
 #	define NIPQUAD_FMT "%u.%u.%u.%u"
 #endif
 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 5, 0)
+#	define ipv6_find_hdr xtnu_ipv6_find_hdr
+#endif
+
 #define ip_route_me_harder    xtnu_ip_route_me_harder
 #define skb_make_writable     xtnu_skb_make_writable
 #define xt_target             xtnu_target

extensions/compat_xtnu.h

@@ -162,6 +162,8 @@ extern void xtnu_csum_replace4(__u16 __bitwise *, __be32, __be32);
 extern void xtnu_proto_csum_replace4(__u16 __bitwise *, struct sk_buff *,
 	__be32, __be32, bool);
 extern int xtnu_skb_linearize(struct sk_buff *);
+extern int xtnu_ipv6_find_hdr(const struct sk_buff *, unsigned int *,
+	int, unsigned short *, int *);
 
 extern void *HX_memmem(const void *, size_t, const void *, size_t);
 

extensions/ipset/.gitignore

@@ -1 +0,0 @@
-/ipset

extensions/ipset/Kbuild

@@ -1,7 +0,0 @@
-# -*- Makefile -*-
-
-obj-m += ipt_set.o ipt_SET.o
-obj-m += ip_set.o ip_set_ipmap.o ip_set_portmap.o ip_set_macipmap.o
-obj-m += ip_set_iphash.o ip_set_nethash.o ip_set_ipporthash.o
-obj-m += ip_set_ipportiphash.o ip_set_ipportnethash.o
-obj-m += ip_set_iptree.o ip_set_iptreemap.o ip_set_setlist.o

extensions/ipset/Makefile.am

@@ -1,11 +0,0 @@
-# -*- Makefile -*-
-
-AM_CFLAGS = ${regular_CFLAGS} -DIPSET_LIB_DIR=\"${xtlibdir}\"
-
-include ../../Makefile.extra
-
-sbin_PROGRAMS = ipset
-ipset_LDADD   = -ldl
-ipset_LDFLAGS = -rdynamic
-
-man_MANS      = ipset.8

extensions/ipset/Mbuild

@@ -1,7 +0,0 @@
-# -*- Makefile -*-
-
-obj-m += $(addprefix lib,$(patsubst %.c,%.so,$(notdir \
-	$(wildcard ${XA_SRCDIR}/ipset_*.c))))
-
-libipset_%.oo: ${XA_SRCDIR}/ipset_%.c
-	${AM_V_CC}${CC} ${AM_DEPFLAGS} ${AM_CFLAGS} -DPIC -fPIC ${CFLAGS} -o $@ -c $<;

extensions/ipset/ip_set.h

@@ -1,569 +0,0 @@
-#ifndef _IP_SET_H
-#define _IP_SET_H
-
-/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
- *                         Patrick Schaaf <bof@bof.de>
- *                         Martin Josefsson <gandalf@wlug.westbo.se>
- * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.  
- */
-
-#ifndef CONFIG_IP_NF_SET_MAX
-	/* from 2 to 65534 */
-#	define CONFIG_IP_NF_SET_MAX 256
-#endif
-#ifndef CONFIG_IP_NF_SET_HASHSIZE
-#	define CONFIG_IP_NF_SET_HASHSIZE 1024
-#endif
-
-#if 0
-#define IP_SET_DEBUG
-#endif
-
-/*
- * A sockopt of such quality has hardly ever been seen before on the open
- * market!  This little beauty, hardly ever used: above 64, so it's
- * traditionally used for firewalling, not touched (even once!) by the
- * 2.0, 2.2 and 2.4 kernels!
- *
- * Comes with its own certificate of authenticity, valid anywhere in the
- * Free world!
- *
- * Rusty, 19.4.2000
- */
-#define SO_IP_SET 		83
-
-/*
- * Heavily modify by Joakim Axelsson 08.03.2002
- * - Made it more modulebased
- *
- * Additional heavy modifications by Jozsef Kadlecsik 22.02.2004
- * - bindings added
- * - in order to "deal with" backward compatibility, renamed to ipset
- */
-
-/* 
- * Used so that the kernel module and ipset-binary can match their versions 
- */
-#define IP_SET_PROTOCOL_UNALIGNED	3
-#define IP_SET_PROTOCOL_VERSION		4
-
-#define IP_SET_MAXNAMELEN 32	/* set names and set typenames */
-
-/* Lets work with our own typedef for representing an IP address.
- * We hope to make the code more portable, possibly to IPv6...
- *
- * The representation works in HOST byte order, because most set types
- * will perform arithmetic operations and compare operations.
- * 
- * For now the type is an uint32_t.
- *
- * Make sure to ONLY use the functions when translating and parsing
- * in order to keep the host byte order and make it more portable:
- *  parse_ip()
- *  parse_mask()
- *  parse_ipandmask()
- *  ip_tostring()
- * (Joakim: where are they???)
- */
-
-typedef uint32_t ip_set_ip_t;
-
-/* Sets are identified by an id in kernel space. Tweak with ip_set_id_t
- * and IP_SET_INVALID_ID if you want to increase the max number of sets.
- */
-typedef uint16_t ip_set_id_t;
-
-#define IP_SET_INVALID_ID	65535
-
-/* How deep we follow bindings */
-#define IP_SET_MAX_BINDINGS	6
-
-/*
- * Option flags for kernel operations (ipt_set_info)
- */
-#define IPSET_SRC 		0x01	/* Source match/add */
-#define IPSET_DST		0x02	/* Destination match/add */
-#define IPSET_MATCH_INV		0x04	/* Inverse matching */
-
-/*
- * Set features
- */
-#define IPSET_TYPE_IP		0x01	/* IP address type of set */
-#define IPSET_TYPE_PORT		0x02	/* Port type of set */
-#define IPSET_DATA_SINGLE	0x04	/* Single data storage */
-#define IPSET_DATA_DOUBLE	0x08	/* Double data storage */
-#define IPSET_DATA_TRIPLE	0x10	/* Triple data storage */
-#define IPSET_TYPE_IP1		0x20	/* IP address type of set */
-#define IPSET_TYPE_SETNAME	0x40	/* setname type of set */
-
-/* Reserved keywords */
-#define IPSET_TOKEN_DEFAULT	":default:"
-#define IPSET_TOKEN_ALL		":all:"
-
-/* SO_IP_SET operation constants, and their request struct types.
- *
- * Operation ids:
- *	  0-99:	 commands with version checking
- *	100-199: add/del/test/bind/unbind
- *	200-299: list, save, restore
- */
-
-/* Single shot operations: 
- * version, create, destroy, flush, rename and swap 
- *
- * Sets are identified by name.
- */
-
-#define IP_SET_REQ_STD		\
-	unsigned op;		\
-	unsigned version;	\
-	char name[IP_SET_MAXNAMELEN]
-
-#define IP_SET_OP_CREATE	0x00000001	/* Create a new (empty) set */
-struct ip_set_req_create {
-	IP_SET_REQ_STD;
-	char typename[IP_SET_MAXNAMELEN];
-};
-
-#define IP_SET_OP_DESTROY	0x00000002	/* Remove a (empty) set */
-struct ip_set_req_std {
-	IP_SET_REQ_STD;
-};
-
-#define IP_SET_OP_FLUSH		0x00000003	/* Remove all IPs in a set */
-/* Uses ip_set_req_std */
-
-#define IP_SET_OP_RENAME	0x00000004	/* Rename a set */
-/* Uses ip_set_req_create */
-
-#define IP_SET_OP_SWAP		0x00000005	/* Swap two sets */
-/* Uses ip_set_req_create */
-
-union ip_set_name_index {
-	char name[IP_SET_MAXNAMELEN];
-	ip_set_id_t index;
-};
-
-#define IP_SET_OP_GET_BYNAME	0x00000006	/* Get set index by name */
-struct ip_set_req_get_set {
-	unsigned op;
-	unsigned version;
-	union ip_set_name_index set;
-};
-
-#define IP_SET_OP_GET_BYINDEX	0x00000007	/* Get set name by index */
-/* Uses ip_set_req_get_set */
-
-#define IP_SET_OP_VERSION	0x00000100	/* Ask kernel version */
-struct ip_set_req_version {
-	unsigned op;
-	unsigned version;
-};
-
-/* Double shots operations: 
- * add, del, test, bind and unbind.
- *
- * First we query the kernel to get the index and type of the target set,
- * then issue the command. Validity of IP is checked in kernel in order
- * to minimalize sockopt operations.
- */
-
-/* Get minimal set data for add/del/test/bind/unbind IP */
-#define IP_SET_OP_ADT_GET	0x00000010	/* Get set and type */
-struct ip_set_req_adt_get {
-	unsigned op;
-	unsigned version;
-	union ip_set_name_index set;
-	char typename[IP_SET_MAXNAMELEN];
-};
-
-#define IP_SET_REQ_BYINDEX	\
-	unsigned op;		\
-	ip_set_id_t index;
-
-struct ip_set_req_adt {
-	IP_SET_REQ_BYINDEX;
-};
-
-#define IP_SET_OP_ADD_IP	0x00000101	/* Add an IP to a set */
-/* Uses ip_set_req_adt, with type specific addage */
-
-#define IP_SET_OP_DEL_IP	0x00000102	/* Remove an IP from a set */
-/* Uses ip_set_req_adt, with type specific addage */
-
-#define IP_SET_OP_TEST_IP	0x00000103	/* Test an IP in a set */
-/* Uses ip_set_req_adt, with type specific addage */
-
-#define IP_SET_OP_BIND_SET	0x00000104	/* Bind an IP to a set */
-/* Uses ip_set_req_bind, with type specific addage */
-struct ip_set_req_bind {
-	IP_SET_REQ_BYINDEX;
-	char binding[IP_SET_MAXNAMELEN];
-};
-
-#define IP_SET_OP_UNBIND_SET	0x00000105	/* Unbind an IP from a set */
-/* Uses ip_set_req_bind, with type speficic addage 
- * index = 0 means unbinding for all sets */
-
-#define IP_SET_OP_TEST_BIND_SET	0x00000106	/* Test binding an IP to a set */
-/* Uses ip_set_req_bind, with type specific addage */
-
-/* Multiple shots operations: list, save, restore.
- *
- * - check kernel version and query the max number of sets
- * - get the basic information on all sets
- *   and size required for the next step
- * - get actual set data: header, data, bindings
- */
-
-/* Get max_sets and the index of a queried set
- */
-#define IP_SET_OP_MAX_SETS	0x00000020
-struct ip_set_req_max_sets {
-	unsigned op;
-	unsigned version;
-	ip_set_id_t max_sets;		/* max_sets */
-	ip_set_id_t sets;		/* real number of sets */
-	union ip_set_name_index set;	/* index of set if name used */
-};
-
-/* Get the id and name of the sets plus size for next step */
-#define IP_SET_OP_LIST_SIZE	0x00000201
-#define IP_SET_OP_SAVE_SIZE	0x00000202
-struct ip_set_req_setnames {
-	unsigned op;
-	ip_set_id_t index;		/* set to list/save */
-	u_int32_t size;			/* size to get setdata */
-	/* followed by sets number of struct ip_set_name_list */
-};
-
-struct ip_set_name_list {
-	char name[IP_SET_MAXNAMELEN];
-	char typename[IP_SET_MAXNAMELEN];
-	ip_set_id_t index;
-	ip_set_id_t id;
-};
-
-/* The actual list operation */
-#define IP_SET_OP_LIST		0x00000203
-struct ip_set_req_list {
-	IP_SET_REQ_BYINDEX;
-	/* sets number of struct ip_set_list in reply */ 
-};
-
-struct ip_set_list {
-	ip_set_id_t index;
-	ip_set_id_t binding;
-	u_int32_t ref;
-	u_int32_t header_size;	/* Set header data of header_size */
-	u_int32_t members_size;	/* Set members data of members_size */
-	u_int32_t bindings_size;/* Set bindings data of bindings_size */
-};
-
-struct ip_set_hash_list {
-	ip_set_ip_t ip;
-	ip_set_id_t binding;
-};
-
-/* The save operation */
-#define IP_SET_OP_SAVE		0x00000204
-/* Uses ip_set_req_list, in the reply replaced by
- * sets number of struct ip_set_save plus a marker
- * ip_set_save followed by ip_set_hash_save structures.
- */
-struct ip_set_save {
-	ip_set_id_t index;
-	ip_set_id_t binding;
-	u_int32_t header_size;	/* Set header data of header_size */
-	u_int32_t members_size;	/* Set members data of members_size */
-};
-
-/* At restoring, ip == 0 means default binding for the given set: */
-struct ip_set_hash_save {
-	ip_set_ip_t ip;
-	ip_set_id_t id;
-	ip_set_id_t binding;
-};
-
-/* The restore operation */
-#define IP_SET_OP_RESTORE	0x00000205
-/* Uses ip_set_req_setnames followed by ip_set_restore structures
- * plus a marker ip_set_restore, followed by ip_set_hash_save 
- * structures.
- */
-struct ip_set_restore {
-	char name[IP_SET_MAXNAMELEN];
-	char typename[IP_SET_MAXNAMELEN];
-	ip_set_id_t index;
-	u_int32_t header_size;	/* Create data of header_size */
-	u_int32_t members_size;	/* Set members data of members_size */
-};
-
-static inline int bitmap_bytes(ip_set_ip_t a, ip_set_ip_t b)
-{
-	return 4 * ((((b - a + 8) / 8) + 3) / 4);
-}
-
-/* General limit for the elements in a set */
-#define MAX_RANGE 0x0000FFFF
-
-/* Alignment: 'unsigned long' unsupported */
-#define IPSET_ALIGNTO		4
-#define	IPSET_ALIGN(len) (((len) + IPSET_ALIGNTO - 1) & ~(IPSET_ALIGNTO - 1))
-#define IPSET_VALIGN(len, old) ((old) ? (len) : IPSET_ALIGN(len))
-
-#ifdef __KERNEL__
-#include "ip_set_compat.h"
-#include "ip_set_malloc.h"
-
-#define ip_set_printk(format, args...) 			\
-	do {							\
-		printk("%s: %s: ", __FILE__, __FUNCTION__);	\
-		printk(format "\n" , ## args);			\
-	} while (0)
-
-#if defined(IP_SET_DEBUG)
-#define DP(format, args...) 					\
-	do {							\
-		printk("%s: %s (DBG): ", __FILE__, __FUNCTION__);\
-		printk(format "\n" , ## args);			\
-	} while (0)
-#define IP_SET_ASSERT(x)					\
-	do {							\
-		if (!(x))					\
-			printk("IP_SET_ASSERT: %s:%i(%s)\n",	\
-				__FILE__, __LINE__, __FUNCTION__); \
-	} while (0)
-#else
-#define DP(format, args...)
-#define IP_SET_ASSERT(x)
-#endif
-
-struct ip_set;
-
-/*
- * The ip_set_type definition - one per set type, e.g. "ipmap".
- *
- * Each individual set has a pointer, set->type, going to one
- * of these structures. Function pointers inside the structure implement
- * the real behaviour of the sets.
- *
- * If not mentioned differently, the implementation behind the function
- * pointers of a set_type, is expected to return 0 if ok, and a negative
- * errno (e.g. -EINVAL) on error.
- */
-struct ip_set_type {
-	struct list_head list;	/* next in list of set types */
-
-	/* test for IP in set (kernel: iptables -m set src|dst)
-	 * return 0 if not in set, 1 if in set.
-	 */
-	int (*testip_kernel) (struct ip_set *set,
-			      const struct sk_buff * skb, 
-			      const u_int32_t *flags);
-
-	/* test for IP in set (userspace: ipset -T set IP)
-	 * return 0 if not in set, 1 if in set.
-	 */
-	int (*testip) (struct ip_set *set,
-		       const void *data, u_int32_t size);
-
-	/*
-	 * Size of the data structure passed by when
-	 * adding/deletin/testing an entry.
-	 */
-	u_int32_t reqsize;
-
-	/* Add IP into set (userspace: ipset -A set IP)
-	 * Return -EEXIST if the address is already in the set,
-	 * and -ERANGE if the address lies outside the set bounds.
-	 * If the address was not already in the set, 0 is returned.
-	 */
-	int (*addip) (struct ip_set *set, 
-		      const void *data, u_int32_t size);
-
-	/* Add IP into set (kernel: iptables ... -j SET set src|dst)
-	 * Return -EEXIST if the address is already in the set,
-	 * and -ERANGE if the address lies outside the set bounds.
-	 * If the address was not already in the set, 0 is returned.
-	 */
-	int (*addip_kernel) (struct ip_set *set,
-			     const struct sk_buff * skb,
-			     const u_int32_t *flags);
-
-	/* remove IP from set (userspace: ipset -D set --entry x)
-	 * Return -EEXIST if the address is NOT in the set,
-	 * and -ERANGE if the address lies outside the set bounds.
-	 * If the address really was in the set, 0 is returned.
-	 */
-	int (*delip) (struct ip_set *set, 
-		      const void *data, u_int32_t size);
-
-	/* remove IP from set (kernel: iptables ... -j SET --entry x)
-	 * Return -EEXIST if the address is NOT in the set,
-	 * and -ERANGE if the address lies outside the set bounds.
-	 * If the address really was in the set, 0 is returned.
-	 */
-	int (*delip_kernel) (struct ip_set *set,
-			     const struct sk_buff * skb,
-			     const u_int32_t *flags);
-
-	/* new set creation - allocated type specific items
-	 */
-	int (*create) (struct ip_set *set,
-		       const void *data, u_int32_t size);
-
-	/* retry the operation after successfully tweaking the set
-	 */
-	int (*retry) (struct ip_set *set);
-
-	/* set destruction - free type specific items
-	 * There is no return value.
-	 * Can be called only when child sets are destroyed.
-	 */
-	void (*destroy) (struct ip_set *set);
-
-	/* set flushing - reset all bits in the set, or something similar.
-	 * There is no return value.
-	 */
-	void (*flush) (struct ip_set *set);
-
-	/* Listing: size needed for header
-	 */
-	u_int32_t header_size;
-
-	/* Listing: Get the header
-	 *
-	 * Fill in the information in "data".
-	 * This function is always run after list_header_size() under a 
-	 * writelock on the set. Therefor is the length of "data" always 
-	 * correct. 
-	 */
-	void (*list_header) (const struct ip_set *set, 
-			     void *data);
-
-	/* Listing: Get the size for the set members
-	 */
-	int (*list_members_size) (const struct ip_set *set, char dont_align);
-
-	/* Listing: Get the set members
-	 *
-	 * Fill in the information in "data".
-	 * This function is always run after list_member_size() under a 
-	 * writelock on the set. Therefor is the length of "data" always 
-	 * correct. 
-	 */
-	void (*list_members) (const struct ip_set *set,
-			      void *data, char dont_align);
-
-	char typename[IP_SET_MAXNAMELEN];
-	unsigned char features;
-	int protocol_version;
-
-	/* Set this to THIS_MODULE if you are a module, otherwise NULL */
-	struct module *me;
-};
-
-extern int ip_set_register_set_type(struct ip_set_type *set_type);
-extern void ip_set_unregister_set_type(struct ip_set_type *set_type);
-
-/* A generic ipset */
-struct ip_set {
-	char name[IP_SET_MAXNAMELEN];	/* the name of the set */
-	rwlock_t lock;			/* lock for concurrency control */
-	ip_set_id_t id;			/* set id for swapping */
-	atomic_t ref;			/* in kernel and in hash references */
-	struct ip_set_type *type; 	/* the set types */
-	void *data;			/* pooltype specific data */
-};
-
-/* register and unregister set references */
-extern ip_set_id_t ip_set_get_byname(const char name[IP_SET_MAXNAMELEN]);
-extern ip_set_id_t ip_set_get_byindex(ip_set_id_t index);
-extern void ip_set_put_byindex(ip_set_id_t index);
-extern ip_set_id_t ip_set_id(ip_set_id_t index);
-extern ip_set_id_t __ip_set_get_byname(const char name[IP_SET_MAXNAMELEN],
-				       struct ip_set **set);
-extern void __ip_set_put_byindex(ip_set_id_t index);
-
-/* API for iptables set match, and SET target */
-extern int ip_set_addip_kernel(ip_set_id_t id,
-			       const struct sk_buff *skb,
-			       const u_int32_t *flags);
-extern int ip_set_delip_kernel(ip_set_id_t id,
-			       const struct sk_buff *skb,
-			       const u_int32_t *flags);
-extern int ip_set_testip_kernel(ip_set_id_t id,
-				const struct sk_buff *skb,
-				const u_int32_t *flags);
-
-/* Macros to generate functions */
-
-#define STRUCT(pre, type)	CONCAT2(pre, type)
-#define CONCAT2(pre, type)	struct pre##type
-
-#define FNAME(pre, mid, post)	CONCAT3(pre, mid, post)
-#define CONCAT3(pre, mid, post)	pre##mid##post
-
-#define UADT0(type, adt, args...)					\
-static int								\
-FNAME(type,_u,adt)(struct ip_set *set, const void *data, u_int32_t size)\
-{									\
-	const STRUCT(ip_set_req_,type) *req = data;			\
-									\
-	return FNAME(type,_,adt)(set , ## args);			\
-}
-
-#define UADT(type, adt, args...)					\
-	UADT0(type, adt, req->ip , ## args)
-
-#define KADT(type, adt, getfn, args...)					\
-static int								\
-FNAME(type,_k,adt)(struct ip_set *set,					\
-	     const struct sk_buff *skb,					\
-	     const u_int32_t *flags)					\
-{									\
-	ip_set_ip_t ip = getfn(skb, flags);				\
-									\
-	KADT_CONDITION							\
-	return FNAME(type,_,adt)(set, ip , ##args);			\
-}
-
-#define REGISTER_MODULE(type)						\
-static int __init ip_set_##type##_init(void)				\
-{									\
-	init_max_page_size();						\
-	return ip_set_register_set_type(&ip_set_##type);		\
-}									\
-									\
-static void __exit ip_set_##type##_fini(void)				\
-{									\
-	/* FIXME: possible race with ip_set_create() */			\
-	ip_set_unregister_set_type(&ip_set_##type);			\
-}									\
-									\
-module_init(ip_set_##type##_init);					\
-module_exit(ip_set_##type##_fini);
-
-/* Common functions */
-
-static inline ip_set_ip_t
-ipaddr(const struct sk_buff *skb, const u_int32_t *flags)
-{
-	return ntohl(flags[0] & IPSET_SRC ? ip_hdr(skb)->saddr : ip_hdr(skb)->daddr);
-}
-
-#define jhash_ip(map, i, ip)	jhash_1word(ip, *(map->initval + i))
-
-#define pack_ip_port(map, ip, port) \
-	(port + ((ip - ((map)->first_ip)) << 16))
-
-#endif				/* __KERNEL__ */
-
-#define UNUSED __attribute__ ((unused))
-
-#endif /*_IP_SET_H*/

extensions/ipset/ip_set_bitmaps.h

@@ -1,120 +0,0 @@
-#ifndef __IP_SET_BITMAPS_H
-#define __IP_SET_BITMAPS_H
-
-/* Macros to generate functions */
-
-#ifdef __KERNEL__
-#define BITMAP_CREATE(type)						\
-static int								\
-type##_create(struct ip_set *set, const void *data, u_int32_t size)	\
-{									\
-	int newbytes;							\
-	const struct ip_set_req_##type##_create *req = data;		\
-	struct ip_set_##type *map;					\
-									\
-	if (req->from > req->to) {					\
-		DP("bad range");					\
-		return -ENOEXEC;					\
-	}								\
-									\
-	map = kmalloc(sizeof(struct ip_set_##type), GFP_KERNEL);	\
-	if (!map) {							\
-		DP("out of memory for %zu bytes",			\
-		   sizeof(struct ip_set_##type));			\
-		return -ENOMEM;						\
-	}								\
-	map->first_ip = req->from;					\
-	map->last_ip = req->to;						\
-									\
-	newbytes = __##type##_create(req, map);				\
-	if (newbytes < 0) {						\
-		kfree(map);						\
-		return newbytes;					\
-	}								\
-									\
-	map->size = newbytes;						\
-	map->members = ip_set_malloc(newbytes);				\
-	if (!map->members) {						\
-		DP("out of memory for %i bytes", newbytes);		\
-		kfree(map);						\
-		return -ENOMEM;						\
-	}								\
-	memset(map->members, 0, newbytes);				\
-									\
-	set->data = map;						\
-	return 0;							\
-}
-
-#define BITMAP_DESTROY(type)						\
-static void								\
-type##_destroy(struct ip_set *set)					\
-{									\
-	struct ip_set_##type *map = set->data;				\
-									\
-	ip_set_free(map->members, map->size);				\
-	kfree(map);							\
-									\
-	set->data = NULL;						\
-}
-
-#define BITMAP_FLUSH(type)						\
-static void								\
-type##_flush(struct ip_set *set)					\
-{									\
-	struct ip_set_##type *map = set->data;				\
-	memset(map->members, 0, map->size);				\
-}
-
-#define BITMAP_LIST_HEADER(type)					\
-static void								\
-type##_list_header(const struct ip_set *set, void *data)		\
-{									\
-	const struct ip_set_##type *map = set->data;			\
-	struct ip_set_req_##type##_create *header = data;		\
-									\
-	header->from = map->first_ip;					\
-	header->to = map->last_ip;					\
-	__##type##_list_header(map, header);				\
-}
-
-#define BITMAP_LIST_MEMBERS_SIZE(type, dtype, sizeid, testfn)		\
-static int								\
-type##_list_members_size(const struct ip_set *set, char dont_align)	\
-{									\
-	const struct ip_set_##type *map = set->data;			\
-	ip_set_ip_t i, elements = 0;					\
-									\
-	if (dont_align)							\
-		return map->size;					\
-									\
-	for (i = 0; i < sizeid; i++)					\
-		if (testfn)						\
-			elements++;					\
-									\
-	return elements * IPSET_ALIGN(sizeof(dtype));			\
-}
-
-#define IP_SET_TYPE(type, __features)					\
-struct ip_set_type ip_set_##type = {					\
-	.typename		= #type,				\
-	.features		= __features,				\
-	.protocol_version	= IP_SET_PROTOCOL_VERSION,		\
-	.create			= &type##_create,			\
-	.destroy		= &type##_destroy,			\
-	.flush			= &type##_flush,			\
-	.reqsize		= sizeof(struct ip_set_req_##type),	\
-	.addip			= &type##_uadd,				\
-	.addip_kernel		= &type##_kadd,				\
-	.delip			= &type##_udel,				\
-	.delip_kernel		= &type##_kdel,				\
-	.testip			= &type##_utest,			\
-	.testip_kernel		= &type##_ktest,			\
-	.header_size		= sizeof(struct ip_set_req_##type##_create),\
-	.list_header		= &type##_list_header,			\
-	.list_members_size	= &type##_list_members_size,		\
-	.list_members		= &type##_list_members,			\
-	.me			= THIS_MODULE,				\
-};
-#endif /* __KERNEL */
-
-#endif /* __IP_SET_BITMAPS_H */

extensions/ipset/ip_set_compat.h

@@ -1,92 +0,0 @@
-#ifndef _IP_SET_COMPAT_H
-#define _IP_SET_COMPAT_H
-
-#ifdef __KERNEL__
-#include <linux/version.h>
-
-/* Arrgh */
-#ifdef MODULE
-#define __MOD_INC(foo)		__MOD_INC_USE_COUNT(foo)
-#define __MOD_DEC(foo)		__MOD_DEC_USE_COUNT(foo)
-#else
-#define __MOD_INC(foo)		1
-#define __MOD_DEC(foo)
-#endif
-
-/* Backward compatibility */
-#ifndef __nocast
-#define __nocast
-#endif
-#ifndef __bitwise__
-#define __bitwise__
-#endif
-
-/* Compatibility glue code */
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
-#include <linux/interrupt.h>
-#define DEFINE_RWLOCK(x)                rwlock_t x = RW_LOCK_UNLOCKED
-#define try_module_get(x)		__MOD_INC(x)
-#define module_put(x)                   __MOD_DEC(x)
-#define __clear_bit(nr, addr)		clear_bit(nr, addr)
-#define __set_bit(nr, addr)		set_bit(nr, addr)
-#define __test_and_set_bit(nr, addr)	test_and_set_bit(nr, addr)
-#define __test_and_clear_bit(nr, addr)	test_and_clear_bit(nr, addr)
-
-typedef unsigned __bitwise__ gfp_t;
-
-static inline void *kzalloc(size_t size, gfp_t flags)
-{
-	void *data = kmalloc(size, flags);
-	
-	if (data)
-		memset(data, 0, size);
-	
-	return data;
-}
-#endif
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
-#define __KMEM_CACHE_T__	kmem_cache_t
-#else
-#define __KMEM_CACHE_T__	struct kmem_cache
-#endif
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)
-#define ip_hdr(skb)		((skb)->nh.iph)
-#define skb_mac_header(skb)	((skb)->mac.raw)
-#define eth_hdr(skb)		((struct ethhdr *)skb_mac_header(skb))
-#endif
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,23)
-#include <linux/netfilter.h>
-#define KMEM_CACHE_CREATE(name, size) \
-	kmem_cache_create(name, size, 0, 0, NULL, NULL)
-#else
-#define KMEM_CACHE_CREATE(name, size) \
-	kmem_cache_create(name, size, 0, 0, NULL)
-#endif
-
-#ifndef NIPQUAD
-#define NIPQUAD(addr) \
-	((unsigned char *)&addr)[0], \
-	((unsigned char *)&addr)[1], \
-	((unsigned char *)&addr)[2], \
-	((unsigned char *)&addr)[3]
-#endif
-
-#ifndef HIPQUAD
-#if defined(__LITTLE_ENDIAN)
-#define HIPQUAD(addr) \
-	((unsigned char *)&addr)[3], \
-	((unsigned char *)&addr)[2], \
-	((unsigned char *)&addr)[1], \
-	((unsigned char *)&addr)[0]
-#elif defined(__BIG_ENDIAN)
-#define HIPQUAD NIPQUAD
-#else
-#error "Please fix asm/byteorder.h"
-#endif /* __LITTLE_ENDIAN */
-#endif
-
-#endif /* __KERNEL__ */
-#endif /* _IP_SET_COMPAT_H */   

extensions/ipset/ip_set_getport.h

@@ -1,48 +0,0 @@
-#ifndef _IP_SET_GETPORT_H
-#define _IP_SET_GETPORT_H
-
-#ifdef __KERNEL__
-
-#define INVALID_PORT	(MAX_RANGE + 1)
-
-/* We must handle non-linear skbs */
-static inline ip_set_ip_t
-get_port(const struct sk_buff *skb, const u_int32_t *flags)
-{
-	struct iphdr *iph = ip_hdr(skb);
-	u_int16_t offset = ntohs(iph->frag_off) & IP_OFFSET;
-	switch (iph->protocol) {
-	case IPPROTO_TCP: {
-		struct tcphdr tcph;
-		
-		/* See comments at tcp_match in ip_tables.c */
-		if (offset)
-			return INVALID_PORT;
-
-		if (skb_copy_bits(skb, ip_hdr(skb)->ihl*4, &tcph, sizeof(tcph)) < 0)
-			/* No choice either */
-			return INVALID_PORT;
-	     	
-	     	return ntohs(flags[0] & IPSET_SRC ?
-			     tcph.source : tcph.dest);
-	    }
-	case IPPROTO_UDP: {
-		struct udphdr udph;
-
-		if (offset)
-			return INVALID_PORT;
-
-		if (skb_copy_bits(skb, ip_hdr(skb)->ihl*4, &udph, sizeof(udph)) < 0)
-			/* No choice either */
-			return INVALID_PORT;
-	     	
-	     	return ntohs(flags[0] & IPSET_SRC ?
-			     udph.source : udph.dest);
-	    }
-	default:
-		return INVALID_PORT;
-	}
-}
-#endif				/* __KERNEL__ */
-
-#endif /*_IP_SET_GETPORT_H*/

extensions/ipset/ip_set_hashes.h

@@ -1,314 +0,0 @@
-#ifndef __IP_SET_HASHES_H
-#define __IP_SET_HASHES_H
-
-#define initval_t uint32_t
-
-/* Macros to generate functions */
-
-#ifdef __KERNEL__
-#define HASH_RETRY0(type, dtype, cond)					\
-static int								\
-type##_retry(struct ip_set *set)					\
-{									\
-	struct ip_set_##type *map = set->data, *tmp;			\
-	dtype *elem;							\
-	void *members;							\
-	u_int32_t i, hashsize = map->hashsize;				\
-	int res;							\
-									\
-	if (map->resize == 0)						\
-		return -ERANGE;						\
-									\
-    again:								\
-    	res = 0;							\
-    									\
-	/* Calculate new hash size */					\
-	hashsize += (hashsize * map->resize)/100;			\
-	if (hashsize == map->hashsize)					\
-		hashsize++;						\
-									\
-	ip_set_printk("rehashing of set %s triggered: "			\
-		      "hashsize grows from %lu to %lu",			\
-		      set->name,					\
-		      (long unsigned)map->hashsize,			\
-		      (long unsigned)hashsize);				\
-		      							\
-	tmp = kmalloc(sizeof(struct ip_set_##type)			\
-		      + map->probes * sizeof(initval_t), GFP_ATOMIC);	\
-	if (!tmp) {							\
-		DP("out of memory for %zu bytes",			\
-		   sizeof(struct ip_set_##type)				\
-		   + map->probes * sizeof(initval_t));			\
-		return -ENOMEM;						\
-	}								\
-	tmp->members = harray_malloc(hashsize, sizeof(dtype), GFP_ATOMIC);\
-	if (!tmp->members) {						\
-		DP("out of memory for %zu bytes", hashsize * sizeof(dtype));\
-		kfree(tmp);						\
-		return -ENOMEM;						\
-	}								\
-	tmp->hashsize = hashsize;					\
-	tmp->elements = 0;						\
-	tmp->probes = map->probes;					\
-	tmp->resize = map->resize;					\
-	memcpy(tmp->initval, map->initval, map->probes * sizeof(initval_t));\
-	__##type##_retry(tmp, map);					\
-									\
-	write_lock_bh(&set->lock);					\
-	map = set->data; /* Play safe */				\
-	for (i = 0; i < map->hashsize && res == 0; i++) {		\
-		elem = HARRAY_ELEM(map->members, dtype *, i);		\
-		if (cond)						\
-			res = __##type##_add(tmp, elem);		\
-	}								\
-	if (res) {							\
-		/* Failure, try again */				\
-		write_unlock_bh(&set->lock);				\
-		harray_free(tmp->members);				\
-		kfree(tmp);						\
-		goto again;						\
-	}								\
-									\
-	/* Success at resizing! */					\
-	members = map->members;						\
-									\
-	map->hashsize = tmp->hashsize;					\
-	map->members = tmp->members;					\
-	write_unlock_bh(&set->lock);					\
-									\
-	harray_free(members);						\
-	kfree(tmp);							\
-									\
-	return 0;							\
-}
-
-#define HASH_RETRY(type, dtype)						\
-	HASH_RETRY0(type, dtype, *elem)
-
-#define HASH_RETRY2(type, dtype)						\
-	HASH_RETRY0(type, dtype, elem->ip || elem->ip1)
-
-#define HASH_CREATE(type, dtype)					\
-static int								\
-type##_create(struct ip_set *set, const void *data, u_int32_t size)	\
-{									\
-	const struct ip_set_req_##type##_create *req = data;		\
-	struct ip_set_##type *map;					\
-	uint16_t i;							\
-									\
-	if (req->hashsize < 1) {					\
-		ip_set_printk("hashsize too small");			\
-		return -ENOEXEC;					\
-	}								\
-									\
-	if (req->probes < 1) {						\
-		ip_set_printk("probes too small");			\
-		return -ENOEXEC;					\
-	}								\
-									\
-	map = kmalloc(sizeof(struct ip_set_##type)			\
-		      + req->probes * sizeof(initval_t), GFP_KERNEL);	\
-	if (!map) {							\
-		DP("out of memory for %zu bytes",			\
-		   sizeof(struct ip_set_##type)				\
-		   + req->probes * sizeof(initval_t));			\
-		return -ENOMEM;						\
-	}								\
-	for (i = 0; i < req->probes; i++)				\
-		get_random_bytes(((initval_t *) map->initval)+i, 4);	\
-	map->elements = 0;						\
-	map->hashsize = req->hashsize;					\
-	map->probes = req->probes;					\
-	map->resize = req->resize;					\
-	if (__##type##_create(req, map)) {				\
-		kfree(map);						\
-		return -ENOEXEC;					\
-	}								\
-	map->members = harray_malloc(map->hashsize, sizeof(dtype), GFP_KERNEL);\
-	if (!map->members) {						\
-		DP("out of memory for %zu bytes", map->hashsize * sizeof(dtype));\
-		kfree(map);						\
-		return -ENOMEM;						\
-	}								\
-									\
-	set->data = map;						\
-	return 0;							\
-}
-
-#define HASH_DESTROY(type)						\
-static void								\
-type##_destroy(struct ip_set *set)					\
-{									\
-	struct ip_set_##type *map = set->data;				\
-									\
-	harray_free(map->members);					\
-	kfree(map);							\
-									\
-	set->data = NULL;						\
-}
-
-#define HASH_FLUSH(type, dtype)						\
-static void								\
-type##_flush(struct ip_set *set)					\
-{									\
-	struct ip_set_##type *map = set->data;				\
-	harray_flush(map->members, map->hashsize, sizeof(dtype));	\
-	map->elements = 0;						\
-}
-
-#define HASH_FLUSH_CIDR(type, dtype)					\
-static void								\
-type##_flush(struct ip_set *set)					\
-{									\
-	struct ip_set_##type *map = set->data;				\
-	harray_flush(map->members, map->hashsize, sizeof(dtype));	\
-	memset(map->cidr, 0, sizeof(map->cidr));			\
-	memset(map->nets, 0, sizeof(map->nets));			\
-	map->elements = 0;						\
-}
-
-#define HASH_LIST_HEADER(type)						\
-static void								\
-type##_list_header(const struct ip_set *set, void *data)		\
-{									\
-	const struct ip_set_##type *map = set->data;			\
-	struct ip_set_req_##type##_create *header = data;		\
-									\
-	header->hashsize = map->hashsize;				\
-	header->probes = map->probes;					\
-	header->resize = map->resize;					\
-	__##type##_list_header(map, header);				\
-}
-
-#define HASH_LIST_MEMBERS_SIZE(type, dtype)				\
-static int								\
-type##_list_members_size(const struct ip_set *set, char dont_align)	\
-{									\
-	const struct ip_set_##type *map = set->data;			\
-									\
-	return (map->elements * IPSET_VALIGN(sizeof(dtype), dont_align));\
-}
-
-#define HASH_LIST_MEMBERS(type, dtype)					\
-static void								\
-type##_list_members(const struct ip_set *set, void *data, char dont_align)\
-{									\
-	const struct ip_set_##type *map = set->data;			\
-	dtype *elem, *d;						\
-	uint32_t i, n = 0;						\
-									\
-	for (i = 0; i < map->hashsize; i++) {				\
-		elem = HARRAY_ELEM(map->members, dtype *, i);		\
-		if (*elem) {						\
-			d = data + n * IPSET_VALIGN(sizeof(dtype), dont_align);\
-			*d = *elem;					\
-			n++;						\
-		}							\
-	}								\
-}
-
-#define HASH_LIST_MEMBERS_MEMCPY(type, dtype, nonzero)			\
-static void								\
-type##_list_members(const struct ip_set *set, void *data, char dont_align)\
-{									\
-	const struct ip_set_##type *map = set->data;			\
-	dtype *elem;							\
-	uint32_t i, n = 0;						\
-									\
-	for (i = 0; i < map->hashsize; i++) {				\
-		elem = HARRAY_ELEM(map->members, dtype *, i);		\
-		if (nonzero) {						\
-			memcpy(data + n * IPSET_VALIGN(sizeof(dtype), dont_align),\
-			       elem, sizeof(dtype));			\
-			n++;						\
-		}							\
-	}								\
-}
-
-#define IP_SET_RTYPE(type, __features)					\
-struct ip_set_type ip_set_##type = {					\
-	.typename		= #type,				\
-	.features		= __features,				\
-	.protocol_version	= IP_SET_PROTOCOL_VERSION,		\
-	.create			= &type##_create,			\
-	.retry			= &type##_retry,			\
-	.destroy		= &type##_destroy,			\
-	.flush			= &type##_flush,			\
-	.reqsize		= sizeof(struct ip_set_req_##type),	\
-	.addip			= &type##_uadd,				\
-	.addip_kernel		= &type##_kadd,				\
-	.delip			= &type##_udel,				\
-	.delip_kernel		= &type##_kdel,				\
-	.testip			= &type##_utest,			\
-	.testip_kernel		= &type##_ktest,			\
-	.header_size		= sizeof(struct ip_set_req_##type##_create),\
-	.list_header		= &type##_list_header,			\
-	.list_members_size	= &type##_list_members_size,		\
-	.list_members		= &type##_list_members,			\
-	.me			= THIS_MODULE,				\
-};
-
-/* Helper functions */
-static inline void
-add_cidr_size(uint8_t *cidr, uint8_t size)
-{
-	uint8_t next;
-	int i;
-	
-	for (i = 0; i < 30 && cidr[i]; i++) {
-		if (cidr[i] < size) {
-			next = cidr[i];
-			cidr[i] = size;
-			size = next;
-		}
-	}
-	if (i < 30)
-		cidr[i] = size;
-}
-
-static inline void
-del_cidr_size(uint8_t *cidr, uint8_t size)
-{
-	int i;
-	
-	for (i = 0; i < 29 && cidr[i]; i++) {
-		if (cidr[i] == size)
-			cidr[i] = size = cidr[i+1];
-	}
-	cidr[29] = 0;
-}
-#else
-#include <arpa/inet.h>
-#endif /* __KERNEL */
-
-#ifndef UINT16_MAX
-#define UINT16_MAX 65535
-#endif
-
-static unsigned char shifts[] = {255, 253, 249, 241, 225, 193, 129, 1};
-
-static inline ip_set_ip_t 
-pack_ip_cidr(ip_set_ip_t ip, unsigned char cidr)
-{
-	ip_set_ip_t addr, *paddr = &addr;
-	unsigned char n, t, *a;
-
-	addr = htonl(ip & (0xFFFFFFFF << (32 - (cidr))));
-#ifdef __KERNEL__
-	DP("ip:%u.%u.%u.%u/%u", NIPQUAD(addr), cidr);
-#endif
-	n = cidr / 8;
-	t = cidr % 8;	
-	a = &((unsigned char *)paddr)[n];
-	*a = *a /(1 << (8 - t)) + shifts[t];
-#ifdef __KERNEL__
-	DP("n: %u, t: %u, a: %u", n, t, *a);
-	DP("ip:%u.%u.%u.%u/%u, %u.%u.%u.%u",
-	   HIPQUAD(ip), cidr, NIPQUAD(addr));
-#endif
-
-	return ntohl(addr);
-}
-
-
-#endif /* __IP_SET_HASHES_H */

extensions/ipset/ip_set_iphash.c

@@ -1,164 +0,0 @@
-/* Copyright (C) 2003-2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/* Kernel module implementing an ip hash set */
-
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/ip.h>
-#include <linux/skbuff.h>
-#include "ip_set_jhash.h"
-#include <linux/errno.h>
-#include <asm/uaccess.h>
-#include <asm/bitops.h>
-#include <linux/spinlock.h>
-#include <linux/random.h>
-
-#include <net/ip.h>
-
-#include "ip_set_iphash.h"
-
-static int limit = MAX_RANGE;
-
-static inline __u32
-iphash_id(struct ip_set *set, ip_set_ip_t ip)
-{
-	struct ip_set_iphash *map = set->data;
-	__u32 id;
-	u_int16_t i;
-	ip_set_ip_t *elem;
-
-
-	ip &= map->netmask;	
-	DP("set: %s, ip:%u.%u.%u.%u", set->name, HIPQUAD(ip));
-	for (i = 0; i < map->probes; i++) {
-		id = jhash_ip(map, i, ip) % map->hashsize;
-		DP("hash key: %u", id);
-		elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
-		if (*elem == ip)
-			return id;
-		/* No shortcut - there can be deleted entries. */
-	}
-	return UINT_MAX;
-}
-
-static inline int
-iphash_test(struct ip_set *set, ip_set_ip_t ip)
-{
-	return (ip && iphash_id(set, ip) != UINT_MAX);
-}
-
-#define KADT_CONDITION
-
-UADT(iphash, test)
-KADT(iphash, test, ipaddr)
-
-static inline int
-__iphash_add(struct ip_set_iphash *map, ip_set_ip_t *ip)
-{
-	__u32 probe;
-	u_int16_t i;
-	ip_set_ip_t *elem, *slot = NULL;
-	
-	for (i = 0; i < map->probes; i++) {
-		probe = jhash_ip(map, i, *ip) % map->hashsize;
-		elem = HARRAY_ELEM(map->members, ip_set_ip_t *, probe);
-		if (*elem == *ip)
-			return -EEXIST;
-		if (!(slot || *elem))
-			slot = elem;
-		/* There can be deleted entries, must check all slots */
-	}
-	if (slot) {
-		*slot = *ip;
-		map->elements++;
-		return 0;
-	}
-	/* Trigger rehashing */
-	return -EAGAIN;
-}
-
-static inline int
-iphash_add(struct ip_set *set, ip_set_ip_t ip)
-{
-	struct ip_set_iphash *map = set->data;
-	
-	if (!ip || map->elements >= limit)
-		return -ERANGE;
-
-	ip &= map->netmask;
-	return __iphash_add(map, &ip);
-}
-
-UADT(iphash, add)
-KADT(iphash, add, ipaddr)
-
-static inline void
-__iphash_retry(struct ip_set_iphash *tmp, struct ip_set_iphash *map)
-{
-	tmp->netmask = map->netmask;
-}
-
-HASH_RETRY(iphash, ip_set_ip_t)
-
-static inline int
-iphash_del(struct ip_set *set, ip_set_ip_t ip)
-{
-	struct ip_set_iphash *map = set->data;
-	ip_set_ip_t id, *elem;
-
-	if (!ip)
-		return -ERANGE;
-
-	id = iphash_id(set, ip);
-	if (id == UINT_MAX)
-		return -EEXIST;
-		
-	elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
-	*elem = 0;
-	map->elements--;
-
-	return 0;
-}
-
-UADT(iphash, del)
-KADT(iphash, del, ipaddr)
-
-static inline int
-__iphash_create(const struct ip_set_req_iphash_create *req,
-		struct ip_set_iphash *map)
-{
-	map->netmask = req->netmask;
-	
-	return 0;
-}
-
-HASH_CREATE(iphash, ip_set_ip_t)
-HASH_DESTROY(iphash)
-
-HASH_FLUSH(iphash, ip_set_ip_t)
-
-static inline void
-__iphash_list_header(const struct ip_set_iphash *map,
-		     struct ip_set_req_iphash_create *header)
-{    
-	header->netmask = map->netmask;
-}
-
-HASH_LIST_HEADER(iphash)
-HASH_LIST_MEMBERS_SIZE(iphash, ip_set_ip_t)
-HASH_LIST_MEMBERS(iphash, ip_set_ip_t)
-
-IP_SET_RTYPE(iphash, IPSET_TYPE_IP | IPSET_DATA_SINGLE)
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
-MODULE_DESCRIPTION("iphash type of IP sets");
-module_param(limit, int, 0600);
-MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
-
-REGISTER_MODULE(iphash)

extensions/ipset/ip_set_iphash.h

@@ -1,30 +0,0 @@
-#ifndef __IP_SET_IPHASH_H
-#define __IP_SET_IPHASH_H
-
-#include "ip_set.h"
-#include "ip_set_hashes.h"
-
-#define SETTYPE_NAME		"iphash"
-
-struct ip_set_iphash {
-	ip_set_ip_t *members;		/* the iphash proper */
-	uint32_t elements;		/* number of elements */
-	uint32_t hashsize;		/* hash size */
-	uint16_t probes;		/* max number of probes  */
-	uint16_t resize;		/* resize factor in percent */
-	ip_set_ip_t netmask;		/* netmask */
-	initval_t initval[0];		/* initvals for jhash_1word */
-};
-
-struct ip_set_req_iphash_create {
-	uint32_t hashsize;
-	uint16_t probes;
-	uint16_t resize;
-	ip_set_ip_t netmask;
-};
-
-struct ip_set_req_iphash {
-	ip_set_ip_t ip;
-};
-
-#endif	/* __IP_SET_IPHASH_H */

extensions/ipset/ip_set_ipmap.c

@@ -1,158 +0,0 @@
-/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
- *                         Patrick Schaaf <bof@bof.de>
- * Copyright (C) 2003-2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/* Kernel module implementing an IP set type: the single bitmap type */
-
-#include <linux/module.h>
-#include <linux/ip.h>
-#include <linux/skbuff.h>
-#include <linux/errno.h>
-#include <asm/uaccess.h>
-#include <asm/bitops.h>
-#include <linux/spinlock.h>
-
-#include "ip_set_ipmap.h"
-
-static inline ip_set_ip_t
-ip_to_id(const struct ip_set_ipmap *map, ip_set_ip_t ip)
-{
-	return ((ip & map->netmask) - map->first_ip)/map->hosts;
-}
-
-static inline int
-ipmap_test(const struct ip_set *set, ip_set_ip_t ip)
-{
-	const struct ip_set_ipmap *map = set->data;
-	
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -ERANGE;
-
-	DP("set: %s, ip:%u.%u.%u.%u", set->name, HIPQUAD(ip));
-	return !!test_bit(ip_to_id(map, ip), map->members);
-}
-
-#define KADT_CONDITION
-
-UADT(ipmap, test)
-KADT(ipmap, test, ipaddr)
-
-static inline int
-ipmap_add(struct ip_set *set, ip_set_ip_t ip)
-{
-	struct ip_set_ipmap *map = set->data;
-
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -ERANGE;
-
-	DP("set: %s, ip:%u.%u.%u.%u", set->name, HIPQUAD(ip));
-	if (test_and_set_bit(ip_to_id(map, ip), map->members))
-		return -EEXIST;
-
-	return 0;
-}
-
-UADT(ipmap, add)
-KADT(ipmap, add, ipaddr)
-
-static inline int
-ipmap_del(struct ip_set *set, ip_set_ip_t ip)
-{
-	struct ip_set_ipmap *map = set->data;
-
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -ERANGE;
-
-	DP("set: %s, ip:%u.%u.%u.%u", set->name, HIPQUAD(ip));
-	if (!test_and_clear_bit(ip_to_id(map, ip), map->members))
-		return -EEXIST;
-	
-	return 0;
-}
-
-UADT(ipmap, del)
-KADT(ipmap, del, ipaddr)
-
-static inline int
-__ipmap_create(const struct ip_set_req_ipmap_create *req,
-	       struct ip_set_ipmap *map)
-{
-	map->netmask = req->netmask;
-
-	if (req->netmask == 0xFFFFFFFF) {
-		map->hosts = 1;
-		map->sizeid = map->last_ip - map->first_ip + 1;
-	} else {
-		unsigned int mask_bits, netmask_bits;
-		ip_set_ip_t mask;
-
-		map->first_ip &= map->netmask;	/* Should we better bark? */
-
-		mask = range_to_mask(map->first_ip, map->last_ip, &mask_bits);
-		netmask_bits = mask_to_bits(map->netmask);
-
-		if ((!mask && (map->first_ip || map->last_ip != 0xFFFFFFFF))
-		    || netmask_bits <= mask_bits)
-			return -ENOEXEC;
-
-		DP("mask_bits %u, netmask_bits %u",
-		   mask_bits, netmask_bits);
-		map->hosts = 2 << (32 - netmask_bits - 1);
-		map->sizeid = 2 << (netmask_bits - mask_bits - 1);
-	}
-	if (map->sizeid > MAX_RANGE + 1) {
-		ip_set_printk("range too big, %d elements (max %d)",
-			       map->sizeid, MAX_RANGE+1);
-		return -ENOEXEC;
-	}
-	DP("hosts %u, sizeid %u", map->hosts, map->sizeid);
-	return bitmap_bytes(0, map->sizeid - 1);
-}
-
-BITMAP_CREATE(ipmap)
-BITMAP_DESTROY(ipmap)
-BITMAP_FLUSH(ipmap)
-
-static inline void
-__ipmap_list_header(const struct ip_set_ipmap *map,
-		    struct ip_set_req_ipmap_create *header)
-{
-	header->netmask = map->netmask;
-}
-
-BITMAP_LIST_HEADER(ipmap)
-BITMAP_LIST_MEMBERS_SIZE(ipmap, ip_set_ip_t, map->sizeid,
-			 test_bit(i, map->members))
-
-static void
-ipmap_list_members(const struct ip_set *set, void *data, char dont_align)
-{
-	const struct ip_set_ipmap *map = set->data;
-	uint32_t i, n = 0;
-	ip_set_ip_t *d;
-	
-	if (dont_align) {
-		memcpy(data, map->members, map->size);
-		return;
-	}
-	
-	for (i = 0; i < map->sizeid; i++)
-		if (test_bit(i, map->members)) {
-			d = data + n * IPSET_ALIGN(sizeof(ip_set_ip_t));
-			*d = map->first_ip + i * map->hosts;
-			n++;
-		}
-}
-
-IP_SET_TYPE(ipmap, IPSET_TYPE_IP | IPSET_DATA_SINGLE)
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
-MODULE_DESCRIPTION("ipmap type of IP sets");
-
-REGISTER_MODULE(ipmap)

extensions/ipset/ip_set_ipmap.h

@@ -1,57 +0,0 @@
-#ifndef __IP_SET_IPMAP_H
-#define __IP_SET_IPMAP_H
-
-#include "ip_set.h"
-#include "ip_set_bitmaps.h"
-
-#define SETTYPE_NAME		"ipmap"
-
-struct ip_set_ipmap {
-	void *members;			/* the ipmap proper */
-	ip_set_ip_t first_ip;		/* host byte order, included in range */
-	ip_set_ip_t last_ip;		/* host byte order, included in range */
-	ip_set_ip_t netmask;		/* subnet netmask */
-	ip_set_ip_t sizeid;		/* size of set in IPs */
-	ip_set_ip_t hosts;		/* number of hosts in a subnet */
-	u_int32_t size;			/* size of the ipmap proper */
-};
-
-struct ip_set_req_ipmap_create {
-	ip_set_ip_t from;
-	ip_set_ip_t to;
-	ip_set_ip_t netmask;
-};
-
-struct ip_set_req_ipmap {
-	ip_set_ip_t ip;
-};
-
-static inline unsigned int
-mask_to_bits(ip_set_ip_t mask)
-{
-	unsigned int bits = 32;
-	ip_set_ip_t maskaddr;
-	
-	if (mask == 0xFFFFFFFF)
-		return bits;
-	
-	maskaddr = 0xFFFFFFFE;
-	while (--bits > 0 && maskaddr != mask)
-		maskaddr <<= 1;
-	
-	return bits;
-}
-
-static inline ip_set_ip_t
-range_to_mask(ip_set_ip_t from, ip_set_ip_t to, unsigned int *bits)
-{
-	ip_set_ip_t mask = 0xFFFFFFFE;
-	
-	*bits = 32;
-	while (--(*bits) > 0 && mask && (to & mask) != from)
-		mask <<= 1;
-		
-	return mask;
-}
-	
-#endif /* __IP_SET_IPMAP_H */

extensions/ipset/ip_set_ipporthash.c

@@ -1,197 +0,0 @@
-/* Copyright (C) 2003-2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/* Kernel module implementing an ip+port hash set */
-
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/ip.h>
-#include <linux/tcp.h>
-#include <linux/udp.h>
-#include <linux/skbuff.h>
-#include "ip_set_jhash.h"
-#include <linux/errno.h>
-#include <asm/uaccess.h>
-#include <asm/bitops.h>
-#include <linux/spinlock.h>
-#include <linux/random.h>
-
-#include <net/ip.h>
-
-#include "ip_set_ipporthash.h"
-#include "ip_set_getport.h"
-
-static int limit = MAX_RANGE;
-
-static inline __u32
-ipporthash_id(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t port)
-{
-	struct ip_set_ipporthash *map = set->data;
-	__u32 id;
-	u_int16_t i;
-	ip_set_ip_t *elem;
-
-	ip = pack_ip_port(map, ip, port);
-		
-	if (!ip)
-		return UINT_MAX;
-	
-	for (i = 0; i < map->probes; i++) {
-		id = jhash_ip(map, i, ip) % map->hashsize;
-		DP("hash key: %u", id);
-		elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
-		if (*elem == ip)
-			return id;
-		/* No shortcut - there can be deleted entries. */
-	}
-	return UINT_MAX;
-}
-
-static inline int
-ipporthash_test(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t port)
-{
-	struct ip_set_ipporthash *map = set->data;
-	
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -ERANGE;
-
-	return (ipporthash_id(set, ip, port) != UINT_MAX);
-}
-
-#define KADT_CONDITION						\
-	ip_set_ip_t port;					\
-								\
-	if (flags[1] == 0)					\
-		return 0;					\
-								\
-	port = get_port(skb, flags++);				\
-								\
-	if (port == INVALID_PORT)				\
-		return 0;
-
-UADT(ipporthash, test, req->port)
-KADT(ipporthash, test, ipaddr, port)
-
-static inline int
-__ipporthash_add(struct ip_set_ipporthash *map, ip_set_ip_t *ip)
-{
-	__u32 probe;
-	u_int16_t i;
-	ip_set_ip_t *elem, *slot = NULL;
-
-	for (i = 0; i < map->probes; i++) {
-		probe = jhash_ip(map, i, *ip) % map->hashsize;
-		elem = HARRAY_ELEM(map->members, ip_set_ip_t *, probe);
-		if (*elem == *ip)
-			return -EEXIST;
-		if (!(slot || *elem))
-			slot = elem;
-		/* There can be deleted entries, must check all slots */
-	}
-	if (slot) {
-		*slot = *ip;
-		map->elements++;
-		return 0;
-	}
-	/* Trigger rehashing */
-	return -EAGAIN;
-}
-
-static inline int
-ipporthash_add(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t port)
-{
-	struct ip_set_ipporthash *map = set->data;
-	if (map->elements > limit)
-		return -ERANGE;
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -ERANGE;
-
-	ip = pack_ip_port(map, ip, port);
-
-	if (!ip)
-		return -ERANGE;
-	
-	return __ipporthash_add(map, &ip);
-}
-
-UADT(ipporthash, add, req->port)
-KADT(ipporthash, add, ipaddr, port)
-
-static inline void
-__ipporthash_retry(struct ip_set_ipporthash *tmp,
-		   struct ip_set_ipporthash *map)
-{
-	tmp->first_ip = map->first_ip;
-	tmp->last_ip = map->last_ip;
-}
-
-HASH_RETRY(ipporthash, ip_set_ip_t)
-
-static inline int
-ipporthash_del(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t port)
-{
-	struct ip_set_ipporthash *map = set->data;
-	ip_set_ip_t id;
-	ip_set_ip_t *elem;
-
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -ERANGE;
-
-	id = ipporthash_id(set, ip, port);
-
-	if (id == UINT_MAX)
-		return -EEXIST;
-		
-	elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
-	*elem = 0;
-	map->elements--;
-
-	return 0;
-}
-
-UADT(ipporthash, del, req->port)
-KADT(ipporthash, del, ipaddr, port)
-
-static inline int
-__ipporthash_create(const struct ip_set_req_ipporthash_create *req,
-		    struct ip_set_ipporthash *map)
-{
-	if (req->to - req->from > MAX_RANGE) {
-		ip_set_printk("range too big, %d elements (max %d)",
-			      req->to - req->from + 1, MAX_RANGE+1);
-		return -ENOEXEC;
-	}
-	map->first_ip = req->from;
-	map->last_ip = req->to;
-	return 0;
-}
-
-HASH_CREATE(ipporthash, ip_set_ip_t)
-HASH_DESTROY(ipporthash)
-HASH_FLUSH(ipporthash, ip_set_ip_t)
-
-static inline void
-__ipporthash_list_header(const struct ip_set_ipporthash *map,
-			 struct ip_set_req_ipporthash_create *header)
-{
-	header->from = map->first_ip;
-	header->to = map->last_ip;
-}
-
-HASH_LIST_HEADER(ipporthash)
-HASH_LIST_MEMBERS_SIZE(ipporthash, ip_set_ip_t)
-HASH_LIST_MEMBERS(ipporthash, ip_set_ip_t)
-
-IP_SET_RTYPE(ipporthash, IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_DATA_DOUBLE)
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
-MODULE_DESCRIPTION("ipporthash type of IP sets");
-module_param(limit, int, 0600);
-MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
-
-REGISTER_MODULE(ipporthash)

extensions/ipset/ip_set_ipporthash.h

@@ -1,33 +0,0 @@
-#ifndef __IP_SET_IPPORTHASH_H
-#define __IP_SET_IPPORTHASH_H
-
-#include "ip_set.h"
-#include "ip_set_hashes.h"
-
-#define SETTYPE_NAME			"ipporthash"
-
-struct ip_set_ipporthash {
-	ip_set_ip_t *members;		/* the ipporthash proper */
-	uint32_t elements;		/* number of elements */
-	uint32_t hashsize;		/* hash size */
-	uint16_t probes;		/* max number of probes  */
-	uint16_t resize;		/* resize factor in percent */
-	ip_set_ip_t first_ip;		/* host byte order, included in range */
-	ip_set_ip_t last_ip;		/* host byte order, included in range */
-	initval_t initval[0];		/* initvals for jhash_1word */
-};
-
-struct ip_set_req_ipporthash_create {
-	uint32_t hashsize;
-	uint16_t probes;
-	uint16_t resize;
-	ip_set_ip_t from;
-	ip_set_ip_t to;
-};
-
-struct ip_set_req_ipporthash {
-	ip_set_ip_t ip;
-	ip_set_ip_t port;
-};
-
-#endif	/* __IP_SET_IPPORTHASH_H */

extensions/ipset/ip_set_ipportiphash.c

@@ -1,215 +0,0 @@
-/* Copyright (C) 2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/* Kernel module implementing an ip+port+ip hash set */
-
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/ip.h>
-#include <linux/tcp.h>
-#include <linux/udp.h>
-#include <linux/skbuff.h>
-#include "ip_set_jhash.h"
-#include <linux/errno.h>
-#include <asm/uaccess.h>
-#include <asm/bitops.h>
-#include <linux/spinlock.h>
-#include <linux/random.h>
-
-#include <net/ip.h>
-
-#include "ip_set_ipportiphash.h"
-#include "ip_set_getport.h"
-
-static int limit = MAX_RANGE;
-
-#define jhash_ip2(map, i, ipport, ip1)		\
-	jhash_2words(ipport, ip1, *(map->initval + i))
-
-static inline __u32
-ipportiphash_id(struct ip_set *set,
-		ip_set_ip_t ip, ip_set_ip_t port, ip_set_ip_t ip1)
-{
-	struct ip_set_ipportiphash *map = set->data;
-	__u32 id;
-	u_int16_t i;
-	struct ipportip *elem;
-
-	ip = pack_ip_port(map, ip, port);
-	if (!(ip || ip1))
-		return UINT_MAX;
-	
-	for (i = 0; i < map->probes; i++) {
-		id = jhash_ip2(map, i, ip, ip1) % map->hashsize;
-		DP("hash key: %u", id);
-		elem = HARRAY_ELEM(map->members, struct ipportip *, id);
-		if (elem->ip == ip && elem->ip1 == ip1)
-			return id;
-		/* No shortcut - there can be deleted entries. */
-	}
-	return UINT_MAX;
-}
-
-static inline int
-ipportiphash_test(struct ip_set *set,
-		  ip_set_ip_t ip, ip_set_ip_t port, ip_set_ip_t ip1)
-{
-	struct ip_set_ipportiphash *map = set->data;
-	
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -ERANGE;
-
-	return (ipportiphash_id(set, ip, port, ip1) != UINT_MAX);
-}
-
-#define KADT_CONDITION						\
-	ip_set_ip_t port, ip1;					\
-								\
-	if (flags[2] == 0)					\
-		return 0;					\
-								\
-	port = get_port(skb, flags++);				\
-	ip1 = ipaddr(skb, flags++);				\
-								\
-	if (port == INVALID_PORT)				\
-		return 0;
-
-UADT(ipportiphash, test, req->port, req->ip1)
-KADT(ipportiphash, test, ipaddr, port, ip1)
-
-static inline int
-__ipportip_add(struct ip_set_ipportiphash *map,
-	       ip_set_ip_t ip, ip_set_ip_t ip1)
-{
-	__u32 probe;
-	u_int16_t i;
-	struct ipportip *elem, *slot = NULL;
-
-	for (i = 0; i < map->probes; i++) {
-		probe = jhash_ip2(map, i, ip, ip1) % map->hashsize;
-		elem = HARRAY_ELEM(map->members, struct ipportip *, probe);
-		if (elem->ip == ip && elem->ip1 == ip1)
-			return -EEXIST;
-		if (!(slot || elem->ip || elem->ip1))
-			slot = elem;
-		/* There can be deleted entries, must check all slots */
-	}
-	if (slot) {
-		slot->ip = ip;
-		slot->ip1 = ip1;
-		map->elements++;
-		return 0;
-	}
-	/* Trigger rehashing */
-	return -EAGAIN;
-}
-
-static inline int
-__ipportiphash_add(struct ip_set_ipportiphash *map,
-		   struct ipportip *elem)
-{
-	return __ipportip_add(map, elem->ip, elem->ip1);
-}
-
-static inline int
-ipportiphash_add(struct ip_set *set,
-		 ip_set_ip_t ip, ip_set_ip_t port, ip_set_ip_t ip1)
-{
-	struct ip_set_ipportiphash *map = set->data;
-	
-	if (map->elements > limit)
-		return -ERANGE;
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -ERANGE;
-
-	ip = pack_ip_port(map, ip, port);
-	if (!(ip || ip1))
-		return -ERANGE;
-	
-	return __ipportip_add(map, ip, ip1);
-}
-
-UADT(ipportiphash, add, req->port, req->ip1)
-KADT(ipportiphash, add, ipaddr, port, ip1)
-
-static inline void
-__ipportiphash_retry(struct ip_set_ipportiphash *tmp,
-		     struct ip_set_ipportiphash *map)
-{
-	tmp->first_ip = map->first_ip;
-	tmp->last_ip = map->last_ip;
-}
-
-HASH_RETRY2(ipportiphash, struct ipportip)
-
-static inline int
-ipportiphash_del(struct ip_set *set,
-	       ip_set_ip_t ip, ip_set_ip_t port, ip_set_ip_t ip1)
-{
-	struct ip_set_ipportiphash *map = set->data;
-	ip_set_ip_t id;
-	struct ipportip *elem;
-
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -ERANGE;
-
-	id = ipportiphash_id(set, ip, port, ip1);
-
-	if (id == UINT_MAX)
-		return -EEXIST;
-		
-	elem = HARRAY_ELEM(map->members, struct ipportip *, id);
-	elem->ip = elem->ip1 = 0;
-	map->elements--;
-
-	return 0;
-}
-
-UADT(ipportiphash, del, req->port, req->ip1)
-KADT(ipportiphash, del, ipaddr, port, ip1)
-
-static inline int
-__ipportiphash_create(const struct ip_set_req_ipportiphash_create *req,
-		      struct ip_set_ipportiphash *map)
-{
-	if (req->to - req->from > MAX_RANGE) {
-		ip_set_printk("range too big, %d elements (max %d)",
-			      req->to - req->from + 1, MAX_RANGE+1);
-		return -ENOEXEC;
-	}
-	map->first_ip = req->from;
-	map->last_ip = req->to;
-	return 0;
-}
-
-HASH_CREATE(ipportiphash, struct ipportip)
-HASH_DESTROY(ipportiphash)
-HASH_FLUSH(ipportiphash, struct ipportip)
-
-static inline void
-__ipportiphash_list_header(const struct ip_set_ipportiphash *map,
-			   struct ip_set_req_ipportiphash_create *header)
-{
-	header->from = map->first_ip;
-	header->to = map->last_ip;
-}
-
-HASH_LIST_HEADER(ipportiphash)
-HASH_LIST_MEMBERS_SIZE(ipportiphash, struct ipportip)
-HASH_LIST_MEMBERS_MEMCPY(ipportiphash, struct ipportip,
-			 (elem->ip || elem->ip1))
-
-IP_SET_RTYPE(ipportiphash, IPSET_TYPE_IP | IPSET_TYPE_PORT
-			   | IPSET_TYPE_IP1 | IPSET_DATA_TRIPLE)
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
-MODULE_DESCRIPTION("ipportiphash type of IP sets");
-module_param(limit, int, 0600);
-MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
-
-REGISTER_MODULE(ipportiphash)

extensions/ipset/ip_set_ipportiphash.h

@@ -1,39 +0,0 @@
-#ifndef __IP_SET_IPPORTIPHASH_H
-#define __IP_SET_IPPORTIPHASH_H
-
-#include "ip_set.h"
-#include "ip_set_hashes.h"
-
-#define SETTYPE_NAME			"ipportiphash"
-
-struct ipportip {
-	ip_set_ip_t ip;
-	ip_set_ip_t ip1;
-};
-
-struct ip_set_ipportiphash {
-	struct ipportip *members;	/* the ipportip proper */
-	uint32_t elements;		/* number of elements */
-	uint32_t hashsize;		/* hash size */
-	uint16_t probes;		/* max number of probes  */
-	uint16_t resize;		/* resize factor in percent */
-	ip_set_ip_t first_ip;		/* host byte order, included in range */
-	ip_set_ip_t last_ip;		/* host byte order, included in range */
-	initval_t initval[0];		/* initvals for jhash_1word */
-};
-
-struct ip_set_req_ipportiphash_create {
-	uint32_t hashsize;
-	uint16_t probes;
-	uint16_t resize;
-	ip_set_ip_t from;
-	ip_set_ip_t to;
-};
-
-struct ip_set_req_ipportiphash {
-	ip_set_ip_t ip;
-	ip_set_ip_t port;
-	ip_set_ip_t ip1;
-};
-
-#endif	/* __IP_SET_IPPORTIPHASH_H */

extensions/ipset/ip_set_ipportnethash.c

@@ -1,298 +0,0 @@
-/* Copyright (C) 2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/* Kernel module implementing an ip+port+net hash set */
-
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/ip.h>
-#include <linux/tcp.h>
-#include <linux/udp.h>
-#include <linux/skbuff.h>
-#include "ip_set_jhash.h"
-#include <linux/errno.h>
-#include <asm/uaccess.h>
-#include <asm/bitops.h>
-#include <linux/spinlock.h>
-#include <linux/random.h>
-
-#include <net/ip.h>
-
-#include "ip_set_ipportnethash.h"
-#include "ip_set_getport.h"
-
-static int limit = MAX_RANGE;
-
-#define jhash_ip2(map, i, ipport, ip1)		\
-	jhash_2words(ipport, ip1, *(map->initval + i))
-
-static inline __u32
-ipportnethash_id_cidr(struct ip_set *set,
-		      ip_set_ip_t ip, ip_set_ip_t port,
-		      ip_set_ip_t ip1, uint8_t cidr)
-{
-	struct ip_set_ipportnethash *map = set->data;
-	__u32 id;
-	u_int16_t i;
-	struct ipportip *elem;
-
-	ip = pack_ip_port(map, ip, port);
-	ip1 = pack_ip_cidr(ip1, cidr);
-	if (!(ip || ip1))
-		return UINT_MAX;
-	
-	for (i = 0; i < map->probes; i++) {
-		id = jhash_ip2(map, i, ip, ip1) % map->hashsize;
-		DP("hash key: %u", id);
-		elem = HARRAY_ELEM(map->members, struct ipportip *, id);
-		if (elem->ip == ip && elem->ip1 == ip1)
-			return id;
-		/* No shortcut - there can be deleted entries. */
-	}
-	return UINT_MAX;
-}
-
-static inline __u32
-ipportnethash_id(struct ip_set *set,
-		 ip_set_ip_t ip, ip_set_ip_t port, ip_set_ip_t ip1)
-{
-	struct ip_set_ipportnethash *map = set->data;
-	__u32 id = UINT_MAX;
-	int i;
-
-	for (i = 0; i < 30 && map->cidr[i]; i++) {
-		id = ipportnethash_id_cidr(set, ip, port, ip1, map->cidr[i]);
-		if (id != UINT_MAX)
-			break;
-	}
-	return id;
-}
-
-static inline int
-ipportnethash_test_cidr(struct ip_set *set,
-			ip_set_ip_t ip, ip_set_ip_t port,
-			ip_set_ip_t ip1, uint8_t cidr)
-{
-	struct ip_set_ipportnethash *map = set->data;
-	
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -ERANGE;
-
-	return (ipportnethash_id_cidr(set, ip, port, ip1, cidr) != UINT_MAX);
-}
-
-static inline int
-ipportnethash_test(struct ip_set *set,
-		  ip_set_ip_t ip, ip_set_ip_t port, ip_set_ip_t ip1)
-{
-	struct ip_set_ipportnethash *map = set->data;
-	
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -ERANGE;
-
-	return (ipportnethash_id(set, ip, port, ip1) != UINT_MAX);
-}
-
-static int
-ipportnethash_utest(struct ip_set *set, const void *data, u_int32_t size)
-{
-	const struct ip_set_req_ipportnethash *req = data;
-
-	if (req->cidr <= 0 || req->cidr > 32)
-		return -EINVAL;
-	return (req->cidr == 32 
-		? ipportnethash_test(set, req->ip, req->port, req->ip1)
-		: ipportnethash_test_cidr(set, req->ip, req->port,
-					  req->ip1, req->cidr));
-}
-
-#define KADT_CONDITION						\
-	ip_set_ip_t port, ip1;					\
-								\
-	if (flags[2] == 0)					\
-		return 0;					\
-								\
-	port = get_port(skb, flags++);				\
-	ip1 = ipaddr(skb, flags++);				\
-								\
-	if (port == INVALID_PORT)				\
-		return 0;
-
-KADT(ipportnethash, test, ipaddr, port, ip1)
-
-static inline int
-__ipportnet_add(struct ip_set_ipportnethash *map,
-		ip_set_ip_t ip, ip_set_ip_t ip1)
-{
-	__u32 probe;
-	u_int16_t i;
-	struct ipportip *elem, *slot = NULL;
-
-	for (i = 0; i < map->probes; i++) {
-		probe = jhash_ip2(map, i, ip, ip1) % map->hashsize;
-		elem = HARRAY_ELEM(map->members, struct ipportip *, probe);
-		if (elem->ip == ip && elem->ip1 == ip1)
-			return -EEXIST;
-		if (!(slot || elem->ip || elem->ip1))
-			slot = elem;
-		/* There can be deleted entries, must check all slots */
-	}
-	if (slot) {
-		slot->ip = ip;
-		slot->ip1 = ip1;
-		map->elements++;
-		return 0;
-	}
-	/* Trigger rehashing */
-	return -EAGAIN;
-}
-
-static inline int
-__ipportnethash_add(struct ip_set_ipportnethash *map,
-		    struct ipportip *elem)
-{
-	return __ipportnet_add(map, elem->ip, elem->ip1);
-}
-
-static inline int
-ipportnethash_add(struct ip_set *set,
-		 ip_set_ip_t ip, ip_set_ip_t port,
-		 ip_set_ip_t ip1, uint8_t cidr)
-{
-	struct ip_set_ipportnethash *map = set->data;
-	struct ipportip;
-	int ret;
-	
-	if (map->elements > limit)
-		return -ERANGE;
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -ERANGE;
-	if (cidr <= 0 || cidr >= 32)
-		return -EINVAL;
-	if (map->nets[cidr-1] == UINT16_MAX)
-		return -ERANGE;
-
-	ip = pack_ip_port(map, ip, port);
-	ip1 = pack_ip_cidr(ip1, cidr);
-	if (!(ip || ip1))
-		return -ERANGE;
-	
-	ret =__ipportnet_add(map, ip, ip1);
-	if (ret == 0) {
-		if (!map->nets[cidr-1]++)
-			add_cidr_size(map->cidr, cidr);
-	}
-	return ret;
-}
-
-#undef KADT_CONDITION
-#define KADT_CONDITION							\
-	struct ip_set_ipportnethash *map = set->data;			\
-	uint8_t cidr = map->cidr[0] ? map->cidr[0] : 31;		\
-	ip_set_ip_t port, ip1;						\
-									\
-	if (flags[2] == 0)						\
-		return 0;						\
-									\
-	port = get_port(skb, flags++);					\
-	ip1 = ipaddr(skb, flags++);					\
-									\
-	if (port == INVALID_PORT)					\
-		return 0;
-
-UADT(ipportnethash, add, req->port, req->ip1, req->cidr)
-KADT(ipportnethash, add, ipaddr, port, ip1, cidr)
-
-static inline void
-__ipportnethash_retry(struct ip_set_ipportnethash *tmp,
-		      struct ip_set_ipportnethash *map)
-{
-	tmp->first_ip = map->first_ip;
-	tmp->last_ip = map->last_ip;
-	memcpy(tmp->cidr, map->cidr, sizeof(tmp->cidr));
-	memcpy(tmp->nets, map->nets, sizeof(tmp->nets));
-}
-
-HASH_RETRY2(ipportnethash, struct ipportip)
-
-static inline int
-ipportnethash_del(struct ip_set *set,
-	          ip_set_ip_t ip, ip_set_ip_t port,
-	          ip_set_ip_t ip1, uint8_t cidr)
-{
-	struct ip_set_ipportnethash *map = set->data;
-	ip_set_ip_t id;
-	struct ipportip *elem;
-
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -ERANGE;
-	if (!ip)
-		return -ERANGE;
-	if (cidr <= 0 || cidr >= 32)
-		return -EINVAL;	
-
-	id = ipportnethash_id_cidr(set, ip, port, ip1, cidr);
-
-	if (id == UINT_MAX)
-		return -EEXIST;
-		
-	elem = HARRAY_ELEM(map->members, struct ipportip *, id);
-	elem->ip = elem->ip1 = 0;
-	map->elements--;
-	if (!map->nets[cidr-1]--)
-		del_cidr_size(map->cidr, cidr);
-
-	return 0;
-}
-
-UADT(ipportnethash, del, req->port, req->ip1, req->cidr)
-KADT(ipportnethash, del, ipaddr, port, ip1, cidr)
-
-static inline int
-__ipportnethash_create(const struct ip_set_req_ipportnethash_create *req,
-		       struct ip_set_ipportnethash *map)
-{
-	if (req->to - req->from > MAX_RANGE) {
-		ip_set_printk("range too big, %d elements (max %d)",
-			      req->to - req->from + 1, MAX_RANGE+1);
-		return -ENOEXEC;
-	}
-	map->first_ip = req->from;
-	map->last_ip = req->to;
-	memset(map->cidr, 0, sizeof(map->cidr));
-	memset(map->nets, 0, sizeof(map->nets));
-	return 0;
-}
-
-HASH_CREATE(ipportnethash, struct ipportip)
-HASH_DESTROY(ipportnethash)
-HASH_FLUSH_CIDR(ipportnethash, struct ipportip);
-
-static inline void
-__ipportnethash_list_header(const struct ip_set_ipportnethash *map,
-			    struct ip_set_req_ipportnethash_create *header)
-{
-	header->from = map->first_ip;
-	header->to = map->last_ip;
-}
-
-HASH_LIST_HEADER(ipportnethash)
-
-HASH_LIST_MEMBERS_SIZE(ipportnethash, struct ipportip)
-HASH_LIST_MEMBERS_MEMCPY(ipportnethash, struct ipportip,
-			 (elem->ip || elem->ip1))
-
-IP_SET_RTYPE(ipportnethash, IPSET_TYPE_IP | IPSET_TYPE_PORT
-			    | IPSET_TYPE_IP1 | IPSET_DATA_TRIPLE)
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
-MODULE_DESCRIPTION("ipportnethash type of IP sets");
-module_param(limit, int, 0600);
-MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
-
-REGISTER_MODULE(ipportnethash)

extensions/ipset/ip_set_ipportnethash.h

@@ -1,42 +0,0 @@
-#ifndef __IP_SET_IPPORTNETHASH_H
-#define __IP_SET_IPPORTNETHASH_H
-
-#include "ip_set.h"
-#include "ip_set_hashes.h"
-
-#define SETTYPE_NAME			"ipportnethash"
-
-struct ipportip {
-	ip_set_ip_t ip;
-	ip_set_ip_t ip1;
-};
-
-struct ip_set_ipportnethash {
-	struct ipportip *members;	/* the ipportip proper */
-	uint32_t elements;		/* number of elements */
-	uint32_t hashsize;		/* hash size */
-	uint16_t probes;		/* max number of probes  */
-	uint16_t resize;		/* resize factor in percent */
-	ip_set_ip_t first_ip;		/* host byte order, included in range */
-	ip_set_ip_t last_ip;		/* host byte order, included in range */
-	uint8_t cidr[30];		/* CIDR sizes */
-	uint16_t nets[30];		/* nr of nets by CIDR sizes */
-	initval_t initval[0];		/* initvals for jhash_1word */
-};
-
-struct ip_set_req_ipportnethash_create {
-	uint32_t hashsize;
-	uint16_t probes;
-	uint16_t resize;
-	ip_set_ip_t from;
-	ip_set_ip_t to;
-};
-
-struct ip_set_req_ipportnethash {
-	ip_set_ip_t ip;
-	ip_set_ip_t port;
-	ip_set_ip_t ip1;
-	uint8_t cidr;
-};
-
-#endif	/* __IP_SET_IPPORTNETHASH_H */

extensions/ipset/ip_set_iptree.c

@@ -1,464 +0,0 @@
-/* Copyright (C) 2005-2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/* Kernel module implementing an IP set type: the iptree type */
-
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/ip.h>
-#include <linux/jiffies.h>
-#include <linux/skbuff.h>
-#include <linux/slab.h>
-#include <linux/delay.h>
-#include <linux/errno.h>
-#include <asm/uaccess.h>
-#include <asm/bitops.h>
-#include <linux/spinlock.h>
-#include <linux/timer.h>
-
-#include "ip_set.h"
-#include "ip_set_bitmaps.h"
-#include "ip_set_iptree.h"
-
-static int limit = MAX_RANGE;
-
-/* Garbage collection interval in seconds: */
-#define IPTREE_GC_TIME		5*60
-/* Sleep so many milliseconds before trying again
- * to delete the gc timer at destroying/flushing a set */
-#define IPTREE_DESTROY_SLEEP	100
-
-static __KMEM_CACHE_T__ *branch_cachep;
-static __KMEM_CACHE_T__ *leaf_cachep;
-
-
-#if defined(__LITTLE_ENDIAN)
-#define ABCD(a,b,c,d,addrp) do {		\
-	a = ((unsigned char *)addrp)[3];	\
-	b = ((unsigned char *)addrp)[2];	\
-	c = ((unsigned char *)addrp)[1];	\
-	d = ((unsigned char *)addrp)[0];	\
-} while (0)
-#elif defined(__BIG_ENDIAN)
-#define ABCD(a,b,c,d,addrp) do {		\
-	a = ((unsigned char *)addrp)[0];	\
-	b = ((unsigned char *)addrp)[1];	\
-	c = ((unsigned char *)addrp)[2];	\
-	d = ((unsigned char *)addrp)[3];	\
-} while (0)
-#else
-#error "Please fix asm/byteorder.h"
-#endif /* __LITTLE_ENDIAN */
-
-#define TESTIP_WALK(map, elem, branch) do {	\
-	if ((map)->tree[elem]) {		\
-		branch = (map)->tree[elem];	\
-	} else 					\
-		return 0;			\
-} while (0)
-
-static inline int
-iptree_test(struct ip_set *set, ip_set_ip_t ip)
-{
-	struct ip_set_iptree *map = set->data;
-	struct ip_set_iptreeb *btree;
-	struct ip_set_iptreec *ctree;
-	struct ip_set_iptreed *dtree;
-	unsigned char a,b,c,d;
-
-	if (!ip)
-		return -ERANGE;
-	
-	ABCD(a, b, c, d, &ip);
-	DP("%u %u %u %u timeout %u", a, b, c, d, map->timeout);
-	TESTIP_WALK(map, a, btree);
-	TESTIP_WALK(btree, b, ctree);
-	TESTIP_WALK(ctree, c, dtree);
-	DP("%lu %lu", dtree->expires[d], jiffies);
-	return dtree->expires[d]
-	       && (!map->timeout
-		   || time_after(dtree->expires[d], jiffies));
-}
-
-#define KADT_CONDITION
-
-UADT(iptree, test)
-KADT(iptree, test, ipaddr)
-
-#define ADDIP_WALK(map, elem, branch, type, cachep) do {	\
-	if ((map)->tree[elem]) {				\
-		DP("found %u", elem);				\
-		branch = (map)->tree[elem];			\
-	} else {						\
-		branch = (type *)				\
-			kmem_cache_alloc(cachep, GFP_ATOMIC);	\
-		if (branch == NULL)				\
-			return -ENOMEM;				\
-		memset(branch, 0, sizeof(*branch));		\
-		(map)->tree[elem] = branch;			\
-		DP("alloc %u", elem);				\
-	}							\
-} while (0)	
-
-static inline int
-iptree_add(struct ip_set *set, ip_set_ip_t ip, unsigned int timeout)
-{
-	struct ip_set_iptree *map = set->data;
-	struct ip_set_iptreeb *btree;
-	struct ip_set_iptreec *ctree;
-	struct ip_set_iptreed *dtree;
-	unsigned char a,b,c,d;
-	int ret = 0;
-	
-	if (!ip || map->elements >= limit)
-		/* We could call the garbage collector
-		 * but it's probably overkill */
-		return -ERANGE;
-	
-	ABCD(a, b, c, d, &ip);
-	DP("%u %u %u %u timeout %u", a, b, c, d, timeout);
-	ADDIP_WALK(map, a, btree, struct ip_set_iptreeb, branch_cachep);
-	ADDIP_WALK(btree, b, ctree, struct ip_set_iptreec, branch_cachep);
-	ADDIP_WALK(ctree, c, dtree, struct ip_set_iptreed, leaf_cachep);
-	if (dtree->expires[d]
-	    && (!map->timeout || time_after(dtree->expires[d], jiffies)))
-	    	ret = -EEXIST;
-	if (map->timeout && timeout == 0)
-		timeout = map->timeout;
-	dtree->expires[d] = map->timeout ? (timeout * HZ + jiffies) : 1;
-	/* Lottery: I won! */
-	if (dtree->expires[d] == 0)
-		dtree->expires[d] = 1;
-	DP("%u %lu", d, dtree->expires[d]);
-	if (ret == 0)
-		map->elements++;
-	return ret;
-}
-
-UADT(iptree, add, req->timeout)
-KADT(iptree, add, ipaddr, 0)
-
-#define DELIP_WALK(map, elem, branch) do {	\
-	if ((map)->tree[elem]) {		\
-		branch = (map)->tree[elem];	\
-	} else 					\
-		return -EEXIST;			\
-} while (0)
-
-static inline int
-iptree_del(struct ip_set *set, ip_set_ip_t ip)
-{
-	struct ip_set_iptree *map = set->data;
-	struct ip_set_iptreeb *btree;
-	struct ip_set_iptreec *ctree;
-	struct ip_set_iptreed *dtree;
-	unsigned char a,b,c,d;
-	
-	if (!ip)
-		return -ERANGE;
-		
-	ABCD(a, b, c, d, &ip);
-	DELIP_WALK(map, a, btree);
-	DELIP_WALK(btree, b, ctree);
-	DELIP_WALK(ctree, c, dtree);
-
-	if (dtree->expires[d]) {
-		dtree->expires[d] = 0;
-		map->elements--;
-		return 0;
-	}
-	return -EEXIST;
-}
-
-UADT(iptree, del)
-KADT(iptree, del, ipaddr)
-
-#define LOOP_WALK_BEGIN(map, i, branch) \
-	for (i = 0; i < 256; i++) {	\
-		if (!(map)->tree[i])	\
-			continue;	\
-		branch = (map)->tree[i]
-
-#define LOOP_WALK_END }
-
-static void
-ip_tree_gc(unsigned long ul_set)
-{
-	struct ip_set *set = (struct ip_set *) ul_set;
-	struct ip_set_iptree *map = set->data;
-	struct ip_set_iptreeb *btree;
-	struct ip_set_iptreec *ctree;
-	struct ip_set_iptreed *dtree;
-	unsigned int a,b,c,d;
-	unsigned char i,j,k;
-
-	i = j = k = 0;
-	DP("gc: %s", set->name);
-	write_lock_bh(&set->lock);
-	LOOP_WALK_BEGIN(map, a, btree);
-	LOOP_WALK_BEGIN(btree, b, ctree);
-	LOOP_WALK_BEGIN(ctree, c, dtree);
-	for (d = 0; d < 256; d++) {
-		if (dtree->expires[d]) {
-			DP("gc: %u %u %u %u: expires %lu jiffies %lu",
-			    a, b, c, d,
-			    dtree->expires[d], jiffies);
-			if (map->timeout
-			    && time_before(dtree->expires[d], jiffies)) {
-			    	dtree->expires[d] = 0;
-			    	map->elements--;
-			} else
-				k = 1;
-		}
-	}
-	if (k == 0) {
-		DP("gc: %s: leaf %u %u %u empty",
-		    set->name, a, b, c);
-		kmem_cache_free(leaf_cachep, dtree);
-		ctree->tree[c] = NULL;
-	} else {
-		DP("gc: %s: leaf %u %u %u not empty",
-		    set->name, a, b, c);
-		j = 1;
-		k = 0;
-	}
-	LOOP_WALK_END;
-	if (j == 0) {
-		DP("gc: %s: branch %u %u empty",
-		    set->name, a, b);
-		kmem_cache_free(branch_cachep, ctree);
-		btree->tree[b] = NULL;
-	} else {
-		DP("gc: %s: branch %u %u not empty",
-		    set->name, a, b);
-		i = 1;
-		j = k = 0;
-	}
-	LOOP_WALK_END;
-	if (i == 0) {
-		DP("gc: %s: branch %u empty",
-		    set->name, a);
-		kmem_cache_free(branch_cachep, btree);
-		map->tree[a] = NULL;
-	} else {
-		DP("gc: %s: branch %u not empty",
-		    set->name, a);
-		i = j = k = 0;
-	}
-	LOOP_WALK_END;
-	write_unlock_bh(&set->lock);
-	
-	map->gc.expires = jiffies + map->gc_interval * HZ;
-	add_timer(&map->gc);
-}
-
-static inline void
-init_gc_timer(struct ip_set *set)
-{
-	struct ip_set_iptree *map = set->data;
-
-	/* Even if there is no timeout for the entries,
-	 * we still have to call gc because delete
-	 * do not clean up empty branches */
-	map->gc_interval = IPTREE_GC_TIME;
-	init_timer(&map->gc);
-	map->gc.data = (unsigned long) set;
-	map->gc.function = ip_tree_gc;
-	map->gc.expires = jiffies + map->gc_interval * HZ;
-	add_timer(&map->gc);
-}
-
-static int
-iptree_create(struct ip_set *set, const void *data, u_int32_t size)
-{
-	const struct ip_set_req_iptree_create *req = data;
-	struct ip_set_iptree *map;
-
-	if (size != sizeof(struct ip_set_req_iptree_create)) {
-		ip_set_printk("data length wrong (want %zu, have %lu)",
-			      sizeof(struct ip_set_req_iptree_create),
-			      (unsigned long)size);
-		return -EINVAL;
-	}
-
-	map = kmalloc(sizeof(struct ip_set_iptree), GFP_KERNEL);
-	if (!map) {
-		DP("out of memory for %zu bytes",
-		   sizeof(struct ip_set_iptree));
-		return -ENOMEM;
-	}
-	memset(map, 0, sizeof(*map));
-	map->timeout = req->timeout;
-	map->elements = 0;
-	set->data = map;
-
-	init_gc_timer(set);
-
-	return 0;
-}
-
-static inline void
-__flush(struct ip_set_iptree *map)
-{
-	struct ip_set_iptreeb *btree;
-	struct ip_set_iptreec *ctree;
-	struct ip_set_iptreed *dtree;
-	unsigned int a,b,c;
-
-	LOOP_WALK_BEGIN(map, a, btree);
-	LOOP_WALK_BEGIN(btree, b, ctree);
-	LOOP_WALK_BEGIN(ctree, c, dtree);
-	kmem_cache_free(leaf_cachep, dtree);
-	LOOP_WALK_END;
-	kmem_cache_free(branch_cachep, ctree);
-	LOOP_WALK_END;
-	kmem_cache_free(branch_cachep, btree);
-	LOOP_WALK_END;
-	map->elements = 0;
-}
-
-static void
-iptree_destroy(struct ip_set *set)
-{
-	struct ip_set_iptree *map = set->data;
-
-	/* gc might be running */
-	while (!del_timer(&map->gc))
-		msleep(IPTREE_DESTROY_SLEEP);
-	__flush(map);
-	kfree(map);
-	set->data = NULL;
-}
-
-static void
-iptree_flush(struct ip_set *set)
-{
-	struct ip_set_iptree *map = set->data;
-	unsigned int timeout = map->timeout;
-	
-	/* gc might be running */
-	while (!del_timer(&map->gc))
-		msleep(IPTREE_DESTROY_SLEEP);
-	__flush(map);
-	memset(map, 0, sizeof(*map));
-	map->timeout = timeout;
-
-	init_gc_timer(set);
-}
-
-static void
-iptree_list_header(const struct ip_set *set, void *data)
-{
-	const struct ip_set_iptree *map = set->data;
-	struct ip_set_req_iptree_create *header = data;
-
-	header->timeout = map->timeout;
-}
-
-static int
-iptree_list_members_size(const struct ip_set *set, char dont_align)
-{
-	const struct ip_set_iptree *map = set->data;
-	struct ip_set_iptreeb *btree;
-	struct ip_set_iptreec *ctree;
-	struct ip_set_iptreed *dtree;
-	unsigned int a,b,c,d;
-	unsigned int count = 0;
-
-	LOOP_WALK_BEGIN(map, a, btree);
-	LOOP_WALK_BEGIN(btree, b, ctree);
-	LOOP_WALK_BEGIN(ctree, c, dtree);
-	for (d = 0; d < 256; d++) {
-		if (dtree->expires[d]
-		    && (!map->timeout || time_after(dtree->expires[d], jiffies)))
-		    	count++;
-	}
-	LOOP_WALK_END;
-	LOOP_WALK_END;
-	LOOP_WALK_END;
-
-	DP("members %u", count);
-	return (count * IPSET_VALIGN(sizeof(struct ip_set_req_iptree), dont_align));
-}
-
-static void
-iptree_list_members(const struct ip_set *set, void *data, char dont_align)
-{
-	const struct ip_set_iptree *map = set->data;
-	struct ip_set_iptreeb *btree;
-	struct ip_set_iptreec *ctree;
-	struct ip_set_iptreed *dtree;
-	unsigned int a,b,c,d;
-	size_t offset = 0, datasize;
-	struct ip_set_req_iptree *entry;
-
-	datasize = IPSET_VALIGN(sizeof(struct ip_set_req_iptree), dont_align);
-	LOOP_WALK_BEGIN(map, a, btree);
-	LOOP_WALK_BEGIN(btree, b, ctree);
-	LOOP_WALK_BEGIN(ctree, c, dtree);
-	for (d = 0; d < 256; d++) {
-		if (dtree->expires[d]
-		    && (!map->timeout || time_after(dtree->expires[d], jiffies))) {
-		    	entry = data + offset;
-		    	entry->ip = ((a << 24) | (b << 16) | (c << 8) | d);
-		    	entry->timeout = !map->timeout ? 0
-				: (dtree->expires[d] - jiffies)/HZ;
-			offset += datasize;
-		}
-	}
-	LOOP_WALK_END;
-	LOOP_WALK_END;
-	LOOP_WALK_END;
-}
-
-IP_SET_TYPE(iptree, IPSET_TYPE_IP | IPSET_DATA_SINGLE)
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
-MODULE_DESCRIPTION("iptree type of IP sets");
-module_param(limit, int, 0600);
-MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
-
-static int __init ip_set_iptree_init(void)
-{
-	int ret;
-	
-	branch_cachep = KMEM_CACHE_CREATE("ip_set_iptreeb",
-					  sizeof(struct ip_set_iptreeb));
-	if (!branch_cachep) {
-		printk(KERN_ERR "Unable to create ip_set_iptreeb slab cache\n");
-		ret = -ENOMEM;
-		goto out;
-	}
-	leaf_cachep = KMEM_CACHE_CREATE("ip_set_iptreed",
-					sizeof(struct ip_set_iptreed));
-	if (!leaf_cachep) {
-		printk(KERN_ERR "Unable to create ip_set_iptreed slab cache\n");
-		ret = -ENOMEM;
-		goto free_branch;
-	}
-	ret = ip_set_register_set_type(&ip_set_iptree);
-	if (ret == 0)
-		goto out;
-
-	kmem_cache_destroy(leaf_cachep);
-    free_branch:	
-	kmem_cache_destroy(branch_cachep);
-    out:
-	return ret;
-}
-
-static void __exit ip_set_iptree_fini(void)
-{
-	/* FIXME: possible race with ip_set_create() */
-	ip_set_unregister_set_type(&ip_set_iptree);
-	kmem_cache_destroy(leaf_cachep);
-	kmem_cache_destroy(branch_cachep);
-}
-
-module_init(ip_set_iptree_init);
-module_exit(ip_set_iptree_fini);

extensions/ipset/ip_set_iptree.h

@@ -1,39 +0,0 @@
-#ifndef __IP_SET_IPTREE_H
-#define __IP_SET_IPTREE_H
-
-#include "ip_set.h"
-
-#define SETTYPE_NAME		"iptree"
-
-struct ip_set_iptreed {
-	unsigned long expires[256];	   	/* x.x.x.ADDR */
-};
-
-struct ip_set_iptreec {
-	struct ip_set_iptreed *tree[256];	/* x.x.ADDR.* */
-};
-
-struct ip_set_iptreeb {
-	struct ip_set_iptreec *tree[256];	/* x.ADDR.*.* */
-};
-
-struct ip_set_iptree {
-	unsigned int timeout;
-	unsigned int gc_interval;
-#ifdef __KERNEL__
-	uint32_t elements;		/* number of elements */
-	struct timer_list gc;
-	struct ip_set_iptreeb *tree[256];	/* ADDR.*.*.* */
-#endif
-};
-
-struct ip_set_req_iptree_create {
-	unsigned int timeout;
-};
-
-struct ip_set_req_iptree {
-	ip_set_ip_t ip;
-	unsigned int timeout;
-};
-
-#endif	/* __IP_SET_IPTREE_H */

extensions/ipset/ip_set_iptreemap.c

@@ -1,700 +0,0 @@
-/* Copyright (C) 2007 Sven Wegener <sven.wegener@stealer.net>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published by
- * the Free Software Foundation.
- */
-
-/* This modules implements the iptreemap ipset type. It uses bitmaps to
- * represent every single IPv4 address as a bit. The bitmaps are managed in a
- * tree structure, where the first three octets of an address are used as an
- * index to find the bitmap and the last octet is used as the bit number.
- */
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/ip.h>
-#include <linux/jiffies.h>
-#include <linux/skbuff.h>
-#include <linux/slab.h>
-#include <linux/delay.h>
-#include <linux/errno.h>
-#include <asm/uaccess.h>
-#include <asm/bitops.h>
-#include <linux/spinlock.h>
-#include <linux/timer.h>
-
-#include "ip_set.h"
-#include "ip_set_bitmaps.h"
-#include "ip_set_iptreemap.h"
-
-#define IPTREEMAP_DEFAULT_GC_TIME (5 * 60)
-#define IPTREEMAP_DESTROY_SLEEP (100)
-
-static __KMEM_CACHE_T__ *cachep_b;
-static __KMEM_CACHE_T__ *cachep_c;
-static __KMEM_CACHE_T__ *cachep_d;
-
-static struct ip_set_iptreemap_d *fullbitmap_d;
-static struct ip_set_iptreemap_c *fullbitmap_c;
-static struct ip_set_iptreemap_b *fullbitmap_b;
-
-#if defined(__LITTLE_ENDIAN)
-#define ABCD(a, b, c, d, addr) \
-	do { \
-		a = ((unsigned char *)addr)[3]; \
-		b = ((unsigned char *)addr)[2]; \
-		c = ((unsigned char *)addr)[1]; \
-		d = ((unsigned char *)addr)[0]; \
-	} while (0)
-#elif defined(__BIG_ENDIAN)
-#define ABCD(a,b,c,d,addrp) do {		\
-	a = ((unsigned char *)addrp)[0];	\
-	b = ((unsigned char *)addrp)[1];	\
-	c = ((unsigned char *)addrp)[2];	\
-	d = ((unsigned char *)addrp)[3];	\
-} while (0)
-#else
-#error "Please fix asm/byteorder.h"
-#endif /* __LITTLE_ENDIAN */
-
-#define TESTIP_WALK(map, elem, branch, full) \
-	do { \
-		branch = (map)->tree[elem]; \
-		if (!branch) \
-			return 0; \
-		else if (branch == full) \
-			return 1; \
-	} while (0)
-
-#define ADDIP_WALK(map, elem, branch, type, cachep, full) \
-	do { \
-		branch = (map)->tree[elem]; \
-		if (!branch) { \
-			branch = (type *) kmem_cache_alloc(cachep, GFP_ATOMIC); \
-			if (!branch) \
-				return -ENOMEM; \
-			memset(branch, 0, sizeof(*branch)); \
-			(map)->tree[elem] = branch; \
-		} else if (branch == full) { \
-			return -EEXIST; \
-		} \
-	} while (0)
-
-#define ADDIP_RANGE_LOOP(map, a, a1, a2, hint, branch, full, cachep, free) \
-	for (a = a1; a <= a2; a++) { \
-		branch = (map)->tree[a]; \
-		if (branch != full) { \
-			if ((a > a1 && a < a2) || (hint)) { \
-				if (branch) \
-					free(branch); \
-				(map)->tree[a] = full; \
-				continue; \
-			} else if (!branch) { \
-				branch = kmem_cache_alloc(cachep, GFP_ATOMIC); \
-				if (!branch) \
-					return -ENOMEM; \
-				memset(branch, 0, sizeof(*branch)); \
-				(map)->tree[a] = branch; \
-			}
-
-#define ADDIP_RANGE_LOOP_END() \
-		} \
-	}
-
-#define DELIP_WALK(map, elem, branch, cachep, full, flags) \
-	do { \
-		branch = (map)->tree[elem]; \
-		if (!branch) { \
-			return -EEXIST; \
-		} else if (branch == full) { \
-			branch = kmem_cache_alloc(cachep, flags); \
-			if (!branch) \
-				return -ENOMEM; \
-			memcpy(branch, full, sizeof(*full)); \
-			(map)->tree[elem] = branch; \
-		} \
-	} while (0)
-
-#define DELIP_RANGE_LOOP(map, a, a1, a2, hint, branch, full, cachep, free, flags) \
-	for (a = a1; a <= a2; a++) { \
-		branch = (map)->tree[a]; \
-		if (branch) { \
-			if ((a > a1 && a < a2) || (hint)) { \
-				if (branch != full) \
-					free(branch); \
-				(map)->tree[a] = NULL; \
-				continue; \
-			} else if (branch == full) { \
-				branch = kmem_cache_alloc(cachep, flags); \
-				if (!branch) \
-					return -ENOMEM; \
-				memcpy(branch, full, sizeof(*branch)); \
-				(map)->tree[a] = branch; \
-			}
-
-#define DELIP_RANGE_LOOP_END() \
-		} \
-	}
-
-#define LOOP_WALK_BEGIN(map, i, branch) \
-	for (i = 0; i < 256; i++) { \
-		branch = (map)->tree[i]; \
-		if (likely(!branch)) \
-			continue;
-
-#define LOOP_WALK_END() \
-	}
-
-#define LOOP_WALK_BEGIN_GC(map, i, branch, full, cachep, count) \
-	count = -256; \
-	for (i = 0; i < 256; i++) { \
-		branch = (map)->tree[i]; \
-		if (likely(!branch)) \
-			continue; \
-		count++; \
-		if (branch == full) { \
-			count++; \
-			continue; \
-		}
-
-#define LOOP_WALK_END_GC(map, i, branch, full, cachep, count) \
-		if (-256 == count) { \
-			kmem_cache_free(cachep, branch); \
-			(map)->tree[i] = NULL; \
-		} else if (256 == count) { \
-			kmem_cache_free(cachep, branch); \
-			(map)->tree[i] = full; \
-		} \
-	}
-
-#define LOOP_WALK_BEGIN_COUNT(map, i, branch, inrange, count) \
-	for (i = 0; i < 256; i++) { \
-		if (!(map)->tree[i]) { \
-			if (inrange) { \
-				count++; \
-				inrange = 0; \
-			} \
-			continue; \
-		} \
-		branch = (map)->tree[i];
-
-#define LOOP_WALK_END_COUNT() \
-	}
-
-#define GETVALUE1(a, a1, b1, r) \
-	(a == a1 ? b1 : r)
-
-#define GETVALUE2(a, b, a1, b1, c1, r) \
-	(a == a1 && b == b1 ? c1 : r)
-
-#define GETVALUE3(a, b, c, a1, b1, c1, d1, r) \
-	(a == a1 && b == b1 && c == c1 ? d1 : r)
-
-#define CHECK1(a, a1, a2, b1, b2, c1, c2, d1, d2) \
-	( \
-		GETVALUE1(a, a1, b1, 0) == 0 \
-		&& GETVALUE1(a, a2, b2, 255) == 255 \
-		&& c1 == 0 \
-		&& c2 == 255 \
-		&& d1 == 0 \
-		&& d2 == 255 \
-	)
-
-#define CHECK2(a, b, a1, a2, b1, b2, c1, c2, d1, d2) \
-	( \
-		GETVALUE2(a, b, a1, b1, c1, 0) == 0 \
-		&& GETVALUE2(a, b, a2, b2, c2, 255) == 255 \
-		&& d1 == 0 \
-		&& d2 == 255 \
-	)
-
-#define CHECK3(a, b, c, a1, a2, b1, b2, c1, c2, d1, d2) \
-	( \
-		GETVALUE3(a, b, c, a1, b1, c1, d1, 0) == 0 \
-		&& GETVALUE3(a, b, c, a2, b2, c2, d2, 255) == 255 \
-	)
-
-
-static inline void
-free_d(struct ip_set_iptreemap_d *map)
-{
-	kmem_cache_free(cachep_d, map);
-}
-
-static inline void
-free_c(struct ip_set_iptreemap_c *map)
-{
-	struct ip_set_iptreemap_d *dtree;
-	unsigned int i;
-
-	LOOP_WALK_BEGIN(map, i, dtree) {
-		if (dtree != fullbitmap_d)
-			free_d(dtree);
-	} LOOP_WALK_END();
-
-	kmem_cache_free(cachep_c, map);
-}
-
-static inline void
-free_b(struct ip_set_iptreemap_b *map)
-{
-	struct ip_set_iptreemap_c *ctree;
-	unsigned int i;
-
-	LOOP_WALK_BEGIN(map, i, ctree) {
-		if (ctree != fullbitmap_c)
-			free_c(ctree);
-	} LOOP_WALK_END();
-
-	kmem_cache_free(cachep_b, map);
-}
-
-static inline int
-iptreemap_test(struct ip_set *set, ip_set_ip_t ip)
-{
-	struct ip_set_iptreemap *map = set->data;
-	struct ip_set_iptreemap_b *btree;
-	struct ip_set_iptreemap_c *ctree;
-	struct ip_set_iptreemap_d *dtree;
-	unsigned char a, b, c, d;
-
-	ABCD(a, b, c, d, &ip);
-
-	TESTIP_WALK(map, a, btree, fullbitmap_b);
-	TESTIP_WALK(btree, b, ctree, fullbitmap_c);
-	TESTIP_WALK(ctree, c, dtree, fullbitmap_d);
-
-	return !!test_bit(d, (void *) dtree->bitmap);
-}
-
-#define KADT_CONDITION
-
-UADT(iptreemap, test)
-KADT(iptreemap, test, ipaddr)
-
-static inline int
-__addip_single(struct ip_set *set, ip_set_ip_t ip)
-{
-	struct ip_set_iptreemap *map = (struct ip_set_iptreemap *) set->data;
-	struct ip_set_iptreemap_b *btree;
-	struct ip_set_iptreemap_c *ctree;
-	struct ip_set_iptreemap_d *dtree;
-	unsigned char a, b, c, d;
-
-	ABCD(a, b, c, d, &ip);
-
-	ADDIP_WALK(map, a, btree, struct ip_set_iptreemap_b, cachep_b, fullbitmap_b);
-	ADDIP_WALK(btree, b, ctree, struct ip_set_iptreemap_c, cachep_c, fullbitmap_c);
-	ADDIP_WALK(ctree, c, dtree, struct ip_set_iptreemap_d, cachep_d, fullbitmap_d);
-
-	if (__test_and_set_bit(d, (void *) dtree->bitmap))
-		return -EEXIST;
-
-	__set_bit(b, (void *) btree->dirty);
-
-	return 0;
-}
-
-static inline int
-iptreemap_add(struct ip_set *set, ip_set_ip_t start, ip_set_ip_t end)
-{
-	struct ip_set_iptreemap *map = set->data;
-	struct ip_set_iptreemap_b *btree;
-	struct ip_set_iptreemap_c *ctree;
-	struct ip_set_iptreemap_d *dtree;
-	unsigned int a, b, c, d;
-	unsigned char a1, b1, c1, d1;
-	unsigned char a2, b2, c2, d2;
-
-	if (start == end)
-		return __addip_single(set, start);
-
-	ABCD(a1, b1, c1, d1, &start);
-	ABCD(a2, b2, c2, d2, &end);
-
-	/* This is sooo ugly... */
-	ADDIP_RANGE_LOOP(map, a, a1, a2, CHECK1(a, a1, a2, b1, b2, c1, c2, d1, d2), btree, fullbitmap_b, cachep_b, free_b) {
-		ADDIP_RANGE_LOOP(btree, b, GETVALUE1(a, a1, b1, 0), GETVALUE1(a, a2, b2, 255), CHECK2(a, b, a1, a2, b1, b2, c1, c2, d1, d2), ctree, fullbitmap_c, cachep_c, free_c) {
-			ADDIP_RANGE_LOOP(ctree, c, GETVALUE2(a, b, a1, b1, c1, 0), GETVALUE2(a, b, a2, b2, c2, 255), CHECK3(a, b, c, a1, a2, b1, b2, c1, c2, d1, d2), dtree, fullbitmap_d, cachep_d, free_d) {
-				for (d = GETVALUE3(a, b, c, a1, b1, c1, d1, 0); d <= GETVALUE3(a, b, c, a2, b2, c2, d2, 255); d++)
-					__set_bit(d, (void *) dtree->bitmap);
-				__set_bit(b, (void *) btree->dirty);
-			} ADDIP_RANGE_LOOP_END();
-		} ADDIP_RANGE_LOOP_END();
-	} ADDIP_RANGE_LOOP_END();
-
-	return 0;
-}
-
-UADT0(iptreemap, add, min(req->ip, req->end), max(req->ip, req->end))
-KADT(iptreemap, add, ipaddr, ip)
-
-static inline int
-__delip_single(struct ip_set *set, ip_set_ip_t ip, gfp_t flags)
-{
-	struct ip_set_iptreemap *map = set->data;
-	struct ip_set_iptreemap_b *btree;
-	struct ip_set_iptreemap_c *ctree;
-	struct ip_set_iptreemap_d *dtree;
-	unsigned char a,b,c,d;
-
-	ABCD(a, b, c, d, &ip);
-
-	DELIP_WALK(map, a, btree, cachep_b, fullbitmap_b, flags);
-	DELIP_WALK(btree, b, ctree, cachep_c, fullbitmap_c, flags);
-	DELIP_WALK(ctree, c, dtree, cachep_d, fullbitmap_d, flags);
-
-	if (!__test_and_clear_bit(d, (void *) dtree->bitmap))
-		return -EEXIST;
-
-	__set_bit(b, (void *) btree->dirty);
-
-	return 0;
-}
-
-static inline int
-iptreemap_del(struct ip_set *set,
-	      ip_set_ip_t start, ip_set_ip_t end, gfp_t flags)
-{
-	struct ip_set_iptreemap *map = set->data;
-	struct ip_set_iptreemap_b *btree;
-	struct ip_set_iptreemap_c *ctree;
-	struct ip_set_iptreemap_d *dtree;
-	unsigned int a, b, c, d;
-	unsigned char a1, b1, c1, d1;
-	unsigned char a2, b2, c2, d2;
-
-	if (start == end)
-		return __delip_single(set, start, flags);
-
-	ABCD(a1, b1, c1, d1, &start);
-	ABCD(a2, b2, c2, d2, &end);
-
-	/* This is sooo ugly... */
-	DELIP_RANGE_LOOP(map, a, a1, a2, CHECK1(a, a1, a2, b1, b2, c1, c2, d1, d2), btree, fullbitmap_b, cachep_b, free_b, flags) {
-		DELIP_RANGE_LOOP(btree, b, GETVALUE1(a, a1, b1, 0), GETVALUE1(a, a2, b2, 255), CHECK2(a, b, a1, a2, b1, b2, c1, c2, d1, d2), ctree, fullbitmap_c, cachep_c, free_c, flags) {
-			DELIP_RANGE_LOOP(ctree, c, GETVALUE2(a, b, a1, b1, c1, 0), GETVALUE2(a, b, a2, b2, c2, 255), CHECK3(a, b, c, a1, a2, b1, b2, c1, c2, d1, d2), dtree, fullbitmap_d, cachep_d, free_d, flags) {
-				for (d = GETVALUE3(a, b, c, a1, b1, c1, d1, 0); d <= GETVALUE3(a, b, c, a2, b2, c2, d2, 255); d++)
-					__clear_bit(d, (void *) dtree->bitmap);
-				__set_bit(b, (void *) btree->dirty);
-			} DELIP_RANGE_LOOP_END();
-		} DELIP_RANGE_LOOP_END();
-	} DELIP_RANGE_LOOP_END();
-
-	return 0;
-}
-
-UADT0(iptreemap, del, min(req->ip, req->end), max(req->ip, req->end), GFP_KERNEL)
-KADT(iptreemap, del, ipaddr, ip, GFP_ATOMIC)
-
-/* Check the status of the bitmap
- * -1 == all bits cleared
- *  1 == all bits set
- *  0 == anything else
- */
-static inline int
-bitmap_status(struct ip_set_iptreemap_d *dtree)
-{
-	unsigned char first = dtree->bitmap[0];
-	int a;
-
-	for (a = 1; a < 32; a++)
-		if (dtree->bitmap[a] != first)
-			return 0;
-
-	return (first == 0 ? -1 : (first == 255 ? 1 : 0));
-}
-
-static void
-gc(unsigned long addr)
-{
-	struct ip_set *set = (struct ip_set *) addr;
-	struct ip_set_iptreemap *map = set->data;
-	struct ip_set_iptreemap_b *btree;
-	struct ip_set_iptreemap_c *ctree;
-	struct ip_set_iptreemap_d *dtree;
-	unsigned int a, b, c;
-	int i, j, k;
-
-	write_lock_bh(&set->lock);
-
-	LOOP_WALK_BEGIN_GC(map, a, btree, fullbitmap_b, cachep_b, i) {
-		LOOP_WALK_BEGIN_GC(btree, b, ctree, fullbitmap_c, cachep_c, j) {
-			if (!__test_and_clear_bit(b, (void *) btree->dirty))
-				continue;
-			LOOP_WALK_BEGIN_GC(ctree, c, dtree, fullbitmap_d, cachep_d, k) {
-				switch (bitmap_status(dtree)) {
-					case -1:
-						kmem_cache_free(cachep_d, dtree);
-						ctree->tree[c] = NULL;
-						k--;
-					break;
-					case 1:
-						kmem_cache_free(cachep_d, dtree);
-						ctree->tree[c] = fullbitmap_d;
-						k++;
-					break;
-				}
-			} LOOP_WALK_END();
-		} LOOP_WALK_END_GC(btree, b, ctree, fullbitmap_c, cachep_c, k);
-	} LOOP_WALK_END_GC(map, a, btree, fullbitmap_b, cachep_b, j);
-
-	write_unlock_bh(&set->lock);
-
-	map->gc.expires = jiffies + map->gc_interval * HZ;
-	add_timer(&map->gc);
-}
-
-static inline void
-init_gc_timer(struct ip_set *set)
-{
-	struct ip_set_iptreemap *map = set->data;
-
-	init_timer(&map->gc);
-	map->gc.data = (unsigned long) set;
-	map->gc.function = gc;
-	map->gc.expires = jiffies + map->gc_interval * HZ;
-	add_timer(&map->gc);
-}
-
-static int
-iptreemap_create(struct ip_set *set, const void *data, u_int32_t size)
-{
-	const struct ip_set_req_iptreemap_create *req = data;
-	struct ip_set_iptreemap *map;
-
-	map = kzalloc(sizeof(*map), GFP_KERNEL);
-	if (!map)
-		return -ENOMEM;
-
-	map->gc_interval = req->gc_interval ? req->gc_interval : IPTREEMAP_DEFAULT_GC_TIME;
-	set->data = map;
-
-	init_gc_timer(set);
-
-	return 0;
-}
-
-static inline void
-__flush(struct ip_set_iptreemap *map)
-{
-	struct ip_set_iptreemap_b *btree;
-	unsigned int a;
-
-	LOOP_WALK_BEGIN(map, a, btree);
-		if (btree != fullbitmap_b)
-			free_b(btree);
-	LOOP_WALK_END();
-}
-
-static void
-iptreemap_destroy(struct ip_set *set)
-{
-	struct ip_set_iptreemap *map = set->data;
-
-	while (!del_timer(&map->gc))
-		msleep(IPTREEMAP_DESTROY_SLEEP);
-
-	__flush(map);
-	kfree(map);
-
-	set->data = NULL;
-}
-
-static void
-iptreemap_flush(struct ip_set *set)
-{
-	struct ip_set_iptreemap *map = set->data;
-	unsigned int gc_interval = map->gc_interval;
-
-	while (!del_timer(&map->gc))
-		msleep(IPTREEMAP_DESTROY_SLEEP);
-
-	__flush(map);
-
-	memset(map, 0, sizeof(*map));
-	map->gc_interval = gc_interval;
-
-	init_gc_timer(set);
-}
-
-static void
-iptreemap_list_header(const struct ip_set *set, void *data)
-{
-	struct ip_set_iptreemap *map = set->data;
-	struct ip_set_req_iptreemap_create *header = data;
-
-	header->gc_interval = map->gc_interval;
-}
-
-static int
-iptreemap_list_members_size(const struct ip_set *set, char dont_align)
-{
-	struct ip_set_iptreemap *map = set->data;
-	struct ip_set_iptreemap_b *btree;
-	struct ip_set_iptreemap_c *ctree;
-	struct ip_set_iptreemap_d *dtree;
-	unsigned int a, b, c, d, inrange = 0, count = 0;
-
-	LOOP_WALK_BEGIN_COUNT(map, a, btree, inrange, count) {
-		LOOP_WALK_BEGIN_COUNT(btree, b, ctree, inrange, count) {
-			LOOP_WALK_BEGIN_COUNT(ctree, c, dtree, inrange, count) {
-				for (d = 0; d < 256; d++) {
-					if (test_bit(d, (void *) dtree->bitmap)) {
-						inrange = 1;
-					} else if (inrange) {
-						count++;
-						inrange = 0;
-					}
-				}
-			} LOOP_WALK_END_COUNT();
-		} LOOP_WALK_END_COUNT();
-	} LOOP_WALK_END_COUNT();
-
-	if (inrange)
-		count++;
-
-	return (count * IPSET_VALIGN(sizeof(struct ip_set_req_iptreemap), dont_align));
-}
-
-static inline void
-add_member(void *data, size_t offset, ip_set_ip_t start, ip_set_ip_t end)
-{
-	struct ip_set_req_iptreemap *entry = data + offset;
-
-	entry->ip = start;
-	entry->end = end;
-}
-
-static void
-iptreemap_list_members(const struct ip_set *set, void *data, char dont_align)
-{
-	struct ip_set_iptreemap *map = set->data;
-	struct ip_set_iptreemap_b *btree;
-	struct ip_set_iptreemap_c *ctree;
-	struct ip_set_iptreemap_d *dtree;
-	unsigned int a, b, c, d, inrange = 0;
-	size_t offset = 0, datasize;
-	ip_set_ip_t start = 0, end = 0, ip;
-
-	datasize = IPSET_VALIGN(sizeof(struct ip_set_req_iptreemap), dont_align);
-	LOOP_WALK_BEGIN(map, a, btree) {
-		LOOP_WALK_BEGIN(btree, b, ctree) {
-			LOOP_WALK_BEGIN(ctree, c, dtree) {
-				for (d = 0; d < 256; d++) {
-					if (test_bit(d, (void *) dtree->bitmap)) {
-						ip = ((a << 24) | (b << 16) | (c << 8) | d);
-						if (!inrange) {
-							inrange = 1;
-							start = ip;
-						} else if (end < ip - 1) {
-							add_member(data, offset, start, end);
-							offset += datasize;
-							start = ip;
-						}
-						end = ip;
-					} else if (inrange) {
-						add_member(data, offset, start, end);
-						offset += datasize;
-						inrange = 0;
-					}
-				}
-			} LOOP_WALK_END();
-		} LOOP_WALK_END();
-	} LOOP_WALK_END();
-
-	if (inrange)
-		add_member(data, offset, start, end);
-}
-
-IP_SET_TYPE(iptreemap, IPSET_TYPE_IP | IPSET_DATA_SINGLE)
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Sven Wegener <sven.wegener@stealer.net>");
-MODULE_DESCRIPTION("iptreemap type of IP sets");
-
-static int __init ip_set_iptreemap_init(void)
-{
-	int ret = -ENOMEM;
-	int a;
-
-	cachep_b = KMEM_CACHE_CREATE("ip_set_iptreemap_b",
-				     sizeof(struct ip_set_iptreemap_b));
-	if (!cachep_b) {
-		ip_set_printk("Unable to create ip_set_iptreemap_b slab cache");
-		goto out;
-	}
-
-	cachep_c = KMEM_CACHE_CREATE("ip_set_iptreemap_c",
-				     sizeof(struct ip_set_iptreemap_c));
-	if (!cachep_c) {
-		ip_set_printk("Unable to create ip_set_iptreemap_c slab cache");
-		goto outb;
-	}
-
-	cachep_d = KMEM_CACHE_CREATE("ip_set_iptreemap_d",
-				     sizeof(struct ip_set_iptreemap_d));
-	if (!cachep_d) {
-		ip_set_printk("Unable to create ip_set_iptreemap_d slab cache");
-		goto outc;
-	}
-
-	fullbitmap_d = kmem_cache_alloc(cachep_d, GFP_KERNEL);
-	if (!fullbitmap_d)
-		goto outd;
-
-	fullbitmap_c = kmem_cache_alloc(cachep_c, GFP_KERNEL);
-	if (!fullbitmap_c)
-		goto outbitmapd;
-
-	fullbitmap_b = kmem_cache_alloc(cachep_b, GFP_KERNEL);
-	if (!fullbitmap_b)
-		goto outbitmapc;
-
-	ret = ip_set_register_set_type(&ip_set_iptreemap);
-	if (0 > ret)
-		goto outbitmapb;
-
-	/* Now init our global bitmaps */
-	memset(fullbitmap_d->bitmap, 0xff, sizeof(fullbitmap_d->bitmap));
-
-	for (a = 0; a < 256; a++)
-		fullbitmap_c->tree[a] = fullbitmap_d;
-
-	for (a = 0; a < 256; a++)
-		fullbitmap_b->tree[a] = fullbitmap_c;
-	memset(fullbitmap_b->dirty, 0, sizeof(fullbitmap_b->dirty));
-
-	return 0;
-
-outbitmapb:
-	kmem_cache_free(cachep_b, fullbitmap_b);
-outbitmapc:
-	kmem_cache_free(cachep_c, fullbitmap_c);
-outbitmapd:
-	kmem_cache_free(cachep_d, fullbitmap_d);
-outd:
-	kmem_cache_destroy(cachep_d);
-outc:
-	kmem_cache_destroy(cachep_c);
-outb:
-	kmem_cache_destroy(cachep_b);
-out:
-
-	return ret;
-}
-
-static void __exit ip_set_iptreemap_fini(void)
-{
-	ip_set_unregister_set_type(&ip_set_iptreemap);
-	kmem_cache_free(cachep_d, fullbitmap_d);
-	kmem_cache_free(cachep_c, fullbitmap_c);
-	kmem_cache_free(cachep_b, fullbitmap_b);
-	kmem_cache_destroy(cachep_d);
-	kmem_cache_destroy(cachep_c);
-	kmem_cache_destroy(cachep_b);
-}
-
-module_init(ip_set_iptreemap_init);
-module_exit(ip_set_iptreemap_fini);

extensions/ipset/ip_set_iptreemap.h

@@ -1,40 +0,0 @@
-#ifndef __IP_SET_IPTREEMAP_H
-#define __IP_SET_IPTREEMAP_H
-
-#include "ip_set.h"
-
-#define SETTYPE_NAME		"iptreemap"
-
-#ifdef __KERNEL__
-struct ip_set_iptreemap_d {
-	unsigned char bitmap[32]; /* x.x.x.y */
-};
-
-struct ip_set_iptreemap_c {
-	struct ip_set_iptreemap_d *tree[256]; /* x.x.y.x */
-};
-
-struct ip_set_iptreemap_b {
-	struct ip_set_iptreemap_c *tree[256]; /* x.y.x.x */
-	unsigned char dirty[32];
-};
-#endif
-
-struct ip_set_iptreemap {
-	unsigned int gc_interval;
-#ifdef __KERNEL__
-	struct timer_list gc;
-	struct ip_set_iptreemap_b *tree[256]; /* y.x.x.x */
-#endif
-};
-
-struct ip_set_req_iptreemap_create {
-	unsigned int gc_interval;
-};
-
-struct ip_set_req_iptreemap {
-	ip_set_ip_t ip;
-	ip_set_ip_t end;
-};
-
-#endif /* __IP_SET_IPTREEMAP_H */

extensions/ipset/ip_set_jhash.h

@@ -1,157 +0,0 @@
-#ifndef _LINUX_JHASH_H
-#define _LINUX_JHASH_H
-
-/* jhash.h: Jenkins hash support.
- *
- * Copyright (C) 2006. Bob Jenkins (bob_jenkins@burtleburtle.net)
- *
- * http://burtleburtle.net/bob/hash/
- *
- * These are the credits from Bob's sources:
- *
- * lookup3.c, by Bob Jenkins, May 2006, Public Domain.
- *
- * These are functions for producing 32-bit hashes for hash table lookup.
- * hashword(), hashlittle(), hashlittle2(), hashbig(), mix(), and final() 
- * are externally useful functions.  Routines to test the hash are included 
- * if SELF_TEST is defined.  You can use this free for any purpose.  It's in
- * the public domain.  It has no warranty.
- *
- * Copyright (C) 2009 Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
- *
- * I've modified Bob's hash to be useful in the Linux kernel, and
- * any bugs present are my fault.  Jozsef
- */
-
-#define __rot(x,k) (((x)<<(k)) | ((x)>>(32-(k))))
-
-/* __jhash_mix - mix 3 32-bit values reversibly. */
-#define __jhash_mix(a,b,c) \
-{ \
-  a -= c;  a ^= __rot(c, 4);  c += b; \
-  b -= a;  b ^= __rot(a, 6);  a += c; \
-  c -= b;  c ^= __rot(b, 8);  b += a; \
-  a -= c;  a ^= __rot(c,16);  c += b; \
-  b -= a;  b ^= __rot(a,19);  a += c; \
-  c -= b;  c ^= __rot(b, 4);  b += a; \
-}
-
-/* __jhash_final - final mixing of 3 32-bit values (a,b,c) into c */
-#define __jhash_final(a,b,c) \
-{ \
-  c ^= b; c -= __rot(b,14); \
-  a ^= c; a -= __rot(c,11); \
-  b ^= a; b -= __rot(a,25); \
-  c ^= b; c -= __rot(b,16); \
-  a ^= c; a -= __rot(c,4);  \
-  b ^= a; b -= __rot(a,14); \
-  c ^= b; c -= __rot(b,24); \
-}
-
-/* The golden ration: an arbitrary value */
-#define JHASH_GOLDEN_RATIO	0xdeadbeef
-
-/* The most generic version, hashes an arbitrary sequence
- * of bytes.  No alignment or length assumptions are made about
- * the input key. The result depends on endianness.
- */
-static inline u32 jhash(const void *key, u32 length, u32 initval)
-{
-	u32 a,b,c;
-	const u8 *k = key;
-
-	/* Set up the internal state */
-	a = b = c = JHASH_GOLDEN_RATIO + length + initval;
-
-	/* all but the last block: affect some 32 bits of (a,b,c) */
-	while (length > 12) {
-    		a += (k[0] + ((u32)k[1]<<8) + ((u32)k[2]<<16) + ((u32)k[3]<<24));
-		b += (k[4] + ((u32)k[5]<<8) + ((u32)k[6]<<16) + ((u32)k[7]<<24));
-		c += (k[8] + ((u32)k[9]<<8) + ((u32)k[10]<<16) + ((u32)k[11]<<24));
-		__jhash_mix(a, b, c);
-		length -= 12;
-		k += 12;
-	}
-
-	/* last block: affect all 32 bits of (c) */
-	/* all the case statements fall through */
-	switch (length) {
-	case 12: c += (u32)k[11]<<24;
-	case 11: c += (u32)k[10]<<16;
-	case 10: c += (u32)k[9]<<8;
-	case 9 : c += k[8];
-	case 8 : b += (u32)k[7]<<24;
-	case 7 : b += (u32)k[6]<<16;
-	case 6 : b += (u32)k[5]<<8;
-	case 5 : b += k[4];
-	case 4 : a += (u32)k[3]<<24;
-	case 3 : a += (u32)k[2]<<16;
-	case 2 : a += (u32)k[1]<<8;
-	case 1 : a += k[0];
-		__jhash_final(a, b, c);
-	case 0 :
-		break;
-	}
-
-	return c;
-}
-
-/* A special optimized version that handles 1 or more of u32s.
- * The length parameter here is the number of u32s in the key.
- */
-static inline u32 jhash2(const u32 *k, u32 length, u32 initval)
-{
-	u32 a, b, c;
-
-	/* Set up the internal state */
-	a = b = c = JHASH_GOLDEN_RATIO + (length<<2) + initval;
-
-	/* handle most of the key */
-	while (length > 3) {
-		a += k[0];
-		b += k[1];
-		c += k[2];
-		__jhash_mix(a, b, c);
-		length -= 3;
-		k += 3;
-	}
-
-	/* handle the last 3 u32's */
-	/* all the case statements fall through */ 
-	switch (length) {
-	case 3: c += k[2];
-	case 2: b += k[1];
-	case 1: a += k[0];
-		__jhash_final(a, b, c);
-	case 0:     /* case 0: nothing left to add */
-		break;
-	}
-
-	return c;
-}
-
-/* A special ultra-optimized versions that knows they are hashing exactly
- * 3, 2 or 1 word(s).
- */
-static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
-{
-	a += JHASH_GOLDEN_RATIO + initval;
-	b += JHASH_GOLDEN_RATIO + initval;
-	c += JHASH_GOLDEN_RATIO + initval;
-
-	__jhash_final(a, b, c);
-
-	return c;
-}
-
-static inline u32 jhash_2words(u32 a, u32 b, u32 initval)
-{
-	return jhash_3words(0, a, b, initval);
-}
-
-static inline u32 jhash_1word(u32 a, u32 initval)
-{
-	return jhash_3words(0, 0, a, initval);
-}
-
-#endif /* _LINUX_JHASH_H */

extensions/ipset/ip_set_macipmap.c

@@ -1,179 +0,0 @@
-/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
- *                         Patrick Schaaf <bof@bof.de>
- *                         Martin Josefsson <gandalf@wlug.westbo.se>
- * Copyright (C) 2003-2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/* Kernel module implementing an IP set type: the macipmap type */
-
-#include <linux/module.h>
-#include <linux/ip.h>
-#include <linux/skbuff.h>
-#include <linux/errno.h>
-#include <asm/uaccess.h>
-#include <asm/bitops.h>
-#include <linux/spinlock.h>
-#include <linux/if_ether.h>
-
-#include "ip_set_macipmap.h"
-
-static int
-macipmap_utest(struct ip_set *set, const void *data, u_int32_t size)
-{
-	const struct ip_set_macipmap *map = set->data;
-	const struct ip_set_macip *table = map->members;	
-	const struct ip_set_req_macipmap *req = data;
-
-	if (req->ip < map->first_ip || req->ip > map->last_ip)
-		return -ERANGE;
-
-	DP("set: %s, ip:%u.%u.%u.%u", set->name, HIPQUAD(req->ip));		
-	if (table[req->ip - map->first_ip].match) {
-		return (memcmp(req->ethernet,
-			       &table[req->ip - map->first_ip].ethernet,
-			       ETH_ALEN) == 0);
-	} else {
-		return (map->flags & IPSET_MACIP_MATCHUNSET ? 1 : 0);
-	}
-}
-
-static int
-macipmap_ktest(struct ip_set *set,
-	       const struct sk_buff *skb,
-	       const u_int32_t *flags)
-{
-	const struct ip_set_macipmap *map = set->data;
-	const struct ip_set_macip *table = map->members;
-	ip_set_ip_t ip;
-	
-	ip = ipaddr(skb, flags);
-
-	if (ip < map->first_ip || ip > map->last_ip)
-		return 0;
-
-	DP("set: %s, ip:%u.%u.%u.%u", set->name, HIPQUAD(ip));
-	if (table[ip - map->first_ip].match) {
-		/* Is mac pointer valid?
-		 * If so, compare... */
-		return (skb_mac_header(skb) >= skb->head
-			&& (skb_mac_header(skb) + ETH_HLEN) <= skb->data
-			&& (memcmp(eth_hdr(skb)->h_source,
-				   &table[ip - map->first_ip].ethernet,
-				   ETH_ALEN) == 0));
-	} else {
-		return (map->flags & IPSET_MACIP_MATCHUNSET ? 1 : 0);
-	}
-}
-
-/* returns 0 on success */
-static inline int
-macipmap_add(struct ip_set *set,
-	     ip_set_ip_t ip, const unsigned char *ethernet)
-{
-	struct ip_set_macipmap *map = set->data;
-	struct ip_set_macip *table = map->members;
-
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -ERANGE;
-	if (table[ip - map->first_ip].match)
-		return -EEXIST;
-
-	DP("set: %s, ip: %u.%u.%u.%u", set->name, HIPQUAD(ip));
-	memcpy(&table[ip - map->first_ip].ethernet, ethernet, ETH_ALEN);
-	table[ip - map->first_ip].match = IPSET_MACIP_ISSET;
-	return 0;
-}
-
-#define KADT_CONDITION						\
-	if (!(skb_mac_header(skb) >= skb->head			\
-	      && (skb_mac_header(skb) + ETH_HLEN) <= skb->data))\
-		return -EINVAL;
-
-UADT(macipmap, add, req->ethernet)
-KADT(macipmap, add, ipaddr, eth_hdr(skb)->h_source)
-
-static inline int
-macipmap_del(struct ip_set *set, ip_set_ip_t ip)
-{
-	struct ip_set_macipmap *map = set->data;
-	struct ip_set_macip *table = map->members;
-
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -ERANGE;
-	if (!table[ip - map->first_ip].match)
-		return -EEXIST;
-
-	table[ip - map->first_ip].match = 0;
-	DP("set: %s, ip: %u.%u.%u.%u", set->name, HIPQUAD(ip));
-	return 0;
-}
-
-#undef KADT_CONDITION
-#define KADT_CONDITION
-
-UADT(macipmap, del)
-KADT(macipmap, del, ipaddr)
-
-static inline int
-__macipmap_create(const struct ip_set_req_macipmap_create *req,
-		  struct ip_set_macipmap *map)
-{
-	if (req->to - req->from > MAX_RANGE) {
-		ip_set_printk("range too big, %d elements (max %d)",
-			      req->to - req->from + 1, MAX_RANGE+1);
-		return -ENOEXEC;
-	}
-	map->flags = req->flags;
-	return (req->to - req->from + 1) * sizeof(struct ip_set_macip);
-}
-
-BITMAP_CREATE(macipmap)
-BITMAP_DESTROY(macipmap)
-BITMAP_FLUSH(macipmap)
-
-static inline void
-__macipmap_list_header(const struct ip_set_macipmap *map,
-		       struct ip_set_req_macipmap_create *header)
-{
-	header->flags = map->flags;
-}
-
-BITMAP_LIST_HEADER(macipmap)
-BITMAP_LIST_MEMBERS_SIZE(macipmap, struct ip_set_req_macipmap,
-			 (map->last_ip - map->first_ip + 1),
-			 ((const struct ip_set_macip *)map->members)[i].match)
-
-
-static void
-macipmap_list_members(const struct ip_set *set, void *data, char dont_align)
-{
-	const struct ip_set_macipmap *map = set->data;
-	const struct ip_set_macip *table = map->members;
-	uint32_t i, n = 0;
-	struct ip_set_req_macipmap *d;
-	
-	if (dont_align) {
-		memcpy(data, map->members, map->size);
-		return;
-	}
-	
-	for (i = 0; i < map->last_ip - map->first_ip + 1; i++)
-		if (table[i].match) {
-			d = data + n * IPSET_ALIGN(sizeof(struct ip_set_req_macipmap));
-			d->ip = map->first_ip + i;
-			memcpy(d->ethernet, &table[i].ethernet, ETH_ALEN);
-			n++;
-		}
-}
-
-IP_SET_TYPE(macipmap, IPSET_TYPE_IP | IPSET_DATA_SINGLE)
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
-MODULE_DESCRIPTION("macipmap type of IP sets");
-
-REGISTER_MODULE(macipmap)

extensions/ipset/ip_set_macipmap.h

@@ -1,39 +0,0 @@
-#ifndef __IP_SET_MACIPMAP_H
-#define __IP_SET_MACIPMAP_H
-
-#include "ip_set.h"
-#include "ip_set_bitmaps.h"
-
-#define SETTYPE_NAME		"macipmap"
-
-/* general flags */
-#define IPSET_MACIP_MATCHUNSET	1
-
-/* per ip flags */
-#define IPSET_MACIP_ISSET	1
-
-struct ip_set_macipmap {
-	void *members;			/* the macipmap proper */
-	ip_set_ip_t first_ip;		/* host byte order, included in range */
-	ip_set_ip_t last_ip;		/* host byte order, included in range */
-	u_int32_t flags;
-	u_int32_t size;			/* size of the ipmap proper */
-};
-
-struct ip_set_req_macipmap_create {
-	ip_set_ip_t from;
-	ip_set_ip_t to;
-	u_int32_t flags;
-};
-
-struct ip_set_req_macipmap {
-	ip_set_ip_t ip;
-	unsigned char ethernet[ETH_ALEN];
-};
-
-struct ip_set_macip {
-	unsigned short match;
-	unsigned char ethernet[ETH_ALEN];
-};
-
-#endif	/* __IP_SET_MACIPMAP_H */

extensions/ipset/ip_set_malloc.h

@@ -1,153 +0,0 @@
-#ifndef _IP_SET_MALLOC_H
-#define _IP_SET_MALLOC_H
-
-#ifdef __KERNEL__
-#include <linux/vmalloc.h> 
-
-static size_t max_malloc_size = 0, max_page_size = 0;
-static size_t default_max_malloc_size = 131072;			/* Guaranteed: slab.c */
-
-static inline int init_max_page_size(void)
-{
-/* Compatibility glues to support 2.4.36 */
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
-#define __GFP_NOWARN		0
-
-	/* Guaranteed: slab.c */
-	max_malloc_size = max_page_size = default_max_malloc_size;
-#else
-	size_t page_size = 0;
-
-#define CACHE(x) if (max_page_size == 0 || x < max_page_size)	\
-			page_size = x;
-#include <linux/kmalloc_sizes.h>
-#undef CACHE
-	if (page_size) {
-		if (max_malloc_size == 0)
-			max_malloc_size = page_size;
-
-		max_page_size = page_size;
-
-		return 1;
-	}
-#endif
-	return 0;
-}
-
-struct harray {
-	size_t max_elements;
-	void *arrays[0];
-};
-
-static inline void * 
-__harray_malloc(size_t hashsize, size_t typesize, gfp_t flags)
-{
-	struct harray *harray;
-	size_t max_elements, size, i, j;
-
-	BUG_ON(max_page_size == 0);
-
-	if (typesize > max_page_size)
-		return NULL;
-
-	max_elements = max_page_size/typesize;
-	size = hashsize/max_elements;
-	if (hashsize % max_elements)
-		size++;
-	
-	/* Last pointer signals end of arrays */
-	harray = kmalloc(sizeof(struct harray) + (size + 1) * sizeof(void *),
-			 flags);
-
-	if (!harray)
-		return NULL;
-	
-	for (i = 0; i < size - 1; i++) {
-		harray->arrays[i] = kmalloc(max_elements * typesize, flags);
-		if (!harray->arrays[i])
-			goto undo;
-		memset(harray->arrays[i], 0, max_elements * typesize);
-	}
-	harray->arrays[i] = kmalloc((hashsize - i * max_elements) * typesize, 
-				    flags);
-	if (!harray->arrays[i])
-		goto undo;
-	memset(harray->arrays[i], 0, (hashsize - i * max_elements) * typesize);
-
-	harray->max_elements = max_elements;
-	harray->arrays[size] = NULL;
-	
-	return (void *)harray;
-
-    undo:
-    	for (j = 0; j < i; j++) {
-    		kfree(harray->arrays[j]);
-    	}
-    	kfree(harray);
-    	return NULL;
-}
-
-static inline void *
-harray_malloc(size_t hashsize, size_t typesize, gfp_t flags)
-{
-	void *harray;
-	
-	do {
-		harray = __harray_malloc(hashsize, typesize, flags|__GFP_NOWARN);
-	} while (harray == NULL && init_max_page_size());
-	
-	return harray;
-}		
-
-static inline void harray_free(void *h)
-{
-	struct harray *harray = (struct harray *) h;
-	size_t i;
-	
-    	for (i = 0; harray->arrays[i] != NULL; i++)
-    		kfree(harray->arrays[i]);
-    	kfree(harray);
-}
-
-static inline void harray_flush(void *h, size_t hashsize, size_t typesize)
-{
-	struct harray *harray = (struct harray *) h;
-	size_t i;
-	
-    	for (i = 0; harray->arrays[i+1] != NULL; i++)
-		memset(harray->arrays[i], 0, harray->max_elements * typesize);
-	memset(harray->arrays[i], 0, 
-	       (hashsize - i * harray->max_elements) * typesize);
-}
-
-#define HARRAY_ELEM(h, type, which)				\
-({								\
-	struct harray *__h = (struct harray *)(h);		\
-	((type)((__h)->arrays[(which)/(__h)->max_elements])	\
-		+ (which)%(__h)->max_elements);			\
-})
-
-/* General memory allocation and deallocation */
-static inline void * ip_set_malloc(size_t bytes)
-{
-	BUG_ON(max_malloc_size == 0);
-
-	if (bytes > default_max_malloc_size)
-		return vmalloc(bytes);
-	else
-		return kmalloc(bytes, GFP_KERNEL | __GFP_NOWARN);
-}
-
-static inline void ip_set_free(void * data, size_t bytes)
-{
-	BUG_ON(max_malloc_size == 0);
-
-	if (bytes > default_max_malloc_size)
-		vfree(data);
-	else
-		kfree(data);
-}
-
-#endif				/* __KERNEL__ */
-
-#endif /*_IP_SET_MALLOC_H*/

extensions/ipset/ip_set_nethash.c

@@ -1,218 +0,0 @@
-/* Copyright (C) 2003-2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/* Kernel module implementing a cidr nethash set */
-
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/ip.h>
-#include <linux/skbuff.h>
-#include "ip_set_jhash.h"
-#include <linux/errno.h>
-#include <asm/uaccess.h>
-#include <asm/bitops.h>
-#include <linux/spinlock.h>
-#include <linux/random.h>
-
-#include <net/ip.h>
-
-#include "ip_set_nethash.h"
-
-static int limit = MAX_RANGE;
-
-static inline __u32
-nethash_id_cidr(const struct ip_set_nethash *map,
-		ip_set_ip_t ip,
-		uint8_t cidr)
-{
-	__u32 id;
-	u_int16_t i;
-	ip_set_ip_t *elem;
-
-	ip = pack_ip_cidr(ip, cidr);
-	if (!ip)
-		return MAX_RANGE;
-	
-	for (i = 0; i < map->probes; i++) {
-		id = jhash_ip(map, i, ip) % map->hashsize;
-	   	DP("hash key: %u", id);
-		elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
-	   	if (*elem == ip)
-			return id;
-		/* No shortcut - there can be deleted entries. */
-	}
-	return UINT_MAX;
-}
-
-static inline __u32
-nethash_id(struct ip_set *set, ip_set_ip_t ip)
-{
-	const struct ip_set_nethash *map = set->data;
-	__u32 id = UINT_MAX;
-	int i;
-
-	for (i = 0; i < 30 && map->cidr[i]; i++) {
-		id = nethash_id_cidr(map, ip, map->cidr[i]);
-		if (id != UINT_MAX)
-			break;
-	}
-	return id;
-}
-
-static inline int
-nethash_test_cidr(struct ip_set *set, ip_set_ip_t ip, uint8_t cidr)
-{
-	const struct ip_set_nethash *map = set->data;
-
-	return (nethash_id_cidr(map, ip, cidr) != UINT_MAX);
-}
-
-static inline int
-nethash_test(struct ip_set *set, ip_set_ip_t ip)
-{
-	return (nethash_id(set, ip) != UINT_MAX);
-}
-
-static int
-nethash_utest(struct ip_set *set, const void *data, u_int32_t size)
-{
-	const struct ip_set_req_nethash *req = data;
-
-	if (req->cidr <= 0 || req->cidr > 32)
-		return -EINVAL;
-	return (req->cidr == 32 ? nethash_test(set, req->ip)
-		: nethash_test_cidr(set, req->ip, req->cidr));
-}
-
-#define KADT_CONDITION
-
-KADT(nethash, test, ipaddr)
-
-static inline int
-__nethash_add(struct ip_set_nethash *map, ip_set_ip_t *ip)
-{
-	__u32 probe;
-	u_int16_t i;
-	ip_set_ip_t *elem, *slot = NULL;
-	
-	for (i = 0; i < map->probes; i++) {
-		probe = jhash_ip(map, i, *ip) % map->hashsize;
-		elem = HARRAY_ELEM(map->members, ip_set_ip_t *, probe);
-		if (*elem == *ip)
-			return -EEXIST;
-		if (!(slot || *elem))
-			slot = elem;
-		/* There can be deleted entries, must check all slots */
-	}
-	if (slot) {
-		*slot = *ip;
-		map->elements++;
-		return 0;
-	}
-	/* Trigger rehashing */
-	return -EAGAIN;
-}
-
-static inline int
-nethash_add(struct ip_set *set, ip_set_ip_t ip, uint8_t cidr)
-{
-	struct ip_set_nethash *map = set->data;
-	int ret;
-	
-	if (map->elements >= limit || map->nets[cidr-1] == UINT16_MAX)
-		return -ERANGE;	
-	if (cidr <= 0 || cidr >= 32)
-		return -EINVAL;
-
-	ip = pack_ip_cidr(ip, cidr);
-	if (!ip)
-		return -ERANGE;
-	
-	ret = __nethash_add(map, &ip);
-	if (ret == 0) {
-		if (!map->nets[cidr-1]++)
-			add_cidr_size(map->cidr, cidr);
-	}
-	
-	return ret;
-}
-
-#undef KADT_CONDITION
-#define KADT_CONDITION							\
-	struct ip_set_nethash *map = set->data;				\
-	uint8_t cidr = map->cidr[0] ? map->cidr[0] : 31;
-
-UADT(nethash, add, req->cidr)
-KADT(nethash, add, ipaddr, cidr)
-
-static inline void
-__nethash_retry(struct ip_set_nethash *tmp, struct ip_set_nethash *map)
-{
-	memcpy(tmp->cidr, map->cidr, sizeof(tmp->cidr));
-	memcpy(tmp->nets, map->nets, sizeof(tmp->nets));
-}
-
-HASH_RETRY(nethash, ip_set_ip_t)
-
-static inline int
-nethash_del(struct ip_set *set, ip_set_ip_t ip, uint8_t cidr)
-{
-	struct ip_set_nethash *map = set->data;
-	ip_set_ip_t id, *elem;
-
-	if (cidr <= 0 || cidr >= 32)
-		return -EINVAL;	
-	
-	id = nethash_id_cidr(map, ip, cidr);
-	if (id == UINT_MAX)
-		return -EEXIST;
-		
-	elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id);
-	*elem = 0;
-	map->elements--;
-	if (!map->nets[cidr-1]--)
-		del_cidr_size(map->cidr, cidr);
-	return 0;
-}
-
-UADT(nethash, del, req->cidr)
-KADT(nethash, del, ipaddr, cidr)
-
-static inline int
-__nethash_create(const struct ip_set_req_nethash_create *req,
-		 struct ip_set_nethash *map)
-{
-	memset(map->cidr, 0, sizeof(map->cidr));
-	memset(map->nets, 0, sizeof(map->nets));
-	
-	return 0;
-}
-
-HASH_CREATE(nethash, ip_set_ip_t)
-HASH_DESTROY(nethash)
-
-HASH_FLUSH_CIDR(nethash, ip_set_ip_t)
-
-static inline void
-__nethash_list_header(const struct ip_set_nethash *map,
-		      struct ip_set_req_nethash_create *header)
-{    
-}
-
-HASH_LIST_HEADER(nethash)
-HASH_LIST_MEMBERS_SIZE(nethash, ip_set_ip_t)
-HASH_LIST_MEMBERS(nethash, ip_set_ip_t)
-
-IP_SET_RTYPE(nethash, IPSET_TYPE_IP | IPSET_DATA_SINGLE)
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
-MODULE_DESCRIPTION("nethash type of IP sets");
-module_param(limit, int, 0600);
-MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
-
-REGISTER_MODULE(nethash)

extensions/ipset/ip_set_nethash.h

@@ -1,31 +0,0 @@
-#ifndef __IP_SET_NETHASH_H
-#define __IP_SET_NETHASH_H
-
-#include "ip_set.h"
-#include "ip_set_hashes.h"
-
-#define SETTYPE_NAME		"nethash"
-
-struct ip_set_nethash {
-	ip_set_ip_t *members;		/* the nethash proper */
-	uint32_t elements;		/* number of elements */
-	uint32_t hashsize;		/* hash size */
-	uint16_t probes;		/* max number of probes  */
-	uint16_t resize;		/* resize factor in percent */
-	uint8_t cidr[30];		/* CIDR sizes */
-	uint16_t nets[30];		/* nr of nets by CIDR sizes */
-	initval_t initval[0];		/* initvals for jhash_1word */
-};
-
-struct ip_set_req_nethash_create {
-	uint32_t hashsize;
-	uint16_t probes;
-	uint16_t resize;
-};
-
-struct ip_set_req_nethash {
-	ip_set_ip_t ip;
-	uint8_t cidr;
-};
-
-#endif	/* __IP_SET_NETHASH_H */

extensions/ipset/ip_set_portmap.c

@@ -1,130 +0,0 @@
-/* Copyright (C) 2003-2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/* Kernel module implementing a port set type as a bitmap */
-
-#include <linux/module.h>
-#include <linux/ip.h>
-#include <linux/tcp.h>
-#include <linux/udp.h>
-#include <linux/skbuff.h>
-#include <linux/errno.h>
-#include <asm/uaccess.h>
-#include <asm/bitops.h>
-#include <linux/spinlock.h>
-
-#include <net/ip.h>
-
-#include "ip_set_portmap.h"
-#include "ip_set_getport.h"
-
-static inline int
-portmap_test(const struct ip_set *set, ip_set_ip_t port)
-{
-	const struct ip_set_portmap *map = set->data;
-
-	if (port < map->first_ip || port > map->last_ip)
-		return -ERANGE;
-		
-	DP("set: %s, port: %u", set->name, port);
-	return !!test_bit(port - map->first_ip, map->members);
-}
-
-#define KADT_CONDITION			\
-	if (ip == INVALID_PORT)		\
-		return 0;	
-
-UADT(portmap, test)
-KADT(portmap, test, get_port)
-
-static inline int
-portmap_add(struct ip_set *set, ip_set_ip_t port)
-{
-	struct ip_set_portmap *map = set->data;
-
-	if (port < map->first_ip || port > map->last_ip)
-		return -ERANGE;
-	if (test_and_set_bit(port - map->first_ip, map->members))
-		return -EEXIST;
-	
-	DP("set: %s, port %u", set->name, port);
-	return 0;
-}
-
-UADT(portmap, add)
-KADT(portmap, add, get_port)
-
-static inline int
-portmap_del(struct ip_set *set, ip_set_ip_t port)
-{
-	struct ip_set_portmap *map = set->data;
-
-	if (port < map->first_ip || port > map->last_ip)
-		return -ERANGE;
-	if (!test_and_clear_bit(port - map->first_ip, map->members))
-		return -EEXIST;
-	
-	DP("set: %s, port %u", set->name, port);
-	return 0;
-}
-
-UADT(portmap, del)
-KADT(portmap, del, get_port)
-
-static inline int
-__portmap_create(const struct ip_set_req_portmap_create *req,
-		 struct ip_set_portmap *map)
-{
-	if (req->to - req->from > MAX_RANGE) {
-		ip_set_printk("range too big, %d elements (max %d)",
-			      req->to - req->from + 1, MAX_RANGE+1);
-		return -ENOEXEC;
-	}
-	return bitmap_bytes(req->from, req->to);
-}
-
-BITMAP_CREATE(portmap)
-BITMAP_DESTROY(portmap)
-BITMAP_FLUSH(portmap)
-
-static inline void
-__portmap_list_header(const struct ip_set_portmap *map,
-		      struct ip_set_req_portmap_create *header)
-{
-}
-
-BITMAP_LIST_HEADER(portmap)
-BITMAP_LIST_MEMBERS_SIZE(portmap, ip_set_ip_t, (map->last_ip - map->first_ip + 1),
-			 test_bit(i, map->members))
-
-static void
-portmap_list_members(const struct ip_set *set, void *data, char dont_align)
-{
-	const struct ip_set_portmap *map = set->data;
-	uint32_t i, n = 0;
-	ip_set_ip_t *d;
-	
-	if (dont_align) {
-		memcpy(data, map->members, map->size);
-		return;
-	}
-	
-	for (i = 0; i < map->last_ip - map->first_ip + 1; i++)
-		if (test_bit(i, map->members)) {
-			d = data + n * IPSET_ALIGN(sizeof(ip_set_ip_t));
-			*d = map->first_ip + i;
-			n++;
-		}
-}
-
-IP_SET_TYPE(portmap, IPSET_TYPE_PORT | IPSET_DATA_SINGLE)
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
-MODULE_DESCRIPTION("portmap type of IP sets");
-
-REGISTER_MODULE(portmap)

extensions/ipset/ip_set_portmap.h

@@ -1,25 +0,0 @@
-#ifndef __IP_SET_PORTMAP_H
-#define __IP_SET_PORTMAP_H
-
-#include "ip_set.h"
-#include "ip_set_bitmaps.h"
-
-#define SETTYPE_NAME		"portmap"
-
-struct ip_set_portmap {
-	void *members;			/* the portmap proper */
-	ip_set_ip_t first_ip;		/* host byte order, included in range */
-	ip_set_ip_t last_ip;		/* host byte order, included in range */
-	u_int32_t size;			/* size of the ipmap proper */
-};
-
-struct ip_set_req_portmap_create {
-	ip_set_ip_t from;
-	ip_set_ip_t to;
-};
-
-struct ip_set_req_portmap {
-	ip_set_ip_t ip;
-};
-
-#endif /* __IP_SET_PORTMAP_H */

extensions/ipset/ip_set_setlist.c

@@ -1,324 +0,0 @@
-/* Copyright (C) 2008 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/* Kernel module implementing an IP set type: the setlist type */
-
-#include <linux/module.h>
-#include <linux/ip.h>
-#include <linux/skbuff.h>
-#include <linux/errno.h>
-
-#include "ip_set.h"
-#include "ip_set_bitmaps.h"
-#include "ip_set_setlist.h"
-
-/*
- * before ==> index, ref
- * after  ==> ref, index
- */
-
-static inline int
-next_index_eq(const struct ip_set_setlist *map, int i, ip_set_id_t index)
-{
-	return i < map->size && map->index[i] == index;
-}
-
-static int
-setlist_utest(struct ip_set *set, const void *data, u_int32_t size)
-{
-	const struct ip_set_setlist *map = set->data;
-	const struct ip_set_req_setlist *req = data;
-	ip_set_id_t index, ref = IP_SET_INVALID_ID;
-	int i, res = 0;
-	struct ip_set *s;
-	
-	if (req->before && req->ref[0] == '\0')
-		return 0;
-
-	index = __ip_set_get_byname(req->name, &s);
-	if (index == IP_SET_INVALID_ID)
-		return 0;
-	if (req->ref[0] != '\0') {
-		ref = __ip_set_get_byname(req->ref, &s);
-		if (ref == IP_SET_INVALID_ID)
-			goto finish;
-	}
-	for (i = 0; i < map->size
-		    && map->index[i] != IP_SET_INVALID_ID; i++) {
-		if (req->before && map->index[i] == index) {
-		    	res = next_index_eq(map, i + 1, ref);
-		    	break;
-		} else if (!req->before) {
-			if ((ref == IP_SET_INVALID_ID
-			     && map->index[i] == index)
-			    || (map->index[i] == ref
-			        && next_index_eq(map, i + 1, index))) {
-			        res = 1;
-			        break;
-			}
-		}
-	}
-	if (ref != IP_SET_INVALID_ID)
-		__ip_set_put_byindex(ref);
-finish:
-	__ip_set_put_byindex(index);
-	return res;
-}
-
-static int
-setlist_ktest(struct ip_set *set,
-	      const struct sk_buff *skb,
-	      const u_int32_t *flags)
-{
-	struct ip_set_setlist *map = set->data;
-	int i, res = 0;
-	
-	for (i = 0; i < map->size
-		    && map->index[i] != IP_SET_INVALID_ID
-		    && res == 0; i++)
-		res = ip_set_testip_kernel(map->index[i], skb, flags);
-	return res;
-}
-
-static inline int
-insert_setlist(struct ip_set_setlist *map, int i, ip_set_id_t index)
-{
-	ip_set_id_t tmp;
-	int j;
-
-	DP("i: %u, last %u\n", i, map->index[map->size - 1]);	
-	if (i >= map->size || map->index[map->size - 1] != IP_SET_INVALID_ID)
-		return -ERANGE;
-	
-	for (j = i; j < map->size
-		    && index != IP_SET_INVALID_ID; j++) {
-		tmp = map->index[j];
-		map->index[j] = index;
-		index = tmp;
-	}
-	return 0;
-}
-
-static int
-setlist_uadd(struct ip_set *set, const void *data, u_int32_t size)
-{
-	struct ip_set_setlist *map = set->data;
-	const struct ip_set_req_setlist *req = data;
-	ip_set_id_t index, ref = IP_SET_INVALID_ID;
-	int i, res = -ERANGE;
-	struct ip_set *s;
-	
-	if (req->before && req->ref[0] == '\0')
-		return -EINVAL;
-
-	index = __ip_set_get_byname(req->name, &s);
-	if (index == IP_SET_INVALID_ID)
-		return -EEXIST;
-	/* "Loop detection" */
-	if (strcmp(s->type->typename, "setlist") == 0)
-		goto finish;
-
-	if (req->ref[0] != '\0') {
-		ref = __ip_set_get_byname(req->ref, &s);
-		if (ref == IP_SET_INVALID_ID) {
-			res = -EEXIST;
-			goto finish;
-		}
-	}
-	for (i = 0; i < map->size; i++) {
-		if (map->index[i] != ref)
-			continue;
-		if (req->before) 
-			res = insert_setlist(map, i, index);
-		else
-			res = insert_setlist(map,
-				ref == IP_SET_INVALID_ID ? i : i + 1,
-				index);
-		break;
-	}
-	if (ref != IP_SET_INVALID_ID)
-		__ip_set_put_byindex(ref);
-	/* In case of success, we keep the reference to the set */
-finish:
-	if (res != 0)
-		__ip_set_put_byindex(index);
-	return res;
-}
-
-static int
-setlist_kadd(struct ip_set *set,
-	     const struct sk_buff *skb,
-	     const u_int32_t *flags)
-{
-	struct ip_set_setlist *map = set->data;
-	int i, res = -EINVAL;
-	
-	for (i = 0; i < map->size
-		    && map->index[i] != IP_SET_INVALID_ID
-		    && res != 0; i++)
-		res = ip_set_addip_kernel(map->index[i], skb, flags);
-	return res;
-}
-
-static inline int
-unshift_setlist(struct ip_set_setlist *map, int i)
-{
-	int j;
-	
-	for (j = i; j < map->size - 1; j++)
-		map->index[j] = map->index[j+1];
-	map->index[map->size-1] = IP_SET_INVALID_ID;
-	return 0;
-}
-
-static int
-setlist_udel(struct ip_set *set, const void *data, u_int32_t size)
-{
-	struct ip_set_setlist *map = set->data;
-	const struct ip_set_req_setlist *req = data;
-	ip_set_id_t index, ref = IP_SET_INVALID_ID;
-	int i, res = -EEXIST;
-	struct ip_set *s;
-	
-	if (req->before && req->ref[0] == '\0')
-		return -EINVAL;
-
-	index = __ip_set_get_byname(req->name, &s);
-	if (index == IP_SET_INVALID_ID)
-		return -EEXIST;
-	if (req->ref[0] != '\0') {
-		ref = __ip_set_get_byname(req->ref, &s);
-		if (ref == IP_SET_INVALID_ID)
-			goto finish;
-	}
-	for (i = 0; i < map->size
-	            && map->index[i] != IP_SET_INVALID_ID; i++) {
-		if (req->before) {
-			if (map->index[i] == index
-			    && next_index_eq(map, i + 1, ref)) {
-				res = unshift_setlist(map, i);
-				break;
-			}
-		} else if (ref == IP_SET_INVALID_ID) {
-			if (map->index[i] == index) {
-				res = unshift_setlist(map, i);
-				break;
-			}
-		} else if (map->index[i] == ref
-			   && next_index_eq(map, i + 1, index)) {
-			res = unshift_setlist(map, i + 1);
-			break;
-		}
-	}
-	if (ref != IP_SET_INVALID_ID)
-		__ip_set_put_byindex(ref);
-finish:
-	__ip_set_put_byindex(index);
-	/* In case of success, release the reference to the set */
-	if (res == 0)
-		__ip_set_put_byindex(index);
-	return res;
-}
-
-static int
-setlist_kdel(struct ip_set *set,
-	     const struct sk_buff *skb,
-	     const u_int32_t *flags)
-{
-	struct ip_set_setlist *map = set->data;
-	int i, res = -EINVAL;
-	
-	for (i = 0; i < map->size
-		    && map->index[i] != IP_SET_INVALID_ID
-		    && res != 0; i++)
-		res = ip_set_delip_kernel(map->index[i], skb, flags);
-	return res;
-}
-
-static int
-setlist_create(struct ip_set *set, const void *data, u_int32_t size)
-{
-	struct ip_set_setlist *map;
-	const struct ip_set_req_setlist_create *req = data;
-	int i;
-	
-	map = kmalloc(sizeof(struct ip_set_setlist) +
-		      req->size * sizeof(ip_set_id_t), GFP_KERNEL);
-	if (!map)
-		return -ENOMEM;
-	map->size = req->size;
-	for (i = 0; i < map->size; i++)
-		map->index[i] = IP_SET_INVALID_ID;
-	
-	set->data = map;
-	return 0;
-}                        
-
-static void
-setlist_destroy(struct ip_set *set)
-{
-	struct ip_set_setlist *map = set->data;
-	int i;
-	
-	for (i = 0; i < map->size
-		    && map->index[i] != IP_SET_INVALID_ID; i++)
-		__ip_set_put_byindex(map->index[i]);
-
-	kfree(map);
-	set->data = NULL;
-}
-
-static void
-setlist_flush(struct ip_set *set)
-{
-	struct ip_set_setlist *map = set->data;
-	int i;
-	
-	for (i = 0; i < map->size
-		    && map->index[i] != IP_SET_INVALID_ID; i++) {
-		__ip_set_put_byindex(map->index[i]);
-		map->index[i] = IP_SET_INVALID_ID;
-	}
-}
-
-static void
-setlist_list_header(const struct ip_set *set, void *data)
-{
-	const struct ip_set_setlist *map = set->data;
-	struct ip_set_req_setlist_create *header = data;
-	
-	header->size = map->size;
-}
-
-static int
-setlist_list_members_size(const struct ip_set *set, char dont_align)
-{
-	const struct ip_set_setlist *map = set->data;
-	
-	return map->size * IPSET_VALIGN(sizeof(ip_set_id_t), dont_align);
-}
-
-static void
-setlist_list_members(const struct ip_set *set, void *data, char dont_align)
-{
-	struct ip_set_setlist *map = set->data;
-	ip_set_id_t *d;
-	int i;
-	
-	for (i = 0; i < map->size; i++) {
-		d = data + i * IPSET_VALIGN(sizeof(ip_set_id_t), dont_align);
-		*d = ip_set_id(map->index[i]);
-	}
-}
-
-IP_SET_TYPE(setlist, IPSET_TYPE_SETNAME | IPSET_DATA_SINGLE)
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
-MODULE_DESCRIPTION("setlist type of IP sets");
-
-REGISTER_MODULE(setlist)

extensions/ipset/ip_set_setlist.h

@@ -1,26 +0,0 @@
-#ifndef __IP_SET_SETLIST_H
-#define __IP_SET_SETLIST_H
-
-#include "ip_set.h"
-
-#define SETTYPE_NAME			"setlist"
-
-#define IP_SET_SETLIST_ADD_AFTER	0
-#define IP_SET_SETLIST_ADD_BEFORE	1
-
-struct ip_set_setlist {
-	uint8_t size;
-	ip_set_id_t index[0];
-};
-
-struct ip_set_req_setlist_create {
-	uint8_t size;
-};
-
-struct ip_set_req_setlist {
-	char name[IP_SET_MAXNAMELEN];
-	char ref[IP_SET_MAXNAMELEN];
-	uint8_t before;
-};
-
-#endif /* __IP_SET_SETLIST_H */

extensions/ipset/ipset.8

@@ -1,541 +0,0 @@
-.TH IPSET 8 "Feb 05, 2004" "" ""
-.\"
-.\" Man page written by Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
-.\"
-.\"	This program is free software; you can redistribute it and/or modify
-.\"	it under the terms of the GNU General Public License as published by
-.\"	the Free Software Foundation; either version 2 of the License, or
-.\"	(at your option) any later version.
-.\"
-.\"	This program is distributed in the hope that it will be useful,
-.\"	but WITHOUT ANY WARRANTY; without even the implied warranty of
-.\"	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-.\"	GNU General Public License for more details.
-.\"
-.\"	You should have received a copy of the GNU General Public License
-.\"	along with this program; if not, write to the Free Software
-.\"	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-.\"
-.\"
-.SH NAME
-ipset \(em administration tool for IP sets
-.SH SYNOPSIS
-.PP
-\fBipset \-N\fP \fIset\fP \fItype-specification\fP [\fIoptions\fP...]
-.PP
-\fBipset\fP {\fB\-F\fP|\fB\-H\fP|\fB\-L\fP|\fB\-S\fP|\fB\-X\fP} [\fIset\fP]
-[\fIoptions\fP...]
-.PP
-\fBipset\fP {\fB\-E\fP|\fB\-W\fP} \fIfrom-set\fP \fIto-set\fP
-.PP
-\fBipset\fP {\fB\-A\fP|\fB\-D\fP|\fB\-T\fP} \fIset\fP \fIentry\fP
-.PP
-\fBipset \-R\fP
-.PP
-\fBipset\fP {\fB-V\fP|\fB\-v\fP}
-.SH DESCRIPTION
-.B ipset
-is used to set up, maintain and inspect so called IP sets in the Linux
-kernel. Depending on the type, an IP set may store IP addresses, (TCP/UDP)
-port numbers or additional informations besides IP addresses: the word IP 
-means a general term here. See the set type definitions below.
-.P
-Iptables matches and targets referring to sets creates references, which
-protects the given sets in the kernel. A set cannot be removed (destroyed)
-while there is a single reference pointing to it.
-.SH OPTIONS
-The options that are recognized by
-.B ipset
-can be divided into several different groups.
-.SS COMMANDS
-These options specify the specific action to perform.  Only one of them
-can be specified on the command line unless otherwise specified
-below.  For all the long versions of the command and option names, you
-need to use only enough letters to ensure that
-.B ipset
-can differentiate it from all other options.
-.TP
-\fB\-N\fP, \fB\-\-create\fP \fIsetname\fP \fItype\fP \fItype-specific-options\fP
-Create a set identified with setname and specified type. 
-Type-specific options must be supplied.
-.TP
-\fB\-X\fP, \fB\-\-destroy\fP [\fIsetname\fP]
-Destroy the specified set or all the sets if none is given.
-
-If the set has got references, nothing is done.
-.TP
-\fB\-F\fP, \fB\-\-flush\fP [\fIsetname\fP]
-Delete all entries from the specified set or flush
-all sets if none is given.
-.TP
-\fB\-E\fP, \fB\-\-rename\fP \fIfrom-setname\fP \fIto-setname\fP
-Rename a set. Set identified by to-setname must not exist.
-.TP
-\fB\-W\fP, \fB\-\-swap\fP \fIfrom-setname\fP \fIto-setname\fP
-Swap the content of two sets, or in another words, 
-exchange the name of two sets. The referred sets must exist and
-identical type of sets can be swapped only.
-.TP
-\fB\-L\fP, \fB\-\-list\fP [\fIsetname\fP]
-List the entries for the specified set, or for
-all sets if none is given. The
-\fB\-r\fP/\fB\-\-resolve\fP
-option can be used to force name lookups (which may be slow). When the
-\fB\-s\fP/\fB\-\-sorted\fP
-option is given, the entries are listed sorted (if the given set
-type supports the operation).
-.TP
-\fB\-S\fP, \fB\-\-save\fP [\fIsetname\fP]
-Save the given set, or all sets if none is given
-to stdout in a format that \fB\-\-restore\fP can read.
-.TP
-\fB\-R\fP, \fB\-\-restore\fP
-Restore a saved session generated by \fB\-\-save\fP. The saved session
-can be fed from stdin.
-
-When generating a session file please note that the supported commands
-(create set and add element) must appear in a strict order: first create
-the set, then add all elements. Then create the next set, add all its elements
-and so on. Also, it is a restore operation, so the sets being restored must 
-not exist.
-.TP
-\fB\-A\fP, \fB\-\-add\fP \fIsetname\fP \fIentry\fP
-Add an entry to a set.
-.TP
-\fB\-D\fP, \fB\-\-del\fP \fIsetname\fP \fIentry\fP
-Delete an entry from a set.
-.TP
-\fB-T\fP, \fB\-\-test\fP \fIsetname\fP \fIentry\fP
-Test wether an entry is in a set or not. Exit status number is zero
-if the tested entry is in the set and nonzero if it is missing from
-the set.
-.TP
-\fB\-H\fP, \fB\-\-help\fP [\fIsettype\fP]
-Print help and settype specific help if settype specified.
-.TP
-\fB\-V\fP, \fB\-v\fP, \fB\-\-version\fP
-Print program version and protocol version.
-.P
-.SS "OTHER OPTIONS"
-The following additional options can be specified:
-.TP
-\fB\-r\fP, \fB\-\-resolve\fP
-When listing sets, enforce name lookup. The 
-program will try to display the IP entries resolved to 
-host names or services (whenever applicable), which can trigger
-.B
-slow
-DNS 
-lookups.
-.TP
-\fB\-s\fP, \fB\-\-sorted\fP
-Sorted output. When listing sets, entries are listed sorted.
-.TP
-\fB\-n\fP, \fB\-\-numeric\fP
-Numeric output. When listing sets, IP addresses and 
-port numbers will be printed in numeric format. This is the default.
-.TP
-\fB\-q\fP, \fB\-\-quiet\fP
-Suppress any output to stdout and stderr. ipset will still return
-possible errors.
-.SH SET TYPES
-ipset supports the following set types:
-.SS ipmap
-The ipmap set type uses a memory range, where each bit represents
-one IP address. An ipmap set can store up to 65536 (B-class network)
-IP addresses. The ipmap set type is very fast and memory cheap, great
-for use when one want to match certain IPs in a range. If the optional
-\fB\-\-netmask\fP
-parameter is specified with a CIDR netmask value between 1-31 then
-network addresses are stored in the given set: i.e an
-IP address will be in the set if the network address, which is resulted
-by masking the address with the specified netmask, can be found in the set.
-.P
-Options to use when creating an ipmap set:
-.TP
-\fB\-\-from\fP \fIfrom-addr\fP
-.TP
-\fB\-\-to\fP \fIto-addr\fP
-Create an ipmap set from the specified address range.
-.TP
-\fB\-\-network\fP \fIaddr\fP\fB/\fP\fImask\fP
-Create an ipmap set from the specified network.
-.TP
-\fB\-\-netmask\fP \fIprefixlen\fP
-When the optional
-\fB\-\-netmask\fP
-parameter specified, network addresses will be 
-stored in the set instead of IP addresses, and the \fIfrom-addr\fP parameter
-must be a network address. The \fIprefixlen\fP value must be between 1-31.
-.PP
-Example:
-.IP
-ipset \-N test ipmap \-\-network 192.168.0.0/16 
-.SS macipmap
-The macipmap set type uses a memory range, where each 8 bytes
-represents one IP and a MAC addresses. A macipmap set type can store
-up to 65536 (B-class network) IP addresses with MAC.
-When adding an entry to a macipmap set, you must specify the entry as
-"\fIaddress\fP\fB,\fP\fImac\fP".
-When deleting or testing macipmap entries, the
-"\fB,\fP\fImac\fP"
-part is not mandatory.
-.P
-Options to use when creating an macipmap set:
-.TP
-\fB\-\-from\fP \fIfrom-addr\fP
-.TP
-\fB\-\-to\fP \fIto-addr\fP
-Create a macipmap set from the specified address range.
-.TP
-\fB\-\-network\fP \fIaddr\fP\fB/\fP\fImask\fP
-Create a macipmap set from the specified network.
-.TP
-\fB\-\-matchunset\fP
-When the optional
-\fB\-\-matchunset\fP
-parameter specified, IP addresses which could be stored 
-in the set but not set yet, will always match.
-.P
-Please note, the 
-"set"
-and
-"SET"
-netfilter kernel modules
-.B
-always
-use the source MAC address from the packet to match, add or delete
-entries from a macipmap type of set.
-.SS portmap
-The portmap set type uses a memory range, where each bit represents
-one port. A portmap set type can store up to 65536 ports.
-The portmap set type is very fast and memory cheap.
-.P
-Options to use when creating an portmap set:
-.TP
-\fB\-\-from\fP \fIfrom-port\fP
-.TP
-\fB\-\-to\fP \fIto-port\fP
-Create a portmap set from the specified port range.
-.SS iphash
-The iphash set type uses a hash to store IP addresses.
-In order to avoid clashes in the hash double-hashing, and as a last
-resort, dynamic growing of the hash performed. The iphash set type is
-great to store random addresses. If the optional
-\fB\-\-netmask\fP
-parameter is specified with a CIDR prefix length value between 1-31 then
-network addresses are stored in the given set: i.e an
-IP address will be in the set if the network address, which is resulted
-by masking the address with the specified netmask, can be found in the set.
-.P
-Options to use when creating an iphash set:
-.TP
-\fB\-\-hashsize\fP \fIhashsize\fP
-The initial hash size (default 1024)
-.TP
-\fB\-\-probes\fP \fIprobes\fP
-How many times try to resolve clashing at adding an IP to the hash 
-by double-hashing (default 8).
-.TP
-\fB\-\-resize\fP \fIpercent\fP
-Increase the hash size by this many percent (default 50) when adding
-an IP to the hash could not be performed after
-\fIprobes\fP
-number of double-hashing. 
-.TP
-\fB\-\-netmask\fP \fIprefixlen\fP
-When the optional
-\fB\-\-netmask\fP
-parameter specified, network addresses will be 
-stored in the set instead of IP addresses. The \fIprefixlen\fP value must
-be between 1-31.
-.P
-The iphash type of sets can store up to 65536 entries. If a set is full,
-no new entries can be added to it.
-.P
-Sets created by zero valued resize parameter won't be resized at all.
-The lookup time in an iphash type of set grows approximately linearly with
-the value of the 
-\fIprobes\fP
-parameter. In general higher 
-\fIprobes\fP
-value results better utilized hash while smaller value
-produces larger, sparser hash.
-.PP
-Example:
-.IP
-ipset \-N test iphash \-\-probes 2
-.SS nethash
-The nethash set type uses a hash to store different size of
-network addresses. The
-.I
-entry
-used in the ipset commands must be in the form
-"\fIaddress\fP\fB/\fP\fIprefixlen\fP"
-where prefixlen must be in the inclusive range of 1-31.
-In order to avoid clashes in the hash 
-double-hashing, and as a last resort, dynamic growing of the hash performed.
-.P
-Options to use when creating an nethash set:
-.TP
-\fB\-\-hashsize\fP \fIhashsize\fP
-The initial hash size (default 1024)
-.TP
-\fB\-\-probes\fP \fIprobes\fP
-How many times try to resolve clashing at adding an IP to the hash 
-by double-hashing (default 4).
-.TP
-\fB\-\-resize\fP \fIpercent\fP
-Increase the hash size by this many percent (default 50) when adding
-an IP to the hash could not be performed after
-.P
-The nethash type of sets can store up to 65536 entries. If a set is full,
-no new entries can be added to it.
-.P
-An IP address will be in a nethash type of set if it belongs to any of the
-netblocks added to the set. The matching always start from the smallest
-size of netblock (most specific netmask) to the largest ones (least
-specific netmasks). When adding/deleting IP addresses
-to a nethash set by the
-"SET"
-netfilter kernel module, it will be added/deleted by the smallest
-netblock size which can be found in the set, or by /31 if the set is empty.
-.P
-The lookup time in a nethash type of set grows approximately linearly 
-with the times of the
-\fIprobes\fP
-parameter and the number of different mask parameters in the hash.
-Otherwise the same speed and memory efficiency comments applies here 
-as at the iphash type.
-.SS ipporthash
-The ipporthash set type uses a hash to store IP address and port pairs.
-In order to avoid clashes in the hash double-hashing, and as a last
-resort, dynamic growing of the hash performed. An ipporthash set can 
-store up to 65536 (B-class network) IP addresses with all possible port
-values. When adding, deleting and testing values in an ipporthash type of
-set, the entries must be specified as
-"\fIaddress\fP\fB,\fP\fIport\fP".
-.P
-The ipporthash types of sets evaluates two src/dst parameters of the 
-"set"
-match and 
-"SET"
-target. 
-.P
-Options to use when creating an ipporthash set:
-.TP
-\fB\-\-from\fP \fIfrom-addr\fP
-.TP
-\fB\-\-to\fP \fIto-addr\fP
-Create an ipporthash set from the specified address range.
-.TP
-\fB\-\-network\fP \fIaddr\fP\fB/\fP\fImask\fP
-Create an ipporthash set from the specified network.
-.TP
-\fB\-\-hashsize\fP \fIhashsize\fP
-The initial hash size (default 1024)
-.TP
-\fB\-\-probes\fP \fIprobes\fP
-How many times try to resolve clashing at adding an IP to the hash 
-by double-hashing (default 8).
-.TP
-\fB\-\-resize\fP \fIpercent\fP
-Increase the hash size by this many percent (default 50) when adding
-an IP to the hash could not be performed after
-\fIprobes\fP
-number of double-hashing.
-.P
-The same resizing, speed and memory efficiency comments applies here 
-as at the iphash type.
-.SS ipportiphash
-The ipportiphash set type uses a hash to store IP address,port and IP
-address triples. The first IP address must come form a maximum /16
-sized network or range while the port number and the second IP address
-parameters are arbitrary. When adding, deleting and testing values in an 
-ipportiphash type of set, the entries must be specified as
-"\fIaddress\fP\fB,\fP\fIport\fP\fB,\fP\fIaddress\fP".
-.P
-The ipportiphash types of sets evaluates three src/dst parameters of the 
-"set"
-match and 
-"SET"
-target. 
-.P
-Options to use when creating an ipportiphash set:
-.TP
-\fB\-\-from\fP \fIfrom-addr\fP
-.TP
-\fB\-\-to\fP \fIto-addr\fP
-Create an ipportiphash set from the specified address range.
-.TP
-\fB\-\-network\fP \fIaddr\fP\fB/\fP\fImask\fP
-Create an ipportiphash set from the specified network.
-.TP
-\fB\-\-hashsize\fP \fIhashsize\fP
-The initial hash size (default 1024)
-.TP
-\fB\-\-probes\fP \fIprobes\fP
-How many times try to resolve clashing at adding an IP to the hash 
-by double-hashing (default 8).
-.TP
-\fB\-\-resize\fP \fIpercent\fP
-Increase the hash size by this many percent (default 50) when adding
-an IP to the hash could not be performed after
-\fIprobes\fP
-number of double-hashing.
-.P
-The same resizing, speed and memory efficiency comments applies here 
-as at the iphash type.
-.SS ipportnethash
-The ipportnethash set type uses a hash to store IP address, port, and
-network address triples. The IP address must come form a maximum /16
-sized network or range while the port number and the network address
-parameters are arbitrary, but the size of the network address must be
-between /1-/31. When adding, deleting 
-and testing values in an ipportnethash type of set, the entries must be
-specified as
-"\fIaddress\fP\fB,\fP\fIport\fP\fB,\fP\fIaddress\fP\fB/\fP\fIprefixlen\fP".
-.P
-The ipportnethash types of sets evaluates three src/dst parameters of the 
-"set"
-match and 
-"SET"
-target. 
-.P
-Options to use when creating an ipportnethash set:
-.TP
-\fB\-\-from\fP \fIfrom-address\fP
-.TP
-\fB\-\-to\fP \fIto-address\fP
-Create an ipporthash set from the specified range.
-.TP
-\fB\-\-network\fP \fIaddress\fP\fB/\fP\fImask\fP
-Create an ipporthash set from the specified network.
-.TP
-\fB\-\-hashsize\fP \fIhashsize\fP
-The initial hash size (default 1024)
-.TP
-\fB\-\-probes\fP \fIprobes\fP
-How many times try to resolve clashing at adding an IP to the hash 
-by double-hashing (default 8).
-.TP
-\fB\-\-resize\fP \fIpercent\fP
-Increase the hash size by this many percent (default 50) when adding
-an IP to the hash could not be performed after
-\fIprobes\fP
-number of double-hashing.
-.P
-The same resizing, speed and memory efficiency comments applies here 
-as at the iphash type.
-.SS iptree
-The iptree set type uses a tree to store IP addresses, optionally 
-with timeout values.
-.P
-Options to use when creating an iptree set:
-.TP
-\fB\-\-timeout\fP \fIvalue\fP
-The timeout value for the entries in seconds (default 0)
-.P
-If a set was created with a nonzero valued 
-\fB\-\-timeout\fP
-parameter then one may add IP addresses to the set with a specific 
-timeout value using the syntax 
-"\fIaddress\fP\fB,\fP\fItimeout-value\fP".
-Similarly to the hash types, the iptree type of sets can store up to 65536
-entries.
-.SS iptreemap
-The iptreemap set type uses a tree to store IP addresses or networks, 
-where the last octet of an IP address are stored in a bitmap.
-As input entry, you can add IP addresses, CIDR blocks or network ranges
-to the set. Network ranges can be specified in the format
-"\fIaddress1\fP\fB-\fP\fIaddress2\fP".
-.P
-Options to use when creating an iptreemap set:
-.TP
-\fB\-\-gc\fP \fIvalue\fP
-How often the garbage collection should be called, in seconds (default 300)
-.SS setlist
-The setlist type uses a simple list in which you can store sets. By the
-ipset
-command you can add, delete and test sets in a setlist type of set.
-You can specify the sets as
-"\fIsetname\fP[\fB,\fP{\fBafter\fP|\fBbefore\fP},\fIsetname\fP]".
-By default new sets are added after (appended to) the existing
-elements. Setlist type of sets cannot be added to a setlist type of set.
-.P
-Options to use when creating a setlist type of set:
-.TP
-\fB\-\-size\fP \fIsize\fP
-Create a setlist type of set with the given size (default 8).
-.PP
-By the
-"set"
-match or
-"SET"
-target of
-\fBiptables\fP(8)
-you can test, add or delete entries in the sets. The match
-will try to find a matching IP address/port in the sets and 
-the target will try to add the IP address/port to the first set
-to which it can be added. The number of src,dst options of
-the match and target are important: sets which eats more src,dst
-parameters than specified are skipped, while sets with equal
-or less parameters are checked, elements added. For example
-if
-.I
-a
-and
-.I
-b
-are setlist type of sets then in the command
-.IP
-iptables \-m set \-\-match\-set a src,dst \-j SET \-\-add-set b src,dst
-.PP
-the match and target will skip any set in
-.I a
-and
-.I b
-which stores 
-data triples, but will check all sets with single or double
-data storage in
-.I a
-set and add src to the first single or src,dst to the first double 
-data storage set in
-\fIb\fP.
-You can imagine a setlist type of set as an ordered union of
-the set elements. 
-.P
-Please note: by the ipset command you can add, delete and
-.B test
-the setnames in a setlist type of set, and not the presence of 
-a set's member (such as an IP address).
-.SH GENERAL RESTRICTIONS
-Setnames starting with colon (:) cannot be defined. Zero valued set 
-entries cannot be used with hash type of sets.
-.SH COMMENTS
-If you want to store same size subnets from a given network
-(say /24 blocks from a /8 network), use the ipmap set type.
-If you want to store random same size networks (say random /24 blocks), 
-use the iphash set type. If you have got random size of netblocks, 
-use nethash.
-.P
-Old separator tokens (':' and '%") are still accepted.
-.P
-Binding support is removed.
-.SH DIAGNOSTICS
-Various error messages are printed to standard error.  The exit code
-is 0 for correct functioning.  Errors which appear to be caused by
-invalid or abused command line parameters cause an exit code of 2, and
-other errors cause an exit code of 1.
-.SH BUGS
-Bugs? No, just funny features. :-)
-OK, just kidding...
-.SH SEE ALSO
-.BR iptables (8),
-.SH AUTHORS
-Jozsef Kadlecsik wrote ipset, which is based on ippool by
-Joakim Axelsson, Patrick Schaaf and Martin Josefsson.
-.P
-Sven Wegener wrote the iptreemap type.
-.SH LAST REMARK
-.BR "I stand on the shoulders of giants."

extensions/ipset/ipset.h

@@ -1,200 +0,0 @@
-#ifndef __IPSET_H
-#define __IPSET_H
-
-/* Copyright 2000-2004 Joakim Axelsson (gozem@linux.nu)
- *                     Patrick Schaaf (bof@bof.de)
- *                     Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
- *
- * This program is free software; you can redistribute it and/or modify   
- * it under the terms of the GNU General Public License as published by   
- * the Free Software Foundation; either version 2 of the License, or      
- * (at your option) any later version.                                    
- *                                                                         
- * This program is distributed in the hope that it will be useful,        
- * but WITHOUT ANY WARRANTY; without even the implied warranty of         
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          
- * GNU General Public License for more details.                           
- *                                                                         
- * You should have received a copy of the GNU General Public License      
- * along with this program; if not, write to the Free Software            
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-#include <getopt.h>			/* struct option */
-#include <stdint.h>
-#include <sys/types.h>
-
-#include "ip_set.h"
-
-#define IPSET_LIB_NAME "/libipset_%s.so"
-#define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe"
-
-#define LIST_TRIES 5
-
-#ifdef IPSET_DEBUG
-extern int option_debug;
-#define DP(format, args...) if (option_debug) 			\
-	do {							\
-		fprintf(stderr, "%s: %s (DBG): ", __FILE__, __FUNCTION__);\
-		fprintf(stderr, format "\n" , ## args);			\
-	} while (0)
-#else
-#define DP(format, args...)
-#endif
-
-/* Commands */
-enum set_commands {
-	CMD_NONE,
-	CMD_CREATE,		/* -N */
-	CMD_DESTROY,		/* -X */
-	CMD_FLUSH,		/* -F */
-	CMD_RENAME,		/* -E */
-	CMD_SWAP,		/* -W */
-	CMD_LIST,		/* -L */
-	CMD_SAVE,		/* -S */
-	CMD_RESTORE,		/* -R */
-	CMD_ADD,		/* -A */
-	CMD_DEL,		/* -D */
-	CMD_TEST,		/* -T */
-	CMD_HELP,		/* -H */
-	CMD_VERSION,		/* -V */
-	NUMBER_OF_CMD = CMD_VERSION,
-	/* Internal commands */
-	CMD_MAX_SETS,
-	CMD_LIST_SIZE,
-	CMD_SAVE_SIZE,
-	CMD_ADT_GET,
-};
-
-enum exittype {
-	OTHER_PROBLEM = 1,
-	PARAMETER_PROBLEM,
-	VERSION_PROBLEM
-};
-
-/* The view of an ipset in userspace */
-struct set {
-	char name[IP_SET_MAXNAMELEN];		/* Name of the set */
-	ip_set_id_t id;				/* Unique set id */
-	ip_set_id_t index;			/* Array index */
-	unsigned ref;				/* References in kernel */
-	struct settype *settype;		/* Pointer to set type functions */
-};
-
-struct settype {
-	struct settype *next;
-
-	char typename[IP_SET_MAXNAMELEN];
-
-	int protocol_version;
-
-	/*
-	 * Create set
-	 */
-
-	/* Size of create data. Will be sent to kernel */
-	u_int32_t create_size;
-
-	/* Initialize the create. */
-	void (*create_init) (void *data);
-
-	/* Function which parses command options; returns true if it ate an option */
-	int (*create_parse) (int c, char *argv[], void *data,
-			     unsigned *flags);
-
-	/* Final check; exit if not ok. */
-	void (*create_final) (void *data, unsigned int flags);
-
-	/* Pointer to list of extra command-line options for create */
-	const struct option *create_opts;
-
-	/*
-	 * Add/del/test IP
-	 */
-
-	/* Size of data. Will be sent to kernel */
-	u_int32_t adt_size;
-
-	/* Function which parses command options */
-	ip_set_ip_t (*adt_parser) (int cmd, const char *optarg, void *data);
-
-	/*
-	 * Printing
-	 */
-
-	/* Size of header. */
-	u_int32_t header_size;
-
-	/* Initialize the type-header */
-	void (*initheader) (struct set *set, const void *data);
-
-	/* Pretty print the type-header */
-	void (*printheader) (struct set *set, unsigned options);
-
-	/* Pretty print all IPs */
-	void (*printips) (struct set *set, void *data, u_int32_t len,
-			  unsigned options, char dont_align);
-
-	/* Pretty print all IPs sorted */
-	void (*printips_sorted) (struct set *set, void *data, u_int32_t len,
-				 unsigned options, char dont_align);
-
-	/* Print save arguments for creating the set */
-	void (*saveheader) (struct set *set, unsigned options);
-
-	/* Print save for all IPs */
-	void (*saveips) (struct set *set, void *data, u_int32_t len,
-			 unsigned options, char dont_align);
-
-	/* Print usage */
-	void (*usage) (void);
-
-	/* Internal data */
-	void *header;
-	void *data;
-	int option_offset;
-	unsigned int flags;
-};
-
-extern void settype_register(struct settype *settype);
-
-/* extern void unregister_settype(set_type_t *set_type); */
-
-extern void exit_error(int status, const char *msg, ...);
-
-extern char *binding_ip_tostring(struct set *set,
-				 ip_set_ip_t ip, unsigned options);
-extern char *ip_tostring(ip_set_ip_t ip, unsigned options);
-extern char *ip_tostring_numeric(ip_set_ip_t ip);
-extern void parse_ip(const char *str, ip_set_ip_t * ip);
-extern void parse_mask(const char *str, ip_set_ip_t * mask);
-extern void parse_ipandmask(const char *str, ip_set_ip_t * ip,
-			    ip_set_ip_t * mask);
-extern char *port_tostring(ip_set_ip_t port, unsigned options);
-extern void parse_port(const char *str, ip_set_ip_t * port);
-extern int string_to_number(const char *str, unsigned int min, unsigned int max,
-		            ip_set_ip_t *port);
-
-extern void *ipset_malloc(size_t size);
-extern char *ipset_strdup(const char *);
-extern void ipset_free(void *data);
-
-extern struct set *set_find_byname(const char *name);
-extern struct set *set_find_byid(ip_set_id_t id);
-
-extern unsigned warn_once;
-
-#define BITS_PER_LONG	(8*sizeof(ip_set_ip_t))
-#define BIT_WORD(nr)	((nr) / BITS_PER_LONG)
-
-static inline int test_bit(int nr, const ip_set_ip_t *addr)
-{
-	return 1 & (addr[BIT_WORD(nr)] >> (nr & (BITS_PER_LONG-1)));
-}
-
-#define UNUSED __attribute__ ((unused))
-#define CONSTRUCTOR(module) \
-void __attribute__ ((constructor)) module##_init(void); \
-void module##_init(void)
-
-#endif	/* __IPSET_H */

extensions/ipset/ipset_iphash.c

@@ -1,279 +0,0 @@
-/* Copyright 2004 Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
- *
- * This program is free software; you can redistribute it and/or modify   
- * it under the terms of the GNU General Public License as published by   
- * the Free Software Foundation; either version 2 of the License, or      
- * (at your option) any later version.                                    
- *                                                                         
- * This program is distributed in the hope that it will be useful,        
- * but WITHOUT ANY WARRANTY; without even the implied warranty of         
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          
- * GNU General Public License for more details.                           
- *                                                                         
- * You should have received a copy of the GNU General Public License      
- * along with this program; if not, write to the Free Software            
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-#include <limits.h>			/* UINT_MAX */
-#include <stdio.h>			/* *printf */
-#include <string.h>			/* mem* */
-
-#include "ipset.h"
-
-#include "ip_set_iphash.h"
-
-#define BUFLEN 30;
-
-#define OPT_CREATE_HASHSIZE	0x01U
-#define OPT_CREATE_PROBES	0x02U
-#define OPT_CREATE_RESIZE	0x04U
-#define OPT_CREATE_NETMASK	0x08U
-
-/* Initialize the create. */
-static void
-iphash_create_init(void *data)
-{
-	struct ip_set_req_iphash_create *mydata = data;
-
-	DP("create INIT");
-
-	/* Default create parameters */	
-	mydata->hashsize = 1024;
-	mydata->probes = 8;
-	mydata->resize = 50;
-	
-	mydata->netmask = 0xFFFFFFFF;
-}
-
-/* Function which parses command options; returns true if it ate an option */
-static int
-iphash_create_parse(int c, char *argv[] UNUSED, void *data, unsigned *flags)
-{
-	struct ip_set_req_iphash_create *mydata =
-	    (struct ip_set_req_iphash_create *) data;
-	unsigned int bits;
-	ip_set_ip_t value;
-
-	DP("create_parse");
-
-	switch (c) {
-	case '1':
-
-		if (string_to_number(optarg, 1, UINT_MAX - 1, &mydata->hashsize))
-			exit_error(PARAMETER_PROBLEM, "Invalid hashsize `%s' specified", optarg);
-
-		*flags |= OPT_CREATE_HASHSIZE;
-
-		DP("--hashsize %u", mydata->hashsize);
-		
-		break;
-
-	case '2':
-
-		if (string_to_number(optarg, 1, 65535, &value))
-			exit_error(PARAMETER_PROBLEM, "Invalid probes `%s' specified", optarg);
-
-		mydata->probes = value;
-		*flags |= OPT_CREATE_PROBES;
-
-		DP("--probes %u", mydata->probes);
-		
-		break;
-
-	case '3':
-
-		if (string_to_number(optarg, 0, 65535, &value))
-			exit_error(PARAMETER_PROBLEM, "Invalid resize `%s' specified", optarg);
-
-		mydata->resize = value;
-		*flags |= OPT_CREATE_RESIZE;
-
-		DP("--resize %u", mydata->resize);
-		
-		break;
-
-	case '4':
-
-		if (string_to_number(optarg, 0, 32, &bits))
-			exit_error(PARAMETER_PROBLEM, 
-				  "Invalid netmask `%s' specified", optarg);
-		
-		if (bits != 0)
-			mydata->netmask = 0xFFFFFFFF << (32 - bits);
-
-		*flags |= OPT_CREATE_NETMASK;
-
-		DP("--netmask %x", mydata->netmask);
-		
-		break;
-
-	default:
-		return 0;
-	}
-
-	return 1;
-}
-
-/* Final check; exit if not ok. */
-static void
-iphash_create_final(void *data UNUSED, unsigned int flags UNUSED)
-{
-}
-
-/* Create commandline options */
-static const struct option create_opts[] = {
-	{.name = "hashsize",	.has_arg = required_argument,	.val = '1'},
-	{.name = "probes",	.has_arg = required_argument,	.val = '2'},
-	{.name = "resize",	.has_arg = required_argument,	.val = '3'},
-	{.name = "netmask",	.has_arg = required_argument,	.val = '4'},
-	{NULL},
-};
-
-/* Add, del, test parser */
-static ip_set_ip_t
-iphash_adt_parser(int cmd UNUSED, const char *arg, void *data)
-{
-	struct ip_set_req_iphash *mydata = data;
-
-	parse_ip(arg, &mydata->ip);
-	if (!mydata->ip)
-		exit_error(PARAMETER_PROBLEM,
-			   "Zero valued IP address `%s' specified", arg);
-
-	return mydata->ip;	
-};
-
-/*
- * Print and save
- */
-
-static void
-iphash_initheader(struct set *set, const void *data)
-{
-	const struct ip_set_req_iphash_create *header = data;
-	struct ip_set_iphash *map = set->settype->header;
-
-	memset(map, 0, sizeof(struct ip_set_iphash));
-	map->hashsize = header->hashsize;
-	map->probes = header->probes;
-	map->resize = header->resize;
-	map->netmask = header->netmask;
-}
-
-static unsigned int
-mask_to_bits(ip_set_ip_t mask)
-{
-	unsigned int bits = 32;
-	ip_set_ip_t maskaddr;
-	
-	if (mask == 0xFFFFFFFF)
-		return bits;
-	
-	maskaddr = 0xFFFFFFFE;
-	while (--bits > 0 && maskaddr != mask)
-		maskaddr <<= 1;
-	
-	return bits;
-}
-
-static void
-iphash_printheader(struct set *set, unsigned options UNUSED)
-{
-	struct ip_set_iphash *mysetdata = set->settype->header;
-
-	printf(" hashsize: %u", mysetdata->hashsize);
-	printf(" probes: %u", mysetdata->probes);
-	printf(" resize: %u", mysetdata->resize);
-	if (mysetdata->netmask == 0xFFFFFFFF)
-		printf("\n");
-	else
-		printf(" netmask: %d\n", mask_to_bits(mysetdata->netmask));
-}
-
-static void
-iphash_printips(struct set *set UNUSED, void *data, u_int32_t len,
-		unsigned options, char dont_align)
-{
-	size_t offset = 0;
-	ip_set_ip_t *ip;
-
-	while (offset < len) {
-		ip = data + offset;
-		printf("%s\n", ip_tostring(*ip, options));
-		offset += IPSET_VALIGN(sizeof(ip_set_ip_t), dont_align);
-	}
-}
-
-static void
-iphash_saveheader(struct set *set, unsigned options UNUSED)
-{
-	struct ip_set_iphash *mysetdata = set->settype->header;
-
-	printf("-N %s %s --hashsize %u --probes %u --resize %u",
-	       set->name, set->settype->typename,
-	       mysetdata->hashsize, mysetdata->probes, mysetdata->resize);
-	if (mysetdata->netmask == 0xFFFFFFFF)
-		printf("\n");
-	else
-		printf(" --netmask %d\n", mask_to_bits(mysetdata->netmask));
-}
-
-/* Print save for an IP */
-static void
-iphash_saveips(struct set *set UNUSED, void *data, u_int32_t len,
-	       unsigned options, char dont_align)
-{
-	size_t offset = 0;
-	ip_set_ip_t *ip;
-
-	while (offset < len) {
-		ip = data + offset;
-		printf("-A %s %s\n", set->name, ip_tostring(*ip, options));
-		offset += IPSET_VALIGN(sizeof(ip_set_ip_t), dont_align);
-	}
-}
-
-static void
-iphash_usage(void)
-{
-	printf
-	    ("-N set iphash [--hashsize hashsize] [--probes probes ]\n"
-	     "              [--resize resize] [--netmask CIDR-netmask]\n"
-	     "-A set IP\n"
-	     "-D set IP\n"
-	     "-T set IP\n");
-}
-
-static struct settype settype_iphash = {
-	.typename = SETTYPE_NAME,
-	.protocol_version = IP_SET_PROTOCOL_VERSION,
-
-	/* Create */
-	.create_size = sizeof(struct ip_set_req_iphash_create),
-	.create_init = iphash_create_init,
-	.create_parse = iphash_create_parse,
-	.create_final = iphash_create_final,
-	.create_opts = create_opts,
-
-	/* Add/del/test */
-	.adt_size = sizeof(struct ip_set_req_iphash),
-	.adt_parser = iphash_adt_parser,
-
-	/* Printing */
-	.header_size = sizeof(struct ip_set_iphash),
-	.initheader = iphash_initheader,
-	.printheader = iphash_printheader,
-	.printips = iphash_printips,
-	.printips_sorted = iphash_printips,
-	.saveheader = iphash_saveheader,
-	.saveips = iphash_saveips,
-	
-	.usage = iphash_usage,
-};
-
-CONSTRUCTOR(iphash)
-{
-	settype_register(&settype_iphash);
-
-}

extensions/ipset/ipset_ipmap.c

@@ -1,376 +0,0 @@
-/* Copyright 2000-2004 Joakim Axelsson (gozem@linux.nu)
- *                     Patrick Schaaf (bof@bof.de)
- *                     Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
- *
- * This program is free software; you can redistribute it and/or modify   
- * it under the terms of the GNU General Public License as published by   
- * the Free Software Foundation; either version 2 of the License, or      
- * (at your option) any later version.                                    
- *                                                                         
- * This program is distributed in the hope that it will be useful,        
- * but WITHOUT ANY WARRANTY; without even the implied warranty of         
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          
- * GNU General Public License for more details.                           
- *                                                                         
- * You should have received a copy of the GNU General Public License      
- * along with this program; if not, write to the Free Software            
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-#include <stdio.h>			/* *printf */
-#include <string.h>			/* mem* */
-
-#include "ipset.h"
-
-#include "ip_set_ipmap.h"
-
-#define BUFLEN 30;
-
-#define OPT_CREATE_FROM    0x01U
-#define OPT_CREATE_TO      0x02U
-#define OPT_CREATE_NETWORK 0x04U
-#define OPT_CREATE_NETMASK 0x08U
-
-#define OPT_ADDDEL_IP      0x01U
-
-/* Initialize the create. */
-static void
-ipmap_create_init(void *data)
-{
-	struct ip_set_req_ipmap_create *mydata = data;
-
-	DP("create INIT");
-	mydata->netmask = 0xFFFFFFFF;
-}
-
-/* Function which parses command options; returns true if it ate an option */
-static int
-ipmap_create_parse(int c, char *argv[] UNUSED, void *data, unsigned *flags)
-{
-	struct ip_set_req_ipmap_create *mydata = data;
-	unsigned int bits;
-
-	DP("create_parse");
-
-	switch (c) {
-	case '1':
-		parse_ip(optarg, &mydata->from);
-
-		*flags |= OPT_CREATE_FROM;
-
-		DP("--from %x (%s)", mydata->from,
-		   ip_tostring_numeric(mydata->from));
-
-		break;
-
-	case '2':
-		parse_ip(optarg, &mydata->to);
-
-		*flags |= OPT_CREATE_TO;
-
-		DP("--to %x (%s)", mydata->to,
-		   ip_tostring_numeric(mydata->to));
-
-		break;
-
-	case '3':
-		parse_ipandmask(optarg, &mydata->from, &mydata->to);
-
-		/* Make to the last of from + mask */
-		if (mydata->to)
-			mydata->to = mydata->from | ~(mydata->to);
-		else {
-			mydata->from = 0x00000000;
-			mydata->to = 0xFFFFFFFF;
-		}
-		*flags |= OPT_CREATE_NETWORK;
-
-		DP("--network from %x (%s)", 
-		   mydata->from, ip_tostring_numeric(mydata->from));
-		DP("--network to %x (%s)", 
-		   mydata->to, ip_tostring_numeric(mydata->to));
-
-		break;
-
-	case '4':
-		if (string_to_number(optarg, 0, 32, &bits))
-			exit_error(PARAMETER_PROBLEM, 
-				  "Invalid netmask `%s' specified", optarg);
-		
-		if (bits != 0)
-			mydata->netmask = 0xFFFFFFFF << (32 - bits);
-
-		*flags |= OPT_CREATE_NETMASK;
-
-		DP("--netmask %x", mydata->netmask);
-		
-		break;
-
-	default:
-		return 0;
-	}
-
-	return 1;
-}
-
-/* Final check; exit if not ok. */
-static void
-ipmap_create_final(void *data, unsigned int flags)
-{
-	struct ip_set_req_ipmap_create *mydata = data;
-	ip_set_ip_t range;
-
-	if (flags == 0)
-		exit_error(PARAMETER_PROBLEM,
-			   "Need to specify --from and --to, or --network\n");
-
-	if (flags & OPT_CREATE_NETWORK) {
-		/* --network */
-		if ((flags & OPT_CREATE_FROM) || (flags & OPT_CREATE_TO))
-			exit_error(PARAMETER_PROBLEM,
-				   "Can't specify --from or --to with --network\n");
-	} else {
-		/* --from --to */
-		if ((flags & OPT_CREATE_FROM) == 0
-		    || (flags & OPT_CREATE_TO) == 0)
-			exit_error(PARAMETER_PROBLEM,
-				   "Need to specify both --from and --to\n");
-	}
-
-	DP("from : %x to: %x diff: %x", 
-	   mydata->from, mydata->to,
-	   mydata->to - mydata->from);
-
-	if (mydata->from > mydata->to)
-		exit_error(PARAMETER_PROBLEM,
-			   "From can't be lower than to.\n");
-
-	if (flags & OPT_CREATE_NETMASK) {
-		unsigned int mask_bits, netmask_bits;
-		ip_set_ip_t mask;
-
-		if ((mydata->from & mydata->netmask) != mydata->from)
-			exit_error(PARAMETER_PROBLEM,
-				   "%s is not a network address according to netmask %d\n",
-				   ip_tostring_numeric(mydata->from),
-				   mask_to_bits(mydata->netmask));
-		
-		mask = range_to_mask(mydata->from, mydata->to, &mask_bits);
-		if (!mask
-		    && (mydata->from || mydata->to != 0xFFFFFFFF)) {
-			exit_error(PARAMETER_PROBLEM,
-				   "You have to define a full network with --from"
-				   " and --to if you specify the --network option\n");
-		}
-		netmask_bits = mask_to_bits(mydata->netmask);
-		if (netmask_bits <= mask_bits) {
-			exit_error(PARAMETER_PROBLEM,
-				   "%d netmask specifies larger or equal netblock than the network itself\n");
-		}
-		range = (1<<(netmask_bits - mask_bits)) - 1;
-	} else {
-		range = mydata->to - mydata->from;
-	}
-	if (range > MAX_RANGE)
-		exit_error(PARAMETER_PROBLEM,
-			   "Range too large. Max is %d IPs in range\n",
-			   MAX_RANGE+1);
-}
-
-/* Create commandline options */
-static const struct option create_opts[] = {
-	{.name = "from",	.has_arg = required_argument,	.val = '1'},
-	{.name = "to",		.has_arg = required_argument,	.val = '2'},
-	{.name = "network",	.has_arg = required_argument,	.val = '3'},
-	{.name = "netmask",	.has_arg = required_argument,	.val = '4'},
-	{NULL},
-};
-
-/* Add, del, test parser */
-static ip_set_ip_t
-ipmap_adt_parser(int cmd UNUSED, const char *arg, void *data)
-{
-	struct ip_set_req_ipmap *mydata = data;
-
-	DP("ipmap: %p %p", arg, data);
-
-	parse_ip(arg, &mydata->ip);
-	DP("%s", ip_tostring_numeric(mydata->ip));
-
-	return 1;	
-}
-
-/*
- * Print and save
- */
-
-static void
-ipmap_initheader(struct set *set, const void *data)
-{
-	const struct ip_set_req_ipmap_create *header = data;
-	struct ip_set_ipmap *map = set->settype->header;
-		
-	memset(map, 0, sizeof(struct ip_set_ipmap));
-	map->first_ip = header->from;
-	map->last_ip = header->to;
-	map->netmask = header->netmask;
-
-	if (map->netmask == 0xFFFFFFFF) {
-		map->hosts = 1;
-		map->sizeid = map->last_ip - map->first_ip + 1;
-	} else {
-		unsigned int mask_bits, netmask_bits;
-		ip_set_ip_t mask;
-	
-		mask = range_to_mask(header->from, header->to, &mask_bits);
-		netmask_bits = mask_to_bits(header->netmask);
-
-		DP("bits: %d %d", mask_bits, netmask_bits);
-		map->hosts = 2 << (32 - netmask_bits - 1);
-		map->sizeid = 2 << (netmask_bits - mask_bits - 1);
-	}
-
-	DP("%d %d", map->hosts, map->sizeid );
-}
-
-static void
-ipmap_printheader(struct set *set, unsigned options)
-{
-	struct ip_set_ipmap *mysetdata = set->settype->header;
-
-	printf(" from: %s", ip_tostring(mysetdata->first_ip, options));
-	printf(" to: %s", ip_tostring(mysetdata->last_ip, options));
-	if (mysetdata->netmask == 0xFFFFFFFF)
-		printf("\n");
-	else
-		printf(" netmask: %d\n", mask_to_bits(mysetdata->netmask));
-}
-
-static inline void
-__ipmap_printips_sorted(struct set *set, void *data,
-			u_int32_t len UNUSED, unsigned options)
-{
-	struct ip_set_ipmap *mysetdata = set->settype->header;
-	ip_set_ip_t id;
-
-	for (id = 0; id < mysetdata->sizeid; id++)
-		if (test_bit(id, data))
-			printf("%s\n",
-			       ip_tostring(mysetdata->first_ip
-			       		   + id * mysetdata->hosts,
-					   options));
-}
-
-static void
-ipmap_printips_sorted(struct set *set, void *data,
-		      u_int32_t len, unsigned options,
-		      char dont_align)
-{
-	ip_set_ip_t *ip;
-	size_t offset = 0;
-	
-	if (dont_align)
-		return __ipmap_printips_sorted(set, data, len, options);
-	
-	while (offset < len) {
-		DP("offset: %zu, len %u\n", offset, len);
-		ip = data + offset;
-		printf("%s\n", ip_tostring(*ip, options));
-		offset += IPSET_ALIGN(sizeof(ip_set_ip_t));
-	}
-}
-
-static void
-ipmap_saveheader(struct set *set, unsigned options)
-{
-	struct ip_set_ipmap *mysetdata = set->settype->header;
-
-	printf("-N %s %s --from %s",
-	       set->name, set->settype->typename,
-	       ip_tostring(mysetdata->first_ip, options));
-	printf(" --to %s",
-	       ip_tostring(mysetdata->last_ip, options));
-	if (mysetdata->netmask == 0xFFFFFFFF)
-		printf("\n");
-	else
-		printf(" --netmask %d\n",
-		       mask_to_bits(mysetdata->netmask));
-}
-
-static inline void
-__ipmap_saveips(struct set *set, void *data, u_int32_t len UNUSED,
-		unsigned options)
-{
-	struct ip_set_ipmap *mysetdata = set->settype->header;
-	ip_set_ip_t id;
-
-	DP("%s", set->name);
-	for (id = 0; id < mysetdata->sizeid; id++)
-		if (test_bit(id, data))
-			printf("-A %s %s\n",
-			       set->name,
-			       ip_tostring(mysetdata->first_ip 
-			       		   + id * mysetdata->hosts,
-					   options));
-}
-
-static void
-ipmap_saveips(struct set *set, void *data, u_int32_t len,
-	      unsigned options, char dont_align)
-{
-	ip_set_ip_t *ip;
-	size_t offset = 0;
-	
-	if (dont_align)
-		return __ipmap_saveips(set, data, len, options);
-	
-	while (offset < len) {
-		ip = data + offset;
-		printf("-A %s %s\n", set->name, ip_tostring(*ip, options));
-		offset += IPSET_ALIGN(sizeof(ip_set_ip_t));
-	}
-}
-
-static void
-ipmap_usage(void)
-{
-	printf
-	    ("-N set ipmap --from IP --to IP [--netmask CIDR-netmask]\n"
-	     "-N set ipmap --network IP/mask [--netmask CIDR-netmask]\n"
-	     "-A set IP\n"
-	     "-D set IP\n"
-	     "-T set IP\n");
-}
-
-static struct settype settype_ipmap = {
-	.typename = SETTYPE_NAME,
-	.protocol_version = IP_SET_PROTOCOL_VERSION,
-
-	/* Create */
-	.create_size = sizeof(struct ip_set_req_ipmap_create),
-	.create_init = ipmap_create_init,
-	.create_parse = ipmap_create_parse,
-	.create_final = ipmap_create_final,
-	.create_opts = create_opts,
-
-	/* Add/del/test */
-	.adt_size = sizeof(struct ip_set_req_ipmap),
-	.adt_parser = ipmap_adt_parser,
-
-	/* Printing */
-	.header_size = sizeof(struct ip_set_ipmap),
-	.initheader = ipmap_initheader,
-	.printheader = ipmap_printheader,
-	.printips = ipmap_printips_sorted,
-	.printips_sorted = ipmap_printips_sorted,
-	.saveheader = ipmap_saveheader,
-	.saveips = ipmap_saveips,
-	
-	.usage = ipmap_usage,
-};
-
-CONSTRUCTOR(ipmap)
-{
-	settype_register(&settype_ipmap);
-
-}

extensions/ipset/ipset_ipporthash.c

@@ -1,350 +0,0 @@
-/* Copyright 2004 Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
- *
- * This program is free software; you can redistribute it and/or modify   
- * it under the terms of the GNU General Public License as published by   
- * the Free Software Foundation; either version 2 of the License, or      
- * (at your option) any later version.                                    
- *                                                                         
- * This program is distributed in the hope that it will be useful,        
- * but WITHOUT ANY WARRANTY; without even the implied warranty of         
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          
- * GNU General Public License for more details.                           
- *                                                                         
- * You should have received a copy of the GNU General Public License      
- * along with this program; if not, write to the Free Software            
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-#include <limits.h>			/* UINT_MAX */
-#include <stdio.h>			/* *printf */
-#include <string.h>			/* mem*, str* */
-
-#include "ipset.h"
-
-#include "ip_set_ipporthash.h"
-
-#define OPT_CREATE_HASHSIZE	0x01U
-#define OPT_CREATE_PROBES	0x02U
-#define OPT_CREATE_RESIZE	0x04U
-#define OPT_CREATE_NETWORK	0x08U
-#define OPT_CREATE_FROM		0x10U
-#define OPT_CREATE_TO		0x20U
-
-/* Initialize the create. */
-static void
-ipporthash_create_init(void *data)
-{
-	struct ip_set_req_ipporthash_create *mydata = data;
-
-	DP("create INIT");
-
-	/* Default create parameters */	
-	mydata->hashsize = 1024;
-	mydata->probes = 8;
-	mydata->resize = 50;
-}
-
-/* Function which parses command options; returns true if it ate an option */
-static int
-ipporthash_create_parse(int c, char *argv[] UNUSED, void *data,
-			unsigned *flags)
-{
-	struct ip_set_req_ipporthash_create *mydata = data;
-	ip_set_ip_t value;
-
-	DP("create_parse");
-
-	switch (c) {
-	case '1':
-
-		if (string_to_number(optarg, 1, UINT_MAX - 1, &mydata->hashsize))
-			exit_error(PARAMETER_PROBLEM, "Invalid hashsize `%s' specified", optarg);
-
-		*flags |= OPT_CREATE_HASHSIZE;
-
-		DP("--hashsize %u", mydata->hashsize);
-		
-		break;
-
-	case '2':
-
-		if (string_to_number(optarg, 1, 65535, &value))
-			exit_error(PARAMETER_PROBLEM, "Invalid probes `%s' specified", optarg);
-
-		mydata->probes = value;
-		*flags |= OPT_CREATE_PROBES;
-
-		DP("--probes %u", mydata->probes);
-		
-		break;
-
-	case '3':
-
-		if (string_to_number(optarg, 0, 65535, &value))
-			exit_error(PARAMETER_PROBLEM, "Invalid resize `%s' specified", optarg);
-
-		mydata->resize = value;
-		*flags |= OPT_CREATE_RESIZE;
-
-		DP("--resize %u", mydata->resize);
-		
-		break;
-
-	case '4':
-		parse_ip(optarg, &mydata->from);
-
-		*flags |= OPT_CREATE_FROM;
-
-		DP("--from %x (%s)", mydata->from,
-		   ip_tostring_numeric(mydata->from));
-
-		break;
-
-	case '5':
-		parse_ip(optarg, &mydata->to);
-
-		*flags |= OPT_CREATE_TO;
-
-		DP("--to %x (%s)", mydata->to,
-		   ip_tostring_numeric(mydata->to));
-
-		break;
-
-	case '6':
-		parse_ipandmask(optarg, &mydata->from, &mydata->to);
-
-		/* Make to the last of from + mask */
-		if (mydata->to)
-			mydata->to = mydata->from | ~(mydata->to);
-		else {
-			mydata->from = 0x00000000;
-			mydata->to = 0xFFFFFFFF;
-		}
-		*flags |= OPT_CREATE_NETWORK;
-
-		DP("--network from %x (%s)", 
-		   mydata->from, ip_tostring_numeric(mydata->from));
-		DP("--network to %x (%s)", 
-		   mydata->to, ip_tostring_numeric(mydata->to));
-
-		break;
-
-	default:
-		return 0;
-	}
-
-	return 1;
-}
-
-/* Final check; exit if not ok. */
-static void
-ipporthash_create_final(void *data, unsigned int flags)
-{
-	struct ip_set_req_ipporthash_create *mydata = data;
-
-#ifdef IPSET_DEBUG
-	DP("hashsize %u probes %u resize %u",
-	   mydata->hashsize, mydata->probes, mydata->resize);
-#endif
-
-	if (flags & OPT_CREATE_NETWORK) {
-		/* --network */
-		if ((flags & OPT_CREATE_FROM) || (flags & OPT_CREATE_TO))
-			exit_error(PARAMETER_PROBLEM,
-				   "Can't specify --from or --to with --network\n");
-	} else if (flags & (OPT_CREATE_FROM | OPT_CREATE_TO)) {
-		/* --from --to */
-		if (!(flags & OPT_CREATE_FROM) || !(flags & OPT_CREATE_TO))
-			exit_error(PARAMETER_PROBLEM,
-				   "Need to specify both --from and --to\n");
-	} else {
-		exit_error(PARAMETER_PROBLEM,
-			   "Need to specify --from and --to, or --network\n");
-
-	}
-
-	DP("from : %x to: %x diff: %x", 
-	   mydata->from, mydata->to,
-	   mydata->to - mydata->from);
-
-	if (mydata->from > mydata->to)
-		exit_error(PARAMETER_PROBLEM,
-			   "From can't be higher than to.\n");
-
-	if (mydata->to - mydata->from > MAX_RANGE)
-		exit_error(PARAMETER_PROBLEM,
-			   "Range too large. Max is %d IPs in range\n",
-			   MAX_RANGE+1);
-}
-
-/* Create commandline options */
-static const struct option create_opts[] = {
-	{.name = "hashsize",	.has_arg = required_argument,	.val = '1'},
-	{.name = "probes",	.has_arg = required_argument,	.val = '2'},
-	{.name = "resize",	.has_arg = required_argument,	.val = '3'},
-	{.name = "from",	.has_arg = required_argument,	.val = '4'},
-	{.name = "to",		.has_arg = required_argument,	.val = '5'},
-	{.name = "network",	.has_arg = required_argument,	.val = '6'},
-	{NULL},
-};
-
-/* Add, del, test parser */
-static ip_set_ip_t
-ipporthash_adt_parser(int cmd UNUSED, const char *arg, void *data)
-{
-	struct ip_set_req_ipporthash *mydata = data;
-	char *saved = ipset_strdup(arg);
-	char *ptr, *tmp = saved;
-
-	DP("ipporthash: %p %p", arg, data);
-
-	if (((ptr = strchr(tmp, ':')) || (ptr = strchr(tmp, '%'))) && ++warn_once == 1)
-		fprintf(stderr, "Warning: please use ',' separator token between ip,port.\n"
-			        "Next release won't support old separator tokens.\n");
-
-	ptr = strsep(&tmp, ":%,");
-	parse_ip(ptr, &mydata->ip);
-
-	if (tmp)
-		parse_port(tmp, &mydata->port);
-	else
-		exit_error(PARAMETER_PROBLEM,
-			   "IP address and port must be specified: ip,port");
-
-	if (!(mydata->ip || mydata->port))
-		exit_error(PARAMETER_PROBLEM,
-			  "Zero valued IP address and port `%s' specified", arg);
-	ipset_free(saved);
-	return 1;	
-};
-
-/*
- * Print and save
- */
-
-static void
-ipporthash_initheader(struct set *set, const void *data)
-{
-	const struct ip_set_req_ipporthash_create *header = data;
-	struct ip_set_ipporthash *map = set->settype->header;
-
-	memset(map, 0, sizeof(struct ip_set_ipporthash));
-	map->hashsize = header->hashsize;
-	map->probes = header->probes;
-	map->resize = header->resize;
-	map->first_ip = header->from;
-	map->last_ip = header->to;
-}
-
-static void
-ipporthash_printheader(struct set *set, unsigned options)
-{
-	struct ip_set_ipporthash *mysetdata = set->settype->header;
-
-	printf(" from: %s", ip_tostring(mysetdata->first_ip, options));
-	printf(" to: %s", ip_tostring(mysetdata->last_ip, options));
-	printf(" hashsize: %u", mysetdata->hashsize);
-	printf(" probes: %u", mysetdata->probes);
-	printf(" resize: %u\n", mysetdata->resize);
-}
-
-static void
-ipporthash_printips(struct set *set, void *data, u_int32_t len,
-		    unsigned options, char dont_align)
-{
-	struct ip_set_ipporthash *mysetdata = set->settype->header;
-	size_t offset = 0;
-	ip_set_ip_t *ipptr, ip;
-	uint16_t port;
-
-	while (offset < len) {
-		ipptr = data + offset;
-		ip = (*ipptr>>16) + mysetdata->first_ip;
-		port = (uint16_t) *ipptr;
-		printf("%s,%s\n", 
-		       ip_tostring(ip, options),
-		       port_tostring(port, options));
-		offset += IPSET_VALIGN(sizeof(ip_set_ip_t), dont_align);
-	}
-}
-
-static void
-ipporthash_saveheader(struct set *set, unsigned options)
-{
-	struct ip_set_ipporthash *mysetdata = set->settype->header;
-
-	printf("-N %s %s --from %s",
-	       set->name, set->settype->typename,
-	       ip_tostring(mysetdata->first_ip, options));
-	printf(" --to %s",
-	       ip_tostring(mysetdata->last_ip, options));
-	printf(" --hashsize %u --probes %u --resize %u\n",
-	       mysetdata->hashsize, mysetdata->probes, mysetdata->resize);
-}
-
-/* Print save for an IP */
-static void
-ipporthash_saveips(struct set *set, void *data, u_int32_t len,
-		   unsigned options, char dont_align)
-{
-	struct ip_set_ipporthash *mysetdata = set->settype->header;
-	size_t offset = 0;
-	ip_set_ip_t *ipptr, ip;
-	uint16_t port;
-
-	while (offset < len) {
-		ipptr = data + offset;
-		ip = (*ipptr>>16) + mysetdata->first_ip;
-		port = (uint16_t) *ipptr;
-		printf("-A %s %s,%s\n", set->name, 
-		       ip_tostring(ip, options),
-		       port_tostring(port, options));
-		offset += IPSET_VALIGN(sizeof(ip_set_ip_t), dont_align);
-	}
-}
-
-static void
-ipporthash_usage(void)
-{
-	printf
-	    ("-N set ipporthash --from IP --to IP\n"
-	     "   [--hashsize hashsize] [--probes probes ] [--resize resize]\n"
-	     "-N set ipporthash --network IP/mask\n"
-	     "   [--hashsize hashsize] [--probes probes ] [--resize resize]\n"
-	     "-A set IP,port\n"
-	     "-D set IP,port\n"
-	     "-T set IP,port\n");
-}
-
-static struct settype settype_ipporthash = {
-	.typename = SETTYPE_NAME,
-	.protocol_version = IP_SET_PROTOCOL_VERSION,
-
-	/* Create */
-	.create_size = sizeof(struct ip_set_req_ipporthash_create),
-	.create_init = ipporthash_create_init,
-	.create_parse = ipporthash_create_parse,
-	.create_final = ipporthash_create_final,
-	.create_opts = create_opts,
-
-	/* Add/del/test */
-	.adt_size = sizeof(struct ip_set_req_ipporthash),
-	.adt_parser = ipporthash_adt_parser,
-
-	/* Printing */
-	.header_size = sizeof(struct ip_set_ipporthash),
-	.initheader = ipporthash_initheader,
-	.printheader = ipporthash_printheader,
-	.printips = ipporthash_printips,
-	.printips_sorted = ipporthash_printips,
-	.saveheader = ipporthash_saveheader,
-	.saveips = ipporthash_saveips,
-	
-	.usage = ipporthash_usage,
-};
-
-CONSTRUCTOR(ipporthash)
-{
-	settype_register(&settype_ipporthash);
-
-}

extensions/ipset/ipset_ipportiphash.c

@@ -1,361 +0,0 @@
-/* Copyright 2008 Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
- *
- * This program is free software; you can redistribute it and/or modify   
- * it under the terms of the GNU General Public License as published by   
- * the Free Software Foundation; either version 2 of the License, or      
- * (at your option) any later version.                                    
- *                                                                         
- * This program is distributed in the hope that it will be useful,        
- * but WITHOUT ANY WARRANTY; without even the implied warranty of         
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          
- * GNU General Public License for more details.                           
- *                                                                         
- * You should have received a copy of the GNU General Public License      
- * along with this program; if not, write to the Free Software            
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-#include <limits.h>			/* UINT_MAX */
-#include <stdio.h>			/* *printf */
-#include <string.h>			/* mem*, str* */
-
-#include "ipset.h"
-
-#include "ip_set_ipportiphash.h"
-
-#define OPT_CREATE_HASHSIZE	0x01U
-#define OPT_CREATE_PROBES	0x02U
-#define OPT_CREATE_RESIZE	0x04U
-#define OPT_CREATE_NETWORK	0x08U
-#define OPT_CREATE_FROM		0x10U
-#define OPT_CREATE_TO		0x20U
-
-/* Initialize the create. */
-static void
-ipportiphash_create_init(void *data)
-{
-	struct ip_set_req_ipportiphash_create *mydata = data;
-
-	DP("create INIT");
-
-	/* Default create parameters */	
-	mydata->hashsize = 1024;
-	mydata->probes = 8;
-	mydata->resize = 50;
-}
-
-/* Function which parses command options; returns true if it ate an option */
-static int
-ipportiphash_create_parse(int c, char *argv[] UNUSED, void *data,
-			  unsigned *flags)
-{
-	struct ip_set_req_ipportiphash_create *mydata = data;
-	ip_set_ip_t value;
-
-	DP("create_parse");
-
-	switch (c) {
-	case '1':
-
-		if (string_to_number(optarg, 1, UINT_MAX - 1, &mydata->hashsize))
-			exit_error(PARAMETER_PROBLEM, "Invalid hashsize `%s' specified", optarg);
-
-		*flags |= OPT_CREATE_HASHSIZE;
-
-		DP("--hashsize %u", mydata->hashsize);
-		
-		break;
-
-	case '2':
-
-		if (string_to_number(optarg, 1, 65535, &value))
-			exit_error(PARAMETER_PROBLEM, "Invalid probes `%s' specified", optarg);
-
-		mydata->probes = value;
-		*flags |= OPT_CREATE_PROBES;
-
-		DP("--probes %u", mydata->probes);
-		
-		break;
-
-	case '3':
-
-		if (string_to_number(optarg, 0, 65535, &value))
-			exit_error(PARAMETER_PROBLEM, "Invalid resize `%s' specified", optarg);
-
-		mydata->resize = value;
-		*flags |= OPT_CREATE_RESIZE;
-
-		DP("--resize %u", mydata->resize);
-		
-		break;
-
-	case '4':
-		parse_ip(optarg, &mydata->from);
-
-		*flags |= OPT_CREATE_FROM;
-
-		DP("--from %x (%s)", mydata->from,
-		   ip_tostring_numeric(mydata->from));
-
-		break;
-
-	case '5':
-		parse_ip(optarg, &mydata->to);
-
-		*flags |= OPT_CREATE_TO;
-
-		DP("--to %x (%s)", mydata->to,
-		   ip_tostring_numeric(mydata->to));
-
-		break;
-
-	case '6':
-		parse_ipandmask(optarg, &mydata->from, &mydata->to);
-
-		/* Make to the last of from + mask */
-		if (mydata->to)
-			mydata->to = mydata->from | ~(mydata->to);
-		else {
-			mydata->from = 0x00000000;
-			mydata->to = 0xFFFFFFFF;
-		}
-		*flags |= OPT_CREATE_NETWORK;
-
-		DP("--network from %x (%s)", 
-		   mydata->from, ip_tostring_numeric(mydata->from));
-		DP("--network to %x (%s)", 
-		   mydata->to, ip_tostring_numeric(mydata->to));
-
-		break;
-
-	default:
-		return 0;
-	}
-
-	return 1;
-}
-
-/* Final check; exit if not ok. */
-static void
-ipportiphash_create_final(void *data, unsigned int flags)
-{
-	struct ip_set_req_ipportiphash_create *mydata = data;
-
-#ifdef IPSET_DEBUG
-	DP("hashsize %u probes %u resize %u",
-	   mydata->hashsize, mydata->probes, mydata->resize);
-#endif
-
-	if (flags & OPT_CREATE_NETWORK) {
-		/* --network */
-		if ((flags & OPT_CREATE_FROM) || (flags & OPT_CREATE_TO))
-			exit_error(PARAMETER_PROBLEM,
-				   "Can't specify --from or --to with --network\n");
-	} else if (flags & (OPT_CREATE_FROM | OPT_CREATE_TO)) {
-		/* --from --to */
-		if (!(flags & OPT_CREATE_FROM) || !(flags & OPT_CREATE_TO))
-			exit_error(PARAMETER_PROBLEM,
-				   "Need to specify both --from and --to\n");
-	} else {
-		exit_error(PARAMETER_PROBLEM,
-			   "Need to specify --from and --to, or --network\n");
-
-	}
-
-	DP("from : %x to: %x diff: %x", 
-	   mydata->from, mydata->to,
-	   mydata->to - mydata->from);
-
-	if (mydata->from > mydata->to)
-		exit_error(PARAMETER_PROBLEM,
-			   "From can't be higher than to.\n");
-
-	if (mydata->to - mydata->from > MAX_RANGE)
-		exit_error(PARAMETER_PROBLEM,
-			   "Range too large. Max is %d IPs in range\n",
-			   MAX_RANGE+1);
-}
-
-/* Create commandline options */
-static const struct option create_opts[] = {
-	{.name = "hashsize",	.has_arg = required_argument,	.val = '1'},
-	{.name = "probes",	.has_arg = required_argument,	.val = '2'},
-	{.name = "resize",	.has_arg = required_argument,	.val = '3'},
-	{.name = "from",	.has_arg = required_argument,	.val = '4'},
-	{.name = "to",		.has_arg = required_argument,	.val = '5'},
-	{.name = "network",	.has_arg = required_argument,	.val = '6'},
-	{NULL},
-};
-
-/* Add, del, test parser */
-static ip_set_ip_t
-ipportiphash_adt_parser(int cmd UNUSED, const char *arg, void *data)
-{
-	struct ip_set_req_ipportiphash *mydata = data;
-	char *saved = ipset_strdup(arg);
-	char *ptr, *tmp = saved;
-
-	DP("ipportiphash: %p %p", arg, data);
-
-	if (((ptr = strchr(tmp, ':')) || (ptr = strchr(tmp, '%'))) && ++warn_once == 1)
-		fprintf(stderr, "Warning: please use ',' separator token between ip,port,ip.\n"
-			        "Next release won't support old separator tokens.\n");
-
-	ptr = strsep(&tmp, ":%,");
-	parse_ip(ptr, &mydata->ip);
-
-	if (!tmp)
-		exit_error(PARAMETER_PROBLEM,
-			   "IP address, port and IP address must be specified: ip,port,ip");
-
-	ptr = strsep(&tmp, ":%,");
-	parse_port(ptr, &mydata->port);
-	if (tmp)
-		parse_ip(tmp, &mydata->ip1);
-	else
-		exit_error(PARAMETER_PROBLEM,
-			   "IP address, port and IP address must be specified: ip,port,ip");
-	if (!(mydata->ip || mydata->port || mydata->ip1))
-		exit_error(PARAMETER_PROBLEM,
-			  "Zero valued IP address, port and IP address `%s' specified", arg);
-	ipset_free(saved);
-	return 1;	
-};
-
-/*
- * Print and save
- */
-
-static void
-ipportiphash_initheader(struct set *set, const void *data)
-{
-	const struct ip_set_req_ipportiphash_create *header = data;
-	struct ip_set_ipportiphash *map = set->settype->header;
-
-	memset(map, 0, sizeof(struct ip_set_ipportiphash));
-	map->hashsize = header->hashsize;
-	map->probes = header->probes;
-	map->resize = header->resize;
-	map->first_ip = header->from;
-	map->last_ip = header->to;
-}
-
-static void
-ipportiphash_printheader(struct set *set, unsigned options)
-{
-	struct ip_set_ipportiphash *mysetdata = set->settype->header;
-
-	printf(" from: %s", ip_tostring(mysetdata->first_ip, options));
-	printf(" to: %s", ip_tostring(mysetdata->last_ip, options));
-	printf(" hashsize: %u", mysetdata->hashsize);
-	printf(" probes: %u", mysetdata->probes);
-	printf(" resize: %u\n", mysetdata->resize);
-}
-
-static void
-ipportiphash_printips(struct set *set, void *data, u_int32_t len,
-		      unsigned options, char dont_align)
-{
-	struct ip_set_ipportiphash *mysetdata = set->settype->header;
-	size_t offset = 0;
-	struct ipportip *ipptr;
-	ip_set_ip_t ip;
-	uint16_t port;
-
-	while (offset < len) {
-		ipptr = data + offset;
-		ip = (ipptr->ip>>16) + mysetdata->first_ip;
-		port = (uint16_t) ipptr->ip;
-		printf("%s,%s,", 
-		       ip_tostring(ip, options),
-		       port_tostring(port, options));
-		printf("%s\n", 
-		       ip_tostring(ipptr->ip1, options));
-		offset += IPSET_VALIGN(sizeof(struct ipportip), dont_align);
-	}
-}
-
-static void
-ipportiphash_saveheader(struct set *set, unsigned options)
-{
-	struct ip_set_ipportiphash *mysetdata = set->settype->header;
-
-	printf("-N %s %s --from %s",
-	       set->name, set->settype->typename,
-	       ip_tostring(mysetdata->first_ip, options));
-	printf(" --to %s",
-	       ip_tostring(mysetdata->last_ip, options));
-	printf(" --hashsize %u --probes %u --resize %u\n",
-	       mysetdata->hashsize, mysetdata->probes, mysetdata->resize);
-}
-
-/* Print save for an IP */
-static void
-ipportiphash_saveips(struct set *set, void *data, u_int32_t len,
-		     unsigned options, char dont_align)
-{
-	struct ip_set_ipportiphash *mysetdata = set->settype->header;
-	size_t offset = 0;
-	struct ipportip *ipptr;
-	ip_set_ip_t ip;
-	uint16_t port;
-
-	while (offset < len) {
-		ipptr = data + offset;
-		ip = (ipptr->ip>>16) + mysetdata->first_ip;
-		port = (uint16_t) ipptr->ip;
-		printf("-A %s %s,%s,", set->name, 
-		       ip_tostring(ip, options),
-		       port_tostring(port, options));
-		printf("%s\n",
-		       ip_tostring(ipptr->ip1, options));
-		offset += IPSET_VALIGN(sizeof(struct ipportip), dont_align);
-	}
-}
-
-static void
-ipportiphash_usage(void)
-{
-	printf
-	    ("-N set ipportiphash --from IP --to IP\n"
-	     "   [--hashsize hashsize] [--probes probes ] [--resize resize]\n"
-	     "-N set ipportiphash --network IP/mask\n"
-	     "   [--hashsize hashsize] [--probes probes ] [--resize resize]\n"
-	     "-A set IP,port,IP\n"
-	     "-D set IP,port,IP\n"
-	     "-T set IP,port,IP\n");
-}
-
-static struct settype settype_ipportiphash = {
-	.typename = SETTYPE_NAME,
-	.protocol_version = IP_SET_PROTOCOL_VERSION,
-
-	/* Create */
-	.create_size = sizeof(struct ip_set_req_ipportiphash_create),
-	.create_init = ipportiphash_create_init,
-	.create_parse = ipportiphash_create_parse,
-	.create_final = ipportiphash_create_final,
-	.create_opts = create_opts,
-
-	/* Add/del/test */
-	.adt_size = sizeof(struct ip_set_req_ipportiphash),
-	.adt_parser = ipportiphash_adt_parser,
-
-	/* Printing */
-	.header_size = sizeof(struct ip_set_ipportiphash),
-	.initheader = ipportiphash_initheader,
-	.printheader = ipportiphash_printheader,
-	.printips = ipportiphash_printips,
-	.printips_sorted = ipportiphash_printips,
-	.saveheader = ipportiphash_saveheader,
-	.saveips = ipportiphash_saveips,
-	
-	.usage = ipportiphash_usage,
-};
-
-CONSTRUCTOR(ipportiphash)
-{
-	settype_register(&settype_ipportiphash);
-
-}

extensions/ipset/ipset_ipportnethash.c

@@ -1,426 +0,0 @@
-/* Copyright 2008 Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
- *
- * This program is free software; you can redistribute it and/or modify   
- * it under the terms of the GNU General Public License as published by   
- * the Free Software Foundation; either version 2 of the License, or      
- * (at your option) any later version.                                    
- *                                                                         
- * This program is distributed in the hope that it will be useful,        
- * but WITHOUT ANY WARRANTY; without even the implied warranty of         
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          
- * GNU General Public License for more details.                           
- *                                                                         
- * You should have received a copy of the GNU General Public License      
- * along with this program; if not, write to the Free Software            
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-#include <limits.h>			/* UINT_MAX */
-#include <stdio.h>			/* *printf */
-#include <string.h>			/* mem*, str* */
-
-#include "ipset.h"
-
-#include "ip_set_ipportnethash.h"
-
-#define OPT_CREATE_HASHSIZE	0x01U
-#define OPT_CREATE_PROBES	0x02U
-#define OPT_CREATE_RESIZE	0x04U
-#define OPT_CREATE_NETWORK	0x08U
-#define OPT_CREATE_FROM		0x10U
-#define OPT_CREATE_TO		0x20U
-
-/* Initialize the create. */
-static void
-ipportnethash_create_init(void *data)
-{
-	struct ip_set_req_ipportnethash_create *mydata = data;
-
-	DP("create INIT");
-
-	/* Default create parameters */	
-	mydata->hashsize = 1024;
-	mydata->probes = 8;
-	mydata->resize = 50;
-}
-
-/* Function which parses command options; returns true if it ate an option */
-static int
-ipportnethash_create_parse(int c, char *argv[] UNUSED, void *data,
-			   unsigned *flags)
-{
-	struct ip_set_req_ipportnethash_create *mydata = data;
-	ip_set_ip_t value;
-
-	DP("create_parse");
-
-	switch (c) {
-	case '1':
-
-		if (string_to_number(optarg, 1, UINT_MAX - 1, &mydata->hashsize))
-			exit_error(PARAMETER_PROBLEM, "Invalid hashsize `%s' specified", optarg);
-
-		*flags |= OPT_CREATE_HASHSIZE;
-
-		DP("--hashsize %u", mydata->hashsize);
-		
-		break;
-
-	case '2':
-
-		if (string_to_number(optarg, 1, 65535, &value))
-			exit_error(PARAMETER_PROBLEM, "Invalid probes `%s' specified", optarg);
-
-		mydata->probes = value;
-		*flags |= OPT_CREATE_PROBES;
-
-		DP("--probes %u", mydata->probes);
-		
-		break;
-
-	case '3':
-
-		if (string_to_number(optarg, 0, 65535, &value))
-			exit_error(PARAMETER_PROBLEM, "Invalid resize `%s' specified", optarg);
-
-		mydata->resize = value;
-		*flags |= OPT_CREATE_RESIZE;
-
-		DP("--resize %u", mydata->resize);
-		
-		break;
-
-	case '4':
-		parse_ip(optarg, &mydata->from);
-
-		*flags |= OPT_CREATE_FROM;
-
-		DP("--from %x (%s)", mydata->from,
-		   ip_tostring_numeric(mydata->from));
-
-		break;
-
-	case '5':
-		parse_ip(optarg, &mydata->to);
-
-		*flags |= OPT_CREATE_TO;
-
-		DP("--to %x (%s)", mydata->to,
-		   ip_tostring_numeric(mydata->to));
-
-		break;
-
-	case '6':
-		parse_ipandmask(optarg, &mydata->from, &mydata->to);
-
-		/* Make to the last of from + mask */
-		if (mydata->to)
-			mydata->to = mydata->from | ~(mydata->to);
-		else {
-			mydata->from = 0x00000000;
-			mydata->to = 0xFFFFFFFF;
-		}
-		*flags |= OPT_CREATE_NETWORK;
-
-		DP("--network from %x (%s)", 
-		   mydata->from, ip_tostring_numeric(mydata->from));
-		DP("--network to %x (%s)", 
-		   mydata->to, ip_tostring_numeric(mydata->to));
-
-		break;
-
-	default:
-		return 0;
-	}
-
-	return 1;
-}
-
-/* Final check; exit if not ok. */
-static void
-ipportnethash_create_final(void *data, unsigned int flags)
-{
-	struct ip_set_req_ipportnethash_create *mydata = data;
-
-#ifdef IPSET_DEBUG
-	DP("hashsize %u probes %u resize %u",
-	   mydata->hashsize, mydata->probes, mydata->resize);
-#endif
-
-	if (flags & OPT_CREATE_NETWORK) {
-		/* --network */
-		if ((flags & OPT_CREATE_FROM) || (flags & OPT_CREATE_TO))
-			exit_error(PARAMETER_PROBLEM,
-				   "Can't specify --from or --to with --network\n");
-	} else if (flags & (OPT_CREATE_FROM | OPT_CREATE_TO)) {
-		/* --from --to */
-		if (!(flags & OPT_CREATE_FROM) || !(flags & OPT_CREATE_TO))
-			exit_error(PARAMETER_PROBLEM,
-				   "Need to specify both --from and --to\n");
-	} else {
-		exit_error(PARAMETER_PROBLEM,
-			   "Need to specify --from and --to, or --network\n");
-
-	}
-
-	DP("from : %x to: %x diff: %x", 
-	   mydata->from, mydata->to,
-	   mydata->to - mydata->from);
-
-	if (mydata->from > mydata->to)
-		exit_error(PARAMETER_PROBLEM,
-			   "From can't be higher than to.\n");
-
-	if (mydata->to - mydata->from > MAX_RANGE)
-		exit_error(PARAMETER_PROBLEM,
-			   "Range too large. Max is %d IPs in range\n",
-			   MAX_RANGE+1);
-}
-
-/* Create commandline options */
-static const struct option create_opts[] = {
-	{.name = "hashsize",	.has_arg = required_argument,	.val = '1'},
-	{.name = "probes",	.has_arg = required_argument,	.val = '2'},
-	{.name = "resize",	.has_arg = required_argument,	.val = '3'},
-	{.name = "from",	.has_arg = required_argument,	.val = '4'},
-	{.name = "to",		.has_arg = required_argument,	.val = '5'},
-	{.name = "network",	.has_arg = required_argument,	.val = '6'},
-	{NULL},
-};
-
-/* Add, del, test parser */
-static ip_set_ip_t
-ipportnethash_adt_parser(int cmd, const char *arg, void *data)
-{
-	struct ip_set_req_ipportnethash *mydata = data;
-	char *saved = ipset_strdup(arg);
-	char *ptr, *tmp = saved;
-	ip_set_ip_t cidr;
-
-	DP("ipportnethash: %p %p", arg, data);
-
-	if (((ptr = strchr(tmp, ':')) || (ptr = strchr(tmp, '%'))) && ++warn_once == 1)
-		fprintf(stderr, "Warning: please use ',' separator token between ip,port,net.\n"
-			        "Next release won't support old separator tokens.\n");
-
-	ptr = strsep(&tmp, ":%,");
-	parse_ip(ptr, &mydata->ip);
-	if (!tmp)
-		exit_error(PARAMETER_PROBLEM,
-			   "IP address, port and network address must be specified: ip,port,net");
-
-	ptr = strsep(&tmp, ":%,");
-	parse_port(ptr, &mydata->port);
-	if (!tmp)
-		exit_error(PARAMETER_PROBLEM,
-			   "IP address, port and network address must be specified: ip,port,net");
-
-	ptr = strsep(&tmp, "/");
-	if (tmp == NULL)
-		if (cmd == CMD_TEST)
-			cidr = 32;
-		else
-			exit_error(PARAMETER_PROBLEM,
-				   "Missing /cidr from `%s'", arg);
-	else
-		if (string_to_number(tmp, 1, 31, &cidr))
-			exit_error(PARAMETER_PROBLEM,
-				   "Out of range cidr `%s' specified", arg);
-	
-	mydata->cidr = cidr;
-
-	parse_ip(ptr, &mydata->ip1);
-	ipset_free(saved);
-	return 1;	
-};
-
-/*
- * Print and save
- */
-
-static void
-ipportnethash_initheader(struct set *set, const void *data)
-{
-	const struct ip_set_req_ipportnethash_create *header = data;
-	struct ip_set_ipportnethash *map = set->settype->header;
-
-	memset(map, 0, sizeof(struct ip_set_ipportnethash));
-	map->hashsize = header->hashsize;
-	map->probes = header->probes;
-	map->resize = header->resize;
-	map->first_ip = header->from;
-	map->last_ip = header->to;
-}
-
-static void
-ipportnethash_printheader(struct set *set, unsigned options)
-{
-	struct ip_set_ipportnethash *mysetdata = set->settype->header;
-
-	printf(" from: %s", ip_tostring(mysetdata->first_ip, options));
-	printf(" to: %s", ip_tostring(mysetdata->last_ip, options));
-	printf(" hashsize: %u", mysetdata->hashsize);
-	printf(" probes: %u", mysetdata->probes);
-	printf(" resize: %u\n", mysetdata->resize);
-}
-
-static char buf[20];
-
-static char *
-unpack_ip_tostring(ip_set_ip_t ip, unsigned options UNUSED)
-{
-	int i, j = 3;
-	unsigned char a, b;
-
-	ip = htonl(ip);	
-	for (i = 3; i >= 0; i--)
-		if (((unsigned char *)&ip)[i] != 0) {
-			j = i;
-			break;
-		}
-			
-	a = ((unsigned char *)&ip)[j];
-	if (a <= 128) {
-		a = (a - 1) * 2;
-		b = 7;
-	} else if (a <= 192) {
-		a = (a - 129) * 4;
-		b = 6;
-	} else if (a <= 224) {
-		a = (a - 193) * 8;
-		b = 5;
-	} else if (a <= 240) {
-		a = (a - 225) * 16;
-		b = 4;
-	} else if (a <= 248) {
-		a = (a - 241) * 32;
-		b = 3;
-	} else if (a <= 252) {
-		a = (a - 249) * 64;
-		b = 2;
-	} else if (a <= 254) {
-		a = (a - 253) * 128;
-		b = 1;
-	} else {
-		a = b = 0;
-	}
-	((unsigned char *)&ip)[j] = a;
-	b += j * 8;
-	
-	sprintf(buf, "%u.%u.%u.%u/%u",
-		((unsigned char *)&ip)[0],
-		((unsigned char *)&ip)[1],
-		((unsigned char *)&ip)[2],
-		((unsigned char *)&ip)[3],
-		b);
-
-	DP("%s %s", ip_tostring(ntohl(ip), 0), buf);
-	return buf;
-}
-
-static void
-ipportnethash_printips(struct set *set, void *data, u_int32_t len,
-		       unsigned options, char dont_align)
-{
-	struct ip_set_ipportnethash *mysetdata = set->settype->header;
-	size_t offset = 0;
-	struct ipportip *ipptr;
-	ip_set_ip_t ip;
-	uint16_t port;
-
-	while (offset < len) {
-		ipptr = data + offset;
-		ip = (ipptr->ip>>16) + mysetdata->first_ip;
-		port = (uint16_t) ipptr->ip;
-		printf("%s,%s,", 
-		       ip_tostring(ip, options),
-		       port_tostring(port, options));
-		printf("%s\n", 
-		       unpack_ip_tostring(ipptr->ip1, options));
-		offset += IPSET_VALIGN(sizeof(struct ipportip), dont_align);
-	}
-}
-
-static void
-ipportnethash_saveheader(struct set *set, unsigned options)
-{
-	struct ip_set_ipportnethash *mysetdata = set->settype->header;
-
-	printf("-N %s %s --from %s",
-	       set->name, set->settype->typename,
-	       ip_tostring(mysetdata->first_ip, options));
-	printf(" --to %s",
-	       ip_tostring(mysetdata->last_ip, options));
-	printf(" --hashsize %u --probes %u --resize %u\n",
-	       mysetdata->hashsize, mysetdata->probes, mysetdata->resize);
-}
-
-/* Print save for an IP */
-static void
-ipportnethash_saveips(struct set *set, void *data, u_int32_t len,
-		      unsigned options, char dont_align)
-{
-	struct ip_set_ipportnethash *mysetdata = set->settype->header;
-	size_t offset = 0;
-	struct ipportip *ipptr;
-	ip_set_ip_t ip;
-	uint16_t port;
-
-	while (offset < len) {
-		ipptr = data + offset;
-		ip = (ipptr->ip>>16) + mysetdata->first_ip;
-		port = (uint16_t) ipptr->ip;
-		printf("-A %s %s,%s,", set->name, 
-		       ip_tostring(ip, options),
-		       port_tostring(port, options));
-		printf("%s\n",
-		       unpack_ip_tostring(ipptr->ip, options));
-		offset += IPSET_VALIGN(sizeof(struct ipportip), dont_align);
-	}
-}
-
-static void
-ipportnethash_usage(void)
-{
-	printf
-	    ("-N set ipportnethash --from IP --to IP\n"
-	     "   [--hashsize hashsize] [--probes probes ] [--resize resize]\n"
-	     "-N set ipportnethash --network IP/mask\n"
-	     "   [--hashsize hashsize] [--probes probes ] [--resize resize]\n"
-	     "-A set IP,port,IP/net\n"
-	     "-D set IP,port,IP/net\n"
-	     "-T set IP,port,IP[/net]\n");
-}
-
-static struct settype settype_ipportnethash = {
-	.typename = SETTYPE_NAME,
-	.protocol_version = IP_SET_PROTOCOL_VERSION,
-
-	/* Create */
-	.create_size = sizeof(struct ip_set_req_ipportnethash_create),
-	.create_init = ipportnethash_create_init,
-	.create_parse = ipportnethash_create_parse,
-	.create_final = ipportnethash_create_final,
-	.create_opts = create_opts,
-
-	/* Add/del/test */
-	.adt_size = sizeof(struct ip_set_req_ipportnethash),
-	.adt_parser = ipportnethash_adt_parser,
-
-	/* Printing */
-	.header_size = sizeof(struct ip_set_ipportnethash),
-	.initheader = ipportnethash_initheader,
-	.printheader = ipportnethash_printheader,
-	.printips = ipportnethash_printips,
-	.printips_sorted = ipportnethash_printips,
-	.saveheader = ipportnethash_saveheader,
-	.saveips = ipportnethash_saveips,
-	
-	.usage = ipportnethash_usage,
-};
-
-CONSTRUCTOR(ipportnethash)
-{
-	settype_register(&settype_ipportnethash);
-
-}

extensions/ipset/ipset_iptree.c

@@ -1,224 +0,0 @@
-/* Copyright 2005 Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
- *
- * This program is free software; you can redistribute it and/or modify   
- * it under the terms of the GNU General Public License as published by   
- * the Free Software Foundation; either version 2 of the License, or      
- * (at your option) any later version.                                    
- *                                                                         
- * This program is distributed in the hope that it will be useful,        
- * but WITHOUT ANY WARRANTY; without even the implied warranty of         
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          
- * GNU General Public License for more details.                           
- *                                                                         
- * You should have received a copy of the GNU General Public License      
- * along with this program; if not, write to the Free Software            
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-#include <limits.h>			/* UINT_MAX */
-#include <stdio.h>			/* *printf */
-#include <string.h>			/* mem* */
-
-#include "ipset.h"
-
-#include "ip_set_iptree.h"
-
-#define BUFLEN 30;
-
-#define OPT_CREATE_TIMEOUT    0x01U
-
-/* Initialize the create. */
-static void
-iptree_create_init(void *data)
-{
-	struct ip_set_req_iptree_create *mydata = data;
-
-	DP("create INIT");
-	mydata->timeout = 0;
-}
-
-/* Function which parses command options; returns true if it ate an option */
-static int
-iptree_create_parse(int c, char *argv[] UNUSED, void *data, unsigned *flags)
-{
-	struct ip_set_req_iptree_create *mydata = data;
-
-	DP("create_parse");
-
-	switch (c) {
-	case '1':
-		string_to_number(optarg, 0, UINT_MAX, &mydata->timeout);
-
-		*flags |= OPT_CREATE_TIMEOUT;
-
-		DP("--timeout %u", mydata->timeout);
-
-		break;
-	default:
-		return 0;
-	}
-
-	return 1;
-}
-
-/* Final check; exit if not ok. */
-static void
-iptree_create_final(void *data UNUSED, unsigned int flags UNUSED)
-{
-}
-
-/* Create commandline options */
-static const struct option create_opts[] = {
-	{.name = "timeout",	.has_arg = required_argument,	.val = '1'},
-	{NULL},
-};
-
-/* Add, del, test parser */
-static ip_set_ip_t
-iptree_adt_parser(int cmd UNUSED, const char *arg, void *data)
-{
-	struct ip_set_req_iptree *mydata = data;
-	char *saved = ipset_strdup(arg);
-	char *ptr, *tmp = saved;
-
-	DP("iptree: %p %p", arg, data);
-
-	if (((ptr = strchr(tmp, ':')) || (ptr = strchr(tmp, '%'))) && ++warn_once == 1)
-		fprintf(stderr, "Warning: please use ',' separator token between ip,timeout.\n"
-			        "Next release won't support old separator tokens.\n");
-
-	ptr = strsep(&tmp, ":%,");
-	parse_ip(ptr, &mydata->ip);
-
-	if (tmp)
-		string_to_number(tmp, 0, UINT_MAX, &mydata->timeout);
-	else
-		mydata->timeout = 0;	
-
-	ipset_free(saved);
-	return 1;	
-}
-
-/*
- * Print and save
- */
-
-static void
-iptree_initheader(struct set *set, const void *data)
-{
-	const struct ip_set_req_iptree_create *header = data;
-	struct ip_set_iptree *map = set->settype->header;
-		
-	map->timeout = header->timeout;
-}
-
-static void
-iptree_printheader(struct set *set, unsigned options UNUSED)
-{
-	struct ip_set_iptree *mysetdata = set->settype->header;
-
-	if (mysetdata->timeout)
-		printf(" timeout: %u", mysetdata->timeout);
-	printf("\n");
-}
-
-static void
-iptree_printips_sorted(struct set *set, void *data, u_int32_t len,
-		       unsigned options, char dont_align)
-{
-	struct ip_set_iptree *mysetdata = set->settype->header;
-	struct ip_set_req_iptree *req;
-	size_t offset = 0;
-
-	while (len >= offset + sizeof(struct ip_set_req_iptree)) {
-		req = (struct ip_set_req_iptree *)(data + offset);
-		if (mysetdata->timeout)
-			printf("%s,%u\n", ip_tostring(req->ip, options),
-					  req->timeout);
-		else
-			printf("%s\n", ip_tostring(req->ip, options));
-		offset += IPSET_VALIGN(sizeof(struct ip_set_req_iptree), dont_align);
-	}
-}
-
-static void
-iptree_saveheader(struct set *set, unsigned options UNUSED)
-{
-	struct ip_set_iptree *mysetdata = set->settype->header;
-
-	if (mysetdata->timeout)
-		printf("-N %s %s --timeout %u\n",
-		       set->name, set->settype->typename,
-		       mysetdata->timeout);
-	else
-		printf("-N %s %s\n",
-		       set->name, set->settype->typename);
-}
-
-static void
-iptree_saveips(struct set *set, void *data, u_int32_t len,
-	       unsigned options, char dont_align)
-{
-	struct ip_set_iptree *mysetdata = set->settype->header;
-	struct ip_set_req_iptree *req;
-	size_t offset = 0;
-
-	DP("%s", set->name);
-
-	while (len >= offset + sizeof(struct ip_set_req_iptree)) {
-		req = (struct ip_set_req_iptree *)(data + offset);
-		if (mysetdata->timeout)
-			printf("-A %s %s,%u\n",
-				set->name, 
-				ip_tostring(req->ip, options),
-				req->timeout);
-		else
-			printf("-A %s %s\n", 
-				set->name,
-				ip_tostring(req->ip, options));
-		offset += IPSET_VALIGN(sizeof(struct ip_set_req_iptree), dont_align);
-	}
-}
-
-static void
-iptree_usage(void)
-{
-	printf
-	    ("-N set iptree [--timeout value]\n"
-	     "-A set IP[,timeout]\n"
-	     "-D set IP\n"
-	     "-T set IP\n");
-}
-
-static struct settype settype_iptree = {
-	.typename = SETTYPE_NAME,
-	.protocol_version = IP_SET_PROTOCOL_VERSION,
-
-	/* Create */
-	.create_size = sizeof(struct ip_set_req_iptree_create),
-	.create_init = iptree_create_init,
-	.create_parse = iptree_create_parse,
-	.create_final = iptree_create_final,
-	.create_opts = create_opts,
-
-	/* Add/del/test */
-	.adt_size = sizeof(struct ip_set_req_iptree),
-	.adt_parser = iptree_adt_parser,
-
-	/* Printing */
-	.header_size = sizeof(struct ip_set_iptree),
-	.initheader = iptree_initheader,
-	.printheader = iptree_printheader,
-	.printips = iptree_printips_sorted,	/* We only have sorted version */
-	.printips_sorted = iptree_printips_sorted,
-	.saveheader = iptree_saveheader,
-	.saveips = iptree_saveips,
-	
-	.usage = iptree_usage,
-};
-
-CONSTRUCTOR(iptree)
-{
-	settype_register(&settype_iptree);
-
-}

extensions/ipset/ipset_iptreemap.c

@@ -1,208 +0,0 @@
-/* Copyright 2007 Sven Wegener <sven.wegener@stealer.net>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation; either version 2 of the License, or (at your option)
- * any later version.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
- * Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-#include <limits.h>			/* UINT_MAX */
-#include <stdio.h>			/* *printf */
-#include <string.h>			/* mem* */
-
-#include "ipset.h"
-
-#include "ip_set_iptreemap.h"
-
-#define OPT_CREATE_GC 0x1
-
-static void
-iptreemap_create_init(void *data)
-{
-	struct ip_set_req_iptreemap_create *mydata = data;
-
-	mydata->gc_interval = 0;
-}
-
-static int
-iptreemap_create_parse(int c, char *argv[] UNUSED, void *data,
-		       unsigned int *flags)
-{
-	struct ip_set_req_iptreemap_create *mydata = data;
-
-	switch (c) {
-		case 'g':
-			string_to_number(optarg, 0, UINT_MAX, &mydata->gc_interval);
-
-			*flags |= OPT_CREATE_GC;
-		break;
-		default:
-			return 0;
-		break;
-	}
-
-	return 1;
-}
-
-static void
-iptreemap_create_final(void *data UNUSED, unsigned int flags UNUSED)
-{
-}
-
-static const struct option create_opts[] = {
-	{.name = "gc",	.has_arg = required_argument,	.val = 'g'},
-	{NULL},
-};
-
-static ip_set_ip_t
-iptreemap_adt_parser(int cmd UNUSED, const char *arg, void *data)
-{
-	struct ip_set_req_iptreemap *mydata = data;
-	ip_set_ip_t mask;
-
-	char *saved = ipset_strdup(arg);
-	char *ptr, *tmp = saved;
-
-	if (strchr(tmp, '/')) {
-		parse_ipandmask(tmp, &mydata->ip, &mask);
-		mydata->end = mydata->ip | ~mask;
-	} else {
-		if ((ptr = strchr(tmp, ':')) != NULL && ++warn_once == 1)
-			fprintf(stderr, "Warning: please use '-' separator token between IP range.\n"
-			        "Next release won't support old separator token.\n");
-		ptr = strsep(&tmp, "-:");
-		parse_ip(ptr, &mydata->ip);
-
-		if (tmp) {
-			parse_ip(tmp, &mydata->end);
-		} else {
-			mydata->end = mydata->ip;
-		}
-	}
-
-	ipset_free(saved);
-
-	return 1;
-}
-
-static void
-iptreemap_initheader(struct set *set, const void *data)
-{
-	const struct ip_set_req_iptreemap_create *header = data;
-	struct ip_set_iptreemap *map = set->settype->header;
-
-	map->gc_interval = header->gc_interval;
-}
-
-static void
-iptreemap_printheader(struct set *set, unsigned int options UNUSED)
-{
-	struct ip_set_iptreemap *mysetdata = set->settype->header;
-
-	if (mysetdata->gc_interval)
-		printf(" gc: %u", mysetdata->gc_interval);
-
-	printf("\n");
-}
-
-static void
-iptreemap_printips_sorted(struct set *set UNUSED, void *data,
-			  u_int32_t len, unsigned int options, char dont_align)
-{
-	struct ip_set_req_iptreemap *req;
-	size_t offset = 0;
-
-	while (len >= offset + sizeof(struct ip_set_req_iptreemap)) {
-		req = data + offset;
-
-		printf("%s", ip_tostring(req->ip, options));
-		if (req->ip != req->end)
-			printf("-%s", ip_tostring(req->end, options));
-		printf("\n");
-
-		offset += IPSET_VALIGN(sizeof(struct ip_set_req_iptreemap), dont_align);
-	}
-}
-
-static void
-iptreemap_saveheader(struct set *set, unsigned int options UNUSED)
-{
-	struct ip_set_iptreemap *mysetdata = set->settype->header;
-
-	printf("-N %s %s", set->name, set->settype->typename);
-
-	if (mysetdata->gc_interval)
-		printf(" --gc %u", mysetdata->gc_interval);
-
-	printf("\n");
-}
-
-static void
-iptreemap_saveips(struct set *set UNUSED, void *data,
-		  u_int32_t len, unsigned int options, char dont_align)
-{
-	struct ip_set_req_iptreemap *req;
-	size_t offset = 0;
-
-	while (len >= offset + sizeof(struct ip_set_req_iptreemap)) {
-		req = data + offset;
-
-		printf("-A %s %s", set->name, ip_tostring(req->ip, options));
-
-		if (req->ip != req->end)
-			printf("-%s", ip_tostring(req->end, options));
-
-		printf("\n");
-
-		offset += IPSET_VALIGN(sizeof(struct ip_set_req_iptreemap), dont_align);
-	}
-}
-
-static void
-iptreemap_usage(void)
-{
-	printf(
-		"-N set iptreemap --gc interval\n"
-		"-A set IP\n"
-		"-D set IP\n"
-		"-T set IP\n"
-	);
-}
-
-static struct settype settype_iptreemap = {
-	.typename = SETTYPE_NAME,
-	.protocol_version = IP_SET_PROTOCOL_VERSION,
-
-	.create_size = sizeof(struct ip_set_req_iptreemap_create),
-	.create_init = iptreemap_create_init,
-	.create_parse = iptreemap_create_parse,
-	.create_final = iptreemap_create_final,
-	.create_opts = create_opts,
-
-	.adt_size = sizeof(struct ip_set_req_iptreemap),
-	.adt_parser = iptreemap_adt_parser,
-
-	.header_size = sizeof(struct ip_set_iptreemap),
-	.initheader = iptreemap_initheader,
-	.printheader = iptreemap_printheader,
-	.printips = iptreemap_printips_sorted,
-	.printips_sorted = iptreemap_printips_sorted,
-	.saveheader = iptreemap_saveheader,
-	.saveips = iptreemap_saveips,
-
-	.usage = iptreemap_usage,
-};
-
-CONSTRUCTOR(iptreemap)
-{
-	settype_register(&settype_iptreemap);
-}

extensions/ipset/ipset_macipmap.c

@@ -1,382 +0,0 @@
-/* Copyright 2000, 2001, 2002 Joakim Axelsson (gozem@linux.nu)
- *                            Patrick Schaaf (bof@bof.de)
- *                            Martin Josefsson (gandalf@wlug.westbo.se)
- *
- * This program is free software; you can redistribute it and/or modify   
- * it under the terms of the GNU General Public License as published by   
- * the Free Software Foundation; either version 2 of the License, or      
- * (at your option) any later version.                                    
- *                                                                         
- * This program is distributed in the hope that it will be useful,        
- * but WITHOUT ANY WARRANTY; without even the implied warranty of         
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          
- * GNU General Public License for more details.                           
- *                                                                         
- * You should have received a copy of the GNU General Public License      
- * along with this program; if not, write to the Free Software            
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-
-#include <stdio.h>			/* *printf */
-#include <stdlib.h>			/* mem* */
-#include <string.h>			/* str* */
-#include <net/ethernet.h>		/* ETH_ALEN */
-
-#include "ipset.h"
-
-#include "ip_set_macipmap.h"
-
-#define BUFLEN 30;
-
-#define OPT_CREATE_FROM    0x01U
-#define OPT_CREATE_TO      0x02U
-#define OPT_CREATE_NETWORK 0x04U
-#define OPT_CREATE_MATCHUNSET	0x08U
-
-#define OPT_ADDDEL_IP      0x01U
-#define OPT_ADDDEL_MAC     0x02U
-
-/* Initialize the create. */
-static void
-macipmap_create_init(void *data UNUSED)
-{
-	DP("create INIT");
-	/* Nothing */
-}
-
-/* Function which parses command options; returns true if it ate an option */
-static int
-macipmap_create_parse(int c, char *argv[] UNUSED, void *data, unsigned *flags)
-{
-	struct ip_set_req_macipmap_create *mydata = data;
-
-	DP("create_parse");
-
-	switch (c) {
-	case '1':
-		parse_ip(optarg, &mydata->from);
-
-		*flags |= OPT_CREATE_FROM;
-
-		DP("--from %x (%s)", mydata->from,
-		   ip_tostring_numeric(mydata->from));
-
-		break;
-
-	case '2':
-		parse_ip(optarg, &mydata->to);
-
-		*flags |= OPT_CREATE_TO;
-
-		DP("--to %x (%s)", mydata->to,
-		   ip_tostring_numeric(mydata->to));
-
-		break;
-
-	case '3':
-		parse_ipandmask(optarg, &mydata->from, &mydata->to);
-
-		/* Make to the last of from + mask */
-		mydata->to = mydata->from | (~mydata->to);
-
-		*flags |= OPT_CREATE_NETWORK;
-
-		DP("--network from %x (%s)", 
-		   mydata->from, ip_tostring_numeric(mydata->from));
-		DP("--network to %x (%s)", 
-		   mydata->to, ip_tostring_numeric(mydata->to));
-
-		break;
-
-	case '4':
-		mydata->flags |= IPSET_MACIP_MATCHUNSET;
-
-		*flags |= OPT_CREATE_MATCHUNSET;
-
-		DP("--matchunset");
-
-		break;
-
-	default:
-		return 0;
-	}
-
-	return 1;
-}
-
-/* Final check; exit if not ok. */
-static void
-macipmap_create_final(void *data, unsigned int flags)
-{
-	struct ip_set_req_macipmap_create *mydata = data;
-
-	if (flags == 0)
-		exit_error(PARAMETER_PROBLEM,
-			   "Need to specify --from and --to, or --network\n");
-
-	if (flags & OPT_CREATE_NETWORK) {
-		/* --network */
-		if ((flags & OPT_CREATE_FROM) || (flags & OPT_CREATE_TO))
-			exit_error(PARAMETER_PROBLEM,
-				   "Can't specify --from or --to with --network\n");
-	} else {
-		/* --from --to */
-		if ((flags & OPT_CREATE_FROM) == 0
-		    || (flags & OPT_CREATE_TO) == 0)
-			exit_error(PARAMETER_PROBLEM,
-				   "Need to specify both --from and --to\n");
-	}
-
-
-	DP("from : %x to: %x  diff: %d  match unset: %d", mydata->from,
-	   mydata->to, mydata->to - mydata->from,
-	   flags & OPT_CREATE_MATCHUNSET);
-
-	if (mydata->from > mydata->to)
-		exit_error(PARAMETER_PROBLEM,
-			   "From can't be lower than to.\n");
-
-	if (mydata->to - mydata->from > MAX_RANGE)
-		exit_error(PARAMETER_PROBLEM,
-			   "Range too large. Max is %d IPs in range\n",
-			   MAX_RANGE+1);
-}
-
-/* Create commandline options */
-static const struct option create_opts[] = {
-	{.name = "from",	.has_arg = required_argument,	.val = '1'},
-	{.name = "to",		.has_arg = required_argument,	.val = '2'},
-	{.name = "network",	.has_arg = required_argument,	.val = '3'},
-	{.name = "matchunset",	.has_arg = no_argument,		.val = '4'},
-	{NULL},
-};
-
-static void
-parse_mac(const char *mac, unsigned char *ethernet)
-{
-	unsigned int i = 0;
-
-	if (strlen(mac) != ETH_ALEN * 3 - 1)
-		exit_error(PARAMETER_PROBLEM, "Bad mac address `%s'", mac);
-
-	for (i = 0; i < ETH_ALEN; i++) {
-		long number;
-		char *end;
-
-		number = strtol(mac + i * 3, &end, 16);
-
-		if (end == mac + i * 3 + 2 && number >= 0 && number <= 255)
-			ethernet[i] = number;
-		else
-			exit_error(PARAMETER_PROBLEM,
-				   "Bad mac address `%s'", mac);
-	}
-}
-
-/* Add, del, test parser */
-static ip_set_ip_t
-macipmap_adt_parser(int cmd UNUSED, const char *arg, void *data)
-{
-	struct ip_set_req_macipmap *mydata = data;
-	char *saved = ipset_strdup(arg);
-	char *ptr, *tmp = saved;
-
-	DP("macipmap: %p %p", arg, data);
-
-	ptr = strsep(&tmp, ",");
-	if (!tmp) {
-		tmp = saved;
-		ptr = strsep(&tmp, ":%");	
-		if (tmp && ++warn_once == 1)
-			fprintf(stderr, "Warning: please use ',' separator token between ip,mac.\n"
-				        "Next release won't support old separator tokens.\n");
-	}
-	parse_ip(ptr, &mydata->ip);
-
-	if (tmp)
-		parse_mac(tmp, mydata->ethernet);
-	else
-		memset(mydata->ethernet, 0, ETH_ALEN);	
-
-	free(saved);
-
-	return 1;	
-}
-
-/*
- * Print and save
- */
-
-static void
-macipmap_initheader(struct set *set, const void *data)
-{
-	const struct ip_set_req_macipmap_create *header = data;
-	struct ip_set_macipmap *map = set->settype->header;
-
-	memset(map, 0, sizeof(struct ip_set_macipmap));
-	map->first_ip = header->from;
-	map->last_ip = header->to;
-	map->flags = header->flags;
-}
-
-static void
-macipmap_printheader(struct set *set, unsigned options)
-{
-	struct ip_set_macipmap *mysetdata = set->settype->header;
-
-	printf(" from: %s", ip_tostring(mysetdata->first_ip, options));
-	printf(" to: %s", ip_tostring(mysetdata->last_ip, options));
-
-	if (mysetdata->flags & IPSET_MACIP_MATCHUNSET)
-		printf(" matchunset");
-	printf("\n");
-}
-
-static void
-print_mac(unsigned char macaddress[ETH_ALEN])
-{
-	unsigned int i;
-
-	printf("%02X", macaddress[0]);
-	for (i = 1; i < ETH_ALEN; i++)
-		printf(":%02X", macaddress[i]);
-}
-
-static inline void
-__macipmap_printips_sorted(struct set *set, void *data,
-			   u_int32_t len UNUSED, unsigned options)
-{
-	struct ip_set_macipmap *mysetdata = set->settype->header;
-	struct ip_set_macip *table = data;
-	u_int32_t addr = mysetdata->first_ip;
-
-	while (addr <= mysetdata->last_ip) {
-		if (table[addr - mysetdata->first_ip].match) {
-			printf("%s,", ip_tostring(addr, options));
-			print_mac(table[addr - mysetdata->first_ip].
-				  ethernet);
-			printf("\n");
-		}
-		addr++;
-	}
-}
-
-static void
-macipmap_printips_sorted(struct set *set, void *data,
-			 u_int32_t len, unsigned options,
-			 char dont_align)
-{
-	struct ip_set_req_macipmap *d;
-	size_t offset = 0;
-	
-	if (dont_align)
-		return __macipmap_printips_sorted(set, data, len, options);
-	
-	while (offset < len) {
-		d = data + offset;
-		printf("%s,", ip_tostring(d->ip, options));
-		print_mac(d->ethernet);
-		printf("\n");
-		offset += IPSET_ALIGN(sizeof(struct ip_set_req_macipmap));
-	}
-}
-
-static void
-macipmap_saveheader(struct set *set, unsigned options)
-{
-	struct ip_set_macipmap *mysetdata = set->settype->header;
-
-	printf("-N %s %s --from %s",
-	       set->name, set->settype->typename,
-	       ip_tostring(mysetdata->first_ip, options));
-	printf(" --to %s", ip_tostring(mysetdata->last_ip, options));
-
-	if (mysetdata->flags & IPSET_MACIP_MATCHUNSET)
-		printf(" --matchunset");
-	printf("\n");
-}
-
-static inline void
-__macipmap_saveips(struct set *set, void *data,
-		   u_int32_t len UNUSED, unsigned options)
-{
-	struct ip_set_macipmap *mysetdata = set->settype->header;
-	struct ip_set_macip *table = data;
-	u_int32_t addr = mysetdata->first_ip;
-
-	while (addr <= mysetdata->last_ip) {
-		if (table[addr - mysetdata->first_ip].match) {
-			printf("-A %s %s,",
-			       set->name, ip_tostring(addr, options));
-			print_mac(table[addr - mysetdata->first_ip].
-				  ethernet);
-			printf("\n");
-		}
-		addr++;
-	}
-}
-
-static void
-macipmap_saveips(struct set *set, void *data,
-		 u_int32_t len, unsigned options,
-		 char dont_align)
-{
-	struct ip_set_req_macipmap *d;
-	size_t offset = 0;
-	
-	if (dont_align)
-		return __macipmap_saveips(set, data, len, options);
-	
-	while (offset < len) {
-		d = data + offset;
-		printf("-A %s %s,", set->name, ip_tostring(d->ip, options));
-		print_mac(d->ethernet);
-		printf("\n");
-		offset += IPSET_ALIGN(sizeof(struct ip_set_req_macipmap));
-	}
-}
-
-static void
-macipmap_usage(void)
-{
-	printf
-	    ("-N set macipmap --from IP --to IP [--matchunset]\n"
-	     "-N set macipmap --network IP/mask [--matchunset]\n"
-	     "-A set IP[,MAC]\n"
-	     "-D set IP[,MAC]\n"
-	     "-T set IP[,MAC]\n");
-}
-
-static struct settype settype_macipmap = {
-	.typename = SETTYPE_NAME,
-	.protocol_version = IP_SET_PROTOCOL_VERSION,
-
-	/* Create */
-	.create_size = sizeof(struct ip_set_req_macipmap_create),
-	.create_init = macipmap_create_init,
-	.create_parse = macipmap_create_parse,
-	.create_final = macipmap_create_final,
-	.create_opts = create_opts,
-
-	/* Add/del/test */
-	.adt_size = sizeof(struct ip_set_req_macipmap),
-	.adt_parser = macipmap_adt_parser,
-
-	/* Printing */
-	.header_size = sizeof(struct ip_set_macipmap),
-	.initheader = macipmap_initheader,
-	.printheader = macipmap_printheader,
-	.printips = macipmap_printips_sorted,
-	.printips_sorted = macipmap_printips_sorted,
-	.saveheader = macipmap_saveheader,
-	.saveips = macipmap_saveips,
-
-	.usage = macipmap_usage,
-};
-
-CONSTRUCTOR(macipmap)
-{
-	settype_register(&settype_macipmap);
-
-}

extensions/ipset/ipset_nethash.c

@@ -1,308 +0,0 @@
-/* Copyright 2004 Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
- *
- * This program is free software; you can redistribute it and/or modify   
- * it under the terms of the GNU General Public License as published by   
- * the Free Software Foundation; either version 2 of the License, or      
- * (at your option) any later version.                                    
- *                                                                         
- * This program is distributed in the hope that it will be useful,        
- * but WITHOUT ANY WARRANTY; without even the implied warranty of         
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          
- * GNU General Public License for more details.                           
- *                                                                         
- * You should have received a copy of the GNU General Public License      
- * along with this program; if not, write to the Free Software            
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-#include <limits.h>			/* UINT_MAX */
-#include <stdio.h>			/* *printf */
-#include <string.h>			/* mem*, str* */
-
-#include "ipset.h"
-
-#include "ip_set_nethash.h"
-
-#define BUFLEN 30;
-
-#define OPT_CREATE_HASHSIZE	0x01U
-#define OPT_CREATE_PROBES	0x02U
-#define OPT_CREATE_RESIZE	0x04U
-
-/* Initialize the create. */
-static void
-nethash_create_init(void *data)
-{
-	struct ip_set_req_nethash_create *mydata = data;
-
-	DP("create INIT");
-
-	/* Default create parameters */	
-	mydata->hashsize = 1024;
-	mydata->probes = 4;
-	mydata->resize = 50;
-}
-
-/* Function which parses command options; returns true if it ate an option */
-static int
-nethash_create_parse(int c, char *argv[] UNUSED, void *data, unsigned *flags)
-{
-	struct ip_set_req_nethash_create *mydata = data;
-	ip_set_ip_t value;
-
-	DP("create_parse");
-
-	switch (c) {
-	case '1':
-
-		if (string_to_number(optarg, 1, UINT_MAX - 1, &mydata->hashsize))
-			exit_error(PARAMETER_PROBLEM, "Invalid hashsize `%s' specified", optarg);
-
-		*flags |= OPT_CREATE_HASHSIZE;
-
-		DP("--hashsize %u", mydata->hashsize);
-		
-		break;
-
-	case '2':
-
-		if (string_to_number(optarg, 1, 65535, &value))
-			exit_error(PARAMETER_PROBLEM, "Invalid probes `%s' specified", optarg);
-
-		mydata->probes = value;
-		*flags |= OPT_CREATE_PROBES;
-
-		DP("--probes %u", mydata->probes);
-		
-		break;
-
-	case '3':
-
-		if (string_to_number(optarg, 0, 65535, &value))
-			exit_error(PARAMETER_PROBLEM, "Invalid resize `%s' specified", optarg);
-
-		mydata->resize = value;
-		*flags |= OPT_CREATE_RESIZE;
-
-		DP("--resize %u", mydata->resize);
-		
-		break;
-
-	default:
-		return 0;
-	}
-
-	return 1;
-}
-
-/* Final check; exit if not ok. */
-static void
-nethash_create_final(void *data UNUSED, unsigned int flags UNUSED)
-{
-}
-
-/* Create commandline options */
-static const struct option create_opts[] = {
-	{.name = "hashsize",	.has_arg = required_argument,	.val = '1'},
-	{.name = "probes",	.has_arg = required_argument,	.val = '2'},
-	{.name = "resize",	.has_arg = required_argument,	.val = '3'},
-	{NULL},
-};
-
-/* Add, del, test parser */
-static ip_set_ip_t
-nethash_adt_parser(int cmd, const char *arg, void *data)
-{
-	struct ip_set_req_nethash *mydata = data;
-	char *saved = ipset_strdup(arg);
-	char *ptr, *tmp = saved;
-	ip_set_ip_t cidr;
-
-	ptr = strsep(&tmp, "/");
-	
-	if (tmp == NULL) {
-		if (cmd == CMD_TEST)
-			cidr = 32;
-		else
-			exit_error(PARAMETER_PROBLEM,
-				   "Missing cidr from `%s'", arg);
-	} else
-		if (string_to_number(tmp, 1, 31, &cidr))
-			exit_error(PARAMETER_PROBLEM,
-				   "Out of range cidr `%s' specified", arg);
-	
-	mydata->cidr = cidr;
-	parse_ip(ptr, &mydata->ip);
-#if 0
-	if (!mydata->ip)
-		exit_error(PARAMETER_PROBLEM,
-			  "Zero valued IP address `%s' specified", ptr);
-#endif
-	ipset_free(saved);
-
-	return 1;	
-};
-
-/*
- * Print and save
- */
-
-static void
-nethash_initheader(struct set *set, const void *data)
-{
-	const struct ip_set_req_nethash_create *header = data;
-	struct ip_set_nethash *map = set->settype->header;
-
-	memset(map, 0, sizeof(struct ip_set_nethash));
-	map->hashsize = header->hashsize;
-	map->probes = header->probes;
-	map->resize = header->resize;
-}
-
-static void
-nethash_printheader(struct set *set, unsigned options UNUSED)
-{
-	struct ip_set_nethash *mysetdata = set->settype->header;
-
-	printf(" hashsize: %u", mysetdata->hashsize);
-	printf(" probes: %u", mysetdata->probes);
-	printf(" resize: %u\n", mysetdata->resize);
-}
-
-static char buf[20];
-
-static char *
-unpack_ip_tostring(ip_set_ip_t ip, unsigned options UNUSED)
-{
-	int i, j = 3;
-	unsigned char a, b;
-
-	ip = htonl(ip);	
-	for (i = 3; i >= 0; i--)
-		if (((unsigned char *)&ip)[i] != 0) {
-			j = i;
-			break;
-		}
-			
-	a = ((unsigned char *)&ip)[j];
-	if (a <= 128) {
-		a = (a - 1) * 2;
-		b = 7;
-	} else if (a <= 192) {
-		a = (a - 129) * 4;
-		b = 6;
-	} else if (a <= 224) {
-		a = (a - 193) * 8;
-		b = 5;
-	} else if (a <= 240) {
-		a = (a - 225) * 16;
-		b = 4;
-	} else if (a <= 248) {
-		a = (a - 241) * 32;
-		b = 3;
-	} else if (a <= 252) {
-		a = (a - 249) * 64;
-		b = 2;
-	} else if (a <= 254) {
-		a = (a - 253) * 128;
-		b = 1;
-	} else {
-		a = b = 0;
-	}
-	((unsigned char *)&ip)[j] = a;
-	b += j * 8;
-	
-	sprintf(buf, "%u.%u.%u.%u/%u",
-		((unsigned char *)&ip)[0],
-		((unsigned char *)&ip)[1],
-		((unsigned char *)&ip)[2],
-		((unsigned char *)&ip)[3],
-		b);
-
-	DP("%s %s", ip_tostring(ntohl(ip), 0), buf);
-	return buf;
-}
-
-static void
-nethash_printips(struct set *set UNUSED, void *data, u_int32_t len,
-		 unsigned options, char dont_align)
-{
-	size_t offset = 0;
-	ip_set_ip_t *ip;
-
-	while (offset < len) {
-		ip = data + offset;
-		printf("%s\n", unpack_ip_tostring(*ip, options));
-		offset += IPSET_VALIGN(sizeof(ip_set_ip_t), dont_align);
-	}
-}
-
-static void
-nethash_saveheader(struct set *set, unsigned options UNUSED)
-{
-	struct ip_set_nethash *mysetdata = set->settype->header;
-
-	printf("-N %s %s --hashsize %u --probes %u --resize %u\n",
-	       set->name, set->settype->typename,
-	       mysetdata->hashsize, mysetdata->probes, mysetdata->resize);
-}
-
-/* Print save for an IP */
-static void
-nethash_saveips(struct set *set UNUSED, void *data, u_int32_t len,
-		unsigned options, char dont_align)
-{
-	size_t offset = 0;
-	ip_set_ip_t *ip;
-
-	while (offset < len) {
-		ip = data + offset;
-		printf("-A %s %s\n", set->name,
-		       unpack_ip_tostring(*ip, options));
-		offset += IPSET_VALIGN(sizeof(ip_set_ip_t), dont_align);
-	}
-}
-
-static void
-nethash_usage(void)
-{
-	printf
-	    ("-N set nethash [--hashsize hashsize] [--probes probes ]\n"
-	     "               [--resize resize]\n"
-	     "-A set IP/cidr\n"
-	     "-D set IP/cidr\n"
-	     "-T set IP/cidr\n");
-}
-
-static struct settype settype_nethash = {
-	.typename = SETTYPE_NAME,
-	.protocol_version = IP_SET_PROTOCOL_VERSION,
-
-	/* Create */
-	.create_size = sizeof(struct ip_set_req_nethash_create),
-	.create_init = nethash_create_init,
-	.create_parse = nethash_create_parse,
-	.create_final = nethash_create_final,
-	.create_opts = create_opts,
-
-	/* Add/del/test */
-	.adt_size = sizeof(struct ip_set_req_nethash),
-	.adt_parser = nethash_adt_parser,
-
-	/* Printing */
-	.header_size = sizeof(struct ip_set_nethash),
-	.initheader = nethash_initheader,
-	.printheader = nethash_printheader,
-	.printips = nethash_printips,
-	.printips_sorted = nethash_printips,
-	.saveheader = nethash_saveheader,
-	.saveips = nethash_saveips,
-	
-	.usage = nethash_usage,
-};
-
-CONSTRUCTOR(nethash)
-{
-	settype_register(&settype_nethash);
-
-}

extensions/ipset/ipset_portmap.c

@@ -1,272 +0,0 @@
-/* Copyright 2004 Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
- *
- * This program is free software; you can redistribute it and/or modify   
- * it under the terms of the GNU General Public License as published by   
- * the Free Software Foundation; either version 2 of the License, or      
- * (at your option) any later version.                                    
- *                                                                         
- * This program is distributed in the hope that it will be useful,        
- * but WITHOUT ANY WARRANTY; without even the implied warranty of         
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          
- * GNU General Public License for more details.                           
- *                                                                         
- * You should have received a copy of the GNU General Public License      
- * along with this program; if not, write to the Free Software            
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-
-#include <stdio.h>			/* *printf */
-#include <string.h>			/* mem* */
-
-#include "ipset.h"
-
-#include "ip_set_portmap.h"
-
-#define BUFLEN 30;
-
-#define OPT_CREATE_FROM    0x01U
-#define OPT_CREATE_TO      0x02U
-
-#define OPT_ADDDEL_PORT      0x01U
-
-/* Initialize the create. */
-static void
-portmap_create_init(void *data UNUSED)
-{
-	DP("create INIT");
-	/* Nothing */
-}
-
-/* Function which parses command options; returns true if it ate an option */
-static int
-portmap_create_parse(int c, char *argv[] UNUSED, void *data, unsigned *flags)
-{
-	struct ip_set_req_portmap_create *mydata = data;
-
-	DP("create_parse");
-
-	switch (c) {
-	case '1':
-		parse_port(optarg, &mydata->from);
-
-		*flags |= OPT_CREATE_FROM;
-
-		DP("--from %x (%s)", mydata->from,
-		   port_tostring(mydata->from, 0));
-
-		break;
-
-	case '2':
-		parse_port(optarg, &mydata->to);
-
-		*flags |= OPT_CREATE_TO;
-
-		DP("--to %x (%s)", mydata->to,
-		   port_tostring(mydata->to, 0));
-
-		break;
-
-	default:
-		return 0;
-	}
-
-	return 1;
-}
-
-/* Final check; exit if not ok. */
-static void
-portmap_create_final(void *data, unsigned int flags)
-{
-	struct ip_set_req_portmap_create *mydata = data;
-
-	if (flags == 0) {
-		exit_error(PARAMETER_PROBLEM,
-			   "Need to specify --from and --to\n");
-	} else {
-		/* --from --to */
-		if ((flags & OPT_CREATE_FROM) == 0
-		    || (flags & OPT_CREATE_TO) == 0)
-			exit_error(PARAMETER_PROBLEM,
-				   "Need to specify both --from and --to\n");
-	}
-
-	DP("from : %x to: %x  diff: %d", mydata->from, mydata->to,
-	   mydata->to - mydata->from);
-
-	if (mydata->from > mydata->to)
-		exit_error(PARAMETER_PROBLEM,
-			   "From can't be lower than to.\n");
-
-	if (mydata->to - mydata->from > MAX_RANGE)
-		exit_error(PARAMETER_PROBLEM,
-			   "Range too large. Max is %d ports in range\n",
-			   MAX_RANGE+1);
-}
-
-/* Create commandline options */
-static const struct option create_opts[] = {
-	{.name = "from",	.has_arg = required_argument,	.val = '1'},
-	{.name = "to",		.has_arg = required_argument,	.val = '2'},
-	{NULL},
-};
-
-/* Add, del, test parser */
-static ip_set_ip_t
-portmap_adt_parser(int cmd UNUSED, const char *arg, void *data)
-{
-	struct ip_set_req_portmap *mydata = data;
-
-	parse_port(arg, &mydata->ip);
-	DP("%s", port_tostring(mydata->ip, 0));
-
-	return 1;	
-}
-
-/*
- * Print and save
- */
-
-static void
-portmap_initheader(struct set *set, const void *data)
-{
-	const struct ip_set_req_portmap_create *header = data;
-	struct ip_set_portmap *map = set->settype->header;
-
-	memset(map, 0, sizeof(struct ip_set_portmap));
-	map->first_ip = header->from;
-	map->last_ip = header->to;
-}
-
-static void
-portmap_printheader(struct set *set, unsigned options)
-{
-	struct ip_set_portmap *mysetdata = set->settype->header;
-
-	printf(" from: %s", port_tostring(mysetdata->first_ip, options));
-	printf(" to: %s\n", port_tostring(mysetdata->last_ip, options));
-}
-
-static inline void
-__portmap_printips_sorted(struct set *set, void *data,
-			  u_int32_t len UNUSED, unsigned options)
-{
-	struct ip_set_portmap *mysetdata = set->settype->header;
-	ip_set_ip_t addr = mysetdata->first_ip;
-
-	DP("%u -- %u", mysetdata->first_ip, mysetdata->last_ip);
-	while (addr <= mysetdata->last_ip) {
-		if (test_bit(addr - mysetdata->first_ip, data))
-			printf("%s\n", port_tostring(addr, options));
-		addr++;
-	}
-}
-
-static void
-portmap_printips_sorted(struct set *set, void *data,
-			u_int32_t len, unsigned options,
-			char dont_align)
-{
-	ip_set_ip_t *ip;
-	size_t offset = 0;
-	
-	if (dont_align)
-		return __portmap_printips_sorted(set, data, len, options);
-	
-	while (offset < len) {
-		ip = data + offset;
-		printf("%s\n", port_tostring(*ip, options));
-		offset += IPSET_ALIGN(sizeof(ip_set_ip_t));
-	}
-}
-
-static void
-portmap_saveheader(struct set *set, unsigned options)
-{
-	struct ip_set_portmap *mysetdata = set->settype->header;
-
-	printf("-N %s %s --from %s", 
-	       set->name,
-	       set->settype->typename,
-	       port_tostring(mysetdata->first_ip, options));
-	printf(" --to %s\n", 
-	       port_tostring(mysetdata->last_ip, options));
-}
-
-static inline void
-__portmap_saveips(struct set *set, void *data,
-		  u_int32_t len UNUSED, unsigned options)
-{
-	struct ip_set_portmap *mysetdata = set->settype->header;
-	ip_set_ip_t addr = mysetdata->first_ip;
-
-	while (addr <= mysetdata->last_ip) {
-		DP("addr: %lu, last_ip %lu", (long unsigned)addr, (long unsigned)mysetdata->last_ip);
-		if (test_bit(addr - mysetdata->first_ip, data))
-			printf("-A %s %s\n",
-			       set->name,
-			       port_tostring(addr, options));
-		addr++;
-	}
-}
-
-static void
-portmap_saveips(struct set *set, void *data,
-		u_int32_t len, unsigned options,
-		char dont_align)
-{
-	ip_set_ip_t *ip;
-	size_t offset = 0;
-	
-	if (dont_align)
-		return __portmap_saveips(set, data, len, options);
-	
-	while (offset < len) {
-		ip = data + offset;
-		printf("-A %s %s\n", set->name, port_tostring(*ip, options));
-		offset += IPSET_ALIGN(sizeof(ip_set_ip_t));
-	}
-}
-
-static void
-portmap_usage(void)
-{
-	printf
-	    ("-N set portmap --from PORT --to PORT\n"
-	     "-A set PORT\n"
-	     "-D set PORT\n"
-	     "-T set PORT\n");
-}
-
-static struct settype settype_portmap = {
-	.typename = SETTYPE_NAME,
-	.protocol_version = IP_SET_PROTOCOL_VERSION,
-
-	/* Create */
-	.create_size = sizeof(struct ip_set_req_portmap_create),
-	.create_init = portmap_create_init,
-	.create_parse = portmap_create_parse,
-	.create_final = portmap_create_final,
-	.create_opts = create_opts,
-
-	/* Add/del/test */
-	.adt_size = sizeof(struct ip_set_req_portmap),
-	.adt_parser = portmap_adt_parser,
-
-	/* Printing */
-	.header_size = sizeof(struct ip_set_portmap),
-	.initheader = portmap_initheader,
-	.printheader = portmap_printheader,
-	.printips = portmap_printips_sorted,
-	.printips_sorted = portmap_printips_sorted,
-	.saveheader = portmap_saveheader,
-	.saveips = portmap_saveips,
-	
-	.usage = portmap_usage,
-};
-
-CONSTRUCTOR(portmap)
-{
-	settype_register(&settype_portmap);
-
-}

extensions/ipset/ipset_setlist.c

@@ -1,229 +0,0 @@
-/* Copyright 2008 Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
- *
- * This program is free software; you can redistribute it and/or modify   
- * it under the terms of the GNU General Public License as published by   
- * the Free Software Foundation; either version 2 of the License, or      
- * (at your option) any later version.                                    
- *                                                                         
- * This program is distributed in the hope that it will be useful,        
- * but WITHOUT ANY WARRANTY; without even the implied warranty of         
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          
- * GNU General Public License for more details.                           
- *                                                                         
- * You should have received a copy of the GNU General Public License      
- * along with this program; if not, write to the Free Software            
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-
-#include "ip_set_setlist.h"
-#include "ipset.h"
-
-/* Initialize the create. */
-static void
-setlist_create_init(void *data)
-{
-	struct ip_set_req_setlist_create *mydata = data;
-	
-	mydata->size = 8;
-}
-
-/* Function which parses command options; returns true if it ate an option */
-static int
-setlist_create_parse(int c, char *argv[] UNUSED, void *data,
-		     unsigned *flags UNUSED)
-{
-	struct ip_set_req_setlist_create *mydata = data;
-	unsigned int size;
-	
-	switch (c) {
-	case '1':
-		if (string_to_number(optarg, 1, 255, &size))
-			exit_error(PARAMETER_PROBLEM,
-				   "Invalid size '%s specified: must be "
-				   "between 1-255", optarg);
-		mydata->size = size;
-		break;
-	default:
-		return 0;
-	}
-	return 1;
-}
-
-/* Final check; exit if not ok. */
-static void
-setlist_create_final(void *data UNUSED, unsigned int flags UNUSED)
-{
-}
-
-/* Create commandline options */
-static const struct option create_opts[] = {
-	{.name = "size",	.has_arg = required_argument,	.val = '1'},
-	{NULL},
-};
-
-static void
-check_setname(const char *name)
-{
-	if (strlen(name) > IP_SET_MAXNAMELEN - 1)
-		exit_error(PARAMETER_PROBLEM,
-			"Setname %s is longer than %d characters.",
-			name, IP_SET_MAXNAMELEN - 1);
-}
-
-/* Add, del, test parser */
-static ip_set_ip_t
-setlist_adt_parser(int cmd UNUSED, const char *arg, void *data)
-{
-	struct ip_set_req_setlist *mydata = data;
-	char *saved = ipset_strdup(arg);
-	char *ptr, *tmp = saved;
-	
-	DP("setlist: %p %p", arg, data);
-
-	ptr = strsep(&tmp, ",");
-	check_setname(ptr);
-	strcpy(mydata->name, ptr);
-	
-	if (!tmp) {
-		mydata->before = 0;
-		mydata->ref[0] = '\0';
-		return 1;
-	}
-	
-	ptr = strsep(&tmp, ",");
-	
-	if (tmp == NULL || !(strcmp(ptr, "before") == 0 || strcmp(ptr, "after") == 0))
-		exit_error(PARAMETER_PROBLEM,
-			"Syntax error, you must specify elements as setname,[before|after],setname");
-
-	check_setname(tmp);
-	strcpy(mydata->ref, tmp);
-	mydata->before = !strcmp(ptr, "before");
-
-	free(saved);
-
-	return 1;	
-}
-
-/*
- * Print and save
- */
-
-static void
-setlist_initheader(struct set *set, const void *data)
-{
-	const struct ip_set_req_setlist_create *header = data;
-	struct ip_set_setlist *map = set->settype->header;
-		
-	memset(map, 0, sizeof(struct ip_set_setlist));
-	map->size = header->size;
-}
-
-static void
-setlist_printheader(struct set *set, unsigned options UNUSED)
-{
-	struct ip_set_setlist *mysetdata = set->settype->header;
-
-	printf(" size: %u\n", mysetdata->size);
-}
-
-static void
-setlist_printips_sorted(struct set *set, void *data,
-			u_int32_t len UNUSED, unsigned options UNUSED,
-			char dont_align)
-{
-	struct ip_set_setlist *mysetdata = set->settype->header;
-	int i, asize;
-	ip_set_id_t *id;
-	struct set *elem;
-
-	asize = IPSET_VALIGN(sizeof(ip_set_id_t), dont_align);
-	for (i = 0; i < mysetdata->size; i++ ) {
-		DP("Try %u", i);
-		id = (ip_set_id_t *)(data + i * asize);
-		DP("Try %u, check", i);
-		if (*id == IP_SET_INVALID_ID)
-			return;
-		elem = set_find_byid(*id);
-		printf("%s\n", elem->name);
-	}
-}
-
-static void
-setlist_saveheader(struct set *set, unsigned options UNUSED)
-{
-	struct ip_set_setlist *mysetdata = set->settype->header;
-
-	printf("-N %s %s --size %u\n",
-	       set->name, set->settype->typename,
-	       mysetdata->size);
-}
-
-static void
-setlist_saveips(struct set *set, void *data,
-		u_int32_t len UNUSED, unsigned options UNUSED, char dont_align)
-{
-	struct ip_set_setlist *mysetdata = set->settype->header;
-	int i, asize;
-	ip_set_id_t *id;
-	struct set *elem;
-
-	asize = IPSET_VALIGN(sizeof(ip_set_id_t), dont_align);
-	for (i = 0; i < mysetdata->size; i++ ) {
-		id = (ip_set_id_t *)(data + i * asize);
-		if (*id == IP_SET_INVALID_ID)
-			return;
-		elem = set_find_byid(*id);
-		printf("-A %s %s\n", set->name, elem->name);
-	}
-}
-
-static void
-setlist_usage(void)
-{
-	printf
-	    ("-N set setlist --size size\n"
-	     "-A set setname[,before|after,setname]\n"
-	     "-D set setname\n"
-	     "-T set setname\n");
-}
-
-static struct settype settype_setlist = {
-	.typename = SETTYPE_NAME,
-	.protocol_version = IP_SET_PROTOCOL_VERSION,
-
-	/* Create */
-	.create_size = sizeof(struct ip_set_req_setlist_create),
-	.create_init = setlist_create_init,
-	.create_parse = setlist_create_parse,
-	.create_final = setlist_create_final,
-	.create_opts = create_opts,
-
-	/* Add/del/test */
-	.adt_size = sizeof(struct ip_set_req_setlist),
-	.adt_parser = setlist_adt_parser,
-
-	/* Printing */
-	.header_size = sizeof(struct ip_set_setlist),
-	.initheader = setlist_initheader,
-	.printheader = setlist_printheader,
-	.printips = setlist_printips_sorted,
-	.printips_sorted = setlist_printips_sorted,
-	.saveheader = setlist_saveheader,
-	.saveips = setlist_saveips,
-	
-	.usage = setlist_usage,
-};
-
-CONSTRUCTOR(setlist)
-{
-	settype_register(&settype_setlist);
-
-}

extensions/ipset/ipt_SET.c

@@ -1,138 +0,0 @@
-/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
- *                         Patrick Schaaf <bof@bof.de>
- *                         Martin Josefsson <gandalf@wlug.westbo.se>
- * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/* ipt_SET.c - netfilter target to manipulate IP sets */
-
-#include <linux/module.h>
-#include <linux/ip.h>
-#include <linux/skbuff.h>
-#include <linux/version.h>
-
-#include <linux/netfilter_ipv4.h>
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16)
-#include <linux/netfilter_ipv4/ip_tables.h>
-#define xt_register_target	ipt_register_target
-#define xt_unregister_target	ipt_unregister_target
-#define xt_target		ipt_target
-#define XT_CONTINUE		IPT_CONTINUE
-#else
-#include <linux/netfilter/x_tables.h>
-#endif
-#include "ipt_set.h"
-#include "../compat_xtables.h"
-
-static unsigned int
-target(struct sk_buff **pskb, const struct xt_action_param *par)
-{
-	const struct ipt_set_info_target *info = par->targinfo;
-
-	if (info->add_set.index != IP_SET_INVALID_ID)
-		ip_set_addip_kernel(info->add_set.index,
-				    *pskb,
-				    info->add_set.flags);
-	if (info->del_set.index != IP_SET_INVALID_ID)
-		ip_set_delip_kernel(info->del_set.index,
-				    *pskb,
-				    info->del_set.flags);
-
-	return XT_CONTINUE;
-}
-
-static int
-checkentry(const struct xt_tgchk_param *par)
-{
-	struct ipt_set_info_target *info = par->targinfo;
-	ip_set_id_t index;
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
-	if (targinfosize != IPT_ALIGN(sizeof(*info))) {
-		DP("bad target info size %u", targinfosize);
-		return -EINVAL;
-	}
-#endif
-
-	if (info->add_set.index != IP_SET_INVALID_ID) {
-		index = ip_set_get_byindex(info->add_set.index);
-		if (index == IP_SET_INVALID_ID) {
-			ip_set_printk("cannot find add_set index %u as target",
-				      info->add_set.index);
-			return -EINVAL;
-		}
-	}
-
-	if (info->del_set.index != IP_SET_INVALID_ID) {
-		index = ip_set_get_byindex(info->del_set.index);
-		if (index == IP_SET_INVALID_ID) {
-			ip_set_printk("cannot find del_set index %u as target",
-				      info->del_set.index);
-			return -EINVAL;
-		}
-	}
-	if (info->add_set.flags[IP_SET_MAX_BINDINGS] != 0
-	    || info->del_set.flags[IP_SET_MAX_BINDINGS] != 0) {
-		ip_set_printk("That's nasty!");
-		return -EINVAL;
-	}
-
-	return 0;
-}
-
-static void destroy(const struct xt_tgdtor_param *par)
-{
-	struct ipt_set_info_target *info = par->targinfo;
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
-	if (targetsize != IPT_ALIGN(sizeof(struct ipt_set_info_target))) {
-		ip_set_printk("invalid targetsize %d", targetsize);
-		return;
-	}
-#endif
-	if (info->add_set.index != IP_SET_INVALID_ID)
-		ip_set_put_byindex(info->add_set.index);
-	if (info->del_set.index != IP_SET_INVALID_ID)
-		ip_set_put_byindex(info->del_set.index);
-}
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
-static struct xt_target SET_target = {
-	.name 		= "SET",
-	.target 	= target,
-	.checkentry 	= checkentry,
-	.destroy 	= destroy,
-	.me 		= THIS_MODULE
-};
-#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17) */
-static struct xt_target SET_target = {
-	.name 		= "SET",
-	.family		= AF_INET,
-	.target 	= target,
-	.targetsize	= sizeof(struct ipt_set_info_target),
-	.checkentry 	= checkentry,
-	.destroy 	= destroy,
-	.me 		= THIS_MODULE
-};
-#endif
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
-MODULE_DESCRIPTION("iptables IP set target module");
-
-static int __init ipt_SET_init(void)
-{
-	return xt_register_target(&SET_target);
-}
-
-static void __exit ipt_SET_fini(void)
-{
-	xt_unregister_target(&SET_target);
-}
-
-module_init(ipt_SET_init);
-module_exit(ipt_SET_fini);

extensions/ipset/ipt_set.c

@@ -1,126 +0,0 @@
-/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
- *                         Patrick Schaaf <bof@bof.de>
- *                         Martin Josefsson <gandalf@wlug.westbo.se>
- * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/* Kernel module to match an IP set. */
-
-#include <linux/module.h>
-#include <linux/ip.h>
-#include <linux/skbuff.h>
-#include <linux/version.h>
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,16)
-#include <linux/netfilter_ipv4/ip_tables.h>
-#define xt_register_match	ipt_register_match
-#define xt_unregister_match	ipt_unregister_match
-#define xt_match		ipt_match
-#else
-#include <linux/netfilter/x_tables.h>
-#endif
-#include "ip_set.h"
-#include "ipt_set.h"
-#include "../compat_xtables.h"
-
-static inline int
-match_set(const struct ipt_set_info *info,
-	  const struct sk_buff *skb,
-	  int inv)
-{	
-	if (ip_set_testip_kernel(info->index, skb, info->flags))
-		inv = !inv;
-	return inv;
-}
-
-static bool
-match(const struct sk_buff *skb, struct xt_action_param *par)
-{
-	const struct ipt_set_info_match *info = par->matchinfo;
-		
-	return match_set(&info->match_set,
-			 skb,
-			 info->match_set.flags[0] & IPSET_MATCH_INV);
-}
-
-static int
-checkentry(const struct xt_mtchk_param *par)
-{
-	struct ipt_set_info_match *info = par->matchinfo;
-	ip_set_id_t index;
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
-	if (matchsize != IPT_ALIGN(sizeof(struct ipt_set_info_match))) {
-		ip_set_printk("invalid matchsize %d", matchsize);
-		return -EINVAL;
-	}
-#endif
-
-	index = ip_set_get_byindex(info->match_set.index);
-		
-	if (index == IP_SET_INVALID_ID) {
-		ip_set_printk("Cannot find set indentified by id %u to match",
-			      info->match_set.index);
-		return -ENOENT;
-	}
-	if (info->match_set.flags[IP_SET_MAX_BINDINGS] != 0) {
-		ip_set_printk("That's nasty!");
-		return -EINVAL;
-	}
-
-	return 0;
-}
-
-static void destroy(const struct xt_mtdtor_param *par)
-{
-	struct ipt_set_info_match *info = par->matchinfo;
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
-	if (matchsize != IPT_ALIGN(sizeof(struct ipt_set_info_match))) {
-		ip_set_printk("invalid matchsize %d", matchsize);
-		return;
-	}
-#endif
-	ip_set_put_byindex(info->match_set.index);
-}
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17)
-static struct xt_match set_match = {
-	.name		= "set",
-	.match		= &match,
-	.checkentry	= &checkentry,
-	.destroy	= &destroy,
-	.me		= THIS_MODULE
-};
-#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,17) */
-static struct xt_match set_match = {
-	.name		= "set",
-	.family		= AF_INET,
-	.match		= &match,
-	.matchsize	= sizeof(struct ipt_set_info_match),
-	.checkentry	= &checkentry,
-	.destroy	= &destroy,
-	.me		= THIS_MODULE
-};
-#endif
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
-MODULE_DESCRIPTION("iptables IP set match module");
-
-static int __init ipt_ipset_init(void)
-{
-	return xt_register_match(&set_match);
-}
-
-static void __exit ipt_ipset_fini(void)
-{
-	xt_unregister_match(&set_match);
-}
-
-module_init(ipt_ipset_init);
-module_exit(ipt_ipset_fini);

extensions/ipset/ipt_set.h

@@ -1,21 +0,0 @@
-#ifndef _IPT_SET_H
-#define _IPT_SET_H
-
-#include "ip_set.h"
-
-struct ipt_set_info {
-	ip_set_id_t index;
-	u_int32_t flags[IP_SET_MAX_BINDINGS + 1];
-};
-
-/* match info */
-struct ipt_set_info_match {
-	struct ipt_set_info match_set;
-};
-
-struct ipt_set_info_target {
-	struct ipt_set_info add_set;
-	struct ipt_set_info del_set;
-};
-
-#endif /*_IPT_SET_H*/

extensions/libxt_CHAOS.c

@@ -71,10 +71,10 @@ static void chaos_tg_print(const void *ip,
 
 	switch (info->variant) {
 	case XTCHAOS_DELUDE:
-		printf("DELUDE ");
+		printf(" DELUDE ");
 		break;
 	case XTCHAOS_TARPIT:
-		printf("TARPIT ");
+		printf(" TARPIT ");
 		break;
 	}
 }
@@ -85,10 +85,10 @@ static void chaos_tg_save(const void *ip, const struct xt_entry_target *target)
 
 	switch (info->variant) {
 	case XTCHAOS_DELUDE:
-		printf("--delude ");
+		printf(" --delude ");
 		break;
 	case XTCHAOS_TARPIT:
-		printf("--tarpit ");
+		printf(" --tarpit ");
 		break;
 	}
 }

extensions/libxt_CHECKSUM.c

@@ -62,7 +62,7 @@ static void CHECKSUM_print(const void *ip, const struct xt_entry_target *target,
 	printf("CHECKSUM ");
 
 	if (einfo->operation & XT_CHECKSUM_OP_FILL)
-		printf("fill ");
+		printf(" fill ");
 }
 
 static void CHECKSUM_save(const void *ip, const struct xt_entry_target *target)
@@ -71,7 +71,7 @@ static void CHECKSUM_save(const void *ip, const struct xt_entry_target *target)
 		(const struct xt_CHECKSUM_info *)target->data;
 
 	if (einfo->operation & XT_CHECKSUM_OP_FILL)
-		printf("--checksum-fill ");
+		printf(" --checksum-fill ");
 }
 
 static struct xtables_target checksum_tg_reg = {

extensions/libxt_DHCPMAC.c

@@ -66,7 +66,7 @@ static void dhcpmac_tg_print(const void *ip,
 {
 	const struct dhcpmac_info *info = (void *)target->data;
 
-	printf("DHCPMAC %s" DH_MAC_FMT "/%u ",
+	printf(" DHCPMAC %s" DH_MAC_FMT "/%u ",
 	       info->invert ? "!" : "", DH_MAC_HEX(info->addr), info->mask);
 }
 
@@ -76,8 +76,8 @@ static void dhcpmac_tg_save(const void *ip,
 	const struct dhcpmac_info *info = (const void *)target->data;
 
 	if (info->invert)
-		printf("! ");
-	printf("--set-mac " DH_MAC_FMT "/%u ",
+		printf(" !");
+	printf(" --set-mac " DH_MAC_FMT "/%u ",
 	       DH_MAC_HEX(info->addr), info->mask);
 }
 

extensions/libxt_DNETMAP.c

@@ -0,0 +1,278 @@
+/* Shared library add-on to iptables to add DNETMAP support.
+ * (C) 2010 Marek Kierdelewicz <marek@koba.pl>
+ *
+ * uses some code from libipt_NETMAP by:
+ * Svenning Soerensen <svenning@post5.tele.dk>
+ */
+
+#include <stdio.h>
+#include <netdb.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <xtables.h>
+#include <linux/netfilter/nf_nat.h>
+#include "xt_DNETMAP.h"
+
+#define MODULENAME "DNETMAP"
+
+static const struct option DNETMAP_opts[] = {
+	{"prefix", 1, NULL, 'p'},
+	{"reuse", 0, NULL, 'r'},
+	{"ttl", 1, NULL, 't'},
+	{"static", 0, NULL, 's'},
+	{"persistent", 0, NULL, 'e'},
+	{.name = NULL}
+};
+
+static void DNETMAP_help(void)
+{
+	printf(MODULENAME " target options:\n"
+	       "  --%s address[/mask]\n"
+	       "    Network subnet to map to. If not specified, all existing prefixes are used.\n"
+	       "  --%s\n"
+	       "    Reuse entry for given prenat-ip from any prefix despite bindings ttl < 0.\n"
+	       "  --%s seconds\n"
+	       "    Regenerate bindings ttl value to seconds. If negative value is specified,\n"
+	       "    bindings ttl is kept unchanged. If not specified then default ttl value (600s)\n"
+		"    is used\n"
+		"  --%s\n"
+		"    Match only static entries for this rule. Dynamic entries won't be created.\n"
+		"  --%s\n"
+		"    Set prefix persistent. It won't be removed after deleting last iptables rule.\n\n",
+		DNETMAP_opts[0].name, DNETMAP_opts[1].name,
+		DNETMAP_opts[2].name, DNETMAP_opts[3].name,
+		DNETMAP_opts[4].name);
+}
+
+static u_int32_t bits2netmask(int bits)
+{
+	u_int32_t netmask, bm;
+
+	if (bits >= 32 || bits < 0)
+		return ~0;
+	for (netmask = 0, bm = 0x80000000; bits; bits--, bm >>= 1)
+		netmask |= bm;
+	return htonl(netmask);
+}
+
+static int netmask2bits(u_int32_t netmask)
+{
+	u_int32_t bm;
+	int bits;
+
+	netmask = ntohl(netmask);
+	for (bits = 0, bm = 0x80000000; netmask & bm; netmask <<= 1)
+		bits++;
+	if (netmask)
+		return -1;	/* holes in netmask */
+	return bits;
+}
+
+static void DNETMAP_init(struct xt_entry_target *t)
+{
+	struct xt_DNETMAP_tginfo *tginfo = (void *)&t->data;
+	struct nf_nat_ipv4_multi_range_compat *mr = &tginfo->prefix;
+
+	/* Actually, it's 0, but it's ignored at the moment. */
+	mr->rangesize = 1;
+	tginfo->ttl = 0;
+	tginfo->flags = 0;
+}
+
+/* Parses network address */
+static void parse_prefix(char *arg, struct nf_nat_ipv4_range *range)
+{
+	char *slash;
+	const struct in_addr *ip;
+	u_int32_t netmask;
+	unsigned int bits;
+
+	range->flags |= NF_NAT_RANGE_MAP_IPS;
+	slash = strchr(arg, '/');
+	if (slash)
+		*slash = '\0';
+
+	ip = xtables_numeric_to_ipaddr(arg);
+	if (ip == NULL)
+		xtables_error(PARAMETER_PROBLEM, "Bad IP address \"%s\"\n",
+			      arg);
+	range->min_ip = ip->s_addr;
+	if (slash) {
+		if (strchr(slash + 1, '.')) {
+			ip = xtables_numeric_to_ipmask(slash + 1);
+			if (ip == NULL)
+				xtables_error(PARAMETER_PROBLEM,
+					      "Bad netmask \"%s\"\n",
+					      slash + 1);
+			netmask = ip->s_addr;
+		} else {
+			if (!xtables_strtoui(slash + 1, NULL, &bits, 0, 32))
+				xtables_error(PARAMETER_PROBLEM,
+					      "Bad netmask \"%s\"\n",
+					      slash + 1);
+			netmask = bits2netmask(bits);
+		}
+		/* Don't allow /0 (/1 is probably insane, too) */
+		if (netmask == 0)
+			xtables_error(PARAMETER_PROBLEM, "Netmask needed\n");
+		/* Mask should be <= then /16 */
+		if (bits < 16)
+			xtables_error(PARAMETER_PROBLEM,
+				      "Max netmask size is /16\n");
+	} else
+		netmask = ~0;
+
+	if (range->min_ip & ~netmask) {
+		if (slash)
+			*slash = '/';
+		xtables_error(PARAMETER_PROBLEM, "Bad network address \"%s\"\n",
+			      arg);
+	}
+	range->max_ip = range->min_ip | ~netmask;
+}
+
+static int DNETMAP_parse(int c, char **argv, int invert, unsigned int *flags,
+			 const void *entry, struct xt_entry_target **target)
+{
+	struct xt_DNETMAP_tginfo *tginfo = (void *)(*target)->data;
+	struct nf_nat_ipv4_multi_range_compat *mr = &tginfo->prefix;
+	char *end;
+
+	switch (c) {
+	case 'p':
+		xtables_param_act(XTF_ONLY_ONCE, MODULENAME, "--prefix",
+				  *flags & XT_DNETMAP_PREFIX);
+		xtables_param_act(XTF_NO_INVERT, MODULENAME, "--prefix",
+				  invert);
+
+		/* TO-DO use xtables_ipparse_any instead? */
+		parse_prefix(optarg, &mr->range[0]);
+		*flags |= XT_DNETMAP_PREFIX;
+		tginfo->flags |= XT_DNETMAP_PREFIX;
+		return 1;
+	case 'r':
+		xtables_param_act(XTF_ONLY_ONCE, MODULENAME, "--reuse",
+				  *flags & XT_DNETMAP_REUSE);
+		xtables_param_act(XTF_NO_INVERT, MODULENAME, "--reuse", invert);
+		*flags |= XT_DNETMAP_REUSE;
+		tginfo->flags |= XT_DNETMAP_REUSE;
+		return 1;
+	case 's':
+		xtables_param_act(XTF_ONLY_ONCE, MODULENAME, "--static",
+				  *flags & XT_DNETMAP_STATIC);
+		xtables_param_act(XTF_NO_INVERT, MODULENAME, "--static", invert);
+		*flags |= XT_DNETMAP_STATIC;
+		tginfo->flags |= XT_DNETMAP_STATIC;
+		return 1;
+	case 'e':
+		xtables_param_act(XTF_ONLY_ONCE, MODULENAME, "--persistent",
+				  *flags & XT_DNETMAP_PERSISTENT);
+		xtables_param_act(XTF_NO_INVERT, MODULENAME, "--persistent", invert);
+		*flags |= XT_DNETMAP_PERSISTENT;
+		tginfo->flags |= XT_DNETMAP_PERSISTENT;
+		return 1;
+	case 't':
+		xtables_param_act(XTF_ONLY_ONCE, MODULENAME, "--ttl",
+				  *flags & XT_DNETMAP_TTL);
+		xtables_param_act(XTF_NO_INVERT, MODULENAME, "--ttl", invert);
+		*flags |= XT_DNETMAP_TTL;
+		tginfo->flags |= XT_DNETMAP_TTL;
+		tginfo->ttl = strtol(optarg, &end, 10);
+		if (*end != '\0')
+			return 0;
+		return 1;
+	default:
+		return 0;
+	}
+}
+
+static void DNETMAP_print_addr(const void *ip,
+			       const struct xt_entry_target *target,
+			       int numeric)
+{
+	struct xt_DNETMAP_tginfo *tginfo = (void *)&target->data;
+	const struct nf_nat_ipv4_multi_range_compat *mr = &tginfo->prefix;
+	const struct nf_nat_ipv4_range *r = &mr->range[0];
+	struct in_addr a;
+	int bits;
+
+	a.s_addr = r->min_ip;
+	printf("%s", xtables_ipaddr_to_numeric(&a));
+	a.s_addr = ~(r->min_ip ^ r->max_ip);
+	bits = netmask2bits(a.s_addr);
+	if (bits < 0)
+		printf("/%s", xtables_ipaddr_to_numeric(&a));
+	else
+		printf("/%d", bits);
+}
+
+static void DNETMAP_print(const void *ip, const struct xt_entry_target *target,
+			  int numeric)
+{
+	struct xt_DNETMAP_tginfo *tginfo = (void *)&target->data;
+	const __u8 *flags = &tginfo->flags;
+
+	printf(" prefix ");
+	if (*flags & XT_DNETMAP_PREFIX)
+		DNETMAP_print_addr(ip, target, numeric);
+	else
+		printf("any");
+
+	if (*flags & XT_DNETMAP_REUSE)
+		printf(" reuse");
+
+	if (*flags & XT_DNETMAP_STATIC)
+		printf(" static");
+
+	if (*flags & XT_DNETMAP_PERSISTENT)
+		printf(" persistent");
+
+	if (*flags & XT_DNETMAP_TTL)
+		printf(" ttl %i", tginfo->ttl);
+	else
+		printf(" ttl default");
+}
+
+static void DNETMAP_save(const void *ip, const struct xt_entry_target *target)
+{
+	struct xt_DNETMAP_tginfo *tginfo = (void *)&target->data;
+	const __u8 *flags = &tginfo->flags;
+
+	if (*flags & XT_DNETMAP_PREFIX) {
+		printf(" --%s ", DNETMAP_opts[0].name);
+		DNETMAP_print_addr(ip, target, 0);
+	}
+
+	if (*flags & XT_DNETMAP_REUSE)
+		printf(" --reuse ");
+
+	if (*flags & XT_DNETMAP_STATIC)
+		printf(" --static ");
+
+	if (*flags & XT_DNETMAP_PERSISTENT)
+		printf(" --persistent ");
+
+	/* ommited because default value can change as kernel mod param */
+	if (*flags & XT_DNETMAP_TTL)
+		printf(" --ttl %i ", tginfo->ttl);
+}
+
+static struct xtables_target dnetmap_tg_reg = {
+	.name          = MODULENAME,
+	.version       = XTABLES_VERSION,
+	.family        = NFPROTO_IPV4,
+	.size          = XT_ALIGN(sizeof(struct xt_DNETMAP_tginfo)),
+	.userspacesize = XT_ALIGN(sizeof(struct xt_DNETMAP_tginfo)),
+	.help          = DNETMAP_help,
+	.init          = DNETMAP_init,
+	.parse         = DNETMAP_parse,
+	.print         = DNETMAP_print,
+	.save          = DNETMAP_save,
+	.extra_opts    = DNETMAP_opts,
+};
+
+static void _init(void)
+{
+	xtables_register_target(&dnetmap_tg_reg);
+}

extensions/libxt_DNETMAP.man

@@ -0,0 +1,172 @@
+The \fBDNETMAP\fR target allows dynamic two-way 1:1 mapping of IPv4 subnets.
+Single rule can map private subnet to shorter public subnet creating and
+maintaining unambigeous private-public ip bindings. Second rule can be used to
+map new flows to private subnet according to maintained bindings. Target allows
+efficient public IPv4 space usage and unambigeous NAT at the same time.
+
+Target can be used only in \fBnat\fR table in \fBPOSTROUTING\fR or \fBOUTPUT\fR
+chains for SNAT and in \fBPREROUTING\fR for DNAT. Only flows directed to bound
+IPs will be DNATed. Packet continues chain traversal if there is no free
+postnat-ip to be assigned to prenat-ip. Default binding \fBttl\fR is \fI10
+minutes\fR and can be changed using \fBdefault_ttl\fR module option. Default ip
+hash size is 256 and can be changed using \fBhash_size\fR module option.
+
+.TP
+\fB\-\-prefix\fR \fIaddr\fR\fB/\fR\fImask\fR
+Network subnet to map to. If not specified, all existing prefixes are used.
+.TP
+\fB\-\-reuse\fR
+Reuse entry for given prenat-ip from any prefix despite bindings ttl < 0.
+.TP
+\fB\-\-persistent\fR
+Set prefix persistent. It won't be removed after deleting last iptables rule.
+Option is effective only in the first rule for a given prefix. If you
+need to change persistency for existing prefix, please use proc interface
+described below.
+.TP
+\fB\-\-static\fR
+Don't create dynamic mappings using this rule. Use static mappings only. Note
+that you need to create static mappings via proc interface for this rule with
+this option to have any effect.
+.TP
+\fB\-\-ttl\fR \fIseconds\fR
+Regenerate bindings ttl value to \fIseconds\fR. If negative value is specified,
+bindings ttl is kept unchanged. If not specified then default ttl value (600s)
+is used.
+.PP
+\fB* /proc interface\fR
+
+Module creates following entries for each new specified subnet:
+.TP
+\fB/proc/net/xt_DNETMAP/\fR\fIsubnet\fR\fB_\fR\fImask\fR
+Contains binding table for subnet/mask. Each line contains \fBprenat-ip\fR,
+\fBpostnat-ip\fR,\fBttl\fR (seconds till entry times out), \fBlasthit\fR (last
+entry hit in seconds relative to system boot time). Please note that \fBttl\fR
+and \fBlasthit\fR entries contain \fBS\fR in case of static binding.
+.TP
+\fB/proc/net/xt_DNETMAP/\fR\fIsubnet\fR\fB_\fR\fImask\fR\fB_stat\fR
+Contains statistics for given subnet/mask. Line contains contains four
+numerical values separated by spaces. First one is number of currently used
+dynamic addresses (bindings with negative ttl excluded), second one is number
+static assignments, third one is number of all usable addresses in subnet and
+the fourth one is mean \fBttl\fR value for all active entries. If prefix has
+persistent flag set it'll be noted as fifth entry.
+.PP
+Following write operations are supported via proc interface:
+.TP
+echo "+\fIprenatIP\fR:\fIpostnatIP\fR" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
+Adds static binding between prenatIP nad postnatIP. If postnatIP is already
+bound, previous binding will be timedout immediatelly. Static binding is never
+timedout.
+.TP
+echo "-\fIIP\fR" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
+Removes binding with \fIIP\fR as prenat or postnat address. If removed binding
+is currently static, it'll make entry available for dynamic allocation.
+.TP
+echo "+persistent" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
+Sets persistent flag for prefix. It's usefull if you don't want bindings to get
+flushed when firewall is restarted. You can check if prefix is persistent by
+printing \fB/proc/net/xt_DNETMAP/\fR\fIsubnet\fR\fB_\fR\fImask\fR\fB_stat\fR
+contents.
+.TP
+echo "-persistent" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
+Unsets persistent flag for prefix. In this mode prefix will be deleted if the
+last iptables rule for that prefix is removed.
+.TP
+echo "flush" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
+Flushes all bindings for specific prefix. All static entries are also flushed
+and are available for dynamic bindings.
+.PP
+Note! Entries are removed if the last iptables rule for a specific prefix is
+deleted unless there's persistent flag set.
+.PP
+
+\fB* Logging\fR
+
+Module logs binding add/timeout events to klog. This behaviour can be disabled
+using \fBdisable_log\fR module parameter.
+
+\fB* Examples\fR
+
+\fB1.\fR Map subnet 192.168.0.0/24 to subnets 20.0.0.0/26. SNAT only:
+
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
+
+Active hosts from 192.168.0.0/24 subnet are mapped to 20.0.0.0/26. If packet
+from not yet bound prenat-ip hits the rule and there are no free or timed-out
+(ttl<0) entries in prefix 20.0.0.0/28, then notice is logged to klog and chain
+traversal continues. If packet from already bound prenat-ip hits the rule,
+bindings ttl value is regenerated to default_ttl and SNAT is performed.
+
+\fB2.\fR Use of \fB\-\-reuse\fR and \fB\-\-ttl\fR switches, multiple rule
+interaction:
+
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix
+20.0.0.0/26 --reuse --ttl 200
+
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 30.0.0.0/26
+
+Active hosts from 192.168.0.0/24 subnet are mapped to 20.0.0.0/26 with ttl =
+200 seconds. If there are no free addresses in first prefix the next one
+(30.0.0.0/26) is used with default ttl. It's important to note that the first
+rule SNATs all flows whose source IP is already actively (ttl>0) bound to ANY
+prefix. Parameter \fB\-\-reuse\fR makes this functionality work even for
+inactive (ttl<0) entries.
+
+If both subnets are exhaused, then chain traversal continues.
+
+\fB3.\fR Map 192.168.0.0/24 to subnets 20.0.0.0/26 bidirectional way:
+
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
+
+iptables -t nat -A PREROUTING -j DNETMAP
+
+If host 192.168.0.10 generates some traffic, it gets bound to first free IP in
+subnet - 20.0.0.0. Now any traffic directed to 20.0.0.0 gets DNATed to
+192.168.0.10 as long as there's an active (ttl>0) binding. There's no need to
+specify \fB\-\-prefix\fR parameter in PREROUTING rule, because this way it DNATs
+traffic to all active prefixes. You could specify prefix it you'd like to make
+DNAT work for specific prefix only.
+
+\fB4.\fR Map 192.168.0.0/24 to subnets 20.0.0.0/26 with static assignments only:
+
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
+--static
+
+echo "+192.168.0.10:20.0.0.1" > /proc/net/xt_DNETMAP/20.0.0.0_26
+.br
+echo "+192.168.0.11:20.0.0.2" > /proc/net/xt_DNETMAP/20.0.0.0_26
+.br
+echo "+192.168.0.51:20.0.0.3" > /proc/net/xt_DNETMAP/20.0.0.0_26
+
+This configuration will allow only preconfigured static bindings to work due to
+\fBstatic\fR rule option. Without this flag dynamic bindings would be created
+using non-static entries.
+
+\fB5.\fR Persistent prefix:
+
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
+--persistent
+.br
+\fBor\fR
+.br
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
+.br
+echo "+persistent" > /proc/net/xt_DNETMAP/20.0.0.0_26
+
+Now we can check persistent flag of the prefix:
+.br
+cat /proc/net/xt_DNETMAP/20.0.0.0_26
+.br
+0 0 64 0 \fBpersistent\fR
+
+Flush iptables nat table and see that prefix is still in existence:
+.br
+iptables -F -t nat
+.br
+ls -l /proc/net/xt_DNETMAP
+.br
+-rw-r--r-- 1 root root 0 06-10 09:01 20.0.0.0_26
+.br
+-rw-r--r-- 1 root root 0 06-10 09:01 20.0.0.0_26_stat
+.

extensions/libxt_IPMARK.c

@@ -119,16 +119,16 @@ ipmark_tg_print(const void *entry, const struct xt_entry_target *target,
 	const struct xt_ipmark_tginfo *info = (const void *)target->data;
 
 	if (info->selector == XT_IPMARK_SRC)
-		printf("IPMARK src ip ");
+		printf(" IPMARK src ip ");
 	else
-		printf("IPMARK dst ip ");
+		printf(" IPMARK dst ip ");
 
 	if (info->shift != 0)
-		printf("shift %u ", (unsigned int)info->shift);
+		printf(" shift %u ", (unsigned int)info->shift);
 	if (info->andmask != ~0U)
-		printf("and 0x%x ", (unsigned int)info->andmask);
+		printf(" and 0x%x ", (unsigned int)info->andmask);
 	if (info->ormask != 0)
-		printf("or 0x%x ", (unsigned int)info->ormask);
+		printf(" or 0x%x ", (unsigned int)info->ormask);
 }
 
 static void
@@ -137,16 +137,16 @@ ipmark_tg_save(const void *entry, const struct xt_entry_target *target)
 	const struct xt_ipmark_tginfo *info = (const void *)target->data;
 
 	if (info->selector == XT_IPMARK_SRC)
-		printf("--addr src ");
+		printf(" --addr src ");
 	else
-		printf("--addr dst ");
+		printf(" --addr dst ");
 
 	if (info->shift != 0)
-		printf("--shift %u ", (unsigned int)info->shift);
+		printf(" --shift %u ", (unsigned int)info->shift);
 	if (info->andmask != ~0U)
-		printf("--and-mask 0x%x ", (unsigned int)info->andmask);
+		printf(" --and-mask 0x%x ", (unsigned int)info->andmask);
 	if (info->ormask != 0)
-		printf("--or-mask 0x%x ", (unsigned int)info->ormask);
+		printf(" --or-mask 0x%x ", (unsigned int)info->ormask);
 }
 
 static struct xtables_target ipmark_tg_reg = {

extensions/libxt_LOGMARK.c

@@ -83,7 +83,7 @@ logmark_tg_print(const void *ip, const struct xt_entry_target *target,
 {
 	const struct xt_logmark_tginfo *info = (void *)target->data;
 
-	printf("LOGMARK level %u prefix \"%s\" ", info->level, info->prefix);
+	printf(" LOGMARK level %u prefix \"%s\" ", info->level, info->prefix);
 }
 
 static void
@@ -92,9 +92,9 @@ logmark_tg_save(const void *ip, const struct xt_entry_target *target)
 	const struct xt_logmark_tginfo *info = (void *)target->data;
 
 	if (info->level != 4)
-		printf("--log-level %u ", info->level);
+		printf(" --log-level %u ", info->level);
 	if (*info->prefix != '\0')
-		printf("--log-prefix \"%s\" ", info->prefix);
+		printf(" --log-prefix \"%s\" ", info->prefix);
 }
 
 static struct xtables_target logmark_tg_reg = {

extensions/libxt_RAWDNAT.c

@@ -110,10 +110,10 @@ rawdnat_tg4_print(const void *entry, const struct xt_entry_target *target,
 	const struct xt_rawnat_tginfo *info = (const void *)target->data;
 
 	if (!numeric && info->mask == 32)
-		printf("to-destination %s ",
+		printf(" to-destination %s ",
 		       xtables_ipaddr_to_anyname(&info->addr.in));
 	else
-		printf("to-destination %s/%u ",
+		printf(" to-destination %s/%u ",
 		       xtables_ipaddr_to_numeric(&info->addr.in), info->mask);
 }
 
@@ -124,10 +124,10 @@ rawdnat_tg6_print(const void *entry, const struct xt_entry_target *target,
 	const struct xt_rawnat_tginfo *info = (const void *)target->data;
 
 	if (!numeric && info->mask == 128)
-		printf("to-destination %s ",
+		printf(" to-destination %s ",
 		       xtables_ip6addr_to_anyname(&info->addr.in6));
 	else
-		printf("to-destination %s/%u ",
+		printf(" to-destination %s/%u ",
 		       xtables_ip6addr_to_numeric(&info->addr.in6), info->mask);
 }
 
@@ -136,7 +136,7 @@ rawdnat_tg4_save(const void *entry, const struct xt_entry_target *target)
 {
 	const struct xt_rawnat_tginfo *info = (const void *)target->data;
 
-	printf("--to-destination %s/%u ",
+	printf(" --to-destination %s/%u ",
 	       xtables_ipaddr_to_numeric(&info->addr.in),
 	       info->mask);
 }
@@ -146,43 +146,44 @@ rawdnat_tg6_save(const void *entry, const struct xt_entry_target *target)
 {
 	const struct xt_rawnat_tginfo *info = (const void *)target->data;
 
-	printf("--to-destination %s/%u ",
+	printf(" --to-destination %s/%u ",
 	       xtables_ip6addr_to_numeric(&info->addr.in6),
 	       info->mask);
 }
 
-static struct xtables_target rawdnat_tg4_reg = {
-	.version       = XTABLES_VERSION,
-	.name          = "RAWDNAT",
-	.revision      = 0,
-	.family        = NFPROTO_IPV4,
-	.size          = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
-	.userspacesize = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
-	.help          = rawdnat_tg_help,
-	.parse         = rawdnat_tg4_parse,
-	.final_check   = rawdnat_tg_check,
-	.print         = rawdnat_tg4_print,
-	.save          = rawdnat_tg4_save,
-	.extra_opts    = rawdnat_tg_opts,
-};
-
-static struct xtables_target rawdnat_tg6_reg = {
-	.version       = XTABLES_VERSION,
-	.name          = "RAWDNAT",
-	.revision      = 0,
-	.family        = NFPROTO_IPV6,
-	.size          = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
-	.userspacesize = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
-	.help          = rawdnat_tg_help,
-	.parse         = rawdnat_tg6_parse,
-	.final_check   = rawdnat_tg_check,
-	.print         = rawdnat_tg6_print,
-	.save          = rawdnat_tg6_save,
-	.extra_opts    = rawdnat_tg_opts,
+static struct xtables_target rawdnat_tg_reg[] = {
+	{
+		.version       = XTABLES_VERSION,
+		.name          = "RAWDNAT",
+		.revision      = 0,
+		.family        = NFPROTO_IPV4,
+		.size          = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.userspacesize = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.help          = rawdnat_tg_help,
+		.parse         = rawdnat_tg4_parse,
+		.final_check   = rawdnat_tg_check,
+		.print         = rawdnat_tg4_print,
+		.save          = rawdnat_tg4_save,
+		.extra_opts    = rawdnat_tg_opts,
+	},
+	{
+		.version       = XTABLES_VERSION,
+		.name          = "RAWDNAT",
+		.revision      = 0,
+		.family        = NFPROTO_IPV6,
+		.size          = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.userspacesize = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.help          = rawdnat_tg_help,
+		.parse         = rawdnat_tg6_parse,
+		.final_check   = rawdnat_tg_check,
+		.print         = rawdnat_tg6_print,
+		.save          = rawdnat_tg6_save,
+		.extra_opts    = rawdnat_tg_opts,
+	},
 };
 
 static void _init(void)
 {
-	xtables_register_target(&rawdnat_tg4_reg);
-	xtables_register_target(&rawdnat_tg6_reg);
+	xtables_register_targets(rawdnat_tg_reg,
+		sizeof(rawdnat_tg_reg) / sizeof(*rawdnat_tg_reg));
 }

extensions/libxt_RAWSNAT.c

@@ -110,10 +110,10 @@ rawsnat_tg4_print(const void *entry, const struct xt_entry_target *target,
 	const struct xt_rawnat_tginfo *info = (const void *)target->data;
 
 	if (!numeric && info->mask == 32)
-		printf("to-source %s ",
+		printf(" to-source %s ",
 		       xtables_ipaddr_to_anyname(&info->addr.in));
 	else
-		printf("to-source %s/%u ",
+		printf(" to-source %s/%u ",
 		       xtables_ipaddr_to_numeric(&info->addr.in), info->mask);
 }
 
@@ -124,10 +124,10 @@ rawsnat_tg6_print(const void *entry, const struct xt_entry_target *target,
 	const struct xt_rawnat_tginfo *info = (const void *)target->data;
 
 	if (!numeric && info->mask == 128)
-		printf("to-source %s ",
+		printf(" to-source %s ",
 		       xtables_ip6addr_to_anyname(&info->addr.in6));
 	else
-		printf("to-source %s/%u ",
+		printf(" to-source %s/%u ",
 		       xtables_ip6addr_to_numeric(&info->addr.in6), info->mask);
 }
 
@@ -136,7 +136,7 @@ rawsnat_tg4_save(const void *entry, const struct xt_entry_target *target)
 {
 	const struct xt_rawnat_tginfo *info = (const void *)target->data;
 
-	printf("--to-source %s/%u ",
+	printf(" --to-source %s/%u ",
 	       xtables_ipaddr_to_numeric(&info->addr.in),
 	       info->mask);
 }
@@ -146,43 +146,44 @@ rawsnat_tg6_save(const void *entry, const struct xt_entry_target *target)
 {
 	const struct xt_rawnat_tginfo *info = (const void *)target->data;
 
-	printf("--to-source %s/%u ",
+	printf(" --to-source %s/%u ",
 	       xtables_ip6addr_to_numeric(&info->addr.in6),
 	       info->mask);
 }
 
-static struct xtables_target rawsnat_tg4_reg = {
-	.version       = XTABLES_VERSION,
-	.name          = "RAWSNAT",
-	.revision      = 0,
-	.family        = NFPROTO_IPV4,
-	.size          = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
-	.userspacesize = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
-	.help          = rawsnat_tg_help,
-	.parse         = rawsnat_tg4_parse,
-	.final_check   = rawsnat_tg_check,
-	.print         = rawsnat_tg4_print,
-	.save          = rawsnat_tg4_save,
-	.extra_opts    = rawsnat_tg_opts,
-};
-
-static struct xtables_target rawsnat_tg6_reg = {
-	.version       = XTABLES_VERSION,
-	.name          = "RAWSNAT",
-	.revision      = 0,
-	.family        = NFPROTO_IPV6,
-	.size          = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
-	.userspacesize = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
-	.help          = rawsnat_tg_help,
-	.parse         = rawsnat_tg6_parse,
-	.final_check   = rawsnat_tg_check,
-	.print         = rawsnat_tg6_print,
-	.save          = rawsnat_tg6_save,
-	.extra_opts    = rawsnat_tg_opts,
+static struct xtables_target rawsnat_tg_reg[] = {
+	{
+		.version       = XTABLES_VERSION,
+		.name          = "RAWSNAT",
+		.revision      = 0,
+		.family        = NFPROTO_IPV4,
+		.size          = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.userspacesize = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.help          = rawsnat_tg_help,
+		.parse         = rawsnat_tg4_parse,
+		.final_check   = rawsnat_tg_check,
+		.print         = rawsnat_tg4_print,
+		.save          = rawsnat_tg4_save,
+		.extra_opts    = rawsnat_tg_opts,
+	},
+	{
+		.version       = XTABLES_VERSION,
+		.name          = "RAWSNAT",
+		.revision      = 0,
+		.family        = NFPROTO_IPV6,
+		.size          = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.userspacesize = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.help          = rawsnat_tg_help,
+		.parse         = rawsnat_tg6_parse,
+		.final_check   = rawsnat_tg_check,
+		.print         = rawsnat_tg6_print,
+		.save          = rawsnat_tg6_save,
+		.extra_opts    = rawsnat_tg_opts,
+	},
 };
 
 static void _init(void)
 {
-	xtables_register_target(&rawsnat_tg4_reg);
-	xtables_register_target(&rawsnat_tg6_reg);
+	xtables_register_targets(rawsnat_tg_reg,
+		sizeof(rawsnat_tg_reg) / sizeof(*rawsnat_tg_reg));
 }

extensions/libxt_SYSRQ.man

@@ -36,6 +36,8 @@ The SYSRQ password can be changed through
 .IP
 echo \-n "password" >/sys/module/xt_SYSRQ/parameters/password
 .PP
+The module will not respond to sysrq requests until a password has been set.
+.PP
 Alternatively, the password may be specified at modprobe time, but this is
 insecure as people can possible see it through ps(1). You can use an option
 line in e.g. /etc/modprobe.d/xt_sysrq if it is properly guarded, that is, only
@@ -52,7 +54,7 @@ The xt_SYSRQ module is normally silent unless a successful request is received,
 but the \fIdebug\fP module parameter can be used to find exactly why a
 seemingly correct request is not being processed.
 .PP
-To trigger SYSRQ from a remote host, just use netcat or socat:
+To trigger SYSRQ from a remote host, just use socat:
 .PP
 .nf
 sysrq_key="s"  # the SysRq key(s)
@@ -60,12 +62,11 @@ password="password"
 seqno="$(date +%s)"
 salt="$(dd bs=12 count=1 if=/dev/urandom 2>/dev/null |
     openssl enc \-base64)"
+ipaddr=10.10.25.7
 req="$sysrq_key,$seqno,$salt"
-req="$req,$(echo \-n "$req,$password" | sha1sum | cut \-c1\-40)"
+req="$req,$(echo \-n "$req,$ipaddr,$password" | sha1sum | cut \-c1\-40)"
 
-echo "$req" | socat stdin udp\-sendto:10.10.25.7:9
-# or
-echo "$req" | netcat \-uw1 10.10.25.7 9
+echo "$req" | socat stdin udp\-sendto:$ipaddr:9
 .fi
 .PP
 See the Linux docs for possible sysrq keys. Important ones are: re(b)oot,
@@ -73,8 +74,10 @@ power(o)ff, (s)ync filesystems, (u)mount and remount readonly. More than one
 sysrq key can be used at once, but bear in mind that, for example, a sync may
 not complete before a subsequent reboot or poweroff.
 .PP
+An IPv4 address should have no leading zeros, an IPv6 address should
+be in the form recommended by RFC 5952.  The debug option will log the
+correct form of the address.
+.PP
 The hashing scheme should be enough to prevent mis-use of SYSRQ in many
 environments, but it is not perfect: take reasonable precautions to
-protect your machines.  Most importantly ensure that each machine has a
-different password; there is scant protection for a SYSRQ packet being
-applied to a machine that happens to have the same password.
+protect your machines.

extensions/libxt_TARPIT.c

@@ -1,34 +1,120 @@
 /*
  *	"TARPIT" target extension to iptables
- *	this file is in the Public Domain
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License; either
+ *	version 2 of the License, or any later version, as published by the
+ *	Free Software Foundation.
  */
+#include <stdbool.h>
+#include <stdint.h>
 #include <stdio.h>
 #include <getopt.h>
+#include <string.h>
 #include <xtables.h>
+#include <linux/netfilter/x_tables.h>
+#include "xt_TARPIT.h"
 #include "compat_user.h"
 
+enum {
+	F_TARPIT   = 1 << 0,
+	F_HONEYPOT = 1 << 1,
+	F_RESET    = 1 << 2,
+};
+
+static const struct option tarpit_tg_opts[] = {
+	{.name = "tarpit",   .has_arg = false, .val = 't'},
+	{.name = "honeypot", .has_arg = false, .val = 'h'},
+	{.name = "reset",    .has_arg = false, .val = 'r'},
+	{NULL},
+};
+
 static void tarpit_tg_help(void)
 {
-	printf("TARPIT takes no options\n\n");
+	printf(
+		"TARPIT target options:\n"
+		"  --tarpit      Enable classic 0-window tarpit (default)\n"
+		"  --honeypot    Enable honeypot option\n"
+		"  --reset       Enable inline resets\n");
 }
 
 static int tarpit_tg_parse(int c, char **argv, int invert, unsigned int *flags,
                            const void *entry, struct xt_entry_target **target)
 {
-	return 0;
+	struct xt_tarpit_tginfo *info = (void *)(*target)->data;
+
+	switch (c) {
+	case 't':
+		info->variant = XTTARPIT_TARPIT;
+		*flags |= F_TARPIT;
+		return true;
+	case 'h':
+		info->variant = XTTARPIT_HONEYPOT;
+		*flags |= F_HONEYPOT;
+		return true;
+	case 'r':
+		info->variant = XTTARPIT_RESET;
+		*flags |= F_RESET;
+		return true;
+	}
+	return false;
 }
 
 static void tarpit_tg_check(unsigned int flags)
 {
+	if (flags == (F_TARPIT | F_HONEYPOT | F_RESET))
+		xtables_error(PARAMETER_PROBLEM,
+			"TARPIT: only one action can be used at a time");
+}
+
+static void tarpit_tg_print(const void *ip,
+    const struct xt_entry_target *target, int numeric)
+{
+	const struct xt_tarpit_tginfo *info = (void *)target->data;
+
+	switch (info->variant) {
+	case XTTARPIT_HONEYPOT:
+		printf(" honeypot mode ");
+		break;
+	case XTTARPIT_RESET:
+		printf(" reset mode ");
+		break;
+	default:
+		printf(" tarpit mode ");
+		break;
+	}
+}
+
+static void tarpit_tg_save(const void *ip,
+    const struct xt_entry_target *target)
+{
+	const struct xt_tarpit_tginfo *info = (const void *)target->data;
+
+	switch (info->variant) {
+	case XTTARPIT_TARPIT:
+		printf(" --tarpit ");
+		break;
+	case XTTARPIT_HONEYPOT:
+		printf(" --honeypot ");
+		break;
+	case XTTARPIT_RESET:
+		printf(" --reset ");
+		break;
+	}
 }
 
 static struct xtables_target tarpit_tg_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "TARPIT",
 	.family        = NFPROTO_IPV4,
+	.size          = XT_ALIGN(sizeof(struct xt_tarpit_tginfo)),
+	.userspacesize = XT_ALIGN(sizeof(struct xt_tarpit_tginfo)),
 	.help          = tarpit_tg_help,
 	.parse         = tarpit_tg_parse,
 	.final_check   = tarpit_tg_check,
+	.print         = tarpit_tg_print,
+	.save          = tarpit_tg_save,
+	.extra_opts    = tarpit_tg_opts,
 };
 
 static __attribute__((constructor)) void tarpit_tg_ldr(void)

extensions/libxt_TARPIT.man

@@ -1,14 +1,38 @@
 Captures and holds incoming TCP connections using no local per-connection
-resources. Connections are accepted, but immediately switched to the persist
-state (0 byte window), in which the remote side stops sending data and asks to
-continue every 60-240 seconds. Attempts to close the connection are ignored,
-forcing the remote side to time out the connection in 12-24 minutes.
-
+resources.
+.PP
+TARPIT only works at the TCP level, and is totally application agnostic. This
+module will answer a TCP request and play along like a listening server, but
+aside from sending an ACK or RST, no data is sent. Incoming packets are ignored
+and dropped. The attacker will terminate the session eventually. This module
+allows the initial packets of an attack to be captured by other software for
+inspection. In most cases this is sufficient to determine the nature of the
+attack.
+.PP
 This offers similar functionality to LaBrea
 <http://www.hackbusters.net/LaBrea/> but does not require dedicated hardware or
 IPs. Any TCP port that you would normally DROP or REJECT can instead become a
 tarpit.
-
+.TP
+\fB\-\-tarpit\fP
+This mode completes a connection with the attacker but limits the window size
+to 0, thus keeping the attacker waiting long periods of time. While he is
+maintaining state of the connection and trying to continue every 60-240
+seconds, we keep none, so it is very lightweight. Attempts to close the
+connection are ignored, forcing the remote side to time out the connection in
+12-24 minutes. This mode is the default.
+.TP
+\fB\-\-honeypot\fP
+This mode completes a connection with the attacker, but signals a normal window
+size, so that the remote side will attempt to send data, often with some very
+nasty exploit attempts. We can capture these packets for decoding and further
+analysis. The module does not send any data, so if the remote expects an
+application level response, the game is up.
+.TP
+\fB\-\-reset\fP
+This mode is handy because we can send an inline RST (reset). It has no other
+function.
+.PP
 To tarpit connections to TCP port 80 destined for the current machine:
 .IP
 \-A INPUT \-p tcp \-m tcp \-\-dport 80 \-j TARPIT
@@ -24,10 +48,12 @@ the Linux box, and add:
 .PP
 NOTE:
 If you use the conntrack module while you are using TARPIT, you should also use
-the NOTRACK target, or the kernel will unnecessarily allocate resources for
-each TARPITted connection. To TARPIT incoming connections to the standard IRC
-port while using conntrack, you could:
+unset tracking on the packet, or the kernel will unnecessarily allocate
+resources for each TARPITted connection. To TARPIT incoming connections to the
+standard IRC port while using conntrack, you could:
 .IP
-\-t raw \-A PREROUTING \-p tcp \-\-dport 6667 \-j NOTRACK
+\-t raw \-A PREROUTING \-p tcp \-\-dport 6667 \-j CT \-\-notrack
+.IP
+\-A INPUT \-p tcp \-\-dport 6667 \-j NFLOG
 .IP
 \-A INPUT \-p tcp \-\-dport 6667 \-j TARPIT

extensions/libxt_TEE.c

@@ -105,9 +105,9 @@ static void tee_tg_print(const void *ip, const struct xt_entry_target *target,
 	const struct xt_tee_tginfo *info = (const void *)target->data;
 
 	if (numeric)
-		printf("TEE gw:%s ", xtables_ipaddr_to_numeric(&info->gw.in));
+		printf(" TEE gw:%s ", xtables_ipaddr_to_numeric(&info->gw.in));
 	else
-		printf("TEE gw:%s ", xtables_ipaddr_to_anyname(&info->gw.in));
+		printf(" TEE gw:%s ", xtables_ipaddr_to_anyname(&info->gw.in));
 }
 
 static void tee_tg6_print(const void *ip, const struct xt_entry_target *target,
@@ -116,57 +116,58 @@ static void tee_tg6_print(const void *ip, const struct xt_entry_target *target,
 	const struct xt_tee_tginfo *info = (const void *)target->data;
 
 	if (numeric)
-		printf("TEE gw:%s ", xtables_ip6addr_to_numeric(&info->gw.in6));
+		printf(" TEE gw:%s ", xtables_ip6addr_to_numeric(&info->gw.in6));
 	else
-		printf("TEE gw:%s ", xtables_ip6addr_to_anyname(&info->gw.in6));
+		printf(" TEE gw:%s ", xtables_ip6addr_to_anyname(&info->gw.in6));
 }
 
 static void tee_tg_save(const void *ip, const struct xt_entry_target *target)
 {
 	const struct xt_tee_tginfo *info = (const void *)target->data;
 
-	printf("--gateway %s ", xtables_ipaddr_to_numeric(&info->gw.in));
+	printf(" --gateway %s ", xtables_ipaddr_to_numeric(&info->gw.in));
 }
 
 static void tee_tg6_save(const void *ip, const struct xt_entry_target *target)
 {
 	const struct xt_tee_tginfo *info = (const void *)target->data;
 
-	printf("--gateway %s ", xtables_ip6addr_to_numeric(&info->gw.in6));
+	printf(" --gateway %s ", xtables_ip6addr_to_numeric(&info->gw.in6));
 }
 
-static struct xtables_target tee_tg_reg = {
-	.name          = "TEE",
-	.version       = XTABLES_VERSION,
-	.revision      = 0,
-	.family        = NFPROTO_IPV4,
-	.size          = XT_ALIGN(sizeof(struct xt_tee_tginfo)),
-	.userspacesize = XT_ALIGN(sizeof(struct xt_tee_tginfo)),
-	.help          = tee_tg_help,
-	.parse         = tee_tg_parse,
-	.final_check   = tee_tg_check,
-	.print         = tee_tg_print,
-	.save          = tee_tg_save,
-	.extra_opts    = tee_tg_opts,
-};
-
-static struct xtables_target tee_tg6_reg = {
-	.name          = "TEE",
-	.version       = XTABLES_VERSION,
-	.revision      = 0,
-	.family        = NFPROTO_IPV6,
-	.size          = XT_ALIGN(sizeof(struct xt_tee_tginfo)),
-	.userspacesize = XT_ALIGN(sizeof(struct xt_tee_tginfo)),
-	.help          = tee_tg_help,
-	.parse         = tee_tg6_parse,
-	.final_check   = tee_tg_check,
-	.print         = tee_tg6_print,
-	.save          = tee_tg6_save,
-	.extra_opts    = tee_tg_opts,
+static struct xtables_target tee_tg_reg[] = {
+	{
+		.name          = "TEE",
+		.version       = XTABLES_VERSION,
+		.revision      = 0,
+		.family        = NFPROTO_IPV4,
+		.size          = XT_ALIGN(sizeof(struct xt_tee_tginfo)),
+		.userspacesize = XT_ALIGN(sizeof(struct xt_tee_tginfo)),
+		.help          = tee_tg_help,
+		.parse         = tee_tg_parse,
+		.final_check   = tee_tg_check,
+		.print         = tee_tg_print,
+		.save          = tee_tg_save,
+		.extra_opts    = tee_tg_opts,
+	},
+	{
+		.name          = "TEE",
+		.version       = XTABLES_VERSION,
+		.revision      = 0,
+		.family        = NFPROTO_IPV6,
+		.size          = XT_ALIGN(sizeof(struct xt_tee_tginfo)),
+		.userspacesize = XT_ALIGN(sizeof(struct xt_tee_tginfo)),
+		.help          = tee_tg_help,
+		.parse         = tee_tg6_parse,
+		.final_check   = tee_tg_check,
+		.print         = tee_tg6_print,
+		.save          = tee_tg6_save,
+		.extra_opts    = tee_tg_opts,
+	},
 };
 
 static __attribute__((constructor)) void tee_tg_ldr(void)
 {
-	xtables_register_target(&tee_tg_reg);
-	xtables_register_target(&tee_tg6_reg);
+	xtables_register_targets(tee_tg_reg,
+		sizeof(tee_tg_reg) / sizeof(*tee_tg_reg));
 }

extensions/libxt_condition.c

@@ -67,7 +67,7 @@ static void condition_print(const void *ip, const struct xt_entry_match *match,
 {
 	const struct xt_condition_mtinfo *info = (const void *)match->data;
 
-	printf("condition %s%s ", (info->invert) ? "!" : "", info->name);
+	printf(" condition %s%s ", (info->invert) ? "!" : "", info->name);
 }
 
 
@@ -75,7 +75,7 @@ static void condition_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_condition_mtinfo *info = (const void *)match->data;
 
-	printf("%s--condition \"%s\" ", info->invert ? "! " : "", info->name);
+	printf("%s --condition \"%s\" ", info->invert ? " !" : "", info->name);
 }
 
 static struct xtables_match condition_mt_reg = {

extensions/libxt_dhcpmac.c

@@ -67,7 +67,7 @@ static void dhcpmac_mt_print(const void *ip,
 {
 	const struct dhcpmac_info *info = (void *)match->data;
 
-	printf("dhcpmac %s" DH_MAC_FMT "/%u ",
+	printf(" dhcpmac %s" DH_MAC_FMT "/%u ",
 	       info->invert ? "!" : "", DH_MAC_HEX(info->addr), info->mask);
 }
 
@@ -77,8 +77,8 @@ static void dhcpmac_mt_save(const void *ip,
 	const struct dhcpmac_info *info = (void *)match->data;
 
 	if (info->invert)
-		printf("! ");
-	printf("--mac " DH_MAC_FMT "/%u ",
+		printf(" !");
+	printf(" --mac " DH_MAC_FMT "/%u ",
 	       DH_MAC_HEX(info->addr), info->mask);
 }
 

extensions/libxt_fuzzy.c

@@ -88,7 +88,7 @@ static void fuzzy_mt_print(const void *ip, const struct xt_entry_match *match,
 {
 	const struct xt_fuzzy_mtinfo *info = (const void *)match->data;
 
-	printf("fuzzy: lower limit = %u pps - upper limit = %u pps ",
+	printf(" fuzzy: lower limit = %u pps - upper limit = %u pps ",
 	       info->minimum_rate, info->maximum_rate);
 }
 
@@ -96,11 +96,11 @@ static void fuzzy_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_fuzzy_mtinfo *info = (const void *)match->data;
 
-	printf("--lower-limit %u ", info->minimum_rate);
-	printf("--upper-limit %u ", info->maximum_rate);
+	printf(" --lower-limit %u ", info->minimum_rate);
+	printf(" --upper-limit %u ", info->maximum_rate);
 }
 
-static struct xtables_match fuzzy_mt_reg = { 
+static struct xtables_match fuzzy_mt_reg = {
 	.name          = "fuzzy",
 	.revision      = 1,
 	.version       = XTABLES_VERSION,

extensions/libxt_geoip.c

@@ -2,7 +2,7 @@
  *	"geoip" match extension for iptables
  *	Copyright © Samuel Jean <peejix [at] people netfilter org>, 2004 - 2008
  *	Copyright © Nicolas Bouliane <acidfu [at] people netfilter org>, 2004 - 2008
- *	Jan Engelhardt <jengelh [at] medozas de>, 2008
+ *	Jan Engelhardt <jengelh [at] medozas de>, 2008-2011
  *
  *	This program is free software; you can redistribute it and/or
  *	modify it under the terms of the GNU General Public License; either
@@ -49,19 +49,28 @@ static struct option geoip_opts[] = {
 	{NULL},
 };
 
-static struct geoip_subnet *geoip_get_subnets(const char *code, uint32_t *count)
+static void *
+geoip_get_subnets(const char *code, uint32_t *count, uint8_t nfproto)
 {
-	struct geoip_subnet *subnets;
+	void *subnets;
 	struct stat sb;
 	char buf[256];
 	int fd;
 
 	/* Use simple integer vector files */
+	if (nfproto == NFPROTO_IPV6) {
 #if __BYTE_ORDER == _BIG_ENDIAN
-	snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/BE/%s.iv0", code);
+		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/BE/%s.iv6", code);
 #else
-	snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/LE/%s.iv0", code);
+		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/LE/%s.iv6", code);
 #endif
+	} else {
+#if __BYTE_ORDER == _BIG_ENDIAN
+		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/BE/%s.iv4", code);
+#else
+		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/LE/%s.iv4", code);
+#endif
+	}
 
 	if ((fd = open(buf, O_RDONLY)) < 0) {
 		fprintf(stderr, "Could not open %s: %s\n", buf, strerror(errno));
@@ -69,20 +78,31 @@ static struct geoip_subnet *geoip_get_subnets(const char *code, uint32_t *count)
 	}
 
 	fstat(fd, &sb);
-	if (sb.st_size % sizeof(struct geoip_subnet) != 0)
-		xtables_error(OTHER_PROBLEM, "Database file %s seems to be "
-		           "corrupted", buf);
+	*count = sb.st_size;
+	switch (nfproto) {
+	case NFPROTO_IPV6:
+		if (sb.st_size % sizeof(struct geoip_subnet6) != 0)
+			xtables_error(OTHER_PROBLEM,
+				"Database file %s seems to be corrupted", buf);
+		*count /= sizeof(struct geoip_subnet6);
+		break;
+	case NFPROTO_IPV4:
+		if (sb.st_size % sizeof(struct geoip_subnet4) != 0)
+			xtables_error(OTHER_PROBLEM,
+				"Database file %s seems to be corrupted", buf);
+		*count /= sizeof(struct geoip_subnet4);
+		break;
+	}
 	subnets = malloc(sb.st_size);
 	if (subnets == NULL)
 		xtables_error(OTHER_PROBLEM, "geoip: insufficient memory");
 	read(fd, subnets, sb.st_size);
 	close(fd);
-	*count = sb.st_size / sizeof(struct geoip_subnet);
 	return subnets;
 }
- 
+
 static struct geoip_country_user *geoip_load_cc(const char *code,
-    unsigned short cc)
+    unsigned short cc, uint8_t nfproto)
 {
 	struct geoip_country_user *ginfo;
 	ginfo = malloc(sizeof(struct geoip_country_user));
@@ -90,7 +110,8 @@ static struct geoip_country_user *geoip_load_cc(const char *code,
 	if (!ginfo)
 		return NULL;
 
-	ginfo->subnets = (unsigned long)geoip_get_subnets(code, &ginfo->count);
+	ginfo->subnets = (unsigned long)geoip_get_subnets(code,
+	                 &ginfo->count, nfproto);
 	ginfo->cc = cc;
 
 	return ginfo;
@@ -133,7 +154,7 @@ check_geoip_cc(char *cc, u_int16_t cc_used[], u_int8_t count)
 }
 
 static unsigned int parse_geoip_cc(const char *ccstr, uint16_t *cc,
-    union geoip_country_group *mem)
+    union geoip_country_group *mem, uint8_t nfproto)
 {
 	char *buffer, *cp, *next;
 	u_int8_t i, count = 0;
@@ -150,7 +171,8 @@ static unsigned int parse_geoip_cc(const char *ccstr, uint16_t *cc,
 		if (next) *next++ = '\0';
 
 		if ((cctmp = check_geoip_cc(cp, cc, count)) != 0) {
-			if ((mem[count++].user = (unsigned long)geoip_load_cc(cp, cctmp)) == 0)
+			if ((mem[count++].user =
+			    (unsigned long)geoip_load_cc(cp, cctmp, nfproto)) == 0)
 				xtables_error(OTHER_PROBLEM,
 					"geoip: insufficient memory available");
 			cc[count-1] = cctmp;
@@ -169,11 +191,9 @@ static unsigned int parse_geoip_cc(const char *ccstr, uint16_t *cc,
 	return count;
 }
 
-static int geoip_parse(int c, char **argv, int invert, unsigned int *flags,
-    const void *entry, struct xt_entry_match **match)
+static int geoip_parse(int c, bool invert, unsigned int *flags,
+    const char *arg, struct xt_geoip_match_info *info, uint8_t nfproto)
 {
-	struct xt_geoip_match_info *info = (void *)(*match)->data;
-
 	switch (c) {
 	case '1':
 		if (*flags & (XT_GEOIP_SRC | XT_GEOIP_DST))
@@ -185,7 +205,8 @@ static int geoip_parse(int c, char **argv, int invert, unsigned int *flags,
 		if (invert)
 			*flags |= XT_GEOIP_INV;
 
-		info->count = parse_geoip_cc(argv[optind-1], info->cc, info->mem);
+		info->count = parse_geoip_cc(arg, info->cc, info->mem,
+		              nfproto);
 		info->flags = *flags;
 		return true;
 
@@ -199,7 +220,8 @@ static int geoip_parse(int c, char **argv, int invert, unsigned int *flags,
 		if (invert)
 			*flags |= XT_GEOIP_INV;
 
-		info->count = parse_geoip_cc(argv[optind-1], info->cc, info->mem);
+		info->count = parse_geoip_cc(arg, info->cc, info->mem,
+		              nfproto);
 		info->flags = *flags;
 		return true;
 	}
@@ -207,6 +229,20 @@ static int geoip_parse(int c, char **argv, int invert, unsigned int *flags,
 	return false;
 }
 
+static int geoip_parse6(int c, char **argv, int invert, unsigned int *flags,
+    const void *entry, struct xt_entry_match **match)
+{
+	return geoip_parse(c, invert, flags, optarg,
+	       (void *)(*match)->data, NFPROTO_IPV6);
+}
+
+static int geoip_parse4(int c, char **argv, int invert, unsigned int *flags,
+    const void *entry, struct xt_entry_match **match)
+{
+	return geoip_parse(c, invert, flags, optarg,
+	       (void *)(*match)->data, NFPROTO_IPV4);
+}
+
 static void
 geoip_final_check(unsigned int flags)
 {
@@ -223,9 +259,9 @@ geoip_print(const void *ip, const struct xt_entry_match *match, int numeric)
 	u_int8_t i;
 
 	if (info->flags & XT_GEOIP_SRC)
-		printf("Source ");
+		printf(" Source ");
 	else
-		printf("Destination ");
+		printf(" Destination ");
 
 	if (info->count > 1)
 		printf("countries: ");
@@ -247,34 +283,51 @@ geoip_save(const void *ip, const struct xt_entry_match *match)
 	u_int8_t i;
 
 	if (info->flags & XT_GEOIP_INV)
-		printf("! ");
+		printf(" !");
 
 	if (info->flags & XT_GEOIP_SRC)
-		printf("--source-country ");
+		printf(" --source-country ");
 	else
-		printf("--destination-country ");
+		printf(" --destination-country ");
 
 	for (i = 0; i < info->count; i++)
 		printf("%s%c%c", i ? "," : "", COUNTRY(info->cc[i]));
 	printf(" ");
 }
 
-static struct xtables_match geoip_match = {
-	 .family        = NFPROTO_IPV4,
-	 .name          = "geoip",
-	 .revision      = 1,
-	 .version       = XTABLES_VERSION,
-	 .size          = XT_ALIGN(sizeof(struct xt_geoip_match_info)),
-	 .userspacesize = offsetof(struct xt_geoip_match_info, mem),
-	 .help          = geoip_help,
-	 .parse	        = geoip_parse,
-	 .final_check   = geoip_final_check,
-	 .print         = geoip_print,
-	 .save          = geoip_save,
-	 .extra_opts    = geoip_opts,
+static struct xtables_match geoip_match[] = {
+	{
+		.family        = NFPROTO_IPV6,
+		.name          = "geoip",
+		.revision      = 1,
+		.version       = XTABLES_VERSION,
+		.size          = XT_ALIGN(sizeof(struct xt_geoip_match_info)),
+		.userspacesize = offsetof(struct xt_geoip_match_info, mem),
+		.help          = geoip_help,
+		.parse         = geoip_parse6,
+		.final_check   = geoip_final_check,
+		.print         = geoip_print,
+		.save          = geoip_save,
+		.extra_opts    = geoip_opts,
+	},
+	{
+		.family        = NFPROTO_IPV4,
+		.name          = "geoip",
+		.revision      = 1,
+		.version       = XTABLES_VERSION,
+		.size          = XT_ALIGN(sizeof(struct xt_geoip_match_info)),
+		.userspacesize = offsetof(struct xt_geoip_match_info, mem),
+		.help          = geoip_help,
+		.parse         = geoip_parse4,
+		.final_check   = geoip_final_check,
+		.print         = geoip_print,
+		.save          = geoip_save,
+		.extra_opts    = geoip_opts,
+	},
 };
 
 static __attribute__((constructor)) void geoip_mt_ldr(void)
 {
-	xtables_register_match(&geoip_match);
+	xtables_register_matches(geoip_match,
+		sizeof(geoip_match) / sizeof(*geoip_match));
 }

extensions/libxt_geoip.man

@@ -10,8 +10,13 @@ NOTE:
 The country is inputed by its ISO-3166 code.
 .PP
 The extra files you will need is the binary database files. They are generated
-from a country-subnet database with the geoip_csv_iv0.pl tool that should be
-available in /usr/lib(exec)/xtables-addons/ . The resulting files MUST be moved
-to /usr/share/xt_geoip/
-as the shared library is statically looking for this pathname (e.g.
-/usr/share/xt_geoip/LE/de.iv0).
+from a country-subnet database with the geoip_build_db.pl tool that is shipped
+with the source package, and which should be available in compiled packages in
+/usr/lib(exec)/xtables-addons/. The first command retrieves CSV files from
+MaxMind, while the other two build packed bisectable range files:
+.PP
+mkdir -p /usr/share/xt_geoip; cd /tmp; $path/to/xt_geoip_dl;
+.PP
+$path/to/xt_geoip_build -D /usr/share/xt_geoip GeoIP*.csv;
+.PP
+The shared library is hardcoded to look in these paths, so use them.

extensions/libxt_gradm.c

@@ -0,0 +1,99 @@
+/*
+ *	"gradm" match extension for iptables
+ *	Zbigniew Krzystolik <zbyniu@destrukcja.pl>, 2010
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License;
+ *	either version 2 of the License, or any later version, as
+ *	published by the Free Software Foundation.
+ */
+#include <getopt.h>
+#include <netdb.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <xtables.h>
+#include "xt_gradm.h"
+#include "compat_user.h"
+
+static void gradm_mt_help(void)
+{
+	printf(
+"gradm match options:\n"
+" [!] --enabled    is Grsecurity RBAC enabled\n"
+" [!] --disabled   is Grsecurity RBAC disabled\n");
+};
+
+static const struct option gradm_mt_opts[] = {
+	{.name = "enabled",  .has_arg = false, .val = '1'},
+	{.name = "disabled", .has_arg = false, .val = '2'},
+	{NULL},
+};
+
+static void gradm_mt_init(struct xt_entry_match *m)
+{
+}
+
+static int gradm_mt_parse(int c, char **argv, int invert, unsigned int *flags,
+                          const void *entry, struct xt_entry_match **match)
+{
+	struct xt_gradm_mtinfo *info = (void *)(*match)->data;
+
+	switch (c) {
+	case '1':
+		if (invert)
+			info->invflags |= 1;
+		return true;
+	case '2':
+		if (!invert)
+			info->invflags |= 1;
+		return true;
+	}
+	return false;
+}
+
+static void gradm_mt_check(unsigned int flags)
+{
+}
+
+static void gradm_mt_print(const void *ip, const struct xt_entry_match *match,
+                           int numeric)
+{
+	const struct xt_gradm_mtinfo *info = (const void *)match->data;
+
+	if (info->invflags)
+		printf("gradm: disabled");
+	else
+		printf("gradm: enabled");
+}
+
+static void gradm_mt_save(const void *ip, const struct xt_entry_match *match)
+{
+	const struct xt_gradm_mtinfo *info = (const void *)match->data;
+
+	if (info->invflags)
+		printf(" --disabled ");
+	else
+		printf(" --enabled ");
+}
+
+static struct xtables_match gradm_mt_reg = {
+	.family        = NFPROTO_UNSPEC,
+	.name          = "gradm",
+	.version       = XTABLES_VERSION,
+	.size          = XT_ALIGN(sizeof(struct xt_gradm_mtinfo)),
+	.userspacesize = XT_ALIGN(sizeof(struct xt_gradm_mtinfo)),
+	.help          = gradm_mt_help,
+	.init          = gradm_mt_init,
+	.parse         = gradm_mt_parse,
+	.final_check   = gradm_mt_check,
+	.print         = gradm_mt_print,
+	.save          = gradm_mt_save,
+	.extra_opts    = gradm_mt_opts,
+};
+
+static __attribute__((constructor)) void gradm_mt_ldr(void)
+{
+	xtables_register_match(&gradm_mt_reg);
+}

extensions/libxt_gradm.man

@@ -0,0 +1,7 @@
+This module matches packets based on grsecurity RBAC status.
+.TP
+[\fB!\fP] \fB\-\-enabled\fP
+Matches packets if grsecurity RBAC is enabled.
+.TP
+[\fB!\fP] \fB\-\-disabled\fP
+Matches packets if grsecurity RBAC is disabled.

extensions/libxt_iface.c

@@ -17,8 +17,14 @@
 #include "xt_iface.h"
 #include "compat_user.h"
 
+enum {
+	XT_IFACE_IFACE = 1 << 16,
+};
+
 static const struct option iface_mt_opts[] = {
 	{.name = "iface",        .has_arg = true,  .val = 'i'},
+	{.name = "dev-in",       .has_arg = false, .val = 'I'},
+	{.name = "dev-out",      .has_arg = false, .val = 'O'},
 	{.name = "up",           .has_arg = false, .val = 'u'},
 	{.name = "down",         .has_arg = false, .val = 'U'}, /* not up */
 	{.name = "broadcast",    .has_arg = false, .val = 'b'},
@@ -40,9 +46,7 @@ static void iface_print_opt(const struct xt_iface_mtinfo *info,
     const unsigned int option, const char *command)
 {
 	if (info->flags & option)
-		printf(" %s", command);
-	if (info->invflags & option)
-		printf(" ! %s", command);
+		printf(" %s%s", (info->invflags & option) ? "! " : "", command);
 }
 
 static void iface_setflag(struct xt_iface_mtinfo *info,
@@ -51,10 +55,9 @@ static void iface_setflag(struct xt_iface_mtinfo *info,
 	if (*flags & flag)
 		xtables_error(PARAMETER_PROBLEM,
 			"iface: \"--%s\" flag already specified", command);
+	info->flags |= flag;
 	if (invert)
 		info->invflags |= flag;
-	else
-		info->flags |= flag;
 	*flags |= flag;
 }
 
@@ -69,19 +72,20 @@ static void iface_mt_help(void)
 {
 	printf(
 	"iface match options:\n"
-	"    --iface interface    Name of interface\n"
-	"[!] --up / --down        match if UP flag (not) set\n"
-	"[!] --broadcast          match if BROADCAST flag (not) set\n"
-	"[!] --loopback           match if LOOPBACK flag (not) set\n"
+	"    --iface interface     Name of interface\n"
+	"    --dev-in / --dev-out  Use incoming/outgoing interface instead\n"
+	"[!] --up / --down         match if UP flag (not) set\n"
+	"[!] --broadcast           match if BROADCAST flag (not) set\n"
+	"[!] --loopback            match if LOOPBACK flag (not) set\n"
 	"[!] --pointopoint\n"
-	"[!] --pointtopoint       match if POINTOPOINT flag (not) set\n"
-	"[!] --running            match if RUNNING flag (not) set\n"
-	"[!] --noarp / --arp      match if NOARP flag (not) set\n"
-	"[!] --promisc            match if PROMISC flag (not) set\n"
-	"[!] --multicast          match if MULTICAST flag (not) set\n"
-	"[!] --dynamic            match if DYNAMIC flag (not) set\n"
-	"[!] --lower-up           match if LOWER_UP flag (not) set\n"
-	"[!] --dormant            match if DORMANT flag (not) set\n");
+	"[!] --pointtopoint        match if POINTOPOINT flag (not) set\n"
+	"[!] --running             match if RUNNING flag (not) set\n"
+	"[!] --noarp / --arp       match if NOARP flag (not) set\n"
+	"[!] --promisc             match if PROMISC flag (not) set\n"
+	"[!] --multicast           match if MULTICAST flag (not) set\n"
+	"[!] --dynamic             match if DYNAMIC flag (not) set\n"
+	"[!] --lower-up            match if LOWER_UP flag (not) set\n"
+	"[!] --dormant             match if DORMANT flag (not) set\n");
 }
 
 static int iface_mt_parse(int c, char **argv, int invert, unsigned int *flags,
@@ -111,6 +115,18 @@ static int iface_mt_parse(int c, char **argv, int invert, unsigned int *flags,
 		strcpy(info->ifname, optarg);
 		*flags |= XT_IFACE_IFACE;
 		return true;
+	case 'I': /* --dev-in */
+		xtables_param_act(XTF_ONLY_ONCE, "iface", "--dev-in",
+			*flags & XT_IFACE_IFACE);
+		*flags |= XT_IFACE_IFACE;
+		iface_setflag(info, flags, invert, XT_IFACE_DEV_IN, "dev-in");
+		return true;
+	case 'O': /* --dev-out */
+		xtables_param_act(XTF_ONLY_ONCE, "iface", "--dev-out",
+			*flags & XT_IFACE_IFACE);
+		*flags |= XT_IFACE_IFACE;
+		iface_setflag(info, flags, invert, XT_IFACE_DEV_OUT, "dev-out");
+		return true;
 	case 'u': /* UP */
 		iface_setflag(info, flags, invert, XT_IFACE_UP, "up");
 		return true;
@@ -153,7 +169,8 @@ static void iface_mt_check(unsigned int flags)
 	if (!(flags & XT_IFACE_IFACE))
 		xtables_error(PARAMETER_PROBLEM,
 			"iface: You must specify an interface");
-	if (flags == 0 || flags == XT_IFACE_IFACE)
+	if ((flags & ~(XT_IFACE_IFACE | XT_IFACE_DEV_IN |
+	    XT_IFACE_DEV_OUT)) == 0)
 		xtables_error(PARAMETER_PROBLEM,
 			"iface: You must specify at least one option");
 }
@@ -163,7 +180,14 @@ static void iface_mt_print(const void *ip, const struct xt_entry_match *match,
 {
 	const struct xt_iface_mtinfo *info = (const void *)match->data;
 
-	printf("iface: \"%s\" [state:", info->ifname);
+	printf(" iface: ");
+	if (info->flags & XT_IFACE_DEV_IN)
+		printf("(in)");
+	else if (info->flags & XT_IFACE_DEV_OUT)
+		printf("(out)");
+	else
+		printf("%s", info->ifname);
+	printf(" [state:");
 	iface_print_opt(info, XT_IFACE_UP,          "up");
 	iface_print_opt(info, XT_IFACE_BROADCAST,   "broadcast");
 	iface_print_opt(info, XT_IFACE_LOOPBACK,    "loopback");
@@ -182,7 +206,12 @@ static void iface_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_iface_mtinfo *info = (const void *)match->data;
 
-	printf(" --iface %s", info->ifname);
+	if (info->flags & XT_IFACE_DEV_IN)
+		printf(" --dev-in");
+	else if (info->flags & XT_IFACE_DEV_OUT)
+		printf(" --dev-out");
+	else
+		printf(" --iface %s", info->ifname);
 	iface_print_opt(info, XT_IFACE_UP,          "--up");
 	iface_print_opt(info, XT_IFACE_BROADCAST,   "--broadcast");
 	iface_print_opt(info, XT_IFACE_LOOPBACK,    "--loopback");

extensions/libxt_iface.man

@@ -1,7 +1,20 @@
-Allows you to check interface states.
+Allows you to check interface states. First, an interface needs to be selected
+for comparison. Exactly one option of the following three must be specified:
 .TP
 \fB\-\-iface\fP \fIname\fP
-Check the states on the given interface. This option is required.
+Check the states on the given interface.
+.TP
+\fB\-\-dev\-in\fP
+Check the states on the interface on which the packet came in. If the input
+device is not set, because for example you are using \-m iface in the OUTPUT
+chain, this submatch returns false.
+.TP
+\fB\-\-dev\-out\fP
+Check the states on the interface on which the packet will go out. If the
+output device is not set, because for example you are using \-m iface in the
+INPUT chain, this submatch returns false.
+.PP
+Following that, one can select the interface properties to check for:
 .TP
 [\fB!\fP] \fB\-\-up\fP, [\fB!\fP] \fB\-\-down\fP
 Check the UP flag.

extensions/libxt_ipp2p.c

@@ -208,16 +208,16 @@ ipp2p_mt_print1(const void *entry, const struct xt_entry_match *match,
 
 	for (i = IPP2N_EDK; i <= IPP2N_XDCC; ++i)
 		if (info->cmd & (1 << i))
-			printf("%s ", ipp2p_cmds[i]);
+			printf(" %s ", ipp2p_cmds[i]);
 
 	if (info->debug != 0)
-		printf("--debug ");
+		printf(" --debug ");
 }
 
 static void ipp2p_mt_print(const void *entry,
     const struct xt_entry_match *match, int numeric)
 {
-	printf("ipp2p ");
+	printf(" ipp2p ");
 	ipp2p_mt_print1(entry, match, true);
 }
 

extensions/libxt_ipp2p.man

@@ -36,7 +36,7 @@ Matches some WinMX packets. Considered as beta, use careful!
 Matches Ares and AresLite packets. Use together with \-j DROP only.
 .TP
 \fB\-\-debug\fP
-Prints some information about each hit into kernel logfile. May 
+Prints some information about each hit into kernel logfile. May
 produce huge logfiles so beware!
 .PP
 Note that ipp2p may not (and often, does not) identify all packets that are

extensions/libxt_ipv4options.c

@@ -1,6 +1,6 @@
 /*
  *	"ipv4options" match extension for iptables
- *	Coprygith © Jan Engelhardt, 2009
+ *	Copyright © Jan Engelhardt, 2009
  *
  *	This program is free software; you can redistribute it and/or
  *	modify it under the terms of the GNU General Public License; either
@@ -138,7 +138,7 @@ static void ipv4options_mt_print(const void *ip,
 {
 	const struct xt_ipv4options_mtinfo1 *info = (void *)match->data;
 
-	printf("ipv4options %s ",
+	printf(" ipv4options %s ",
 	       (info->flags & XT_V4OPTS_ANY) ? "any-of" : "all-of");
 	ipv4options_print_flags(info, numeric);
 	printf(" ");
@@ -150,7 +150,7 @@ static void ipv4options_mt_save(const void *ip,
 	const struct xt_ipv4options_mtinfo1 *info = (void *)match->data;
 
 	if (info->map != 0) {
-		printf("--flags ");
+		printf(" --flags ");
 		ipv4options_print_flags(info, true);
 	}
 	if (info->flags & XT_V4OPTS_ANY)