#ifndef _IP_SET_H#define _IP_SET_H/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu> *                         Patrick Schaaf <bof@bof.de> *                         Martin Josefsson <gandalf@wlug.westbo.se> * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation.   */#if 0#define IP_SET_DEBUG#endif/* * A sockopt of such quality has hardly ever been seen before on the open * market!  This little beauty, hardly ever used: above 64, so it's * traditionally used for firewalling, not touched (even once!) by the * 2.0, 2.2 and 2.4 kernels! * * Comes with its own certificate of authenticity, valid anywhere in the * Free world! * * Rusty, 19.4.2000 */#define SO_IP_SET 		83/* * Heavily modify by Joakim Axelsson 08.03.2002 * - Made it more modulebased * * Additional heavy modifications by Jozsef Kadlecsik 22.02.2004 * - bindings added * - in order to "deal with" backward compatibility, renamed to ipset *//*  * Used so that the kernel module and ipset-binary can match their versions  */#define IP_SET_PROTOCOL_VERSION 2#define IP_SET_MAXNAMELEN 32	/* set names and set typenames *//* Lets work with our own typedef for representing an IP address. * We hope to make the code more portable, possibly to IPv6... * * The representation works in HOST byte order, because most set types * will perform arithmetic operations and compare operations. *  * For now the type is an uint32_t. * * Make sure to ONLY use the functions when translating and parsing * in order to keep the host byte order and make it more portable: *  parse_ip() *  parse_mask() *  parse_ipandmask() *  ip_tostring() * (Joakim: where are they???) */typedef uint32_t ip_set_ip_t;/* Sets are identified by an id in kernel space. Tweak with ip_set_id_t * and IP_SET_INVALID_ID if you want to increase the max number of sets. */typedef uint16_t ip_set_id_t;#define IP_SET_INVALID_ID	65535/* How deep we follow bindings */#define IP_SET_MAX_BINDINGS	6/* * Option flags for kernel operations (ipt_set_info) */#define IPSET_SRC 		0x01	/* Source match/add */#define IPSET_DST		0x02	/* Destination match/add */#define IPSET_MATCH_INV		0x04	/* Inverse matching *//* * Set features */#define IPSET_TYPE_IP		0x01	/* IP address type of set */#define IPSET_TYPE_PORT		0x02	/* Port type of set */#define IPSET_DATA_SINGLE	0x04	/* Single data storage */#define IPSET_DATA_DOUBLE	0x08	/* Double data storage *//* Reserved keywords */#define IPSET_TOKEN_DEFAULT	":default:"#define IPSET_TOKEN_ALL		":all:"/* SO_IP_SET operation constants, and their request struct types. * * Operation ids: *	  0-99:	 commands with version checking *	100-199: add/del/test/bind/unbind *	200-299: list, save, restore *//* Single shot operations:  * version, create, destroy, flush, rename and swap  * * Sets are identified by name. */#define IP_SET_REQ_STD		\	unsigned op;		\	unsigned version;	\	char name[IP_SET_MAXNAMELEN]#define IP_SET_OP_CREATE	0x00000001	/* Create a new (empty) set */struct ip_set_req_create {	IP_SET_REQ_STD;	char typename[IP_SET_MAXNAMELEN];};#define IP_SET_OP_DESTROY	0x00000002	/* Remove a (empty) set */struct ip_set_req_std {	IP_SET_REQ_STD;};#define IP_SET_OP_FLUSH		0x00000003	/* Remove all IPs in a set *//* Uses ip_set_req_std */#define IP_SET_OP_RENAME	0x00000004	/* Rename a set *//* Uses ip_set_req_create */#define IP_SET_OP_SWAP		0x00000005	/* Swap two sets *//* Uses ip_set_req_create */union ip_set_name_index {	char name[IP_SET_MAXNAMELEN];	ip_set_id_t index;};#define IP_SET_OP_GET_BYNAME	0x00000006	/* Get set index by name */struct ip_set_req_get_set {	unsigned op;	unsigned version;	union ip_set_name_index set;};#define IP_SET_OP_GET_BYINDEX	0x00000007	/* Get set name by index *//* Uses ip_set_req_get_set */#define IP_SET_OP_VERSION	0x00000100	/* Ask kernel version */struct ip_set_req_version {	unsigned op;	unsigned version;};/* Double shots operations:  * add, del, test, bind and unbind. * * First we query the kernel to get the index and type of the target set, * then issue the command. Validity of IP is checked in kernel in order * to minimalize sockopt operations. *//* Get minimal set data for add/del/test/bind/unbind IP */#define IP_SET_OP_ADT_GET	0x00000010	/* Get set and type */struct ip_set_req_adt_get {	unsigned op;	unsigned version;	union ip_set_name_index set;	char typename[IP_SET_MAXNAMELEN];};#define IP_SET_REQ_BYINDEX	\	unsigned op;		\	ip_set_id_t index;struct ip_set_req_adt {	IP_SET_REQ_BYINDEX;};#define IP_SET_OP_ADD_IP	0x00000101	/* Add an IP to a set *//* Uses ip_set_req_adt, with type specific addage */#define IP_SET_OP_DEL_IP	0x00000102	/* Remove an IP from a set *//* Uses ip_set_req_adt, with type specific addage */#define IP_SET_OP_TEST_IP	0x00000103	/* Test an IP in a set *//* Uses ip_set_req_adt, with type specific addage */#define IP_SET_OP_BIND_SET	0x00000104	/* Bind an IP to a set *//* Uses ip_set_req_bind, with type specific addage */struct ip_set_req_bind {	IP_SET_REQ_BYINDEX;	char binding[IP_SET_MAXNAMELEN];};#define IP_SET_OP_UNBIND_SET	0x00000105	/* Unbind an IP from a set *//* Uses ip_set_req_bind, with type speficic addage  * index = 0 means unbinding for all sets */#define IP_SET_OP_TEST_BIND_SET	0x00000106	/* Test binding an IP to a set *//* Uses ip_set_req_bind, with type specific addage *//* Multiple shots operations: list, save, restore. * * - check kernel version and query the max number of sets * - get the basic information on all sets *   and size required for the next step * - get actual set data: header, data, bindings *//* Get max_sets and the index of a queried set */#define IP_SET_OP_MAX_SETS	0x00000020struct ip_set_req_max_sets {	unsigned op;	unsigned version;	ip_set_id_t max_sets;		/* max_sets */	ip_set_id_t sets;		/* real number of sets */	union ip_set_name_index set;	/* index of set if name used */};/* Get the id and name of the sets plus size for next step */#define IP_SET_OP_LIST_SIZE	0x00000201#define IP_SET_OP_SAVE_SIZE	0x00000202struct ip_set_req_setnames {	unsigned op;	ip_set_id_t index;		/* set to list/save */	size_t size;			/* size to get setdata/bindings */	/* followed by sets number of struct ip_set_name_list */};struct ip_set_name_list {	char name[IP_SET_MAXNAMELEN];	char typename[IP_SET_MAXNAMELEN];	ip_set_id_t index;	ip_set_id_t id;};/* The actual list operation */#define IP_SET_OP_LIST		0x00000203struct ip_set_req_list {	IP_SET_REQ_BYINDEX;	/* sets number of struct ip_set_list in reply */ };struct ip_set_list {	ip_set_id_t index;	ip_set_id_t binding;	u_int32_t ref;	size_t header_size;	/* Set header data of header_size */	size_t members_size;	/* Set members data of members_size */	size_t bindings_size;	/* Set bindings data of bindings_size */};struct ip_set_hash_list {	ip_set_ip_t ip;	ip_set_id_t binding;};/* The save operation */#define IP_SET_OP_SAVE		0x00000204/* Uses ip_set_req_list, in the reply replaced by * sets number of struct ip_set_save plus a marker * ip_set_save followed by ip_set_hash_save structures. */struct ip_set_save {	ip_set_id_t index;	ip_set_id_t binding;	size_t header_size;	/* Set header data of header_size */	size_t members_size;	/* Set members data of members_size */};/* At restoring, ip == 0 means default binding for the given set: */struct ip_set_hash_save {	ip_set_ip_t ip;	ip_set_id_t id;	ip_set_id_t binding;};/* The restore operation */#define IP_SET_OP_RESTORE	0x00000205/* Uses ip_set_req_setnames followed by ip_set_restore structures * plus a marker ip_set_restore, followed by ip_set_hash_save  * structures. */struct ip_set_restore {	char name[IP_SET_MAXNAMELEN];	char typename[IP_SET_MAXNAMELEN];	ip_set_id_t index;	size_t header_size;	/* Create data of header_size */	size_t members_size;	/* Set members data of members_size */};static inline int bitmap_bytes(ip_set_ip_t a, ip_set_ip_t b){	return 4 * ((((b - a + 8) / 8) + 3) / 4);}#ifdef __KERNEL__#define ip_set_printk(format, args...) 			\	do {							\		printk("%s: %s: ", __FILE__, __FUNCTION__);	\		printk(format "\n" , ## args);			\	} while (0)#if defined(IP_SET_DEBUG)#define DP(format, args...) 					\	do {							\		printk("%s: %s (DBG): ", __FILE__, __FUNCTION__);\		printk(format "\n" , ## args);			\	} while (0)#define IP_SET_ASSERT(x)					\	do {							\		if (!(x))					\			printk("IP_SET_ASSERT: %s:%i(%s)\n",	\				__FILE__, __LINE__, __FUNCTION__); \	} while (0)#else#define DP(format, args...)#define IP_SET_ASSERT(x)#endifstruct ip_set;/* * The ip_set_type definition - one per set type, e.g. "ipmap". * * Each individual set has a pointer, set->type, going to one * of these structures. Function pointers inside the structure implement * the real behaviour of the sets. * * If not mentioned differently, the implementation behind the function * pointers of a set_type, is expected to return 0 if ok, and a negative * errno (e.g. -EINVAL) on error. */struct ip_set_type {	struct list_head list;	/* next in list of set types */	/* test for IP in set (kernel: iptables -m set src|dst)	 * return 0 if not in set, 1 if in set.	 */	int (*testip_kernel) (struct ip_set *set,			      const struct sk_buff * skb, 			      ip_set_ip_t *ip,			      const u_int32_t *flags,			      unsigned char index);	/* test for IP in set (userspace: ipset -T set IP)	 * return 0 if not in set, 1 if in set.	 */	int (*testip) (struct ip_set *set,		       const void *data, size_t size,		       ip_set_ip_t *ip);	/*	 * Size of the data structure passed by when	 * adding/deletin/testing an entry.	 */	size_t reqsize;	/* Add IP into set (userspace: ipset -A set IP)	 * Return -EEXIST if the address is already in the set,	 * and -ERANGE if the address lies outside the set bounds.	 * If the address was not already in the set, 0 is returned.	 */	int (*addip) (struct ip_set *set, 		      const void *data, size_t size,		      ip_set_ip_t *ip);	/* Add IP into set (kernel: iptables ... -j SET set src|dst)	 * Return -EEXIST if the address is already in the set,	 * and -ERANGE if the address lies outside the set bounds.	 * If the address was not already in the set, 0 is returned.	 */	int (*addip_kernel) (struct ip_set *set,			     const struct sk_buff * skb, 			     ip_set_ip_t *ip,			     const u_int32_t *flags,			     unsigned char index);	/* remove IP from set (userspace: ipset -D set --entry x)	 * Return -EEXIST if the address is NOT in the set,	 * and -ERANGE if the address lies outside the set bounds.	 * If the address really was in the set, 0 is returned.	 */	int (*delip) (struct ip_set *set, 		      const void *data, size_t size,		      ip_set_ip_t *ip);	/* remove IP from set (kernel: iptables ... -j SET --entry x)	 * Return -EEXIST if the address is NOT in the set,	 * and -ERANGE if the address lies outside the set bounds.	 * If the address really was in the set, 0 is returned.	 */	int (*delip_kernel) (struct ip_set *set,			     const struct sk_buff * skb, 			     ip_set_ip_t *ip,			     const u_int32_t *flags,			     unsigned char index);	/* new set creation - allocated type specific items	 */	int (*create) (struct ip_set *set,		       const void *data, size_t size);	/* retry the operation after successfully tweaking the set	 */	int (*retry) (struct ip_set *set);	/* set destruction - free type specific items	 * There is no return value.	 * Can be called only when child sets are destroyed.	 */	void (*destroy) (struct ip_set *set);	/* set flushing - reset all bits in the set, or something similar.	 * There is no return value.	 */	void (*flush) (struct ip_set *set);	/* Listing: size needed for header	 */	size_t header_size;	/* Listing: Get the header	 *	 * Fill in the information in "data".	 * This function is always run after list_header_size() under a 	 * writelock on the set. Therefor is the length of "data" always 	 * correct. 	 */	void (*list_header) (const struct ip_set *set, 			     void *data);	/* Listing: Get the size for the set members	 */	int (*list_members_size) (const struct ip_set *set);	/* Listing: Get the set members	 *	 * Fill in the information in "data".	 * This function is always run after list_member_size() under a 	 * writelock on the set. Therefor is the length of "data" always 	 * correct. 	 */	void (*list_members) (const struct ip_set *set,			      void *data);	char typename[IP_SET_MAXNAMELEN];	unsigned char features;	int protocol_version;	/* Set this to THIS_MODULE if you are a module, otherwise NULL */	struct module *me;};extern int ip_set_register_set_type(struct ip_set_type *set_type);extern void ip_set_unregister_set_type(struct ip_set_type *set_type);/* A generic ipset */struct ip_set {	char name[IP_SET_MAXNAMELEN];	/* the name of the set */	rwlock_t lock;			/* lock for concurrency control */	ip_set_id_t id;			/* set id for swapping */	ip_set_id_t binding;		/* default binding for the set */	atomic_t ref;			/* in kernel and in hash references */	struct ip_set_type *type; 	/* the set types */	void *data;			/* pooltype specific data */};/* Structure to bind set elements to sets */struct ip_set_hash {	struct list_head list;		/* list of clashing entries in hash */	ip_set_ip_t ip;			/* ip from set */	ip_set_id_t id;			/* set id */	ip_set_id_t binding;		/* set we bind the element to */};/* register and unregister set references */extern ip_set_id_t ip_set_get_byname(const char name[IP_SET_MAXNAMELEN]);extern ip_set_id_t ip_set_get_byindex(ip_set_id_t id);extern void ip_set_put(ip_set_id_t id);/* API for iptables set match, and SET target */extern void ip_set_addip_kernel(ip_set_id_t id,				const struct sk_buff *skb,				const u_int32_t *flags);extern void ip_set_delip_kernel(ip_set_id_t id,				const struct sk_buff *skb,				const u_int32_t *flags);extern int ip_set_testip_kernel(ip_set_id_t id,				const struct sk_buff *skb,				const u_int32_t *flags);#endif				/* __KERNEL__ */#endif /*_IP_SET_H*/