netfilter: ipset: set match: add support to match the counters

The new revision of the set match supports to match the counters
and to suppress updating the counters at matching too.

At the set:list types, the updating of the subcounters can be
suppressed as well.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

3 files changed, 77 insertions, 3 deletions

diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index f6d878a46c43..f77139007983 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -413,7 +413,7 @@ ip_set_test(ip_set_id_t index, const struct sk_buff *skb,
                 ret = 1;
         } else {
                 /* --return-nomatch: invert matched element */
-                if ((opt->flags & IPSET_RETURN_NOMATCH) &&
+                if ((opt->cmdflags & IPSET_FLAG_RETURN_NOMATCH) &&
                     (set->type->features & IPSET_TYPE_NOMATCH) &&
                     (ret > 0 || ret == -ENOTEMPTY))
                         ret = -ret;
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index c09022e37406..979b8c90e422 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -84,9 +84,13 @@ list_set_ktest(struct ip_set *set, const struct sk_buff *skb,
 {
         struct list_set *map = set->data;
         struct set_elem *e;
-        u32 i;
+        u32 i, cmdflags = opt->cmdflags;
         int ret;
 
+        /* Don't lookup sub-counters at all */
+        opt->cmdflags &= ~IPSET_FLAG_MATCH_COUNTERS;
+        if (opt->cmdflags & IPSET_FLAG_SKIP_SUBCOUNTER_UPDATE)
+                opt->cmdflags &= ~IPSET_FLAG_SKIP_COUNTER_UPDATE;
         for (i = 0; i < map->size; i++) {
                 e = list_set_elem(map, i);
                 if (e->id == IPSET_INVALID_ID)
@@ -99,7 +103,7 @@ list_set_ktest(struct ip_set *set, const struct sk_buff *skb,
                         if (SET_WITH_COUNTER(set))
                                 ip_set_update_counter(ext_counter(e, map),
                                                       ext, &opt->ext,
-                                                      opt->cmdflags);
+                                                      cmdflags);
                         return ret;
                 }
         }
diff --git a/net/netfilter/xt_set.c b/net/netfilter/xt_set.c
index 636c5199ff35..31790e789e22 100644
--- a/net/netfilter/xt_set.c
+++ b/net/netfilter/xt_set.c
@@ -189,6 +189,9 @@ set_match_v1(const struct sk_buff *skb, struct xt_action_param *par)
         ADT_OPT(opt, par->family, info->match_set.dim,
                 info->match_set.flags, 0, UINT_MAX);
 
+        if (opt.flags & IPSET_RETURN_NOMATCH)
+                opt.cmdflags |= IPSET_FLAG_RETURN_NOMATCH;
+
         return match_set(info->match_set.index, skb, par, &opt,
                          info->match_set.flags & IPSET_INV_MATCH);
 }
@@ -317,6 +320,52 @@ set_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
 #define set_target_v2_checkentry        set_target_v1_checkentry
 #define set_target_v2_destroy           set_target_v1_destroy
 
+/* Revision 3 match */
+
+static bool
+match_counter(u64 counter, const struct ip_set_counter_match *info)
+{
+        switch (info->op) {
+        case IPSET_COUNTER_NONE:
+                return true;
+        case IPSET_COUNTER_EQ:
+                return counter == info->value;
+        case IPSET_COUNTER_NE:
+                return counter != info->value;
+        case IPSET_COUNTER_LT:
+                return counter < info->value;
+        case IPSET_COUNTER_GT:
+                return counter > info->value;
+        }
+        return false;
+}
+
+static bool
+set_match_v3(const struct sk_buff *skb, struct xt_action_param *par)
+{
+        const struct xt_set_info_match_v3 *info = par->matchinfo;
+        ADT_OPT(opt, par->family, info->match_set.dim,
+                info->match_set.flags, info->flags, UINT_MAX);
+        int ret;
+
+        if (info->packets.op != IPSET_COUNTER_NONE ||
+            info->bytes.op != IPSET_COUNTER_NONE)
+                opt.cmdflags |= IPSET_FLAG_MATCH_COUNTERS;
+
+        ret = match_set(info->match_set.index, skb, par, &opt,
+                        info->match_set.flags & IPSET_INV_MATCH);
+
+        if (!(ret && opt.cmdflags & IPSET_FLAG_MATCH_COUNTERS))
+                return ret;
+
+        if (!match_counter(opt.ext.packets, &info->packets))
+                return 0;
+        return match_counter(opt.ext.bytes, &info->bytes);
+}
+
+#define set_match_v3_checkentry set_match_v1_checkentry
+#define set_match_v3_destroy    set_match_v1_destroy
+
 static struct xt_match set_matches[] __read_mostly = {
         {
                 .name           = "set",
@@ -369,6 +418,27 @@ static struct xt_match set_matches[] __read_mostly = {
                 .destroy        = set_match_v1_destroy,
                 .me             = THIS_MODULE
         },
+        /* counters support: update, match */
+        {
+                .name           = "set",
+                .family         = NFPROTO_IPV4,
+                .revision       = 3,
+                .match          = set_match_v3,
+                .matchsize      = sizeof(struct xt_set_info_match_v3),
+                .checkentry     = set_match_v3_checkentry,
+                .destroy        = set_match_v3_destroy,
+                .me             = THIS_MODULE
+        },
+        {
+                .name           = "set",
+                .family         = NFPROTO_IPV6,
+                .revision       = 3,
+                .match          = set_match_v3,
+                .matchsize      = sizeof(struct xt_set_info_match_v3),
+                .checkentry     = set_match_v3_checkentry,
+                .destroy        = set_match_v3_destroy,
+                .me             = THIS_MODULE
+        },
 };
 
 static struct xt_target set_targets[] __read_mostly = {