netfilter: ipset: Add hash:net,port,net module to kernel.

This adds a new set that provides similar functionality to ip,port,net
but permits arbitrary size subnets for both the first and last
parameter.

Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>

3 files changed, 598 insertions, 0 deletions

diff --git a/net/netfilter/ipset/Kconfig b/net/netfilter/ipset/Kconfig
index 9119f658a69b..a2d6263b6c64 100644
--- a/net/netfilter/ipset/Kconfig
+++ b/net/netfilter/ipset/Kconfig
@@ -90,6 +90,15 @@ config IP_SET_HASH_IPPORTNET
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP_SET_HASH_NETPORTNET
+        tristate "hash:net,port,net set support"
+        depends on IP_SET
+        help
+          This option adds the hash:net,port,net set type support, by which
+          one can store two IPv4/IPv6 subnets, and a protocol/port in a set.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config IP_SET_HASH_NET
         tristate "hash:net set support"
         depends on IP_SET
diff --git a/net/netfilter/ipset/Makefile b/net/netfilter/ipset/Makefile
index 43eef7a19e3c..44b2d38476fa 100644
--- a/net/netfilter/ipset/Makefile
+++ b/net/netfilter/ipset/Makefile
@@ -21,6 +21,7 @@ obj-$(CONFIG_IP_SET_HASH_NET) += ip_set_hash_net.o
 obj-$(CONFIG_IP_SET_HASH_NETPORT) += ip_set_hash_netport.o
 obj-$(CONFIG_IP_SET_HASH_NETIFACE) += ip_set_hash_netiface.o
 obj-$(CONFIG_IP_SET_HASH_NETNET) += ip_set_hash_netnet.o
+obj-$(CONFIG_IP_SET_HASH_NETPORTNET) += ip_set_hash_netportnet.o
 
 # list types
 obj-$(CONFIG_IP_SET_LIST_SET) += ip_set_list_set.o
diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c
new file mode 100644
index 000000000000..363fab933d48
--- /dev/null
+++ b/net/netfilter/ipset/ip_set_hash_netportnet.c
@@ -0,0 +1,588 @@
+/* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/* Kernel module implementing an IP set type: the hash:ip,port,net type */
+
+#include <linux/jhash.h>
+#include <linux/module.h>
+#include <linux/ip.h>
+#include <linux/skbuff.h>
+#include <linux/errno.h>
+#include <linux/random.h>
+#include <net/ip.h>
+#include <net/ipv6.h>
+#include <net/netlink.h>
+#include <net/tcp.h>
+
+#include <linux/netfilter.h>
+#include <linux/netfilter/ipset/pfxlen.h>
+#include <linux/netfilter/ipset/ip_set.h>
+#include <linux/netfilter/ipset/ip_set_getport.h>
+#include <linux/netfilter/ipset/ip_set_hash.h>
+
+#define IPSET_TYPE_REV_MIN      0
+#define IPSET_TYPE_REV_MAX      0 /* Comments support added */
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>");
+IP_SET_MODULE_DESC("hash:net,port,net", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
+MODULE_ALIAS("ip_set_hash:net,port,net");
+
+/* Type specific function prefix */
+#define HTYPE           hash_netportnet
+#define IP_SET_HASH_WITH_PROTO
+#define IP_SET_HASH_WITH_NETS
+#define IPSET_NET_COUNT 2
+
+/* IPv4 variant */
+
+/* Member elements */
+struct hash_netportnet4_elem {
+        union {
+                __be32 ip[2];
+                __be64 ipcmp;
+        };
+        __be16 port;
+        union {
+                u8 cidr[2];
+                u16 ccmp;
+        };
+        u8 nomatch:1;
+        u8 proto;
+};
+
+/* Common functions */
+
+static inline bool
+hash_netportnet4_data_equal(const struct hash_netportnet4_elem *ip1,
+                           const struct hash_netportnet4_elem *ip2,
+                           u32 *multi)
+{
+        return ip1->ipcmp == ip2->ipcmp &&
+               ip1->ccmp == ip2->ccmp &&
+               ip1->port == ip2->port &&
+               ip1->proto == ip2->proto;
+}
+
+static inline int
+hash_netportnet4_do_data_match(const struct hash_netportnet4_elem *elem)
+{
+        return elem->nomatch ? -ENOTEMPTY : 1;
+}
+
+static inline void
+hash_netportnet4_data_set_flags(struct hash_netportnet4_elem *elem, u32 flags)
+{
+        elem->nomatch = !!((flags >> 16) & IPSET_FLAG_NOMATCH);
+}
+
+static inline void
+hash_netportnet4_data_reset_flags(struct hash_netportnet4_elem *elem, u8 *flags)
+{
+        swap(*flags, elem->nomatch);
+}
+
+static inline void
+hash_netportnet4_data_reset_elem(struct hash_netportnet4_elem *elem,
+                                struct hash_netportnet4_elem *orig)
+{
+        elem->ip[1] = orig->ip[1];
+}
+
+static inline void
+hash_netportnet4_data_netmask(struct hash_netportnet4_elem *elem,
+                              u8 cidr, bool inner)
+{
+        if (inner) {
+                elem->ip[1] &= ip_set_netmask(cidr);
+                elem->cidr[1] = cidr;
+        } else {
+                elem->ip[0] &= ip_set_netmask(cidr);
+                elem->cidr[0] = cidr;
+        }
+}
+
+static bool
+hash_netportnet4_data_list(struct sk_buff *skb,
+                          const struct hash_netportnet4_elem *data)
+{
+        u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
+
+        if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip[0]) ||
+            nla_put_ipaddr4(skb, IPSET_ATTR_IP2, data->ip[1]) ||
+            nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr[0]) ||
+            nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr[1]) ||
+            nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
+            (flags &&
+             nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
+                goto nla_put_failure;
+        return 0;
+
+nla_put_failure:
+        return 1;
+}
+
+static inline void
+hash_netportnet4_data_next(struct hash_netportnet4_elem *next,
+                          const struct hash_netportnet4_elem *d)
+{
+        next->ipcmp = d->ipcmp;
+        next->port = d->port;
+}
+
+#define MTYPE           hash_netportnet4
+#define PF              4
+#define HOST_MASK       32
+#include "ip_set_hash_gen.h"
+
+static int
+hash_netportnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
+                     const struct xt_action_param *par,
+                     enum ipset_adt adt, struct ip_set_adt_opt *opt)
+{
+        const struct hash_netportnet *h = set->data;
+        ipset_adtfn adtfn = set->variant->adt[adt];
+        struct hash_netportnet4_elem e = {
+                .cidr[0] = IP_SET_INIT_CIDR(h->nets[0].cidr[0], HOST_MASK),