History

netfilter: ipset: Expose the initval hash parameter to userspace

It makes possible to reproduce exactly the same set after a save/restore.

Jozsef Kadlecsik committed 6 years ago

Commit 3976ca11 parent ccf0a4b14 files · +34 −17Browse files

Unified · Split

14 files
  1. include/uapi/linux/netfilter/ipset/ip_set.h +1 −1
  2. net/netfilter/ipset/ip_set_hash_gen.h +9 −4
  3. net/netfilter/ipset/ip_set_hash_ip.c +2 −1
  4. net/netfilter/ipset/ip_set_hash_ipmac.c +2 −1
  5. net/netfilter/ipset/ip_set_hash_ipmark.c +2 −1
  6. net/netfilter/ipset/ip_set_hash_ipport.c +2 −1
  7. net/netfilter/ipset/ip_set_hash_ipportip.c +2 −1
  8. net/netfilter/ipset/ip_set_hash_ipportnet.c +2 −1
  9. net/netfilter/ipset/ip_set_hash_mac.c +2 −1
  10. net/netfilter/ipset/ip_set_hash_net.c +2 −1
  11. net/netfilter/ipset/ip_set_hash_netiface.c +2 −1
  12. net/netfilter/ipset/ip_set_hash_netnet.c +2 −1
  13. net/netfilter/ipset/ip_set_hash_netport.c +2 −1
  14. net/netfilter/ipset/ip_set_hash_netportnet.c +2 −1
include/uapi/linux/netfilter/ipset/ip_set.h+1−1
@@ -92,7 +92,7 @@ enum { · 91 unmodified lines
9292 /* Reserve empty slots */
9393 IPSET_ATTR_CADT_MAX = 16,
9494 /* Create-only specific attributes */
95− IPSET_ATTR_GC,
95+ IPSET_ATTR_INITVAL, /* was unused IPSET_ATTR_GC */
9696 IPSET_ATTR_HASHSIZE,
9797 IPSET_ATTR_MAXELEM,
9898 IPSET_ATTR_NETMASK,
net/netfilter/ipset/ip_set_hash_gen.h+9−4
@@ -1301,9 +1301,11 @@ mtype_head(struct ip_set *set, struct sk_buff *skb) · 1300 unmodified lines
13011301 if (nla_put_u32(skb, IPSET_ATTR_MARKMASK, h->markmask))
13021302 goto nla_put_failure;
13031303 #endif
1304− if (set->flags & IPSET_CREATE_FLAG_BUCKETSIZE &&
1305− nla_put_u8(skb, IPSET_ATTR_BUCKETSIZE, h->bucketsize))
1306− goto nla_put_failure;
1304+ if (set->flags & IPSET_CREATE_FLAG_BUCKETSIZE) {
1305+ if (nla_put_u8(skb, IPSET_ATTR_BUCKETSIZE, h->bucketsize) ||
1306+ nla_put_net32(skb, IPSET_ATTR_INITVAL, htonl(h->initval)))
1307+ goto nla_put_failure;
1308+ }
13071309 if (nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref)) ||
13081310 nla_put_net32(skb, IPSET_ATTR_MEMSIZE, htonl(memsize)) ||
13091311 nla_put_net32(skb, IPSET_ATTR_ELEMENTS, htonl(elements)))
@@ -1546,7 +1548,10 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set, · 236 unmodified lines
15461548 #ifdef IP_SET_HASH_WITH_MARKMASK
15471549 h->markmask = markmask;
15481550 #endif
1549− get_random_bytes(&h->initval, sizeof(h->initval));
1551+ if (tb[IPSET_ATTR_INITVAL])
1552+ h->initval = ntohl(nla_get_be32(tb[IPSET_ATTR_INITVAL]));
1553+ else
1554+ get_random_bytes(&h->initval, sizeof(h->initval));
15501555 h->bucketsize = AHASH_MAX_SIZE;
15511556 if (tb[IPSET_ATTR_BUCKETSIZE]) {
15521557 h->bucketsize = nla_get_u8(tb[IPSET_ATTR_BUCKETSIZE]);
net/netfilter/ipset/ip_set_hash_ip.c+2−1
@@ -24,7 +24,7 @@ · 23 unmodified lines
2424 /* 2 Comments support */
2525 /* 3 Forceadd support */
2626 /* 4 skbinfo support */
27−#define IPSET_TYPE_REV_MAX 5 /* bucketsize support */
27+#define IPSET_TYPE_REV_MAX 5 /* bucketsize, initval support */
2828
2929 MODULE_LICENSE("GPL");
3030 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
@@ -283,6 +283,7 @@ static struct ip_set_type hash_ip_type __read_mostly = { · 252 unmodified lines
283283 .create_policy = {
284284 [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
285285 [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
286+ [IPSET_ATTR_INITVAL] = { .type = NLA_U32 },
286287 [IPSET_ATTR_BUCKETSIZE] = { .type = NLA_U8 },
287288 [IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
288289 [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
net/netfilter/ipset/ip_set_hash_ipmac.c+2−1
@@ -23,7 +23,7 @@ · 22 unmodified lines
2323 #include <linux/netfilter/ipset/ip_set_hash.h>
2424
2525 #define IPSET_TYPE_REV_MIN 0
26−#define IPSET_TYPE_REV_MAX 1 /* bucketsize support */
26+#define IPSET_TYPE_REV_MAX 1 /* bucketsize, initval support */
2727
2828 MODULE_LICENSE("GPL");
2929 MODULE_AUTHOR("Tomasz Chilinski <tomasz.chilinski@chilan.com>");
@@ -273,6 +273,7 @@ static struct ip_set_type hash_ipmac_type __read_mostly = { · 243 unmodified lines
273273 .create_policy = {
274274 [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
275275 [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
276+ [IPSET_ATTR_INITVAL] = { .type = NLA_U32 },
276277 [IPSET_ATTR_BUCKETSIZE] = { .type = NLA_U8 },
277278 [IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
278279 [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
net/netfilter/ipset/ip_set_hash_ipmark.c+2−1
@@ -22,7 +22,7 @@ · 21 unmodified lines
2222 #define IPSET_TYPE_REV_MIN 0
2323 /* 1 Forceadd support */
2424 /* 2 skbinfo support */
25−#define IPSET_TYPE_REV_MAX 3 /* bucketsize support */
25+#define IPSET_TYPE_REV_MAX 3 /* bucketsize, initval support */
2626
2727 MODULE_LICENSE("GPL");
2828 MODULE_AUTHOR("Vytas Dauksa <vytas.dauksa@smoothwall.net>");
@@ -281,6 +281,7 @@ static struct ip_set_type hash_ipmark_type __read_mostly = { · 252 unmodified lines
281281 [IPSET_ATTR_MARKMASK] = { .type = NLA_U32 },
282282 [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
283283 [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
284+ [IPSET_ATTR_INITVAL] = { .type = NLA_U32 },
284285 [IPSET_ATTR_BUCKETSIZE] = { .type = NLA_U8 },
285286 [IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
286287 [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
net/netfilter/ipset/ip_set_hash_ipport.c+2−1
@@ -26,7 +26,7 @@ · 25 unmodified lines
2626 /* 3 Comments support added */
2727 /* 4 Forceadd support added */
2828 /* 5 skbinfo support added */
29−#define IPSET_TYPE_REV_MAX 6 /* bucketsize support added */
29+#define IPSET_TYPE_REV_MAX 6 /* bucketsize, initval support added */
3030
3131 MODULE_LICENSE("GPL");
3232 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
@@ -347,6 +347,7 @@ static struct ip_set_type hash_ipport_type __read_mostly = { · 314 unmodified lines
347347 .create_policy = {
348348 [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
349349 [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
350+ [IPSET_ATTR_INITVAL] = { .type = NLA_U32 },
350351 [IPSET_ATTR_BUCKETSIZE] = { .type = NLA_U8 },
351352 [IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
352353 [IPSET_ATTR_PROTO] = { .type = NLA_U8 },
net/netfilter/ipset/ip_set_hash_ipportip.c+2−1
@@ -26,7 +26,7 @@ · 25 unmodified lines
2626 /* 3 Comments support added */
2727 /* 4 Forceadd support added */
2828 /* 5 skbinfo support added */
29−#define IPSET_TYPE_REV_MAX 6 /* bucketsize support added */
29+#define IPSET_TYPE_REV_MAX 6 /* bucketsize, initval support added */
3030
3131 MODULE_LICENSE("GPL");
3232 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
@@ -362,6 +362,7 @@ static struct ip_set_type hash_ipportip_type __read_mostly = { · 329 unmodified lines
362362 .create_policy = {
363363 [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
364364 [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
365+ [IPSET_ATTR_INITVAL] = { .type = NLA_U32 },
365366 [IPSET_ATTR_BUCKETSIZE] = { .type = NLA_U8 },
366367 [IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
367368 [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
net/netfilter/ipset/ip_set_hash_ipportnet.c+2−1
@@ -28,7 +28,7 @@ · 27 unmodified lines
2828 /* 5 Comments support added */
2929 /* 6 Forceadd support added */
3030 /* 7 skbinfo support added */
31−#define IPSET_TYPE_REV_MAX 8 /* bucketsize support added */
31+#define IPSET_TYPE_REV_MAX 8 /* bucketsize, initval support added */
3232
3333 MODULE_LICENSE("GPL");
3434 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
@@ -519,6 +519,7 @@ static struct ip_set_type hash_ipportnet_type __read_mostly = { · 484 unmodified lines
519519 .create_policy = {
520520 [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
521521 [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
522+ [IPSET_ATTR_INITVAL] = { .type = NLA_U32 },
522523 [IPSET_ATTR_BUCKETSIZE] = { .type = NLA_U8 },
523524 [IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
524525 [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
net/netfilter/ipset/ip_set_hash_mac.c+2−1
@@ -16,7 +16,7 @@ · 15 unmodified lines
1616 #include <linux/netfilter/ipset/ip_set_hash.h>
1717
1818 #define IPSET_TYPE_REV_MIN 0
19−#define IPSET_TYPE_REV_MAX 1 /* bucketsize support */
19+#define IPSET_TYPE_REV_MAX 1 /* bucketsize, initval support */
2020
2121 MODULE_LICENSE("GPL");
2222 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
@@ -130,6 +130,7 @@ static struct ip_set_type hash_mac_type __read_mostly = { · 107 unmodified lines
130130 .create_policy = {
131131 [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
132132 [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
133+ [IPSET_ATTR_INITVAL] = { .type = NLA_U32 },
133134 [IPSET_ATTR_BUCKETSIZE] = { .type = NLA_U8 },
134135 [IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
135136 [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
net/netfilter/ipset/ip_set_hash_net.c+2−1
@@ -25,7 +25,7 @@ · 24 unmodified lines
2525 /* 4 Comments support added */
2626 /* 5 Forceadd support added */
2727 /* 6 skbinfo support added */
28−#define IPSET_TYPE_REV_MAX 7 /* bucketsize support added */
28+#define IPSET_TYPE_REV_MAX 7 /* bucketsize, initval support added */
2929
3030 MODULE_LICENSE("GPL");
3131 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
@@ -360,6 +360,7 @@ static struct ip_set_type hash_net_type __read_mostly = { · 328 unmodified lines
360360 .create_policy = {
361361 [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
362362 [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
363+ [IPSET_ATTR_INITVAL] = { .type = NLA_U32 },
363364 [IPSET_ATTR_BUCKETSIZE] = { .type = NLA_U8 },
364365 [IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
365366 [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
net/netfilter/ipset/ip_set_hash_netiface.c+2−1
@@ -27,7 +27,7 @@ · 26 unmodified lines
2727 /* 5 Forceadd support added */
2828 /* 6 skbinfo support added */
2929 /* 7 interface wildcard support added */
30−#define IPSET_TYPE_REV_MAX 8 /* bucketsize support added */
30+#define IPSET_TYPE_REV_MAX 8 /* bucketsize, initval support added */
3131
3232 MODULE_LICENSE("GPL");
3333 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
@@ -476,6 +476,7 @@ static struct ip_set_type hash_netiface_type __read_mostly = { · 442 unmodified lines
476476 .create_policy = {
477477 [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
478478 [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
479+ [IPSET_ATTR_INITVAL] = { .type = NLA_U32 },
479480 [IPSET_ATTR_BUCKETSIZE] = { .type = NLA_U8 },
480481 [IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
481482 [IPSET_ATTR_PROTO] = { .type = NLA_U8 },
net/netfilter/ipset/ip_set_hash_netnet.c+2−1
@@ -23,7 +23,7 @@ · 22 unmodified lines
2323 #define IPSET_TYPE_REV_MIN 0
2424 /* 1 Forceadd support added */
2525 /* 2 skbinfo support added */
26−#define IPSET_TYPE_REV_MAX 3 /* bucketsize support added */
26+#define IPSET_TYPE_REV_MAX 3 /* bucketsize, initval support added */
2727
2828 MODULE_LICENSE("GPL");
2929 MODULE_AUTHOR("Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>");
@@ -465,6 +465,7 @@ static struct ip_set_type hash_netnet_type __read_mostly = { · 435 unmodified lines
465465 .create_policy = {
466466 [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
467467 [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
468+ [IPSET_ATTR_INITVAL] = { .type = NLA_U32 },
468469 [IPSET_ATTR_BUCKETSIZE] = { .type = NLA_U8 },
469470 [IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
470471 [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
net/netfilter/ipset/ip_set_hash_netport.c+2−1
@@ -27,7 +27,7 @@ · 26 unmodified lines
2727 /* 5 Comments support added */
2828 /* 6 Forceadd support added */
2929 /* 7 skbinfo support added */
30−#define IPSET_TYPE_REV_MAX 8 /* bucketsize support added */
30+#define IPSET_TYPE_REV_MAX 8 /* bucketsize, initval support added */
3131
3232 MODULE_LICENSE("GPL");
3333 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
@@ -466,6 +466,7 @@ static struct ip_set_type hash_netport_type __read_mostly = { · 432 unmodified lines
466466 .create_policy = {
467467 [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
468468 [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
469+ [IPSET_ATTR_INITVAL] = { .type = NLA_U32 },
469470 [IPSET_ATTR_BUCKETSIZE] = { .type = NLA_U8 },
470471 [IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
471472 [IPSET_ATTR_PROTO] = { .type = NLA_U8 },
net/netfilter/ipset/ip_set_hash_netportnet.c+2−1
@@ -24,7 +24,7 @@ · 23 unmodified lines
2424 /* 0 Comments support added */
2525 /* 1 Forceadd support added */
2626 /* 2 skbinfo support added */
27−#define IPSET_TYPE_REV_MAX 3 /* bucketsize support added */
27+#define IPSET_TYPE_REV_MAX 3 /* bucketsize, initval support added */
2828
2929 MODULE_LICENSE("GPL");
3030 MODULE_AUTHOR("Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>");
@@ -564,6 +564,7 @@ static struct ip_set_type hash_netportnet_type __read_mostly = { · 533 unmodified lines
564564 .create_policy = {
565565 [IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
566566 [IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
567+ [IPSET_ATTR_INITVAL] = { .type = NLA_U32 },
567568 [IPSET_ATTR_BUCKETSIZE] = { .type = NLA_U8 },
568569 [IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
569570 [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },