net/netfilter/ipset/ip_set_hash_netportnet.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@netfilter.org> */
   3
   4 /* Kernel module implementing an IP set type: the hash:ip,port,net type */
   5
   6 #include <linux/jhash.h>
   7 #include <linux/module.h>
   8 #include <linux/ip.h>
   9 #include <linux/skbuff.h>
  10 #include <linux/errno.h>
  11 #include <linux/random.h>
  12 #include <net/ip.h>
  13 #include <net/ipv6.h>
  14 #include <net/netlink.h>
  15 #include <net/tcp.h>
  16
  17 #include <linux/netfilter.h>
  18 #include <linux/netfilter/ipset/pfxlen.h>
  19 #include <linux/netfilter/ipset/ip_set.h>
  20 #include <linux/netfilter/ipset/ip_set_getport.h>
  21 #include <linux/netfilter/ipset/ip_set_hash.h>
  22
  23 #define IPSET_TYPE_REV_MIN      0
  24 /*                              0    Comments support added */
  25 /*                              1    Forceadd support added */
  26 #define IPSET_TYPE_REV_MAX      2 /* skbinfo support added */
  27
  28 MODULE_LICENSE("GPL");
  29 MODULE_AUTHOR("Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>");
  30 IP_SET_MODULE_DESC("hash:net,port,net", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
  31 MODULE_ALIAS("ip_set_hash:net,port,net");
  32
  33 /* Type specific function prefix */
  34 #define HTYPE           hash_netportnet
  35 #define IP_SET_HASH_WITH_PROTO
  36 #define IP_SET_HASH_WITH_NETS
  37 #define IPSET_NET_COUNT 2
  38 #define IP_SET_HASH_WITH_NET0
  39
  40 /* IPv4 variant */
  41
  42 /* Member elements */
  43 struct hash_netportnet4_elem {
  44         union {
  45                 __be32 ip[2];
  46                 __be64 ipcmp;
  47         };
  48         __be16 port;
  49         union {
  50                 u8 cidr[2];
  51                 u16 ccmp;
  52         };
  53         u16 padding;
  54         u8 nomatch;
  55         u8 proto;
  56 };
  57
  58 /* Common functions */
  59
  60 static bool
  61 hash_netportnet4_data_equal(const struct hash_netportnet4_elem *ip1,
  62                             const struct hash_netportnet4_elem *ip2,
  63                             u32 *multi)
  64 {
  65         return ip1->ipcmp == ip2->ipcmp &&
  66                ip1->ccmp == ip2->ccmp &&
  67                ip1->port == ip2->port &&
  68                ip1->proto == ip2->proto;
  69 }
  70
  71 static int
  72 hash_netportnet4_do_data_match(const struct hash_netportnet4_elem *elem)
  73 {
  74         return elem->nomatch ? -ENOTEMPTY : 1;
  75 }
  76
  77 static void
  78 hash_netportnet4_data_set_flags(struct hash_netportnet4_elem *elem, u32 flags)
  79 {
  80         elem->nomatch = !!((flags >> 16) & IPSET_FLAG_NOMATCH);
  81 }
  82
  83 static void
  84 hash_netportnet4_data_reset_flags(struct hash_netportnet4_elem *elem, u8 *flags)
  85 {
  86         swap(*flags, elem->nomatch);
  87 }
  88
  89 static void
  90 hash_netportnet4_data_reset_elem(struct hash_netportnet4_elem *elem,
  91                                  struct hash_netportnet4_elem *orig)
  92 {
  93         elem->ip[1] = orig->ip[1];
  94 }
  95
  96 static void
  97 hash_netportnet4_data_netmask(struct hash_netportnet4_elem *elem,
  98                               u8 cidr, bool inner)
  99 {
 100         if (inner) {
 101                 elem->ip[1] &= ip_set_netmask(cidr);
 102                 elem->cidr[1] = cidr;
 103         } else {
 104                 elem->ip[0] &= ip_set_netmask(cidr);
 105                 elem->cidr[0] = cidr;
 106         }
 107 }
 108
 109 static bool
 110 hash_netportnet4_data_list(struct sk_buff *skb,
 111                            const struct hash_netportnet4_elem *data)
 112 {
 113         u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
 114
 115         if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip[0]) ||
 116             nla_put_ipaddr4(skb, IPSET_ATTR_IP2, data->ip[1]) ||
 117             nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
 118             nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr[0]) ||
 119             nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr[1]) ||
 120             nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
 121             (flags &&
 122              nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
 123                 goto nla_put_failure;
 124         return false;
 125
 126 nla_put_failure:
 127         return true;
 128 }
 129
 130 static void
 131 hash_netportnet4_data_next(struct hash_netportnet4_elem *next,
 132                            const struct hash_netportnet4_elem *d)
 133 {
 134         next->ipcmp = d->ipcmp;
 135         next->port = d->port;
 136 }
 137
 138 #define MTYPE           hash_netportnet4
 139 #define HOST_MASK       32
 140 #include "ip_set_hash_gen.h"
 141
 142 static void
 143 hash_netportnet4_init(struct hash_netportnet4_elem *e)
 144 {
 145         e->cidr[0] = HOST_MASK;
 146         e->cidr[1] = HOST_MASK;
 147 }
 148
 149 static int
 150 hash_netportnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
 151                       const struct xt_action_param *par,
 152                       enum ipset_adt adt, struct ip_set_adt_opt *opt)
 153 {
 154         const struct hash_netportnet4 *h = set->data;
 155         ipset_adtfn adtfn = set->variant->adt[adt];
 156         struct hash_netportnet4_elem e = { };
 157         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
 158
 159         e.cidr[0] = INIT_CIDR(h->nets[0].cidr[0], HOST_MASK);
 160         e.cidr[1] = INIT_CIDR(h->nets[0].cidr[1], HOST_MASK);
 161         if (adt == IPSET_TEST)
 162                 e.ccmp = (HOST_MASK << (sizeof(e.cidr[0]) * 8)) | HOST_MASK;
 163
 164         if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
 165                                  &e.port, &e.proto))
 166                 return -EINVAL;
 167
 168         ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip[0]);
 169         ip4addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &e.ip[1]);
 170         e.ip[0] &= ip_set_netmask(e.cidr[0]);
 171         e.ip[1] &= ip_set_netmask(e.cidr[1]);
 172
 173         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
 174 }
 175
 176 static u32
 177 hash_netportnet4_range_to_cidr(u32 from, u32 to, u8 *cidr)
 178 {
 179         if (from == 0 && to == UINT_MAX) {
 180                 *cidr = 0;
 181                 return to;
 182         }
 183         return ip_set_range_to_cidr(from, to, cidr);
 184 }
 185
 186 static int
 187 hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
 188                       enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 189 {
 190         struct hash_netportnet4 *h = set->data;
 191         ipset_adtfn adtfn = set->variant->adt[adt];
 192         struct hash_netportnet4_elem e = { };
 193         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
 194         u32 ip = 0, ip_to = 0, p = 0, port, port_to;
 195         u32 ip2_from = 0, ip2_to = 0, ip2, i = 0;
 196         bool with_ports = false;
 197         int ret;
 198
 199         if (tb[IPSET_ATTR_LINENO])
 200                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
 201
 202         hash_netportnet4_init(&e);
 203         if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
 204                      !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
 205                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
 206                      !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
 207                 return -IPSET_ERR_PROTOCOL;
 208
 209         ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
 210         if (ret)
 211                 return ret;
 212
 213         ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2], &ip2_from);
 214         if (ret)
 215                 return ret;
 216
 217         ret = ip_set_get_extensions(set, tb, &ext);
 218         if (ret)
 219                 return ret;
 220
 221         if (tb[IPSET_ATTR_CIDR]) {
 222                 e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
 223                 if (e.cidr[0] > HOST_MASK)
 224                         return -IPSET_ERR_INVALID_CIDR;
 225         }
 226
 227         if (tb[IPSET_ATTR_CIDR2]) {
 228                 e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
 229                 if (e.cidr[1] > HOST_MASK)
 230                         return -IPSET_ERR_INVALID_CIDR;
 231         }
 232
 233         e.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
 234
 235         if (tb[IPSET_ATTR_PROTO]) {
 236                 e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
 237                 with_ports = ip_set_proto_with_ports(e.proto);
 238
 239                 if (e.proto == 0)
 240                         return -IPSET_ERR_INVALID_PROTO;
 241         } else {
 242                 return -IPSET_ERR_MISSING_PROTO;
 243         }
 244
 245         if (!(with_ports || e.proto == IPPROTO_ICMP))
 246                 e.port = 0;
 247
 248         if (tb[IPSET_ATTR_CADT_FLAGS]) {
 249                 u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
 250
 251                 if (cadt_flags & IPSET_FLAG_NOMATCH)
 252                         flags |= (IPSET_FLAG_NOMATCH << 16);
 253         }
 254
 255         with_ports = with_ports && tb[IPSET_ATTR_PORT_TO];
 256         if (adt == IPSET_TEST ||
 257             !(tb[IPSET_ATTR_IP_TO] || with_ports || tb[IPSET_ATTR_IP2_TO])) {
 258                 e.ip[0] = htonl(ip & ip_set_hostmask(e.cidr[0]));
 259                 e.ip[1] = htonl(ip2_from & ip_set_hostmask(e.cidr[1]));
 260                 ret = adtfn(set, &e, &ext, &ext, flags);
 261                 return ip_set_enomatch(ret, flags, adt, set) ? -ret :
 262                        ip_set_eexist(ret, flags) ? 0 : ret;
 263         }
 264
 265         ip_to = ip;
 266         if (tb[IPSET_ATTR_IP_TO]) {
 267                 ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
 268                 if (ret)
 269                         return ret;
 270                 if (ip > ip_to)
 271                         swap(ip, ip_to);
 272                 if (unlikely(ip + UINT_MAX == ip_to))
 273                         return -IPSET_ERR_HASH_RANGE;
 274         } else {
 275                 ip_set_mask_from_to(ip, ip_to, e.cidr[0]);
 276         }
 277
 278         port_to = port = ntohs(e.port);
 279         if (tb[IPSET_ATTR_PORT_TO]) {
 280                 port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
 281                 if (port > port_to)
 282                         swap(port, port_to);
 283         }
 284
 285         ip2_to = ip2_from;
 286         if (tb[IPSET_ATTR_IP2_TO]) {
 287                 ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2_TO], &ip2_to);
 288                 if (ret)
 289                         return ret;
 290                 if (ip2_from > ip2_to)
 291                         swap(ip2_from, ip2_to);
 292                 if (unlikely(ip2_from + UINT_MAX == ip2_to))
 293                         return -IPSET_ERR_HASH_RANGE;
 294         } else {
 295                 ip_set_mask_from_to(ip2_from, ip2_to, e.cidr[1]);
 296         }
 297
 298         if (retried) {
 299                 ip = ntohl(h->next.ip[0]);
 300                 p = ntohs(h->next.port);
 301                 ip2 = ntohl(h->next.ip[1]);
 302         } else {
 303                 p = port;
 304                 ip2 = ip2_from;
 305         }
 306
 307         do {
 308                 e.ip[0] = htonl(ip);
 309                 ip = hash_netportnet4_range_to_cidr(ip, ip_to, &e.cidr[0]);
 310                 for (; p <= port_to; p++) {
 311                         e.port = htons(p);
 312                         do {
 313                                 i++;
 314                                 e.ip[1] = htonl(ip2);
 315                                 if (i > IPSET_MAX_RANGE) {
 316                                         hash_netportnet4_data_next(&h->next,
 317                                                                    &e);
 318                                         return -ERANGE;
 319                                 }
 320                                 ip2 = hash_netportnet4_range_to_cidr(ip2,
 321                                                         ip2_to, &e.cidr[1]);
 322                                 ret = adtfn(set, &e, &ext, &ext, flags);
 323                                 if (ret && !ip_set_eexist(ret, flags))
 324                                         return ret;
 325
 326                                 ret = 0;
 327                         } while (ip2++ < ip2_to);
 328                         ip2 = ip2_from;
 329                 }
 330                 p = port;
 331         } while (ip++ < ip_to);
 332         return ret;
 333 }
 334
 335 /* IPv6 variant */
 336
 337 struct hash_netportnet6_elem {
 338         union nf_inet_addr ip[2];
 339         __be16 port;
 340         union {
 341                 u8 cidr[2];
 342                 u16 ccmp;
 343         };
 344         u16 padding;
 345         u8 nomatch;
 346         u8 proto;
 347 };
 348
 349 /* Common functions */
 350
 351 static bool
 352 hash_netportnet6_data_equal(const struct hash_netportnet6_elem *ip1,
 353                             const struct hash_netportnet6_elem *ip2,
 354                             u32 *multi)
 355 {
 356         return ipv6_addr_equal(&ip1->ip[0].in6, &ip2->ip[0].in6) &&
 357                ipv6_addr_equal(&ip1->ip[1].in6, &ip2->ip[1].in6) &&
 358                ip1->ccmp == ip2->ccmp &&
 359                ip1->port == ip2->port &&
 360                ip1->proto == ip2->proto;
 361 }
 362
 363 static int
 364 hash_netportnet6_do_data_match(const struct hash_netportnet6_elem *elem)
 365 {
 366         return elem->nomatch ? -ENOTEMPTY : 1;
 367 }
 368
 369 static void
 370 hash_netportnet6_data_set_flags(struct hash_netportnet6_elem *elem, u32 flags)
 371 {
 372         elem->nomatch = !!((flags >> 16) & IPSET_FLAG_NOMATCH);
 373 }
 374
 375 static void
 376 hash_netportnet6_data_reset_flags(struct hash_netportnet6_elem *elem, u8 *flags)
 377 {
 378         swap(*flags, elem->nomatch);
 379 }
 380
 381 static void
 382 hash_netportnet6_data_reset_elem(struct hash_netportnet6_elem *elem,
 383                                  struct hash_netportnet6_elem *orig)
 384 {
 385         elem->ip[1] = orig->ip[1];
 386 }
 387
 388 static void
 389 hash_netportnet6_data_netmask(struct hash_netportnet6_elem *elem,
 390                               u8 cidr, bool inner)
 391 {
 392         if (inner) {
 393                 ip6_netmask(&elem->ip[1], cidr);
 394                 elem->cidr[1] = cidr;
 395         } else {
 396                 ip6_netmask(&elem->ip[0], cidr);
 397                 elem->cidr[0] = cidr;
 398         }
 399 }
 400
 401 static bool
 402 hash_netportnet6_data_list(struct sk_buff *skb,
 403                            const struct hash_netportnet6_elem *data)
 404 {
 405         u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
 406
 407         if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip[0].in6) ||
 408             nla_put_ipaddr6(skb, IPSET_ATTR_IP2, &data->ip[1].in6) ||
 409             nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
 410             nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr[0]) ||
 411             nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr[1]) ||
 412             nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
 413             (flags &&
 414              nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
 415                 goto nla_put_failure;
 416         return false;
 417
 418 nla_put_failure:
 419         return true;
 420 }
 421
 422 static void
 423 hash_netportnet6_data_next(struct hash_netportnet6_elem *next,
 424                            const struct hash_netportnet6_elem *d)
 425 {
 426         next->port = d->port;
 427 }
 428
 429 #undef MTYPE
 430 #undef HOST_MASK
 431
 432 #define MTYPE           hash_netportnet6
 433 #define HOST_MASK       128
 434 #define IP_SET_EMIT_CREATE
 435 #include "ip_set_hash_gen.h"
 436
 437 static void
 438 hash_netportnet6_init(struct hash_netportnet6_elem *e)
 439 {
 440         e->cidr[0] = HOST_MASK;
 441         e->cidr[1] = HOST_MASK;
 442 }
 443
 444 static int
 445 hash_netportnet6_kadt(struct ip_set *set, const struct sk_buff *skb,
 446                       const struct xt_action_param *par,
 447                       enum ipset_adt adt, struct ip_set_adt_opt *opt)
 448 {
 449         const struct hash_netportnet6 *h = set->data;
 450         ipset_adtfn adtfn = set->variant->adt[adt];
 451         struct hash_netportnet6_elem e = { };
 452         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
 453
 454         e.cidr[0] = INIT_CIDR(h->nets[0].cidr[0], HOST_MASK);
 455         e.cidr[1] = INIT_CIDR(h->nets[0].cidr[1], HOST_MASK);
 456         if (adt == IPSET_TEST)
 457                 e.ccmp = (HOST_MASK << (sizeof(u8) * 8)) | HOST_MASK;
 458
 459         if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
 460                                  &e.port, &e.proto))
 461                 return -EINVAL;
 462
 463         ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip[0].in6);
 464         ip6addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &e.ip[1].in6);
 465         ip6_netmask(&e.ip[0], e.cidr[0]);
 466         ip6_netmask(&e.ip[1], e.cidr[1]);
 467
 468         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
 469 }
 470
 471 static int
 472 hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
 473                       enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 474 {
 475         const struct hash_netportnet6 *h = set->data;
 476         ipset_adtfn adtfn = set->variant->adt[adt];
 477         struct hash_netportnet6_elem e = { };
 478         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
 479         u32 port, port_to;
 480         bool with_ports = false;
 481         int ret;
 482
 483         if (tb[IPSET_ATTR_LINENO])
 484                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
 485
 486         hash_netportnet6_init(&e);
 487         if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
 488                      !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
 489                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
 490                      !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
 491                 return -IPSET_ERR_PROTOCOL;
 492         if (unlikely(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_IP2_TO]))
 493                 return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
 494
 495         ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip[0]);
 496         if (ret)
 497                 return ret;
 498
 499         ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP2], &e.ip[1]);
 500         if (ret)
 501                 return ret;
 502
 503         ret = ip_set_get_extensions(set, tb, &ext);
 504         if (ret)
 505                 return ret;
 506
 507         if (tb[IPSET_ATTR_CIDR]) {
 508                 e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
 509                 if (e.cidr[0] > HOST_MASK)
 510                         return -IPSET_ERR_INVALID_CIDR;
 511         }
 512
 513         if (tb[IPSET_ATTR_CIDR2]) {
 514                 e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
 515                 if (e.cidr[1] > HOST_MASK)
 516                         return -IPSET_ERR_INVALID_CIDR;
 517         }
 518
 519         ip6_netmask(&e.ip[0], e.cidr[0]);
 520         ip6_netmask(&e.ip[1], e.cidr[1]);
 521
 522         e.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
 523
 524         if (tb[IPSET_ATTR_PROTO]) {
 525                 e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
 526                 with_ports = ip_set_proto_with_ports(e.proto);
 527
 528                 if (e.proto == 0)
 529                         return -IPSET_ERR_INVALID_PROTO;
 530         } else {
 531                 return -IPSET_ERR_MISSING_PROTO;
 532         }
 533
 534         if (!(with_ports || e.proto == IPPROTO_ICMPV6))
 535                 e.port = 0;
 536
 537         if (tb[IPSET_ATTR_CADT_FLAGS]) {
 538                 u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
 539
 540                 if (cadt_flags & IPSET_FLAG_NOMATCH)
 541                         flags |= (IPSET_FLAG_NOMATCH << 16);
 542         }
 543
 544         if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
 545                 ret = adtfn(set, &e, &ext, &ext, flags);
 546                 return ip_set_enomatch(ret, flags, adt, set) ? -ret :
 547                        ip_set_eexist(ret, flags) ? 0 : ret;
 548         }
 549
 550         port = ntohs(e.port);
 551         port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
 552         if (port > port_to)
 553                 swap(port, port_to);
 554
 555         if (retried)
 556                 port = ntohs(h->next.port);
 557         for (; port <= port_to; port++) {
 558                 e.port = htons(port);
 559                 ret = adtfn(set, &e, &ext, &ext, flags);
 560
 561                 if (ret && !ip_set_eexist(ret, flags))
 562                         return ret;
 563
 564                 ret = 0;
 565         }
 566         return ret;
 567 }
 568
 569 static struct ip_set_type hash_netportnet_type __read_mostly = {
 570         .name           = "hash:net,port,net",
 571         .protocol       = IPSET_PROTOCOL,
 572         .features       = IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_TYPE_IP2 |
 573                           IPSET_TYPE_NOMATCH,
 574         .dimension      = IPSET_DIM_THREE,
 575         .family         = NFPROTO_UNSPEC,
 576         .revision_min   = IPSET_TYPE_REV_MIN,
 577         .revision_max   = IPSET_TYPE_REV_MAX,
 578         .create         = hash_netportnet_create,
 579         .create_policy  = {
 580                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
 581                 [IPSET_ATTR_MAXELEM]    = { .type = NLA_U32 },
 582                 [IPSET_ATTR_PROBES]     = { .type = NLA_U8 },
 583                 [IPSET_ATTR_RESIZE]     = { .type = NLA_U8  },
 584                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
 585                 [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
 586         },
 587         .adt_policy     = {
 588                 [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
 589                 [IPSET_ATTR_IP_TO]      = { .type = NLA_NESTED },
 590                 [IPSET_ATTR_IP2]        = { .type = NLA_NESTED },
 591                 [IPSET_ATTR_IP2_TO]     = { .type = NLA_NESTED },
 592                 [IPSET_ATTR_PORT]       = { .type = NLA_U16 },
 593                 [IPSET_ATTR_PORT_TO]    = { .type = NLA_U16 },
 594                 [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
 595                 [IPSET_ATTR_CIDR2]      = { .type = NLA_U8 },
 596                 [IPSET_ATTR_PROTO]      = { .type = NLA_U8 },
 597                 [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
 598                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
 599                 [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
 600                 [IPSET_ATTR_BYTES]      = { .type = NLA_U64 },
 601                 [IPSET_ATTR_PACKETS]    = { .type = NLA_U64 },
 602                 [IPSET_ATTR_COMMENT]    = { .type = NLA_NUL_STRING,
 603                                             .len  = IPSET_MAX_COMMENT_SIZE },
 604                 [IPSET_ATTR_SKBMARK]    = { .type = NLA_U64 },
 605                 [IPSET_ATTR_SKBPRIO]    = { .type = NLA_U32 },
 606                 [IPSET_ATTR_SKBQUEUE]   = { .type = NLA_U16 },
 607         },
 608         .me             = THIS_MODULE,
 609 };
 610
 611 static int __init
 612 hash_netportnet_init(void)
 613 {
 614         return ip_set_type_register(&hash_netportnet_type);
 615 }
 616
 617 static void __exit
 618 hash_netportnet_fini(void)
 619 {
 620         rcu_barrier();
 621         ip_set_type_unregister(&hash_netportnet_type);
 622 }
 623
 624 module_init(hash_netportnet_init);
 625 module_exit(hash_netportnet_fini);