net/netfilter/ipset/ip_set_hash_netportnet.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@netfilter.org> */
   3
   4 /* Kernel module implementing an IP set type: the hash:ip,port,net type */
   5
   6 #include <linux/jhash.h>
   7 #include <linux/module.h>
   8 #include <linux/ip.h>
   9 #include <linux/skbuff.h>
  10 #include <linux/errno.h>
  11 #include <linux/random.h>
  12 #include <net/ip.h>
  13 #include <net/ipv6.h>
  14 #include <net/netlink.h>
  15 #include <net/tcp.h>
  16
  17 #include <linux/netfilter.h>
  18 #include <linux/netfilter/ipset/pfxlen.h>
  19 #include <linux/netfilter/ipset/ip_set.h>
  20 #include <linux/netfilter/ipset/ip_set_getport.h>
  21 #include <linux/netfilter/ipset/ip_set_hash.h>
  22
  23 #define IPSET_TYPE_REV_MIN      0
  24 /*                              0    Comments support added */
  25 /*                              1    Forceadd support added */
  26 /*                              2    skbinfo support added */
  27 #define IPSET_TYPE_REV_MAX      3 /* bucketsize, initval support added */
  28
  29 MODULE_LICENSE("GPL");
  30 MODULE_AUTHOR("Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>");
  31 IP_SET_MODULE_DESC("hash:net,port,net", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
  32 MODULE_ALIAS("ip_set_hash:net,port,net");
  33
  34 /* Type specific function prefix */
  35 #define HTYPE           hash_netportnet
  36 #define IP_SET_HASH_WITH_PROTO
  37 #define IP_SET_HASH_WITH_NETS
  38 #define IPSET_NET_COUNT 2
  39 #define IP_SET_HASH_WITH_NET0
  40
  41 /* IPv4 variant */
  42
  43 /* Member elements */
  44 struct hash_netportnet4_elem {
  45         union {
  46                 __be32 ip[2];
  47                 __be64 ipcmp;
  48         };
  49         __be16 port;
  50         union {
  51                 u8 cidr[2];
  52                 u16 ccmp;
  53         };
  54         u16 padding;
  55         u8 nomatch;
  56         u8 proto;
  57 };
  58
  59 /* Common functions */
  60
  61 static bool
  62 hash_netportnet4_data_equal(const struct hash_netportnet4_elem *ip1,
  63                             const struct hash_netportnet4_elem *ip2,
  64                             u32 *multi)
  65 {
  66         return ip1->ipcmp == ip2->ipcmp &&
  67                ip1->ccmp == ip2->ccmp &&
  68                ip1->port == ip2->port &&
  69                ip1->proto == ip2->proto;
  70 }
  71
  72 static int
  73 hash_netportnet4_do_data_match(const struct hash_netportnet4_elem *elem)
  74 {
  75         return elem->nomatch ? -ENOTEMPTY : 1;
  76 }
  77
  78 static void
  79 hash_netportnet4_data_set_flags(struct hash_netportnet4_elem *elem, u32 flags)
  80 {
  81         elem->nomatch = !!((flags >> 16) & IPSET_FLAG_NOMATCH);
  82 }
  83
  84 static void
  85 hash_netportnet4_data_reset_flags(struct hash_netportnet4_elem *elem, u8 *flags)
  86 {
  87         swap(*flags, elem->nomatch);
  88 }
  89
  90 static void
  91 hash_netportnet4_data_reset_elem(struct hash_netportnet4_elem *elem,
  92                                  struct hash_netportnet4_elem *orig)
  93 {
  94         elem->ip[1] = orig->ip[1];
  95 }
  96
  97 static void
  98 hash_netportnet4_data_netmask(struct hash_netportnet4_elem *elem,
  99                               u8 cidr, bool inner)
 100 {
 101         if (inner) {
 102                 elem->ip[1] &= ip_set_netmask(cidr);
 103                 elem->cidr[1] = cidr;
 104         } else {
 105                 elem->ip[0] &= ip_set_netmask(cidr);
 106                 elem->cidr[0] = cidr;
 107         }
 108 }
 109
 110 static bool
 111 hash_netportnet4_data_list(struct sk_buff *skb,
 112                            const struct hash_netportnet4_elem *data)
 113 {
 114         u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
 115
 116         if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, data->ip[0]) ||
 117             nla_put_ipaddr4(skb, IPSET_ATTR_IP2, data->ip[1]) ||
 118             nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
 119             nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr[0]) ||
 120             nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr[1]) ||
 121             nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
 122             (flags &&
 123              nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
 124                 goto nla_put_failure;
 125         return false;
 126
 127 nla_put_failure:
 128         return true;
 129 }
 130
 131 static void
 132 hash_netportnet4_data_next(struct hash_netportnet4_elem *next,
 133                            const struct hash_netportnet4_elem *d)
 134 {
 135         next->ipcmp = d->ipcmp;
 136         next->port = d->port;
 137 }
 138
 139 #define MTYPE           hash_netportnet4
 140 #define HOST_MASK       32
 141 #include "ip_set_hash_gen.h"
 142
 143 static void
 144 hash_netportnet4_init(struct hash_netportnet4_elem *e)
 145 {
 146         e->cidr[0] = HOST_MASK;
 147         e->cidr[1] = HOST_MASK;
 148 }
 149
 150 static int
 151 hash_netportnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
 152                       const struct xt_action_param *par,
 153                       enum ipset_adt adt, struct ip_set_adt_opt *opt)
 154 {
 155         const struct hash_netportnet4 *h = set->data;
 156         ipset_adtfn adtfn = set->variant->adt[adt];
 157         struct hash_netportnet4_elem e = { };
 158         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
 159
 160         e.cidr[0] = INIT_CIDR(h->nets[0].cidr[0], HOST_MASK);
 161         e.cidr[1] = INIT_CIDR(h->nets[0].cidr[1], HOST_MASK);
 162         if (adt == IPSET_TEST)
 163                 e.ccmp = (HOST_MASK << (sizeof(e.cidr[0]) * 8)) | HOST_MASK;
 164
 165         if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
 166                                  &e.port, &e.proto))
 167                 return -EINVAL;
 168
 169         ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip[0]);
 170         ip4addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &e.ip[1]);
 171         e.ip[0] &= ip_set_netmask(e.cidr[0]);
 172         e.ip[1] &= ip_set_netmask(e.cidr[1]);
 173
 174         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
 175 }
 176
 177 static u32
 178 hash_netportnet4_range_to_cidr(u32 from, u32 to, u8 *cidr)
 179 {
 180         if (from == 0 && to == UINT_MAX) {
 181                 *cidr = 0;
 182                 return to;
 183         }
 184         return ip_set_range_to_cidr(from, to, cidr);
 185 }
 186
 187 static int
 188 hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
 189                       enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 190 {
 191         struct hash_netportnet4 *h = set->data;
 192         ipset_adtfn adtfn = set->variant->adt[adt];
 193         struct hash_netportnet4_elem e = { };
 194         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
 195         u32 ip = 0, ip_to = 0, p = 0, port, port_to;
 196         u32 ip2_from = 0, ip2_to = 0, ip2, i = 0;
 197         bool with_ports = false;
 198         int ret;
 199
 200         if (tb[IPSET_ATTR_LINENO])
 201                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
 202
 203         hash_netportnet4_init(&e);
 204         if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
 205                      !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
 206                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
 207                      !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
 208                 return -IPSET_ERR_PROTOCOL;
 209
 210         ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
 211         if (ret)
 212                 return ret;
 213
 214         ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2], &ip2_from);
 215         if (ret)
 216                 return ret;
 217
 218         ret = ip_set_get_extensions(set, tb, &ext);
 219         if (ret)
 220                 return ret;
 221
 222         if (tb[IPSET_ATTR_CIDR]) {
 223                 e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
 224                 if (e.cidr[0] > HOST_MASK)
 225                         return -IPSET_ERR_INVALID_CIDR;
 226         }
 227
 228         if (tb[IPSET_ATTR_CIDR2]) {
 229                 e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
 230                 if (e.cidr[1] > HOST_MASK)
 231                         return -IPSET_ERR_INVALID_CIDR;
 232         }
 233
 234         e.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
 235
 236         if (tb[IPSET_ATTR_PROTO]) {
 237                 e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
 238                 with_ports = ip_set_proto_with_ports(e.proto);
 239
 240                 if (e.proto == 0)
 241                         return -IPSET_ERR_INVALID_PROTO;
 242         } else {
 243                 return -IPSET_ERR_MISSING_PROTO;
 244         }
 245
 246         if (!(with_ports || e.proto == IPPROTO_ICMP))
 247                 e.port = 0;
 248
 249         if (tb[IPSET_ATTR_CADT_FLAGS]) {
 250                 u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
 251
 252                 if (cadt_flags & IPSET_FLAG_NOMATCH)
 253                         flags |= (IPSET_FLAG_NOMATCH << 16);
 254         }
 255
 256         with_ports = with_ports && tb[IPSET_ATTR_PORT_TO];
 257         if (adt == IPSET_TEST ||
 258             !(tb[IPSET_ATTR_IP_TO] || with_ports || tb[IPSET_ATTR_IP2_TO])) {
 259                 e.ip[0] = htonl(ip & ip_set_hostmask(e.cidr[0]));
 260                 e.ip[1] = htonl(ip2_from & ip_set_hostmask(e.cidr[1]));
 261                 ret = adtfn(set, &e, &ext, &ext, flags);
 262                 return ip_set_enomatch(ret, flags, adt, set) ? -ret :
 263                        ip_set_eexist(ret, flags) ? 0 : ret;
 264         }
 265
 266         ip_to = ip;
 267         if (tb[IPSET_ATTR_IP_TO]) {
 268                 ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
 269                 if (ret)
 270                         return ret;
 271                 if (ip > ip_to)
 272                         swap(ip, ip_to);
 273                 if (unlikely(ip + UINT_MAX == ip_to))
 274                         return -IPSET_ERR_HASH_RANGE;
 275         } else {
 276                 ip_set_mask_from_to(ip, ip_to, e.cidr[0]);
 277         }
 278
 279         port_to = port = ntohs(e.port);
 280         if (tb[IPSET_ATTR_PORT_TO]) {
 281                 port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
 282                 if (port > port_to)
 283                         swap(port, port_to);
 284         }
 285
 286         ip2_to = ip2_from;
 287         if (tb[IPSET_ATTR_IP2_TO]) {
 288                 ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2_TO], &ip2_to);
 289                 if (ret)
 290                         return ret;
 291                 if (ip2_from > ip2_to)
 292                         swap(ip2_from, ip2_to);
 293                 if (unlikely(ip2_from + UINT_MAX == ip2_to))
 294                         return -IPSET_ERR_HASH_RANGE;
 295         } else {
 296                 ip_set_mask_from_to(ip2_from, ip2_to, e.cidr[1]);
 297         }
 298
 299         if (retried) {
 300                 ip = ntohl(h->next.ip[0]);
 301                 p = ntohs(h->next.port);
 302                 ip2 = ntohl(h->next.ip[1]);
 303         } else {
 304                 p = port;
 305                 ip2 = ip2_from;
 306         }
 307
 308         do {
 309                 e.ip[0] = htonl(ip);
 310                 ip = hash_netportnet4_range_to_cidr(ip, ip_to, &e.cidr[0]);
 311                 for (; p <= port_to; p++) {
 312                         e.port = htons(p);
 313                         do {
 314                                 i++;
 315                                 e.ip[1] = htonl(ip2);
 316                                 if (i > IPSET_MAX_RANGE) {
 317                                         hash_netportnet4_data_next(&h->next,
 318                                                                    &e);
 319                                         return -ERANGE;
 320                                 }
 321                                 ip2 = hash_netportnet4_range_to_cidr(ip2,
 322                                                         ip2_to, &e.cidr[1]);
 323                                 ret = adtfn(set, &e, &ext, &ext, flags);
 324                                 if (ret && !ip_set_eexist(ret, flags))
 325                                         return ret;
 326
 327                                 ret = 0;
 328                         } while (ip2++ < ip2_to);
 329                         ip2 = ip2_from;
 330                 }
 331                 p = port;
 332         } while (ip++ < ip_to);
 333         return ret;
 334 }
 335
 336 /* IPv6 variant */
 337
 338 struct hash_netportnet6_elem {
 339         union nf_inet_addr ip[2];
 340         __be16 port;
 341         union {
 342                 u8 cidr[2];
 343                 u16 ccmp;
 344         };
 345         u16 padding;
 346         u8 nomatch;
 347         u8 proto;
 348 };
 349
 350 /* Common functions */
 351
 352 static bool
 353 hash_netportnet6_data_equal(const struct hash_netportnet6_elem *ip1,
 354                             const struct hash_netportnet6_elem *ip2,
 355                             u32 *multi)
 356 {
 357         return ipv6_addr_equal(&ip1->ip[0].in6, &ip2->ip[0].in6) &&
 358                ipv6_addr_equal(&ip1->ip[1].in6, &ip2->ip[1].in6) &&
 359                ip1->ccmp == ip2->ccmp &&
 360                ip1->port == ip2->port &&
 361                ip1->proto == ip2->proto;
 362 }
 363
 364 static int
 365 hash_netportnet6_do_data_match(const struct hash_netportnet6_elem *elem)
 366 {
 367         return elem->nomatch ? -ENOTEMPTY : 1;
 368 }
 369
 370 static void
 371 hash_netportnet6_data_set_flags(struct hash_netportnet6_elem *elem, u32 flags)
 372 {
 373         elem->nomatch = !!((flags >> 16) & IPSET_FLAG_NOMATCH);
 374 }
 375
 376 static void
 377 hash_netportnet6_data_reset_flags(struct hash_netportnet6_elem *elem, u8 *flags)
 378 {
 379         swap(*flags, elem->nomatch);
 380 }
 381
 382 static void
 383 hash_netportnet6_data_reset_elem(struct hash_netportnet6_elem *elem,
 384                                  struct hash_netportnet6_elem *orig)
 385 {
 386         elem->ip[1] = orig->ip[1];
 387 }
 388
 389 static void
 390 hash_netportnet6_data_netmask(struct hash_netportnet6_elem *elem,
 391                               u8 cidr, bool inner)
 392 {
 393         if (inner) {
 394                 ip6_netmask(&elem->ip[1], cidr);
 395                 elem->cidr[1] = cidr;
 396         } else {
 397                 ip6_netmask(&elem->ip[0], cidr);
 398                 elem->cidr[0] = cidr;
 399         }
 400 }
 401
 402 static bool
 403 hash_netportnet6_data_list(struct sk_buff *skb,
 404                            const struct hash_netportnet6_elem *data)
 405 {
 406         u32 flags = data->nomatch ? IPSET_FLAG_NOMATCH : 0;
 407
 408         if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &data->ip[0].in6) ||
 409             nla_put_ipaddr6(skb, IPSET_ATTR_IP2, &data->ip[1].in6) ||
 410             nla_put_net16(skb, IPSET_ATTR_PORT, data->port) ||
 411             nla_put_u8(skb, IPSET_ATTR_CIDR, data->cidr[0]) ||
 412             nla_put_u8(skb, IPSET_ATTR_CIDR2, data->cidr[1]) ||
 413             nla_put_u8(skb, IPSET_ATTR_PROTO, data->proto) ||
 414             (flags &&
 415              nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS, htonl(flags))))
 416                 goto nla_put_failure;
 417         return false;
 418
 419 nla_put_failure:
 420         return true;
 421 }
 422
 423 static void
 424 hash_netportnet6_data_next(struct hash_netportnet6_elem *next,
 425                            const struct hash_netportnet6_elem *d)
 426 {
 427         next->port = d->port;
 428 }
 429
 430 #undef MTYPE
 431 #undef HOST_MASK
 432
 433 #define MTYPE           hash_netportnet6
 434 #define HOST_MASK       128
 435 #define IP_SET_EMIT_CREATE
 436 #include "ip_set_hash_gen.h"
 437
 438 static void
 439 hash_netportnet6_init(struct hash_netportnet6_elem *e)
 440 {
 441         e->cidr[0] = HOST_MASK;
 442         e->cidr[1] = HOST_MASK;
 443 }
 444
 445 static int
 446 hash_netportnet6_kadt(struct ip_set *set, const struct sk_buff *skb,
 447                       const struct xt_action_param *par,
 448                       enum ipset_adt adt, struct ip_set_adt_opt *opt)
 449 {
 450         const struct hash_netportnet6 *h = set->data;
 451         ipset_adtfn adtfn = set->variant->adt[adt];
 452         struct hash_netportnet6_elem e = { };
 453         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
 454
 455         e.cidr[0] = INIT_CIDR(h->nets[0].cidr[0], HOST_MASK);
 456         e.cidr[1] = INIT_CIDR(h->nets[0].cidr[1], HOST_MASK);
 457         if (adt == IPSET_TEST)
 458                 e.ccmp = (HOST_MASK << (sizeof(u8) * 8)) | HOST_MASK;
 459
 460         if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
 461                                  &e.port, &e.proto))
 462                 return -EINVAL;
 463
 464         ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip[0].in6);
 465         ip6addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &e.ip[1].in6);
 466         ip6_netmask(&e.ip[0], e.cidr[0]);
 467         ip6_netmask(&e.ip[1], e.cidr[1]);
 468
 469         return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
 470 }
 471
 472 static int
 473 hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
 474                       enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 475 {
 476         const struct hash_netportnet6 *h = set->data;
 477         ipset_adtfn adtfn = set->variant->adt[adt];
 478         struct hash_netportnet6_elem e = { };
 479         struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
 480         u32 port, port_to;
 481         bool with_ports = false;
 482         int ret;
 483
 484         if (tb[IPSET_ATTR_LINENO])
 485                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
 486
 487         hash_netportnet6_init(&e);
 488         if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
 489                      !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
 490                      !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
 491                      !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
 492                 return -IPSET_ERR_PROTOCOL;
 493         if (unlikely(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_IP2_TO]))
 494                 return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
 495
 496         ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip[0]);
 497         if (ret)
 498                 return ret;
 499
 500         ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP2], &e.ip[1]);
 501         if (ret)
 502                 return ret;
 503
 504         ret = ip_set_get_extensions(set, tb, &ext);
 505         if (ret)
 506                 return ret;
 507
 508         if (tb[IPSET_ATTR_CIDR]) {
 509                 e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
 510                 if (e.cidr[0] > HOST_MASK)
 511                         return -IPSET_ERR_INVALID_CIDR;
 512         }
 513
 514         if (tb[IPSET_ATTR_CIDR2]) {
 515                 e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
 516                 if (e.cidr[1] > HOST_MASK)
 517                         return -IPSET_ERR_INVALID_CIDR;
 518         }
 519
 520         ip6_netmask(&e.ip[0], e.cidr[0]);
 521         ip6_netmask(&e.ip[1], e.cidr[1]);
 522
 523         e.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
 524
 525         if (tb[IPSET_ATTR_PROTO]) {
 526                 e.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
 527                 with_ports = ip_set_proto_with_ports(e.proto);
 528
 529                 if (e.proto == 0)
 530                         return -IPSET_ERR_INVALID_PROTO;
 531         } else {
 532                 return -IPSET_ERR_MISSING_PROTO;
 533         }
 534
 535         if (!(with_ports || e.proto == IPPROTO_ICMPV6))
 536                 e.port = 0;
 537
 538         if (tb[IPSET_ATTR_CADT_FLAGS]) {
 539                 u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
 540
 541                 if (cadt_flags & IPSET_FLAG_NOMATCH)
 542                         flags |= (IPSET_FLAG_NOMATCH << 16);
 543         }
 544
 545         if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
 546                 ret = adtfn(set, &e, &ext, &ext, flags);
 547                 return ip_set_enomatch(ret, flags, adt, set) ? -ret :
 548                        ip_set_eexist(ret, flags) ? 0 : ret;
 549         }
 550
 551         port = ntohs(e.port);
 552         port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
 553         if (port > port_to)
 554                 swap(port, port_to);
 555
 556         if (retried)
 557                 port = ntohs(h->next.port);
 558         for (; port <= port_to; port++) {
 559                 e.port = htons(port);
 560                 ret = adtfn(set, &e, &ext, &ext, flags);
 561
 562                 if (ret && !ip_set_eexist(ret, flags))
 563                         return ret;
 564
 565                 ret = 0;
 566         }
 567         return ret;
 568 }
 569
 570 static struct ip_set_type hash_netportnet_type __read_mostly = {
 571         .name           = "hash:net,port,net",
 572         .protocol       = IPSET_PROTOCOL,
 573         .features       = IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_TYPE_IP2 |
 574                           IPSET_TYPE_NOMATCH,
 575         .dimension      = IPSET_DIM_THREE,
 576         .family         = NFPROTO_UNSPEC,
 577         .revision_min   = IPSET_TYPE_REV_MIN,
 578         .revision_max   = IPSET_TYPE_REV_MAX,
 579         .create_flags[IPSET_TYPE_REV_MAX] = IPSET_CREATE_FLAG_BUCKETSIZE,
 580         .create         = hash_netportnet_create,
 581         .create_policy  = {
 582                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
 583                 [IPSET_ATTR_MAXELEM]    = { .type = NLA_U32 },
 584                 [IPSET_ATTR_INITVAL]    = { .type = NLA_U32 },
 585                 [IPSET_ATTR_BUCKETSIZE] = { .type = NLA_U8 },
 586                 [IPSET_ATTR_RESIZE]     = { .type = NLA_U8  },
 587                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
 588                 [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
 589         },
 590         .adt_policy     = {
 591                 [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
 592                 [IPSET_ATTR_IP_TO]      = { .type = NLA_NESTED },
 593                 [IPSET_ATTR_IP2]        = { .type = NLA_NESTED },
 594                 [IPSET_ATTR_IP2_TO]     = { .type = NLA_NESTED },
 595                 [IPSET_ATTR_PORT]       = { .type = NLA_U16 },
 596                 [IPSET_ATTR_PORT_TO]    = { .type = NLA_U16 },
 597                 [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
 598                 [IPSET_ATTR_CIDR2]      = { .type = NLA_U8 },
 599                 [IPSET_ATTR_PROTO]      = { .type = NLA_U8 },
 600                 [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
 601                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
 602                 [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
 603                 [IPSET_ATTR_BYTES]      = { .type = NLA_U64 },
 604                 [IPSET_ATTR_PACKETS]    = { .type = NLA_U64 },
 605                 [IPSET_ATTR_COMMENT]    = { .type = NLA_NUL_STRING,
 606                                             .len  = IPSET_MAX_COMMENT_SIZE },
 607                 [IPSET_ATTR_SKBMARK]    = { .type = NLA_U64 },
 608                 [IPSET_ATTR_SKBPRIO]    = { .type = NLA_U32 },
 609                 [IPSET_ATTR_SKBQUEUE]   = { .type = NLA_U16 },
 610         },
 611         .me             = THIS_MODULE,
 612 };
 613
 614 static int __init
 615 hash_netportnet_init(void)
 616 {
 617         return ip_set_type_register(&hash_netportnet_type);
 618 }
 619
 620 static void __exit
 621 hash_netportnet_fini(void)
 622 {
 623         rcu_barrier();
 624         ip_set_type_unregister(&hash_netportnet_type);
 625 }
 626
 627 module_init(hash_netportnet_init);
 628 module_exit(hash_netportnet_fini);