Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0-only
2/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
3 * Patrick Schaaf <bof@bof.de>
4 * Martin Josefsson <gandalf@wlug.westbo.se>
5 * Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@netfilter.org>
6 */
7
8/* Kernel module which implements the set match and SET target
9 * for netfilter/iptables.
10 */
11
12#include <linux/module.h>
13#include <linux/skbuff.h>
14
15#include <linux/netfilter/x_tables.h>
16#include <linux/netfilter/ipset/ip_set.h>
17#include <linux/netfilter/ipset/ip_set_timeout.h>
18#include <uapi/linux/netfilter/xt_set.h>
19
20MODULE_LICENSE("GPL");
21MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
22MODULE_DESCRIPTION("Xtables: IP set match and target module");
23MODULE_ALIAS("xt_SET");
24MODULE_ALIAS("ipt_set");
25MODULE_ALIAS("ip6t_set");
26MODULE_ALIAS("ipt_SET");
27MODULE_ALIAS("ip6t_SET");
28
29static inline int
30match_set(ip_set_id_t index, const struct sk_buff *skb,
31 const struct xt_action_param *par,
32 struct ip_set_adt_opt *opt, int inv)
33{
34 if (ip_set_test(index, skb, par, opt))
35 inv = !inv;
36 return inv;
37}
38
39#define ADT_OPT(n, f, d, fs, cfs, t, p, b, po, bo) \
40struct ip_set_adt_opt n = { \
41 .family = f, \
42 .dim = d, \
43 .flags = fs, \
44 .cmdflags = cfs, \
45 .ext.timeout = t, \
46 .ext.packets = p, \
47 .ext.bytes = b, \
48 .ext.packets_op = po, \
49 .ext.bytes_op = bo, \
50}
51
52/* Revision 0 interface: backward compatible with netfilter/iptables */
53
54static bool
55set_match_v0(const struct sk_buff *skb, struct xt_action_param *par)
56{
57 const struct xt_set_info_match_v0 *info = par->matchinfo;
58
59 ADT_OPT(opt, xt_family(par), info->match_set.u.compat.dim,
60 info->match_set.u.compat.flags, 0, UINT_MAX,
61 0, 0, 0, 0);
62
63 return match_set(info->match_set.index, skb, par, &opt,
64 info->match_set.u.compat.flags & IPSET_INV_MATCH);
65}
66
67static void
68compat_flags(struct xt_set_info_v0 *info)
69{
70 u_int8_t i;
71
72 /* Fill out compatibility data according to enum ip_set_kopt */
73 info->u.compat.dim = IPSET_DIM_ZERO;
74 if (info->u.flags[0] & IPSET_MATCH_INV)
75 info->u.compat.flags |= IPSET_INV_MATCH;
76 for (i = 0; i < IPSET_DIM_MAX - 1 && info->u.flags[i]; i++) {
77 info->u.compat.dim++;
78 if (info->u.flags[i] & IPSET_SRC)
79 info->u.compat.flags |= (1 << info->u.compat.dim);
80 }
81}
82
83static int
84set_match_v0_checkentry(const struct xt_mtchk_param *par)
85{
86 struct xt_set_info_match_v0 *info = par->matchinfo;
87 ip_set_id_t index;
88
89 index = ip_set_nfnl_get_byindex(par->net, info->match_set.index);
90
91 if (index == IPSET_INVALID_ID) {
92 pr_info_ratelimited("Cannot find set identified by id %u to match\n",
93 info->match_set.index);
94 return -ENOENT;
95 }
96 if (info->match_set.u.flags[IPSET_DIM_MAX - 1] != 0) {
97 pr_info_ratelimited("set match dimension is over the limit!\n");
98 ip_set_nfnl_put(par->net, info->match_set.index);
99 return -ERANGE;
100 }
101
102 /* Fill out compatibility data */
103 compat_flags(&info->match_set);
104
105 return 0;
106}
107
108static void
109set_match_v0_destroy(const struct xt_mtdtor_param *par)
110{
111 struct xt_set_info_match_v0 *info = par->matchinfo;
112
113 ip_set_nfnl_put(par->net, info->match_set.index);
114}
115
116/* Revision 1 match */
117
118static bool
119set_match_v1(const struct sk_buff *skb, struct xt_action_param *par)
120{
121 const struct xt_set_info_match_v1 *info = par->matchinfo;
122
123 ADT_OPT(opt, xt_family(par), info->match_set.dim,
124 info->match_set.flags, 0, UINT_MAX,
125 0, 0, 0, 0);
126
127 if (opt.flags & IPSET_RETURN_NOMATCH)
128 opt.cmdflags |= IPSET_FLAG_RETURN_NOMATCH;
129
130 return match_set(info->match_set.index, skb, par, &opt,
131 info->match_set.flags & IPSET_INV_MATCH);
132}
133
134static int
135set_match_v1_checkentry(const struct xt_mtchk_param *par)
136{
137 struct xt_set_info_match_v1 *info = par->matchinfo;
138 ip_set_id_t index;
139
140 index = ip_set_nfnl_get_byindex(par->net, info->match_set.index);
141
142 if (index == IPSET_INVALID_ID) {
143 pr_info_ratelimited("Cannot find set identified by id %u to match\n",
144 info->match_set.index);
145 return -ENOENT;
146 }
147 if (info->match_set.dim > IPSET_DIM_MAX) {
148 pr_info_ratelimited("set match dimension is over the limit!\n");
149 ip_set_nfnl_put(par->net, info->match_set.index);
150 return -ERANGE;
151 }
152
153 return 0;
154}
155
156static void
157set_match_v1_destroy(const struct xt_mtdtor_param *par)
158{
159 struct xt_set_info_match_v1 *info = par->matchinfo;
160
161 ip_set_nfnl_put(par->net, info->match_set.index);
162}
163
164/* Revision 3 match */
165
166static bool
167set_match_v3(const struct sk_buff *skb, struct xt_action_param *par)
168{
169 const struct xt_set_info_match_v3 *info = par->matchinfo;
170
171 ADT_OPT(opt, xt_family(par), info->match_set.dim,
172 info->match_set.flags, info->flags, UINT_MAX,
173 info->packets.value, info->bytes.value,
174 info->packets.op, info->bytes.op);
175
176 if (info->packets.op != IPSET_COUNTER_NONE ||
177 info->bytes.op != IPSET_COUNTER_NONE)
178 opt.cmdflags |= IPSET_FLAG_MATCH_COUNTERS;
179
180 return match_set(info->match_set.index, skb, par, &opt,
181 info->match_set.flags & IPSET_INV_MATCH);
182}
183
184#define set_match_v3_checkentry set_match_v1_checkentry
185#define set_match_v3_destroy set_match_v1_destroy
186
187/* Revision 4 match */
188
189static bool
190set_match_v4(const struct sk_buff *skb, struct xt_action_param *par)
191{
192 const struct xt_set_info_match_v4 *info = par->matchinfo;
193
194 ADT_OPT(opt, xt_family(par), info->match_set.dim,
195 info->match_set.flags, info->flags, UINT_MAX,
196 info->packets.value, info->bytes.value,
197 info->packets.op, info->bytes.op);
198
199 if (info->packets.op != IPSET_COUNTER_NONE ||
200 info->bytes.op != IPSET_COUNTER_NONE)
201 opt.cmdflags |= IPSET_FLAG_MATCH_COUNTERS;
202
203 return match_set(info->match_set.index, skb, par, &opt,
204 info->match_set.flags & IPSET_INV_MATCH);
205}
206
207#define set_match_v4_checkentry set_match_v1_checkentry
208#define set_match_v4_destroy set_match_v1_destroy
209
210/* Revision 0 interface: backward compatible with netfilter/iptables */
211
212static unsigned int
213set_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
214{
215 const struct xt_set_info_target_v0 *info = par->targinfo;
216
217 ADT_OPT(add_opt, xt_family(par), info->add_set.u.compat.dim,
218 info->add_set.u.compat.flags, 0, UINT_MAX,
219 0, 0, 0, 0);
220 ADT_OPT(del_opt, xt_family(par), info->del_set.u.compat.dim,
221 info->del_set.u.compat.flags, 0, UINT_MAX,
222 0, 0, 0, 0);
223
224 if (info->add_set.index != IPSET_INVALID_ID)
225 ip_set_add(info->add_set.index, skb, par, &add_opt);
226 if (info->del_set.index != IPSET_INVALID_ID)
227 ip_set_del(info->del_set.index, skb, par, &del_opt);
228
229 return XT_CONTINUE;
230}
231
232static int
233set_target_v0_checkentry(const struct xt_tgchk_param *par)
234{
235 struct xt_set_info_target_v0 *info = par->targinfo;
236 ip_set_id_t index;
237
238 if (info->add_set.index != IPSET_INVALID_ID) {
239 index = ip_set_nfnl_get_byindex(par->net, info->add_set.index);
240 if (index == IPSET_INVALID_ID) {
241 pr_info_ratelimited("Cannot find add_set index %u as target\n",
242 info->add_set.index);
243 return -ENOENT;
244 }
245 }
246
247 if (info->del_set.index != IPSET_INVALID_ID) {
248 index = ip_set_nfnl_get_byindex(par->net, info->del_set.index);
249 if (index == IPSET_INVALID_ID) {
250 pr_info_ratelimited("Cannot find del_set index %u as target\n",
251 info->del_set.index);
252 if (info->add_set.index != IPSET_INVALID_ID)
253 ip_set_nfnl_put(par->net, info->add_set.index);
254 return -ENOENT;
255 }
256 }
257 if (info->add_set.u.flags[IPSET_DIM_MAX - 1] != 0 ||
258 info->del_set.u.flags[IPSET_DIM_MAX - 1] != 0) {
259 pr_info_ratelimited("SET target dimension over the limit!\n");
260 if (info->add_set.index != IPSET_INVALID_ID)
261 ip_set_nfnl_put(par->net, info->add_set.index);
262 if (info->del_set.index != IPSET_INVALID_ID)
263 ip_set_nfnl_put(par->net, info->del_set.index);
264 return -ERANGE;
265 }
266
267 /* Fill out compatibility data */
268 compat_flags(&info->add_set);
269 compat_flags(&info->del_set);
270
271 return 0;
272}
273
274static void
275set_target_v0_destroy(const struct xt_tgdtor_param *par)
276{
277 const struct xt_set_info_target_v0 *info = par->targinfo;
278
279 if (info->add_set.index != IPSET_INVALID_ID)
280 ip_set_nfnl_put(par->net, info->add_set.index);
281 if (info->del_set.index != IPSET_INVALID_ID)
282 ip_set_nfnl_put(par->net, info->del_set.index);
283}
284
285/* Revision 1 target */
286
287static unsigned int
288set_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
289{
290 const struct xt_set_info_target_v1 *info = par->targinfo;
291
292 ADT_OPT(add_opt, xt_family(par), info->add_set.dim,
293 info->add_set.flags, 0, UINT_MAX,
294 0, 0, 0, 0);
295 ADT_OPT(del_opt, xt_family(par), info->del_set.dim,
296 info->del_set.flags, 0, UINT_MAX,
297 0, 0, 0, 0);
298
299 if (info->add_set.index != IPSET_INVALID_ID)
300 ip_set_add(info->add_set.index, skb, par, &add_opt);
301 if (info->del_set.index != IPSET_INVALID_ID)
302 ip_set_del(info->del_set.index, skb, par, &del_opt);
303
304 return XT_CONTINUE;
305}
306
307static int
308set_target_v1_checkentry(const struct xt_tgchk_param *par)
309{
310 const struct xt_set_info_target_v1 *info = par->targinfo;
311 ip_set_id_t index;
312
313 if (info->add_set.index != IPSET_INVALID_ID) {
314 index = ip_set_nfnl_get_byindex(par->net, info->add_set.index);
315 if (index == IPSET_INVALID_ID) {
316 pr_info_ratelimited("Cannot find add_set index %u as target\n",
317 info->add_set.index);
318 return -ENOENT;
319 }
320 }
321
322 if (info->del_set.index != IPSET_INVALID_ID) {
323 index = ip_set_nfnl_get_byindex(par->net, info->del_set.index);
324 if (index == IPSET_INVALID_ID) {
325 pr_info_ratelimited("Cannot find del_set index %u as target\n",
326 info->del_set.index);
327 if (info->add_set.index != IPSET_INVALID_ID)
328 ip_set_nfnl_put(par->net, info->add_set.index);
329 return -ENOENT;
330 }
331 }
332 if (info->add_set.dim > IPSET_DIM_MAX ||
333 info->del_set.dim > IPSET_DIM_MAX) {
334 pr_info_ratelimited("SET target dimension over the limit!\n");
335 if (info->add_set.index != IPSET_INVALID_ID)
336 ip_set_nfnl_put(par->net, info->add_set.index);
337 if (info->del_set.index != IPSET_INVALID_ID)
338 ip_set_nfnl_put(par->net, info->del_set.index);
339 return -ERANGE;
340 }
341
342 return 0;
343}
344
345static void
346set_target_v1_destroy(const struct xt_tgdtor_param *par)
347{
348 const struct xt_set_info_target_v1 *info = par->targinfo;
349
350 if (info->add_set.index != IPSET_INVALID_ID)
351 ip_set_nfnl_put(par->net, info->add_set.index);
352 if (info->del_set.index != IPSET_INVALID_ID)
353 ip_set_nfnl_put(par->net, info->del_set.index);
354}
355
356/* Revision 2 target */
357
358static unsigned int
359set_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
360{
361 const struct xt_set_info_target_v2 *info = par->targinfo;
362
363 ADT_OPT(add_opt, xt_family(par), info->add_set.dim,
364 info->add_set.flags, info->flags, info->timeout,
365 0, 0, 0, 0);
366 ADT_OPT(del_opt, xt_family(par), info->del_set.dim,
367 info->del_set.flags, 0, UINT_MAX,
368 0, 0, 0, 0);
369
370 /* Normalize to fit into jiffies */
371 if (add_opt.ext.timeout != IPSET_NO_TIMEOUT &&
372 add_opt.ext.timeout > IPSET_MAX_TIMEOUT)
373 add_opt.ext.timeout = IPSET_MAX_TIMEOUT;
374 if (info->add_set.index != IPSET_INVALID_ID)
375 ip_set_add(info->add_set.index, skb, par, &add_opt);
376 if (info->del_set.index != IPSET_INVALID_ID)
377 ip_set_del(info->del_set.index, skb, par, &del_opt);
378
379 return XT_CONTINUE;
380}
381
382#define set_target_v2_checkentry set_target_v1_checkentry
383#define set_target_v2_destroy set_target_v1_destroy
384
385/* Revision 3 target */
386
387#define MOPT(opt, member) ((opt).ext.skbinfo.member)
388
389static unsigned int
390set_target_v3(struct sk_buff *skb, const struct xt_action_param *par)
391{
392 const struct xt_set_info_target_v3 *info = par->targinfo;
393 int ret;
394
395 ADT_OPT(add_opt, xt_family(par), info->add_set.dim,
396 info->add_set.flags, info->flags, info->timeout,
397 0, 0, 0, 0);
398 ADT_OPT(del_opt, xt_family(par), info->del_set.dim,
399 info->del_set.flags, 0, UINT_MAX,
400 0, 0, 0, 0);
401 ADT_OPT(map_opt, xt_family(par), info->map_set.dim,
402 info->map_set.flags, 0, UINT_MAX,
403 0, 0, 0, 0);
404
405 /* Normalize to fit into jiffies */
406 if (add_opt.ext.timeout != IPSET_NO_TIMEOUT &&
407 add_opt.ext.timeout > IPSET_MAX_TIMEOUT)
408 add_opt.ext.timeout = IPSET_MAX_TIMEOUT;
409 if (info->add_set.index != IPSET_INVALID_ID)
410 ip_set_add(info->add_set.index, skb, par, &add_opt);
411 if (info->del_set.index != IPSET_INVALID_ID)
412 ip_set_del(info->del_set.index, skb, par, &del_opt);
413 if (info->map_set.index != IPSET_INVALID_ID) {
414 map_opt.cmdflags |= info->flags & (IPSET_FLAG_MAP_SKBMARK |
415 IPSET_FLAG_MAP_SKBPRIO |
416 IPSET_FLAG_MAP_SKBQUEUE);
417 ret = match_set(info->map_set.index, skb, par, &map_opt,
418 info->map_set.flags & IPSET_INV_MATCH);
419 if (!ret)
420 return XT_CONTINUE;
421 if (map_opt.cmdflags & IPSET_FLAG_MAP_SKBMARK)
422 skb->mark = (skb->mark & ~MOPT(map_opt,skbmarkmask))
423 ^ MOPT(map_opt, skbmark);
424 if (map_opt.cmdflags & IPSET_FLAG_MAP_SKBPRIO)
425 skb->priority = MOPT(map_opt, skbprio);
426 if ((map_opt.cmdflags & IPSET_FLAG_MAP_SKBQUEUE) &&
427 skb->dev &&
428 skb->dev->real_num_tx_queues > MOPT(map_opt, skbqueue))
429 skb_set_queue_mapping(skb, MOPT(map_opt, skbqueue));
430 }
431 return XT_CONTINUE;
432}
433
434static int
435set_target_v3_checkentry(const struct xt_tgchk_param *par)
436{
437 const struct xt_set_info_target_v3 *info = par->targinfo;
438 ip_set_id_t index;
439 int ret = 0;
440
441 if (info->add_set.index != IPSET_INVALID_ID) {
442 index = ip_set_nfnl_get_byindex(par->net,
443 info->add_set.index);
444 if (index == IPSET_INVALID_ID) {
445 pr_info_ratelimited("Cannot find add_set index %u as target\n",
446 info->add_set.index);
447 return -ENOENT;
448 }
449 }
450
451 if (info->del_set.index != IPSET_INVALID_ID) {
452 index = ip_set_nfnl_get_byindex(par->net,
453 info->del_set.index);
454 if (index == IPSET_INVALID_ID) {
455 pr_info_ratelimited("Cannot find del_set index %u as target\n",
456 info->del_set.index);
457 ret = -ENOENT;
458 goto cleanup_add;
459 }
460 }
461
462 if (info->map_set.index != IPSET_INVALID_ID) {
463 if (strncmp(par->table, "mangle", 7)) {
464 pr_info_ratelimited("--map-set only usable from mangle table\n");
465 ret = -EINVAL;
466 goto cleanup_del;
467 }
468 if (((info->flags & IPSET_FLAG_MAP_SKBPRIO) |
469 (info->flags & IPSET_FLAG_MAP_SKBQUEUE)) &&
470 (par->hook_mask & ~(1 << NF_INET_FORWARD |
471 1 << NF_INET_LOCAL_OUT |
472 1 << NF_INET_POST_ROUTING))) {
473 pr_info_ratelimited("mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains\n");
474 ret = -EINVAL;
475 goto cleanup_del;
476 }
477 index = ip_set_nfnl_get_byindex(par->net,
478 info->map_set.index);
479 if (index == IPSET_INVALID_ID) {
480 pr_info_ratelimited("Cannot find map_set index %u as target\n",
481 info->map_set.index);
482 ret = -ENOENT;
483 goto cleanup_del;
484 }
485 }
486
487 if (info->add_set.dim > IPSET_DIM_MAX ||
488 info->del_set.dim > IPSET_DIM_MAX ||
489 info->map_set.dim > IPSET_DIM_MAX) {
490 pr_info_ratelimited("SET target dimension over the limit!\n");
491 ret = -ERANGE;
492 goto cleanup_mark;
493 }
494
495 return 0;
496cleanup_mark:
497 if (info->map_set.index != IPSET_INVALID_ID)
498 ip_set_nfnl_put(par->net, info->map_set.index);
499cleanup_del:
500 if (info->del_set.index != IPSET_INVALID_ID)
501 ip_set_nfnl_put(par->net, info->del_set.index);
502cleanup_add:
503 if (info->add_set.index != IPSET_INVALID_ID)
504 ip_set_nfnl_put(par->net, info->add_set.index);
505 return ret;
506}
507
508static void
509set_target_v3_destroy(const struct xt_tgdtor_param *par)
510{
511 const struct xt_set_info_target_v3 *info = par->targinfo;
512
513 if (info->add_set.index != IPSET_INVALID_ID)
514 ip_set_nfnl_put(par->net, info->add_set.index);
515 if (info->del_set.index != IPSET_INVALID_ID)
516 ip_set_nfnl_put(par->net, info->del_set.index);
517 if (info->map_set.index != IPSET_INVALID_ID)
518 ip_set_nfnl_put(par->net, info->map_set.index);
519}
520
521static struct xt_match set_matches[] __read_mostly = {
522 {
523 .name = "set",
524 .family = NFPROTO_IPV4,
525 .revision = 0,
526 .match = set_match_v0,
527 .matchsize = sizeof(struct xt_set_info_match_v0),
528 .checkentry = set_match_v0_checkentry,
529 .destroy = set_match_v0_destroy,
530 .me = THIS_MODULE
531 },
532 {
533 .name = "set",
534 .family = NFPROTO_IPV4,
535 .revision = 1,
536 .match = set_match_v1,
537 .matchsize = sizeof(struct xt_set_info_match_v1),
538 .checkentry = set_match_v1_checkentry,
539 .destroy = set_match_v1_destroy,
540 .me = THIS_MODULE
541 },
542 {
543 .name = "set",
544 .family = NFPROTO_IPV6,
545 .revision = 1,
546 .match = set_match_v1,
547 .matchsize = sizeof(struct xt_set_info_match_v1),
548 .checkentry = set_match_v1_checkentry,
549 .destroy = set_match_v1_destroy,
550 .me = THIS_MODULE
551 },
552 /* --return-nomatch flag support */
553 {
554 .name = "set",
555 .family = NFPROTO_IPV4,
556 .revision = 2,
557 .match = set_match_v1,
558 .matchsize = sizeof(struct xt_set_info_match_v1),
559 .checkentry = set_match_v1_checkentry,
560 .destroy = set_match_v1_destroy,
561 .me = THIS_MODULE
562 },
563 {
564 .name = "set",
565 .family = NFPROTO_IPV6,
566 .revision = 2,
567 .match = set_match_v1,
568 .matchsize = sizeof(struct xt_set_info_match_v1),
569 .checkentry = set_match_v1_checkentry,
570 .destroy = set_match_v1_destroy,
571 .me = THIS_MODULE
572 },
573 /* counters support: update, match */
574 {
575 .name = "set",
576 .family = NFPROTO_IPV4,
577 .revision = 3,
578 .match = set_match_v3,
579 .matchsize = sizeof(struct xt_set_info_match_v3),
580 .checkentry = set_match_v3_checkentry,
581 .destroy = set_match_v3_destroy,
582 .me = THIS_MODULE
583 },
584 {
585 .name = "set",
586 .family = NFPROTO_IPV6,
587 .revision = 3,
588 .match = set_match_v3,
589 .matchsize = sizeof(struct xt_set_info_match_v3),
590 .checkentry = set_match_v3_checkentry,
591 .destroy = set_match_v3_destroy,
592 .me = THIS_MODULE
593 },
594 /* new revision for counters support: update, match */
595 {
596 .name = "set",
597 .family = NFPROTO_IPV4,
598 .revision = 4,
599 .match = set_match_v4,
600 .matchsize = sizeof(struct xt_set_info_match_v4),
601 .checkentry = set_match_v4_checkentry,
602 .destroy = set_match_v4_destroy,
603 .me = THIS_MODULE
604 },
605 {
606 .name = "set",
607 .family = NFPROTO_IPV6,
608 .revision = 4,
609 .match = set_match_v4,
610 .matchsize = sizeof(struct xt_set_info_match_v4),
611 .checkentry = set_match_v4_checkentry,
612 .destroy = set_match_v4_destroy,
613 .me = THIS_MODULE
614 },
615};
616
617static struct xt_target set_targets[] __read_mostly = {
618 {
619 .name = "SET",
620 .revision = 0,
621 .family = NFPROTO_IPV4,
622 .target = set_target_v0,
623 .targetsize = sizeof(struct xt_set_info_target_v0),
624 .checkentry = set_target_v0_checkentry,
625 .destroy = set_target_v0_destroy,
626 .me = THIS_MODULE
627 },
628 {
629 .name = "SET",
630 .revision = 1,
631 .family = NFPROTO_IPV4,
632 .target = set_target_v1,
633 .targetsize = sizeof(struct xt_set_info_target_v1),
634 .checkentry = set_target_v1_checkentry,
635 .destroy = set_target_v1_destroy,
636 .me = THIS_MODULE
637 },
638 {
639 .name = "SET",
640 .revision = 1,
641 .family = NFPROTO_IPV6,
642 .target = set_target_v1,
643 .targetsize = sizeof(struct xt_set_info_target_v1),
644 .checkentry = set_target_v1_checkentry,
645 .destroy = set_target_v1_destroy,
646 .me = THIS_MODULE
647 },
648 /* --timeout and --exist flags support */
649 {
650 .name = "SET",
651 .revision = 2,
652 .family = NFPROTO_IPV4,
653 .target = set_target_v2,
654 .targetsize = sizeof(struct xt_set_info_target_v2),
655 .checkentry = set_target_v2_checkentry,
656 .destroy = set_target_v2_destroy,
657 .me = THIS_MODULE
658 },
659 {
660 .name = "SET",
661 .revision = 2,
662 .family = NFPROTO_IPV6,
663 .target = set_target_v2,
664 .targetsize = sizeof(struct xt_set_info_target_v2),
665 .checkentry = set_target_v2_checkentry,
666 .destroy = set_target_v2_destroy,
667 .me = THIS_MODULE
668 },
669 /* --map-set support */
670 {
671 .name = "SET",
672 .revision = 3,
673 .family = NFPROTO_IPV4,
674 .target = set_target_v3,
675 .targetsize = sizeof(struct xt_set_info_target_v3),
676 .checkentry = set_target_v3_checkentry,
677 .destroy = set_target_v3_destroy,
678 .me = THIS_MODULE
679 },
680 {
681 .name = "SET",
682 .revision = 3,
683 .family = NFPROTO_IPV6,
684 .target = set_target_v3,
685 .targetsize = sizeof(struct xt_set_info_target_v3),
686 .checkentry = set_target_v3_checkentry,
687 .destroy = set_target_v3_destroy,
688 .me = THIS_MODULE
689 },
690};
691
692static int __init xt_set_init(void)
693{
694 int ret = xt_register_matches(set_matches, ARRAY_SIZE(set_matches));
695
696 if (!ret) {
697 ret = xt_register_targets(set_targets,
698 ARRAY_SIZE(set_targets));
699 if (ret)
700 xt_unregister_matches(set_matches,
701 ARRAY_SIZE(set_matches));
702 }
703 return ret;
704}
705
706static void __exit xt_set_fini(void)
707{
708 xt_unregister_matches(set_matches, ARRAY_SIZE(set_matches));
709 xt_unregister_targets(set_targets, ARRAY_SIZE(set_targets));
710}
711
712module_init(xt_set_init);
713module_exit(xt_set_fini);