[linux.git] / net / netfilter / xt_set.c

/* Copyright (C) 2000-2002 Joakim Axelsson <[email protected]>
 *                         Patrick Schaaf <[email protected]>
 *                         Martin Josefsson <[email protected]>
 * Copyright (C) 2003-2011 Jozsef Kadlecsik <[email protected]>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

/* Kernel module which implements the set match and SET target
 * for netfilter/iptables. */

#include <linux/module.h>
#include <linux/skbuff.h>

#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_set.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Jozsef Kadlecsik <[email protected]>");
MODULE_DESCRIPTION("Xtables: IP set match and target module");
MODULE_ALIAS("xt_SET");
MODULE_ALIAS("ipt_set");
MODULE_ALIAS("ip6t_set");
MODULE_ALIAS("ipt_SET");
MODULE_ALIAS("ip6t_SET");

static inline int
match_set(ip_set_id_t index, const struct sk_buff *skb,
	  const struct xt_action_param *par,
	  const struct ip_set_adt_opt *opt, int inv)
{
	if (ip_set_test(index, skb, par, opt))
		inv = !inv;
	return inv;
}

#define ADT_OPT(n, f, d, fs, cfs, t)	\
const struct ip_set_adt_opt n = {	\
	.family	= f,			\
	.dim = d,			\
	.flags = fs,			\
	.cmdflags = cfs,		\
	.timeout = t,			\
}

/* Revision 0 interface: backward compatible with netfilter/iptables */

static bool
set_match_v0(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_set_info_match_v0 *info = par->matchinfo;
	ADT_OPT(opt, par->family, info->match_set.u.compat.dim,
		info->match_set.u.compat.flags, 0, UINT_MAX);

	return match_set(info->match_set.index, skb, par, &opt,
			 info->match_set.u.compat.flags & IPSET_INV_MATCH);
}

static void
compat_flags(struct xt_set_info_v0 *info)
{
	u_int8_t i;

	/* Fill out compatibility data according to enum ip_set_kopt */
	info->u.compat.dim = IPSET_DIM_ZERO;
	if (info->u.flags[0] & IPSET_MATCH_INV)
		info->u.compat.flags |= IPSET_INV_MATCH;
	for (i = 0; i < IPSET_DIM_MAX-1 && info->u.flags[i]; i++) {
		info->u.compat.dim++;
		if (info->u.flags[i] & IPSET_SRC)
			info->u.compat.flags |= (1<<info->u.compat.dim);
	}
}

static int
set_match_v0_checkentry(const struct xt_mtchk_param *par)
{
	struct xt_set_info_match_v0 *info = par->matchinfo;
	ip_set_id_t index;

	index = ip_set_nfnl_get_byindex(info->match_set.index);

	if (index == IPSET_INVALID_ID) {
		pr_warning("Cannot find set indentified by id %u to match\n",
			   info->match_set.index);
		return -ENOENT;
	}
	if (info->match_set.u.flags[IPSET_DIM_MAX-1] != 0) {
		pr_warning("Protocol error: set match dimension "
			   "is over the limit!\n");
		ip_set_nfnl_put(info->match_set.index);
		return -ERANGE;
	}

	/* Fill out compatibility data */
	compat_flags(&info->match_set);

	return 0;
}

static void
set_match_v0_destroy(const struct xt_mtdtor_param *par)
{
	struct xt_set_info_match_v0 *info = par->matchinfo;

	ip_set_nfnl_put(info->match_set.index);
}

static unsigned int
set_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct xt_set_info_target_v0 *info = par->targinfo;
	ADT_OPT(add_opt, par->family, info->add_set.u.compat.dim,
		info->add_set.u.compat.flags, 0, UINT_MAX);
	ADT_OPT(del_opt, par->family, info->del_set.u.compat.dim,
		info->del_set.u.compat.flags, 0, UINT_MAX);

	if (info->add_set.index != IPSET_INVALID_ID)
		ip_set_add(info->add_set.index, skb, par, &add_opt);
	if (info->del_set.index != IPSET_INVALID_ID)
		ip_set_del(info->del_set.index, skb, par, &del_opt);

	return XT_CONTINUE;
}

static int
set_target_v0_checkentry(const struct xt_tgchk_param *par)
{
	struct xt_set_info_target_v0 *info = par->targinfo;
	ip_set_id_t index;

	if (info->add_set.index != IPSET_INVALID_ID) {
		index = ip_set_nfnl_get_byindex(info->add_set.index);
		if (index == IPSET_INVALID_ID) {
			pr_warning("Cannot find add_set index %u as target\n",
				   info->add_set.index);
			return -ENOENT;
		}
	}

	if (info->del_set.index != IPSET_INVALID_ID) {
		index = ip_set_nfnl_get_byindex(info->del_set.index);
		if (index == IPSET_INVALID_ID) {
			pr_warning("Cannot find del_set index %u as target\n",
				   info->del_set.index);
			if (info->add_set.index != IPSET_INVALID_ID)
				ip_set_nfnl_put(info->add_set.index);
			return -ENOENT;
		}
	}
	if (info->add_set.u.flags[IPSET_DIM_MAX-1] != 0 ||
	    info->del_set.u.flags[IPSET_DIM_MAX-1] != 0) {
		pr_warning("Protocol error: SET target dimension "
			   "is over the limit!\n");
		if (info->add_set.index != IPSET_INVALID_ID)
			ip_set_nfnl_put(info->add_set.index);
		if (info->del_set.index != IPSET_INVALID_ID)
			ip_set_nfnl_put(info->del_set.index);
		return -ERANGE;
	}

	/* Fill out compatibility data */
	compat_flags(&info->add_set);
	compat_flags(&info->del_set);

	return 0;
}

static void
set_target_v0_destroy(const struct xt_tgdtor_param *par)
{
	const struct xt_set_info_target_v0 *info = par->targinfo;

	if (info->add_set.index != IPSET_INVALID_ID)
		ip_set_nfnl_put(info->add_set.index);
	if (info->del_set.index != IPSET_INVALID_ID)
		ip_set_nfnl_put(info->del_set.index);
}

/* Revision 1 match and target */

static bool
set_match_v1(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_set_info_match_v1 *info = par->matchinfo;
	ADT_OPT(opt, par->family, info->match_set.dim,
		info->match_set.flags, 0, UINT_MAX);

	return match_set(info->match_set.index, skb, par, &opt,
			 info->match_set.flags & IPSET_INV_MATCH);
}

static int
set_match_v1_checkentry(const struct xt_mtchk_param *par)
{
	struct xt_set_info_match_v1 *info = par->matchinfo;
	ip_set_id_t index;

	index = ip_set_nfnl_get_byindex(info->match_set.index);

	if (index == IPSET_INVALID_ID) {
		pr_warning("Cannot find set indentified by id %u to match\n",
			   info->match_set.index);
		return -ENOENT;
	}
	if (info->match_set.dim > IPSET_DIM_MAX) {
		pr_warning("Protocol error: set match dimension "
			   "is over the limit!\n");
		ip_set_nfnl_put(info->match_set.index);
		return -ERANGE;
	}

	return 0;
}

static void
set_match_v1_destroy(const struct xt_mtdtor_param *par)
{
	struct xt_set_info_match_v1 *info = par->matchinfo;

	ip_set_nfnl_put(info->match_set.index);
}

static unsigned int
set_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct xt_set_info_target_v1 *info = par->targinfo;
	ADT_OPT(add_opt, par->family, info->add_set.dim,
		info->add_set.flags, 0, UINT_MAX);
	ADT_OPT(del_opt, par->family, info->del_set.dim,
		info->del_set.flags, 0, UINT_MAX);

	if (info->add_set.index != IPSET_INVALID_ID)
		ip_set_add(info->add_set.index, skb, par, &add_opt);
	if (info->del_set.index != IPSET_INVALID_ID)
		ip_set_del(info->del_set.index, skb, par, &del_opt);

	return XT_CONTINUE;
}

static int
set_target_v1_checkentry(const struct xt_tgchk_param *par)
{
	const struct xt_set_info_target_v1 *info = par->targinfo;
	ip_set_id_t index;

	if (info->add_set.index != IPSET_INVALID_ID) {
		index = ip_set_nfnl_get_byindex(info->add_set.index);
		if (index == IPSET_INVALID_ID) {
			pr_warning("Cannot find add_set index %u as target\n",
				   info->add_set.index);
			return -ENOENT;
		}
	}

	if (info->del_set.index != IPSET_INVALID_ID) {
		index = ip_set_nfnl_get_byindex(info->del_set.index);
		if (index == IPSET_INVALID_ID) {
			pr_warning("Cannot find del_set index %u as target\n",
				   info->del_set.index);
			if (info->add_set.index != IPSET_INVALID_ID)
				ip_set_nfnl_put(info->add_set.index);
			return -ENOENT;
		}
	}
	if (info->add_set.dim > IPSET_DIM_MAX ||
	    info->del_set.dim > IPSET_DIM_MAX) {
		pr_warning("Protocol error: SET target dimension "
			   "is over the limit!\n");
		if (info->add_set.index != IPSET_INVALID_ID)
			ip_set_nfnl_put(info->add_set.index);
		if (info->del_set.index != IPSET_INVALID_ID)
			ip_set_nfnl_put(info->del_set.index);
		return -ERANGE;
	}

	return 0;
}

static void
set_target_v1_destroy(const struct xt_tgdtor_param *par)
{
	const struct xt_set_info_target_v1 *info = par->targinfo;

	if (info->add_set.index != IPSET_INVALID_ID)
		ip_set_nfnl_put(info->add_set.index);
	if (info->del_set.index != IPSET_INVALID_ID)
		ip_set_nfnl_put(info->del_set.index);
}

/* Revision 2 target */

static unsigned int
set_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
{
	const struct xt_set_info_target_v2 *info = par->targinfo;
	ADT_OPT(add_opt, par->family, info->add_set.dim,
		info->add_set.flags, info->flags, info->timeout);
	ADT_OPT(del_opt, par->family, info->del_set.dim,
		info->del_set.flags, 0, UINT_MAX);

	if (info->add_set.index != IPSET_INVALID_ID)
		ip_set_add(info->add_set.index, skb, par, &add_opt);
	if (info->del_set.index != IPSET_INVALID_ID)
		ip_set_del(info->del_set.index, skb, par, &del_opt);

	return XT_CONTINUE;
}

#define set_target_v2_checkentry	set_target_v1_checkentry
#define set_target_v2_destroy		set_target_v1_destroy

static struct xt_match set_matches[] __read_mostly = {
	{
		.name		= "set",
		.family		= NFPROTO_IPV4,
		.revision	= 0,
		.match		= set_match_v0,
		.matchsize	= sizeof(struct xt_set_info_match_v0),
		.checkentry	= set_match_v0_checkentry,
		.destroy	= set_match_v0_destroy,
		.me		= THIS_MODULE
	},
	{
		.name		= "set",
		.family		= NFPROTO_IPV4,
		.revision	= 1,
		.match		= set_match_v1,
		.matchsize	= sizeof(struct xt_set_info_match_v1),
		.checkentry	= set_match_v1_checkentry,
		.destroy	= set_match_v1_destroy,
		.me		= THIS_MODULE
	},
	{
		.name		= "set",
		.family		= NFPROTO_IPV6,
		.revision	= 1,
		.match		= set_match_v1,
		.matchsize	= sizeof(struct xt_set_info_match_v1),
		.checkentry	= set_match_v1_checkentry,
		.destroy	= set_match_v1_destroy,
		.me		= THIS_MODULE
	},
};

static struct xt_target set_targets[] __read_mostly = {
	{
		.name		= "SET",
		.revision	= 0,
		.family		= NFPROTO_IPV4,
		.target		= set_target_v0,
		.targetsize	= sizeof(struct xt_set_info_target_v0),
		.checkentry	= set_target_v0_checkentry,
		.destroy	= set_target_v0_destroy,
		.me		= THIS_MODULE
	},
	{
		.name		= "SET",
		.revision	= 1,
		.family		= NFPROTO_IPV4,
		.target		= set_target_v1,
		.targetsize	= sizeof(struct xt_set_info_target_v1),
		.checkentry	= set_target_v1_checkentry,
		.destroy	= set_target_v1_destroy,
		.me		= THIS_MODULE
	},
	{
		.name		= "SET",
		.revision	= 1,
		.family		= NFPROTO_IPV6,
		.target		= set_target_v1,
		.targetsize	= sizeof(struct xt_set_info_target_v1),
		.checkentry	= set_target_v1_checkentry,
		.destroy	= set_target_v1_destroy,
		.me		= THIS_MODULE
	},
	{
		.name		= "SET",
		.revision	= 2,
		.family		= NFPROTO_IPV4,
		.target		= set_target_v2,
		.targetsize	= sizeof(struct xt_set_info_target_v2),
		.checkentry	= set_target_v2_checkentry,
		.destroy	= set_target_v2_destroy,
		.me		= THIS_MODULE
	},
	{
		.name		= "SET",
		.revision	= 2,
		.family		= NFPROTO_IPV6,
		.target		= set_target_v2,
		.targetsize	= sizeof(struct xt_set_info_target_v2),
		.checkentry	= set_target_v2_checkentry,
		.destroy	= set_target_v2_destroy,
		.me		= THIS_MODULE
	},
};

static int __init xt_set_init(void)
{
	int ret = xt_register_matches(set_matches, ARRAY_SIZE(set_matches));

	if (!ret) {
		ret = xt_register_targets(set_targets,
					  ARRAY_SIZE(set_targets));
		if (ret)
			xt_unregister_matches(set_matches,
					      ARRAY_SIZE(set_matches));
	}
	return ret;
}

static void __exit xt_set_fini(void)
{
	xt_unregister_matches(set_matches, ARRAY_SIZE(set_matches));
	xt_unregister_targets(set_targets, ARRAY_SIZE(set_targets));
}

module_init(xt_set_init);
module_exit(xt_set_fini);
Commit	Line	Data
d956798d JK	1	/* Copyright (C) 2000-2002 Joakim Axelsson <[email protected]>
	2	* Patrick Schaaf <[email protected]>
	3	* Martin Josefsson <[email protected]>
	4	* Copyright (C) 2003-2011 Jozsef Kadlecsik <[email protected]>
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*/
	10
	11	/* Kernel module which implements the set match and SET target
	12	* for netfilter/iptables. */
	13
	14	#include <linux/module.h>
	15	#include <linux/skbuff.h>
d956798d JK	16
	17	#include <linux/netfilter/x_tables.h>
	18	#include <linux/netfilter/xt_set.h>
	19
	20	MODULE_LICENSE("GPL");
	21	MODULE_AUTHOR("Jozsef Kadlecsik <[email protected]>");
	22	MODULE_DESCRIPTION("Xtables: IP set match and target module");
	23	MODULE_ALIAS("xt_SET");
	24	MODULE_ALIAS("ipt_set");
	25	MODULE_ALIAS("ip6t_set");
	26	MODULE_ALIAS("ipt_SET");
	27	MODULE_ALIAS("ip6t_SET");
	28
	29	static inline int
	30	match_set(ip_set_id_t index, const struct sk_buff *skb,
b66554cf	31	const struct xt_action_param *par,
ac8cc925	32	const struct ip_set_adt_opt *opt, int inv)
d956798d	33	{
b66554cf	34	if (ip_set_test(index, skb, par, opt))
d956798d JK	35	inv = !inv;
	36	return inv;
	37	}
	38
15b4d93f	39	#define ADT_OPT(n, f, d, fs, cfs, t) \
ac8cc925 JK	40	const struct ip_set_adt_opt n = { \
	41	.family = f, \
	42	.dim = d, \
	43	.flags = fs, \
	44	.cmdflags = cfs, \
	45	.timeout = t, \
	46	}
	47
d956798d JK	48	/* Revision 0 interface: backward compatible with netfilter/iptables */
	49
	50	static bool
	51	set_match_v0(const struct sk_buff skb, struct xt_action_param par)
	52	{
	53	const struct xt_set_info_match_v0 *info = par->matchinfo;
ac8cc925 JK	54	ADT_OPT(opt, par->family, info->match_set.u.compat.dim,
ac8cc925 JK	55	info->match_set.u.compat.flags, 0, UINT_MAX);
d956798d	56
b66554cf	57	return match_set(info->match_set.index, skb, par, &opt,
d956798d JK	58	info->match_set.u.compat.flags & IPSET_INV_MATCH);
	59	}
	60
	61	static void
	62	compat_flags(struct xt_set_info_v0 *info)
	63	{
	64	u_int8_t i;
	65
	66	/* Fill out compatibility data according to enum ip_set_kopt */
	67	info->u.compat.dim = IPSET_DIM_ZERO;
	68	if (info->u.flags[0] & IPSET_MATCH_INV)
	69	info->u.compat.flags \|= IPSET_INV_MATCH;
	70	for (i = 0; i < IPSET_DIM_MAX-1 && info->u.flags[i]; i++) {
	71	info->u.compat.dim++;
	72	if (info->u.flags[i] & IPSET_SRC)
	73	info->u.compat.flags \|= (1<<info->u.compat.dim);
	74	}
	75	}
	76
	77	static int
	78	set_match_v0_checkentry(const struct xt_mtchk_param *par)
	79	{
	80	struct xt_set_info_match_v0 *info = par->matchinfo;
	81	ip_set_id_t index;
	82
	83	index = ip_set_nfnl_get_byindex(info->match_set.index);
	84
	85	if (index == IPSET_INVALID_ID) {
	86	pr_warning("Cannot find set indentified by id %u to match\n",
	87	info->match_set.index);
	88	return -ENOENT;
	89	}
	90	if (info->match_set.u.flags[IPSET_DIM_MAX-1] != 0) {
	91	pr_warning("Protocol error: set match dimension "
	92	"is over the limit!\n");
eafbd3fd	93	ip_set_nfnl_put(info->match_set.index);
d956798d JK	94	return -ERANGE;
	95	}
	96
	97	/* Fill out compatibility data */
	98	compat_flags(&info->match_set);
	99
	100	return 0;
	101	}
	102
	103	static void
	104	set_match_v0_destroy(const struct xt_mtdtor_param *par)
	105	{
	106	struct xt_set_info_match_v0 *info = par->matchinfo;
	107
	108	ip_set_nfnl_put(info->match_set.index);
	109	}
	110
	111	static unsigned int
	112	set_target_v0(struct sk_buff skb, const struct xt_action_param par)
	113	{
	114	const struct xt_set_info_target_v0 *info = par->targinfo;
ac8cc925 JK	115	ADT_OPT(add_opt, par->family, info->add_set.u.compat.dim,
	116	info->add_set.u.compat.flags, 0, UINT_MAX);
	117	ADT_OPT(del_opt, par->family, info->del_set.u.compat.dim,
	118	info->del_set.u.compat.flags, 0, UINT_MAX);
d956798d JK	119
d956798d JK	120	if (info->add_set.index != IPSET_INVALID_ID)
b66554cf	121	ip_set_add(info->add_set.index, skb, par, &add_opt);
d956798d	122	if (info->del_set.index != IPSET_INVALID_ID)
b66554cf	123	ip_set_del(info->del_set.index, skb, par, &del_opt);
d956798d JK	124
	125	return XT_CONTINUE;
	126	}
	127
	128	static int
	129	set_target_v0_checkentry(const struct xt_tgchk_param *par)
	130	{
	131	struct xt_set_info_target_v0 *info = par->targinfo;
	132	ip_set_id_t index;
	133
	134	if (info->add_set.index != IPSET_INVALID_ID) {
	135	index = ip_set_nfnl_get_byindex(info->add_set.index);
	136	if (index == IPSET_INVALID_ID) {
	137	pr_warning("Cannot find add_set index %u as target\n",
	138	info->add_set.index);
	139	return -ENOENT;
	140	}
	141	}
	142
	143	if (info->del_set.index != IPSET_INVALID_ID) {
	144	index = ip_set_nfnl_get_byindex(info->del_set.index);
	145	if (index == IPSET_INVALID_ID) {
	146	pr_warning("Cannot find del_set index %u as target\n",
	147	info->del_set.index);
eafbd3fd JK	148	if (info->add_set.index != IPSET_INVALID_ID)
eafbd3fd JK	149	ip_set_nfnl_put(info->add_set.index);
d956798d JK	150	return -ENOENT;
	151	}
	152	}
	153	if (info->add_set.u.flags[IPSET_DIM_MAX-1] != 0 \|\|
	154	info->del_set.u.flags[IPSET_DIM_MAX-1] != 0) {
	155	pr_warning("Protocol error: SET target dimension "
	156	"is over the limit!\n");
eafbd3fd JK	157	if (info->add_set.index != IPSET_INVALID_ID)
	158	ip_set_nfnl_put(info->add_set.index);
	159	if (info->del_set.index != IPSET_INVALID_ID)
	160	ip_set_nfnl_put(info->del_set.index);
d956798d JK	161	return -ERANGE;
	162	}
	163
	164	/* Fill out compatibility data */
	165	compat_flags(&info->add_set);
	166	compat_flags(&info->del_set);
	167
	168	return 0;
	169	}
	170
	171	static void
	172	set_target_v0_destroy(const struct xt_tgdtor_param *par)
	173	{
	174	const struct xt_set_info_target_v0 *info = par->targinfo;
	175
	176	if (info->add_set.index != IPSET_INVALID_ID)
	177	ip_set_nfnl_put(info->add_set.index);
	178	if (info->del_set.index != IPSET_INVALID_ID)
	179	ip_set_nfnl_put(info->del_set.index);
	180	}
	181
ac8cc925	182	/* Revision 1 match and target */
d956798d JK	183
d956798d JK	184	static bool
ac8cc925	185	set_match_v1(const struct sk_buff skb, struct xt_action_param par)
d956798d	186	{
ac8cc925 JK	187	const struct xt_set_info_match_v1 *info = par->matchinfo;
	188	ADT_OPT(opt, par->family, info->match_set.dim,
	189	info->match_set.flags, 0, UINT_MAX);
d956798d	190
b66554cf	191	return match_set(info->match_set.index, skb, par, &opt,
d956798d JK	192	info->match_set.flags & IPSET_INV_MATCH);
	193	}
	194
	195	static int
ac8cc925	196	set_match_v1_checkentry(const struct xt_mtchk_param *par)
d956798d	197	{
ac8cc925	198	struct xt_set_info_match_v1 *info = par->matchinfo;
d956798d JK	199	ip_set_id_t index;
	200
	201	index = ip_set_nfnl_get_byindex(info->match_set.index);
	202
	203	if (index == IPSET_INVALID_ID) {
	204	pr_warning("Cannot find set indentified by id %u to match\n",
	205	info->match_set.index);
	206	return -ENOENT;
	207	}
	208	if (info->match_set.dim > IPSET_DIM_MAX) {
	209	pr_warning("Protocol error: set match dimension "
	210	"is over the limit!\n");
eafbd3fd	211	ip_set_nfnl_put(info->match_set.index);
d956798d JK	212	return -ERANGE;
	213	}
	214
	215	return 0;
	216	}
	217
	218	static void
ac8cc925	219	set_match_v1_destroy(const struct xt_mtdtor_param *par)
d956798d	220	{
ac8cc925	221	struct xt_set_info_match_v1 *info = par->matchinfo;
d956798d JK	222
	223	ip_set_nfnl_put(info->match_set.index);
	224	}
	225
	226	static unsigned int
ac8cc925	227	set_target_v1(struct sk_buff skb, const struct xt_action_param par)
d956798d	228	{
ac8cc925 JK	229	const struct xt_set_info_target_v1 *info = par->targinfo;
	230	ADT_OPT(add_opt, par->family, info->add_set.dim,
	231	info->add_set.flags, 0, UINT_MAX);
	232	ADT_OPT(del_opt, par->family, info->del_set.dim,
	233	info->del_set.flags, 0, UINT_MAX);
d956798d JK	234
d956798d JK	235	if (info->add_set.index != IPSET_INVALID_ID)
b66554cf	236	ip_set_add(info->add_set.index, skb, par, &add_opt);
d956798d	237	if (info->del_set.index != IPSET_INVALID_ID)
b66554cf	238	ip_set_del(info->del_set.index, skb, par, &del_opt);
d956798d JK	239
	240	return XT_CONTINUE;
	241	}
	242
	243	static int
ac8cc925	244	set_target_v1_checkentry(const struct xt_tgchk_param *par)
d956798d	245	{
ac8cc925	246	const struct xt_set_info_target_v1 *info = par->targinfo;
d956798d JK	247	ip_set_id_t index;
	248
	249	if (info->add_set.index != IPSET_INVALID_ID) {
	250	index = ip_set_nfnl_get_byindex(info->add_set.index);
	251	if (index == IPSET_INVALID_ID) {
	252	pr_warning("Cannot find add_set index %u as target\n",
	253	info->add_set.index);
	254	return -ENOENT;
	255	}
	256	}
	257
	258	if (info->del_set.index != IPSET_INVALID_ID) {
	259	index = ip_set_nfnl_get_byindex(info->del_set.index);
	260	if (index == IPSET_INVALID_ID) {
	261	pr_warning("Cannot find del_set index %u as target\n",
	262	info->del_set.index);
eafbd3fd JK	263	if (info->add_set.index != IPSET_INVALID_ID)
eafbd3fd JK	264	ip_set_nfnl_put(info->add_set.index);
d956798d JK	265	return -ENOENT;
	266	}
	267	}
	268	if (info->add_set.dim > IPSET_DIM_MAX \|\|
eafbd3fd	269	info->del_set.dim > IPSET_DIM_MAX) {
d956798d JK	270	pr_warning("Protocol error: SET target dimension "
d956798d JK	271	"is over the limit!\n");
eafbd3fd JK	272	if (info->add_set.index != IPSET_INVALID_ID)
	273	ip_set_nfnl_put(info->add_set.index);
	274	if (info->del_set.index != IPSET_INVALID_ID)
	275	ip_set_nfnl_put(info->del_set.index);
d956798d JK	276	return -ERANGE;
	277	}
	278
	279	return 0;
	280	}
	281
	282	static void
ac8cc925	283	set_target_v1_destroy(const struct xt_tgdtor_param *par)
d956798d	284	{
ac8cc925	285	const struct xt_set_info_target_v1 *info = par->targinfo;
d956798d JK	286
	287	if (info->add_set.index != IPSET_INVALID_ID)
	288	ip_set_nfnl_put(info->add_set.index);
	289	if (info->del_set.index != IPSET_INVALID_ID)
	290	ip_set_nfnl_put(info->del_set.index);
	291	}
	292
ac8cc925 JK	293	/* Revision 2 target */
	294
	295	static unsigned int
	296	set_target_v2(struct sk_buff skb, const struct xt_action_param par)
	297	{
	298	const struct xt_set_info_target_v2 *info = par->targinfo;
	299	ADT_OPT(add_opt, par->family, info->add_set.dim,
	300	info->add_set.flags, info->flags, info->timeout);
	301	ADT_OPT(del_opt, par->family, info->del_set.dim,
	302	info->del_set.flags, 0, UINT_MAX);
	303
	304	if (info->add_set.index != IPSET_INVALID_ID)
b66554cf	305	ip_set_add(info->add_set.index, skb, par, &add_opt);
ac8cc925	306	if (info->del_set.index != IPSET_INVALID_ID)
b66554cf	307	ip_set_del(info->del_set.index, skb, par, &del_opt);
ac8cc925 JK	308
	309	return XT_CONTINUE;
	310	}
	311
	312	#define set_target_v2_checkentry set_target_v1_checkentry
	313	#define set_target_v2_destroy set_target_v1_destroy
	314
d956798d JK	315	static struct xt_match set_matches[] __read_mostly = {
	316	{
	317	.name = "set",
	318	.family = NFPROTO_IPV4,
	319	.revision = 0,
	320	.match = set_match_v0,
	321	.matchsize = sizeof(struct xt_set_info_match_v0),
	322	.checkentry = set_match_v0_checkentry,
	323	.destroy = set_match_v0_destroy,
	324	.me = THIS_MODULE
	325	},
	326	{
	327	.name = "set",
	328	.family = NFPROTO_IPV4,
	329	.revision = 1,
ac8cc925 JK	330	.match = set_match_v1,
	331	.matchsize = sizeof(struct xt_set_info_match_v1),
	332	.checkentry = set_match_v1_checkentry,
	333	.destroy = set_match_v1_destroy,
d956798d JK	334	.me = THIS_MODULE
	335	},
	336	{
	337	.name = "set",
	338	.family = NFPROTO_IPV6,
	339	.revision = 1,
ac8cc925 JK	340	.match = set_match_v1,
	341	.matchsize = sizeof(struct xt_set_info_match_v1),
	342	.checkentry = set_match_v1_checkentry,
	343	.destroy = set_match_v1_destroy,
d956798d JK	344	.me = THIS_MODULE
	345	},
	346	};
	347
	348	static struct xt_target set_targets[] __read_mostly = {
	349	{
	350	.name = "SET",
	351	.revision = 0,
	352	.family = NFPROTO_IPV4,
	353	.target = set_target_v0,
	354	.targetsize = sizeof(struct xt_set_info_target_v0),
	355	.checkentry = set_target_v0_checkentry,
	356	.destroy = set_target_v0_destroy,
	357	.me = THIS_MODULE
	358	},
	359	{
	360	.name = "SET",
	361	.revision = 1,
	362	.family = NFPROTO_IPV4,
ac8cc925 JK	363	.target = set_target_v1,
	364	.targetsize = sizeof(struct xt_set_info_target_v1),
	365	.checkentry = set_target_v1_checkentry,
	366	.destroy = set_target_v1_destroy,
d956798d JK	367	.me = THIS_MODULE
	368	},
	369	{
	370	.name = "SET",
	371	.revision = 1,
	372	.family = NFPROTO_IPV6,
ac8cc925 JK	373	.target = set_target_v1,
	374	.targetsize = sizeof(struct xt_set_info_target_v1),
	375	.checkentry = set_target_v1_checkentry,
	376	.destroy = set_target_v1_destroy,
	377	.me = THIS_MODULE
	378	},
	379	{
	380	.name = "SET",
	381	.revision = 2,
	382	.family = NFPROTO_IPV4,
	383	.target = set_target_v2,
	384	.targetsize = sizeof(struct xt_set_info_target_v2),
	385	.checkentry = set_target_v2_checkentry,
	386	.destroy = set_target_v2_destroy,
	387	.me = THIS_MODULE
	388	},
	389	{
	390	.name = "SET",
	391	.revision = 2,
	392	.family = NFPROTO_IPV6,
	393	.target = set_target_v2,
	394	.targetsize = sizeof(struct xt_set_info_target_v2),
	395	.checkentry = set_target_v2_checkentry,
	396	.destroy = set_target_v2_destroy,
d956798d JK	397	.me = THIS_MODULE
	398	},
	399	};
	400
	401	static int __init xt_set_init(void)
	402	{
	403	int ret = xt_register_matches(set_matches, ARRAY_SIZE(set_matches));
	404
	405	if (!ret) {
	406	ret = xt_register_targets(set_targets,
	407	ARRAY_SIZE(set_targets));
	408	if (ret)
	409	xt_unregister_matches(set_matches,
	410	ARRAY_SIZE(set_matches));
	411	}
	412	return ret;
	413	}
	414
	415	static void __exit xt_set_fini(void)
	416	{
	417	xt_unregister_matches(set_matches, ARRAY_SIZE(set_matches));
	418	xt_unregister_targets(set_targets, ARRAY_SIZE(set_targets));
	419	}
	420
	421	module_init(xt_set_init);
	422	module_exit(xt_set_fini);