ip_set_list_set.c 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /* Copyright (C) 2008-2013 Jozsef Kadlecsik <kadlec@netfilter.org> */
  3. /* Kernel module implementing an IP set type: the list:set type */
  4. #include <linux/module.h>
  5. #include <linux/ip.h>
  6. #include <linux/rculist.h>
  7. #include <linux/skbuff.h>
  8. #include <linux/errno.h>
  9. #include <linux/netfilter/ipset/ip_set.h>
  10. #include <linux/netfilter/ipset/ip_set_list.h>
  11. #define IPSET_TYPE_REV_MIN 0
  12. /* 1 Counters support added */
  13. /* 2 Comments support added */
  14. #define IPSET_TYPE_REV_MAX 3 /* skbinfo support added */
  15. MODULE_LICENSE("GPL");
  16. MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
  17. IP_SET_MODULE_DESC("list:set", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
  18. MODULE_ALIAS("ip_set_list:set");
  19. /* Member elements */
  20. struct set_elem {
  21. struct rcu_head rcu;
  22. struct list_head list;
  23. struct ip_set *set; /* Sigh, in order to cleanup reference */
  24. ip_set_id_t id;
  25. } __aligned(__alignof__(u64));
  26. struct set_adt_elem {
  27. ip_set_id_t id;
  28. ip_set_id_t refid;
  29. int before;
  30. };
  31. /* Type structure */
  32. struct list_set {
  33. u32 size; /* size of set list array */
  34. struct timer_list gc; /* garbage collection */
  35. struct ip_set *set; /* attached to this ip_set */
  36. struct net *net; /* namespace */
  37. struct list_head members; /* the set members */
  38. };
  39. static int
  40. list_set_ktest(struct ip_set *set, const struct sk_buff *skb,
  41. const struct xt_action_param *par,
  42. struct ip_set_adt_opt *opt, const struct ip_set_ext *ext)
  43. {
  44. struct list_set *map = set->data;
  45. struct ip_set_ext *mext = &opt->ext;
  46. struct set_elem *e;
  47. u32 flags = opt->cmdflags;
  48. int ret;
  49. /* Don't lookup sub-counters at all */
  50. opt->cmdflags &= ~IPSET_FLAG_MATCH_COUNTERS;
  51. if (opt->cmdflags & IPSET_FLAG_SKIP_SUBCOUNTER_UPDATE)
  52. opt->cmdflags |= IPSET_FLAG_SKIP_COUNTER_UPDATE;
  53. list_for_each_entry_rcu(e, &map->members, list) {
  54. ret = ip_set_test(e->id, skb, par, opt);
  55. if (ret <= 0)
  56. continue;
  57. if (ip_set_match_extensions(set, ext, mext, flags, e))
  58. return 1;
  59. }
  60. return 0;
  61. }
  62. static int
  63. list_set_kadd(struct ip_set *set, const struct sk_buff *skb,
  64. const struct xt_action_param *par,
  65. struct ip_set_adt_opt *opt, const struct ip_set_ext *ext)
  66. {
  67. struct list_set *map = set->data;
  68. struct set_elem *e;
  69. int ret;
  70. list_for_each_entry(e, &map->members, list) {
  71. if (SET_WITH_TIMEOUT(set) &&
  72. ip_set_timeout_expired(ext_timeout(e, set)))
  73. continue;
  74. ret = ip_set_add(e->id, skb, par, opt);
  75. if (ret == 0)
  76. return ret;
  77. }
  78. return 0;
  79. }
  80. static int
  81. list_set_kdel(struct ip_set *set, const struct sk_buff *skb,
  82. const struct xt_action_param *par,
  83. struct ip_set_adt_opt *opt, const struct ip_set_ext *ext)
  84. {
  85. struct list_set *map = set->data;
  86. struct set_elem *e;
  87. int ret;
  88. list_for_each_entry(e, &map->members, list) {
  89. if (SET_WITH_TIMEOUT(set) &&
  90. ip_set_timeout_expired(ext_timeout(e, set)))
  91. continue;
  92. ret = ip_set_del(e->id, skb, par, opt);
  93. if (ret == 0)
  94. return ret;
  95. }
  96. return 0;
  97. }
  98. static int
  99. list_set_kadt(struct ip_set *set, const struct sk_buff *skb,
  100. const struct xt_action_param *par,
  101. enum ipset_adt adt, struct ip_set_adt_opt *opt)
  102. {
  103. struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
  104. int ret = -EINVAL;
  105. rcu_read_lock();
  106. switch (adt) {
  107. case IPSET_TEST:
  108. ret = list_set_ktest(set, skb, par, opt, &ext);
  109. break;
  110. case IPSET_ADD:
  111. ret = list_set_kadd(set, skb, par, opt, &ext);
  112. break;
  113. case IPSET_DEL:
  114. ret = list_set_kdel(set, skb, par, opt, &ext);
  115. break;
  116. default:
  117. break;
  118. }
  119. rcu_read_unlock();
  120. return ret;
  121. }
  122. /* Userspace interfaces: we are protected by the nfnl mutex */
  123. static void
  124. __list_set_del_rcu(struct rcu_head * rcu)
  125. {
  126. struct set_elem *e = container_of(rcu, struct set_elem, rcu);
  127. struct ip_set *set = e->set;
  128. ip_set_ext_destroy(set, e);
  129. kfree(e);
  130. }
  131. static void
  132. list_set_del(struct ip_set *set, struct set_elem *e)
  133. {
  134. struct list_set *map = set->data;
  135. set->elements--;
  136. list_del_rcu(&e->list);
  137. ip_set_put_byindex(map->net, e->id);
  138. call_rcu(&e->rcu, __list_set_del_rcu);
  139. }
  140. static void
  141. list_set_replace(struct ip_set *set, struct set_elem *e, struct set_elem *old)
  142. {
  143. struct list_set *map = set->data;
  144. list_replace_rcu(&old->list, &e->list);
  145. ip_set_put_byindex(map->net, old->id);
  146. call_rcu(&old->rcu, __list_set_del_rcu);
  147. }
  148. static void
  149. set_cleanup_entries(struct ip_set *set)
  150. {
  151. struct list_set *map = set->data;
  152. struct set_elem *e, *n;
  153. list_for_each_entry_safe(e, n, &map->members, list)
  154. if (ip_set_timeout_expired(ext_timeout(e, set)))
  155. list_set_del(set, e);
  156. }
  157. static int
  158. list_set_utest(struct ip_set *set, void *value, const struct ip_set_ext *ext,
  159. struct ip_set_ext *mext, u32 flags)
  160. {
  161. struct list_set *map = set->data;
  162. struct set_adt_elem *d = value;
  163. struct set_elem *e, *next, *prev = NULL;
  164. int ret;
  165. list_for_each_entry(e, &map->members, list) {
  166. if (SET_WITH_TIMEOUT(set) &&
  167. ip_set_timeout_expired(ext_timeout(e, set)))
  168. continue;
  169. else if (e->id != d->id) {
  170. prev = e;
  171. continue;
  172. }
  173. if (d->before == 0) {
  174. ret = 1;
  175. } else if (d->before > 0) {
  176. next = list_next_entry(e, list);
  177. ret = !list_is_last(&e->list, &map->members) &&
  178. next->id == d->refid;
  179. } else {
  180. ret = prev && prev->id == d->refid;
  181. }
  182. return ret;
  183. }
  184. return 0;
  185. }
  186. static void
  187. list_set_init_extensions(struct ip_set *set, const struct ip_set_ext *ext,
  188. struct set_elem *e)
  189. {
  190. if (SET_WITH_COUNTER(set))
  191. ip_set_init_counter(ext_counter(e, set), ext);
  192. if (SET_WITH_COMMENT(set))
  193. ip_set_init_comment(set, ext_comment(e, set), ext);
  194. if (SET_WITH_SKBINFO(set))
  195. ip_set_init_skbinfo(ext_skbinfo(e, set), ext);
  196. /* Update timeout last */
  197. if (SET_WITH_TIMEOUT(set))
  198. ip_set_timeout_set(ext_timeout(e, set), ext->timeout);
  199. }
  200. static int
  201. list_set_uadd(struct ip_set *set, void *value, const struct ip_set_ext *ext,
  202. struct ip_set_ext *mext, u32 flags)
  203. {
  204. struct list_set *map = set->data;
  205. struct set_adt_elem *d = value;
  206. struct set_elem *e, *n, *prev, *next;
  207. bool flag_exist = flags & IPSET_FLAG_EXIST;
  208. /* Find where to add the new entry */
  209. n = prev = next = NULL;
  210. list_for_each_entry(e, &map->members, list) {
  211. if (SET_WITH_TIMEOUT(set) &&
  212. ip_set_timeout_expired(ext_timeout(e, set)))
  213. continue;
  214. else if (d->id == e->id)
  215. n = e;
  216. else if (d->before == 0 || e->id != d->refid)
  217. continue;
  218. else if (d->before > 0)
  219. next = e;
  220. else
  221. prev = e;
  222. }
  223. /* If before/after is used on an empty set */
  224. if ((d->before > 0 && !next) ||
  225. (d->before < 0 && !prev))
  226. return -IPSET_ERR_REF_EXIST;
  227. /* Re-add already existing element */
  228. if (n) {
  229. if (!flag_exist)
  230. return -IPSET_ERR_EXIST;
  231. /* Update extensions */
  232. ip_set_ext_destroy(set, n);
  233. list_set_init_extensions(set, ext, n);
  234. /* Set is already added to the list */
  235. ip_set_put_byindex(map->net, d->id);
  236. return 0;
  237. }
  238. /* Add new entry */
  239. if (d->before == 0) {
  240. /* Append */
  241. n = list_empty(&map->members) ? NULL :
  242. list_last_entry(&map->members, struct set_elem, list);
  243. } else if (d->before > 0) {
  244. /* Insert after next element */
  245. if (!list_is_last(&next->list, &map->members))
  246. n = list_next_entry(next, list);
  247. } else {
  248. /* Insert before prev element */
  249. if (prev->list.prev != &map->members)
  250. n = list_prev_entry(prev, list);
  251. }
  252. /* Can we replace a timed out entry? */
  253. if (n &&
  254. !(SET_WITH_TIMEOUT(set) &&
  255. ip_set_timeout_expired(ext_timeout(n, set))))
  256. n = NULL;
  257. e = kzalloc(set->dsize, GFP_ATOMIC);
  258. if (!e)
  259. return -ENOMEM;
  260. e->id = d->id;
  261. e->set = set;
  262. INIT_LIST_HEAD(&e->list);
  263. list_set_init_extensions(set, ext, e);
  264. if (n)
  265. list_set_replace(set, e, n);
  266. else if (next)
  267. list_add_tail_rcu(&e->list, &next->list);
  268. else if (prev)
  269. list_add_rcu(&e->list, &prev->list);
  270. else
  271. list_add_tail_rcu(&e->list, &map->members);
  272. set->elements++;
  273. return 0;
  274. }
  275. static int
  276. list_set_udel(struct ip_set *set, void *value, const struct ip_set_ext *ext,
  277. struct ip_set_ext *mext, u32 flags)
  278. {
  279. struct list_set *map = set->data;
  280. struct set_adt_elem *d = value;
  281. struct set_elem *e, *next, *prev = NULL;
  282. list_for_each_entry(e, &map->members, list) {
  283. if (SET_WITH_TIMEOUT(set) &&
  284. ip_set_timeout_expired(ext_timeout(e, set)))
  285. continue;
  286. else if (e->id != d->id) {
  287. prev = e;
  288. continue;
  289. }
  290. if (d->before > 0) {
  291. next = list_next_entry(e, list);
  292. if (list_is_last(&e->list, &map->members) ||
  293. next->id != d->refid)
  294. return -IPSET_ERR_REF_EXIST;
  295. } else if (d->before < 0) {
  296. if (!prev || prev->id != d->refid)
  297. return -IPSET_ERR_REF_EXIST;
  298. }
  299. list_set_del(set, e);
  300. return 0;
  301. }
  302. return d->before != 0 ? -IPSET_ERR_REF_EXIST : -IPSET_ERR_EXIST;
  303. }
  304. static int
  305. list_set_uadt(struct ip_set *set, struct nlattr *tb[],
  306. enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
  307. {
  308. struct list_set *map = set->data;
  309. ipset_adtfn adtfn = set->variant->adt[adt];
  310. struct set_adt_elem e = { .refid = IPSET_INVALID_ID };
  311. struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
  312. struct ip_set *s;
  313. int ret = 0;
  314. if (tb[IPSET_ATTR_LINENO])
  315. *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
  316. if (unlikely(!tb[IPSET_ATTR_NAME] ||
  317. !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
  318. return -IPSET_ERR_PROTOCOL;
  319. ret = ip_set_get_extensions(set, tb, &ext);
  320. if (ret)
  321. return ret;
  322. e.id = ip_set_get_byname(map->net, nla_data(tb[IPSET_ATTR_NAME]), &s);
  323. if (e.id == IPSET_INVALID_ID)
  324. return -IPSET_ERR_NAME;
  325. /* "Loop detection" */
  326. if (s->type->features & IPSET_TYPE_NAME) {
  327. ret = -IPSET_ERR_LOOP;
  328. goto finish;
  329. }
  330. if (tb[IPSET_ATTR_CADT_FLAGS]) {
  331. u32 f = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
  332. e.before = f & IPSET_FLAG_BEFORE;
  333. }
  334. if (e.before && !tb[IPSET_ATTR_NAMEREF]) {
  335. ret = -IPSET_ERR_BEFORE;
  336. goto finish;
  337. }
  338. if (tb[IPSET_ATTR_NAMEREF]) {
  339. e.refid = ip_set_get_byname(map->net,
  340. nla_data(tb[IPSET_ATTR_NAMEREF]),
  341. &s);
  342. if (e.refid == IPSET_INVALID_ID) {
  343. ret = -IPSET_ERR_NAMEREF;
  344. goto finish;
  345. }
  346. if (!e.before)
  347. e.before = -1;
  348. }
  349. if (adt != IPSET_TEST && SET_WITH_TIMEOUT(set))
  350. set_cleanup_entries(set);
  351. ret = adtfn(set, &e, &ext, &ext, flags);
  352. finish:
  353. if (e.refid != IPSET_INVALID_ID)
  354. ip_set_put_byindex(map->net, e.refid);
  355. if (adt != IPSET_ADD || ret)
  356. ip_set_put_byindex(map->net, e.id);
  357. return ip_set_eexist(ret, flags) ? 0 : ret;
  358. }
  359. static void
  360. list_set_flush(struct ip_set *set)
  361. {
  362. struct list_set *map = set->data;
  363. struct set_elem *e, *n;
  364. list_for_each_entry_safe(e, n, &map->members, list)
  365. list_set_del(set, e);
  366. set->elements = 0;
  367. set->ext_size = 0;
  368. }
  369. static void
  370. list_set_destroy(struct ip_set *set)
  371. {
  372. struct list_set *map = set->data;
  373. struct set_elem *e, *n;
  374. if (SET_WITH_TIMEOUT(set))
  375. del_timer_sync(&map->gc);
  376. list_for_each_entry_safe(e, n, &map->members, list) {
  377. list_del(&e->list);
  378. ip_set_put_byindex(map->net, e->id);
  379. ip_set_ext_destroy(set, e);
  380. kfree(e);
  381. }
  382. kfree(map);
  383. set->data = NULL;
  384. }
  385. /* Calculate the actual memory size of the set data */
  386. static size_t
  387. list_set_memsize(const struct list_set *map, size_t dsize)
  388. {
  389. struct set_elem *e;
  390. u32 n = 0;
  391. rcu_read_lock();
  392. list_for_each_entry_rcu(e, &map->members, list)
  393. n++;
  394. rcu_read_unlock();
  395. return (sizeof(*map) + n * dsize);
  396. }
  397. static int
  398. list_set_head(struct ip_set *set, struct sk_buff *skb)
  399. {
  400. const struct list_set *map = set->data;
  401. struct nlattr *nested;
  402. size_t memsize = list_set_memsize(map, set->dsize) + set->ext_size;
  403. nested = nla_nest_start(skb, IPSET_ATTR_DATA);
  404. if (!nested)
  405. goto nla_put_failure;
  406. if (nla_put_net32(skb, IPSET_ATTR_SIZE, htonl(map->size)) ||
  407. nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref)) ||
  408. nla_put_net32(skb, IPSET_ATTR_MEMSIZE, htonl(memsize)) ||
  409. nla_put_net32(skb, IPSET_ATTR_ELEMENTS, htonl(set->elements)))
  410. goto nla_put_failure;
  411. if (unlikely(ip_set_put_flags(skb, set)))
  412. goto nla_put_failure;
  413. nla_nest_end(skb, nested);
  414. return 0;
  415. nla_put_failure:
  416. return -EMSGSIZE;
  417. }
  418. static int
  419. list_set_list(const struct ip_set *set,
  420. struct sk_buff *skb, struct netlink_callback *cb)
  421. {
  422. const struct list_set *map = set->data;
  423. struct nlattr *atd, *nested;
  424. u32 i = 0, first = cb->args[IPSET_CB_ARG0];
  425. char name[IPSET_MAXNAMELEN];
  426. struct set_elem *e;
  427. int ret = 0;
  428. atd = nla_nest_start(skb, IPSET_ATTR_ADT);
  429. if (!atd)
  430. return -EMSGSIZE;
  431. rcu_read_lock();
  432. list_for_each_entry_rcu(e, &map->members, list) {
  433. if (i < first ||
  434. (SET_WITH_TIMEOUT(set) &&
  435. ip_set_timeout_expired(ext_timeout(e, set)))) {
  436. i++;
  437. continue;
  438. }
  439. nested = nla_nest_start(skb, IPSET_ATTR_DATA);
  440. if (!nested)
  441. goto nla_put_failure;
  442. ip_set_name_byindex(map->net, e->id, name);
  443. if (nla_put_string(skb, IPSET_ATTR_NAME, name))
  444. goto nla_put_failure;
  445. if (ip_set_put_extensions(skb, set, e, true))
  446. goto nla_put_failure;
  447. nla_nest_end(skb, nested);
  448. i++;
  449. }
  450. nla_nest_end(skb, atd);
  451. /* Set listing finished */
  452. cb->args[IPSET_CB_ARG0] = 0;
  453. goto out;
  454. nla_put_failure:
  455. nla_nest_cancel(skb, nested);
  456. if (unlikely(i == first)) {
  457. nla_nest_cancel(skb, atd);
  458. cb->args[IPSET_CB_ARG0] = 0;
  459. ret = -EMSGSIZE;
  460. } else {
  461. cb->args[IPSET_CB_ARG0] = i;
  462. nla_nest_end(skb, atd);
  463. }
  464. out:
  465. rcu_read_unlock();
  466. return ret;
  467. }
  468. static bool
  469. list_set_same_set(const struct ip_set *a, const struct ip_set *b)
  470. {
  471. const struct list_set *x = a->data;
  472. const struct list_set *y = b->data;
  473. return x->size == y->size &&
  474. a->timeout == b->timeout &&
  475. a->extensions == b->extensions;
  476. }
  477. static const struct ip_set_type_variant set_variant = {
  478. .kadt = list_set_kadt,
  479. .uadt = list_set_uadt,
  480. .adt = {
  481. [IPSET_ADD] = list_set_uadd,
  482. [IPSET_DEL] = list_set_udel,
  483. [IPSET_TEST] = list_set_utest,
  484. },
  485. .destroy = list_set_destroy,
  486. .flush = list_set_flush,
  487. .head = list_set_head,
  488. .list = list_set_list,
  489. .same_set = list_set_same_set,
  490. };
  491. static void
  492. list_set_gc(struct timer_list *t)
  493. {
  494. struct list_set *map = from_timer(map, t, gc);
  495. struct ip_set *set = map->set;
  496. spin_lock_bh(&set->lock);
  497. set_cleanup_entries(set);
  498. spin_unlock_bh(&set->lock);
  499. map->gc.expires = jiffies + IPSET_GC_PERIOD(set->timeout) * HZ;
  500. add_timer(&map->gc);
  501. }
  502. static void
  503. list_set_gc_init(struct ip_set *set, void (*gc)(struct timer_list *t))
  504. {
  505. struct list_set *map = set->data;
  506. timer_setup(&map->gc, gc, 0);
  507. mod_timer(&map->gc, jiffies + IPSET_GC_PERIOD(set->timeout) * HZ);
  508. }
  509. /* Create list:set type of sets */
  510. static bool
  511. init_list_set(struct net *net, struct ip_set *set, u32 size)
  512. {
  513. struct list_set *map;
  514. map = kzalloc(sizeof(*map), GFP_KERNEL);
  515. if (!map)
  516. return false;
  517. map->size = size;
  518. map->net = net;
  519. map->set = set;
  520. INIT_LIST_HEAD(&map->members);
  521. set->data = map;
  522. return true;
  523. }
  524. static int
  525. list_set_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
  526. u32 flags)
  527. {
  528. u32 size = IP_SET_LIST_DEFAULT_SIZE;
  529. if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_SIZE) ||
  530. !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
  531. !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
  532. return -IPSET_ERR_PROTOCOL;
  533. if (tb[IPSET_ATTR_SIZE])
  534. size = ip_set_get_h32(tb[IPSET_ATTR_SIZE]);
  535. if (size < IP_SET_LIST_MIN_SIZE)
  536. size = IP_SET_LIST_MIN_SIZE;
  537. set->variant = &set_variant;
  538. set->dsize = ip_set_elem_len(set, tb, sizeof(struct set_elem),
  539. __alignof__(struct set_elem));
  540. if (!init_list_set(net, set, size))
  541. return -ENOMEM;
  542. if (tb[IPSET_ATTR_TIMEOUT]) {
  543. set->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
  544. list_set_gc_init(set, list_set_gc);
  545. }
  546. return 0;
  547. }
  548. static struct ip_set_type list_set_type __read_mostly = {
  549. .name = "list:set",
  550. .protocol = IPSET_PROTOCOL,
  551. .features = IPSET_TYPE_NAME | IPSET_DUMP_LAST,
  552. .dimension = IPSET_DIM_ONE,
  553. .family = NFPROTO_UNSPEC,
  554. .revision_min = IPSET_TYPE_REV_MIN,
  555. .revision_max = IPSET_TYPE_REV_MAX,
  556. .create = list_set_create,
  557. .create_policy = {
  558. [IPSET_ATTR_SIZE] = { .type = NLA_U32 },
  559. [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
  560. [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
  561. },
  562. .adt_policy = {
  563. [IPSET_ATTR_NAME] = { .type = NLA_STRING,
  564. .len = IPSET_MAXNAMELEN },
  565. [IPSET_ATTR_NAMEREF] = { .type = NLA_STRING,
  566. .len = IPSET_MAXNAMELEN },
  567. [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
  568. [IPSET_ATTR_LINENO] = { .type = NLA_U32 },
  569. [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
  570. [IPSET_ATTR_BYTES] = { .type = NLA_U64 },
  571. [IPSET_ATTR_PACKETS] = { .type = NLA_U64 },
  572. [IPSET_ATTR_COMMENT] = { .type = NLA_NUL_STRING,
  573. .len = IPSET_MAX_COMMENT_SIZE },
  574. [IPSET_ATTR_SKBMARK] = { .type = NLA_U64 },
  575. [IPSET_ATTR_SKBPRIO] = { .type = NLA_U32 },
  576. [IPSET_ATTR_SKBQUEUE] = { .type = NLA_U16 },
  577. },
  578. .me = THIS_MODULE,
  579. };
  580. static int __init
  581. list_set_init(void)
  582. {
  583. return ip_set_type_register(&list_set_type);
  584. }
  585. static void __exit
  586. list_set_fini(void)
  587. {
  588. rcu_barrier();
  589. ip_set_type_unregister(&list_set_type);
  590. }
  591. module_init(list_set_init);
  592. module_exit(list_set_fini);