net/netfilter/ipset/ip_set_bitmap_ipmac.c

   1 /* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
   2  *                         Patrick Schaaf <bof@bof.de>
   3  *                         Martin Josefsson <gandalf@wlug.westbo.se>
   4  * Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  */
  10
  11 /* Kernel module implementing an IP set type: the bitmap:ip,mac type */
  12
  13 #include <linux/module.h>
  14 #include <linux/ip.h>
  15 #include <linux/etherdevice.h>
  16 #include <linux/skbuff.h>
  17 #include <linux/errno.h>
  18 #include <linux/if_ether.h>
  19 #include <linux/netlink.h>
  20 #include <linux/jiffies.h>
  21 #include <linux/timer.h>
  22 #include <net/netlink.h>
  23
  24 #include <linux/netfilter/ipset/pfxlen.h>
  25 #include <linux/netfilter/ipset/ip_set.h>
  26 #include <linux/netfilter/ipset/ip_set_timeout.h>
  27 #include <linux/netfilter/ipset/ip_set_bitmap.h>
  28
  29 MODULE_LICENSE("GPL");
  30 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
  31 MODULE_DESCRIPTION("bitmap:ip,mac type of IP sets");
  32 MODULE_ALIAS("ip_set_bitmap:ip,mac");
  33
  34 enum {
  35         MAC_EMPTY,              /* element is not set */
  36         MAC_FILLED,             /* element is set with MAC */
  37         MAC_UNSET,              /* element is set, without MAC */
  38 };
  39
  40 /* Type structure */
  41 struct bitmap_ipmac {
  42         void *members;          /* the set members */
  43         u32 first_ip;           /* host byte order, included in range */
  44         u32 last_ip;            /* host byte order, included in range */
  45         u32 timeout;            /* timeout value */
  46         struct timer_list gc;   /* garbage collector */
  47         size_t dsize;           /* size of element */
  48 };
  49
  50 /* ADT structure for generic function args */
  51 struct ipmac {
  52         u32 id;                 /* id in array */
  53         unsigned char *ether;   /* ethernet address */
  54 };
  55
  56 /* Member element without and with timeout */
  57
  58 struct ipmac_elem {
  59         unsigned char ether[ETH_ALEN];
  60         unsigned char match;
  61 } __attribute__ ((aligned));
  62
  63 struct ipmac_telem {
  64         unsigned char ether[ETH_ALEN];
  65         unsigned char match;
  66         unsigned long timeout;
  67 } __attribute__ ((aligned));
  68
  69 static inline void *
  70 bitmap_ipmac_elem(const struct bitmap_ipmac *map, u32 id)
  71 {
  72         return (void *)((char *)map->members + id * map->dsize);
  73 }
  74
  75 static inline bool
  76 bitmap_timeout(const struct bitmap_ipmac *map, u32 id)
  77 {
  78         const struct ipmac_telem *elem = bitmap_ipmac_elem(map, id);
  79
  80         return ip_set_timeout_test(elem->timeout);
  81 }
  82
  83 static inline bool
  84 bitmap_expired(const struct bitmap_ipmac *map, u32 id)
  85 {
  86         const struct ipmac_telem *elem = bitmap_ipmac_elem(map, id);
  87
  88         return ip_set_timeout_expired(elem->timeout);
  89 }
  90
  91 static inline int
  92 bitmap_ipmac_exist(const struct ipmac_telem *elem)
  93 {
  94         return elem->match == MAC_UNSET ||
  95                (elem->match == MAC_FILLED &&
  96                 !ip_set_timeout_expired(elem->timeout));
  97 }
  98
  99 /* Base variant */
 100
 101 static int
 102 bitmap_ipmac_test(struct ip_set *set, void *value, u32 timeout, u32 flags)
 103 {
 104         const struct bitmap_ipmac *map = set->data;
 105         const struct ipmac *data = value;
 106         const struct ipmac_elem *elem = bitmap_ipmac_elem(map, data->id);
 107
 108         switch (elem->match) {
 109         case MAC_UNSET:
 110                 /* Trigger kernel to fill out the ethernet address */
 111                 return -EAGAIN;
 112         case MAC_FILLED:
 113                 return data->ether == NULL ||
 114                        compare_ether_addr(data->ether, elem->ether) == 0;
 115         }
 116         return 0;
 117 }
 118
 119 static int
 120 bitmap_ipmac_add(struct ip_set *set, void *value, u32 timeout, u32 flags)
 121 {
 122         struct bitmap_ipmac *map = set->data;
 123         const struct ipmac *data = value;
 124         struct ipmac_elem *elem = bitmap_ipmac_elem(map, data->id);
 125
 126         switch (elem->match) {
 127         case MAC_UNSET:
 128                 if (!data->ether)
 129                         /* Already added without ethernet address */
 130                         return -IPSET_ERR_EXIST;
 131                 /* Fill the MAC address */
 132                 memcpy(elem->ether, data->ether, ETH_ALEN);
 133                 elem->match = MAC_FILLED;
 134                 break;
 135         case MAC_FILLED:
 136                 return -IPSET_ERR_EXIST;
 137         case MAC_EMPTY:
 138                 if (data->ether) {
 139                         memcpy(elem->ether, data->ether, ETH_ALEN);
 140                         elem->match = MAC_FILLED;
 141                 } else
 142                         elem->match = MAC_UNSET;
 143         }
 144
 145         return 0;
 146 }
 147
 148 static int
 149 bitmap_ipmac_del(struct ip_set *set, void *value, u32 timeout, u32 flags)
 150 {
 151         struct bitmap_ipmac *map = set->data;
 152         const struct ipmac *data = value;
 153         struct ipmac_elem *elem = bitmap_ipmac_elem(map, data->id);
 154
 155         if (elem->match == MAC_EMPTY)
 156                 return -IPSET_ERR_EXIST;
 157
 158         elem->match = MAC_EMPTY;
 159
 160         return 0;
 161 }
 162
 163 static int
 164 bitmap_ipmac_list(const struct ip_set *set,
 165                   struct sk_buff *skb, struct netlink_callback *cb)
 166 {
 167         const struct bitmap_ipmac *map = set->data;
 168         const struct ipmac_elem *elem;
 169         struct nlattr *atd, *nested;
 170         u32 id, first = cb->args[2];
 171         u32 last = map->last_ip - map->first_ip;
 172
 173         atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
 174         if (!atd)
 175                 return -EMSGSIZE;
 176         for (; cb->args[2] <= last; cb->args[2]++) {
 177                 id = cb->args[2];
 178                 elem = bitmap_ipmac_elem(map, id);
 179                 if (elem->match == MAC_EMPTY)
 180                         continue;
 181                 nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
 182                 if (!nested) {
 183                         if (id == first) {
 184                                 nla_nest_cancel(skb, atd);
 185                                 return -EMSGSIZE;
 186                         } else
 187                                 goto nla_put_failure;
 188                 }
 189                 NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP,
 190                                 htonl(map->first_ip + id));
 191                 if (elem->match == MAC_FILLED)
 192                         NLA_PUT(skb, IPSET_ATTR_ETHER, ETH_ALEN,
 193                                 elem->ether);
 194                 ipset_nest_end(skb, nested);
 195         }
 196         ipset_nest_end(skb, atd);
 197         /* Set listing finished */
 198         cb->args[2] = 0;
 199
 200         return 0;
 201
 202 nla_put_failure:
 203         nla_nest_cancel(skb, nested);
 204         ipset_nest_end(skb, atd);
 205         if (unlikely(id == first)) {
 206                 cb->args[2] = 0;
 207                 return -EMSGSIZE;
 208         }
 209         return 0;
 210 }
 211
 212 /* Timeout variant */
 213
 214 static int
 215 bitmap_ipmac_ttest(struct ip_set *set, void *value, u32 timeout, u32 flags)
 216 {
 217         const struct bitmap_ipmac *map = set->data;
 218         const struct ipmac *data = value;
 219         const struct ipmac_elem *elem = bitmap_ipmac_elem(map, data->id);
 220
 221         switch (elem->match) {
 222         case MAC_UNSET:
 223                 /* Trigger kernel to fill out the ethernet address */
 224                 return -EAGAIN;
 225         case MAC_FILLED:
 226                 return (data->ether == NULL ||
 227                         compare_ether_addr(data->ether, elem->ether) == 0) &&
 228                        !bitmap_expired(map, data->id);
 229         }
 230         return 0;
 231 }
 232
 233 static int
 234 bitmap_ipmac_tadd(struct ip_set *set, void *value, u32 timeout, u32 flags)
 235 {
 236         struct bitmap_ipmac *map = set->data;
 237         const struct ipmac *data = value;
 238         struct ipmac_telem *elem = bitmap_ipmac_elem(map, data->id);
 239         bool flag_exist = flags & IPSET_FLAG_EXIST;
 240
 241         switch (elem->match) {
 242         case MAC_UNSET:
 243                 if (!(data->ether || flag_exist))
 244                         /* Already added without ethernet address */
 245                         return -IPSET_ERR_EXIST;
 246                 /* Fill the MAC address and activate the timer */
 247                 memcpy(elem->ether, data->ether, ETH_ALEN);
 248                 elem->match = MAC_FILLED;
 249                 if (timeout == map->timeout)
 250                         /* Timeout was not specified, get stored one */
 251                         timeout = elem->timeout;
 252                 elem->timeout = ip_set_timeout_set(timeout);
 253                 break;
 254         case MAC_FILLED:
 255                 if (!(bitmap_expired(map, data->id) || flag_exist))
 256                         return -IPSET_ERR_EXIST;
 257                 /* Fall through */
 258         case MAC_EMPTY:
 259                 if (data->ether) {
 260                         memcpy(elem->ether, data->ether, ETH_ALEN);
 261                         elem->match = MAC_FILLED;
 262                 } else
 263                         elem->match = MAC_UNSET;
 264                 /* If MAC is unset yet, we store plain timeout value
 265                  * because the timer is not activated yet
 266                  * and we can reuse it later when MAC is filled out,
 267                  * possibly by the kernel */
 268                 elem->timeout = data->ether ? ip_set_timeout_set(timeout)
 269                                             : timeout;
 270                 break;
 271         }
 272
 273         return 0;
 274 }
 275
 276 static int
 277 bitmap_ipmac_tdel(struct ip_set *set, void *value, u32 timeout, u32 flags)
 278 {
 279         struct bitmap_ipmac *map = set->data;
 280         const struct ipmac *data = value;
 281         struct ipmac_telem *elem = bitmap_ipmac_elem(map, data->id);
 282
 283         if (elem->match == MAC_EMPTY || bitmap_expired(map, data->id))
 284                 return -IPSET_ERR_EXIST;
 285
 286         elem->match = MAC_EMPTY;
 287
 288         return 0;
 289 }
 290
 291 static int
 292 bitmap_ipmac_tlist(const struct ip_set *set,
 293                    struct sk_buff *skb, struct netlink_callback *cb)
 294 {
 295         const struct bitmap_ipmac *map = set->data;
 296         const struct ipmac_telem *elem;
 297         struct nlattr *atd, *nested;
 298         u32 id, first = cb->args[2];
 299         u32 timeout, last = map->last_ip - map->first_ip;
 300
 301         atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
 302         if (!atd)
 303                 return -EMSGSIZE;
 304         for (; cb->args[2] <= last; cb->args[2]++) {
 305                 id = cb->args[2];
 306                 elem = bitmap_ipmac_elem(map, id);
 307                 if (!bitmap_ipmac_exist(elem))
 308                         continue;
 309                 nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
 310                 if (!nested) {
 311                         if (id == first) {
 312                                 nla_nest_cancel(skb, atd);
 313                                 return -EMSGSIZE;
 314                         } else
 315                                 goto nla_put_failure;
 316                 }
 317                 NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP,
 318                                 htonl(map->first_ip + id));
 319                 if (elem->match == MAC_FILLED)
 320                         NLA_PUT(skb, IPSET_ATTR_ETHER, ETH_ALEN,
 321                                 elem->ether);
 322                 timeout = elem->match == MAC_UNSET ? elem->timeout
 323                                 : ip_set_timeout_get(elem->timeout);
 324                 NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(timeout));
 325                 ipset_nest_end(skb, nested);
 326         }
 327         ipset_nest_end(skb, atd);
 328         /* Set listing finished */
 329         cb->args[2] = 0;
 330
 331         return 0;
 332
 333 nla_put_failure:
 334         nla_nest_cancel(skb, nested);
 335         ipset_nest_end(skb, atd);
 336         return -EMSGSIZE;
 337 }
 338
 339 static int
 340 bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
 341                   enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 342 {
 343         struct bitmap_ipmac *map = set->data;
 344         ipset_adtfn adtfn = set->variant->adt[adt];
 345         struct ipmac data;
 346
 347         /* MAC can be src only */
 348         if (!(opt->flags & IPSET_DIM_TWO_SRC))
 349                 return 0;
 350
 351         data.id = ntohl(ip4addr(skb, opt->flags & IPSET_DIM_ONE_SRC));
 352         if (data.id < map->first_ip || data.id > map->last_ip)
 353                 return -IPSET_ERR_BITMAP_RANGE;
 354
 355         /* Backward compatibility: we don't check the second flag */
 356         if (skb_mac_header(skb) < skb->head ||
 357             (skb_mac_header(skb) + ETH_HLEN) > skb->data)
 358                 return -EINVAL;
 359
 360         data.id -= map->first_ip;
 361         data.ether = eth_hdr(skb)->h_source;
 362
 363         return adtfn(set, &data, opt_timeout(opt, map), opt->cmdflags);
 364 }
 365
 366 static int
 367 bitmap_ipmac_uadt(struct ip_set *set, struct nlattr *tb[],
 368                   enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 369 {
 370         const struct bitmap_ipmac *map = set->data;
 371         ipset_adtfn adtfn = set->variant->adt[adt];
 372         struct ipmac data;
 373         u32 timeout = map->timeout;
 374         int ret = 0;
 375
 376         if (unlikely(!tb[IPSET_ATTR_IP] ||
 377                      !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 378                 return -IPSET_ERR_PROTOCOL;
 379
 380         if (tb[IPSET_ATTR_LINENO])
 381                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
 382
 383         ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &data.id);
 384         if (ret)
 385                 return ret;
 386
 387         if (data.id < map->first_ip || data.id > map->last_ip)
 388                 return -IPSET_ERR_BITMAP_RANGE;
 389
 390         if (tb[IPSET_ATTR_ETHER])
 391                 data.ether = nla_data(tb[IPSET_ATTR_ETHER]);
 392         else
 393                 data.ether = NULL;
 394
 395         if (tb[IPSET_ATTR_TIMEOUT]) {
 396                 if (!with_timeout(map->timeout))
 397                         return -IPSET_ERR_TIMEOUT;
 398                 timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 399         }
 400
 401         data.id -= map->first_ip;
 402
 403         ret = adtfn(set, &data, timeout, flags);
 404
 405         return ip_set_eexist(ret, flags) ? 0 : ret;
 406 }
 407
 408 static void
 409 bitmap_ipmac_destroy(struct ip_set *set)
 410 {
 411         struct bitmap_ipmac *map = set->data;
 412
 413         if (with_timeout(map->timeout))
 414                 del_timer_sync(&map->gc);
 415
 416         ip_set_free(map->members);
 417         kfree(map);
 418
 419         set->data = NULL;
 420 }
 421
 422 static void
 423 bitmap_ipmac_flush(struct ip_set *set)
 424 {
 425         struct bitmap_ipmac *map = set->data;
 426
 427         memset(map->members, 0,
 428                (map->last_ip - map->first_ip + 1) * map->dsize);
 429 }
 430
 431 static int
 432 bitmap_ipmac_head(struct ip_set *set, struct sk_buff *skb)
 433 {
 434         const struct bitmap_ipmac *map = set->data;
 435         struct nlattr *nested;
 436
 437         nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
 438         if (!nested)
 439                 goto nla_put_failure;
 440         NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, htonl(map->first_ip));
 441         NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
 442         NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
 443         NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
 444                       htonl(sizeof(*map)
 445                             + (map->last_ip - map->first_ip + 1) * map->dsize));
 446         if (with_timeout(map->timeout))
 447                 NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout));
 448         ipset_nest_end(skb, nested);
 449
 450         return 0;
 451 nla_put_failure:
 452         return -EMSGSIZE;
 453 }
 454
 455 static bool
 456 bitmap_ipmac_same_set(const struct ip_set *a, const struct ip_set *b)
 457 {
 458         const struct bitmap_ipmac *x = a->data;
 459         const struct bitmap_ipmac *y = b->data;
 460
 461         return x->first_ip == y->first_ip &&
 462                x->last_ip == y->last_ip &&
 463                x->timeout == y->timeout;
 464 }
 465
 466 static const struct ip_set_type_variant bitmap_ipmac = {
 467         .kadt   = bitmap_ipmac_kadt,
 468         .uadt   = bitmap_ipmac_uadt,
 469         .adt    = {
 470                 [IPSET_ADD] = bitmap_ipmac_add,
 471                 [IPSET_DEL] = bitmap_ipmac_del,
 472                 [IPSET_TEST] = bitmap_ipmac_test,
 473         },
 474         .destroy = bitmap_ipmac_destroy,
 475         .flush  = bitmap_ipmac_flush,
 476         .head   = bitmap_ipmac_head,
 477         .list   = bitmap_ipmac_list,
 478         .same_set = bitmap_ipmac_same_set,
 479 };
 480
 481 static const struct ip_set_type_variant bitmap_tipmac = {
 482         .kadt   = bitmap_ipmac_kadt,
 483         .uadt   = bitmap_ipmac_uadt,
 484         .adt    = {
 485                 [IPSET_ADD] = bitmap_ipmac_tadd,
 486                 [IPSET_DEL] = bitmap_ipmac_tdel,
 487                 [IPSET_TEST] = bitmap_ipmac_ttest,
 488         },
 489         .destroy = bitmap_ipmac_destroy,
 490         .flush  = bitmap_ipmac_flush,
 491         .head   = bitmap_ipmac_head,
 492         .list   = bitmap_ipmac_tlist,
 493         .same_set = bitmap_ipmac_same_set,
 494 };
 495
 496 static void
 497 bitmap_ipmac_gc(unsigned long ul_set)
 498 {
 499         struct ip_set *set = (struct ip_set *) ul_set;
 500         struct bitmap_ipmac *map = set->data;
 501         struct ipmac_telem *elem;
 502         u32 id, last = map->last_ip - map->first_ip;
 503
 504         /* We run parallel with other readers (test element)
 505          * but adding/deleting new entries is locked out */
 506         read_lock_bh(&set->lock);
 507         for (id = 0; id <= last; id++) {
 508                 elem = bitmap_ipmac_elem(map, id);
 509                 if (elem->match == MAC_FILLED &&
 510                     ip_set_timeout_expired(elem->timeout))
 511                         elem->match = MAC_EMPTY;
 512         }
 513         read_unlock_bh(&set->lock);
 514
 515         map->gc.expires = jiffies + IPSET_GC_PERIOD(map->timeout) * HZ;
 516         add_timer(&map->gc);
 517 }
 518
 519 static void
 520 bitmap_ipmac_gc_init(struct ip_set *set)
 521 {
 522         struct bitmap_ipmac *map = set->data;
 523
 524         init_timer(&map->gc);
 525         map->gc.data = (unsigned long) set;
 526         map->gc.function = bitmap_ipmac_gc;
 527         map->gc.expires = jiffies + IPSET_GC_PERIOD(map->timeout) * HZ;
 528         add_timer(&map->gc);
 529 }
 530
 531 /* Create bitmap:ip,mac type of sets */
 532
 533 static bool
 534 init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,
 535                u32 first_ip, u32 last_ip)
 536 {
 537         map->members = ip_set_alloc((last_ip - first_ip + 1) * map->dsize);
 538         if (!map->members)
 539                 return false;
 540         map->first_ip = first_ip;
 541         map->last_ip = last_ip;
 542         map->timeout = IPSET_NO_TIMEOUT;
 543
 544         set->data = map;
 545         set->family = AF_INET;
 546
 547         return true;
 548 }
 549
 550 static int
 551 bitmap_ipmac_create(struct ip_set *set, struct nlattr *tb[],
 552                     u32 flags)
 553 {
 554         u32 first_ip, last_ip, elements;
 555         struct bitmap_ipmac *map;
 556         int ret;
 557
 558         if (unlikely(!tb[IPSET_ATTR_IP] ||
 559                      !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 560                 return -IPSET_ERR_PROTOCOL;
 561
 562         ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &first_ip);
 563         if (ret)
 564                 return ret;
 565
 566         if (tb[IPSET_ATTR_IP_TO]) {
 567                 ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &last_ip);
 568                 if (ret)
 569                         return ret;
 570                 if (first_ip > last_ip) {
 571                         u32 tmp = first_ip;
 572
 573                         first_ip = last_ip;
 574                         last_ip = tmp;
 575                 }
 576         } else if (tb[IPSET_ATTR_CIDR]) {
 577                 u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
 578
 579                 if (cidr >= 32)
 580                         return -IPSET_ERR_INVALID_CIDR;
 581                 last_ip = first_ip | ~ip_set_hostmask(cidr);
 582         } else
 583                 return -IPSET_ERR_PROTOCOL;
 584
 585         elements = last_ip - first_ip + 1;
 586
 587         if (elements > IPSET_BITMAP_MAX_RANGE + 1)
 588                 return -IPSET_ERR_BITMAP_RANGE_SIZE;
 589
 590         map = kzalloc(sizeof(*map), GFP_KERNEL);
 591         if (!map)
 592                 return -ENOMEM;
 593
 594         if (tb[IPSET_ATTR_TIMEOUT]) {
 595                 map->dsize = sizeof(struct ipmac_telem);
 596
 597                 if (!init_map_ipmac(set, map, first_ip, last_ip)) {
 598                         kfree(map);
 599                         return -ENOMEM;
 600                 }
 601
 602                 map->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 603
 604                 set->variant = &bitmap_tipmac;
 605
 606                 bitmap_ipmac_gc_init(set);
 607         } else {
 608                 map->dsize = sizeof(struct ipmac_elem);
 609
 610                 if (!init_map_ipmac(set, map, first_ip, last_ip)) {
 611                         kfree(map);
 612                         return -ENOMEM;
 613                 }
 614                 set->variant = &bitmap_ipmac;
 615
 616         }
 617         return 0;
 618 }
 619
 620 static struct ip_set_type bitmap_ipmac_type = {
 621         .name           = "bitmap:ip,mac",
 622         .protocol       = IPSET_PROTOCOL,
 623         .features       = IPSET_TYPE_IP | IPSET_TYPE_MAC,
 624         .dimension      = IPSET_DIM_TWO,
 625         .family         = AF_INET,
 626         .revision_min   = 0,
 627         .revision_max   = 0,
 628         .create         = bitmap_ipmac_create,
 629         .create_policy  = {
 630                 [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
 631                 [IPSET_ATTR_IP_TO]      = { .type = NLA_NESTED },
 632                 [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
 633                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
 634         },
 635         .adt_policy     = {
 636                 [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
 637                 [IPSET_ATTR_ETHER]      = { .type = NLA_BINARY, .len  = ETH_ALEN },
 638                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
 639                 [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
 640         },
 641         .me             = THIS_MODULE,
 642 };
 643
 644 static int __init
 645 bitmap_ipmac_init(void)
 646 {
 647         return ip_set_type_register(&bitmap_ipmac_type);
 648 }
 649
 650 static void __exit
 651 bitmap_ipmac_fini(void)
 652 {
 653         ip_set_type_unregister(&bitmap_ipmac_type);
 654 }
 655
 656 module_init(bitmap_ipmac_init);
 657 module_exit(bitmap_ipmac_fini);