net/netfilter/ipset/ip_set_bitmap_ipmac.c

   1 /* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
   2  *                         Patrick Schaaf <bof@bof.de>
   3  *                         Martin Josefsson <gandalf@wlug.westbo.se>
   4  * Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  */
  10
  11 /* Kernel module implementing an IP set type: the bitmap:ip,mac type */
  12
  13 #include <linux/module.h>
  14 #include <linux/ip.h>
  15 #include <linux/etherdevice.h>
  16 #include <linux/skbuff.h>
  17 #include <linux/errno.h>
  18 #include <linux/if_ether.h>
  19 #include <linux/netlink.h>
  20 #include <linux/jiffies.h>
  21 #include <linux/timer.h>
  22 #include <net/netlink.h>
  23
  24 #include <linux/netfilter/ipset/pfxlen.h>
  25 #include <linux/netfilter/ipset/ip_set.h>
  26 #include <linux/netfilter/ipset/ip_set_timeout.h>
  27 #include <linux/netfilter/ipset/ip_set_bitmap.h>
  28
  29 #define REVISION_MIN    0
  30 #define REVISION_MAX    0
  31
  32 MODULE_LICENSE("GPL");
  33 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
  34 IP_SET_MODULE_DESC("bitmap:ip,mac", REVISION_MIN, REVISION_MAX);
  35 MODULE_ALIAS("ip_set_bitmap:ip,mac");
  36
  37 enum {
  38         MAC_EMPTY,              /* element is not set */
  39         MAC_FILLED,             /* element is set with MAC */
  40         MAC_UNSET,              /* element is set, without MAC */
  41 };
  42
  43 /* Type structure */
  44 struct bitmap_ipmac {
  45         void *members;          /* the set members */
  46         u32 first_ip;           /* host byte order, included in range */
  47         u32 last_ip;            /* host byte order, included in range */
  48         u32 timeout;            /* timeout value */
  49         struct timer_list gc;   /* garbage collector */
  50         size_t dsize;           /* size of element */
  51 };
  52
  53 /* ADT structure for generic function args */
  54 struct ipmac {
  55         u32 id;                 /* id in array */
  56         unsigned char *ether;   /* ethernet address */
  57 };
  58
  59 /* Member element without and with timeout */
  60
  61 struct ipmac_elem {
  62         unsigned char ether[ETH_ALEN];
  63         unsigned char match;
  64 } __attribute__ ((aligned));
  65
  66 struct ipmac_telem {
  67         unsigned char ether[ETH_ALEN];
  68         unsigned char match;
  69         unsigned long timeout;
  70 } __attribute__ ((aligned));
  71
  72 static inline void *
  73 bitmap_ipmac_elem(const struct bitmap_ipmac *map, u32 id)
  74 {
  75         return (void *)((char *)map->members + id * map->dsize);
  76 }
  77
  78 static inline bool
  79 bitmap_timeout(const struct bitmap_ipmac *map, u32 id)
  80 {
  81         const struct ipmac_telem *elem = bitmap_ipmac_elem(map, id);
  82
  83         return ip_set_timeout_test(elem->timeout);
  84 }
  85
  86 static inline bool
  87 bitmap_expired(const struct bitmap_ipmac *map, u32 id)
  88 {
  89         const struct ipmac_telem *elem = bitmap_ipmac_elem(map, id);
  90
  91         return ip_set_timeout_expired(elem->timeout);
  92 }
  93
  94 static inline int
  95 bitmap_ipmac_exist(const struct ipmac_telem *elem)
  96 {
  97         return elem->match == MAC_UNSET ||
  98                (elem->match == MAC_FILLED &&
  99                 !ip_set_timeout_expired(elem->timeout));
 100 }
 101
 102 /* Base variant */
 103
 104 static int
 105 bitmap_ipmac_test(struct ip_set *set, void *value, u32 timeout, u32 flags)
 106 {
 107         const struct bitmap_ipmac *map = set->data;
 108         const struct ipmac *data = value;
 109         const struct ipmac_elem *elem = bitmap_ipmac_elem(map, data->id);
 110
 111         switch (elem->match) {
 112         case MAC_UNSET:
 113                 /* Trigger kernel to fill out the ethernet address */
 114                 return -EAGAIN;
 115         case MAC_FILLED:
 116                 return data->ether == NULL ||
 117                        ether_addr_equal(data->ether, elem->ether);
 118         }
 119         return 0;
 120 }
 121
 122 static int
 123 bitmap_ipmac_add(struct ip_set *set, void *value, u32 timeout, u32 flags)
 124 {
 125         struct bitmap_ipmac *map = set->data;
 126         const struct ipmac *data = value;
 127         struct ipmac_elem *elem = bitmap_ipmac_elem(map, data->id);
 128
 129         switch (elem->match) {
 130         case MAC_UNSET:
 131                 if (!data->ether)
 132                         /* Already added without ethernet address */
 133                         return -IPSET_ERR_EXIST;
 134                 /* Fill the MAC address */
 135                 memcpy(elem->ether, data->ether, ETH_ALEN);
 136                 elem->match = MAC_FILLED;
 137                 break;
 138         case MAC_FILLED:
 139                 return -IPSET_ERR_EXIST;
 140         case MAC_EMPTY:
 141                 if (data->ether) {
 142                         memcpy(elem->ether, data->ether, ETH_ALEN);
 143                         elem->match = MAC_FILLED;
 144                 } else
 145                         elem->match = MAC_UNSET;
 146         }
 147
 148         return 0;
 149 }
 150
 151 static int
 152 bitmap_ipmac_del(struct ip_set *set, void *value, u32 timeout, u32 flags)
 153 {
 154         struct bitmap_ipmac *map = set->data;
 155         const struct ipmac *data = value;
 156         struct ipmac_elem *elem = bitmap_ipmac_elem(map, data->id);
 157
 158         if (elem->match == MAC_EMPTY)
 159                 return -IPSET_ERR_EXIST;
 160
 161         elem->match = MAC_EMPTY;
 162
 163         return 0;
 164 }
 165
 166 static int
 167 bitmap_ipmac_list(const struct ip_set *set,
 168                   struct sk_buff *skb, struct netlink_callback *cb)
 169 {
 170         const struct bitmap_ipmac *map = set->data;
 171         const struct ipmac_elem *elem;
 172         struct nlattr *atd, *nested;
 173         u32 id, first = cb->args[2];
 174         u32 last = map->last_ip - map->first_ip;
 175
 176         atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
 177         if (!atd)
 178                 return -EMSGSIZE;
 179         for (; cb->args[2] <= last; cb->args[2]++) {
 180                 id = cb->args[2];
 181                 elem = bitmap_ipmac_elem(map, id);
 182                 if (elem->match == MAC_EMPTY)
 183                         continue;
 184                 nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
 185                 if (!nested) {
 186                         if (id == first) {
 187                                 nla_nest_cancel(skb, atd);
 188                                 return -EMSGSIZE;
 189                         } else
 190                                 goto nla_put_failure;
 191                 }
 192                 if (nla_put_ipaddr4(skb, IPSET_ATTR_IP,
 193                                     htonl(map->first_ip + id)) ||
 194                     (elem->match == MAC_FILLED &&
 195                      nla_put(skb, IPSET_ATTR_ETHER, ETH_ALEN,
 196                              elem->ether)))
 197                         goto nla_put_failure;
 198                 ipset_nest_end(skb, nested);
 199         }
 200         ipset_nest_end(skb, atd);
 201         /* Set listing finished */
 202         cb->args[2] = 0;
 203
 204         return 0;
 205
 206 nla_put_failure:
 207         nla_nest_cancel(skb, nested);
 208         ipset_nest_end(skb, atd);
 209         if (unlikely(id == first)) {
 210                 cb->args[2] = 0;
 211                 return -EMSGSIZE;
 212         }
 213         return 0;
 214 }
 215
 216 /* Timeout variant */
 217
 218 static int
 219 bitmap_ipmac_ttest(struct ip_set *set, void *value, u32 timeout, u32 flags)
 220 {
 221         const struct bitmap_ipmac *map = set->data;
 222         const struct ipmac *data = value;
 223         const struct ipmac_elem *elem = bitmap_ipmac_elem(map, data->id);
 224
 225         switch (elem->match) {
 226         case MAC_UNSET:
 227                 /* Trigger kernel to fill out the ethernet address */
 228                 return -EAGAIN;
 229         case MAC_FILLED:
 230                 return (data->ether == NULL ||
 231                         ether_addr_equal(data->ether, elem->ether)) &&
 232                        !bitmap_expired(map, data->id);
 233         }
 234         return 0;
 235 }
 236
 237 static int
 238 bitmap_ipmac_tadd(struct ip_set *set, void *value, u32 timeout, u32 flags)
 239 {
 240         struct bitmap_ipmac *map = set->data;
 241         const struct ipmac *data = value;
 242         struct ipmac_telem *elem = bitmap_ipmac_elem(map, data->id);
 243         bool flag_exist = flags & IPSET_FLAG_EXIST;
 244
 245         switch (elem->match) {
 246         case MAC_UNSET:
 247                 if (!(data->ether || flag_exist))
 248                         /* Already added without ethernet address */
 249                         return -IPSET_ERR_EXIST;
 250                 /* Fill the MAC address and activate the timer */
 251                 memcpy(elem->ether, data->ether, ETH_ALEN);
 252                 elem->match = MAC_FILLED;
 253                 if (timeout == map->timeout)
 254                         /* Timeout was not specified, get stored one */
 255                         timeout = elem->timeout;
 256                 elem->timeout = ip_set_timeout_set(timeout);
 257                 break;
 258         case MAC_FILLED:
 259                 if (!(bitmap_expired(map, data->id) || flag_exist))
 260                         return -IPSET_ERR_EXIST;
 261                 /* Fall through */
 262         case MAC_EMPTY:
 263                 if (data->ether) {
 264                         memcpy(elem->ether, data->ether, ETH_ALEN);
 265                         elem->match = MAC_FILLED;
 266                 } else
 267                         elem->match = MAC_UNSET;
 268                 /* If MAC is unset yet, we store plain timeout value
 269                  * because the timer is not activated yet
 270                  * and we can reuse it later when MAC is filled out,
 271                  * possibly by the kernel */
 272                 elem->timeout = data->ether ? ip_set_timeout_set(timeout)
 273                                             : timeout;
 274                 break;
 275         }
 276
 277         return 0;
 278 }
 279
 280 static int
 281 bitmap_ipmac_tdel(struct ip_set *set, void *value, u32 timeout, u32 flags)
 282 {
 283         struct bitmap_ipmac *map = set->data;
 284         const struct ipmac *data = value;
 285         struct ipmac_telem *elem = bitmap_ipmac_elem(map, data->id);
 286
 287         if (elem->match == MAC_EMPTY || bitmap_expired(map, data->id))
 288                 return -IPSET_ERR_EXIST;
 289
 290         elem->match = MAC_EMPTY;
 291
 292         return 0;
 293 }
 294
 295 static int
 296 bitmap_ipmac_tlist(const struct ip_set *set,
 297                    struct sk_buff *skb, struct netlink_callback *cb)
 298 {
 299         const struct bitmap_ipmac *map = set->data;
 300         const struct ipmac_telem *elem;
 301         struct nlattr *atd, *nested;
 302         u32 id, first = cb->args[2];
 303         u32 timeout, last = map->last_ip - map->first_ip;
 304
 305         atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
 306         if (!atd)
 307                 return -EMSGSIZE;
 308         for (; cb->args[2] <= last; cb->args[2]++) {
 309                 id = cb->args[2];
 310                 elem = bitmap_ipmac_elem(map, id);
 311                 if (!bitmap_ipmac_exist(elem))
 312                         continue;
 313                 nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
 314                 if (!nested) {
 315                         if (id == first) {
 316                                 nla_nest_cancel(skb, atd);
 317                                 return -EMSGSIZE;
 318                         } else
 319                                 goto nla_put_failure;
 320                 }
 321                 if (nla_put_ipaddr4(skb, IPSET_ATTR_IP,
 322                                     htonl(map->first_ip + id)) ||
 323                     (elem->match == MAC_FILLED &&
 324                      nla_put(skb, IPSET_ATTR_ETHER, ETH_ALEN,
 325                              elem->ether)))
 326                         goto nla_put_failure;
 327                 timeout = elem->match == MAC_UNSET ? elem->timeout
 328                                 : ip_set_timeout_get(elem->timeout);
 329                 if (nla_put_net32(skb, IPSET_ATTR_TIMEOUT, htonl(timeout)))
 330                         goto nla_put_failure;
 331                 ipset_nest_end(skb, nested);
 332         }
 333         ipset_nest_end(skb, atd);
 334         /* Set listing finished */
 335         cb->args[2] = 0;
 336
 337         return 0;
 338
 339 nla_put_failure:
 340         nla_nest_cancel(skb, nested);
 341         ipset_nest_end(skb, atd);
 342         return -EMSGSIZE;
 343 }
 344
 345 static int
 346 bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
 347                   const struct xt_action_param *par,
 348                   enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 349 {
 350         struct bitmap_ipmac *map = set->data;
 351         ipset_adtfn adtfn = set->variant->adt[adt];
 352         struct ipmac data;
 353
 354         /* MAC can be src only */
 355         if (!(opt->flags & IPSET_DIM_TWO_SRC))
 356                 return 0;
 357
 358         data.id = ntohl(ip4addr(skb, opt->flags & IPSET_DIM_ONE_SRC));
 359         if (data.id < map->first_ip || data.id > map->last_ip)
 360                 return -IPSET_ERR_BITMAP_RANGE;
 361
 362         /* Backward compatibility: we don't check the second flag */
 363         if (skb_mac_header(skb) < skb->head ||
 364             (skb_mac_header(skb) + ETH_HLEN) > skb->data)
 365                 return -EINVAL;
 366
 367         data.id -= map->first_ip;
 368         data.ether = eth_hdr(skb)->h_source;
 369
 370         return adtfn(set, &data, opt_timeout(opt, map), opt->cmdflags);
 371 }
 372
 373 static int
 374 bitmap_ipmac_uadt(struct ip_set *set, struct nlattr *tb[],
 375                   enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 376 {
 377         const struct bitmap_ipmac *map = set->data;
 378         ipset_adtfn adtfn = set->variant->adt[adt];
 379         struct ipmac data;
 380         u32 timeout = map->timeout;
 381         int ret = 0;
 382
 383         if (unlikely(!tb[IPSET_ATTR_IP] ||
 384                      !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 385                 return -IPSET_ERR_PROTOCOL;
 386
 387         if (tb[IPSET_ATTR_LINENO])
 388                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
 389
 390         ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &data.id);
 391         if (ret)
 392                 return ret;
 393
 394         if (data.id < map->first_ip || data.id > map->last_ip)
 395                 return -IPSET_ERR_BITMAP_RANGE;
 396
 397         if (tb[IPSET_ATTR_ETHER])
 398                 data.ether = nla_data(tb[IPSET_ATTR_ETHER]);
 399         else
 400                 data.ether = NULL;
 401
 402         if (tb[IPSET_ATTR_TIMEOUT]) {
 403                 if (!with_timeout(map->timeout))
 404                         return -IPSET_ERR_TIMEOUT;
 405                 timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 406         }
 407
 408         data.id -= map->first_ip;
 409
 410         ret = adtfn(set, &data, timeout, flags);
 411
 412         return ip_set_eexist(ret, flags) ? 0 : ret;
 413 }
 414
 415 static void
 416 bitmap_ipmac_destroy(struct ip_set *set)
 417 {
 418         struct bitmap_ipmac *map = set->data;
 419
 420         if (with_timeout(map->timeout))
 421                 del_timer_sync(&map->gc);
 422
 423         ip_set_free(map->members);
 424         kfree(map);
 425
 426         set->data = NULL;
 427 }
 428
 429 static void
 430 bitmap_ipmac_flush(struct ip_set *set)
 431 {
 432         struct bitmap_ipmac *map = set->data;
 433
 434         memset(map->members, 0,
 435                (map->last_ip - map->first_ip + 1) * map->dsize);
 436 }
 437
 438 static int
 439 bitmap_ipmac_head(struct ip_set *set, struct sk_buff *skb)
 440 {
 441         const struct bitmap_ipmac *map = set->data;
 442         struct nlattr *nested;
 443
 444         nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
 445         if (!nested)
 446                 goto nla_put_failure;
 447         if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, htonl(map->first_ip)) ||
 448             nla_put_ipaddr4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip)) ||
 449             nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1)) ||
 450             nla_put_net32(skb, IPSET_ATTR_MEMSIZE,
 451                           htonl(sizeof(*map) +
 452                                 ((map->last_ip - map->first_ip + 1) *
 453                                  map->dsize))) ||
 454             (with_timeout(map->timeout) &&
 455              nla_put_net32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout))))
 456                 goto nla_put_failure;
 457         ipset_nest_end(skb, nested);
 458
 459         return 0;
 460 nla_put_failure:
 461         return -EMSGSIZE;
 462 }
 463
 464 static bool
 465 bitmap_ipmac_same_set(const struct ip_set *a, const struct ip_set *b)
 466 {
 467         const struct bitmap_ipmac *x = a->data;
 468         const struct bitmap_ipmac *y = b->data;
 469
 470         return x->first_ip == y->first_ip &&
 471                x->last_ip == y->last_ip &&
 472                x->timeout == y->timeout;
 473 }
 474
 475 static const struct ip_set_type_variant bitmap_ipmac = {
 476         .kadt   = bitmap_ipmac_kadt,
 477         .uadt   = bitmap_ipmac_uadt,
 478         .adt    = {
 479                 [IPSET_ADD] = bitmap_ipmac_add,
 480                 [IPSET_DEL] = bitmap_ipmac_del,
 481                 [IPSET_TEST] = bitmap_ipmac_test,
 482         },
 483         .destroy = bitmap_ipmac_destroy,
 484         .flush  = bitmap_ipmac_flush,
 485         .head   = bitmap_ipmac_head,
 486         .list   = bitmap_ipmac_list,
 487         .same_set = bitmap_ipmac_same_set,
 488 };
 489
 490 static const struct ip_set_type_variant bitmap_tipmac = {
 491         .kadt   = bitmap_ipmac_kadt,
 492         .uadt   = bitmap_ipmac_uadt,
 493         .adt    = {
 494                 [IPSET_ADD] = bitmap_ipmac_tadd,
 495                 [IPSET_DEL] = bitmap_ipmac_tdel,
 496                 [IPSET_TEST] = bitmap_ipmac_ttest,
 497         },
 498         .destroy = bitmap_ipmac_destroy,
 499         .flush  = bitmap_ipmac_flush,
 500         .head   = bitmap_ipmac_head,
 501         .list   = bitmap_ipmac_tlist,
 502         .same_set = bitmap_ipmac_same_set,
 503 };
 504
 505 static void
 506 bitmap_ipmac_gc(unsigned long ul_set)
 507 {
 508         struct ip_set *set = (struct ip_set *) ul_set;
 509         struct bitmap_ipmac *map = set->data;
 510         struct ipmac_telem *elem;
 511         u32 id, last = map->last_ip - map->first_ip;
 512
 513         /* We run parallel with other readers (test element)
 514          * but adding/deleting new entries is locked out */
 515         read_lock_bh(&set->lock);
 516         for (id = 0; id <= last; id++) {
 517                 elem = bitmap_ipmac_elem(map, id);
 518                 if (elem->match == MAC_FILLED &&
 519                     ip_set_timeout_expired(elem->timeout))
 520                         elem->match = MAC_EMPTY;
 521         }
 522         read_unlock_bh(&set->lock);
 523
 524         map->gc.expires = jiffies + IPSET_GC_PERIOD(map->timeout) * HZ;
 525         add_timer(&map->gc);
 526 }
 527
 528 static void
 529 bitmap_ipmac_gc_init(struct ip_set *set)
 530 {
 531         struct bitmap_ipmac *map = set->data;
 532
 533         init_timer(&map->gc);
 534         map->gc.data = (unsigned long) set;
 535         map->gc.function = bitmap_ipmac_gc;
 536         map->gc.expires = jiffies + IPSET_GC_PERIOD(map->timeout) * HZ;
 537         add_timer(&map->gc);
 538 }
 539
 540 /* Create bitmap:ip,mac type of sets */
 541
 542 static bool
 543 init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,
 544                u32 first_ip, u32 last_ip)
 545 {
 546         map->members = ip_set_alloc((last_ip - first_ip + 1) * map->dsize);
 547         if (!map->members)
 548                 return false;
 549         map->first_ip = first_ip;
 550         map->last_ip = last_ip;
 551         map->timeout = IPSET_NO_TIMEOUT;
 552
 553         set->data = map;
 554         set->family = NFPROTO_IPV4;
 555
 556         return true;
 557 }
 558
 559 static int
 560 bitmap_ipmac_create(struct ip_set *set, struct nlattr *tb[],
 561                     u32 flags)
 562 {
 563         u32 first_ip, last_ip;
 564         u64 elements;
 565         struct bitmap_ipmac *map;
 566         int ret;
 567
 568         if (unlikely(!tb[IPSET_ATTR_IP] ||
 569                      !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 570                 return -IPSET_ERR_PROTOCOL;
 571
 572         ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &first_ip);
 573         if (ret)
 574                 return ret;
 575
 576         if (tb[IPSET_ATTR_IP_TO]) {
 577                 ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &last_ip);
 578                 if (ret)
 579                         return ret;
 580                 if (first_ip > last_ip) {
 581                         u32 tmp = first_ip;
 582
 583                         first_ip = last_ip;
 584                         last_ip = tmp;
 585                 }
 586         } else if (tb[IPSET_ATTR_CIDR]) {
 587                 u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
 588
 589                 if (cidr >= 32)
 590                         return -IPSET_ERR_INVALID_CIDR;
 591                 ip_set_mask_from_to(first_ip, last_ip, cidr);
 592         } else
 593                 return -IPSET_ERR_PROTOCOL;
 594
 595         elements = (u64)last_ip - first_ip + 1;
 596
 597         if (elements > IPSET_BITMAP_MAX_RANGE + 1)
 598                 return -IPSET_ERR_BITMAP_RANGE_SIZE;
 599
 600         map = kzalloc(sizeof(*map), GFP_KERNEL);
 601         if (!map)
 602                 return -ENOMEM;
 603
 604         if (tb[IPSET_ATTR_TIMEOUT]) {
 605                 map->dsize = sizeof(struct ipmac_telem);
 606
 607                 if (!init_map_ipmac(set, map, first_ip, last_ip)) {
 608                         kfree(map);
 609                         return -ENOMEM;
 610                 }
 611
 612                 map->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 613
 614                 set->variant = &bitmap_tipmac;
 615
 616                 bitmap_ipmac_gc_init(set);
 617         } else {
 618                 map->dsize = sizeof(struct ipmac_elem);
 619
 620                 if (!init_map_ipmac(set, map, first_ip, last_ip)) {
 621                         kfree(map);
 622                         return -ENOMEM;
 623                 }
 624                 set->variant = &bitmap_ipmac;
 625
 626         }
 627         return 0;
 628 }
 629
 630 static struct ip_set_type bitmap_ipmac_type = {
 631         .name           = "bitmap:ip,mac",
 632         .protocol       = IPSET_PROTOCOL,
 633         .features       = IPSET_TYPE_IP | IPSET_TYPE_MAC,
 634         .dimension      = IPSET_DIM_TWO,
 635         .family         = NFPROTO_IPV4,
 636         .revision_min   = REVISION_MIN,
 637         .revision_max   = REVISION_MAX,
 638         .create         = bitmap_ipmac_create,
 639         .create_policy  = {
 640                 [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
 641                 [IPSET_ATTR_IP_TO]      = { .type = NLA_NESTED },
 642                 [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
 643                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
 644         },
 645         .adt_policy     = {
 646                 [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
 647                 [IPSET_ATTR_ETHER]      = { .type = NLA_BINARY,
 648                                             .len  = ETH_ALEN },
 649                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
 650                 [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
 651         },
 652         .me             = THIS_MODULE,
 653 };
 654
 655 static int __init
 656 bitmap_ipmac_init(void)
 657 {
 658         return ip_set_type_register(&bitmap_ipmac_type);
 659 }
 660
 661 static void __exit
 662 bitmap_ipmac_fini(void)
 663 {
 664         ip_set_type_unregister(&bitmap_ipmac_type);
 665 }
 666
 667 module_init(bitmap_ipmac_init);
 668 module_exit(bitmap_ipmac_fini);