net/netfilter/ipset/ip_set_bitmap_ipmac.c

   1 /* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
   2  *                         Patrick Schaaf <bof@bof.de>
   3  *                         Martin Josefsson <gandalf@wlug.westbo.se>
   4  * Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  */
  10
  11 /* Kernel module implementing an IP set type: the bitmap:ip,mac type */
  12
  13 #include <linux/module.h>
  14 #include <linux/ip.h>
  15 #include <linux/etherdevice.h>
  16 #include <linux/skbuff.h>
  17 #include <linux/errno.h>
  18 #include <linux/if_ether.h>
  19 #include <linux/netlink.h>
  20 #include <linux/jiffies.h>
  21 #include <linux/timer.h>
  22 #include <net/netlink.h>
  23
  24 #include <linux/netfilter/ipset/pfxlen.h>
  25 #include <linux/netfilter/ipset/ip_set.h>
  26 #include <linux/netfilter/ipset/ip_set_timeout.h>
  27 #include <linux/netfilter/ipset/ip_set_bitmap.h>
  28
  29 MODULE_LICENSE("GPL");
  30 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
  31 MODULE_DESCRIPTION("bitmap:ip,mac type of IP sets");
  32 MODULE_ALIAS("ip_set_bitmap:ip,mac");
  33
  34 enum {
  35         MAC_EMPTY,              /* element is not set */
  36         MAC_FILLED,             /* element is set with MAC */
  37         MAC_UNSET,              /* element is set, without MAC */
  38 };
  39
  40 /* Type structure */
  41 struct bitmap_ipmac {
  42         void *members;          /* the set members */
  43         u32 first_ip;           /* host byte order, included in range */
  44         u32 last_ip;            /* host byte order, included in range */
  45         u32 timeout;            /* timeout value */
  46         struct timer_list gc;   /* garbage collector */
  47         size_t dsize;           /* size of element */
  48 };
  49
  50 /* ADT structure for generic function args */
  51 struct ipmac {
  52         u32 id;                 /* id in array */
  53         unsigned char *ether;   /* ethernet address */
  54 };
  55
  56 /* Member element without and with timeout */
  57
  58 struct ipmac_elem {
  59         unsigned char ether[ETH_ALEN];
  60         unsigned char match;
  61 } __attribute__ ((aligned));
  62
  63 struct ipmac_telem {
  64         unsigned char ether[ETH_ALEN];
  65         unsigned char match;
  66         unsigned long timeout;
  67 } __attribute__ ((aligned));
  68
  69 static inline void *
  70 bitmap_ipmac_elem(const struct bitmap_ipmac *map, u32 id)
  71 {
  72         return (void *)((char *)map->members + id * map->dsize);
  73 }
  74
  75 static inline bool
  76 bitmap_timeout(const struct bitmap_ipmac *map, u32 id)
  77 {
  78         const struct ipmac_telem *elem = bitmap_ipmac_elem(map, id);
  79
  80         return ip_set_timeout_test(elem->timeout);
  81 }
  82
  83 static inline bool
  84 bitmap_expired(const struct bitmap_ipmac *map, u32 id)
  85 {
  86         const struct ipmac_telem *elem = bitmap_ipmac_elem(map, id);
  87
  88         return ip_set_timeout_expired(elem->timeout);
  89 }
  90
  91 static inline int
  92 bitmap_ipmac_exist(const struct ipmac_telem *elem)
  93 {
  94         return elem->match == MAC_UNSET ||
  95                (elem->match == MAC_FILLED &&
  96                 !ip_set_timeout_expired(elem->timeout));
  97 }
  98
  99 /* Base variant */
 100
 101 static int
 102 bitmap_ipmac_test(struct ip_set *set, void *value, u32 timeout, u32 flags)
 103 {
 104         const struct bitmap_ipmac *map = set->data;
 105         const struct ipmac *data = value;
 106         const struct ipmac_elem *elem = bitmap_ipmac_elem(map, data->id);
 107
 108         switch (elem->match) {
 109         case MAC_UNSET:
 110                 /* Trigger kernel to fill out the ethernet address */
 111                 return -EAGAIN;
 112         case MAC_FILLED:
 113                 return data->ether == NULL ||
 114                        compare_ether_addr(data->ether, elem->ether) == 0;
 115         }
 116         return 0;
 117 }
 118
 119 static int
 120 bitmap_ipmac_add(struct ip_set *set, void *value, u32 timeout, u32 flags)
 121 {
 122         struct bitmap_ipmac *map = set->data;
 123         const struct ipmac *data = value;
 124         struct ipmac_elem *elem = bitmap_ipmac_elem(map, data->id);
 125
 126         switch (elem->match) {
 127         case MAC_UNSET:
 128                 if (!data->ether)
 129                         /* Already added without ethernet address */
 130                         return -IPSET_ERR_EXIST;
 131                 /* Fill the MAC address */
 132                 memcpy(elem->ether, data->ether, ETH_ALEN);
 133                 elem->match = MAC_FILLED;
 134                 break;
 135         case MAC_FILLED:
 136                 return -IPSET_ERR_EXIST;
 137         case MAC_EMPTY:
 138                 if (data->ether) {
 139                         memcpy(elem->ether, data->ether, ETH_ALEN);
 140                         elem->match = MAC_FILLED;
 141                 } else
 142                         elem->match = MAC_UNSET;
 143         }
 144
 145         return 0;
 146 }
 147
 148 static int
 149 bitmap_ipmac_del(struct ip_set *set, void *value, u32 timeout, u32 flags)
 150 {
 151         struct bitmap_ipmac *map = set->data;
 152         const struct ipmac *data = value;
 153         struct ipmac_elem *elem = bitmap_ipmac_elem(map, data->id);
 154
 155         if (elem->match == MAC_EMPTY)
 156                 return -IPSET_ERR_EXIST;
 157
 158         elem->match = MAC_EMPTY;
 159
 160         return 0;
 161 }
 162
 163 static int
 164 bitmap_ipmac_list(const struct ip_set *set,
 165                   struct sk_buff *skb, struct netlink_callback *cb)
 166 {
 167         const struct bitmap_ipmac *map = set->data;
 168         const struct ipmac_elem *elem;
 169         struct nlattr *atd, *nested;
 170         u32 id, first = cb->args[2];
 171         u32 last = map->last_ip - map->first_ip;
 172
 173         atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
 174         if (!atd)
 175                 return -EMSGSIZE;
 176         for (; cb->args[2] <= last; cb->args[2]++) {
 177                 id = cb->args[2];
 178                 elem = bitmap_ipmac_elem(map, id);
 179                 if (elem->match == MAC_EMPTY)
 180                         continue;
 181                 nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
 182                 if (!nested) {
 183                         if (id == first) {
 184                                 nla_nest_cancel(skb, atd);
 185                                 return -EMSGSIZE;
 186                         } else
 187                                 goto nla_put_failure;
 188                 }
 189                 NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP,
 190                                 htonl(map->first_ip + id));
 191                 if (elem->match == MAC_FILLED)
 192                         NLA_PUT(skb, IPSET_ATTR_ETHER, ETH_ALEN,
 193                                 elem->ether);
 194                 ipset_nest_end(skb, nested);
 195         }
 196         ipset_nest_end(skb, atd);
 197         /* Set listing finished */
 198         cb->args[2] = 0;
 199
 200         return 0;
 201
 202 nla_put_failure:
 203         nla_nest_cancel(skb, nested);
 204         ipset_nest_end(skb, atd);
 205         if (unlikely(id == first)) {
 206                 cb->args[2] = 0;
 207                 return -EMSGSIZE;
 208         }
 209         return 0;
 210 }
 211
 212 /* Timeout variant */
 213
 214 static int
 215 bitmap_ipmac_ttest(struct ip_set *set, void *value, u32 timeout, u32 flags)
 216 {
 217         const struct bitmap_ipmac *map = set->data;
 218         const struct ipmac *data = value;
 219         const struct ipmac_elem *elem = bitmap_ipmac_elem(map, data->id);
 220
 221         switch (elem->match) {
 222         case MAC_UNSET:
 223                 /* Trigger kernel to fill out the ethernet address */
 224                 return -EAGAIN;
 225         case MAC_FILLED:
 226                 return (data->ether == NULL ||
 227                         compare_ether_addr(data->ether, elem->ether) == 0) &&
 228                        !bitmap_expired(map, data->id);
 229         }
 230         return 0;
 231 }
 232
 233 static int
 234 bitmap_ipmac_tadd(struct ip_set *set, void *value, u32 timeout, u32 flags)
 235 {
 236         struct bitmap_ipmac *map = set->data;
 237         const struct ipmac *data = value;
 238         struct ipmac_telem *elem = bitmap_ipmac_elem(map, data->id);
 239         bool flag_exist = flags & IPSET_FLAG_EXIST;
 240
 241         switch (elem->match) {
 242         case MAC_UNSET:
 243                 if (!(data->ether || flag_exist))
 244                         /* Already added without ethernet address */
 245                         return -IPSET_ERR_EXIST;
 246                 /* Fill the MAC address and activate the timer */
 247                 memcpy(elem->ether, data->ether, ETH_ALEN);
 248                 elem->match = MAC_FILLED;
 249                 if (timeout == map->timeout)
 250                         /* Timeout was not specified, get stored one */
 251                         timeout = elem->timeout;
 252                 elem->timeout = ip_set_timeout_set(timeout);
 253                 break;
 254         case MAC_FILLED:
 255                 if (!(bitmap_expired(map, data->id) || flag_exist))
 256                         return -IPSET_ERR_EXIST;
 257                 /* Fall through */
 258         case MAC_EMPTY:
 259                 if (data->ether) {
 260                         memcpy(elem->ether, data->ether, ETH_ALEN);
 261                         elem->match = MAC_FILLED;
 262                 } else
 263                         elem->match = MAC_UNSET;
 264                 /* If MAC is unset yet, we store plain timeout value
 265                  * because the timer is not activated yet
 266                  * and we can reuse it later when MAC is filled out,
 267                  * possibly by the kernel */
 268                 elem->timeout = data->ether ? ip_set_timeout_set(timeout)
 269                                             : timeout;
 270                 break;
 271         }
 272
 273         return 0;
 274 }
 275
 276 static int
 277 bitmap_ipmac_tdel(struct ip_set *set, void *value, u32 timeout, u32 flags)
 278 {
 279         struct bitmap_ipmac *map = set->data;
 280         const struct ipmac *data = value;
 281         struct ipmac_telem *elem = bitmap_ipmac_elem(map, data->id);
 282
 283         if (elem->match == MAC_EMPTY || bitmap_expired(map, data->id))
 284                 return -IPSET_ERR_EXIST;
 285
 286         elem->match = MAC_EMPTY;
 287
 288         return 0;
 289 }
 290
 291 static int
 292 bitmap_ipmac_tlist(const struct ip_set *set,
 293                    struct sk_buff *skb, struct netlink_callback *cb)
 294 {
 295         const struct bitmap_ipmac *map = set->data;
 296         const struct ipmac_telem *elem;
 297         struct nlattr *atd, *nested;
 298         u32 id, first = cb->args[2];
 299         u32 timeout, last = map->last_ip - map->first_ip;
 300
 301         atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
 302         if (!atd)
 303                 return -EMSGSIZE;
 304         for (; cb->args[2] <= last; cb->args[2]++) {
 305                 id = cb->args[2];
 306                 elem = bitmap_ipmac_elem(map, id);
 307                 if (!bitmap_ipmac_exist(elem))
 308                         continue;
 309                 nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
 310                 if (!nested) {
 311                         if (id == first) {
 312                                 nla_nest_cancel(skb, atd);
 313                                 return -EMSGSIZE;
 314                         } else
 315                                 goto nla_put_failure;
 316                 }
 317                 NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP,
 318                                 htonl(map->first_ip + id));
 319                 if (elem->match == MAC_FILLED)
 320                         NLA_PUT(skb, IPSET_ATTR_ETHER, ETH_ALEN,
 321                                 elem->ether);
 322                 timeout = elem->match == MAC_UNSET ? elem->timeout
 323                                 : ip_set_timeout_get(elem->timeout);
 324                 NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(timeout));
 325                 ipset_nest_end(skb, nested);
 326         }
 327         ipset_nest_end(skb, atd);
 328         /* Set listing finished */
 329         cb->args[2] = 0;
 330
 331         return 0;
 332
 333 nla_put_failure:
 334         nla_nest_cancel(skb, nested);
 335         ipset_nest_end(skb, atd);
 336         return -EMSGSIZE;
 337 }
 338
 339 static int
 340 bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
 341                   const struct xt_action_param *par,
 342                   enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 343 {
 344         struct bitmap_ipmac *map = set->data;
 345         ipset_adtfn adtfn = set->variant->adt[adt];
 346         struct ipmac data;
 347
 348         /* MAC can be src only */
 349         if (!(opt->flags & IPSET_DIM_TWO_SRC))
 350                 return 0;
 351
 352         data.id = ntohl(ip4addr(skb, opt->flags & IPSET_DIM_ONE_SRC));
 353         if (data.id < map->first_ip || data.id > map->last_ip)
 354                 return -IPSET_ERR_BITMAP_RANGE;
 355
 356         /* Backward compatibility: we don't check the second flag */
 357         if (skb_mac_header(skb) < skb->head ||
 358             (skb_mac_header(skb) + ETH_HLEN) > skb->data)
 359                 return -EINVAL;
 360
 361         data.id -= map->first_ip;
 362         data.ether = eth_hdr(skb)->h_source;
 363
 364         return adtfn(set, &data, opt_timeout(opt, map), opt->cmdflags);
 365 }
 366
 367 static int
 368 bitmap_ipmac_uadt(struct ip_set *set, struct nlattr *tb[],
 369                   enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 370 {
 371         const struct bitmap_ipmac *map = set->data;
 372         ipset_adtfn adtfn = set->variant->adt[adt];
 373         struct ipmac data;
 374         u32 timeout = map->timeout;
 375         int ret = 0;
 376
 377         if (unlikely(!tb[IPSET_ATTR_IP] ||
 378                      !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 379                 return -IPSET_ERR_PROTOCOL;
 380
 381         if (tb[IPSET_ATTR_LINENO])
 382                 *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
 383
 384         ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &data.id);
 385         if (ret)
 386                 return ret;
 387
 388         if (data.id < map->first_ip || data.id > map->last_ip)
 389                 return -IPSET_ERR_BITMAP_RANGE;
 390
 391         if (tb[IPSET_ATTR_ETHER])
 392                 data.ether = nla_data(tb[IPSET_ATTR_ETHER]);
 393         else
 394                 data.ether = NULL;
 395
 396         if (tb[IPSET_ATTR_TIMEOUT]) {
 397                 if (!with_timeout(map->timeout))
 398                         return -IPSET_ERR_TIMEOUT;
 399                 timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 400         }
 401
 402         data.id -= map->first_ip;
 403
 404         ret = adtfn(set, &data, timeout, flags);
 405
 406         return ip_set_eexist(ret, flags) ? 0 : ret;
 407 }
 408
 409 static void
 410 bitmap_ipmac_destroy(struct ip_set *set)
 411 {
 412         struct bitmap_ipmac *map = set->data;
 413
 414         if (with_timeout(map->timeout))
 415                 del_timer_sync(&map->gc);
 416
 417         ip_set_free(map->members);
 418         kfree(map);
 419
 420         set->data = NULL;
 421 }
 422
 423 static void
 424 bitmap_ipmac_flush(struct ip_set *set)
 425 {
 426         struct bitmap_ipmac *map = set->data;
 427
 428         memset(map->members, 0,
 429                (map->last_ip - map->first_ip + 1) * map->dsize);
 430 }
 431
 432 static int
 433 bitmap_ipmac_head(struct ip_set *set, struct sk_buff *skb)
 434 {
 435         const struct bitmap_ipmac *map = set->data;
 436         struct nlattr *nested;
 437
 438         nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
 439         if (!nested)
 440                 goto nla_put_failure;
 441         NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, htonl(map->first_ip));
 442         NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
 443         NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
 444         NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
 445                       htonl(sizeof(*map)
 446                             + (map->last_ip - map->first_ip + 1) * map->dsize));
 447         if (with_timeout(map->timeout))
 448                 NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout));
 449         ipset_nest_end(skb, nested);
 450
 451         return 0;
 452 nla_put_failure:
 453         return -EMSGSIZE;
 454 }
 455
 456 static bool
 457 bitmap_ipmac_same_set(const struct ip_set *a, const struct ip_set *b)
 458 {
 459         const struct bitmap_ipmac *x = a->data;
 460         const struct bitmap_ipmac *y = b->data;
 461
 462         return x->first_ip == y->first_ip &&
 463                x->last_ip == y->last_ip &&
 464                x->timeout == y->timeout;
 465 }
 466
 467 static const struct ip_set_type_variant bitmap_ipmac = {
 468         .kadt   = bitmap_ipmac_kadt,
 469         .uadt   = bitmap_ipmac_uadt,
 470         .adt    = {
 471                 [IPSET_ADD] = bitmap_ipmac_add,
 472                 [IPSET_DEL] = bitmap_ipmac_del,
 473                 [IPSET_TEST] = bitmap_ipmac_test,
 474         },
 475         .destroy = bitmap_ipmac_destroy,
 476         .flush  = bitmap_ipmac_flush,
 477         .head   = bitmap_ipmac_head,
 478         .list   = bitmap_ipmac_list,
 479         .same_set = bitmap_ipmac_same_set,
 480 };
 481
 482 static const struct ip_set_type_variant bitmap_tipmac = {
 483         .kadt   = bitmap_ipmac_kadt,
 484         .uadt   = bitmap_ipmac_uadt,
 485         .adt    = {
 486                 [IPSET_ADD] = bitmap_ipmac_tadd,
 487                 [IPSET_DEL] = bitmap_ipmac_tdel,
 488                 [IPSET_TEST] = bitmap_ipmac_ttest,
 489         },
 490         .destroy = bitmap_ipmac_destroy,
 491         .flush  = bitmap_ipmac_flush,
 492         .head   = bitmap_ipmac_head,
 493         .list   = bitmap_ipmac_tlist,
 494         .same_set = bitmap_ipmac_same_set,
 495 };
 496
 497 static void
 498 bitmap_ipmac_gc(unsigned long ul_set)
 499 {
 500         struct ip_set *set = (struct ip_set *) ul_set;
 501         struct bitmap_ipmac *map = set->data;
 502         struct ipmac_telem *elem;
 503         u32 id, last = map->last_ip - map->first_ip;
 504
 505         /* We run parallel with other readers (test element)
 506          * but adding/deleting new entries is locked out */
 507         read_lock_bh(&set->lock);
 508         for (id = 0; id <= last; id++) {
 509                 elem = bitmap_ipmac_elem(map, id);
 510                 if (elem->match == MAC_FILLED &&
 511                     ip_set_timeout_expired(elem->timeout))
 512                         elem->match = MAC_EMPTY;
 513         }
 514         read_unlock_bh(&set->lock);
 515
 516         map->gc.expires = jiffies + IPSET_GC_PERIOD(map->timeout) * HZ;
 517         add_timer(&map->gc);
 518 }
 519
 520 static void
 521 bitmap_ipmac_gc_init(struct ip_set *set)
 522 {
 523         struct bitmap_ipmac *map = set->data;
 524
 525         init_timer(&map->gc);
 526         map->gc.data = (unsigned long) set;
 527         map->gc.function = bitmap_ipmac_gc;
 528         map->gc.expires = jiffies + IPSET_GC_PERIOD(map->timeout) * HZ;
 529         add_timer(&map->gc);
 530 }
 531
 532 /* Create bitmap:ip,mac type of sets */
 533
 534 static bool
 535 init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,
 536                u32 first_ip, u32 last_ip)
 537 {
 538         map->members = ip_set_alloc((last_ip - first_ip + 1) * map->dsize);
 539         if (!map->members)
 540                 return false;
 541         map->first_ip = first_ip;
 542         map->last_ip = last_ip;
 543         map->timeout = IPSET_NO_TIMEOUT;
 544
 545         set->data = map;
 546         set->family = AF_INET;
 547
 548         return true;
 549 }
 550
 551 static int
 552 bitmap_ipmac_create(struct ip_set *set, struct nlattr *tb[],
 553                     u32 flags)
 554 {
 555         u32 first_ip, last_ip, elements;
 556         struct bitmap_ipmac *map;
 557         int ret;
 558
 559         if (unlikely(!tb[IPSET_ATTR_IP] ||
 560                      !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 561                 return -IPSET_ERR_PROTOCOL;
 562
 563         ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &first_ip);
 564         if (ret)
 565                 return ret;
 566
 567         if (tb[IPSET_ATTR_IP_TO]) {
 568                 ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &last_ip);
 569                 if (ret)
 570                         return ret;
 571                 if (first_ip > last_ip) {
 572                         u32 tmp = first_ip;
 573
 574                         first_ip = last_ip;
 575                         last_ip = tmp;
 576                 }
 577         } else if (tb[IPSET_ATTR_CIDR]) {
 578                 u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
 579
 580                 if (cidr >= 32)
 581                         return -IPSET_ERR_INVALID_CIDR;
 582                 ip_set_mask_from_to(first_ip, last_ip, cidr);
 583         } else
 584                 return -IPSET_ERR_PROTOCOL;
 585
 586         elements = last_ip - first_ip + 1;
 587
 588         if (elements > IPSET_BITMAP_MAX_RANGE + 1)
 589                 return -IPSET_ERR_BITMAP_RANGE_SIZE;
 590
 591         map = kzalloc(sizeof(*map), GFP_KERNEL);
 592         if (!map)
 593                 return -ENOMEM;
 594
 595         if (tb[IPSET_ATTR_TIMEOUT]) {
 596                 map->dsize = sizeof(struct ipmac_telem);
 597
 598                 if (!init_map_ipmac(set, map, first_ip, last_ip)) {
 599                         kfree(map);
 600                         return -ENOMEM;
 601                 }
 602
 603                 map->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 604
 605                 set->variant = &bitmap_tipmac;
 606
 607                 bitmap_ipmac_gc_init(set);
 608         } else {
 609                 map->dsize = sizeof(struct ipmac_elem);
 610
 611                 if (!init_map_ipmac(set, map, first_ip, last_ip)) {
 612                         kfree(map);
 613                         return -ENOMEM;
 614                 }
 615                 set->variant = &bitmap_ipmac;
 616
 617         }
 618         return 0;
 619 }
 620
 621 static struct ip_set_type bitmap_ipmac_type = {
 622         .name           = "bitmap:ip,mac",
 623         .protocol       = IPSET_PROTOCOL,
 624         .features       = IPSET_TYPE_IP | IPSET_TYPE_MAC,
 625         .dimension      = IPSET_DIM_TWO,
 626         .family         = AF_INET,
 627         .revision_min   = 0,
 628         .revision_max   = 0,
 629         .create         = bitmap_ipmac_create,
 630         .create_policy  = {
 631                 [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
 632                 [IPSET_ATTR_IP_TO]      = { .type = NLA_NESTED },
 633                 [IPSET_ATTR_CIDR]       = { .type = NLA_U8 },
 634                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
 635         },
 636         .adt_policy     = {
 637                 [IPSET_ATTR_IP]         = { .type = NLA_NESTED },
 638                 [IPSET_ATTR_ETHER]      = { .type = NLA_BINARY,
 639                                             .len  = ETH_ALEN },
 640                 [IPSET_ATTR_TIMEOUT]    = { .type = NLA_U32 },
 641                 [IPSET_ATTR_LINENO]     = { .type = NLA_U32 },
 642         },
 643         .me             = THIS_MODULE,
 644 };
 645
 646 static int __init
 647 bitmap_ipmac_init(void)
 648 {
 649         return ip_set_type_register(&bitmap_ipmac_type);
 650 }
 651
 652 static void __exit
 653 bitmap_ipmac_fini(void)
 654 {
 655         ip_set_type_unregister(&bitmap_ipmac_type);
 656 }
 657
 658 module_init(bitmap_ipmac_init);
 659 module_exit(bitmap_ipmac_fini);