[mirror_ubuntu-bionic-kernel.git] / net / netfilter / ipset / ip_set_hash_ipmac.c

/* Copyright (C) 2016 Tomasz Chilinski <tomasz.chilinski@chilan.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

/* Kernel module implementing an IP set type: the hash:ip,mac type */

#include <linux/jhash.h>
#include <linux/module.h>
#include <linux/ip.h>
#include <linux/etherdevice.h>
#include <linux/skbuff.h>
#include <linux/errno.h>
#include <linux/random.h>
#include <linux/if_ether.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/netlink.h>
#include <net/tcp.h>

#include <linux/netfilter.h>
#include <linux/netfilter/ipset/pfxlen.h>
#include <linux/netfilter/ipset/ip_set.h>
#include <linux/netfilter/ipset/ip_set_hash.h>

#define IPSET_TYPE_REV_MIN	0
#define IPSET_TYPE_REV_MAX	0

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Tomasz Chilinski <tomasz.chilinski@chilan.com>");
IP_SET_MODULE_DESC("hash:ip,mac", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
MODULE_ALIAS("ip_set_hash:ip,mac");

/* Type specific function prefix */
#define HTYPE		hash_ipmac

/* Zero valued element is not supported */
static const unsigned char invalid_ether[ETH_ALEN] = { 0 };

/* IPv4 variant */

/* Member elements */
struct hash_ipmac4_elem {
	/* Zero valued IP addresses cannot be stored */
	__be32 ip;
	union {
		unsigned char ether[ETH_ALEN];
		__be32 foo[2];
	};
};

/* Common functions */

static inline bool
hash_ipmac4_data_equal(const struct hash_ipmac4_elem *e1,
		       const struct hash_ipmac4_elem *e2,
		       u32 *multi)
{
	return e1->ip == e2->ip && ether_addr_equal(e1->ether, e2->ether);
}

static bool
hash_ipmac4_data_list(struct sk_buff *skb, const struct hash_ipmac4_elem *e)
{
	if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, e->ip) ||
	    nla_put(skb, IPSET_ATTR_ETHER, ETH_ALEN, e->ether))
		goto nla_put_failure;
	return false;

nla_put_failure:
	return true;
}

static inline void
hash_ipmac4_data_next(struct hash_ipmac4_elem *next,
		      const struct hash_ipmac4_elem *e)
{
	next->ip = e->ip;
}

#define MTYPE		hash_ipmac4
#define PF		4
#define HOST_MASK	32
#define HKEY_DATALEN	sizeof(struct hash_ipmac4_elem)
#include "ip_set_hash_gen.h"

static int
hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
		 const struct xt_action_param *par,
		 enum ipset_adt adt, struct ip_set_adt_opt *opt)
{
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } };
	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);

	 /* MAC can be src only */
	if (!(opt->flags & IPSET_DIM_TWO_SRC))
		return 0;

	if (skb_mac_header(skb) < skb->head ||
	    (skb_mac_header(skb) + ETH_HLEN) > skb->data)
		return -EINVAL;

	memcpy(e.ether, eth_hdr(skb)->h_source, ETH_ALEN);
	if (ether_addr_equal(e.ether, invalid_ether))
		return -EINVAL;

	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip);

	return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
}

static int
hash_ipmac4_uadt(struct ip_set *set, struct nlattr *tb[],
		 enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
{
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } };
	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
	int ret;

	if (unlikely(!tb[IPSET_ATTR_IP] ||
		     !tb[IPSET_ATTR_ETHER] ||
		     nla_len(tb[IPSET_ATTR_ETHER]) != ETH_ALEN ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES)   ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBMARK) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBPRIO) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBQUEUE)))
		return -IPSET_ERR_PROTOCOL;

	if (tb[IPSET_ATTR_LINENO])
		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);

	ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP], &e.ip) ||
		ip_set_get_extensions(set, tb, &ext);
	if (ret)
		return ret;
	memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN);
	if (ether_addr_equal(e.ether, invalid_ether))
		return -IPSET_ERR_HASH_ELEM;

	return adtfn(set, &e, &ext, &ext, flags);
}

/* IPv6 variant */

/* Member elements */
struct hash_ipmac6_elem {
	/* Zero valued IP addresses cannot be stored */
	union nf_inet_addr ip;
	union {
		unsigned char ether[ETH_ALEN];
		__be32 foo[2];
	};
};

/* Common functions */

static inline bool
hash_ipmac6_data_equal(const struct hash_ipmac6_elem *e1,
		       const struct hash_ipmac6_elem *e2,
		       u32 *multi)
{
	return ipv6_addr_equal(&e1->ip.in6, &e2->ip.in6) &&
		ether_addr_equal(e1->ether, e2->ether);
}

static bool
hash_ipmac6_data_list(struct sk_buff *skb, const struct hash_ipmac6_elem *e)
{
	if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &e->ip.in6) ||
	    nla_put(skb, IPSET_ATTR_ETHER, ETH_ALEN, e->ether))
		goto nla_put_failure;
	return false;

nla_put_failure:
	return true;
}

static inline void
hash_ipmac6_data_next(struct hash_ipmac6_elem *next,
		      const struct hash_ipmac6_elem *e)
{
}

#undef MTYPE
#undef PF
#undef HOST_MASK
#undef HKEY_DATALEN

#define MTYPE		hash_ipmac6
#define PF		6
#define HOST_MASK	128
#define HKEY_DATALEN	sizeof(struct hash_ipmac6_elem)
#define IP_SET_EMIT_CREATE
#include "ip_set_hash_gen.h"

static int
hash_ipmac6_kadt(struct ip_set *set, const struct sk_buff *skb,
		 const struct xt_action_param *par,
		 enum ipset_adt adt, struct ip_set_adt_opt *opt)
{
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_ipmac6_elem e = {
		{ .all = { 0 } },
		{ .foo[0] = 0, .foo[1] = 0 }
	};
	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);

	 /* MAC can be src only */
	if (!(opt->flags & IPSET_DIM_TWO_SRC))
		return 0;

	if (skb_mac_header(skb) < skb->head ||
	    (skb_mac_header(skb) + ETH_HLEN) > skb->data)
		return -EINVAL;

	memcpy(e.ether, eth_hdr(skb)->h_source, ETH_ALEN);
	if (ether_addr_equal(e.ether, invalid_ether))
		return -EINVAL;

	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip.in6);

	return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
}

static int
hash_ipmac6_uadt(struct ip_set *set, struct nlattr *tb[],
		 enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
{
	ipset_adtfn adtfn = set->variant->adt[adt];
	struct hash_ipmac6_elem e = {
		{ .all = { 0 } },
		{ .foo[0] = 0, .foo[1] = 0 }
	};
	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
	int ret;

	if (unlikely(!tb[IPSET_ATTR_IP] ||
		     !tb[IPSET_ATTR_ETHER] ||
		     nla_len(tb[IPSET_ATTR_ETHER]) != ETH_ALEN ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES)   ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBMARK) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBPRIO) ||
		     !ip_set_optattr_netorder(tb, IPSET_ATTR_SKBQUEUE)))
		return -IPSET_ERR_PROTOCOL;

	if (tb[IPSET_ATTR_LINENO])
		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);

	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip) ||
		ip_set_get_extensions(set, tb, &ext);
	if (ret)
		return ret;

	memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN);
	if (ether_addr_equal(e.ether, invalid_ether))
		return -IPSET_ERR_HASH_ELEM;

	return adtfn(set, &e, &ext, &ext, flags);
}

static struct ip_set_type hash_ipmac_type __read_mostly = {
	.name		= "hash:ip,mac",
	.protocol	= IPSET_PROTOCOL,
	.features	= IPSET_TYPE_IP | IPSET_TYPE_MAC,
	.dimension	= IPSET_DIM_TWO,
	.family		= NFPROTO_UNSPEC,
	.revision_min	= IPSET_TYPE_REV_MIN,
	.revision_max	= IPSET_TYPE_REV_MAX,
	.create		= hash_ipmac_create,
	.create_policy	= {
		[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
		[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
		[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
		[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
		[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },
	},
	.adt_policy	= {
		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
		[IPSET_ATTR_ETHER]	= { .type = NLA_BINARY,
				.len  = ETH_ALEN },
		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },
		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },
		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING },
		[IPSET_ATTR_SKBMARK]	= { .type = NLA_U64 },
		[IPSET_ATTR_SKBPRIO]	= { .type = NLA_U32 },
		[IPSET_ATTR_SKBQUEUE]	= { .type = NLA_U16 },
	},
	.me		= THIS_MODULE,
};

static int __init
hash_ipmac_init(void)
{
	return ip_set_type_register(&hash_ipmac_type);
}

static void __exit
hash_ipmac_fini(void)
{
	ip_set_type_unregister(&hash_ipmac_type);
}

module_init(hash_ipmac_init);
module_exit(hash_ipmac_fini);
Commit	Line	Data
c0db95c7 TC	1	/* Copyright (C) 2016 Tomasz Chilinski <tomasz.chilinski@chilan.com>
	2	*
	3	* This program is free software; you can redistribute it and/or modify
	4	* it under the terms of the GNU General Public License version 2 as
	5	* published by the Free Software Foundation.
	6	*/
	7
	8	/* Kernel module implementing an IP set type: the hash:ip,mac type */
	9
	10	#include <linux/jhash.h>
	11	#include <linux/module.h>
	12	#include <linux/ip.h>
	13	#include <linux/etherdevice.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/errno.h>
	16	#include <linux/random.h>
	17	#include <linux/if_ether.h>
	18	#include <net/ip.h>
	19	#include <net/ipv6.h>
	20	#include <net/netlink.h>
	21	#include <net/tcp.h>
	22
	23	#include <linux/netfilter.h>
	24	#include <linux/netfilter/ipset/pfxlen.h>
	25	#include <linux/netfilter/ipset/ip_set.h>
	26	#include <linux/netfilter/ipset/ip_set_hash.h>
	27
	28	#define IPSET_TYPE_REV_MIN 0
	29	#define IPSET_TYPE_REV_MAX 0
	30
	31	MODULE_LICENSE("GPL");
	32	MODULE_AUTHOR("Tomasz Chilinski <tomasz.chilinski@chilan.com>");
	33	IP_SET_MODULE_DESC("hash:ip,mac", IPSET_TYPE_REV_MIN, IPSET_TYPE_REV_MAX);
	34	MODULE_ALIAS("ip_set_hash:ip,mac");
	35
	36	/* Type specific function prefix */
	37	#define HTYPE hash_ipmac
	38
	39	/* Zero valued element is not supported */
	40	static const unsigned char invalid_ether[ETH_ALEN] = { 0 };
	41
	42	/* IPv4 variant */
	43
	44	/* Member elements */
	45	struct hash_ipmac4_elem {
	46	/* Zero valued IP addresses cannot be stored */
	47	__be32 ip;
	48	union {
	49	unsigned char ether[ETH_ALEN];
	50	__be32 foo[2];
	51	};
	52	};
	53
	54	/* Common functions */
	55
	56	static inline bool
	57	hash_ipmac4_data_equal(const struct hash_ipmac4_elem *e1,
	58	const struct hash_ipmac4_elem *e2,
	59	u32 *multi)
	60	{
	61	return e1->ip == e2->ip && ether_addr_equal(e1->ether, e2->ether);
	62	}
	63
	64	static bool
65	hash_ipmac4_data_list(struct sk_buff skb, const struct hash_ipmac4_elem e)
66	{
67	if (nla_put_ipaddr4(skb, IPSET_ATTR_IP, e->ip) \|\|
68	nla_put(skb, IPSET_ATTR_ETHER, ETH_ALEN, e->ether))
69	goto nla_put_failure;
737d387b	70	return false;
c0db95c7 TC	71
c0db95c7 TC	72	nla_put_failure:
737d387b	73	return true;
c0db95c7 TC	74	}
	75
	76	static inline void
	77	hash_ipmac4_data_next(struct hash_ipmac4_elem *next,
	78	const struct hash_ipmac4_elem *e)
	79	{
	80	next->ip = e->ip;
	81	}
	82
	83	#define MTYPE hash_ipmac4
	84	#define PF 4
	85	#define HOST_MASK 32
	86	#define HKEY_DATALEN sizeof(struct hash_ipmac4_elem)
	87	#include "ip_set_hash_gen.h"
	88
	89	static int
	90	hash_ipmac4_kadt(struct ip_set set, const struct sk_buff skb,
	91	const struct xt_action_param *par,
	92	enum ipset_adt adt, struct ip_set_adt_opt *opt)
	93	{
	94	ipset_adtfn adtfn = set->variant->adt[adt];
	95	struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } };
	96	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
	97
	98	/* MAC can be src only */
	99	if (!(opt->flags & IPSET_DIM_TWO_SRC))
	100	return 0;
	101
	102	if (skb_mac_header(skb) < skb->head \|\|
	103	(skb_mac_header(skb) + ETH_HLEN) > skb->data)
	104	return -EINVAL;
	105
	106	memcpy(e.ether, eth_hdr(skb)->h_source, ETH_ALEN);
	107	if (ether_addr_equal(e.ether, invalid_ether))
	108	return -EINVAL;
	109
	110	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip);
	111
	112	return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
	113	}
	114
	115	static int
	116	hash_ipmac4_uadt(struct ip_set set, struct nlattr tb[],
	117	enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
	118	{
	119	ipset_adtfn adtfn = set->variant->adt[adt];
	120	struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } };
	121	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
	122	int ret;
	123
	124	if (unlikely(!tb[IPSET_ATTR_IP] \|\|
	125	!tb[IPSET_ATTR_ETHER] \|\|
	126	nla_len(tb[IPSET_ATTR_ETHER]) != ETH_ALEN \|\|
	127	!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) \|\|
	128	!ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) \|\|
	129	!ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES) \|\|
	130	!ip_set_optattr_netorder(tb, IPSET_ATTR_SKBMARK) \|\|
	131	!ip_set_optattr_netorder(tb, IPSET_ATTR_SKBPRIO) \|\|
	132	!ip_set_optattr_netorder(tb, IPSET_ATTR_SKBQUEUE)))
	133	return -IPSET_ERR_PROTOCOL;
	134
	135	if (tb[IPSET_ATTR_LINENO])
	136	*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
	137
138	ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP], &e.ip) \|\|
139	ip_set_get_extensions(set, tb, &ext);
140	if (ret)
141	return ret;
142	memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN);
143	if (ether_addr_equal(e.ether, invalid_ether))
144	return -IPSET_ERR_HASH_ELEM;
145
146	return adtfn(set, &e, &ext, &ext, flags);
147	}
148
149	/* IPv6 variant */
150
151	/* Member elements */
152	struct hash_ipmac6_elem {
153	/* Zero valued IP addresses cannot be stored */
154	union nf_inet_addr ip;
155	union {
156	unsigned char ether[ETH_ALEN];
157	__be32 foo[2];
158	};
159	};
160
161	/* Common functions */
162
163	static inline bool
164	hash_ipmac6_data_equal(const struct hash_ipmac6_elem *e1,
165	const struct hash_ipmac6_elem *e2,
166	u32 *multi)
167	{
168	return ipv6_addr_equal(&e1->ip.in6, &e2->ip.in6) &&
169	ether_addr_equal(e1->ether, e2->ether);
170	}
171
172	static bool
173	hash_ipmac6_data_list(struct sk_buff skb, const struct hash_ipmac6_elem e)
174	{
175	if (nla_put_ipaddr6(skb, IPSET_ATTR_IP, &e->ip.in6) \|\|
176	nla_put(skb, IPSET_ATTR_ETHER, ETH_ALEN, e->ether))
177	goto nla_put_failure;
737d387b	178	return false;
c0db95c7 TC	179
c0db95c7 TC	180	nla_put_failure:
737d387b	181	return true;
c0db95c7 TC	182	}
	183
	184	static inline void
	185	hash_ipmac6_data_next(struct hash_ipmac6_elem *next,
	186	const struct hash_ipmac6_elem *e)
	187	{
	188	}
	189
	190	#undef MTYPE
	191	#undef PF
	192	#undef HOST_MASK
	193	#undef HKEY_DATALEN
	194
	195	#define MTYPE hash_ipmac6
	196	#define PF 6
	197	#define HOST_MASK 128
	198	#define HKEY_DATALEN sizeof(struct hash_ipmac6_elem)
	199	#define IP_SET_EMIT_CREATE
	200	#include "ip_set_hash_gen.h"
	201
	202	static int
	203	hash_ipmac6_kadt(struct ip_set set, const struct sk_buff skb,
	204	const struct xt_action_param *par,
	205	enum ipset_adt adt, struct ip_set_adt_opt *opt)
	206	{
	207	ipset_adtfn adtfn = set->variant->adt[adt];
	208	struct hash_ipmac6_elem e = {
	209	{ .all = { 0 } },
	210	{ .foo[0] = 0, .foo[1] = 0 }
	211	};
	212	struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
	213
	214	/* MAC can be src only */
	215	if (!(opt->flags & IPSET_DIM_TWO_SRC))
	216	return 0;
	217
	218	if (skb_mac_header(skb) < skb->head \|\|
	219	(skb_mac_header(skb) + ETH_HLEN) > skb->data)
	220	return -EINVAL;
	221
	222	memcpy(e.ether, eth_hdr(skb)->h_source, ETH_ALEN);
	223	if (ether_addr_equal(e.ether, invalid_ether))
	224	return -EINVAL;
	225
	226	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip.in6);
	227
	228	return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
	229	}
	230
	231	static int
	232	hash_ipmac6_uadt(struct ip_set set, struct nlattr tb[],
	233	enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
	234	{
	235	ipset_adtfn adtfn = set->variant->adt[adt];
	236	struct hash_ipmac6_elem e = {
	237	{ .all = { 0 } },
	238	{ .foo[0] = 0, .foo[1] = 0 }
	239	};
	240	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
	241	int ret;
	242
	243	if (unlikely(!tb[IPSET_ATTR_IP] \|\|
	244	!tb[IPSET_ATTR_ETHER] \|\|
	245	nla_len(tb[IPSET_ATTR_ETHER]) != ETH_ALEN \|\|
246	!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) \|\|
247	!ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) \|\|
248	!ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES) \|\|
249	!ip_set_optattr_netorder(tb, IPSET_ATTR_SKBMARK) \|\|
250	!ip_set_optattr_netorder(tb, IPSET_ATTR_SKBPRIO) \|\|
251	!ip_set_optattr_netorder(tb, IPSET_ATTR_SKBQUEUE)))
252	return -IPSET_ERR_PROTOCOL;
253
254	if (tb[IPSET_ATTR_LINENO])
255	*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
256
257	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &e.ip) \|\|
258	ip_set_get_extensions(set, tb, &ext);
259	if (ret)
260	return ret;
261
262	memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN);
263	if (ether_addr_equal(e.ether, invalid_ether))
264	return -IPSET_ERR_HASH_ELEM;
265
266	return adtfn(set, &e, &ext, &ext, flags);
267	}
268
269	static struct ip_set_type hash_ipmac_type __read_mostly = {
270	.name = "hash:ip,mac",
271	.protocol = IPSET_PROTOCOL,
272	.features = IPSET_TYPE_IP \| IPSET_TYPE_MAC,
273	.dimension = IPSET_DIM_TWO,
274	.family = NFPROTO_UNSPEC,
275	.revision_min = IPSET_TYPE_REV_MIN,
276	.revision_max = IPSET_TYPE_REV_MAX,
277	.create = hash_ipmac_create,
278	.create_policy = {
279	[IPSET_ATTR_HASHSIZE] = { .type = NLA_U32 },
280	[IPSET_ATTR_MAXELEM] = { .type = NLA_U32 },
281	[IPSET_ATTR_PROBES] = { .type = NLA_U8 },
282	[IPSET_ATTR_RESIZE] = { .type = NLA_U8 },
283	[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
284	[IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
285	},
286	.adt_policy = {
287	[IPSET_ATTR_IP] = { .type = NLA_NESTED },
288	[IPSET_ATTR_ETHER] = { .type = NLA_BINARY,
289	.len = ETH_ALEN },
290	[IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
291	[IPSET_ATTR_LINENO] = { .type = NLA_U32 },
292	[IPSET_ATTR_BYTES] = { .type = NLA_U64 },
293	[IPSET_ATTR_PACKETS] = { .type = NLA_U64 },
294	[IPSET_ATTR_COMMENT] = { .type = NLA_NUL_STRING },
295	[IPSET_ATTR_SKBMARK] = { .type = NLA_U64 },
296	[IPSET_ATTR_SKBPRIO] = { .type = NLA_U32 },
297	[IPSET_ATTR_SKBQUEUE] = { .type = NLA_U16 },
298	},
299	.me = THIS_MODULE,
300	};
301
302	static int __init
303	hash_ipmac_init(void)
304	{
305	return ip_set_type_register(&hash_ipmac_type);
306	}
307
308	static void __exit
309	hash_ipmac_fini(void)
310	{
311	ip_set_type_unregister(&hash_ipmac_type);
312	}
313
314	module_init(hash_ipmac_init);
315	module_exit(hash_ipmac_fini);