xref: /openbmc/linux/net/netfilter/xt_set.c (revision 31527da5) 
1 /* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
2  *                         Patrick Schaaf <bof@bof.de>
3  *                         Martin Josefsson <gandalf@wlug.westbo.se>
4  * Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License version 2 as
8  * published by the Free Software Foundation.
9  */
10 
11 /* Kernel module which implements the set match and SET target
12  * for netfilter/iptables.
13  */
14 
15 #include <linux/module.h>
16 #include <linux/skbuff.h>
17 
18 #include <linux/netfilter/x_tables.h>
19 #include <linux/netfilter/ipset/ip_set.h>
20 #include <linux/netfilter/ipset/ip_set_timeout.h>
21 #include <uapi/linux/netfilter/xt_set.h>
22 
23 MODULE_LICENSE("GPL");
24 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
25 MODULE_DESCRIPTION("Xtables: IP set match and target module");
26 MODULE_ALIAS("xt_SET");
27 MODULE_ALIAS("ipt_set");
28 MODULE_ALIAS("ip6t_set");
29 MODULE_ALIAS("ipt_SET");
30 MODULE_ALIAS("ip6t_SET");
31 
32 static inline int
33 match_set(ip_set_id_t index, const struct sk_buff *skb,
34 	  const struct xt_action_param *par,
35 	  struct ip_set_adt_opt *opt, int inv)
36 {
37 	if (ip_set_test(index, skb, par, opt))
38 		inv = !inv;
39 	return inv;
40 }
41 
42 #define ADT_OPT(n, f, d, fs, cfs, t, p, b, po, bo)	\
43 struct ip_set_adt_opt n = {				\
44 	.family	= f,					\
45 	.dim = d,					\
46 	.flags = fs,					\
47 	.cmdflags = cfs,				\
48 	.ext.timeout = t,				\
49 	.ext.packets = p,				\
50 	.ext.bytes = b,					\
51 	.ext.packets_op = po,				\
52 	.ext.bytes_op = bo,				\
53 }
54 
55 /* Revision 0 interface: backward compatible with netfilter/iptables */
56 
57 static bool
58 set_match_v0(const struct sk_buff *skb, struct xt_action_param *par)
59 {
60 	const struct xt_set_info_match_v0 *info = par->matchinfo;
61 
62 	ADT_OPT(opt, xt_family(par), info->match_set.u.compat.dim,
63 		info->match_set.u.compat.flags, 0, UINT_MAX,
64 		0, 0, 0, 0);
65 
66 	return match_set(info->match_set.index, skb, par, &opt,
67 			 info->match_set.u.compat.flags & IPSET_INV_MATCH);
68 }
69 
70 static void
71 compat_flags(struct xt_set_info_v0 *info)
72 {
73 	u_int8_t i;
74 
75 	/* Fill out compatibility data according to enum ip_set_kopt */
76 	info->u.compat.dim = IPSET_DIM_ZERO;
77 	if (info->u.flags[0] & IPSET_MATCH_INV)
78 		info->u.compat.flags |= IPSET_INV_MATCH;
79 	for (i = 0; i < IPSET_DIM_MAX - 1 && info->u.flags[i]; i++) {
80 		info->u.compat.dim++;
81 		if (info->u.flags[i] & IPSET_SRC)
82 			info->u.compat.flags |= (1 << info->u.compat.dim);
83 	}
84 }
85 
86 static int
87 set_match_v0_checkentry(const struct xt_mtchk_param *par)
88 {
89 	struct xt_set_info_match_v0 *info = par->matchinfo;
90 	ip_set_id_t index;
91 
92 	index = ip_set_nfnl_get_byindex(par->net, info->match_set.index);
93 
94 	if (index == IPSET_INVALID_ID) {
95 		pr_info_ratelimited("Cannot find set identified by id %u to match\n",
96 				    info->match_set.index);
97 		return -ENOENT;
98 	}
99 	if (info->match_set.u.flags[IPSET_DIM_MAX - 1] != 0) {
100 		pr_info_ratelimited("set match dimension is over the limit!\n");
101 		ip_set_nfnl_put(par->net, info->match_set.index);
102 		return -ERANGE;
103 	}
104 
105 	/* Fill out compatibility data */
106 	compat_flags(&info->match_set);
107 
108 	return 0;
109 }
110 
111 static void
112 set_match_v0_destroy(const struct xt_mtdtor_param *par)
113 {
114 	struct xt_set_info_match_v0 *info = par->matchinfo;
115 
116 	ip_set_nfnl_put(par->net, info->match_set.index);
117 }
118 
119 /* Revision 1 match */
120 
121 static bool
122 set_match_v1(const struct sk_buff *skb, struct xt_action_param *par)
123 {
124 	const struct xt_set_info_match_v1 *info = par->matchinfo;
125 
126 	ADT_OPT(opt, xt_family(par), info->match_set.dim,
127 		info->match_set.flags, 0, UINT_MAX,
128 		0, 0, 0, 0);
129 
130 	if (opt.flags & IPSET_RETURN_NOMATCH)
131 		opt.cmdflags |= IPSET_FLAG_RETURN_NOMATCH;
132 
133 	return match_set(info->match_set.index, skb, par, &opt,
134 			 info->match_set.flags & IPSET_INV_MATCH);
135 }
136 
137 static int
138 set_match_v1_checkentry(const struct xt_mtchk_param *par)
139 {
140 	struct xt_set_info_match_v1 *info = par->matchinfo;
141 	ip_set_id_t index;
142 
143 	index = ip_set_nfnl_get_byindex(par->net, info->match_set.index);
144 
145 	if (index == IPSET_INVALID_ID) {
146 		pr_info_ratelimited("Cannot find set identified by id %u to match\n",
147 				    info->match_set.index);
148 		return -ENOENT;
149 	}
150 	if (info->match_set.dim > IPSET_DIM_MAX) {
151 		pr_info_ratelimited("set match dimension is over the limit!\n");
152 		ip_set_nfnl_put(par->net, info->match_set.index);
153 		return -ERANGE;
154 	}
155 
156 	return 0;
157 }
158 
159 static void
160 set_match_v1_destroy(const struct xt_mtdtor_param *par)
161 {
162 	struct xt_set_info_match_v1 *info = par->matchinfo;
163 
164 	ip_set_nfnl_put(par->net, info->match_set.index);
165 }
166 
167 /* Revision 3 match */
168 
169 static bool
170 set_match_v3(const struct sk_buff *skb, struct xt_action_param *par)
171 {
172 	const struct xt_set_info_match_v3 *info = par->matchinfo;
173 
174 	ADT_OPT(opt, xt_family(par), info->match_set.dim,
175 		info->match_set.flags, info->flags, UINT_MAX,
176 		info->packets.value, info->bytes.value,
177 		info->packets.op, info->bytes.op);
178 
179 	if (info->packets.op != IPSET_COUNTER_NONE ||
180 	    info->bytes.op != IPSET_COUNTER_NONE)
181 		opt.cmdflags |= IPSET_FLAG_MATCH_COUNTERS;
182 
183 	return match_set(info->match_set.index, skb, par, &opt,
184 			 info->match_set.flags & IPSET_INV_MATCH);
185 }
186 
187 #define set_match_v3_checkentry	set_match_v1_checkentry
188 #define set_match_v3_destroy	set_match_v1_destroy
189 
190 /* Revision 4 match */
191 
192 static bool
193 set_match_v4(const struct sk_buff *skb, struct xt_action_param *par)
194 {
195 	const struct xt_set_info_match_v4 *info = par->matchinfo;
196 
197 	ADT_OPT(opt, xt_family(par), info->match_set.dim,
198 		info->match_set.flags, info->flags, UINT_MAX,
199 		info->packets.value, info->bytes.value,
200 		info->packets.op, info->bytes.op);
201 
202 	if (info->packets.op != IPSET_COUNTER_NONE ||
203 	    info->bytes.op != IPSET_COUNTER_NONE)
204 		opt.cmdflags |= IPSET_FLAG_MATCH_COUNTERS;
205 
206 	return match_set(info->match_set.index, skb, par, &opt,
207 			 info->match_set.flags & IPSET_INV_MATCH);
208 }
209 
210 #define set_match_v4_checkentry	set_match_v1_checkentry
211 #define set_match_v4_destroy	set_match_v1_destroy
212 
213 /* Revision 0 interface: backward compatible with netfilter/iptables */
214 
215 static unsigned int
216 set_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
217 {
218 	const struct xt_set_info_target_v0 *info = par->targinfo;
219 
220 	ADT_OPT(add_opt, xt_family(par), info->add_set.u.compat.dim,
221 		info->add_set.u.compat.flags, 0, UINT_MAX,
222 		0, 0, 0, 0);
223 	ADT_OPT(del_opt, xt_family(par), info->del_set.u.compat.dim,
224 		info->del_set.u.compat.flags, 0, UINT_MAX,
225 		0, 0, 0, 0);
226 
227 	if (info->add_set.index != IPSET_INVALID_ID)
228 		ip_set_add(info->add_set.index, skb, par, &add_opt);
229 	if (info->del_set.index != IPSET_INVALID_ID)
230 		ip_set_del(info->del_set.index, skb, par, &del_opt);
231 
232 	return XT_CONTINUE;
233 }
234 
235 static int
236 set_target_v0_checkentry(const struct xt_tgchk_param *par)
237 {
238 	struct xt_set_info_target_v0 *info = par->targinfo;
239 	ip_set_id_t index;
240 
241 	if (info->add_set.index != IPSET_INVALID_ID) {
242 		index = ip_set_nfnl_get_byindex(par->net, info->add_set.index);
243 		if (index == IPSET_INVALID_ID) {
244 			pr_info_ratelimited("Cannot find add_set index %u as target\n",
245 					    info->add_set.index);
246 			return -ENOENT;
247 		}
248 	}
249 
250 	if (info->del_set.index != IPSET_INVALID_ID) {
251 		index = ip_set_nfnl_get_byindex(par->net, info->del_set.index);
252 		if (index == IPSET_INVALID_ID) {
253 			pr_info_ratelimited("Cannot find del_set index %u as target\n",
254 					    info->del_set.index);
255 			if (info->add_set.index != IPSET_INVALID_ID)
256 				ip_set_nfnl_put(par->net, info->add_set.index);
257 			return -ENOENT;
258 		}
259 	}
260 	if (info->add_set.u.flags[IPSET_DIM_MAX - 1] != 0 ||
261 	    info->del_set.u.flags[IPSET_DIM_MAX - 1] != 0) {
262 		pr_info_ratelimited("SET target dimension over the limit!\n");
263 		if (info->add_set.index != IPSET_INVALID_ID)
264 			ip_set_nfnl_put(par->net, info->add_set.index);
265 		if (info->del_set.index != IPSET_INVALID_ID)
266 			ip_set_nfnl_put(par->net, info->del_set.index);
267 		return -ERANGE;
268 	}
269 
270 	/* Fill out compatibility data */
271 	compat_flags(&info->add_set);
272 	compat_flags(&info->del_set);
273 
274 	return 0;
275 }
276 
277 static void
278 set_target_v0_destroy(const struct xt_tgdtor_param *par)
279 {
280 	const struct xt_set_info_target_v0 *info = par->targinfo;
281 
282 	if (info->add_set.index != IPSET_INVALID_ID)
283 		ip_set_nfnl_put(par->net, info->add_set.index);
284 	if (info->del_set.index != IPSET_INVALID_ID)
285 		ip_set_nfnl_put(par->net, info->del_set.index);
286 }
287 
288 /* Revision 1 target */
289 
290 static unsigned int
291 set_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
292 {
293 	const struct xt_set_info_target_v1 *info = par->targinfo;
294 
295 	ADT_OPT(add_opt, xt_family(par), info->add_set.dim,
296 		info->add_set.flags, 0, UINT_MAX,
297 		0, 0, 0, 0);
298 	ADT_OPT(del_opt, xt_family(par), info->del_set.dim,
299 		info->del_set.flags, 0, UINT_MAX,
300 		0, 0, 0, 0);
301 
302 	if (info->add_set.index != IPSET_INVALID_ID)
303 		ip_set_add(info->add_set.index, skb, par, &add_opt);
304 	if (info->del_set.index != IPSET_INVALID_ID)
305 		ip_set_del(info->del_set.index, skb, par, &del_opt);
306 
307 	return XT_CONTINUE;
308 }
309 
310 static int
311 set_target_v1_checkentry(const struct xt_tgchk_param *par)
312 {
313 	const struct xt_set_info_target_v1 *info = par->targinfo;
314 	ip_set_id_t index;
315 
316 	if (info->add_set.index != IPSET_INVALID_ID) {
317 		index = ip_set_nfnl_get_byindex(par->net, info->add_set.index);
318 		if (index == IPSET_INVALID_ID) {
319 			pr_info_ratelimited("Cannot find add_set index %u as target\n",
320 					    info->add_set.index);
321 			return -ENOENT;
322 		}
323 	}
324 
325 	if (info->del_set.index != IPSET_INVALID_ID) {
326 		index = ip_set_nfnl_get_byindex(par->net, info->del_set.index);
327 		if (index == IPSET_INVALID_ID) {
328 			pr_info_ratelimited("Cannot find del_set index %u as target\n",
329 					    info->del_set.index);
330 			if (info->add_set.index != IPSET_INVALID_ID)
331 				ip_set_nfnl_put(par->net, info->add_set.index);
332 			return -ENOENT;
333 		}
334 	}
335 	if (info->add_set.dim > IPSET_DIM_MAX ||
336 	    info->del_set.dim > IPSET_DIM_MAX) {
337 		pr_info_ratelimited("SET target dimension over the limit!\n");
338 		if (info->add_set.index != IPSET_INVALID_ID)
339 			ip_set_nfnl_put(par->net, info->add_set.index);
340 		if (info->del_set.index != IPSET_INVALID_ID)
341 			ip_set_nfnl_put(par->net, info->del_set.index);
342 		return -ERANGE;
343 	}
344 
345 	return 0;
346 }
347 
348 static void
349 set_target_v1_destroy(const struct xt_tgdtor_param *par)
350 {
351 	const struct xt_set_info_target_v1 *info = par->targinfo;
352 
353 	if (info->add_set.index != IPSET_INVALID_ID)
354 		ip_set_nfnl_put(par->net, info->add_set.index);
355 	if (info->del_set.index != IPSET_INVALID_ID)
356 		ip_set_nfnl_put(par->net, info->del_set.index);
357 }
358 
359 /* Revision 2 target */
360 
361 static unsigned int
362 set_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
363 {
364 	const struct xt_set_info_target_v2 *info = par->targinfo;
365 
366 	ADT_OPT(add_opt, xt_family(par), info->add_set.dim,
367 		info->add_set.flags, info->flags, info->timeout,
368 		0, 0, 0, 0);
369 	ADT_OPT(del_opt, xt_family(par), info->del_set.dim,
370 		info->del_set.flags, 0, UINT_MAX,
371 		0, 0, 0, 0);
372 
373 	/* Normalize to fit into jiffies */
374 	if (add_opt.ext.timeout != IPSET_NO_TIMEOUT &&
375 	    add_opt.ext.timeout > IPSET_MAX_TIMEOUT)
376 		add_opt.ext.timeout = IPSET_MAX_TIMEOUT;
377 	if (info->add_set.index != IPSET_INVALID_ID)
378 		ip_set_add(info->add_set.index, skb, par, &add_opt);
379 	if (info->del_set.index != IPSET_INVALID_ID)
380 		ip_set_del(info->del_set.index, skb, par, &del_opt);
381 
382 	return XT_CONTINUE;
383 }
384 
385 #define set_target_v2_checkentry	set_target_v1_checkentry
386 #define set_target_v2_destroy		set_target_v1_destroy
387 
388 /* Revision 3 target */
389 
390 #define MOPT(opt, member)	((opt).ext.skbinfo.member)
391 
392 static unsigned int
393 set_target_v3(struct sk_buff *skb, const struct xt_action_param *par)
394 {
395 	const struct xt_set_info_target_v3 *info = par->targinfo;
396 	int ret;
397 
398 	ADT_OPT(add_opt, xt_family(par), info->add_set.dim,
399 		info->add_set.flags, info->flags, info->timeout,
400 		0, 0, 0, 0);
401 	ADT_OPT(del_opt, xt_family(par), info->del_set.dim,
402 		info->del_set.flags, 0, UINT_MAX,
403 		0, 0, 0, 0);
404 	ADT_OPT(map_opt, xt_family(par), info->map_set.dim,
405 		info->map_set.flags, 0, UINT_MAX,
406 		0, 0, 0, 0);
407 
408 	/* Normalize to fit into jiffies */
409 	if (add_opt.ext.timeout != IPSET_NO_TIMEOUT &&
410 	    add_opt.ext.timeout > IPSET_MAX_TIMEOUT)
411 		add_opt.ext.timeout = IPSET_MAX_TIMEOUT;
412 	if (info->add_set.index != IPSET_INVALID_ID)
413 		ip_set_add(info->add_set.index, skb, par, &add_opt);
414 	if (info->del_set.index != IPSET_INVALID_ID)
415 		ip_set_del(info->del_set.index, skb, par, &del_opt);
416 	if (info->map_set.index != IPSET_INVALID_ID) {
417 		map_opt.cmdflags |= info->flags & (IPSET_FLAG_MAP_SKBMARK |
418 						   IPSET_FLAG_MAP_SKBPRIO |
419 						   IPSET_FLAG_MAP_SKBQUEUE);
420 		ret = match_set(info->map_set.index, skb, par, &map_opt,
421 				info->map_set.flags & IPSET_INV_MATCH);
422 		if (!ret)
423 			return XT_CONTINUE;
424 		if (map_opt.cmdflags & IPSET_FLAG_MAP_SKBMARK)
425 			skb->mark = (skb->mark & ~MOPT(map_opt,skbmarkmask))
426 				    ^ MOPT(map_opt, skbmark);
427 		if (map_opt.cmdflags & IPSET_FLAG_MAP_SKBPRIO)
428 			skb->priority = MOPT(map_opt, skbprio);
429 		if ((map_opt.cmdflags & IPSET_FLAG_MAP_SKBQUEUE) &&
430 		    skb->dev &&
431 		    skb->dev->real_num_tx_queues > MOPT(map_opt, skbqueue))
432 			skb_set_queue_mapping(skb, MOPT(map_opt, skbqueue));
433 	}
434 	return XT_CONTINUE;
435 }
436 
437 static int
438 set_target_v3_checkentry(const struct xt_tgchk_param *par)
439 {
440 	const struct xt_set_info_target_v3 *info = par->targinfo;
441 	ip_set_id_t index;
442 
443 	if (info->add_set.index != IPSET_INVALID_ID) {
444 		index = ip_set_nfnl_get_byindex(par->net,
445 						info->add_set.index);
446 		if (index == IPSET_INVALID_ID) {
447 			pr_info_ratelimited("Cannot find add_set index %u as target\n",
448 					    info->add_set.index);
449 			return -ENOENT;
450 		}
451 	}
452 
453 	if (info->del_set.index != IPSET_INVALID_ID) {
454 		index = ip_set_nfnl_get_byindex(par->net,
455 						info->del_set.index);
456 		if (index == IPSET_INVALID_ID) {
457 			pr_info_ratelimited("Cannot find del_set index %u as target\n",
458 					    info->del_set.index);
459 			if (info->add_set.index != IPSET_INVALID_ID)
460 				ip_set_nfnl_put(par->net,
461 						info->add_set.index);
462 			return -ENOENT;
463 		}
464 	}
465 
466 	if (info->map_set.index != IPSET_INVALID_ID) {
467 		if (strncmp(par->table, "mangle", 7)) {
468 			pr_info_ratelimited("--map-set only usable from mangle table\n");
469 			return -EINVAL;
470 		}
471 		if (((info->flags & IPSET_FLAG_MAP_SKBPRIO) |
472 		     (info->flags & IPSET_FLAG_MAP_SKBQUEUE)) &&
473 		     (par->hook_mask & ~(1 << NF_INET_FORWARD |
474 					 1 << NF_INET_LOCAL_OUT |
475 					 1 << NF_INET_POST_ROUTING))) {
476 			pr_info_ratelimited("mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains\n");
477 			return -EINVAL;
478 		}
479 		index = ip_set_nfnl_get_byindex(par->net,
480 						info->map_set.index);
481 		if (index == IPSET_INVALID_ID) {
482 			pr_info_ratelimited("Cannot find map_set index %u as target\n",
483 					    info->map_set.index);
484 			if (info->add_set.index != IPSET_INVALID_ID)
485 				ip_set_nfnl_put(par->net,
486 						info->add_set.index);
487 			if (info->del_set.index != IPSET_INVALID_ID)
488 				ip_set_nfnl_put(par->net,
489 						info->del_set.index);
490 			return -ENOENT;
491 		}
492 	}
493 
494 	if (info->add_set.dim > IPSET_DIM_MAX ||
495 	    info->del_set.dim > IPSET_DIM_MAX ||
496 	    info->map_set.dim > IPSET_DIM_MAX) {
497 		pr_info_ratelimited("SET target dimension over the limit!\n");
498 		if (info->add_set.index != IPSET_INVALID_ID)
499 			ip_set_nfnl_put(par->net, info->add_set.index);
500 		if (info->del_set.index != IPSET_INVALID_ID)
501 			ip_set_nfnl_put(par->net, info->del_set.index);
502 		if (info->map_set.index != IPSET_INVALID_ID)
503 			ip_set_nfnl_put(par->net, info->map_set.index);
504 		return -ERANGE;
505 	}
506 
507 	return 0;
508 }
509 
510 static void
511 set_target_v3_destroy(const struct xt_tgdtor_param *par)
512 {
513 	const struct xt_set_info_target_v3 *info = par->targinfo;
514 
515 	if (info->add_set.index != IPSET_INVALID_ID)
516 		ip_set_nfnl_put(par->net, info->add_set.index);
517 	if (info->del_set.index != IPSET_INVALID_ID)
518 		ip_set_nfnl_put(par->net, info->del_set.index);
519 	if (info->map_set.index != IPSET_INVALID_ID)
520 		ip_set_nfnl_put(par->net, info->map_set.index);
521 }
522 
523 static struct xt_match set_matches[] __read_mostly = {
524 	{
525 		.name		= "set",
526 		.family		= NFPROTO_IPV4,
527 		.revision	= 0,
528 		.match		= set_match_v0,
529 		.matchsize	= sizeof(struct xt_set_info_match_v0),
530 		.checkentry	= set_match_v0_checkentry,
531 		.destroy	= set_match_v0_destroy,
532 		.me		= THIS_MODULE
533 	},
534 	{
535 		.name		= "set",
536 		.family		= NFPROTO_IPV4,
537 		.revision	= 1,
538 		.match		= set_match_v1,
539 		.matchsize	= sizeof(struct xt_set_info_match_v1),
540 		.checkentry	= set_match_v1_checkentry,
541 		.destroy	= set_match_v1_destroy,
542 		.me		= THIS_MODULE
543 	},
544 	{
545 		.name		= "set",
546 		.family		= NFPROTO_IPV6,
547 		.revision	= 1,
548 		.match		= set_match_v1,
549 		.matchsize	= sizeof(struct xt_set_info_match_v1),
550 		.checkentry	= set_match_v1_checkentry,
551 		.destroy	= set_match_v1_destroy,
552 		.me		= THIS_MODULE
553 	},
554 	/* --return-nomatch flag support */
555 	{
556 		.name		= "set",
557 		.family		= NFPROTO_IPV4,
558 		.revision	= 2,
559 		.match		= set_match_v1,
560 		.matchsize	= sizeof(struct xt_set_info_match_v1),
561 		.checkentry	= set_match_v1_checkentry,
562 		.destroy	= set_match_v1_destroy,
563 		.me		= THIS_MODULE
564 	},
565 	{
566 		.name		= "set",
567 		.family		= NFPROTO_IPV6,
568 		.revision	= 2,
569 		.match		= set_match_v1,
570 		.matchsize	= sizeof(struct xt_set_info_match_v1),
571 		.checkentry	= set_match_v1_checkentry,
572 		.destroy	= set_match_v1_destroy,
573 		.me		= THIS_MODULE
574 	},
575 	/* counters support: update, match */
576 	{
577 		.name		= "set",
578 		.family		= NFPROTO_IPV4,
579 		.revision	= 3,
580 		.match		= set_match_v3,
581 		.matchsize	= sizeof(struct xt_set_info_match_v3),
582 		.checkentry	= set_match_v3_checkentry,
583 		.destroy	= set_match_v3_destroy,
584 		.me		= THIS_MODULE
585 	},
586 	{
587 		.name		= "set",
588 		.family		= NFPROTO_IPV6,
589 		.revision	= 3,
590 		.match		= set_match_v3,
591 		.matchsize	= sizeof(struct xt_set_info_match_v3),
592 		.checkentry	= set_match_v3_checkentry,
593 		.destroy	= set_match_v3_destroy,
594 		.me		= THIS_MODULE
595 	},
596 	/* new revision for counters support: update, match */
597 	{
598 		.name		= "set",
599 		.family		= NFPROTO_IPV4,
600 		.revision	= 4,
601 		.match		= set_match_v4,
602 		.matchsize	= sizeof(struct xt_set_info_match_v4),
603 		.checkentry	= set_match_v4_checkentry,
604 		.destroy	= set_match_v4_destroy,
605 		.me		= THIS_MODULE
606 	},
607 	{
608 		.name		= "set",
609 		.family		= NFPROTO_IPV6,
610 		.revision	= 4,
611 		.match		= set_match_v4,
612 		.matchsize	= sizeof(struct xt_set_info_match_v4),
613 		.checkentry	= set_match_v4_checkentry,
614 		.destroy	= set_match_v4_destroy,
615 		.me		= THIS_MODULE
616 	},
617 };
618 
619 static struct xt_target set_targets[] __read_mostly = {
620 	{
621 		.name		= "SET",
622 		.revision	= 0,
623 		.family		= NFPROTO_IPV4,
624 		.target		= set_target_v0,
625 		.targetsize	= sizeof(struct xt_set_info_target_v0),
626 		.checkentry	= set_target_v0_checkentry,
627 		.destroy	= set_target_v0_destroy,
628 		.me		= THIS_MODULE
629 	},
630 	{
631 		.name		= "SET",
632 		.revision	= 1,
633 		.family		= NFPROTO_IPV4,
634 		.target		= set_target_v1,
635 		.targetsize	= sizeof(struct xt_set_info_target_v1),
636 		.checkentry	= set_target_v1_checkentry,
637 		.destroy	= set_target_v1_destroy,
638 		.me		= THIS_MODULE
639 	},
640 	{
641 		.name		= "SET",
642 		.revision	= 1,
643 		.family		= NFPROTO_IPV6,
644 		.target		= set_target_v1,
645 		.targetsize	= sizeof(struct xt_set_info_target_v1),
646 		.checkentry	= set_target_v1_checkentry,
647 		.destroy	= set_target_v1_destroy,
648 		.me		= THIS_MODULE
649 	},
650 	/* --timeout and --exist flags support */
651 	{
652 		.name		= "SET",
653 		.revision	= 2,
654 		.family		= NFPROTO_IPV4,
655 		.target		= set_target_v2,
656 		.targetsize	= sizeof(struct xt_set_info_target_v2),
657 		.checkentry	= set_target_v2_checkentry,
658 		.destroy	= set_target_v2_destroy,
659 		.me		= THIS_MODULE
660 	},
661 	{
662 		.name		= "SET",
663 		.revision	= 2,
664 		.family		= NFPROTO_IPV6,
665 		.target		= set_target_v2,
666 		.targetsize	= sizeof(struct xt_set_info_target_v2),
667 		.checkentry	= set_target_v2_checkentry,
668 		.destroy	= set_target_v2_destroy,
669 		.me		= THIS_MODULE
670 	},
671 	/* --map-set support */
672 	{
673 		.name		= "SET",
674 		.revision	= 3,
675 		.family		= NFPROTO_IPV4,
676 		.target		= set_target_v3,
677 		.targetsize	= sizeof(struct xt_set_info_target_v3),
678 		.checkentry	= set_target_v3_checkentry,
679 		.destroy	= set_target_v3_destroy,
680 		.me		= THIS_MODULE
681 	},
682 	{
683 		.name		= "SET",
684 		.revision	= 3,
685 		.family		= NFPROTO_IPV6,
686 		.target		= set_target_v3,
687 		.targetsize	= sizeof(struct xt_set_info_target_v3),
688 		.checkentry	= set_target_v3_checkentry,
689 		.destroy	= set_target_v3_destroy,
690 		.me		= THIS_MODULE
691 	},
692 };
693 
694 static int __init xt_set_init(void)
695 {
696 	int ret = xt_register_matches(set_matches, ARRAY_SIZE(set_matches));
697 
698 	if (!ret) {
699 		ret = xt_register_targets(set_targets,
700 					  ARRAY_SIZE(set_targets));
701 		if (ret)
702 			xt_unregister_matches(set_matches,
703 					      ARRAY_SIZE(set_matches));
704 	}
705 	return ret;
706 }
707 
708 static void __exit xt_set_fini(void)
709 {
710 	xt_unregister_matches(set_matches, ARRAY_SIZE(set_matches));
711 	xt_unregister_targets(set_targets, ARRAY_SIZE(set_targets));
712 }
713 
714 module_init(xt_set_init);
715 module_exit(xt_set_fini);
716