Xtables-addons 1.37

Remove mention of netcat from the libxt_SYSRQ manpage.

INSTALL

@@ -22,7 +22,7 @@ Supported configurations for this release
 	  - CONFIG_CONNECTOR y/m if you wish to receive userspace
 	    notifications from pknock through netlink/connector
 
-For ipset-5 you need:
+For ipset-6 you need:
 
 	* libmnl
 

README

@@ -19,7 +19,7 @@ simplified, and sped up.
 Included in this package
 ========================
 - ipset 4.5
-- ipset 5.4.1
+- ipset 6.7-genl
 - xt_ACCOUNT 1.16, libxt_ACCOUNT 1.3
 
 

configure.ac

@@ -1,5 +1,4 @@
-
-AC_INIT([xtables-addons], [1.34])
+AC_INIT([xtables-addons], [1.37])
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
 AC_PROG_INSTALL
@@ -42,7 +41,7 @@ regular_CFLAGS="-Wall -Waggregate-return -Wmissing-declarations \
 
 if test -n "$kbuilddir"; then
 	AC_MSG_CHECKING([kernel version that we will build against])
-	krel="$(make -sC "$kbuilddir" M=. kernelrelease)";
+	krel="$(make -sC "$kbuilddir" M=$PWD kernelrelease)";
 	kmajor="${krel%%[[^0-9]]*}";
 	kmajor="$(($kmajor+0))";
 	krel="${krel:${#kmajor}}";
@@ -61,19 +60,14 @@ if test -n "$kbuilddir"; then
 		echo "WARNING: Version detection did not succeed. Continue at own luck.";
 	else
 		echo "$kmajor.$kminor.$kmicro.$kstable in $kbuilddir";
-		if test "$kmajor" -gt 2 -o "$kminor" -gt 6 -o "$kmicro" -gt 38; then
+		if test "$kmajor" -gt 3 -o "$kmajor" -eq 3 -a "$kminor" -gt 1; then
 			echo "WARNING: You are trying a newer kernel. Results may vary. :-)";
+		elif test "$kmajor" -eq 3; then
+			:;
 		elif test "$kmajor" -eq 2 -a "$kminor" -eq 6 -a "$kmicro" -ge 29; then
-			:; # everything ok
-		elif test \( "$kmajor" -lt 2 -o \
-		    \( "$kmajor" -eq 2 -a "$kminor" -lt 6 \) -o \
-		    \( "$kmajor" -eq 2 -a "$kminor" -eq 0 -a "$kmicro" -lt 17 \) -o \
-		    \( "$kmajor" -eq 2 -a "$kminor" -eq 6 -a "$kmicro" -eq 18 -a \
-		    "$kstable" -lt 5 \) \); then
-			echo "ERROR: That kernel version is not supported at all. Please see INSTALL for minimum configuration.";
-			exit 1;
+			:;
 		else
-			echo "WARNING: That kernel version has been recently deprecated for use with Xtables-addons). Compilation may fail.";
+			echo "WARNING: That kernel version is not supported.";
 		fi;
 	fi;
 fi;
@@ -84,6 +78,6 @@ AC_SUBST([kbuilddir])
 AC_SUBST([xtlibdir])
 AC_CONFIG_FILES([Makefile Makefile.iptrules Makefile.mans geoip/Makefile
 	extensions/Makefile extensions/ACCOUNT/Makefile
-	extensions/ipset-4/Makefile extensions/ipset-5/Makefile
+	extensions/ipset-4/Makefile extensions/ipset-6/Makefile
 	extensions/pknock/Makefile])
 AC_OUTPUT

doc/changelog.txt

@@ -3,6 +3,38 @@ HEAD
 ====
 
 
+v1.37 (2011-06-25)
+==================
+Fixes:
+- xt_SYSRQ: make IPv6 trigger work again
+- xt_SYSRQ: improve security: include host address in digest
+- xt_TARPIT: fix a kernel oops in --reset mode
+
+
+v1.36 (2011-06-03)
+==================
+Changes:
+- xt_geoip: avoid recursive function calls
+- xt_TARPIT: unlock for use in all tables
+- xt_TARPIT: honeypot and reset modes
+- update to ipset 6.7
+- support for Linux 3.0
+
+
+v1.35 (2011-04-11)
+==================
+Enhancements:
+- update to ipset 6.3
+  * allow "new" as a commad alias to "create"
+  * resolving IP addresses did not work at listing/saving sets, fixed
+  * check ICMP and ICMPv6 with the set match and target in the testsuite
+  * avoid possible syntax clashing at saving hostnames
+  * fix linking with CONFIG_IPV6=n
+  * sctp, udplite support for the hash:*port* types
+- ipset-genl: handle EAGAIN return value emitted from autoloader
+- ipset-genl: resolve nfgenmsg remains and fix spurious protocol abort
+
+
 v1.34 (2011-04-07)
 ==================
 Fixes:

extensions/ACCOUNT/Makefile.am

@@ -9,3 +9,5 @@ sbin_PROGRAMS = iptaccount
 iptaccount_LDADD = libxt_ACCOUNT_cl.la
 
 lib_LTLIBRARIES = libxt_ACCOUNT_cl.la
+
+man_MANS = iptaccount.8

extensions/ACCOUNT/iptaccount.8

@@ -0,0 +1,26 @@
+.TH iptaccount 8 "v1.16" "" "v1.16"
+.SH Name
+iptaccount \(em administrative utility to access xt_ACCOUNT statistics
+.SH Syntax
+\fBiptaccount\fP [\fB\-acfhu\fP] [\fB\-l\fP \fIname\fP]
+.SH Options
+.PP
+\fB\-a\fP
+List all (accounting) table names.
+.PP
+\fB\-c\fP
+Loop every second (abort with CTRL+C).
+.PP
+\fB\-f\fP
+Flush data after display.
+.PP
+\fB\-h\fP
+Free all kernel handles. (Experts only!)
+.PP
+\fB\-l\fP \fIname\fP
+Show data in accounting table called by \fIname\fP.
+.TP
+\fB\-u\fP
+Show kernel handle usage.
+.SH "See also"
+\fBxtables-addons\fP(8)

extensions/ACCOUNT/libxt_ACCOUNT.man

@@ -40,19 +40,7 @@ to account the overall traffic to/from your internet provider.
 .PP
 The data can be queried using the userspace libxt_ACCOUNT_cl library,
 and by the reference implementation to show usage of this library,
-the \fBiptaccount\fP(8) tool, which features following options:
-.PP
-[\fB\-u\fP] show kernel handle usage
-.PP
-[\fB\-h\fP] free all kernel handles (experts only!)
-.PP
-[\fB\-a\fP] list all table names
-.PP
-[\fB\-l\fP \fIname\fP] show data in table \fIname\fP
-.PP
-[\fB\-f\fP] flush data after showing
-.PP
-[\fB\-c\fP] loop every second (abort with CTRL+C)
+the \fBiptaccount\fP(8) tool.
 .PP
 Here is an example of use:
 .PP

extensions/Kbuild

@@ -28,7 +28,7 @@ obj-${build_geoip}       += xt_geoip.o
 obj-${build_iface}       += xt_iface.o
 obj-${build_ipp2p}       += xt_ipp2p.o
 obj-${build_ipset4}      += ipset-4/
-obj-${build_ipset5}      += ipset-5/
+obj-${build_ipset6}      += ipset-6/
 obj-${build_ipv4options} += xt_ipv4options.o
 obj-${build_length2}     += xt_length2.o
 obj-${build_lscan}       += xt_lscan.o

extensions/Mbuild

@@ -20,7 +20,7 @@ obj-${build_geoip}       += libxt_geoip.so
 obj-${build_iface}       += libxt_iface.so
 obj-${build_ipp2p}       += libxt_ipp2p.so
 obj-${build_ipset4}      += ipset-4/
-obj-${build_ipset5}      += ipset-5/
+obj-${build_ipset6}      += ipset-6/
 obj-${build_ipv4options} += libxt_ipv4options.so
 obj-${build_length2}     += libxt_length2.so
 obj-${build_lscan}       += libxt_lscan.so

extensions/ipset-5/ip_set_getport.h

@@ -1,11 +0,0 @@
-#ifndef _IP_SET_GETPORT_H
-#define _IP_SET_GETPORT_H
-
-extern bool ip_set_get_ip4_port(const struct sk_buff *skb, bool src,
-				__be16 *port, u8 *proto);
-extern bool ip_set_get_ip6_port(const struct sk_buff *skb, bool src,
-				__be16 *port, u8 *proto);
-extern bool ip_set_get_ip_port(const struct sk_buff *skb, u8 pf, bool src,
-				__be16 *port);
-
-#endif /*_IP_SET_GETPORT_H*/

extensions/ipset-5/slist.h

@@ -1,89 +0,0 @@
-#ifndef _IP_SET_SLIST_H
-#define _IP_SET_SLIST_H
-
-#include <linux/stddef.h>
-#include <linux/prefetch.h>
-#include <asm/system.h>
-
-/*
- * Single linked lists with a single pointer.
- * Mostly useful for hash tables where the two pointer list head
- * and list node is too wasteful.
- */
-
-struct slist {
-	struct slist *next;
-};
-
-#define SLIST(name) struct slist name = {  .next = NULL }
-#define INIT_SLIST(ptr) ((ptr)->next = NULL)
-
-#define slist_entry(ptr, type, member) container_of(ptr, type, member)
-
-#define slist_for_each(pos, head) \
-	for (pos = (head)->next; pos && ({ prefetch(pos->next); 1; }); \
-	     pos = pos->next)
-
-#define slist_for_each_prev(prev, pos, head) \
-	for (prev = head, pos = (head)->next; \
-	     pos && ({ prefetch(pos->next); 1; }); \
-	     prev = pos, pos = pos->next)
-
-#define slist_for_each_safe(pos, n, head) \
-	for (pos = (head)->next; pos && ({ n = pos->next; 1; }); \
-	     pos = n)
-
-/**
- * slist_for_each_entry	- iterate over list of given type
- * @tpos:	the type * to use as a loop cursor.
- * @pos:	the &struct slist to use as a loop cursor.
- * @head:	the head for your list.
- * @member:	the name of the slist within the struct.
- */
-#define slist_for_each_entry(tpos, pos, head, member)			 \
-	for (pos = (head)->next;					 \
-	     pos && ({ prefetch(pos->next); 1; }) &&			 \
-		({ tpos = slist_entry(pos, typeof(*tpos), member); 1; });\
-	     pos = pos->next)
-
-/**
- * slist_for_each_entry_continue - iterate over a hlist continuing
- *				   after current point
- * @tpos:	the type * to use as a loop cursor.
- * @pos:	the &struct slist to use as a loop cursor.
- * @member:	the name of the slist within the struct.
- */
-#define slist_for_each_entry_continue(tpos, pos, member)		 \
-	for (pos = (pos)->next;						 \
-	     pos && ({ prefetch(pos->next); 1; }) &&			 \
-		({ tpos = slist_entry(pos, typeof(*tpos), member); 1; });\
-	     pos = pos->next)
-
-/**
- * slist_for_each_entry_from - iterate over a hlist continuing
- *			       from current point
- * @tpos:	the type * to use as a loop cursor.
- * @pos:	the &struct slist to use as a loop cursor.
- * @member:	the name of the slist within the struct.
- */
-#define slist_for_each_entry_from(tpos, pos, member)			 \
-	for (; pos && ({ prefetch(pos->next); 1; }) &&			 \
-		({ tpos = slist_entry(pos, typeof(*tpos), member); 1; });\
-	     pos = pos->next)
-
-/**
- * slist_for_each_entry_safe - iterate over list of given type safe against
- *			       removal of list entry
- * @tpos:	the type * to use as a loop cursor.
- * @pos:	the &struct slist to use as a loop cursor.
- * @n:		another &struct slist to use as temporary storage
- * @head:	the head for your list.
- * @member:	the name of the slist within the struct.
- */
-#define slist_for_each_entry_safe(tpos, pos, n, head, member)		\
-	for (pos = (head)->next;					\
-	     pos && ({ n = pos->next; 1; }) &&				\
-		({ tpos = slist_entry(pos, typeof(*tpos), member); 1; });\
-	     pos = n)
-
-#endif /* _IP_SET_SLIST_H */

extensions/ipset-6/Kbuild

@@ -4,7 +4,7 @@ obj-m += xt_set.o
 obj-m += ip_set.o ip_set_bitmap_ip.o ip_set_bitmap_ipmac.o
 obj-m += ip_set_bitmap_port.o ip_set_hash_ip.o ip_set_hash_ipport.o
 obj-m += ip_set_hash_ipportip.o ip_set_hash_ipportnet.o ip_set_hash_net.o
-obj-m += ip_set_hash_netport.o ip_set_list_set.o
+obj-m += ip_set_hash_netiface.o ip_set_hash_netport.o ip_set_list_set.o
 
 ip_set-y := ip_set_core.o ip_set_getport.o pfxlen.o
 

extensions/ipset-6/Makefile.am

@@ -17,8 +17,9 @@ ipset_SOURCES = src/ipset.c src/errcode.c src/ui.c src/ipset_bitmap_ip.c \
                 src/ipset_bitmap_ipmac.c src/ipset_bitmap_port.c \
                 src/ipset_hash_ip.c src/ipset_hash_ipport.c \
                 src/ipset_hash_ipportip.c src/ipset_hash_ipportnet.c \
-                src/ipset_hash_net.c src/ipset_hash_netport.c \
+                src/ipset_hash_net.c src/ipset_hash_netiface.c \
+                src/ipset_hash_netport.c \
                 src/ipset_list_set.c
 ipset_LDADD   = libipset.la
 
-man_MANS      = ipset.8
+man_MANS      = src/ipset.8

extensions/ipset-6/README

@@ -0,0 +1,88 @@
+This is the ipset source tree. Follow the next steps to install ipset.
+If you upgrade from an earlier 5.x release, please read the UPGRADE
+instructions too.
+
+0. You need the source tree of your kernel (version >= 2.6.34)
+   and it have to be configured with ip6tables support enabled,
+   modules compiled. Please apply the netlink.patch against your kernel
+   tree, which adds the new subsystem identifier for ipset.
+
+   Recompile and install the patched kernel and its modules. Please note,
+   you have to run the patched kernel for ipset to work.
+
+   The ipset source code depends on the libmnl library so the library
+   must be installed. You can download the libmnl library from
+
+	git://git.netfilter.org/libmnl.git
+
+1. Initialize the compiling environment for ipset. The packages automake,
+   autoconf and libtool are required.
+
+   % ./autogen.sh
+
+2. Run `./configure` and then compile the ipset binary and the kernel
+   modules.
+
+   Configure parameters can be used to to override the default path
+   to the kernel source tree (/lib/modules/`uname -r`/build),
+   the maximum number of sets (256), the default hash sizes (1024).
+   See `./configure --help`.
+
+   % ./configure
+   % make
+   % make modules
+
+3. Install the binary and the kernel modules
+
+   # make install
+   # make modules_install
+
+   After installing the modules, you can run the testsuite as well.
+   Please note, several assumptions must be met for the testsuite:
+
+	- no sets defined
+	- iptables/ip6tables rules are not set up
+	- the destination for kernel logs is /var/log/kern.log
+	- the networks 10.255.255.0/24 and 1002:1002:1002:1002::/64
+	  are not in use
+	- sendip utility is installed
+
+   # make tests
+
+4. Cleanup the source tree
+
+   % make clean
+   % make modules_clean
+
+That's it! 
+
+Read the ipset(8) and iptables(8), ip6tables(8) manpages on how to use
+ipset and its match and target from iptables.
+
+Compatibilities and incompatibilities:
+
+- The ipset 6.x userspace utility contains a backward compatibility
+  interface to support the commandline syntax of ipset 4.x.
+  The commandline syntax of ipset 6.x is fully compatible with 5.x.
+- The ipset 6.x userspace utility can't talk to the kernel part of ipset 5.x
+  or 4.x.
+- The ipset 6.x kernel part can't talk to the userspace utility from
+  ipset 5.x or 4.x.
+- The ipset 6.x kernel part can work together with the set match and SET
+  target from iptables 1.4.7 and below, however if you need the IPv6 support
+  from ipset 6.x, then you have to use iptables 1.4.8 or above.
+
+The ipset 6.x can interpret the commandline syntax of ipset 4.x, however
+some internal changes mean different behaviour:
+
+- The "--matchunset" flag for the macipmap type is ignored and not used
+  anymore.
+- The "--probes" and "--resize" parameters of the hash types are ignored
+  and not used anymore.
+- The "--from", "--to" and "--network" parameters of the ipporthash,
+  ipportiphash and ipportnethash types are ignored and not used anymore.
+- The hash types are not resized when new entries are added by the SET
+  target. If you use a set together with the SET target, create it with
+  the proper size because it won't be resized automatically.
+- The iptree, iptreemap types are not implemented in ipset 6.x. The types
+  are automatically substituted with the hash:ip type.

extensions/ipset-6/include/libipset/data.h

@@ -44,12 +44,15 @@ enum ipset_opt {
 	IPSET_OPT_NAMEREF,
 	IPSET_OPT_IP2,
 	IPSET_OPT_CIDR2,
+	IPSET_OPT_IP2_TO,
 	IPSET_OPT_PROTO,
+	IPSET_OPT_IFACE,
 	/* Swap/rename to */
 	IPSET_OPT_SETNAME2,
 	/* Flags */
 	IPSET_OPT_EXIST,
 	IPSET_OPT_BEFORE,
+	IPSET_OPT_PHYSDEV,
 	/* Internal options */
 	IPSET_OPT_FLAGS = 48,	/* IPSET_FLAG_EXIST| */
 	IPSET_OPT_CADT_FLAGS,	/* IPSET_FLAG_BEFORE| */
@@ -65,7 +68,7 @@ enum ipset_opt {
 #define IPSET_FLAGS_ALL		(~0LL)
 
 #define IPSET_CREATE_FLAGS		\
-	( IPSET_FLAG(IPSET_OPT_FAMILY)	\
+	(IPSET_FLAG(IPSET_OPT_FAMILY)	\
 	| IPSET_FLAG(IPSET_OPT_TYPENAME)\
 	| IPSET_FLAG(IPSET_OPT_TYPE)	\
 	| IPSET_FLAG(IPSET_OPT_IP)	\
@@ -83,7 +86,7 @@ enum ipset_opt {
 	| IPSET_FLAG(IPSET_OPT_SIZE))
 
 #define IPSET_ADT_FLAGS			\
-	( IPSET_FLAG(IPSET_OPT_IP)	\
+	(IPSET_FLAG(IPSET_OPT_IP)	\
 	| IPSET_FLAG(IPSET_OPT_IP_TO)	\
 	| IPSET_FLAG(IPSET_OPT_CIDR)	\
 	| IPSET_FLAG(IPSET_OPT_PORT)	\
@@ -95,8 +98,10 @@ enum ipset_opt {
 	| IPSET_FLAG(IPSET_OPT_IP2)	\
 	| IPSET_FLAG(IPSET_OPT_CIDR2)	\
 	| IPSET_FLAG(IPSET_OPT_PROTO)	\
+	| IPSET_FLAG(IPSET_OPT_IFACE) \
 	| IPSET_FLAG(IPSET_OPT_CADT_FLAGS)\
-	| IPSET_FLAG(IPSET_OPT_BEFORE))
+	| IPSET_FLAG(IPSET_OPT_BEFORE) \
+	| IPSET_FLAG(IPSET_OPT_PHYSDEV))
 
 struct ipset_data;
 
@@ -109,7 +114,7 @@ extern bool ipset_data_ignored(struct ipset_data *data, enum ipset_opt opt);
 
 extern int ipset_data_set(struct ipset_data *data, enum ipset_opt opt,
 			  const void *value);
-extern const void * ipset_data_get(const struct ipset_data *data,
+extern const void *ipset_data_get(const struct ipset_data *data,
 				  enum ipset_opt opt);
 
 static inline bool
@@ -119,13 +124,13 @@ ipset_data_test(const struct ipset_data *data, enum ipset_opt opt)
 }
 
 /* Shortcuts */
-extern const char * ipset_data_setname(const struct ipset_data *data);
+extern const char *ipset_data_setname(const struct ipset_data *data);
 extern uint8_t ipset_data_family(const struct ipset_data *data);
 extern uint8_t ipset_data_cidr(const struct ipset_data *data);
 extern uint64_t ipset_data_flags(const struct ipset_data *data);
 
 extern void ipset_data_reset(struct ipset_data *data);
-extern struct ipset_data * ipset_data_init(void);
+extern struct ipset_data *ipset_data_init(void);
 extern void ipset_data_fini(struct ipset_data *data);
 
 extern size_t ipset_data_sizeof(enum ipset_opt opt, uint8_t family);

extensions/ipset-6/include/libipset/debug.h

@@ -12,7 +12,7 @@
 #include <sys/socket.h>
 #include <linux/netlink.h>
 #define D(fmt, args...) \
-	fprintf(stderr, "%s: %s: " fmt "\n", __FILE__, __FUNCTION__ , ## args)
+	fprintf(stderr, "%s: %s: " fmt "\n", __FILE__, __func__ , ## args)
 #define IF_D(test, fmt, args...) \
 	if (test)		 \
 		D(fmt , ## args)

extensions/ipset-6/include/libipset/icmp.h

@@ -9,8 +9,8 @@
 
 #include <stdint.h>				/* uintxx_t */
 
-extern const char * id_to_icmp(uint8_t id);
-extern const char * icmp_to_name(uint8_t type, uint8_t code);
+extern const char *id_to_icmp(uint8_t id);
+extern const char *icmp_to_name(uint8_t type, uint8_t code);
 extern int name_to_icmp(const char *str, uint16_t *typecode);
 
 #endif /* LIBIPSET_ICMP_H */

extensions/ipset-6/include/libipset/icmpv6.h

@@ -9,8 +9,8 @@
 
 #include <stdint.h>				/* uintxx_t */
 
-extern const char * id_to_icmpv6(uint8_t id);
-extern const char * icmpv6_to_name(uint8_t type, uint8_t code);
+extern const char *id_to_icmpv6(uint8_t id);
+extern const char *icmpv6_to_name(uint8_t type, uint8_t code);
 extern int name_to_icmpv6(const char *str, uint16_t *typecode);
 
 #endif /* LIBIPSET_ICMPV6_H */

extensions/ipset-6/include/libipset/linux_ip_set.h

@@ -4,7 +4,7 @@
 /* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
  *                         Patrick Schaaf <bof@bof.de>
  *                         Martin Josefsson <gandalf@wlug.westbo.se>
- * Copyright (C) 2003-2010 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+ * Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -12,7 +12,7 @@
  */
 
 /* The protocol version */
-#define IPSET_PROTOCOL		5
+#define IPSET_PROTOCOL		0x60
 
 /* The max length of strings including NUL: set and type identifiers */
 #define IPSET_MAXNAMELEN	32
@@ -104,6 +104,8 @@ enum {
 	IPSET_ATTR_NAMEREF,
 	IPSET_ATTR_IP2,
 	IPSET_ATTR_CIDR2,
+	IPSET_ATTR_IP2_TO,
+	IPSET_ATTR_IFACE,
 	__IPSET_ATTR_ADT_MAX,
 };
 #define IPSET_ATTR_ADT_MAX	(__IPSET_ATTR_ADT_MAX - 1)
@@ -118,7 +120,7 @@ enum {
 
 /* Error codes */
 enum ipset_errno {
-	IPSET_ERR_PRIVATE = 128,
+	IPSET_ERR_PRIVATE = 4096,
 	IPSET_ERR_PROTOCOL,
 	IPSET_ERR_FIND_TYPE,
 	IPSET_ERR_MAX_SETS,
@@ -135,19 +137,25 @@ enum ipset_errno {
 	IPSET_ERR_IPADDR_IPV6,
 
 	/* Type specific error codes */
-	IPSET_ERR_TYPE_SPECIFIC = 160,
+	IPSET_ERR_TYPE_SPECIFIC = 4352,
 };
 
 /* Flags at command level */
 enum ipset_cmd_flags {
 	IPSET_FLAG_BIT_EXIST	= 0,
 	IPSET_FLAG_EXIST	= (1 << IPSET_FLAG_BIT_EXIST),
+	IPSET_FLAG_BIT_LIST_SETNAME = 1,
+	IPSET_FLAG_LIST_SETNAME	= (1 << IPSET_FLAG_BIT_LIST_SETNAME),
+	IPSET_FLAG_BIT_LIST_HEADER = 2,
+	IPSET_FLAG_LIST_HEADER	= (1 << IPSET_FLAG_BIT_LIST_HEADER),
 };
 
 /* Flags at CADT attribute level */
 enum ipset_cadt_flags {
 	IPSET_FLAG_BIT_BEFORE	= 0,
 	IPSET_FLAG_BEFORE	= (1 << IPSET_FLAG_BIT_BEFORE),
+	IPSET_FLAG_BIT_PHYSDEV	= 1,
+	IPSET_FLAG_PHYSDEV	= (1 << IPSET_FLAG_BIT_PHYSDEV),
 };
 
 /* Commands with settype-specific attributes */

extensions/ipset-6/include/libipset/linux_ip_set_hash.h

@@ -11,6 +11,10 @@ enum {
 	IPSET_ERR_INVALID_PROTO,
 	/* Protocol missing but must be specified */
 	IPSET_ERR_MISSING_PROTO,
+	/* Range not supported */
+	IPSET_ERR_HASH_RANGE_UNSUPPORTED,
+	/* Invalid range */
+	IPSET_ERR_HASH_RANGE,
 };
 
 #endif /* __IP_SET_HASH_H */

extensions/ipset-6/include/libipset/parse.h

@@ -17,6 +17,7 @@
 #define IPSET_PROTO_SEPARATOR	":"
 
 struct ipset_session;
+struct ipset_arg;
 
 typedef int (*ipset_parsefn)(struct ipset_session *s,
 			     enum ipset_opt opt, const char *str);
@@ -59,6 +60,8 @@ extern int ipset_parse_ipnet(struct ipset_session *session,
 			     enum ipset_opt opt, const char *str);
 extern int ipset_parse_ip4_single6(struct ipset_session *session,
 				enum ipset_opt opt, const char *str);
+extern int ipset_parse_ip4_net6(struct ipset_session *session,
+				enum ipset_opt opt, const char *str);
 extern int ipset_parse_name(struct ipset_session *session,
 			    enum ipset_opt opt, const char *str);
 extern int ipset_parse_before(struct ipset_session *session,
@@ -77,6 +80,8 @@ extern int ipset_parse_flag(struct ipset_session *session,
 			    enum ipset_opt opt, const char *str);
 extern int ipset_parse_typename(struct ipset_session *session,
 				enum ipset_opt opt, const char *str);
+extern int ipset_parse_iface(struct ipset_session *session,
+			     enum ipset_opt opt, const char *str);
 extern int ipset_parse_output(struct ipset_session *session,
 			      int opt, const char *str);
 extern int ipset_parse_ignored(struct ipset_session *session,
@@ -84,8 +89,8 @@ extern int ipset_parse_ignored(struct ipset_session *session,
 extern int ipset_parse_elem(struct ipset_session *session,
 			    enum ipset_opt opt, const char *str);
 extern int ipset_call_parser(struct ipset_session *session,
-			     ipset_parsefn parse, const char *optstr,
-			     enum ipset_opt optional, const char *str);
+			     const struct ipset_arg *arg,
+			     const char *str);
 
 /* Compatibility parser functions */
 extern int ipset_parse_iptimeout(struct ipset_session *session,

extensions/ipset-6/include/libipset/pfxlen.h

@@ -12,7 +12,7 @@
 	{.ip6 = { \
 		__constant_htonl(a), __constant_htonl(b), \
 		__constant_htonl(c), __constant_htonl(d), \
-	}}
+	} }
 
 /*
  * This table works for both IPv4 and IPv6;

extensions/ipset-6/include/libipset/print.h

@@ -37,6 +37,9 @@ extern int ipset_print_name(char *buf, unsigned int len,
 extern int ipset_print_port(char *buf, unsigned int len,
 			    const struct ipset_data *data,
 			    enum ipset_opt opt, uint8_t env);
+extern int ipset_print_iface(char *buf, unsigned int len,
+			     const struct ipset_data *data,
+			     enum ipset_opt opt, uint8_t env);
 extern int ipset_print_proto(char *buf, unsigned int len,
 			     const struct ipset_data *data,
 			     enum ipset_opt opt, uint8_t env);

extensions/ipset-6/include/libipset/session.h

@@ -21,10 +21,14 @@ struct ipset_session;
 struct ipset_data;
 struct ipset_handle;
 
-extern struct ipset_data * ipset_session_data(const struct ipset_session *session);
-extern struct ipset_handle * ipset_session_handle(const struct ipset_session *session);
-extern const struct ipset_type * ipset_saved_type(const struct ipset_session *session);
-extern void ipset_session_lineno(struct ipset_session *session, uint32_t lineno);
+extern struct ipset_data *
+	ipset_session_data(const struct ipset_session *session);
+extern struct ipset_handle *
+	ipset_session_handle(const struct ipset_session *session);
+extern const struct ipset_type *
+	ipset_saved_type(const struct ipset_session *session);
+extern void ipset_session_lineno(struct ipset_session *session,
+				 uint32_t lineno);
 
 enum ipset_err_type {
 	IPSET_ERROR,
@@ -47,8 +51,8 @@ extern int ipset_session_report(struct ipset_session *session,
 })
 
 extern void ipset_session_report_reset(struct ipset_session *session);
-extern const char * ipset_session_error(const struct ipset_session *session);
-extern const char * ipset_session_warning(const struct ipset_session *session);
+extern const char *ipset_session_error(const struct ipset_session *session);
+extern const char *ipset_session_warning(const struct ipset_session *session);
 
 #define ipset_session_data_set(session, opt, value)	\
 	ipset_data_set(ipset_session_data(session), opt, value)
@@ -65,6 +69,10 @@ enum ipset_envopt {
 	IPSET_ENV_RESOLVE	= (1 << IPSET_ENV_BIT_RESOLVE),
 	IPSET_ENV_BIT_EXIST	= 3,
 	IPSET_ENV_EXIST		= (1 << IPSET_ENV_BIT_EXIST),
+	IPSET_ENV_BIT_LIST_SETNAME = 4,
+	IPSET_ENV_LIST_SETNAME	= (1 << IPSET_ENV_BIT_LIST_SETNAME),
+	IPSET_ENV_BIT_LIST_HEADER = 5,
+	IPSET_ENV_LIST_HEADER	= (1 << IPSET_ENV_BIT_LIST_HEADER),
 };
 
 extern int ipset_envopt_parse(struct ipset_session *session,
@@ -89,7 +97,9 @@ extern int ipset_cmd(struct ipset_session *session, enum ipset_cmd cmd,
 typedef int (*ipset_outfn)(const char *fmt, ...)
 	__attribute__ ((format (printf, 1, 2)));
 
-extern struct ipset_session * ipset_session_init(ipset_outfn outfn);
+extern struct ipset_session *ipset_session_init(ipset_outfn outfn);
 extern int ipset_session_fini(struct ipset_session *session);
 
+extern void ipset_debug_msg(const char *dir, void *buffer, int len);
+
 #endif /* LIBIPSET_SESSION_H */

extensions/ipset-6/include/libipset/types.h

@@ -70,7 +70,7 @@ struct ipset_elem {
  * but for the readability the full list is supported.
   */
 struct ipset_type {
-	char name[IPSET_MAXNAMELEN];		/* type name */
+	const char *name;
 	uint8_t revision;			/* revision number */
 	uint8_t family;				/* supported family */
 	uint8_t dimension;			/* elem dimension */
@@ -97,13 +97,14 @@ extern int ipset_cache_swap(const char *from, const char *to);
 extern int ipset_cache_init(void);
 extern void ipset_cache_fini(void);
 
-extern const struct ipset_type * ipset_type_get(struct ipset_session *session,
-						enum ipset_cmd cmd);
-extern const struct ipset_type * ipset_type_check(struct ipset_session *session);
+extern const struct ipset_type *
+	ipset_type_get(struct ipset_session *session, enum ipset_cmd cmd);
+extern const struct ipset_type *
+	ipset_type_check(struct ipset_session *session);
 
 extern int ipset_type_add(struct ipset_type *type);
-extern const struct ipset_type * ipset_types(void);
-extern const char * ipset_typename_resolve(const char *str);
+extern const struct ipset_type *ipset_types(void);
+extern const char *ipset_typename_resolve(const char *str);
 extern bool ipset_match_typename(const char *str,
 				 const struct ipset_type *t);
 

extensions/ipset-6/include/libipset/utils.h

@@ -11,10 +11,10 @@
 #include <netinet/in.h>				/* struct in[6]_addr */
 
 /* String equality tests */
-#define STREQ(a,b)		(strcmp(a,b) == 0)
-#define STRNEQ(a,b,n)		(strncmp(a,b,n) == 0)
-#define STRCASEQ(a,b)		(strcasecmp(a,b) == 0)
-#define STRNCASEQ(a,b,n)	(strncasecmp(a,b,n) == 0)
+#define STREQ(a, b)		(strcmp(a, b) == 0)
+#define STRNEQ(a, b, n)		(strncmp(a, b, n) == 0)
+#define STRCASEQ(a, b)		(strcasecmp(a, b) == 0)
+#define STRNCASEQ(a, b, n)	(strncasecmp(a, b, n) == 0)
 
 /* Stringify tokens */
 #define _STR(c)			#c

extensions/ipset-6/ip_set.h

@@ -14,7 +14,7 @@
 #include <linux/netlink.h>
 
 /* The protocol version */
-#define IPSET_PROTOCOL		5
+#define IPSET_PROTOCOL		0x60
 
 /* The max length of strings including NUL: set and type identifiers */
 #define IPSET_MAXNAMELEN	32
@@ -106,6 +106,8 @@ enum {
 	IPSET_ATTR_NAMEREF,
 	IPSET_ATTR_IP2,
 	IPSET_ATTR_CIDR2,
+	IPSET_ATTR_IP2_TO,
+	IPSET_ATTR_IFACE,
 	__IPSET_ATTR_ADT_MAX,
 };
 #define IPSET_ATTR_ADT_MAX	(__IPSET_ATTR_ADT_MAX - 1)
@@ -120,7 +122,7 @@ enum {
 
 /* Error codes */
 enum ipset_errno {
-	IPSET_ERR_PRIVATE = 128,
+	IPSET_ERR_PRIVATE = 4096,
 	IPSET_ERR_PROTOCOL,
 	IPSET_ERR_FIND_TYPE,
 	IPSET_ERR_MAX_SETS,
@@ -137,19 +139,25 @@ enum ipset_errno {
 	IPSET_ERR_IPADDR_IPV6,
 
 	/* Type specific error codes */
-	IPSET_ERR_TYPE_SPECIFIC = 160,
+	IPSET_ERR_TYPE_SPECIFIC = 4352,
 };
 
 /* Flags at command level */
 enum ipset_cmd_flags {
 	IPSET_FLAG_BIT_EXIST	= 0,
 	IPSET_FLAG_EXIST	= (1 << IPSET_FLAG_BIT_EXIST),
+	IPSET_FLAG_BIT_LIST_SETNAME = 1,
+	IPSET_FLAG_LIST_SETNAME	= (1 << IPSET_FLAG_BIT_LIST_SETNAME),
+	IPSET_FLAG_BIT_LIST_HEADER = 2,
+	IPSET_FLAG_LIST_HEADER	= (1 << IPSET_FLAG_BIT_LIST_HEADER),
 };
 
 /* Flags at CADT attribute level */
 enum ipset_cadt_flags {
 	IPSET_FLAG_BIT_BEFORE	= 0,
 	IPSET_FLAG_BEFORE	= (1 << IPSET_FLAG_BIT_BEFORE),
+	IPSET_FLAG_BIT_PHYSDEV	= 1,
+	IPSET_FLAG_PHYSDEV	= (1 << IPSET_FLAG_BIT_PHYSDEV),
 };
 
 /* Commands with settype-specific attributes */
@@ -167,6 +175,7 @@ enum ipset_adt {
 #include <linux/ipv6.h>
 #include <linux/netlink.h>
 #include <linux/netfilter.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/vmalloc.h>
 #include <net/netlink.h>
 
@@ -208,6 +217,8 @@ enum ip_set_feature {
 	IPSET_TYPE_IP2 = (1 << IPSET_TYPE_IP2_FLAG),
 	IPSET_TYPE_NAME_FLAG = 4,
 	IPSET_TYPE_NAME = (1 << IPSET_TYPE_NAME_FLAG),
+	IPSET_TYPE_IFACE_FLAG = 5,
+	IPSET_TYPE_IFACE = (1 << IPSET_TYPE_IFACE_FLAG),
 	/* Strictly speaking not a feature, but a flag for dumping:
 	 * this settype must be dumped last */
 	IPSET_DUMP_LAST_FLAG = 7,
@@ -216,7 +227,17 @@ enum ip_set_feature {
 
 struct ip_set;
 
-typedef int (*ipset_adtfn)(struct ip_set *set, void *value, u32 timeout);
+typedef int (*ipset_adtfn)(struct ip_set *set, void *value,
+			   u32 timeout, u32 flags);
+
+/* Kernel API function options */
+struct ip_set_adt_opt {
+	u8 family;		/* Actual protocol family */
+	u8 dim;			/* Dimension of match/target */
+	u8 flags;		/* Direction and negation flags */
+	u32 cmdflags;		/* Command-like flags */
+	u32 timeout;		/* Timeout value */
+};
 
 /* Set type, variant-specific part */
 struct ip_set_type_variant {
@@ -225,14 +246,15 @@ struct ip_set_type_variant {
 	 *			zero for no match/success to add/delete
 	 *			positive for matching element */
 	int (*kadt)(struct ip_set *set, const struct sk_buff * skb,
-		    enum ipset_adt adt, u8 pf, u8 dim, u8 flags);
+		    const struct xt_action_param *par,
+		    enum ipset_adt adt, const struct ip_set_adt_opt *opt);
 
 	/* Userspace: test/add/del entries
 	 *		returns negative error code,
 	 *			zero for no match/success to add/delete
 	 *			positive for matching element */
-	int (*uadt)(struct ip_set *set, struct nlattr *head, int len,
-		    enum ipset_adt adt, u32 *lineno, u32 flags);
+	int (*uadt)(struct ip_set *set, struct nlattr *tb[],
+		    enum ipset_adt adt, u32 *lineno, u32 flags, bool retried);
 
 	/* Low level add/del/test functions */
 	ipset_adtfn adt[IPSET_ADT_MAX];
@@ -270,12 +292,15 @@ struct ip_set_type {
 	u8 dimension;
 	/* Supported family: may be AF_UNSPEC for both AF_INET/AF_INET6 */
 	u8 family;
-	/* Type revision */
-	u8 revision;
+	/* Type revisions */
+	u8 revision_min, revision_max;
 
 	/* Create set */
-	int (*create)(struct ip_set *set,
-		      struct nlattr *head, int len, u32 flags);
+	int (*create)(struct ip_set *set, struct nlattr *tb[], u32 flags);
+
+	/* Attribute policies */
+	const struct nla_policy create_policy[IPSET_ATTR_CREATE_MAX + 1];
+	const struct nla_policy adt_policy[IPSET_ATTR_ADT_MAX + 1];
 
 	/* Set this to THIS_MODULE if you are a module, otherwise NULL */
 	struct module *me;
@@ -292,13 +317,15 @@ struct ip_set {
 	/* Lock protecting the set data */
 	rwlock_t lock;
 	/* References to the set */
-	atomic_t ref;
+	u32 ref;
 	/* The core set type */
 	struct ip_set_type *type;
 	/* The type variant doing the real job */
 	const struct ip_set_type_variant *variant;
 	/* The actual INET family of the set */
 	u8 family;
+	/* The type revision */
+	u8 revision;
 	/* The type specific data */
 	void *data;
 };
@@ -306,21 +333,25 @@ struct ip_set {
 /* register and unregister set references */
 extern ip_set_id_t ip_set_get_byname(const char *name, struct ip_set **set);
 extern void ip_set_put_byindex(ip_set_id_t index);
-extern const char * ip_set_name_byindex(ip_set_id_t index);
+extern const char *ip_set_name_byindex(ip_set_id_t index);
 extern ip_set_id_t ip_set_nfnl_get(const char *name);
 extern ip_set_id_t ip_set_nfnl_get_byindex(ip_set_id_t index);
 extern void ip_set_nfnl_put(ip_set_id_t index);
 
 /* API for iptables set match, and SET target */
+
 extern int ip_set_add(ip_set_id_t id, const struct sk_buff *skb,
-		      u8 family, u8 dim, u8 flags);
+		      const struct xt_action_param *par,
+		      const struct ip_set_adt_opt *opt);
 extern int ip_set_del(ip_set_id_t id, const struct sk_buff *skb,
-		      u8 family, u8 dim, u8 flags);
+		      const struct xt_action_param *par,
+		      const struct ip_set_adt_opt *opt);
 extern int ip_set_test(ip_set_id_t id, const struct sk_buff *skb,
-		       u8 family, u8 dim, u8 flags);
+		       const struct xt_action_param *par,
+		       const struct ip_set_adt_opt *opt);
 
 /* Utility functions */
-extern void * ip_set_alloc(size_t size, gfp_t gfp_mask);
+extern void *ip_set_alloc(size_t size);
 extern void ip_set_free(void *members);
 extern int ip_set_get_ipaddr4(struct nlattr *nla,  __be32 *ipaddr);
 extern int ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr);

extensions/ipset-6/ip_set_ahash.h

@@ -5,6 +5,11 @@
 #include "jhash.h"
 #include "ip_set_timeout.h"
 
+#define CONCAT(a, b, c)		a##b##c
+#define TOKEN(a, b, c)		CONCAT(a, b, c)
+
+#define type_pf_next		TOKEN(TYPE, PF, _elem)
+
 /* Hashing which uses arrays to resolve clashing. The hash table is resized
  * (doubled) when searching becomes too long.
  * Internally jhash is used with the assumption that the size of the
@@ -38,7 +43,7 @@ struct htable {
 	struct hbucket bucket[0]; /* hashtable buckets */
 };
 
-#define hbucket(h, i)		&((h)->bucket[i])
+#define hbucket(h, i)		(&((h)->bucket[i]))
 
 /* Book-keeping of the prefixes added to the set */
 struct ip_set_hash_nets {
@@ -54,9 +59,13 @@ struct ip_set_hash {
 	u32 initval;		/* random jhash init value */
 	u32 timeout;		/* timeout value, if enabled */
 	struct timer_list gc;	/* garbage collection when timeout enabled */
+	struct type_pf_next next; /* temporary storage for uadd */
 #ifdef IP_SET_HASH_WITH_NETMASK
 	u8 netmask;		/* netmask value for subnets to store */
 #endif
+#ifdef IP_SET_HASH_WITH_RBTREE
+	struct rb_root rbtree;
+#endif
 #ifdef IP_SET_HASH_WITH_NETS
 	struct ip_set_hash_nets nets[0]; /* book-keeping of prefixes */
 #endif
@@ -194,6 +203,9 @@ ip_set_hash_destroy(struct ip_set *set)
 		del_timer_sync(&h->gc);
 
 	ahash_destroy(h->table);
+#ifdef IP_SET_HASH_WITH_RBTREE
+	rbtree_destroy(&h->rbtree);
+#endif
 	kfree(h);
 
 	set->data = NULL;
@@ -217,6 +229,7 @@ ip_set_hash_destroy(struct ip_set *set)
 #define type_pf_data_netmask	TOKEN(TYPE, PF, _data_netmask)
 #define type_pf_data_list	TOKEN(TYPE, PF, _data_list)
 #define type_pf_data_tlist	TOKEN(TYPE, PF, _data_tlist)
+#define type_pf_data_next	TOKEN(TYPE, PF, _data_next)
 
 #define type_pf_elem		TOKEN(TYPE, PF, _elem)
 #define type_pf_telem		TOKEN(TYPE, PF, _telem)
@@ -311,8 +324,7 @@ retry:
 		/* In case we have plenty of memory :-) */
 		return -IPSET_ERR_HASH_FULL;
 	t = ip_set_alloc(sizeof(*t)
-			 + jhash_size(htable_bits) * sizeof(struct hbucket),
-			 GFP_KERNEL);
+			 + jhash_size(htable_bits) * sizeof(struct hbucket));
 	if (!t)
 		return -ENOMEM;
 	t->htable_bits = htable_bits;
@@ -347,10 +359,13 @@ retry:
 	return 0;
 }
 
+static void
+type_pf_data_next(struct ip_set_hash *h, const struct type_pf_elem *d);
+
 /* Add an element to a hash and update the internal counters when succeeded,
  * otherwise report the proper error code. */
 static int
-type_pf_add(struct ip_set *set, void *value, u32 timeout)
+type_pf_add(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
 	struct ip_set_hash *h = set->data;
 	struct htable *t;
@@ -373,8 +388,11 @@ type_pf_add(struct ip_set *set, void *value, u32 timeout)
 		}
 
 	ret = type_pf_elem_add(n, value);
-	if (ret != 0)
+	if (ret != 0) {
+		if (ret == -EAGAIN)
+			type_pf_data_next(h, d);
 		goto out;
+	}
 
 #ifdef IP_SET_HASH_WITH_NETS
 	add_cidr(h, d->cidr, HOST_MASK);
@@ -389,7 +407,7 @@ out:
  * and free up space if possible.
  */
 static int
-type_pf_del(struct ip_set *set, void *value, u32 timeout)
+type_pf_del(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
 	struct ip_set_hash *h = set->data;
 	struct htable *t = h->table;
@@ -464,7 +482,7 @@ type_pf_test_cidrs(struct ip_set *set, struct type_pf_elem *d, u32 timeout)
 
 /* Test whether the element is added to the set */
 static int
-type_pf_test(struct ip_set *set, void *value, u32 timeout)
+type_pf_test(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
 	struct ip_set_hash *h = set->data;
 	struct htable *t = h->table;
@@ -516,8 +534,7 @@ type_pf_head(struct ip_set *set, struct sk_buff *skb)
 	if (h->netmask != HOST_MASK)
 		NLA_PUT_U8(skb, IPSET_ATTR_NETMASK, h->netmask);
 #endif
-	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-		      htonl(atomic_read(&set->ref) - 1));
+	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
 	NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE, htonl(memsize));
 	if (with_timeout(h->timeout))
 		NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(h->timeout));
@@ -525,7 +542,7 @@ type_pf_head(struct ip_set *set, struct sk_buff *skb)
 
 	return 0;
 nla_put_failure:
-	return -EFAULT;
+	return -EMSGSIZE;
 }
 
 /* Reply a LIST/SAVE request: dump the elements of the specified set */
@@ -545,7 +562,7 @@ type_pf_list(const struct ip_set *set,
 
 	atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
 	if (!atd)
-		return -EFAULT;
+		return -EMSGSIZE;
 	pr_debug("list hash set %s\n", set->name);
 	for (; cb->args[2] < jhash_size(t->htable_bits); cb->args[2]++) {
 		incomplete = skb_tail_pointer(skb);
@@ -559,7 +576,7 @@ type_pf_list(const struct ip_set *set,
 			if (!nested) {
 				if (cb->args[2] == first) {
 					nla_nest_cancel(skb, atd);
-					return -EFAULT;
+					return -EMSGSIZE;
 				} else
 					goto nla_put_failure;
 			}
@@ -581,16 +598,18 @@ nla_put_failure:
 		pr_warning("Can't list set %s: one bucket does not fit into "
 			   "a message. Please report it!\n", set->name);
 		cb->args[2] = 0;
+		return -EMSGSIZE;
 	}
 	return 0;
 }
 
 static int
 type_pf_kadt(struct ip_set *set, const struct sk_buff * skb,
-	     enum ipset_adt adt, u8 pf, u8 dim, u8 flags);
+	     const struct xt_action_param *par,
+	     enum ipset_adt adt, const struct ip_set_adt_opt *opt);
 static int
-type_pf_uadt(struct ip_set *set, struct nlattr *head, int len,
-	     enum ipset_adt adt, u32 *lineno, u32 flags);
+type_pf_uadt(struct ip_set *set, struct nlattr *tb[],
+	     enum ipset_adt adt, u32 *lineno, u32 flags, bool retried);
 
 static const struct ip_set_type_variant type_pf_variant = {
 	.kadt	= type_pf_kadt,
@@ -742,8 +761,7 @@ retry:
 		/* In case we have plenty of memory :-) */
 		return -IPSET_ERR_HASH_FULL;
 	t = ip_set_alloc(sizeof(*t)
-			 + jhash_size(htable_bits) * sizeof(struct hbucket),
-			 GFP_KERNEL);
+			 + jhash_size(htable_bits) * sizeof(struct hbucket));
 	if (!t)
 		return -ENOMEM;
 	t->htable_bits = htable_bits;
@@ -778,7 +796,7 @@ retry:
 }
 
 static int
-type_pf_tadd(struct ip_set *set, void *value, u32 timeout)
+type_pf_tadd(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
 	struct ip_set_hash *h = set->data;
 	struct htable *t = h->table;
@@ -786,6 +804,7 @@ type_pf_tadd(struct ip_set *set, void *value, u32 timeout)
 	struct hbucket *n;
 	struct type_pf_elem *data;
 	int ret = 0, i, j = AHASH_MAX_SIZE + 1;
+	bool flag_exist = flags & IPSET_FLAG_EXIST;
 	u32 key;
 
 	if (h->elements >= h->maxelem)
@@ -801,7 +820,7 @@ type_pf_tadd(struct ip_set *set, void *value, u32 timeout)
 	for (i = 0; i < n->pos; i++) {
 		data = ahash_tdata(n, i);
 		if (type_pf_data_equal(data, d)) {
-			if (type_pf_data_expired(data))
+			if (type_pf_data_expired(data) || flag_exist)
 				j = i;
 			else {
 				ret = -IPSET_ERR_EXIST;
@@ -822,8 +841,11 @@ type_pf_tadd(struct ip_set *set, void *value, u32 timeout)
 		goto out;
 	}
 	ret = type_pf_elem_tadd(n, d, timeout);
-	if (ret != 0)
+	if (ret != 0) {
+		if (ret == -EAGAIN)
+			type_pf_data_next(h, d);
 		goto out;
+	}
 
 #ifdef IP_SET_HASH_WITH_NETS
 	add_cidr(h, d->cidr, HOST_MASK);
@@ -835,13 +857,13 @@ out:
 }
 
 static int
-type_pf_tdel(struct ip_set *set, void *value, u32 timeout)
+type_pf_tdel(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
 	struct ip_set_hash *h = set->data;
 	struct htable *t = h->table;
 	const struct type_pf_elem *d = value;
 	struct hbucket *n;
-	int i, ret = 0;
+	int i;
 	struct type_pf_elem *data;
 	u32 key;
 
@@ -852,7 +874,7 @@ type_pf_tdel(struct ip_set *set, void *value, u32 timeout)
 		if (!type_pf_data_equal(data, d))
 			continue;
 		if (type_pf_data_expired(data))
-			ret = -IPSET_ERR_EXIST;
+			return -IPSET_ERR_EXIST;
 		if (i != n->pos - 1)
 			/* Not last one */
 			type_pf_data_copy(data, ahash_tdata(n, n->pos - 1));
@@ -907,7 +929,7 @@ type_pf_ttest_cidrs(struct ip_set *set, struct type_pf_elem *d, u32 timeout)
 #endif
 
 static int
-type_pf_ttest(struct ip_set *set, void *value, u32 timeout)
+type_pf_ttest(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
 	struct ip_set_hash *h = set->data;
 	struct htable *t = h->table;
@@ -946,7 +968,7 @@ type_pf_tlist(const struct ip_set *set,
 
 	atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
 	if (!atd)
-		return -EFAULT;
+		return -EMSGSIZE;
 	for (; cb->args[2] < jhash_size(t->htable_bits); cb->args[2]++) {
 		incomplete = skb_tail_pointer(skb);
 		n = hbucket(t, cb->args[2]);
@@ -960,7 +982,7 @@ type_pf_tlist(const struct ip_set *set,
 			if (!nested) {
 				if (cb->args[2] == first) {
 					nla_nest_cancel(skb, atd);
-					return -EFAULT;
+					return -EMSGSIZE;
 				} else
 					goto nla_put_failure;
 			}
@@ -982,6 +1004,7 @@ nla_put_failure:
 		pr_warning("Can't list set %s: one bucket does not fit into "
 			   "a message. Please report it!\n", set->name);
 		cb->args[2] = 0;
+		return -EMSGSIZE;
 	}
 	return 0;
 }

extensions/ipset-6/ip_set_bitmap_ip.c

@@ -13,7 +13,6 @@
 #include <linux/ip.h>
 #include <linux/skbuff.h>
 #include <linux/errno.h>
-#include <linux/uaccess.h>
 #include <linux/bitops.h>
 #include <linux/spinlock.h>
 #include <linux/netlink.h>
@@ -33,8 +32,7 @@ MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
 MODULE_DESCRIPTION("bitmap:ip type of IP sets");
 MODULE_ALIAS("ip_set_bitmap:ip");
 
-/* Base variant */
-
+/* Type structure */
 struct bitmap_ip {
 	void *members;		/* the set members */
 	u32 first_ip;		/* host byte order, included in range */
@@ -43,32 +41,45 @@ struct bitmap_ip {
 	u32 hosts;		/* number of hosts in a subnet */
 	size_t memsize;		/* members size */
 	u8 netmask;		/* subnet netmask */
+	u32 timeout;		/* timeout parameter */
+	struct timer_list gc;	/* garbage collection */
 };
 
+/* Base variant */
+
 static inline u32
 ip_to_id(const struct bitmap_ip *m, u32 ip)
 {
 	return ((ip & ip_set_hostmask(m->netmask)) - m->first_ip)/m->hosts;
 }
 
-static inline int
-bitmap_ip_test(const struct bitmap_ip *map, u32 id)
+static int
+bitmap_ip_test(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
+	const struct bitmap_ip *map = set->data;
+	u16 id = *(u16 *)value;
+
 	return !!test_bit(id, map->members);
 }
 
-static inline int
-bitmap_ip_add(struct bitmap_ip *map, u32 id)
+static int
+bitmap_ip_add(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
+	struct bitmap_ip *map = set->data;
+	u16 id = *(u16 *)value;
+
 	if (test_and_set_bit(id, map->members))
 		return -IPSET_ERR_EXIST;
 
 	return 0;
 }
 
-static inline int
-bitmap_ip_del(struct bitmap_ip *map, u32 id)
+static int
+bitmap_ip_del(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
+	struct bitmap_ip *map = set->data;
+	u16 id = *(u16 *)value;
+
 	if (!test_and_clear_bit(id, map->members))
 		return -IPSET_ERR_EXIST;
 
@@ -76,52 +87,166 @@ bitmap_ip_del(struct bitmap_ip *map, u32 id)
 }
 
 static int
-bitmap_ip_kadt(struct ip_set *set, const struct sk_buff *skb,
-	       enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+bitmap_ip_list(const struct ip_set *set,
+	       struct sk_buff *skb, struct netlink_callback *cb)
+{
+	const struct bitmap_ip *map = set->data;
+	struct nlattr *atd, *nested;
+	u32 id, first = cb->args[2];
+
+	atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
+	if (!atd)
+		return -EMSGSIZE;
+	for (; cb->args[2] < map->elements; cb->args[2]++) {
+		id = cb->args[2];
+		if (!test_bit(id, map->members))
+			continue;
+		nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
+		if (!nested) {
+			if (id == first) {
+				nla_nest_cancel(skb, atd);
+				return -EMSGSIZE;
+			} else
+				goto nla_put_failure;
+		}
+		NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP,
+				htonl(map->first_ip + id * map->hosts));
+		ipset_nest_end(skb, nested);
+	}
+	ipset_nest_end(skb, atd);
+	/* Set listing finished */
+	cb->args[2] = 0;
+	return 0;
+
+nla_put_failure:
+	nla_nest_cancel(skb, nested);
+	ipset_nest_end(skb, atd);
+	if (unlikely(id == first)) {
+		cb->args[2] = 0;
+		return -EMSGSIZE;
+	}
+	return 0;
+}
+
+/* Timeout variant */
+
+static int
+bitmap_ip_ttest(struct ip_set *set, void *value, u32 timeout, u32 flags)
+{
+	const struct bitmap_ip *map = set->data;
+	const unsigned long *members = map->members;
+	u16 id = *(u16 *)value;
+
+	return ip_set_timeout_test(members[id]);
+}
+
+static int
+bitmap_ip_tadd(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
 	struct bitmap_ip *map = set->data;
+	unsigned long *members = map->members;
+	u16 id = *(u16 *)value;
+
+	if (ip_set_timeout_test(members[id]) && !(flags & IPSET_FLAG_EXIST))
+		return -IPSET_ERR_EXIST;
+
+	members[id] = ip_set_timeout_set(timeout);
+
+	return 0;
+}
+
+static int
+bitmap_ip_tdel(struct ip_set *set, void *value, u32 timeout, u32 flags)
+{
+	struct bitmap_ip *map = set->data;
+	unsigned long *members = map->members;
+	u16 id = *(u16 *)value;
+	int ret = -IPSET_ERR_EXIST;
+
+	if (ip_set_timeout_test(members[id]))
+		ret = 0;
+
+	members[id] = IPSET_ELEM_UNSET;
+	return ret;
+}
+
+static int
+bitmap_ip_tlist(const struct ip_set *set,
+		struct sk_buff *skb, struct netlink_callback *cb)
+{
+	const struct bitmap_ip *map = set->data;
+	struct nlattr *adt, *nested;
+	u32 id, first = cb->args[2];
+	const unsigned long *members = map->members;
+
+	adt = ipset_nest_start(skb, IPSET_ATTR_ADT);
+	if (!adt)
+		return -EMSGSIZE;
+	for (; cb->args[2] < map->elements; cb->args[2]++) {
+		id = cb->args[2];
+		if (!ip_set_timeout_test(members[id]))
+			continue;
+		nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
+		if (!nested) {
+			if (id == first) {
+				nla_nest_cancel(skb, adt);
+				return -EMSGSIZE;
+			} else
+				goto nla_put_failure;
+		}
+		NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP,
+				htonl(map->first_ip + id * map->hosts));
+		NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
+			      htonl(ip_set_timeout_get(members[id])));
+		ipset_nest_end(skb, nested);
+	}
+	ipset_nest_end(skb, adt);
+
+	/* Set listing finished */
+	cb->args[2] = 0;
+
+	return 0;
+
+nla_put_failure:
+	nla_nest_cancel(skb, nested);
+	ipset_nest_end(skb, adt);
+	if (unlikely(id == first)) {
+		cb->args[2] = 0;
+		return -EMSGSIZE;
+	}
+	return 0;
+}
+
+static int
+bitmap_ip_kadt(struct ip_set *set, const struct sk_buff *skb,
+	       const struct xt_action_param *par,
+	       enum ipset_adt adt, const struct ip_set_adt_opt *opt)
+{
+	struct bitmap_ip *map = set->data;
+	ipset_adtfn adtfn = set->variant->adt[adt];
 	u32 ip;
 
-	ip = ntohl(ip4addr(skb, flags & IPSET_DIM_ONE_SRC));
+	ip = ntohl(ip4addr(skb, opt->flags & IPSET_DIM_ONE_SRC));
 	if (ip < map->first_ip || ip > map->last_ip)
 		return -IPSET_ERR_BITMAP_RANGE;
 
 	ip = ip_to_id(map, ip);
 
-	switch (adt) {
-	case IPSET_TEST:
-		return bitmap_ip_test(map, ip);
-	case IPSET_ADD:
-		return bitmap_ip_add(map, ip);
-	case IPSET_DEL:
-		return bitmap_ip_del(map, ip);
-	default:
-		return -EINVAL;
-	}
+	return adtfn(set, &ip, opt_timeout(opt, map), opt->cmdflags);
 }
 
-static const struct nla_policy bitmap_ip_adt_policy[IPSET_ATTR_ADT_MAX+1] = {
-	[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
-	[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
-	[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-	[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
-};
-
 static int
-bitmap_ip_uadt(struct ip_set *set, struct nlattr *head, int len,
-	       enum ipset_adt adt, u32 *lineno, u32 flags)
+bitmap_ip_uadt(struct ip_set *set, struct nlattr *tb[],
+	       enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	struct bitmap_ip *map = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
+	ipset_adtfn adtfn = set->variant->adt[adt];
+	u32 timeout = map->timeout;
 	u32 ip, ip_to, id;
 	int ret = 0;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      bitmap_ip_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
-	if (unlikely(!tb[IPSET_ATTR_IP]))
+	if (unlikely(!tb[IPSET_ATTR_IP] ||
+		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 		return -IPSET_ERR_PROTOCOL;
 
 	if (tb[IPSET_ATTR_LINENO])
@@ -134,13 +259,16 @@ bitmap_ip_uadt(struct ip_set *set, struct nlattr *head, int len,
 	if (ip < map->first_ip || ip > map->last_ip)
 		return -IPSET_ERR_BITMAP_RANGE;
 
-	/* Set was defined without timeout support:
-	 * don't ignore the attribute silently */
-	if (tb[IPSET_ATTR_TIMEOUT])
+	if (tb[IPSET_ATTR_TIMEOUT]) {
+		if (!with_timeout(map->timeout))
 			return -IPSET_ERR_TIMEOUT;
+		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
+	}
 
-	if (adt == IPSET_TEST)
-		return bitmap_ip_test(map, ip_to_id(map, ip));
+	if (adt == IPSET_TEST) {
+		id = ip_to_id(map, ip);
+		return adtfn(set, &id, timeout, flags);
+	}
 
 	if (tb[IPSET_ATTR_IP_TO]) {
 		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
@@ -156,8 +284,7 @@ bitmap_ip_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 		if (cidr > 32)
 			return -IPSET_ERR_INVALID_CIDR;
-		ip &= ip_set_hostmask(cidr);
-		ip_to = ip | ~ip_set_hostmask(cidr);
+		ip_set_mask_from_to(ip, ip_to, cidr);
 	} else
 		ip_to = ip;
 
@@ -166,8 +293,7 @@ bitmap_ip_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 	for (; !before(ip_to, ip); ip += map->hosts) {
 		id = ip_to_id(map, ip);
-		ret = adt == IPSET_ADD ? bitmap_ip_add(map, id)
-				       : bitmap_ip_del(map, id);
+		ret = adtfn(set, &id, timeout, flags);
 
 		if (ret && !ip_set_eexist(ret, flags))
 			return ret;
@@ -182,6 +308,9 @@ bitmap_ip_destroy(struct ip_set *set)
 {
 	struct bitmap_ip *map = set->data;
 
+	if (with_timeout(map->timeout))
+		del_timer_sync(&map->gc);
+
 	ip_set_free(map->members);
 	kfree(map);
 
@@ -209,53 +338,16 @@ bitmap_ip_head(struct ip_set *set, struct sk_buff *skb)
 	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
 	if (map->netmask != 32)
 		NLA_PUT_U8(skb, IPSET_ATTR_NETMASK, map->netmask);
-	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-		      htonl(atomic_read(&set->ref) - 1));
+	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
 	NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
 		      htonl(sizeof(*map) + map->memsize));
+	if (with_timeout(map->timeout))
+		NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout));
 	ipset_nest_end(skb, nested);
 
 	return 0;
 nla_put_failure:
-	return -EFAULT;
-}
-
-static int
-bitmap_ip_list(const struct ip_set *set,
-	       struct sk_buff *skb, struct netlink_callback *cb)
-{
-	const struct bitmap_ip *map = set->data;
-	struct nlattr *atd, *nested;
-	u32 id, first = cb->args[2];
-
-	atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
-	if (!atd)
-		return -EFAULT;
-	for (; cb->args[2] < map->elements; cb->args[2]++) {
-		id = cb->args[2];
-		if (!bitmap_ip_test(map, id))
-			continue;
-		nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
-		if (!nested) {
-			if (id == first) {
-				nla_nest_cancel(skb, atd);
-				return -EFAULT;
-			} else
-				goto nla_put_failure;
-		}
-		NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP,
-				htonl(map->first_ip + id * map->hosts));
-		ipset_nest_end(skb, nested);
-	}
-	ipset_nest_end(skb, atd);
-	/* Set listing finished */
-	cb->args[2] = 0;
-	return 0;
-
-nla_put_failure:
-	nla_nest_cancel(skb, nested);
-	ipset_nest_end(skb, atd);
-	return 0;
+	return -EMSGSIZE;
 }
 
 static bool
@@ -266,12 +358,18 @@ bitmap_ip_same_set(const struct ip_set *a, const struct ip_set *b)
 
 	return x->first_ip == y->first_ip &&
 	       x->last_ip == y->last_ip &&
-	       x->netmask == y->netmask;
+	       x->netmask == y->netmask &&
+	       x->timeout == y->timeout;
 }
 
 static const struct ip_set_type_variant bitmap_ip = {
 	.kadt	= bitmap_ip_kadt,
 	.uadt	= bitmap_ip_uadt,
+	.adt	= {
+		[IPSET_ADD] = bitmap_ip_add,
+		[IPSET_DEL] = bitmap_ip_del,
+		[IPSET_TEST] = bitmap_ip_test,
+	},
 	.destroy = bitmap_ip_destroy,
 	.flush	= bitmap_ip_flush,
 	.head	= bitmap_ip_head,
@@ -279,261 +377,26 @@ static const struct ip_set_type_variant bitmap_ip = {
 	.same_set = bitmap_ip_same_set,
 };
 
-/* Timeout variant */
-
-struct bitmap_ip_timeout {
-	unsigned long *members;	/* the set members */
-	u32 first_ip;		/* host byte order, included in range */
-	u32 last_ip;		/* host byte order, included in range */
-	u32 elements;		/* number of max elements in the set */
-	u32 hosts;		/* number of hosts in a subnet */
-	size_t memsize;		/* members size */
-	u8 netmask;		/* subnet netmask */
-
-	u32 timeout;		/* timeout parameter */
-	struct timer_list gc;	/* garbage collection */
-};
-
-static inline bool
-bitmap_ip_timeout_test(const struct bitmap_ip_timeout *map, u32 id)
-{
-	return ip_set_timeout_test(map->members[id]);
-}
-
-static inline int
-bitmap_ip_timeout_add(struct bitmap_ip_timeout *map,
-		      u32 id, u32 timeout)
-{
-	if (bitmap_ip_timeout_test(map, id))
-		return -IPSET_ERR_EXIST;
-
-	map->members[id] = ip_set_timeout_set(timeout);
-
-	return 0;
-}
-
-static inline int
-bitmap_ip_timeout_del(struct bitmap_ip_timeout *map, u32 id)
-{
-	int ret = -IPSET_ERR_EXIST;
-
-	if (bitmap_ip_timeout_test(map, id))
-		ret = 0;
-
-	map->members[id] = IPSET_ELEM_UNSET;
-	return ret;
-}
-
-static int
-bitmap_ip_timeout_kadt(struct ip_set *set, const struct sk_buff *skb,
-		       enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
-{
-	struct bitmap_ip_timeout *map = set->data;
-	u32 ip;
-
-	ip = ntohl(ip4addr(skb, flags & IPSET_DIM_ONE_SRC));
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -IPSET_ERR_BITMAP_RANGE;
-
-	ip = ip_to_id((const struct bitmap_ip *)map, ip);
-
-	switch (adt) {
-	case IPSET_TEST:
-		return bitmap_ip_timeout_test(map, ip);
-	case IPSET_ADD:
-		return bitmap_ip_timeout_add(map, ip, map->timeout);
-	case IPSET_DEL:
-		return bitmap_ip_timeout_del(map, ip);
-	default:
-		return -EINVAL;
-	}
-}
-
-static int
-bitmap_ip_timeout_uadt(struct ip_set *set, struct nlattr *head, int len,
-		       enum ipset_adt adt, u32 *lineno, u32 flags)
-{
-	struct bitmap_ip_timeout *map = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
-	u32 ip, ip_to, id, timeout = map->timeout;
-	int ret = 0;
-
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      bitmap_ip_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
-	if (unlikely(!tb[IPSET_ATTR_IP] ||
-		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
-		return -IPSET_ERR_PROTOCOL;
-
-	if (tb[IPSET_ATTR_LINENO])
-		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
-
-	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
-	if (ret)
-		return ret;
-
-	if (ip < map->first_ip || ip > map->last_ip)
-		return -IPSET_ERR_BITMAP_RANGE;
-
-	if (adt == IPSET_TEST)
-		return bitmap_ip_timeout_test(map,
-				ip_to_id((const struct bitmap_ip *)map, ip));
-
-	if (tb[IPSET_ATTR_IP_TO]) {
-		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
-		if (ret)
-			return ret;
-		if (ip > ip_to) {
-			swap(ip, ip_to);
-			if (ip < map->first_ip)
-				return -IPSET_ERR_BITMAP_RANGE;
-		}
-	} else if (tb[IPSET_ATTR_CIDR]) {
-		u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
-
-		if (cidr > 32)
-			return -IPSET_ERR_INVALID_CIDR;
-		ip &= ip_set_hostmask(cidr);
-		ip_to = ip | ~ip_set_hostmask(cidr);
-	} else
-		ip_to = ip;
-
-	if (ip_to > map->last_ip)
-		return -IPSET_ERR_BITMAP_RANGE;
-
-	if (tb[IPSET_ATTR_TIMEOUT])
-		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
-
-	for (; !before(ip_to, ip); ip += map->hosts) {
-		id = ip_to_id((const struct bitmap_ip *)map, ip);
-		ret = adt == IPSET_ADD
-			? bitmap_ip_timeout_add(map, id, timeout)
-			: bitmap_ip_timeout_del(map, id);
-
-		if (ret && !ip_set_eexist(ret, flags))
-			return ret;
-		else
-			ret = 0;
-	}
-	return ret;
-}
-
-static void
-bitmap_ip_timeout_destroy(struct ip_set *set)
-{
-	struct bitmap_ip_timeout *map = set->data;
-
-	del_timer_sync(&map->gc);
-	ip_set_free(map->members);
-	kfree(map);
-
-	set->data = NULL;
-}
-
-static void
-bitmap_ip_timeout_flush(struct ip_set *set)
-{
-	struct bitmap_ip_timeout *map = set->data;
-
-	memset(map->members, IPSET_ELEM_UNSET, map->memsize);
-}
-
-static int
-bitmap_ip_timeout_head(struct ip_set *set, struct sk_buff *skb)
-{
-	const struct bitmap_ip_timeout *map = set->data;
-	struct nlattr *nested;
-
-	nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
-	if (!nested)
-		goto nla_put_failure;
-	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, htonl(map->first_ip));
-	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
-	if (map->netmask != 32)
-		NLA_PUT_U8(skb, IPSET_ATTR_NETMASK, map->netmask);
-	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout));
-	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-		      htonl(atomic_read(&set->ref) - 1));
-	NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
-		      htonl(sizeof(*map) + map->memsize));
-	ipset_nest_end(skb, nested);
-
-	return 0;
-nla_put_failure:
-	return -EFAULT;
-}
-
-static int
-bitmap_ip_timeout_list(const struct ip_set *set,
-		       struct sk_buff *skb, struct netlink_callback *cb)
-{
-	const struct bitmap_ip_timeout *map = set->data;
-	struct nlattr *adt, *nested;
-	u32 id, first = cb->args[2];
-	const unsigned long *table = map->members;
-
-	adt = ipset_nest_start(skb, IPSET_ATTR_ADT);
-	if (!adt)
-		return -EFAULT;
-	for (; cb->args[2] < map->elements; cb->args[2]++) {
-		id = cb->args[2];
-		if (!bitmap_ip_timeout_test(map, id))
-			continue;
-		nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
-		if (!nested) {
-			if (id == first) {
-				nla_nest_cancel(skb, adt);
-				return -EFAULT;
-			} else
-				goto nla_put_failure;
-		}
-		NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP,
-				htonl(map->first_ip + id * map->hosts));
-		NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-			      htonl(ip_set_timeout_get(table[id])));
-		ipset_nest_end(skb, nested);
-	}
-	ipset_nest_end(skb, adt);
-
-	/* Set listing finished */
-	cb->args[2] = 0;
-
-	return 0;
-
-nla_put_failure:
-	nla_nest_cancel(skb, nested);
-	ipset_nest_end(skb, adt);
-	return 0;
-}
-
-static bool
-bitmap_ip_timeout_same_set(const struct ip_set *a, const struct ip_set *b)
-{
-	const struct bitmap_ip_timeout *x = a->data;
-	const struct bitmap_ip_timeout *y = b->data;
-
-	return x->first_ip == y->first_ip &&
-	       x->last_ip == y->last_ip &&
-	       x->netmask == y->netmask &&
-	       x->timeout == y->timeout;
-}
-
-static const struct ip_set_type_variant bitmap_ip_timeout = {
-	.kadt	= bitmap_ip_timeout_kadt,
-	.uadt	= bitmap_ip_timeout_uadt,
-	.destroy = bitmap_ip_timeout_destroy,
-	.flush	= bitmap_ip_timeout_flush,
-	.head	= bitmap_ip_timeout_head,
-	.list	= bitmap_ip_timeout_list,
-	.same_set = bitmap_ip_timeout_same_set,
+static const struct ip_set_type_variant bitmap_tip = {
+	.kadt	= bitmap_ip_kadt,
+	.uadt	= bitmap_ip_uadt,
+	.adt	= {
+		[IPSET_ADD] = bitmap_ip_tadd,
+		[IPSET_DEL] = bitmap_ip_tdel,
+		[IPSET_TEST] = bitmap_ip_ttest,
+	},
+	.destroy = bitmap_ip_destroy,
+	.flush	= bitmap_ip_flush,
+	.head	= bitmap_ip_head,
+	.list	= bitmap_ip_tlist,
+	.same_set = bitmap_ip_same_set,
 };
 
 static void
 bitmap_ip_gc(unsigned long ul_set)
 {
 	struct ip_set *set = (struct ip_set *) ul_set;
-	struct bitmap_ip_timeout *map = set->data;
+	struct bitmap_ip *map = set->data;
 	unsigned long *table = map->members;
 	u32 id;
 
@@ -552,7 +415,7 @@ bitmap_ip_gc(unsigned long ul_set)
 static void
 bitmap_ip_gc_init(struct ip_set *set)
 {
-	struct bitmap_ip_timeout *map = set->data;
+	struct bitmap_ip *map = set->data;
 
 	init_timer(&map->gc);
 	map->gc.data = (unsigned long) set;
@@ -563,21 +426,12 @@ bitmap_ip_gc_init(struct ip_set *set)
 
 /* Create bitmap:ip type of sets */
 
-static const struct nla_policy
-bitmap_ip_create_policy[IPSET_ATTR_CREATE_MAX+1] = {
-	[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
-	[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
-	[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
-	[IPSET_ATTR_NETMASK]	= { .type = NLA_U8  },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-};
-
 static bool
 init_map_ip(struct ip_set *set, struct bitmap_ip *map,
 	    u32 first_ip, u32 last_ip,
 	    u32 elements, u32 hosts, u8 netmask)
 {
-	map->members = ip_set_alloc(map->memsize, GFP_KERNEL);
+	map->members = ip_set_alloc(map->memsize);
 	if (!map->members)
 		return false;
 	map->first_ip = first_ip;
@@ -585,6 +439,7 @@ init_map_ip(struct ip_set *set, struct bitmap_ip *map,
 	map->elements = elements;
 	map->hosts = hosts;
 	map->netmask = netmask;
+	map->timeout = IPSET_NO_TIMEOUT;
 
 	set->data = map;
 	set->family = AF_INET;
@@ -593,18 +448,13 @@ init_map_ip(struct ip_set *set, struct bitmap_ip *map,
 }
 
 static int
-bitmap_ip_create(struct ip_set *set, struct nlattr *head, int len,
-		 u32 flags)
+bitmap_ip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 {
-	struct nlattr *tb[IPSET_ATTR_CREATE_MAX+1];
+	struct bitmap_ip *map;
 	u32 first_ip, last_ip, hosts, elements;
 	u8 netmask = 32;
 	int ret;
 
-	if (nla_parse(tb, IPSET_ATTR_CREATE_MAX, head, len,
-		      bitmap_ip_create_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_IP] ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 		return -IPSET_ERR_PROTOCOL;
@@ -628,7 +478,7 @@ bitmap_ip_create(struct ip_set *set, struct nlattr *head, int len,
 
 		if (cidr >= 32)
 			return -IPSET_ERR_INVALID_CIDR;
-		last_ip = first_ip | ~ip_set_hostmask(cidr);
+		ip_set_mask_from_to(first_ip, last_ip, cidr);
 	} else
 		return -IPSET_ERR_PROTOCOL;
 
@@ -664,37 +514,27 @@ bitmap_ip_create(struct ip_set *set, struct nlattr *head, int len,
 
 	pr_debug("hosts %u, elements %u\n", hosts, elements);
 
-	if (tb[IPSET_ATTR_TIMEOUT]) {
-		struct bitmap_ip_timeout *map;
-
 	map = kzalloc(sizeof(*map), GFP_KERNEL);
 	if (!map)
 		return -ENOMEM;
 
+	if (tb[IPSET_ATTR_TIMEOUT]) {
 		map->memsize = elements * sizeof(unsigned long);
 
-		if (!init_map_ip(set, (struct bitmap_ip *)map,
-				 first_ip, last_ip,
+		if (!init_map_ip(set, map, first_ip, last_ip,
 				 elements, hosts, netmask)) {
 			kfree(map);
 			return -ENOMEM;
 		}
 
 		map->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
-		set->variant = &bitmap_ip_timeout;
+		set->variant = &bitmap_tip;
 
 		bitmap_ip_gc_init(set);
 	} else {
-		struct bitmap_ip *map;
-
-		map = kzalloc(sizeof(*map), GFP_KERNEL);
-		if (!map)
-			return -ENOMEM;
-
 		map->memsize = bitmap_bytes(0, elements - 1);
 
-		if (!init_map_ip(set, map,
-				 first_ip, last_ip,
+		if (!init_map_ip(set, map, first_ip, last_ip,
 				 elements, hosts, netmask)) {
 			kfree(map);
 			return -ENOMEM;
@@ -711,8 +551,23 @@ static struct ip_set_type bitmap_ip_type __read_mostly = {
 	.features	= IPSET_TYPE_IP,
 	.dimension	= IPSET_DIM_ONE,
 	.family		= AF_INET,
-	.revision	= 0,
+	.revision_min	= 0,
+	.revision_max	= 0,
 	.create		= bitmap_ip_create,
+	.create_policy	= {
+		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
+		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
+		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
+		[IPSET_ATTR_NETMASK]	= { .type = NLA_U8  },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+	},
+	.adt_policy	= {
+		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
+		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
+		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
+	},
 	.me		= THIS_MODULE,
 };
 

extensions/ipset-6/ip_set_bitmap_ipmac.c

@@ -15,9 +15,6 @@
 #include <linux/etherdevice.h>
 #include <linux/skbuff.h>
 #include <linux/errno.h>
-#include <linux/uaccess.h>
-#include <linux/bitops.h>
-#include <linux/spinlock.h>
 #include <linux/if_ether.h>
 #include <linux/netlink.h>
 #include <linux/jiffies.h>
@@ -102,7 +99,7 @@ bitmap_ipmac_exist(const struct ipmac_telem *elem)
 /* Base variant */
 
 static int
-bitmap_ipmac_test(struct ip_set *set, void *value, u32 timeout)
+bitmap_ipmac_test(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
 	const struct bitmap_ipmac *map = set->data;
 	const struct ipmac *data = value;
@@ -120,7 +117,7 @@ bitmap_ipmac_test(struct ip_set *set, void *value, u32 timeout)
 }
 
 static int
-bitmap_ipmac_add(struct ip_set *set, void *value, u32 timeout)
+bitmap_ipmac_add(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
 	struct bitmap_ipmac *map = set->data;
 	const struct ipmac *data = value;
@@ -149,7 +146,7 @@ bitmap_ipmac_add(struct ip_set *set, void *value, u32 timeout)
 }
 
 static int
-bitmap_ipmac_del(struct ip_set *set, void *value, u32 timeout)
+bitmap_ipmac_del(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
 	struct bitmap_ipmac *map = set->data;
 	const struct ipmac *data = value;
@@ -175,7 +172,7 @@ bitmap_ipmac_list(const struct ip_set *set,
 
 	atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
 	if (!atd)
-		return -EFAULT;
+		return -EMSGSIZE;
 	for (; cb->args[2] <= last; cb->args[2]++) {
 		id = cb->args[2];
 		elem = bitmap_ipmac_elem(map, id);
@@ -185,7 +182,7 @@ bitmap_ipmac_list(const struct ip_set *set,
 		if (!nested) {
 			if (id == first) {
 				nla_nest_cancel(skb, atd);
-				return -EFAULT;
+				return -EMSGSIZE;
 			} else
 				goto nla_put_failure;
 		}
@@ -205,13 +202,17 @@ bitmap_ipmac_list(const struct ip_set *set,
 nla_put_failure:
 	nla_nest_cancel(skb, nested);
 	ipset_nest_end(skb, atd);
+	if (unlikely(id == first)) {
+		cb->args[2] = 0;
+		return -EMSGSIZE;
+	}
 	return 0;
 }
 
 /* Timeout variant */
 
 static int
-bitmap_ipmac_ttest(struct ip_set *set, void *value, u32 timeout)
+bitmap_ipmac_ttest(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
 	const struct bitmap_ipmac *map = set->data;
 	const struct ipmac *data = value;
@@ -230,15 +231,16 @@ bitmap_ipmac_ttest(struct ip_set *set, void *value, u32 timeout)
 }
 
 static int
-bitmap_ipmac_tadd(struct ip_set *set, void *value, u32 timeout)
+bitmap_ipmac_tadd(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
 	struct bitmap_ipmac *map = set->data;
 	const struct ipmac *data = value;
 	struct ipmac_telem *elem = bitmap_ipmac_elem(map, data->id);
+	bool flag_exist = flags & IPSET_FLAG_EXIST;
 
 	switch (elem->match) {
 	case MAC_UNSET:
-		if (!data->ether)
+		if (!(data->ether || flag_exist))
 			/* Already added without ethernet address */
 			return -IPSET_ERR_EXIST;
 		/* Fill the MAC address and activate the timer */
@@ -250,7 +252,7 @@ bitmap_ipmac_tadd(struct ip_set *set, void *value, u32 timeout)
 		elem->timeout = ip_set_timeout_set(timeout);
 		break;
 	case MAC_FILLED:
-		if (!bitmap_expired(map, data->id))
+		if (!(bitmap_expired(map, data->id) || flag_exist))
 			return -IPSET_ERR_EXIST;
 		/* Fall through */
 	case MAC_EMPTY:
@@ -272,7 +274,7 @@ bitmap_ipmac_tadd(struct ip_set *set, void *value, u32 timeout)
 }
 
 static int
-bitmap_ipmac_tdel(struct ip_set *set, void *value, u32 timeout)
+bitmap_ipmac_tdel(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
 	struct bitmap_ipmac *map = set->data;
 	const struct ipmac *data = value;
@@ -298,7 +300,7 @@ bitmap_ipmac_tlist(const struct ip_set *set,
 
 	atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
 	if (!atd)
-		return -EFAULT;
+		return -EMSGSIZE;
 	for (; cb->args[2] <= last; cb->args[2]++) {
 		id = cb->args[2];
 		elem = bitmap_ipmac_elem(map, id);
@@ -308,7 +310,7 @@ bitmap_ipmac_tlist(const struct ip_set *set,
 		if (!nested) {
 			if (id == first) {
 				nla_nest_cancel(skb, atd);
-				return -EFAULT;
+				return -EMSGSIZE;
 			} else
 				goto nla_put_failure;
 		}
@@ -331,18 +333,23 @@ bitmap_ipmac_tlist(const struct ip_set *set,
 nla_put_failure:
 	nla_nest_cancel(skb, nested);
 	ipset_nest_end(skb, atd);
-	return 0;
+	return -EMSGSIZE;
 }
 
 static int
 bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
-		  enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+		  const struct xt_action_param *par,
+		  enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 {
 	struct bitmap_ipmac *map = set->data;
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct ipmac data;
 
-	data.id = ntohl(ip4addr(skb, flags & IPSET_DIM_ONE_SRC));
+	/* MAC can be src only */
+	if (!(opt->flags & IPSET_DIM_TWO_SRC))
+		return 0;
+
+	data.id = ntohl(ip4addr(skb, opt->flags & IPSET_DIM_ONE_SRC));
 	if (data.id < map->first_ip || data.id > map->last_ip)
 		return -IPSET_ERR_BITMAP_RANGE;
 
@@ -354,32 +361,19 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
 	data.id -= map->first_ip;
 	data.ether = eth_hdr(skb)->h_source;
 
-	return adtfn(set, &data, map->timeout);
+	return adtfn(set, &data, opt_timeout(opt, map), opt->cmdflags);
 }
 
-static const struct nla_policy
-bitmap_ipmac_adt_policy[IPSET_ATTR_ADT_MAX + 1] = {
-	[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
-	[IPSET_ATTR_ETHER]	= { .type = NLA_BINARY, .len  = ETH_ALEN },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-	[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
-};
-
 static int
-bitmap_ipmac_uadt(struct ip_set *set, struct nlattr *head, int len,
-		  enum ipset_adt adt, u32 *lineno, u32 flags)
+bitmap_ipmac_uadt(struct ip_set *set, struct nlattr *tb[],
+		  enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	const struct bitmap_ipmac *map = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct ipmac data;
 	u32 timeout = map->timeout;
 	int ret = 0;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      bitmap_ipmac_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_IP] ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 		return -IPSET_ERR_PROTOCOL;
@@ -407,7 +401,7 @@ bitmap_ipmac_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 	data.id -= map->first_ip;
 
-	ret = adtfn(set, &data, timeout);
+	ret = adtfn(set, &data, timeout, flags);
 
 	return ip_set_eexist(ret, flags) ? 0 : ret;
 }
@@ -446,8 +440,7 @@ bitmap_ipmac_head(struct ip_set *set, struct sk_buff *skb)
 		goto nla_put_failure;
 	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, htonl(map->first_ip));
 	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
-	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-		      htonl(atomic_read(&set->ref) - 1));
+	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
 	NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
 		      htonl(sizeof(*map)
 			    + (map->last_ip - map->first_ip + 1) * map->dsize));
@@ -457,7 +450,7 @@ bitmap_ipmac_head(struct ip_set *set, struct sk_buff *skb)
 
 	return 0;
 nla_put_failure:
-	return -EFAULT;
+	return -EMSGSIZE;
 }
 
 static bool
@@ -538,20 +531,11 @@ bitmap_ipmac_gc_init(struct ip_set *set)
 
 /* Create bitmap:ip,mac type of sets */
 
-static const struct nla_policy
-bitmap_ipmac_create_policy[IPSET_ATTR_CREATE_MAX+1] = {
-	[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
-	[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
-	[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-};
-
 static bool
 init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,
 	       u32 first_ip, u32 last_ip)
 {
-	map->members = ip_set_alloc((last_ip - first_ip + 1) * map->dsize,
-				    GFP_KERNEL);
+	map->members = ip_set_alloc((last_ip - first_ip + 1) * map->dsize);
 	if (!map->members)
 		return false;
 	map->first_ip = first_ip;
@@ -565,18 +549,13 @@ init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,
 }
 
 static int
-bitmap_ipmac_create(struct ip_set *set, struct nlattr *head, int len,
+bitmap_ipmac_create(struct ip_set *set, struct nlattr *tb[],
 		    u32 flags)
 {
-	struct nlattr *tb[IPSET_ATTR_CREATE_MAX+1];
 	u32 first_ip, last_ip, elements;
 	struct bitmap_ipmac *map;
 	int ret;
 
-	if (nla_parse(tb, IPSET_ATTR_CREATE_MAX, head, len,
-		      bitmap_ipmac_create_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_IP] ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 		return -IPSET_ERR_PROTOCOL;
@@ -600,7 +579,7 @@ bitmap_ipmac_create(struct ip_set *set, struct nlattr *head, int len,
 
 		if (cidr >= 32)
 			return -IPSET_ERR_INVALID_CIDR;
-		last_ip = first_ip | ~ip_set_hostmask(cidr);
+		ip_set_mask_from_to(first_ip, last_ip, cidr);
 	} else
 		return -IPSET_ERR_PROTOCOL;
 
@@ -645,8 +624,22 @@ static struct ip_set_type bitmap_ipmac_type = {
 	.features	= IPSET_TYPE_IP | IPSET_TYPE_MAC,
 	.dimension	= IPSET_DIM_TWO,
 	.family		= AF_INET,
-	.revision	= 0,
+	.revision_min	= 0,
+	.revision_max	= 0,
 	.create		= bitmap_ipmac_create,
+	.create_policy	= {
+		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
+		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
+		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+	},
+	.adt_policy	= {
+		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
+		[IPSET_ATTR_ETHER]	= { .type = NLA_BINARY,
+					    .len  = ETH_ALEN },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
+	},
 	.me		= THIS_MODULE,
 };
 

extensions/ipset-6/ip_set_bitmap_port.c

@@ -9,13 +9,8 @@
 
 #include <linux/module.h>
 #include <linux/ip.h>
-#include <linux/tcp.h>
-#include <linux/udp.h>
 #include <linux/skbuff.h>
 #include <linux/errno.h>
-#include <linux/uaccess.h>
-#include <linux/bitops.h>
-#include <linux/spinlock.h>
 #include <linux/netlink.h>
 #include <linux/jiffies.h>
 #include <linux/timer.h>
@@ -32,24 +27,33 @@ MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
 MODULE_DESCRIPTION("bitmap:port type of IP sets");
 MODULE_ALIAS("ip_set_bitmap:port");
 
-/* Base variant */
-
+/* Type structure */
 struct bitmap_port {
 	void *members;		/* the set members */
 	u16 first_port;		/* host byte order, included in range */
 	u16 last_port;		/* host byte order, included in range */
 	size_t memsize;		/* members size */
+	u32 timeout;		/* timeout parameter */
+	struct timer_list gc;	/* garbage collection */
 };
 
-static inline int
-bitmap_port_test(const struct bitmap_port *map, u16 id)
+/* Base variant */
+
+static int
+bitmap_port_test(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
+	const struct bitmap_port *map = set->data;
+	u16 id = *(u16 *)value;
+
 	return !!test_bit(id, map->members);
 }
 
-static inline int
-bitmap_port_add(struct bitmap_port *map, u16 id)
+static int
+bitmap_port_add(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
+	struct bitmap_port *map = set->data;
+	u16 id = *(u16 *)value;
+
 	if (test_and_set_bit(id, map->members))
 		return -IPSET_ERR_EXIST;
 
@@ -57,8 +61,11 @@ bitmap_port_add(struct bitmap_port *map, u16 id)
 }
 
 static int
-bitmap_port_del(struct bitmap_port *map, u16 id)
+bitmap_port_del(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
+	struct bitmap_port *map = set->data;
+	u16 id = *(u16 *)value;
+
 	if (!test_and_clear_bit(id, map->members))
 		return -IPSET_ERR_EXIST;
 
@@ -66,14 +73,151 @@ bitmap_port_del(struct bitmap_port *map, u16 id)
 }
 
 static int
-bitmap_port_kadt(struct ip_set *set, const struct sk_buff *skb,
-		 enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+bitmap_port_list(const struct ip_set *set,
+		 struct sk_buff *skb, struct netlink_callback *cb)
+{
+	const struct bitmap_port *map = set->data;
+	struct nlattr *atd, *nested;
+	u16 id, first = cb->args[2];
+	u16 last = map->last_port - map->first_port;
+
+	atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
+	if (!atd)
+		return -EMSGSIZE;
+	for (; cb->args[2] <= last; cb->args[2]++) {
+		id = cb->args[2];
+		if (!test_bit(id, map->members))
+			continue;
+		nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
+		if (!nested) {
+			if (id == first) {
+				nla_nest_cancel(skb, atd);
+				return -EMSGSIZE;
+			} else
+				goto nla_put_failure;
+		}
+		NLA_PUT_NET16(skb, IPSET_ATTR_PORT,
+			      htons(map->first_port + id));
+		ipset_nest_end(skb, nested);
+	}
+	ipset_nest_end(skb, atd);
+	/* Set listing finished */
+	cb->args[2] = 0;
+
+	return 0;
+
+nla_put_failure:
+	nla_nest_cancel(skb, nested);
+	ipset_nest_end(skb, atd);
+	if (unlikely(id == first)) {
+		cb->args[2] = 0;
+		return -EMSGSIZE;
+	}
+	return 0;
+}
+
+/* Timeout variant */
+
+static int
+bitmap_port_ttest(struct ip_set *set, void *value, u32 timeout, u32 flags)
+{
+	const struct bitmap_port *map = set->data;
+	const unsigned long *members = map->members;
+	u16 id = *(u16 *)value;
+
+	return ip_set_timeout_test(members[id]);
+}
+
+static int
+bitmap_port_tadd(struct ip_set *set, void *value, u32 timeout, u32 flags)
 {
 	struct bitmap_port *map = set->data;
+	unsigned long *members = map->members;
+	u16 id = *(u16 *)value;
+
+	if (ip_set_timeout_test(members[id]) && !(flags & IPSET_FLAG_EXIST))
+		return -IPSET_ERR_EXIST;
+
+	members[id] = ip_set_timeout_set(timeout);
+
+	return 0;
+}
+
+static int
+bitmap_port_tdel(struct ip_set *set, void *value, u32 timeout, u32 flags)
+{
+	struct bitmap_port *map = set->data;
+	unsigned long *members = map->members;
+	u16 id = *(u16 *)value;
+	int ret = -IPSET_ERR_EXIST;
+
+	if (ip_set_timeout_test(members[id]))
+		ret = 0;
+
+	members[id] = IPSET_ELEM_UNSET;
+	return ret;
+}
+
+static int
+bitmap_port_tlist(const struct ip_set *set,
+		  struct sk_buff *skb, struct netlink_callback *cb)
+{
+	const struct bitmap_port *map = set->data;
+	struct nlattr *adt, *nested;
+	u16 id, first = cb->args[2];
+	u16 last = map->last_port - map->first_port;
+	const unsigned long *members = map->members;
+
+	adt = ipset_nest_start(skb, IPSET_ATTR_ADT);
+	if (!adt)
+		return -EMSGSIZE;
+	for (; cb->args[2] <= last; cb->args[2]++) {
+		id = cb->args[2];
+		if (!ip_set_timeout_test(members[id]))
+			continue;
+		nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
+		if (!nested) {
+			if (id == first) {
+				nla_nest_cancel(skb, adt);
+				return -EMSGSIZE;
+			} else
+				goto nla_put_failure;
+		}
+		NLA_PUT_NET16(skb, IPSET_ATTR_PORT,
+			      htons(map->first_port + id));
+		NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
+			      htonl(ip_set_timeout_get(members[id])));
+		ipset_nest_end(skb, nested);
+	}
+	ipset_nest_end(skb, adt);
+
+	/* Set listing finished */
+	cb->args[2] = 0;
+
+	return 0;
+
+nla_put_failure:
+	nla_nest_cancel(skb, nested);
+	ipset_nest_end(skb, adt);
+	if (unlikely(id == first)) {
+		cb->args[2] = 0;
+		return -EMSGSIZE;
+	}
+	return 0;
+}
+
+static int
+bitmap_port_kadt(struct ip_set *set, const struct sk_buff *skb,
+		 const struct xt_action_param *par,
+		 enum ipset_adt adt, const struct ip_set_adt_opt *opt)
+{
+	struct bitmap_port *map = set->data;
+	ipset_adtfn adtfn = set->variant->adt[adt];
 	__be16 __port;
 	u16 port = 0;
 
-	if (!ip_set_get_ip_port(skb, pf, flags & IPSET_DIM_ONE_SRC, &__port))
+	if (!ip_set_get_ip_port(skb, opt->family,
+				opt->flags & IPSET_DIM_ONE_SRC, &__port))
 		return -EINVAL;
 
 	port = ntohs(__port);
@@ -83,41 +227,23 @@ bitmap_port_kadt(struct ip_set *set, const struct sk_buff *skb,
 
 	port -= map->first_port;
 
-	switch (adt) {
-	case IPSET_TEST:
-		return bitmap_port_test(map, port);
-	case IPSET_ADD:
-		return bitmap_port_add(map, port);
-	case IPSET_DEL:
-		return bitmap_port_del(map, port);
-	default:
-		return -EINVAL;
-	}
+	return adtfn(set, &port, opt_timeout(opt, map), opt->cmdflags);
 }
 
-static const struct nla_policy bitmap_port_adt_policy[IPSET_ATTR_ADT_MAX+1] = {
-	[IPSET_ATTR_PORT]	= { .type = NLA_U16 },
-	[IPSET_ATTR_PORT_TO]	= { .type = NLA_U16 },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-	[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
-};
-
 static int
-bitmap_port_uadt(struct ip_set *set, struct nlattr *head, int len,
-		 enum ipset_adt adt, u32 *lineno, u32 flags)
+bitmap_port_uadt(struct ip_set *set, struct nlattr *tb[],
+		 enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	struct bitmap_port *map = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
+	ipset_adtfn adtfn = set->variant->adt[adt];
+	u32 timeout = map->timeout;
 	u32 port;	/* wraparound */
 	u16 id, port_to;
 	int ret = 0;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      bitmap_port_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
-		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO)))
+		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
+		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 		return -IPSET_ERR_PROTOCOL;
 
 	if (tb[IPSET_ATTR_LINENO])
@@ -127,11 +253,16 @@ bitmap_port_uadt(struct ip_set *set, struct nlattr *head, int len,
 	if (port < map->first_port || port > map->last_port)
 		return -IPSET_ERR_BITMAP_RANGE;
 
-	if (tb[IPSET_ATTR_TIMEOUT])
+	if (tb[IPSET_ATTR_TIMEOUT]) {
+		if (!with_timeout(map->timeout))
 			return -IPSET_ERR_TIMEOUT;
+		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
+	}
 
-	if (adt == IPSET_TEST)
-		return bitmap_port_test(map, port - map->first_port);
+	if (adt == IPSET_TEST) {
+		id = port - map->first_port;
+		return adtfn(set, &id, timeout, flags);
+	}
 
 	if (tb[IPSET_ATTR_PORT_TO]) {
 		port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
@@ -148,8 +279,7 @@ bitmap_port_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 	for (; port <= port_to; port++) {
 		id = port - map->first_port;
-		ret = adt == IPSET_ADD ? bitmap_port_add(map, id)
-				       : bitmap_port_del(map, id);
+		ret = adtfn(set, &id, timeout, flags);
 
 		if (ret && !ip_set_eexist(ret, flags))
 			return ret;
@@ -164,6 +294,9 @@ bitmap_port_destroy(struct ip_set *set)
 {
 	struct bitmap_port *map = set->data;
 
+	if (with_timeout(map->timeout))
+		del_timer_sync(&map->gc);
+
 	ip_set_free(map->members);
 	kfree(map);
 
@@ -189,55 +322,16 @@ bitmap_port_head(struct ip_set *set, struct sk_buff *skb)
 		goto nla_put_failure;
 	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, htons(map->first_port));
 	NLA_PUT_NET16(skb, IPSET_ATTR_PORT_TO, htons(map->last_port));
-	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-		      htonl(atomic_read(&set->ref) - 1));
+	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
 	NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
 		      htonl(sizeof(*map) + map->memsize));
+	if (with_timeout(map->timeout))
+		NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout));
 	ipset_nest_end(skb, nested);
 
 	return 0;
 nla_put_failure:
-	return -EFAULT;
-}
-
-static int
-bitmap_port_list(const struct ip_set *set,
-		 struct sk_buff *skb, struct netlink_callback *cb)
-{
-	const struct bitmap_port *map = set->data;
-	struct nlattr *atd, *nested;
-	u16 id, first = cb->args[2];
-	u16 last = map->last_port - map->first_port;
-
-	atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
-	if (!atd)
-		return -EFAULT;
-	for (; cb->args[2] <= last; cb->args[2]++) {
-		id = cb->args[2];
-		if (!test_bit(id, map->members))
-			continue;
-		nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
-		if (!nested) {
-			if (id == first) {
-				nla_nest_cancel(skb, atd);
-				return -EFAULT;
-			} else
-				goto nla_put_failure;
-		}
-		NLA_PUT_NET16(skb, IPSET_ATTR_PORT,
-			      htons(map->first_port + id));
-		ipset_nest_end(skb, nested);
-	}
-	ipset_nest_end(skb, atd);
-	/* Set listing finished */
-	cb->args[2] = 0;
-
-	return 0;
-
-nla_put_failure:
-	nla_nest_cancel(skb, nested);
-	ipset_nest_end(skb, atd);
-	return 0;
+	return -EMSGSIZE;
 }
 
 static bool
@@ -247,12 +341,18 @@ bitmap_port_same_set(const struct ip_set *a, const struct ip_set *b)
 	const struct bitmap_port *y = b->data;
 
 	return x->first_port == y->first_port &&
-	       x->last_port == y->last_port;
+	       x->last_port == y->last_port &&
+	       x->timeout == y->timeout;
 }
 
 static const struct ip_set_type_variant bitmap_port = {
 	.kadt	= bitmap_port_kadt,
 	.uadt	= bitmap_port_uadt,
+	.adt	= {
+		[IPSET_ADD] = bitmap_port_add,
+		[IPSET_DEL] = bitmap_port_del,
+		[IPSET_TEST] = bitmap_port_test,
+	},
 	.destroy = bitmap_port_destroy,
 	.flush	= bitmap_port_flush,
 	.head	= bitmap_port_head,
@@ -260,251 +360,26 @@ static const struct ip_set_type_variant bitmap_port = {
 	.same_set = bitmap_port_same_set,
 };
 
-/* Timeout variant */
-
-struct bitmap_port_timeout {
-	unsigned long *members;	/* the set members */
-	u16 first_port;		/* host byte order, included in range */
-	u16 last_port;		/* host byte order, included in range */
-	size_t memsize;		/* members size */
-
-	u32 timeout;		/* timeout parameter */
-	struct timer_list gc;	/* garbage collection */
-};
-
-static inline bool
-bitmap_port_timeout_test(const struct bitmap_port_timeout *map, u16 id)
-{
-	return ip_set_timeout_test(map->members[id]);
-}
-
-static int
-bitmap_port_timeout_add(const struct bitmap_port_timeout *map,
-			u16 id, u32 timeout)
-{
-	if (bitmap_port_timeout_test(map, id))
-		return -IPSET_ERR_EXIST;
-
-	map->members[id] = ip_set_timeout_set(timeout);
-
-	return 0;
-}
-
-static int
-bitmap_port_timeout_del(const struct bitmap_port_timeout *map,
-			u16 id)
-{
-	int ret = -IPSET_ERR_EXIST;
-
-	if (bitmap_port_timeout_test(map, id))
-		ret = 0;
-
-	map->members[id] = IPSET_ELEM_UNSET;
-	return ret;
-}
-
-static int
-bitmap_port_timeout_kadt(struct ip_set *set, const struct sk_buff *skb,
-			 enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
-{
-	struct bitmap_port_timeout *map = set->data;
-	__be16 __port;
-	u16 port = 0;
-
-	if (!ip_set_get_ip_port(skb, pf, flags & IPSET_DIM_ONE_SRC, &__port))
-		return -EINVAL;
-
-	port = ntohs(__port);
-
-	if (port < map->first_port || port > map->last_port)
-		return -IPSET_ERR_BITMAP_RANGE;
-
-	port -= map->first_port;
-
-	switch (adt) {
-	case IPSET_TEST:
-		return bitmap_port_timeout_test(map, port);
-	case IPSET_ADD:
-		return bitmap_port_timeout_add(map, port, map->timeout);
-	case IPSET_DEL:
-		return bitmap_port_timeout_del(map, port);
-	default:
-		return -EINVAL;
-	}
-}
-
-static int
-bitmap_port_timeout_uadt(struct ip_set *set, struct nlattr *head, int len,
-			 enum ipset_adt adt, u32 *lineno, u32 flags)
-{
-	const struct bitmap_port_timeout *map = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
-	u16 id, port_to;
-	u32 port, timeout = map->timeout;	/* wraparound */
-	int ret = 0;
-
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      bitmap_port_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
-	if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
-		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
-		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
-		return -IPSET_ERR_PROTOCOL;
-
-	if (tb[IPSET_ATTR_LINENO])
-		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
-
-	port = ip_set_get_h16(tb[IPSET_ATTR_PORT]);
-	if (port < map->first_port || port > map->last_port)
-		return -IPSET_ERR_BITMAP_RANGE;
-
-	if (adt == IPSET_TEST)
-		return bitmap_port_timeout_test(map, port - map->first_port);
-
-	if (tb[IPSET_ATTR_PORT_TO]) {
-		port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
-		if (port > port_to) {
-			swap(port, port_to);
-			if (port < map->first_port)
-				return -IPSET_ERR_BITMAP_RANGE;
-		}
-	} else
-		port_to = port;
-
-	if (port_to > map->last_port)
-		return -IPSET_ERR_BITMAP_RANGE;
-
-	if (tb[IPSET_ATTR_TIMEOUT])
-		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
-
-	for (; port <= port_to; port++) {
-		id = port - map->first_port;
-		ret = adt == IPSET_ADD
-			? bitmap_port_timeout_add(map, id, timeout)
-			: bitmap_port_timeout_del(map, id);
-
-		if (ret && !ip_set_eexist(ret, flags))
-			return ret;
-		else
-			ret = 0;
-	}
-	return ret;
-}
-
-static void
-bitmap_port_timeout_destroy(struct ip_set *set)
-{
-	struct bitmap_port_timeout *map = set->data;
-
-	del_timer_sync(&map->gc);
-	ip_set_free(map->members);
-	kfree(map);
-
-	set->data = NULL;
-}
-
-static void
-bitmap_port_timeout_flush(struct ip_set *set)
-{
-	struct bitmap_port_timeout *map = set->data;
-
-	memset(map->members, 0, map->memsize);
-}
-
-static int
-bitmap_port_timeout_head(struct ip_set *set, struct sk_buff *skb)
-{
-	const struct bitmap_port_timeout *map = set->data;
-	struct nlattr *nested;
-
-	nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
-	if (!nested)
-		goto nla_put_failure;
-	NLA_PUT_NET16(skb, IPSET_ATTR_PORT, htons(map->first_port));
-	NLA_PUT_NET16(skb, IPSET_ATTR_PORT_TO, htons(map->last_port));
-	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT , htonl(map->timeout));
-	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-		      htonl(atomic_read(&set->ref) - 1));
-	NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
-		      htonl(sizeof(*map) + map->memsize));
-	ipset_nest_end(skb, nested);
-
-	return 0;
-nla_put_failure:
-	return -EFAULT;
-}
-
-static int
-bitmap_port_timeout_list(const struct ip_set *set,
-			 struct sk_buff *skb, struct netlink_callback *cb)
-{
-	const struct bitmap_port_timeout *map = set->data;
-	struct nlattr *adt, *nested;
-	u16 id, first = cb->args[2];
-	u16 last = map->last_port - map->first_port;
-	const unsigned long *table = map->members;
-
-	adt = ipset_nest_start(skb, IPSET_ATTR_ADT);
-	if (!adt)
-		return -EFAULT;
-	for (; cb->args[2] <= last; cb->args[2]++) {
-		id = cb->args[2];
-		if (!bitmap_port_timeout_test(map, id))
-			continue;
-		nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
-		if (!nested) {
-			if (id == first) {
-				nla_nest_cancel(skb, adt);
-				return -EFAULT;
-			} else
-				goto nla_put_failure;
-		}
-		NLA_PUT_NET16(skb, IPSET_ATTR_PORT,
-			      htons(map->first_port + id));
-		NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
-			      htonl(ip_set_timeout_get(table[id])));
-		ipset_nest_end(skb, nested);
-	}
-	ipset_nest_end(skb, adt);
-
-	/* Set listing finished */
-	cb->args[2] = 0;
-
-	return 0;
-
-nla_put_failure:
-	nla_nest_cancel(skb, nested);
-	ipset_nest_end(skb, adt);
-	return 0;
-}
-
-static bool
-bitmap_port_timeout_same_set(const struct ip_set *a, const struct ip_set *b)
-{
-	const struct bitmap_port_timeout *x = a->data;
-	const struct bitmap_port_timeout *y = b->data;
-
-	return x->first_port == y->first_port &&
-	       x->last_port == y->last_port &&
-	       x->timeout == y->timeout;
-}
-
-static const struct ip_set_type_variant bitmap_port_timeout = {
-	.kadt	= bitmap_port_timeout_kadt,
-	.uadt	= bitmap_port_timeout_uadt,
-	.destroy = bitmap_port_timeout_destroy,
-	.flush	= bitmap_port_timeout_flush,
-	.head	= bitmap_port_timeout_head,
-	.list	= bitmap_port_timeout_list,
-	.same_set = bitmap_port_timeout_same_set,
+static const struct ip_set_type_variant bitmap_tport = {
+	.kadt	= bitmap_port_kadt,
+	.uadt	= bitmap_port_uadt,
+	.adt	= {
+		[IPSET_ADD] = bitmap_port_tadd,
+		[IPSET_DEL] = bitmap_port_tdel,
+		[IPSET_TEST] = bitmap_port_ttest,
+	},
+	.destroy = bitmap_port_destroy,
+	.flush	= bitmap_port_flush,
+	.head	= bitmap_port_head,
+	.list	= bitmap_port_tlist,
+	.same_set = bitmap_port_same_set,
 };
 
 static void
 bitmap_port_gc(unsigned long ul_set)
 {
 	struct ip_set *set = (struct ip_set *) ul_set;
-	struct bitmap_port_timeout *map = set->data;
+	struct bitmap_port *map = set->data;
 	unsigned long *table = map->members;
 	u32 id;	/* wraparound */
 	u16 last = map->last_port - map->first_port;
@@ -524,7 +399,7 @@ bitmap_port_gc(unsigned long ul_set)
 static void
 bitmap_port_gc_init(struct ip_set *set)
 {
-	struct bitmap_port_timeout *map = set->data;
+	struct bitmap_port *map = set->data;
 
 	init_timer(&map->gc);
 	map->gc.data = (unsigned long) set;
@@ -535,22 +410,16 @@ bitmap_port_gc_init(struct ip_set *set)
 
 /* Create bitmap:ip type of sets */
 
-static const struct nla_policy
-bitmap_port_create_policy[IPSET_ATTR_CREATE_MAX+1] = {
-	[IPSET_ATTR_PORT]	= { .type = NLA_U16 },
-	[IPSET_ATTR_PORT_TO]	= { .type = NLA_U16 },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-};
-
 static bool
 init_map_port(struct ip_set *set, struct bitmap_port *map,
 	      u16 first_port, u16 last_port)
 {
-	map->members = ip_set_alloc(map->memsize, GFP_KERNEL);
+	map->members = ip_set_alloc(map->memsize);
 	if (!map->members)
 		return false;
 	map->first_port = first_port;
 	map->last_port = last_port;
+	map->timeout = IPSET_NO_TIMEOUT;
 
 	set->data = map;
 	set->family = AF_UNSPEC;
@@ -559,16 +428,12 @@ init_map_port(struct ip_set *set, struct bitmap_port *map,
 }
 
 static int
-bitmap_port_create(struct ip_set *set, struct nlattr *head, int len,
+bitmap_port_create(struct ip_set *set, struct nlattr *tb[],
 		 u32 flags)
 {
-	struct nlattr *tb[IPSET_ATTR_CREATE_MAX+1];
+	struct bitmap_port *map;
 	u16 first_port, last_port;
 
-	if (nla_parse(tb, IPSET_ATTR_CREATE_MAX, head, len,
-		      bitmap_port_create_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
 		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT_TO) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
@@ -583,33 +448,24 @@ bitmap_port_create(struct ip_set *set, struct nlattr *head, int len,
 		last_port = tmp;
 	}
 
-	if (tb[IPSET_ATTR_TIMEOUT]) {
-		struct bitmap_port_timeout *map;
-
 	map = kzalloc(sizeof(*map), GFP_KERNEL);
 	if (!map)
 		return -ENOMEM;
 
+	if (tb[IPSET_ATTR_TIMEOUT]) {
 		map->memsize = (last_port - first_port + 1)
 			       * sizeof(unsigned long);
 
-		if (!init_map_port(set, (struct bitmap_port *) map,
-				   first_port, last_port)) {
+		if (!init_map_port(set, map, first_port, last_port)) {
 			kfree(map);
 			return -ENOMEM;
 		}
 
 		map->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
-		set->variant = &bitmap_port_timeout;
+		set->variant = &bitmap_tport;
 
 		bitmap_port_gc_init(set);
 	} else {
-		struct bitmap_port *map;
-
-		map = kzalloc(sizeof(*map), GFP_KERNEL);
-		if (!map)
-			return -ENOMEM;
-
 		map->memsize = bitmap_bytes(0, last_port - first_port);
 		pr_debug("memsize: %zu\n", map->memsize);
 		if (!init_map_port(set, map, first_port, last_port)) {
@@ -628,8 +484,20 @@ static struct ip_set_type bitmap_port_type = {
 	.features	= IPSET_TYPE_PORT,
 	.dimension	= IPSET_DIM_ONE,
 	.family		= AF_UNSPEC,
-	.revision	= 0,
+	.revision_min	= 0,
+	.revision_max	= 0,
 	.create		= bitmap_port_create,
+	.create_policy	= {
+		[IPSET_ATTR_PORT]	= { .type = NLA_U16 },
+		[IPSET_ATTR_PORT_TO]	= { .type = NLA_U16 },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+	},
+	.adt_policy	= {
+		[IPSET_ATTR_PORT]	= { .type = NLA_U16 },
+		[IPSET_ATTR_PORT_TO]	= { .type = NLA_U16 },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
+	},
 	.me		= THIS_MODULE,
 };
 

extensions/ipset-6/ip_set_getport.c

@@ -11,8 +11,10 @@
 #include <linux/skbuff.h>
 #include <linux/icmp.h>
 #include <linux/icmpv6.h>
+#include <linux/sctp.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <net/ip.h>
+#include <net/ipv6.h>
 
 #include "ip_set_getport.h"
 
@@ -34,7 +36,20 @@ get_port(const struct sk_buff *skb, int protocol, unsigned int protooff,
 		*port = src ? th->source : th->dest;
 		break;
 	}
-	case IPPROTO_UDP: {
+	case IPPROTO_SCTP: {
+		sctp_sctphdr_t _sh;
+		const sctp_sctphdr_t *sh;
+
+		sh = skb_header_pointer(skb, protooff, sizeof(_sh), &_sh);
+		if (sh == NULL)
+			/* No choice either */
+			return false;
+
+		*port = src ? sh->source : sh->dest;
+		break;
+	}
+	case IPPROTO_UDP:
+	case IPPROTO_UDPLITE: {
 		struct udphdr _udph;
 		const struct udphdr *uh;
 
@@ -93,21 +108,23 @@ ip_set_get_ip4_port(const struct sk_buff *skb, bool src,
 }
 EXPORT_SYMBOL_GPL(ip_set_get_ip4_port);
 
+#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
 bool
 ip_set_get_ip6_port(const struct sk_buff *skb, bool src,
 		    __be16 *port, u8 *proto)
 {
-	unsigned int protooff = 0;
-	int protocol;
-	unsigned short fragoff;
+	int protoff;
+	u8 nexthdr;
 
-	protocol = ipv6_find_hdr(skb, &protooff, -1, &fragoff);
-	if (protocol <= 0 || fragoff)
+	nexthdr = ipv6_hdr(skb)->nexthdr;
+	protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr);
+	if (protoff < 0)
 		return false;
 
-	return get_port(skb, protocol, protooff, src, port, proto);
+	return get_port(skb, nexthdr, protoff, src, port, proto);
 }
 EXPORT_SYMBOL_GPL(ip_set_get_ip6_port);
+#endif
 
 bool
 ip_set_get_ip_port(const struct sk_buff *skb, u8 pf, bool src, __be16 *port)
@@ -118,8 +135,10 @@ ip_set_get_ip_port(const struct sk_buff *skb, u8 pf, bool src, __be16 *port)
 	switch (pf) {
 	case AF_INET:
 		ret = ip_set_get_ip4_port(skb, src, port, &proto);
+		break;
 	case AF_INET6:
 		ret = ip_set_get_ip6_port(skb, src, port, &proto);
+		break;
 	default:
 		return false;
 	}

extensions/ipset-6/ip_set_getport.h

@@ -0,0 +1,33 @@
+#ifndef _IP_SET_GETPORT_H
+#define _IP_SET_GETPORT_H
+
+extern bool ip_set_get_ip4_port(const struct sk_buff *skb, bool src,
+				__be16 *port, u8 *proto);
+
+#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+extern bool ip_set_get_ip6_port(const struct sk_buff *skb, bool src,
+				__be16 *port, u8 *proto);
+#else
+static inline bool ip_set_get_ip6_port(const struct sk_buff *skb, bool src,
+				       __be16 *port, u8 *proto)
+{
+	return false;
+}
+#endif
+
+extern bool ip_set_get_ip_port(const struct sk_buff *skb, u8 pf, bool src,
+				__be16 *port);
+
+static inline bool ip_set_proto_with_ports(u8 proto)
+{
+	switch (proto) {
+	case IPPROTO_TCP:
+	case IPPROTO_SCTP:
+	case IPPROTO_UDP:
+	case IPPROTO_UDPLITE:
+		return true;
+	}
+	return false;
+}
+
+#endif /*_IP_SET_GETPORT_H*/

extensions/ipset-6/ip_set_hash.h

@@ -11,6 +11,10 @@ enum {
 	IPSET_ERR_INVALID_PROTO,
 	/* Protocol missing but must be specified */
 	IPSET_ERR_MISSING_PROTO,
+	/* Range not supported */
+	IPSET_ERR_HASH_RANGE_UNSUPPORTED,
+	/* Invalid range */
+	IPSET_ERR_HASH_RANGE,
 };
 
 #ifdef __KERNEL__

extensions/ipset-6/ip_set_hash_ip.c

@@ -12,9 +12,6 @@
 #include <linux/ip.h>
 #include <linux/skbuff.h>
 #include <linux/errno.h>
-#include <linux/uaccess.h>
-#include <linux/bitops.h>
-#include <linux/spinlock.h>
 #include <linux/random.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -111,45 +108,39 @@ nla_put_failure:
 #define HOST_MASK	32
 #include "ip_set_ahash.h"
 
+static inline void
+hash_ip4_data_next(struct ip_set_hash *h, const struct hash_ip4_elem *d)
+{
+	h->next.ip = ntohl(d->ip);
+}
+
 static int
 hash_ip4_kadt(struct ip_set *set, const struct sk_buff *skb,
-	      enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+	      const struct xt_action_param *par,
+	      enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 {
 	const struct ip_set_hash *h = set->data;
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	__be32 ip;
 
-	ip4addrptr(skb, flags & IPSET_DIM_ONE_SRC, &ip);
+	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &ip);
 	ip &= ip_set_netmask(h->netmask);
 	if (ip == 0)
 		return -EINVAL;
 
-	return adtfn(set, &ip, h->timeout);
+	return adtfn(set, &ip, opt_timeout(opt, h), opt->cmdflags);
 }
 
-static const struct nla_policy hash_ip4_adt_policy[IPSET_ATTR_ADT_MAX + 1] = {
-	[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
-	[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
-	[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-	[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
-};
-
 static int
-hash_ip4_uadt(struct ip_set *set, struct nlattr *head, int len,
-	      enum ipset_adt adt, u32 *lineno, u32 flags)
+hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[],
+	      enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	const struct ip_set_hash *h = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	u32 ip, ip_to, hosts, timeout = h->timeout;
 	__be32 nip;
 	int ret = 0;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      hash_ip4_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_IP] ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 		return -IPSET_ERR_PROTOCOL;
@@ -173,7 +164,7 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *head, int len,
 		nip = htonl(ip);
 		if (nip == 0)
 			return -IPSET_ERR_HASH_ELEM;
-		return adtfn(set, &nip, timeout);
+		return adtfn(set, &nip, timeout, flags);
 	}
 
 	if (tb[IPSET_ATTR_IP_TO]) {
@@ -187,18 +178,19 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 		if (cidr > 32)
 			return -IPSET_ERR_INVALID_CIDR;
-		ip &= ip_set_hostmask(cidr);
-		ip_to = ip | ~ip_set_hostmask(cidr);
+		ip_set_mask_from_to(ip, ip_to, cidr);
 	} else
 		ip_to = ip;
 
 	hosts = h->netmask == 32 ? 1 : 2 << (32 - h->netmask - 1);
 
+	if (retried)
+		ip = h->next.ip;
 	for (; !before(ip_to, ip); ip += hosts) {
 		nip = htonl(ip);
 		if (nip == 0)
 			return -IPSET_ERR_HASH_ELEM;
-		ret = adtfn(set, &nip, timeout);
+		ret = adtfn(set, &nip, timeout, flags);
 
 		if (ret && !ip_set_eexist(ret, flags))
 			return ret;
@@ -297,20 +289,26 @@ nla_put_failure:
 #define HOST_MASK	128
 #include "ip_set_ahash.h"
 
+static inline void
+hash_ip6_data_next(struct ip_set_hash *h, const struct hash_ip6_elem *d)
+{
+}
+
 static int
 hash_ip6_kadt(struct ip_set *set, const struct sk_buff *skb,
-	      enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+	      const struct xt_action_param *par,
+	      enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 {
 	const struct ip_set_hash *h = set->data;
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	union nf_inet_addr ip;
 
-	ip6addrptr(skb, flags & IPSET_DIM_ONE_SRC, &ip.in6);
+	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &ip.in6);
 	ip6_netmask(&ip, h->netmask);
 	if (ipv6_addr_any(&ip.in6))
 		return -EINVAL;
 
-	return adtfn(set, &ip, h->timeout);
+	return adtfn(set, &ip, opt_timeout(opt, h), opt->cmdflags);
 }
 
 static const struct nla_policy hash_ip6_adt_policy[IPSET_ATTR_ADT_MAX + 1] = {
@@ -320,22 +318,19 @@ static const struct nla_policy hash_ip6_adt_policy[IPSET_ATTR_ADT_MAX + 1] = {
 };
 
 static int
-hash_ip6_uadt(struct ip_set *set, struct nlattr *head, int len,
-	      enum ipset_adt adt, u32 *lineno, u32 flags)
+hash_ip6_uadt(struct ip_set *set, struct nlattr *tb[],
+	      enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	const struct ip_set_hash *h = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	union nf_inet_addr ip;
 	u32 timeout = h->timeout;
 	int ret;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      hash_ip6_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_IP] ||
-		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
+		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
+		     tb[IPSET_ATTR_IP_TO] ||
+		     tb[IPSET_ATTR_CIDR]))
 		return -IPSET_ERR_PROTOCOL;
 
 	if (tb[IPSET_ATTR_LINENO])
@@ -355,27 +350,16 @@ hash_ip6_uadt(struct ip_set *set, struct nlattr *head, int len,
 		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 	}
 
-	ret = adtfn(set, &ip, timeout);
+	ret = adtfn(set, &ip, timeout, flags);
 
 	return ip_set_eexist(ret, flags) ? 0 : ret;
 }
 
 /* Create hash:ip type of sets */
 
-static const struct nla_policy
-hash_ip_create_policy[IPSET_ATTR_CREATE_MAX+1] = {
-	[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
-	[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
-	[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
-	[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-	[IPSET_ATTR_NETMASK]	= { .type = NLA_U8  },
-};
-
 static int
-hash_ip_create(struct ip_set *set, struct nlattr *head, int len, u32 flags)
+hash_ip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 {
-	struct nlattr *tb[IPSET_ATTR_CREATE_MAX+1];
 	u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
 	u8 netmask, hbits;
 	struct ip_set_hash *h;
@@ -386,10 +370,6 @@ hash_ip_create(struct ip_set *set, struct nlattr *head, int len, u32 flags)
 	pr_debug("Create set %s with family %s\n",
 		 set->name, set->family == AF_INET ? "inet" : "inet6");
 
-	if (nla_parse(tb, IPSET_ATTR_CREATE_MAX, head, len,
-		      hash_ip_create_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
@@ -425,8 +405,7 @@ hash_ip_create(struct ip_set *set, struct nlattr *head, int len, u32 flags)
 	hbits = htable_bits(hashsize);
 	h->table = ip_set_alloc(
 			sizeof(struct htable)
-			+ jhash_size(hbits) * sizeof(struct hbucket),
-			GFP_KERNEL);
+			+ jhash_size(hbits) * sizeof(struct hbucket));
 	if (!h->table) {
 		kfree(h);
 		return -ENOMEM;
@@ -463,8 +442,24 @@ static struct ip_set_type hash_ip_type __read_mostly = {
 	.features	= IPSET_TYPE_IP,
 	.dimension	= IPSET_DIM_ONE,
 	.family		= AF_UNSPEC,
-	.revision	= 0,
+	.revision_min	= 0,
+	.revision_max	= 0,
 	.create		= hash_ip_create,
+	.create_policy	= {
+		[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
+		[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
+		[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
+		[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+		[IPSET_ATTR_NETMASK]	= { .type = NLA_U8  },
+	},
+	.adt_policy	= {
+		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
+		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
+		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
+	},
 	.me		= THIS_MODULE,
 };
 

extensions/ipset-6/ip_set_hash_ipport.c

@@ -12,9 +12,6 @@
 #include <linux/ip.h>
 #include <linux/skbuff.h>
 #include <linux/errno.h>
-#include <linux/uaccess.h>
-#include <linux/bitops.h>
-#include <linux/spinlock.h>
 #include <linux/random.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -127,51 +124,44 @@ nla_put_failure:
 #define HOST_MASK	32
 #include "ip_set_ahash.h"
 
+static inline void
+hash_ipport4_data_next(struct ip_set_hash *h,
+		       const struct hash_ipport4_elem *d)
+{
+	h->next.ip = ntohl(d->ip);
+	h->next.port = ntohs(d->port);
+}
+
 static int
 hash_ipport4_kadt(struct ip_set *set, const struct sk_buff *skb,
-		  enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+		  const struct xt_action_param *par,
+		  enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 {
 	const struct ip_set_hash *h = set->data;
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_ipport4_elem data = { };
 
-	if (!ip_set_get_ip4_port(skb, flags & IPSET_DIM_TWO_SRC,
+	if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
 				 &data.port, &data.proto))
 		return -EINVAL;
 
-	ip4addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip);
+	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip);
 
-	return adtfn(set, &data, h->timeout);
+	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
 }
 
-static const struct nla_policy
-hash_ipport_adt_policy[IPSET_ATTR_ADT_MAX + 1] = {
-	[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
-	[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
-	[IPSET_ATTR_PORT]	= { .type = NLA_U16 },
-	[IPSET_ATTR_PORT_TO]	= { .type = NLA_U16 },
-	[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
-	[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-	[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
-};
-
 static int
-hash_ipport4_uadt(struct ip_set *set, struct nlattr *head, int len,
-		  enum ipset_adt adt, u32 *lineno, u32 flags)
+hash_ipport4_uadt(struct ip_set *set, struct nlattr *tb[],
+		  enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	const struct ip_set_hash *h = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_ipport4_elem data = { };
-	u32 ip, ip_to, p, port, port_to;
+	u32 ip, ip_to, p = 0, port, port_to;
 	u32 timeout = h->timeout;
+	bool with_ports = false;
 	int ret;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      hash_ipport_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_IP] ||
 		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
@@ -192,21 +182,15 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 	if (tb[IPSET_ATTR_PROTO]) {
 		data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
+		with_ports = ip_set_proto_with_ports(data.proto);
 
 		if (data.proto == 0)
 			return -IPSET_ERR_INVALID_PROTO;
 	} else
 		return -IPSET_ERR_MISSING_PROTO;
 
-	switch (data.proto) {
-	case IPPROTO_UDP:
-	case IPPROTO_TCP:
-	case IPPROTO_ICMP:
-		break;
-	default:
+	if (!(with_ports || data.proto == IPPROTO_ICMP))
 		data.port = 0;
-		break;
-	}
 
 	if (tb[IPSET_ATTR_TIMEOUT]) {
 		if (!with_timeout(h->timeout))
@@ -215,10 +199,9 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *head, int len,
 	}
 
 	if (adt == IPSET_TEST ||
-	    !(data.proto == IPPROTO_TCP || data.proto == IPPROTO_UDP) ||
 	    !(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_CIDR] ||
 	      tb[IPSET_ATTR_PORT_TO])) {
-		ret = adtfn(set, &data, timeout);
+		ret = adtfn(set, &data, timeout, flags);
 		return ip_set_eexist(ret, flags) ? 0 : ret;
 	}
 
@@ -234,30 +217,32 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 		if (cidr > 32)
 			return -IPSET_ERR_INVALID_CIDR;
-		ip &= ip_set_hostmask(cidr);
-		ip_to = ip | ~ip_set_hostmask(cidr);
+		ip_set_mask_from_to(ip, ip_to, cidr);
 	} else
 		ip_to = ip;
 
-	port = ntohs(data.port);
-	if (tb[IPSET_ATTR_PORT_TO]) {
+	port_to = port = ntohs(data.port);
+	if (with_ports && tb[IPSET_ATTR_PORT_TO]) {
 		port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
 		if (port > port_to)
 			swap(port, port_to);
-	} else
-		port_to = port;
+	}
 
-	for (; !before(ip_to, ip); ip++)
-		for (p = port; p <= port_to; p++) {
+	if (retried)
+		ip = h->next.ip;
+	for (; !before(ip_to, ip); ip++) {
+		p = retried && ip == h->next.ip ? h->next.port : port;
+		for (; p <= port_to; p++) {
 			data.ip = htonl(ip);
 			data.port = htons(p);
-			ret = adtfn(set, &data, timeout);
+			ret = adtfn(set, &data, timeout, flags);
 
 			if (ret && !ip_set_eexist(ret, flags))
 				return ret;
 			else
 				ret = 0;
 		}
+	}
 	return ret;
 }
 
@@ -355,43 +340,49 @@ nla_put_failure:
 #define HOST_MASK	128
 #include "ip_set_ahash.h"
 
+static inline void
+hash_ipport6_data_next(struct ip_set_hash *h,
+		       const struct hash_ipport6_elem *d)
+{
+	h->next.port = ntohs(d->port);
+}
+
 static int
 hash_ipport6_kadt(struct ip_set *set, const struct sk_buff *skb,
-		  enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+		  const struct xt_action_param *par,
+		  enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 {
 	const struct ip_set_hash *h = set->data;
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_ipport6_elem data = { };
 
-	if (!ip_set_get_ip6_port(skb, flags & IPSET_DIM_TWO_SRC,
+	if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
 				 &data.port, &data.proto))
 		return -EINVAL;
 
-	ip6addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
+	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
 
-	return adtfn(set, &data, h->timeout);
+	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
 }
 
 static int
-hash_ipport6_uadt(struct ip_set *set, struct nlattr *head, int len,
-		  enum ipset_adt adt, u32 *lineno, u32 flags)
+hash_ipport6_uadt(struct ip_set *set, struct nlattr *tb[],
+		  enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	const struct ip_set_hash *h = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_ipport6_elem data = { };
 	u32 port, port_to;
 	u32 timeout = h->timeout;
+	bool with_ports = false;
 	int ret;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      hash_ipport_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_IP] ||
 		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
-		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
+		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
+		     tb[IPSET_ATTR_IP_TO] ||
+		     tb[IPSET_ATTR_CIDR]))
 		return -IPSET_ERR_PROTOCOL;
 
 	if (tb[IPSET_ATTR_LINENO])
@@ -408,21 +399,15 @@ hash_ipport6_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 	if (tb[IPSET_ATTR_PROTO]) {
 		data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
+		with_ports = ip_set_proto_with_ports(data.proto);
 
 		if (data.proto == 0)
 			return -IPSET_ERR_INVALID_PROTO;
 	} else
 		return -IPSET_ERR_MISSING_PROTO;
 
-	switch (data.proto) {
-	case IPPROTO_UDP:
-	case IPPROTO_TCP:
-	case IPPROTO_ICMPV6:
-		break;
-	default:
+	if (!(with_ports || data.proto == IPPROTO_ICMPV6))
 		data.port = 0;
-		break;
-	}
 
 	if (tb[IPSET_ATTR_TIMEOUT]) {
 		if (!with_timeout(h->timeout))
@@ -430,10 +415,8 @@ hash_ipport6_uadt(struct ip_set *set, struct nlattr *head, int len,
 		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 	}
 
-	if (adt == IPSET_TEST ||
-	    !(data.proto == IPPROTO_TCP || data.proto == IPPROTO_UDP) ||
-	    !tb[IPSET_ATTR_PORT_TO]) {
-		ret = adtfn(set, &data, timeout);
+	if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
+		ret = adtfn(set, &data, timeout, flags);
 		return ip_set_eexist(ret, flags) ? 0 : ret;
 	}
 
@@ -442,9 +425,11 @@ hash_ipport6_uadt(struct ip_set *set, struct nlattr *head, int len,
 	if (port > port_to)
 		swap(port, port_to);
 
+	if (retried)
+		port = h->next.port;
 	for (; port <= port_to; port++) {
 		data.port = htons(port);
-		ret = adtfn(set, &data, timeout);
+		ret = adtfn(set, &data, timeout, flags);
 
 		if (ret && !ip_set_eexist(ret, flags))
 			return ret;
@@ -456,20 +441,9 @@ hash_ipport6_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 /* Create hash:ip type of sets */
 
-static const struct nla_policy
-hash_ipport_create_policy[IPSET_ATTR_CREATE_MAX+1] = {
-	[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
-	[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
-	[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
-	[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
-	[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-};
-
 static int
-hash_ipport_create(struct ip_set *set, struct nlattr *head, int len, u32 flags)
+hash_ipport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 {
-	struct nlattr *tb[IPSET_ATTR_CREATE_MAX+1];
 	struct ip_set_hash *h;
 	u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
 	u8 hbits;
@@ -477,10 +451,6 @@ hash_ipport_create(struct ip_set *set, struct nlattr *head, int len, u32 flags)
 	if (!(set->family == AF_INET || set->family == AF_INET6))
 		return -IPSET_ERR_INVALID_FAMILY;
 
-	if (nla_parse(tb, IPSET_ATTR_CREATE_MAX, head, len,
-		      hash_ipport_create_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
@@ -506,8 +476,7 @@ hash_ipport_create(struct ip_set *set, struct nlattr *head, int len, u32 flags)
 	hbits = htable_bits(hashsize);
 	h->table = ip_set_alloc(
 			sizeof(struct htable)
-			+ jhash_size(hbits) * sizeof(struct hbucket),
-			GFP_KERNEL);
+			+ jhash_size(hbits) * sizeof(struct hbucket));
 	if (!h->table) {
 		kfree(h);
 		return -ENOMEM;
@@ -544,8 +513,27 @@ static struct ip_set_type hash_ipport_type __read_mostly = {
 	.features	= IPSET_TYPE_IP | IPSET_TYPE_PORT,
 	.dimension	= IPSET_DIM_TWO,
 	.family		= AF_UNSPEC,
-	.revision	= 0,
+	.revision_min	= 0,
+	.revision_max	= 1,	/* SCTP and UDPLITE support added */
 	.create		= hash_ipport_create,
+	.create_policy	= {
+		[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
+		[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
+		[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
+		[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
+		[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+	},
+	.adt_policy	= {
+		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
+		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
+		[IPSET_ATTR_PORT]	= { .type = NLA_U16 },
+		[IPSET_ATTR_PORT_TO]	= { .type = NLA_U16 },
+		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
+		[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
+	},
 	.me		= THIS_MODULE,
 };
 

extensions/ipset-6/ip_set_hash_ipportip.c

@@ -12,9 +12,6 @@
 #include <linux/ip.h>
 #include <linux/skbuff.h>
 #include <linux/errno.h>
-#include <linux/uaccess.h>
-#include <linux/bitops.h>
-#include <linux/spinlock.h>
 #include <linux/random.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -130,53 +127,45 @@ nla_put_failure:
 #define HOST_MASK	32
 #include "ip_set_ahash.h"
 
+static inline void
+hash_ipportip4_data_next(struct ip_set_hash *h,
+			 const struct hash_ipportip4_elem *d)
+{
+	h->next.ip = ntohl(d->ip);
+	h->next.port = ntohs(d->port);
+}
+
 static int
 hash_ipportip4_kadt(struct ip_set *set, const struct sk_buff *skb,
-		    enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+		    const struct xt_action_param *par,
+		    enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 {
 	const struct ip_set_hash *h = set->data;
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_ipportip4_elem data = { };
 
-	if (!ip_set_get_ip4_port(skb, flags & IPSET_DIM_TWO_SRC,
+	if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
 				 &data.port, &data.proto))
 		return -EINVAL;
 
-	ip4addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip);
-	ip4addrptr(skb, flags & IPSET_DIM_THREE_SRC, &data.ip2);
+	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip);
+	ip4addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &data.ip2);
 
-	return adtfn(set, &data, h->timeout);
+	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
 }
 
-static const struct nla_policy
-hash_ipportip_adt_policy[IPSET_ATTR_ADT_MAX + 1] = {
-	[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
-	[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
-	[IPSET_ATTR_IP2]	= { .type = NLA_NESTED },
-	[IPSET_ATTR_PORT]	= { .type = NLA_U16 },
-	[IPSET_ATTR_PORT_TO]	= { .type = NLA_U16 },
-	[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
-	[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-	[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
-};
-
 static int
-hash_ipportip4_uadt(struct ip_set *set, struct nlattr *head, int len,
-		    enum ipset_adt adt, u32 *lineno, u32 flags)
+hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[],
+		    enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	const struct ip_set_hash *h = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_ipportip4_elem data = { };
-	u32 ip, ip_to, p, port, port_to;
+	u32 ip, ip_to, p = 0, port, port_to;
 	u32 timeout = h->timeout;
+	bool with_ports = false;
 	int ret;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      hash_ipportip_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
 		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
@@ -201,21 +190,15 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 	if (tb[IPSET_ATTR_PROTO]) {
 		data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
+		with_ports = ip_set_proto_with_ports(data.proto);
 
 		if (data.proto == 0)
 			return -IPSET_ERR_INVALID_PROTO;
 	} else
 		return -IPSET_ERR_MISSING_PROTO;
 
-	switch (data.proto) {
-	case IPPROTO_UDP:
-	case IPPROTO_TCP:
-	case IPPROTO_ICMP:
-		break;
-	default:
+	if (!(with_ports || data.proto == IPPROTO_ICMP))
 		data.port = 0;
-		break;
-	}
 
 	if (tb[IPSET_ATTR_TIMEOUT]) {
 		if (!with_timeout(h->timeout))
@@ -224,10 +207,9 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *head, int len,
 	}
 
 	if (adt == IPSET_TEST ||
-	    !(data.proto == IPPROTO_TCP || data.proto == IPPROTO_UDP) ||
 	    !(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_CIDR] ||
 	      tb[IPSET_ATTR_PORT_TO])) {
-		ret = adtfn(set, &data, timeout);
+		ret = adtfn(set, &data, timeout, flags);
 		return ip_set_eexist(ret, flags) ? 0 : ret;
 	}
 
@@ -243,30 +225,32 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 		if (cidr > 32)
 			return -IPSET_ERR_INVALID_CIDR;
-		ip &= ip_set_hostmask(cidr);
-		ip_to = ip | ~ip_set_hostmask(cidr);
+		ip_set_mask_from_to(ip, ip_to, cidr);
 	} else
 		ip_to = ip;
 
-	port = ntohs(data.port);
-	if (tb[IPSET_ATTR_PORT_TO]) {
+	port_to = port = ntohs(data.port);
+	if (with_ports && tb[IPSET_ATTR_PORT_TO]) {
 		port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
 		if (port > port_to)
 			swap(port, port_to);
-	} else
-		port_to = port;
+	}
 
-	for (; !before(ip_to, ip); ip++)
-		for (p = port; p <= port_to; p++) {
+	if (retried)
+		ip = h->next.ip;
+	for (; !before(ip_to, ip); ip++) {
+		p = retried && ip == h->next.ip ? h->next.port : port;
+		for (; p <= port_to; p++) {
 			data.ip = htonl(ip);
 			data.port = htons(p);
-			ret = adtfn(set, &data, timeout);
+			ret = adtfn(set, &data, timeout, flags);
 
 			if (ret && !ip_set_eexist(ret, flags))
 				return ret;
 			else
 				ret = 0;
 		}
+	}
 	return ret;
 }
 
@@ -369,44 +353,50 @@ nla_put_failure:
 #define HOST_MASK	128
 #include "ip_set_ahash.h"
 
+static inline void
+hash_ipportip6_data_next(struct ip_set_hash *h,
+			 const struct hash_ipportip6_elem *d)
+{
+	h->next.port = ntohs(d->port);
+}
+
 static int
 hash_ipportip6_kadt(struct ip_set *set, const struct sk_buff *skb,
-		    enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+		    const struct xt_action_param *par,
+		    enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 {
 	const struct ip_set_hash *h = set->data;
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_ipportip6_elem data = { };
 
-	if (!ip_set_get_ip6_port(skb, flags & IPSET_DIM_TWO_SRC,
+	if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
 				 &data.port, &data.proto))
 		return -EINVAL;
 
-	ip6addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
-	ip6addrptr(skb, flags & IPSET_DIM_THREE_SRC, &data.ip2.in6);
+	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
+	ip6addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &data.ip2.in6);
 
-	return adtfn(set, &data, h->timeout);
+	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
 }
 
 static int
-hash_ipportip6_uadt(struct ip_set *set, struct nlattr *head, int len,
-		    enum ipset_adt adt, u32 *lineno, u32 flags)
+hash_ipportip6_uadt(struct ip_set *set, struct nlattr *tb[],
+		    enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	const struct ip_set_hash *h = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_ipportip6_elem data = { };
 	u32 port, port_to;
 	u32 timeout = h->timeout;
+	bool with_ports = false;
 	int ret;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      hash_ipportip_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
 		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
-		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
+		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
+		     tb[IPSET_ATTR_IP_TO] ||
+		     tb[IPSET_ATTR_CIDR]))
 		return -IPSET_ERR_PROTOCOL;
 
 	if (tb[IPSET_ATTR_LINENO])
@@ -427,21 +417,15 @@ hash_ipportip6_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 	if (tb[IPSET_ATTR_PROTO]) {
 		data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
+		with_ports = ip_set_proto_with_ports(data.proto);
 
 		if (data.proto == 0)
 			return -IPSET_ERR_INVALID_PROTO;
 	} else
 		return -IPSET_ERR_MISSING_PROTO;
 
-	switch (data.proto) {
-	case IPPROTO_UDP:
-	case IPPROTO_TCP:
-	case IPPROTO_ICMPV6:
-		break;
-	default:
+	if (!(with_ports || data.proto == IPPROTO_ICMPV6))
 		data.port = 0;
-		break;
-	}
 
 	if (tb[IPSET_ATTR_TIMEOUT]) {
 		if (!with_timeout(h->timeout))
@@ -449,10 +433,8 @@ hash_ipportip6_uadt(struct ip_set *set, struct nlattr *head, int len,
 		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 	}
 
-	if (adt == IPSET_TEST ||
-	    !(data.proto == IPPROTO_TCP || data.proto == IPPROTO_UDP) ||
-	    !tb[IPSET_ATTR_PORT_TO]) {
-		ret = adtfn(set, &data, timeout);
+	if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
+		ret = adtfn(set, &data, timeout, flags);
 		return ip_set_eexist(ret, flags) ? 0 : ret;
 	}
 
@@ -461,9 +443,11 @@ hash_ipportip6_uadt(struct ip_set *set, struct nlattr *head, int len,
 	if (port > port_to)
 		swap(port, port_to);
 
+	if (retried)
+		port = h->next.port;
 	for (; port <= port_to; port++) {
 		data.port = htons(port);
-		ret = adtfn(set, &data, timeout);
+		ret = adtfn(set, &data, timeout, flags);
 
 		if (ret && !ip_set_eexist(ret, flags))
 			return ret;
@@ -475,20 +459,9 @@ hash_ipportip6_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 /* Create hash:ip type of sets */
 
-static const struct nla_policy
-hash_ipportip_create_policy[IPSET_ATTR_CREATE_MAX+1] = {
-	[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
-	[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
-	[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
-	[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-};
-
 static int
-hash_ipportip_create(struct ip_set *set, struct nlattr *head,
-		     int len, u32 flags)
+hash_ipportip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 {
-	struct nlattr *tb[IPSET_ATTR_CREATE_MAX+1];
 	struct ip_set_hash *h;
 	u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
 	u8 hbits;
@@ -496,10 +469,6 @@ hash_ipportip_create(struct ip_set *set, struct nlattr *head,
 	if (!(set->family == AF_INET || set->family == AF_INET6))
 		return -IPSET_ERR_INVALID_FAMILY;
 
-	if (nla_parse(tb, IPSET_ATTR_CREATE_MAX, head, len,
-		      hash_ipportip_create_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
@@ -525,8 +494,7 @@ hash_ipportip_create(struct ip_set *set, struct nlattr *head,
 	hbits = htable_bits(hashsize);
 	h->table = ip_set_alloc(
 			sizeof(struct htable)
-			+ jhash_size(hbits) * sizeof(struct hbucket),
-			GFP_KERNEL);
+			+ jhash_size(hbits) * sizeof(struct hbucket));
 	if (!h->table) {
 		kfree(h);
 		return -ENOMEM;
@@ -563,8 +531,27 @@ static struct ip_set_type hash_ipportip_type __read_mostly = {
 	.features	= IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_TYPE_IP2,
 	.dimension	= IPSET_DIM_THREE,
 	.family		= AF_UNSPEC,
-	.revision	= 0,
+	.revision_min	= 0,
+	.revision_max	= 1,	/* SCTP and UDPLITE support added */
 	.create		= hash_ipportip_create,
+	.create_policy	= {
+		[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
+		[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
+		[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
+		[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+	},
+	.adt_policy	= {
+		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
+		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
+		[IPSET_ATTR_IP2]	= { .type = NLA_NESTED },
+		[IPSET_ATTR_PORT]	= { .type = NLA_U16 },
+		[IPSET_ATTR_PORT_TO]	= { .type = NLA_U16 },
+		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
+		[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
+	},
 	.me		= THIS_MODULE,
 };
 

extensions/ipset-6/ip_set_hash_ipportnet.c

@@ -12,9 +12,6 @@
 #include <linux/ip.h>
 #include <linux/skbuff.h>
 #include <linux/errno.h>
-#include <asm/uaccess.h>
-#include <asm/bitops.h>
-#include <linux/spinlock.h>
 #include <linux/random.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -143,61 +140,55 @@ nla_put_failure:
 #define HOST_MASK	32
 #include "ip_set_ahash.h"
 
+static inline void
+hash_ipportnet4_data_next(struct ip_set_hash *h,
+			  const struct hash_ipportnet4_elem *d)
+{
+	h->next.ip = ntohl(d->ip);
+	h->next.port = ntohs(d->port);
+	h->next.ip2 = ntohl(d->ip2);
+}
+
 static int
 hash_ipportnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
-		     enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+		     const struct xt_action_param *par,
+		     enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 {
 	const struct ip_set_hash *h = set->data;
 	ipset_adtfn adtfn = set->variant->adt[adt];
-	struct hash_ipportnet4_elem data =
-		{ .cidr = h->nets[0].cidr || HOST_MASK };
+	struct hash_ipportnet4_elem data = {
+		.cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+	};
 
 	if (data.cidr == 0)
 		return -EINVAL;
 	if (adt == IPSET_TEST)
 		data.cidr = HOST_MASK;
 
-	if (!ip_set_get_ip4_port(skb, flags & IPSET_DIM_TWO_SRC,
+	if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
 				 &data.port, &data.proto))
 		return -EINVAL;
 
-	ip4addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip);
-	ip4addrptr(skb, flags & IPSET_DIM_THREE_SRC, &data.ip2);
+	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip);
+	ip4addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &data.ip2);
 	data.ip2 &= ip_set_netmask(data.cidr);
 
-	return adtfn(set, &data, h->timeout);
+	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
 }
 
-static const struct nla_policy
-hash_ipportnet_adt_policy[IPSET_ATTR_ADT_MAX + 1] = {
-	[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
-	[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
-	[IPSET_ATTR_IP2]	= { .type = NLA_NESTED },
-	[IPSET_ATTR_PORT]	= { .type = NLA_U16 },
-	[IPSET_ATTR_PORT_TO]	= { .type = NLA_U16 },
-	[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
-	[IPSET_ATTR_CIDR2]	= { .type = NLA_U8 },
-	[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-	[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
-};
-
 static int
-hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *head, int len,
-		     enum ipset_adt adt, u32 *lineno, u32 flags)
+hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
+		     enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	const struct ip_set_hash *h = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_ipportnet4_elem data = { .cidr = HOST_MASK };
-	u32 ip, ip_to, p, port, port_to;
+	u32 ip, ip_to, p = 0, port, port_to;
+	u32 ip2_from = 0, ip2_to, ip2_last, ip2;
 	u32 timeout = h->timeout;
+	bool with_ports = false;
 	int ret;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      hash_ipportnet_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
 		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
@@ -207,21 +198,19 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *head, int len,
 	if (tb[IPSET_ATTR_LINENO])
 		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
 
-	ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP], &data.ip);
+	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
 	if (ret)
 		return ret;
 
-	ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP2], &data.ip2);
+	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2], &ip2_from);
 	if (ret)
 		return ret;
 
-	if (tb[IPSET_ATTR_CIDR2])
+	if (tb[IPSET_ATTR_CIDR2]) {
 		data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
-
 		if (!data.cidr)
 			return -IPSET_ERR_INVALID_CIDR;
-
-	data.ip2 &= ip_set_netmask(data.cidr);
+	}
 
 	if (tb[IPSET_ATTR_PORT])
 		data.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
@@ -230,21 +219,15 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 	if (tb[IPSET_ATTR_PROTO]) {
 		data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
+		with_ports = ip_set_proto_with_ports(data.proto);
 
 		if (data.proto == 0)
 			return -IPSET_ERR_INVALID_PROTO;
 	} else
 		return -IPSET_ERR_MISSING_PROTO;
 
-	switch (data.proto) {
-	case IPPROTO_UDP:
-	case IPPROTO_TCP:
-	case IPPROTO_ICMP:
-		break;
-	default:
+	if (!(with_ports || data.proto == IPPROTO_ICMP))
 		data.port = 0;
-		break;
-	}
 
 	if (tb[IPSET_ATTR_TIMEOUT]) {
 		if (!with_timeout(h->timeout))
@@ -252,15 +235,16 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *head, int len,
 		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 	}
 
+	with_ports = with_ports && tb[IPSET_ATTR_PORT_TO];
 	if (adt == IPSET_TEST ||
-	    !(data.proto == IPPROTO_TCP || data.proto == IPPROTO_UDP) ||
-	    !(tb[IPSET_ATTR_IP_TO] || tb[IPSET_ATTR_CIDR] ||
-	      tb[IPSET_ATTR_PORT_TO])) {
-		ret = adtfn(set, &data, timeout);
+	    !(tb[IPSET_ATTR_CIDR] || tb[IPSET_ATTR_IP_TO] || with_ports ||
+	      tb[IPSET_ATTR_IP2_TO])) {
+		data.ip = htonl(ip);
+		data.ip2 = htonl(ip2_from & ip_set_hostmask(data.cidr));
+		ret = adtfn(set, &data, timeout, flags);
 		return ip_set_eexist(ret, flags) ? 0 : ret;
 	}
 
-	ip = ntohl(data.ip);
 	if (tb[IPSET_ATTR_IP_TO]) {
 		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
 		if (ret)
@@ -272,29 +256,49 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 		if (cidr > 32)
 			return -IPSET_ERR_INVALID_CIDR;
-		ip &= ip_set_hostmask(cidr);
-		ip_to = ip | ~ip_set_hostmask(cidr);
-	} else
-		ip_to = ip;
+		ip_set_mask_from_to(ip, ip_to, cidr);
+	}
 
-	port = ntohs(data.port);
+	port_to = port = ntohs(data.port);
 	if (tb[IPSET_ATTR_PORT_TO]) {
 		port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
 		if (port > port_to)
 			swap(port, port_to);
-	} else
-		port_to = port;
+	}
+	if (tb[IPSET_ATTR_IP2_TO]) {
+		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2_TO], &ip2_to);
+		if (ret)
+			return ret;
+		if (ip2_from > ip2_to)
+			swap(ip2_from, ip2_to);
+		if (ip2_from + UINT_MAX == ip2_to)
+			return -IPSET_ERR_HASH_RANGE;
+	} else {
+		ip_set_mask_from_to(ip2_from, ip2_to, data.cidr);
+	}
 
-	for (; !before(ip_to, ip); ip++)
-		for (p = port; p <= port_to; p++) {
+	if (retried)
+		ip = h->next.ip;
+	for (; !before(ip_to, ip); ip++) {
 		data.ip = htonl(ip);
+		p = retried && ip == h->next.ip ? h->next.port : port;
+		for (; p <= port_to; p++) {
 			data.port = htons(p);
-			ret = adtfn(set, &data, timeout);
+			ip2 = retried && ip == h->next.ip && p == h->next.port
+				? h->next.ip2 : ip2_from;
+			while (!after(ip2, ip2_to)) {
+				data.ip2 = htonl(ip2);
+				ip2_last = ip_set_range_to_cidr(ip2, ip2_to,
+								&data.cidr);
+				ret = adtfn(set, &data, timeout, flags);
 
 				if (ret && !ip_set_eexist(ret, flags))
 					return ret;
 				else
 					ret = 0;
+				ip2 = ip2_last + 1;
+			}
+		}
 	}
 	return ret;
 }
@@ -417,52 +421,61 @@ nla_put_failure:
 #define HOST_MASK	128
 #include "ip_set_ahash.h"
 
+static inline void
+hash_ipportnet6_data_next(struct ip_set_hash *h,
+			  const struct hash_ipportnet6_elem *d)
+{
+	h->next.port = ntohs(d->port);
+}
+
 static int
 hash_ipportnet6_kadt(struct ip_set *set, const struct sk_buff *skb,
-		     enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+		     const struct xt_action_param *par,
+		     enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 {
 	const struct ip_set_hash *h = set->data;
 	ipset_adtfn adtfn = set->variant->adt[adt];
-	struct hash_ipportnet6_elem data =
-		{ .cidr = h->nets[0].cidr || HOST_MASK };
+	struct hash_ipportnet6_elem data = {
+		.cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+	};
 
 	if (data.cidr == 0)
 		return -EINVAL;
 	if (adt == IPSET_TEST)
 		data.cidr = HOST_MASK;
 
-	if (!ip_set_get_ip6_port(skb, flags & IPSET_DIM_TWO_SRC,
+	if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
 				 &data.port, &data.proto))
 		return -EINVAL;
 
-	ip6addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
-	ip6addrptr(skb, flags & IPSET_DIM_THREE_SRC, &data.ip2.in6);
+	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
+	ip6addrptr(skb, opt->flags & IPSET_DIM_THREE_SRC, &data.ip2.in6);
 	ip6_netmask(&data.ip2, data.cidr);
 
-	return adtfn(set, &data, h->timeout);
+	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
 }
 
 static int
-hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *head, int len,
-		     enum ipset_adt adt, u32 *lineno, u32 flags)
+hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
+		     enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	const struct ip_set_hash *h = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_ipportnet6_elem data = { .cidr = HOST_MASK };
 	u32 port, port_to;
 	u32 timeout = h->timeout;
+	bool with_ports = false;
 	int ret;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      hash_ipportnet_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
 		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
-		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
+		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
+		     tb[IPSET_ATTR_IP_TO] ||
+		     tb[IPSET_ATTR_CIDR]))
 		return -IPSET_ERR_PROTOCOL;
+	if (unlikely(tb[IPSET_ATTR_IP_TO]))
+		return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
 
 	if (tb[IPSET_ATTR_LINENO])
 		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
@@ -490,21 +503,15 @@ hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 	if (tb[IPSET_ATTR_PROTO]) {
 		data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
+		with_ports = ip_set_proto_with_ports(data.proto);
 
 		if (data.proto == 0)
 			return -IPSET_ERR_INVALID_PROTO;
 	} else
 		return -IPSET_ERR_MISSING_PROTO;
 
-	switch (data.proto) {
-	case IPPROTO_UDP:
-	case IPPROTO_TCP:
-	case IPPROTO_ICMPV6:
-		break;
-	default:
+	if (!(with_ports || data.proto == IPPROTO_ICMPV6))
 		data.port = 0;
-		break;
-	}
 
 	if (tb[IPSET_ATTR_TIMEOUT]) {
 		if (!with_timeout(h->timeout))
@@ -512,10 +519,8 @@ hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *head, int len,
 		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 	}
 
-	if (adt == IPSET_TEST ||
-	    !(data.proto == IPPROTO_TCP || data.proto == IPPROTO_UDP) ||
-	    !tb[IPSET_ATTR_PORT_TO]) {
-		ret = adtfn(set, &data, timeout);
+	if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
+		ret = adtfn(set, &data, timeout, flags);
 		return ip_set_eexist(ret, flags) ? 0 : ret;
 	}
 
@@ -524,9 +529,11 @@ hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *head, int len,
 	if (port > port_to)
 		swap(port, port_to);
 
+	if (retried)
+		port = h->next.port;
 	for (; port <= port_to; port++) {
 		data.port = htons(port);
-		ret = adtfn(set, &data, timeout);
+		ret = adtfn(set, &data, timeout, flags);
 
 		if (ret && !ip_set_eexist(ret, flags))
 			return ret;
@@ -538,20 +545,9 @@ hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 /* Create hash:ip type of sets */
 
-static const struct nla_policy
-hash_ipportnet_create_policy[IPSET_ATTR_CREATE_MAX+1] = {
-	[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
-	[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
-	[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
-	[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-};
-
 static int
-hash_ipportnet_create(struct ip_set *set, struct nlattr *head,
-		     int len, u32 flags)
+hash_ipportnet_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 {
-	struct nlattr *tb[IPSET_ATTR_CREATE_MAX+1];
 	struct ip_set_hash *h;
 	u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
 	u8 hbits;
@@ -559,10 +555,6 @@ hash_ipportnet_create(struct ip_set *set, struct nlattr *head,
 	if (!(set->family == AF_INET || set->family == AF_INET6))
 		return -IPSET_ERR_INVALID_FAMILY;
 
-	if (nla_parse(tb, IPSET_ATTR_CREATE_MAX, head, len,
-		      hash_ipportnet_create_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
@@ -590,8 +582,7 @@ hash_ipportnet_create(struct ip_set *set, struct nlattr *head,
 	hbits = htable_bits(hashsize);
 	h->table = ip_set_alloc(
 			sizeof(struct htable)
-			+ jhash_size(hbits) * sizeof(struct hbucket),
-			GFP_KERNEL);
+			+ jhash_size(hbits) * sizeof(struct hbucket));
 	if (!h->table) {
 		kfree(h);
 		return -ENOMEM;
@@ -629,8 +620,30 @@ static struct ip_set_type hash_ipportnet_type __read_mostly = {
 	.features	= IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_TYPE_IP2,
 	.dimension	= IPSET_DIM_THREE,
 	.family		= AF_UNSPEC,
-	.revision	= 0,
+	.revision_min	= 0,
+	/*		  1	   SCTP and UDPLITE support added */
+	.revision_max	= 2,	/* Range as input support for IPv4 added */
 	.create		= hash_ipportnet_create,
+	.create_policy	= {
+		[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
+		[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
+		[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
+		[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+	},
+	.adt_policy	= {
+		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
+		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
+		[IPSET_ATTR_IP2]	= { .type = NLA_NESTED },
+		[IPSET_ATTR_IP2_TO]	= { .type = NLA_NESTED },
+		[IPSET_ATTR_PORT]	= { .type = NLA_U16 },
+		[IPSET_ATTR_PORT_TO]	= { .type = NLA_U16 },
+		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
+		[IPSET_ATTR_CIDR2]	= { .type = NLA_U8 },
+		[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
+	},
 	.me		= THIS_MODULE,
 };
 

extensions/ipset-6/ip_set_hash_net.c

@@ -12,9 +12,6 @@
 #include <linux/ip.h>
 #include <linux/skbuff.h>
 #include <linux/errno.h>
-#include <linux/uaccess.h>
-#include <linux/bitops.h>
-#include <linux/spinlock.h>
 #include <linux/random.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -128,46 +125,46 @@ nla_put_failure:
 #define HOST_MASK	32
 #include "ip_set_ahash.h"
 
+static inline void
+hash_net4_data_next(struct ip_set_hash *h,
+		    const struct hash_net4_elem *d)
+{
+	h->next.ip = ntohl(d->ip);
+}
+
 static int
 hash_net4_kadt(struct ip_set *set, const struct sk_buff *skb,
-	       enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+	       const struct xt_action_param *par,
+	       enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 {
 	const struct ip_set_hash *h = set->data;
 	ipset_adtfn adtfn = set->variant->adt[adt];
-	struct hash_net4_elem data = { .cidr = h->nets[0].cidr || HOST_MASK };
+	struct hash_net4_elem data = {
+		.cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+	};
 
 	if (data.cidr == 0)
 		return -EINVAL;
 	if (adt == IPSET_TEST)
 		data.cidr = HOST_MASK;
 
-	ip4addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip);
+	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip);
 	data.ip &= ip_set_netmask(data.cidr);
 
-	return adtfn(set, &data, h->timeout);
+	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
 }
 
-static const struct nla_policy hash_net_adt_policy[IPSET_ATTR_ADT_MAX + 1] = {
-	[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
-	[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-};
-
 static int
-hash_net4_uadt(struct ip_set *set, struct nlattr *head, int len,
-	       enum ipset_adt adt, u32 *lineno, u32 flags)
+hash_net4_uadt(struct ip_set *set, struct nlattr *tb[],
+	       enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	const struct ip_set_hash *h = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_net4_elem data = { .cidr = HOST_MASK };
 	u32 timeout = h->timeout;
+	u32 ip = 0, ip_to, last;
 	int ret;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      hash_net_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_IP] ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 		return -IPSET_ERR_PROTOCOL;
@@ -175,17 +172,15 @@ hash_net4_uadt(struct ip_set *set, struct nlattr *head, int len,
 	if (tb[IPSET_ATTR_LINENO])
 		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
 
-	ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP], &data.ip);
+	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
 	if (ret)
 		return ret;
 
-	if (tb[IPSET_ATTR_CIDR])
+	if (tb[IPSET_ATTR_CIDR]) {
 		data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
-
 		if (!data.cidr)
 			return -IPSET_ERR_INVALID_CIDR;
-
-	data.ip &= ip_set_netmask(data.cidr);
+	}
 
 	if (tb[IPSET_ATTR_TIMEOUT]) {
 		if (!with_timeout(h->timeout))
@@ -193,9 +188,35 @@ hash_net4_uadt(struct ip_set *set, struct nlattr *head, int len,
 		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 	}
 
-	ret = adtfn(set, &data, timeout);
-
+	if (adt == IPSET_TEST || !tb[IPSET_ATTR_IP_TO]) {
+		data.ip = htonl(ip & ip_set_hostmask(data.cidr));
+		ret = adtfn(set, &data, timeout, flags);
 		return ip_set_eexist(ret, flags) ? 0 : ret;
+	}
+
+	ip_to = ip;
+	if (tb[IPSET_ATTR_IP_TO]) {
+		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
+		if (ret)
+			return ret;
+		if (ip_to < ip)
+			swap(ip, ip_to);
+		if (ip + UINT_MAX == ip_to)
+			return -IPSET_ERR_HASH_RANGE;
+	}
+	if (retried)
+		ip = h->next.ip;
+	while (!after(ip, ip_to)) {
+		data.ip = htonl(ip);
+		last = ip_set_range_to_cidr(ip, ip_to, &data.cidr);
+		ret = adtfn(set, &data, timeout, flags);
+		if (ret && !ip_set_eexist(ret, flags))
+			return ret;
+		else
+			ret = 0;
+		ip = last + 1;
+	}
+	return ret;
 }
 
 static bool
@@ -304,43 +325,49 @@ nla_put_failure:
 #define HOST_MASK	128
 #include "ip_set_ahash.h"
 
+static inline void
+hash_net6_data_next(struct ip_set_hash *h,
+		    const struct hash_net6_elem *d)
+{
+}
+
 static int
 hash_net6_kadt(struct ip_set *set, const struct sk_buff *skb,
-	       enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+	       const struct xt_action_param *par,
+	       enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 {
 	const struct ip_set_hash *h = set->data;
 	ipset_adtfn adtfn = set->variant->adt[adt];
-	struct hash_net6_elem data = { .cidr = h->nets[0].cidr || HOST_MASK };
+	struct hash_net6_elem data = {
+		.cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+	};
 
 	if (data.cidr == 0)
 		return -EINVAL;
 	if (adt == IPSET_TEST)
 		data.cidr = HOST_MASK;
 
-	ip6addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
+	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
 	ip6_netmask(&data.ip, data.cidr);
 
-	return adtfn(set, &data, h->timeout);
+	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
 }
 
 static int
-hash_net6_uadt(struct ip_set *set, struct nlattr *head, int len,
-	       enum ipset_adt adt, u32 *lineno, u32 flags)
+hash_net6_uadt(struct ip_set *set, struct nlattr *tb[],
+	       enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	const struct ip_set_hash *h = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_net6_elem data = { .cidr = HOST_MASK };
 	u32 timeout = h->timeout;
 	int ret;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      hash_net_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_IP] ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 		return -IPSET_ERR_PROTOCOL;
+	if (unlikely(tb[IPSET_ATTR_IP_TO]))
+		return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
 
 	if (tb[IPSET_ATTR_LINENO])
 		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
@@ -363,26 +390,16 @@ hash_net6_uadt(struct ip_set *set, struct nlattr *head, int len,
 		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 	}
 
-	ret = adtfn(set, &data, timeout);
+	ret = adtfn(set, &data, timeout, flags);
 
 	return ip_set_eexist(ret, flags) ? 0 : ret;
 }
 
 /* Create hash:ip type of sets */
 
-static const struct nla_policy
-hash_net_create_policy[IPSET_ATTR_CREATE_MAX+1] = {
-	[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
-	[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
-	[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
-	[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-};
-
 static int
-hash_net_create(struct ip_set *set, struct nlattr *head, int len, u32 flags)
+hash_net_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 {
-	struct nlattr *tb[IPSET_ATTR_CREATE_MAX+1];
 	u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
 	struct ip_set_hash *h;
 	u8 hbits;
@@ -390,10 +407,6 @@ hash_net_create(struct ip_set *set, struct nlattr *head, int len, u32 flags)
 	if (!(set->family == AF_INET || set->family == AF_INET6))
 		return -IPSET_ERR_INVALID_FAMILY;
 
-	if (nla_parse(tb, IPSET_ATTR_CREATE_MAX, head, len,
-		      hash_net_create_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
@@ -421,8 +434,7 @@ hash_net_create(struct ip_set *set, struct nlattr *head, int len, u32 flags)
 	hbits = htable_bits(hashsize);
 	h->table = ip_set_alloc(
 			sizeof(struct htable)
-			+ jhash_size(hbits) * sizeof(struct hbucket),
-			GFP_KERNEL);
+			+ jhash_size(hbits) * sizeof(struct hbucket));
 	if (!h->table) {
 		kfree(h);
 		return -ENOMEM;
@@ -459,8 +471,22 @@ static struct ip_set_type hash_net_type __read_mostly = {
 	.features	= IPSET_TYPE_IP,
 	.dimension	= IPSET_DIM_ONE,
 	.family		= AF_UNSPEC,
-	.revision	= 0,
+	.revision_min	= 0,
+	.revision_max	= 1,	/* Range as input support for IPv4 added */
 	.create		= hash_net_create,
+	.create_policy	= {
+		[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
+		[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
+		[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
+		[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+	},
+	.adt_policy	= {
+		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
+		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
+		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+	},
 	.me		= THIS_MODULE,
 };
 

extensions/ipset-6/ip_set_hash_netiface.c

@@ -0,0 +1,762 @@
+/* Copyright (C) 2011 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/* Kernel module implementing an IP set type: the hash:net,iface type */
+
+#include "jhash.h"
+#include <linux/module.h>
+#include <linux/ip.h>
+#include <linux/skbuff.h>
+#include <linux/errno.h>
+#include <linux/random.h>
+#include <linux/rbtree.h>
+#include <net/ip.h>
+#include <net/ipv6.h>
+#include <net/netlink.h>
+
+#include <linux/netfilter.h>
+#include "pfxlen.h"
+#include "ip_set.h"
+#include "ip_set_timeout.h"
+#include "ip_set_hash.h"
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
+MODULE_DESCRIPTION("hash:net,iface type of IP sets");
+MODULE_ALIAS("ip_set_hash:net,iface");
+
+/* Interface name rbtree */
+
+struct iface_node {
+	struct rb_node node;
+	char iface[IFNAMSIZ];
+};
+
+#define iface_data(n)	(rb_entry(n, struct iface_node, node)->iface)
+
+static inline long
+ifname_compare(const char *_a, const char *_b)
+{
+	const long *a = (const long *)_a;
+	const long *b = (const long *)_b;
+
+	BUILD_BUG_ON(IFNAMSIZ > 4 * sizeof(unsigned long));
+	if (a[0] != b[0])
+		return a[0] - b[0];
+	if (IFNAMSIZ > sizeof(long)) {
+		if (a[1] != b[1])
+			return a[1] - b[1];
+	}
+	if (IFNAMSIZ > 2 * sizeof(long)) {
+		if (a[2] != b[2])
+			return a[2] - b[2];
+	}
+	if (IFNAMSIZ > 3 * sizeof(long)) {
+		if (a[3] != b[3])
+			return a[3] - b[3];
+	}
+	return 0;
+}
+
+static void
+rbtree_destroy(struct rb_root *root)
+{
+	struct rb_node *p, *n = root->rb_node;
+	struct iface_node *node;
+
+	/* Non-recursive destroy, like in ext3 */
+	while (n) {
+		if (n->rb_left) {
+			n = n->rb_left;
+			continue;
+		}
+		if (n->rb_right) {
+			n = n->rb_right;
+			continue;
+		}
+		p = rb_parent(n);
+		node = rb_entry(n, struct iface_node, node);
+		if (!p)
+			*root = RB_ROOT;
+		else if (p->rb_left == n)
+			p->rb_left = NULL;
+		else if (p->rb_right == n)
+			p->rb_right = NULL;
+
+		kfree(node);
+		n = p;
+	}
+}
+
+static int
+iface_test(struct rb_root *root, const char **iface)
+{
+	struct rb_node *n = root->rb_node;
+
+	while (n) {
+		const char *d = iface_data(n);
+		int res = ifname_compare(*iface, d);
+
+		if (res < 0)
+			n = n->rb_left;
+		else if (res > 0)
+			n = n->rb_right;
+		else {
+			*iface = d;
+			return 1;
+		}
+	}
+	return 0;
+}
+
+static int
+iface_add(struct rb_root *root, const char **iface)
+{
+	struct rb_node **n = &(root->rb_node), *p = NULL;
+	struct iface_node *d;
+
+	while (*n) {
+		char *ifname = iface_data(*n);
+		int res = ifname_compare(*iface, ifname);
+
+		p = *n;
+		if (res < 0)
+			n = &((*n)->rb_left);
+		else if (res > 0)
+			n = &((*n)->rb_right);
+		else {
+			*iface = ifname;
+			return 0;
+		}
+	}
+
+	d = kzalloc(sizeof(*d), GFP_ATOMIC);
+	if (!d)
+		return -ENOMEM;
+	strcpy(d->iface, *iface);
+
+	rb_link_node(&d->node, p, n);
+	rb_insert_color(&d->node, root);
+
+	*iface = d->iface;
+	return 0;
+}
+
+/* Type specific function prefix */
+#define TYPE		hash_netiface
+
+static bool
+hash_netiface_same_set(const struct ip_set *a, const struct ip_set *b);
+
+#define hash_netiface4_same_set	hash_netiface_same_set
+#define hash_netiface6_same_set	hash_netiface_same_set
+
+#define STREQ(a, b)	(strcmp(a, b) == 0)
+
+/* The type variant functions: IPv4 */
+
+/* Member elements without timeout */
+struct hash_netiface4_elem {
+	__be32 ip;
+	const char *iface;
+	u8 physdev;
+	u8 cidr;
+	u16 padding;
+};
+
+/* Member elements with timeout support */
+struct hash_netiface4_telem {
+	__be32 ip;
+	const char *iface;
+	u8 physdev;
+	u8 cidr;
+	u16 padding;
+	unsigned long timeout;
+};
+
+static inline bool
+hash_netiface4_data_equal(const struct hash_netiface4_elem *ip1,
+			  const struct hash_netiface4_elem *ip2)
+{
+	return ip1->ip == ip2->ip &&
+	       ip1->cidr == ip2->cidr &&
+	       ip1->physdev == ip2->physdev &&
+	       ip1->iface == ip2->iface;
+}
+
+static inline bool
+hash_netiface4_data_isnull(const struct hash_netiface4_elem *elem)
+{
+	return elem->cidr == 0;
+}
+
+static inline void
+hash_netiface4_data_copy(struct hash_netiface4_elem *dst,
+			 const struct hash_netiface4_elem *src) {
+	dst->ip = src->ip;
+	dst->cidr = src->cidr;
+	dst->physdev = src->physdev;
+	dst->iface = src->iface;
+}
+
+static inline void
+hash_netiface4_data_netmask(struct hash_netiface4_elem *elem, u8 cidr)
+{
+	elem->ip &= ip_set_netmask(cidr);
+	elem->cidr = cidr;
+}
+
+static inline void
+hash_netiface4_data_zero_out(struct hash_netiface4_elem *elem)
+{
+	elem->cidr = 0;
+}
+
+static bool
+hash_netiface4_data_list(struct sk_buff *skb,
+			 const struct hash_netiface4_elem *data)
+{
+	u32 flags = data->physdev ? IPSET_FLAG_PHYSDEV : 0;
+
+	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
+	NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
+	NLA_PUT_STRING(skb, IPSET_ATTR_IFACE, data->iface);
+	if (flags)
+		NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, flags);
+	return 0;
+
+nla_put_failure:
+	return 1;
+}
+
+static bool
+hash_netiface4_data_tlist(struct sk_buff *skb,
+			  const struct hash_netiface4_elem *data)
+{
+	const struct hash_netiface4_telem *tdata =
+		(const struct hash_netiface4_telem *)data;
+	u32 flags = data->physdev ? IPSET_FLAG_PHYSDEV : 0;
+
+	NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, data->ip);
+	NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
+	NLA_PUT_STRING(skb, IPSET_ATTR_IFACE, data->iface);
+	if (flags)
+		NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, flags);
+	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
+		      htonl(ip_set_timeout_get(tdata->timeout)));
+
+	return 0;
+
+nla_put_failure:
+	return 1;
+}
+
+#define IP_SET_HASH_WITH_NETS
+#define IP_SET_HASH_WITH_RBTREE
+
+#define PF		4
+#define HOST_MASK	32
+#include "ip_set_ahash.h"
+
+static inline void
+hash_netiface4_data_next(struct ip_set_hash *h,
+			 const struct hash_netiface4_elem *d)
+{
+	h->next.ip = ntohl(d->ip);
+}
+
+static int
+hash_netiface4_kadt(struct ip_set *set, const struct sk_buff *skb,
+		    const struct xt_action_param *par,
+		    enum ipset_adt adt, const struct ip_set_adt_opt *opt)
+{
+	struct ip_set_hash *h = set->data;
+	ipset_adtfn adtfn = set->variant->adt[adt];
+	struct hash_netiface4_elem data = {
+		.cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+	};
+	int ret;
+
+	if (data.cidr == 0)
+		return -EINVAL;
+	if (adt == IPSET_TEST)
+		data.cidr = HOST_MASK;
+
+	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip);
+	data.ip &= ip_set_netmask(data.cidr);
+
+#define IFACE(dir)	(par->dir ? par->dir->name : NULL)
+#define PHYSDEV(dir)	(nf_bridge->dir ? nf_bridge->dir->name : NULL)
+#define SRCDIR		(opt->flags & IPSET_DIM_TWO_SRC)
+
+	if (opt->cmdflags & IPSET_FLAG_PHYSDEV) {
+#ifdef CONFIG_BRIDGE_NETFILTER
+		const struct nf_bridge_info *nf_bridge = skb->nf_bridge;
+
+		if (!nf_bridge)
+			return -EINVAL;
+		data.iface = SRCDIR ? PHYSDEV(physindev) : PHYSDEV(physoutdev);
+		data.physdev = 1;
+#else
+		data.iface = NULL;
+#endif
+	} else
+		data.iface = SRCDIR ? IFACE(in) : IFACE(out);
+
+	if (!data.iface)
+		return -EINVAL;
+	ret = iface_test(&h->rbtree, &data.iface);
+	if (adt == IPSET_ADD) {
+		if (!ret) {
+			ret = iface_add(&h->rbtree, &data.iface);
+			if (ret)
+				return ret;
+		}
+	} else if (!ret)
+		return ret;
+
+	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
+}
+
+static int
+hash_netiface4_uadt(struct ip_set *set, struct nlattr *tb[],
+		    enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
+{
+	struct ip_set_hash *h = set->data;
+	ipset_adtfn adtfn = set->variant->adt[adt];
+	struct hash_netiface4_elem data = { .cidr = HOST_MASK };
+	u32 ip = 0, ip_to, last;
+	u32 timeout = h->timeout;
+	char iface[IFNAMSIZ] = {};
+	int ret;
+
+	if (unlikely(!tb[IPSET_ATTR_IP] ||
+		     !tb[IPSET_ATTR_IFACE] ||
+		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
+		     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
+		return -IPSET_ERR_PROTOCOL;
+
+	if (tb[IPSET_ATTR_LINENO])
+		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
+
+	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
+	if (ret)
+		return ret;
+
+	if (tb[IPSET_ATTR_CIDR]) {
+		data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+		if (!data.cidr)
+			return -IPSET_ERR_INVALID_CIDR;
+	}
+
+	if (tb[IPSET_ATTR_TIMEOUT]) {
+		if (!with_timeout(h->timeout))
+			return -IPSET_ERR_TIMEOUT;
+		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
+	}
+
+	strcpy(iface, nla_data(tb[IPSET_ATTR_IFACE]));
+	data.iface = iface;
+	ret = iface_test(&h->rbtree, &data.iface);
+	if (adt == IPSET_ADD) {
+		if (!ret) {
+			ret = iface_add(&h->rbtree, &data.iface);
+			if (ret)
+				return ret;
+		}
+	} else if (!ret)
+		return ret;
+
+	if (tb[IPSET_ATTR_CADT_FLAGS]) {
+		u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
+		if (cadt_flags & IPSET_FLAG_PHYSDEV)
+			data.physdev = 1;
+	}
+
+	if (adt == IPSET_TEST || !tb[IPSET_ATTR_IP_TO]) {
+		data.ip = htonl(ip & ip_set_hostmask(data.cidr));
+		ret = adtfn(set, &data, timeout, flags);
+		return ip_set_eexist(ret, flags) ? 0 : ret;
+	}
+
+	if (tb[IPSET_ATTR_IP_TO]) {
+		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
+		if (ret)
+			return ret;
+		if (ip_to < ip)
+			swap(ip, ip_to);
+		if (ip + UINT_MAX == ip_to)
+			return -IPSET_ERR_HASH_RANGE;
+	} else {
+		ip_set_mask_from_to(ip, ip_to, data.cidr);
+	}
+
+	if (retried)
+		ip = h->next.ip;
+	while (!after(ip, ip_to)) {
+		data.ip = htonl(ip);
+		last = ip_set_range_to_cidr(ip, ip_to, &data.cidr);
+		ret = adtfn(set, &data, timeout, flags);
+
+		if (ret && !ip_set_eexist(ret, flags))
+			return ret;
+		else
+			ret = 0;
+		ip = last + 1;
+	}
+	return ret;
+}
+
+static bool
+hash_netiface_same_set(const struct ip_set *a, const struct ip_set *b)
+{
+	const struct ip_set_hash *x = a->data;
+	const struct ip_set_hash *y = b->data;
+
+	/* Resizing changes htable_bits, so we ignore it */
+	return x->maxelem == y->maxelem &&
+	       x->timeout == y->timeout;
+}
+
+/* The type variant functions: IPv6 */
+
+struct hash_netiface6_elem {
+	union nf_inet_addr ip;
+	const char *iface;
+	u8 physdev;
+	u8 cidr;
+	u16 padding;
+};
+
+struct hash_netiface6_telem {
+	union nf_inet_addr ip;
+	const char *iface;
+	u8 physdev;
+	u8 cidr;
+	u16 padding;
+	unsigned long timeout;
+};
+
+static inline bool
+hash_netiface6_data_equal(const struct hash_netiface6_elem *ip1,
+			  const struct hash_netiface6_elem *ip2)
+{
+	return ipv6_addr_cmp(&ip1->ip.in6, &ip2->ip.in6) == 0 &&
+	       ip1->cidr == ip2->cidr &&
+	       ip1->physdev == ip2->physdev &&
+	       ip1->iface == ip2->iface;
+}
+
+static inline bool
+hash_netiface6_data_isnull(const struct hash_netiface6_elem *elem)
+{
+	return elem->cidr == 0;
+}
+
+static inline void
+hash_netiface6_data_copy(struct hash_netiface6_elem *dst,
+			 const struct hash_netiface6_elem *src)
+{
+	memcpy(dst, src, sizeof(*dst));
+}
+
+static inline void
+hash_netiface6_data_zero_out(struct hash_netiface6_elem *elem)
+{
+}
+
+static inline void
+ip6_netmask(union nf_inet_addr *ip, u8 prefix)
+{
+	ip->ip6[0] &= ip_set_netmask6(prefix)[0];
+	ip->ip6[1] &= ip_set_netmask6(prefix)[1];
+	ip->ip6[2] &= ip_set_netmask6(prefix)[2];
+	ip->ip6[3] &= ip_set_netmask6(prefix)[3];
+}
+
+static inline void
+hash_netiface6_data_netmask(struct hash_netiface6_elem *elem, u8 cidr)
+{
+	ip6_netmask(&elem->ip, cidr);
+	elem->cidr = cidr;
+}
+
+static bool
+hash_netiface6_data_list(struct sk_buff *skb,
+			 const struct hash_netiface6_elem *data)
+{
+	u32 flags = data->physdev ? IPSET_FLAG_PHYSDEV : 0;
+
+	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &data->ip);
+	NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
+	NLA_PUT_STRING(skb, IPSET_ATTR_IFACE, data->iface);
+	if (flags)
+		NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, flags);
+	return 0;
+
+nla_put_failure:
+	return 1;
+}
+
+static bool
+hash_netiface6_data_tlist(struct sk_buff *skb,
+			  const struct hash_netiface6_elem *data)
+{
+	const struct hash_netiface6_telem *e =
+		(const struct hash_netiface6_telem *)data;
+	u32 flags = data->physdev ? IPSET_FLAG_PHYSDEV : 0;
+
+	NLA_PUT_IPADDR6(skb, IPSET_ATTR_IP, &e->ip);
+	NLA_PUT_U8(skb, IPSET_ATTR_CIDR, data->cidr);
+	NLA_PUT_STRING(skb, IPSET_ATTR_IFACE, data->iface);
+	if (flags)
+		NLA_PUT_NET32(skb, IPSET_ATTR_CADT_FLAGS, flags);
+	NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT,
+		      htonl(ip_set_timeout_get(e->timeout)));
+	return 0;
+
+nla_put_failure:
+	return 1;
+}
+
+#undef PF
+#undef HOST_MASK
+
+#define PF		6
+#define HOST_MASK	128
+#include "ip_set_ahash.h"
+
+static inline void
+hash_netiface6_data_next(struct ip_set_hash *h,
+			 const struct hash_netiface6_elem *d)
+{
+}
+
+static int
+hash_netiface6_kadt(struct ip_set *set, const struct sk_buff *skb,
+		    const struct xt_action_param *par,
+		    enum ipset_adt adt, const struct ip_set_adt_opt *opt)
+{
+	struct ip_set_hash *h = set->data;
+	ipset_adtfn adtfn = set->variant->adt[adt];
+	struct hash_netiface6_elem data = {
+		.cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+	};
+	int ret;
+
+	if (data.cidr == 0)
+		return -EINVAL;
+	if (adt == IPSET_TEST)
+		data.cidr = HOST_MASK;
+
+	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
+	ip6_netmask(&data.ip, data.cidr);
+
+	if (opt->cmdflags & IPSET_FLAG_PHYSDEV) {
+#ifdef CONFIG_BRIDGE_NETFILTER
+		const struct nf_bridge_info *nf_bridge = skb->nf_bridge;
+
+		if (!nf_bridge)
+			return -EINVAL;
+		data.iface = SRCDIR ? PHYSDEV(physindev) : PHYSDEV(physoutdev);
+		data.physdev = 1;
+#else
+		data.iface = NULL;
+#endif
+	} else
+		data.iface = SRCDIR ? IFACE(in) : IFACE(out);
+
+	if (!data.iface)
+		return -EINVAL;
+	ret = iface_test(&h->rbtree, &data.iface);
+	if (adt == IPSET_ADD) {
+		if (!ret) {
+			ret = iface_add(&h->rbtree, &data.iface);
+			if (ret)
+				return ret;
+		}
+	} else if (!ret)
+		return ret;
+
+	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
+}
+
+static int
+hash_netiface6_uadt(struct ip_set *set, struct nlattr *tb[],
+		   enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
+{
+	struct ip_set_hash *h = set->data;
+	ipset_adtfn adtfn = set->variant->adt[adt];
+	struct hash_netiface6_elem data = { .cidr = HOST_MASK };
+	u32 timeout = h->timeout;
+	char iface[IFNAMSIZ] = {};
+	int ret;
+
+	if (unlikely(!tb[IPSET_ATTR_IP] ||
+		     !tb[IPSET_ATTR_IFACE] ||
+		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
+		     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
+		return -IPSET_ERR_PROTOCOL;
+	if (unlikely(tb[IPSET_ATTR_IP_TO]))
+		return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
+
+	if (tb[IPSET_ATTR_LINENO])
+		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
+
+	ret = ip_set_get_ipaddr6(tb[IPSET_ATTR_IP], &data.ip);
+	if (ret)
+		return ret;
+
+	if (tb[IPSET_ATTR_CIDR])
+		data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+	if (!data.cidr)
+		return -IPSET_ERR_INVALID_CIDR;
+	ip6_netmask(&data.ip, data.cidr);
+
+	if (tb[IPSET_ATTR_TIMEOUT]) {
+		if (!with_timeout(h->timeout))
+			return -IPSET_ERR_TIMEOUT;
+		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
+	}
+
+	strcpy(iface, nla_data(tb[IPSET_ATTR_IFACE]));
+	data.iface = iface;
+	ret = iface_test(&h->rbtree, &data.iface);
+	if (adt == IPSET_ADD) {
+		if (!ret) {
+			ret = iface_add(&h->rbtree, &data.iface);
+			if (ret)
+				return ret;
+		}
+	} else if (!ret)
+		return ret;
+
+	if (tb[IPSET_ATTR_CADT_FLAGS]) {
+		u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
+		if (cadt_flags & IPSET_FLAG_PHYSDEV)
+			data.physdev = 1;
+	}
+
+	ret = adtfn(set, &data, timeout, flags);
+
+	return ip_set_eexist(ret, flags) ? 0 : ret;
+}
+
+/* Create hash:ip type of sets */
+
+static int
+hash_netiface_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
+{
+	struct ip_set_hash *h;
+	u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
+	u8 hbits;
+
+	if (!(set->family == AF_INET || set->family == AF_INET6))
+		return -IPSET_ERR_INVALID_FAMILY;
+
+	if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
+		     !ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) ||
+		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
+		return -IPSET_ERR_PROTOCOL;
+
+	if (tb[IPSET_ATTR_HASHSIZE]) {
+		hashsize = ip_set_get_h32(tb[IPSET_ATTR_HASHSIZE]);
+		if (hashsize < IPSET_MIMINAL_HASHSIZE)
+			hashsize = IPSET_MIMINAL_HASHSIZE;
+	}
+
+	if (tb[IPSET_ATTR_MAXELEM])
+		maxelem = ip_set_get_h32(tb[IPSET_ATTR_MAXELEM]);
+
+	h = kzalloc(sizeof(*h)
+		    + sizeof(struct ip_set_hash_nets)
+		      * (set->family == AF_INET ? 32 : 128), GFP_KERNEL);
+	if (!h)
+		return -ENOMEM;
+
+	h->maxelem = maxelem;
+	get_random_bytes(&h->initval, sizeof(h->initval));
+	h->timeout = IPSET_NO_TIMEOUT;
+
+	hbits = htable_bits(hashsize);
+	h->table = ip_set_alloc(
+			sizeof(struct htable)
+			+ jhash_size(hbits) * sizeof(struct hbucket));
+	if (!h->table) {
+		kfree(h);
+		return -ENOMEM;
+	}
+	h->table->htable_bits = hbits;
+	h->rbtree = RB_ROOT;
+
+	set->data = h;
+
+	if (tb[IPSET_ATTR_TIMEOUT]) {
+		h->timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
+
+		set->variant = set->family == AF_INET
+			? &hash_netiface4_tvariant : &hash_netiface6_tvariant;
+
+		if (set->family == AF_INET)
+			hash_netiface4_gc_init(set);
+		else
+			hash_netiface6_gc_init(set);
+	} else {
+		set->variant = set->family == AF_INET
+			? &hash_netiface4_variant : &hash_netiface6_variant;
+	}
+
+	pr_debug("create %s hashsize %u (%u) maxelem %u: %p(%p)\n",
+		 set->name, jhash_size(h->table->htable_bits),
+		 h->table->htable_bits, h->maxelem, set->data, h->table);
+
+	return 0;
+}
+
+static struct ip_set_type hash_netiface_type __read_mostly = {
+	.name		= "hash:net,iface",
+	.protocol	= IPSET_PROTOCOL,
+	.features	= IPSET_TYPE_IP | IPSET_TYPE_IFACE,
+	.dimension	= IPSET_DIM_TWO,
+	.family		= AF_UNSPEC,
+	.revision_min	= 0,
+	.create		= hash_netiface_create,
+	.create_policy	= {
+		[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
+		[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
+		[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
+		[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
+		[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+	},
+	.adt_policy	= {
+		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
+		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
+		[IPSET_ATTR_IFACE]	= { .type = NLA_NUL_STRING,
+					    .len = IPSET_MAXNAMELEN - 1 },
+		[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },
+		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
+	},
+	.me		= THIS_MODULE,
+};
+
+static int __init
+hash_netiface_init(void)
+{
+	return ip_set_type_register(&hash_netiface_type);
+}
+
+static void __exit
+hash_netiface_fini(void)
+{
+	ip_set_type_unregister(&hash_netiface_type);
+}
+
+module_init(hash_netiface_init);
+module_exit(hash_netiface_fini);

extensions/ipset-6/ip_set_hash_netport.c

@@ -12,9 +12,6 @@
 #include <linux/ip.h>
 #include <linux/skbuff.h>
 #include <linux/errno.h>
-#include <linux/uaccess.h>
-#include <linux/bitops.h>
-#include <linux/spinlock.h>
 #include <linux/random.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -140,57 +137,52 @@ nla_put_failure:
 #define HOST_MASK	32
 #include "ip_set_ahash.h"
 
+static inline void
+hash_netport4_data_next(struct ip_set_hash *h,
+			const struct hash_netport4_elem *d)
+{
+	h->next.ip = ntohl(d->ip);
+	h->next.port = ntohs(d->port);
+}
+
 static int
 hash_netport4_kadt(struct ip_set *set, const struct sk_buff *skb,
-		   enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+		   const struct xt_action_param *par,
+		   enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 {
 	const struct ip_set_hash *h = set->data;
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_netport4_elem data = {
-		.cidr = h->nets[0].cidr || HOST_MASK };
+		.cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+	};
 
 	if (data.cidr == 0)
 		return -EINVAL;
 	if (adt == IPSET_TEST)
 		data.cidr = HOST_MASK;
 
-	if (!ip_set_get_ip4_port(skb, flags & IPSET_DIM_TWO_SRC,
+	if (!ip_set_get_ip4_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
 				 &data.port, &data.proto))
 		return -EINVAL;
 
-	ip4addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip);
+	ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip);
 	data.ip &= ip_set_netmask(data.cidr);
 
-	return adtfn(set, &data, h->timeout);
+	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
 }
 
-static const struct nla_policy
-hash_netport_adt_policy[IPSET_ATTR_ADT_MAX + 1] = {
-	[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
-	[IPSET_ATTR_PORT]	= { .type = NLA_U16 },
-	[IPSET_ATTR_PORT_TO]	= { .type = NLA_U16 },
-	[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
-	[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-	[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
-};
-
 static int
-hash_netport4_uadt(struct ip_set *set, struct nlattr *head, int len,
-		   enum ipset_adt adt, u32 *lineno, u32 flags)
+hash_netport4_uadt(struct ip_set *set, struct nlattr *tb[],
+		   enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	const struct ip_set_hash *h = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_netport4_elem data = { .cidr = HOST_MASK };
-	u32 port, port_to;
+	u32 port, port_to, p = 0, ip = 0, ip_to, last;
 	u32 timeout = h->timeout;
+	bool with_ports = false;
 	int ret;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      hash_netport_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_IP] ||
 		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
@@ -200,15 +192,15 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *head, int len,
 	if (tb[IPSET_ATTR_LINENO])
 		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
 
-	ret = ip_set_get_ipaddr4(tb[IPSET_ATTR_IP], &data.ip);
+	ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP], &ip);
 	if (ret)
 		return ret;
 
-	if (tb[IPSET_ATTR_CIDR])
+	if (tb[IPSET_ATTR_CIDR]) {
 		data.cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
 		if (!data.cidr)
 			return -IPSET_ERR_INVALID_CIDR;
-	data.ip &= ip_set_netmask(data.cidr);
+	}
 
 	if (tb[IPSET_ATTR_PORT])
 		data.port = nla_get_be16(tb[IPSET_ATTR_PORT]);
@@ -217,21 +209,15 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 	if (tb[IPSET_ATTR_PROTO]) {
 		data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
+		with_ports = ip_set_proto_with_ports(data.proto);
 
 		if (data.proto == 0)
 			return -IPSET_ERR_INVALID_PROTO;
 	} else
 		return -IPSET_ERR_MISSING_PROTO;
 
-	switch (data.proto) {
-	case IPPROTO_UDP:
-	case IPPROTO_TCP:
-	case IPPROTO_ICMP:
-		break;
-	default:
+	if (!(with_ports || data.proto == IPPROTO_ICMP))
 		data.port = 0;
-		break;
-	}
 
 	if (tb[IPSET_ATTR_TIMEOUT]) {
 		if (!with_timeout(h->timeout))
@@ -239,27 +225,48 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *head, int len,
 		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 	}
 
-	if (adt == IPSET_TEST ||
-	    !(data.proto == IPPROTO_TCP || data.proto == IPPROTO_UDP) ||
-	    !tb[IPSET_ATTR_PORT_TO]) {
-		ret = adtfn(set, &data, timeout);
+	with_ports = with_ports && tb[IPSET_ATTR_PORT_TO];
+	if (adt == IPSET_TEST || !(with_ports || tb[IPSET_ATTR_IP_TO])) {
+		data.ip = htonl(ip & ip_set_hostmask(data.cidr));
+		ret = adtfn(set, &data, timeout, flags);
 		return ip_set_eexist(ret, flags) ? 0 : ret;
 	}
 
-	port = ntohs(data.port);
+	port = port_to = ntohs(data.port);
+	if (tb[IPSET_ATTR_PORT_TO]) {
 		port_to = ip_set_get_h16(tb[IPSET_ATTR_PORT_TO]);
-	if (port > port_to)
+		if (port_to < port)
 			swap(port, port_to);
+	}
+	if (tb[IPSET_ATTR_IP_TO]) {
+		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
+		if (ret)
+			return ret;
+		if (ip_to < ip)
+			swap(ip, ip_to);
+		if (ip + UINT_MAX == ip_to)
+			return -IPSET_ERR_HASH_RANGE;
+	} else {
+		ip_set_mask_from_to(ip, ip_to, data.cidr);
+	}
 
-	for (; port <= port_to; port++) {
-		data.port = htons(port);
-		ret = adtfn(set, &data, timeout);
+	if (retried)
+		ip = h->next.ip;
+	while (!after(ip, ip_to)) {
+		data.ip = htonl(ip);
+		last = ip_set_range_to_cidr(ip, ip_to, &data.cidr);
+		p = retried && ip == h->next.ip ? h->next.port : port;
+		for (; p <= port_to; p++) {
+			data.port = htons(p);
+			ret = adtfn(set, &data, timeout, flags);
 
 			if (ret && !ip_set_eexist(ret, flags))
 				return ret;
 			else
 				ret = 0;
 		}
+		ip = last + 1;
+	}
 	return ret;
 }
 
@@ -376,51 +383,58 @@ nla_put_failure:
 #define HOST_MASK	128
 #include "ip_set_ahash.h"
 
+static inline void
+hash_netport6_data_next(struct ip_set_hash *h,
+			const struct hash_netport6_elem *d)
+{
+	h->next.port = ntohs(d->port);
+}
+
 static int
 hash_netport6_kadt(struct ip_set *set, const struct sk_buff *skb,
-		   enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+		   const struct xt_action_param *par,
+		   enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 {
 	const struct ip_set_hash *h = set->data;
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_netport6_elem data = {
-		.cidr = h->nets[0].cidr || HOST_MASK };
+		.cidr = h->nets[0].cidr ? h->nets[0].cidr : HOST_MASK
+	};
 
 	if (data.cidr == 0)
 		return -EINVAL;
 	if (adt == IPSET_TEST)
 		data.cidr = HOST_MASK;
 
-	if (!ip_set_get_ip6_port(skb, flags & IPSET_DIM_TWO_SRC,
+	if (!ip_set_get_ip6_port(skb, opt->flags & IPSET_DIM_TWO_SRC,
 				 &data.port, &data.proto))
 		return -EINVAL;
 
-	ip6addrptr(skb, flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
+	ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &data.ip.in6);
 	ip6_netmask(&data.ip, data.cidr);
 
-	return adtfn(set, &data, h->timeout);
+	return adtfn(set, &data, opt_timeout(opt, h), opt->cmdflags);
 }
 
 static int
-hash_netport6_uadt(struct ip_set *set, struct nlattr *head, int len,
-		   enum ipset_adt adt, u32 *lineno, u32 flags)
+hash_netport6_uadt(struct ip_set *set, struct nlattr *tb[],
+		   enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	const struct ip_set_hash *h = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
 	ipset_adtfn adtfn = set->variant->adt[adt];
 	struct hash_netport6_elem data = { .cidr = HOST_MASK };
 	u32 port, port_to;
 	u32 timeout = h->timeout;
+	bool with_ports = false;
 	int ret;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      hash_netport_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_IP] ||
 		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 		return -IPSET_ERR_PROTOCOL;
+	if (unlikely(tb[IPSET_ATTR_IP_TO]))
+		return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
 
 	if (tb[IPSET_ATTR_LINENO])
 		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
@@ -442,21 +456,15 @@ hash_netport6_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 	if (tb[IPSET_ATTR_PROTO]) {
 		data.proto = nla_get_u8(tb[IPSET_ATTR_PROTO]);
+		with_ports = ip_set_proto_with_ports(data.proto);
 
 		if (data.proto == 0)
 			return -IPSET_ERR_INVALID_PROTO;
 	} else
 		return -IPSET_ERR_MISSING_PROTO;
 
-	switch (data.proto) {
-	case IPPROTO_UDP:
-	case IPPROTO_TCP:
-	case IPPROTO_ICMPV6:
-		break;
-	default:
+	if (!(with_ports || data.proto == IPPROTO_ICMPV6))
 		data.port = 0;
-		break;
-	}
 
 	if (tb[IPSET_ATTR_TIMEOUT]) {
 		if (!with_timeout(h->timeout))
@@ -464,10 +472,8 @@ hash_netport6_uadt(struct ip_set *set, struct nlattr *head, int len,
 		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 	}
 
-	if (adt == IPSET_TEST ||
-	    !(data.proto == IPPROTO_TCP || data.proto == IPPROTO_UDP) ||
-	    !tb[IPSET_ATTR_PORT_TO]) {
-		ret = adtfn(set, &data, timeout);
+	if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
+		ret = adtfn(set, &data, timeout, flags);
 		return ip_set_eexist(ret, flags) ? 0 : ret;
 	}
 
@@ -476,9 +482,11 @@ hash_netport6_uadt(struct ip_set *set, struct nlattr *head, int len,
 	if (port > port_to)
 		swap(port, port_to);
 
+	if (retried)
+		port = h->next.port;
 	for (; port <= port_to; port++) {
 		data.port = htons(port);
-		ret = adtfn(set, &data, timeout);
+		ret = adtfn(set, &data, timeout, flags);
 
 		if (ret && !ip_set_eexist(ret, flags))
 			return ret;
@@ -490,20 +498,9 @@ hash_netport6_uadt(struct ip_set *set, struct nlattr *head, int len,
 
 /* Create hash:ip type of sets */
 
-static const struct nla_policy
-hash_netport_create_policy[IPSET_ATTR_CREATE_MAX+1] = {
-	[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
-	[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
-	[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
-	[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
-	[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-};
-
 static int
-hash_netport_create(struct ip_set *set, struct nlattr *head, int len, u32 flags)
+hash_netport_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 {
-	struct nlattr *tb[IPSET_ATTR_CREATE_MAX+1];
 	struct ip_set_hash *h;
 	u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM;
 	u8 hbits;
@@ -511,10 +508,6 @@ hash_netport_create(struct ip_set *set, struct nlattr *head, int len, u32 flags)
 	if (!(set->family == AF_INET || set->family == AF_INET6))
 		return -IPSET_ERR_INVALID_FAMILY;
 
-	if (nla_parse(tb, IPSET_ATTR_CREATE_MAX, head, len,
-		      hash_netport_create_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_HASHSIZE) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_MAXELEM) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
@@ -542,8 +535,7 @@ hash_netport_create(struct ip_set *set, struct nlattr *head, int len, u32 flags)
 	hbits = htable_bits(hashsize);
 	h->table = ip_set_alloc(
 			sizeof(struct htable)
-			+ jhash_size(hbits) * sizeof(struct hbucket),
-			GFP_KERNEL);
+			+ jhash_size(hbits) * sizeof(struct hbucket));
 	if (!h->table) {
 		kfree(h);
 		return -ENOMEM;
@@ -580,8 +572,28 @@ static struct ip_set_type hash_netport_type __read_mostly = {
 	.features	= IPSET_TYPE_IP | IPSET_TYPE_PORT,
 	.dimension	= IPSET_DIM_TWO,
 	.family		= AF_UNSPEC,
-	.revision	= 0,
+	.revision_min	= 0,
+	/*		  1	   SCTP and UDPLITE support added */
+	.revision_max	= 2,	/* Range as input support for IPv4 added */
 	.create		= hash_netport_create,
+	.create_policy	= {
+		[IPSET_ATTR_HASHSIZE]	= { .type = NLA_U32 },
+		[IPSET_ATTR_MAXELEM]	= { .type = NLA_U32 },
+		[IPSET_ATTR_PROBES]	= { .type = NLA_U8 },
+		[IPSET_ATTR_RESIZE]	= { .type = NLA_U8  },
+		[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+	},
+	.adt_policy	= {
+		[IPSET_ATTR_IP]		= { .type = NLA_NESTED },
+		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },
+		[IPSET_ATTR_PORT]	= { .type = NLA_U16 },
+		[IPSET_ATTR_PORT_TO]	= { .type = NLA_U16 },
+		[IPSET_ATTR_PROTO]	= { .type = NLA_U8 },
+		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
+	},
 	.me		= THIS_MODULE,
 };
 

extensions/ipset-6/ip_set_list_set.c

@@ -43,14 +43,19 @@ struct list_set {
 static inline struct set_elem *
 list_set_elem(const struct list_set *map, u32 id)
 {
-	return (struct set_elem *)((char *)map->members + id * map->dsize);
+	return (struct set_elem *)((void *)map->members + id * map->dsize);
+}
+
+static inline struct set_telem *
+list_set_telem(const struct list_set *map, u32 id)
+{
+	return (struct set_telem *)((void *)map->members + id * map->dsize);
 }
 
 static inline bool
 list_set_timeout(const struct list_set *map, u32 id)
 {
-	const struct set_telem *elem =
-		(const struct set_telem *) list_set_elem(map, id);
+	const struct set_telem *elem = list_set_telem(map, id);
 
 	return ip_set_timeout_test(elem->timeout);
 }
@@ -58,24 +63,17 @@ list_set_timeout(const struct list_set *map, u32 id)
 static inline bool
 list_set_expired(const struct list_set *map, u32 id)
 {
-	const struct set_telem *elem =
-		(const struct set_telem *) list_set_elem(map, id);
+	const struct set_telem *elem = list_set_telem(map, id);
 
 	return ip_set_timeout_expired(elem->timeout);
 }
 
-static inline int
-list_set_exist(const struct set_telem *elem)
-{
-	return elem->id != IPSET_INVALID_ID &&
-	       !ip_set_timeout_expired(elem->timeout);
-}
-
 /* Set list without and with timeout */
 
 static int
 list_set_kadt(struct ip_set *set, const struct sk_buff *skb,
-	      enum ipset_adt adt, u8 pf, u8 dim, u8 flags)
+	      const struct xt_action_param *par,
+	      enum ipset_adt adt, const struct ip_set_adt_opt *opt)
 {
 	struct list_set *map = set->data;
 	struct set_elem *elem;
@@ -90,17 +88,17 @@ list_set_kadt(struct ip_set *set, const struct sk_buff *skb,
 			continue;
 		switch (adt) {
 		case IPSET_TEST:
-			ret = ip_set_test(elem->id, skb, pf, dim, flags);
+			ret = ip_set_test(elem->id, skb, par, opt);
 			if (ret > 0)
 				return ret;
 			break;
 		case IPSET_ADD:
-			ret = ip_set_add(elem->id, skb, pf, dim, flags);
+			ret = ip_set_add(elem->id, skb, par, opt);
 			if (ret == 0)
 				return ret;
 			break;
 		case IPSET_DEL:
-			ret = ip_set_del(elem->id, skb, pf, dim, flags);
+			ret = ip_set_del(elem->id, skb, par, opt);
 			if (ret == 0)
 				return ret;
 			break;
@@ -111,26 +109,29 @@ list_set_kadt(struct ip_set *set, const struct sk_buff *skb,
 	return -EINVAL;
 }
 
-static const struct nla_policy list_set_adt_policy[IPSET_ATTR_ADT_MAX+1] = {
-	[IPSET_ATTR_NAME]	= { .type = NLA_STRING,
-				    .len = IPSET_MAXNAMELEN },
-	[IPSET_ATTR_NAMEREF]	= { .type = NLA_STRING,
-				    .len = IPSET_MAXNAMELEN },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-	[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
-	[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },
-};
-
 static bool
-next_id_eq(const struct list_set *map, u32 i, ip_set_id_t id)
+id_eq(const struct list_set *map, u32 i, ip_set_id_t id)
 {
 	const struct set_elem *elem;
 
-	if (i + 1 < map->size) {
-		elem = list_set_elem(map, i + 1);
+	if (i < map->size) {
+		elem = list_set_elem(map, i);
+		return elem->id == id;
+	}
+
+	return 0;
+}
+
+static bool
+id_eq_timeout(const struct list_set *map, u32 i, ip_set_id_t id)
+{
+	const struct set_elem *elem;
+
+	if (i < map->size) {
+		elem = list_set_elem(map, i);
 		return !!(elem->id == id &&
 			  !(with_timeout(map->timeout) &&
-			    list_set_expired(map, i + 1)));
+			    list_set_expired(map, i)));
 	}
 
 	return 0;
@@ -156,11 +157,11 @@ list_elem_tadd(struct list_set *map, u32 i, ip_set_id_t id,
 	struct set_telem *e;
 
 	for (; i < map->size; i++) {
-		e = (struct set_telem *)list_set_elem(map, i);
+		e = list_set_telem(map, i);
 		swap(e->id, id);
+		swap(e->timeout, timeout);
 		if (e->id == IPSET_INVALID_ID)
 			break;
-		swap(e->timeout, timeout);
 	}
 }
 
@@ -174,7 +175,7 @@ list_set_add(struct list_set *map, u32 i, ip_set_id_t id,
 		/* Last element replaced: e.g. add new,before,last */
 		ip_set_put_byindex(e->id);
 	if (with_timeout(map->timeout))
-		list_elem_tadd(map, i, id, timeout);
+		list_elem_tadd(map, i, id, ip_set_timeout_set(timeout));
 	else
 		list_elem_add(map, i, id);
 
@@ -182,11 +183,11 @@ list_set_add(struct list_set *map, u32 i, ip_set_id_t id,
 }
 
 static int
-list_set_del(struct list_set *map, ip_set_id_t id, u32 i)
+list_set_del(struct list_set *map, u32 i)
 {
 	struct set_elem *a = list_set_elem(map, i), *b;
 
-	ip_set_put_byindex(id);
+	ip_set_put_byindex(a->id);
 
 	for (; i < map->size - 1; i++) {
 		b = list_set_elem(map, i + 1);
@@ -203,13 +204,26 @@ list_set_del(struct list_set *map, ip_set_id_t id, u32 i)
 	return 0;
 }
 
+static void
+cleanup_entries(struct list_set *map)
+{
+	struct set_telem *e;
+	u32 i;
+
+	for (i = 0; i < map->size; i++) {
+		e = list_set_telem(map, i);
+		if (e->id != IPSET_INVALID_ID && list_set_expired(map, i))
+			list_set_del(map, i);
+	}
+}
+
 static int
-list_set_uadt(struct ip_set *set, struct nlattr *head, int len,
-	      enum ipset_adt adt, u32 *lineno, u32 flags)
+list_set_uadt(struct ip_set *set, struct nlattr *tb[],
+	      enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
 {
 	struct list_set *map = set->data;
-	struct nlattr *tb[IPSET_ATTR_ADT_MAX+1];
 	bool with_timeout = with_timeout(map->timeout);
+	bool flag_exist = flags & IPSET_FLAG_EXIST;
 	int before = 0;
 	u32 timeout = map->timeout;
 	ip_set_id_t id, refid = IPSET_INVALID_ID;
@@ -218,10 +232,6 @@ list_set_uadt(struct ip_set *set, struct nlattr *head, int len,
 	u32 i;
 	int ret = 0;
 
-	if (nla_parse(tb, IPSET_ATTR_ADT_MAX, head, len,
-		      list_set_adt_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!tb[IPSET_ATTR_NAME] ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
@@ -266,6 +276,8 @@ list_set_uadt(struct ip_set *set, struct nlattr *head, int len,
 		}
 		timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
 	}
+	if (with_timeout && adt != IPSET_TEST)
+		cleanup_entries(map);
 
 	switch (adt) {
 	case IPSET_TEST:
@@ -277,22 +289,37 @@ list_set_uadt(struct ip_set *set, struct nlattr *head, int len,
 			else if (with_timeout && list_set_expired(map, i))
 				continue;
 			else if (before > 0 && elem->id == id)
-				ret = next_id_eq(map, i, refid);
+				ret = id_eq_timeout(map, i + 1, refid);
 			else if (before < 0 && elem->id == refid)
-				ret = next_id_eq(map, i, id);
+				ret = id_eq_timeout(map, i + 1, id);
 			else if (before == 0 && elem->id == id)
 				ret = 1;
 		}
 		break;
 	case IPSET_ADD:
-		for (i = 0; i < map->size && !ret; i++) {
+		for (i = 0; i < map->size; i++) {
 			elem = list_set_elem(map, i);
-			if (elem->id == id &&
-			    !(with_timeout && list_set_expired(map, i)))
+			if (elem->id != id)
+				continue;
+			if (!(with_timeout && flag_exist)) {
 				ret = -IPSET_ERR_EXIST;
+				goto finish;
+			} else {
+				struct set_telem *e = list_set_telem(map, i);
+
+				if ((before > 1 &&
+				     !id_eq(map, i + 1, refid)) ||
+				    (before < 0 &&
+				     (i == 0 || !id_eq(map, i - 1, refid)))) {
+					ret = -IPSET_ERR_EXIST;
+					goto finish;
+				}
+				e->timeout = ip_set_timeout_set(timeout);
+				ip_set_put_byindex(id);
+				ret = 0;
+				goto finish;
+			}
 		}
-		if (ret == -IPSET_ERR_EXIST)
-			break;
 		ret = -IPSET_ERR_LIST_FULL;
 		for (i = 0; i < map->size && ret == -IPSET_ERR_LIST_FULL; i++) {
 			elem = list_set_elem(map, i);
@@ -301,9 +328,7 @@ list_set_uadt(struct ip_set *set, struct nlattr *head, int len,
 					: list_set_add(map, i, id, timeout);
 			else if (elem->id != refid)
 				continue;
-			else if (with_timeout && list_set_expired(map, i))
-				ret = -IPSET_ERR_REF_EXIST;
-			else if (before)
+			else if (before > 0)
 				ret = list_set_add(map, i, id, timeout);
 			else if (i + 1 < map->size)
 				ret = list_set_add(map, i + 1, id, timeout);
@@ -317,17 +342,13 @@ list_set_uadt(struct ip_set *set, struct nlattr *head, int len,
 				ret = before != 0 ? -IPSET_ERR_REF_EXIST
 						  : -IPSET_ERR_EXIST;
 				break;
-			} else if (with_timeout && list_set_expired(map, i))
-				continue;
-			else if (elem->id == id &&
+			} else if (elem->id == id &&
 				   (before == 0 ||
-				  (before > 0 &&
-				   next_id_eq(map, i, refid))))
-				ret = list_set_del(map, id, i);
-			else if (before < 0 &&
-				 elem->id == refid &&
-				 next_id_eq(map, i, id))
-				ret = list_set_del(map, id, i + 1);
+				    (before > 0 && id_eq(map, i + 1, refid))))
+				ret = list_set_del(map, i);
+			else if (elem->id == refid &&
+				 before < 0 && id_eq(map, i + 1, id))
+				ret = list_set_del(map, i + 1);
 		}
 		break;
 	default:
@@ -384,15 +405,14 @@ list_set_head(struct ip_set *set, struct sk_buff *skb)
 	NLA_PUT_NET32(skb, IPSET_ATTR_SIZE, htonl(map->size));
 	if (with_timeout(map->timeout))
 		NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout));
-	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
-		      htonl(atomic_read(&set->ref) - 1));
+	NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
 	NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
 		      htonl(sizeof(*map) + map->size * map->dsize));
 	ipset_nest_end(skb, nested);
 
 	return 0;
 nla_put_failure:
-	return -EFAULT;
+	return -EMSGSIZE;
 }
 
 static int
@@ -406,7 +426,7 @@ list_set_list(const struct ip_set *set,
 
 	atd = ipset_nest_start(skb, IPSET_ATTR_ADT);
 	if (!atd)
-		return -EFAULT;
+		return -EMSGSIZE;
 	for (; cb->args[2] < map->size; cb->args[2]++) {
 		i = cb->args[2];
 		e = list_set_elem(map, i);
@@ -418,7 +438,7 @@ list_set_list(const struct ip_set *set,
 		if (!nested) {
 			if (i == first) {
 				nla_nest_cancel(skb, atd);
-				return -EFAULT;
+				return -EMSGSIZE;
 			} else
 				goto nla_put_failure;
 		}
@@ -441,6 +461,10 @@ finish:
 nla_put_failure:
 	nla_nest_cancel(skb, nested);
 	ipset_nest_end(skb, atd);
+	if (unlikely(i == first)) {
+		cb->args[2] = 0;
+		return -EMSGSIZE;
+	}
 	return 0;
 }
 
@@ -469,19 +493,10 @@ list_set_gc(unsigned long ul_set)
 {
 	struct ip_set *set = (struct ip_set *) ul_set;
 	struct list_set *map = set->data;
-	struct set_telem *e;
-	u32 i;
 
-	/* We run parallel with other readers (test element)
-	 * but adding/deleting new entries is locked out */
-	read_lock_bh(&set->lock);
-	for (i = map->size - 1; i >= 0; i--) {
-		e = (struct set_telem *) list_set_elem(map, i);
-		if (e->id != IPSET_INVALID_ID &&
-		    list_set_expired(map, i))
-			list_set_del(map, e->id, i);
-	}
-	read_unlock_bh(&set->lock);
+	write_lock_bh(&set->lock);
+	cleanup_entries(map);
+	write_unlock_bh(&set->lock);
 
 	map->gc.expires = jiffies + IPSET_GC_PERIOD(map->timeout) * HZ;
 	add_timer(&map->gc);
@@ -501,12 +516,6 @@ list_set_gc_init(struct ip_set *set)
 
 /* Create list:set type of sets */
 
-static const struct nla_policy
-list_set_create_policy[IPSET_ATTR_CREATE_MAX+1] = {
-	[IPSET_ATTR_SIZE]	= { .type = NLA_U32 },
-	[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
-};
-
 static bool
 init_list_set(struct ip_set *set, u32 size, size_t dsize,
 	      unsigned long timeout)
@@ -533,16 +542,10 @@ init_list_set(struct ip_set *set, u32 size, size_t dsize,
 }
 
 static int
-list_set_create(struct ip_set *set, struct nlattr *head, int len,
-		u32 flags)
+list_set_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 {
-	struct nlattr *tb[IPSET_ATTR_CREATE_MAX+1];
 	u32 size = IP_SET_LIST_DEFAULT_SIZE;
 
-	if (nla_parse(tb, IPSET_ATTR_CREATE_MAX, head, len,
-		      list_set_create_policy))
-		return -IPSET_ERR_PROTOCOL;
-
 	if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_SIZE) ||
 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT)))
 		return -IPSET_ERR_PROTOCOL;
@@ -573,8 +576,22 @@ static struct ip_set_type list_set_type __read_mostly = {
 	.features	= IPSET_TYPE_NAME | IPSET_DUMP_LAST,
 	.dimension	= IPSET_DIM_ONE,
 	.family		= AF_UNSPEC,
-	.revision	= 0,
+	.revision_min	= 0,
+	.revision_max	= 0,
 	.create		= list_set_create,
+	.create_policy	= {
+		[IPSET_ATTR_SIZE]	= { .type = NLA_U32 },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+	},
+	.adt_policy	= {
+		[IPSET_ATTR_NAME]	= { .type = NLA_STRING,
+					    .len = IPSET_MAXNAMELEN },
+		[IPSET_ATTR_NAMEREF]	= { .type = NLA_STRING,
+					    .len = IPSET_MAXNAMELEN },
+		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
+		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },
+		[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },
+	},
 	.me		= THIS_MODULE,
 };
 

extensions/ipset-6/ip_set_timeout.h

@@ -22,6 +22,9 @@
 
 #define with_timeout(timeout)	((timeout) != IPSET_NO_TIMEOUT)
 
+#define opt_timeout(opt, map)	\
+	(with_timeout((opt)->timeout) ? (opt)->timeout : (map)->timeout)
+
 static inline unsigned int
 ip_set_timeout_uget(struct nlattr *tb)
 {
@@ -45,7 +48,7 @@ ip_set_timeout_test(unsigned long timeout)
 {
 	return timeout != IPSET_ELEM_UNSET &&
 	       (timeout == IPSET_ELEM_PERMANENT ||
-		time_after(timeout, jiffies));
+		time_is_after_jiffies(timeout));
 }
 
 static inline bool
@@ -53,7 +56,7 @@ ip_set_timeout_expired(unsigned long timeout)
 {
 	return timeout != IPSET_ELEM_UNSET &&
 	       timeout != IPSET_ELEM_PERMANENT &&
-	       time_before(timeout, jiffies);
+	       time_is_before_jiffies(timeout);
 }
 
 static inline unsigned long
@@ -64,7 +67,7 @@ ip_set_timeout_set(u32 timeout)
 	if (!timeout)
 		return IPSET_ELEM_PERMANENT;
 
-	t = timeout * HZ + jiffies;
+	t = msecs_to_jiffies(timeout * 1000) + jiffies;
 	if (t == IPSET_ELEM_UNSET || t == IPSET_ELEM_PERMANENT)
 		/* Bingo! */
 		t++;
@@ -75,7 +78,8 @@ ip_set_timeout_set(u32 timeout)
 static inline u32
 ip_set_timeout_get(unsigned long timeout)
 {
-	return timeout == IPSET_ELEM_PERMANENT ? 0 : (timeout - jiffies)/HZ;
+	return timeout == IPSET_ELEM_PERMANENT ? 0 :
+		jiffies_to_msecs(timeout - jiffies)/1000;
 }
 
 #else
@@ -89,14 +93,14 @@ static inline bool
 ip_set_timeout_test(unsigned long timeout)
 {
 	return timeout == IPSET_ELEM_PERMANENT ||
-	       time_after(timeout, jiffies);
+	       time_is_after_jiffies(timeout);
 }
 
 static inline bool
 ip_set_timeout_expired(unsigned long timeout)
 {
 	return timeout != IPSET_ELEM_PERMANENT &&
-	       time_before(timeout, jiffies);
+	       time_is_before_jiffies(timeout);
 }
 
 static inline unsigned long
@@ -107,7 +111,7 @@ ip_set_timeout_set(u32 timeout)
 	if (!timeout)
 		return IPSET_ELEM_PERMANENT;
 
-	t = timeout * HZ + jiffies;
+	t = msecs_to_jiffies(timeout * 1000) + jiffies;
 	if (t == IPSET_ELEM_PERMANENT)
 		/* Bingo! :-) */
 		t++;
@@ -118,7 +122,8 @@ ip_set_timeout_set(u32 timeout)
 static inline u32
 ip_set_timeout_get(unsigned long timeout)
 {
-	return timeout == IPSET_ELEM_PERMANENT ? 0 : (timeout - jiffies)/HZ;
+	return timeout == IPSET_ELEM_PERMANENT ? 0 :
+		jiffies_to_msecs(timeout - jiffies)/1000;
 }
 #endif /* ! IP_SET_BITMAP_TIMEOUT */
 

extensions/ipset-6/libipset/data.c

@@ -7,6 +7,7 @@
 #include <assert.h>				/* assert */
 #include <arpa/inet.h>				/* ntoh* */
 #include <net/ethernet.h>			/* ETH_ALEN */
+#include <net/if.h>				/* IFNAMSIZ */
 #include <sys/socket.h>				/* AF_ */
 #include <stdlib.h>				/* malloc, free */
 #include <string.h>				/* memset */
@@ -66,11 +67,13 @@ struct ipset_data {
 		/* ADT/LIST/SAVE */
 		struct {
 			union nf_inet_addr ip2;
+			union nf_inet_addr ip2_to;
 			uint8_t cidr2;
 			uint8_t proto;
 			char ether[ETH_ALEN];
 			char name[IPSET_MAXNAMELEN];
 			char nameref[IPSET_MAXNAMELEN];
+			char iface[IFNAMSIZ];
 		} adt;
 	};
 };
@@ -289,12 +292,20 @@ ipset_data_set(struct ipset_data *data, enum ipset_opt opt, const void *value)
 			return -1;
 		copy_addr(data->family, &data->adt.ip2, value);
 		break;
+	case IPSET_OPT_IP2_TO:
+		if (!(data->family == AF_INET || data->family == AF_INET6))
+			return -1;
+		copy_addr(data->family, &data->adt.ip2_to, value);
+		break;
 	case IPSET_OPT_CIDR2:
 		data->adt.cidr2 = *(const uint8_t *) value;
 		break;
 	case IPSET_OPT_PROTO:
 		data->adt.proto = *(const uint8_t *) value;
 		break;
+	case IPSET_OPT_IFACE:
+		ipset_strlcpy(data->adt.iface, value, IFNAMSIZ);
+		break;
 	/* Swap/rename */
 	case IPSET_OPT_SETNAME2:
 		ipset_strlcpy(data->setname2, value, IPSET_MAXNAMELEN);
@@ -306,6 +317,9 @@ ipset_data_set(struct ipset_data *data, enum ipset_opt opt, const void *value)
 	case IPSET_OPT_BEFORE:
 		cadt_flag_type_attr(data, opt, IPSET_FLAG_BEFORE);
 		break;
+	case IPSET_OPT_PHYSDEV:
+		cadt_flag_type_attr(data, opt, IPSET_FLAG_PHYSDEV);
+		break;
 	case IPSET_OPT_FLAGS:
 		data->flags = *(const uint32_t *)value;
 		break;
@@ -401,10 +415,14 @@ ipset_data_get(const struct ipset_data *data, enum ipset_opt opt)
 		return data->adt.nameref;
 	case IPSET_OPT_IP2:
 		return &data->adt.ip2;
+	case IPSET_OPT_IP2_TO:
+		return &data->adt.ip2_to;
 	case IPSET_OPT_CIDR2:
 		return &data->adt.cidr2;
 	case IPSET_OPT_PROTO:
 		return &data->adt.proto;
+	case IPSET_OPT_IFACE:
+		return &data->adt.iface;
 	/* Swap/rename */
 	case IPSET_OPT_SETNAME2:
 		return data->setname2;
@@ -414,6 +432,7 @@ ipset_data_get(const struct ipset_data *data, enum ipset_opt opt)
 		return &data->flags;
 	case IPSET_OPT_CADT_FLAGS:
 	case IPSET_OPT_BEFORE:
+	case IPSET_OPT_PHYSDEV:
 		return &data->cadt_flags;
 	default:
 		return NULL;
@@ -436,6 +455,7 @@ ipset_data_sizeof(enum ipset_opt opt, uint8_t family)
 	case IPSET_OPT_IP:
 	case IPSET_OPT_IP_TO:
 	case IPSET_OPT_IP2:
+	case IPSET_OPT_IP2_TO:
 		return family == AF_INET ? sizeof(uint32_t)
 					 : sizeof(struct in6_addr);
 	case IPSET_OPT_PORT:
@@ -463,8 +483,9 @@ ipset_data_sizeof(enum ipset_opt opt, uint8_t family)
 		return sizeof(uint8_t);
 	case IPSET_OPT_ETHER:
 		return ETH_ALEN;
-	/* Flags counted once */
+	/* Flags doesn't counted once :-( */
 	case IPSET_OPT_BEFORE:
+	case IPSET_OPT_PHYSDEV:
 		return sizeof(uint32_t);
 	default:
 		return 0;

extensions/ipset-6/libipset/debug.c

@@ -0,0 +1,288 @@
+/* Copyright 2011 Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <arpa/inet.h>					/* inet_ntop */
+#include <libmnl/libmnl.h>				/* libmnl backend */
+
+struct ipset_attrname {
+	const char *name;
+};
+
+static const struct ipset_attrname cmdattr2name[] = {
+	[IPSET_ATTR_PROTOCOL]	= { .name = "PROTOCOL" },
+	[IPSET_ATTR_SETNAME]	= { .name = "SETNAME" },
+	[IPSET_ATTR_TYPENAME]	= { .name = "TYPENAME" },
+	[IPSET_ATTR_REVISION]	= { .name = "REVISION" },
+	[IPSET_ATTR_FAMILY]	= { .name = "FAMILY" },
+	[IPSET_ATTR_FLAGS]	= { .name = "FLAGS" },
+	[IPSET_ATTR_DATA]	= { .name = "DATA" },
+	[IPSET_ATTR_ADT]	= { .name = "ADT" },
+	[IPSET_ATTR_LINENO]	= { .name = "LINENO" },
+	[IPSET_ATTR_PROTOCOL_MIN] = { .name = "PROTO_MIN" },
+};
+
+static const struct ipset_attrname createattr2name[] = {
+	[IPSET_ATTR_IP]		= { .name = "IP" },
+	[IPSET_ATTR_IP_TO]	= { .name = "IP_TO" },
+	[IPSET_ATTR_CIDR]	= { .name = "CIDR" },
+	[IPSET_ATTR_PORT]	= { .name = "PORT" },
+	[IPSET_ATTR_PORT_TO]	= { .name = "PORT_TO" },
+	[IPSET_ATTR_TIMEOUT]	= { .name = "TIMEOUT" },
+	[IPSET_ATTR_PROTO]	= { .name = "PROTO" },
+	[IPSET_ATTR_CADT_FLAGS]	= { .name = "CADT_FLAGS" },
+	[IPSET_ATTR_CADT_LINENO] = { .name = "CADT_LINENO" },
+	[IPSET_ATTR_GC]		= { .name = "GC" },
+	[IPSET_ATTR_HASHSIZE]	= { .name = "HASHSIZE" },
+	[IPSET_ATTR_MAXELEM]	= { .name = "MAXELEM" },
+	[IPSET_ATTR_NETMASK]	= { .name = "NETMASK" },
+	[IPSET_ATTR_PROBES]	= { .name = "PROBES" },
+	[IPSET_ATTR_RESIZE]	= { .name = "RESIZE" },
+	[IPSET_ATTR_SIZE]	= { .name = "SIZE" },
+	[IPSET_ATTR_ELEMENTS]	= { .name = "ELEMENTS" },
+	[IPSET_ATTR_REFERENCES]	= { .name = "REFERENCES" },
+	[IPSET_ATTR_MEMSIZE]	= { .name = "MEMSIZE" },
+};
+
+static const struct ipset_attrname adtattr2name[] = {
+	[IPSET_ATTR_IP]		= { .name = "IP" },
+	[IPSET_ATTR_IP_TO]	= { .name = "IP_TO" },
+	[IPSET_ATTR_CIDR]	= { .name = "CIDR" },
+	[IPSET_ATTR_PORT]	= { .name = "PORT" },
+	[IPSET_ATTR_PORT_TO]	= { .name = "PORT_TO" },
+	[IPSET_ATTR_TIMEOUT]	= { .name = "TIMEOUT" },
+	[IPSET_ATTR_PROTO]	= { .name = "PROTO" },
+	[IPSET_ATTR_CADT_FLAGS]	= { .name = "CADT_FLAGS" },
+	[IPSET_ATTR_CADT_LINENO] = { .name = "CADT_LINENO" },
+	[IPSET_ATTR_ETHER]	= { .name = "ETHER" },
+	[IPSET_ATTR_NAME]	= { .name = "NAME" },
+	[IPSET_ATTR_NAMEREF]	= { .name = "NAMEREF" },
+	[IPSET_ATTR_IP2]	= { .name = "IP2" },
+	[IPSET_ATTR_CIDR2]	= { .name = "CIDR2" },
+	[IPSET_ATTR_IP2_TO]	= { .name = "IP2_TO" },
+	[IPSET_ATTR_IFACE]	= { .name = "IFACE" },
+};
+
+static void
+debug_cadt_attrs(int max, const struct ipset_attr_policy *policy,
+		 const struct ipset_attrname attr2name[],
+		 struct nlattr *nla[])
+{
+	uint32_t v;
+	int i;
+
+	fprintf(stderr, "\t\t%s attributes:\n",
+		policy == create_attrs ? "CREATE" : "ADT");
+	for (i = IPSET_ATTR_UNSPEC + 1; i <= max; i++) {
+		if (!nla[i])
+			continue;
+		switch (policy[i].type) {
+		case MNL_TYPE_U8:
+			v = *(uint8_t *) mnl_attr_get_payload(nla[i]);
+			fprintf(stderr, "\t\t%s: %u\n",
+				attr2name[i].name, v);
+			break;
+		case MNL_TYPE_U16:
+			v = *(uint16_t *) mnl_attr_get_payload(nla[i]);
+			fprintf(stderr, "\t\t%s: %u\n",
+				attr2name[i].name, ntohs(v));
+			break;
+		case MNL_TYPE_U32:
+			v = *(uint32_t *) mnl_attr_get_payload(nla[i]);
+			fprintf(stderr, "\t\t%s: %u\n",
+				attr2name[i].name, ntohl(v));
+			break;
+		case MNL_TYPE_NUL_STRING:
+			fprintf(stderr, "\t\t%s: %s\n",
+				attr2name[i].name,
+				(const char *) mnl_attr_get_payload(nla[i]));
+			break;
+		case MNL_TYPE_NESTED: {
+			struct nlattr *ipattr[IPSET_ATTR_IPADDR_MAX+1] = {};
+			char addr[INET6_ADDRSTRLEN];
+			void *d;
+
+			if (mnl_attr_parse_nested(nla[i], ipaddr_attr_cb,
+						  ipattr) < 0) {
+				fprintf(stderr,
+					"\t\tIPADDR: cannot validate "
+					"and parse attributes\n");
+				continue;
+			}
+			if (ipattr[IPSET_ATTR_IPADDR_IPV4]) {
+				d = mnl_attr_get_payload(
+					ipattr[IPSET_ATTR_IPADDR_IPV4]);
+
+				inet_ntop(AF_INET, d, addr, INET6_ADDRSTRLEN);
+				fprintf(stderr, "\t\t%s: %s\n",
+					attr2name[i].name, addr);
+			} else if (ipattr[IPSET_ATTR_IPADDR_IPV6]) {
+				d = mnl_attr_get_payload(
+					ipattr[IPSET_ATTR_IPADDR_IPV6]);
+
+				inet_ntop(AF_INET6, d, addr, INET6_ADDRSTRLEN);
+				fprintf(stderr, "\t\t%s: %s\n",
+					attr2name[i].name, addr);
+			}
+			break;
+		}
+		default:
+			fprintf(stderr, "\t\t%s: unresolved!\n",
+				attr2name[i].name);
+		}
+	}
+}
+
+static void
+debug_cmd_attrs(int cmd, struct nlattr *nla[])
+{
+	struct nlattr *adt[IPSET_ATTR_ADT_MAX+1] = {};
+	struct nlattr *cattr[IPSET_ATTR_CREATE_MAX+1] = {};
+	uint32_t v;
+	int i;
+
+	fprintf(stderr, "\tCommand attributes:\n");
+	for (i = IPSET_ATTR_UNSPEC + 1; i <= IPSET_ATTR_CMD_MAX; i++) {
+		if (!nla[i])
+			continue;
+		switch (cmd_attrs[i].type) {
+		case MNL_TYPE_U8:
+			v = *(uint8_t *) mnl_attr_get_payload(nla[i]);
+			fprintf(stderr, "\t%s: %u\n",
+				cmdattr2name[i].name, v);
+			break;
+		case MNL_TYPE_U16:
+			v = *(uint16_t *) mnl_attr_get_payload(nla[i]);
+			fprintf(stderr, "\t%s: %u\n",
+				cmdattr2name[i].name, ntohs(v));
+			break;
+		case MNL_TYPE_U32:
+			v = *(uint32_t *) mnl_attr_get_payload(nla[i]);
+			fprintf(stderr, "\t%s: %u\n",
+				cmdattr2name[i].name, ntohl(v));
+			break;
+		case MNL_TYPE_NUL_STRING:
+			fprintf(stderr, "\t%s: %s\n",
+				cmdattr2name[i].name,
+				(const char *) mnl_attr_get_payload(nla[i]));
+			break;
+		case MNL_TYPE_NESTED:
+			if (i == IPSET_ATTR_DATA) {
+				switch (cmd) {
+				case IPSET_CMD_ADD:
+				case IPSET_CMD_DEL:
+				case IPSET_CMD_TEST:
+					if (mnl_attr_parse_nested(nla[i],
+							adt_attr_cb, adt) < 0) {
+						fprintf(stderr,
+							"\tADT: cannot validate "
+							"and parse attributes\n");
+						continue;
+					}
+					debug_cadt_attrs(IPSET_ATTR_ADT_MAX,
+							 adt_attrs,
+							 adtattr2name,
+							 adt);
+					break;
+				default:
+					if (mnl_attr_parse_nested(nla[i],
+							create_attr_cb,
+							cattr) < 0) {
+						fprintf(stderr,
+							"\tCREATE: cannot validate "
+							"and parse attributes\n");
+						continue;
+					}
+					debug_cadt_attrs(IPSET_ATTR_CREATE_MAX,
+							 create_attrs,
+							 createattr2name,
+							 cattr);
+				}
+			} else {
+				struct nlattr *tb;
+				mnl_attr_for_each_nested(tb, nla[i]) {
+					memset(adt, 0, sizeof(adt));
+					if (mnl_attr_parse_nested(tb,
+							adt_attr_cb, adt) < 0) {
+						fprintf(stderr,
+							"\tADT: cannot validate "
+							"and parse attributes\n");
+						continue;
+					}
+					debug_cadt_attrs(IPSET_ATTR_ADT_MAX,
+							 adt_attrs,
+							 adtattr2name,
+							 adt);
+				}
+			}
+			break;
+		default:
+			fprintf(stderr, "\t%s: unresolved!\n",
+				cmdattr2name[i].name);
+		}
+	}
+}
+
+void
+ipset_debug_msg(const char *dir, void *buffer, int len)
+{
+	const struct nlmsghdr *nlh = buffer;
+	struct nlattr *nla[IPSET_ATTR_CMD_MAX+1] = {};
+	int cmd, nfmsglen = MNL_ALIGN(sizeof(struct nfgenmsg));
+
+	debug = 0;
+	while (mnl_nlmsg_ok(nlh, len)) {
+		switch (nlh->nlmsg_type) {
+		case NLMSG_NOOP:
+		case NLMSG_DONE:
+		case NLMSG_OVERRUN:
+			fprintf(stderr, "Message header: %s msg %s\n"
+					"\tlen %d\n"
+					"\tseq  %u\n",
+				dir,
+				nlh->nlmsg_type == NLMSG_NOOP ? "NOOP" :
+				nlh->nlmsg_type == NLMSG_DONE ? "DONE" :
+				"OVERRUN",
+				len, nlh->nlmsg_seq);
+			goto next_msg;
+		case NLMSG_ERROR: {
+			const struct nlmsgerr *err = mnl_nlmsg_get_payload(nlh);
+			fprintf(stderr, "Message header: %s msg ERROR\n"
+					"\tlen %d\n"
+					"\terrcode %d\n"
+					"\tseq %u\n",
+				dir, len, err->error, nlh->nlmsg_seq);
+			goto next_msg;
+			}
+		default:
+			;
+		}
+		cmd = ipset_get_nlmsg_type(nlh);
+		fprintf(stderr, "Message header: %s cmd  %s (%d)\n"
+				"\tlen %d\n"
+				"\tflag %s\n"
+				"\tseq %u\n",
+			dir,
+			cmd <= IPSET_CMD_NONE ? "NONE!" :
+			cmd >= IPSET_CMD_MAX ? "MAX!" : cmd2name[cmd], cmd,
+			len,
+			!(nlh->nlmsg_flags & NLM_F_EXCL) ? "EXIST" : "none",
+			nlh->nlmsg_seq);
+		if (cmd <= IPSET_CMD_NONE || cmd >= IPSET_CMD_MAX)
+			goto next_msg;
+		memset(nla, 0, sizeof(nla));
+		if (mnl_attr_parse(nlh, nfmsglen,
+				cmd_attr_cb, nla) < MNL_CB_STOP) {
+			fprintf(stderr, "\tcannot validate "
+				"and parse attributes\n");
+			goto next_msg;
+		}
+		debug_cmd_attrs(cmd, nla);
+next_msg:
+		nlh = mnl_nlmsg_next(nlh, &len);
+	}
+	debug = 1;
+}

extensions/ipset-6/libipset/icmp.c

@@ -49,17 +49,18 @@ static const struct icmp_names icmp_typecodes[] = {
 	{ "address-mask-reply", 18, 0 },
 };
 
-const char * id_to_icmp(uint8_t id)
+const char *id_to_icmp(uint8_t id)
 {
 	return id < ARRAY_SIZE(icmp_typecodes) ? icmp_typecodes[id].name : NULL;
 }
 
-const char * icmp_to_name(uint8_t type, uint8_t code)
+const char *icmp_to_name(uint8_t type, uint8_t code)
 {
 	unsigned int i;
 
 	for (i = 0; i < ARRAY_SIZE(icmp_typecodes); i++)
-		if (icmp_typecodes[i].type == type && icmp_typecodes[i].code == code)
+		if (icmp_typecodes[i].type == type &&
+		    icmp_typecodes[i].code == code)
 			return icmp_typecodes[i].name;
 
 	return NULL;
@@ -71,7 +72,8 @@ int name_to_icmp(const char *str, uint16_t *typecode)
 
 	for (i = 0; i < ARRAY_SIZE(icmp_typecodes); i++)
 		if (STRNCASEQ(icmp_typecodes[i].name, str, strlen(str))) {
-			*typecode = (icmp_typecodes[i].type << 8) | icmp_typecodes[i].code;
+			*typecode = (icmp_typecodes[i].type << 8) |
+				    icmp_typecodes[i].code;
 			return 0;
 		}
 

extensions/ipset-6/libipset/icmpv6.c

@@ -36,17 +36,19 @@ static const struct icmpv6_names icmpv6_typecodes[] = {
 	{ "redirect", 137, 0 },
 };
 
-const char * id_to_icmpv6(uint8_t id)
+const char *id_to_icmpv6(uint8_t id)
 {
-	return id < ARRAY_SIZE(icmpv6_typecodes) ? icmpv6_typecodes[id].name : NULL;
+	return id < ARRAY_SIZE(icmpv6_typecodes) ?
+	       icmpv6_typecodes[id].name : NULL;
 }
 
-const char * icmpv6_to_name(uint8_t type, uint8_t code)
+const char *icmpv6_to_name(uint8_t type, uint8_t code)
 {
 	unsigned int i;
 
 	for (i = 0; i < ARRAY_SIZE(icmpv6_typecodes); i++)
-		if (icmpv6_typecodes[i].type == type && icmpv6_typecodes[i].code == code)
+		if (icmpv6_typecodes[i].type == type &&
+		    icmpv6_typecodes[i].code == code)
 			return icmpv6_typecodes[i].name;
 
 	return NULL;
@@ -58,7 +60,8 @@ int name_to_icmpv6(const char *str, uint16_t *typecode)
 
 	for (i = 0; i < ARRAY_SIZE(icmpv6_typecodes); i++)
 		if (STRNCASEQ(icmpv6_typecodes[i].name, str, strlen(str))) {
-			*typecode = (icmpv6_typecodes[i].type << 8) | icmpv6_typecodes[i].code;
+			*typecode = (icmpv6_typecodes[i].type << 8) |
+				    icmpv6_typecodes[i].code;
 			return 0;
 		}
 

extensions/ipset-6/libipset/mnl.c

@@ -38,13 +38,14 @@ struct ipset_handle {
 
 /* Netlink flags of the commands */
 static const uint16_t cmdflags[] = {
-	[IPSET_CMD_CREATE-1]	= NLM_F_REQUEST|NLM_F_ACK|NLM_F_CREATE|NLM_F_EXCL,
+	[IPSET_CMD_CREATE-1]	= NLM_F_REQUEST|NLM_F_ACK|
+					NLM_F_CREATE|NLM_F_EXCL,
 	[IPSET_CMD_DESTROY-1]	= NLM_F_REQUEST|NLM_F_ACK,
 	[IPSET_CMD_FLUSH-1]	= NLM_F_REQUEST|NLM_F_ACK,
 	[IPSET_CMD_RENAME-1]	= NLM_F_REQUEST|NLM_F_ACK,
 	[IPSET_CMD_SWAP-1]	= NLM_F_REQUEST|NLM_F_ACK,
-	[IPSET_CMD_LIST-1]	= NLM_F_REQUEST,
-	[IPSET_CMD_SAVE-1]	= NLM_F_REQUEST,
+	[IPSET_CMD_LIST-1]	= NLM_F_REQUEST|NLM_F_ACK,
+	[IPSET_CMD_SAVE-1]	= NLM_F_REQUEST|NLM_F_ACK,
 	[IPSET_CMD_ADD-1]	= NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL,
 	[IPSET_CMD_DEL-1]	= NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL,
 	[IPSET_CMD_TEST-1]	= NLM_F_REQUEST|NLM_F_ACK,
@@ -83,7 +84,6 @@ ipset_mnl_fill_hdr(struct ipset_handle *handle, enum ipset_cmd cmd,
 	nlh->nlmsg_flags = NLM_F_REQUEST;
 	if (cmdflags[cmd-1] & NLM_F_ACK)
 		nlh->nlmsg_flags |= NLM_F_ACK;
-	nlh->nlmsg_seq = handle->seq = time(NULL);
 
 	ghdr = mnl_nlmsg_put_extra_header(nlh, sizeof(struct genlmsghdr));
 	ghdr->cmd = cmd;
@@ -102,19 +102,24 @@ ipset_mnl_query(struct ipset_handle *handle, void *buffer, size_t len)
 	assert(handle);
 	assert(buffer);
 
+	nlh->nlmsg_seq = ++handle->seq;
+#ifdef IPSET_DEBUG
+	ipset_debug_msg("sent", nlh, nlh->nlmsg_len);
+#endif
 	if (mnl_socket_sendto(handle->h, nlh, nlh->nlmsg_len) < 0)
 		return -ECOMM;
 
-	D("message sent");
 	ret = mnl_socket_recvfrom(handle->h, buffer, len);
-	D("message received, ret: %d", ret);
+#ifdef IPSET_DEBUG
+	ipset_debug_msg("received", buffer, ret);
+#endif
 	while (ret > 0) {
 		ret = mnl_cb_run2(buffer, ret,
 				  handle->seq, handle->portid,
 				  handle->cb_ctl[NLMSG_MIN_TYPE],
 				  handle->data,
 				  handle->cb_ctl, NLMSG_MIN_TYPE);
-		D("nfln_cb_run2, ret: %d", ret);
+		D("nfln_cb_run2, ret: %d, errno %d", ret, errno);
 		if (ret <= 0)
 			break;
 		ret = mnl_socket_recvfrom(handle->h, buffer, len);
@@ -225,6 +230,7 @@ ipset_mnl_init(mnl_cb_t *cb_ctl, void *data)
 	handle->portid = mnl_socket_get_portid(handle->h);
 	handle->cb_ctl = cb_ctl;
 	handle->data = data;
+	handle->seq = time(NULL);
 
 	if (ipset_mnl_getid(handle, false) < 0)
 		goto close_nl;

extensions/ipset-6/libipset/parse.c

@@ -12,6 +12,7 @@
 #include <sys/types.h>				/* getaddrinfo */
 #include <sys/socket.h>				/* getaddrinfo, AF_ */
 #include <net/ethernet.h>			/* ETH_ALEN */
+#include <net/if.h>				/* IFNAMSIZ */
 #include <netinet/in.h>				/* IPPROTO_ */
 
 #include <libipset/debug.h>			/* D() */
@@ -47,11 +48,13 @@ ipset_strchr(const char *str, const char *sep)
 	assert(str);
 	assert(sep);
 
-	for (; *sep != '\0'; sep++)
-		if ((match = strchr(str, sep[0])) != NULL
-		    && str[0] != sep[0]
-		    && str[strlen(str)-1] != sep[0])
+	for (; *sep != '\0'; sep++) {
+		match = strchr(str, sep[0]);
+		if (match != NULL &&
+		    str[0] != sep[0] &&
+		    str[strlen(str)-1] != sep[0])
 			return match;
+	}
 
 	return NULL;
 }
@@ -178,9 +181,9 @@ ipset_parse_ether(struct ipset_session *session,
 
 		number = strtol(str + i * 3, &end, 16);
 
-		if (end == str + i * 3 + 2
-		    && (*end == ':' || *end == '\0')
-		    && number >= 0 && number <= 255)
+		if (end == str + i * 3 + 2 &&
+		    (*end == ':' || *end == '\0') &&
+		    number >= 0 && number <= 255)
 			ether[i] = number;
 		else
 			goto error;
@@ -198,9 +201,9 @@ static int
 parse_portname(struct ipset_session *session, const char *str,
 	       uint16_t *port, const char *proto)
 {
-	struct servent *service;
+	struct servent *service = getservbyname(str, proto);
 
-	if ((service = getservbyname(str, proto)) != NULL) {
+	if (service != NULL) {
 		*port = ntohs((uint16_t) service->s_port);
 		return 0;
 	}
@@ -232,8 +235,8 @@ ipset_parse_port(struct ipset_session *session,
 	assert(opt == IPSET_OPT_PORT || opt == IPSET_OPT_PORT_TO);
 	assert(str);
 
-	if ((err = string_to_u16(session, str, &port)) == 0
-	    || (err = parse_portname(session, str, &port, proto)) == 0)
+	if ((err = string_to_u16(session, str, &port)) == 0 ||
+	    (err = parse_portname(session, str, &port, proto)) == 0)
 		err = ipset_session_data_set(session, opt, &port);
 
 	if (!err)
@@ -384,11 +387,12 @@ parse_icmp_typecode(struct ipset_session *session,
 	if (a == NULL) {
 		free(saved);
 		return ipset_err(session,
-				 "Cannot parse %s as an %s type/code.", str, family);
+				 "Cannot parse %s as an %s type/code.",
+				 str, family);
 	}
 	*a++ = '\0';
-	if ((err = string_to_u8(session, a, &type)) != 0
-	    || (err = string_to_u8(session, tmp, &code)) != 0)
+	if ((err = string_to_u8(session, a, &type)) != 0 ||
+	    (err = string_to_u8(session, tmp, &code)) != 0)
 		goto error;
 
 	typecode = (type << 8) | code;
@@ -500,30 +504,32 @@ ipset_parse_proto_port(struct ipset_session *session,
 		p = *(const uint8_t *) ipset_data_get(data, IPSET_OPT_PROTO);
 		switch (p) {
 		case IPPROTO_TCP:
-			proto = tmp;
-			tmp = a;
-			goto parse_port;
+		case IPPROTO_SCTP:
 		case IPPROTO_UDP:
+		case IPPROTO_UDPLITE:
 			proto = tmp;
 			tmp = a;
 			goto parse_port;
 		case IPPROTO_ICMP:
 			if (family != AF_INET) {
-				syntax_err("Protocol ICMP can be used with family INET only");
+				syntax_err("Protocol ICMP can be used "
+					   "with family INET only");
 				goto error;
 			}
 			err = ipset_parse_icmp(session, opt, a);
 			break;
 		case IPPROTO_ICMPV6:
 			if (family != AF_INET6) {
-				syntax_err("Protocol ICMPv6 can be used with family INET6 only");
+				syntax_err("Protocol ICMPv6 can be used "
+					   "with family INET6 only");
 				goto error;
 			}
 			err = ipset_parse_icmpv6(session, opt, a);
 			break;
 		default:
 			if (!STREQ(a, "0")) {
-				syntax_err("Protocol %s can be used with pseudo port value 0 only.");
+				syntax_err("Protocol %s can be used "
+					   "with pseudo port value 0 only.");
 				goto error;
 			}
 			ipset_data_flags_set(data, IPSET_FLAG(opt));
@@ -634,13 +640,21 @@ get_addrinfo(struct ipset_session *session,
 			continue;
 		if (found == 0) {
 			if (family == AF_INET) {
-				/* Workaround: direct cast increases required alignment on Sparc */
-				const struct sockaddr_in *saddr = (void *)i->ai_addr;
-				err = ipset_session_data_set(session, opt, &saddr->sin_addr);
+				/* Workaround: direct cast increases
+				 * required alignment on Sparc
+				 */
+				const struct sockaddr_in *saddr =
+					(void *)i->ai_addr;
+				err = ipset_session_data_set(session,
+					opt, &saddr->sin_addr);
 			} else {
-				/* Workaround: direct cast increases required alignment on Sparc */
-				const struct sockaddr_in6 *saddr = (void *)i->ai_addr;
-				err = ipset_session_data_set(session, opt, &saddr->sin6_addr);
+				/* Workaround: direct cast increases
+				 * required alignment on Sparc
+				 */
+				const struct sockaddr_in6 *saddr =
+					(void *)i->ai_addr;
+				err = ipset_session_data_set(session,
+					opt, &saddr->sin6_addr);
 			}
 		} else if (found == 1) {
 			ipset_warn(session,
@@ -668,8 +682,15 @@ parse_ipaddr(struct ipset_session *session,
 	char *saved = strdup(str);
 	char *a, *tmp = saved;
 	struct addrinfo *info;
-        enum ipset_opt copt = opt == IPSET_OPT_IP ? IPSET_OPT_CIDR
-        			: IPSET_OPT_CIDR2;
+	enum ipset_opt copt, opt2;
+
+	if (opt == IPSET_OPT_IP) {
+		copt = IPSET_OPT_CIDR;
+		opt2 = IPSET_OPT_IP_TO;
+	} else {
+		copt = IPSET_OPT_CIDR2;
+		opt2 = IPSET_OPT_IP2_TO;
+	}
 
 	if (tmp == NULL)
 		return ipset_err(session,
@@ -679,8 +700,8 @@ parse_ipaddr(struct ipset_session *session,
 		/* IP/mask */
 		*a++ = '\0';
 
-		if ((err = string_to_cidr(session, a, 0, m, &m)) != 0
-		    || (err = ipset_session_data_set(session, copt, &m)) != 0)
+		if ((err = string_to_cidr(session, a, 0, m, &m)) != 0 ||
+		    (err = ipset_session_data_set(session, copt, &m)) != 0)
 			goto out;
 	} else if ((a = range_separator(tmp)) != NULL) {
 		/* IP-IP */
@@ -688,11 +709,11 @@ parse_ipaddr(struct ipset_session *session,
 		D("range %s", a);
 		range++;
 	}
-	if ((aerr = get_addrinfo(session, opt, tmp, &info, family)) != 0
-	    || !range)
+	if ((aerr = get_addrinfo(session, opt, tmp, &info, family)) != 0 ||
+	    !range)
 		goto out;
 	freeaddrinfo(info);
-	aerr = get_addrinfo(session, IPSET_OPT_IP_TO, a, &info, family);
+	aerr = get_addrinfo(session, opt2, a, &info, family);
 
 out:
 	if (aerr != EINVAL)
@@ -733,10 +754,10 @@ parse_ip(struct ipset_session *session,
 
 	switch (addrtype) {
 	case IPADDR_PLAIN:
-		if (range_separator(str)
-		    || (cidr_separator(str) && !cidr_hostaddr(str, family)))
-			return syntax_err("plain IP address must be supplied: %s",
-					  str);
+		if (range_separator(str) ||
+		    (cidr_separator(str) && !cidr_hostaddr(str, family)))
+			return syntax_err("plain IP address must be supplied: "
+					  "%s", str);
 		break;
 	case IPADDR_NET:
 		if (!cidr_separator(str) || range_separator(str))
@@ -800,9 +821,9 @@ ipset_parse_single_ip(struct ipset_session *session,
 		      enum ipset_opt opt, const char *str)
 {
 	assert(session);
-	assert(opt == IPSET_OPT_IP
-	       || opt == IPSET_OPT_IP_TO
-	       || opt == IPSET_OPT_IP2);
+	assert(opt == IPSET_OPT_IP ||
+	       opt == IPSET_OPT_IP_TO ||
+	       opt == IPSET_OPT_IP2);
 	assert(str);
 
 	return parse_ip(session, opt, str, IPADDR_PLAIN);
@@ -876,8 +897,8 @@ ipset_parse_netrange(struct ipset_session *session,
 	assert(str);
 
 	if (!(range_separator(str) || cidr_separator(str)))
-		return syntax_err("IP/cidr or IP-IP range must be specified: %s",
-				  str);
+		return syntax_err("IP/cidr or IP-IP range must be specified: "
+				  "%s", str);
 	return parse_ip(session, opt, str, IPADDR_ANY);
 }
 
@@ -903,8 +924,8 @@ ipset_parse_iprange(struct ipset_session *session,
 	assert(str);
 
 	if (cidr_separator(str))
-		return syntax_err("IP address or IP-IP range must be specified: %s",
-				  str);
+		return syntax_err("IP address or IP-IP range must be "
+				  "specified: %s", str);
 	return parse_ip(session, opt, str, IPADDR_ANY);
 }
 
@@ -974,6 +995,46 @@ ipset_parse_ip4_single6(struct ipset_session *session,
 
 }
 
+/**
+ * ipset_parse_ip4_net6 - parse IPv4|IPv6 address or address/cidr pattern
+ * @session: session structure
+ * @opt: option kind of the data
+ * @str: string to parse
+ *
+ * Parse string as an IPv4|IPv6 address or address/cidr pattern. For IPv4,
+ * address range is valid too.
+ * If family is not set yet in the data blob, INET is assumed.
+ * The values are stored in the data blob of the session.
+ *
+ * FIXME: if the hostname resolves to multiple addresses,
+ * the first one is used only.
+ *
+ * Returns 0 on success or a negative error code.
+ */
+int
+ipset_parse_ip4_net6(struct ipset_session *session,
+		     enum ipset_opt opt, const char *str)
+{
+	struct ipset_data *data;
+	uint8_t family;
+
+	assert(session);
+	assert(opt == IPSET_OPT_IP || opt == IPSET_OPT_IP2);
+	assert(str);
+
+	data = ipset_session_data(session);
+	family = ipset_data_family(data);
+
+	if (family == AF_UNSPEC) {
+		family = AF_INET;
+		ipset_data_set(data, IPSET_OPT_FAMILY, &family);
+	}
+
+	return family == AF_INET ? parse_ip(session, opt, str, IPADDR_ANY)
+				 : ipset_parse_ipnet(session, opt, str);
+
+}
+
 /**
  * ipset_parse_iptimeout - parse IPv4|IPv6 address and timeout
  * @session: session structure
@@ -1029,7 +1090,7 @@ do {									\
 	if (strlen(str) > IPSET_MAXNAMELEN - 1) {			\
 		if (saved != NULL)					\
 			free(saved);					\
-	return syntax_err("setname '%s' is longer than %u characters",	\
+		return syntax_err("setname '%s' is longer than %u characters",\
 				  str, IPSET_MAXNAMELEN - 1);		\
 	}								\
 } while (0)
@@ -1076,8 +1137,8 @@ ipset_parse_name_compat(struct ipset_session *session,
 		*a++ = '\0';
 		if ((b = elem_separator(a)) != NULL)
 			*b++ = '\0';
-		if (b == NULL
-		    || !(STREQ(a, "before") || STREQ(a, "after"))) {
+		if (b == NULL ||
+		    !(STREQ(a, "before") || STREQ(a, "after"))) {
 			err = ipset_err(session, "you must specify elements "
 					"as setname%s[before|after]%ssetname",
 					sep, sep);
@@ -1118,9 +1179,9 @@ ipset_parse_setname(struct ipset_session *session,
 		    enum ipset_opt opt, const char *str)
 {
 	assert(session);
-	assert(opt == IPSET_SETNAME
-	       || opt == IPSET_OPT_NAME
-	       || opt == IPSET_OPT_SETNAME2);
+	assert(opt == IPSET_SETNAME ||
+	       opt == IPSET_OPT_NAME ||
+	       opt == IPSET_OPT_SETNAME2);
 	assert(str);
 
 	check_setname(str, NULL);
@@ -1348,6 +1409,41 @@ ipset_parse_typename(struct ipset_session *session,
 	return ipset_session_data_set(session, IPSET_OPT_TYPE, type);
 }
 
+/**
+ * ipset_parse_iface - parse string as an interface name
+ * @session: session structure
+ * @opt: option kind of the data
+ * @str: string to parse
+ *
+ * Parse string as an interface name, optionally with 'physdev:' prefix.
+ * The value is stored in the data blob of the session.
+ *
+ * Returns 0 on success or a negative error code.
+ */
+int
+ipset_parse_iface(struct ipset_session *session,
+		  enum ipset_opt opt, const char *str)
+{
+	struct ipset_data *data;
+	int offset = 0, err = 0;
+
+	assert(session);
+	assert(opt == IPSET_OPT_IFACE);
+	assert(str);
+
+	data = ipset_session_data(session);
+	if (STREQ(str, "physdev:")) {
+		offset = 8;
+		err = ipset_data_set(data, IPSET_OPT_PHYSDEV, str);
+	}
+	if (strlen(str + offset) > IFNAMSIZ - 1)
+		return syntax_err("interface name '%s' is longer "
+				  "than %u characters",
+				  str + offset, IFNAMSIZ - 1);
+
+	return ipset_data_set(data, opt, str + offset);
+}
+
 /**
  * ipset_parse_output - parse output format name
  * @session: session structure
@@ -1396,7 +1492,8 @@ ipset_parse_ignored(struct ipset_session *session,
 
 	if (!ipset_data_ignored(ipset_session_data(session), opt))
 		ipset_warn(session,
-			   "Option %s is ignored. Please upgrade your syntax.", str);
+			   "Option %s is ignored. "
+			   "Please upgrade your syntax.", str);
 
 	return 0;
 }
@@ -1416,15 +1513,14 @@ ipset_parse_ignored(struct ipset_session *session,
  */
 int
 ipset_call_parser(struct ipset_session *session,
-		  ipset_parsefn parse, const char *optstr,
-		  enum ipset_opt opt, const char *str)
+				  const struct ipset_arg *arg,
+				  const char *str)
 {
 	if (ipset_data_flags_test(ipset_session_data(session),
-				  IPSET_FLAG(opt)))
-		syntax_err("%s already specified", optstr);
+				  IPSET_FLAG(arg->opt)))
+		syntax_err("%s already specified", arg->name[0]);
 
-	return parse(session, opt, parse == ipset_parse_ignored
-				   ? optstr : str);
+	return arg->parse(session, arg->opt, str);
 }
 
 #define parse_elem(s, t, d, str)					\

extensions/ipset-6/libipset/print.c

@@ -12,6 +12,7 @@
 #include <sys/socket.h>				/* inet_ntop */
 #include <arpa/inet.h>				/* inet_ntop */
 #include <net/ethernet.h>			/* ETH_ALEN */
+#include <net/if.h>				/* IFNAMSIZ */
 
 #include <libipset/debug.h>			/* D() */
 #include <libipset/data.h>			/* ipset_data_* */
@@ -142,30 +143,56 @@ ipset_print_type(char *buf, unsigned int len,
 	return snprintf(buf, len, "%s", type->name);
 }
 
-#define GETNAMEINFO(family, f, n)					\
-static inline int							\
-__getnameinfo##f(char *buf, unsigned int len,				\
-		 int flags, const union nf_inet_addr *addr)		\
-{									\
-	struct sockaddr_in##n saddr;					\
-	int err;							\
-									\
-	memset(&saddr, 0, sizeof(saddr));				\
-	in##f##cpy(&saddr.sin##n##_addr, &addr->in##n);			\
-	saddr.sin##n##_family = family;					\
-									\
-	err = getnameinfo((const struct sockaddr *)&saddr, 		\
-			  sizeof(saddr),				\
-			  buf, len, NULL, 0, flags);			\
-									\
-	if (err == EAI_AGAIN && !(flags & NI_NUMERICHOST))		\
-		err = getnameinfo((const struct sockaddr *)&saddr, 	\
-				  sizeof(saddr),			\
-				  buf, len, NULL, 0, 			\
-				  flags | NI_NUMERICHOST);		\
-	D("getnameinfo err: %i, errno %i", err, errno);			\
-	return (err == 0 ? (int)strlen(buf) :				\
-	       (err == EAI_OVERFLOW || err == EAI_SYSTEM) ? (int)len : -1);\
+static inline int
+__getnameinfo4(char *buf, unsigned int len,
+	       int flags, const union nf_inet_addr *addr)
+{
+	struct sockaddr_in saddr;
+	int err;
+
+	memset(&saddr, 0, sizeof(saddr));
+	in4cpy(&saddr.sin_addr, &addr->in);
+	saddr.sin_family = AF_INET;
+
+	err = getnameinfo((const struct sockaddr *)&saddr,
+			  sizeof(saddr),
+			  buf, len, NULL, 0, flags);
+
+	if (!(flags & NI_NUMERICHOST) &&
+	    (err == EAI_AGAIN || (err == 0 && strchr(buf, '-') != NULL)))
+		err = getnameinfo((const struct sockaddr *)&saddr,
+				  sizeof(saddr),
+				  buf, len, NULL, 0,
+				  flags | NI_NUMERICHOST);
+	D("getnameinfo err: %i, errno %i", err, errno);
+	return (err == 0 ? (int)strlen(buf) :
+	       (err == EAI_OVERFLOW || err == EAI_SYSTEM) ? (int)len : -1);
+}
+
+static inline int
+__getnameinfo6(char *buf, unsigned int len,
+	       int flags, const union nf_inet_addr *addr)
+{
+	struct sockaddr_in6 saddr;
+	int err;
+
+	memset(&saddr, 0, sizeof(saddr));
+	in6cpy(&saddr.sin6_addr, &addr->in6);
+	saddr.sin6_family = AF_INET6;
+
+	err = getnameinfo((const struct sockaddr *)&saddr,
+			  sizeof(saddr),
+			  buf, len, NULL, 0, flags);
+
+	if (!(flags & NI_NUMERICHOST) &&
+	    (err == EAI_AGAIN || (err == 0 && strchr(buf, '-') != NULL)))
+		err = getnameinfo((const struct sockaddr *)&saddr,
+				  sizeof(saddr),
+				  buf, len, NULL, 0,
+				  flags | NI_NUMERICHOST);
+	D("getnameinfo err: %i, errno %i", err, errno);
+	return (err == 0 ? (int)strlen(buf) :
+	       (err == EAI_OVERFLOW || err == EAI_SYSTEM) ? (int)len : -1);
 }
 
 #define SNPRINTF_IP(mask, f)						\
@@ -188,10 +215,8 @@ snprintf_ipv##f(char *buf, unsigned int len, int flags,			\
 	return offset;							\
 }
 
-GETNAMEINFO(AF_INET, 4, )
 SNPRINTF_IP(32, 4)
 
-GETNAMEINFO(AF_INET6, 6, 6)
 SNPRINTF_IP(128, 6)
 
 /**
@@ -229,7 +254,7 @@ ipset_print_ip(char *buf, unsigned int len,
 		D("CIDR: %u", cidr);
 	} else
 		cidr = family == AF_INET6 ? 128 : 32;
-	flags = env & (1 << IPSET_ENV_RESOLVE) ? 0 : NI_NUMERICHOST;
+	flags = (env & IPSET_ENV_RESOLVE) ? 0 : NI_NUMERICHOST;
 
 	ip = ipset_data_get(data, opt);
 	assert(ip);
@@ -286,9 +311,9 @@ ipset_print_ipaddr(char *buf, unsigned int len,
 	assert(buf);
 	assert(len > 0);
 	assert(data);
-	assert(opt == IPSET_OPT_IP
-	       || opt == IPSET_OPT_IP_TO
-	       || opt == IPSET_OPT_IP2);
+	assert(opt == IPSET_OPT_IP ||
+	       opt == IPSET_OPT_IP_TO ||
+	       opt == IPSET_OPT_IP2);
 
 	family = ipset_data_family(data);
 	cidropt = opt == IPSET_OPT_IP ? IPSET_OPT_CIDR : IPSET_OPT_CIDR2;
@@ -296,7 +321,7 @@ ipset_print_ipaddr(char *buf, unsigned int len,
 		cidr = *(const uint8_t *) ipset_data_get(data, cidropt);
 	else
 		cidr = family == AF_INET6 ? 128 : 32;
-	flags = env & (1 << IPSET_ENV_RESOLVE) ? 0 : NI_NUMERICHOST;
+	flags = (env & IPSET_ENV_RESOLVE) ? 0 : NI_NUMERICHOST;
 
 	ip = ipset_data_get(data, opt);
 	assert(ip);
@@ -442,6 +467,45 @@ ipset_print_port(char *buf, unsigned int len,
 	return offset;
 }
 
+/**
+ * ipset_print_iface - print interface element string
+ * @buf: printing buffer
+ * @len: length of available buffer space
+ * @data: data blob
+ * @opt: the option kind
+ * @env: environment flags
+ *
+ * Print interface element string to output buffer.
+ *
+ * Return lenght of printed string or error size.
+ */
+int
+ipset_print_iface(char *buf, unsigned int len,
+		  const struct ipset_data *data, enum ipset_opt opt,
+		  uint8_t env UNUSED)
+{
+	const char *name;
+	int size, offset = 0;
+
+	assert(buf);
+	assert(len > 0);
+	assert(data);
+	assert(opt == IPSET_OPT_IFACE);
+
+	if (len < IFNAMSIZ + strlen("physdev:"))
+		return -1;
+
+	if (ipset_data_test(data, IPSET_OPT_PHYSDEV)) {
+		size = snprintf(buf, len, "physdev:");
+		SNPRINTF_FAILURE(size, len, offset);
+	}
+	name = ipset_data_get(data, opt);
+	assert(name);
+	size = snprintf(buf, len, "%s", name);
+	SNPRINTF_FAILURE(size, len, offset);
+	return offset;
+}
+
 /**
  * ipset_print_proto - print protocol name
  * @buf: printing buffer
@@ -510,7 +574,8 @@ ipset_print_icmp(char *buf, unsigned int len,
 	if (name != NULL)
 		return snprintf(buf, len, "%s", name);
 	else
-		return snprintf(buf, len, "%u/%u", typecode >> 8, typecode & 0xFF);
+		return snprintf(buf, len, "%u/%u",
+				typecode >> 8, typecode & 0xFF);
 }
 
 /**
@@ -544,7 +609,8 @@ ipset_print_icmpv6(char *buf, unsigned int len,
 	if (name != NULL)
 		return snprintf(buf, len, "%s", name);
 	else
-		return snprintf(buf, len, "%u/%u", typecode >> 8, typecode & 0xFF);
+		return snprintf(buf, len, "%u/%u",
+				typecode >> 8, typecode & 0xFF);
 }
 
 /**
@@ -584,7 +650,9 @@ ipset_print_proto_port(char *buf, unsigned int len,
 
 		switch (proto) {
 		case IPPROTO_TCP:
+		case IPPROTO_SCTP:
 		case IPPROTO_UDP:
+		case IPPROTO_UDPLITE:
 			break;
 		case IPPROTO_ICMP:
 			return ipset_print_icmp(buf + offset, len, data,
@@ -642,9 +710,9 @@ ipset_print_elem(char *buf, unsigned int len,
 	SNPRINTF_FAILURE(size, len, offset);
 	IF_D(ipset_data_test(data, type->elem[IPSET_DIM_TWO].opt),
 	     "print second elem");
-	if (type->dimension == IPSET_DIM_ONE
-	    || (type->last_elem_optional
-	        && !ipset_data_test(data, type->elem[IPSET_DIM_TWO].opt)))
+	if (type->dimension == IPSET_DIM_ONE ||
+	    (type->last_elem_optional &&
+	     !ipset_data_test(data, type->elem[IPSET_DIM_TWO].opt)))
 		return offset;
 
 	size = snprintf(buf + offset, len, IPSET_ELEM_SEPARATOR);
@@ -652,9 +720,9 @@ ipset_print_elem(char *buf, unsigned int len,
 	size = type->elem[IPSET_DIM_TWO].print(buf + offset, len, data,
 			type->elem[IPSET_DIM_TWO].opt, env);
 	SNPRINTF_FAILURE(size, len, offset);
-	if (type->dimension == IPSET_DIM_TWO
-	    || (type->last_elem_optional
-	        && !ipset_data_test(data, type->elem[IPSET_DIM_THREE].opt)))
+	if (type->dimension == IPSET_DIM_TWO ||
+	    (type->last_elem_optional &&
+	     !ipset_data_test(data, type->elem[IPSET_DIM_THREE].opt)))
 		return offset;
 
 	size = snprintf(buf + offset, len, IPSET_ELEM_SEPARATOR);
@@ -728,6 +796,9 @@ ipset_print_data(char *buf, unsigned int len,
 	case IPSET_OPT_PORT:
 		size = ipset_print_port(buf, len, data, opt, env);
 		break;
+	case IPSET_OPT_IFACE:
+		size = ipset_print_iface(buf, len, data, opt, env);
+		break;
 	case IPSET_OPT_GC:
 	case IPSET_OPT_HASHSIZE:
 	case IPSET_OPT_MAXELEM:

extensions/ipset-6/libipset/session.c

@@ -13,6 +13,7 @@
 #include <string.h>				/* str* */
 #include <unistd.h>				/* getpagesize */
 #include <net/ethernet.h>			/* ETH_ALEN */
+#include <net/if.h>				/* IFNAMSIZ */
 
 #include <libipset/debug.h>			/* D() */
 #include <libipset/data.h>			/* IPSET_OPT_* */
@@ -37,6 +38,7 @@ struct ipset_session {
 	/* Command state */
 	enum ipset_cmd cmd;			/* Current command */
 	uint32_t lineno;			/* Current lineno in restore mode */
+	uint32_t printed_set;			/* Printed sets so far */
 	char saved_setname[IPSET_MAXNAMELEN];	/* Saved setname */
 	const struct ipset_type *saved_type;	/* Saved type */
 	struct nlattr *nested[IPSET_NEST_MAX];	/* Pointer to nest levels */
@@ -138,6 +140,8 @@ ipset_envopt_parse(struct ipset_session *session, int opt,
 	case IPSET_ENV_QUIET:
 	case IPSET_ENV_RESOLVE:
 	case IPSET_ENV_EXIST:
+	case IPSET_ENV_LIST_SETNAME:
+	case IPSET_ENV_LIST_HEADER:
 		session->envopts |= opt;
 		return 0;
 	default:
@@ -196,7 +200,7 @@ ipset_session_output(struct ipset_session *session,
  *
  * Returns -1.
  */
-int __attribute__((format(printf,3,4)))
+int __attribute__((format(printf, 3, 4)))
 ipset_session_report(struct ipset_session *session,
 		     enum ipset_err_type type,
 		     const char *fmt, ...)
@@ -468,6 +472,15 @@ static const struct ipset_attr_policy adt_attrs[] = {
 		.type = MNL_TYPE_U8,
 		.opt = IPSET_OPT_CIDR2,
 	},
+	[IPSET_ATTR_IP2_TO] = {
+		.type = MNL_TYPE_NESTED,
+		.opt = IPSET_OPT_IP2_TO,
+	},
+	[IPSET_ATTR_IFACE] = {
+		.type = MNL_TYPE_NUL_STRING,
+		.opt = IPSET_OPT_IFACE,
+		.len  = IFNAMSIZ,
+	},
 };
 
 static const struct ipset_attr_policy ipaddr_attrs[] = {
@@ -480,6 +493,10 @@ static const struct ipset_attr_policy ipaddr_attrs[] = {
 	},
 };
 
+#ifdef IPSET_DEBUG
+static int debug = 1;
+#endif
+
 static int
 generic_data_attr_cb(const struct nlattr *attr, void *data,
 		     int attr_max, const struct ipset_attr_policy *policy)
@@ -487,18 +504,18 @@ generic_data_attr_cb(const struct nlattr *attr, void *data,
 	const struct nlattr **tb = data;
 	int type = mnl_attr_get_type(attr);
 
-	D("attr type: %u, len %u", type, attr->nla_len);
+	IF_D(debug, "attr type: %u, len %u", type, attr->nla_len);
 	if (mnl_attr_type_valid(attr, attr_max) < 0) {
-		D("attr type: %u INVALID", type);
+		IF_D(debug, "attr type: %u INVALID", type);
 		return MNL_CB_ERROR;
 	}
 	if (mnl_attr_validate(attr, policy[type].type) < 0) {
-		D("attr type: %u POLICY, attrlen %u", type,
+		IF_D(debug, "attr type: %u POLICY, attrlen %u", type,
 		     mnl_attr_get_payload_len(attr));
 		return MNL_CB_ERROR;
 	}
-	if (policy[type].type == MNL_TYPE_NUL_STRING
-	    && mnl_attr_get_payload_len(attr) > IPSET_MAXNAMELEN)
+	if (policy[type].type == MNL_TYPE_NUL_STRING &&
+	    mnl_attr_get_payload_len(attr) > IPSET_MAXNAMELEN)
 		return MNL_CB_ERROR;
 	tb[type] = attr;
 	return MNL_CB_OK;
@@ -648,7 +665,7 @@ call_outfn(struct ipset_session *session)
 /* Handle printing failures */
 static jmp_buf printf_failure;
 
-static int __attribute__((format(printf,2,3)))
+static int __attribute__((format(printf, 2, 3)))
 safe_snprintf(struct ipset_session *session, const char *fmt, ...)
 {
 	va_list args;
@@ -829,8 +846,9 @@ list_create(struct ipset_session *session, struct nlattr *nla[])
 			      type->name);
 		break;
 	case IPSET_LIST_PLAIN:
-		safe_snprintf(session, "Name: %s\n"
+		safe_snprintf(session, "%sName: %s\n"
 			      "Type: %s\nHeader: ",
+			      session->printed_set ? "\n" : "",
 			      ipset_data_setname(data),
 			      type->name);
 		break;
@@ -847,10 +865,10 @@ list_create(struct ipset_session *session, struct nlattr *nla[])
 	}
 
 	for (arg = type->args[IPSET_CREATE]; arg != NULL && arg->opt; arg++) {
-		if (!arg->print
-		    || !ipset_data_test(data, arg->opt)
-		    || (arg->opt == IPSET_OPT_FAMILY
-		        && family == type->family))
+		if (!arg->print ||
+		    !ipset_data_test(data, arg->opt) ||
+		    (arg->opt == IPSET_OPT_FAMILY &&
+		     family == type->family))
 			continue;
 		switch (session->mode) {
 		case IPSET_LIST_SAVE:
@@ -887,18 +905,24 @@ list_create(struct ipset_session *session, struct nlattr *nla[])
 		safe_dprintf(session, ipset_print_number, IPSET_OPT_MEMSIZE);
 		safe_snprintf(session, "\nReferences: ");
 		safe_dprintf(session, ipset_print_number, IPSET_OPT_REFERENCES);
-		safe_snprintf(session, "\nMembers:\n");
+		safe_snprintf(session,
+			session->envopts & IPSET_ENV_LIST_HEADER ?
+			"\n" : "\nMembers:\n");
 		break;
 	case IPSET_LIST_XML:
-		safe_snprintf(session, "</elements>\n    <memsize>");
+		safe_snprintf(session, "    <memsize>");
 		safe_dprintf(session, ipset_print_number, IPSET_OPT_MEMSIZE);
 		safe_snprintf(session, "</memsize>\n    <references>");
 		safe_dprintf(session, ipset_print_number, IPSET_OPT_REFERENCES);
-		safe_snprintf(session, "</references>\n  </header>\n  <members>\n");
+		safe_snprintf(session,
+			session->envopts & IPSET_ENV_LIST_HEADER ?
+			"</references>\n  </header>\n" :
+			"</references>\n  </header>\n  <members>\n");
 		break;
 	default:
 		break;
 	}
+	session->printed_set++;
 
 	return MNL_CB_OK;
 }
@@ -910,16 +934,17 @@ print_set_done(struct ipset_session *session)
 		? "NONE" : session->saved_setname);
 	switch (session->mode) {
 	case IPSET_LIST_XML:
-		if (session->saved_setname[0] == '\0')
-			safe_snprintf(session, "\n");
-		else
+		if (session->envopts & IPSET_ENV_LIST_SETNAME)
+			break;
+		if (session->envopts & IPSET_ENV_LIST_HEADER) {
+			if (session->saved_setname[0] != '\0')
+				safe_snprintf(session, "</ipset>\n");
+			break;
+		}
+		if (session->saved_setname[0] != '\0')
 			safe_snprintf(session, "  </members>\n</ipset>\n");
 		break;
-	case IPSET_LIST_SAVE:
-		/* No empty lines between the sets */
-		break;
 	default:
-		safe_snprintf(session, "\n");
 		break;
 	}
 	return call_outfn(session) ? MNL_CB_ERROR : MNL_CB_STOP;
@@ -931,8 +956,11 @@ callback_list(struct ipset_session *session, struct nlattr *nla[],
 {
 	struct ipset_data *data = session->data;
 
-	if (setjmp(printf_failure))
+	if (setjmp(printf_failure)) {
+		session->saved_setname[0] = '\0';
+		session->printed_set = 0;
 		return MNL_CB_ERROR;
+	}
 
 	if (!nla[IPSET_ATTR_SETNAME])
 		FAILURE("Broken %s kernel message: missing setname!",
@@ -940,10 +968,21 @@ callback_list(struct ipset_session *session, struct nlattr *nla[],
 
 	ATTR2DATA(session, nla, IPSET_ATTR_SETNAME, cmd_attrs);
 	D("setname %s", ipset_data_setname(data));
+	if (session->envopts & IPSET_ENV_LIST_SETNAME &&
+	    session->mode != IPSET_LIST_SAVE) {
+		if (session->mode == IPSET_LIST_XML)
+			safe_snprintf(session, "<ipset name=\"%s\"/>\n",
+				      ipset_data_setname(data));
+		else
+			safe_snprintf(session, "%s\n",
+				      ipset_data_setname(data));
+		return call_outfn(session) ? MNL_CB_ERROR : MNL_CB_OK;
+	}
+
 	if (STREQ(ipset_data_setname(data), session->saved_setname)) {
 		/* Header part already seen */
-		if (ipset_data_test(data, IPSET_OPT_TYPE)
-		    && nla[IPSET_ATTR_DATA] != NULL)
+		if (ipset_data_test(data, IPSET_OPT_TYPE) &&
+		    nla[IPSET_ATTR_DATA] != NULL)
 			FAILURE("Broken %s kernel message: "
 				"extra DATA received!", cmd2name[cmd]);
 	} else {
@@ -959,13 +998,14 @@ callback_list(struct ipset_session *session, struct nlattr *nla[],
 	if (nla[IPSET_ATTR_DATA] != NULL) {
 		struct nlattr *cattr[IPSET_ATTR_CREATE_MAX+1] = {};
 
-		if (!(nla[IPSET_ATTR_TYPENAME]
-		      && nla[IPSET_ATTR_FAMILY]
-		      && nla[IPSET_ATTR_REVISION]))
+		if (!(nla[IPSET_ATTR_TYPENAME] &&
+		      nla[IPSET_ATTR_FAMILY] &&
+		      nla[IPSET_ATTR_REVISION]))
 			FAILURE("Broken %s kernel message: missing %s!",
 				cmd2name[cmd],
 				!nla[IPSET_ATTR_TYPENAME] ? "typename" :
-				!nla[IPSET_ATTR_FAMILY] ? "family" : "revision");
+				!nla[IPSET_ATTR_FAMILY] ? "family" :
+				"revision");
 
 		/* Reset CREATE specific flags */
 		ipset_data_flags_unset(data, IPSET_CREATE_FLAGS);
@@ -1034,8 +1074,8 @@ callback_version(struct ipset_session *session, struct nlattr *nla[])
 			"while userspace supports protocol versions %u-%u",
 			min, max, IPSET_PROTOCOL_MIN, IPSET_PROTOCOL_MAX);
 
-	if (!(session->envopts & IPSET_ENV_QUIET)
-	    && max != IPSET_PROTOCOL_MAX)
+	if (!(session->envopts & IPSET_ENV_QUIET) &&
+	    max != IPSET_PROTOCOL_MAX)
 		ipset_warn(session,
 			   "Kernel support protocol versions %u-%u "
 			   "while userspace supports protocol versions %u-%u",
@@ -1061,9 +1101,9 @@ callback_header(struct ipset_session *session, struct nlattr *nla[])
 			"does not match with received one `%s'!",
 			ipset_data_setname(data), setname);
 
-	if (!(nla[IPSET_ATTR_TYPENAME]
-	      && nla[IPSET_ATTR_REVISION]
-	      && nla[IPSET_ATTR_FAMILY]))
+	if (!(nla[IPSET_ATTR_TYPENAME] &&
+	      nla[IPSET_ATTR_REVISION] &&
+	      nla[IPSET_ATTR_FAMILY]))
 		FAILURE("Broken HEADER kernel message: "
 			"missing attribute '%s'!",
 			!nla[IPSET_ATTR_TYPENAME] ? "typename" :
@@ -1084,9 +1124,9 @@ callback_type(struct ipset_session *session, struct nlattr *nla[])
 	const struct ipset_data *data = session->data;
 	const char *typename, *orig;
 
-	if (!(nla[IPSET_ATTR_TYPENAME]
-	      && nla[IPSET_ATTR_REVISION]
-	      && nla[IPSET_ATTR_FAMILY]))
+	if (!(nla[IPSET_ATTR_TYPENAME] &&
+	      nla[IPSET_ATTR_REVISION] &&
+	      nla[IPSET_ATTR_FAMILY]))
 		FAILURE("Broken TYPE kernel message: "
 			"missing attribute '%s'!",
 			!nla[IPSET_ATTR_TYPENAME] ? "typename" :
@@ -1285,16 +1325,20 @@ callback_error(const struct nlmsghdr *nlh, void *cbdata)
 			break;
 		case IPSET_CMD_RENAME:
 			ipset_cache_rename(ipset_data_setname(data),
-					   ipset_data_get(data, IPSET_OPT_SETNAME2));
+					   ipset_data_get(data,
+							  IPSET_OPT_SETNAME2));
 			break;
 		case IPSET_CMD_SWAP:
 			ipset_cache_swap(ipset_data_setname(data),
-					 ipset_data_get(data, IPSET_OPT_SETNAME2));
+					 ipset_data_get(data,
+							IPSET_OPT_SETNAME2));
 			break;
 		case IPSET_CMD_TEST:
 			if (!(session->envopts & IPSET_ENV_QUIET)) {
-				ipset_print_elem(session->report, IPSET_ERRORBUFLEN,
-						 session->data, IPSET_OPT_NONE, 0);
+				ipset_print_elem(session->report,
+						 IPSET_ERRORBUFLEN,
+						 session->data,
+						 IPSET_OPT_NONE, 0);
 				ipset_warn(session, " is in set %s.",
 					   ipset_data_setname(data));
 			}
@@ -1308,7 +1352,8 @@ callback_error(const struct nlmsghdr *nlh, void *cbdata)
 			print_set_done(session);
 			break;
 		default:
-			FAILURE("ACK message received to command %s[%u], which is not expected",
+			FAILURE("ACK message received to command %s[%u], "
+				"which is not expected",
 				session->cmd < IPSET_MSG_MAX
 				? cmd2name[session->cmd] : "unknown",
 				session->cmd);
@@ -1320,8 +1365,8 @@ callback_error(const struct nlmsghdr *nlh, void *cbdata)
 	/* Error messages */
 
 	/* Special case for IPSET_CMD_TEST */
-	if (session->cmd == IPSET_CMD_TEST
-	    && err->error == -IPSET_ERR_EXIST) {
+	if (session->cmd == IPSET_CMD_TEST &&
+	    err->error == -IPSET_ERR_EXIST) {
 		if (!(session->envopts & IPSET_ENV_QUIET)) {
 			ipset_print_elem(session->report, IPSET_ERRORBUFLEN,
 					 session->data, IPSET_OPT_NONE, 0);
@@ -1386,7 +1431,8 @@ attr_len(const struct ipset_attr_policy *attr, uint8_t family, uint16_t *flags)
 }
 
 #define BUFFER_FULL(bufsize, nlmsg_len, nestlen, attrlen)	\
-(nlmsg_len + nestlen + MNL_ATTR_HDRLEN + MNL_ALIGN(alen) + MNL_ALIGN(sizeof(struct nlmsgerr)) > bufsize)
+(nlmsg_len + nestlen + MNL_ATTR_HDRLEN + MNL_ALIGN(alen) + \
+	MNL_ALIGN(sizeof(struct nlmsgerr)) > bufsize)
 
 static int
 rawdata2attr(struct ipset_session *session, struct nlmsghdr *nlh,
@@ -1406,7 +1452,8 @@ rawdata2attr(struct ipset_session *session, struct nlmsghdr *nlh,
 					      : IPSET_ATTR_IPADDR_IPV6;
 
 		alen = attr_len(attr, family, &flags);
-		if (BUFFER_FULL(session->bufsize, nlh->nlmsg_len, MNL_ATTR_HDRLEN, alen))
+		if (BUFFER_FULL(session->bufsize, nlh->nlmsg_len,
+				MNL_ATTR_HDRLEN, alen))
 			return 1;
 		nested = mnl_attr_nest_start(nlh, type);
 		D("family: %s", family == AF_INET ? "INET" :
@@ -1422,6 +1469,9 @@ rawdata2attr(struct ipset_session *session, struct nlmsghdr *nlh,
 		return 1;
 
 	switch (attr->type) {
+	case MNL_TYPE_NUL_STRING:
+		alen = strlen((const char *)d) + 1;
+		break;
 	case MNL_TYPE_U32: {
 		uint32_t value = htonl(*(const uint32_t *)d);
 
@@ -1497,7 +1547,7 @@ addattr_adt(struct ipset_session *session,
 static int
 build_send_private_msg(struct ipset_session *session, enum ipset_cmd cmd)
 {
-	char buffer[PRIVATE_MSG_BUFLEN] __attribute__ ((aligned));
+	char buffer[PRIVATE_MSG_BUFLEN] __attribute__ ((aligned)) = {};
 	struct nlmsghdr *nlh = (void *)buffer;
 	struct ipset_data *data = session->data;
 	int len = PRIVATE_MSG_BUFLEN, ret;
@@ -1523,9 +1573,11 @@ build_send_private_msg(struct ipset_session *session, enum ipset_cmd cmd)
 			return ipset_err(session,
 				"Invalid internal TYPE command: "
 				"missing settype");
-		ADDATTR(session, nlh, data, IPSET_ATTR_TYPENAME, AF_INET, cmd_attrs);
+		ADDATTR(session, nlh, data, IPSET_ATTR_TYPENAME,
+			AF_INET, cmd_attrs);
 		if (ipset_data_test(data, IPSET_OPT_FAMILY))
-			ADDATTR(session, nlh, data, IPSET_ATTR_FAMILY, AF_INET, cmd_attrs);
+			ADDATTR(session, nlh, data, IPSET_ATTR_FAMILY,
+				AF_INET, cmd_attrs);
 		else
 			/* bitmap:port and list:set types */
 			mnl_attr_put_u8(nlh, IPSET_ATTR_FAMILY, AF_UNSPEC);
@@ -1546,10 +1598,10 @@ build_send_private_msg(struct ipset_session *session, enum ipset_cmd cmd)
 static inline bool
 may_aggregate_ad(struct ipset_session *session, enum ipset_cmd cmd)
 {
-	return session->lineno != 0
-	       && (cmd == IPSET_CMD_ADD || cmd == IPSET_CMD_DEL)
-	       && cmd == session->cmd
-	       && STREQ(ipset_data_setname(session->data), session->saved_setname);
+	return session->lineno != 0 &&
+	       (cmd == IPSET_CMD_ADD || cmd == IPSET_CMD_DEL) &&
+	       cmd == session->cmd &&
+	       STREQ(ipset_data_setname(session->data), session->saved_setname);
 }
 
 static int
@@ -1587,12 +1639,18 @@ build_msg(struct ipset_session *session, bool aggregate)
 		/* Core attributes:
 		 * setname, typename, revision, family, flags (optional) */
 		ADDATTR_SETNAME(session, nlh, data);
-		ADDATTR(session, nlh, data, IPSET_ATTR_TYPENAME, AF_INET, cmd_attrs);
+		ADDATTR(session, nlh, data, IPSET_ATTR_TYPENAME,
+			AF_INET, cmd_attrs);
 		ADDATTR_RAW(session, nlh, &type->revision,
 			    IPSET_ATTR_REVISION, cmd_attrs);
 		D("family: %u, type family %u",
 		  ipset_data_family(data), type->family);
-		ADDATTR(session, nlh, data, IPSET_ATTR_FAMILY, AF_INET, cmd_attrs);
+		if (ipset_data_test(data, IPSET_OPT_FAMILY))
+			ADDATTR(session, nlh, data, IPSET_ATTR_FAMILY,
+				AF_INET, cmd_attrs);
+		else
+			/* bitmap:port and list:set types */
+			mnl_attr_put_u8(nlh, IPSET_ATTR_FAMILY, AF_UNSPEC);
 
 		/* Type-specific create attributes */
 		D("call open_nested");
@@ -1604,23 +1662,41 @@ build_msg(struct ipset_session *session, bool aggregate)
 	}
 	case IPSET_CMD_DESTROY:
 	case IPSET_CMD_FLUSH:
-	case IPSET_CMD_LIST:
 	case IPSET_CMD_SAVE:
 		if (ipset_data_test(data, IPSET_SETNAME))
 			ADDATTR_SETNAME(session, nlh, data);
 		break;
+	case IPSET_CMD_LIST: {
+		uint32_t flags = 0;
+
+		if (session->envopts & IPSET_ENV_LIST_SETNAME)
+			flags |= IPSET_FLAG_LIST_SETNAME;
+		if (session->envopts & IPSET_ENV_LIST_HEADER)
+			flags |= IPSET_FLAG_LIST_HEADER;
+		if (ipset_data_test(data, IPSET_SETNAME))
+			ADDATTR_SETNAME(session, nlh, data);
+		if (flags && session->mode != IPSET_LIST_SAVE) {
+			ipset_data_set(data, IPSET_OPT_FLAGS, &flags);
+			ADDATTR(session, nlh, data, IPSET_ATTR_FLAGS, AF_INET,
+				cmd_attrs);
+		}
+		break;
+	}
 	case IPSET_CMD_RENAME:
 	case IPSET_CMD_SWAP:
 		if (!ipset_data_test(data, IPSET_SETNAME))
 			return ipset_err(session,
 				"Invalid %s command: missing from-setname",
-				session->cmd == IPSET_CMD_SWAP ? "swap" : "rename");
+				session->cmd == IPSET_CMD_SWAP ? "swap" :
+				"rename");
 		if (!ipset_data_test(data, IPSET_OPT_SETNAME2))
 			return ipset_err(session,
 				"Invalid %s command: missing to-setname",
-				session->cmd == IPSET_CMD_SWAP ? "swap" : "rename");
+				session->cmd == IPSET_CMD_SWAP ? "swap" :
+				"rename");
 		ADDATTR_SETNAME(session, nlh, data);
-		ADDATTR_RAW(session, nlh, ipset_data_get(data, IPSET_OPT_SETNAME2),
+		ADDATTR_RAW(session, nlh,
+			    ipset_data_get(data, IPSET_OPT_SETNAME2),
 			    IPSET_ATTR_SETNAME2, cmd_attrs);
 		break;
 	case IPSET_CMD_ADD:
@@ -1632,12 +1708,14 @@ build_msg(struct ipset_session *session, bool aggregate)
 			if (!ipset_data_test(data, IPSET_SETNAME))
 				return ipset_err(session,
 					"Invalid %s command: missing setname",
-					session->cmd == IPSET_CMD_ADD ? "add" : "del");
+					session->cmd == IPSET_CMD_ADD ? "add" :
+					"del");
 
 			if (!ipset_data_test(data, IPSET_OPT_TYPE))
 				return ipset_err(session,
 					"Invalid %s command: missing settype",
-					session->cmd == IPSET_CMD_ADD ? "add" : "del");
+					session->cmd == IPSET_CMD_ADD ? "add" :
+					"del");
 
 			/* Core options: setname */
 			ADDATTR_SETNAME(session, nlh, data);
@@ -1655,11 +1733,12 @@ build_msg(struct ipset_session *session, bool aggregate)
 			D("open_nested failed");
 			return 1;
 		}
-		if (addattr_adt(session, nlh, data, ipset_data_family(data))
-		    || ADDATTR_RAW(session, nlh, &session->lineno,
+		if (addattr_adt(session, nlh, data, ipset_data_family(data)) ||
+		    ADDATTR_RAW(session, nlh, &session->lineno,
 				IPSET_ATTR_LINENO, cmd_attrs)) {
 			/* Cancel last, unfinished nested attribute */
-			mnl_attr_nest_cancel(nlh, session->nested[session->nestid-1]);
+			mnl_attr_nest_cancel(nlh,
+					session->nested[session->nestid-1]);
 			session->nested[--session->nestid] = NULL;
 			return 1;
 		}
@@ -1713,7 +1792,8 @@ ipset_commit(struct ipset_session *session)
 	assert(session);
 
 	nlh = session->buffer;
-	D("send buffer: len %u, cmd %s", nlh->nlmsg_len, cmd2name[session->cmd]);
+	D("send buffer: len %u, cmd %s",
+	  nlh->nlmsg_len, cmd2name[session->cmd]);
 	if (nlh->nlmsg_len == 0)
 		/* Nothing to do */
 		return 0;
@@ -1729,6 +1809,7 @@ ipset_commit(struct ipset_session *session)
 
 	/* Reset saved data and nested state */
 	session->saved_setname[0] = '\0';
+	session->printed_set = 0;
 	for (i = session->nestid - 1; i >= 0; i--)
 		session->nested[i] = NULL;
 	session->nestid = 0;
@@ -1845,8 +1926,8 @@ ipset_cmd(struct ipset_session *session, enum ipset_cmd cmd, uint32_t lineno)
 
 	/* We have to save the type for error handling */
 	session->saved_type = ipset_data_get(data, IPSET_OPT_TYPE);
-	if (session->lineno != 0
-	    && (cmd == IPSET_CMD_ADD || cmd == IPSET_CMD_DEL)) {
+	if (session->lineno != 0 &&
+	    (cmd == IPSET_CMD_ADD || cmd == IPSET_CMD_DEL)) {
 		/* Save setname for the next possible aggregated restore line */
 		strcpy(session->saved_setname, ipset_data_setname(data));
 		ipset_data_reset(data);
@@ -1926,3 +2007,7 @@ ipset_session_fini(struct ipset_session *session)
 	free(session);
 	return 0;
 }
+
+#ifdef IPSET_DEBUG
+#include "debug.c"
+#endif

extensions/ipset-6/libipset/types.c

@@ -28,8 +28,8 @@ struct ipset {
 	struct ipset *next;
 };
 
-static struct ipset_type *typelist = NULL;	/* registered set types */
-static struct ipset *setlist = NULL;		/* cached sets */
+static struct ipset_type *typelist;		/* registered set types */
+static struct ipset *setlist;			/* cached sets */
 
 /**
  * ipset_cache_add - add a set to the cache
@@ -178,7 +178,7 @@ ipset_cache_swap(const char *from, const char *to)
 bool
 ipset_match_typename(const char *name, const struct ipset_type *type)
 {
-	const char * const * alias = type->alias;
+	const char * const *alias = type->alias;
 
 	if (STREQ(name, type->name))
 		return true;
@@ -198,7 +198,7 @@ create_type_get(struct ipset_session *session)
 	struct ipset_data *data;
 	const char *typename;
 	uint8_t family, tmin = 0, tmax = 0;
-	const uint8_t *kmin, *kmax;
+	uint8_t kmin, kmax;
 	int ret;
 
 	data = ipset_session_data(session);
@@ -216,7 +216,7 @@ create_type_get(struct ipset_session *session)
 		    && MATCH_FAMILY(t, family)) {
 			if (match == NULL) {
 				match = t;
-		    		tmax = t->revision;
+				tmin = tmax = t->revision;
 			} else if (t->family == match->family)
 				tmin = t->revision;
 		}
@@ -240,34 +240,48 @@ create_type_get(struct ipset_session *session)
 	if (ret != 0)
 		return NULL;
 
-	kmax = ipset_data_get(data, IPSET_OPT_REVISION);
+	kmin = kmax = *(const uint8_t *)ipset_data_get(data,
+						IPSET_OPT_REVISION);
 	if (ipset_data_test(data, IPSET_OPT_REVISION_MIN))
-		kmin = ipset_data_get(data, IPSET_OPT_REVISION_MIN);
-	else
-		kmin = kmax;
-	if (MAX(tmin, *kmin) > MIN(tmax, *kmax)) {
-		if (*kmin > tmax)
+		kmin = *(const uint8_t *)ipset_data_get(data,
+						IPSET_OPT_REVISION_MIN);
+
+	if (MAX(tmin, kmin) > MIN(tmax, kmax)) {
+		if (kmin > tmax)
 			return ipset_errptr(session,
-				"Kernel supports %s type with family %s "
-				"in minimal revision %u while ipset library "
-				"in maximal revision %u. "
-				"You need to upgrade your ipset library.",
+				"Kernel supports %s type, family %s "
+				"with minimal revision %u while ipset program "
+				"with maximal revision %u.\n"
+				"You need to upgrade your ipset program.",
 				typename,
 				family == AF_INET ? "INET" :
 				family == AF_INET6 ? "INET6" : "UNSPEC",
-				*kmin, tmax);
+				kmin, tmax);
 		else
 			return ipset_errptr(session,
-				"Kernel supports %s type with family %s "
-				"in maximal revision %u while ipset library "
-				"in minimal revision %u. "
+				"Kernel supports %s type, family %s "
+				"with maximal revision %u while ipset program "
+				"with minimal revision %u.\n"
 				"You need to upgrade your kernel.",
 				typename,
 				family == AF_INET ? "INET" :
 				family == AF_INET6 ? "INET6" : "UNSPEC",
-				*kmax, tmin);
+				kmax, tmin);
 	}
 
+	/* Disable unsupported revisions */
+	for (match = NULL, t = typelist; t != NULL; t = t->next) {
+		/* Skip revisions which are unsupported by the kernel */
+		if (t->kernel_check == IPSET_KERNEL_MISMATCH)
+			continue;
+		if (ipset_match_typename(typename, t)
+		    && MATCH_FAMILY(t, family)) {
+			if (t->revision < kmin || t->revision > kmax)
+				t->kernel_check = IPSET_KERNEL_MISMATCH;
+			else if (match == NULL)
+				match = t;
+		}
+	}
 	match->kernel_check = IPSET_KERNEL_OK;
 found:
 	ipset_data_set(data, IPSET_OPT_TYPE, match);
@@ -441,13 +455,15 @@ ipset_type_add(struct ipset_type *type)
 
 	assert(type);
 
+	if (strlen(type->name) > IPSET_MAXNAMELEN - 1)
+		return -EINVAL;
+
 	/* Add to the list: higher revision numbers first */
 	for (t = typelist, prev = NULL; t != NULL; t = t->next) {
 		if (STREQ(t->name, type->name)) {
-			if (t->revision == type->revision) {
-				errno = EEXIST;
-				return -1;
-			} else if (t->revision < type->revision) {
+			if (t->revision == type->revision)
+				return -EEXIST;
+			else if (t->revision < type->revision) {
 				type->next = t;
 				if (prev)
 					prev->next = type;
@@ -457,10 +473,9 @@ ipset_type_add(struct ipset_type *type)
 			}
 		}
 		if (t->next != NULL && STREQ(t->next->name, type->name)) {
-			if (t->next->revision == type->revision) {
-				errno = EEXIST;
-				return -1;
-			} else if (t->next->revision < type->revision) {
+			if (t->next->revision == type->revision)
+				return -EEXIST;
+			else if (t->next->revision < type->revision) {
 				type->next = t->next;
 				t->next = type;
 				return 0;

extensions/ipset-6/pfxlen.c

@@ -289,3 +289,24 @@ const union nf_inet_addr ip_set_hostmask_map[] = {
 	E(0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF),
 };
 EXPORT_SYMBOL_GPL(ip_set_hostmask_map);
+
+/* Find the largest network which matches the range from left, in host order. */
+u32
+ip_set_range_to_cidr(u32 from, u32 to, u8 *cidr)
+{
+	u32 last;
+	u8 i;
+
+	for (i = 1; i < 32; i++) {
+		if ((from & ip_set_hostmask(i)) != from)
+			continue;
+		last = from | ~ip_set_hostmask(i);
+		if (!after(last, to)) {
+			*cidr = i;
+			return last;
+		}
+	}
+	*cidr = 32;
+	return from;
+}
+EXPORT_SYMBOL_GPL(ip_set_range_to_cidr);

extensions/ipset-6/pfxlen.h

@@ -3,6 +3,7 @@
 
 #include <asm/byteorder.h>
 #include <linux/netfilter.h>
+#include <net/tcp.h>
 
 /* Prefixlen maps, by Jan Engelhardt  */
 extern const union nf_inet_addr ip_set_netmask_map[];
@@ -32,4 +33,12 @@ ip_set_hostmask6(u8 pfxlen)
 	return &ip_set_hostmask_map[pfxlen].ip6[0];
 }
 
+extern u32 ip_set_range_to_cidr(u32 from, u32 to, u8 *cidr);
+
+#define ip_set_mask_from_to(from, to, cidr)	\
+do {						\
+	from &= ip_set_hostmask(cidr);		\
+	to = from | ~ip_set_hostmask(cidr);	\
+} while (0)
+
 #endif /*_PFXLEN_H */

extensions/ipset-6/src/errcode.c

@@ -21,8 +21,10 @@
 /* Core kernel error codes */
 static const struct ipset_errcode_table core_errcode_table[] = {
 	/* Generic error codes */
-	{ EEXIST, 0,
+	{ ENOENT, 0,
 	  "The set with the given name does not exist" },
+	{ EMSGSIZE, 0,
+	  "Kernel error received: message could not be created" },
 	{ IPSET_ERR_PROTOCOL,  0,
 	  "Kernel error received: ipset protocol error" },
 
@@ -30,14 +32,14 @@ static const struct ipset_errcode_table core_errcode_table[] = {
 	{ EEXIST, IPSET_CMD_CREATE,
 	  "Set cannot be created: set with the same name already exists" },
 	{ IPSET_ERR_FIND_TYPE, 0,
-	  "Kernel error received: set type does not supported" },
+	  "Kernel error received: set type not supported" },
 	{ IPSET_ERR_MAX_SETS, 0,
 	  "Kernel error received: maximal number of sets reached, "
 	  "cannot create more." },
 	{ IPSET_ERR_INVALID_NETMASK, 0,
 	  "The value of the netmask parameter is invalid" },
 	{ IPSET_ERR_INVALID_FAMILY, 0,
-	  "The protocol family not supported by the set type" },
+	  "Protocol family not supported by the set type" },
 
 	/* DESTROY specific error codes */
 	{ IPSET_ERR_BUSY, IPSET_CMD_DESTROY,
@@ -111,6 +113,10 @@ static const struct ipset_errcode_table hash_errcode_table[] = {
 	  "Invalid protocol specified" },
 	{ IPSET_ERR_MISSING_PROTO, 0,
 	  "Protocol missing, but must be specified" },
+	{ IPSET_ERR_HASH_RANGE_UNSUPPORTED, 0,
+	  "Range is not supported in the \"net\" component of the element" },
+	{ IPSET_ERR_HASH_RANGE, 0,
+	  "Invalid range, covers the whole address space" },
 	{ },
 };
 
@@ -168,8 +174,8 @@ ipset_errcode(struct ipset_session *session, enum ipset_cmd cmd, int errcode)
 
 retry:
 	for (i = 0, generic = -1; table[i].errcode; i++) {
-		if (table[i].errcode == errcode
-		    && (table[i].cmd == cmd || table[i].cmd == 0)) {
+		if (table[i].errcode == errcode &&
+		    (table[i].cmd == cmd || table[i].cmd == 0)) {
 			if (table[i].cmd == 0) {
 				generic = i;
 				continue;

extensions/ipset-6/src/ipset.8

@@ -21,7 +21,7 @@ ipset \(em administration tool for IP sets
 .PP 
 COMMANDS := { \fBcreate\fR | \fBadd\fR | \fBdel\fR | \fBtest\fR | \fBdestroy\fR | \fBlist\fR | \fBsave\fR | \fBrestore\fR | \fBflush\fR | \fBrename\fR | \fBswap\fR | \fBhelp\fR | \fBversion\fR | \fB\-\fR }
 .PP 
-\fIOPTIONS\fR := { \fB\-exist\fR | \fB\-output\fR { \fBplain\fR | \fBsave\fR | \fBxml\fR } | \fB\-quiet\fR | \fB\-resolve\fR | \fB\-sorted\fR }
+\fIOPTIONS\fR := { \fB\-exist\fR | \fB\-output\fR { \fBplain\fR | \fBsave\fR | \fBxml\fR } | \fB\-quiet\fR | \fB\-resolve\fR | \fB\-sorted\fR | \fB\-name\fR | \fB\-terse\fR }
 .PP 
 \fBipset\fR \fBcreate\fR \fISETNAME\fR \fITYPENAME\fR [ \fICREATE\-OPTIONS\fR ]
 .PP 
@@ -109,7 +109,7 @@ Destroy the specified set or all the sets if none is given.
 
 If the set has got reference(s), nothing is done and no set destroyed.
 .TP 
-\fBlist\fP [ \fISETNAME\fP ]
+\fBlist\fP [ \fISETNAME\fP ] [ \fIOPTIONS\fP ]
 List the header data and the entries for the specified set, or for
 all sets if none is given. The
 \fB\-resolve\fP
@@ -120,8 +120,13 @@ type supports the operation). The option
 \fB\-output\fR
 can be used to control the format of the listing:
 \fBplain\fR, \fBsave\fR or \fBxml\fR.
-The default is
-\fBplain\fR. 
+(The default is
+\fBplain\fR.)
+If the option
+\fB\-name\fR
+is specified, just the names of the existing sets are listed. If the option
+\fB\-terse\fR
+is specified, just the set names and headers are listed. 
 .TP 
 \fBsave\fP [ \fISETNAME\fP ]
 Save the given set, or all sets if none is given
@@ -190,6 +195,13 @@ DNS lookups.
 .TP 
 \fB\-s\fP, \fB\-sorted\fP
 Sorted output. When listing sets entries are listed sorted. Not supported yet.
+.TP 
+\fB\-n\fP, \fB\-name\fP
+List just the names of the existing sets, i.e. suppress listing of set headers and members.
+.TP 
+\fB\-t\fP, \fB\-terse\fP
+List the set names and headers, i.e. suppress listing of set members.
+
 .SH "SET TYPES"
 A set type comprises of the storage method by which the data is stored and
 the data type(s) which are stored in the set. Therefore the
@@ -202,8 +214,8 @@ command follows the syntax
 
 where the current list of the methods are
 \fBbitmap\fR, \fBhash\fR, and \fBlist\fR and the possible data types
-are \fBip\fR, \fBmac\fR and \fBport\fR. The dimension of a set
-is equal to the number of data types in its type name.
+are \fBip\fR, \fBnet\fR, \fBmac\fR, \fBport\fR and \fBiface\fR.
+The dimension of a set is equal to the number of data types in its type name.
 
 When adding, deleting or testing entries in a set, the same comma separated
 data syntax must be used for the entry parameter of the commands, i.e
@@ -231,6 +243,8 @@ parameter for the \fBcreate\fR command means the default timeout value (in secon
 for new entries. If a set is created with timeout support, then the same 
 \fBtimeout\fR option can be used to specify non\-default timeout values
 when adding entries. Zero timeout value means the entry is added permanent to the set.
+The timeout value of already added elements can be changed by readding the element
+using the \fB\-exist\fR option.
 .SS bitmap:ip
 The \fBbitmap:ip\fR set type uses a memory range to store either IPv4 host
 (default) or IPv4 network addresses. A \fBbitmap:ip\fR type of set can store up
@@ -300,9 +314,10 @@ matched by the kernel, it will automatically fill out the missing MAC address wi
 source MAC address from the packet. If the entry was specified with a timeout value,
 the timer starts off when the IP and MAC address pair is complete.
 .PP 
-Please note, the \fBset\fR match and \fBSET\fR target netfilter kernel modules
-\fBalways\fR use the source MAC address from the packet to match, add or delete
-entries from a \fBbitmap:ip,mac\fR type of set.
+The \fBbitmap:ip,mac\fR type of sets require two \fBsrc/dst\fR parameters of
+the \fBset\fR match and \fBSET\fR target netfilter kernel modules and the second
+one must be \fBsrc\fR to match, add or delete entries because the \fBset\fR match
+and \fBSET\fR target have access to the source MAC address only.
 .PP 
 Examples:
 .IP 
@@ -330,6 +345,9 @@ Mandatory options to use when creating a \fBbitmap:port\fR type of set:
 \fBrange\fP \fIfromport\fP\-\fItoport\fR
 Create the set from the specified inclusive port range.
 .PP 
+The \fBset\fR match and \fBSET\fR target netfilter kernel modules interpret
+the stored numbers as TCP or UDP port numbers.
+.PP 
 Examples:
 .IP 
 ipset create foo bitmap:port range 0\-1024
@@ -380,9 +398,9 @@ a range or a network:
 .PP 
 Examples:
 .IP 
-ipset create foo hash:ip netmask 24
+ipset create foo hash:ip netmask 30
 .IP 
-ipset add foo 192.168.1.1\-192.168.1.2
+ipset add foo 192.168.1.0/24
 .IP 
 ipset test foo 192.168.1.2
 .SS hash:net
@@ -391,13 +409,16 @@ Network address with zero prefix size cannot be stored in this type of sets.
 .PP 
 \fICREATE\-OPTIONS\fR := [ \fBfamily\fR { \fBinet\fR | \fBinet6\fR } ] | [ \fBhashsize\fR \fIvalue\fR ] [ \fBmaxelem\fR \fIvalue\fR ] [ \fBtimeout\fR \fIvalue\fR ]
 .PP 
-\fIADD\-ENTRY\fR := \fIip\fR[/\fIcidr\fR]
+\fIADD\-ENTRY\fR := \fInetaddr\fR
 .PP 
 \fIADD\-OPTIONS\fR := [ \fBtimeout\fR \fIvalue\fR ]
 .PP 
-\fIDEL\-ENTRY\fR := \fIip\fR[/\fIcidr\fR]
+\fIDEL\-ENTRY\fR := \fInetaddr\fR
 .PP 
-\fITEST\-ENTRY\fR := \fIip\fR[/\fIcidr\fR]
+\fITEST\-ENTRY\fR := \fInetaddr\fR
+.PP 
+where
+\fInetaddr\fR := \fIip\fR[/\fIcidr\fR]
 .PP 
 Optional \fBcreate\fR options:
 .TP 
@@ -413,9 +434,16 @@ correct value.
 \fBmaxelem\fR \fIvalue\fR
 The maximal number of elements which can be stored in the set, default 65536.
 .PP 
+For the \fBinet\fR family one can add or delete multiple entries by specifying
+a range, which is converted internally to network(s) equal to the range:
+.PP 
+\fInetaddr\fR := { \fIip\fR[/\fIcidr\fR] | \fIfromaddr\fR\-\fItoaddr\fR }
+.PP 
 When adding/deleting/testing entries, if the cidr prefix parameter is not specified,
-then the host prefix value is assumed. When adding/deleting entries, overlapping
-elements are not checked.
+then the host prefix value is assumed. When adding/deleting entries, the exact
+element is added/deleted and overlapping elements are not checked by the kernel.
+When testing entries, if a host address is tested, then the kernel tries to match
+the host address in the networks added to the set and reports the result accordingly.
 .PP 
 From the \fBset\fR netfilter match point of view the searching for a match
 always  starts  from  the smallest  size  of netblock (most specific
@@ -431,7 +459,7 @@ Examples:
 .IP 
 ipset create foo hash:net
 .IP 
-ipset add foo 192.168.0/24
+ipset add foo 192.168.0.0/24
 .IP 
 ipset add foo 10.1.0.0/16
 .IP 
@@ -481,8 +509,8 @@ TCP port or range of ports expressed in TCP portname identifiers from /etc/servi
 \fIportnumber[\-portnumber]\fR
 TCP port or range of ports expressed in TCP port numbers
 .TP 
-\fBtcp\fR|\fBudp\fR:\fIportname\fR|\fIportnumber\fR[\-\fIportname\fR|\fIportnumber\fR]
-TCP or UDP port or port range expressed in port name(s) or port number(s)
+\fBtcp\fR|\fBsctp\fR|\fBudp\fR|\fBudplite\fR:\fIportname\fR|\fIportnumber\fR[\-\fIportname\fR|\fIportnumber\fR]
+TCP, SCTP, UDP or UDPLITE port or port range expressed in port name(s) or port number(s)
 .TP 
 \fBicmp\fR:\fIcodename\fR|\fItype\fR/\fIcode\fR
 ICMP codename or type/code. The supported ICMP codename identifiers can always
@@ -508,7 +536,7 @@ ipset add foo 192.168.1.0/24,80\-82
 .IP 
 ipset add foo 192.168.1.1,udp:53
 .IP 
-ipset add foo 192.168.1.1,ospf:0
+ipset add foo 192.168.1.1,vrrp:0
 .IP 
 ipset test foo 192.168.1.1,80
 .SS hash:net,port
@@ -519,13 +547,16 @@ address with zero prefix size is not accepted either.
 .PP 
 \fICREATE\-OPTIONS\fR := [ \fBfamily\fR { \fBinet\fR | \fBinet6\fR } ] | [ \fBhashsize\fR \fIvalue\fR ] [ \fBmaxelem\fR \fIvalue\fR ] [ \fBtimeout\fR \fIvalue\fR ]
 .PP 
-\fIADD\-ENTRY\fR := \fIipaddr\fR[/\fIcidr\fR],[\fIproto\fR:]\fIport\fR
+\fIADD\-ENTRY\fR := \fInetaddr\fR,[\fIproto\fR:]\fIport\fR
 .PP 
 \fIADD\-OPTIONS\fR := [ \fBtimeout\fR \fIvalue\fR ]
 .PP 
-\fIDEL\-ENTRY\fR := \fIipaddr\fR[/\fIcidr\fR],[\fIproto\fR:]\fIport\fR
+\fIDEL\-ENTRY\fR := \fInetaddr\fR,[\fIproto\fR:]\fIport\fR
 .PP 
-\fITEST\-ENTRY\fR := \fIipaddr\fR[/\fIcidr\fR],[\fIproto\fR:]\fIport\fR
+\fITEST\-ENTRY\fR := \fInetaddr\fR,[\fIproto\fR:]\fIport\fR
+.PP 
+where
+\fInetaddr\fR := \fIip\fR[/\fIcidr\fR]
 .PP 
 Optional \fBcreate\fR options:
 .TP 
@@ -541,14 +572,17 @@ correct value.
 \fBmaxelem\fR \fIvalue\fR
 The maximal number of elements which can be stored in the set, default 65536.
 .PP 
-For the
+For the \fInetaddr\fR part of the elements
+see the description at the \fBhash:net\fR set type. For the
 [\fIproto\fR:]\fIport\fR
 part of the elements see the description at the
 \fBhash:ip,port\fR set type.
 .PP 
 When adding/deleting/testing entries, if the cidr prefix parameter is not specified,
-then the host prefix value is assumed. When adding/deleting entries, overlapping
-elements are not checked.
+then the host prefix value is assumed. When adding/deleting entries, the exact
+element is added/deleted and overlapping elements are not checked by the kernel.
+When testing entries, if a host address is tested, then the kernel tries to match
+the host address in the networks added to the set and reports the result accordingly.
 .PP 
 From the \fBset\fR netfilter match point of view the searching for a  match
 always  starts  from  the smallest  size  of netblock (most specific
@@ -623,18 +657,22 @@ address with zero prefix size cannot be stored either.
 .PP 
 \fICREATE\-OPTIONS\fR := [ \fBfamily\fR { \fBinet\fR | \fBinet6\fR } ] | [ \fBhashsize\fR \fIvalue\fR ] [ \fBmaxelem\fR \fIvalue\fR ] [ \fBtimeout\fR \fIvalue\fR ]
 .PP 
-\fIADD\-ENTRY\fR := \fIipaddr\fR,[\fIproto\fR:]\fIport\fR,\fIip\fR[/\fIcidr\fR]
+\fIADD\-ENTRY\fR := \fIipaddr\fR,[\fIproto\fR:]\fIport\fR,\fInetaddr\fR
 .PP 
 \fIADD\-OPTIONS\fR := [ \fBtimeout\fR \fIvalue\fR ]
 .PP 
-\fIDEL\-ENTRY\fR := \fIipaddr\fR,[\fIproto\fR:]\fIport\fR,\fIip\fR[/\fIcidr\fR]
+\fIDEL\-ENTRY\fR := \fIipaddr\fR,[\fIproto\fR:]\fIport\fR,\fInetaddr\fR
 .PP 
-\fITEST\-ENTRY\fR := \fIipaddr\fR,[\fIproto\fR:]\fIport\fR,\fIip\fR[/\fIcidr\fR]
+\fITEST\-ENTRY\fR := \fIipaddr\fR,[\fIproto\fR:]\fIport\fR,\fInetaddr\fR
 .PP 
-For the first \fIipaddr\fR and
+where
+\fInetaddr\fR := \fIip\fR[/\fIcidr\fR]
+.PP 
+For the \fIipaddr\fR and
 [\fIproto\fR:]\fIport\fR
 parts of the elements see the descriptions at the
-\fBhash:ip,port\fR set type.
+\fBhash:ip,port\fR set type. For the \fInetaddr\fR part of the elements
+see the description at the \fBhash:net\fR set type.
 .PP 
 Optional \fBcreate\fR options:
 .TP 
@@ -673,6 +711,73 @@ ipset add foo 192.168.1,80,10.0.0/24
 ipset add foo 192.168.2,25,10.1.0.0/16
 .IP 
 ipset test foo 192.168.1,80.10.0.0/24
+.SS hash:net,iface
+The \fBhash:net,iface\fR set type uses a hash to store different sized IP network
+address and interface name pairs. Network address with zero prefix size is not
+accepted.
+.PP 
+\fICREATE\-OPTIONS\fR := [ \fBfamily\fR { \fBinet\fR | \fBinet6\fR } ] | [ \fBhashsize\fR \fIvalue\fR ] [ \fBmaxelem\fR \fIvalue\fR ] [ \fBtimeout\fR \fIvalue\fR ]
+.PP 
+\fIADD\-ENTRY\fR := \fInetaddr\fR,[\fBphysdev\fR:]\fIiface\fR
+.PP 
+\fIADD\-OPTIONS\fR := [ \fBtimeout\fR \fIvalue\fR ]
+.PP 
+\fIDEL\-ENTRY\fR := \fInetaddr\fR,[\fBphysdev\fR:]\fIiface\fR
+.PP 
+\fITEST\-ENTRY\fR := \fInetaddr\fR,[\fBphysdev\fR:]\fIiface\fR
+.PP 
+where
+\fInetaddr\fR := \fIip\fR[/\fIcidr\fR]
+.PP 
+Optional \fBcreate\fR options:
+.TP 
+\fBfamily\fR { \fBinet\fR | \fBinet6\fR }
+The protocol family of the IP addresses to be stored in the set. The default is
+\fBinet\fR, i.e IPv4.
+.TP 
+\fBhashsize\fR \fIvalue\fR
+The initial hash size for the set, default is 1024. The hash size must be a power
+of two, the kernel automatically rounds up non power of two hash sizes to the first
+correct value.
+.TP 
+\fBmaxelem\fR \fIvalue\fR
+The maximal number of elements which can be stored in the set, default 65536.
+.PP 
+For the \fInetaddr\fR part of the elements
+see the description at the \fBhash:net\fR set type.
+.PP 
+When adding/deleting/testing entries, if the cidr prefix parameter is not specified,
+then the host prefix value is assumed. When adding/deleting entries, the exact
+element is added/deleted and overlapping elements are not checked by the kernel.
+When testing entries, if a host address is tested, then the kernel tries to match
+the host address in the networks added to the set and reports the result accordingly.
+.PP 
+From the \fBset\fR netfilter match point of view the searching for a  match
+always  starts  from  the smallest  size  of netblock (most specific
+prefix) to the largest one (least specific prefix) added to the set.
+When  adding/deleting IP
+addresses  to the set by the \fBSET\fR netfilter target, it  will  be
+added/deleted by the most specific prefix which can be found in  the
+set, or by the host prefix value if the set is empty.
+.PP 
+The second direction parameter of the \fBset\fR match and
+\fBSET\fR target modules corresponds to the incoming/outgoing interface
+: \fBsrc\fR to the incoming, while \fBdst\fR to the outgoing. When
+the interface is flagged with \fBphysdev:\fR, the interface is interpreted
+as the incoming/outgoing bridge port.
+.PP 
+The lookup time grows linearly with the number of the different prefix
+values added to the set. 
+.PP 
+Examples:
+.IP 
+ipset create foo hash:net,iface
+.IP 
+ipset add foo 192.168.0/24,eth0
+.IP 
+ipset add foo 10.1.0.0/16,eth1
+.IP 
+ipset test foo 192.168.0/24,eth0
 .SS list:set
 The \fBlist:set\fR type uses a simple list in which you can store
 set names.

extensions/ipset-6/src/ipset.c

@@ -26,12 +26,12 @@
 static char program_name[] = PACKAGE;
 static char program_version[] = PACKAGE_VERSION;
 
-static struct ipset_session *session = NULL;
-static uint32_t restore_line = 0;
-static bool interactive = false;
+static struct ipset_session *session;
+static uint32_t restore_line;
+static bool interactive;
 static char cmdline[1024];
 static char *newargv[255];
-static int newargc = 0;
+static int newargc;
 
 /* The known set types: (typename, revision, family) is unique */
 extern struct ipset_type ipset_bitmap_ip0;
@@ -39,10 +39,14 @@ extern struct ipset_type ipset_bitmap_ipmac0;
 extern struct ipset_type ipset_bitmap_port0;
 extern struct ipset_type ipset_hash_ip0;
 extern struct ipset_type ipset_hash_net0;
-extern struct ipset_type ipset_hash_netport0;
-extern struct ipset_type ipset_hash_ipport0;
-extern struct ipset_type ipset_hash_ipportip0;
-extern struct ipset_type ipset_hash_ipportnet0;
+extern struct ipset_type ipset_hash_net1;
+extern struct ipset_type ipset_hash_netport1;
+extern struct ipset_type ipset_hash_netport2;
+extern struct ipset_type ipset_hash_netiface0;
+extern struct ipset_type ipset_hash_ipport1;
+extern struct ipset_type ipset_hash_ipportip1;
+extern struct ipset_type ipset_hash_ipportnet1;
+extern struct ipset_type ipset_hash_ipportnet2;
 extern struct ipset_type ipset_list_set0;
 
 enum exittype {
@@ -53,12 +57,12 @@ enum exittype {
 	SESSION_PROBLEM,
 };
 
-static int __attribute__((format(printf,2,3)))
+static int __attribute__((format(printf, 2, 3)))
 exit_error(int status, const char *msg, ...)
 {
-	bool quiet = !interactive
-		     && session
-		     && ipset_envopt_test(session, IPSET_ENV_QUIET);
+	bool quiet = !interactive &&
+		     session &&
+		     ipset_envopt_test(session, IPSET_ENV_QUIET);
 
 	if (status && msg && !quiet) {
 		va_list args;
@@ -94,8 +98,8 @@ exit_error(int status, const char *msg, ...)
 static int
 handle_error(void)
 {
-	if (ipset_session_warning(session)
-	    && !ipset_envopt_test(session, IPSET_ENV_QUIET))
+	if (ipset_session_warning(session) &&
+	    !ipset_envopt_test(session, IPSET_ENV_QUIET))
 		fprintf(stderr, "Warning: %s\n",
 			ipset_session_warning(session));
 	if (ipset_session_error(session))
@@ -121,9 +125,8 @@ help(void)
 	       "Usage: %s [options] COMMAND\n\nCommands:\n",
 	       program_name, program_version, program_name);
 
-	for (c = ipset_commands; c->cmd; c++) {
+	for (c = ipset_commands; c->cmd; c++)
 		printf("%s %s\n", c->name[0], c->help);
-	}
 	printf("\nOptions:\n");
 
 	while (opt->flag) {
@@ -145,9 +148,9 @@ build_argv(char *buffer)
 		newargv[i] = NULL;
 	newargc = 1;
 
-	ptr = strtok(buffer, " \t\n");
+	ptr = strtok(buffer, " \t\r\n");
 	newargv[newargc++] = ptr;
-	while ((ptr = strtok(NULL, " \t\n")) != NULL) {
+	while ((ptr = strtok(NULL, " \t\r\n")) != NULL) {
 		if ((newargc + 1) < (int)(sizeof(newargv)/sizeof(char *)))
 			newargv[newargc++] = ptr;
 		else {
@@ -181,7 +184,7 @@ restore(char *argv0)
 			c++;
 		if (c[0] == '\0' || c[0] == '#')
 			continue;
-		else if (strcmp(c, "COMMIT\n") == 0) {
+		else if (STREQ(c, "COMMIT\n") || STREQ(c, "COMMIT\r\n")) {
 			ret = ipset_commit(session);
 			if (ret < 0)
 				handle_error();
@@ -206,68 +209,61 @@ restore(char *argv0)
 static int
 call_parser(int *argc, char *argv[], const struct ipset_arg *args)
 {
-	int i = 1, ret = 0;
+	int ret = 0;
 	const struct ipset_arg *arg;
 	const char *optstr;
 
 	/* Currently CREATE and ADT may have got additional arguments */
-	if (!args)
-		goto done;
+	if (!args && *argc > 1)
+		goto err_unknown;
+	while (*argc > 1) {
 		for (arg = args; arg->opt; arg++) {
-		for (i = 1; i < *argc; ) {
-			D("argc: %u, i: %u: %s vs %s",
-			  *argc, i, argv[i], arg->name[0]);
-			if (!(ipset_match_option(argv[i], arg->name))) {
-				i++;
+			D("argc: %u, %s vs %s", *argc, argv[1], arg->name[0]);
+			if (!(ipset_match_option(argv[1], arg->name)))
 				continue;
-			}
-			optstr = argv[i];
+
+			optstr = argv[1];
 			/* Shift off matched option */
 			D("match %s", arg->name[0]);
-			ipset_shift_argv(argc, argv, i);
-			D("argc: %u, i: %u", *argc, i);
+			ipset_shift_argv(argc, argv, 1);
 			switch (arg->has_arg) {
 			case IPSET_MANDATORY_ARG:
-				if (i + 1 > *argc)
+				if (*argc < 2)
 					return exit_error(PARAMETER_PROBLEM,
 						"Missing mandatory argument "
 						"of option `%s'",
 						arg->name[0]);
 				/* Fall through */
 			case IPSET_OPTIONAL_ARG:
-				if (i + 1 <= *argc) {
+				if (*argc >= 2) {
 					ret = ipset_call_parser(session,
-							arg->parse,
-							optstr, arg->opt,
-							argv[i]);
+						arg, argv[1]);
 					if (ret < 0)
 						return ret;
-					ipset_shift_argv(argc, argv, i);
+					ipset_shift_argv(argc, argv, 1);
 					break;
 				}
 				/* Fall through */
 			default:
-				ret = ipset_call_parser(session,
-							arg->parse,
-							optstr, arg->opt,
-							optstr);
+				ret = ipset_call_parser(session, arg, optstr);
 				if (ret < 0)
 					return ret;
 			}
+			break;
 		}
+		if (!arg->opt)
+			goto err_unknown;
 	}
-done:
-	if (i < *argc)
-		return exit_error(PARAMETER_PROBLEM,
-				  "Unknown argument: `%s'",
-				  argv[i]);
 	return ret;
+
+err_unknown:
+	return exit_error(PARAMETER_PROBLEM, "Unknown argument: `%s'", argv[1]);
 }
 
 static enum ipset_adt
 cmd2cmd(int cmd)
 {
-	switch(cmd) {
+	switch (cmd) {
 	case IPSET_CMD_ADD:
 		return IPSET_ADD;
 	case IPSET_CMD_DEL:
@@ -353,9 +349,9 @@ check_allowed(const struct ipset_type *type, enum ipset_cmd command)
 		allowed |= IPSET_FLAG(IPSET_OPT_CIDR);
 
 	for (i = IPSET_OPT_IP; i < IPSET_OPT_FLAGS; i++) {
-		if (!(cmdflags & IPSET_FLAG(i))
-		    || (allowed & IPSET_FLAG(i))
-		    || !(flags & IPSET_FLAG(i)))
+		if (!(cmdflags & IPSET_FLAG(i)) ||
+		    (allowed & IPSET_FLAG(i)) ||
+		    !(flags & IPSET_FLAG(i)))
 			continue;
 		/* Not allowed element-expressions */
 		switch (i) {
@@ -363,19 +359,22 @@ check_allowed(const struct ipset_type *type, enum ipset_cmd command)
 			exit_error(OTHER_PROBLEM,
 				"IP/CIDR range is not allowed in command %s "
 				"with set type %s and family %s",
-				cmd2name(command), type->name, session_family());
+				cmd2name(command), type->name,
+				session_family());
 			return;
 		case IPSET_OPT_IP_TO:
 			exit_error(OTHER_PROBLEM,
 				"FROM-TO IP range is not allowed in command %s "
 				"with set type %s and family %s",
-				cmd2name(command), type->name, session_family());
+				cmd2name(command), type->name,
+				session_family());
 			return;
 		case IPSET_OPT_PORT_TO:
 			exit_error(OTHER_PROBLEM,
 				"FROM-TO port range is not allowed in command %s "
 				"with set type %s and family %s",
-				cmd2name(command), type->name, session_family());
+				cmd2name(command), type->name,
+				session_family());
 			return;
 		default:
 			break;
@@ -395,7 +394,8 @@ check_allowed(const struct ipset_type *type, enum ipset_cmd command)
 				"%s parameter is not allowed in command %s "
 				"with set type %s and family %s",
 				arg->name[0],
-				cmd2name(command), type->name, session_family());
+				cmd2name(command), type->name,
+				session_family());
 			return;
 		}
 		exit_error(OTHER_PROBLEM,
@@ -476,62 +476,58 @@ parse_commandline(int argc, char *argv[])
 
 	/* Second: parse command */
 	for (command = ipset_commands;
-	     command->cmd && cmd == IPSET_CMD_NONE;
+		 argc > 1 && command->cmd && cmd == IPSET_CMD_NONE;
 	     command++) {
-		for (i = 1; i < argc; ) {
-			if (!ipset_match_cmd(argv[1], command->name)) {
-				i++;
+		if (!ipset_match_cmd(argv[1], command->name))
 			continue;
-			}
-			if (restore_line != 0
-			    && (command->cmd == IPSET_CMD_RESTORE
-			    	|| command->cmd == IPSET_CMD_VERSION
-			    	|| command->cmd == IPSET_CMD_HELP))
+
+		if (restore_line != 0 &&
+		    (command->cmd == IPSET_CMD_RESTORE ||
+		     command->cmd == IPSET_CMD_VERSION ||
+		     command->cmd == IPSET_CMD_HELP))
 			return exit_error(PARAMETER_PROBLEM,
 				"Command `%s' is invalid "
 				"in restore mode.",
 				command->name[0]);
-				if (interactive
-				    && command->cmd == IPSET_CMD_RESTORE) {
+		if (interactive && command->cmd == IPSET_CMD_RESTORE) {
 			printf("Restore command ignored "
 			       "in interactive mode\n");
 			return 0;
 		}
 
 		/* Shift off matched command arg */
-			ipset_shift_argv(&argc, argv, i);
+		ipset_shift_argv(&argc, argv, 1);
 		cmd = command->cmd;
 		switch (command->has_arg) {
 		case IPSET_MANDATORY_ARG:
 		case IPSET_MANDATORY_ARG2:
-				if (i + 1 > argc)
+			if (argc < 2)
 				return exit_error(PARAMETER_PROBLEM,
 					"Missing mandatory argument "
 					"to command %s",
 					command->name[0]);
 			/* Fall through */
 		case IPSET_OPTIONAL_ARG:
-				arg0 = argv[i];
-				if (i + 1 <= argc)
+			arg0 = argv[1];
+			if (argc >= 2)
 				/* Shift off first arg */
-					ipset_shift_argv(&argc, argv, i);
+				ipset_shift_argv(&argc, argv, 1);
 			break;
 		default:
 			break;
 		}
 		if (command->has_arg == IPSET_MANDATORY_ARG2) {
-				if (i + 1 > argc)
+			if (argc < 2)
 				return exit_error(PARAMETER_PROBLEM,
 					"Missing second mandatory "
 					"argument to command %s",
 					command->name[0]);
-				arg1 = argv[i];
+			arg1 = argv[1];
 			/* Shift off second arg */
-				ipset_shift_argv(&argc, argv, i);
+			ipset_shift_argv(&argc, argv, 1);
 		}
 		break;
 	}
-	}
 
 	/* Third: catch interactive mode, handle help, version */
 	switch (cmd) {
@@ -565,15 +561,16 @@ parse_commandline(int argc, char *argv[])
 				argv[1]);
 		return exit_error(PARAMETER_PROBLEM, "No command specified.");
 	case IPSET_CMD_VERSION:
-		printf("%s v%s.\n", program_name, program_version);
+		printf("%s v%s, protocol version: %u\n",
+		       program_name, program_version, IPSET_PROTOCOL);
 		if (interactive)
 			return 0;
 		return exit_error(NO_PROBLEM, NULL);
 	case IPSET_CMD_HELP:
 		help();
 
-		if (interactive
-		    || !ipset_envopt_test(session, IPSET_ENV_QUIET)) {
+		if (interactive ||
+		    !ipset_envopt_test(session, IPSET_ENV_QUIET)) {
 			if (arg0) {
 				/* Type-specific help, without kernel checking */
 				type = type_find(arg0);
@@ -726,16 +723,22 @@ parse_commandline(int argc, char *argv[])
 int
 main(int argc, char *argv[])
 {
+	int ret;
+
 	/* Register types */
 	ipset_type_add(&ipset_bitmap_ip0);
 	ipset_type_add(&ipset_bitmap_ipmac0);
 	ipset_type_add(&ipset_bitmap_port0);
 	ipset_type_add(&ipset_hash_ip0);
 	ipset_type_add(&ipset_hash_net0);
-	ipset_type_add(&ipset_hash_netport0);
-	ipset_type_add(&ipset_hash_ipport0);
-	ipset_type_add(&ipset_hash_ipportip0);
-	ipset_type_add(&ipset_hash_ipportnet0);
+	ipset_type_add(&ipset_hash_net1);
+	ipset_type_add(&ipset_hash_netport1);
+	ipset_type_add(&ipset_hash_netport2);
+	ipset_type_add(&ipset_hash_netiface0);
+	ipset_type_add(&ipset_hash_ipport1);
+	ipset_type_add(&ipset_hash_ipportip1);
+	ipset_type_add(&ipset_hash_ipportnet1);
+	ipset_type_add(&ipset_hash_ipportnet2);
 	ipset_type_add(&ipset_list_set0);
 
 	/* Initialize session */
@@ -744,5 +747,9 @@ main(int argc, char *argv[])
 		return exit_error(OTHER_PROBLEM,
 			"Cannot initialize ipset session, aborting.");
 
-	return parse_commandline(argc, argv);
+	ret = parse_commandline(argc, argv);
+
+	ipset_session_fini(session);
+
+	return ret;
 }

extensions/ipset-6/src/ipset_hash_ip.c

@@ -81,7 +81,7 @@ static const char hash_ip_usage[] =
 
 struct ipset_type ipset_hash_ip0 = {
 	.name = "hash:ip",
-	.alias = { "iphash", "iptree", "iptreemap", NULL },
+	.alias = { "iphash", NULL },
 	.revision = 0,
 	.family = AF_INET46,
 	.dimension = IPSET_DIM_ONE,
@@ -92,7 +92,6 @@ struct ipset_type ipset_hash_ip0 = {
 			.opt = IPSET_OPT_IP
 		},
 	},
-	.compat_parse_elem = ipset_parse_iptimeout,
 	.args = {
 		[IPSET_CREATE] = hash_ip_create_args,
 		[IPSET_ADD] = hash_ip_add_args,

extensions/ipset-6/src/ipset_hash_ipport.c

@@ -70,7 +70,7 @@ static const struct ipset_arg hash_ipport_add_args[] = {
 	{ },
 };
 
-static const char hash_ipport_usage[] =
+static const char hash_ipport1_usage[] =
 "create SETNAME hash:ip,port\n"
 "		[family inet|inet6]\n"
 "               [hashsize VALUE] [maxelem VALUE]\n"
@@ -82,13 +82,13 @@ static const char hash_ipport_usage[] =
 "      IP is a valid IPv4 or IPv6 address (or hostname).\n"
 "      Adding/deleting multiple elements in IP/CIDR or FROM-TO form\n"
 "      is supported for IPv4.\n"
-"      Adding/deleting multiple elements with TCP/UDP port range\n"
-"      is supported both for IPv4 and IPv6.\n";
+"      Adding/deleting multiple elements with TCP/SCTP/UDP/UDPLITE\n"
+"      port range is supported both for IPv4 and IPv6.\n";
 
-struct ipset_type ipset_hash_ipport0 = {
+struct ipset_type ipset_hash_ipport1 = {
 	.name = "hash:ip,port",
 	.alias = { "ipporthash", NULL },
-	.revision = 0,
+	.revision = 1,
 	.family = AF_INET46,
 	.dimension = IPSET_DIM_TWO,
 	.elem = {
@@ -139,6 +139,6 @@ struct ipset_type ipset_hash_ipport0 = {
 			| IPSET_FLAG(IPSET_OPT_PROTO),
 	},
 
-	.usage = hash_ipport_usage,
+	.usage = hash_ipport1_usage,
 	.usagefn = ipset_port_usage,
 };

extensions/ipset-6/src/ipset_hash_ipportip.c

@@ -70,7 +70,7 @@ static const struct ipset_arg hash_ipportip_add_args[] = {
 	{ },
 };
 
-static const char hash_ipportip_usage[] =
+static const char hash_ipportip1_usage[] =
 "create SETNAME hash:ip,port,ip\n"
 "		[family inet|inet6]\n"
 "               [hashsize VALUE] [maxelem VALUE]\n"
@@ -82,13 +82,13 @@ static const char hash_ipportip_usage[] =
 "      IP is a valid IPv4 or IPv6 address (or hostname).\n"
 "      Adding/deleting multiple elements in IP/CIDR or FROM-TO form\n"
 "      in the first IP component is supported for IPv4.\n"
-"      Adding/deleting multiple elements with TCP/UDP port range\n"
-"      is supported both for IPv4 and IPv6.\n";
+"      Adding/deleting multiple elements with TCP/SCTP/UDP/UDPLITE\n"
+"      port range is supported both for IPv4 and IPv6.\n";
 
-struct ipset_type ipset_hash_ipportip0 = {
+struct ipset_type ipset_hash_ipportip1 = {
 	.name = "hash:ip,port,ip",
 	.alias = { "ipportiphash", NULL },
-	.revision = 0,
+	.revision = 1,
 	.family = AF_INET46,
 	.dimension = IPSET_DIM_THREE,
 	.elem = {
@@ -150,6 +150,6 @@ struct ipset_type ipset_hash_ipportip0 = {
 			| IPSET_FLAG(IPSET_OPT_IP2),
 	},
 
-	.usage = hash_ipportip_usage,
+	.usage = hash_ipportip1_usage,
 	.usagefn = ipset_port_usage,
 };

extensions/ipset-6/src/ipset_hash_ipportnet.c

@@ -70,7 +70,7 @@ static const struct ipset_arg hash_ipportnet_add_args[] = {
 	{ },
 };
 
-static const char hash_ipportnet_usage[] =
+static const char hash_ipportnet1_usage[] =
 "create SETNAME hash:ip,port,net\n"
 "		[family inet|inet6]\n"
 "               [hashsize VALUE] [maxelem VALUE]\n"
@@ -83,13 +83,13 @@ static const char hash_ipportnet_usage[] =
 "      CIDR is a valid IPv4 or IPv6 CIDR prefix.\n"
 "      Adding/deleting multiple elements in IP/CIDR or FROM-TO form\n"
 "      in the first IP component is supported for IPv4.\n"
-"      Adding/deleting multiple elements with TCP/UDP port range\n"
-"      is supported both for IPv4 and IPv6.\n";
+"      Adding/deleting multiple elements with TCP/SCTP/UDP/UDPLITE\n"
+"      port range is supported both for IPv4 and IPv6.\n";
 
-struct ipset_type ipset_hash_ipportnet0 = {
+struct ipset_type ipset_hash_ipportnet1 = {
 	.name = "hash:ip,port,net",
 	.alias = { "ipportnethash", NULL },
-	.revision = 0,
+	.revision = 1,
 	.family = AF_INET46,
 	.dimension = IPSET_DIM_THREE,
 	.elem = {
@@ -133,6 +133,7 @@ struct ipset_type ipset_hash_ipportnet0 = {
 			| IPSET_FLAG(IPSET_OPT_MAXELEM)
 			| IPSET_FLAG(IPSET_OPT_TIMEOUT),
 		[IPSET_ADD] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_CIDR)
 			| IPSET_FLAG(IPSET_OPT_IP_TO)
 			| IPSET_FLAG(IPSET_OPT_PORT)
 			| IPSET_FLAG(IPSET_OPT_PORT_TO)
@@ -141,6 +142,7 @@ struct ipset_type ipset_hash_ipportnet0 = {
 			| IPSET_FLAG(IPSET_OPT_CIDR2)
 			| IPSET_FLAG(IPSET_OPT_TIMEOUT),
 		[IPSET_DEL] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_CIDR)
 			| IPSET_FLAG(IPSET_OPT_IP_TO)
 			| IPSET_FLAG(IPSET_OPT_PORT)
 			| IPSET_FLAG(IPSET_OPT_PORT_TO)
@@ -154,6 +156,99 @@ struct ipset_type ipset_hash_ipportnet0 = {
 			| IPSET_FLAG(IPSET_OPT_CIDR2),
 	},
 
-	.usage = hash_ipportnet_usage,
+	.usage = hash_ipportnet1_usage,
 	.usagefn = ipset_port_usage,
 };
+
+static const char hash_ipportnet2_usage[] =
+"create SETNAME hash:ip,port,net\n"
+"		[family inet|inet6]\n"
+"               [hashsize VALUE] [maxelem VALUE]\n"
+"               [timeout VALUE]\n"
+"add    SETNAME IP,PROTO:PORT,IP[/CIDR] [timeout VALUE]\n"
+"del    SETNAME IP,PROTO:PORT,IP[/CIDR]\n"
+"test   SETNAME IP,PROTO:PORT,IP[/CIDR]\n\n"
+"where depending on the INET family\n"
+"      IP are valid IPv4 or IPv6 addresses (or hostnames),\n"
+"      CIDR is a valid IPv4 or IPv6 CIDR prefix.\n"
+"      Adding/deleting multiple elements in IP/CIDR or FROM-TO form\n"
+"      in both IP components are supported for IPv4.\n"
+"      Adding/deleting multiple elements with TCP/SCTP/UDP/UDPLITE\n"
+"      port range is supported both for IPv4 and IPv6.\n";
+
+struct ipset_type ipset_hash_ipportnet2 = {
+	.name = "hash:ip,port,net",
+	.alias = { "ipportnethash", NULL },
+	.revision = 2,
+	.family = AF_INET46,
+	.dimension = IPSET_DIM_THREE,
+	.elem = {
+		[IPSET_DIM_ONE] = {
+			.parse = ipset_parse_ip4_single6,
+			.print = ipset_print_ip,
+			.opt = IPSET_OPT_IP
+		},
+		[IPSET_DIM_TWO] = {
+			.parse = ipset_parse_proto_port,
+			.print = ipset_print_proto_port,
+			.opt = IPSET_OPT_PORT
+		},
+		[IPSET_DIM_THREE] = {
+			.parse = ipset_parse_ip4_net6,
+			.print = ipset_print_ip,
+			.opt = IPSET_OPT_IP2
+		},
+	},
+	.args = {
+		[IPSET_CREATE] = hash_ipportnet_create_args,
+		[IPSET_ADD] = hash_ipportnet_add_args,
+	},
+	.mandatory = {
+		[IPSET_CREATE] = 0,
+		[IPSET_ADD] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_PORT)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_IP2),
+		[IPSET_DEL] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_PORT)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_IP2),
+		[IPSET_TEST] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_PORT)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_IP2),
+	},
+	.full = {
+		[IPSET_CREATE] = IPSET_FLAG(IPSET_OPT_HASHSIZE)
+			| IPSET_FLAG(IPSET_OPT_MAXELEM)
+			| IPSET_FLAG(IPSET_OPT_TIMEOUT),
+		[IPSET_ADD] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_CIDR)
+			| IPSET_FLAG(IPSET_OPT_IP_TO)
+			| IPSET_FLAG(IPSET_OPT_PORT)
+			| IPSET_FLAG(IPSET_OPT_PORT_TO)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_IP2)
+			| IPSET_FLAG(IPSET_OPT_CIDR2)
+			| IPSET_FLAG(IPSET_OPT_IP2_TO)
+			| IPSET_FLAG(IPSET_OPT_TIMEOUT),
+		[IPSET_DEL] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_CIDR)
+			| IPSET_FLAG(IPSET_OPT_IP_TO)
+			| IPSET_FLAG(IPSET_OPT_PORT)
+			| IPSET_FLAG(IPSET_OPT_PORT_TO)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_IP2)
+			| IPSET_FLAG(IPSET_OPT_CIDR2)
+			| IPSET_FLAG(IPSET_OPT_IP2_TO),
+		[IPSET_TEST] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_PORT)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_IP2)
+			| IPSET_FLAG(IPSET_OPT_CIDR2),
+	},
+
+	.usage = hash_ipportnet2_usage,
+	.usagefn = ipset_port_usage,
+};
+

extensions/ipset-6/src/ipset_hash_net.c

@@ -57,7 +57,7 @@ static const struct ipset_arg hash_net_add_args[] = {
 	{ },
 };
 
-static const char hash_net_usage[] =
+static const char hash_net0_usage[] =
 "create SETNAME hash:net\n"
 "		[family inet|inet6]\n"
 "               [hashsize VALUE] [maxelem VALUE]\n"
@@ -105,5 +105,60 @@ struct ipset_type ipset_hash_net0 = {
 			| IPSET_FLAG(IPSET_OPT_CIDR),
 	},
 
-	.usage = hash_net_usage,
+	.usage = hash_net0_usage,
 };
+
+static const char hash_net1_usage[] =
+"create SETNAME hash:net\n"
+"		[family inet|inet6]\n"
+"               [hashsize VALUE] [maxelem VALUE]\n"
+"               [timeout VALUE]\n"
+"add    SETNAME IP[/CIDR]|FROM-TO [timeout VALUE]\n"
+"del    SETNAME IP[/CIDR]|FROM-TO\n"
+"test   SETNAME IP[/CIDR]\n\n"
+"where depending on the INET family\n"
+"      IP is an IPv4 or IPv6 address (or hostname),\n"
+"      CIDR is a valid IPv4 or IPv6 CIDR prefix.\n"
+"      IP range is not supported with IPv6.\n";
+
+struct ipset_type ipset_hash_net1 = {
+	.name = "hash:net",
+	.alias = { "nethash", NULL },
+	.revision = 1,
+	.family = AF_INET46,
+	.dimension = IPSET_DIM_ONE,
+	.elem = {
+		[IPSET_DIM_ONE] = {
+			.parse = ipset_parse_ip4_net6,
+			.print = ipset_print_ip,
+			.opt = IPSET_OPT_IP
+		},
+	},
+	.args = {
+		[IPSET_CREATE] = hash_net_create_args,
+		[IPSET_ADD] = hash_net_add_args,
+	},
+	.mandatory = {
+		[IPSET_CREATE] = 0,
+		[IPSET_ADD] = IPSET_FLAG(IPSET_OPT_IP),
+		[IPSET_DEL] = IPSET_FLAG(IPSET_OPT_IP),
+		[IPSET_TEST] = IPSET_FLAG(IPSET_OPT_IP),
+	},
+	.full = {
+		[IPSET_CREATE] = IPSET_FLAG(IPSET_OPT_HASHSIZE)
+			| IPSET_FLAG(IPSET_OPT_MAXELEM)
+			| IPSET_FLAG(IPSET_OPT_TIMEOUT),
+		[IPSET_ADD] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_CIDR)
+			| IPSET_FLAG(IPSET_OPT_IP_TO)
+			| IPSET_FLAG(IPSET_OPT_TIMEOUT),
+		[IPSET_DEL] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_CIDR)
+			| IPSET_FLAG(IPSET_OPT_IP_TO),
+		[IPSET_TEST] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_CIDR),
+	},
+
+	.usage = hash_net1_usage,
+};
+

extensions/ipset-6/src/ipset_hash_netiface.c

@@ -1,4 +1,4 @@
-/* Copyright 2007-2010 Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
+/* Copyright 2011 Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -11,7 +11,7 @@
 #include <libipset/types.h>			/* prototypes */
 
 /* Parse commandline arguments */
-static const struct ipset_arg hash_netport_create_args[] = {
+static const struct ipset_arg hash_netiface_create_args[] = {
 	{ .name = { "family", NULL },
 	  .has_arg = IPSET_MANDATORY_ARG,	.opt = IPSET_OPT_FAMILY,
 	  .parse = ipset_parse_family,		.print = ipset_print_family,
@@ -41,7 +41,7 @@ static const struct ipset_arg hash_netport_create_args[] = {
 	{ },
 };
 
-static const struct ipset_arg hash_netport_add_args[] = {
+static const struct ipset_arg hash_netiface_add_args[] = {
 	{ .name = { "timeout", NULL },
 	  .has_arg = IPSET_MANDATORY_ARG,	.opt = IPSET_OPT_TIMEOUT,
 	  .parse = ipset_parse_uint32,		.print = ipset_print_number,
@@ -49,74 +49,72 @@ static const struct ipset_arg hash_netport_add_args[] = {
 	{ },
 };
 
-static const char hash_netport_usage[] =
-"create SETNAME hash:net,port\n"
+static const char hash_netiface_usage[] =
+"create SETNAME hash:net,iface\n"
 "		[family inet|inet6]\n"
 "               [hashsize VALUE] [maxelem VALUE]\n"
 "               [timeout VALUE]\n"
-"add    SETNAME IP[/CIDR],PROTO:PORT [timeout VALUE]\n"
-"del    SETNAME IP[/CIDR],PROTO:PORT\n"
-"test   SETNAME IP[/CIDR],PROTO:PORT\n\n"
+"add    SETNAME IP[/CIDR]|FROM-TO,[physdev:]IFACE [timeout VALUE]\n"
+"del    SETNAME IP[/CIDR]|FROM-TO,[physdev:]IFACE\n"
+"test   SETNAME IP[/CIDR],[physdev:]IFACE\n\n"
 "where depending on the INET family\n"
 "      IP is a valid IPv4 or IPv6 address (or hostname),\n"
 "      CIDR is a valid IPv4 or IPv6 CIDR prefix.\n"
-"      Adding/deleting multiple elements with TCP/UDP port range supported.\n";
+"      Adding/deleting multiple elements with IPv4 is supported.\n";
 
-struct ipset_type ipset_hash_netport0 = {
-	.name = "hash:net,port",
-	.alias = { "netporthash", NULL },
+struct ipset_type ipset_hash_netiface0 = {
+	.name = "hash:net,iface",
+	.alias = { "netifacehash", NULL },
 	.revision = 0,
 	.family = AF_INET46,
 	.dimension = IPSET_DIM_TWO,
 	.elem = {
 		[IPSET_DIM_ONE] = {
-			.parse = ipset_parse_ipnet,
+			.parse = ipset_parse_ip4_net6,
 			.print = ipset_print_ip,
 			.opt = IPSET_OPT_IP
 		},
 		[IPSET_DIM_TWO] = {
-			.parse = ipset_parse_proto_port,
-			.print = ipset_print_proto_port,
-			.opt = IPSET_OPT_PORT
+			.parse = ipset_parse_iface,
+			.print = ipset_print_iface,
+			.opt = IPSET_OPT_IFACE
 		},
 	},
 	.args = {
-		[IPSET_CREATE] = hash_netport_create_args,
-		[IPSET_ADD] = hash_netport_add_args,
+		[IPSET_CREATE] = hash_netiface_create_args,
+		[IPSET_ADD] = hash_netiface_add_args,
 	},
 	.mandatory = {
 		[IPSET_CREATE] = 0,
 		[IPSET_ADD] = IPSET_FLAG(IPSET_OPT_IP)
-			| IPSET_FLAG(IPSET_OPT_PROTO)
-			| IPSET_FLAG(IPSET_OPT_PORT),
+			| IPSET_FLAG(IPSET_OPT_IFACE),
 		[IPSET_DEL] = IPSET_FLAG(IPSET_OPT_IP)
-			| IPSET_FLAG(IPSET_OPT_PROTO)
-			| IPSET_FLAG(IPSET_OPT_PORT),
+			| IPSET_FLAG(IPSET_OPT_IFACE),
 		[IPSET_TEST] = IPSET_FLAG(IPSET_OPT_IP)
-			| IPSET_FLAG(IPSET_OPT_PROTO)
-			| IPSET_FLAG(IPSET_OPT_PORT),
+			| IPSET_FLAG(IPSET_OPT_IFACE),
 	},
 	.full = {
 		[IPSET_CREATE] = IPSET_FLAG(IPSET_OPT_HASHSIZE)
 			| IPSET_FLAG(IPSET_OPT_MAXELEM)
 			| IPSET_FLAG(IPSET_OPT_TIMEOUT),
 		[IPSET_ADD] = IPSET_FLAG(IPSET_OPT_IP)
-			| IPSET_FLAG(IPSET_OPT_PORT)
-			| IPSET_FLAG(IPSET_OPT_PORT_TO)
-			| IPSET_FLAG(IPSET_OPT_PROTO)
-			| IPSET_FLAG(IPSET_OPT_TIMEOUT)
-			| IPSET_FLAG(IPSET_OPT_CIDR),
+			| IPSET_FLAG(IPSET_OPT_CIDR)
+			| IPSET_FLAG(IPSET_OPT_IP_TO)
+			| IPSET_FLAG(IPSET_OPT_IFACE)
+			| IPSET_FLAG(IPSET_OPT_PHYSDEV)
+			| IPSET_FLAG(IPSET_OPT_TIMEOUT),
 		[IPSET_DEL] = IPSET_FLAG(IPSET_OPT_IP)
-			| IPSET_FLAG(IPSET_OPT_PORT)
-			| IPSET_FLAG(IPSET_OPT_PORT_TO)
-			| IPSET_FLAG(IPSET_OPT_PROTO)
-			| IPSET_FLAG(IPSET_OPT_CIDR),
+			| IPSET_FLAG(IPSET_OPT_CIDR)
+			| IPSET_FLAG(IPSET_OPT_IP_TO)
+			| IPSET_FLAG(IPSET_OPT_IFACE)
+			| IPSET_FLAG(IPSET_OPT_PHYSDEV),
 		[IPSET_TEST] = IPSET_FLAG(IPSET_OPT_IP)
-			| IPSET_FLAG(IPSET_OPT_PORT)
-			| IPSET_FLAG(IPSET_OPT_PROTO)
-			| IPSET_FLAG(IPSET_OPT_CIDR),
+			| IPSET_FLAG(IPSET_OPT_CIDR)
+			| IPSET_FLAG(IPSET_OPT_IP_TO)
+			| IPSET_FLAG(IPSET_OPT_IFACE)
+			| IPSET_FLAG(IPSET_OPT_PHYSDEV),
 	},
 
-	.usage = hash_netport_usage,
-	.usagefn = ipset_port_usage,
+	.usage = hash_netiface_usage,
 };
+

extensions/ipset-6/src/ipset_hash_netport.c

@@ -0,0 +1,199 @@
+/* Copyright 2007-2010 Jozsef Kadlecsik (kadlec@blackhole.kfki.hu)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <libipset/data.h>			/* IPSET_OPT_* */
+#include <libipset/parse.h>			/* parser functions */
+#include <libipset/print.h>			/* printing functions */
+#include <libipset/ui.h>			/* ipset_port_usage */
+#include <libipset/types.h>			/* prototypes */
+
+/* Parse commandline arguments */
+static const struct ipset_arg hash_netport_create_args[] = {
+	{ .name = { "family", NULL },
+	  .has_arg = IPSET_MANDATORY_ARG,	.opt = IPSET_OPT_FAMILY,
+	  .parse = ipset_parse_family,		.print = ipset_print_family,
+	},
+	/* Alias: family inet */
+	{ .name = { "-4", NULL },
+	  .has_arg = IPSET_NO_ARG,		.opt = IPSET_OPT_FAMILY,
+	  .parse = ipset_parse_family,
+	},
+	/* Alias: family inet6 */
+	{ .name = { "-6", NULL },
+	  .has_arg = IPSET_NO_ARG,		.opt = IPSET_OPT_FAMILY,
+	  .parse = ipset_parse_family,
+	},
+	{ .name = { "hashsize", NULL },
+	  .has_arg = IPSET_MANDATORY_ARG,	.opt = IPSET_OPT_HASHSIZE,
+	  .parse = ipset_parse_uint32,		.print = ipset_print_number,
+	},
+	{ .name = { "maxelem", NULL },
+	  .has_arg = IPSET_MANDATORY_ARG,	.opt = IPSET_OPT_MAXELEM,
+	  .parse = ipset_parse_uint32,		.print = ipset_print_number,
+	},
+	{ .name = { "timeout", NULL },
+	  .has_arg = IPSET_MANDATORY_ARG,	.opt = IPSET_OPT_TIMEOUT,
+	  .parse = ipset_parse_uint32,		.print = ipset_print_number,
+	},
+	{ },
+};
+
+static const struct ipset_arg hash_netport_add_args[] = {
+	{ .name = { "timeout", NULL },
+	  .has_arg = IPSET_MANDATORY_ARG,	.opt = IPSET_OPT_TIMEOUT,
+	  .parse = ipset_parse_uint32,		.print = ipset_print_number,
+	},
+	{ },
+};
+
+static const char hash_netport1_usage[] =
+"create SETNAME hash:net,port\n"
+"		[family inet|inet6]\n"
+"               [hashsize VALUE] [maxelem VALUE]\n"
+"               [timeout VALUE]\n"
+"add    SETNAME IP[/CIDR],PROTO:PORT [timeout VALUE]\n"
+"del    SETNAME IP[/CIDR],PROTO:PORT\n"
+"test   SETNAME IP[/CIDR],PROTO:PORT\n\n"
+"where depending on the INET family\n"
+"      IP is a valid IPv4 or IPv6 address (or hostname),\n"
+"      CIDR is a valid IPv4 or IPv6 CIDR prefix.\n"
+"      Adding/deleting multiple elements with TCP/SCTP/UDP/UDPLITE\n"
+"      port range is supported both for IPv4 and IPv6.\n";
+
+struct ipset_type ipset_hash_netport1 = {
+	.name = "hash:net,port",
+	.alias = { "netporthash", NULL },
+	.revision = 1,
+	.family = AF_INET46,
+	.dimension = IPSET_DIM_TWO,
+	.elem = {
+		[IPSET_DIM_ONE] = {
+			.parse = ipset_parse_ipnet,
+			.print = ipset_print_ip,
+			.opt = IPSET_OPT_IP
+		},
+		[IPSET_DIM_TWO] = {
+			.parse = ipset_parse_proto_port,
+			.print = ipset_print_proto_port,
+			.opt = IPSET_OPT_PORT
+		},
+	},
+	.args = {
+		[IPSET_CREATE] = hash_netport_create_args,
+		[IPSET_ADD] = hash_netport_add_args,
+	},
+	.mandatory = {
+		[IPSET_CREATE] = 0,
+		[IPSET_ADD] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_PORT),
+		[IPSET_DEL] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_PORT),
+		[IPSET_TEST] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_PORT),
+	},
+	.full = {
+		[IPSET_CREATE] = IPSET_FLAG(IPSET_OPT_HASHSIZE)
+			| IPSET_FLAG(IPSET_OPT_MAXELEM)
+			| IPSET_FLAG(IPSET_OPT_TIMEOUT),
+		[IPSET_ADD] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_PORT)
+			| IPSET_FLAG(IPSET_OPT_PORT_TO)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_TIMEOUT)
+			| IPSET_FLAG(IPSET_OPT_CIDR),
+		[IPSET_DEL] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_PORT)
+			| IPSET_FLAG(IPSET_OPT_PORT_TO)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_CIDR),
+		[IPSET_TEST] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_PORT)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_CIDR),
+	},
+
+	.usage = hash_netport1_usage,
+	.usagefn = ipset_port_usage,
+};
+
+static const char hash_netport2_usage[] =
+"create SETNAME hash:net,port\n"
+"		[family inet|inet6]\n"
+"               [hashsize VALUE] [maxelem VALUE]\n"
+"               [timeout VALUE]\n"
+"add    SETNAME IP[/CIDR]|FROM-TO,PROTO:PORT [timeout VALUE]\n"
+"del    SETNAME IP[/CIDR]|FROM-TO,PROTO:PORT\n"
+"test   SETNAME IP[/CIDR],PROTO:PORT\n\n"
+"where depending on the INET family\n"
+"      IP is a valid IPv4 or IPv6 address (or hostname),\n"
+"      CIDR is a valid IPv4 or IPv6 CIDR prefix.\n"
+"      Adding/deleting multiple elements with IPv4 is supported.\n"
+"      Adding/deleting multiple elements with TCP/SCTP/UDP/UDPLITE\n"
+"      port range is supported both for IPv4 and IPv6.\n";
+
+struct ipset_type ipset_hash_netport2 = {
+	.name = "hash:net,port",
+	.alias = { "netporthash", NULL },
+	.revision = 2,
+	.family = AF_INET46,
+	.dimension = IPSET_DIM_TWO,
+	.elem = {
+		[IPSET_DIM_ONE] = {
+			.parse = ipset_parse_ip4_net6,
+			.print = ipset_print_ip,
+			.opt = IPSET_OPT_IP
+		},
+		[IPSET_DIM_TWO] = {
+			.parse = ipset_parse_proto_port,
+			.print = ipset_print_proto_port,
+			.opt = IPSET_OPT_PORT
+		},
+	},
+	.args = {
+		[IPSET_CREATE] = hash_netport_create_args,
+		[IPSET_ADD] = hash_netport_add_args,
+	},
+	.mandatory = {
+		[IPSET_CREATE] = 0,
+		[IPSET_ADD] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_PORT),
+		[IPSET_DEL] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_PORT),
+		[IPSET_TEST] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_PORT),
+	},
+	.full = {
+		[IPSET_CREATE] = IPSET_FLAG(IPSET_OPT_HASHSIZE)
+			| IPSET_FLAG(IPSET_OPT_MAXELEM)
+			| IPSET_FLAG(IPSET_OPT_TIMEOUT),
+		[IPSET_ADD] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_CIDR)
+			| IPSET_FLAG(IPSET_OPT_IP_TO)
+			| IPSET_FLAG(IPSET_OPT_PORT)
+			| IPSET_FLAG(IPSET_OPT_PORT_TO)
+			| IPSET_FLAG(IPSET_OPT_PROTO)
+			| IPSET_FLAG(IPSET_OPT_TIMEOUT),
+		[IPSET_DEL] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_CIDR)
+			| IPSET_FLAG(IPSET_OPT_IP_TO)
+			| IPSET_FLAG(IPSET_OPT_PORT)
+			| IPSET_FLAG(IPSET_OPT_PORT_TO)
+			| IPSET_FLAG(IPSET_OPT_PROTO),
+		[IPSET_TEST] = IPSET_FLAG(IPSET_OPT_IP)
+			| IPSET_FLAG(IPSET_OPT_CIDR)
+			| IPSET_FLAG(IPSET_OPT_PORT)
+			| IPSET_FLAG(IPSET_OPT_PROTO),
+	},
+
+	.usage = hash_netport2_usage,
+	.usagefn = ipset_port_usage,
+};

extensions/ipset-6/src/ui.c

@@ -23,9 +23,9 @@
 const struct ipset_commands ipset_commands[] = {
 	/* Order is important */
 
-	{	/* c[reate], --create, n, -N */
+	{	/* c[reate], --create, n[ew], -N */
 		.cmd = IPSET_CMD_CREATE,
-		.name = { "create", "n" },
+		.name = { "create", "new" },
 		.has_arg = IPSET_MANDATORY_ARG2,
 		.help = "SETNAME TYPENAME [type-specific-options]\n"
 			"        Create a new set",
@@ -143,14 +143,15 @@ ipset_match_cmd(const char *arg, const char * const name[])
 
 	if (len > strlen(name[0]) || !len)
 		return false;
-	else if (strncmp(arg, name[0], len) == 0)
+	else if (len > 1 &&
+		 ((strncmp(arg, name[0], len) == 0) ||
+		  (name[1] != NULL && (strncmp(arg, name[1], len) == 0))))
 		return true;
 	else if (len != 1)
 		return false;
-	else if (name[1] == NULL)
-		return tolower(arg[0]) == name[0][0];
 	else
-		return tolower(arg[0]) == name[1][0];	
+		return tolower(arg[0]) == name[0][0] ||
+		       (name[1] != NULL && tolower(arg[0]) == name[1][0]);
 }
 
 const struct ipset_envopts ipset_envopts[] = {
@@ -188,6 +189,19 @@ const struct ipset_envopts ipset_envopts[] = {
 		  "        when adding already existing elements\n"
 		  "        or when deleting non-existing elements.",
 	},
+	{ .name = { "-n", "-name" },
+	  .parse = ipset_envopt_parse,
+	  .has_arg = IPSET_NO_ARG,	.flag = IPSET_ENV_LIST_SETNAME,
+	  .help = "\n"
+		  "        When listing, list just setnames from kernel.\n",
+	},
+	{ .name = { "-t", "-terse" },
+	  .parse = ipset_envopt_parse,
+	  .has_arg = IPSET_NO_ARG,	.flag = IPSET_ENV_LIST_HEADER,
+	  .help = "\n"
+		  "        When listing, list setnames and set headers\n"
+		  "        from kernel only.",
+	},
 	{ },
 };
 
@@ -202,8 +216,8 @@ ipset_match_option(const char *arg, const char * const name[])
 	if (arg[0] == '-' && arg[1] == '-')
 		arg++, arg++;
 
-	return STREQ(arg, name[0])
-	       || (name[1] != NULL && STREQ(arg, name[1]));
+	return STREQ(arg, name[0]) ||
+	       (name[1] != NULL && STREQ(arg, name[1]));
 }
 
 /* Strict envopt matching */
@@ -217,8 +231,8 @@ ipset_match_envopt(const char *arg, const char * const name[])
 	if (arg[0] == '-' && arg[1] == '-')
 		arg++;
 
-	return STREQ(arg, name[0])
-	       || (name[1] != NULL && STREQ(arg, name[1]));
+	return STREQ(arg, name[0]) ||
+	       (name[1] != NULL && STREQ(arg, name[1]));
 }
 
 /**
@@ -237,9 +251,8 @@ ipset_shift_argv(int *argc, char *argv[], int from)
 
 	assert(*argc >= from + 1);
 
-	for (i = from + 1; i <= *argc; i++) {
+	for (i = from + 1; i <= *argc; i++)
 		argv[i-1] = argv[i];
-	}
 	(*argc)--;
 	return;
 }
@@ -256,9 +269,9 @@ ipset_port_usage(void)
 	const char *name;
 
 	printf("      [PROTO:]PORT is a valid pattern of the following:\n"
-	       "           PORTNAME         port name from /etc/services\n"
-	       "           PORTNUMBER       port number identifier\n"
-	       "           tcp|udp:PORTNAME|PORTNUMBER\n"
+	       "           PORTNAME         TCP port name from /etc/services\n"
+	       "           PORTNUMBER       TCP port number identifier\n"
+	       "           tcp|sctp|udp|udplite:PORTNAME|PORTNUMBER\n"
 	       "           icmp:CODENAME    supported ICMP codename\n"
 	       "           icmp:TYPE/CODE   ICMP type/code value\n"
 	       "           icmpv6:CODENAME  supported ICMPv6 codename\n"

extensions/ipset-6/xt_set.c

@@ -29,52 +29,33 @@ MODULE_ALIAS("ip6t_SET");
 
 static inline int
 match_set(ip_set_id_t index, const struct sk_buff *skb,
-	  u8 pf, u8 dim, u8 flags, int inv)
+	  const struct xt_action_param *par,
+	  const struct ip_set_adt_opt *opt, int inv)
 {
-	if (ip_set_test(index, skb, pf, dim, flags))
+	if (ip_set_test(index, skb, par, opt))
 		inv = !inv;
 	return inv;
 }
 
+#define ADT_OPT(n, f, d, fs, cfs, t)	\
+const struct ip_set_adt_opt n = {	\
+	.family	= f,			\
+	.dim = d,			\
+	.flags = fs,			\
+	.cmdflags = cfs,		\
+	.timeout = t,			\
+}
+
 /* Revision 0 interface: backward compatible with netfilter/iptables */
 
-/* Backward compatibility constrains (incomplete):
- *  2.6.24: [NETLINK]: Introduce nested and byteorder flag to netlink attribute
- *  2.6.25: is_vmalloc_addr(): Check if an address is within the vmalloc
- *	    boundaries
- *  2.6.27: rcu: split list.h and move rcu-protected lists into rculist.h
- *  2.6.28: netfilter: ctnetlink: remove bogus module dependency between
- *	    ctnetlink and nf_nat (nfnl_lock/nfnl_unlock)
- *  2.6.29: generic swap(): introduce global macro swap(a, b)
- *  2.6.31: netfilter: passive OS fingerprint xtables match
- *  2.6.34: rcu: Add lockdep-enabled variants of rcu_dereference()
- */
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
-#error "Linux kernel version too old: must be >= 2.6.34"
-#endif
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 35)
-#define CHECK_OK	1
-#define CHECK_FAIL	0
-#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35) */
-#define	CHECK_OK	0
-#define CHECK_FAIL	(-EINVAL)
-#endif
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 35)
-static bool
-set_match_v0(const struct sk_buff *skb, const struct xt_match_param *par)
-#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35) */
 static bool
 set_match_v0(const struct sk_buff *skb, struct xt_action_param *par)
-#endif
 {
 	const struct xt_set_info_match_v0 *info = par->matchinfo;
+	ADT_OPT(opt, par->family, info->match_set.u.compat.dim,
+		info->match_set.u.compat.flags, 0, UINT_MAX);
 
-	return match_set(info->match_set.index, skb, par->family,
-			 info->match_set.u.compat.dim,
-			 info->match_set.u.compat.flags,
+	return match_set(info->match_set.index, skb, par, &opt,
 			 info->match_set.u.compat.flags & IPSET_INV_MATCH);
 }
 
@@ -94,13 +75,8 @@ compat_flags(struct xt_set_info_v0 *info)
 	}
 }
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 35)
-static bool
-set_match_v0_checkentry(const struct xt_mtchk_param *par)
-#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35) */
 static int
 set_match_v0_checkentry(const struct xt_mtchk_param *par)
-#endif
 {
 	struct xt_set_info_match_v0 *info = par->matchinfo;
 	ip_set_id_t index;
@@ -110,17 +86,19 @@ set_match_v0_checkentry(const struct xt_mtchk_param *par)
 	if (index == IPSET_INVALID_ID) {
 		pr_warning("Cannot find set indentified by id %u to match\n",
 			   info->match_set.index);
-		return CHECK_FAIL;	/* error */
+		return -ENOENT;
 	}
 	if (info->match_set.u.flags[IPSET_DIM_MAX-1] != 0) {
-		pr_warning("That's nasty!\n");
-		return CHECK_FAIL;	/* error */
+		pr_warning("Protocol error: set match dimension "
+			   "is over the limit!\n");
+		ip_set_nfnl_put(info->match_set.index);
+		return -ERANGE;
 	}
 
 	/* Fill out compatibility data */
 	compat_flags(&info->match_set);
 
-	return CHECK_OK;
+	return 0;
 }
 
 static void
@@ -131,35 +109,25 @@ set_match_v0_destroy(const struct xt_mtdtor_param *par)
 	ip_set_nfnl_put(info->match_set.index);
 }
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 35)
-static unsigned int
-set_target_v0(struct sk_buff *skb, const struct xt_target_param *par)
-#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35) */
 static unsigned int
 set_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
-#endif
 {
 	const struct xt_set_info_target_v0 *info = par->targinfo;
+	ADT_OPT(add_opt, par->family, info->add_set.u.compat.dim,
+		info->add_set.u.compat.flags, 0, UINT_MAX);
+	ADT_OPT(del_opt, par->family, info->del_set.u.compat.dim,
+		info->del_set.u.compat.flags, 0, UINT_MAX);
 
 	if (info->add_set.index != IPSET_INVALID_ID)
-		ip_set_add(info->add_set.index, skb, par->family,
-			   info->add_set.u.compat.dim,
-			   info->add_set.u.compat.flags);
+		ip_set_add(info->add_set.index, skb, par, &add_opt);
 	if (info->del_set.index != IPSET_INVALID_ID)
-		ip_set_del(info->del_set.index, skb, par->family,
-			   info->del_set.u.compat.dim,
-			   info->del_set.u.compat.flags);
+		ip_set_del(info->del_set.index, skb, par, &del_opt);
 
 	return XT_CONTINUE;
 }
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 35)
-static bool
-set_target_v0_checkentry(const struct xt_tgchk_param *par)
-#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35) */
 static int
 set_target_v0_checkentry(const struct xt_tgchk_param *par)
-#endif
 {
 	struct xt_set_info_target_v0 *info = par->targinfo;
 	ip_set_id_t index;
@@ -167,31 +135,38 @@ set_target_v0_checkentry(const struct xt_tgchk_param *par)
 	if (info->add_set.index != IPSET_INVALID_ID) {
 		index = ip_set_nfnl_get_byindex(info->add_set.index);
 		if (index == IPSET_INVALID_ID) {
-			pr_warning("cannot find add_set index %u as target\n",
+			pr_warning("Cannot find add_set index %u as target\n",
 				   info->add_set.index);
-			return CHECK_FAIL;	/* error */
+			return -ENOENT;
 		}
 	}
 
 	if (info->del_set.index != IPSET_INVALID_ID) {
 		index = ip_set_nfnl_get_byindex(info->del_set.index);
 		if (index == IPSET_INVALID_ID) {
-			pr_warning("cannot find del_set index %u as target\n",
+			pr_warning("Cannot find del_set index %u as target\n",
 				   info->del_set.index);
-			return CHECK_FAIL;	/* error */
+			if (info->add_set.index != IPSET_INVALID_ID)
+				ip_set_nfnl_put(info->add_set.index);
+			return -ENOENT;
 		}
 	}
 	if (info->add_set.u.flags[IPSET_DIM_MAX-1] != 0 ||
 	    info->del_set.u.flags[IPSET_DIM_MAX-1] != 0) {
-		pr_warning("That's nasty!\n");
-		return CHECK_FAIL;	/* error */
+		pr_warning("Protocol error: SET target dimension "
+			   "is over the limit!\n");
+		if (info->add_set.index != IPSET_INVALID_ID)
+			ip_set_nfnl_put(info->add_set.index);
+		if (info->del_set.index != IPSET_INVALID_ID)
+			ip_set_nfnl_put(info->del_set.index);
+		return -ERANGE;
 	}
 
 	/* Fill out compatibility data */
 	compat_flags(&info->add_set);
 	compat_flags(&info->del_set);
 
-	return CHECK_OK;
+	return 0;
 }
 
 static void
@@ -205,33 +180,23 @@ set_target_v0_destroy(const struct xt_tgdtor_param *par)
 		ip_set_nfnl_put(info->del_set.index);
 }
 
-/* Revision 1: current interface to netfilter/iptables */
+/* Revision 1 match and target */
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 35)
 static bool
-set_match(const struct sk_buff *skb, const struct xt_match_param *par)
-#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35) */
-static bool
-set_match(const struct sk_buff *skb, struct xt_action_param *par)
-#endif
+set_match_v1(const struct sk_buff *skb, struct xt_action_param *par)
 {
-	const struct xt_set_info_match *info = par->matchinfo;
+	const struct xt_set_info_match_v1 *info = par->matchinfo;
+	ADT_OPT(opt, par->family, info->match_set.dim,
+		info->match_set.flags, 0, UINT_MAX);
 
-	return match_set(info->match_set.index, skb, par->family,
-			 info->match_set.dim,
-			 info->match_set.flags,
+	return match_set(info->match_set.index, skb, par, &opt,
 			 info->match_set.flags & IPSET_INV_MATCH);
 }
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 35)
-static bool
-set_match_checkentry(const struct xt_mtchk_param *par)
-#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35) */
 static int
-set_match_checkentry(const struct xt_mtchk_param *par)
-#endif
+set_match_v1_checkentry(const struct xt_mtchk_param *par)
 {
-	struct xt_set_info_match *info = par->matchinfo;
+	struct xt_set_info_match_v1 *info = par->matchinfo;
 	ip_set_id_t index;
 
 	index = ip_set_nfnl_get_byindex(info->match_set.index);
@@ -239,89 +204,86 @@ set_match_checkentry(const struct xt_mtchk_param *par)
 	if (index == IPSET_INVALID_ID) {
 		pr_warning("Cannot find set indentified by id %u to match\n",
 			   info->match_set.index);
-		return CHECK_FAIL;	/* error */
+		return -ENOENT;
 	}
 	if (info->match_set.dim > IPSET_DIM_MAX) {
-		pr_warning("That's nasty!\n");
-		return CHECK_FAIL;	/* error */
+		pr_warning("Protocol error: set match dimension "
+			   "is over the limit!\n");
+		ip_set_nfnl_put(info->match_set.index);
+		return -ERANGE;
 	}
 
-	return CHECK_OK;
+	return 0;
 }
 
 static void
-set_match_destroy(const struct xt_mtdtor_param *par)
+set_match_v1_destroy(const struct xt_mtdtor_param *par)
 {
-	struct xt_set_info_match *info = par->matchinfo;
+	struct xt_set_info_match_v1 *info = par->matchinfo;
 
 	ip_set_nfnl_put(info->match_set.index);
 }
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 35)
 static unsigned int
-set_target(struct sk_buff *skb, const struct xt_target_param *par)
-#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35) */
-static unsigned int
-set_target(struct sk_buff *skb, const struct xt_action_param *par)
-#endif
+set_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
 {
-	const struct xt_set_info_target *info = par->targinfo;
+	const struct xt_set_info_target_v1 *info = par->targinfo;
+	ADT_OPT(add_opt, par->family, info->add_set.dim,
+		info->add_set.flags, 0, UINT_MAX);
+	ADT_OPT(del_opt, par->family, info->del_set.dim,
+		info->del_set.flags, 0, UINT_MAX);
 
 	if (info->add_set.index != IPSET_INVALID_ID)
-		ip_set_add(info->add_set.index,
-			   skb, par->family,
-			   info->add_set.dim,
-			   info->add_set.flags);
+		ip_set_add(info->add_set.index, skb, par, &add_opt);
 	if (info->del_set.index != IPSET_INVALID_ID)
-		ip_set_del(info->del_set.index,
-			   skb, par->family,
-			   info->add_set.dim,
-			   info->del_set.flags);
+		ip_set_del(info->del_set.index, skb, par, &del_opt);
 
 	return XT_CONTINUE;
 }
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 35)
-static bool
-set_target_checkentry(const struct xt_tgchk_param *par)
-#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35) */
 static int
-set_target_checkentry(const struct xt_tgchk_param *par)
-#endif
+set_target_v1_checkentry(const struct xt_tgchk_param *par)
 {
-	const struct xt_set_info_target *info = par->targinfo;
+	const struct xt_set_info_target_v1 *info = par->targinfo;
 	ip_set_id_t index;
 
 	if (info->add_set.index != IPSET_INVALID_ID) {
 		index = ip_set_nfnl_get_byindex(info->add_set.index);
 		if (index == IPSET_INVALID_ID) {
-			pr_warning("cannot find add_set index %u as target\n",
+			pr_warning("Cannot find add_set index %u as target\n",
 				   info->add_set.index);
-			return CHECK_FAIL;	/* error */
+			return -ENOENT;
 		}
 	}
 
 	if (info->del_set.index != IPSET_INVALID_ID) {
 		index = ip_set_nfnl_get_byindex(info->del_set.index);
 		if (index == IPSET_INVALID_ID) {
-			pr_warning("cannot find del_set index %u as target\n",
+			pr_warning("Cannot find del_set index %u as target\n",
 				   info->del_set.index);
-			return CHECK_FAIL;	/* error */
+			if (info->add_set.index != IPSET_INVALID_ID)
+				ip_set_nfnl_put(info->add_set.index);
+			return -ENOENT;
 		}
 	}
 	if (info->add_set.dim > IPSET_DIM_MAX ||
-	    info->del_set.flags > IPSET_DIM_MAX) {
-		pr_warning("That's nasty!\n");
-		return CHECK_FAIL;	/* error */
+	    info->del_set.dim > IPSET_DIM_MAX) {
+		pr_warning("Protocol error: SET target dimension "
+			   "is over the limit!\n");
+		if (info->add_set.index != IPSET_INVALID_ID)
+			ip_set_nfnl_put(info->add_set.index);
+		if (info->del_set.index != IPSET_INVALID_ID)
+			ip_set_nfnl_put(info->del_set.index);
+		return -ERANGE;
 	}
 
-	return CHECK_OK;
+	return 0;
 }
 
 static void
-set_target_destroy(const struct xt_tgdtor_param *par)
+set_target_v1_destroy(const struct xt_tgdtor_param *par)
 {
-	const struct xt_set_info_target *info = par->targinfo;
+	const struct xt_set_info_target_v1 *info = par->targinfo;
 
 	if (info->add_set.index != IPSET_INVALID_ID)
 		ip_set_nfnl_put(info->add_set.index);
@@ -329,6 +291,28 @@ set_target_destroy(const struct xt_tgdtor_param *par)
 		ip_set_nfnl_put(info->del_set.index);
 }
 
+/* Revision 2 target */
+
+static unsigned int
+set_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
+{
+	const struct xt_set_info_target_v2 *info = par->targinfo;
+	ADT_OPT(add_opt, par->family, info->add_set.dim,
+		info->add_set.flags, info->flags, info->timeout);
+	ADT_OPT(del_opt, par->family, info->del_set.dim,
+		info->del_set.flags, 0, UINT_MAX);
+
+	if (info->add_set.index != IPSET_INVALID_ID)
+		ip_set_add(info->add_set.index, skb, par, &add_opt);
+	if (info->del_set.index != IPSET_INVALID_ID)
+		ip_set_del(info->del_set.index, skb, par, &del_opt);
+
+	return XT_CONTINUE;
+}
+
+#define set_target_v2_checkentry	set_target_v1_checkentry
+#define set_target_v2_destroy		set_target_v1_destroy
+
 static struct xt_match set_matches[] __read_mostly = {
 	{
 		.name		= "set",
@@ -344,20 +328,20 @@ static struct xt_match set_matches[] __read_mostly = {
 		.name		= "set",
 		.family		= NFPROTO_IPV4,
 		.revision	= 1,
-		.match		= set_match,
-		.matchsize	= sizeof(struct xt_set_info_match),
-		.checkentry	= set_match_checkentry,
-		.destroy	= set_match_destroy,
+		.match		= set_match_v1,
+		.matchsize	= sizeof(struct xt_set_info_match_v1),
+		.checkentry	= set_match_v1_checkentry,
+		.destroy	= set_match_v1_destroy,
 		.me		= THIS_MODULE
 	},
 	{
 		.name		= "set",
 		.family		= NFPROTO_IPV6,
 		.revision	= 1,
-		.match		= set_match,
-		.matchsize	= sizeof(struct xt_set_info_match),
-		.checkentry	= set_match_checkentry,
-		.destroy	= set_match_destroy,
+		.match		= set_match_v1,
+		.matchsize	= sizeof(struct xt_set_info_match_v1),
+		.checkentry	= set_match_v1_checkentry,
+		.destroy	= set_match_v1_destroy,
 		.me		= THIS_MODULE
 	},
 };
@@ -377,20 +361,40 @@ static struct xt_target set_targets[] __read_mostly = {
 		.name		= "SET",
 		.revision	= 1,
 		.family		= NFPROTO_IPV4,
-		.target		= set_target,
-		.targetsize	= sizeof(struct xt_set_info_target),
-		.checkentry	= set_target_checkentry,
-		.destroy	= set_target_destroy,
+		.target		= set_target_v1,
+		.targetsize	= sizeof(struct xt_set_info_target_v1),
+		.checkentry	= set_target_v1_checkentry,
+		.destroy	= set_target_v1_destroy,
 		.me		= THIS_MODULE
 	},
 	{
 		.name		= "SET",
 		.revision	= 1,
 		.family		= NFPROTO_IPV6,
-		.target		= set_target,
-		.targetsize	= sizeof(struct xt_set_info_target),
-		.checkentry	= set_target_checkentry,
-		.destroy	= set_target_destroy,
+		.target		= set_target_v1,
+		.targetsize	= sizeof(struct xt_set_info_target_v1),
+		.checkentry	= set_target_v1_checkentry,
+		.destroy	= set_target_v1_destroy,
+		.me		= THIS_MODULE
+	},
+	{
+		.name		= "SET",
+		.revision	= 2,
+		.family		= NFPROTO_IPV4,
+		.target		= set_target_v2,
+		.targetsize	= sizeof(struct xt_set_info_target_v2),
+		.checkentry	= set_target_v2_checkentry,
+		.destroy	= set_target_v2_destroy,
+		.me		= THIS_MODULE
+	},
+	{
+		.name		= "SET",
+		.revision	= 2,
+		.family		= NFPROTO_IPV6,
+		.target		= set_target_v2,
+		.targetsize	= sizeof(struct xt_set_info_target_v2),
+		.checkentry	= set_target_v2_checkentry,
+		.destroy	= set_target_v2_destroy,
 		.me		= THIS_MODULE
 	},
 };

extensions/ipset-6/xt_set.h

@@ -1,6 +1,7 @@
 #ifndef _XT_SET_H
 #define _XT_SET_H
 
+#include <linux/types.h>
 #include "ip_set.h"
 
 /* Revision 0 interface: backward compatible with netfilter/iptables */
@@ -34,7 +35,7 @@ struct xt_set_info_target_v0 {
 	struct xt_set_info_v0 del_set;
 };
 
-/* Revision 1: current interface to netfilter/iptables */
+/* Revision 1  match and target */
 
 struct xt_set_info {
 	ip_set_id_t index;
@@ -43,13 +44,22 @@ struct xt_set_info {
 };
 
 /* match and target infos */
-struct xt_set_info_match {
+struct xt_set_info_match_v1 {
 	struct xt_set_info match_set;
 };
 
-struct xt_set_info_target {
+struct xt_set_info_target_v1 {
 	struct xt_set_info add_set;
 	struct xt_set_info del_set;
 };
 
+/* Revision 2 target */
+
+struct xt_set_info_target_v2 {
+	struct xt_set_info add_set;
+	struct xt_set_info del_set;
+	u32 flags;
+	u32 timeout;
+};
+
 #endif /*_XT_SET_H*/

extensions/libxt_SYSRQ.man

@@ -36,6 +36,8 @@ The SYSRQ password can be changed through
 .IP
 echo \-n "password" >/sys/module/xt_SYSRQ/parameters/password
 .PP
+The module will not respond to sysrq requests until a password has been set.
+.PP
 Alternatively, the password may be specified at modprobe time, but this is
 insecure as people can possible see it through ps(1). You can use an option
 line in e.g. /etc/modprobe.d/xt_sysrq if it is properly guarded, that is, only
@@ -52,7 +54,7 @@ The xt_SYSRQ module is normally silent unless a successful request is received,
 but the \fIdebug\fP module parameter can be used to find exactly why a
 seemingly correct request is not being processed.
 .PP
-To trigger SYSRQ from a remote host, just use netcat or socat:
+To trigger SYSRQ from a remote host, just use socat:
 .PP
 .nf
 sysrq_key="s"  # the SysRq key(s)
@@ -60,12 +62,11 @@ password="password"
 seqno="$(date +%s)"
 salt="$(dd bs=12 count=1 if=/dev/urandom 2>/dev/null |
     openssl enc \-base64)"
+ipaddr=10.10.25.7
 req="$sysrq_key,$seqno,$salt"
-req="$req,$(echo \-n "$req,$password" | sha1sum | cut \-c1\-40)"
+req="$req,$(echo \-n "$req,$ipaddr,$password" | sha1sum | cut \-c1\-40)"
 
-echo "$req" | socat stdin udp\-sendto:10.10.25.7:9
-# or
-echo "$req" | netcat \-uw1 10.10.25.7 9
+echo "$req" | socat stdin udp\-sendto:$ipaddr:9
 .fi
 .PP
 See the Linux docs for possible sysrq keys. Important ones are: re(b)oot,
@@ -73,8 +74,10 @@ power(o)ff, (s)ync filesystems, (u)mount and remount readonly. More than one
 sysrq key can be used at once, but bear in mind that, for example, a sync may
 not complete before a subsequent reboot or poweroff.
 .PP
+An IPv4 address should have no leading zeros, an IPv6 address should
+be in the form recommended by RFC 5952.  The debug option will log the
+correct form of the address.
+.PP
 The hashing scheme should be enough to prevent mis-use of SYSRQ in many
 environments, but it is not perfect: take reasonable precautions to
-protect your machines.  Most importantly ensure that each machine has a
-different password; there is scant protection for a SYSRQ packet being
-applied to a machine that happens to have the same password.
+protect your machines.

extensions/libxt_TARPIT.c

@@ -1,34 +1,120 @@
 /*
  *	"TARPIT" target extension to iptables
- *	this file is in the Public Domain
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License; either
+ *	version 2 of the License, or any later version, as published by the
+ *	Free Software Foundation.
  */
+#include <stdbool.h>
+#include <stdint.h>
 #include <stdio.h>
 #include <getopt.h>
+#include <string.h>
 #include <xtables.h>
+#include <linux/netfilter/x_tables.h>
+#include "xt_TARPIT.h"
 #include "compat_user.h"
 
+enum {
+	F_TARPIT   = 1 << 0,
+	F_HONEYPOT = 1 << 1,
+	F_RESET    = 1 << 2,
+};
+
+static const struct option tarpit_tg_opts[] = {
+	{.name = "tarpit",   .has_arg = false, .val = 't'},
+	{.name = "honeypot", .has_arg = false, .val = 'h'},
+	{.name = "reset",    .has_arg = false, .val = 'r'},
+	{NULL},
+};
+
 static void tarpit_tg_help(void)
 {
-	printf("TARPIT takes no options\n\n");
+	printf(
+		"TARPIT target options:\n"
+		"  --tarpit      Enable classic 0-window tarpit (default)\n"
+		"  --honeypot    Enable honeypot option\n"
+		"  --reset       Enable inline resets\n");
 }
 
 static int tarpit_tg_parse(int c, char **argv, int invert, unsigned int *flags,
                            const void *entry, struct xt_entry_target **target)
 {
-	return 0;
+	struct xt_tarpit_tginfo *info = (void *)(*target)->data;
+
+	switch (c) {
+	case 't':
+		info->variant = XTTARPIT_TARPIT;
+		*flags |= F_TARPIT;
+		return true;
+	case 'h':
+		info->variant = XTTARPIT_HONEYPOT;
+		*flags |= F_HONEYPOT;
+		return true;
+	case 'r':
+		info->variant = XTTARPIT_RESET;
+		*flags |= F_RESET;
+		return true;
+	}
+	return false;
 }
 
 static void tarpit_tg_check(unsigned int flags)
 {
+	if (flags == (F_TARPIT | F_HONEYPOT | F_RESET))
+		xtables_error(PARAMETER_PROBLEM,
+			"TARPIT: only one action can be used at a time");
+}
+
+static void tarpit_tg_print(const void *ip,
+    const struct xt_entry_target *target, int numeric)
+{
+	const struct xt_tarpit_tginfo *info = (void *)target->data;
+
+	switch (info->variant) {
+	case XTTARPIT_HONEYPOT:
+		printf(" honeypot mode ");
+		break;
+	case XTTARPIT_RESET:
+		printf(" reset mode ");
+		break;
+	default:
+		printf(" tarpit mode ");
+		break;
+	}
+}
+
+static void tarpit_tg_save(const void *ip,
+    const struct xt_entry_target *target)
+{
+	const struct xt_tarpit_tginfo *info = (const void *)target->data;
+
+	switch (info->variant) {
+	case XTTARPIT_TARPIT:
+		printf(" --tarpit ");
+		break;
+	case XTTARPIT_HONEYPOT:
+		printf(" --honeypot ");
+		break;
+	case XTTARPIT_RESET:
+		printf(" --reset ");
+		break;
+	}
 }
 
 static struct xtables_target tarpit_tg_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "TARPIT",
 	.family        = NFPROTO_IPV4,
+	.size          = XT_ALIGN(sizeof(struct xt_tarpit_tginfo)),
+	.userspacesize = XT_ALIGN(sizeof(struct xt_tarpit_tginfo)),
 	.help          = tarpit_tg_help,
 	.parse         = tarpit_tg_parse,
 	.final_check   = tarpit_tg_check,
+	.print         = tarpit_tg_print,
+	.save          = tarpit_tg_save,
+	.extra_opts    = tarpit_tg_opts,
 };
 
 static __attribute__((constructor)) void tarpit_tg_ldr(void)

extensions/libxt_TARPIT.man

@@ -1,14 +1,38 @@
 Captures and holds incoming TCP connections using no local per-connection
-resources. Connections are accepted, but immediately switched to the persist
-state (0 byte window), in which the remote side stops sending data and asks to
-continue every 60-240 seconds. Attempts to close the connection are ignored,
-forcing the remote side to time out the connection in 12-24 minutes.
-
+resources.
+.PP
+TARPIT only works at the TCP level, and is totally application agnostic. This
+module will answer a TCP request and play along like a listening server, but
+aside from sending an ACK or RST, no data is sent. Incoming packets are ignored
+and dropped. The attacker will terminate the session eventually. This module
+allows the initial packets of an attack to be captured by other software for
+inspection. In most cases this is sufficient to determine the nature of the
+attack.
+.PP
 This offers similar functionality to LaBrea
 <http://www.hackbusters.net/LaBrea/> but does not require dedicated hardware or
 IPs. Any TCP port that you would normally DROP or REJECT can instead become a
 tarpit.
-
+.TP
+\fB\-\-tarpit\fP
+This mode completes a connection with the attacker but limits the window size
+to 0, thus keeping the attacker waiting long periods of time. While he is
+maintaining state of the connection and trying to continue every 60-240
+seconds, we keep none, so it is very lightweight. Attempts to close the
+connection are ignored, forcing the remote side to time out the connection in
+12-24 minutes. This mode is the default.
+.TP
+\fB\-\-honeypot\fP
+This mode completes a connection with the attacker, but signals a normal window
+size, so that the remote side will attempt to send data, often with some very
+nasty exploit attempts. We can capture these packets for decoding and further
+analysis. The module does not send any data, so if the remote expects an
+application level response, the game is up.
+.TP
+\fB\-\-reset\fP
+This mode is handy because we can send an inline RST (reset). It has no other
+function.
+.PP
 To tarpit connections to TCP port 80 destined for the current machine:
 .IP
 \-A INPUT \-p tcp \-m tcp \-\-dport 80 \-j TARPIT
@@ -24,10 +48,12 @@ the Linux box, and add:
 .PP
 NOTE:
 If you use the conntrack module while you are using TARPIT, you should also use
-the NOTRACK target, or the kernel will unnecessarily allocate resources for
-each TARPITted connection. To TARPIT incoming connections to the standard IRC
-port while using conntrack, you could:
+unset tracking on the packet, or the kernel will unnecessarily allocate
+resources for each TARPITted connection. To TARPIT incoming connections to the
+standard IRC port while using conntrack, you could:
 .IP
-\-t raw \-A PREROUTING \-p tcp \-\-dport 6667 \-j NOTRACK
+\-t raw \-A PREROUTING \-p tcp \-\-dport 6667 \-j CT \-\-notrack
+.IP
+\-A INPUT \-p tcp \-\-dport 6667 \-j NFLOG
 .IP
 \-A INPUT \-p tcp \-\-dport 6667 \-j TARPIT

extensions/libxt_ipv4options.man

@@ -21,7 +21,7 @@ Known symbol names (and their number):
 .PP
 4 \(em \fBtimestamp\fP \(em RFC 781, 791
 .PP
-7 \(em \fBrecord\-route\fP \em RFC 791
+7 \(em \fBrecord\-route\fP \(em RFC 791
 .PP
 9 \(em \fBssrr\fP \(em Strict Source Routing, RFC 791
 .PP

extensions/xt_SYSRQ.c

@@ -4,6 +4,8 @@
  *
  *	Based upon the ipt_SYSRQ idea by Marek Zalem <marek [at] terminus sk>
  *
+ *	Security additions John Haxby <john.haxby [at] oracle com>
+ *
  *	This program is free software; you can redistribute it and/or
  *	modify it under the terms of the GNU General Public License
  *	version 2 or 3 as published by the Free Software Foundation.
@@ -58,13 +60,13 @@ static char *sysrq_hexdigest;
  * is a series of sysrq requests; <seqno> is a sequence number that must be
  * greater than the last sequence number; <salt> is some random bytes; and
  * <hash> is the hash of everything up to and including the preceding ","
- * together with the password.
+ * together with "<dstaddr>,<password>".
  *
  * For example
  *
  *   salt=$RANDOM
  *   req="s,$(date +%s),$salt"
- *   echo "$req,$(echo -n $req,secret | sha1sum | cut -c1-40)"
+ *   echo "$req,$(echo -n $req,10.10.25.1,secret | sha1sum | cut -c1-40)"
  *
  * You will want a better salt and password than that though :-)
  */
@@ -121,7 +123,6 @@ static unsigned int sysrq_tg(const void *pdata, uint16_t len)
 	sg_init_table(sg, 2);
 #endif
 	sg_set_buf(&sg[0], data, n);
-	strcpy(sysrq_digest_password, sysrq_password);
 	i = strlen(sysrq_digest_password);
 	sg_set_buf(&sg[1], sysrq_digest_password, i);
 	ret = crypto_hash_digest(&desc, sg, n + i, sysrq_digest);
@@ -223,6 +224,8 @@ sysrq_tg4(struct sk_buff **pskb, const struct xt_action_param *par)
 		       ": " NIPQUAD_FMT ":%u -> :%u len=%u\n",
 		       NIPQUAD(iph->saddr), htons(udph->source),
 		       htons(udph->dest), len);
+	sprintf(sysrq_digest_password, NIPQUAD_FMT ",%s",
+	        NIPQUAD(iph->daddr), sysrq_password);
 	return sysrq_tg((void *)udph + sizeof(struct udphdr), len);
 }
 
@@ -253,7 +256,9 @@ sysrq_tg6(struct sk_buff **pskb, const struct xt_action_param *par)
 		       ": " NIP6_FMT ":%hu -> :%hu len=%u\n",
 		       NIP6(iph->saddr), ntohs(udph->source),
 		       ntohs(udph->dest), len);
-	return sysrq_tg(udph + sizeof(struct udphdr), len);
+	sprintf(sysrq_digest_password, NIP6_FMT ",%s",
+	        NIP6(iph->daddr), sysrq_password);
+	return sysrq_tg((void *)udph + sizeof(struct udphdr), len);
 }
 #endif
 
@@ -340,7 +345,9 @@ static int __init sysrq_crypto_init(void)
 	sysrq_hexdigest = kmalloc(2 * sysrq_digest_size + 1, GFP_KERNEL);
 	if (sysrq_hexdigest == NULL)
 		goto fail;
-	sysrq_digest_password = kmalloc(sizeof(sysrq_password), GFP_KERNEL);
+	sysrq_digest_password =
+	    kmalloc(sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:255.255.255.255") +
+		    sizeof(sysrq_password), GFP_KERNEL);
 	if (sysrq_digest_password == NULL)
 		goto fail;
 	do_gettimeofday(&now);
@@ -376,6 +383,7 @@ module_init(sysrq_tg_init);
 module_exit(sysrq_tg_exit);
 MODULE_DESCRIPTION("Xtables: triggering SYSRQ remotely");
 MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
+MODULE_AUTHOR("John Haxby <john.haxby@oracle.com");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ipt_SYSRQ");
 MODULE_ALIAS("ip6t_SYSRQ");

extensions/xt_TARPIT.Kconfig

@@ -13,4 +13,10 @@ config NETFILTER_XT_TARGET_TARPIT
 	This offers similar functionality to LaBrea
 	<http://www.hackbusters.net/LaBrea/>, but does not require dedicated
 	hardware or IPs. Any TCP port that you would normally DROP or REJECT
-	can instead become a tar pit.
+	can instead become a tar pit or honeypot. All 3 modes may be used
+	in iptables rules interchangably and simultaneously.
+
+	A honeypot option is available which will answer connections normally
+	and allow the remote to send data packets that may be captured in a
+	pcap for later analysis. A reset mode is also available that will only
+	send an inline reset (RST).

extensions/xt_TARPIT.c

@@ -48,14 +48,17 @@
 #include <net/route.h>
 #include <net/tcp.h>
 #include "compat_xtables.h"
+#include "xt_TARPIT.h"
 
-static void tarpit_tcp(struct sk_buff *oldskb, unsigned int hook)
+static void tarpit_tcp(struct sk_buff *oldskb, unsigned int hook,
+    unsigned int mode)
 {
 	struct tcphdr _otcph, *oth, *tcph;
 	unsigned int addr_type = RTN_UNSPEC;
 	struct sk_buff *nskb;
+	const struct iphdr *oldhdr;
 	struct iphdr *niph;
-	u_int16_t tmp;
+	uint16_t tmp, payload;
 
 	/* A truncated TCP header is not going to be useful */
 	if (oldskb->len < ip_hdrlen(oldskb) + sizeof(struct tcphdr))
@@ -66,17 +69,6 @@ static void tarpit_tcp(struct sk_buff *oldskb, unsigned int hook)
 	if (oth == NULL)
 		return;
 
-	/* No replies for RST, FIN or !SYN,!ACK */
-	if (oth->rst || oth->fin || (!oth->syn && !oth->ack))
-		return;
-
-	/* Rate-limit replies to !SYN,ACKs */
-#if 0
-	if (!oth->syn && oth->ack)
-		if (!xrlim_allow(rt_dst(ort), HZ))
-			return;
-#endif
-
 	/* Check checksum. */
 	if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP))
 		return;
@@ -102,6 +94,7 @@ static void tarpit_tcp(struct sk_buff *oldskb, unsigned int hook)
 	skb_shinfo(nskb)->gso_type = 0;
 #endif
 
+	oldhdr = ip_hdr(oldskb);
 	tcph = (struct tcphdr *)(skb_network_header(nskb) + ip_hdrlen(nskb));
 
 	/* Swap source and dest */
@@ -111,29 +104,95 @@ static void tarpit_tcp(struct sk_buff *oldskb, unsigned int hook)
 	tcph->source = tcph->dest;
 	tcph->dest   = tmp;
 
+	/* Calculate payload size?? */
+	payload = nskb->len - ip_hdrlen(nskb) - sizeof(struct tcphdr);
+
 	/* Truncate to length (no data) */
 	tcph->doff    = sizeof(struct tcphdr) / 4;
 	skb_trim(nskb, ip_hdrlen(nskb) + sizeof(struct tcphdr));
 	niph->tot_len = htons(nskb->len);
+	tcph->urg_ptr = 0;
+	/* Reset flags */
+	((u_int8_t *)tcph)[13] = 0;
 
-	/* Use supplied sequence number or make a new one */
+	if (mode == XTTARPIT_TARPIT) {
+		/* No replies for RST, FIN or !SYN,!ACK */
+		if (oth->rst || oth->fin || (!oth->syn && !oth->ack))
+			return;
 		tcph->seq = oth->ack ? oth->ack_seq : 0;
 
 		/* Our SYN-ACKs must have a >0 window */
 		tcph->window  = (oth->syn && !oth->ack) ? htons(5) : 0;
-	tcph->urg_ptr = 0;
-
-	/* Reset flags */
-	((u_int8_t *)tcph)[13] = 0;
-
 		if (oth->syn && oth->ack) {
 			tcph->rst     = true;
 			tcph->ack_seq = false;
 		} else {
 			tcph->syn     = oth->syn;
-		tcph->ack     = 1;
+			tcph->ack     = true;
 			tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn);
 		}
+#if 0
+		/* Rate-limit replies to !SYN,ACKs */
+		if (!oth->syn && oth->ack)
+			if (!xrlim_allow(rt_dst(ort), HZ))
+				return;
+#endif
+	} else if (mode == XTTARPIT_HONEYPOT) {
+		/* Do not answer any resets regardless of combination */
+		if (oth->rst || oth->seq == 0xDEADBEEF)
+			return;
+		/* Send a reset to scanners. They like that. */
+		if (oth->syn && oth->ack) {
+			tcph->window  = 0;
+			tcph->ack     = false;
+			tcph->psh     = true;
+			tcph->ack_seq = 0xdeadbeef; /* see if they ack it */
+			tcph->seq     = oth->ack_seq;
+			tcph->rst     = true;
+		}
+
+		/* SYN > SYN-ACK */
+		if (oth->syn && !oth->ack) {
+			tcph->syn     = true;
+			tcph->ack     = true;
+			tcph->window  = oth->window &
+			                ((net_random() & 0x1f) - 0xf);
+			tcph->seq     = htonl(net_random() & ~oth->seq);
+			tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn);
+		}
+
+		/* ACK > ACK */
+		if (oth->ack && (!(oth->fin || oth->syn))) {
+			tcph->syn     = false;
+			tcph->ack     = true;
+			tcph->window  = oth->window &
+			                ((net_random() & 0x1f) - 0xf);
+			tcph->ack_seq = payload > 100 ?
+			                htonl(ntohl(oth->seq) + payload) :
+			                oth->seq;
+			tcph->seq     = oth->ack_seq;
+		}
+
+		/*
+		 * FIN > RST.
+		 * We cannot terminate gracefully so just be abrupt.
+		 */
+		if (oth->fin) {
+			tcph->window  = 0;
+			tcph->seq     = oth->ack_seq;
+			tcph->ack_seq = oth->ack_seq;
+			tcph->fin     = false;
+			tcph->ack     = false;
+			tcph->rst     = true;
+		}
+	} else if (mode == XTTARPIT_RESET) {
+		tcph->window  = 0;
+		tcph->ack     = false;
+		tcph->syn     = false;
+		tcph->rst     = true;
+		tcph->seq     = oth->ack_seq;
+		tcph->ack_seq = oth->seq;
+	}
 
 	/* Adjust TCP checksum */
 	tcph->check = 0;
@@ -149,7 +208,10 @@ static void tarpit_tcp(struct sk_buff *oldskb, unsigned int hook)
 
 	/* Set DF, id = 0 */
 	niph->frag_off = htons(IP_DF);
+	if (mode == XTTARPIT_TARPIT || mode == XTTARPIT_RESET)
 		niph->id = 0;
+	else if (mode == XTTARPIT_HONEYPOT)
+		niph->id = ~oldhdr->id + 1;
 
 #ifdef CONFIG_BRIDGE_NETFILTER
 	if (hook != NF_INET_FORWARD || (nskb->nf_bridge != NULL &&
@@ -167,6 +229,9 @@ static void tarpit_tcp(struct sk_buff *oldskb, unsigned int hook)
 	nskb->ip_summed = CHECKSUM_NONE;
 
 	/* Adjust IP TTL */
+	if (mode == XTTARPIT_HONEYPOT)
+		niph->ttl = 128;
+	else
 		niph->ttl = dst_metric(skb_dst(nskb), RTAX_HOPLIMIT);
 
 	/* Adjust IP checksum */
@@ -193,6 +258,7 @@ tarpit_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 	const struct sk_buff *skb = *pskb;
 	const struct iphdr *iph = ip_hdr(skb);
 	const struct rtable *rt = skb_rtable(skb);
+	const struct xt_tarpit_tginfo *info = par->targinfo;
 
 	/* Do we have an input route cache entry? (Not in PREROUTING.) */
 	if (rt == NULL)
@@ -218,7 +284,7 @@ tarpit_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 	if (iph->frag_off & htons(IP_OFFSET))
 		return NF_DROP;
 
-	tarpit_tcp(*pskb, par->hooknum);
+	tarpit_tcp(*pskb, par->hooknum, info->variant);
 	return NF_DROP;
 }
 
@@ -226,10 +292,10 @@ static struct xt_target tarpit_tg_reg __read_mostly = {
 	.name       = "TARPIT",
 	.revision   = 0,
 	.family     = NFPROTO_IPV4,
-	.table  = "filter",
 	.hooks      = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),
 	.proto      = IPPROTO_TCP,
 	.target     = tarpit_tg,
+	.targetsize = sizeof(struct xt_tarpit_tginfo),
 	.me         = THIS_MODULE,
 };
 

extensions/xt_TARPIT.h

@@ -0,0 +1,14 @@
+#ifndef _LINUX_NETFILTER_XT_TARPIT_H
+#define _LINUX_NETFILTER_XT_TARPIT_H 1
+
+enum xt_tarpit_target_variant {
+	XTTARPIT_TARPIT,
+	XTTARPIT_HONEYPOT,
+	XTTARPIT_RESET,
+};
+
+struct xt_tarpit_tginfo {
+	uint8_t variant;
+};
+
+#endif /* _LINUX_NETFILTER_XT_TARPIT_H */

extensions/xt_geoip.c

@@ -167,6 +167,7 @@ static bool geoip_bsearch6(const struct geoip_subnet6 *range,
 {
 	int mid;
 
+	while (true) {
 		if (hi <= lo)
 			return false;
 		mid = (lo + hi) / 2;
@@ -174,9 +175,12 @@ static bool geoip_bsearch6(const struct geoip_subnet6 *range,
 		    ipv6_cmp(addr, &range[mid].end) <= 0)
 			return true;
 		if (ipv6_cmp(&range[mid].begin, addr) > 0)
-		return geoip_bsearch6(range, addr, lo, mid);
+			hi = mid;
 		else if (ipv6_cmp(&range[mid].end, addr) < 0)
-		return geoip_bsearch6(range, addr, mid + 1, hi);
+			lo = mid + 1;
+		else
+			break;
+	}
 
 	WARN_ON(true);
 	return false;
@@ -218,15 +222,19 @@ static bool geoip_bsearch4(const struct geoip_subnet4 *range,
 {
 	int mid;
 
+	while (true) {
 		if (hi <= lo)
 			return false;
 		mid = (lo + hi) / 2;
 		if (range[mid].begin <= addr && addr <= range[mid].end)
 			return true;
 		if (range[mid].begin > addr)
-		return geoip_bsearch4(range, addr, lo, mid);
+			hi = mid;
 		else if (range[mid].end < addr)
-		return geoip_bsearch4(range, addr, mid + 1, hi);
+			lo = mid + 1;
+		else
+			break;
+	}
 
 	WARN_ON(true);
 	return false;

mconfig

@@ -21,7 +21,7 @@ build_gradm=m
 build_iface=m
 build_ipp2p=m
 build_ipset4=m
-build_ipset5=
+build_ipset6=
 build_ipv4options=m
 build_length2=m
 build_lscan=m

xtables-addons.8.in

@@ -1,12 +1,12 @@
-.TH xtables-addons 8 "v1.32 (2011-01-04)" "" "v1.32 (2011-01-04)"
+.TH xtables-addons 8 "v1.37 (2011-06-25)" "" "v1.37 (2011-06-25)"
 .SH Name
 Xtables-addons \(em additional extensions for iptables, ip6tables, etc.
 .SH Targets
 .\" @TARGET@
 .SH Matches
 .\" @MATCHES@
-.SH "SEE ALSO"
-\fBiptables\fP(8), \fBip6tables\fP(8)
+.SH "See also"
+\fBiptables\fP(8), \fBip6tables\fP(8), \fBiptaccount\fP(8)
 .PP
 For developers, the book "Writing Netfilter modules" at
 http://jengelh.medozas.de/documents/Netfilter_Modules.pdf provides detailed