ip_set_core.c source code [linux/net/netfilter/ipset/ip_set_core.c]

1	// SPDX-License-Identifier: GPL-2.0-only
2	/ Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>*
3	* Patrick Schaaf <bof@bof.de>
4	* Copyright (C) 2003-2013 Jozsef Kadlecsik <kadlec@netfilter.org>
5	*/
6
7	/ Kernel module for IP set management /
8
9	#include <linux/init.h>
10	#include <linux/module.h>
11	#include <linux/moduleparam.h>
12	#include <linux/ip.h>
13	#include <linux/skbuff.h>
14	#include <linux/spinlock.h>
15	#include <linux/rculist.h>
16	#include <net/netlink.h>
17	#include <net/net_namespace.h>
18	#include <net/netns/generic.h>
19
20	#include <linux/netfilter.h>
21	#include <linux/netfilter/x_tables.h>
22	#include <linux/netfilter/nfnetlink.h>
23	#include <linux/netfilter/ipset/ip_set.h>
24
25	static LIST_HEAD(ip_set_type_list); / all registered set types /
26	static DEFINE_MUTEX(ip_set_type_mutex); / protects ip_set_type_list /
27	static DEFINE_RWLOCK(ip_set_ref_lock); / protects the set refs /
28
29	struct ip_set_net {
30	struct ip_set * __rcu ip_set_list; /* all individual sets /
31	ip_set_id_t ip_set_max; / max number of sets /
32	bool is_deleted; / deleted by ip_set_net_exit /
33	bool is_destroyed; / all sets are destroyed /
34	};
35
36	static unsigned int ip_set_net_id __read_mostly;
37
38	static struct ip_set_net ip_set_pernet(struct* net *net)
39	{
40	return net_generic(net, id: ip_set_net_id);
41	}
42
43	#define IP_SET_INC 64
44	#define STRNCMP(a, b) (strncmp(a, b, IPSET_MAXNAMELEN) == 0)
45
46	static unsigned int max_sets;
47
48	module_param(max_sets, int, `0600`);
49	MODULE_PARM_DESC(max_sets, "maximal number of sets");
50	MODULE_LICENSE("GPL");
51	MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@netfilter.org>");
52	MODULE_DESCRIPTION("core IP set support");
53	MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);
54
55	/ When the nfnl mutex or ip_set_ref_lock is held: /
56	#define ip_set_dereference(p) \
57	rcu_dereference_protected(p, \
58	lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) \|\| \
59	lockdep_is_held(&ip_set_ref_lock))
60	#define ip_set(inst, id) \
61	ip_set_dereference((inst)->ip_set_list)[id]
62	#define ip_set_ref_netlink(inst,id) \
63	rcu_dereference_raw((inst)->ip_set_list)[id]
64	#define ip_set_dereference_nfnl(p) \
65	rcu_dereference_check(p, lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET))
66
67	/ The set types are implemented in modules and registered set types*
68	* can be found in ip_set_type_list. Adding/deleting types is
69	* serialized by ip_set_type_mutex.
70	*/
71
72	static void
73	ip_set_type_lock(void)
74	{
75	mutex_lock(&ip_set_type_mutex);
76	}
77
78	static void
79	ip_set_type_unlock(void)
80	{
81	mutex_unlock(lock: &ip_set_type_mutex);
82	}
83
84	/ Register and deregister settype /
85
86	static struct ip_set_type *
87	find_set_type(const char *name, u8 family, u8 revision)
88	{
89	struct ip_set_type *type;
90
91	list_for_each_entry_rcu(type, &ip_set_type_list, list,
92	lockdep_is_held(&ip_set_type_mutex))
93	if (STRNCMP(type->name, name) &&
94	(type->family == family \|\|
95	type->family == NFPROTO_UNSPEC) &&
96	revision >= type->revision_min &&
97	revision <= type->revision_max)
98	return type;
99	return NULL;
100	}
101
102	/ Unlock, try to load a set type module and lock again /
103	static bool
104	load_settype(const char *name)
105	{
106	nfnl_unlock(NFNL_SUBSYS_IPSET);
107	pr_debug("try to load ip_set_%s\n", name);
108	if (request_module("ip_set_%s", name) < `0`) {
109	pr_warn("Can't find ip_set type %s\n", name);
110	nfnl_lock(NFNL_SUBSYS_IPSET);
111	return false;
112	}
113	nfnl_lock(NFNL_SUBSYS_IPSET);
114	return true;
115	}
116
117	/ Find a set type and reference it /
118	#define find_set_type_get(name, family, revision, found) \
119	__find_set_type_get(name, family, revision, found, false)
120
121	static int
122	__find_set_type_get(const char *name, u8 family, u8 revision,
123	struct ip_set_type **found, bool retry)
124	{
125	struct ip_set_type *type;
126	int err;
127
128	if (retry && !load_settype(name))
129	return -IPSET_ERR_FIND_TYPE;
130
131	rcu_read_lock();
132	*found = find_set_type(name, family, revision);
133	if (*found) {
134	err = !try_module_get(module: (*found)->me) ? -EFAULT : `0`;
135	goto unlock;
136	}
137	/ Make sure the type is already loaded*
138	* but we don't support the revision
139	*/
140	list_for_each_entry_rcu(type, &ip_set_type_list, list)
141	if (STRNCMP(type->name, name)) {
142	err = -IPSET_ERR_FIND_TYPE;
143	goto unlock;
144	}
145	rcu_read_unlock();
146
147	return retry ? -IPSET_ERR_FIND_TYPE :
148	__find_set_type_get(name, family, revision, found, retry: true);
149
150	unlock:
151	rcu_read_unlock();
152	return err;
153	}
154
155	/ Find a given set type by name and family.*
156	* If we succeeded, the supported minimal and maximum revisions are
157	* filled out.
158	*/
159	#define find_set_type_minmax(name, family, min, max) \
160	__find_set_type_minmax(name, family, min, max, false)
161
162	static int
163	__find_set_type_minmax(const char name, u8 family, u8 min, u8 *max,
164	bool retry)
165	{
166	struct ip_set_type *type;
167	bool found = false;
168
169	if (retry && !load_settype(name))
170	return -IPSET_ERR_FIND_TYPE;
171
172	min = `255`; max = `0`;
173	rcu_read_lock();
174	list_for_each_entry_rcu(type, &ip_set_type_list, list)
175	if (STRNCMP(type->name, name) &&
176	(type->family == family \|\|
177	type->family == NFPROTO_UNSPEC)) {
178	found = true;
179	if (type->revision_min < *min)
180	*min = type->revision_min;
181	if (type->revision_max > *max)
182	*max = type->revision_max;
183	}
184	rcu_read_unlock();
185	if (found)
186	return `0`;
187
188	return retry ? -IPSET_ERR_FIND_TYPE :
189	__find_set_type_minmax(name, family, min, max, retry: true);
190	}
191
192	#define family_name(f) ((f) == NFPROTO_IPV4 ? "inet" : \
193	(f) == NFPROTO_IPV6 ? "inet6" : "any")
194
195	/ Register a set type structure. The type is identified by*
196	* the unique triple of name, family and revision.
197	*/
198	int
199	ip_set_type_register(struct ip_set_type *type)
200	{
201	int ret = `0`;
202
203	if (type->protocol != IPSET_PROTOCOL) {
204	pr_warn("ip_set type %s, family %s, revision %u:%u uses wrong protocol version %u (want %u)\n",
205	type->name, family_name(type->family),
206	type->revision_min, type->revision_max,
207	type->protocol, IPSET_PROTOCOL);
208	return -EINVAL;
209	}
210
211	ip_set_type_lock();
212	if (find_set_type(name: type->name, family: type->family, revision: type->revision_min)) {
213	/ Duplicate! /
214	pr_warn("ip_set type %s, family %s with revision min %u already registered!\n",
215	type->name, family_name(type->family),
216	type->revision_min);
217	ip_set_type_unlock();
218	return -EINVAL;
219	}
220	list_add_rcu(new: &type->list, head: &ip_set_type_list);
221	pr_debug("type %s, family %s, revision %u:%u registered.\n",
222	type->name, family_name(type->family),
223	type->revision_min, type->revision_max);
224	ip_set_type_unlock();
225
226	return ret;
227	}
228	EXPORT_SYMBOL_GPL(ip_set_type_register);
229
230	/ Unregister a set type. There's a small race with ip_set_create /
231	void
232	ip_set_type_unregister(struct ip_set_type *type)
233	{
234	ip_set_type_lock();
235	if (!find_set_type(name: type->name, family: type->family, revision: type->revision_min)) {
236	pr_warn("ip_set type %s, family %s with revision min %u not registered\n",
237	type->name, family_name(type->family),
238	type->revision_min);
239	ip_set_type_unlock();
240	return;
241	}
242	list_del_rcu(entry: &type->list);
243	pr_debug("type %s, family %s with revision min %u unregistered.\n",
244	type->name, family_name(type->family), type->revision_min);
245	ip_set_type_unlock();
246
247	synchronize_rcu();
248	}
249	EXPORT_SYMBOL_GPL(ip_set_type_unregister);
250
251	/ Utility functions /
252	void *
253	ip_set_alloc(size_t size)
254	{
255	return kvzalloc(size, GFP_KERNEL_ACCOUNT);
256	}
257	EXPORT_SYMBOL_GPL(ip_set_alloc);
258
259	void
260	ip_set_free(void *members)
261	{
262	pr_debug("%p: free with %s\n", members,
263	is_vmalloc_addr(members) ? "vfree" : "kfree");
264	kvfree(addr: members);
265	}
266	EXPORT_SYMBOL_GPL(ip_set_free);
267
268	static bool
269	flag_nested(const struct nlattr *nla)
270	{
271	return nla->nla_type & NLA_F_NESTED;
272	}
273
274	static const struct nla_policy ipaddr_policy[IPSET_ATTR_IPADDR_MAX + `1`] = {
275	[IPSET_ATTR_IPADDR_IPV4] = { .type = NLA_U32 },
276	[IPSET_ATTR_IPADDR_IPV6] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
277	};
278
279	int
280	ip_set_get_ipaddr4(struct nlattr nla, __be32 ipaddr)
281	{
282	struct nlattr *tb[IPSET_ATTR_IPADDR_MAX + `1`];
283
284	if (unlikely(!flag_nested(nla)))
285	return -IPSET_ERR_PROTOCOL;
286	if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla,
287	policy: ipaddr_policy, NULL))
288	return -IPSET_ERR_PROTOCOL;
289	if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV4)))
290	return -IPSET_ERR_PROTOCOL;
291
292	*ipaddr = nla_get_be32(nla: tb[IPSET_ATTR_IPADDR_IPV4]);
293	return `0`;
294	}
295	EXPORT_SYMBOL_GPL(ip_set_get_ipaddr4);
296
297	int
298	ip_set_get_ipaddr6(struct nlattr nla, union* nf_inet_addr *ipaddr)
299	{
300	struct nlattr *tb[IPSET_ATTR_IPADDR_MAX + `1`];
301
302	if (unlikely(!flag_nested(nla)))
303	return -IPSET_ERR_PROTOCOL;
304
305	if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla,
306	policy: ipaddr_policy, NULL))
307	return -IPSET_ERR_PROTOCOL;
308	if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV6)))
309	return -IPSET_ERR_PROTOCOL;
310
311	memcpy(ipaddr, nla_data(tb[IPSET_ATTR_IPADDR_IPV6]),
312	sizeof(struct in6_addr));
313	return `0`;
314	}
315	EXPORT_SYMBOL_GPL(ip_set_get_ipaddr6);
316
317	static u32
318	ip_set_timeout_get(const unsigned long *timeout)
319	{
320	u32 t;
321
322	if (*timeout == IPSET_ELEM_PERMANENT)
323	return `0`;
324
325	t = jiffies_to_msecs(j: *timeout - jiffies) / MSEC_PER_SEC;
326	/ Zero value in userspace means no timeout /
327	return t == `0` ? `1` : t;
328	}
329
330	static char *
331	ip_set_comment_uget(struct nlattr *tb)
332	{
333	return nla_data(nla: tb);
334	}
335
336	/ Called from uadd only, protected by the set spinlock.*
337	* The kadt functions don't use the comment extensions in any way.
338	*/
339	void
340	ip_set_init_comment(struct ip_set set, struct* ip_set_comment *comment,
341	const struct ip_set_ext *ext)
342	{
343	struct ip_set_comment_rcu *c = rcu_dereference_protected(comment->c, `1`);
344	size_t len = ext->comment ? strlen(ext->comment) : `0`;
345
346	if (unlikely(c)) {
347	set->ext_size -= sizeof(*c) + strlen(c->str) + `1`;
348	kfree_rcu(c, rcu);
349	rcu_assign_pointer(comment->c, NULL);
350	}
351	if (!len)
352	return;
353	if (unlikely(len > IPSET_MAX_COMMENT_SIZE))
354	len = IPSET_MAX_COMMENT_SIZE;
355	c = kmalloc(size: sizeof(*c) + len + `1`, GFP_ATOMIC);
356	if (unlikely(!c))
357	return;
358	strscpy(c->str, ext->comment, len + `1`);
359	set->ext_size += sizeof(*c) + strlen(c->str) + `1`;
360	rcu_assign_pointer(comment->c, c);
361	}
362	EXPORT_SYMBOL_GPL(ip_set_init_comment);
363
364	/ Used only when dumping a set, protected by rcu_read_lock() /
365	static int
366	ip_set_put_comment(struct sk_buff skb, const* struct ip_set_comment *comment)
367	{
368	struct ip_set_comment_rcu *c = rcu_dereference(comment->c);
369
370	if (!c)
371	return `0`;
372	return nla_put_string(skb, attrtype: IPSET_ATTR_COMMENT, str: c->str);
373	}
374
375	/ Called from uadd/udel, flush or the garbage collectors protected*
376	* by the set spinlock.
377	* Called when the set is destroyed and when there can't be any user
378	* of the set data anymore.
379	*/
380	static void
381	ip_set_comment_free(struct ip_set set, void* *ptr)
382	{
383	struct ip_set_comment *comment = ptr;
384	struct ip_set_comment_rcu *c;
385
386	c = rcu_dereference_protected(comment->c, `1`);
387	if (unlikely(!c))
388	return;
389	set->ext_size -= sizeof(*c) + strlen(c->str) + `1`;
390	kfree_rcu(c, rcu);
391	rcu_assign_pointer(comment->c, NULL);
392	}
393
394	typedef void (destroyer)(struct* ip_set , void* *);
395	/ ipset data extension types, in size order /
396
397	const struct ip_set_ext_type ip_set_extensions[] = {
398	[IPSET_EXT_ID_COUNTER] = {
399	.type = IPSET_EXT_COUNTER,
400	.flag = IPSET_FLAG_WITH_COUNTERS,
401	.len = sizeof(struct ip_set_counter),
402	.align = __alignof__(struct ip_set_counter),
403	},
404	[IPSET_EXT_ID_TIMEOUT] = {
405	.type = IPSET_EXT_TIMEOUT,
406	.len = sizeof(unsigned long),
407	.align = __alignof__(unsigned long),
408	},
409	[IPSET_EXT_ID_SKBINFO] = {
410	.type = IPSET_EXT_SKBINFO,
411	.flag = IPSET_FLAG_WITH_SKBINFO,
412	.len = sizeof(struct ip_set_skbinfo),
413	.align = __alignof__(struct ip_set_skbinfo),
414	},
415	[IPSET_EXT_ID_COMMENT] = {
416	.type = IPSET_EXT_COMMENT \| IPSET_EXT_DESTROY,
417	.flag = IPSET_FLAG_WITH_COMMENT,
418	.len = sizeof(struct ip_set_comment),
419	.align = __alignof__(struct ip_set_comment),
420	.destroy = ip_set_comment_free,
421	},
422	};
423	EXPORT_SYMBOL_GPL(ip_set_extensions);
424
425	static bool
426	add_extension(enum ip_set_ext_id id, u32 flags, struct nlattr *tb[])
427	{
428	return ip_set_extensions[id].flag ?
429	(flags & ip_set_extensions[id].flag) :
430	!!tb[IPSET_ATTR_TIMEOUT];
431	}
432
433	size_t
434	ip_set_elem_len(struct ip_set set, struct* nlattr *tb[], size_t len,
435	size_t align)
436	{
437	enum ip_set_ext_id id;
438	u32 cadt_flags = `0`;
439
440	if (tb[IPSET_ATTR_CADT_FLAGS])
441	cadt_flags = ip_set_get_h32(attr: tb[IPSET_ATTR_CADT_FLAGS]);
442	if (cadt_flags & IPSET_FLAG_WITH_FORCEADD)
443	set->flags \|= IPSET_CREATE_FLAG_FORCEADD;
444	if (!align)
445	align = `1`;
446	for (id = `0`; id < IPSET_EXT_ID_MAX; id++) {
447	if (!add_extension(id, flags: cadt_flags, tb))
448	continue;
449	if (align < ip_set_extensions[id].align)
450	align = ip_set_extensions[id].align;
451	len = ALIGN(len, ip_set_extensions[id].align);
452	set->offset[id] = len;
453	set->extensions \|= ip_set_extensions[id].type;
454	len += ip_set_extensions[id].len;
455	}
456	return ALIGN(len, align);
457	}
458	EXPORT_SYMBOL_GPL(ip_set_elem_len);
459
460	int
461	ip_set_get_extensions(struct ip_set set, struct* nlattr *tb[],
462	struct ip_set_ext *ext)
463	{
464	u64 fullmark;
465
466	if (unlikely(!ip_set_optattr_netorder(tb, IPSET_ATTR_TIMEOUT) \|\|
467	!ip_set_optattr_netorder(tb, IPSET_ATTR_PACKETS) \|\|
468	!ip_set_optattr_netorder(tb, IPSET_ATTR_BYTES) \|\|
469	!ip_set_optattr_netorder(tb, IPSET_ATTR_SKBMARK) \|\|
470	!ip_set_optattr_netorder(tb, IPSET_ATTR_SKBPRIO) \|\|
471	!ip_set_optattr_netorder(tb, IPSET_ATTR_SKBQUEUE)))
472	return -IPSET_ERR_PROTOCOL;
473
474	if (tb[IPSET_ATTR_TIMEOUT]) {
475	if (!SET_WITH_TIMEOUT(set))
476	return -IPSET_ERR_TIMEOUT;
477	ext->timeout = ip_set_timeout_uget(tb: tb[IPSET_ATTR_TIMEOUT]);
478	}
479	if (tb[IPSET_ATTR_BYTES] \|\| tb[IPSET_ATTR_PACKETS]) {
480	if (!SET_WITH_COUNTER(set))
481	return -IPSET_ERR_COUNTER;
482	if (tb[IPSET_ATTR_BYTES])
483	ext->bytes = be64_to_cpu(nla_get_be64(
484	tb[IPSET_ATTR_BYTES]));
485	if (tb[IPSET_ATTR_PACKETS])
486	ext->packets = be64_to_cpu(nla_get_be64(
487	tb[IPSET_ATTR_PACKETS]));
488	}
489	if (tb[IPSET_ATTR_COMMENT]) {
490	if (!SET_WITH_COMMENT(set))
491	return -IPSET_ERR_COMMENT;
492	ext->comment = ip_set_comment_uget(tb: tb[IPSET_ATTR_COMMENT]);
493	}
494	if (tb[IPSET_ATTR_SKBMARK]) {
495	if (!SET_WITH_SKBINFO(set))
496	return -IPSET_ERR_SKBINFO;
497	fullmark = be64_to_cpu(nla_get_be64(tb[IPSET_ATTR_SKBMARK]));
498	ext->skbinfo.skbmark = fullmark >> `32`;
499	ext->skbinfo.skbmarkmask = fullmark & `0xffffffff`;
500	}
501	if (tb[IPSET_ATTR_SKBPRIO]) {
502	if (!SET_WITH_SKBINFO(set))
503	return -IPSET_ERR_SKBINFO;
504	ext->skbinfo.skbprio =
505	be32_to_cpu(nla_get_be32(tb[IPSET_ATTR_SKBPRIO]));
506	}
507	if (tb[IPSET_ATTR_SKBQUEUE]) {
508	if (!SET_WITH_SKBINFO(set))
509	return -IPSET_ERR_SKBINFO;
510	ext->skbinfo.skbqueue =
511	be16_to_cpu(nla_get_be16(tb[IPSET_ATTR_SKBQUEUE]));
512	}
513	return `0`;
514	}
515	EXPORT_SYMBOL_GPL(ip_set_get_extensions);
516
517	static u64
518	ip_set_get_bytes(const struct ip_set_counter *counter)
519	{
520	return (u64)atomic64_read(v: &(counter)->bytes);
521	}
522
523	static u64
524	ip_set_get_packets(const struct ip_set_counter *counter)
525	{
526	return (u64)atomic64_read(v: &(counter)->packets);
527	}
528
529	static bool
530	ip_set_put_counter(struct sk_buff skb, const* struct ip_set_counter *counter)
531	{
532	return nla_put_net64(skb, attrtype: IPSET_ATTR_BYTES,
533	cpu_to_be64(ip_set_get_bytes(counter)),
534	padattr: IPSET_ATTR_PAD) \|\|
535	nla_put_net64(skb, attrtype: IPSET_ATTR_PACKETS,
536	cpu_to_be64(ip_set_get_packets(counter)),
537	padattr: IPSET_ATTR_PAD);
538	}
539
540	static bool
541	ip_set_put_skbinfo(struct sk_buff skb, const* struct ip_set_skbinfo *skbinfo)
542	{
543	/ Send nonzero parameters only /
544	return ((skbinfo->skbmark \|\| skbinfo->skbmarkmask) &&
545	nla_put_net64(skb, attrtype: IPSET_ATTR_SKBMARK,
546	cpu_to_be64((u64)skbinfo->skbmark << `32` \|
547	skbinfo->skbmarkmask),
548	padattr: IPSET_ATTR_PAD)) \|\|
549	(skbinfo->skbprio &&
550	nla_put_net32(skb, attrtype: IPSET_ATTR_SKBPRIO,
551	cpu_to_be32(skbinfo->skbprio))) \|\|
552	(skbinfo->skbqueue &&
553	nla_put_net16(skb, attrtype: IPSET_ATTR_SKBQUEUE,
554	cpu_to_be16(skbinfo->skbqueue)));
555	}
556
557	int
558	ip_set_put_extensions(struct sk_buff skb, const* struct ip_set *set,
559	const void *e, bool active)
560	{
561	if (SET_WITH_TIMEOUT(set)) {
562	unsigned long *timeout = ext_timeout(e, set);
563
564	if (nla_put_net32(skb, attrtype: IPSET_ATTR_TIMEOUT,
565	htonl(active ? ip_set_timeout_get(timeout)
566	: *timeout)))
567	return -EMSGSIZE;
568	}
569	if (SET_WITH_COUNTER(set) &&
570	ip_set_put_counter(skb, ext_counter(e, set)))
571	return -EMSGSIZE;
572	if (SET_WITH_COMMENT(set) &&
573	ip_set_put_comment(skb, ext_comment(e, set)))
574	return -EMSGSIZE;
575	if (SET_WITH_SKBINFO(set) &&
576	ip_set_put_skbinfo(skb, ext_skbinfo(e, set)))
577	return -EMSGSIZE;
578	return `0`;
579	}
580	EXPORT_SYMBOL_GPL(ip_set_put_extensions);
581
582	static bool
583	ip_set_match_counter(u64 counter, u64 match, u8 op)
584	{
585	switch (op) {
586	case IPSET_COUNTER_NONE:
587	return true;
588	case IPSET_COUNTER_EQ:
589	return counter == match;
590	case IPSET_COUNTER_NE:
591	return counter != match;
592	case IPSET_COUNTER_LT:
593	return counter < match;
594	case IPSET_COUNTER_GT:
595	return counter > match;
596	}
597	return false;
598	}
599
600	static void
601	ip_set_add_bytes(u64 bytes, struct ip_set_counter *counter)
602	{
603	atomic64_add(i: (long long)bytes, v: &(counter)->bytes);
604	}
605
606	static void
607	ip_set_add_packets(u64 packets, struct ip_set_counter *counter)
608	{
609	atomic64_add(i: (long long)packets, v: &(counter)->packets);
610	}
611
612	static void
613	ip_set_update_counter(struct ip_set_counter *counter,
614	const struct ip_set_ext *ext, u32 flags)
615	{
616	if (ext->packets != ULLONG_MAX &&
617	!(flags & IPSET_FLAG_SKIP_COUNTER_UPDATE)) {
618	ip_set_add_bytes(bytes: ext->bytes, counter);
619	ip_set_add_packets(packets: ext->packets, counter);
620	}
621	}
622
623	static void
624	ip_set_get_skbinfo(struct ip_set_skbinfo *skbinfo,
625	const struct ip_set_ext *ext,
626	struct ip_set_ext *mext, u32 flags)
627	{
628	mext->skbinfo = *skbinfo;
629	}
630
631	bool
632	ip_set_match_extensions(struct ip_set set, const* struct ip_set_ext *ext,
633	struct ip_set_ext mext, u32 flags, void* *data)
634	{
635	if (SET_WITH_TIMEOUT(set) &&
636	ip_set_timeout_expired(ext_timeout(data, set)))
637	return false;
638	if (SET_WITH_COUNTER(set)) {
639	struct ip_set_counter *counter = ext_counter(data, set);
640
641	ip_set_update_counter(counter, ext, flags);
642
643	if (flags & IPSET_FLAG_MATCH_COUNTERS &&
644	!(ip_set_match_counter(counter: ip_set_get_packets(counter),
645	match: mext->packets, op: mext->packets_op) &&
646	ip_set_match_counter(counter: ip_set_get_bytes(counter),
647	match: mext->bytes, op: mext->bytes_op)))
648	return false;
649	}
650	if (SET_WITH_SKBINFO(set))
651	ip_set_get_skbinfo(ext_skbinfo(data, set),
652	ext, mext, flags);
653	return true;
654	}
655	EXPORT_SYMBOL_GPL(ip_set_match_extensions);
656
657	/ Creating/destroying/renaming/swapping affect the existence and*
658	* the properties of a set. All of these can be executed from userspace
659	* only and serialized by the nfnl mutex indirectly from nfnetlink.
660	*
661	* Sets are identified by their index in ip_set_list and the index
662	* is used by the external references (set/SET netfilter modules).
663	*
664	* The set behind an index may change by swapping only, from userspace.
665	*/
666
667	static void
668	__ip_set_get(struct ip_set *set)
669	{
670	write_lock_bh(&ip_set_ref_lock);
671	set->ref++;
672	write_unlock_bh(&ip_set_ref_lock);
673	}
674
675	static void
676	__ip_set_put(struct ip_set *set)
677	{
678	write_lock_bh(&ip_set_ref_lock);
679	BUG_ON(set->ref == `0`);
680	set->ref--;
681	write_unlock_bh(&ip_set_ref_lock);
682	}
683
684	/ set->ref can be swapped out by ip_set_swap, netlink events (like dump) need*
685	* a separate reference counter
686	*/
687	static void
688	__ip_set_get_netlink(struct ip_set *set)
689	{
690	write_lock_bh(&ip_set_ref_lock);
691	set->ref_netlink++;
692	write_unlock_bh(&ip_set_ref_lock);
693	}
694
695	static void
696	__ip_set_put_netlink(struct ip_set *set)
697	{
698	write_lock_bh(&ip_set_ref_lock);
699	BUG_ON(set->ref_netlink == `0`);
700	set->ref_netlink--;
701	write_unlock_bh(&ip_set_ref_lock);
702	}
703
704	/ Add, del and test set entries from kernel.*
705	*
706	* The set behind the index must exist and must be referenced
707	* so it can't be destroyed (or changed) under our foot.
708	*/
709
710	static struct ip_set *
711	ip_set_rcu_get(struct net *net, ip_set_id_t index)
712	{
713	struct ip_set_net *inst = ip_set_pernet(net);
714
715	/ ip_set_list and the set pointer need to be protected /
716	return ip_set_dereference_nfnl(inst->ip_set_list)[index];
717	}
718
719	static inline void
720	ip_set_lock(struct ip_set *set)
721	{
722	if (!set->variant->region_lock)
723	spin_lock_bh(lock: &set->lock);
724	}
725
726	static inline void
727	ip_set_unlock(struct ip_set *set)
728	{
729	if (!set->variant->region_lock)
730	spin_unlock_bh(lock: &set->lock);
731	}
732
733	int
734	ip_set_test(ip_set_id_t index, const struct sk_buff *skb,
735	const struct xt_action_param par, struct* ip_set_adt_opt *opt)
736	{
737	struct ip_set *set = ip_set_rcu_get(net: xt_net(par), index);
738	int ret = `0`;
739
740	BUG_ON(!set);
741	pr_debug("set %s, index %u\n", set->name, index);
742
743	if (opt->dim < set->type->dimension \|\|
744	!(opt->family == set->family \|\| set->family == NFPROTO_UNSPEC))
745	return `0`;
746
747	ret = set->variant->kadt(set, skb, par, IPSET_TEST, opt);
748
749	if (ret == -EAGAIN) {
750	/ Type requests element to be completed /
751	pr_debug("element must be completed, ADD is triggered\n");
752	ip_set_lock(set);
753	set->variant->kadt(set, skb, par, IPSET_ADD, opt);
754	ip_set_unlock(set);
755	ret = `1`;
756	} else {
757	/ --return-nomatch: invert matched element /
758	if ((opt->cmdflags & IPSET_FLAG_RETURN_NOMATCH) &&
759	(set->type->features & IPSET_TYPE_NOMATCH) &&
760	(ret > `0` \|\| ret == -ENOTEMPTY))
761	ret = -ret;
762	}
763
764	/ Convert error codes to nomatch /
765	return (ret < `0` ? `0` : ret);
766	}
767	EXPORT_SYMBOL_GPL(ip_set_test);
768
769	int
770	ip_set_add(ip_set_id_t index, const struct sk_buff *skb,
771	const struct xt_action_param par, struct* ip_set_adt_opt *opt)
772	{
773	struct ip_set *set = ip_set_rcu_get(net: xt_net(par), index);
774	int ret;
775
776	BUG_ON(!set);
777	pr_debug("set %s, index %u\n", set->name, index);
778
779	if (opt->dim < set->type->dimension \|\|
780	!(opt->family == set->family \|\| set->family == NFPROTO_UNSPEC))
781	return -IPSET_ERR_TYPE_MISMATCH;
782
783	ip_set_lock(set);
784	ret = set->variant->kadt(set, skb, par, IPSET_ADD, opt);
785	ip_set_unlock(set);
786
787	return ret;
788	}
789	EXPORT_SYMBOL_GPL(ip_set_add);
790
791	int
792	ip_set_del(ip_set_id_t index, const struct sk_buff *skb,
793	const struct xt_action_param par, struct* ip_set_adt_opt *opt)
794	{
795	struct ip_set *set = ip_set_rcu_get(net: xt_net(par), index);
796	int ret = `0`;
797
798	BUG_ON(!set);
799	pr_debug("set %s, index %u\n", set->name, index);
800
801	if (opt->dim < set->type->dimension \|\|
802	!(opt->family == set->family \|\| set->family == NFPROTO_UNSPEC))
803	return -IPSET_ERR_TYPE_MISMATCH;
804
805	ip_set_lock(set);
806	ret = set->variant->kadt(set, skb, par, IPSET_DEL, opt);
807	ip_set_unlock(set);
808
809	return ret;
810	}
811	EXPORT_SYMBOL_GPL(ip_set_del);
812
813	/ Find set by name, reference it once. The reference makes sure the*
814	* thing pointed to, does not go away under our feet.
815	*
816	*/
817	ip_set_id_t
818	ip_set_get_byname(struct net net, const* char name, struct* ip_set **set)
819	{
820	ip_set_id_t i, index = IPSET_INVALID_ID;
821	struct ip_set *s;
822	struct ip_set_net *inst = ip_set_pernet(net);
823
824	rcu_read_lock();
825	for (i = `0`; i < inst->ip_set_max; i++) {
826	s = rcu_dereference(inst->ip_set_list)[i];
827	if (s && STRNCMP(s->name, name)) {
828	__ip_set_get(set: s);
829	index = i;
830	*set = s;
831	break;
832	}
833	}
834	rcu_read_unlock();
835
836	return index;
837	}
838	EXPORT_SYMBOL_GPL(ip_set_get_byname);
839
840	/ If the given set pointer points to a valid set, decrement*
841	* reference count by 1. The caller shall not assume the index
842	* to be valid, after calling this function.
843	*
844	*/
845
846	static void
847	__ip_set_put_byindex(struct ip_set_net *inst, ip_set_id_t index)
848	{
849	struct ip_set *set;
850
851	rcu_read_lock();
852	set = rcu_dereference(inst->ip_set_list)[index];
853	if (set)
854	__ip_set_put(set);
855	rcu_read_unlock();
856	}
857
858	void
859	ip_set_put_byindex(struct net *net, ip_set_id_t index)
860	{
861	struct ip_set_net *inst = ip_set_pernet(net);
862
863	__ip_set_put_byindex(inst, index);
864	}
865	EXPORT_SYMBOL_GPL(ip_set_put_byindex);
866
867	/ Get the name of a set behind a set index.*
868	* Set itself is protected by RCU, but its name isn't: to protect against
869	* renaming, grab ip_set_ref_lock as reader (see ip_set_rename()) and copy the
870	* name.
871	*/
872	void
873	ip_set_name_byindex(struct net net, ip_set_id_t index, char* *name)
874	{
875	struct ip_set *set = ip_set_rcu_get(net, index);
876
877	BUG_ON(!set);
878
879	read_lock_bh(&ip_set_ref_lock);
880	strscpy_pad(name, set->name, IPSET_MAXNAMELEN);
881	read_unlock_bh(&ip_set_ref_lock);
882	}
883	EXPORT_SYMBOL_GPL(ip_set_name_byindex);
884
885	/ Routines to call by external subsystems, which do not*
886	* call nfnl_lock for us.
887	*/
888
889	/ Find set by index, reference it once. The reference makes sure the*
890	* thing pointed to, does not go away under our feet.
891	*
892	* The nfnl mutex is used in the function.
893	*/
894	ip_set_id_t
895	ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index)
896	{
897	struct ip_set *set;
898	struct ip_set_net *inst = ip_set_pernet(net);
899
900	if (index >= inst->ip_set_max)
901	return IPSET_INVALID_ID;
902
903	nfnl_lock(NFNL_SUBSYS_IPSET);
904	set = ip_set(inst, index);
905	if (set)
906	__ip_set_get(set);
907	else
908	index = IPSET_INVALID_ID;
909	nfnl_unlock(NFNL_SUBSYS_IPSET);
910
911	return index;
912	}
913	EXPORT_SYMBOL_GPL(ip_set_nfnl_get_byindex);
914
915	/ If the given set pointer points to a valid set, decrement*
916	* reference count by 1. The caller shall not assume the index
917	* to be valid, after calling this function.
918	*
919	* The nfnl mutex is used in the function.
920	*/
921	void
922	ip_set_nfnl_put(struct net *net, ip_set_id_t index)
923	{
924	struct ip_set *set;
925	struct ip_set_net *inst = ip_set_pernet(net);
926
927	nfnl_lock(NFNL_SUBSYS_IPSET);
928	if (!inst->is_deleted) { / already deleted from ip_set_net_exit() /
929	set = ip_set(inst, index);
930	if (set)
931	__ip_set_put(set);
932	}
933	nfnl_unlock(NFNL_SUBSYS_IPSET);
934	}
935	EXPORT_SYMBOL_GPL(ip_set_nfnl_put);
936
937	/ Communication protocol with userspace over netlink.*
938	*
939	* The commands are serialized by the nfnl mutex.
940	*/
941
942	static inline u8 protocol(const struct nlattr * const tb[])
943	{
944	return nla_get_u8(nla: tb[IPSET_ATTR_PROTOCOL]);
945	}
946
947	static inline bool
948	protocol_failed(const struct nlattr * const tb[])
949	{
950	return !tb[IPSET_ATTR_PROTOCOL] \|\| protocol(tb) != IPSET_PROTOCOL;
951	}
952
953	static inline bool
954	protocol_min_failed(const struct nlattr * const tb[])
955	{
956	return !tb[IPSET_ATTR_PROTOCOL] \|\| protocol(tb) < IPSET_PROTOCOL_MIN;
957	}
958
959	static inline u32
960	flag_exist(const struct nlmsghdr *nlh)
961	{
962	return nlh->nlmsg_flags & NLM_F_EXCL ? `0` : IPSET_FLAG_EXIST;
963	}
964
965	static struct nlmsghdr *
966	start_msg(struct sk_buff skb, u32 portid, u32 seq, unsigned* int flags,
967	enum ipset_cmd cmd)
968	{
969	return nfnl_msg_put(skb, portid, seq,
970	type: nfnl_msg_type(NFNL_SUBSYS_IPSET, msg_type: cmd), flags,
971	family: NFPROTO_IPV4, NFNETLINK_V0, res_id: `0`);
972	}
973
974	/ Create a set /
975
976	static const struct nla_policy ip_set_create_policy[IPSET_ATTR_CMD_MAX + `1`] = {
977	[IPSET_ATTR_PROTOCOL] = { .type = NLA_U8 },
978	[IPSET_ATTR_SETNAME] = { .type = NLA_NUL_STRING,
979	.len = IPSET_MAXNAMELEN - `1` },
980	[IPSET_ATTR_TYPENAME] = { .type = NLA_NUL_STRING,
981	.len = IPSET_MAXNAMELEN - `1`},
982	[IPSET_ATTR_REVISION] = { .type = NLA_U8 },
983	[IPSET_ATTR_FAMILY] = { .type = NLA_U8 },
984	[IPSET_ATTR_DATA] = { .type = NLA_NESTED },
985	};
986
987	static struct ip_set *
988	find_set_and_id(struct ip_set_net inst, const* char name, ip_set_id_t id)
989	{
990	struct ip_set *set = NULL;
991	ip_set_id_t i;
992
993	*id = IPSET_INVALID_ID;
994	for (i = `0`; i < inst->ip_set_max; i++) {
995	set = ip_set(inst, i);
996	if (set && STRNCMP(set->name, name)) {
997	*id = i;
998	break;
999	}
1000	}
1001	return (*id == IPSET_INVALID_ID ? NULL : set);
1002	}
1003
1004	static inline struct ip_set *
1005	find_set(struct ip_set_net inst, const* char *name)
1006	{
1007	ip_set_id_t id;
1008
1009	return find_set_and_id(inst, name, id: &id);
1010	}
1011
1012	static int
1013	find_free_id(struct ip_set_net inst, const* char name, ip_set_id_t index,
1014	struct ip_set **set)
1015	{
1016	struct ip_set *s;
1017	ip_set_id_t i;
1018
1019	*index = IPSET_INVALID_ID;
1020	for (i = `0`; i < inst->ip_set_max; i++) {
1021	s = ip_set(inst, i);
1022	if (!s) {
1023	if (*index == IPSET_INVALID_ID)
1024	*index = i;
1025	} else if (STRNCMP(name, s->name)) {
1026	/ Name clash /
1027	*set = s;
1028	return -EEXIST;
1029	}
1030	}
1031	if (*index == IPSET_INVALID_ID)
1032	/ No free slot remained /
1033	return -IPSET_ERR_MAX_SETS;
1034	return `0`;
1035	}
1036
1037	static int ip_set_none(struct sk_buff skb, const* struct nfnl_info *info,
1038	const struct nlattr * const attr[])
1039	{
1040	return -EOPNOTSUPP;
1041	}
1042
1043	static int ip_set_create(struct sk_buff skb, const* struct nfnl_info *info,
1044	const struct nlattr * const attr[])
1045	{
1046	struct ip_set_net *inst = ip_set_pernet(net: info->net);
1047	struct ip_set set, clash = NULL;
1048	ip_set_id_t index = IPSET_INVALID_ID;
1049	struct nlattr *tb[IPSET_ATTR_CREATE_MAX + `1`] = {};
1050	const char name, typename;
1051	u8 family, revision;
1052	u32 flags = flag_exist(nlh: info->nlh);
1053	int ret = `0`;
1054
1055	if (unlikely(protocol_min_failed(attr) \|\|
1056	!attr[IPSET_ATTR_SETNAME] \|\|
1057	!attr[IPSET_ATTR_TYPENAME] \|\|
1058	!attr[IPSET_ATTR_REVISION] \|\|
1059	!attr[IPSET_ATTR_FAMILY] \|\|
1060	(attr[IPSET_ATTR_DATA] &&
1061	!flag_nested(attr[IPSET_ATTR_DATA]))))
1062	return -IPSET_ERR_PROTOCOL;
1063
1064	name = nla_data(nla: attr[IPSET_ATTR_SETNAME]);
1065	typename = nla_data(nla: attr[IPSET_ATTR_TYPENAME]);
1066	family = nla_get_u8(nla: attr[IPSET_ATTR_FAMILY]);
1067	revision = nla_get_u8(nla: attr[IPSET_ATTR_REVISION]);
1068	pr_debug("setname: %s, typename: %s, family: %s, revision: %u\n",
1069	name, typename, family_name(family), revision);
1070
1071	/ First, and without any locks, allocate and initialize*
1072	* a normal base set structure.
1073	*/
1074	set = kzalloc(size: sizeof(*set), GFP_KERNEL);
1075	if (!set)
1076	return -ENOMEM;
1077	spin_lock_init(&set->lock);
1078	strscpy(set->name, name, IPSET_MAXNAMELEN);
1079	set->family = family;
1080	set->revision = revision;
1081
1082	/ Next, check that we know the type, and take*
1083	* a reference on the type, to make sure it stays available
1084	* while constructing our new set.
1085	*
1086	* After referencing the type, we try to create the type
1087	* specific part of the set without holding any locks.
1088	*/
1089	ret = find_set_type_get(typename, family, revision, &set->type);
1090	if (ret)
1091	goto out;
1092
1093	/ Without holding any locks, create private part. /
1094	if (attr[IPSET_ATTR_DATA] &&
1095	nla_parse_nested(tb, IPSET_ATTR_CREATE_MAX, nla: attr[IPSET_ATTR_DATA],
1096	policy: set->type->create_policy, NULL)) {
1097	ret = -IPSET_ERR_PROTOCOL;
1098	goto put_out;
1099	}
1100	/ Set create flags depending on the type revision /
1101	set->flags \|= set->type->create_flags[revision];
1102
1103	ret = set->type->create(info->net, set, tb, flags);
1104	if (ret != `0`)
1105	goto put_out;
1106
1107	/ BTW, ret==0 here. /
1108
1109	/ Here, we have a valid, constructed set and we are protected*
1110	* by the nfnl mutex. Find the first free index in ip_set_list
1111	* and check clashing.
1112	*/
1113	ret = find_free_id(inst, name: set->name, index: &index, set: &clash);
1114	if (ret == -EEXIST) {
1115	/ If this is the same set and requested, ignore error /
1116	if ((flags & IPSET_FLAG_EXIST) &&
1117	STRNCMP(set->type->name, clash->type->name) &&
1118	set->type->family == clash->type->family &&
1119	set->type->revision_min == clash->type->revision_min &&
1120	set->type->revision_max == clash->type->revision_max &&
1121	set->variant->same_set(set, clash))
1122	ret = `0`;
1123	goto cleanup;
1124	} else if (ret == -IPSET_ERR_MAX_SETS) {
1125	struct ip_set list, tmp;
1126	ip_set_id_t i = inst->ip_set_max + IP_SET_INC;
1127
1128	if (i < inst->ip_set_max \|\| i == IPSET_INVALID_ID)
1129	/ Wraparound /
1130	goto cleanup;
1131
1132	list = kvcalloc(n: i, size: sizeof(struct ip_set *), GFP_KERNEL);
1133	if (!list)
1134	goto cleanup;
1135	/ nfnl mutex is held, both lists are valid /
1136	tmp = ip_set_dereference(inst->ip_set_list);
1137	memcpy(list, tmp, sizeof(struct ip_set ) inst->ip_set_max);
1138	rcu_assign_pointer(inst->ip_set_list, list);
1139	/ Make sure all current packets have passed through /
1140	synchronize_net();
1141	/ Use new list /
1142	index = inst->ip_set_max;
1143	inst->ip_set_max = i;
1144	kvfree(addr: tmp);
1145	ret = `0`;
1146	} else if (ret) {
1147	goto cleanup;
1148	}
1149
1150	/ Finally! Add our shiny new set to the list, and be done. /
1151	pr_debug("create: '%s' created with index %u!\n", set->name, index);
1152	ip_set(inst, index) = set;
1153
1154	return ret;
1155
1156	cleanup:
1157	set->variant->cancel_gc(set);
1158	set->variant->destroy(set);
1159	put_out:
1160	module_put(module: set->type->me);
1161	out:
1162	kfree(objp: set);
1163	return ret;
1164	}
1165
1166	/ Destroy sets /
1167
1168	static const struct nla_policy
1169	ip_set_setname_policy[IPSET_ATTR_CMD_MAX + `1`] = {
1170	[IPSET_ATTR_PROTOCOL] = { .type = NLA_U8 },
1171	[IPSET_ATTR_SETNAME] = { .type = NLA_NUL_STRING,
1172	.len = IPSET_MAXNAMELEN - `1` },
1173	};
1174
1175	static void
1176	ip_set_destroy_set(struct ip_set *set)
1177	{
1178	pr_debug("set: %s\n", set->name);
1179
1180	/ Must call it without holding any lock /
1181	set->variant->destroy(set);
1182	module_put(module: set->type->me);
1183	kfree(objp: set);
1184	}
1185
1186	static void
1187	ip_set_destroy_set_rcu(struct rcu_head *head)
1188	{
1189	struct ip_set set = container_of(head, struct* ip_set, rcu);
1190
1191	ip_set_destroy_set(set);
1192	}
1193
1194	static int ip_set_destroy(struct sk_buff skb, const* struct nfnl_info *info,
1195	const struct nlattr * const attr[])
1196	{
1197	struct ip_set_net *inst = ip_set_pernet(net: info->net);
1198	struct ip_set *s;
1199	ip_set_id_t i;
1200	int ret = `0`;
1201
1202	if (unlikely(protocol_min_failed(attr)))
1203	return -IPSET_ERR_PROTOCOL;
1204
1205
1206	/ Commands are serialized and references are*
1207	* protected by the ip_set_ref_lock.
1208	* External systems (i.e. xt_set) must call
1209	* ip_set_put\|get_nfnl_* functions, that way we
1210	* can safely check references here.
1211	*
1212	* list:set timer can only decrement the reference
1213	* counter, so if it's already zero, we can proceed
1214	* without holding the lock.
1215	*/
1216	if (!attr[IPSET_ATTR_SETNAME]) {
1217	/ Must wait for flush to be really finished in list:set /
1218	rcu_barrier();
1219	read_lock_bh(&ip_set_ref_lock);
1220	for (i = `0`; i < inst->ip_set_max; i++) {
1221	s = ip_set(inst, i);
1222	if (s && (s->ref \|\| s->ref_netlink)) {
1223	ret = -IPSET_ERR_BUSY;
1224	goto out;
1225	}
1226	}
1227	inst->is_destroyed = true;
1228	read_unlock_bh(&ip_set_ref_lock);
1229	for (i = `0`; i < inst->ip_set_max; i++) {
1230	s = ip_set(inst, i);
1231	if (s) {
1232	ip_set(inst, i) = NULL;
1233	/ Must cancel garbage collectors /
1234	s->variant->cancel_gc(s);
1235	ip_set_destroy_set(set: s);
1236	}
1237	}
1238	/ Modified by ip_set_destroy() only, which is serialized /
1239	inst->is_destroyed = false;
1240	} else {
1241	u32 flags = flag_exist(nlh: info->nlh);
1242	u16 features = `0`;
1243
1244	read_lock_bh(&ip_set_ref_lock);
1245	s = find_set_and_id(inst, name: nla_data(nla: attr[IPSET_ATTR_SETNAME]),
1246	id: &i);
1247	if (!s) {
1248	if (!(flags & IPSET_FLAG_EXIST))
1249	ret = -ENOENT;
1250	goto out;
1251	} else if (s->ref \|\| s->ref_netlink) {
1252	ret = -IPSET_ERR_BUSY;
1253	goto out;
1254	}
1255	features = s->type->features;
1256	ip_set(inst, i) = NULL;
1257	read_unlock_bh(&ip_set_ref_lock);
1258	if (features & IPSET_TYPE_NAME) {
1259	/ Must wait for flush to be really finished /
1260	rcu_barrier();
1261	}
1262	/ Must cancel garbage collectors /
1263	s->variant->cancel_gc(s);
1264	call_rcu(head: &s->rcu, func: ip_set_destroy_set_rcu);
1265	}
1266	return `0`;
1267	out:
1268	read_unlock_bh(&ip_set_ref_lock);
1269	return ret;
1270	}
1271
1272	/ Flush sets /
1273
1274	static void
1275	ip_set_flush_set(struct ip_set *set)
1276	{
1277	pr_debug("set: %s\n", set->name);
1278
1279	ip_set_lock(set);
1280	set->variant->flush(set);
1281	ip_set_unlock(set);
1282	}
1283
1284	static int ip_set_flush(struct sk_buff skb, const* struct nfnl_info *info,
1285	const struct nlattr * const attr[])
1286	{
1287	struct ip_set_net *inst = ip_set_pernet(net: info->net);
1288	struct ip_set *s;
1289	ip_set_id_t i;
1290
1291	if (unlikely(protocol_min_failed(attr)))
1292	return -IPSET_ERR_PROTOCOL;
1293
1294	if (!attr[IPSET_ATTR_SETNAME]) {
1295	for (i = `0`; i < inst->ip_set_max; i++) {
1296	s = ip_set(inst, i);
1297	if (s)
1298	ip_set_flush_set(set: s);
1299	}
1300	} else {
1301	s = find_set(inst, name: nla_data(nla: attr[IPSET_ATTR_SETNAME]));
1302	if (!s)
1303	return -ENOENT;
1304
1305	ip_set_flush_set(set: s);
1306	}
1307
1308	return `0`;
1309	}
1310
1311	/ Rename a set /
1312
1313	static const struct nla_policy
1314	ip_set_setname2_policy[IPSET_ATTR_CMD_MAX + `1`] = {
1315	[IPSET_ATTR_PROTOCOL] = { .type = NLA_U8 },
1316	[IPSET_ATTR_SETNAME] = { .type = NLA_NUL_STRING,
1317	.len = IPSET_MAXNAMELEN - `1` },
1318	[IPSET_ATTR_SETNAME2] = { .type = NLA_NUL_STRING,
1319	.len = IPSET_MAXNAMELEN - `1` },
1320	};
1321
1322	static int ip_set_rename(struct sk_buff skb, const* struct nfnl_info *info,
1323	const struct nlattr * const attr[])
1324	{
1325	struct ip_set_net *inst = ip_set_pernet(net: info->net);
1326	struct ip_set set, s;
1327	const char *name2;
1328	ip_set_id_t i;
1329	int ret = `0`;
1330
1331	if (unlikely(protocol_min_failed(attr) \|\|
1332	!attr[IPSET_ATTR_SETNAME] \|\|
1333	!attr[IPSET_ATTR_SETNAME2]))
1334	return -IPSET_ERR_PROTOCOL;
1335
1336	set = find_set(inst, name: nla_data(nla: attr[IPSET_ATTR_SETNAME]));
1337	if (!set)
1338	return -ENOENT;
1339
1340	write_lock_bh(&ip_set_ref_lock);
1341	if (set->ref != `0` \|\| set->ref_netlink != `0`) {
1342	ret = -IPSET_ERR_REFERENCED;
1343	goto out;
1344	}
1345
1346	name2 = nla_data(nla: attr[IPSET_ATTR_SETNAME2]);
1347	for (i = `0`; i < inst->ip_set_max; i++) {
1348	s = ip_set(inst, i);
1349	if (s && STRNCMP(s->name, name2)) {
1350	ret = -IPSET_ERR_EXIST_SETNAME2;
1351	goto out;
1352	}
1353	}
1354	strscpy_pad(set->name, name2, IPSET_MAXNAMELEN);
1355
1356	out:
1357	write_unlock_bh(&ip_set_ref_lock);
1358	return ret;
1359	}
1360
1361	/ Swap two sets so that name/index points to the other.*
1362	* References and set names are also swapped.
1363	*
1364	* The commands are serialized by the nfnl mutex and references are
1365	* protected by the ip_set_ref_lock. The kernel interfaces
1366	* do not hold the mutex but the pointer settings are atomic
1367	* so the ip_set_list always contains valid pointers to the sets.
1368	*/
1369
1370	static int ip_set_swap(struct sk_buff skb, const* struct nfnl_info *info,
1371	const struct nlattr * const attr[])
1372	{
1373	struct ip_set_net *inst = ip_set_pernet(net: info->net);
1374	struct ip_set from, to;
1375	ip_set_id_t from_id, to_id;
1376	char from_name[IPSET_MAXNAMELEN];
1377
1378	if (unlikely(protocol_min_failed(attr) \|\|
1379	!attr[IPSET_ATTR_SETNAME] \|\|
1380	!attr[IPSET_ATTR_SETNAME2]))
1381	return -IPSET_ERR_PROTOCOL;
1382
1383	from = find_set_and_id(inst, name: nla_data(nla: attr[IPSET_ATTR_SETNAME]),
1384	id: &from_id);
1385	if (!from)
1386	return -ENOENT;
1387
1388	to = find_set_and_id(inst, name: nla_data(nla: attr[IPSET_ATTR_SETNAME2]),
1389	id: &to_id);
1390	if (!to)
1391	return -IPSET_ERR_EXIST_SETNAME2;
1392
1393	/ Features must not change.*
1394	* Not an artifical restriction anymore, as we must prevent
1395	* possible loops created by swapping in setlist type of sets.
1396	*/
1397	if (!(from->type->features == to->type->features &&
1398	from->family == to->family))
1399	return -IPSET_ERR_TYPE_MISMATCH;
1400
1401	write_lock_bh(&ip_set_ref_lock);
1402
1403	if (from->ref_netlink \|\| to->ref_netlink) {
1404	write_unlock_bh(&ip_set_ref_lock);
1405	return -EBUSY;
1406	}
1407
1408	strscpy_pad(from_name, from->name, IPSET_MAXNAMELEN);
1409	strscpy_pad(from->name, to->name, IPSET_MAXNAMELEN);
1410	strscpy_pad(to->name, from_name, IPSET_MAXNAMELEN);
1411
1412	swap(from->ref, to->ref);
1413	ip_set(inst, from_id) = to;
1414	ip_set(inst, to_id) = from;
1415	write_unlock_bh(&ip_set_ref_lock);
1416
1417	return `0`;
1418	}
1419
1420	/ List/save set data /
1421
1422	#define DUMP_INIT 0
1423	#define DUMP_ALL 1
1424	#define DUMP_ONE 2
1425	#define DUMP_LAST 3
1426
1427	#define DUMP_TYPE(arg) (((u32)(arg)) & 0x0000FFFF)
1428	#define DUMP_FLAGS(arg) (((u32)(arg)) >> 16)
1429
1430	int
1431	ip_set_put_flags(struct sk_buff skb, struct* ip_set *set)
1432	{
1433	u32 cadt_flags = `0`;
1434
1435	if (SET_WITH_TIMEOUT(set))
1436	if (unlikely(nla_put_net32(skb, IPSET_ATTR_TIMEOUT,
1437	htonl(set->timeout))))
1438	return -EMSGSIZE;
1439	if (SET_WITH_COUNTER(set))
1440	cadt_flags \|= IPSET_FLAG_WITH_COUNTERS;
1441	if (SET_WITH_COMMENT(set))
1442	cadt_flags \|= IPSET_FLAG_WITH_COMMENT;
1443	if (SET_WITH_SKBINFO(set))
1444	cadt_flags \|= IPSET_FLAG_WITH_SKBINFO;
1445	if (SET_WITH_FORCEADD(set))
1446	cadt_flags \|= IPSET_FLAG_WITH_FORCEADD;
1447
1448	if (!cadt_flags)
1449	return `0`;
1450	return nla_put_net32(skb, attrtype: IPSET_ATTR_CADT_FLAGS, htonl(cadt_flags));
1451	}
1452	EXPORT_SYMBOL_GPL(ip_set_put_flags);
1453
1454	static int
1455	ip_set_dump_done(struct netlink_callback *cb)
1456	{
1457	if (cb->args[IPSET_CB_ARG0]) {
1458	struct ip_set_net *inst =
1459	(struct ip_set_net *)cb->args[IPSET_CB_NET];
1460	ip_set_id_t index = (ip_set_id_t)cb->args[IPSET_CB_INDEX];
1461	struct ip_set *set = ip_set_ref_netlink(inst, index);
1462
1463	if (set->variant->uref)
1464	set->variant->uref(set, cb, false);
1465	pr_debug("release set %s\n", set->name);
1466	__ip_set_put_netlink(set);
1467	}
1468	return `0`;
1469	}
1470
1471	static inline void
1472	dump_attrs(struct nlmsghdr *nlh)
1473	{
1474	const struct nlattr *attr;
1475	int rem;
1476
1477	pr_debug("dump nlmsg\n");
1478	nlmsg_for_each_attr(attr, nlh, sizeof(struct nfgenmsg), rem) {
1479	pr_debug("type: %u, len %u\n", nla_type(attr), attr->nla_len);
1480	}
1481	}
1482
1483	static const struct nla_policy
1484	ip_set_dump_policy[IPSET_ATTR_CMD_MAX + `1`] = {
1485	[IPSET_ATTR_PROTOCOL] = { .type = NLA_U8 },
1486	[IPSET_ATTR_SETNAME] = { .type = NLA_NUL_STRING,
1487	.len = IPSET_MAXNAMELEN - `1` },
1488	[IPSET_ATTR_FLAGS] = { .type = NLA_U32 },
1489	};
1490
1491	static int
1492	ip_set_dump_start(struct netlink_callback *cb)
1493	{
1494	struct nlmsghdr *nlh = nlmsg_hdr(skb: cb->skb);
1495	int min_len = nlmsg_total_size(payload: sizeof(struct nfgenmsg));
1496	struct nlattr *cda[IPSET_ATTR_CMD_MAX + `1`];
1497	struct nlattr attr = (void* *)nlh + min_len;
1498	struct sk_buff *skb = cb->skb;
1499	struct ip_set_net *inst = ip_set_pernet(net: sock_net(sk: skb->sk));
1500	u32 dump_type;
1501	int ret;
1502
1503	ret = nla_parse(tb: cda, IPSET_ATTR_CMD_MAX, head: attr,
1504	len: nlh->nlmsg_len - min_len,
1505	policy: ip_set_dump_policy, NULL);
1506	if (ret)
1507	goto error;
1508
1509	cb->args[IPSET_CB_PROTO] = nla_get_u8(nla: cda[IPSET_ATTR_PROTOCOL]);
1510	if (cda[IPSET_ATTR_SETNAME]) {
1511	ip_set_id_t index;
1512	struct ip_set *set;
1513
1514	set = find_set_and_id(inst, name: nla_data(nla: cda[IPSET_ATTR_SETNAME]),
1515	id: &index);
1516	if (!set) {
1517	ret = -ENOENT;
1518	goto error;
1519	}
1520	dump_type = DUMP_ONE;
1521	cb->args[IPSET_CB_INDEX] = index;
1522	} else {
1523	dump_type = DUMP_ALL;
1524	}
1525
1526	if (cda[IPSET_ATTR_FLAGS]) {
1527	u32 f = ip_set_get_h32(attr: cda[IPSET_ATTR_FLAGS]);
1528
1529	dump_type \|= (f << `16`);
1530	}
1531	cb->args[IPSET_CB_NET] = (unsigned long)inst;
1532	cb->args[IPSET_CB_DUMP] = dump_type;
1533
1534	return `0`;
1535
1536	error:
1537	/ We have to create and send the error message manually :-( /
1538	if (nlh->nlmsg_flags & NLM_F_ACK) {
1539	netlink_ack(in_skb: cb->skb, nlh, err: ret, NULL);
1540	}
1541	return ret;
1542	}
1543
1544	static int
1545	ip_set_dump_do(struct sk_buff skb, struct* netlink_callback *cb)
1546	{
1547	ip_set_id_t index = IPSET_INVALID_ID, max;
1548	struct ip_set *set = NULL;
1549	struct nlmsghdr *nlh = NULL;
1550	unsigned int flags = NETLINK_CB(cb->skb).portid ? NLM_F_MULTI : `0`;
1551	struct ip_set_net *inst = ip_set_pernet(net: sock_net(sk: skb->sk));
1552	u32 dump_type, dump_flags;
1553	bool is_destroyed;
1554	int ret = `0`;
1555
1556	if (!cb->args[IPSET_CB_DUMP])
1557	return -EINVAL;
1558
1559	if (cb->args[IPSET_CB_INDEX] >= inst->ip_set_max)
1560	goto out;
1561
1562	dump_type = DUMP_TYPE(cb->args[IPSET_CB_DUMP]);
1563	dump_flags = DUMP_FLAGS(cb->args[IPSET_CB_DUMP]);
1564	max = dump_type == DUMP_ONE ? cb->args[IPSET_CB_INDEX] + `1`
1565	: inst->ip_set_max;
1566	dump_last:
1567	pr_debug("dump type, flag: %u %u index: %ld\n",
1568	dump_type, dump_flags, cb->args[IPSET_CB_INDEX]);
1569	for (; cb->args[IPSET_CB_INDEX] < max; cb->args[IPSET_CB_INDEX]++) {
1570	index = (ip_set_id_t)cb->args[IPSET_CB_INDEX];
1571	write_lock_bh(&ip_set_ref_lock);
1572	set = ip_set(inst, index);
1573	is_destroyed = inst->is_destroyed;
1574	if (!set \|\| is_destroyed) {
1575	write_unlock_bh(&ip_set_ref_lock);
1576	if (dump_type == DUMP_ONE) {
1577	ret = -ENOENT;
1578	goto out;
1579	}
1580	if (is_destroyed) {
1581	/ All sets are just being destroyed /
1582	ret = `0`;
1583	goto out;
1584	}
1585	continue;
1586	}
1587	/ When dumping all sets, we must dump "sorted"*
1588	* so that lists (unions of sets) are dumped last.
1589	*/
1590	if (dump_type != DUMP_ONE &&
1591	((dump_type == DUMP_ALL) ==
1592	!!(set->type->features & IPSET_DUMP_LAST))) {
1593	write_unlock_bh(&ip_set_ref_lock);
1594	continue;
1595	}
1596	pr_debug("List set: %s\n", set->name);
1597	if (!cb->args[IPSET_CB_ARG0]) {
1598	/ Start listing: make sure set won't be destroyed /
1599	pr_debug("reference set\n");
1600	set->ref_netlink++;
1601	}
1602	write_unlock_bh(&ip_set_ref_lock);
1603	nlh = start_msg(skb, NETLINK_CB(cb->skb).portid,
1604	seq: cb->nlh->nlmsg_seq, flags,
1605	cmd: IPSET_CMD_LIST);
1606	if (!nlh) {
1607	ret = -EMSGSIZE;
1608	goto release_refcount;
1609	}
1610	if (nla_put_u8(skb, attrtype: IPSET_ATTR_PROTOCOL,
1611	value: cb->args[IPSET_CB_PROTO]) \|\|
1612	nla_put_string(skb, attrtype: IPSET_ATTR_SETNAME, str: set->name))
1613	goto nla_put_failure;
1614	if (dump_flags & IPSET_FLAG_LIST_SETNAME)
1615	goto next_set;
1616	switch (cb->args[IPSET_CB_ARG0]) {
1617	case `0`:
1618	/ Core header data /
1619	if (nla_put_string(skb, attrtype: IPSET_ATTR_TYPENAME,
1620	str: set->type->name) \|\|
1621	nla_put_u8(skb, attrtype: IPSET_ATTR_FAMILY,
1622	value: set->family) \|\|
1623	nla_put_u8(skb, attrtype: IPSET_ATTR_REVISION,
1624	value: set->revision))
1625	goto nla_put_failure;
1626	if (cb->args[IPSET_CB_PROTO] > IPSET_PROTOCOL_MIN &&
1627	nla_put_net16(skb, attrtype: IPSET_ATTR_INDEX, htons(index)))
1628	goto nla_put_failure;
1629	ret = set->variant->head(set, skb);
1630	if (ret < `0`)
1631	goto release_refcount;
1632	if (dump_flags & IPSET_FLAG_LIST_HEADER)
1633	goto next_set;
1634	if (set->variant->uref)
1635	set->variant->uref(set, cb, true);
1636	fallthrough;
1637	default:
1638	ret = set->variant->list(set, skb, cb);
1639	if (!cb->args[IPSET_CB_ARG0])
1640	/ Set is done, proceed with next one /
1641	goto next_set;
1642	goto release_refcount;
1643	}
1644	}
1645	/ If we dump all sets, continue with dumping last ones /
1646	if (dump_type == DUMP_ALL) {
1647	dump_type = DUMP_LAST;
1648	cb->args[IPSET_CB_DUMP] = dump_type \| (dump_flags << `16`);
1649	cb->args[IPSET_CB_INDEX] = `0`;
1650	if (set && set->variant->uref)
1651	set->variant->uref(set, cb, false);
1652	goto dump_last;
1653	}
1654	goto out;
1655
1656	nla_put_failure:
1657	ret = -EFAULT;
1658	next_set:
1659	if (dump_type == DUMP_ONE)
1660	cb->args[IPSET_CB_INDEX] = IPSET_INVALID_ID;
1661	else
1662	cb->args[IPSET_CB_INDEX]++;
1663	release_refcount:
1664	/ If there was an error or set is done, release set /
1665	if (ret \|\| !cb->args[IPSET_CB_ARG0]) {
1666	set = ip_set_ref_netlink(inst, index);
1667	if (set->variant->uref)
1668	set->variant->uref(set, cb, false);
1669	pr_debug("release set %s\n", set->name);
1670	__ip_set_put_netlink(set);
1671	cb->args[IPSET_CB_ARG0] = `0`;
1672	}
1673	out:
1674	if (nlh) {
1675	nlmsg_end(skb, nlh);
1676	pr_debug("nlmsg_len: %u\n", nlh->nlmsg_len);
1677	dump_attrs(nlh);
1678	}
1679
1680	return ret < `0` ? ret : skb->len;
1681	}
1682
1683	static int ip_set_dump(struct sk_buff skb, const* struct nfnl_info *info,
1684	const struct nlattr * const attr[])
1685	{
1686	if (unlikely(protocol_min_failed(attr)))
1687	return -IPSET_ERR_PROTOCOL;
1688
1689	{
1690	struct netlink_dump_control c = {
1691	.start = ip_set_dump_start,
1692	.dump = ip_set_dump_do,
1693	.done = ip_set_dump_done,
1694	};
1695	return netlink_dump_start(ssk: info->sk, skb, nlh: info->nlh, control: &c);
1696	}
1697	}
1698
1699	/ Add, del and test /
1700
1701	static const struct nla_policy ip_set_adt_policy[IPSET_ATTR_CMD_MAX + `1`] = {
1702	[IPSET_ATTR_PROTOCOL] = { .type = NLA_U8 },
1703	[IPSET_ATTR_SETNAME] = { .type = NLA_NUL_STRING,
1704	.len = IPSET_MAXNAMELEN - `1` },
1705	[IPSET_ATTR_LINENO] = { .type = NLA_U32 },
1706	[IPSET_ATTR_DATA] = { .type = NLA_NESTED },
1707	[IPSET_ATTR_ADT] = { .type = NLA_NESTED },
1708	};
1709
1710	static int
1711	call_ad(struct net net, struct* sock ctnl, struct* sk_buff *skb,
1712	struct ip_set set, struct* nlattr tb[], enum* ipset_adt adt,
1713	u32 flags, bool use_lineno)
1714	{
1715	int ret;
1716	u32 lineno = `0`;
1717	bool eexist = flags & IPSET_FLAG_EXIST, retried = false;
1718
1719	do {
1720	if (retried) {
1721	__ip_set_get_netlink(set);
1722	nfnl_unlock(NFNL_SUBSYS_IPSET);
1723	cond_resched();
1724	nfnl_lock(NFNL_SUBSYS_IPSET);
1725	__ip_set_put_netlink(set);
1726	}
1727
1728	ip_set_lock(set);
1729	ret = set->variant->uadt(set, tb, adt, &lineno, flags, retried);
1730	ip_set_unlock(set);
1731	retried = true;
1732	} while (ret == -ERANGE \|\|
1733	(ret == -EAGAIN &&
1734	set->variant->resize &&
1735	(ret = set->variant->resize(set, retried)) == `0`));
1736
1737	if (!ret \|\| (ret == -IPSET_ERR_EXIST && eexist))
1738	return `0`;
1739	if (lineno && use_lineno) {
1740	/ Error in restore/batch mode: send back lineno /
1741	struct nlmsghdr rep, nlh = nlmsg_hdr(skb);
1742	struct sk_buff *skb2;
1743	struct nlmsgerr *errmsg;
1744	size_t payload = min(SIZE_MAX,
1745	sizeof(*errmsg) + nlmsg_len(nlh));
1746	int min_len = nlmsg_total_size(payload: sizeof(struct nfgenmsg));
1747	struct nlattr *cda[IPSET_ATTR_CMD_MAX + `1`];
1748	struct nlattr *cmdattr;
1749	u32 *errline;
1750
1751	skb2 = nlmsg_new(payload, GFP_KERNEL);
1752	if (!skb2)
1753	return -ENOMEM;
1754	rep = nlmsg_put(skb: skb2, NETLINK_CB(skb).portid,
1755	seq: nlh->nlmsg_seq, NLMSG_ERROR, payload, flags: `0`);
1756	errmsg = nlmsg_data(nlh: rep);
1757	errmsg->error = ret;
1758	unsafe_memcpy(&errmsg->msg, nlh, nlh->nlmsg_len,
1759	/ Bounds checked by the skb layer. /);
1760
1761	cmdattr = (void *)&errmsg->msg + min_len;
1762
1763	ret = nla_parse(tb: cda, IPSET_ATTR_CMD_MAX, head: cmdattr,
1764	len: nlh->nlmsg_len - min_len, policy: ip_set_adt_policy,
1765	NULL);
1766
1767	if (ret) {
1768	nlmsg_free(skb: skb2);
1769	return ret;
1770	}
1771	errline = nla_data(nla: cda[IPSET_ATTR_LINENO]);
1772
1773	*errline = lineno;
1774
1775	nfnetlink_unicast(skb: skb2, net, NETLINK_CB(skb).portid);
1776	/ Signal netlink not to send its ACK/errmsg. /
1777	return -EINTR;
1778	}
1779
1780	return ret;
1781	}
1782
1783	static int ip_set_ad(struct net net, struct* sock *ctnl,
1784	struct sk_buff *skb,
1785	enum ipset_adt adt,
1786	const struct nlmsghdr *nlh,
1787	const struct nlattr * const attr[],
1788	struct netlink_ext_ack *extack)
1789	{
1790	struct ip_set_net *inst = ip_set_pernet(net);
1791	struct ip_set *set;
1792	struct nlattr *tb[IPSET_ATTR_ADT_MAX + `1`] = {};
1793	const struct nlattr *nla;
1794	u32 flags = flag_exist(nlh);
1795	bool use_lineno;
1796	int ret = `0`;
1797
1798	if (unlikely(protocol_min_failed(attr) \|\|
1799	!attr[IPSET_ATTR_SETNAME] \|\|
1800	!((attr[IPSET_ATTR_DATA] != NULL) ^
1801	(attr[IPSET_ATTR_ADT] != NULL)) \|\|
1802	(attr[IPSET_ATTR_DATA] &&
1803	!flag_nested(attr[IPSET_ATTR_DATA])) \|\|
1804	(attr[IPSET_ATTR_ADT] &&
1805	(!flag_nested(attr[IPSET_ATTR_ADT]) \|\|
1806	!attr[IPSET_ATTR_LINENO]))))
1807	return -IPSET_ERR_PROTOCOL;
1808
1809	set = find_set(inst, name: nla_data(nla: attr[IPSET_ATTR_SETNAME]));
1810	if (!set)
1811	return -ENOENT;
1812
1813	use_lineno = !!attr[IPSET_ATTR_LINENO];
1814	if (attr[IPSET_ATTR_DATA]) {
1815	if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX,
1816	nla: attr[IPSET_ATTR_DATA],
1817	policy: set->type->adt_policy, NULL))
1818	return -IPSET_ERR_PROTOCOL;
1819	ret = call_ad(net, ctnl, skb, set, tb, adt, flags,
1820	use_lineno);
1821	} else {
1822	int nla_rem;
1823
1824	nla_for_each_nested(nla, attr[IPSET_ATTR_ADT], nla_rem) {
1825	if (nla_type(nla) != IPSET_ATTR_DATA \|\|
1826	!flag_nested(nla) \|\|
1827	nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, nla,
1828	policy: set->type->adt_policy, NULL))
1829	return -IPSET_ERR_PROTOCOL;
1830	ret = call_ad(net, ctnl, skb, set, tb, adt,
1831	flags, use_lineno);
1832	if (ret < `0`)
1833	return ret;
1834	}
1835	}
1836	return ret;
1837	}
1838
1839	static int ip_set_uadd(struct sk_buff skb, const* struct nfnl_info *info,
1840	const struct nlattr * const attr[])
1841	{
1842	return ip_set_ad(net: info->net, ctnl: info->sk, skb,
1843	adt: IPSET_ADD, nlh: info->nlh, attr, extack: info->extack);
1844	}
1845
1846	static int ip_set_udel(struct sk_buff skb, const* struct nfnl_info *info,
1847	const struct nlattr * const attr[])
1848	{
1849	return ip_set_ad(net: info->net, ctnl: info->sk, skb,
1850	adt: IPSET_DEL, nlh: info->nlh, attr, extack: info->extack);
1851	}
1852
1853	static int ip_set_utest(struct sk_buff skb, const* struct nfnl_info *info,
1854	const struct nlattr * const attr[])
1855	{
1856	struct ip_set_net *inst = ip_set_pernet(net: info->net);
1857	struct ip_set *set;
1858	struct nlattr *tb[IPSET_ATTR_ADT_MAX + `1`] = {};
1859	int ret = `0`;
1860	u32 lineno;
1861
1862	if (unlikely(protocol_min_failed(attr) \|\|
1863	!attr[IPSET_ATTR_SETNAME] \|\|
1864	!attr[IPSET_ATTR_DATA] \|\|
1865	!flag_nested(attr[IPSET_ATTR_DATA])))
1866	return -IPSET_ERR_PROTOCOL;
1867
1868	set = find_set(inst, name: nla_data(nla: attr[IPSET_ATTR_SETNAME]));
1869	if (!set)
1870	return -ENOENT;
1871
1872	if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, nla: attr[IPSET_ATTR_DATA],
1873	policy: set->type->adt_policy, NULL))
1874	return -IPSET_ERR_PROTOCOL;
1875
1876	rcu_read_lock_bh();
1877	ret = set->variant->uadt(set, tb, IPSET_TEST, &lineno, `0`, `0`);
1878	rcu_read_unlock_bh();
1879	/ Userspace can't trigger element to be re-added /
1880	if (ret == -EAGAIN)
1881	ret = `1`;
1882
1883	return ret > `0` ? `0` : -IPSET_ERR_EXIST;
1884	}
1885
1886	/ Get headed data of a set /
1887
1888	static int ip_set_header(struct sk_buff skb, const* struct nfnl_info *info,
1889	const struct nlattr * const attr[])
1890	{
1891	struct ip_set_net *inst = ip_set_pernet(net: info->net);
1892	const struct ip_set *set;
1893	struct sk_buff *skb2;
1894	struct nlmsghdr *nlh2;
1895
1896	if (unlikely(protocol_min_failed(attr) \|\|
1897	!attr[IPSET_ATTR_SETNAME]))
1898	return -IPSET_ERR_PROTOCOL;
1899
1900	set = find_set(inst, name: nla_data(nla: attr[IPSET_ATTR_SETNAME]));
1901	if (!set)
1902	return -ENOENT;
1903
1904	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1905	if (!skb2)
1906	return -ENOMEM;
1907
1908	nlh2 = start_msg(skb: skb2, NETLINK_CB(skb).portid, seq: info->nlh->nlmsg_seq, flags: `0`,
1909	cmd: IPSET_CMD_HEADER);
1910	if (!nlh2)
1911	goto nlmsg_failure;
1912	if (nla_put_u8(skb: skb2, attrtype: IPSET_ATTR_PROTOCOL, value: protocol(tb: attr)) \|\|
1913	nla_put_string(skb: skb2, attrtype: IPSET_ATTR_SETNAME, str: set->name) \|\|
1914	nla_put_string(skb: skb2, attrtype: IPSET_ATTR_TYPENAME, str: set->type->name) \|\|
1915	nla_put_u8(skb: skb2, attrtype: IPSET_ATTR_FAMILY, value: set->family) \|\|
1916	nla_put_u8(skb: skb2, attrtype: IPSET_ATTR_REVISION, value: set->revision))
1917	goto nla_put_failure;
1918	nlmsg_end(skb: skb2, nlh: nlh2);
1919
1920	return nfnetlink_unicast(skb: skb2, net: info->net, NETLINK_CB(skb).portid);
1921
1922	nla_put_failure:
1923	nlmsg_cancel(skb: skb2, nlh: nlh2);
1924	nlmsg_failure:
1925	kfree_skb(skb: skb2);
1926	return -EMSGSIZE;
1927	}
1928
1929	/ Get type data /
1930
1931	static const struct nla_policy ip_set_type_policy[IPSET_ATTR_CMD_MAX + `1`] = {
1932	[IPSET_ATTR_PROTOCOL] = { .type = NLA_U8 },
1933	[IPSET_ATTR_TYPENAME] = { .type = NLA_NUL_STRING,
1934	.len = IPSET_MAXNAMELEN - `1` },
1935	[IPSET_ATTR_FAMILY] = { .type = NLA_U8 },
1936	};
1937
1938	static int ip_set_type(struct sk_buff skb, const* struct nfnl_info *info,
1939	const struct nlattr * const attr[])
1940	{
1941	struct sk_buff *skb2;
1942	struct nlmsghdr *nlh2;
1943	u8 family, min, max;
1944	const char *typename;
1945	int ret = `0`;
1946
1947	if (unlikely(protocol_min_failed(attr) \|\|
1948	!attr[IPSET_ATTR_TYPENAME] \|\|
1949	!attr[IPSET_ATTR_FAMILY]))
1950	return -IPSET_ERR_PROTOCOL;
1951
1952	family = nla_get_u8(nla: attr[IPSET_ATTR_FAMILY]);
1953	typename = nla_data(nla: attr[IPSET_ATTR_TYPENAME]);
1954	ret = find_set_type_minmax(typename, family, &min, &max);
1955	if (ret)
1956	return ret;
1957
1958	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1959	if (!skb2)
1960	return -ENOMEM;
1961
1962	nlh2 = start_msg(skb: skb2, NETLINK_CB(skb).portid, seq: info->nlh->nlmsg_seq, flags: `0`,
1963	cmd: IPSET_CMD_TYPE);
1964	if (!nlh2)
1965	goto nlmsg_failure;
1966	if (nla_put_u8(skb: skb2, attrtype: IPSET_ATTR_PROTOCOL, value: protocol(tb: attr)) \|\|
1967	nla_put_string(skb: skb2, attrtype: IPSET_ATTR_TYPENAME, str: typename) \|\|
1968	nla_put_u8(skb: skb2, attrtype: IPSET_ATTR_FAMILY, value: family) \|\|
1969	nla_put_u8(skb: skb2, attrtype: IPSET_ATTR_REVISION, value: max) \|\|
1970	nla_put_u8(skb: skb2, attrtype: IPSET_ATTR_REVISION_MIN, value: min))
1971	goto nla_put_failure;
1972	nlmsg_end(skb: skb2, nlh: nlh2);
1973
1974	pr_debug("Send TYPE, nlmsg_len: %u\n", nlh2->nlmsg_len);
1975	return nfnetlink_unicast(skb: skb2, net: info->net, NETLINK_CB(skb).portid);
1976
1977	nla_put_failure:
1978	nlmsg_cancel(skb: skb2, nlh: nlh2);
1979	nlmsg_failure:
1980	kfree_skb(skb: skb2);
1981	return -EMSGSIZE;
1982	}
1983
1984	/ Get protocol version /
1985
1986	static const struct nla_policy
1987	ip_set_protocol_policy[IPSET_ATTR_CMD_MAX + `1`] = {
1988	[IPSET_ATTR_PROTOCOL] = { .type = NLA_U8 },
1989	};
1990
1991	static int ip_set_protocol(struct sk_buff skb, const* struct nfnl_info *info,
1992	const struct nlattr * const attr[])
1993	{
1994	struct sk_buff *skb2;
1995	struct nlmsghdr *nlh2;
1996
1997	if (unlikely(!attr[IPSET_ATTR_PROTOCOL]))
1998	return -IPSET_ERR_PROTOCOL;
1999
2000	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2001	if (!skb2)
2002	return -ENOMEM;
2003
2004	nlh2 = start_msg(skb: skb2, NETLINK_CB(skb).portid, seq: info->nlh->nlmsg_seq, flags: `0`,
2005	cmd: IPSET_CMD_PROTOCOL);
2006	if (!nlh2)
2007	goto nlmsg_failure;
2008	if (nla_put_u8(skb: skb2, attrtype: IPSET_ATTR_PROTOCOL, IPSET_PROTOCOL))
2009	goto nla_put_failure;
2010	if (nla_put_u8(skb: skb2, attrtype: IPSET_ATTR_PROTOCOL_MIN, IPSET_PROTOCOL_MIN))
2011	goto nla_put_failure;
2012	nlmsg_end(skb: skb2, nlh: nlh2);
2013
2014	return nfnetlink_unicast(skb: skb2, net: info->net, NETLINK_CB(skb).portid);
2015
2016	nla_put_failure:
2017	nlmsg_cancel(skb: skb2, nlh: nlh2);
2018	nlmsg_failure:
2019	kfree_skb(skb: skb2);
2020	return -EMSGSIZE;
2021	}
2022
2023	/ Get set by name or index, from userspace /
2024
2025	static int ip_set_byname(struct sk_buff skb, const* struct nfnl_info *info,
2026	const struct nlattr * const attr[])
2027	{
2028	struct ip_set_net *inst = ip_set_pernet(net: info->net);
2029	struct sk_buff *skb2;
2030	struct nlmsghdr *nlh2;
2031	ip_set_id_t id = IPSET_INVALID_ID;
2032	const struct ip_set *set;
2033
2034	if (unlikely(protocol_failed(attr) \|\|
2035	!attr[IPSET_ATTR_SETNAME]))
2036	return -IPSET_ERR_PROTOCOL;
2037
2038	set = find_set_and_id(inst, name: nla_data(nla: attr[IPSET_ATTR_SETNAME]), id: &id);
2039	if (id == IPSET_INVALID_ID)
2040	return -ENOENT;
2041
2042	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2043	if (!skb2)
2044	return -ENOMEM;
2045
2046	nlh2 = start_msg(skb: skb2, NETLINK_CB(skb).portid, seq: info->nlh->nlmsg_seq, flags: `0`,
2047	cmd: IPSET_CMD_GET_BYNAME);
2048	if (!nlh2)
2049	goto nlmsg_failure;
2050	if (nla_put_u8(skb: skb2, attrtype: IPSET_ATTR_PROTOCOL, value: protocol(tb: attr)) \|\|
2051	nla_put_u8(skb: skb2, attrtype: IPSET_ATTR_FAMILY, value: set->family) \|\|
2052	nla_put_net16(skb: skb2, attrtype: IPSET_ATTR_INDEX, htons(id)))
2053	goto nla_put_failure;
2054	nlmsg_end(skb: skb2, nlh: nlh2);
2055
2056	return nfnetlink_unicast(skb: skb2, net: info->net, NETLINK_CB(skb).portid);
2057
2058	nla_put_failure:
2059	nlmsg_cancel(skb: skb2, nlh: nlh2);
2060	nlmsg_failure:
2061	kfree_skb(skb: skb2);
2062	return -EMSGSIZE;
2063	}
2064
2065	static const struct nla_policy ip_set_index_policy[IPSET_ATTR_CMD_MAX + `1`] = {
2066	[IPSET_ATTR_PROTOCOL] = { .type = NLA_U8 },
2067	[IPSET_ATTR_INDEX] = { .type = NLA_U16 },
2068	};
2069
2070	static int ip_set_byindex(struct sk_buff skb, const* struct nfnl_info *info,
2071	const struct nlattr * const attr[])
2072	{
2073	struct ip_set_net *inst = ip_set_pernet(net: info->net);
2074	struct sk_buff *skb2;
2075	struct nlmsghdr *nlh2;
2076	ip_set_id_t id = IPSET_INVALID_ID;
2077	const struct ip_set *set;
2078
2079	if (unlikely(protocol_failed(attr) \|\|
2080	!attr[IPSET_ATTR_INDEX]))
2081	return -IPSET_ERR_PROTOCOL;
2082
2083	id = ip_set_get_h16(attr: attr[IPSET_ATTR_INDEX]);
2084	if (id >= inst->ip_set_max)
2085	return -ENOENT;
2086	set = ip_set(inst, id);
2087	if (set == NULL)
2088	return -ENOENT;
2089
2090	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2091	if (!skb2)
2092	return -ENOMEM;
2093
2094	nlh2 = start_msg(skb: skb2, NETLINK_CB(skb).portid, seq: info->nlh->nlmsg_seq, flags: `0`,
2095	cmd: IPSET_CMD_GET_BYINDEX);
2096	if (!nlh2)
2097	goto nlmsg_failure;
2098	if (nla_put_u8(skb: skb2, attrtype: IPSET_ATTR_PROTOCOL, value: protocol(tb: attr)) \|\|
2099	nla_put_string(skb: skb2, attrtype: IPSET_ATTR_SETNAME, str: set->name))
2100	goto nla_put_failure;
2101	nlmsg_end(skb: skb2, nlh: nlh2);
2102
2103	return nfnetlink_unicast(skb: skb2, net: info->net, NETLINK_CB(skb).portid);
2104
2105	nla_put_failure:
2106	nlmsg_cancel(skb: skb2, nlh: nlh2);
2107	nlmsg_failure:
2108	kfree_skb(skb: skb2);
2109	return -EMSGSIZE;
2110	}
2111
2112	static const struct nfnl_callback ip_set_netlink_subsys_cb[IPSET_MSG_MAX] = {
2113	[IPSET_CMD_NONE] = {
2114	.call = ip_set_none,
2115	.type = NFNL_CB_MUTEX,
2116	.attr_count = IPSET_ATTR_CMD_MAX,
2117	},
2118	[IPSET_CMD_CREATE] = {
2119	.call = ip_set_create,
2120	.type = NFNL_CB_MUTEX,
2121	.attr_count = IPSET_ATTR_CMD_MAX,
2122	.policy = ip_set_create_policy,
2123	},
2124	[IPSET_CMD_DESTROY] = {
2125	.call = ip_set_destroy,
2126	.type = NFNL_CB_MUTEX,
2127	.attr_count = IPSET_ATTR_CMD_MAX,
2128	.policy = ip_set_setname_policy,
2129	},
2130	[IPSET_CMD_FLUSH] = {
2131	.call = ip_set_flush,
2132	.type = NFNL_CB_MUTEX,
2133	.attr_count = IPSET_ATTR_CMD_MAX,
2134	.policy = ip_set_setname_policy,
2135	},
2136	[IPSET_CMD_RENAME] = {
2137	.call = ip_set_rename,
2138	.type = NFNL_CB_MUTEX,
2139	.attr_count = IPSET_ATTR_CMD_MAX,
2140	.policy = ip_set_setname2_policy,
2141	},
2142	[IPSET_CMD_SWAP] = {
2143	.call = ip_set_swap,
2144	.type = NFNL_CB_MUTEX,
2145	.attr_count = IPSET_ATTR_CMD_MAX,
2146	.policy = ip_set_setname2_policy,
2147	},
2148	[IPSET_CMD_LIST] = {
2149	.call = ip_set_dump,
2150	.type = NFNL_CB_MUTEX,
2151	.attr_count = IPSET_ATTR_CMD_MAX,
2152	.policy = ip_set_dump_policy,
2153	},
2154	[IPSET_CMD_SAVE] = {
2155	.call = ip_set_dump,
2156	.type = NFNL_CB_MUTEX,
2157	.attr_count = IPSET_ATTR_CMD_MAX,
2158	.policy = ip_set_setname_policy,
2159	},
2160	[IPSET_CMD_ADD] = {
2161	.call = ip_set_uadd,
2162	.type = NFNL_CB_MUTEX,
2163	.attr_count = IPSET_ATTR_CMD_MAX,
2164	.policy = ip_set_adt_policy,
2165	},
2166	[IPSET_CMD_DEL] = {
2167	.call = ip_set_udel,
2168	.type = NFNL_CB_MUTEX,
2169	.attr_count = IPSET_ATTR_CMD_MAX,
2170	.policy = ip_set_adt_policy,
2171	},
2172	[IPSET_CMD_TEST] = {
2173	.call = ip_set_utest,
2174	.type = NFNL_CB_MUTEX,
2175	.attr_count = IPSET_ATTR_CMD_MAX,
2176	.policy = ip_set_adt_policy,
2177	},
2178	[IPSET_CMD_HEADER] = {
2179	.call = ip_set_header,
2180	.type = NFNL_CB_MUTEX,
2181	.attr_count = IPSET_ATTR_CMD_MAX,
2182	.policy = ip_set_setname_policy,
2183	},
2184	[IPSET_CMD_TYPE] = {
2185	.call = ip_set_type,
2186	.type = NFNL_CB_MUTEX,
2187	.attr_count = IPSET_ATTR_CMD_MAX,
2188	.policy = ip_set_type_policy,
2189	},
2190	[IPSET_CMD_PROTOCOL] = {
2191	.call = ip_set_protocol,
2192	.type = NFNL_CB_MUTEX,
2193	.attr_count = IPSET_ATTR_CMD_MAX,
2194	.policy = ip_set_protocol_policy,
2195	},
2196	[IPSET_CMD_GET_BYNAME] = {
2197	.call = ip_set_byname,
2198	.type = NFNL_CB_MUTEX,
2199	.attr_count = IPSET_ATTR_CMD_MAX,
2200	.policy = ip_set_setname_policy,
2201	},
2202	[IPSET_CMD_GET_BYINDEX] = {
2203	.call = ip_set_byindex,
2204	.type = NFNL_CB_MUTEX,
2205	.attr_count = IPSET_ATTR_CMD_MAX,
2206	.policy = ip_set_index_policy,
2207	},
2208	};
2209
2210	static struct nfnetlink_subsystem ip_set_netlink_subsys __read_mostly = {
2211	.name = "ip_set",
2212	.subsys_id = NFNL_SUBSYS_IPSET,
2213	.cb_count = IPSET_MSG_MAX,
2214	.cb = ip_set_netlink_subsys_cb,
2215	};
2216
2217	/ Interface to iptables/ip6tables /
2218
2219	static int
2220	ip_set_sockfn_get(struct sock sk, int* optval, void __user user, int* *len)
2221	{
2222	unsigned int *op;
2223	void *data;
2224	int copylen = *len, ret = `0`;
2225	struct net *net = sock_net(sk);
2226	struct ip_set_net *inst = ip_set_pernet(net);
2227
2228	if (!ns_capable(ns: net->user_ns, CAP_NET_ADMIN))
2229	return -EPERM;
2230	if (optval != SO_IP_SET)
2231	return -EBADF;
2232	if (len < sizeof(unsigned* int))
2233	return -EINVAL;
2234
2235	data = vmalloc(size: *len);
2236	if (!data)
2237	return -ENOMEM;
2238	if (copy_from_user(to: data, from: user, n: *len) != `0`) {
2239	ret = -EFAULT;
2240	goto done;
2241	}
2242	op = data;
2243
2244	if (*op < IP_SET_OP_VERSION) {
2245	/ Check the version at the beginning of operations /
2246	struct ip_set_req_version *req_version = data;
2247
2248	if (len < sizeof(struct* ip_set_req_version)) {
2249	ret = -EINVAL;
2250	goto done;
2251	}
2252
2253	if (req_version->version < IPSET_PROTOCOL_MIN) {
2254	ret = -EPROTO;
2255	goto done;
2256	}
2257	}
2258
2259	switch (*op) {
2260	case IP_SET_OP_VERSION: {
2261	struct ip_set_req_version *req_version = data;
2262
2263	if (len != sizeof(struct* ip_set_req_version)) {
2264	ret = -EINVAL;
2265	goto done;
2266	}
2267
2268	req_version->version = IPSET_PROTOCOL;
2269	if (copy_to_user(to: user, from: req_version,
2270	n: sizeof(struct ip_set_req_version)))
2271	ret = -EFAULT;
2272	goto done;
2273	}
2274	case IP_SET_OP_GET_BYNAME: {
2275	struct ip_set_req_get_set *req_get = data;
2276	ip_set_id_t id;
2277
2278	if (len != sizeof(struct* ip_set_req_get_set)) {
2279	ret = -EINVAL;
2280	goto done;
2281	}
2282	req_get->set.name[IPSET_MAXNAMELEN - `1`] = `'\0'`;
2283	nfnl_lock(NFNL_SUBSYS_IPSET);
2284	find_set_and_id(inst, name: req_get->set.name, id: &id);
2285	req_get->set.index = id;
2286	nfnl_unlock(NFNL_SUBSYS_IPSET);
2287	goto copy;
2288	}
2289	case IP_SET_OP_GET_FNAME: {
2290	struct ip_set_req_get_set_family *req_get = data;
2291	ip_set_id_t id;
2292
2293	if (len != sizeof(struct* ip_set_req_get_set_family)) {
2294	ret = -EINVAL;
2295	goto done;
2296	}
2297	req_get->set.name[IPSET_MAXNAMELEN - `1`] = `'\0'`;
2298	nfnl_lock(NFNL_SUBSYS_IPSET);
2299	find_set_and_id(inst, name: req_get->set.name, id: &id);
2300	req_get->set.index = id;
2301	if (id != IPSET_INVALID_ID)
2302	req_get->family = ip_set(inst, id)->family;
2303	nfnl_unlock(NFNL_SUBSYS_IPSET);
2304	goto copy;
2305	}
2306	case IP_SET_OP_GET_BYINDEX: {
2307	struct ip_set_req_get_set *req_get = data;
2308	struct ip_set *set;
2309
2310	if (len != sizeof(struct* ip_set_req_get_set) \|\|
2311	req_get->set.index >= inst->ip_set_max) {
2312	ret = -EINVAL;
2313	goto done;
2314	}
2315	nfnl_lock(NFNL_SUBSYS_IPSET);
2316	set = ip_set(inst, req_get->set.index);
2317	ret = strscpy(req_get->set.name, set ? set->name : "",
2318	IPSET_MAXNAMELEN);
2319	nfnl_unlock(NFNL_SUBSYS_IPSET);
2320	if (ret < `0`)
2321	goto done;
2322	goto copy;
2323	}
2324	default:
2325	ret = -EBADMSG;
2326	goto done;
2327	} / end of switch(op) /
2328
2329	copy:
2330	if (copy_to_user(to: user, from: data, n: copylen))
2331	ret = -EFAULT;
2332
2333	done:
2334	vfree(addr: data);
2335	if (ret > `0`)
2336	ret = `0`;
2337	return ret;
2338	}
2339
2340	static struct nf_sockopt_ops so_set __read_mostly = {
2341	.pf = PF_INET,
2342	.get_optmin = SO_IP_SET,
2343	.get_optmax = SO_IP_SET + `1`,
2344	.get = ip_set_sockfn_get,
2345	.owner = THIS_MODULE,
2346	};
2347
2348	static int __net_init
2349	ip_set_net_init(struct net *net)
2350	{
2351	struct ip_set_net *inst = ip_set_pernet(net);
2352	struct ip_set **list;
2353
2354	inst->ip_set_max = max_sets ? max_sets : CONFIG_IP_SET_MAX;
2355	if (inst->ip_set_max >= IPSET_INVALID_ID)
2356	inst->ip_set_max = IPSET_INVALID_ID - `1`;
2357
2358	list = kvcalloc(n: inst->ip_set_max, size: sizeof(struct ip_set *), GFP_KERNEL);
2359	if (!list)
2360	return -ENOMEM;
2361	inst->is_deleted = false;
2362	inst->is_destroyed = false;
2363	rcu_assign_pointer(inst->ip_set_list, list);
2364	return `0`;
2365	}
2366
2367	static void __net_exit
2368	ip_set_net_exit(struct net *net)
2369	{
2370	struct ip_set_net *inst = ip_set_pernet(net);
2371
2372	struct ip_set *set = NULL;
2373	ip_set_id_t i;
2374
2375	inst->is_deleted = true; / flag for ip_set_nfnl_put /
2376
2377	nfnl_lock(NFNL_SUBSYS_IPSET);
2378	for (i = `0`; i < inst->ip_set_max; i++) {
2379	set = ip_set(inst, i);
2380	if (set) {
2381	ip_set(inst, i) = NULL;
2382	set->variant->cancel_gc(set);
2383	ip_set_destroy_set(set);
2384	}
2385	}
2386	nfnl_unlock(NFNL_SUBSYS_IPSET);
2387	kvfree(rcu_dereference_protected(inst->ip_set_list, `1`));
2388	}
2389
2390	static struct pernet_operations ip_set_net_ops = {
2391	.init = ip_set_net_init,
2392	.exit = ip_set_net_exit,
2393	.id = &ip_set_net_id,
2394	.size = sizeof(struct ip_set_net),
2395	};
2396
2397	static int __init
2398	ip_set_init(void)
2399	{
2400	int ret = register_pernet_subsys(&ip_set_net_ops);
2401
2402	if (ret) {
2403	pr_err("ip_set: cannot register pernet_subsys.\n");
2404	return ret;
2405	}
2406
2407	ret = nfnetlink_subsys_register(n: &ip_set_netlink_subsys);
2408	if (ret != `0`) {
2409	pr_err("ip_set: cannot register with nfnetlink.\n");
2410	unregister_pernet_subsys(&ip_set_net_ops);
2411	return ret;
2412	}
2413
2414	ret = nf_register_sockopt(reg: &so_set);
2415	if (ret != `0`) {
2416	pr_err("SO_SET registry failed: %d\n", ret);
2417	nfnetlink_subsys_unregister(n: &ip_set_netlink_subsys);
2418	unregister_pernet_subsys(&ip_set_net_ops);
2419	return ret;
2420	}
2421
2422	return `0`;
2423	}
2424
2425	static void __exit
2426	ip_set_fini(void)
2427	{
2428	nf_unregister_sockopt(reg: &so_set);
2429	nfnetlink_subsys_unregister(n: &ip_set_netlink_subsys);
2430	unregister_pernet_subsys(&ip_set_net_ops);
2431
2432	/ Wait for call_rcu() in destroy /
2433	rcu_barrier();
2434
2435	pr_debug("these are the famous last words\n");
2436	}
2437
2438	module_init(ip_set_init);
2439	module_exit(ip_set_fini);
2440
2441	MODULE_DESCRIPTION("ip_set: protocol " __stringify(IPSET_PROTOCOL));
2442

source code of linux/net/netfilter/ipset/ip_set_core.c