2017-01-18 10:30:13 -07:00
|
|
|
/*
|
|
|
|
* Copyright (c) 2017 Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
|
|
* published by the Free Software Foundation.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
#include <linux/init.h>
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/list.h>
|
|
|
|
#include <linux/netlink.h>
|
|
|
|
#include <linux/netfilter.h>
|
|
|
|
#include <linux/netfilter/nf_tables.h>
|
|
|
|
#include <net/netfilter/nf_tables.h>
|
|
|
|
|
2017-03-10 10:32:31 -07:00
|
|
|
struct nft_bitmap_elem {
|
|
|
|
struct list_head head;
|
|
|
|
struct nft_set_ext ext;
|
|
|
|
};
|
|
|
|
|
2017-01-18 10:30:13 -07:00
|
|
|
/* This bitmap uses two bits to represent one element. These two bits determine
|
|
|
|
* the element state in the current and the future generation.
|
|
|
|
*
|
|
|
|
* An element can be in three states. The generation cursor is represented using
|
|
|
|
* the ^ character, note that this cursor shifts on every succesful transaction.
|
|
|
|
* If no transaction is going on, we observe all elements are in the following
|
|
|
|
* state:
|
|
|
|
*
|
|
|
|
* 11 = this element is active in the current generation. In case of no updates,
|
|
|
|
* ^ it stays active in the next generation.
|
|
|
|
* 00 = this element is inactive in the current generation. In case of no
|
|
|
|
* ^ updates, it stays inactive in the next generation.
|
|
|
|
*
|
|
|
|
* On transaction handling, we observe these two temporary states:
|
|
|
|
*
|
|
|
|
* 01 = this element is inactive in the current generation and it becomes active
|
|
|
|
* ^ in the next one. This happens when the element is inserted but commit
|
|
|
|
* path has not yet been executed yet, so activation is still pending. On
|
|
|
|
* transaction abortion, the element is removed.
|
|
|
|
* 10 = this element is active in the current generation and it becomes inactive
|
|
|
|
* ^ in the next one. This happens when the element is deactivated but commit
|
|
|
|
* path has not yet been executed yet, so removal is still pending. On
|
|
|
|
* transation abortion, the next generation bit is reset to go back to
|
|
|
|
* restore its previous state.
|
|
|
|
*/
|
|
|
|
struct nft_bitmap {
|
2017-03-10 10:32:31 -07:00
|
|
|
struct list_head list;
|
|
|
|
u16 bitmap_size;
|
|
|
|
u8 bitmap[];
|
2017-01-18 10:30:13 -07:00
|
|
|
};
|
|
|
|
|
netfilter: nft_set_bitmap: fetch the element key based on the set->klen
Currently we just assume the element key as a u32 integer, regardless of
the set key length.
This is incorrect, for example, the tcp port number is only 16 bits.
So when we use the nft_payload expr to get the tcp dport and store
it to dreg, the dport will be stored at 0~15 bits, and 16~31 bits
will be padded with zero.
So the reg->data[dreg] will be looked like as below:
0 15 31
+-+-+-+-+-+-+-+-+-+-+-+-+
| tcp dport | 0 |
+-+-+-+-+-+-+-+-+-+-+-+-+
But for these big-endian systems, if we treate this register as a u32
integer, the element key will be larger than 65535, so the following
lookup in bitmap set will cause out of bound access.
Another issue is that if we add element with comments in bitmap
set(although the comments will be ignored eventually), the element will
vanish strangely. Because we treate the element key as a u32 integer, so
the comments will become the part of the element key, then the element
key will also be larger than 65535 and out of bound access will happen:
# nft add element t s { 1 comment test }
Since set->klen is 1 or 2, it's fine to treate the element key as a u8 or
u16 integer.
Fixes: 665153ff5752 ("netfilter: nf_tables: add bitmap set type")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2017-03-05 09:02:52 -07:00
|
|
|
static inline void nft_bitmap_location(const struct nft_set *set,
|
|
|
|
const void *key,
|
|
|
|
u32 *idx, u32 *off)
|
2017-01-18 10:30:13 -07:00
|
|
|
{
|
netfilter: nft_set_bitmap: fetch the element key based on the set->klen
Currently we just assume the element key as a u32 integer, regardless of
the set key length.
This is incorrect, for example, the tcp port number is only 16 bits.
So when we use the nft_payload expr to get the tcp dport and store
it to dreg, the dport will be stored at 0~15 bits, and 16~31 bits
will be padded with zero.
So the reg->data[dreg] will be looked like as below:
0 15 31
+-+-+-+-+-+-+-+-+-+-+-+-+
| tcp dport | 0 |
+-+-+-+-+-+-+-+-+-+-+-+-+
But for these big-endian systems, if we treate this register as a u32
integer, the element key will be larger than 65535, so the following
lookup in bitmap set will cause out of bound access.
Another issue is that if we add element with comments in bitmap
set(although the comments will be ignored eventually), the element will
vanish strangely. Because we treate the element key as a u32 integer, so
the comments will become the part of the element key, then the element
key will also be larger than 65535 and out of bound access will happen:
# nft add element t s { 1 comment test }
Since set->klen is 1 or 2, it's fine to treate the element key as a u8 or
u16 integer.
Fixes: 665153ff5752 ("netfilter: nf_tables: add bitmap set type")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2017-03-05 09:02:52 -07:00
|
|
|
u32 k;
|
|
|
|
|
|
|
|
if (set->klen == 2)
|
|
|
|
k = *(u16 *)key;
|
|
|
|
else
|
|
|
|
k = *(u8 *)key;
|
|
|
|
k <<= 1;
|
2017-01-18 10:30:13 -07:00
|
|
|
|
|
|
|
*idx = k / BITS_PER_BYTE;
|
|
|
|
*off = k % BITS_PER_BYTE;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Fetch the two bits that represent the element and check if it is active based
|
|
|
|
* on the generation mask.
|
|
|
|
*/
|
|
|
|
static inline bool
|
|
|
|
nft_bitmap_active(const u8 *bitmap, u32 idx, u32 off, u8 genmask)
|
|
|
|
{
|
|
|
|
return (bitmap[idx] & (0x3 << off)) & (genmask << off);
|
|
|
|
}
|
|
|
|
|
|
|
|
static bool nft_bitmap_lookup(const struct net *net, const struct nft_set *set,
|
|
|
|
const u32 *key, const struct nft_set_ext **ext)
|
|
|
|
{
|
|
|
|
const struct nft_bitmap *priv = nft_set_priv(set);
|
|
|
|
u8 genmask = nft_genmask_cur(net);
|
|
|
|
u32 idx, off;
|
|
|
|
|
netfilter: nft_set_bitmap: fetch the element key based on the set->klen
Currently we just assume the element key as a u32 integer, regardless of
the set key length.
This is incorrect, for example, the tcp port number is only 16 bits.
So when we use the nft_payload expr to get the tcp dport and store
it to dreg, the dport will be stored at 0~15 bits, and 16~31 bits
will be padded with zero.
So the reg->data[dreg] will be looked like as below:
0 15 31
+-+-+-+-+-+-+-+-+-+-+-+-+
| tcp dport | 0 |
+-+-+-+-+-+-+-+-+-+-+-+-+
But for these big-endian systems, if we treate this register as a u32
integer, the element key will be larger than 65535, so the following
lookup in bitmap set will cause out of bound access.
Another issue is that if we add element with comments in bitmap
set(although the comments will be ignored eventually), the element will
vanish strangely. Because we treate the element key as a u32 integer, so
the comments will become the part of the element key, then the element
key will also be larger than 65535 and out of bound access will happen:
# nft add element t s { 1 comment test }
Since set->klen is 1 or 2, it's fine to treate the element key as a u8 or
u16 integer.
Fixes: 665153ff5752 ("netfilter: nf_tables: add bitmap set type")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2017-03-05 09:02:52 -07:00
|
|
|
nft_bitmap_location(set, key, &idx, &off);
|
2017-01-18 10:30:13 -07:00
|
|
|
|
|
|
|
return nft_bitmap_active(priv->bitmap, idx, off, genmask);
|
|
|
|
}
|
|
|
|
|
2017-03-10 10:32:31 -07:00
|
|
|
static struct nft_bitmap_elem *
|
|
|
|
nft_bitmap_elem_find(const struct nft_set *set, struct nft_bitmap_elem *this,
|
|
|
|
u8 genmask)
|
|
|
|
{
|
|
|
|
const struct nft_bitmap *priv = nft_set_priv(set);
|
|
|
|
struct nft_bitmap_elem *be;
|
|
|
|
|
|
|
|
list_for_each_entry_rcu(be, &priv->list, head) {
|
|
|
|
if (memcmp(nft_set_ext_key(&be->ext),
|
|
|
|
nft_set_ext_key(&this->ext), set->klen) ||
|
|
|
|
!nft_set_elem_active(&be->ext, genmask))
|
|
|
|
continue;
|
|
|
|
|
|
|
|
return be;
|
|
|
|
}
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2017-01-18 10:30:13 -07:00
|
|
|
static int nft_bitmap_insert(const struct net *net, const struct nft_set *set,
|
|
|
|
const struct nft_set_elem *elem,
|
2017-03-10 10:32:31 -07:00
|
|
|
struct nft_set_ext **ext)
|
2017-01-18 10:30:13 -07:00
|
|
|
{
|
|
|
|
struct nft_bitmap *priv = nft_set_priv(set);
|
2017-03-10 10:32:31 -07:00
|
|
|
struct nft_bitmap_elem *new = elem->priv, *be;
|
2017-01-18 10:30:13 -07:00
|
|
|
u8 genmask = nft_genmask_next(net);
|
|
|
|
u32 idx, off;
|
|
|
|
|
2017-03-10 10:32:31 -07:00
|
|
|
be = nft_bitmap_elem_find(set, new, genmask);
|
|
|
|
if (be) {
|
|
|
|
*ext = &be->ext;
|
2017-01-18 10:30:13 -07:00
|
|
|
return -EEXIST;
|
2017-03-10 10:32:31 -07:00
|
|
|
}
|
2017-01-18 10:30:13 -07:00
|
|
|
|
2017-03-10 10:32:31 -07:00
|
|
|
nft_bitmap_location(set, nft_set_ext_key(&new->ext), &idx, &off);
|
2017-01-18 10:30:13 -07:00
|
|
|
/* Enter 01 state. */
|
|
|
|
priv->bitmap[idx] |= (genmask << off);
|
2017-03-10 10:32:31 -07:00
|
|
|
list_add_tail_rcu(&new->head, &priv->list);
|
2017-01-18 10:30:13 -07:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void nft_bitmap_remove(const struct net *net,
|
|
|
|
const struct nft_set *set,
|
|
|
|
const struct nft_set_elem *elem)
|
|
|
|
{
|
|
|
|
struct nft_bitmap *priv = nft_set_priv(set);
|
2017-03-10 10:32:31 -07:00
|
|
|
struct nft_bitmap_elem *be = elem->priv;
|
2017-01-18 10:30:13 -07:00
|
|
|
u8 genmask = nft_genmask_next(net);
|
|
|
|
u32 idx, off;
|
|
|
|
|
2017-03-10 10:32:31 -07:00
|
|
|
nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
|
2017-01-18 10:30:13 -07:00
|
|
|
/* Enter 00 state. */
|
|
|
|
priv->bitmap[idx] &= ~(genmask << off);
|
2017-03-10 10:32:31 -07:00
|
|
|
list_del_rcu(&be->head);
|
2017-01-18 10:30:13 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static void nft_bitmap_activate(const struct net *net,
|
|
|
|
const struct nft_set *set,
|
|
|
|
const struct nft_set_elem *elem)
|
|
|
|
{
|
|
|
|
struct nft_bitmap *priv = nft_set_priv(set);
|
2017-03-10 10:32:31 -07:00
|
|
|
struct nft_bitmap_elem *be = elem->priv;
|
2017-01-18 10:30:13 -07:00
|
|
|
u8 genmask = nft_genmask_next(net);
|
|
|
|
u32 idx, off;
|
|
|
|
|
2017-03-10 10:32:31 -07:00
|
|
|
nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
|
2017-01-18 10:30:13 -07:00
|
|
|
/* Enter 11 state. */
|
|
|
|
priv->bitmap[idx] |= (genmask << off);
|
2017-03-10 10:32:31 -07:00
|
|
|
nft_set_elem_change_active(net, set, &be->ext);
|
2017-01-18 10:30:13 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static bool nft_bitmap_flush(const struct net *net,
|
2017-03-10 10:32:31 -07:00
|
|
|
const struct nft_set *set, void *_be)
|
2017-01-18 10:30:13 -07:00
|
|
|
{
|
|
|
|
struct nft_bitmap *priv = nft_set_priv(set);
|
|
|
|
u8 genmask = nft_genmask_next(net);
|
2017-03-10 10:32:31 -07:00
|
|
|
struct nft_bitmap_elem *be = _be;
|
2017-01-18 10:30:13 -07:00
|
|
|
u32 idx, off;
|
|
|
|
|
2017-03-10 10:32:31 -07:00
|
|
|
nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
|
2017-01-18 10:30:13 -07:00
|
|
|
/* Enter 10 state, similar to deactivation. */
|
|
|
|
priv->bitmap[idx] &= ~(genmask << off);
|
2017-03-10 10:32:31 -07:00
|
|
|
nft_set_elem_change_active(net, set, &be->ext);
|
2017-01-18 10:30:13 -07:00
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void *nft_bitmap_deactivate(const struct net *net,
|
|
|
|
const struct nft_set *set,
|
|
|
|
const struct nft_set_elem *elem)
|
|
|
|
{
|
|
|
|
struct nft_bitmap *priv = nft_set_priv(set);
|
2017-03-10 10:32:31 -07:00
|
|
|
struct nft_bitmap_elem *this = elem->priv, *be;
|
2017-01-18 10:30:13 -07:00
|
|
|
u8 genmask = nft_genmask_next(net);
|
netfilter: nft_set_bitmap: fetch the element key based on the set->klen
Currently we just assume the element key as a u32 integer, regardless of
the set key length.
This is incorrect, for example, the tcp port number is only 16 bits.
So when we use the nft_payload expr to get the tcp dport and store
it to dreg, the dport will be stored at 0~15 bits, and 16~31 bits
will be padded with zero.
So the reg->data[dreg] will be looked like as below:
0 15 31
+-+-+-+-+-+-+-+-+-+-+-+-+
| tcp dport | 0 |
+-+-+-+-+-+-+-+-+-+-+-+-+
But for these big-endian systems, if we treate this register as a u32
integer, the element key will be larger than 65535, so the following
lookup in bitmap set will cause out of bound access.
Another issue is that if we add element with comments in bitmap
set(although the comments will be ignored eventually), the element will
vanish strangely. Because we treate the element key as a u32 integer, so
the comments will become the part of the element key, then the element
key will also be larger than 65535 and out of bound access will happen:
# nft add element t s { 1 comment test }
Since set->klen is 1 or 2, it's fine to treate the element key as a u8 or
u16 integer.
Fixes: 665153ff5752 ("netfilter: nf_tables: add bitmap set type")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2017-03-05 09:02:52 -07:00
|
|
|
u32 idx, off;
|
2017-01-18 10:30:13 -07:00
|
|
|
|
netfilter: nft_set_bitmap: fetch the element key based on the set->klen
Currently we just assume the element key as a u32 integer, regardless of
the set key length.
This is incorrect, for example, the tcp port number is only 16 bits.
So when we use the nft_payload expr to get the tcp dport and store
it to dreg, the dport will be stored at 0~15 bits, and 16~31 bits
will be padded with zero.
So the reg->data[dreg] will be looked like as below:
0 15 31
+-+-+-+-+-+-+-+-+-+-+-+-+
| tcp dport | 0 |
+-+-+-+-+-+-+-+-+-+-+-+-+
But for these big-endian systems, if we treate this register as a u32
integer, the element key will be larger than 65535, so the following
lookup in bitmap set will cause out of bound access.
Another issue is that if we add element with comments in bitmap
set(although the comments will be ignored eventually), the element will
vanish strangely. Because we treate the element key as a u32 integer, so
the comments will become the part of the element key, then the element
key will also be larger than 65535 and out of bound access will happen:
# nft add element t s { 1 comment test }
Since set->klen is 1 or 2, it's fine to treate the element key as a u8 or
u16 integer.
Fixes: 665153ff5752 ("netfilter: nf_tables: add bitmap set type")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2017-03-05 09:02:52 -07:00
|
|
|
nft_bitmap_location(set, elem->key.val.data, &idx, &off);
|
2017-01-18 10:30:13 -07:00
|
|
|
|
2017-03-10 10:32:31 -07:00
|
|
|
be = nft_bitmap_elem_find(set, this, genmask);
|
|
|
|
if (!be)
|
2017-01-18 10:30:13 -07:00
|
|
|
return NULL;
|
|
|
|
|
|
|
|
/* Enter 10 state. */
|
|
|
|
priv->bitmap[idx] &= ~(genmask << off);
|
2017-03-10 10:32:31 -07:00
|
|
|
nft_set_elem_change_active(net, set, &be->ext);
|
2017-01-18 10:30:13 -07:00
|
|
|
|
2017-03-10 10:32:31 -07:00
|
|
|
return be;
|
2017-01-18 10:30:13 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static void nft_bitmap_walk(const struct nft_ctx *ctx,
|
|
|
|
struct nft_set *set,
|
|
|
|
struct nft_set_iter *iter)
|
|
|
|
{
|
|
|
|
const struct nft_bitmap *priv = nft_set_priv(set);
|
2017-03-10 10:32:31 -07:00
|
|
|
struct nft_bitmap_elem *be;
|
2017-01-18 10:30:13 -07:00
|
|
|
struct nft_set_elem elem;
|
2017-03-10 10:32:31 -07:00
|
|
|
|
|
|
|
list_for_each_entry_rcu(be, &priv->list, head) {
|
|
|
|
if (iter->count < iter->skip)
|
|
|
|
goto cont;
|
|
|
|
if (!nft_set_elem_active(&be->ext, iter->genmask))
|
|
|
|
goto cont;
|
|
|
|
|
|
|
|
elem.priv = be;
|
|
|
|
|
|
|
|
iter->err = iter->fn(ctx, set, iter, &elem);
|
|
|
|
|
|
|
|
if (iter->err < 0)
|
|
|
|
return;
|
2017-01-18 10:30:13 -07:00
|
|
|
cont:
|
2017-03-10 10:32:31 -07:00
|
|
|
iter->count++;
|
2017-01-18 10:30:13 -07:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* The bitmap size is pow(2, key length in bits) / bits per byte. This is
|
|
|
|
* multiplied by two since each element takes two bits. For 8 bit keys, the
|
|
|
|
* bitmap consumes 66 bytes. For 16 bit keys, 16388 bytes.
|
|
|
|
*/
|
|
|
|
static inline u32 nft_bitmap_size(u32 klen)
|
|
|
|
{
|
|
|
|
return ((2 << ((klen * BITS_PER_BYTE) - 1)) / BITS_PER_BYTE) << 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline u32 nft_bitmap_total_size(u32 klen)
|
|
|
|
{
|
|
|
|
return sizeof(struct nft_bitmap) + nft_bitmap_size(klen);
|
|
|
|
}
|
|
|
|
|
|
|
|
static unsigned int nft_bitmap_privsize(const struct nlattr * const nla[])
|
|
|
|
{
|
|
|
|
u32 klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
|
|
|
|
|
|
|
|
return nft_bitmap_total_size(klen);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int nft_bitmap_init(const struct nft_set *set,
|
|
|
|
const struct nft_set_desc *desc,
|
|
|
|
const struct nlattr * const nla[])
|
|
|
|
{
|
|
|
|
struct nft_bitmap *priv = nft_set_priv(set);
|
|
|
|
|
2017-03-10 10:32:31 -07:00
|
|
|
INIT_LIST_HEAD(&priv->list);
|
2017-02-26 09:12:11 -07:00
|
|
|
priv->bitmap_size = nft_bitmap_size(set->klen);
|
2017-01-18 10:30:13 -07:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void nft_bitmap_destroy(const struct nft_set *set)
|
|
|
|
{
|
2017-04-15 09:37:36 -06:00
|
|
|
struct nft_bitmap *priv = nft_set_priv(set);
|
|
|
|
struct nft_bitmap_elem *be, *n;
|
|
|
|
|
|
|
|
list_for_each_entry_safe(be, n, &priv->list, head)
|
|
|
|
nft_set_elem_destroy(set, be, true);
|
2017-01-18 10:30:13 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features,
|
|
|
|
struct nft_set_estimate *est)
|
|
|
|
{
|
|
|
|
/* Make sure bitmaps we don't get bitmaps larger than 16 Kbytes. */
|
|
|
|
if (desc->klen > 2)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
est->size = nft_bitmap_total_size(desc->klen);
|
|
|
|
est->lookup = NFT_SET_CLASS_O_1;
|
|
|
|
est->space = NFT_SET_CLASS_O_1;
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2017-05-22 10:47:51 -06:00
|
|
|
static struct nft_set_type nft_bitmap_type;
|
2017-01-18 10:30:13 -07:00
|
|
|
static struct nft_set_ops nft_bitmap_ops __read_mostly = {
|
2017-05-22 10:47:51 -06:00
|
|
|
.type = &nft_bitmap_type,
|
2017-01-18 10:30:13 -07:00
|
|
|
.privsize = nft_bitmap_privsize,
|
2017-03-10 10:32:31 -07:00
|
|
|
.elemsize = offsetof(struct nft_bitmap_elem, ext),
|
2017-01-18 10:30:13 -07:00
|
|
|
.estimate = nft_bitmap_estimate,
|
|
|
|
.init = nft_bitmap_init,
|
|
|
|
.destroy = nft_bitmap_destroy,
|
|
|
|
.insert = nft_bitmap_insert,
|
|
|
|
.remove = nft_bitmap_remove,
|
|
|
|
.deactivate = nft_bitmap_deactivate,
|
|
|
|
.flush = nft_bitmap_flush,
|
|
|
|
.activate = nft_bitmap_activate,
|
|
|
|
.lookup = nft_bitmap_lookup,
|
|
|
|
.walk = nft_bitmap_walk,
|
2017-05-22 10:47:51 -06:00
|
|
|
};
|
|
|
|
|
|
|
|
static struct nft_set_type nft_bitmap_type __read_mostly = {
|
|
|
|
.ops = &nft_bitmap_ops,
|
2017-01-18 10:30:13 -07:00
|
|
|
.owner = THIS_MODULE,
|
|
|
|
};
|
|
|
|
|
|
|
|
static int __init nft_bitmap_module_init(void)
|
|
|
|
{
|
2017-05-22 10:47:51 -06:00
|
|
|
return nft_register_set(&nft_bitmap_type);
|
2017-01-18 10:30:13 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
static void __exit nft_bitmap_module_exit(void)
|
|
|
|
{
|
2017-05-22 10:47:51 -06:00
|
|
|
nft_unregister_set(&nft_bitmap_type);
|
2017-01-18 10:30:13 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
module_init(nft_bitmap_module_init);
|
|
|
|
module_exit(nft_bitmap_module_exit);
|
|
|
|
|
|
|
|
MODULE_LICENSE("GPL");
|
|
|
|
MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
|
|
|
|
MODULE_ALIAS_NFT_SET();
|