ip-array_ipset_functions

#!/usr/bin/env bash

# ------------------------------------------------------------------------- #

  #*#   ######             #
   #    #     #           # #    #####   #####     ##     #   #
   #    #     #          #   #   #    #  #    #   #  #     # #
   #    ######   #####  #     #  #    #  #    #  #    #     #
   #    #               #######  #####   #####   ######     #
   #    #               #     #  #   #   #   #   #    #     #
  ###   #               #     #  #    #  #    #  #    #     #

# ------------------------------------------------------------------------- #
#
#    Copyright (C) 2005-2018 Mart Frauenlob aka AllKind
#
#    This program is free software; you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation; either version 2 of the License, or
#    (at your option) any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program; if not, write to the Free Software
#    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
#
# ------------------------------------------------------------------------- #
#
#                      IP-ARRAY IPSET FUNCTIONS
#
# ------------------------------------------------------------------------- #

# ------------------------------------------------------------------------- #
# IPSET
# ------------------------------------------------------------------------- #

val_setname() { # validate name of an ipset set
[[ $1 ]] || { reqparm $FUNCNAME 1; return 1; }
[[ ${1:0:1} = : && $IPSET_SYNTAX = old ]] && {
	log -E "Invalid setname \`$1' - must not begin with a colon."
	return 1
}
[[ $1 != *+([[:space:]])* ]] || {
	log -E "Invalid setname \`$1' - must not contain spaces."
	return 1
}
} # -------------------------------------------------------------------------

val_ipset_port_spec() {
[[ $1 ]] || { reqparm $FUNCNAME 1; return 1; }
local str_p="$1"
case "$1" in
	@(tcp|sctp|udp|udplite):\[*+([[:alpha:]])*\]-\[*+([[:alpha:]])*\])
		val_port_range_word "${1#@(tcp|sctp|udp|udplite):}" || return
	;;
	@(tcp|sctp|udp|udplite):\[*+([[:alpha:]])*\]-+([[:word:]]))
		val_port_range_word "${1#@(tcp|sctp|udp|udplite):}" || return
	;;
	@(tcp|sctp|udp|udplite):+([[:word:]])-\[*+([[:alpha:]])*\])
		val_port_range_word "${1#@(tcp|sctp|udp|udplite):}" || return
	;;
	@(tcp|sctp|udp|udplite):@(+([[:word:]])-+([[:word:]])|+([[:digit:]])-+([[:digit:]])))
		val_port_range_word "${1#@(tcp|sctp|udp|udplite):}" || return
	;;
	@(tcp|sctp|udp|udplite):@(+([[:word:]])|+([[:digit:]])))
		val_port "${1#@(tcp|sctp|udp|udplite):}" || return
	;;
	@(tcp|sctp|udp|udplite):\[*+([[:alpha:]])*\])
		str_p="${1#@(tcp|sctp|udp|udplite):\[}"
		str_p="${str_p%\]}"
		val_port "$str_p" || return
	;;
	icmp:*)
		val_icmp_type "${1#icmp:}" || return
	;;
	+([[:word:]])-+([[:word:]])|+([[:digit:]])-+([[:digit:]]))
		val_port_range_word "$1" || return
	;;
	+([[:word:]])-+([[:word:]]))
		val_port_range_word "$1" || return
	;;
	\[*\]-\[*\]|\[*\]-+([[:word:]])|+([[:word:]])-\[*\])
		val_port_range_word "$1" || return
	;;
	+([[:digit:]]):0|*+([[:alpha:]])*:0)
		val_proto "${1%:0}" || return
	;;
	+([[:digit:]])|+([[:word:]]))
		val_port "$1" || return
	;;
	\[*+([[:alpha:]])*-*+([[:alpha:]])*\])
		str_p="${str_p#[}"
		str_p="${str_p%]}"
		val_port "$str_p" || return
	;;
	*) log -E "Invalid entry \`$1' expecting: [proto:]port."
		return 1
esac
} # -------------------------------------------------------------------------

_ipset_check_common_create_opts() {
if [[ $option = @(comment|counters|skbinfo) ]]; then
	if ((IPSET_VERSION[0] < 6)); then
		log -E "Option \`$option' is not supported: ipset version is too old."
		return 1
	fi
fi
case "$option" in
	comment)
		# ipset -ge v6.20 has comment flag
		if ((IPSET_VERSION[0] == 6 && IPSET_VERSION[1] < 20)); then
			log -E "Option \`$option' is not supported: ipset version is too old."
			return 1
		fi
	;;
	counters)
		# ipset -ge v6.19 has counters flag
		if ((IPSET_VERSION[0] == 6 && IPSET_VERSION[1] < 19)); then
			log -E "Option \`$option' is not supported: ipset version is too old."
			return 1
		fi
	;;
	skbinfo)
		# ipset -ge v6.22 has skbinfo flag
		if ((IPSET_VERSION[0] == 6 && IPSET_VERSION[1] < 22)); then
			log -E "Option \`$option' is not supported: ipset version is too old."
			return 1
		fi
	;;
	timeout)
		val_numeric "$opt_arg" || return 1
	;;
esac
} # -------------------------------------------------------------------------

ipset_create() { # create an ipset set (cache commands)
[[ $2 ]] || { reqparm $FUNCNAME 2; return 1; }
((USE_IPSET)) || {
	log -W "ipset usage is disabled. set creation command will be ignored."
	return 0
}
local str_set="$1" str_type="$2" str_create="-N" str_tmp
shift 2
local -a arr_opts
local option opt_arg
local strERR="Failed creating set \`$str_set'."
local str_failcmd='eval log -F "$strERR"; raise_cfg_err_count; return 0'
val_setname "$str_set" || { raise_cfg_err_count; return $ER_CONF; }
check_set_exist "$str_set" && {
	log -W "ipset set \`$str_set' has already been created."
	return 0
}
lsearch "$str_type" $UNSUPPORTED_SETLIST && {
	log -E "ipset set type \`$str_type' is not supported."
	$str_failcmd
}
if ((${#CREATED_SETS_ARRAY[@]} == $MAX_SETS)); then
	log -E "The maximum amount of sets that can be created ($MAX_SETS) has been reached."
	$str_failcmd
fi
if [[ $IPSET_SYNTAX = new ]]; then
	str_create=create
fi
case "$str_type" in
	bitmap:ip|bitmap:ip,mac|bitmap:port)
		local -a arr_opts=("$@")
		while (($#)); do
			option="$1" opt_arg="$2"
			case "$option" in
				range|netmask|timeout)
					if [[ -z $opt_arg ]]; then
						log -E "$strERR Missing value to option \`$option' for \`$str_type' set."
						$str_failcmd
					fi
				;;
			esac
			_ipset_check_common_create_opts || $str_failcmd
			case "$option" in
				comment|counters|skbinfo) : ;;
				timeout) shift ;;
				range)
					if [[ $str_type = bitmap:port ]]; then
						if ((IPSET_VERSION[0] > 6)) || ((IPSET_VERSION[0] == 6 && IPSET_VERSION[1] >= 20)); then
							# ipset versions greater or equal to 6.20 allow proto:port specification
							val_ipset_port_spec "$opt_arg" || $str_failcmd
						else
							val_port_range_word "$opt_arg" || $str_failcmd
						fi
					else
						val_ip4_addr "$opt_arg" || $str_failcmd
					fi
					shift
				;;
				netmask)
					if [[ $str_type = bitmap:ip ]]; then
						val_numeric "$opt_arg" || $str_failcmd
						((opt_arg >= 1 && opt_arg <= 32)) || {
							log -E "$strERR Invalid value \`$opt_arg' with \`$option' for \`$str_type' set. Valid range: 1-32."
							$str_failcmd
						}
					else
						log -E "$strERR Invalid option \`$option' for \`$str_type' set."
						$str_failcmd

					fi
					shift
				;;
				*) log -E "$strERR Invalid option \`$option' for \`$str_type' set."
					$str_failcmd
				;;
			esac
			shift
		done
	;;
	hash:ip|hash:net|hash:ip,port|hash:net,port|hash:ip,port,ip|hash:ip,port,net|hash:net,iface|hash:net,port,net|hash:ip,mark|hash:mac)
		local -a arr_opts=("$@")
		while (($#)); do
			option="$1" opt_arg="$2"
			if [[ $option = @(family|maxelem|hashsize|timeout|markmask) ]]; then
				if [[ -z $opt_arg ]]; then
					log -E "$strERR Missing value to option \`$option' for \`$str_type' set."
					$str_failcmd
				fi
			fi
			_ipset_check_common_create_opts || $str_failcmd
			case "$option" in
				comment|counters|skbinfo) : ;;
				timeout) shift ;;
				forceadd)
					if ((IPSET_VERSION[0] < 6)); then
						log -E "Option \`$option' is not supported: ipset version is too old."
						$str_failcmd
					fi
					# ipset -ge v6.22 has forceadd flag
					if ((IPSET_VERSION[0] == 6 && IPSET_VERSION[1] < 22)); then
						log -E "Option \`$option' is not supported: ipset version is too old."
						$str_failcmd
					fi
				;;
				markmask)
					if ((IPSET_VERSION[0] < 6)); then
						log -E "Option \`$option' is not supported: ipset version is too old."
						$str_failcmd
					fi
					# ipset -ge v6.21 has markmask flag
					if ((IPSET_VERSION[0] == 6 && IPSET_VERSION[1] < 21)); then
						log -E "Option \`$option' is not supported: ipset version is too old."
						$str_failcmd
					fi
					if [[ $str_type != hash:ip,mark ]]; then
						log -E "Option  \`$option' is only available for hash:ip,mark type of sets."
						$str_failcmd
					fi
					val_32bit_off1 "$opt_arg" || {
						log -E "$strERR Value \`$opt_arg' is not valid for the markmask option must be between 1 and 4294967295."
						$str_failcmd
					}
					shift
				;;
				family)
					if [[ $str_type = hash:mac ]]; then
						log -E "$strERR Option  \`$option' is not available for hash:mac type of sets."
						$str_failcmd
					fi
					if [[ $opt_arg = inet6 ]]; then
						log -E "Option argument \`$opt_arg' is not supported."
						$str_failcmd
					elif [[ $opt_arg = inet ]]; then :
					else
						log -E "$strERR Invalid value \`$opt_arg' with \`$option' for \`$str_type' set. Valid values: inet|inet6."
						$str_failcmd
					fi
					shift
				;;
				hashsize)
					val_numeric "$opt_arg" || $str_failcmd
					shift
				;;
				maxelem)
					val_numeric "$opt_arg" || $str_failcmd
					shift
				;;
				netmask)
					case "$str_type" in
						hash:ip)
							((opt_arg >= 1 && opt_arg <= 32)) || {
								log -E "$strERR Invalid value \`$opt_arg' with \`$option' for \`$str_type' set. Valid range: 1-32."
								$str_failcmd
							}
						;;
						*) log -E "$strERR Invalid option \`$option' for \`$str_type' set."
							$str_failcmd
					esac
					shift
				;;
				*) log -E "$strERR Invalid option \`$option' for \`$str_type' set."
					$str_failcmd
			esac
			shift
		done
	;;
	list:set)
		local -a arr_opts=("$@")
		while (($#)); do
			option="$1" opt_arg="$2"
			if [[ $option = @(timeout|size) ]]; then
				if [[ -z $opt_arg ]]; then
					log -E "$strERR Missing value to option \`$option' for \`$str_type' set."
					$str_failcmd
				fi
			fi
			_ipset_check_common_create_opts || $str_failcmd
			case "$option" in
				comment|counters|skbinfo) : ;;
				timeout) shift ;;
				size)
					val_numeric "$opt_arg" || $str_failcmd
					shift
				;;
				*) log -E "$strERR Invalid option \`$option' for \`$str_type' set."
					$str_failcmd
			esac
			shift
		done
	;;
	ipmap)
		local str_from="" str_to="" str_netmask=""
		while (($#)); do
			option="$1" opt_arg="$2"
			if [[ -z $opt_arg ]]; then
				log -E "$strERR Missing value to option \`$option' for \`$str_type' set."
				$str_failcmd
			fi
			case "$option" in
				from)
					val_ip4_ip "$opt_arg" || $str_failcmd
					str_from="--$option $opt_arg"
				;;
				to)
					val_ip4_ip "$opt_arg" || $str_failcmd
					str_to="--$option $opt_arg"
				;;
				network)
					val_ip4_cidr_net "$opt_arg" || $str_failcmd
					str_network="--$option $opt_arg"
				;;
				netmask)
					((opt_arg >= 1 opt_arg && <= 31)) || {
						log -E "$strERR Invalid value \`$opt_arg' with \`$option' for \`$str_type' set. Valid range: 1-31."
						$str_failcmd
					}
					str_netmask="--$option $opt_arg"
				;;
				*) log -E "$strERR Invalid option \`$option' for \`$str_type' set."
					$str_failcmd
			esac
			shift 2
		done
		if [[ $str_network ]]; then
			if [[ $str_netmask ]]; then arr_opts=($str_network $str_netmask)
			else arr_opts=($str_network)
			fi
		fi
		if [[ $str_from ]]; then
			if [[ $str_to ]]; then
				if [[ $str_netmask ]]; then arr_opts=($str_from $str_to $str_netmask)
				else arr_opts=($str_from $str_to)
				fi
			else
				log -E "$strErr \`$str_type' needs \`from value to value' options."
				$str_failcmd
			fi
		fi
		if [[ $str_netmask ]] && [[ -z $str_from || -z $str_to ]]; then
			log -E "$strErr \`$str_type' option \`netmask' needs \`from value to value' options."
			$str_failcmd
		fi
	;;
	macipmap)
		local str_from="" str_to=""
		while (($#)); do
			option="$1" opt_arg="$2"
			case "$option" in
				from|to|network)
					if [[ -z $opt_arg ]]; then
						log -E "$strERR Missing value to option \`$option' for \`$str_type' set."
						$str_failcmd
					fi
				;;
			esac
			case "$option" in
				from)
					val_ip4_ip "$opt_arg" || $str_failcmd
					str_from="--$option $opt_arg"
					shift
				;;
				to)
					val_ip4_ip "$opt_arg" || $str_failcmd
					str_to="--$option $opt_arg"
					shift
				;;
				network)
					val_ip4_cidr_net "$opt_arg" || $str_failcmd
					arr_opts=(--$option $opt_arg)
					shift
				;;
				matchunset)
					arr_opts[${#arr_opts[@]}]="--$option"
				;;
				*) log -E "$strERR Invalid option \`$option' for \`$str_type' set."
					$str_failcmd
			esac
			shift
		done
		if [[ $str_from && $str_to ]]; then
			arr_opts=($str_from $str_to)
		elif [[ $str_from && -z $str_to ]]; then
			log -E "$strErr \`$str_type' needs \`from value to value' options."
			$str_failcmd
		fi
	;;
	portmap)
		if (($# == 4)); then
			if [[ $1 = from && $2 = +([[:digit:]]) && $3 = to && $4 = +([[:digit:]]) ]]; then
				for rvar in $2 $4; do
					val_port $rvar || $str_failcmd
				done
				arr_opts=(--from $2 --to $4)
			else
				log -E "$strErr \`$str_type' needs \`from value to value' options."
				$str_failcmd
			fi
		else
			log -E "$strErr \`$str_type' needs \`from value to value' options."
			$str_failcmd
		fi
	;;
	iphash)
		while (($#)); do
			option="$1" opt_arg="$2"
			case "$option" in
				hashsize|probes)
					val_numeric "$opt_arg" || $str_failcmd
					arr_opts[${#arr_opts[@]}]="--$option $opt_arg"
				;;
				resize)
					val_numeric "$opt_arg" || $str_failcmd
					arr_opts[${#arr_opts[@]}]="--$option $opt_arg"
				;;
				netmask)
					((opt_arg >= 1 && opt_arg <= 31)) || {
						log -E "$strERR Invalid value \`$opt_arg' with \`$option' for \`$str_type' set. Valid range: 1-31."
						$str_failcmd
					}
					arr_opts[${#arr_opts[@]}]="--$option $opt_arg"
				;;
				*) log -E "$strERR Invalid option \`$option' for \`$str_type' set."
					$str_failcmd
			esac
			shift 2
		done
	;;
	nethash)
		while (($#)); do
			option="$1" opt_arg="$2"
			if [[ -z $opt_arg ]]; then
				log -E "$strERR Missing value to option \`$option' for \`$str_type' set."
				$str_failcmd
			fi
			case "$option" in
				hashsize|probes)
					val_numeric "$opt_arg" || $str_failcmd
					arr_opts[${#arr_opts[@]}]="--$option $opt_arg"
				;;
				resize)
					val_numeric "$opt_arg" || $str_failcmd
					arr_opts[${#arr_opts[@]}]="--$option $opt_arg"
				;;
				*) log -E "$strERR Invalid option \`$option' for \`$str_type' set."
					$str_failcmd
			esac
			shift 2
		done
	;;
	ipporthash|ipportiphash|ipportnethash)
		local str_from="" str_to=""
		while (($#)); do
			option="$1" opt_arg="$2"
			if [[ -z $opt_arg ]]; then
				log -E "$strERR Missing value to option \`$option' for \`$str_type' set."
				$str_failcmd
			fi
			case "$option" in
				from)
					val_ip4_ip "$opt_arg" || $str_failcmd
					str_from="--$option $opt_arg"
				;;
				to)
					val_ip4_ip "$opt_arg" || $str_failcmd
					str_to="--$option $opt_arg"
				;;
				network)
					val_ip4_cidr_net "$opt_arg" || $str_failcmd
					arr_opts[${#arr_opts[@]}]="--$option $opt_arg"
				;;
				hashsize|probes)
					val_numeric "$opt_arg" || $str_failcmd
					arr_opts[${#arr_opts[@]}]="--$option $opt_arg"
				;;
				resize)
					val_numeric "$opt_arg" || $str_failcmd
					arr_opts[${#arr_opts[@]}]="--$option $opt_arg"
				;;
				*) log -E "$strERR Invalid option \`$option' for \`$str_type' set."
					$str_failcmd
			esac
			shift 2
		done
		if [[ $str_from && $str_to ]]; then
			arr_opts[${#arr_opts[@]}]="$str_from $str_to"
		else
			if [[ $str_from && -z $str_to ]] || [[ -z $str_from && $str_to ]]; then
				log -E "$strErr \`$str_type' needs \`from value to value' options."
				$str_failcmd
			fi
		fi
	;;
	iptree|iptreemap|setlist)
		local i_tmp=0
		if [[ $1 ]]; then
			case "$str_type" in
				iptree) [[ $1 = timeout ]] && i_tmp=1 ;;
				iptreemap) [[ $1 = gc ]] && i_tmp=1 ;;
				setlist) [[ $1 = size ]] && i_tmp=1 ;;
			esac
			if ((i_tmp)); then
				if [[ $2 ]]; then
					if [[ $2 = +([[:digit:]]) ]]; then
						arr_opts=(--$1 $2)
					else
						log -E "$strERR Invalid value \`$2' with option \`$1' for \`$str_type' set."
						$str_failcmd
					fi
				else
					log -E "$strERR Missing value to option \`$1' for \`$str_type' set."
					$str_failcmd
				fi
			else
				log -E "$strERR Invalid option \`$1' for \`$str_type' set."
				$str_failcmd
			fi
		fi
	;;
	*) log -E "Unknown set type \`$str_type'."
		$str_failcmd
esac
log -e "creating set: \`$str_set' of type: \`$str_type'"
IPSET_SETS_ARRAY[${#IPSET_SETS_ARRAY[@]}]="$str_create $str_set $str_type ${arr_opts[@]}"
CREATED_SETS_ARRAY[${#CREATED_SETS_ARRAY[@]}]="$str_set $str_type"
} # -------------------------------------------------------------------------

ipset_add() { # add an entry (cache) to an ipset set
[[ $2 ]] || { reqparm $FUNCNAME 2; return 1; }
((USE_IPSET)) || {
	log -W "ipset usage is disabled. ipset commands will be ignored."
	return 0
}
local str_set="$1" str_in="$2" str_entry="$2" str_cmd="-A" str_type str_in option opt_arg
local strERR="adding entry to set: \`$*'"
local str_failcmd='eval log -F "$strERR"; raise_cfg_err_count; return 0'
shift 2
local arr_opts=("$@")
if [[ $IPSET_SYNTAX = new ]]; then
	str_cmd=add
fi
check_set_exist "$str_set" || {
	log -E "ipset set \`$str_set' has not been created."
	$str_failcmd
}
str_type=$(printf "%s\n" "${CREATED_SETS_ARRAY[@]}" | lsearch_echo "$str_set")
str_type=${str_type#$str_set }
case $str_type in
	ipmap|bitmap:ip|iphash|hash:ip)
		val_ip4_addr "$str_in" || $str_failcmd
	;;
	nethash|hash:net)
		val_ip4_cidr_net "$str_in" || $str_failcmd
	;;
	macipmap|bitmap:ip,mac)
		val_ip4_ip "${str_in%,*}" || $str_failcmd
		val_mac "${str_in#*,}" || $str_failcmd
	;;
	portmap|bitmap:port)
		case "$str_in" in
			*-*|\[*\]-\[*\]) val_port_range_word "$str_in" || $str_failcmd ;;
			*) val_port "$str_in" || $str_failcmd
		esac
	;;
	iptree)
		case "$str_in" in
			*,*)
				val_ip4_ip "${str_in%,*}" || $str_failcmd
				val_numeric "${str_in#*,}" || $str_failcmd # timeout
			;;
			*) val_ip4_ip "$str_in" || $str_failcmd
		esac
	;;
	iptreemap)
		case "$str_in" in
			*,*)
				val_ip4_addr "${str_in%,*}" || $str_failcmd
				val_numeric "${str_in#*,}" || $str_failcmd # timeout
			;;
			*) val_ip4_addr "$str_in" || $str_failcmd
		esac
	;;
	ipporthash)
		case "$str_in" in
			*,*)
				val_ip4_ip "${str_in%,*}" || $str_failcmd
				val_port "${str_in#*,}" || $str_failcmd
			;;
			*) log -E "Invalid entry \`$str_in' expecting: ip,port."
				$str_failcmd
		esac
	;;
	ipportiphash)
		case "$str_in" in
			*,*,*)
				val_ip4_ip "${str_in%%,*}" || $str_failcmd
				val_ip4_ip "${str_in##*,}" || $str_failcmd
				str_in="${str_in%,*}"
				val_port "${str_in#*,}" || $str_failcmd
			;;
			*) log -E "Invalid entry \`$str_in' expecting: ip,port."
				$str_failcmd
		esac
	;;
	ipportnethash)
		case "$str_in" in
			*,*,*)
				val_ip4_ip "${str_in%%,*}" || $str_failcmd
				val_ip4_cidr_net "${str_in##*,}" || $str_failcmd
				str_in="${str_in%,*}"
				val_port "${str_in#*,}" || $str_failcmd
			;;
			*) log -E "Invalid entry \`$str_in' expecting: ip,port."
				$str_failcmd
		esac
	;;
	hash:ip,port|hash:net,port)
		case "$str_in" in
			*,*)
				case "$str_type" in
					hash:ip,port)
						val_ip4_ip "${str_in%,*}" || $str_failcmd
					;;
					hash:net,port)
						val_ip4_cidr_net "${str_in%,*}" || $str_failcmd
					;;
				esac
				val_ipset_port_spec "${str_in#*,}" || $str_failcmd
			;;
			*) log -E "Invalid entry \`$str_in' expecting: ip,[proto:]port."
				$str_failcmd
		esac
	;;
	hash:ip,port,ip|hash:ip,port,net|hash:net,port,net)
		case "$str_in" in
			*,*,*)
				case "$str_type" in
					hash:ip,port,ip)
						val_ip4_ip "${str_in%%,*}" || $str_failcmd
						val_ip4_ip "${str_in##*,}" || $str_failcmd
					;;
					hash:ip,port,net)
						val_ip4_ip "${str_in%%,*}" || $str_failcmd
						val_ip4_cidr_net "${str_in##*,}" || $str_failcmd
					;;
					hash:net,port,net)
						val_ip4_cidr_net "${str_in%%,*}" || $str_failcmd
						val_ip4_cidr_net "${str_in##*,}" || $str_failcmd
					;;
				esac
				str_in="${str_in%,*}"; str_in="${str_in#*,}"
				val_ipset_port_spec "$str_in" || $str_failcmd
			;;
			*) log -E "Invalid entry \`$str_in' expecting: (ip|net),[proto:]port,[ip|net]."
				$str_failcmd
		esac
	;;
	hash:net,iface)
		val_ip4_cidr_net "${str_in%,*}" || $str_failcmd
		check_iface "${str_in#*,}" || $str_failcmd
	;;
	hash:ip,mark)
		val_ip4_ip "${str_in%,*}" || $str_failcmd
		val_32bit "${str_in#*,}" || $str_failcmd
	;;
	hash:mac)
		val_mac "$str_in" || $str_failcmd
	;;
	setlist|list:set)
		case "$str_in" in
			*,@(before|after),*)
				if [[ $IPSET_SYNTAX = old ]]; then
					str_in="${str_in/,@(before|after),/ }"
				else
					log -E "Expecting \`before|after' as seperate option."
					$str_failcmd
				fi
			;;
		esac
		for str_tmp in $str_in; do
			check_set_exist "$str_tmp" || {
				log -E "ipset set \`$str_tmp' has not been created."
				$str_failcmd
			}
		done
	;;
	"")
		log -U $FUNCNAME
		log -f "$strERR"
		raise_gen_err_count
		return 1
	;;
esac
while (($#)); do # remaining options
	option="$1" opt_arg="$2"
	shift
	if [[ $IPSET_SYNTAX = new ]]; then
		if [[ $option = @(bytes|packets|comment|nomatch|skbmark|skbprio|skbqueue) ]]; then
			if ((IPSET_VERSION[0] < 6)); then
				log -E "Option \`$option' is not supported: ipset version is too old."
				$str_failcmd
			fi
		fi
		case "$option" in
			comment)
				# ipset -ge v6.20 has comment flag
				if ((IPSET_VERSION[0] == 6 && IPSET_VERSION[1] < 20)); then
					log -E "Option \`$option' is not supported: ipset version is too old."
					$str_failcmd
				fi
				shift
			;;
			bytes|packets)
				# ipset -ge v6.19 has counters flag
				if ((IPSET_VERSION[0] == 6 && IPSET_VERSION[1] < 19)); then
					log -E "Option \`$option' is not supported: ipset version is too old."
					$str_failcmd
				fi
				val_numeric "$opt_arg" || $str_failcmd
				shift
			;;
			skbmark|skbprio|skbqueue)
				# ipset -ge v6.22 has comment flag
				if ((IPSET_VERSION[0] == 6 && IPSET_VERSION[1] < 22)); then
					log -E "Option \`$option' is not supported: ipset version is too old."
					$str_failcmd
				fi
				shift
			;;
			timeout)
				val_numeric "$opt_arg" || $str_failcmd
				shift
			;;
			nomatch)
				[[ $str_type = @(hash:net|hash:net,port|hash:ip,port,net|hash:net,iface|hash:net,port,net) ]] || {
					log -E "Option \`$option' is not valid with set of type \`$str_type'."
					$str_failcmd
				}
			;;
			before|after)
				[[ $str_type = list:set ]] || {
					log -E "Option \`$option' is not valid with set of type \`$str_type'."
					$str_failcmd
				}
				check_set_exist "$opt_arg" || {
					log -E "ipset set \`$opt_arg' has not been created."
					$str_failcmd
				}
				shift
			;;
			-\!|-exist|-q|-quiet) : ;;
			*) log -E "Option \`$option' is unknown."
				$str_failcmd
		esac
	else
		case "$option" in
			-q|--quiet) : ;;
			quiet)
				for opt_arg in ${!arr_opts[@]}; do
					if [[ ${arr_opts[opt_arg]} = quiet ]]; then
						arr_opts[opt_arg]=--quiet
						break
					fi
				done
			;;
			*) log -E "Option \`$option' is unknown."
				$str_failcmd
		esac
	fi
done
log -e "adding to set: $str_set $str_entry ${arr_opts[@]}"
IPSET_ENTRIES_ARRAY[${#IPSET_ENTRIES_ARRAY[@]}]="$str_cmd $str_set $str_entry ${arr_opts[@]}"
} # -------------------------------------------------------------------------

ipset_destroy() {
local str_set="$1" str_cmd="-X"
if [[ $IPSET_SYNTAX = new ]]; then
	str_cmd=destroy
fi
if [[ $str_set ]]; then
	val_setname "$str_set" || return
	run_ipset $str_cmd "$str_set"
else
	run_ipset $str_cmd
fi
} # -------------------------------------------------------------------------

ipset_list() {
local str_set="$1" str_cmd="-L"
if [[ $IPSET_SYNTAX = new ]]; then
	str_cmd=list
fi
if [[ $str_set ]]; then
	val_setname "$str_set" || return
	run_ipset $str_cmd "$str_set"
else
	run_ipset $str_cmd
fi
} # -------------------------------------------------------------------------

ipset_flush() {
local str_set="$1" str_cmd="-F"
if [[ $IPSET_SYNTAX = new ]]; then
	str_cmd=flush
fi
if [[ $str_set ]]; then
	val_setname "$str_set" || return
	run_ipset $str_cmd "$str_set"
else
	run_ipset $str_cmd
fi
} # -------------------------------------------------------------------------

ipset_save() {
local str_set="$1" str_cmd="-S"
if [[ $IPSET_SYNTAX = new ]]; then
	str_cmd=save
fi
if [[ $str_set ]]; then
	val_setname "$str_set" || return
	run_ipset $str_cmd "$str_set"
else
	run_ipset $str_cmd
fi
} # -------------------------------------------------------------------------

ipset_restore() {
local str_cmd="-R"
if [[ $IPSET_SYNTAX = new ]]; then
	str_cmd=restore
fi
run_ipset $str_cmd
} # -------------------------------------------------------------------------

ipset_test() {
[[ $2 ]] || { reqparm $FUNCNAME 2; return 1; }
local str_set="$1" str_entry="$2" str_cmd="-T"
if [[ $IPSET_SYNTAX = new ]]; then
	str_cmd=test
fi
val_setname "$str_set" || return
run_ipset $str_cmd "$str_set" "$str_entry"
} # -------------------------------------------------------------------------

ipset_version_check() {
local str_typename
log -e "Checking for ipset version"
if ! [[ $IPSET && -x $IPSET ]]; then
	USE_IPSET=0
	return 0
else
	if dn run_ipset list; then
		IPSET_SYNTAX=new
		IPSET_VERSION="$(run_ipset version)"
	else
		ISET_SYNTAX=old
		IPSET_VERSION="$(run_ipset --version)"
	fi
	IPSET_VERSION="${IPSET_VERSION#ipset v}"
	IPSET_VERSION="${IPSET_VERSION%,+([[:blank:]])protocol*}"
	read -a IPSET_VERSION <<< ${IPSET_VERSION//./ }
	[[ ${IPSET_VERSION[0]} = +([[:digit:]]) ]] || {
		log -f "retrieving ipset version"
		return $ER_FAIL
	}
	readonly IPSET_VERSION
	[[ $DEBUG_INFO ]] && dbg_arr IPSET_VERSION
	for str_typename in $(show_array_column IPARRAY_IPSET_SETTYPE_LIST); do
		if ((IPSET_VERSION[0] >= 6)) && [[ $str_typename != *:* ]]; then
			log -w "Adding \`$str_typename' set type to list of unsupported set types."
			UNSUPPORTED_SETLIST+=" $str_typename"
			continue
		elif ((IPSET_VERSION[0] < 6)) && [[ $str_typename = *:* ]]; then
			log -w "Adding \`$str_typename' set type to list of unsupported set types."
			UNSUPPORTED_SETLIST+=" $str_typename"
			continue
		fi
	done
	if ((NO_IPT_COMPAT_CHECK)); then
	   readonly UNSUPPORTED_SETLIST
   fi
fi
} # -------------------------------------------------------------------------

test_ipset() {
[[ $1 ]] || { reqparm $FUNCNAME 1; return 1; }
[[ ${IPSET} && -x ${IPSET} ]] || return 0
((NO_IPT_COMPAT_CHECK == 0)) || return 0
local -i idx
local str_typename str_create="-N" str_destroy="-X" str_opt="ipmap --network 192.168.0.0/24" str_dn="dn"
[[ $DEBUG_INFO ]] && str_dn=""
if [[ $IPSET_SYNTAX = new ]]; then
	str_create="create" str_destroy="destroy" str_opt="hash:ip"
fi
case "$1" in
	create)
		if ((USE_IPSET)); then
			log -I "Checking for ipset set types"
			for idx in ${!IPARRAY_IPSET_SETTYPE_LIST[@]}; do
				set -- ${IPARRAY_IPSET_SETTYPE_LIST[idx]}
				str_typename="$1"
				shift
				if ((IPSET_VERSION[0] >= 6)) && [[ $str_typename != *:* ]]; then
					continue
				elif ((IPSET_VERSION[0] < 6)) && [[ $str_typename = *:* ]]; then
					continue
				fi
				log -e "${PF}checking for $str_typename type"
				if $str_dn run_ipset $str_create ${ME}_TEST_SET $str_typename $@; then
					$str_dn run_ipset $str_destroy ${ME}_TEST_SET
				else
					UNSUPPORTED_SETLIST+=" $str_typename"
					log -f "creating set: \`${ME}_TEST_SET $str_typename $@'"
				fi
			done
			readonly UNSUPPORTED_SETLIST
		fi
		# to make the test for the set match and SET target available,
		# we don't honour USE_IPSET here.
		log -w "creating ipset test set"
		$str_dn run_ipset $str_create ${ME}_TEST_SET $str_opt || {
			log -f "creating test set: ${ME}_TEST_SET $str_opt"
		}
	;;
	delete)
#		if ((IPSET_VERSION[0])); then # commented out as we bail out in version check
		log -w "deleting ipset test set"
		$str_dn run_ipset $str_destroy ${ME}_TEST_SET || {
			log -f "deleting test set: \`${ME}_TEST_SET'"
		}
#		fi
	;;
	*) log -o "$1" $FUNCNAME; return 1
esac
} # -------------------------------------------------------------------------

ipset_flush_destroy() {
if [[ $IPSET_SYNTAX = new ]]; then
	IPSET_CMD_ARRAY[${#IPSET_CMD_ARRAY[@]}]="flush"
	IPSET_CMD_ARRAY[${#IPSET_CMD_ARRAY[@]}]="destroy"
else
	IPSET_CMD_ARRAY[${#IPSET_CMD_ARRAY[@]}]="-F"
	IPSET_CMD_ARRAY[${#IPSET_CMD_ARRAY[@]}]="-X"
fi
} # -------------------------------------------------------------------------

ipset_merge_arrays() { # join entries to their according sets
local str_set
local -i idx eidx
ipset_flush_destroy
for idx in ${!IPSET_SETS_ARRAY[@]}; do
	IPSET_CMD_ARRAY[${#IPSET_CMD_ARRAY[@]}]=${IPSET_SETS_ARRAY[idx]}
	set -- ${IPSET_SETS_ARRAY[idx]}
	str_set=$2
	for eidx in ${!IPSET_ENTRIES_ARRAY[@]}; do
		set -- ${IPSET_ENTRIES_ARRAY[eidx]}
		if [[ $2 = $str_set ]]; then
			IPSET_CMD_ARRAY[${#IPSET_CMD_ARRAY[@]}]=$@
			unset IPSET_ENTRIES_ARRAY[eidx]
		fi
	done
done
} # -------------------------------------------------------------------------