summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Use unified diff output in testsJozsef Kadlecsik2011-04-1124-66/+66
|
* ipset 6.3 releasedv6.3Jozsef Kadlecsik2011-04-103-1/+13
|
* Testsuite checks addedJozsef Kadlecsik2011-04-103-0/+40
| | | | | | - check iptables match/target extensions with invalid number of dir parameters - check SET target with --del-set option
* set match and SET target fixesJozsef Kadlecsik2011-04-091-2/+16
| | | | | | | The SET target with --del-set did not work due to using wrongly the internal dimension of --add-set instead of --del-set. Also, the checkentries did not release the set references when returned an error. Bugs reported by Lennert Buytenhek.
* Whitespace fixes: some space before tab slipped in.Jozsef Kadlecsik2011-04-081-2/+2
|
* bitmap:ip,mac type requires "src" for MACJozsef Kadlecsik2011-04-082-3/+8
| | | | | | | | | Enforce that the second "src/dst" parameter of the set match and SET target must be "src", because we have access to the source MAC only in the packet. The previous behaviour, that the type required the second parameter but actually ignored the value was counter-intuitive and confusing. Manpage is updated to reflect the change.
* Testsuite changes: keep temporary filesJozsef Kadlecsik2011-04-0825-68/+68
| | | | | Keep temporary files in the tests and erase them only after successfully running the testsuite. This makes simpler to analyze failed tests.
* ipset/Kconfig was a mixed up kernel config file, fixed (Michael Tokarev)Jozsef Kadlecsik2011-03-291-1029/+73
|
* ipset 6.2 releasedv6.2Jozsef Kadlecsik2011-03-273-1/+10
|
* Manpage updateJozsef Kadlecsik2011-03-271-0/+2
|
* Timeout can be modified for already added elementsJozsef Kadlecsik2011-03-2721-101/+244
| | | | | | | | | | When an element to a set with timeout added, one can change the timeout by "readding" the element with the "-exist" flag. That means the timeout value is reset to the specified one (or to the default from the set specification if the "timeout n" option is not used). Example ipset add foo 1.2.3.4 timeout 10 ipset add foo 1.2.3.4 timeout 600 -exist
* Add explicit text message to detect patched kernel.Jozsef Kadlecsik2011-03-261-0/+13
|
* References are protected by rwlock instead of mutexJozsef Kadlecsik2011-03-258-56/+83
| | | | | | | The timeout variant of the list:set type must reference the member sets. However, its garbage collector runs at timer interrupt so the mutex protection of the references is a no go. Therefore the reference protection is converted to rwlock.
* list:set timeout variant fixesJozsef Kadlecsik2011-03-233-32/+61
| | | | | | | - the timeout value was actually not set - the garbage collector was broken The variant is fixed, the tests to the testsuite are added.
* ipset 6.1 releasedv6.1Jozsef Kadlecsik2011-03-193-1/+11
|
* Fix revision reportingJozsef Kadlecsik2011-03-192-5/+4
| | | | Revision reporting got broken by the revision checking patch, fixed.
* SCTP, UDPLITE support addedJozsef Kadlecsik2011-03-1815-43/+74
| | | | SCTP and UDPLITE port support added to the hash:*port* types.
* Fix checking the revision of the set type at create commandJozsef Kadlecsik2011-03-181-4/+16
| | | | | | The revision number was not checked at the create command: if the userspace sent a valid set type but with not supported revision number, it'd create a loop.
* Manpage was not installedJozsef Kadlecsik2011-03-181-0/+2
| | | | | Entry to install the manpage was missing from Makefile.am (reported by Mark A. Ziesemer)
* hash:ip,port* types with IPv4Jozsef Kadlecsik2011-03-185-94/+48
| | | | | | The hash:ip,port* types with IPv4 silently ignored when address ranges with non TCP/UDP were added/deleted from the set and the first address from the range was only used.
* netfilter:ipset: fix the compile warning in ip_set_createShan Wei2011-03-041-1/+1
| | | | | | | net/netfilter/ipset/ip_set_core.c:615: warning: ?clash? may be used uninitialized in this function Signed-off-by: shanw <shanw@shanw-desktop.(none)> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset 6.0 releasedv6.0Jozsef Kadlecsik2011-02-035-14/+59
|
* Print protocol version together with ipset versionJozsef Kadlecsik2011-02-031-1/+2
|
* Reorganized kernel/ subdirJozsef Kadlecsik2011-02-0322-131/+1133
| | | | | The kernel/ subdirectory is reorganized to follow the kernel directory structure.
* netfilter: ipset: fix linking with CONFIG_IPV6=nPatrick McHardy2011-02-032-6/+19
| | | | | | | | | Add some #ifdefs to unconditionally return false in ip_set_get_ip6_port() when CONFIG_IPV6=n and convert to ipv6_skip_exthdr() to avoid pulling in the ip6_tables module when loading ipset. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: ipset: send error message manuallyJozsef Kadlecsik2011-02-021-7/+26
| | | | | | | | | | | When a message carries multiple commands and one of them triggers an error, we have to report to the userspace which one was that. The line number of the command plays this role and there's an attribute reserved in the header part of the message to be filled out with the error line number. In order not to modify the original message received from the userspace, we construct a new, complete netlink error message and modifies the attribute there, then send it. Netlink is notified not to send its ACK/error message.
* netfilter: ipset: add missing break statemtns in ip_set_get_ip_port()Patrick McHardy2011-02-021-0/+2
| | | | | | | | Don't fall through in the switch statement, otherwise IPv4 headers are incorrectly parsed again as IPv6 and the return value will always be 'false'. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: ipset: add missing include to xt_set.hPatrick McHardy2011-02-011-0/+1
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: ipset: remove unnecessary includesPatrick McHardy2011-02-019-27/+0
| | | | | | | | | None of the set types need uaccess.h since this is handled centrally in ip_set_core. Most set types additionally don't need bitops.h and spinlock.h since they use neither. tcp.h is only needed by those using before(), udp.h is not needed at all. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: ipset: use nla_parse_nested()Patrick McHardy2011-02-011-26/+16
| | | | | | | | | | | | Replace calls of the form: nla_parse(tb, ATTR_MAX, nla_data(attr), nla_len(attr), policy) by: nla_parse_nested(tb, ATTR_MAX, attr, policy) Signed-off-by: Patrick McHardy <kaber@trash.net>
* Testsuite compatibility with debugging enabledJozsef Kadlecsik2011-02-011-1/+1
| | | | | The error line checking would fail when debugging is enabled (and spit out junk lines), fixed.
* Allow "new" as a commad alias to "create"Jozsef Kadlecsik2011-02-011-7/+7
| | | | It's too easy to mistype "n" to "new", so just allow it.
* ipset: improve command argument parsingHolger Eitzenberger2011-02-011-22/+20
| | | | | | | | | | | | | | | | | | | | | | The number of comparisons for a matching a command name can be made smaller by just checking on argv[1]. As an example consider the following 'create' arguments 'hashsize', 'family' and 'timeout'. When having the command create foo hash:ip timeout 60 family inet hashsize 64 it compares without this patch: strcmp("timeout", "hashsize") strcmp("64", "hashsize") strcmp("family", "hashsize") strcmp("inet", "hashsize") strcmp("hashsize", "hashsize") It is worse in practice, as 'create' has more arguments than this. Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org>
* ipset: avoid the unnecessary argv[] loopHolger Eitzenberger2011-02-011-50/+46
| | | | | | | | After stripping off the global options there simply has to follow a command name, there is no other syntax possible. Therefore the argv[] loop is unnecessary. Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org>
* ipset: pass ipset_arg argument pointerHolger Eitzenberger2011-02-013-16/+10
| | | | Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org>
* Separate ipset errnos completely from system ones and bump protocol version.Jozsef Kadlecsik2011-01-312-7/+7
|
* Use better error codes in xt_set.cJozsef Kadlecsik2011-01-311-12/+12
|
* Fix sparse warning about shadowed definitionJozsef Kadlecsik2011-01-271-1/+1
|
* bitmap:ip type: flavour specific adt functionsJozsef Kadlecsik2011-01-271-301/+168
| | | | | Use flavour-specific ADT functions and use shared ones for all other type functions (Patrick McHardy's review)
* bitmap:port type: flavour specific adt functionsJozsef Kadlecsik2011-01-271-278/+159
| | | | | Use flavour-specific ADT functions and use shared ones for all other type functions (Patrick McHardy's review)
* Move the type specifici attribute validation to the coreJozsef Kadlecsik2011-01-2713-392/+254
| | | | | | The type specific attribute validation can be moved to the ipset core. That way it's done centrally and thus can be eliminated from the individual set types (suggested by Patrick McHardy).
* Fix the spelling error fix :-)Jozsef Kadlecsik2011-01-261-1/+1
| | | | Spelling error fixed (Ferenc Wagner)
* Use vzalloc() instead of __vmalloc()Jozsef Kadlecsik2011-01-2612-24/+20
| | | | Use vzalloc() if kernel version supports it. (Eric Dumazet, Patrick McHardy)
* Use meaningful error messages in xt_set.cJozsef Kadlecsik2011-01-261-8/+12
| | | | Old cryptic error messages are not useful (Patrick McHardy's review)
* Constified attribute cannot be writtenJozsef Kadlecsik2011-01-262-1/+13
| | | | | | Attribute is const so a little bit more work is needed to return the error line number. A test is also added in order to check the functionality. (Patrick McHardy's review)
* Send (N)ACK at dumping only when NLM_F_ACK is setJozsef Kadlecsik2011-01-262-3/+5
| | | | | Missing check of the flag NLM_F_ACK is added to the kernel - and userspace does set it too (Patrick McHardy's review)
* Correct the error codes: use ENOENT and EMSGSIZEJozsef Kadlecsik2011-01-267-44/+72
| | | | Use correct error codes (Patrick McHardy's review)
* Resolving IP addresses did not work at listing/saving sets, fixed.Jozsef Kadlecsik2011-01-261-2/+2
|
* ipset: fix spelling errorHolger Eitzenberger2011-01-251-2/+2
| | | | | Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: fix the Netlink sequence numberHolger Eitzenberger2011-01-251-1/+2
| | | | | | | | | | Do not use time() as a Netlink sequence number for each message, as otherwise the same seq number will be used when sending another message in the same second. Instead use time() just for initialization, then increment per message. Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 17:53:11 +0000