summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* ipset 6.12.1 releasedv6.12.1Jozsef Kadlecsik2012-05-102-1/+7
|
* Enable silent (kernel style) compile messagesJozsef Kadlecsik2012-05-107-37/+9
|
* Fix build failed on --disable-dependency-trackingNeutron Soutmun2012-05-102-6/+11
|
* Add tarball target to MakefileJozsef Kadlecsik2012-05-101-1/+8
|
* ipset 6.12 releasedJozsef Kadlecsik2012-05-103-1/+30
|
* Backport nla_put_net* functions as NLA_PUT* were removedJozsef Kadlecsik2012-05-101-0/+22
|
* Cleanup generated files by make tidyJozsef Kadlecsik2012-05-101-0/+1
|
* netlink: add netlink_dump_control structure for netlink_dump_start()Pablo Neira Ayuso2012-05-101-2/+12
| | | | Backport of Pablo's patch to the ipset package.
* ipset: Stop using NLA_PUT*().David S. Miller2012-05-1014-258/+309
| | | | | | | These macros contain a hidden goto, and are thus extremely error prone and make code hard to audit. Signed-off-by: David S. Miller <davem@davemloft.net>
* Add more CC warning option to debug modeJozsef Kadlecsik2012-05-1013-2/+20
|
* Report syntax error messages immediatelyJozsef Kadlecsik2012-05-101-1/+1
|
* Suppress false syntax error messagesJozsef Kadlecsik2012-05-105-5/+39
| | | | | | If a create command fails at the kernel side, false syntax error was also reported due to the chicken and egg problem of the family option.
* Add configure summary for the ipset userspace toolJozsef Kadlecsik2012-05-102-3/+41
|
* Add dynamic module support to ipset userspace toolNeutron Soutmun2012-05-1020-67/+313
| | | | | | | | | | | | | The patch adds supporting dynamic modules for the set types to ipset userspace tool. The dynamic module support can be enabled by the --enable-settype-modules of "configure". The list of set types to be compiled as dynamic modules can be specified in the --with-settype-modules-list option. Example --enable-settype-modules \ --with-settype-modules-list="ipset_hash_ip ipset_hash_ipport" The keyword "all" can be used to compile all set types as dynamic modules.
* Move ipset_port_usage() into libNeutron Soutmun2012-05-066-33/+46
|
* Fix hash size checking in kernelJozsef Kadlecsik2012-05-068-21/+65
| | | | | | The hash size must fit both into u32 (jhash) and the max value of size_t. The missing checking could lead to kernel crash, bug reported by Seblu.
* Fix invalid assignment to const void pointerJozsef Kadlecsik2012-05-061-7/+7
| | | | | gcc 4.7 and above ignore such assignments which leads to a broken ipset binary (bug reported by Seblu).
* Correct README file about minimal required iptables versionOskar Berggren2012-05-041-1/+1
|
* Sparse warnings "incorrect type in assignment" fixedJozsef Kadlecsik2012-05-047-33/+39
|
* Remove unused variables (warnings fixed)Jozsef Kadlecsik2012-05-042-2/+2
|
* Fix timeout value overflow bug at large timeout parametersJozsef Kadlecsik2012-05-0415-29/+75
| | | | | Large timeout parameters could result wrong timeout values due to an overflow at msec to jiffies conversion (reported by Andreas Herz)
* ipv6: Add fragment reporting to ipv6_skip_exthdr().Jesse Gross2012-05-041-0/+8
| | | | | | | | | | While parsing through IPv6 extension headers, fragment headers are skipped making them invisible to the caller. This reports the fragment offset of the last header in order to make it possible to determine whether the packet is fragmented and, if so whether it is a first or last fragment. Signed-off-by: Jesse Gross <jesse@nicira.com>
* net: remove ipv6_addr_copy()Alexey Dobriyan2012-04-192-2/+2
| | | | | | | C assignment can handle struct in6_addr copying. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Improve ipset help text messages (Mr Dash Four)Jozsef Kadlecsik2012-04-191-4/+4
|
* Fix the inclusion of linux/export.hHenry Culver2012-01-202-2/+2
| | | | | | The tests for inclusion of linux/export.h in ipset-6.11:kernel/net/netfilter/ipset/{ip_set_getport.c,pfxlen.c} are incorrect, linux/export.h did not go in until 3.2.0.
* ipset 6.11 releasedv6.12v6.11Jozsef Kadlecsik2012-01-143-1/+24
|
* Support hostnames and service names with dashJozsef Kadlecsik2012-01-144-45/+161
| | | | | | | | The square brackets are introduced as an escape mechanism to enter hostnames or service names with dash in order to avoid mixing up the dash in the name with the range notation. Problem reported by Stephen Hemminger and Marc Guardiola.
* hash:net,iface timeout bug fixedJozsef Kadlecsik2012-01-131-0/+8
| | | | | Timed out entries were still matched till the garbage collector purged them out. The fix is verified in the testsuite.
* Exceptions support added to hash:*net* typesJozsef Kadlecsik2012-01-1327-139/+1123
| | | | | | | | | | | | The "nomatch" keyword and option is added to the hash:*net* types, by which one can add exception entries to sets. Example: ipset create test hash:net ipset add test 192.168.0/24 ipset add test 192.168.0/30 nomatch In this case the IP addresses from 192.168.0/24 except 192.168.0/30 match the elements of the set.
* net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modulesPaul Gortmaker2012-01-132-0/+8
| | | | | | | These files are non modular, but need to export symbols using the macros now living in export.h -- call out the include so that things won't break when we remove the implicit presence of module.h from everywhere.
* Log warning when a hash type of set gets fullJozsef Kadlecsik2012-01-101-4/+18
| | | | | If the set is full, the SET target cannot add more elements. Log warning so that the admin got notified about it.
* Set types moved into libipset libraryJozsef Kadlecsik2012-01-0518-46/+66
| | | | | The libipset library is complete by this step, and "ipset" just a CLI interface based on the lib.
* Library map file added in order to support library versioning.Jozsef Kadlecsik2012-01-053-1/+179
|
* doc: Linux 2.6.39 already has the defsJan Engelhardt2012-01-041-1/+1
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* build: install libipset in the right placeJan Engelhardt2012-01-041-0/+1
| | | | | | | | The .c files used to build the plugins for ipset all use #include <libipset/...>, so the files we install should preferably also be in a directory called "libipset" rather than just "ipset". Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Provide a pkgconfig fileJan Engelhardt2012-01-043-1/+14
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* build: make distcheck work and use POSIX mode for tarball generationJan Engelhardt2011-12-234-2/+6
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* build: install libipset/linux_ip_set_list.hJan Engelhardt2011-12-231-0/+1
| | | | | | | The other linux_ip_set*.h files are shipped, so this one probably should too. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* build: include libipset/nfproto.hJan Engelhardt2011-12-231-0/+1
| | | | | | libipset/types.h, which is installed by default, requires nfproto.h. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* build: process include/libipset/Jan Engelhardt2011-12-234-5/+3
| | | | | | | We need to visit that directory, otherwise `make install` is incomplete and `make distcheck` fails. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* build: use AC_CONFIG_AUX_DIR and stash away toolsJan Engelhardt2011-12-232-5/+2
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Update .gitignoreJan Engelhardt2011-12-231-3/+3
| | | | | | Only ignore these paths if they are a directory. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset 6.10 releasedv6.10Jozsef Kadlecsik2011-11-253-1/+12
|
* Tests added to check ICMP/ICMPv6 type/code parsingJozsef Kadlecsik2011-11-244-0/+14
|
* ICMP/ICMPv6 type/code parser bug fixedJozsef Kadlecsik2011-11-161-2/+2
| | | | | The ICMP/ICMPv6 type/code parser swapped the type and code values. (Bug reported by Sabitov)
* ipset: fix lookup of tcp port namesStephen Hemminger2011-11-161-2/+2
| | | | | | | | | | | The protocol argument to getservbyname() must be lowercase tcp not uppercase TCP. This fixes the bug observed by: # ipset add foo http ipset v6.9.1: Syntax error: 'http' is invalid as number Syntax error: cannot parse 'http' as a TCP port Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Invert the logic to include version.h in ip_set_core.cJozsef Kadlecsik2011-09-152-2/+2
|
* Suppress false compile-time warnings:Jozsef Kadlecsik2011-09-153-3/+3
| | | | warning: 'ip_to' may be used uninitialized in this function
* Optionally disable building the kernel module.Mathieu Bridon2011-09-152-0/+27
| | | | | | | | | | | | | | | | | | | | | Distributors (like Fedora) might be interested in including the ipset tools and libs, but they often don't want to build and ship external kernel modules, especially if those modules are already included in their kernel packages. This patch introduces a new --with-kmod configure option that can be used to conditionally build the kernel module. The module is still built by default, to preserve compatibility. A user who wants to build only the user-space part of ipset can do so by running the following: $ ./autogen.sh $ configure --with-kmod=no $ make # make install Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Make tidy completeJozsef Kadlecsik2011-09-061-0/+1
|