summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add element count to hash headersEric B Munson2015-06-1971-81/+163
| | | | | | | | | | | | | | | | | | | | | | It would be useful for userspace to query the size of an ipset hash, however, this data is not exposed to userspace outside of counting the number of member entries. This patch uses the attribute IPSET_ATTR_ELEMENTS to indicate the size in the the header that is exported to userspace. This field is then printed by the userspace tool for hashes. Because it is only meaningful for hashes to report their size, the output is conditional on the set type. To do this checking the MATCH_TYPENAME macro was moved to utils.h. The bulk of this patch changes the expected test suite to account for the change in output. Signed-off-by: Eric B Munson <emunson@akamai.com> Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: Josh Hunt <johunt@akamai.com> Cc: netfilter-devel@vger.kernel.org Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netlink: implement nla_put_in_addr and nla_put_in6_addrJiri Benc2015-06-133-3/+27
| | | | | | | | | | | | | | | | IP addresses are often stored in netlink attributes. Add generic functions to do that. For nla_put_in_addr, it would be nicer to pass struct in_addr but this is not used universally throughout the kernel, in way too many places __be32 is used to store IPv4 address. Signed-off-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Compatibility part added. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: deinline ip_set_put_extensions()Denys Vlasenko2015-06-132-23/+27
| | | | | | | | | | | | | | | | | | | | | | n x86 allyesconfig build: The function compiles to 489 bytes of machine code. It has 25 callsites. text data bss dec hex filename 82441375 22255384 20627456 125324215 7784bb7 vmlinux.before 82434909 22255384 20627456 125317749 7783275 vmlinux Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com> CC: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> CC: Eric W. Biederman <ebiederm@xmission.com> CC: David S. Miller <davem@davemloft.net> CC: Jan Engelhardt <jengelh@medozas.de> CC: Jiri Pirko <jpirko@redhat.com> CC: linux-kernel@vger.kernel.org CC: netdev@vger.kernel.org CC: netfilter-devel@vger.kernel.org Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Fix error path in mtype_resize() when new hash bucket cannot be allocatedJozsef Kadlecsik2015-06-131-10/+15
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* There is no need to call synchronize_rcu() after list_add_rcu()Jozsef Kadlecsik2015-06-131-1/+1
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Fix typo in function name get_phyoutdev_name()Jozsef Kadlecsik2015-06-131-2/+2
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Separate memsize calculation code into dedicated functionsJozsef Kadlecsik2015-05-062-10/+31
| | | | | | | | | | Hash types already has it's memsize calculation code in separate functions. Do the same for *bitmap* and *list* sets. Ported from a patch proposed by Sergey Popovich <popovich_sergei@mail.ua>. Suggested-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Split extensions into separate filesJozsef Kadlecsik2015-05-064-92/+122
| | | | | | | Ported from a patch proposed by Sergey Popovich <popovich_sergei@mail.ua>. Suggested-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Improve comment extension helpersJozsef Kadlecsik2015-05-061-1/+1
| | | | | | | | | Allocate memory with kmalloc() rather than kzalloc(). Ported from a patch proposed by Sergey Popovich <popovich_sergei@mail.ua>. Suggested-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Improve skbinfo get/init helpersJozsef Kadlecsik2015-05-053-30/+24
| | | | | | | | | | | Use struct ip_set_skbinfo in struct ip_set_ext instead of open coded fields and assign structure members in get/init helpers instead of copying members one by one. Ported from a patch proposed by Sergey Popovich <popovich_sergei@mail.ua>. Suggested-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Headers file cleanupJozsef Kadlecsik2015-05-053-31/+31
| | | | | | | | | | Remove extra whitespace, group counter helper together. Mark some of the helpers arguments as const. Ported from a patch proposed by Sergey Popovich <popovich_sergei@mail.ua>. Suggested-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Correct rcu_dereference_bh_nfnl() usageJozsef Kadlecsik2015-05-051-4/+6
| | | | | | | | | | | | | When rcu_dereference_bh_nfnl() macro would be defined on the target system if will accept pointer and subsystem id. Check if rcu_dereference_bh_nfnl() is defined and make it accepting two arguments. Ported from a patch proposed by Sergey Popovich <popovich_sergei@mail.ua>. Suggested-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: bridge: add helpers for fetching physin/outdevpabloFlorian Westphal2015-04-273-9/+52
| | | | | | | | | | | | | | | | right now we store this in the nf_bridge_info struct, accessible via skb->nf_bridge. This patch prepares removal of this pointer from skb: Instead of using skb->nf_bridge->x, we use helpers to obtain the in/out device (or ifindexes). Followup patches to netfilter will then allow nf_bridge_info to be obtained by a call into the br_netfilter core, rather than keeping a pointer to it in sk_buff. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* When a single set is destroyed, make sure it can't be grabbed by dumpJozsef Kadlecsik2015-04-261-9/+11
|
* In comment extension ip_set_comment_free() is always called in a safe pathJozsef Kadlecsik2015-04-261-1/+11
|
* Add rcu_barrier() to module removal in the bitmap types tooJozsef Kadlecsik2015-04-173-0/+3
|
* Fix coding styles reported by the most recent checkpatch.pl.Jozsef Kadlecsik2015-04-1716-114/+133
|
* Make sure bitmap:ip,mac detects the proper MAC even when it's overwrittenJozsef Kadlecsik2015-03-294-6/+20
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* RCU safe comment extension handlingJozsef Kadlecsik2015-03-294-20/+42
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Make sure the proper is_destroyed value is checked at dumpingJozsef Kadlecsik2015-03-291-2/+4
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Fix broken commit "Check extensions attributes before getting extensions."Jozsef Kadlecsik2015-03-291-8/+8
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Improve preprocessor macros checksSergey Popovich2015-03-243-7/+18
| | | | | | | | Check if mandatory MTYPE, HTYPE and HOST_MASK macros defined. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Fix hashing for ipv6 setsSergey Popovich2015-03-245-8/+2
| | | | | | | | | | | | | | | HKEY_DATALEN remains defined after first inclusion of ip_set_hash_gen.h, so it is incorrectly reused for IPv6 code. Undefine HKEY_DATALEN in ip_set_hash_gen.h at the end. Also remove some useless defines of HKEY_DATALEN in ip_set_hash_{ip{,mark,port},netiface}.c as ip_set_hash_gen.h defines it correctly for such set types anyway. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Fix ext_*() macrosSergey Popovich2015-03-231-4/+4
| | | | | | | | | So pointers returned by these macros could be referenced with -> directly. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Check for comment netlink attribute lengthSergey Popovich2015-03-2315-15/+30
| | | | | | | | Ensure userspace supplies string not longer than IPSET_MAX_COMMENT_SIZE. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Return bool values instead of intSergey Popovich2015-03-2010-38/+43
| | | | | Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Check CIDR value only when attribute is givenSergey Popovich2015-03-204-49/+41
| | | | | | | | | | | | | | | | There is no reason to check CIDR value regardless attribute specifying CIDR is given. Initialize cidr array in element structure on element structure declaration to let more freedom to the compiler to optimize initialization right before element structure is used. Remove local variables cidr and cidr2 for netnet and netportnet hashes as we do not use packed cidr value for such set types and can store value directly in e.cidr[]. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Make sure we always return line number on batchSergey Popovich2015-03-2015-75/+75
| | | | | | | | | | | | Even if we return with generic IPSET_ERR_PROTOCOL it is good idea to return line number if we called in batch mode. Moreover we are not always exiting with IPSET_ERR_PROTOCOL. For example hash:ip,port,net may return IPSET_ERR_HASH_RANGE_UNSUPPORTED or IPSET_ERR_INVALID_CIDR. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Permit CIDR equal to the host address CIDR in IPv6Sergey Popovich2015-03-205-15/+38
| | | | | | | | | | | | | Permit userspace to supply CIDR length equal to the host address CIDR length in netlink message. Prohibit any other CIDR length for IPv6 variant of the set. Also return -IPSET_ERR_HASH_RANGE_UNSUPPORTED instead of generic -IPSET_ERR_PROTOCOL in IPv6 variant of hash:ip,port,net when IPSET_ATTR_IP_TO attribute is given. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Use HOST_MASK literal to represent host address CIDR lenSergey Popovich2015-03-207-9/+11
| | | | | Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Check IPSET_ATTR_PORT only onceSergey Popovich2015-03-205-40/+10
| | | | | | | | | | We do not need to check tb[IPSET_ATTR_PORT] != NULL before retrieving port, as this attribute is known to exist due to ip_set_attr_netorder() returning true only when attribute exists and it is in network byte order. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Check extensions attributes before getting extensions.Sergey Popovich2015-03-2016-170/+29
| | | | | | | | Make all extensions attributes checks within ip_set_get_extensions() and reduce number of duplicated code. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Use SET_WITH_*() helpers to test set extensionsSergey Popovich2015-03-202-7/+7
| | | | | Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Return ipset error instead of boolSergey Popovich2015-03-1912-48/+126
| | | | | | | | | | | | Statement ret = func1() || func2() returns 0 when both func1() and func2() return 0, or 1 if func1() or func2() returns non-zero. However in our case func1() and func2() returns error code on failure, so it seems good to propagate such error codes, rather than returning 1 in case of failure. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Preprocessor directices cleanupSergey Popovich2015-03-1912-34/+4
| | | | | | | | | | | | | | * Undefine mtype_data_reset_elem before defining. * Remove duplicated mtype_gc_init undefine, move mtype_gc_init define closer to mtype_gc define. * Use htype instead of HTYPE in IPSET_TOKEN(HTYPE, _create)(). * Remove PF definition from sets: no more used. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: No need to make nomatch bitfieldSergey Popovich2015-03-191-2/+2
| | | | | | | | | | We do not store cidr packed with no match, so there is no need to make nomatch bitfield. This simplifies mtype_data_reset_flags() a bit. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Make sure bit operations are not reorderedJozsef Kadlecsik2015-03-192-2/+10
| | | | | Sergey Popovich pointed out that {set,clear}_bit() operations must be protected against instruction reordering.
* Support linking libipset to C++ programsJozsef Kadlecsik2015-03-1810-1/+80
| | | | Issue reported by Pavel Odintsov.
* netfilter: ipset: Properly calculate extensions offsets and total lengthSergey Popovich2015-03-161-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Offsets and total length returned by the ip_set_elem_len() calculated incorrectly as initial set element length (i.e. len parameter) is used multiple times in offset calculations, also affecting set element total length. Use initial set element length as start offset, do not add aligned extension offset to the offset. Return offset as total length of the set element. This reduces memory requirements on per element basic for the hash:* type of sets. For example output from 'ipset -terse list test-1' on 64-bit PC, where test-1 is generated via following script: #!/bin/bash set_name='test-1' ipset create "$set_name" hash:net family inet \ timeout 10800 counters comment \ hashsize 65536 maxelem 65536 declare -i o3 o4 fmt="add $set_name 192.168.%u.%u\n" for ((o3 = 0; o3 < 256; o3++)); do for ((o4 = 0; o4 < 256; o4++)); do printf "$fmt" $o3 $o4 done done |ipset -exist restore BEFORE this patch is applied # ipset -terse list test-1 Name: test-1 Type: hash:net Revision: 6 Header: family inet hashsize 65536 maxelem 65536 timeout 10800 counters comment Size in memory: 26348440 and AFTER applying patch # ipset -terse list test-1 Name: test-1 Type: hash:net Revision: 6 Header: family inet hashsize 65536 maxelem 65536 timeout 10800 counters comment Size in memory: 7706392 References: 0 Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: propose rewording in manpageNeutron Soutmun2015-03-131-3/+2
| | | | | | | | | | | | | | | | | | | | | | I have prepared the patch which refers to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780336, reported and proposed by H. Renault <hr@herverenault.fr>. man ipset reads: del SETNAME DEL-ENTRY [ DEL-OPTIONS ] Delete an entry from a set. If the -exist option is specified, ipset ignores if the entry does not added to (already expired from) the set. Proposed rewording: Delete an entry from a set. If the -exist option is specified and the entry is not in the set (maybe already expired), then the command is ignored. Signed-off-by: Neutron Soutmun <neo.neutron@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Fix cidr handling for hash:*net* typesJozsef Kadlecsik2015-03-1311-36/+63
| | | | | | | | Commit 092d67cda9ad4 broke the cidr handling for the hash:*net* types when the sets were used by the SET target: entries with invalid cidr values were added to the sets. Reported by Jonathan Johnson. Testsuite entry is added to verify the fix.
* netfilter: ipset: fix boolreturn.cocci warningskbuild test robot2015-03-111-2/+2
| | | | | | | | | | | | | net/netfilter/xt_set.c:196:9-10: WARNING: return of 0/1 in function 'set_match_v3' with return type bool net/netfilter/xt_set.c:242:9-10: WARNING: return of 0/1 in function 'set_match_v4' with return type bool Return statements in functions returning bool should use true/false instead of 1/0. Generated by: scripts/coccinelle/misc/boolreturn.cocci CC: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: make ip_set_get_ip*_port to use skb_network_offsetAlexander Drozdov2015-03-111-2/+4
| | | | | | | | | | All the ipset functions respect skb->network_header value, except for ip_set_get_ip4_port() & ip_set_get_ip6_port(). The functions should use skb_network_offset() to get the transport header offset. Signed-off-by: Alexander Drozdov <al.drozdov@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Make sure listing doesn't grab a set which is just being destroyed.Jozsef Kadlecsik2015-01-081-6/+21
| | | | | There was a small window when all sets are destroyed and a concurrent listing of all sets could grab a set which is just being destroyed.
* Missing rcu_read_lock() and _unlock() in mtype_list() fixedJozsef Kadlecsik2015-01-061-0/+3
|
* More compatibility checking and simplificationsJozsef Kadlecsik2015-01-068-33/+74
| | | | | Try hard to keep the support of the 2.6.32 kernel tree and simplify the code with self-referential macros.
* Compatibility: define RCU_INIT_POINTER when __rcu is not definedJozsef Kadlecsik2015-01-061-1/+6
|
* Compatibility: check kernel source for list_last_entryJozsef Kadlecsik2015-01-062-0/+16
| | | | list_last_entry is missing on CentOS7, reported by Ricardo Klein.
* Fix coding styles reported by checkpatch.plJozsef Kadlecsik2015-01-0621-204/+221
|
* Use nlmsg_total_size instead of NLMSG_SPACE in ip_set_core.c.Jozsef Kadlecsik2015-01-061-2/+2
|
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-01 03:43:51 +0000