summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* netfilter: ipset: Return ipset error instead of boolSergey Popovich2015-03-1912-48/+126
| | | | | | | | | | | | Statement ret = func1() || func2() returns 0 when both func1() and func2() return 0, or 1 if func1() or func2() returns non-zero. However in our case func1() and func2() returns error code on failure, so it seems good to propagate such error codes, rather than returning 1 in case of failure. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Preprocessor directices cleanupSergey Popovich2015-03-1912-34/+4
| | | | | | | | | | | | | | * Undefine mtype_data_reset_elem before defining. * Remove duplicated mtype_gc_init undefine, move mtype_gc_init define closer to mtype_gc define. * Use htype instead of HTYPE in IPSET_TOKEN(HTYPE, _create)(). * Remove PF definition from sets: no more used. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: No need to make nomatch bitfieldSergey Popovich2015-03-191-2/+2
| | | | | | | | | | We do not store cidr packed with no match, so there is no need to make nomatch bitfield. This simplifies mtype_data_reset_flags() a bit. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Make sure bit operations are not reorderedJozsef Kadlecsik2015-03-192-2/+10
| | | | | Sergey Popovich pointed out that {set,clear}_bit() operations must be protected against instruction reordering.
* Support linking libipset to C++ programsJozsef Kadlecsik2015-03-1810-1/+80
| | | | Issue reported by Pavel Odintsov.
* netfilter: ipset: Properly calculate extensions offsets and total lengthSergey Popovich2015-03-161-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Offsets and total length returned by the ip_set_elem_len() calculated incorrectly as initial set element length (i.e. len parameter) is used multiple times in offset calculations, also affecting set element total length. Use initial set element length as start offset, do not add aligned extension offset to the offset. Return offset as total length of the set element. This reduces memory requirements on per element basic for the hash:* type of sets. For example output from 'ipset -terse list test-1' on 64-bit PC, where test-1 is generated via following script: #!/bin/bash set_name='test-1' ipset create "$set_name" hash:net family inet \ timeout 10800 counters comment \ hashsize 65536 maxelem 65536 declare -i o3 o4 fmt="add $set_name 192.168.%u.%u\n" for ((o3 = 0; o3 < 256; o3++)); do for ((o4 = 0; o4 < 256; o4++)); do printf "$fmt" $o3 $o4 done done |ipset -exist restore BEFORE this patch is applied # ipset -terse list test-1 Name: test-1 Type: hash:net Revision: 6 Header: family inet hashsize 65536 maxelem 65536 timeout 10800 counters comment Size in memory: 26348440 and AFTER applying patch # ipset -terse list test-1 Name: test-1 Type: hash:net Revision: 6 Header: family inet hashsize 65536 maxelem 65536 timeout 10800 counters comment Size in memory: 7706392 References: 0 Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: propose rewording in manpageNeutron Soutmun2015-03-131-3/+2
| | | | | | | | | | | | | | | | | | | | | | I have prepared the patch which refers to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780336, reported and proposed by H. Renault <hr@herverenault.fr>. man ipset reads: del SETNAME DEL-ENTRY [ DEL-OPTIONS ] Delete an entry from a set. If the -exist option is specified, ipset ignores if the entry does not added to (already expired from) the set. Proposed rewording: Delete an entry from a set. If the -exist option is specified and the entry is not in the set (maybe already expired), then the command is ignored. Signed-off-by: Neutron Soutmun <neo.neutron@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Fix cidr handling for hash:*net* typesJozsef Kadlecsik2015-03-1311-36/+63
| | | | | | | | Commit 092d67cda9ad4 broke the cidr handling for the hash:*net* types when the sets were used by the SET target: entries with invalid cidr values were added to the sets. Reported by Jonathan Johnson. Testsuite entry is added to verify the fix.
* netfilter: ipset: fix boolreturn.cocci warningskbuild test robot2015-03-111-2/+2
| | | | | | | | | | | | | net/netfilter/xt_set.c:196:9-10: WARNING: return of 0/1 in function 'set_match_v3' with return type bool net/netfilter/xt_set.c:242:9-10: WARNING: return of 0/1 in function 'set_match_v4' with return type bool Return statements in functions returning bool should use true/false instead of 1/0. Generated by: scripts/coccinelle/misc/boolreturn.cocci CC: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: make ip_set_get_ip*_port to use skb_network_offsetAlexander Drozdov2015-03-111-2/+4
| | | | | | | | | | All the ipset functions respect skb->network_header value, except for ip_set_get_ip4_port() & ip_set_get_ip6_port(). The functions should use skb_network_offset() to get the transport header offset. Signed-off-by: Alexander Drozdov <al.drozdov@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Make sure listing doesn't grab a set which is just being destroyed.Jozsef Kadlecsik2015-01-081-6/+21
| | | | | There was a small window when all sets are destroyed and a concurrent listing of all sets could grab a set which is just being destroyed.
* Missing rcu_read_lock() and _unlock() in mtype_list() fixedJozsef Kadlecsik2015-01-061-0/+3
|
* More compatibility checking and simplificationsJozsef Kadlecsik2015-01-068-33/+74
| | | | | Try hard to keep the support of the 2.6.32 kernel tree and simplify the code with self-referential macros.
* Compatibility: define RCU_INIT_POINTER when __rcu is not definedJozsef Kadlecsik2015-01-061-1/+6
|
* Compatibility: check kernel source for list_last_entryJozsef Kadlecsik2015-01-062-0/+16
| | | | list_last_entry is missing on CentOS7, reported by Ricardo Klein.
* Fix coding styles reported by checkpatch.plJozsef Kadlecsik2015-01-0621-204/+221
|
* Use nlmsg_total_size instead of NLMSG_SPACE in ip_set_core.c.Jozsef Kadlecsik2015-01-061-2/+2
|
* There's no need to call synchronize_rcu() with kfree_rcu()Jozsef Kadlecsik2015-01-061-4/+0
|
* Call rcu_barrier() in module removal pathJozsef Kadlecsik2014-12-1012-2/+14
|
* Call synchronize_rcu() in set type (un)register functions only when neededJozsef Kadlecsik2014-12-101-5/+4
|
* Remove an unused macroJozsef Kadlecsik2014-12-101-4/+0
|
* Give a better name to a macro in ip_set_core.cJozsef Kadlecsik2014-12-101-9/+9
|
* Resolve the STREQ macro to make the code more readable, and use nla_strlcpy ↵Jozsef Kadlecsik2014-12-101-6/+5
| | | | where possible
* Use MSEC_PER_SEC consistentlyJozsef Kadlecsik2014-12-011-2/+2
|
* Make possible to pass extra flags to sparse (userspace)Jozsef Kadlecsik2014-11-271-1/+1
|
* Remove unnecessary integer RCU handling and fix sparse warningsJozsef Kadlecsik2014-11-276-122/+90
|
* Fix sparse warningJozsef Kadlecsik2014-11-271-2/+2
| | | | "warning: cast to restricted __be32" warnings are fixed
* ipset 6.24 releasedv6.24Jozsef Kadlecsik2014-11-243-1/+37
|
* netfilter: ipset: small potential read beyond the end of bufferDan Carpenter2014-11-181-0/+5
| | | | | | | | | | We could be reading 8 bytes into a 4 byte buffer here. It seems harmless but adding a check is the right thing to do and it silences a static checker warning. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* The "extra" subdirectory for kernel modules may have a full subtreeJozsef Kadlecsik2014-11-181-1/+1
| | | | | | | | | | | | | | Jesper Dangaard Brouer reported that on Red Hat Enterprise Linux Server release 6.5 the extra subdirectory contains the full subtree path /lib/modules/*/extra/netfilter/ipset/ and not /lib/modules/*/extra/ipset/ Check only "/extra/" in the path.
* Fix parallel resizing and listing of the same setJozsef Kadlecsik2014-11-185-22/+80
| | | | | | | | When elements added to a hash:* type of set and resizing triggered, parallel listing could start to list the original set (before resizing) and "continue" with listing the new set. Fix it by references and using the original hash table for listing. Therefore the destroying the original hash table may happen from the resizing or listing functions.
* styles warned by checkpatch.pl fixedJozsef Kadlecsik2014-11-1811-11/+38
|
* Introduce RCU in all set types instead of rwlock per setJozsef Kadlecsik2014-11-189-488/+615
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Performance is tested by Jesper Dangaard Brouer: Simple drop in FORWARD ~~~~~~~~~~~~~~~~~~~~~~ Dropping via simple iptables net-mask match:: iptables -t raw -N simple || iptables -t raw -F simple iptables -t raw -I simple -s 198.18.0.0/15 -j DROP iptables -t raw -D PREROUTING -j simple iptables -t raw -I PREROUTING -j simple Drop performance in "raw": 11.3Mpps Generator: sending 12.2Mpps (tx:12264083 pps) Drop via original ipset in RAW table ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Create a set with lots of elements:: sudo ./ipset destroy test echo "create test hash:ip hashsize 65536" > test.set for x in `seq 0 255`; do for y in `seq 0 255`; do echo "add test 198.18.$x.$y" >> test.set done done sudo ./ipset restore < test.set Dropping via ipset:: iptables -t raw -F iptables -t raw -N net198 || iptables -t raw -F net198 iptables -t raw -I net198 -m set --match-set test src -j DROP iptables -t raw -I PREROUTING -j net198 Drop performance in "raw" with ipset: 8Mpps Perf report numbers ipset drop in "raw":: + 24.65% ksoftirqd/1 [ip_set] [k] ip_set_test - 21.42% ksoftirqd/1 [kernel.kallsyms] [k] _raw_read_lock_bh - _raw_read_lock_bh + 99.88% ip_set_test - 19.42% ksoftirqd/1 [kernel.kallsyms] [k] _raw_read_unlock_bh - _raw_read_unlock_bh + 99.72% ip_set_test + 4.31% ksoftirqd/1 [ip_set_hash_ip] [k] hash_ip4_kadt + 2.27% ksoftirqd/1 [ixgbe] [k] ixgbe_fetch_rx_buffer + 2.18% ksoftirqd/1 [ip_tables] [k] ipt_do_table + 1.81% ksoftirqd/1 [ip_set_hash_ip] [k] hash_ip4_test + 1.61% ksoftirqd/1 [kernel.kallsyms] [k] __netif_receive_skb_core + 1.44% ksoftirqd/1 [kernel.kallsyms] [k] build_skb + 1.42% ksoftirqd/1 [kernel.kallsyms] [k] ip_rcv + 1.36% ksoftirqd/1 [kernel.kallsyms] [k] __local_bh_enable_ip + 1.16% ksoftirqd/1 [kernel.kallsyms] [k] dev_gro_receive + 1.09% ksoftirqd/1 [kernel.kallsyms] [k] __rcu_read_unlock + 0.96% ksoftirqd/1 [ixgbe] [k] ixgbe_clean_rx_irq + 0.95% ksoftirqd/1 [kernel.kallsyms] [k] __netdev_alloc_frag + 0.88% ksoftirqd/1 [kernel.kallsyms] [k] kmem_cache_alloc + 0.87% ksoftirqd/1 [xt_set] [k] set_match_v3 + 0.85% ksoftirqd/1 [kernel.kallsyms] [k] inet_gro_receive + 0.83% ksoftirqd/1 [kernel.kallsyms] [k] nf_iterate + 0.76% ksoftirqd/1 [kernel.kallsyms] [k] put_compound_page + 0.75% ksoftirqd/1 [kernel.kallsyms] [k] __rcu_read_lock Drop via ipset in RAW table with RCU-locking ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ With RCU locking, the RW-lock is gone. Drop performance in "raw" with ipset with RCU-locking: 11.3Mpps Performance-tested-by: Jesper Dangaard Brouer <brouer@redhat.com>
* Remove rbtree from hash:net,iface in order to run under RCUJozsef Kadlecsik2014-11-181-167/+17
|
* Explicitly add padding elements to hash:net,net and hash:net,port,netJozsef Kadlecsik2014-11-182-0/+4
| | | | The elements must be u32 sized for the used hash function.
* Allocate the proper size of memory when /0 networks are supportedJozsef Kadlecsik2014-11-181-2/+1
|
* Simplify cidr handling for hash:*net* typesJozsef Kadlecsik2014-11-181-28/+28
|
* Indicate when /0 networks are supportedJozsef Kadlecsik2014-11-182-1/+2
|
* Add more compatibility checkings to support older kernel releasesJozsef Kadlecsik2014-11-183-6/+32
|
* Make_global.am: Don't include host headersBaruch Siach2014-11-041-2/+1
| | | | | | | This is bad for cross compilation. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Kernel API changes in em_ipset.c, support both old and new onesJozsef Kadlecsik2014-11-033-0/+40
|
* netfilter: Convert uses of __constant_<foo> to <foo>Joe Perches2014-11-031-2/+2
| | | | | | | | | | The use of __constant_<foo> has been unnecessary for quite awhile now. Make these uses consistent with the rest of the kernel. Signed-off-by: Joe Perches <joe@perches.com> Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* net: use the new API kvfree()WANG Cong2014-11-033-4/+22
| | | | | | | | | It is available since v3.15-rc5. Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: "David S. Miller" <davem@davemloft.net> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* treewide: fix errors in printkMasanari Iida2014-11-031-1/+1
| | | | | | | | | This patch fix spelling typo in printk. Signed-off-by: Masanari Iida <standby24x7@gmail.com> Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Acked-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* netfilter: use IS_ENABLED(CONFIG_BRIDGE_NETFILTER)Pablo Neira Ayuso2014-11-031-2/+2
| | | | | | | | | | In 34666d4 ("netfilter: bridge: move br_netfilter out of the core"), the bridge netfilter code has been modularized. Use IS_ENABLED instead of ifdef to cover the module case. Fixes: 34666d4 ("netfilter: bridge: move br_netfilter out of the core") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Use IS_ENABLED macro and define it if requiredJozsef Kadlecsik2014-11-032-1/+12
|
* Alignment problem between 64bit kernel 32bit userspaceJozsef Kadlecsik2014-11-033-6/+88
| | | | | | | | | | | | | | | | Sven-Haegar Koch reported the issue: sims:~# iptables -A OUTPUT -m set --match-set testset src -j ACCEPT iptables: Invalid argument. Run `dmesg' for more information. In syslog: x_tables: ip_tables: set.3 match: invalid size 48 (kernel) != (user) 32 which was introduced by the counter extension in ipset. The patch fixes the alignment issue with introducing a new set match revision with the fixed underlying 'struct ip_set_counter_match' structure.
* Add script to check libipset.map for missing symbolsJozsef Kadlecsik2014-10-284-3/+36
|
* Update libipset.map with ipset_parse_tcp_udp_portThomas Backlund2014-10-281-0/+1
| | | | | | | | | | | | | | | | | | | | | | | Commit: author Quentin Armitage <quentin@armitage.org.uk> 2013-08-09 11:26:33 (GMT) committer Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> 2013-08-17 19:31:29 (GMT) commit 480761a3bdaa55bf8c966e4dab950ebf84775863 (patch) tree 6d750f948abf1ae4f93e4c704502d085ac13d679 parent 3a4419954a3ae0ba5dafd711e6b8dd8f0beb5c21 (diff) Add specifying protocol for bitmap:port Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> added ipset_parse_tcp_udp_port(), but forgot to update libipset.map so we get: /usr/lib64/ipset/ipset_bitmap_port.so: /usr/lib64/ipset/ipset_bitmap_port.so: undefined symbol: ipset_parse_tcp_udp_port so update the map. Signed-off-by: Thomas Backlund <tmb@mageia.org> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* libipset: Bump lib version and update map fileNeutron Soutmun2014-10-282-1/+6
| | | | | | | | | | The ipset_parse_uint16() was introduced but no lib version bumped and no map file updated. Bump lib version to 9:0:6. (current and age was bumped) Signed-off-by: Neutron Soutmun <neo.neutron@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>