summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Support hostnames and service names with dashJozsef Kadlecsik2012-01-144-45/+161
| | | | | | | | The square brackets are introduced as an escape mechanism to enter hostnames or service names with dash in order to avoid mixing up the dash in the name with the range notation. Problem reported by Stephen Hemminger and Marc Guardiola.
* hash:net,iface timeout bug fixedJozsef Kadlecsik2012-01-131-0/+8
| | | | | Timed out entries were still matched till the garbage collector purged them out. The fix is verified in the testsuite.
* Exceptions support added to hash:*net* typesJozsef Kadlecsik2012-01-1327-139/+1123
| | | | | | | | | | | | The "nomatch" keyword and option is added to the hash:*net* types, by which one can add exception entries to sets. Example: ipset create test hash:net ipset add test 192.168.0/24 ipset add test 192.168.0/30 nomatch In this case the IP addresses from 192.168.0/24 except 192.168.0/30 match the elements of the set.
* net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modulesPaul Gortmaker2012-01-132-0/+8
| | | | | | | These files are non modular, but need to export symbols using the macros now living in export.h -- call out the include so that things won't break when we remove the implicit presence of module.h from everywhere.
* Log warning when a hash type of set gets fullJozsef Kadlecsik2012-01-101-4/+18
| | | | | If the set is full, the SET target cannot add more elements. Log warning so that the admin got notified about it.
* Set types moved into libipset libraryJozsef Kadlecsik2012-01-0518-46/+66
| | | | | The libipset library is complete by this step, and "ipset" just a CLI interface based on the lib.
* Library map file added in order to support library versioning.Jozsef Kadlecsik2012-01-053-1/+179
|
* doc: Linux 2.6.39 already has the defsJan Engelhardt2012-01-041-1/+1
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* build: install libipset in the right placeJan Engelhardt2012-01-041-0/+1
| | | | | | | | The .c files used to build the plugins for ipset all use #include <libipset/...>, so the files we install should preferably also be in a directory called "libipset" rather than just "ipset". Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Provide a pkgconfig fileJan Engelhardt2012-01-043-1/+14
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* build: make distcheck work and use POSIX mode for tarball generationJan Engelhardt2011-12-234-2/+6
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* build: install libipset/linux_ip_set_list.hJan Engelhardt2011-12-231-0/+1
| | | | | | | The other linux_ip_set*.h files are shipped, so this one probably should too. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* build: include libipset/nfproto.hJan Engelhardt2011-12-231-0/+1
| | | | | | libipset/types.h, which is installed by default, requires nfproto.h. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* build: process include/libipset/Jan Engelhardt2011-12-234-5/+3
| | | | | | | We need to visit that directory, otherwise `make install` is incomplete and `make distcheck` fails. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* build: use AC_CONFIG_AUX_DIR and stash away toolsJan Engelhardt2011-12-232-5/+2
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Update .gitignoreJan Engelhardt2011-12-231-3/+3
| | | | | | Only ignore these paths if they are a directory. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset 6.10 releasedv6.10Jozsef Kadlecsik2011-11-253-1/+12
|
* Tests added to check ICMP/ICMPv6 type/code parsingJozsef Kadlecsik2011-11-244-0/+14
|
* ICMP/ICMPv6 type/code parser bug fixedJozsef Kadlecsik2011-11-161-2/+2
| | | | | The ICMP/ICMPv6 type/code parser swapped the type and code values. (Bug reported by Sabitov)
* ipset: fix lookup of tcp port namesStephen Hemminger2011-11-161-2/+2
| | | | | | | | | | | The protocol argument to getservbyname() must be lowercase tcp not uppercase TCP. This fixes the bug observed by: # ipset add foo http ipset v6.9.1: Syntax error: 'http' is invalid as number Syntax error: cannot parse 'http' as a TCP port Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Invert the logic to include version.h in ip_set_core.cJozsef Kadlecsik2011-09-152-2/+2
|
* Suppress false compile-time warnings:Jozsef Kadlecsik2011-09-153-3/+3
| | | | warning: 'ip_to' may be used uninitialized in this function
* Optionally disable building the kernel module.Mathieu Bridon2011-09-152-0/+27
| | | | | | | | | | | | | | | | | | | | | Distributors (like Fedora) might be interested in including the ipset tools and libs, but they often don't want to build and ship external kernel modules, especially if those modules are already included in their kernel packages. This patch introduces a new --with-kmod configure option that can be used to conditionally build the kernel module. The module is still built by default, to preserve compatibility. A user who wants to build only the user-space part of ipset can do so by running the following: $ ./autogen.sh $ configure --with-kmod=no $ make # make install Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Make tidy completeJozsef Kadlecsik2011-09-061-0/+1
|
* ipset 6.9.1 releasedv6.9.1Jozsef Kadlecsik2011-09-062-1/+4
|
* Fix compiling ipset as external kernel modulesJozsef Kadlecsik2011-09-062-2/+2
|
* ipset 6.9 releasedv6.9Jozsef Kadlecsik2011-09-063-1/+19
|
* Complete Kconfig with hash:net,iface typeJozsef Kadlecsik2011-09-051-0/+10
| | | | | The Kconfig file is not used at building ipset as external system, still let the file be complete.
* rtnetlink: Compute and store minimum ifinfo dump sizeGreg Rose2011-09-051-0/+4
| | | | | | | | | | | | | | | | | | [The patch changes the API of the netlink_dump_start interface: port it to the standalone ipset package.] The message size allocated for rtnl ifinfo dumps was limited to a single page. This is not enough for additional interface info available with devices that support SR-IOV and caused a bug in which VF info would not be displayed if more than approximately 40 VFs were created per interface. Implement a new function pointer for the rtnl_register service that will calculate the amount of data required for the ifinfo dump and allocate enough data to satisfy the request. Signed-off-by: Greg Rose <gregory.v.rose@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
* Remove redundant linux/version.h includes from net/Jesper Juhl2011-09-052-1/+2
| | | | | | | | | | | | | | | | | | | | | | It was suggested by "make versioncheck" that the follwing includes of linux/version.h are redundant: /home/jj/src/linux-2.6/net/caif/caif_dev.c: 14 linux/version.h not needed. /home/jj/src/linux-2.6/net/caif/chnl_net.c: 10 linux/version.h not needed. /home/jj/src/linux-2.6/net/ipv4/gre.c: 19 linux/version.h not needed. /home/jj/src/linux-2.6/net/netfilter/ipset/ip_set_core.c: 20 linux/version.h not needed. /home/jj/src/linux-2.6/net/netfilter/xt_set.c: 16 linux/version.h not needed. and it seems that it is right. Beyond manually inspecting the source files I also did a few build tests with various configs to confirm that including the header in those files is indeed not needed. Here's a patch to remove the pointless includes. Signed-off-by: Jesper Juhl <jj@chaosbits.net> Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Merge branch 'master' of git://dev.medozas.de/ipsetJozsef Kadlecsik2011-09-0138-167/+194
|\ | | | | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
| * build: move ipset_errcode into libraryJan Engelhardt2011-08-313-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The library cannot stand on its own: 19:13 seven:../ipset/lib > ldd -r .libs/libipset.so.1 linux-vdso.so.1 => (0x00007fff9a569000) libmnl.so.0 => /usr/lib64/libmnl.so.0 (0x00007fd42ae5c000) libc.so.6 => /lib64/libc.so.6 (0x00007fd42aaef000) /lib64/ld-linux-x86-64.so.2 (0x00007fd42b28d000) undefined symbol: ipset_errcode (.libs/libipset.so.1) Resolve this by moving ipset_errcode into the library. Reported-by: Arkadiusz Miskiewicz <a.miskiewicz@gmail.com> References: http://marc.info/?l=netfilter-devel&m=131435791514602&w=2
| * build: abort autogen on subcommand failureJan Engelhardt2011-08-311-1/+1
| | | | | | | | | | | | | | Needed to stop an automated build process when automake requirements are not fulfilled. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
| * ipset: use NFPROTO_ constantsJan Engelhardt2011-08-3134-165/+192
|/ | | | | ipset is actually using NFPROTO values rather than AF (xt_set passes that along).
* Propagate "expose userspace-relevant parts in ip_set.h" to ipset sourceJozsef Kadlecsik2011-08-3115-45/+68
| | | | | | With the header file restructuring, the ipset userspace enums IPSET_DIM_* clash with the kernel ones. In this patch the userspace is converted to use the kernel part enums and thus we got rid of userspace enums IPSET_DIM_*.
* netfilter: ipset: expose userspace-relevant parts in ip_set.hJan Engelhardt2011-08-311-12/+14
| | | | | | | iptables's libxt_SET.c depends on these. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: avoid use of kernel-only typesJan Engelhardt2011-08-311-2/+2
| | | | | | | | | | | | | When using the xt_set.h header in userspace, one will get these gcc reports: ipset/ip_set.h:184:1: error: unknown type name "u16" In file included from libxt_SET.c:21:0: netfilter/xt_set.h:61:2: error: unknown type name "u32" netfilter/xt_set.h:62:2: error: unknown type name "u32" Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: Remove unnecessary OOM logging messagesJoe Perches2011-08-311-3/+1
| | | | | | | | | | | Removing unnecessary messages saves code and text. Site specific OOM messages are duplications of a generic MM out of memory message and aren't really useful, so just delete them. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Dumping error triggered removing references twice and lead to kernel BUGJozsef Kadlecsik2011-08-311-0/+1
| | | | | | | | If there was a dumping error in the middle, the set-specific variable was not zeroed out and thus the 'done' function of the dumping wrongly tried to release the already released reference of the set. The already released reference was caught by __ip_set_put and triggered a kernel BUG message. The issue was reported by Jean-Philippe Menil.
* Autoload set type modules safelyJozsef Kadlecsik2011-08-291-10/+26
| | | | | | Jan Engelhardt noticed when userspace requests a set type unknown to the kernel, it can lead to a loop due to the unsafe type module loading. The issue is fixed in this patch.
* ipset 6.8 releasedv6.8Jozsef Kadlecsik2011-07-113-1/+12
|
* Update the manpage and document the limits in hash:net,iface.Jozsef Kadlecsik2011-07-111-1/+5
|
* Fix compiler warnings "'hash_ip4_data_next' declared inline after being called"Chris Friesen2011-07-091-1/+1
| | | | | | | | Some gcc versions warn about prototypes without "inline" when the declaration includes the "inline" keyword. The fix generates a false error message "marked inline, but without a definition" with sparse below 0.4.2. Signed-off-by: Chris Friesen <chris.friesen@genband.com>
* hash:net,iface fixed to handle overlapping nets behind different interfacesJozsef Kadlecsik2011-07-0810-51/+198
| | | | | | | | | | | | | | | | | | If overlapping networks with different interfaces was added to the set, the type did not handle it properly. Example ipset create test hash:net,iface ipset add test 192.168.0.0/16,eth0 ipset add test 192.168.0.0/24,eth1 Now, if a packet was sent from 192.168.0.0/24,eth0, the type returned a match. In the patch the algorithm is fixed in order to correctly handle overlapping networks. Limitation: the same network cannot be stored with more than 64 different interfaces in a single set.
* Make possible to hash some part of the data element only.Jozsef Kadlecsik2011-06-141-4/+10
|
* README file corrections from Richard LucassenJozsef Kadlecsik2011-06-081-3/+4
|
* ipset 6.7 releasedv6.7Jozsef Kadlecsik2011-05-313-1/+20
|
* Whitespace and coding fixes detected by checkpatch.plJozsef Kadlecsik2011-05-3149-675/+773
|
* hash:net,iface type introducedJozsef Kadlecsik2011-05-3021-6/+1157
| | | | | | | | | | The hash:net,iface type makes possible to store network address and interface name pairs in a set. It's mostly suitable for egress and ingress filtering. Examples: # ipset create test hash:net,iface # ipset add test 192.168.0.0/16,eth0 # ipset add test 192.168.0.0/24,eth1
* hash:* tests may seem to fail due to the too wide grep pattern, fix themJozsef Kadlecsik2011-05-305-7/+7
|