summaryrefslogtreecommitdiffstats
path: root/kernel/net/netfilter/ipset/ip_set_bitmap_ip.c
Commit message (Collapse)AuthorAgeFilesLines
* ipset: Add net namespace for ipsetVitaly Lavrov2013-09-281-1/+2
| | | | | | | | | | | | | | | | This patch adds netns support for ipset. Major changes were made in ip_set_core.c and ip_set.h. Global variables are moved to per net namespace. Added initialization code and the destruction of the network namespace ipset subsystem. In the prototypes of public functions ip_set_* added parameter "struct net*". The remaining corrections related to the change prototypes of public functions ip_set_*. The patch for git://git.netfilter.org/ipset.git commit 6a4ec96c0b8caac5c35474e40e319704d92ca347 Signed-off-by: Vitaly Lavrov <lve@guap.ru> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Support comments in bitmap-type ipsets.Oliver Smith2013-09-231-1/+3
| | | | | | | | | | | | | | This provides kernel support for creating bitmap ipsets with comment support. As is the case for hashes, this incurs a penalty when flushing or destroying the entire ipset as the entries must first be walked in order to free the comment strings. This penalty is of course far less than the cost of listing an ipset to userspace. Any set created without support for comments will be flushed/destroyed as before. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Generalize extensions supportJozsef Kadlecsik2013-09-071-73/+8
| | | | | Get rid of the structure based extensions and introduce a blob for the extensions. Thus we can support more extension types easily.
* Move extension data to set structureJozsef Kadlecsik2013-09-071-23/+22
| | | | | | Default timeout and extension offsets are moved to struct set, because all set types supports all extensions and it makes possible to generalize extension support.
* Rename extension offset ids to extension idsJozsef Kadlecsik2013-09-061-5/+5
|
* Fix "may be used uninitialized" warningsJozsef Kadlecsik2013-05-011-2/+2
| | | | Reported-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Rename simple macro names to avoid namespace issues.Jozsef Kadlecsik2013-05-011-5/+5
| | | | Reported-by: David Laight <David.Laight@ACULAB.COM>
* The bitmap types with counter supportJozsef Kadlecsik2013-04-091-5/+57
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Bitmap types using the unified code baseJozsef Kadlecsik2013-04-091-279/+72
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Include supported revisions in module descriptionJozsef Kadlecsik2012-09-111-3/+6
|
* Check and reject crazy /0 input parametersJozsef Kadlecsik2012-09-101-4/+6
| | | | | | | | bitmap:ip and bitmap:ip,mac type did not reject such a crazy range when created and using such a set results in a kernel crash. The hash types just silently ignored such parameters. Reject invalid /0 input parameters explicitely.
* ipset: Stop using NLA_PUT*().David S. Miller2012-05-101-15/+18
| | | | | | | These macros contain a hidden goto, and are thus extremely error prone and make code hard to audit. Signed-off-by: David S. Miller <davem@davemloft.net>
* ipset: use NFPROTO_ constantsJan Engelhardt2011-08-311-2/+2
| | | | | ipset is actually using NFPROTO values rather than AF (xt_set passes that along).
* Add xt_action_param to the variant level kadt functions, ipset API changeJozsef Kadlecsik2011-05-271-0/+1
| | | | | | With the change the sets can use any parameter available for the match and target extensions, like input/output interface. It's required for the hash:net,iface set type.
* Use unified from/to address masking and check the usageJozsef Kadlecsik2011-05-231-4/+2
|
* Take into account cidr value for the from address when creating the setJozsef Kadlecsik2011-05-221-0/+1
| | | | | | When creating a set from a range expressed as a network like 10.1.1.172/29, the from address was taken as the IP address part and not masked with the netmask from the cidr.
* Set type support with multiple revisions addedJozsef Kadlecsik2011-05-111-1/+2
| | | | | A set type may have multiple revisions, for example when syntax is extended. Support continuous revision ranges in set types.
* Fix adding ranges to hash typesJozsef Kadlecsik2011-05-061-1/+1
| | | | | | When ranges are added to hash types, the elements may trigger rehashing the set. However, the last successfully added element was not kept track so the adding started again with the first element after the rehashing. Bug reported by Mr Dash Four.
* Options and flags support added to the kernel APIJozsef Kadlecsik2011-04-181-3/+3
| | | | | | The support makes possible to specify the timeout value for the SET target and a flag to reset the timeout for already existing entries.
* Timeout can be modified for already added elementsJozsef Kadlecsik2011-03-271-10/+10
| | | | | | | | | | When an element to a set with timeout added, one can change the timeout by "readding" the element with the "-exist" flag. That means the timeout value is reset to the specified one (or to the default from the set specification if the "timeout n" option is not used). Example ipset add foo 1.2.3.4 timeout 10 ipset add foo 1.2.3.4 timeout 600 -exist
* References are protected by rwlock instead of mutexJozsef Kadlecsik2011-03-251-2/+1
| | | | | | | The timeout variant of the list:set type must reference the member sets. However, its garbage collector runs at timer interrupt so the mutex protection of the references is a no go. Therefore the reference protection is converted to rwlock.
* Reorganized kernel/ subdirJozsef Kadlecsik2011-02-031-0/+587
The kernel/ subdirectory is reorganized to follow the kernel directory structure.