path: root/src
diff options
authorOliver Smith <>2013-09-20 10:13:54 +0200
committerJozsef Kadlecsik <>2013-09-20 22:20:28 +0200
commitab7c172107690be48110c6176fa9000e4f4cf4d8 (patch)
tree1e600ff48412fef6590ceb40085860c3cecce9d4 /src
parent560c3b54e572d383f0931e4d82c5734725152030 (diff)
ipset: Add userspace code to support hash:net,net kernel module.
This adds the userspace library, tests to validate correct operation of the module and also provides appropriate usage information in the man page. The library version has been bumped accordingly. Signed-off-by: Oliver Smith <> Signed-off-by: Jozsef Kadlecsik <>
Diffstat (limited to 'src')
1 files changed, 74 insertions, 0 deletions
diff --git a/src/ipset.8 b/src/ipset.8
index d7fa964..b53e94d 100644
--- a/src/ipset.8
+++ b/src/ipset.8
@@ -534,6 +534,80 @@ ipset add foo 192.168.0/30 nomatch
When matching the elements in the set above, all IP addresses will match
from the networks, and 192.168.0/24 except
the ones from 192.168.0/30.
+.SS hash:net,net
+The \fBhash:net,net\fR set type uses a hash to store pairs of different sized IP
+network addresses. Bear in mind that the first parameter has precedence
+over the second, so a nomatch entry could be potentially be ineffective if a more specific
+first parameter existed with a suitable second parameter.
+Network address with zero prefix size cannot be stored in this type of set.
+\fICREATE\-OPTIONS\fR := [ \fBfamily\fR { \fBinet\fR | \fBinet6\fR } ] | [ \fBhashsize\fR \fIvalue\fR ] [ \fBmaxelem\fR \fIvalue\fR ] [ \fBtimeout\fR \fIvalue\fR ] [ \fBcounters\fP ]
+\fIADD\-ENTRY\fR := \fInetaddr\fR,\fInetaddr\fR
+\fIADD\-OPTIONS\fR := [ \fBtimeout\fR \fIvalue\fR ] [ \fBnomatch\fR ] [ \fBpackets\fR \fIvalue\fR ] [ \fBbytes\fR \fIvalue\fR ]
+\fIDEL\-ENTRY\fR := \fInetaddr\fR,\fInetaddr\fR
+\fITEST\-ENTRY\fR := \fInetaddr\fR,\fInetaddr,\fR
+\fInetaddr\fR := \fIip\fR[/\fIcidr\fR]
+Optional \fBcreate\fR options:
+\fBfamily\fR { \fBinet\fR | \fBinet6\fR }
+The protocol family of the IP addresses to be stored in the set. The default is
+\fBinet\fR, i.e IPv4.
+\fBhashsize\fR \fIvalue\fR
+The initial hash size for the set, default is 1024. The hash size must be a power
+of two, the kernel automatically rounds up non power of two hash sizes to the first
+correct value.
+\fBmaxelem\fR \fIvalue\fR
+The maximal number of elements which can be stored in the set, default 65536.
+For the \fBinet\fR family one can add or delete multiple entries by specifying
+a range, which is converted internally to network(s) equal to the range:
+\fInetaddr\fR := { \fIip\fR[/\fIcidr\fR] | \fIfromaddr\fR\-\fItoaddr\fR }
+When adding/deleting/testing entries, if the cidr prefix parameter is not specified,
+then the host prefix value is assumed. When adding/deleting entries, the exact
+element is added/deleted and overlapping elements are not checked by the kernel.
+When testing entries, if a host address is tested, then the kernel tries to match
+the host address in the networks added to the set and reports the result accordingly.
+From the \fBset\fR netfilter match point of view the searching for a match
+always starts from the smallest size of netblock (most specific
+prefix) to the largest one (least specific prefix) with the first param
+having precedence.
+When adding/deleting IP addresses to the set by the \fBSET\fR netfilter target,
+it will be added/deleted by the most specific prefix which can be found in
+the set, or by the host prefix value if the set is empty.
+The lookup time grows linearly with the number of the different prefix
+values added to the first parameter of the set. The number of secondary prefixes
+further increases this as the list of secondary prefixes is traversed per primary
+ipset create foo hash:net,net
+ipset add foo,
+ipset add foo,
+ipset add foo 192.168.0/24,
+ipset add foo 192.168.0/30,192.168.64/30 nomatch
+When matching the elements in the set above, all IP addresses will match
+from the networks<->,<->
+and 192.168.0/24<-> except the ones from
.SS hash:ip,port
The \fBhash:ip,port\fR set type uses a hash to store IP address and port number pairs.
The port number is interpreted together with a protocol (default TCP) and zero