summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* The unnamed union initialization may lead to compilation errorJozsef Kadlecsik2013-10-082-24/+20
| | | | | | | | | | | | The unnamed union should be possible to be initialized directly, but unfortunately it's not so: /usr/src/ipset/kernel/net/netfilter/ipset/ip_set_hash_netnet.c: In function ?hash_netnet4_kadt?: /usr/src/ipset/kernel/net/netfilter/ipset/ip_set_hash_netnet.c:141: error: unknown field ?cidr? specified in initializer Reported-by: Husnu Demir <hdemir@metu.edu.tr>
* Use dev_net() instead of the direct access to ->nd_netJozsef Kadlecsik2013-10-041-2/+2
| | | | | | We have to use dev_net() instead of the direct access to ->nd_net, otherwise compilation fails if NET_NS is not enabled. Reported by the kbuild test robot.
* ipset 6.20 releasedv6.20Jozsef Kadlecsik2013-10-023-1/+58
|
* Missing comment support added to hash:ip,port,ip and hash:net,iface typesJozsef Kadlecsik2013-10-022-0/+323
|
* Compatibility code is modified not to rely on kernel version numbersJozsef Kadlecsik2013-10-027-41/+241
| | | | | | | Instead the kernel source code is checked to verify the different compatibility issues for the supported kernel releases. This way hopefully backported features will be handled properly.
* Use netlink callback dump args onlyJozsef Kadlecsik2013-10-025-54/+68
| | | | | Instead of cb->data, use callback dump args only and introduce symbolic names instead of plain numbers at accessing the argument members.
* ipset: Add userspace code to support hash:net,port,net kernel module.Oliver Smith2013-09-3011-140/+763
| | | | | | | | | This adds the userspace library, tests to validate correct operation of the module and also provides appropriate usage information in the man page. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Add hash:net,port,net module to kernel.Oliver Smith2013-09-303-1/+598
| | | | | | | | | This adds a new set that provides similar functionality to ip,port,net but permits arbitrary size subnets for both the first and last parameter. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: Add net namespace for ipsetVitaly Lavrov2013-09-289-148/+245
| | | | | | | | | | | | | | | | This patch adds netns support for ipset. Major changes were made in ip_set_core.c and ip_set.h. Global variables are moved to per net namespace. Added initialization code and the destruction of the network namespace ipset subsystem. In the prototypes of public functions ip_set_* added parameter "struct net*". The remaining corrections related to the change prototypes of public functions ip_set_*. The patch for git://git.netfilter.org/ipset.git commit 6a4ec96c0b8caac5c35474e40e319704d92ca347 Signed-off-by: Vitaly Lavrov <lve@guap.ru> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Use a common function at listing the extensions of the elementsJozsef Kadlecsik2013-09-255-50/+33
|
* Tests added to check comment extensionJozsef Kadlecsik2013-09-2412-3/+2139
|
* For set:list types, replaced elements must be zeroed outJozsef Kadlecsik2013-09-231-1/+3
| | | | | The new extensions require zero initialization for the new element to be added into a slot from where another element was pushed away.
* Fix hash resizing with commentsJozsef Kadlecsik2013-09-231-5/+5
| | | | | The destroy function must take into account that resizing doesn't create new extensions so those cannot be destroyed at resize.
* ipset: Add new userspace set revisions for comment supportOliver Smith2013-09-2311-26/+1303
| | | | | | | | | | | This introduces new revisions of all hash and bitmap ipsets to complement the comment functionality introduced into the kernel modules. Currently all sets have a compile-time limit of 255 characters including \0. This can otherwise be arbitrarily modified. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: Support comments in the userspace library.Oliver Smith2013-09-2314-6/+144
| | | | | | | | | This adds support to the userspace portion of ipset for handling ipsets with the comment extension enabled. The library revision has been raised accordingly. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: Rework the "fake" argument parsing for ipset restore.Oliver Smith2013-09-231-9/+43
| | | | | | | | | | | | This reworks the argument parsing functionality of ipset to handle quote-delimited lines in such a way that they are considered to be a single argument. This commit is necessary for ipset to successfully restore sets that have comments. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Support comments in the list-type ipset.Oliver Smith2013-09-231-6/+12
| | | | | | | | This provides kernel support for creating list ipsets with the comment annotation extension. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Support comments in bitmap-type ipsets.Oliver Smith2013-09-234-9/+17
| | | | | | | | | | | | | | This provides kernel support for creating bitmap ipsets with comment support. As is the case for hashes, this incurs a penalty when flushing or destroying the entire ipset as the entries must first be walked in order to free the comment strings. This penalty is of course far less than the cost of listing an ipset to userspace. Any set created without support for comments will be flushed/destroyed as before. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Support comments in hash-type ipsets.Oliver Smith2013-09-239-13/+30
| | | | | | | | | | | | | This provides kernel support for creating ipsets with comment support. This does incur a penalty to flushing/destroying an ipset since all entries are walked in order to free the allocated strings, this penalty is of course less expensive than the operation of listing an ipset to userspace, so for general-purpose usage the overall impact is expected to be little to none. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Support comments for ipset entries in the core.Oliver Smith2013-09-234-8/+118
| | | | | | | | | | | | | This adds the core support for having comments on ipset entries. The comments are stored as standard null-terminated strings in dynamically allocated memory after being passed to the kernel. As a result of this, code has been added to the generic destroy function to iterate all extensions and call that extension's destroy task if the set has that extension activated, and if such a task is defined. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: Add userspace code to support hash:net,net kernel module.Oliver Smith2013-09-2015-2/+640
| | | | | | | | | This adds the userspace library, tests to validate correct operation of the module and also provides appropriate usage information in the man page. The library version has been bumped accordingly. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Add hash:net,net module to kernel.Oliver Smith2013-09-204-9/+541
| | | | | | | | | | This adds a new set that provides the ability to configure pairs of subnets. A small amount of additional handling code has been added to the generic hash header file - this code is conditionally activated by a preprocessor definition. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Kconfig: ipset needs NETFILTER_NETLINKJozsef Kadlecsik2013-09-172-1/+6
| | | | | NETFILTER_NETLINK is not selectable in recent kernels, check and warn if not enabled indirectly.
* Add test to verify CIDR trackingJozsef Kadlecsik2013-09-151-0/+12
|
* netfilter: ipset: Fix serious failure in CIDR trackingOliver Smith2013-09-151-10/+14
| | | | | | | | | | | | | | | | | | | | | | | | | This fixes a serious bug affecting all hash types with a net element - specifically, if a CIDR value is deleted such that none of the same size exist any more, all larger (less-specific) values will then fail to match. Adding back any prefix with a CIDR equal to or more specific than the one deleted will fix it. Steps to reproduce: ipset -N test hash:net ipset -A test 1.1.0.0/16 ipset -A test 2.2.2.0/24 ipset -T test 1.1.1.1 #1.1.1.1 IS in set ipset -D test 2.2.2.0/24 ipset -T test 1.1.1.1 #1.1.1.1 IS NOT in set This is due to the fact that the nets counter was unconditionally decremented prior to the iteration that shifts up the entries. Now, we first check if there is a proceeding entry and if not, decrement it and return. Otherwise, we proceed to iterate and then zero the last element, which, in most cases, will already be zero. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* configure: uclinux is also linuxGustavo Zacarias2013-09-131-1/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* list:set: make sure all elements are checked by the gcJozsef Kadlecsik2013-09-091-2/+5
| | | | | When an element timed out, the next one was skipped by the garbage collector, fixed.
* Support extensions which need a per data destroy functionJozsef Kadlecsik2013-09-094-43/+107
|
* Generalize extensions supportJozsef Kadlecsik2013-09-0714-749/+118
| | | | | Get rid of the structure based extensions and introduce a blob for the extensions. Thus we can support more extension types easily.
* Move extension data to set structureJozsef Kadlecsik2013-09-0715-289/+266
| | | | | | Default timeout and extension offsets are moved to struct set, because all set types supports all extensions and it makes possible to generalize extension support.
* Rename extension offset ids to extension idsJozsef Kadlecsik2013-09-067-43/+43
|
* Prepare ipset to support multiple networks for hash typesJozsef Kadlecsik2013-09-046-44/+48
| | | | | | In order to support hash:net,net, hash:net,port,net etc. types, arrays are introduced for the book-keeping of existing cidr sizes and network numbers in a set.
* Introduce new operation to get both setname and familyJozsef Kadlecsik2013-09-042-0/+25
| | | | | | | | ip[6]tables set match and SET target need to know the family of the set in order to reject adding rules which refer to a set with a non-mathcing family. Currently such rules are silently accepted and then ignored instead of generating a clear error message to the user, which is not helpful.
* Add specifying protocol for bitmap:portQuentin Armitage2013-08-174-18/+67
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Remove artifical restriction of netmask values for hash:ip type.Jozsef Kadlecsik2013-08-171-6/+4
| | | | Reported by Quentin Armitage, closes netfilter bugzilla id #844.
* Make sure called test scripts can be executed (reported by Tomas Budai)Jozsef Kadlecsik2013-08-161-0/+3
|
* Manpage fix: not just identical, but compatible type of sets can be swappedJozsef Kadlecsik2013-08-141-5/+5
| | | | Reported by Quentin Armitage, netfilter bugzilla id #843.
* Validate the set family and not the set type family at swapping.Jozsef Kadlecsik2013-08-141-1/+1
| | | | Bug reported by Quentin Armitage, netfilter bugzilla id #843.
* Fix error message typoJozsef Kadlecsik2013-08-141-1/+1
| | | | Reported by Quentin Armitage, netfilter bugzilla id #843.
* Parse option "family" first, because other options may depend on itJozsef Kadlecsik2013-08-141-24/+47
| | | | | | | Option like "netmask" depends on the INET family, so parse "family" first, then the rest of the options. Bug reported by Quentin Armitage, closed netfilter bugzilla #841.
* Change 2nd parameter type of ipset_parse_elemQuentin Armitage2013-08-012-2/+2
| | | | | | | | | The only place in ipset where ipset_parse_elem is called is src/ipset.c. The second parameter to the function call is type->last_elem_optional, which is of type bool, but ipset_parse_elem is defined in lib/parse.c with the second parameter having type enum ipset_opt. The use in lib/parse.c is clearly as a bool.
* Consistent userspace testing with nomatch flagJozsef Kadlecsik2013-07-226-12/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The "nomatch" commandline flag should invert the matching at testing, similarly to the --return-nomatch flag of the "set" match of iptables. Until now it worked with the elements with "nomatch" flag only. From now on it works with elements without the flag too, i.e: # ipset n test hash:net # ipset a test 10.0.0.0/24 nomatch # ipset t test 10.0.0.1 10.0.0.1 is NOT in set test. # ipset t test 10.0.0.1 nomatch 10.0.0.1 is in set test. # ipset a test 192.168.0.0/24 # ipset t test 192.168.0.1 192.168.0.1 is in set test. # ipset t test 192.168.0.1 nomatch 192.168.0.1 is NOT in set test. Before the patch the results were ... # ipset t test 192.168.0.1 192.168.0.1 is in set test. # ipset t test 192.168.0.1 nomatch 192.168.0.1 is in set test.
* Report broken netlink messages in debug modeJozsef Kadlecsik2013-07-191-0/+13
|
* Skip really non-first fragments for IPv6 when getting port/protocolJozsef Kadlecsik2013-05-311-4/+2
|
* ipset standalone package needs to ship em_ipset.cJozsef Kadlecsik2013-05-314-4/+152
| | | | | | | | Due to the ipset kernel API changes, em_ipset.c needs to be provided in the ipset package, reported by Jan Engelhardt: WARNING: //lib/modules/3.7.10-jng15-default/kernel/net/sched/em_ipset.ko disagrees about version of symbol ip_set_test
* ipset: Fix hyphen used as minus sign in manpageNeutron Soutmun2013-05-131-1/+1
| | | | | Signed-off-by: Neutron Soutmun <neo.neutron@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* libipset.pc must be installed via 'make install'Eric Leblond2013-05-111-0/+3
| | | | | | | | libipset.pc was not installed by classic 'make install'. This patch adds it to the list of installed files. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset 6.19 releasedv6.19Jozsef Kadlecsik2013-05-093-1/+59
|
* Compatibility fixes to keep the support of kernels back to 2.6.32Jozsef Kadlecsik2013-05-092-48/+48
|
* Check at modules_install whether depmod ignores the extra subdirJozsef Kadlecsik2013-05-091-0/+18
| | | | | | | | | The external kernel modules are installed in the extra subdir in /lib/modules/<kernelrelease>/, but depmod in some distributions (at least in Ubuntu 12.04 LTS) ingores the subdir. Warn about it, because that way the modules are actually not available there. Reported by Husnu Demir and tian fang.
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 19:43:40 +0000