summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Coding style fixesJozsef Kadlecsik2012-09-1115-48/+64
|
* The set type revision number is added to the header part of listingJozsef Kadlecsik2012-09-1126-75/+76
| | | | | | | | | Incompatibility: if your script rely on the number of lines in the header of set listings, then the new line Revision: number can break your script.
* Include supported revisions in module descriptionJozsef Kadlecsik2012-09-1112-39/+78
|
* Help prints list type revision and terse descriptionJozsef Kadlecsik2012-09-1013-5/+25
| | | | | In order to catch kernel/userspace revision mismatch, better print all available data.
* Add /0 network support to hash:net,iface typeJozsef Kadlecsik2012-09-104-30/+117
| | | | | Now it is possible to setup a single hash:net,iface type of set and a single ip6?tables match which covers all egress/ingress filtering.
* Fix cidr book keeping for hash:*net* typesJozsef Kadlecsik2012-09-101-49/+55
| | | | | | | The book-keeping of the different sized networks were bogus, fix it. The broken code could lead invalid matching in such sets when the number of different sized networks were greater than the smallest CIDR value of the networks.
* Check and reject crazy /0 input parametersJozsef Kadlecsik2012-09-106-10/+13
| | | | | | | | bitmap:ip and bitmap:ip,mac type did not reject such a crazy range when created and using such a set results in a kernel crash. The hash types just silently ignored such parameters. Reject invalid /0 input parameters explicitely.
* Backport ether_addr_equalJozsef Kadlecsik2012-09-101-2/+11
|
* Coding style fix, backport from kernelJozsef Kadlecsik2012-09-101-2/+2
|
* net: cleanup unsigned to unsigned intEric Dumazet2012-09-082-7/+7
| | | | | | | Use of "unsigned int" is preferred to bare "unsigned" in net tree. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Fix errors when compiling in debug mode.Krunal Patel2012-08-313-8/+6
|
* Make sure IPPROTO_UDPLITE is definedJozsef Kadlecsik2012-08-311-0/+3
|
* build: restore -version-infoJan Engelhardt2012-07-012-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On Sunday 2012-07-01 19:20, Jozsef Kadlecsik wrote: >[...] >> * therefore the patch makes a clean restart, >> using -version-info 3:0:0, to continue using .so.3 >> starting from ipset-6.13 until the next *real* >> incompatible change. > >What is still unclear for me, why a clean restart is required. Looking >into "libtool", as I see, "-version-number 3:0:1" and "-version-info >3:0:1" produces the same result. They don't. The libtool manual goes on attempting to explain "-version-number" with C:R:A, though it could have been a lot easier to just say "it copies the values as-is to the file suffix". ---8<--- location git://git.inai.de/ipset (updated) parent 7c7b022a18ea2bae11d889b345caef87f3bf145e (v6.13) commit 2b145f0794de6f56eaded0a6403be995be98c93b Author: Jan Engelhardt <jengelh@inai.de> Date: Sat Jun 30 20:39:27 2012 +0200 build: restore -version-info Commit v6.13~7 accidentally swapped "-version-info" with "-version-number". Because "-version-number" takes the values "FIRST:AGE:REV", which is different from "-version-info CURRENT:REV:AGE", libipset.so.3 was emitted. Restore using "-version-info" and continue to use 3 as the "FIRST" interface (instead of 2), because it was declared that way in ipset-6.13. Also note that the version names in libipset.map generally are not supposed to follow SO versions, but the program version): IPSET_6.13 {...}. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset 6.13 releasedv6.13Jozsef Kadlecsik2012-06-293-1/+16
|
* Explain in more detail src/dst for hash:net,ifaceJozsef Kadlecsik2012-06-291-2/+3
|
* ipset: Handle properly an IPSET_CMD_NONETomasz Bursztyka2012-06-291-0/+12
| | | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: hash:net,iface: fix interface comparisonFlorian Westphal2012-06-191-28/+4
| | | | | | | | | | | | | | | | ifname_compare() assumes that skb->dev is zero-padded, e.g 'eth1\0\0\0\0\0...'. This isn't always the case. e1000 driver does strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1); in e1000_probe(), so once device is registered dev->name memory contains 'eth1\0:0:3\0\0\0' (or something like that), which makes eth1 compare fail. Use plain strcmp() instead. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset help lists set types multiple times, fixed (reported by Mr Dash Four)Jozsef Kadlecsik2012-06-191-1/+5
| | | | | | ipset help listed every set type, including the ones with multiple revisions - which were listed thus multiple times. Set types with multiple revisions are listed once from now on.
* The commandline parser was too permissive, make it more strictJozsef Kadlecsik2012-06-194-34/+34
| | | | | | The parser allowed more possible argument alternatives for command options than the documented one, which limited the possibility of other option names. The patch makes the parser more strict.
* Timeout fixing bug broke SET target special timeout value, fixedJozsef Kadlecsik2012-06-081-1/+3
| | | | | | The patch "Fix timeout value overflow bug at large timeout parameters" broke the SET target when no timeout was specified (reported by Jean-Philippe Menil).
* Allow saving to/restoring from a file without shell redirectionJozsef Kadlecsik2012-05-238-11/+141
| | | | | | | | | Mathieu Bridon suggested that in some environments where there is no access to a full shell with input/output redirection, it'd be useful to read from/write to directly a file (bugzilla #788). The patch adds the new "-file" option to specify a filename to print into when listing/saving sets or read from when restoring sets.
* Use MSEC_PER_SEC instead of harcoded valueJozsef Kadlecsik2012-05-152-4/+4
| | | | | David Laight and Eric Dumazet noticed that we were using hardcoded 1000 instead of MSEC_PER_SEC to calculate the timeout.
* Fix typo of word "unkown" to "unknown".Neutron Soutmun2012-05-152-3/+3
|
* ipset 6.12.1 releasedv6.12.1Jozsef Kadlecsik2012-05-102-1/+7
|
* Enable silent (kernel style) compile messagesJozsef Kadlecsik2012-05-107-37/+9
|
* Fix build failed on --disable-dependency-trackingNeutron Soutmun2012-05-102-6/+11
|
* Add tarball target to MakefileJozsef Kadlecsik2012-05-101-1/+8
|
* ipset 6.12 releasedJozsef Kadlecsik2012-05-103-1/+30
|
* Backport nla_put_net* functions as NLA_PUT* were removedJozsef Kadlecsik2012-05-101-0/+22
|
* Cleanup generated files by make tidyJozsef Kadlecsik2012-05-101-0/+1
|
* netlink: add netlink_dump_control structure for netlink_dump_start()Pablo Neira Ayuso2012-05-101-2/+12
| | | | Backport of Pablo's patch to the ipset package.
* ipset: Stop using NLA_PUT*().David S. Miller2012-05-1014-258/+309
| | | | | | | These macros contain a hidden goto, and are thus extremely error prone and make code hard to audit. Signed-off-by: David S. Miller <davem@davemloft.net>
* Add more CC warning option to debug modeJozsef Kadlecsik2012-05-1013-2/+20
|
* Report syntax error messages immediatelyJozsef Kadlecsik2012-05-101-1/+1
|
* Suppress false syntax error messagesJozsef Kadlecsik2012-05-105-5/+39
| | | | | | If a create command fails at the kernel side, false syntax error was also reported due to the chicken and egg problem of the family option.
* Add configure summary for the ipset userspace toolJozsef Kadlecsik2012-05-102-3/+41
|
* Add dynamic module support to ipset userspace toolNeutron Soutmun2012-05-1020-67/+313
| | | | | | | | | | | | | The patch adds supporting dynamic modules for the set types to ipset userspace tool. The dynamic module support can be enabled by the --enable-settype-modules of "configure". The list of set types to be compiled as dynamic modules can be specified in the --with-settype-modules-list option. Example --enable-settype-modules \ --with-settype-modules-list="ipset_hash_ip ipset_hash_ipport" The keyword "all" can be used to compile all set types as dynamic modules.
* Move ipset_port_usage() into libNeutron Soutmun2012-05-066-33/+46
|
* Fix hash size checking in kernelJozsef Kadlecsik2012-05-068-21/+65
| | | | | | The hash size must fit both into u32 (jhash) and the max value of size_t. The missing checking could lead to kernel crash, bug reported by Seblu.
* Fix invalid assignment to const void pointerJozsef Kadlecsik2012-05-061-7/+7
| | | | | gcc 4.7 and above ignore such assignments which leads to a broken ipset binary (bug reported by Seblu).
* Correct README file about minimal required iptables versionOskar Berggren2012-05-041-1/+1
|
* Sparse warnings "incorrect type in assignment" fixedJozsef Kadlecsik2012-05-047-33/+39
|
* Remove unused variables (warnings fixed)Jozsef Kadlecsik2012-05-042-2/+2
|
* Fix timeout value overflow bug at large timeout parametersJozsef Kadlecsik2012-05-0415-29/+75
| | | | | Large timeout parameters could result wrong timeout values due to an overflow at msec to jiffies conversion (reported by Andreas Herz)
* ipv6: Add fragment reporting to ipv6_skip_exthdr().Jesse Gross2012-05-041-0/+8
| | | | | | | | | | While parsing through IPv6 extension headers, fragment headers are skipped making them invisible to the caller. This reports the fragment offset of the last header in order to make it possible to determine whether the packet is fragmented and, if so whether it is a first or last fragment. Signed-off-by: Jesse Gross <jesse@nicira.com>
* net: remove ipv6_addr_copy()Alexey Dobriyan2012-04-192-2/+2
| | | | | | | C assignment can handle struct in6_addr copying. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Improve ipset help text messages (Mr Dash Four)Jozsef Kadlecsik2012-04-191-4/+4
|
* Fix the inclusion of linux/export.hHenry Culver2012-01-202-2/+2
| | | | | | The tests for inclusion of linux/export.h in ipset-6.11:kernel/net/netfilter/ipset/{ip_set_getport.c,pfxlen.c} are incorrect, linux/export.h did not go in until 3.2.0.
* ipset 6.11 releasedv6.12v6.11Jozsef Kadlecsik2012-01-143-1/+24
|
* Support hostnames and service names with dashJozsef Kadlecsik2012-01-144-45/+161
| | | | | | | | The square brackets are introduced as an escape mechanism to enter hostnames or service names with dash in order to avoid mixing up the dash in the name with the range notation. Problem reported by Stephen Hemminger and Marc Guardiola.