summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Use IS_ENABLED macro and define it if requiredJozsef Kadlecsik2014-11-032-1/+12
|
* Alignment problem between 64bit kernel 32bit userspaceJozsef Kadlecsik2014-11-033-6/+88
| | | | | | | | | | | | | | | | Sven-Haegar Koch reported the issue: sims:~# iptables -A OUTPUT -m set --match-set testset src -j ACCEPT iptables: Invalid argument. Run `dmesg' for more information. In syslog: x_tables: ip_tables: set.3 match: invalid size 48 (kernel) != (user) 32 which was introduced by the counter extension in ipset. The patch fixes the alignment issue with introducing a new set match revision with the fixed underlying 'struct ip_set_counter_match' structure.
* Add script to check libipset.map for missing symbolsJozsef Kadlecsik2014-10-284-3/+36
|
* Update libipset.map with ipset_parse_tcp_udp_portThomas Backlund2014-10-281-0/+1
| | | | | | | | | | | | | | | | | | | | | | | Commit: author Quentin Armitage <quentin@armitage.org.uk> 2013-08-09 11:26:33 (GMT) committer Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> 2013-08-17 19:31:29 (GMT) commit 480761a3bdaa55bf8c966e4dab950ebf84775863 (patch) tree 6d750f948abf1ae4f93e4c704502d085ac13d679 parent 3a4419954a3ae0ba5dafd711e6b8dd8f0beb5c21 (diff) Add specifying protocol for bitmap:port Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> added ipset_parse_tcp_udp_port(), but forgot to update libipset.map so we get: /usr/lib64/ipset/ipset_bitmap_port.so: /usr/lib64/ipset/ipset_bitmap_port.so: undefined symbol: ipset_parse_tcp_udp_port so update the map. Signed-off-by: Thomas Backlund <tmb@mageia.org> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* libipset: Bump lib version and update map fileNeutron Soutmun2014-10-282-1/+6
| | | | | | | | | | The ipset_parse_uint16() was introduced but no lib version bumped and no map file updated. Bump lib version to 9:0:6. (current and age was bumped) Signed-off-by: Neutron Soutmun <neo.neutron@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: off by one in ip_set_nfnl_get_byindex()Dan Carpenter2014-10-211-1/+1
| | | | | | | | The ->ip_set_list[] array is initialized in ip_set_net_init() and it has ->ip_set_max elements so this check should be >= instead of > otherwise we are off by one. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Bash utilities updatedJozsef Kadlecsik2014-09-302-48/+79
|
* ipset: Fix hyphen used as minus sign in manpageNeutron Soutmun2014-09-301-1/+1
| | | | | Signed-off-by: Neutron Soutmun <neo.neutron@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset 6.23 releasedv6.23Jozsef Kadlecsik2014-09-233-1/+18
|
* The utils are updated from their sourcesJozsef Kadlecsik2014-09-231-77/+109
|
* Order create and add options in manpage so that generic ones come firstJozsef Kadlecsik2014-09-231-51/+51
|
* Centralise generic create options (family, hashsize, maxelem) on top of man ↵Mart Frauenlob2014-09-231-175/+35
| | | | | | | page in the generic options section. Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Support glibc < 2.9 (fixes bugzilla id #891)Jozsef Kadlecsik2014-09-232-0/+71
|
* Support updating extensions when the set is fullJozsef Kadlecsik2014-09-233-23/+43
| | | | | | When the set was full (hash type and maxelem reached), it was not possible to update the extension part of already existing elements. The patch removes this limitation. (Fixes netfilter bugzilla id 880.)
* Add description of hash:mac set type to man page.Mart Frauenlob2014-09-221-0/+32
| | | | | Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Add missing space for skbinfo option synopsis.Mart Frauenlob2014-09-221-1/+1
| | | | | Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* The library/API versions were forgotten to bump (reported by Sergei Zhirikov)Jozsef Kadlecsik2014-09-222-1/+9
| | | | | With introducing the skbinfo extension, the library/API versions should have been incremented, which is fixed now.
* Retry printing when sprintf fails (reported by Stig Thormodsrud)Jozsef Kadlecsik2014-09-221-14/+2
| | | | | | Instead of returning the length of the string which would have been printed, sprintf sometimes simply returns an error code. Handle the case and flush the printing buffer and retry.
* ipset 6.22 releasedv6.22Jozsef Kadlecsik2014-09-153-1/+48
|
* hash:mac type added to ipsetJozsef Kadlecsik2014-09-1512-4/+416
|
* skbinfo extension: send nonzero extension elements only to userspaceJozsef Kadlecsik2014-09-151-7/+11
|
* Add test to check mark mappingJozsef Kadlecsik2014-09-142-0/+17
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: remove extran newline on debug outputHolger Eitzenberger2014-09-141-1/+1
| | | | | | | | | [ The following text is in the "utf-8" character set. ] [ Your display is set for the "ISO-8859-2" character set. ] [ Some characters may be displayed incorrectly. ] Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: avoid duplicate command flagsHolger Eitzenberger2014-09-141-4/+2
| | | | | | | | | | | | [ The following text is in the "utf-8" character set. ] [ Your display is set for the "ISO-8859-2" character set. ] [ Some characters may be displayed incorrectly. ] NLM_F_DUMP is #defined as (NLM_F_ROOT | NLM_F_ACK), so specifying all of them is redundant. Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Remove a duplicate debug printHolger Eitzenberger2014-09-141-2/+1
| | | | | | | | | [ The following text is in the "utf-8" character set. ] [ Your display is set for the "ISO-8859-2" character set. ] [ Some characters may be displayed incorrectly. ] Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: Convert pr_warning to pr_warnJoe Perches2014-09-143-42/+35
| | | | | | | | | | | | Use the more common pr_warn. Other miscellanea: o Coalesce formats o Realign arguments Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Add skbinfo extension support to SET target.Anton Danilov2014-09-142-12/+191
| | | | | Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: man: Add the skbinfo extension documentation.Anton Danilov2014-09-141-28/+42
| | | | | Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* libipset: Add userspace support of the skbinfo extension of the list set type.Anton Danilov2014-09-141-0/+131
| | | | | | | | Add userspace part for support of new revisions of the list set type with the skbinfo extension. Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* libipset: Add userspace support of the skbinfo extension of the hash set types.Anton Danilov2014-09-1410-0/+1827
| | | | | | | | Add userspace part for support of new revisions of the hash set types with the skbinfo extension. Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* libipset: Add userspace support of the skbinfo extension of the bitmap set ↵Anton Danilov2014-09-143-0/+405
| | | | | | | | | | types. Add userspace part for support of new revisions of the bitmap set types with the skbinfo extension. Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* libipset: Add userspace code for the skbinfo extension support.Anton Danilov2014-09-1410-3/+201
| | | | | | | | | Add userspace code to support of the skbinfo extension independly of set types. Defines constants, flag and function for print/parse/send/recieve of skbinfo parameters. Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Add skbinfo extension kernel support for the list set type.Anton Danilov2014-09-081-2/+17
| | | | | | | | Add skbinfo extension kernel support for the list set type. Introduce the new revision of the list set type. Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Add skbinfo extension kernel support for the hash set types.Anton Danilov2014-09-0811-25/+130
| | | | | | | | Add skbinfo extension kernel support for the hash set types. Inroduce the new revisions of all hash set types. Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Add skbinfo extension kernel support for the bitmap set types.Anton Danilov2014-09-084-6/+31
| | | | | | | | Add skbinfo extension kernel support for the bitmap set types. Inroduce the new revisions of bitmap_ip, bitmap_ipmac and bitmap_port set types. Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netfilter: ipset: Add skbinfo extension kernel support in the ipset core.Anton Danilov2014-09-083-2/+93
| | | | | | | | | | | Skbinfo extension provides mapping of metainformation with lookup in the ipset tables. This patch defines the flags, the constants, the functions and the structures for the data type independent support of the extension. Note the firewall mark stores in the kernel structures as two 32bit values, but transfered through netlink as one 64bit value. Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Fix static checker warning in ip_set_core.cJozsef Kadlecsik2014-09-011-1/+2
| | | | | | | | | Dan Carpenter reported the following static checker warning: net/netfilter/ipset/ip_set_core.c:1414 call_ad() error: 'nlh->nlmsg_len' from user is not capped properly The payload size is limited now by the max size of size_t.
* Make possible to compile ipset with IPSET_DEBUG from the dist.Clinton Roy2014-08-191-0/+3
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Fix warn: integer overflows 'sizeof(*map) + size * set->dsize'Jozsef Kadlecsik2014-08-052-1/+4
| | | | | | | | | Dan Carpenter reported that the static checker emits the warning net/netfilter/ipset/ip_set_list_set.c:600 init_list_set() warn: integer overflows 'sizeof(*map) + size * set->dsize' Limit the maximal number of elements in list type of sets.
* net/netfilter/ipset: Resolve missing-field-initializer warningsMark Rustad2014-08-056-18/+18
| | | | | | | | | Resolve missing-field-initializer warnings by providing a directed initializer. Signed-off-by: Mark Rustad <mark.d.rustad@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* netnet,netportnet: Fix value range support for IPv4Sergey Popovich2014-05-062-8/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ranges of values are broken with hash:net,net and hash:net,port,net. hash:net,net ============ # ipset create test-nn hash:net,net # ipset add test-nn 10.0.10.1-10.0.10.127,10.0.0.0/8 # ipset list test-nn Name: test-nn Type: hash:net,net Revision: 0 Header: family inet hashsize 1024 maxelem 65536 Size in memory: 16960 References: 0 Members: 10.0.10.1,10.0.0.0/8 # ipset test test-nn 10.0.10.65,10.0.0.1 10.0.10.65,10.0.0.1 is NOT in set test-nn. # ipset test test-nn 10.0.10.1,10.0.0.1 10.0.10.1,10.0.0.1 is in set test-nn. hash:net,port,net ================= # ipset create test-npn hash:net,port,net # ipset add test-npn 10.0.10.1-10.0.10.127,tcp:80,10.0.0.0/8 # ipset list test-npn Name: test-npn Type: hash:net,port,net Revision: 0 Header: family inet hashsize 1024 maxelem 65536 Size in memory: 17344 References: 0 Members: 10.0.10.8/29,tcp:80,10.0.0.0 10.0.10.16/28,tcp:80,10.0.0.0 10.0.10.2/31,tcp:80,10.0.0.0 10.0.10.64/26,tcp:80,10.0.0.0 10.0.10.32/27,tcp:80,10.0.0.0 10.0.10.4/30,tcp:80,10.0.0.0 10.0.10.1,tcp:80,10.0.0.0 # ipset list test-npn # ipset test test-npn 10.0.10.126,tcp:80,10.0.0.2 10.0.10.126,tcp:80,10.0.0.2 is NOT in set test-npn. # ipset test test-npn 10.0.10.126,tcp:80,10.0.0.0 10.0.10.126,tcp:80,10.0.0.0 is in set test-npn. # ipset create test-npn hash:net,port,net # ipset add test-npn 10.0.10.0/24,tcp:80-81,10.0.0.0/8 # ipset list test-npn Name: test-npn Type: hash:net,port,net Revision: 0 Header: family inet hashsize 1024 maxelem 65536 Size in memory: 17024 References: 0 Members: 10.0.10.0,tcp:80,10.0.0.0 10.0.10.0,tcp:81,10.0.0.0 # ipset test test-npn 10.0.10.126,tcp:80,10.0.0.0 10.0.10.126,tcp:80,10.0.0.0 is NOT in set test-npn. # ipset test test-npn 10.0.10.0,tcp:80,10.0.0.0 10.0.10.0,tcp:80,10.0.0.0 is in set test-npn. Correctly setup from..to variables where no IPSET_ATTR_IP_TO{,2} attribute is given, so in range processing loop we construct proper cidr value. Check whenever we have no ranges and can short cut in hash:net,net properly. Use unlikely() where appropriate, to comply with other modules. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ru> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* libipset: print third element in debuggingSergey Popovich2014-05-061-1/+3
| | | | | | | | | We have that done for first and second elements when parsing element string, do this for third element for convenience. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ru> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: Handle missing leading zeros in ethernet address parserJaneks Jaunups2014-05-062-5/+16
| | | | | | | | ipset would not parse ether addresses which are not exactly 17 characters long, for ex. 1:2:3:4:5:6, which is fixed in the patch. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Removed invalid IPSET_ATTR_MARKMASK validationVytas Dauksa2014-04-071-1/+1
| | | | | | | | | Markmask is an u32, hence it can't be greater then 4294967295 ( i.e. 0xffffffff ). This was causing smatch warning: net/netfilter/ipset/ip_set_hash_gen.h:1084 hash_ipmark_create() warn: impossible condition '(markmask > 4294967295) => (0-u32max > u32max)' Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: Pass IPSET_BIN to test scripts to change binary locationNeutron Soutmun2014-04-0711-42/+54
| | | | | | | | | | | | | In the "as-installed" package testing situation, the test scripts should invokes the system installed "ipset" binary. Therefore, the IPSET_BIN could be passed to change the binary location. IPSET_BIN=/sbin/ipset ./runtest.sh The test scripts run fine in build source tree without IPSET_BIN. Signed-off-by: Neutron Soutmun <neo.neutron@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: Fix grammar error in manpageNeutron Soutmun2014-04-071-1/+1
| | | | | | | | | | Refer to: https://bugs.launchpad.net/ubuntu/+source/lintian/+bug/608231 The "allows to" is a common grammar error which it will probably be replaced by "allows one to" as a suggestion in above bug report page. Signed-off-by: Neutron Soutmun <neo.neutron@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: Fix printf format warningNeutron Soutmun2014-04-071-1/+2
| | | | | | | | | Using PRIx32 macro is portable across multiple architectures and also fix the printf format warning on any architectures that "%llx" is not refer to 32 bits size. Signed-off-by: Neutron Soutmun <neo.neutron@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset 6.21.1 releasedv6.21.1Jozsef Kadlecsik2014-03-073-1/+9
|
* netfilter: ip_set: rename nfnl_dereference()/nfnl_set()Patrick McHardy2014-03-071-23/+23
| | | | | | | | | | The next patch will introduce a nfnl_dereference() macro that actually checks that the appropriate mutex is held and therefore needs a subsystem argument. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* The bash utilities are updatedJozsef Kadlecsik2014-03-076-523/+1181
|