path: root/kernel/include/uapi
Commit message (Collapse)AuthorAgeFilesLines
* Expose the initval hash parameter to userspaceJozsef Kadlecsik2020-09-211-1/+1
| | | | | | It makes possible to reproduce exactly the same set after a save/restore. Signed-off-by: Jozsef Kadlecsik <>
* Add bucketsize parameter to all hash typesJozsef Kadlecsik2020-09-211-1/+3
| | | | | | | | | The parameter defines the upper limit in any hash bucket at adding new entries from userspace - if the limit would be exceeded, ipset doubles the hash size and rehashes. It means the set may consume more memory but gives faster evaluation at matching in the set. Signed-off-by: Jozsef Kadlecsik <>
* Revert "Introduce --update-counters-first flag for the set target"Jozsef Kadlecsik2020-09-201-3/+0
| | | | This reverts commit c2dfb6432aea5bb0a3522901b0c44f42d8adbd49.
* Introduce --update-counters-first flag for the set targetJozsef Kadlecsik2020-03-091-0/+3
| | | | | | | | | | | | | | | Stefano Brivio reported that the patch 'netfilter: ipset: Fix "don't update counters" mode when counters used at the matching' changed the semantic of when the counters are updated. Before the patch the counters were updated regardless of the results of the counter matches, after the patch the counters were updated only if the counter match conditions (if specified) matched the packet. In order to handle both ways, the --update-counters-first flag is introduced: when the flag is specified, the counters are updated before checking the counter match conditions. Without the flag the current evaluation path (i.e. update only if counter conditions match) works. Signed-off-by: Jozsef Kadlecsik <>
* treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500Thomas Gleixner2019-10-311-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Based on 2 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license version 2 as published by the free software foundation this program is free software you can redistribute it and or modify it under the terms of the gnu general public license version 2 as published by the free software foundation # extracted by the scancode license scanner the SPDX license identifier GPL-2.0-only has been chosen to replace the boilerplate/reference in 4122 file(s). Signed-off-by: Thomas Gleixner <> Reviewed-by: Enrico Weigelt <> Reviewed-by: Kate Stewart <> Reviewed-by: Allison Randal <> Cc: Link: Signed-off-by: Greg Kroah-Hartman <>
* ipset: Add wildcard support to net,ifaceKristian Evensen2019-10-311-0/+2
| | | | | | | | | | | | | | | | | | | | | The net,iface equal functions currently compares the full interface names. In several cases, wildcard (or prefix) matching is useful. For example, when converting a large iptables rule-set to make use of ipset, I was able to significantly reduce the number of set elements by making use of wildcard matching. Wildcard matching is enabled by adding "wildcard" when adding an element to a set. Internally, this causes the IPSET_FLAG_IFACE_WILDCARD-flag to be set. When this flag is set, only the initial part of the interface name is used for comparison. Wildcard matching is done per element and not per set, as there are many cases where mixing wildcard and non-wildcard elements are useful. This means that is up to the user to handle (avoid) overlapping interface names. Signed-off-by: Kristian Evensen <> Signed-off-by: Jozsef Kadlecsik <>
* ipset: update my email addressJozsef Kadlecsik2019-06-051-1/+1
| | | | | | | | | It's better to use my email address in the source code. I might not be able to use in the future. Signed-off-by: Jozsef Kadlecsik <> Signed-off-by: Jozsef Kadlecsik <>
* Introduction of new commands and protocol version 7Jozsef Kadlecsik2018-10-271-7/+12
| | | | | | | | | | | Two new commands (IPSET_CMD_GET_BYNAME, IPSET_CMD_GET_BYINDEX) are introduced. The new commands makes possible to eliminate the getsockopt operation (in iptables set/SET match/target) and thus use only netlink communication between userspace and kernel for ipset. With the new protocol version, userspace can exactly know which functionality is supported by the running kernel. Both the kernel and userspace is fully backward compatible.
* License cleanup: add SPDX license identifier to uapi header files with no ↵Greg Kroah-Hartman2018-10-224-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | license Many user space API headers are missing licensing information, which makes it hard for compliance tools to determine the correct license. By default are files without license information under the default license of the kernel, which is GPLV2. Marking them GPLV2 would exclude them from being included in non GPLV2 code, which is obviously not intended. The user space API headers fall under the syscall exception which is in the kernels COPYING file: NOTE! This copyright does *not* cover user programs that use kernel services by normal system calls - this is merely considered normal use of the kernel, and does *not* fall under the heading of "derived work". otherwise syscall usage would not be possible. Update the files which contain no license information with an SPDX license identifier. The chosen identifier is 'GPL-2.0 WITH Linux-syscall-note' which is the officially assigned identifier for the Linux syscall exception. SPDX license identifiers are a legally binding shorthand, which can be used instead of the full boiler plate text. This patch is based on work done by Thomas Gleixner and Kate Stewart and Philippe Ombredanne. See the previous patch in this series for the methodology of how this patch was researched. Reviewed-by: Kate Stewart <> Reviewed-by: Philippe Ombredanne <> Reviewed-by: Thomas Gleixner <> Signed-off-by: Greg Kroah-Hartman <> Signed-off-by: Jozsef Kadlecsik <>
* netfilter: fix include files for compilationMikko Rapeli2016-10-113-0/+6
| | | | | | | | | Add missing header dependencies and other small changes so that each file compiles alone in userspace. Signed-off-by: Mikko Rapeli <> Signed-off-by: Pablo Neira Ayuso <> Signed-off-by: Jozsef Kadlecsik <>
* ipset: Backports for the nla_put_net64() API changesNeutron Soutmun2016-06-281-0/+1
| | | | | | | | | | | | | | | | | | | * Backports the patch "libnl: nla_put_net64():align on a 64-bit area" [1] by Nicolas Dichtel <> * Since the nla_put_net64() API has been changed, therefore, the should provides the macro IPSET_NLA_PUT_NET64 that point to the nla_put_net64() with appropriate number of arguments. The build script should distinguish the API changes by detect for the existence of nla_put_64bit() function in include/net/netlink.h. This function was added in the same patches set and called by the nla_put_be64() that called by nla_put_net64() respectively. [1] Signed-off-by: Neutron Soutmun <> Signed-off-by: Jozsef Kadlecsik <>
* Fix __aligned_u64 compatibility support for older kernel releasesJozsef Kadlecsik2016-02-291-1/+1
| | | | The issue was reported by Mart Frauenlob.
* More compatibility checking and simplificationsJozsef Kadlecsik2015-01-061-1/+0
| | | | | Try hard to keep the support of the 2.6.32 kernel tree and simplify the code with self-referential macros.
* Fix coding styles reported by checkpatch.plJozsef Kadlecsik2015-01-061-1/+1
* Alignment problem between 64bit kernel 32bit userspaceJozsef Kadlecsik2014-11-032-3/+18
| | | | | | | | | | | | | | | | Sven-Haegar Koch reported the issue: sims:~# iptables -A OUTPUT -m set --match-set testset src -j ACCEPT iptables: Invalid argument. Run `dmesg' for more information. In syslog: x_tables: ip_tables: set.3 match: invalid size 48 (kernel) != (user) 32 which was introduced by the counter extension in ipset. The patch fixes the alignment issue with introducing a new set match revision with the fixed underlying 'struct ip_set_counter_match' structure.
* netfilter: ipset: Add skbinfo extension support to SET target.Anton Danilov2014-09-141-0/+10
| | | | | Signed-off-by: Anton Danilov <> Signed-off-by: Jozsef Kadlecsik <>
* netfilter: ipset: Add skbinfo extension kernel support in the ipset core.Anton Danilov2014-09-081-0/+12
| | | | | | | | | | | Skbinfo extension provides mapping of metainformation with lookup in the ipset tables. This patch defines the flags, the constants, the functions and the structures for the data type independent support of the extension. Note the firewall mark stores in the kernel structures as two 32bit values, but transfered through netlink as one 64bit value. Signed-off-by: Anton Danilov <> Signed-off-by: Jozsef Kadlecsik <>
* ipset: add forceadd kernel support for hash set typesJosh Hunt2014-03-041-2/+5
| | | | | | | | | | | | | | | | | | Adds a new property for hash set types, where if a set is created with the 'forceadd' option and the set becomes full the next addition to the set may succeed and evict a random entry from the set. To keep overhead low eviction is done very simply. It checks to see which bucket the new entry would be added. If the bucket's pos value is non-zero (meaning there's at least one entry in the bucket) it replaces the first entry in the bucket. If pos is zero, then it continues down the normal add process. This property is useful if you have a set for 'ban' lists where it may not matter if you release some entries from the set early. Signed-off-by: Josh Hunt <> Signed-off-by: Jozsef Kadlecsik <>
* kernel: uapi: fix MARKMASK attr ABI breakageFlorian Westphal2014-02-141-2/+2
| | | | | | | | | | | | | | commit 2dfb973c0dcc6d2211 (add markmask for hash:ip,mark data type) inserted IPSET_ATTR_MARKMASK in-between other enum values, i.e. changing values of all further attributes. This causes 'ipset list' segfault on existing kernels since ipset no longer finds IPSET_ATTR_MEMSIZE (it has a different value on kernel side). Jozsef points out it should be moved below IPSET_ATTR_MARK which works since there is some extra reserved space after that value. Signed-off-by: Florian Westphal <> Signed-off-by: Jozsef Kadlecsik <>
* Prepare the kernel for create option flags when no extension is neededJozsef Kadlecsik2014-02-131-0/+6
* add markmask for hash:ip,mark data typeVytas Dauksa2014-01-231-0/+2
| | | | | | | | | Introduce packet mark mask for hash:ip,mark data type. This allows to set mark bit filter for the ip set. Change-Id: Id8dd9ca7e64477c4f7b022a1d9c1a5b187f1c96e Signed-off-by: Jozsef Kadlecsik <>
* add hash:ip,mark data type to ipsetVytas Dauksa2014-01-081-0/+1
| | | | | | | | | | | | | | | | Introduce packet mark support with new ip,mark hash set. This includes userspace and kernelspace code, hash:ip,mark set tests and man page updates. The intended use of ip,mark set is similar to the ip:port type, but for protocols which don't use a predictable port number. Instead of port number it matches a firewall mark determined by a layer 7 filtering program like opendpi. As well as allowing or blocking traffic it will also be used for accounting packets and bytes sent for each protocol. Signed-off-by: Jozsef Kadlecsik <>
* ipset: Support comments in the userspace library.Oliver Smith2013-09-231-0/+3
| | | | | | | | | This adds support to the userspace portion of ipset for handling ipsets with the comment extension enabled. The library revision has been raised accordingly. Signed-off-by: Oliver Smith <> Signed-off-by: Jozsef Kadlecsik <>
* netfilter: ipset: Support comments for ipset entries in the core.Oliver Smith2013-09-231-0/+4
| | | | | | | | | | | | | This adds the core support for having comments on ipset entries. The comments are stored as standard null-terminated strings in dynamically allocated memory after being passed to the kernel. As a result of this, code has been added to the generic destroy function to iterate all extensions and call that extension's destroy task if the set has that extension activated, and if such a task is defined. Signed-off-by: Oliver Smith <> Signed-off-by: Jozsef Kadlecsik <>
* Introduce new operation to get both setname and familyJozsef Kadlecsik2013-09-041-0/+8
| | | | | | | | ip[6]tables set match and SET target need to know the family of the set in order to reject adding rules which refer to a set with a non-mathcing family. Currently such rules are silently accepted and then ignored instead of generating a clear error message to the user, which is not helpful.
* set match: add support to match the countersJozsef Kadlecsik2013-04-092-4/+36
| | | | | | | | | | The new revision of the set match supports to match the counters and to suppress updating the counters at matching too. At the set:list types, the updating of the subcounters can be suppressed as well. Signed-off-by: Jozsef Kadlecsik <>
* Introduce the counter extension in the coreJozsef Kadlecsik2013-04-091-0/+5
| | | | Signed-off-by: Jozsef Kadlecsik <>
* The uapi include split in the package itselfJozsef Kadlecsik2013-04-095-0/+351
Signed-off-by: Jozsef Kadlecsik <>