summaryrefslogtreecommitdiffstats
path: root/kernel
Commit message (Collapse)AuthorAgeFilesLines
* netfilter: Remove unnecessary OOM logging messagesJoe Perches2011-08-311-3/+1
| | | | | | | | | | | Removing unnecessary messages saves code and text. Site specific OOM messages are duplications of a generic MM out of memory message and aren't really useful, so just delete them. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Dumping error triggered removing references twice and lead to kernel BUGJozsef Kadlecsik2011-08-311-0/+1
| | | | | | | | If there was a dumping error in the middle, the set-specific variable was not zeroed out and thus the 'done' function of the dumping wrongly tried to release the already released reference of the set. The already released reference was caught by __ip_set_put and triggered a kernel BUG message. The issue was reported by Jean-Philippe Menil.
* Autoload set type modules safelyJozsef Kadlecsik2011-08-291-10/+26
| | | | | | Jan Engelhardt noticed when userspace requests a set type unknown to the kernel, it can lead to a loop due to the unsafe type module loading. The issue is fixed in this patch.
* ipset 6.8 releasedv6.8Jozsef Kadlecsik2011-07-111-0/+7
|
* Fix compiler warnings "'hash_ip4_data_next' declared inline after being called"Chris Friesen2011-07-091-1/+1
| | | | | | | | Some gcc versions warn about prototypes without "inline" when the declaration includes the "inline" keyword. The fix generates a false error message "marked inline, but without a definition" with sparse below 0.4.2. Signed-off-by: Chris Friesen <chris.friesen@genband.com>
* hash:net,iface fixed to handle overlapping nets behind different interfacesJozsef Kadlecsik2011-07-088-51/+117
| | | | | | | | | | | | | | | | | | If overlapping networks with different interfaces was added to the set, the type did not handle it properly. Example ipset create test hash:net,iface ipset add test 192.168.0.0/16,eth0 ipset add test 192.168.0.0/24,eth1 Now, if a packet was sent from 192.168.0.0/24,eth0, the type returned a match. In the patch the algorithm is fixed in order to correctly handle overlapping networks. Limitation: the same network cannot be stored with more than 64 different interfaces in a single set.
* Make possible to hash some part of the data element only.Jozsef Kadlecsik2011-06-141-4/+10
|
* ipset 6.7 releasedv6.7Jozsef Kadlecsik2011-05-311-0/+8
|
* Whitespace and coding fixes detected by checkpatch.plJozsef Kadlecsik2011-05-3111-27/+28
|
* hash:net,iface type introducedJozsef Kadlecsik2011-05-304-0/+774
| | | | | | | | | | The hash:net,iface type makes possible to store network address and interface name pairs in a set. It's mostly suitable for egress and ingress filtering. Examples: # ipset create test hash:net,iface # ipset add test 192.168.0.0/16,eth0 # ipset add test 192.168.0.0/24,eth1
* Use the stored first cidr value instead of '1'Jozsef Kadlecsik2011-05-283-8/+16
|
* Fix return code for destroy when sets are in useJozsef Kadlecsik2011-05-281-1/+1
|
* Add xt_action_param to the variant level kadt functions, ipset API changeJozsef Kadlecsik2011-05-2714-16/+43
| | | | | | With the change the sets can use any parameter available for the match and target extensions, like input/output interface. It's required for the hash:net,iface set type.
* Drop supporting kernel versions below 2.6.35Jozsef Kadlecsik2011-05-241-83/+14
|
* ipset 6.6 releasedv6.6Jozsef Kadlecsik2011-05-241-0/+9
|
* Use unified from/to address masking and check the usageJozsef Kadlecsik2011-05-238-17/+15
|
* ip_set_flush returned -EPROTO instead of -IPSET_ERR_PROTOCOL, fixedJozsef Kadlecsik2011-05-231-1/+1
|
* Take into account cidr value for the from address when creating the setJozsef Kadlecsik2011-05-221-0/+1
| | | | | | When creating a set from a range expressed as a network like 10.1.1.172/29, the from address was taken as the IP address part and not masked with the netmask from the cidr.
* Adding ranges to hash types with timeout could still fail, fixedJozsef Kadlecsik2011-05-211-1/+1
| | | | | | The patch "Fix adding ranges to hash types" had got a mistypeing in the timeout variant of the hash types, which actually made the patch ineffective. Fixed!
* Removed old, not used hashing method ip_set_chashJozsef Kadlecsik2011-05-202-1253/+0
|
* Remove variable 'ret' in type_pf_tdel(), which is set but not usedJozsef Kadlecsik2011-05-201-2/+2
|
* Use proper timeout parameter to jiffies conversionJozsef Kadlecsik2011-05-201-8/+10
|
* ipset 6.5 releasedv6.5Jozsef Kadlecsik2011-05-151-0/+5
|
* Support range for IPv4 at adding/deleting elements for hash:*net* typesJozsef Kadlecsik2011-05-158-55/+165
| | | | | | | | | | | | | | | | | | | The range internally is converted to the network(s) equal to the range. Example: # ipset new test hash:net # ipset add test 10.2.0.0-10.2.1.12 # ipset list test Name: test Type: hash:net Header: family inet hashsize 1024 maxelem 65536 Size in memory: 16888 References: 0 Members: 10.2.1.12 10.2.1.0/29 10.2.0.0/24 10.2.1.8/30
* Set type support with multiple revisions addedJozsef Kadlecsik2011-05-1112-32/+49
| | | | | A set type may have multiple revisions, for example when syntax is extended. Support continuous revision ranges in set types.
* Fix adding ranges to hash typesJozsef Kadlecsik2011-05-0613-34/+157
| | | | | | When ranges are added to hash types, the elements may trigger rehashing the set. However, the last successfully added element was not kept track so the adding started again with the first element after the rehashing. Bug reported by Mr Dash Four.
* ipset 6.4 releasedv6.4Jozsef Kadlecsik2011-04-191-0/+5
|
* Support listing setnames and headers tooJozsef Kadlecsik2011-04-182-27/+50
| | | | | | Current listing makes possible to list sets with full content only. The patch adds support partial listings, i.e. listing just the existing setnames or listing set headers, without set members.
* Fix order of listing of setsJozsef Kadlecsik2011-04-181-8/+10
| | | | | | | | A restoreable saving of sets requires that list:set type of sets come last and the code part which should have taken into account the ordering was broken. The patch fixes the listing order. Testsuite entry added which checks the listing order.
* Options and flags support added to the kernel APIJozsef Kadlecsik2011-04-1816-138/+215
| | | | | | The support makes possible to specify the timeout value for the SET target and a flag to reset the timeout for already existing entries.
* ipset 6.3 releasedv6.3Jozsef Kadlecsik2011-04-101-0/+6
|
* set match and SET target fixesJozsef Kadlecsik2011-04-091-2/+16
| | | | | | | The SET target with --del-set did not work due to using wrongly the internal dimension of --add-set instead of --del-set. Also, the checkentries did not release the set references when returned an error. Bugs reported by Lennert Buytenhek.
* Whitespace fixes: some space before tab slipped in.Jozsef Kadlecsik2011-04-081-2/+2
|
* bitmap:ip,mac type requires "src" for MACJozsef Kadlecsik2011-04-081-0/+4
| | | | | | | | | Enforce that the second "src/dst" parameter of the set match and SET target must be "src", because we have access to the source MAC only in the packet. The previous behaviour, that the type required the second parameter but actually ignored the value was counter-intuitive and confusing. Manpage is updated to reflect the change.
* ipset/Kconfig was a mixed up kernel config file, fixed (Michael Tokarev)Jozsef Kadlecsik2011-03-291-1029/+73
|
* ipset 6.2 releasedv6.2Jozsef Kadlecsik2011-03-271-0/+6
|
* Timeout can be modified for already added elementsJozsef Kadlecsik2011-03-2712-101/+136
| | | | | | | | | | When an element to a set with timeout added, one can change the timeout by "readding" the element with the "-exist" flag. That means the timeout value is reset to the specified one (or to the default from the set specification if the "timeout n" option is not used). Example ipset add foo 1.2.3.4 timeout 10 ipset add foo 1.2.3.4 timeout 600 -exist
* References are protected by rwlock instead of mutexJozsef Kadlecsik2011-03-257-56/+73
| | | | | | | The timeout variant of the list:set type must reference the member sets. However, its garbage collector runs at timer interrupt so the mutex protection of the references is a no go. Therefore the reference protection is converted to rwlock.
* list:set timeout variant fixesJozsef Kadlecsik2011-03-231-29/+24
| | | | | | | - the timeout value was actually not set - the garbage collector was broken The variant is fixed, the tests to the testsuite are added.
* ipset 6.1 releasedv6.1Jozsef Kadlecsik2011-03-191-0/+6
|
* Fix revision reportingJozsef Kadlecsik2011-03-191-1/+1
| | | | Revision reporting got broken by the revision checking patch, fixed.
* SCTP, UDPLITE support addedJozsef Kadlecsik2011-03-186-5/+21
| | | | SCTP and UDPLITE port support added to the hash:*port* types.
* Fix checking the revision of the set type at create commandJozsef Kadlecsik2011-03-181-4/+16
| | | | | | The revision number was not checked at the create command: if the userspace sent a valid set type but with not supported revision number, it'd create a loop.
* hash:ip,port* types with IPv4Jozsef Kadlecsik2011-03-185-94/+48
| | | | | | The hash:ip,port* types with IPv4 silently ignored when address ranges with non TCP/UDP were added/deleted from the set and the first address from the range was only used.
* netfilter:ipset: fix the compile warning in ip_set_createShan Wei2011-03-041-1/+1
| | | | | | | net/netfilter/ipset/ip_set_core.c:615: warning: ?clash? may be used uninitialized in this function Signed-off-by: shanw <shanw@shanw-desktop.(none)> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset 6.0 releasedv6.0Jozsef Kadlecsik2011-02-031-0/+26
|
* Reorganized kernel/ subdirJozsef Kadlecsik2011-02-0321-125/+1124
| | | | | The kernel/ subdirectory is reorganized to follow the kernel directory structure.
* netfilter: ipset: fix linking with CONFIG_IPV6=nPatrick McHardy2011-02-032-6/+19
| | | | | | | | | Add some #ifdefs to unconditionally return false in ip_set_get_ip6_port() when CONFIG_IPV6=n and convert to ipv6_skip_exthdr() to avoid pulling in the ip6_tables module when loading ipset. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netfilter: ipset: send error message manuallyJozsef Kadlecsik2011-02-021-7/+26
| | | | | | | | | | | When a message carries multiple commands and one of them triggers an error, we have to report to the userspace which one was that. The line number of the command plays this role and there's an attribute reserved in the header part of the message to be filled out with the error line number. In order not to modify the original message received from the userspace, we construct a new, complete netlink error message and modifies the attribute there, then send it. Netlink is notified not to send its ACK/error message.
* netfilter: ipset: add missing break statemtns in ip_set_get_ip_port()Patrick McHardy2011-02-021-0/+2
| | | | | | | | Don't fall through in the switch statement, otherwise IPv4 headers are incorrectly parsed again as IPv6 and the return value will always be 'false'. Signed-off-by: Patrick McHardy <kaber@trash.net>