summaryrefslogtreecommitdiffstats
path: root/src/ipset.8
Commit message (Collapse)AuthorAgeFilesLines
* Add bucketsize parameter to all hash typesJozsef Kadlecsik2020-09-211-14/+24
| | | | | | | | | The parameter defines the upper limit in any hash bucket at adding new entries from userspace - if the limit would be exceeded, ipset doubles the hash size and rehashes. It means the set may consume more memory but gives faster evaluation at matching in the set. Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* Document explicitly that protocol is not stored in bitmap:portJozsef Kadlecsik2019-11-141-2/+3
|
* ipset: Add wildcard support to net,ifaceKristian Evensen2019-10-311-1/+7
| | | | | | | | | | | | | | | | | | | | | The net,iface equal functions currently compares the full interface names. In several cases, wildcard (or prefix) matching is useful. For example, when converting a large iptables rule-set to make use of ipset, I was able to significantly reduce the number of set elements by making use of wildcard matching. Wildcard matching is enabled by adding "wildcard" when adding an element to a set. Internally, this causes the IPSET_FLAG_IFACE_WILDCARD-flag to be set. When this flag is set, only the initial part of the interface name is used for comparison. Wildcard matching is done per element and not per set, as there are many cases where mixing wildcard and non-wildcard elements are useful. This means that is up to the user to handle (avoid) overlapping interface names. Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* ipset: update my email addressJozsef Kadlecsik2019-06-051-1/+1
| | | | | | | | | It's better to use my kadlec@netfilter.org email address in the source code. I might not be able to use kadlec@blackhole.kfki.hu in the future. Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Correct the manpage about the sort option, supported since 3713072dJozsef Kadlecsik2018-11-301-1/+1
|
* Implement sorting for hash types in the ipset toolJozsef Kadlecsik2018-11-261-2/+2
| | | | | Support listing/saving with sorted entries for the hash types. (bitmap and list types are automatically sorted.)
* manpage: Add comment about matching on destination MAC addressStefano Brivio2018-08-301-7/+19
| | | | | | | | | | Patch "ipset: Allow matching on destination MAC address for mac and ipmac sets" allows the user to match on destination MAC addresses in some selected cases. Add a comment to the manpage detailing in which cases it makes sense. Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Limit max timeout value to (UINT_MAX >> 1)/MSEC_PER_SECJozsef Kadlecsik2018-06-011-1/+2
| | | | | | | | Due to the negative value condition in msecs_to_jiffies(), the real max possible timeout value must be set to (UINT_MAX >> 1)/MSEC_PER_SEC. Neutron Soutmun proposed the proper fix, but an insufficient one was applied, see https://patchwork.ozlabs.org/patch/400405/.
* Update manpage about the size parameter of list:set types.Jozsef Kadlecsik2017-02-191-1/+2
| | | | The parameter is ignored since ipset version 6.24.
* hash:ipmac type support added to ipset, userspace partTomasz Chilinski2016-05-051-0/+22
| | | | | Signed-off-by: Tomasz Chili??ski <tomasz.chilinski@chilan.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Manpage typo correctionsDavid Wittman2015-07-201-3/+3
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Fix grammar error in manpageNeutron Soutmun2015-07-201-1/+1
| | | | | | | | | | Refer to: https://bugs.launchpad.net/ubuntu/+source/lintian/+bug/608231 The "allows to" is a common grammar error which it will probably be replaced by "allows one to" as a suggestion in above bug report page. Signed-off-by: Neutron Soutmun <neo.neutron@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset manpage: refer to iptables-extensionsJozsef Kadlecsik2015-06-251-1/+2
|
* Add element count to all set types headerJozsef Kadlecsik2015-06-251-0/+5
| | | | | | It is better to list the set elements for all set types, thus the header information is uniform. Element counts are therefore added to the bitmap and list types.
* ipset: propose rewording in manpageNeutron Soutmun2015-03-131-3/+2
| | | | | | | | | | | | | | | | | | | | | | I have prepared the patch which refers to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780336, reported and proposed by H. Renault <hr@herverenault.fr>. man ipset reads: del SETNAME DEL-ENTRY [ DEL-OPTIONS ] Delete an entry from a set. If the -exist option is specified, ipset ignores if the entry does not added to (already expired from) the set. Proposed rewording: Delete an entry from a set. If the -exist option is specified and the entry is not in the set (maybe already expired), then the command is ignored. Signed-off-by: Neutron Soutmun <neo.neutron@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: Fix hyphen used as minus sign in manpageNeutron Soutmun2014-09-301-1/+1
| | | | | Signed-off-by: Neutron Soutmun <neo.neutron@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Order create and add options in manpage so that generic ones come firstJozsef Kadlecsik2014-09-231-51/+51
|
* Centralise generic create options (family, hashsize, maxelem) on top of man ↵Mart Frauenlob2014-09-231-175/+35
| | | | | | | page in the generic options section. Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Add description of hash:mac set type to man page.Mart Frauenlob2014-09-221-0/+32
| | | | | Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Add missing space for skbinfo option synopsis.Mart Frauenlob2014-09-221-1/+1
| | | | | Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: man: Add the skbinfo extension documentation.Anton Danilov2014-09-141-28/+42
| | | | | Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: Fix grammar error in manpageNeutron Soutmun2014-04-071-1/+1
| | | | | | | | | | Refer to: https://bugs.launchpad.net/ubuntu/+source/lintian/+bug/608231 The "allows to" is a common grammar error which it will probably be replaced by "allows one to" as a suggestion in above bug report page. Signed-off-by: Neutron Soutmun <neo.neutron@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: add userspace support for forceaddJosh Hunt2014-03-041-0/+7
| | | | | | | The userspace side of the forceadd changes. Signed-off-by: Josh Hunt <johunt@akamai.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* add markmask for hash:ip,mark data typeVytas Dauksa2014-01-231-1/+5
| | | | | | | | | Introduce packet mark mask for hash:ip,mark data type. This allows to set mark bit filter for the ip set. Change-Id: Id8dd9ca7e64477c4f7b022a1d9c1a5b187f1c96e Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* add hash:ip,mark data type to ipsetVytas Dauksa2014-01-081-0/+49
| | | | | | | | | | | | | | | | Introduce packet mark support with new ip,mark hash set. This includes userspace and kernelspace code, hash:ip,mark set tests and man page updates. The intended use of ip,mark set is similar to the ip:port type, but for protocols which don't use a predictable port number. Instead of port number it matches a firewall mark determined by a layer 7 filtering program like opendpi. As well as allowing or blocking traffic it will also be used for accounting packets and bytes sent for each protocol. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: manpage: correct add action synopsis for hash:net,port,net.Mart Frauenlob2013-11-261-1/+1
| | | | | Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: manpage: remove spare comma for hash:net,net test action.Mart Frauenlob2013-11-261-1/+1
| | | | | Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: Add userspace code to support hash:net,port,net kernel module.Oliver Smith2013-09-301-140/+202
| | | | | | | | | This adds the userspace library, tests to validate correct operation of the module and also provides appropriate usage information in the man page. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: Add new userspace set revisions for comment supportOliver Smith2013-09-231-24/+47
| | | | | | | | | | | This introduces new revisions of all hash and bitmap ipsets to complement the comment functionality introduced into the kernel modules. Currently all sets have a compile-time limit of 255 characters including \0. This can otherwise be arbitrarily modified. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* ipset: Add userspace code to support hash:net,net kernel module.Oliver Smith2013-09-201-0/+74
| | | | | | | | | This adds the userspace library, tests to validate correct operation of the module and also provides appropriate usage information in the man page. The library version has been bumped accordingly. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Add specifying protocol for bitmap:portQuentin Armitage2013-08-171-4/+9
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Manpage fix: not just identical, but compatible type of sets can be swappedJozsef Kadlecsik2013-08-141-5/+5
| | | | Reported by Quentin Armitage, netfilter bugzilla id #843.
* ipset: Fix hyphen used as minus sign in manpageNeutron Soutmun2013-05-131-1/+1
| | | | | Signed-off-by: Neutron Soutmun <neo.neutron@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Manpage typing error correction (reported by Husnu Demir)Jozsef Kadlecsik2013-05-021-2/+2
|
* Manpage updatesJozsef Kadlecsik2013-04-091-52/+79
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Add /0 network support to hash:net,iface typeJozsef Kadlecsik2012-09-101-2/+1
| | | | | Now it is possible to setup a single hash:net,iface type of set and a single ip6?tables match which covers all egress/ingress filtering.
* Explain in more detail src/dst for hash:net,ifaceJozsef Kadlecsik2012-06-291-2/+3
|
* Allow saving to/restoring from a file without shell redirectionJozsef Kadlecsik2012-05-231-6/+21
| | | | | | | | | Mathieu Bridon suggested that in some environments where there is no access to a full shell with input/output redirection, it'd be useful to read from/write to directly a file (bugzilla #788). The patch adds the new "-file" option to specify a filename to print into when listing/saving sets or read from when restoring sets.
* Support hostnames and service names with dashJozsef Kadlecsik2012-01-141-0/+6
| | | | | | | | The square brackets are introduced as an escape mechanism to enter hostnames or service names with dash in order to avoid mixing up the dash in the name with the range notation. Problem reported by Stephen Hemminger and Marc Guardiola.
* Exceptions support added to hash:*net* typesJozsef Kadlecsik2012-01-131-6/+23
| | | | | | | | | | | | The "nomatch" keyword and option is added to the hash:*net* types, by which one can add exception entries to sets. Example: ipset create test hash:net ipset add test 192.168.0/24 ipset add test 192.168.0/30 nomatch In this case the IP addresses from 192.168.0/24 except 192.168.0/30 match the elements of the set.
* Update the manpage and document the limits in hash:net,iface.Jozsef Kadlecsik2011-07-111-1/+5
|
* hash:net,iface type introducedJozsef Kadlecsik2011-05-301-2/+69
| | | | | | | | | | The hash:net,iface type makes possible to store network address and interface name pairs in a set. It's mostly suitable for egress and ingress filtering. Examples: # ipset create test hash:net,iface # ipset add test 192.168.0.0/16,eth0 # ipset add test 192.168.0.0/24,eth1
* Support range for IPv4 at adding/deleting elements for hash:*net* typesJozsef Kadlecsik2011-05-151-13/+29
| | | | | | | | | | | | | | | | | | | The range internally is converted to the network(s) equal to the range. Example: # ipset new test hash:net # ipset add test 10.2.0.0-10.2.1.12 # ipset list test Name: test Type: hash:net Header: family inet hashsize 1024 maxelem 65536 Size in memory: 16888 References: 0 Members: 10.2.1.12 10.2.1.0/29 10.2.0.0/24 10.2.1.8/30
* Support listing setnames and headers tooJozsef Kadlecsik2011-04-181-4/+16
| | | | | | Current listing makes possible to list sets with full content only. The patch adds support partial listings, i.e. listing just the existing setnames or listing set headers, without set members.
* bitmap:ip,mac type requires "src" for MACJozsef Kadlecsik2011-04-081-3/+4
| | | | | | | | | Enforce that the second "src/dst" parameter of the set match and SET target must be "src", because we have access to the source MAC only in the packet. The previous behaviour, that the type required the second parameter but actually ignored the value was counter-intuitive and confusing. Manpage is updated to reflect the change.
* Manpage updateJozsef Kadlecsik2011-03-271-0/+2
|
* SCTP, UDPLITE support addedJozsef Kadlecsik2011-03-181-10/+17
| | | | SCTP and UDPLITE port support added to the hash:*port* types.
* Updated manpage to reflect wider input possibilities in the ipset tool.Jozsef Kadlecsik2010-12-171-41/+45
|
* Manpage cleanups, so it's more clear and straightforward.Jozsef Kadlecsik2010-12-151-20/+20
|
* Document which elements cannot be stored in the different hash types.Jozsef Kadlecsik2010-12-141-4/+13
| | | | And enforce from kernel side as well...