summaryrefslogtreecommitdiffstats
path: root/src/ipset.c
Commit message (Collapse)AuthorAgeFilesLines
* ipset-translate: allow invoking with a path nameQuentin Armitage2022-08-161-1/+2
| | | | | | | | | | | | | | | | Executing /usr/sbin/ipset-translate results in the ipset functionality being run, rather than the ipset-translate functionality. # ipset-translate destroy fred This command is not supported, use `ipset-translate restore < file' # /usr/sbin/ipset-translate destroy fred ipset v7.15: The set with the given name does not exist use basename() to resolve the issue. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1626 Signed-off-by: Quentin Armitage <quentin@armitage.org.uk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add ipset to nftables translation infrastructurePablo Neira Ayuso2021-06-261-1/+7
| | | | | | | | | | | | | | | | | | | | | This patch provides the ipset-translate utility which allows you to translate your existing ipset file to nftables. The ipset-translate utility is actually a symlink to ipset, which checks for 'argv[0] == ipset-translate' to exercise the translation path. You can translate your ipset file through: ipset-translate restore < sets.ipt This patch reuses the existing parser and API to represent the sets and the elements. There is a new ipset_xlate_set dummy object that allows to store a created set to fetch the type without interactions with the kernel. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* ipset: update my email addressJozsef Kadlecsik2019-06-051-1/+1
| | | | | | | | | It's better to use my kadlec@netfilter.org email address in the source code. I might not be able to use kadlec@blackhole.kfki.hu in the future. Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Library reworked to support embedding ipset completelyJozsef Kadlecsik2018-10-181-878/+11
| | | | | | | | | | | The ipset library is rewritten/extended to support embedding ipset, so that sets can fully be managed without calling the ipset binary. The ipset binary relies completely on the new library. The libipset.3 manpage was written about the library functions and usage. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Fix leak in build_argv() on line parsing errorStefano Brivio2018-08-241-2/+3
| | | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Userspace revision handling is reworkedJozsef Kadlecsik2018-01-021-20/+54
| | | | | | | | | | | In order to make it simpler and more straightforward to express the revisions of the set type, all keywords and their parsing are separated from the individual set types. All backward compatibility arguments are recognized and ignored arguments are supported. Recognized but ignored arguments will be removed in a later release.
* Replace the last reference to u_int8_t with uint8_t.Jozsef Kadlecsik2017-09-261-1/+1
|
* Revert "ipset: fix build with musl"Jozsef Kadlecsik2017-09-261-2/+0
| | | | | | This reverts commit 992723e3712a09037338aa9e5506a080e24d1642. The single u_int8_t usage was a leftover.
* ipset: fix build with muslStijn Tintel2017-09-251-0/+2
| | | | | | | | | Include sys/types.h for u_int8_t and define _GNU_SOURCE for musl to expose it. Fixes: 54802b2c2826 ("Report if the option is supported by a newer kernel release") Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Report if the option is supported by a newer kernel releaseJozsef Kadlecsik2017-09-111-6/+27
| | | | | Instead ot printing "Unknown argument: foo", if foo option is supported by a newer kernel release, report that.
* ipset: Rework the "fake" argument parsing for ipset restore.Oliver Smith2013-09-231-9/+43
| | | | | | | | | | | | This reworks the argument parsing functionality of ipset to handle quote-delimited lines in such a way that they are considered to be a single argument. This commit is necessary for ipset to successfully restore sets that have comments. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Parse option "family" first, because other options may depend on itJozsef Kadlecsik2013-08-141-24/+47
| | | | | | | Option like "netmask" depends on the INET family, so parse "family" first, then the rest of the options. Bug reported by Quentin Armitage, closed netfilter bugzilla #841.
* Interactive mode error after syntax error (reported by Mart Frauenlob)Jozsef Kadlecsik2013-02-211-3/+8
| | | | | | | | | | | | ipset> list foo ipset v6.16.1: The set with the given name does not exist ipset> -t No command specified ipset> list ipset v6.16.1: Internal protocol error In interactive mode the state was not cleaned up properly after a syntax error, fixed.
* Coding style fixesJozsef Kadlecsik2012-09-111-3/+3
|
* Help prints list type revision and terse descriptionJozsef Kadlecsik2012-09-101-5/+5
| | | | | In order to catch kernel/userspace revision mismatch, better print all available data.
* Fix errors when compiling in debug mode.Krunal Patel2012-08-311-4/+5
|
* ipset help lists set types multiple times, fixed (reported by Mr Dash Four)Jozsef Kadlecsik2012-06-191-1/+5
| | | | | | ipset help listed every set type, including the ones with multiple revisions - which were listed thus multiple times. Set types with multiple revisions are listed once from now on.
* Allow saving to/restoring from a file without shell redirectionJozsef Kadlecsik2012-05-231-3/+58
| | | | | | | | | Mathieu Bridon suggested that in some environments where there is no access to a full shell with input/output redirection, it'd be useful to read from/write to directly a file (bugzilla #788). The patch adds the new "-file" option to specify a filename to print into when listing/saving sets or read from when restoring sets.
* Set types moved into libipset libraryJozsef Kadlecsik2012-01-051-31/+2
| | | | | The libipset library is complete by this step, and "ipset" just a CLI interface based on the lib.
* ipset: use NFPROTO_ constantsJan Engelhardt2011-08-311-5/+5
| | | | | ipset is actually using NFPROTO values rather than AF (xt_set passes that along).
* Whitespace and coding fixes detected by checkpatch.plJozsef Kadlecsik2011-05-311-49/+53
|
* hash:net,iface type introducedJozsef Kadlecsik2011-05-301-0/+2
| | | | | | | | | | The hash:net,iface type makes possible to store network address and interface name pairs in a set. It's mostly suitable for egress and ingress filtering. Examples: # ipset create test hash:net,iface # ipset add test 192.168.0.0/16,eth0 # ipset add test 192.168.0.0/24,eth1
* Fix warnings reported by valgrindJozsef Kadlecsik2011-05-251-1/+7
|
* Accept "\r\n" terminated COMMIT command in restore filesJozsef Kadlecsik2011-05-241-1/+1
|
* Accept "\r\n" terminated lines in restore filesJozsef Kadlecsik2011-05-211-2/+2
|
* Support range for IPv4 at adding/deleting elements for hash:*net* typesJozsef Kadlecsik2011-05-151-8/+14
| | | | | | | | | | | | | | | | | | | The range internally is converted to the network(s) equal to the range. Example: # ipset new test hash:net # ipset add test 10.2.0.0-10.2.1.12 # ipset list test Name: test Type: hash:net Header: family inet hashsize 1024 maxelem 65536 Size in memory: 16888 References: 0 Members: 10.2.1.12 10.2.1.0/29 10.2.0.0/24 10.2.1.8/30
* Print protocol version together with ipset versionJozsef Kadlecsik2011-02-031-1/+2
|
* ipset: improve command argument parsingHolger Eitzenberger2011-02-011-22/+20
| | | | | | | | | | | | | | | | | | | | | | The number of comparisons for a matching a command name can be made smaller by just checking on argv[1]. As an example consider the following 'create' arguments 'hashsize', 'family' and 'timeout'. When having the command create foo hash:ip timeout 60 family inet hashsize 64 it compares without this patch: strcmp("timeout", "hashsize") strcmp("64", "hashsize") strcmp("family", "hashsize") strcmp("inet", "hashsize") strcmp("hashsize", "hashsize") It is worse in practice, as 'create' has more arguments than this. Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org>
* ipset: avoid the unnecessary argv[] loopHolger Eitzenberger2011-02-011-50/+46
| | | | | | | | After stripping off the global options there simply has to follow a command name, there is no other syntax possible. Therefore the argv[] loop is unnecessary. Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org>
* ipset: pass ipset_arg argument pointerHolger Eitzenberger2011-02-011-8/+2
| | | | Signed-off-by: Holger Eitzenberger <holger@eitzenberger.org>
* Do session initialization onceHolger Eitzenberger2011-01-181-8/+6
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* Show correct line numbers in restore output for parser errorsJozsef Kadlecsik2011-01-181-0/+3
| | | | | | | | | | | | | | | | | Parser errors are reported by a wrong lineno at restore, bug reported by Holger Eitzenberger: create foo6 hash:ip hashsize 64 family inet6 add foo6 20a1:1234:5678::/64 add foo6 20a1:1234:5679::/64 you get: ipset v5.2: Error in line 1: Syntax error: plain IP address must be supplied: 20a1:1234:5678::/64 Should be line 2 though. The solution is to set the session lineno before parsing.
* Should have gone to sleep: fix check_allowed. Really.Jozsef Kadlecsik2010-12-191-11/+11
| | | | | | | It's not as nice as I'd like to be: IPSET_CREATE_FLAGS and IPSET_ADT_FLAGS are required elsewhere, but to make life simpler, some flags (like IPSET_OPT_TYPENAME) are *not* added to the types full[] flags. So those must be excluded here.
* The fix of incorrect comparison in check_allowed completed.Jozsef Kadlecsik2010-12-181-22/+25
| | | | | There was still some other incorrect usage of 'enum ipset_cmd' and 'enum ipset_adt' - corrected.
* Fix incorrect comparison in check_allowedJozsef Kadlecsik2010-12-181-1/+1
| | | | Wrong enum type was used in the comparison, reported by Jan Engelhardt.
* Missing spaces in error strings fixed.Jozsef Kadlecsik2010-12-171-4/+4
|
* Use the 'full' flags of the types and check not allowed flags.Jozsef Kadlecsik2010-12-171-12/+107
|
* Fixing dangling empty line produced backward-incompatible exit codes, fixed.Jozsef Kadlecsik2010-12-131-2/+2
|
* Fix dangling empty line at error/warning messages emitted by ipset.Jozsef Kadlecsik2010-12-101-3/+4
|
* Fixes, cleanups, commentsv5.0-pre8Jozsef Kadlecsik2010-10-241-15/+32
| | | | | | | | | | | | | | | | | | | - More comments added to the code - ICMP and ICMPv6 support added to the hash:ip,port, hash:ip,port,ip and hash:ip,port,net types - hash:net and hash:ip,port,net types are reworked - hash:net,port type added - Wrong direction parameters fixed in hash:ip,port - Helps and manpage are updated - More tests added - Ugly macros are rewritten to functions in parse.c (Holger Eitzenberger) - resize related bug in hash types fixed (Holger Eitzenberger) - autoreconf patches by Jan Engelhardt applied - netlink patch minimalized: dumping can be initialized by a second parsing of the message (thanks to David and Patrick for the suggestion) - IPv4/IPv6 address attributes are introduced in order to fix the context (suggested by David)
* ipset 5: last new feature addedv5.0-pre3Jozsef Kadlecsik2010-06-221-11/+20
| | | | | | | | | | | - the hash types can now store protocol together port, not only port - lots of fixes everywhere: parser, error reporting, manpage The last bits on the todo list before announcing ipset 5: - recheck all the error messages - add possibly more tests - polish manpage
* ipset 5 in an almost ready state - milestonev5.0-pre1Jozsef Kadlecsik2010-06-151-79/+115
| | | | | | | | | | | | Reworked protocol and internal interfaces, missing set types added, backward compatibility verified, lots of tests added (and thanks to the tests, bugs fixed), even the manpage is rewritten ;-). Countless changes everywhere... The missing bits before announcing ipset 5: - net namespace support - new iptables/ip6tables extension library - iptables/ip6tables match and target tests (backward/forward compatibility) - tests on catching syntax errors
* Third stage to ipset-5Jozsef Kadlecsik2010-04-221-1933/+465
| | | | Refresh existing files in src/ with the new content.
* First staget to ipset-5Jozsef Kadlecsik2010-04-221-0/+2054
Create src/ and move ipset source there. Get rid of unnecessary and outdated files.