From 6dd8bdacfe82ed178c5d6538685f02eb996a3c76 Mon Sep 17 00:00:00 2001 From: Kristian Evensen Date: Thu, 26 Sep 2019 12:06:45 +0200 Subject: ipset: Add wildcard support to net,iface The net,iface equal functions currently compares the full interface names. In several cases, wildcard (or prefix) matching is useful. For example, when converting a large iptables rule-set to make use of ipset, I was able to significantly reduce the number of set elements by making use of wildcard matching. Wildcard matching is enabled by adding "wildcard" when adding an element to a set. Internally, this causes the IPSET_FLAG_IFACE_WILDCARD-flag to be set. When this flag is set, only the initial part of the interface name is used for comparison. Wildcard matching is done per element and not per set, as there are many cases where mixing wildcard and non-wildcard elements are useful. This means that is up to the user to handle (avoid) overlapping interface names. Signed-off-by: Kristian Evensen Signed-off-by: Jozsef Kadlecsik --- include/libipset/args.h | 1 + include/libipset/data.h | 4 +++- include/libipset/linux_ip_set.h | 2 ++ 3 files changed, 6 insertions(+), 1 deletion(-) (limited to 'include/libipset') diff --git a/include/libipset/args.h b/include/libipset/args.h index ce14251..616cca5 100644 --- a/include/libipset/args.h +++ b/include/libipset/args.h @@ -44,6 +44,7 @@ enum ipset_keywords { IPSET_ARG_FORCEADD, /* forceadd */ IPSET_ARG_MARKMASK, /* markmask */ IPSET_ARG_NOMATCH, /* nomatch */ + IPSET_ARG_IFACE_WILDCARD, /* interface wildcard match */ /* Extensions */ IPSET_ARG_TIMEOUT, /* timeout */ IPSET_ARG_COUNTERS, /* counters */ diff --git a/include/libipset/data.h b/include/libipset/data.h index 9749847..851773a 100644 --- a/include/libipset/data.h +++ b/include/libipset/data.h @@ -66,6 +66,7 @@ enum ipset_opt { IPSET_OPT_SKBMARK, IPSET_OPT_SKBPRIO, IPSET_OPT_SKBQUEUE, + IPSET_OPT_IFACE_WILDCARD, /* Internal options */ IPSET_OPT_FLAGS = 48, /* IPSET_FLAG_EXIST| */ IPSET_OPT_CADT_FLAGS, /* IPSET_FLAG_BEFORE| */ @@ -128,7 +129,8 @@ enum ipset_opt { | IPSET_FLAG(IPSET_OPT_ADT_COMMENT)\ | IPSET_FLAG(IPSET_OPT_SKBMARK) \ | IPSET_FLAG(IPSET_OPT_SKBPRIO) \ - | IPSET_FLAG(IPSET_OPT_SKBQUEUE)) + | IPSET_FLAG(IPSET_OPT_SKBQUEUE) \ + | IPSET_FLAG(IPSET_OPT_IFACE_WILDCARD)) struct ipset_data; diff --git a/include/libipset/linux_ip_set.h b/include/libipset/linux_ip_set.h index 3cd151f..d2337f9 100644 --- a/include/libipset/linux_ip_set.h +++ b/include/libipset/linux_ip_set.h @@ -204,6 +204,8 @@ enum ipset_cadt_flags { IPSET_FLAG_WITH_FORCEADD = (1 << IPSET_FLAG_BIT_WITH_FORCEADD), IPSET_FLAG_BIT_WITH_SKBINFO = 6, IPSET_FLAG_WITH_SKBINFO = (1 << IPSET_FLAG_BIT_WITH_SKBINFO), + IPSET_FLAG_BIT_IFACE_WILDCARD = 7, + IPSET_FLAG_IFACE_WILDCARD = (1 << IPSET_FLAG_BIT_IFACE_WILDCARD), IPSET_FLAG_CADT_MAX = 15, }; -- cgit v1.2.3