2 - Report if the option is supported by a newer kernel release
3 - ipset: Fix ipset command replacement in runtest.sh (Neutron Soutmun)
4 - Correct a test: number of entries may be outdated
7 - Fix possible truncated output in ipset output buffer handling
8 (Reported by Omri Bahumi and Yoni Lavi).
9 - Missing prototype added in ipset_hash_ipmac.c (debugging)
12 - Update manpage about the size parameter of list:set types.
13 - New test to verify that only the intended entries are deleted at hash
17 - Drop extra comma from error message (Neutron Soutmun)
18 - Fix the incorrect dynamic/static modules list (Neutron Soutmun)
19 - Correct tests to check the number of entries too
20 - hash:ipmac type support added to ipset, userspace part (Tomasz Chilinski)
23 - Suppress unnecessary stderr in command loop for resize and list
24 - Correction in comment test
25 - Support chroot buildroots (reported by Jan Engelhardt)
26 - Fix "configure" breakage due to pkg-config related changes
27 (reported by Jan Engelhardt)
30 - Support older pkg-config packages
31 - Add bash completion to the install routine (Mart Frauenlob)
32 - Fix misleading error message with comment extension
33 - Test added to check 0.0.0.0/0,iface to be matched in
35 - Fix link with libtool >= 2.4.4 (Olivier Blin)
38 - Handle uint64_t alignment issue in ipset tool
41 - Out of bound access in hash:net* types fixed (reported by Dave Jones):
42 new tests added to the testsuite to verify the fix
43 - Warn about loaded in ip_set modules at module installation
44 - Use IPSET_BIN in resize-and-list.sh and suppress echoing of loop
46 - Manpage typo corrections (David Wittman)
47 - Fix grammar error in manpage (Neutron Soutmun)
50 - ipset manpage: refer to iptables-extensions
51 - Update userspace header file from the kernel tree
52 - Handle 'extern "C" {' in check_libmap.sh
55 - Add element count to all set types header
56 - Add element count to hash headers (Eric B Munson)
57 - Support linking libipset to C++ programs (reported by Pavel Odintsov)
58 - ipset: propose rewording in manpage (Neutron Soutmun)
59 - More compatibility checking and simplifications to support the
61 - Compatibility: define RCU_INIT_POINTER when __rcu is not defined
62 - Compatibility: check kernel source for list_last_entry
63 (CentOS7, reported by Ricardo Klein)
64 - Make possible to pass extra flags to sparse
67 - The "extra" subdirectory for kernel modules may have a full subtree
68 (reported by Jesper Dangaard Brouer)
69 - Add more compatibility checkings to support older kernel releases
70 - Make_global.am: Don't include host headers (Baruch Siach)
71 - Alignment problem between 64bit kernel 32bit userspace fixed
72 (reported by Sven-Haegar Koch)
73 - Add script to check libipset.map for missing symbols
74 - Update libipset.map with ipset_parse_tcp_udp_port (Thomas Backlund)
75 - libipset: Bump lib version and update map file (Neutron Soutmun)
76 - Bash utilities updated
77 - ipset: Fix hyphen used as minus sign in manpage (Neutron Soutmun)
80 - The utils are updated from their sources
81 - Order create and add options in manpage so that generic ones
83 - Centralise generic create options (family, hashsize, maxelem)
84 on top of man page in the generic options section. (Mart Frauenlob)
85 - Support glibc < 2.9 (fixes bugzilla id #891)
86 - Add description of hash:mac set type to man page. (Mart Frauenlob)
87 - Add missing space for skbinfo option synopsis. (Mart Frauenlob)
88 - The library/API versions were forgotten to bump (reported by
90 - Retry printing when sprintf fails (reported by Stig Thormodsrud)
93 - hash:mac type added to ipset
94 - Add test to check mark mapping
95 - ipset: remove extran newline on debug output (Holger Eitzenberger)
96 - ipset: avoid duplicate command flags (Holger Eitzenberger)
97 - Remove a duplicate debug print (Holger Eitzenberger)
98 - ipset: man: Add the skbinfo extension documentation. (Anton Danilov)
99 - libipset: Add userspace support of the skbinfo extension of the list
100 set type. (Anton Danilov)
101 - libipset: Add userspace support of the skbinfo extension of the hash
102 set types. (Anton Danilov)
103 - libipset: Add userspace support of the skbinfo extension of the
104 bitmap set types. (Anton Danilov)
105 - libipset: Add userspace code for the skbinfo extension support.
107 - Make possible to compile ipset with IPSET_DEBUG from the dist.
109 - libipset: print third element in debugging (Sergey Popovich)
110 - ipset: Handle missing leading zeros in ethernet address parser
112 - ipset: Pass IPSET_BIN to test scripts to change binary location
114 - ipset: Fix grammar error in manpage (Neutron Soutmun)
115 - ipset: Fix printf format warning (Neutron Soutmun)
118 - The bash utilities are updated
119 - Fix libipset library release versioning (reported by Mathieu Bridon)
122 - ipset: add userspace support for forceadd (Josh Hunt)
123 - kernel: uapi: fix MARKMASK attr ABI breakage (Florian Westphal)
124 - lib: fix ifname 'physdev:' prefix parsing (Florian Westphal)
125 - Prepare the kernel for create option flags when no extension is needed
126 - print mark & mark mask in hex rather then decimal (Vytas Dauksa)
127 - add markmask for hash:ip,mark data type (Vytas Dauksa)
128 - add hash:ip,mark data type to ipset (Vytas Dauksa)
129 - ipset: manpage: correct add action synopsis for hash:net,port,net.
131 - ipset: manpage: remove spare comma for hash:net,net test action.
133 - Fix all set output from list/save when set with counters in use.
135 - ipset: Fix malformed output from list/save for ICMP types in port field
137 - ipset: fix timeout data type size (Nikolay Martynov)
140 - build: fix incorrect library versioning (Jan Engelhardt)
141 - netfilter: ipset: Fix configure failure when --with-kmod=no
143 - Avoid clashing with configured kernel in [CONFIG_]IP_SET_MAX
146 - Missing comment support added to hash:ip,port,ip and hash:net,iface
148 - Compatibility code is modified not to rely on kernel version numbers
149 - Add userspace code to support hash:net,port,net kernel module
151 - Tests added to check comment extension
152 - Add new userspace set revisions for comment support (Oliver Smith)
153 - Support comments in the userspace library (Oliver Smith)
154 - Rework the "fake" argument parsing for ipset restore (Oliver Smith)
155 - Add userspace code to support hash:net,net kernel module
157 - Add test to verify CIDR tracking
158 - configure: uclinux is also linux (Gustavo Zacarias)
159 - Add specifying protocol for bitmap:port (Quentin Armitage)
160 - Remove artifical restriction of netmask values for hash:ip type
161 (Reported by Quentin Armitage, netfilter bugzilla id #844)
162 - Make sure called test scripts can be executed (reported by Tomas Budai)
163 - Manpage fix: not just identical, but compatible type of sets can be
164 swapped (Reported by Quentin Armitage, netfilter bugzilla id #843)
165 - Fix error message typo (Reported by Quentin Armitage, netfilter bugzilla
167 - Parse option "family" first, because other options may depend on it
168 (Bug reported by Quentin Armitage, closed netfilter bugzilla #841)
169 - Change 2nd parameter type of ipset_parse_elem (Quentin Armitage)
170 - Report broken netlink messages in debug mode
171 - Fix hyphen used as minus sign in manpage (Neutron Soutmun)
172 - libipset.pc must be installed via 'make install' (Eric Leblond)
175 - Check at modules_install whether depmod ignores the extra subdir
176 (reported by Husnu Demir and tian fang)
177 - The utils are updated from their sources
178 - Manpage typing error correction (reported by Husnu Demir)
179 - Update testsuite as the trailing space was eliminated at listings
180 - Add sparse checking support to userspace
181 - Improve XML output: add element tag and root element (suggested by Lucas
184 - Add new testsuite entries to verify counters and the new type
186 - Introduce the new set type revisions with counter support
187 - Support counters in the ipset library
188 - The uapi include split in the package itself
191 - Kernel part bugfix release
194 - Fix revision printing in XML mode (reported by Mart Frauenlob)
195 - Correct "Suspicious condition (assignment + comparison)" (Thomas Jarosch)
196 - Fix error path when protocol number is used with port range
197 - Interactive mode error after syntax error (reported by Mart Frauenlob)
198 - The ipset_bash_completion tool is added
199 - The ipset_list tool is added
202 - Remove all modules before testing resize
203 - build: support for Linux 3.7 UAPI (Jan Engelhardt)
206 - Fix interactive mode (Fredrik Eriksson)
207 - Use gethostbyname2 instead of getaddrinfo
208 - Make tests/check_cidrs.sh script executable
209 - Add tests to check completely ranges with hash types
210 - Make easier to apply the netlink.patch
211 - Support protocol numbers as well, not only protocol names
212 - Add (back) the debug flag to configure
213 - Add simple test to check cidr book-keeping
216 - Support to match elements marked with "nomatch" in hash:*net* sets
218 - The set type revision number is added to the header part of listing
219 - Help prints list type revision and terse description
220 - Add /0 network support to hash:net,iface type
221 - Fix errors when compiling in debug mode (Krunal Patel)
222 - Make sure IPPROTO_UDPLITE is defined
223 - build: restore -version-info (Jan Engelhardt)
226 - Explain in more detail src/dst for hash:net,iface
227 - ipset help lists set types multiple times, fixed
228 (reported by Mr Dash Four)
229 - The commandline parser was too permissive, make it more strict
230 - Allow saving to/restoring from a file without shell redirection
231 - Fix typo of word "unkown" to "unknown" (Neutron Soutmun)
234 - Enable silent (kernel style) compile messages
235 - Fix build failed on --disable-dependency-tracking
237 - Add tarball target to Makefile
240 - Cleanup generated files by make tidy
241 - Add more CC warning option to debug mode
242 - Report syntax error messages immediately
243 - Suppress false syntax error messages
244 - Add configure summary for the ipset userspace tool
245 - Add dynamic module support to ipset userspace tool
247 - Move ipset_port_usage() into lib (Neutron Soutmun)
248 - Fix invalid assignment to const void pointer (bug reported by Seblu)
249 - Remove unused variables (warnings fixed)
250 - Fix timeout value overflow bug at large timeout parameters
251 (bug reported by Andreas Herz)
252 - Improve ipset help text messages (Mr Dash Four)
255 - Support hostnames and service names with dash
256 - Exceptions support added to hash:*net* types
257 - Log warning when a hash type of set gets full
258 - Set types moved into libipset library
259 - Library map file added in order to support library versioning
260 - doc: Linux 2.6.39 already has the defs (Jan Engelhardt)
261 - build: install libipset in the right place (Jan Engelhardt)
262 - Provide a pkgconfig file (Jan Engelhardt)
263 - build: make distcheck work and use POSIX mode for tarball generation
265 - build: install libipset/linux_ip_set_list.h (Jan Engelhardt)
266 - build: include libipset/nfproto.h (Jan Engelhardt)
267 - build: process include/libipset/ (Jan Engelhardt)
268 - build: use AC_CONFIG_AUX_DIR and stash away tools (Jan Engelhardt)
269 - Update .gitignore (Jan Engelhardt)
272 - Tests added to check ICMP/ICMPv6 type/code parsing
273 - ICMP/ICMPv6 type/code parser bug fixed (bug reported by Sabitov)
274 - ipset: fix lookup of tcp port names (Stephen Hemminger)
275 - Optionally disable building the kernel module (Mathieu Bridon)
279 - build: move ipset_errcode into library (Jan Engelhardt)
280 - build: abort autogen on subcommand failure (Jan Engelhardt)
281 - ipset: use NFPROTO_ constants (Jan Engelhardt)
282 - Propagate "expose userspace-relevant parts in ip_set.h" to ipset source
285 - Update the manpage and document the limits in hash:net,iface.
286 - README file corrections from Richard Lucassen
289 - Whitespace and coding fixes, detected by checkpatch.pl
290 - hash:net,iface type introduced
291 - hash:* tests may seem to fail due to the too wide grep pattern, fix them
292 - Remove iptree tests and compatibility element parsing
293 - hash:net test may seem to fail due to the too wide grep pattern, fix it
294 - Fix long time uncovered bug at adding string attributes to the netlink
296 - Fix warnings reported by valgrind
297 - Remove supporting set types iptree and iptreemap
300 - Restore with bitmap:port and list:set types did not work, fixed
301 - Accept "\r\n" terminated COMMIT command in restore files
302 - Fix the message sequence number book-keeping
303 - Protocol-level debugging support added
304 - hash:net stress test in range notation added
305 - ipset_mnl_query: in debug mode print the errno returned by the cb
307 - Accept "\r\n" terminated lines in restore files
308 - Remove outdated checking of IPv6 support from configure.ac
311 - Support range for IPv4 at adding/deleting elements for hash:*net* types
312 - Disable type revisions which are not supported both by the kernel and
314 - Update ipset help text to reflect SCTP and UDPLITE support
315 - Ignore -n flag (list just setnames) when sets are to be saved
318 - Get rid of the trailing empty line at listing sets
319 - Fix XML listing, remove broken unused "elements" tag
320 - Support listing setnames and headers too
321 - Sorting is dependent on the locale settings, use LC_ALL=C
322 - Use unified diff output in tests
325 - Testsuite changes: keep temporary files
326 - bitmap:ip,mac type requires "src" for MAC: manpage is updated to reflect
328 - Testsuite checks added (SET target and dir parameter checks)
334 - Manpage was not installed (reported by Mark A. Ziesemer)
335 - SCTP, UDPLITE support to the hash:*port* types added
338 - Print protocol version together with ipset version
339 - Testsuite compatibility with debugging enabled
340 - Allow "new" as a commad alias to "create"
341 - ipset: improve command argument parsing (Holger Eitzenberger)
342 - ipset: avoid the unnecessary argv[] loop (Holger Eitzenberger)
343 - ipset: pass ipset_arg argument pointer (Holger Eitzenberger)
344 - Separate ipset errnos completely from system ones and bump protocol
346 - Fix the spelling error fix :-) (Ferenc Wagner)
347 - Resolving IP addresses did not work at listing/saving sets, fixed
348 - ipset: fix spelling error (Holger Eitzenberger)
349 - ipset: fix the Netlink sequence number (Holger Eitzenberger)
350 - ipset: turn Set name[] into a const pointer (Holger Eitzenberger)
351 - Check ICMP and ICMPv6 with the set match and target in the testsuite
352 - Avoid possible syntax clashing at saving hostnames
355 - Set the non-debug compiling the default
356 - Testsuite fix of ospf replaced with vrrp.
357 - Fix build with NDEBUG defined (Holger Eitzenberger)
358 - Do session initialization once (Holger Eitzenberger)
359 - Make IPv4 and IPv6 address handling similar (Holger Eitzenberger)
360 - Show correct line numbers in restore output for parser errors
361 (Holger Eitzenberger)
362 - Replace ospf with vrrp in the testsuite
363 - Remove autogenerated files (Jan Engelhardt)
364 - Use only AC_CANONICAL_HOST (Jan Engelhardt)
367 - Handle internal printing errors
368 - Use cast to void * instead of memcpy as Sparc workaround at sockaddr_XXX
369 (suggested by Jan Engelhardt)
370 - Listing/saving of large sets could produce broken listing, fixed.
371 - Support libtool < 2.2
374 - Test cases for IPv6 restore and more complex restore sessions added
375 - Restore mode did not work for IPv6, fixed (reported by Elie Rosenblum)
376 - libipset: static annotations (Jan Engelhardt)
377 - libipset: const annotations (Jan Engelhardt)
378 - libipset: remove redundant casts (Jan Engelhardt)
379 - libipset: remove redundant indirection via union name (Jan Engelhardt)
380 - libipset: ipset_strncpy is really a strlcpy-type operation
382 - Prevent calling Makefile directly in the kernel/ subdirectory
383 - Put back the Sparc specific workaround at getaddrinfo
384 (reported by Jan Engelhardt)
385 - Check old system kernel header files
386 - Check from `configure` that the kernel source is patched with
388 - Use configure to detect compiler warning flags
389 - Try to solve PKG_CHECK_MODULES issue (reported by Rob Sterenborg)
390 - Fix incorrect comparison in check_allowed (reported by Jan Engelhardt)
393 - New main branch - ipset completely rewritten
396 - Checking null entries when listing/saving hash types of sets
397 deleted because it's unnecessary and can mask possible errors.
400 - Manpage fixes and corrections (Jan Engelhardt)
403 - New protocol is introduced to handle aligment issues properly
404 (bug reported by Georg Chini)
405 - Binding support is removed
408 - Correct format specifiers and change %i to %d (Jan Engelhardt)
411 - New kernel-userspace protocol release
412 - Bigendian and 64/32bit fixes (Stefan Gula, bugzilla id 593)
413 - tests/runtests.sh changed to support old bash shells
416 - On parisc architecture cast increases required aligment (bugzilla
418 - Respect LDFLAGS settings at compile time (Peter Volkov).
421 - In order to disable the extra warning flags, NO_EXTRA_WARN_FLAGS
422 variable added to userspace Makefile
425 - Some compiler warning options are too aggressive and
429 - Premature checking prevents to add valid elements to hash
430 types, fixed (bug reported by JC Janos).
431 - Local variable shadows another variable, fixed (reported
433 - More compiler warning options added and warnings fixed.
436 - Include file <limits.h> was missing from userspace set type
437 modules, reported by Krzysztof Oledzki and Sven Wegener.
440 - Only kernel part changes, see kernel/ChangeLog
443 - macipmap type reported misleading deprecated separator
444 tokens and printed the old one at listing set elements
445 (bug reported by Krzysztof Oledzki)
446 - Warn only once about deprecated separator tokens in
450 - Added KBUILD_OUTPUT support (Sven Wegener)
451 - Fix memory leak in ipset_iptreemap (Sven Wegener)
452 - Fix multiple compiler warnings (Sven Wegener)
453 - ipportiphash, ipportnethash and setlist types added
454 - binding marked as deprecated functionality
455 - element separator token changed to ',' in anticipating
456 IPv6 addresses, old separator tokens are still supported
457 - unnecessary includes removed
458 - ipset does not try to resolve IP addresses when listing
459 the content of sets (default changed)
461 - ChangeLog forked for kernel part
464 - Fix to compile ipset with 2.4.26.x tree statically (bug reported by
468 - compatibility for the 2.6.x kernel tree improved and compiler warnings
469 fixed (Jan Engelhardt)
470 - compatibility fixes for the 2.4.36.x kernel tree added
473 - including limits.h for UINT_MAX is required with glibc-2.8 (pud)
474 - needless cast from and to void pointers cleanups in iptreemap (Sven Wegener)
475 - Initial ipset release with kernel modules included.
478 - segfault on --unbind :all: :all: fixed (reported by bugzilla,
479 report and patch sent by Tom Eastep)
480 - User input parameters are sanitized everywhere
481 - Initial testsuite added and 'test' target to the Makefile
482 added: few bugs discovered and fixed
483 - typo in macipmap type prevented to use max size set of this type
484 - *map types are made sure to allow and use max size of sets
487 - jiffies rollover bug in iptree type fixed (reported by Lukasz Nierycho
489 - endiannes bug in iptree type fixed (spotted by Jan Engelhardt)
490 - iptreemap type added (submitted by Sven Wegener)
491 - 2.6.22/23 compatibility fixes (Jeremy Jacque)
492 - typo fixes in ipset (Neville D)
493 - separator changed to ':' from '%' (old one still supported) in ipset
496 - use correct type (socklen_t) for getsockopt (H. Nakano)
497 - incorrect return codes fixed (Tomasz Lemiech, Alexey Bortnikov)
498 - kernel header dependency removed (asm/bitops.h)
499 - ipset now tries to load in the ip_set kernel module if the protocol
503 - 'ipset -N' did not generate proper return code
504 - 'limit' module parameter added to the kernel modules of the
505 iphash, ipporthash, nethash and iptree type of sets so that
506 the maximal number of elements can now be limited
507 - zero valued entries (port 0 or IP address 0.0.0.0) were
508 detected as members of the hash/tree kind of sets
509 (reported by Andrew Kraslavsky)
510 - list and save operations used the external identifier
511 of the sets for the bindings instead of the internal one
512 (reported by Amin Azez)
515 - Nasty off-by-one bug fixed in iptree type of sets
516 (bug reported by Pablo Sole)
519 All patches were submitted by Jones Desougi
520 - missing or confusing error message fixes for ipporthash
521 - minor correction in debugging in nethash
522 - copy-paste bug in kernel set types at memory allocation
524 - unified memory allocations in ipset
527 - memory allocation in iptree is changed to GFP_ATOMIC because
528 we hold a lock (bug reported by Radek Hladik)
529 - compatibility fix: __nocast is not defined in all 2.6 branches
530 (problem reported by Ming-Ching Tiew)
531 - manpage corrections
534 - garbage collector of iptree type of sets is fixed: flushing
535 sets/removing kernel module could corrupt the timer
536 - new ipporthash type added
537 - manpage fixes and corrections
540 - half-fixed memory allocation bug in iphash and nethash finally
541 completely fixed (bug reported by Nikolai Malykh)
542 - restrictions to enter zero-valued entries into all non-hash type sets
544 - Too strict check on the set size of ipmap type was corrected
547 - memory allocation bug in iphash and nethash in connection with the SET
548 target was fixed (bug reported by Nikolai Malykh)
549 - lockhelp.h was removed from the 2.6.13 kernel tree, ip_set.c is
550 updated accordingly (Cardoso Didier, Samir Bellabes)
551 - manpage is updated to clearly state the command order in restore mode
554 - Jiffies rollover bug in ip_set_iptree reported and fixed by Rob Nielsen
555 - Compiler warning in the non-SMP case fixed (Marcus Sundberg)
556 - slab cache names shrunk in order to be compatible with 2.4.* (Marcus
560 - Magic number in ip_set_nethash.h was mistyped (bug reported by Rob
562 - ipset can now test IP addresses in nethash type of sets (i.e. addresses
563 in netblocks added to the set)
566 - Locking bug in ip_set_nethash.c (Clifford Wolf and Rob Carlson)
567 - Makefile contained an unnecessary variable in IPSET_LIB_DIR (Clifford
569 - Safety checkings of restore in ipset was incomplete (Robin H. Johnson)
570 - More careful resizing by avoiding locking completely
571 - stdin stored internally in a temporary file, so we can feed 'ipset -R'
573 - iptree maptype added
576 - Lock debugging used with debugless lock definiton (Piotr Chytla and
578 - Bindings were not properly filled out at listing (kernel)
579 - When listing sets from kernel, id was not added to the set structure
581 - nethash maptype added
582 - ipset manpage corrections (macipmap)
585 - Missing -fPIC in Makefile (Robert Iakobashvili)
586 - Cut'n'paste bug at saving macipmap types (Vincent Bernat).
587 - Bug in printing/saving SET targets reported and fixed by Michal
591 - Chaining of sets are changed: child sets replaced by bindings
592 - Kernel-userspace communication reorganized to minimize the number
594 - Save and restore functionality implemented
595 - iphash type reworked: clashing resolved by double-hashing and by
596 dynamically growing the set
600 - Rewritten to support child pools
601 - portmap, iphash pool support added
602 - too much other mods here and there to list...