]> granicus.if.org Git - ipset/log
ipset
12 years agoCoding style fixes
Jozsef Kadlecsik [Tue, 11 Sep 2012 15:38:17 +0000 (17:38 +0200)]
Coding style fixes

12 years agoThe set type revision number is added to the header part of listing
Jozsef Kadlecsik [Tue, 11 Sep 2012 15:34:37 +0000 (17:34 +0200)]
The set type revision number is added to the header part of listing

Incompatibility: if your script rely on the number of lines in the header
of set listings, then the new line

Revision: number

can break your script.

12 years agoInclude supported revisions in module description
Jozsef Kadlecsik [Tue, 11 Sep 2012 15:10:08 +0000 (17:10 +0200)]
Include supported revisions in module description

12 years agoHelp prints list type revision and terse description
Jozsef Kadlecsik [Sat, 8 Sep 2012 20:55:04 +0000 (22:55 +0200)]
Help prints list type revision and terse description

In order to catch kernel/userspace revision mismatch, better print
all available data.

12 years agoAdd /0 network support to hash:net,iface type
Jozsef Kadlecsik [Mon, 10 Sep 2012 19:22:23 +0000 (21:22 +0200)]
Add /0 network support to hash:net,iface type

Now it is possible to setup a single hash:net,iface type of set and
a single ip6?tables match which covers all egress/ingress filtering.

12 years agoFix cidr book keeping for hash:*net* types
Jozsef Kadlecsik [Mon, 10 Sep 2012 19:19:09 +0000 (21:19 +0200)]
Fix cidr book keeping for hash:*net* types

The book-keeping of the different sized networks were bogus, fix it.
The broken code could lead invalid matching in such sets when the number
of different sized networks were greater than the smallest CIDR value of
the networks.

12 years agoCheck and reject crazy /0 input parameters
Jozsef Kadlecsik [Tue, 4 Sep 2012 15:45:59 +0000 (17:45 +0200)]
Check and reject crazy /0 input parameters

bitmap:ip and bitmap:ip,mac type did not reject such a crazy range
when created and using such a set results in a kernel crash.
The hash types just silently ignored such parameters.

Reject invalid /0 input parameters explicitely.

12 years agoBackport ether_addr_equal
Jozsef Kadlecsik [Sat, 8 Sep 2012 16:37:21 +0000 (18:37 +0200)]
Backport ether_addr_equal

12 years agoCoding style fix, backport from kernel
Jozsef Kadlecsik [Mon, 10 Sep 2012 18:51:07 +0000 (20:51 +0200)]
Coding style fix, backport from kernel

12 years agonet: cleanup unsigned to unsigned int
Eric Dumazet [Sat, 8 Sep 2012 16:01:32 +0000 (18:01 +0200)]
net: cleanup unsigned to unsigned int

Use of "unsigned int" is preferred to bare "unsigned" in net tree.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
12 years agoFix errors when compiling in debug mode.
Krunal Patel [Fri, 31 Aug 2012 15:06:09 +0000 (17:06 +0200)]
Fix errors when compiling in debug mode.

12 years agoMake sure IPPROTO_UDPLITE is defined
Jozsef Kadlecsik [Fri, 31 Aug 2012 14:53:33 +0000 (16:53 +0200)]
Make sure IPPROTO_UDPLITE is defined

12 years agobuild: restore -version-info
Jan Engelhardt [Sun, 1 Jul 2012 18:36:19 +0000 (20:36 +0200)]
build: restore -version-info

On Sunday 2012-07-01 19:20, Jozsef Kadlecsik wrote:
>[...]
>> * therefore the patch makes a clean restart,
>>   using -version-info 3:0:0, to continue using .so.3
>>   starting from ipset-6.13 until the next *real*
>>   incompatible change.
>
>What is still unclear for me, why a clean restart is required. Looking
>into "libtool", as I see, "-version-number 3:0:1" and "-version-info
>3:0:1" produces the same result.

They don't. The libtool manual goes on attempting to explain
"-version-number" with C:R:A, though it could have been a lot easier
to just say "it copies the values as-is to the file suffix".

---8<---
location git://git.inai.de/ipset (updated)

parent 7c7b022a18ea2bae11d889b345caef87f3bf145e (v6.13)
commit 2b145f0794de6f56eaded0a6403be995be98c93b
Author: Jan Engelhardt <jengelh@inai.de>
Date:   Sat Jun 30 20:39:27 2012 +0200

build: restore -version-info

Commit v6.13~7 accidentally swapped "-version-info" with
"-version-number". Because "-version-number" takes the values
"FIRST:AGE:REV", which is different from "-version-info
CURRENT:REV:AGE", libipset.so.3 was emitted.

Restore using "-version-info" and continue to use 3 as the "FIRST"
interface (instead of 2), because it was declared that way in
ipset-6.13.

Also note that the version names in libipset.map generally are not
supposed to follow SO versions, but the program version):
IPSET_6.13 {...}.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
12 years agoipset 6.13 released v6.13
Jozsef Kadlecsik [Fri, 29 Jun 2012 19:48:45 +0000 (21:48 +0200)]
ipset 6.13 released

12 years agoExplain in more detail src/dst for hash:net,iface
Jozsef Kadlecsik [Fri, 29 Jun 2012 19:29:46 +0000 (21:29 +0200)]
Explain in more detail src/dst for hash:net,iface

12 years agoipset: Handle properly an IPSET_CMD_NONE
Tomasz Bursztyka [Thu, 28 Jun 2012 12:57:48 +0000 (15:57 +0300)]
ipset: Handle properly an IPSET_CMD_NONE

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
12 years agonetfilter: ipset: hash:net,iface: fix interface comparison
Florian Westphal [Sun, 17 Jun 2012 19:56:46 +0000 (21:56 +0200)]
netfilter: ipset: hash:net,iface: fix interface comparison

ifname_compare() assumes that skb->dev is zero-padded,
e.g 'eth1\0\0\0\0\0...'. This isn't always the case. e1000 driver does

strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1);

in e1000_probe(), so once device is registered dev->name memory contains
'eth1\0:0:3\0\0\0' (or something like that), which makes eth1 compare
fail.

Use plain strcmp() instead.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
12 years agoipset help lists set types multiple times, fixed (reported by Mr Dash Four)
Jozsef Kadlecsik [Tue, 19 Jun 2012 20:24:53 +0000 (22:24 +0200)]
ipset help lists set types multiple times, fixed (reported by Mr Dash Four)

ipset help listed every set type, including the ones with multiple
revisions - which were listed thus multiple times. Set types with
multiple revisions are listed once from now on.

12 years agoThe commandline parser was too permissive, make it more strict
Jozsef Kadlecsik [Tue, 19 Jun 2012 20:06:59 +0000 (22:06 +0200)]
The commandline parser was too permissive, make it more strict

The parser allowed more possible argument alternatives for
command options than the documented one, which limited the possibility
of other option names. The patch makes the parser more strict.

12 years agoTimeout fixing bug broke SET target special timeout value, fixed
Jozsef Kadlecsik [Fri, 8 Jun 2012 08:02:59 +0000 (10:02 +0200)]
Timeout fixing bug broke SET target special timeout value, fixed

The patch "Fix timeout value overflow bug at large timeout parameters"
broke the SET target when no timeout was specified (reported by
Jean-Philippe Menil).

12 years agoAllow saving to/restoring from a file without shell redirection
Jozsef Kadlecsik [Wed, 23 May 2012 21:27:42 +0000 (23:27 +0200)]
Allow saving to/restoring from a file without shell redirection

Mathieu Bridon suggested that in some environments where there is no
access to a full shell with input/output redirection, it'd be useful
to read from/write to directly a file (bugzilla #788).

The patch adds the new "-file" option to specify a filename to print
into when listing/saving sets or read from when restoring sets.

12 years agoUse MSEC_PER_SEC instead of harcoded value
Jozsef Kadlecsik [Tue, 15 May 2012 13:31:10 +0000 (15:31 +0200)]
Use MSEC_PER_SEC instead of harcoded value

David Laight and Eric Dumazet noticed that we were using hardcoded
1000 instead of MSEC_PER_SEC to calculate the timeout.

12 years agoFix typo of word "unkown" to "unknown".
Neutron Soutmun [Tue, 15 May 2012 13:27:24 +0000 (15:27 +0200)]
Fix typo of word "unkown" to "unknown".

12 years agoipset 6.12.1 released v6.12.1
Jozsef Kadlecsik [Thu, 10 May 2012 20:07:43 +0000 (22:07 +0200)]
ipset 6.12.1 released

12 years agoEnable silent (kernel style) compile messages
Jozsef Kadlecsik [Thu, 10 May 2012 20:05:37 +0000 (22:05 +0200)]
Enable silent (kernel style) compile messages

12 years agoFix build failed on --disable-dependency-tracking
Neutron Soutmun [Thu, 10 May 2012 19:29:34 +0000 (21:29 +0200)]
Fix build failed on --disable-dependency-tracking

12 years agoAdd tarball target to Makefile
Jozsef Kadlecsik [Thu, 10 May 2012 11:31:53 +0000 (13:31 +0200)]
Add tarball target to Makefile

12 years agoipset 6.12 released
Jozsef Kadlecsik [Thu, 10 May 2012 09:54:18 +0000 (11:54 +0200)]
ipset 6.12 released

12 years agoBackport nla_put_net* functions as NLA_PUT* were removed
Jozsef Kadlecsik [Thu, 10 May 2012 09:42:08 +0000 (11:42 +0200)]
Backport nla_put_net* functions as NLA_PUT* were removed

12 years agoCleanup generated files by make tidy
Jozsef Kadlecsik [Thu, 10 May 2012 09:16:01 +0000 (11:16 +0200)]
Cleanup generated files by make tidy

12 years agonetlink: add netlink_dump_control structure for netlink_dump_start()
Pablo Neira Ayuso [Thu, 10 May 2012 09:12:24 +0000 (11:12 +0200)]
netlink: add netlink_dump_control structure for netlink_dump_start()

Backport of Pablo's patch to the ipset package.

12 years agoipset: Stop using NLA_PUT*().
David S. Miller [Thu, 10 May 2012 08:44:03 +0000 (10:44 +0200)]
ipset: Stop using NLA_PUT*().

These macros contain a hidden goto, and are thus extremely error
prone and make code hard to audit.

Signed-off-by: David S. Miller <davem@davemloft.net>
12 years agoAdd more CC warning option to debug mode
Jozsef Kadlecsik [Thu, 10 May 2012 08:29:22 +0000 (10:29 +0200)]
Add more CC warning option to debug mode

12 years agoReport syntax error messages immediately
Jozsef Kadlecsik [Thu, 10 May 2012 07:42:36 +0000 (09:42 +0200)]
Report syntax error messages immediately

12 years agoSuppress false syntax error messages
Jozsef Kadlecsik [Thu, 10 May 2012 07:30:36 +0000 (09:30 +0200)]
Suppress false syntax error messages

If a create command fails at the kernel side, false syntax error
was also reported due to  the chicken and egg problem of the family
option.

12 years agoAdd configure summary for the ipset userspace tool
Jozsef Kadlecsik [Thu, 10 May 2012 07:22:29 +0000 (09:22 +0200)]
Add configure summary for the ipset userspace tool

12 years agoAdd dynamic module support to ipset userspace tool
Neutron Soutmun [Thu, 10 May 2012 06:05:53 +0000 (08:05 +0200)]
Add dynamic module support to ipset userspace tool

The patch adds supporting dynamic modules for the set types to ipset
userspace tool. The dynamic module support can be enabled by the
--enable-settype-modules of "configure". The list of set types to
be compiled as dynamic modules can be specified in the
--with-settype-modules-list option. Example

--enable-settype-modules \
--with-settype-modules-list="ipset_hash_ip ipset_hash_ipport"

The keyword "all" can be used to compile all set types as dynamic modules.

12 years agoMove ipset_port_usage() into lib
Neutron Soutmun [Sun, 6 May 2012 20:18:52 +0000 (22:18 +0200)]
Move ipset_port_usage() into lib

12 years agoFix hash size checking in kernel
Jozsef Kadlecsik [Sun, 6 May 2012 20:10:52 +0000 (22:10 +0200)]
Fix hash size checking in kernel

The hash size must fit both into u32 (jhash) and the max value of
size_t. The missing checking could lead to kernel crash, bug reported
by Seblu.

12 years agoFix invalid assignment to const void pointer
Jozsef Kadlecsik [Fri, 4 May 2012 20:06:50 +0000 (22:06 +0200)]
Fix invalid assignment to const void pointer

gcc 4.7 and above ignore such assignments which leads to a broken
ipset binary (bug reported by Seblu).

12 years agoCorrect README file about minimal required iptables version
Oskar Berggren [Fri, 4 May 2012 19:48:16 +0000 (21:48 +0200)]
Correct README file about minimal required iptables version

12 years agoSparse warnings "incorrect type in assignment" fixed
Jozsef Kadlecsik [Fri, 4 May 2012 19:46:48 +0000 (21:46 +0200)]
Sparse warnings "incorrect type in assignment" fixed

12 years agoRemove unused variables (warnings fixed)
Jozsef Kadlecsik [Fri, 4 May 2012 19:45:07 +0000 (21:45 +0200)]
Remove unused variables (warnings fixed)

12 years agoFix timeout value overflow bug at large timeout parameters
Jozsef Kadlecsik [Fri, 4 May 2012 19:37:28 +0000 (21:37 +0200)]
Fix timeout value overflow bug at large timeout parameters

Large timeout parameters could result wrong timeout values due to
an overflow at msec to jiffies conversion (reported by Andreas Herz)

12 years agoipv6: Add fragment reporting to ipv6_skip_exthdr().
Jesse Gross [Fri, 4 May 2012 14:55:03 +0000 (16:55 +0200)]
ipv6: Add fragment reporting to ipv6_skip_exthdr().

While parsing through IPv6 extension headers, fragment headers are
skipped making them invisible to the caller.  This reports the
fragment offset of the last header in order to make it possible to
determine whether the packet is fragmented and, if so whether it is
a first or last fragment.

Signed-off-by: Jesse Gross <jesse@nicira.com>
12 years agonet: remove ipv6_addr_copy()
Alexey Dobriyan [Thu, 19 Apr 2012 15:34:32 +0000 (17:34 +0200)]
net: remove ipv6_addr_copy()

C assignment can handle struct in6_addr copying.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
12 years agoImprove ipset help text messages (Mr Dash Four)
Jozsef Kadlecsik [Thu, 19 Apr 2012 15:00:56 +0000 (17:00 +0200)]
Improve ipset help text messages (Mr Dash Four)

12 years agoFix the inclusion of linux/export.h
Henry Culver [Fri, 20 Jan 2012 12:40:55 +0000 (13:40 +0100)]
Fix the inclusion of linux/export.h

The tests for inclusion of linux/export.h in
ipset-6.11:kernel/net/netfilter/ipset/{ip_set_getport.c,pfxlen.c} are
incorrect, linux/export.h did not go in until 3.2.0.

12 years agoipset 6.11 released v6.11 v6.12
Jozsef Kadlecsik [Sat, 14 Jan 2012 14:25:34 +0000 (15:25 +0100)]
ipset 6.11 released

12 years agoSupport hostnames and service names with dash
Jozsef Kadlecsik [Sat, 14 Jan 2012 14:06:00 +0000 (15:06 +0100)]
Support hostnames and service names with dash

The square brackets are introduced as an escape mechanism to
enter hostnames or service names with dash in order to avoid
mixing up the dash in the name with the range notation.

Problem reported by Stephen Hemminger and Marc Guardiola.

12 years agohash:net,iface timeout bug fixed
Jozsef Kadlecsik [Fri, 13 Jan 2012 21:55:54 +0000 (22:55 +0100)]
hash:net,iface timeout bug fixed

Timed out entries were still matched till the garbage collector
purged them out. The fix is verified in the testsuite.

12 years agoExceptions support added to hash:*net* types
Jozsef Kadlecsik [Fri, 13 Jan 2012 21:52:44 +0000 (22:52 +0100)]
Exceptions support added to hash:*net* types

The "nomatch" keyword and option is added to the hash:*net* types,
by which one can add exception entries to sets. Example:

ipset create test hash:net
ipset add test 192.168.0/24
ipset add test 192.168.0/30 nomatch

In this case the IP addresses from 192.168.0/24 except 192.168.0/30
match the elements of the set.

12 years agonet: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules
Paul Gortmaker [Fri, 13 Jan 2012 20:28:45 +0000 (21:28 +0100)]
net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules

These files are non modular, but need to export symbols using
the macros now living in export.h -- call out the include so
that things won't break when we remove the implicit presence
of module.h from everywhere.

12 years agoLog warning when a hash type of set gets full
Jozsef Kadlecsik [Tue, 10 Jan 2012 16:04:32 +0000 (17:04 +0100)]
Log warning when a hash type of set gets full

If the set is full, the SET target cannot add more elements.
Log warning so that the admin got notified about it.

12 years agoSet types moved into libipset library
Jozsef Kadlecsik [Thu, 5 Jan 2012 20:30:20 +0000 (21:30 +0100)]
Set types moved into libipset library

The libipset library is complete by this step, and "ipset" just
a CLI interface based on the lib.

12 years agoLibrary map file added in order to support library versioning.
Jozsef Kadlecsik [Thu, 5 Jan 2012 10:49:26 +0000 (11:49 +0100)]
Library map file added in order to support library versioning.

12 years agodoc: Linux 2.6.39 already has the defs
Jan Engelhardt [Sun, 1 Jan 2012 00:25:33 +0000 (01:25 +0100)]
doc: Linux 2.6.39 already has the defs

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
12 years agobuild: install libipset in the right place
Jan Engelhardt [Sun, 1 Jan 2012 00:25:34 +0000 (01:25 +0100)]
build: install libipset in the right place

The .c files used to build the plugins for ipset all use #include
<libipset/...>, so the files we install should preferably also be in a
directory called "libipset" rather than just "ipset".

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
12 years agoProvide a pkgconfig file
Jan Engelhardt [Sun, 1 Jan 2012 00:25:35 +0000 (01:25 +0100)]
Provide a pkgconfig file

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 years agobuild: make distcheck work and use POSIX mode for tarball generation
Jan Engelhardt [Sat, 17 Dec 2011 15:35:08 +0000 (16:35 +0100)]
build: make distcheck work and use POSIX mode for tarball generation

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 years agobuild: install libipset/linux_ip_set_list.h
Jan Engelhardt [Sat, 17 Dec 2011 15:35:07 +0000 (16:35 +0100)]
build: install libipset/linux_ip_set_list.h

The other linux_ip_set*.h files are shipped, so this one probably
should too.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 years agobuild: include libipset/nfproto.h
Jan Engelhardt [Sat, 17 Dec 2011 15:35:06 +0000 (16:35 +0100)]
build: include libipset/nfproto.h

libipset/types.h, which is installed by default, requires nfproto.h.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 years agobuild: process include/libipset/
Jan Engelhardt [Sat, 17 Dec 2011 15:35:05 +0000 (16:35 +0100)]
build: process include/libipset/

We need to visit that directory, otherwise `make install` is
incomplete and `make distcheck` fails.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 years agobuild: use AC_CONFIG_AUX_DIR and stash away tools
Jan Engelhardt [Sat, 17 Dec 2011 15:35:04 +0000 (16:35 +0100)]
build: use AC_CONFIG_AUX_DIR and stash away tools

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 years agoUpdate .gitignore
Jan Engelhardt [Sat, 17 Dec 2011 15:35:03 +0000 (16:35 +0100)]
Update .gitignore

Only ignore these paths if they are a directory.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 years agoipset 6.10 released v6.10
Jozsef Kadlecsik [Fri, 25 Nov 2011 08:36:04 +0000 (09:36 +0100)]
ipset 6.10 released

13 years agoTests added to check ICMP/ICMPv6 type/code parsing
Jozsef Kadlecsik [Thu, 24 Nov 2011 15:49:54 +0000 (16:49 +0100)]
Tests added to check ICMP/ICMPv6 type/code parsing

13 years agoICMP/ICMPv6 type/code parser bug fixed
Jozsef Kadlecsik [Wed, 16 Nov 2011 21:49:01 +0000 (22:49 +0100)]
ICMP/ICMPv6 type/code parser bug fixed

The ICMP/ICMPv6 type/code parser swapped the type and code values.
(Bug reported by Sabitov)

13 years agoipset: fix lookup of tcp port names
Stephen Hemminger [Fri, 28 Oct 2011 16:16:13 +0000 (18:16 +0200)]
ipset: fix lookup of tcp port names

The protocol argument to getservbyname() must be lowercase tcp not
uppercase TCP. This fixes the bug observed by:

 # ipset add foo http
 ipset v6.9.1: Syntax error: 'http' is invalid as number
 Syntax error: cannot parse 'http' as a TCP port

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 years agoInvert the logic to include version.h in ip_set_core.c
Jozsef Kadlecsik [Thu, 15 Sep 2011 19:00:22 +0000 (21:00 +0200)]
Invert the logic to include version.h in ip_set_core.c

13 years agoSuppress false compile-time warnings:
Jozsef Kadlecsik [Thu, 15 Sep 2011 07:07:41 +0000 (09:07 +0200)]
Suppress false compile-time warnings:

warning: 'ip_to' may be used uninitialized in this function

13 years agoOptionally disable building the kernel module.
Mathieu Bridon [Mon, 12 Sep 2011 08:03:23 +0000 (16:03 +0800)]
Optionally disable building the kernel module.

Distributors (like Fedora) might be interested in including the ipset
tools and libs, but they often don't want to build and ship external
kernel modules, especially if those modules are already included in
their kernel packages.

This patch introduces a new --with-kmod configure option that can be
used to conditionally build the kernel module. The module is still built
by default, to preserve compatibility.

A user who wants to build only the user-space part of ipset can do so by
running the following:

    $ ./autogen.sh
    $ configure --with-kmod=no
    $ make
    # make install

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 years agoMake tidy complete
Jozsef Kadlecsik [Tue, 6 Sep 2011 19:29:53 +0000 (21:29 +0200)]
Make tidy complete

13 years agoipset 6.9.1 released v6.9.1
Jozsef Kadlecsik [Tue, 6 Sep 2011 19:26:56 +0000 (21:26 +0200)]
ipset 6.9.1 released

13 years agoFix compiling ipset as external kernel modules
Jozsef Kadlecsik [Tue, 6 Sep 2011 19:25:10 +0000 (21:25 +0200)]
Fix compiling ipset as external kernel modules

13 years agoipset 6.9 released v6.9
Jozsef Kadlecsik [Tue, 6 Sep 2011 19:12:17 +0000 (21:12 +0200)]
ipset 6.9 released

13 years agoComplete Kconfig with hash:net,iface type
Jozsef Kadlecsik [Mon, 5 Sep 2011 15:33:50 +0000 (17:33 +0200)]
Complete Kconfig with hash:net,iface type

The Kconfig file is not used at building ipset as external system,
still let the file be complete.

13 years agortnetlink: Compute and store minimum ifinfo dump size
Greg Rose [Mon, 5 Sep 2011 15:11:40 +0000 (17:11 +0200)]
rtnetlink: Compute and store minimum ifinfo dump size

[The patch changes the API of the netlink_dump_start interface: port
it to the standalone ipset package.]

The message size allocated for rtnl ifinfo dumps was limited to
a single page.  This is not enough for additional interface info
available with devices that support SR-IOV and caused a bug in
which VF info would not be displayed if more than approximately
40 VFs were created per interface.

Implement a new function pointer for the rtnl_register service that will
calculate the amount of data required for the ifinfo dump and allocate
enough data to satisfy the request.

Signed-off-by: Greg Rose <gregory.v.rose@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
13 years agoRemove redundant linux/version.h includes from net/
Jesper Juhl [Mon, 5 Sep 2011 15:07:17 +0000 (17:07 +0200)]
Remove redundant linux/version.h includes from net/

It was suggested by "make versioncheck" that the follwing includes of
linux/version.h are redundant:

  /home/jj/src/linux-2.6/net/caif/caif_dev.c: 14 linux/version.h not needed.
  /home/jj/src/linux-2.6/net/caif/chnl_net.c: 10 linux/version.h not needed.
  /home/jj/src/linux-2.6/net/ipv4/gre.c: 19 linux/version.h not needed.
  /home/jj/src/linux-2.6/net/netfilter/ipset/ip_set_core.c: 20 linux/version.h not needed.
  /home/jj/src/linux-2.6/net/netfilter/xt_set.c: 16 linux/version.h not needed.

and it seems that it is right.

Beyond manually inspecting the source files I also did a few build
tests with various configs to confirm that including the header in
those files is indeed not needed.

Here's a patch to remove the pointless includes.

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 years agoMerge branch 'master' of git://dev.medozas.de/ipset
Jozsef Kadlecsik [Thu, 1 Sep 2011 09:10:10 +0000 (11:10 +0200)]
Merge branch 'master' of git://dev.medozas.de/ipset

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 years agobuild: move ipset_errcode into library
Jan Engelhardt [Sun, 28 Aug 2011 17:13:47 +0000 (19:13 +0200)]
build: move ipset_errcode into library

The library cannot stand on its own:

19:13 seven:../ipset/lib > ldd -r .libs/libipset.so.1
        linux-vdso.so.1 =>  (0x00007fff9a569000)
        libmnl.so.0 => /usr/lib64/libmnl.so.0 (0x00007fd42ae5c000)
        libc.so.6 => /lib64/libc.so.6 (0x00007fd42aaef000)
        /lib64/ld-linux-x86-64.so.2 (0x00007fd42b28d000)
undefined symbol: ipset_errcode (.libs/libipset.so.1)

Resolve this by moving ipset_errcode into the library.

Reported-by: Arkadiusz Miskiewicz <a.miskiewicz@gmail.com>
References: http://marc.info/?l=netfilter-devel&m=131435791514602&w=2

13 years agobuild: abort autogen on subcommand failure
Jan Engelhardt [Mon, 1 Aug 2011 19:26:24 +0000 (21:26 +0200)]
build: abort autogen on subcommand failure

Needed to stop an automated build process when automake requirements
are not fulfilled.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
13 years agoipset: use NFPROTO_ constants
Jan Engelhardt [Thu, 25 Aug 2011 09:17:33 +0000 (11:17 +0200)]
ipset: use NFPROTO_ constants

ipset is actually using NFPROTO values rather than AF (xt_set passes
that along).

13 years agoPropagate "expose userspace-relevant parts in ip_set.h" to ipset source
Jozsef Kadlecsik [Wed, 31 Aug 2011 13:56:34 +0000 (15:56 +0200)]
Propagate "expose userspace-relevant parts in ip_set.h" to ipset source

With the header file restructuring, the ipset userspace enums IPSET_DIM_*
clash with the kernel ones. In this patch the userspace is converted to
use the kernel part enums and thus we got rid of userspace enums IPSET_DIM_*.

13 years agonetfilter: ipset: expose userspace-relevant parts in ip_set.h
Jan Engelhardt [Wed, 31 Aug 2011 12:10:05 +0000 (14:10 +0200)]
netfilter: ipset: expose userspace-relevant parts in ip_set.h

iptables's libxt_SET.c depends on these.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 years agonetfilter: ipset: avoid use of kernel-only types
Jan Engelhardt [Wed, 31 Aug 2011 12:10:04 +0000 (14:10 +0200)]
netfilter: ipset: avoid use of kernel-only types

When using the xt_set.h header in userspace, one will get these gcc
reports:

ipset/ip_set.h:184:1: error: unknown type name "u16"
In file included from libxt_SET.c:21:0:
netfilter/xt_set.h:61:2: error: unknown type name "u32"
netfilter/xt_set.h:62:2: error: unknown type name "u32"

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 years agonetfilter: Remove unnecessary OOM logging messages
Joe Perches [Mon, 29 Aug 2011 21:17:25 +0000 (14:17 -0700)]
netfilter: Remove unnecessary OOM logging messages

Removing unnecessary messages saves code and text.

Site specific OOM messages are duplications of a generic MM
out of memory message and aren't really useful, so just
delete them.

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
13 years agoDumping error triggered removing references twice and lead to kernel BUG
Jozsef Kadlecsik [Wed, 31 Aug 2011 10:32:55 +0000 (12:32 +0200)]
Dumping error triggered removing references twice and lead to kernel BUG

If there was a dumping error in the middle, the set-specific variable was
not zeroed out and thus the 'done' function of the dumping wrongly tried
to release the already released reference of the set. The already released
reference was caught by __ip_set_put and triggered a kernel BUG message.
The issue was reported by Jean-Philippe Menil.

13 years agoAutoload set type modules safely
Jozsef Kadlecsik [Mon, 29 Aug 2011 15:08:55 +0000 (17:08 +0200)]
Autoload set type modules safely

Jan Engelhardt noticed when userspace requests a set type unknown
to the kernel, it can lead to a loop due to the unsafe type module
loading. The issue is fixed in this patch.

13 years agoipset 6.8 released v6.8
Jozsef Kadlecsik [Mon, 11 Jul 2011 09:10:47 +0000 (11:10 +0200)]
ipset 6.8 released

13 years agoUpdate the manpage and document the limits in hash:net,iface.
Jozsef Kadlecsik [Mon, 11 Jul 2011 08:50:21 +0000 (10:50 +0200)]
Update the manpage and document the limits in hash:net,iface.

13 years agoFix compiler warnings "'hash_ip4_data_next' declared inline after being called"
Chris Friesen [Sat, 9 Jul 2011 08:19:41 +0000 (10:19 +0200)]
Fix compiler warnings "'hash_ip4_data_next' declared inline after being called"

Some gcc versions warn about prototypes without "inline" when the declaration
includes the "inline" keyword. The fix generates a false error message
"marked inline, but without a definition" with sparse below 0.4.2.

Signed-off-by: Chris Friesen <chris.friesen@genband.com>
13 years agohash:net,iface fixed to handle overlapping nets behind different interfaces
Jozsef Kadlecsik [Fri, 8 Jul 2011 09:06:40 +0000 (11:06 +0200)]
hash:net,iface fixed to handle overlapping nets behind different interfaces

If overlapping networks with different interfaces was added to
the set, the type did not handle it properly. Example

ipset create test hash:net,iface
ipset add test 192.168.0.0/16,eth0
ipset add test 192.168.0.0/24,eth1

Now, if a packet was sent from 192.168.0.0/24,eth0, the type returned
a match.

In the patch the algorithm is fixed in order to correctly handle
overlapping networks.

Limitation: the same network cannot be stored with more than 64 different
interfaces in a single set.

13 years agoMake possible to hash some part of the data element only.
Jozsef Kadlecsik [Tue, 14 Jun 2011 19:58:39 +0000 (21:58 +0200)]
Make possible to hash some part of the data element only.

13 years agoREADME file corrections from Richard Lucassen
Jozsef Kadlecsik [Wed, 8 Jun 2011 17:41:31 +0000 (19:41 +0200)]
README file corrections from Richard Lucassen

13 years agoipset 6.7 released v6.7
Jozsef Kadlecsik [Tue, 31 May 2011 19:44:47 +0000 (21:44 +0200)]
ipset 6.7 released

13 years agoWhitespace and coding fixes detected by checkpatch.pl
Jozsef Kadlecsik [Tue, 31 May 2011 17:38:00 +0000 (19:38 +0200)]
Whitespace and coding fixes detected by checkpatch.pl

13 years agohash:net,iface type introduced
Jozsef Kadlecsik [Mon, 30 May 2011 15:48:01 +0000 (17:48 +0200)]
hash:net,iface type introduced

The hash:net,iface type makes possible to store network address and
interface name pairs in a set. It's mostly suitable for egress
and ingress filtering. Examples:

# ipset create test hash:net,iface
# ipset add test 192.168.0.0/16,eth0
# ipset add test 192.168.0.0/24,eth1

13 years agohash:* tests may seem to fail due to the too wide grep pattern, fix them
Jozsef Kadlecsik [Mon, 30 May 2011 15:29:58 +0000 (17:29 +0200)]
hash:* tests may seem to fail due to the too wide grep pattern, fix them

13 years agoUse the stored first cidr value instead of '1'
Jozsef Kadlecsik [Sat, 28 May 2011 21:36:14 +0000 (23:36 +0200)]
Use the stored first cidr value instead of '1'