07 Nov, 2015
1 commit
-
The data extensions in ipset lacked the proper memory alignment and
thus could lead to kernel crash on several architectures. Therefore
the structures have been reorganized and alignment attributes added
where needed. The patch was tested on armv7h by Gerhard Wiesinger and
on x86_64, sparc64 by Jozsef Kadlecsik.Reported-by: Gerhard Wiesinger
Tested-by: Gerhard Wiesinger
Tested-by: Jozsef Kadlecsik
Signed-off-by: Jozsef Kadlecsik
14 Jun, 2015
4 commits
-
Signed-off-by: Jozsef Kadlecsik
-
There's nothing much required because the bitmap types use atomic
bit operations. However the logic of adding elements slightly changed:
first the MAC address updated (which is not atomic), then the element
activated (added). The extensions may call kfree_rcu() therefore we
call rcu_barrier() at module removal.Signed-off-by: Jozsef Kadlecsik
-
Even if we return with generic IPSET_ERR_PROTOCOL it is good idea
to return line number if we called in batch mode.Moreover we are not always exiting with IPSET_ERR_PROTOCOL. For
example hash:ip,port,net may return IPSET_ERR_HASH_RANGE_UNSUPPORTED
or IPSET_ERR_INVALID_CIDR.Signed-off-by: Sergey Popovich
Signed-off-by: Jozsef Kadlecsik -
Make all extensions attributes checks within ip_set_get_extensions()
and reduce number of duplicated code.Signed-off-by: Sergey Popovich
Signed-off-by: Jozsef Kadlecsik
13 May, 2015
1 commit
-
Ensure userspace supplies string not longer than
IPSET_MAX_COMMENT_SIZE.Signed-off-by: Sergey Popovich
Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Pablo Neira Ayuso
16 Sep, 2014
1 commit
-
Add skbinfo extension kernel support for the bitmap set types.
Inroduce the new revisions of bitmap_ip, bitmap_ipmac and bitmap_port set types.Signed-off-by: Anton Danilov
Signed-off-by: Jozsef Kadlecsik
25 Aug, 2014
1 commit
-
Resolve missing-field-initializer warnings by providing a
directed initializer.Signed-off-by: Mark Rustad
Signed-off-by: Jeff Kirsher
Signed-off-by: Jozsef Kadlecsik
28 Oct, 2013
1 commit
-
At the restructuring of the bitmap types creation in ipset, for the
bitmap:port type wrong (too large) memory allocation was copied
(netfilter bugzilla id #859).Reported-by: Quentin Armitage
Signed-off-by: Jozsef Kadlecsik
01 Oct, 2013
6 commits
-
This patch adds netns support for ipset.
Major changes were made in ip_set_core.c and ip_set.h.
Global variables are moved to per net namespace.
Added initialization code and the destruction of the network namespace ipset subsystem.
In the prototypes of public functions ip_set_* added parameter "struct net*".The remaining corrections related to the change prototypes of public functions ip_set_*.
The patch for git://git.netfilter.org/ipset.git commit 6a4ec96c0b8caac5c35474e40e319704d92ca347
Signed-off-by: Vitaly Lavrov
Signed-off-by: Jozsef Kadlecsik -
This provides kernel support for creating bitmap ipsets with comment
support.As is the case for hashes, this incurs a penalty when flushing or
destroying the entire ipset as the entries must first be walked in order
to free the comment strings. This penalty is of course far less than the
cost of listing an ipset to userspace. Any set created without support
for comments will be flushed/destroyed as before.Signed-off-by: Oliver Smith
Signed-off-by: Jozsef Kadlecsik -
Get rid of the structure based extensions and introduce a blob for
the extensions. Thus we can support more extension types easily.Signed-off-by: Jozsef Kadlecsik
-
Default timeout and extension offsets are moved to struct set, because
all set types supports all extensions and it makes possible to generalize
extension support.Signed-off-by: Jozsef Kadlecsik
-
Signed-off-by: Jozsef Kadlecsik
-
Reported-by: David Laight
Signed-off-by: Jozsef Kadlecsik
30 Apr, 2013
2 commits
-
Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Pablo Neira Ayuso -
Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Pablo Neira Ayuso
23 Sep, 2012
1 commit
-
Signed-off-by: Jozsef Kadlecsik
02 Apr, 2012
1 commit
-
These macros contain a hidden goto, and are thus extremely error
prone and make code hard to audit.Signed-off-by: David S. Miller
08 Mar, 2012
1 commit
-
ipset is actually using NFPROTO values rather than AF (xt_set passes
that along).Signed-off-by: Jan Engelhardt
Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Pablo Neira Ayuso
17 Jun, 2011
5 commits
-
With the change the sets can use any parameter available for the match
and target extensions, like input/output interface. It's required for
the hash:net,iface set type.Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Patrick McHardy -
A set type may have multiple revisions, for example when syntax is
extended. Support continuous revision ranges in set types.Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Patrick McHardy -
When ranges are added to hash types, the elements may trigger rehashing
the set. However, the last successfully added element was not kept track
so the adding started again with the first element after the rehashing.Bug reported by Mr Dash Four.
Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Patrick McHardy -
The support makes possible to specify the timeout value for
the SET target and a flag to reset the timeout for already existing
entries.Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Patrick McHardy -
When an element to a set with timeout added, one can change the timeout
by "readding" the element with the "-exist" flag. That means the timeout
value is reset to the specified one (or to the default from the set
specification if the "timeout n" option is not used). Exampleipset add foo 1.2.3.4 timeout 10
ipset add foo 1.2.3.4 timeout 600 -existSigned-off-by: Jozsef Kadlecsik
Signed-off-by: Patrick McHardy
04 Apr, 2011
1 commit
-
The timeout variant of the list:set type must reference the member sets.
However, its garbage collector runs at timer interrupt so the mutex
protection of the references is a no go. Therefore the reference protection
is converted to rwlock.Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Patrick McHardy
01 Feb, 2011
2 commits
-
None of the set types need uaccess.h since this is handled centrally
in ip_set_core. Most set types additionally don't need bitops.h and
spinlock.h since they use neither. tcp.h is only needed by those
using before(), udp.h is not needed at all.Signed-off-by: Patrick McHardy
-
The module implements the bitmap:port type in two flavours, without
and with timeout support to store TCP/UDP ports from a range.Signed-off-by: Jozsef Kadlecsik
Signed-off-by: Patrick McHardy
