linux.git/include/linux/netfilter/ipset, branch v3.16

netfilter: ipset: add forceadd kernel support for hash set types

2014-03-06T08:31:43+00:00

Adds a new property for hash set types, where if a set is created
with the 'forceadd' option and the set becomes full the next addition
to the set may succeed and evict a random entry from the set.

To keep overhead low eviction is done very simply. It checks to see
which bucket the new entry would be added. If the bucket's pos value
is non-zero (meaning there's at least one entry in the bucket) it
replaces the first entry in the bucket. If pos is zero, then it continues
down the normal add process.

This property is useful if you have a set for 'ban' lists where it may
not matter if you release some entries from the set early.

Signed-off-by: Josh Hunt 
Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: Prepare the kernel for create option flags when no extension is needed

2014-03-06T08:31:42+00:00

Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: add hash:ip,mark data type to ipset

2014-03-06T08:31:42+00:00

Introduce packet mark support with new ip,mark hash set. This includes
userspace and kernelspace code, hash:ip,mark set tests and man page
updates.

The intended use of ip,mark set is similar to the ip:port type, but for
protocols which don't use a predictable port number. Instead of port
number it matches a firewall mark determined by a layer 7 filtering
program like opendpi.

As well as allowing or blocking traffic it will also be used for
accounting packets and bytes sent for each protocol.

Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: remove unused code

2014-01-03T22:41:35+00:00

Function never used in current upstream code.

Signed-off-by: Stephen Hemminger 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: Use netlink callback dump args only

2013-10-22T08:13:59+00:00

Instead of cb->data, use callback dump args only and introduce symbolic
names instead of plain numbers at accessing the argument members.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfiler: ipset: Add net namespace for ipset

2013-09-30T19:42:52+00:00

This patch adds netns support for ipset.

Major changes were made in ip_set_core.c and ip_set.h.
Global variables are moved to per net namespace.
Added initialization code and the destruction of the network namespace ipset subsystem.
In the prototypes of public functions ip_set_* added parameter "struct net*".

The remaining corrections related to the change prototypes of public functions ip_set_*.

The patch for git://git.netfilter.org/ipset.git commit 6a4ec96c0b8caac5c35474e40e319704d92ca347

Signed-off-by: Vitaly Lavrov 
Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: Use a common function at listing the extensions

2013-09-30T19:42:36+00:00

Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: Support comments for ipset entries in the core.

2013-09-30T19:33:28+00:00

This adds the core support for having comments on ipset entries.

The comments are stored as standard null-terminated strings in
dynamically allocated memory after being passed to the kernel. As a
result of this, code has been added to the generic destroy function to
iterate all extensions and call that extension's destroy task if the set
has that extension activated, and if such a task is defined.

Signed-off-by: Oliver Smith 
Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: Support extensions which need a per data destroy function

2013-09-30T19:33:27+00:00

Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: Generalize extensions support

2013-09-30T19:33:27+00:00

Get rid of the structure based extensions and introduce a blob for
the extensions. Thus we can support more extension types easily.

Signed-off-by: Jozsef Kadlecsik