linux.git/include/linux/netfilter/ipset, branch v3.6

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2012-05-17T02:17:37+00:00

netfilter: ipset: fix timeout value overflow bug

2012-05-16T22:56:41+00:00

Large timeout parameters could result wrong timeout values due to
an overflow at msec to jiffies conversion (reported by Andreas Herz)

[ This patch was mangled by Pablo Neira Ayuso since David Laight and
  Eric Dumazet noticed that we were using hardcoded 1000 instead of
  MSEC_PER_SEC to calculate the timeout ]

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: fix hash size checking in kernel

2012-05-16T19:38:49+00:00

The hash size must fit both into u32 (jhash) and the max value of
size_t. The missing checking could lead to kernel crash, bug reported
by Seblu.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

net: cleanup unsigned to unsigned int

2012-04-15T16:44:40+00:00

Use of "unsigned int" is preferred to bare "unsigned" in net tree.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

ipset: Stop using NLA_PUT*().

2012-04-02T08:33:41+00:00

These macros contain a hidden goto, and are thus extremely error
prone and make code hard to audit.

Signed-off-by: David S. Miller

netfilter: ipset: hash:net,iface timeout bug fixed

2012-03-07T16:40:37+00:00

Timed out entries were still matched till the garbage collector
purged them out. The fix is verified in the testsuite.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: Exceptions support added to hash:net types

2012-03-07T16:40:35+00:00

The "nomatch" keyword and option is added to the hash:*net* types,
by which one can add exception entries to sets. Example:

        ipset create test hash:net
        ipset add test 192.168.0/24
        ipset add test 192.168.0/30 nomatch

In this case the IP addresses from 192.168.0/24 except 192.168.0/30
match the elements of the set.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: Log warning when a hash type of set gets full

2012-03-07T16:40:33+00:00

If the set is full, the SET target cannot add more elements.
Log warning so that the admin got notified about it.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: expose userspace-relevant parts in ip_set.h

2012-03-07T16:40:31+00:00

iptables's libxt_SET.c depends on these.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: use NFPROTO_ constants

2012-03-07T16:40:29+00:00

ipset is actually using NFPROTO values rather than AF (xt_set passes
that along).

Signed-off-by: Jan Engelhardt 
Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso