linux.git/include/linux/netfilter/ipset, branch v3.9

netfilter: ipset: hash:net: nomatch flag not excluded on set resize

2013-04-09T19:04:16+00:00

If a resize is triggered the nomatch flag is not excluded at hashing,
which leads to the element missed at lookup in the resized set.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

netfilter: ipset: timeout values corrupted on set resize

2013-02-21T16:34:47+00:00

If a resize is triggered on a set with timeouts enabled, the timeout
values will get corrupted when copying them to the new set. This occured
b/c the wrong timeout value is supplied to type_pf_elem_tadd().

This also adds simple debug statement similar to the one in type_pf_resize().

Signed-off-by: Josh Hunt 
Signed-off-by: Jozsef Kadlecsik

UAPI: Remove empty non-UAPI Kbuild files

2012-10-17T11:31:15+00:00

Remove non-UAPI Kbuild files that have become empty as a result of UAPI
disintegration.  They used to have only header-y lines in them and those have
now moved to the Kbuild files in the corresponding uapi/ directories.

Possibly these should not be removed but rather have a comment inserted to say
they are intentionally left blank.  This would make it easier to add generated
header lines in future without having to restore the infrastructure.

Note that at this point not all the UAPI disintegration parts have been merged,
so it is likely that more empty Kbuild files will turn up.

It is probably necessary to make the files non-empty to prevent the patch
program from automatically deleting them when it reduces them to nothing.

Signed-off-by: David Howells

UAPI: (Scripted) Disintegrate include/linux/netfilter/ipset

2012-10-09T08:48:55+00:00

Signed-off-by: David Howells 
Acked-by: Arnd Bergmann 
Acked-by: Thomas Gleixner 
Acked-by: Michael Kerrisk 
Acked-by: Paul E. McKenney 
Acked-by: Dave Jones

netfilter: ipset: Support to match elements marked with "nomatch"

2012-09-22T20:44:34+00:00

Exceptions can now be matched and we can branch according to the
possible cases:

a. match in the set if the element is not flagged as "nomatch"
b. match in the set if the element is flagged with "nomatch"
c. no match

i.e.

iptables ... -m set --match-set ... -j ...
iptables ... -m set --match-set ... --nomatch-entries -j ...
...

Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: Coding style fixes

2012-09-22T20:44:29+00:00

Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: Include supported revisions in module description

2012-09-22T20:44:24+00:00

Signed-off-by: Jozsef Kadlecsik

netfilter: ipset: Rewrite cidr book keeping to handle /0

2012-09-22T20:43:42+00:00

Signed-off-by: Jozsef Kadlecsik

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2012-05-17T02:17:37+00:00

netfilter: ipset: fix timeout value overflow bug

2012-05-16T22:56:41+00:00

Large timeout parameters could result wrong timeout values due to
an overflow at msec to jiffies conversion (reported by Andreas Herz)

[ This patch was mangled by Pablo Neira Ayuso since David Laight and
  Eric Dumazet noticed that we were using hardcoded 1000 instead of
  MSEC_PER_SEC to calculate the timeout ]

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso