Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b90cb8ba authored by Oliver Smith's avatar Oliver Smith Committed by Jozsef Kadlecsik
Browse files

netfilter: ipset: Support comments in bitmap-type ipsets. 



This provides kernel support for creating bitmap ipsets with comment
support.

As is the case for hashes, this incurs a penalty when flushing or
destroying the entire ipset as the entries must first be walked in order
to free the comment strings. This penalty is of course far less than the
cost of listing an ipset to userspace. Any set created without support
for comments will be flushed/destroyed as before.

Signed-off-by: default avatarOliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>
Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
parent 68b63f08

net/netfilter/ipset/ip_set_bitmap_gen.h

+8 −6
Original line number Diff line number Diff line
@@ -101,12 +101,9 @@ mtype_head(struct ip_set *set, struct sk_buff *skb) 
	    nla_put_net32(skb, IPSET_ATTR_MEMSIZE,

			  htonl(sizeof(*map) +

				map->memsize +

				set->dsize * map->elements)) ||

	    (SET_WITH_TIMEOUT(set) &&

	     nla_put_net32(skb, IPSET_ATTR_TIMEOUT, htonl(set->timeout))) ||

	    (SET_WITH_COUNTER(set) &&

	     nla_put_net32(skb, IPSET_ATTR_CADT_FLAGS,

			   htonl(IPSET_FLAG_WITH_COUNTERS))))

				set->dsize * map->elements)))

		goto nla_put_failure;

	if (unlikely(ip_set_put_flags(skb, set)))

		goto nla_put_failure;

	ipset_nest_end(skb, nested);
@@ -162,6 +159,8 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext, 


	if (SET_WITH_COUNTER(set))

		ip_set_init_counter(ext_counter(x, set), ext);

	if (SET_WITH_COMMENT(set))

		ip_set_init_comment(ext_comment(x, set), ext);

	return 0;

}
@@ -233,6 +232,9 @@ mtype_list(const struct ip_set *set, 
		if (SET_WITH_COUNTER(set) &&

		    ip_set_put_counter(skb, ext_counter(x, set)))

			goto nla_put_failure;

		if (SET_WITH_COMMENT(set) &&

		    ip_set_put_comment(skb, ext_comment(x, set)))

			goto nla_put_failure;

		ipset_nest_end(skb, nested);

	}

	ipset_nest_end(skb, adt);

net/netfilter/ipset/ip_set_bitmap_ip.c

+3 −1
Original line number Diff line number Diff line
@@ -26,7 +26,8 @@ 
#include <linux/netfilter/ipset/ip_set_bitmap.h>



#define IPSET_TYPE_REV_MIN	0

#define IPSET_TYPE_REV_MAX	1	/* Counter support added */

/*				1	   Counter support added */

#define IPSET_TYPE_REV_MAX	2	/* Comment support added */



MODULE_LICENSE("GPL");

MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
@@ -354,6 +355,7 @@ static struct ip_set_type bitmap_ip_type __read_mostly = { 
		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },

		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },

		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },

		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING },

	},

	.me		= THIS_MODULE,

};

net/netfilter/ipset/ip_set_bitmap_ipmac.c

+3 −1
Original line number Diff line number Diff line
@@ -26,7 +26,8 @@ 
#include <linux/netfilter/ipset/ip_set_bitmap.h>



#define IPSET_TYPE_REV_MIN	0

#define IPSET_TYPE_REV_MAX	1	/* Counter support added */

/*				1	   Counter support added */

#define IPSET_TYPE_REV_MAX	2	/* Comment support added */



MODULE_LICENSE("GPL");

MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
@@ -403,6 +404,7 @@ static struct ip_set_type bitmap_ipmac_type = { 
		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },

		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },

		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },

		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING },

	},

	.me		= THIS_MODULE,

};

net/netfilter/ipset/ip_set_bitmap_port.c

+3 −1
Original line number Diff line number Diff line
@@ -21,7 +21,8 @@ 
#include <linux/netfilter/ipset/ip_set_getport.h>



#define IPSET_TYPE_REV_MIN	0

#define IPSET_TYPE_REV_MAX	1	/* Counter support added */

/*				1	   Counter support added */

#define IPSET_TYPE_REV_MAX	2	/* Comment support added */



MODULE_LICENSE("GPL");

MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
@@ -288,6 +289,7 @@ static struct ip_set_type bitmap_port_type = { 
		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },

		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },

		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },

		[IPSET_ATTR_COMMENT]	= { .type = NLA_NUL_STRING },

	},

	.me		= THIS_MODULE,

};