[netfilter-cvslog] r7011 - in
trunk/patch-o-matic-ng/patchlets/set/linux-2.6:
include/linux/netfilter_ipv4 net/ipv4/netfilter
kadlec at blackhole.kfki.hu
kadlec at blackhole.kfki.hu
Tue Aug 28 13:29:12 CEST 2007
Author: kadlec at blackhole.kfki.hu
Date: 2007-08-28 13:29:12 +0200 (Tue, 28 Aug 2007)
New Revision: 7011
Added:
trunk/patch-o-matic-ng/patchlets/set/linux-2.6/include/linux/netfilter_ipv4/ip_set_iptreemap.h
trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_iptreemap.c
Modified:
trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/Kconfig.ladd
trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/Makefile.ladd_2
trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set.c
trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_iphash.c
trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_ipmap.c
trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_ipporthash.c
trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_iptree.c
trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_macipmap.c
trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_nethash.c
trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_portmap.c
trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ipt_SET.c
trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ipt_set.c
Log:
New ipset release: 2.3.0, see ipset changelog
Added: trunk/patch-o-matic-ng/patchlets/set/linux-2.6/include/linux/netfilter_ipv4/ip_set_iptreemap.h
===================================================================
--- trunk/patch-o-matic-ng/patchlets/set/linux-2.6/include/linux/netfilter_ipv4/ip_set_iptreemap.h (rev 0)
+++ trunk/patch-o-matic-ng/patchlets/set/linux-2.6/include/linux/netfilter_ipv4/ip_set_iptreemap.h 2007-08-28 11:29:12 UTC (rev 7011)
@@ -0,0 +1,40 @@
+#ifndef __IP_SET_IPTREEMAP_H
+#define __IP_SET_IPTREEMAP_H
+
+#include <linux/netfilter_ipv4/ip_set.h>
+
+#define SETTYPE_NAME "iptreemap"
+
+#ifdef __KERNEL__
+struct ip_set_iptreemap_d {
+ unsigned char bitmap[32]; /* x.x.x.y */
+};
+
+struct ip_set_iptreemap_c {
+ struct ip_set_iptreemap_d *tree[256]; /* x.x.y.x */
+};
+
+struct ip_set_iptreemap_b {
+ struct ip_set_iptreemap_c *tree[256]; /* x.y.x.x */
+ unsigned char dirty[32];
+};
+#endif
+
+struct ip_set_iptreemap {
+ unsigned int gc_interval;
+#ifdef __KERNEL__
+ struct timer_list gc;
+ struct ip_set_iptreemap_b *tree[256]; /* y.x.x.x */
+#endif
+};
+
+struct ip_set_req_iptreemap_create {
+ unsigned int gc_interval;
+};
+
+struct ip_set_req_iptreemap {
+ ip_set_ip_t start;
+ ip_set_ip_t end;
+};
+
+#endif /* __IP_SET_IPTREEMAP_H */
Modified: trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/Kconfig.ladd
===================================================================
--- trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/Kconfig.ladd 2007-08-28 11:23:22 UTC (rev 7010)
+++ trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/Kconfig.ladd 2007-08-28 11:29:12 UTC (rev 7011)
@@ -87,6 +87,14 @@
To compile it as a module, choose M here. If unsure, say N.
+config IP_NF_SET_IPTREEMAP
+ tristate "iptreemap set support"
+ depends on IP_NF_SET
+ help
+ This option adds the iptreemap set type support.
+
+ To compile it as a module, choose M here. If unsure, say N.
+
config IP_NF_MATCH_SET
tristate "set match support"
depends on IP_NF_SET
Modified: trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/Makefile.ladd_2
===================================================================
--- trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/Makefile.ladd_2 2007-08-28 11:23:22 UTC (rev 7010)
+++ trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/Makefile.ladd_2 2007-08-28 11:29:12 UTC (rev 7011)
@@ -10,3 +10,4 @@
obj-$(CONFIG_IP_NF_SET_NETHASH) += ip_set_nethash.o
obj-$(CONFIG_IP_NF_SET_IPPORTHASH) += ip_set_ipporthash.o
obj-$(CONFIG_IP_NF_SET_IPTREE) += ip_set_iptree.o
+obj-$(CONFIG_IP_NF_SET_IPTREEMAP) += ip_set_iptreemap.o
Modified: trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set.c
===================================================================
--- trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set.c 2007-08-28 11:23:22 UTC (rev 7010)
+++ trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set.c 2007-08-28 11:29:12 UTC (rev 7011)
@@ -1940,7 +1940,7 @@
MODULE_AUTHOR("Jozsef Kadlecsik <kadlec at blackhole.kfki.hu>");
MODULE_DESCRIPTION("module implementing core IP set support");
-static int __init init(void)
+static int __init ip_set_init(void)
{
int res;
ip_set_id_t i;
@@ -1977,7 +1977,7 @@
return 0;
}
-static void __exit fini(void)
+static void __exit ip_set_fini(void)
{
/* There can't be any existing set or binding */
nf_unregister_sockopt(&so_set);
@@ -1997,5 +1997,5 @@
EXPORT_SYMBOL(ip_set_delip_kernel);
EXPORT_SYMBOL(ip_set_testip_kernel);
-module_init(init);
-module_exit(fini);
+module_init(ip_set_init);
+module_exit(ip_set_fini);
Modified: trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_iphash.c
===================================================================
--- trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_iphash.c 2007-08-28 11:23:22 UTC (rev 7010)
+++ trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_iphash.c 2007-08-28 11:29:12 UTC (rev 7011)
@@ -10,6 +10,8 @@
#include <linux/module.h>
#include <linux/ip.h>
#include <linux/skbuff.h>
+#include <linux/version.h>
+#include <linux/jhash.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ip_set.h>
#include <linux/errno.h>
@@ -23,7 +25,6 @@
#include <linux/netfilter_ipv4/ip_set_malloc.h>
#include <linux/netfilter_ipv4/ip_set_iphash.h>
-#include <linux/netfilter_ipv4/ip_set_jhash.h>
static int limit = MAX_RANGE;
@@ -88,8 +89,13 @@
{
return __testip(set,
ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr),
+#endif
hash_ip);
}
@@ -100,7 +106,7 @@
u_int16_t i;
ip_set_ip_t *elem;
- if (!ip || map->elements > limit)
+ if (!ip || map->elements >= limit)
return -ERANGE;
*hash_ip = ip & map->netmask;
@@ -145,8 +151,13 @@
{
return __addip((struct ip_set_iphash *) set->data,
ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr),
+#endif
hash_ip);
}
@@ -268,8 +279,13 @@
{
return __delip(set,
ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr),
+#endif
hash_ip);
}
@@ -398,16 +414,16 @@
module_param(limit, int, 0600);
MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
-static int __init init(void)
+static int __init ip_set_iphash_init(void)
{
return ip_set_register_set_type(&ip_set_iphash);
}
-static void __exit fini(void)
+static void __exit ip_set_iphash_fini(void)
{
/* FIXME: possible race with ip_set_create() */
ip_set_unregister_set_type(&ip_set_iphash);
}
-module_init(init);
-module_exit(fini);
+module_init(ip_set_iphash_init);
+module_exit(ip_set_iphash_fini);
Modified: trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_ipmap.c
===================================================================
--- trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_ipmap.c 2007-08-28 11:23:22 UTC (rev 7010)
+++ trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_ipmap.c 2007-08-28 11:29:12 UTC (rev 7011)
@@ -12,6 +12,7 @@
#include <linux/module.h>
#include <linux/ip.h>
#include <linux/skbuff.h>
+#include <linux/version.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ip_set.h>
#include <linux/errno.h>
@@ -64,17 +65,15 @@
const u_int32_t *flags,
unsigned char index)
{
- int res;
-
- DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
- flags[index] & IPSET_SRC ? "SRC" : "DST",
- NIPQUAD(skb->nh.iph->saddr),
- NIPQUAD(skb->nh.iph->daddr));
-
- res = __testip(set,
- ntohl(flags[index] & IPSET_SRC
+ int res = __testip(set,
+ ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr),
+#endif
hash_ip);
return (res < 0 ? 0 : res);
}
@@ -121,8 +120,13 @@
{
return __addip(set,
ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr),
+#endif
hash_ip);
}
@@ -167,8 +171,13 @@
{
return __delip(set,
ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr),
+#endif
hash_ip);
}
@@ -312,16 +321,16 @@
MODULE_AUTHOR("Jozsef Kadlecsik <kadlec at blackhole.kfki.hu>");
MODULE_DESCRIPTION("ipmap type of IP sets");
-static int __init init(void)
+static int __init ip_set_ipmap_init(void)
{
return ip_set_register_set_type(&ip_set_ipmap);
}
-static void __exit fini(void)
+static void __exit ip_set_ipmap_fini(void)
{
/* FIXME: possible race with ip_set_create() */
ip_set_unregister_set_type(&ip_set_ipmap);
}
-module_init(init);
-module_exit(fini);
+module_init(ip_set_ipmap_init);
+module_exit(ip_set_ipmap_fini);
Modified: trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_ipporthash.c
===================================================================
--- trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_ipporthash.c 2007-08-28 11:23:22 UTC (rev 7010)
+++ trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_ipporthash.c 2007-08-28 11:29:12 UTC (rev 7011)
@@ -12,6 +12,8 @@
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/skbuff.h>
+#include <linux/version.h>
+#include <linux/jhash.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ip_set.h>
#include <linux/errno.h>
@@ -25,7 +27,6 @@
#include <linux/netfilter_ipv4/ip_set_malloc.h>
#include <linux/netfilter_ipv4/ip_set_ipporthash.h>
-#include <linux/netfilter_ipv4/ip_set_jhash.h>
static int limit = MAX_RANGE;
@@ -33,7 +34,11 @@
static inline ip_set_ip_t
get_port(const struct sk_buff *skb, u_int32_t flags)
{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ struct iphdr *iph = ip_hdr(skb);
+#else
struct iphdr *iph = skb->nh.iph;
+#endif
u_int16_t offset = ntohs(iph->frag_off) & IP_OFFSET;
switch (iph->protocol) {
@@ -44,7 +49,11 @@
if (offset)
return INVALID_PORT;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ if (skb_copy_bits(skb, ip_hdr(skb)->ihl*4, &tcph, sizeof(tcph)) < 0)
+#else
if (skb_copy_bits(skb, skb->nh.iph->ihl*4, &tcph, sizeof(tcph)) < 0)
+#endif
/* No choice either */
return INVALID_PORT;
@@ -57,7 +66,11 @@
if (offset)
return INVALID_PORT;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ if (skb_copy_bits(skb, ip_hdr(skb)->ihl*4, &udph, sizeof(udph)) < 0)
+#else
if (skb_copy_bits(skb, skb->nh.iph->ihl*4, &udph, sizeof(udph)) < 0)
+#endif
/* No choice either */
return INVALID_PORT;
@@ -147,8 +160,13 @@
DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
flags[index] & IPSET_SRC ? "SRC" : "DST",
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ NIPQUAD(ip_hdr(skb)->saddr),
+ NIPQUAD(ip_hdr(skb)->daddr));
+#else
NIPQUAD(skb->nh.iph->saddr),
NIPQUAD(skb->nh.iph->daddr));
+#endif
DP("flag %s port %u",
flags[index+1] & IPSET_SRC ? "SRC" : "DST",
port);
@@ -157,8 +175,13 @@
return __testip(set,
ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr),
+#endif
port,
hash_ip);
}
@@ -232,8 +255,13 @@
DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
flags[index] & IPSET_SRC ? "SRC" : "DST",
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ NIPQUAD(ip_hdr(skb)->saddr),
+ NIPQUAD(ip_hdr(skb)->daddr));
+#else
NIPQUAD(skb->nh.iph->saddr),
NIPQUAD(skb->nh.iph->daddr));
+#endif
DP("flag %s port %u",
flags[index+1] & IPSET_SRC ? "SRC" : "DST",
port);
@@ -242,8 +270,13 @@
return __addip((struct ip_set_ipporthash *) set->data,
ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr),
+#endif
port,
hash_ip);
}
@@ -377,8 +410,13 @@
DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
flags[index] & IPSET_SRC ? "SRC" : "DST",
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ NIPQUAD(ip_hdr(skb)->saddr),
+ NIPQUAD(ip_hdr(skb)->daddr));
+#else
NIPQUAD(skb->nh.iph->saddr),
NIPQUAD(skb->nh.iph->daddr));
+#endif
DP("flag %s port %u",
flags[index+1] & IPSET_SRC ? "SRC" : "DST",
port);
@@ -387,8 +425,13 @@
return __delip(set,
ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr),
+#endif
port,
hash_ip);
}
@@ -520,16 +563,16 @@
module_param(limit, int, 0600);
MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
-static int __init init(void)
+static int __init ip_set_ipporthash_init(void)
{
return ip_set_register_set_type(&ip_set_ipporthash);
}
-static void __exit fini(void)
+static void __exit ip_set_ipporthash_fini(void)
{
/* FIXME: possible race with ip_set_create() */
ip_set_unregister_set_type(&ip_set_ipporthash);
}
-module_init(init);
-module_exit(fini);
+module_init(ip_set_ipporthash_init);
+module_exit(ip_set_ipporthash_fini);
Modified: trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_iptree.c
===================================================================
--- trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_iptree.c 2007-08-28 11:23:22 UTC (rev 7010)
+++ trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_iptree.c 2007-08-28 11:29:12 UTC (rev 7011)
@@ -43,12 +43,23 @@
static kmem_cache_t *leaf_cachep;
#endif
+#if defined(__LITTLE_ENDIAN)
#define ABCD(a,b,c,d,addrp) do { \
a = ((unsigned char *)addrp)[3]; \
b = ((unsigned char *)addrp)[2]; \
c = ((unsigned char *)addrp)[1]; \
d = ((unsigned char *)addrp)[0]; \
} while (0)
+#elif defined(__BIG_ENDIAN)
+#define ABCD(a,b,c,d,addrp) do { \
+ a = ((unsigned char *)addrp)[0]; \
+ b = ((unsigned char *)addrp)[1]; \
+ c = ((unsigned char *)addrp)[2]; \
+ d = ((unsigned char *)addrp)[3]; \
+} while (0)
+#else
+#error "Please fix asm/byteorder.h"
+#endif /* __LITTLE_ENDIAN */
#define TESTIP_WALK(map, elem, branch) do { \
if ((map)->tree[elem]) { \
@@ -76,8 +87,9 @@
TESTIP_WALK(btree, b, ctree);
TESTIP_WALK(ctree, c, dtree);
DP("%lu %lu", dtree->expires[d], jiffies);
- return !!(map->timeout ? (time_after(dtree->expires[d], jiffies))
- : dtree->expires[d]);
+ return dtree->expires[d]
+ && (!map->timeout
+ || time_after(dtree->expires[d], jiffies));
}
static int
@@ -107,24 +119,34 @@
DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
flags[index] & IPSET_SRC ? "SRC" : "DST",
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ NIPQUAD(ip_hdr(skb)->saddr),
+ NIPQUAD(ip_hdr(skb)->daddr));
+#else
NIPQUAD(skb->nh.iph->saddr),
NIPQUAD(skb->nh.iph->daddr));
+#endif
res = __testip(set,
ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr),
+#endif
hash_ip);
return (res < 0 ? 0 : res);
}
-#define ADDIP_WALK(map, elem, branch, type, cachep, flags) do { \
+#define ADDIP_WALK(map, elem, branch, type, cachep) do { \
if ((map)->tree[elem]) { \
DP("found %u", elem); \
branch = (map)->tree[elem]; \
} else { \
branch = (type *) \
- kmem_cache_alloc(cachep, flags); \
+ kmem_cache_alloc(cachep, GFP_ATOMIC); \
if (branch == NULL) \
return -ENOMEM; \
memset(branch, 0, sizeof(*branch)); \
@@ -135,8 +157,7 @@
static inline int
__addip(struct ip_set *set, ip_set_ip_t ip, unsigned int timeout,
- ip_set_ip_t *hash_ip,
- unsigned int __nocast flags)
+ ip_set_ip_t *hash_ip)
{
struct ip_set_iptree *map = (struct ip_set_iptree *) set->data;
struct ip_set_iptreeb *btree;
@@ -145,7 +166,7 @@
unsigned char a,b,c,d;
int ret = 0;
- if (!ip || map->elements > limit)
+ if (!ip || map->elements >= limit)
/* We could call the garbage collector
* but it's probably overkill */
return -ERANGE;
@@ -153,14 +174,14 @@
*hash_ip = ip;
ABCD(a, b, c, d, hash_ip);
DP("%u %u %u %u timeout %u", a, b, c, d, timeout);
- ADDIP_WALK(map, a, btree, struct ip_set_iptreeb, branch_cachep, flags);
- ADDIP_WALK(btree, b, ctree, struct ip_set_iptreec, branch_cachep, flags);
- ADDIP_WALK(ctree, c, dtree, struct ip_set_iptreed, leaf_cachep, flags);
+ ADDIP_WALK(map, a, btree, struct ip_set_iptreeb, branch_cachep);
+ ADDIP_WALK(btree, b, ctree, struct ip_set_iptreec, branch_cachep);
+ ADDIP_WALK(ctree, c, dtree, struct ip_set_iptreed, leaf_cachep);
if (dtree->expires[d]
&& (!map->timeout || time_after(dtree->expires[d], jiffies)))
ret = -EEXIST;
dtree->expires[d] = map->timeout ? (timeout * HZ + jiffies) : 1;
- /* Lottery */
+ /* Lottery: I won! */
if (dtree->expires[d] == 0)
dtree->expires[d] = 1;
DP("%u %lu", d, dtree->expires[d]);
@@ -186,8 +207,7 @@
DP("%u.%u.%u.%u %u", HIPQUAD(req->ip), req->timeout);
return __addip(set, req->ip,
req->timeout ? req->timeout : map->timeout,
- hash_ip,
- GFP_ATOMIC);
+ hash_ip);
}
static int
@@ -201,11 +221,15 @@
return __addip(set,
ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr),
+#endif
map->timeout,
- hash_ip,
- GFP_ATOMIC);
+ hash_ip);
}
#define DELIP_WALK(map, elem, branch) do { \
@@ -266,8 +290,13 @@
{
return __delip(set,
ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr),
+#endif
hash_ip);
}
@@ -528,21 +557,33 @@
module_param(limit, int, 0600);
MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
-static int __init init(void)
+static int __init ip_set_iptree_init(void)
{
int ret;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
branch_cachep = kmem_cache_create("ip_set_iptreeb",
sizeof(struct ip_set_iptreeb),
+ 0, 0, NULL);
+#else
+ branch_cachep = kmem_cache_create("ip_set_iptreeb",
+ sizeof(struct ip_set_iptreeb),
0, 0, NULL, NULL);
+#endif
if (!branch_cachep) {
printk(KERN_ERR "Unable to create ip_set_iptreeb slab cache\n");
ret = -ENOMEM;
goto out;
}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
leaf_cachep = kmem_cache_create("ip_set_iptreed",
sizeof(struct ip_set_iptreed),
+ 0, 0, NULL);
+#else
+ leaf_cachep = kmem_cache_create("ip_set_iptreed",
+ sizeof(struct ip_set_iptreed),
0, 0, NULL, NULL);
+#endif
if (!leaf_cachep) {
printk(KERN_ERR "Unable to create ip_set_iptreed slab cache\n");
ret = -ENOMEM;
@@ -559,7 +600,7 @@
return ret;
}
-static void __exit fini(void)
+static void __exit ip_set_iptree_fini(void)
{
/* FIXME: possible race with ip_set_create() */
ip_set_unregister_set_type(&ip_set_iptree);
@@ -567,5 +608,5 @@
kmem_cache_destroy(branch_cachep);
}
-module_init(init);
-module_exit(fini);
+module_init(ip_set_iptree_init);
+module_exit(ip_set_iptree_fini);
Added: trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_iptreemap.c
===================================================================
--- trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_iptreemap.c (rev 0)
+++ trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_iptreemap.c 2007-08-28 11:29:12 UTC (rev 7011)
@@ -0,0 +1,829 @@
+/* Copyright (C) 2007 Sven Wegener <sven.wegener at stealer.net>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ */
+
+/* This modules implements the iptreemap ipset type. It uses bitmaps to
+ * represent every single IPv4 address as a single bit. The bitmaps are managed
+ * in a tree structure, where the first three octets of an addresses are used
+ * as an index to find the bitmap and the last octet is used as the bit number.
+ */
+
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/ip.h>
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ip_set.h>
+#include <linux/errno.h>
+#include <asm/uaccess.h>
+#include <asm/bitops.h>
+#include <linux/spinlock.h>
+
+#include <linux/netfilter_ipv4/ip_set_iptreemap.h>
+
+#define IPTREEMAP_DEFAULT_GC_TIME (5 * 60)
+#define IPTREEMAP_DESTROY_SLEEP (100)
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
+static struct kmem_cache *cachep_b;
+static struct kmem_cache *cachep_c;
+static struct kmem_cache *cachep_d;
+#else
+static kmem_cache_t *cachep_b;
+static kmem_cache_t *cachep_c;
+static kmem_cache_t *cachep_d;
+#endif
+
+static struct ip_set_iptreemap_d *fullbitmap_d;
+static struct ip_set_iptreemap_c *fullbitmap_c;
+static struct ip_set_iptreemap_b *fullbitmap_b;
+
+#if defined(__LITTLE_ENDIAN)
+#define ABCD(a, b, c, d, addr) \
+ do { \
+ a = ((unsigned char *)addr)[3]; \
+ b = ((unsigned char *)addr)[2]; \
+ c = ((unsigned char *)addr)[1]; \
+ d = ((unsigned char *)addr)[0]; \
+ } while (0)
+#elif defined(__BIG_ENDIAN)
+#define ABCD(a,b,c,d,addrp) do { \
+ a = ((unsigned char *)addrp)[0]; \
+ b = ((unsigned char *)addrp)[1]; \
+ c = ((unsigned char *)addrp)[2]; \
+ d = ((unsigned char *)addrp)[3]; \
+} while (0)
+#else
+#error "Please fix asm/byteorder.h"
+#endif /* __LITTLE_ENDIAN */
+
+#define TESTIP_WALK(map, elem, branch, full) \
+ do { \
+ branch = (map)->tree[elem]; \
+ if (!branch) \
+ return 0; \
+ else if (branch == full) \
+ return 1; \
+ } while (0)
+
+#define ADDIP_WALK(map, elem, branch, type, cachep, full) \
+ do { \
+ branch = (map)->tree[elem]; \
+ if (!branch) { \
+ branch = (type *) kmem_cache_alloc(cachep, GFP_ATOMIC); \
+ if (!branch) \
+ return -ENOMEM; \
+ memset(branch, 0, sizeof(*branch)); \
+ (map)->tree[elem] = branch; \
+ } else if (branch == full) { \
+ return -EEXIST; \
+ } \
+ } while (0)
+
+#define ADDIP_RANGE_LOOP(map, a, a1, a2, hint, branch, full, cachep, free) \
+ for (a = a1; a <= a2; a++) { \
+ branch = (map)->tree[a]; \
+ if (branch != full) { \
+ if ((a > a1 && a < a2) || (hint)) { \
+ if (branch) \
+ free(branch); \
+ (map)->tree[a] = full; \
+ continue; \
+ } else if (!branch) { \
+ branch = kmem_cache_alloc(cachep, GFP_ATOMIC); \
+ if (!branch) \
+ return -ENOMEM; \
+ memset(branch, 0, sizeof(*branch)); \
+ (map)->tree[a] = branch; \
+ }
+
+#define ADDIP_RANGE_LOOP_END() \
+ } \
+ }
+
+#define DELIP_WALK(map, elem, branch, cachep, full, flags) \
+ do { \
+ branch = (map)->tree[elem]; \
+ if (!branch) { \
+ return -EEXIST; \
+ } else if (branch == full) { \
+ branch = kmem_cache_alloc(cachep, flags); \
+ if (!branch) \
+ return -ENOMEM; \
+ memcpy(branch, full, sizeof(*full)); \
+ (map)->tree[elem] = branch; \
+ } \
+ } while (0)
+
+#define DELIP_RANGE_LOOP(map, a, a1, a2, hint, branch, full, cachep, free, flags) \
+ for (a = a1; a <= a2; a++) { \
+ branch = (map)->tree[a]; \
+ if (branch) { \
+ if ((a > a1 && a < a2) || (hint)) { \
+ if (branch != full) \
+ free(branch); \
+ (map)->tree[a] = NULL; \
+ continue; \
+ } else if (branch == full) { \
+ branch = kmem_cache_alloc(cachep, flags); \
+ if (!branch) \
+ return -ENOMEM; \
+ memcpy(branch, full, sizeof(*branch)); \
+ (map)->tree[a] = branch; \
+ }
+
+#define DELIP_RANGE_LOOP_END() \
+ } \
+ }
+
+#define LOOP_WALK_BEGIN(map, i, branch) \
+ for (i = 0; i < 256; i++) { \
+ branch = (map)->tree[i]; \
+ if (likely(!branch)) \
+ continue;
+
+#define LOOP_WALK_END() \
+ }
+
+#define LOOP_WALK_BEGIN_GC(map, i, branch, full, cachep, count) \
+ count = -256; \
+ for (i = 0; i < 256; i++) { \
+ branch = (map)->tree[i]; \
+ if (likely(!branch)) \
+ continue; \
+ count++; \
+ if (branch == full) { \
+ count++; \
+ continue; \
+ }
+
+#define LOOP_WALK_END_GC(map, i, branch, full, cachep, count) \
+ if (-256 == count) { \
+ kmem_cache_free(cachep, branch); \
+ (map)->tree[i] = NULL; \
+ } else if (256 == count) { \
+ kmem_cache_free(cachep, branch); \
+ (map)->tree[i] = full; \
+ } \
+ }
+
+#define LOOP_WALK_BEGIN_COUNT(map, i, branch, inrange, count) \
+ for (i = 0; i < 256; i++) { \
+ if (!(map)->tree[i]) { \
+ if (inrange) { \
+ count++; \
+ inrange = 0; \
+ } \
+ continue; \
+ } \
+ branch = (map)->tree[i];
+
+#define LOOP_WALK_END_COUNT() \
+ }
+
+#define MIN(a, b) (a < b ? a : b)
+#define MAX(a, b) (a > b ? a : b)
+
+#define GETVALUE1(a, a1, b1, r) \
+ (a == a1 ? b1 : r)
+
+#define GETVALUE2(a, b, a1, b1, c1, r) \
+ (a == a1 && b == b1 ? c1 : r)
+
+#define GETVALUE3(a, b, c, a1, b1, c1, d1, r) \
+ (a == a1 && b == b1 && c == c1 ? d1 : r)
+
+#define CHECK1(a, a1, a2, b1, b2, c1, c2, d1, d2) \
+ ( \
+ GETVALUE1(a, a1, b1, 0) == 0 \
+ && GETVALUE1(a, a2, b2, 255) == 255 \
+ && c1 == 0 \
+ && c2 == 255 \
+ && d1 == 0 \
+ && d2 == 255 \
+ )
+
+#define CHECK2(a, b, a1, a2, b1, b2, c1, c2, d1, d2) \
+ ( \
+ GETVALUE2(a, b, a1, b1, c1, 0) == 0 \
+ && GETVALUE2(a, b, a2, b2, c2, 255) == 255 \
+ && d1 == 0 \
+ && d2 == 255 \
+ )
+
+#define CHECK3(a, b, c, a1, a2, b1, b2, c1, c2, d1, d2) \
+ ( \
+ GETVALUE3(a, b, c, a1, b1, c1, d1, 0) == 0 \
+ && GETVALUE3(a, b, c, a2, b2, c2, d2, 255) == 255 \
+ )
+
+
+static inline void
+free_d(struct ip_set_iptreemap_d *map)
+{
+ kmem_cache_free(cachep_d, map);
+}
+
+static inline void
+free_c(struct ip_set_iptreemap_c *map)
+{
+ struct ip_set_iptreemap_d *dtree;
+ unsigned int i;
+
+ LOOP_WALK_BEGIN(map, i, dtree) {
+ if (dtree != fullbitmap_d)
+ free_d(dtree);
+ } LOOP_WALK_END();
+
+ kmem_cache_free(cachep_c, map);
+}
+
+static inline void
+free_b(struct ip_set_iptreemap_b *map)
+{
+ struct ip_set_iptreemap_c *ctree;
+ unsigned int i;
+
+ LOOP_WALK_BEGIN(map, i, ctree) {
+ if (ctree != fullbitmap_c)
+ free_c(ctree);
+ } LOOP_WALK_END();
+
+ kmem_cache_free(cachep_b, map);
+}
+
+static inline int
+__testip(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
+{
+ struct ip_set_iptreemap *map = (struct ip_set_iptreemap *) set->data;
+ struct ip_set_iptreemap_b *btree;
+ struct ip_set_iptreemap_c *ctree;
+ struct ip_set_iptreemap_d *dtree;
+ unsigned char a, b, c, d;
+
+ *hash_ip = ip;
+
+ ABCD(a, b, c, d, hash_ip);
+
+ TESTIP_WALK(map, a, btree, fullbitmap_b);
+ TESTIP_WALK(btree, b, ctree, fullbitmap_c);
+ TESTIP_WALK(ctree, c, dtree, fullbitmap_d);
+
+ return !!test_bit(d, (void *) dtree->bitmap);
+}
+
+static int
+testip(struct ip_set *set, const void *data, size_t size, ip_set_ip_t *hash_ip)
+{
+ struct ip_set_req_iptreemap *req = (struct ip_set_req_iptreemap *) data;
+
+ if (size != sizeof(struct ip_set_req_iptreemap)) {
+ ip_set_printk("data length wrong (want %zu, have %zu)", sizeof(struct ip_set_req_iptreemap), size);
+ return -EINVAL;
+ }
+
+ return __testip(set, req->start, hash_ip);
+}
+
+static int
+testip_kernel(struct ip_set *set, const struct sk_buff *skb, ip_set_ip_t *hash_ip, const u_int32_t *flags, unsigned char index)
+{
+ int res;
+
+ res = __testip(set,
+ ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
+ ? skb->nh.iph->saddr
+ : skb->nh.iph->daddr),
+#endif
+ hash_ip);
+
+ return (res < 0 ? 0 : res);
+}
+
+static inline int
+__addip_single(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip)
+{
+ struct ip_set_iptreemap *map = (struct ip_set_iptreemap *) set->data;
+ struct ip_set_iptreemap_b *btree;
+ struct ip_set_iptreemap_c *ctree;
+ struct ip_set_iptreemap_d *dtree;
+ unsigned char a, b, c, d;
+
+ *hash_ip = ip;
+
+ ABCD(a, b, c, d, hash_ip);
+
+ ADDIP_WALK(map, a, btree, struct ip_set_iptreemap_b, cachep_b, fullbitmap_b);
+ ADDIP_WALK(btree, b, ctree, struct ip_set_iptreemap_c, cachep_c, fullbitmap_c);
+ ADDIP_WALK(ctree, c, dtree, struct ip_set_iptreemap_d, cachep_d, fullbitmap_d);
+
+ if (test_and_set_bit(d, (void *) dtree->bitmap))
+ return -EEXIST;
+
+ set_bit(b, (void *) btree->dirty);
+
+ return 0;
+}
+
+static inline int
+__addip_range(struct ip_set *set, ip_set_ip_t start, ip_set_ip_t end, ip_set_ip_t *hash_ip)
+{
+ struct ip_set_iptreemap *map = (struct ip_set_iptreemap *) set->data;
+ struct ip_set_iptreemap_b *btree;
+ struct ip_set_iptreemap_c *ctree;
+ struct ip_set_iptreemap_d *dtree;
+ unsigned int a, b, c, d;
+ unsigned char a1, b1, c1, d1;
+ unsigned char a2, b2, c2, d2;
+
+ if (start == end)
+ return __addip_single(set, start, hash_ip);
+
+ *hash_ip = start;
+
+ ABCD(a1, b1, c1, d1, &start);
+ ABCD(a2, b2, c2, d2, &end);
+
+ /* This is sooo ugly... */
+ ADDIP_RANGE_LOOP(map, a, a1, a2, CHECK1(a, a1, a2, b1, b2, c1, c2, d1, d2), btree, fullbitmap_b, cachep_b, free_b) {
+ ADDIP_RANGE_LOOP(btree, b, GETVALUE1(a, a1, b1, 0), GETVALUE1(a, a2, b2, 255), CHECK2(a, b, a1, a2, b1, b2, c1, c2, d1, d2), ctree, fullbitmap_c, cachep_c, free_c) {
+ ADDIP_RANGE_LOOP(ctree, c, GETVALUE2(a, b, a1, b1, c1, 0), GETVALUE2(a, b, a2, b2, c2, 255), CHECK3(a, b, c, a1, a2, b1, b2, c1, c2, d1, d2), dtree, fullbitmap_d, cachep_d, free_d) {
+ for (d = GETVALUE3(a, b, c, a1, b1, c1, d1, 0); d <= GETVALUE3(a, b, c, a2, b2, c2, d2, 255); d++)
+ set_bit(d, (void *) dtree->bitmap);
+ set_bit(b, (void *) btree->dirty);
+ } ADDIP_RANGE_LOOP_END();
+ } ADDIP_RANGE_LOOP_END();
+ } ADDIP_RANGE_LOOP_END();
+
+ return 0;
+}
+
+static int
+addip(struct ip_set *set, const void *data, size_t size, ip_set_ip_t *hash_ip)
+{
+ struct ip_set_req_iptreemap *req = (struct ip_set_req_iptreemap *) data;
+
+ if (size != sizeof(struct ip_set_req_iptreemap)) {
+ ip_set_printk("data length wrong (want %zu, have %zu)", sizeof(struct ip_set_req_iptreemap), size);
+ return -EINVAL;
+ }
+
+ return __addip_range(set, MIN(req->start, req->end), MAX(req->start, req->end), hash_ip);
+}
+
+static int
+addip_kernel(struct ip_set *set, const struct sk_buff *skb, ip_set_ip_t *hash_ip, const u_int32_t *flags, unsigned char index)
+{
+
+ return __addip_single(set,
+ ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
+ ? skb->nh.iph->saddr
+ : skb->nh.iph->daddr),
+#endif
+ hash_ip);
+}
+
+static inline int
+__delip_single(struct ip_set *set, ip_set_ip_t ip, ip_set_ip_t *hash_ip, unsigned int __nocast flags)
+{
+ struct ip_set_iptreemap *map = (struct ip_set_iptreemap *) set->data;
+ struct ip_set_iptreemap_b *btree;
+ struct ip_set_iptreemap_c *ctree;
+ struct ip_set_iptreemap_d *dtree;
+ unsigned char a,b,c,d;
+
+ *hash_ip = ip;
+
+ ABCD(a, b, c, d, hash_ip);
+
+ DELIP_WALK(map, a, btree, cachep_b, fullbitmap_b, flags);
+ DELIP_WALK(btree, b, ctree, cachep_c, fullbitmap_c, flags);
+ DELIP_WALK(ctree, c, dtree, cachep_d, fullbitmap_d, flags);
+
+ if (!test_and_clear_bit(d, (void *) dtree->bitmap))
+ return -EEXIST;
+
+ set_bit(b, (void *) btree->dirty);
+
+ return 0;
+}
+
+static inline int
+__delip_range(struct ip_set *set, ip_set_ip_t start, ip_set_ip_t end, ip_set_ip_t *hash_ip, unsigned int __nocast flags)
+{
+ struct ip_set_iptreemap *map = (struct ip_set_iptreemap *) set->data;
+ struct ip_set_iptreemap_b *btree;
+ struct ip_set_iptreemap_c *ctree;
+ struct ip_set_iptreemap_d *dtree;
+ unsigned int a, b, c, d;
+ unsigned char a1, b1, c1, d1;
+ unsigned char a2, b2, c2, d2;
+
+ if (start == end)
+ return __delip_single(set, start, hash_ip, flags);
+
+ *hash_ip = start;
+
+ ABCD(a1, b1, c1, d1, &start);
+ ABCD(a2, b2, c2, d2, &end);
+
+ /* This is sooo ugly... */
+ DELIP_RANGE_LOOP(map, a, a1, a2, CHECK1(a, a1, a2, b1, b2, c1, c2, d1, d2), btree, fullbitmap_b, cachep_b, free_b, flags) {
+ DELIP_RANGE_LOOP(btree, b, GETVALUE1(a, a1, b1, 0), GETVALUE1(a, a2, b2, 255), CHECK2(a, b, a1, a2, b1, b2, c1, c2, d1, d2), ctree, fullbitmap_c, cachep_c, free_c, flags) {
+ DELIP_RANGE_LOOP(ctree, c, GETVALUE2(a, b, a1, b1, c1, 0), GETVALUE2(a, b, a2, b2, c2, 255), CHECK3(a, b, c, a1, a2, b1, b2, c1, c2, d1, d2), dtree, fullbitmap_d, cachep_d, free_d, flags) {
+ for (d = GETVALUE3(a, b, c, a1, b1, c1, d1, 0); d <= GETVALUE3(a, b, c, a2, b2, c2, d2, 255); d++)
+ clear_bit(d, (void *) dtree->bitmap);
+ set_bit(b, (void *) btree->dirty);
+ } DELIP_RANGE_LOOP_END();
+ } DELIP_RANGE_LOOP_END();
+ } DELIP_RANGE_LOOP_END();
+
+ return 0;
+}
+
+static int
+delip(struct ip_set *set, const void *data, size_t size, ip_set_ip_t *hash_ip)
+{
+ struct ip_set_req_iptreemap *req = (struct ip_set_req_iptreemap *) data;
+
+ if (size != sizeof(struct ip_set_req_iptreemap)) {
+ ip_set_printk("data length wrong (want %zu, have %zu)", sizeof(struct ip_set_req_iptreemap), size);
+ return -EINVAL;
+ }
+
+ return __delip_range(set, MIN(req->start, req->end), MAX(req->start, req->end), hash_ip, GFP_KERNEL);
+}
+
+static int
+delip_kernel(struct ip_set *set, const struct sk_buff *skb, ip_set_ip_t *hash_ip, const u_int32_t *flags, unsigned char index)
+{
+ return __delip_single(set,
+ ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
+ ? skb->nh.iph->saddr
+ : skb->nh.iph->daddr),
+#endif
+ hash_ip,
+ GFP_ATOMIC);
+}
+
+/* Check the status of the bitmap
+ * -1 == all bits cleared
+ * 1 == all bits set
+ * 0 == anything else
+ */
+static inline int
+bitmap_status(struct ip_set_iptreemap_d *dtree)
+{
+ unsigned char first = dtree->bitmap[0];
+ int a;
+
+ for (a = 1; a < 32; a++)
+ if (dtree->bitmap[a] != first)
+ return 0;
+
+ return (first == 0 ? -1 : (first == 255 ? 1 : 0));
+}
+
+static void
+gc(unsigned long addr)
+{
+ struct ip_set *set = (struct ip_set *) addr;
+ struct ip_set_iptreemap *map = (struct ip_set_iptreemap *) set->data;
+ struct ip_set_iptreemap_b *btree;
+ struct ip_set_iptreemap_c *ctree;
+ struct ip_set_iptreemap_d *dtree;
+ unsigned int a, b, c;
+ int i, j, k;
+
+ write_lock_bh(&set->lock);
+
+ LOOP_WALK_BEGIN_GC(map, a, btree, fullbitmap_b, cachep_b, i) {
+ LOOP_WALK_BEGIN_GC(btree, b, ctree, fullbitmap_c, cachep_c, j) {
+ if (!test_and_clear_bit(b, (void *) btree->dirty))
+ continue;
+ LOOP_WALK_BEGIN_GC(ctree, c, dtree, fullbitmap_d, cachep_d, k) {
+ switch (bitmap_status(dtree)) {
+ case -1:
+ kmem_cache_free(cachep_d, dtree);
+ ctree->tree[c] = NULL;
+ k--;
+ break;
+ case 1:
+ kmem_cache_free(cachep_d, dtree);
+ ctree->tree[c] = fullbitmap_d;
+ k++;
+ break;
+ }
+ } LOOP_WALK_END();
+ } LOOP_WALK_END_GC(btree, b, ctree, fullbitmap_c, cachep_c, k);
+ } LOOP_WALK_END_GC(map, a, btree, fullbitmap_b, cachep_b, j);
+
+ write_unlock_bh(&set->lock);
+
+ map->gc.expires = jiffies + map->gc_interval * HZ;
+ add_timer(&map->gc);
+}
+
+static inline void
+init_gc_timer(struct ip_set *set)
+{
+ struct ip_set_iptreemap *map = (struct ip_set_iptreemap *) set->data;
+
+ init_timer(&map->gc);
+ map->gc.data = (unsigned long) set;
+ map->gc.function = gc;
+ map->gc.expires = jiffies + map->gc_interval * HZ;
+ add_timer(&map->gc);
+}
+
+static int create(struct ip_set *set, const void *data, size_t size)
+{
+ struct ip_set_req_iptreemap_create *req = (struct ip_set_req_iptreemap_create *) data;
+ struct ip_set_iptreemap *map;
+
+ if (size != sizeof(struct ip_set_req_iptreemap_create)) {
+ ip_set_printk("data length wrong (want %zu, have %zu)", sizeof(struct ip_set_req_iptreemap_create), size);
+ return -EINVAL;
+ }
+
+ map = kzalloc(sizeof(*map), GFP_KERNEL);
+ if (!map)
+ return -ENOMEM;
+
+ map->gc_interval = req->gc_interval ? req->gc_interval : IPTREEMAP_DEFAULT_GC_TIME;
+ set->data = map;
+
+ init_gc_timer(set);
+
+ return 0;
+}
+
+static inline void __flush(struct ip_set_iptreemap *map)
+{
+ struct ip_set_iptreemap_b *btree;
+ unsigned int a;
+
+ LOOP_WALK_BEGIN(map, a, btree);
+ if (btree != fullbitmap_b)
+ free_b(btree);
+ LOOP_WALK_END();
+}
+
+static void destroy(struct ip_set *set)
+{
+ struct ip_set_iptreemap *map = (struct ip_set_iptreemap *) set->data;
+
+ while (!del_timer(&map->gc))
+ msleep(IPTREEMAP_DESTROY_SLEEP);
+
+ __flush(map);
+ kfree(map);
+
+ set->data = NULL;
+}
+
+static void flush(struct ip_set *set)
+{
+ struct ip_set_iptreemap *map = (struct ip_set_iptreemap *) set->data;
+
+ while (!del_timer(&map->gc))
+ msleep(IPTREEMAP_DESTROY_SLEEP);
+
+ __flush(map);
+
+ memset(map, 0, sizeof(*map));
+
+ init_gc_timer(set);
+}
+
+static void list_header(const struct ip_set *set, void *data)
+{
+ struct ip_set_iptreemap *map = (struct ip_set_iptreemap *) set->data;
+ struct ip_set_req_iptreemap_create *header = (struct ip_set_req_iptreemap_create *) data;
+
+ header->gc_interval = map->gc_interval;
+}
+
+static int list_members_size(const struct ip_set *set)
+{
+ struct ip_set_iptreemap *map = (struct ip_set_iptreemap *) set->data;
+ struct ip_set_iptreemap_b *btree;
+ struct ip_set_iptreemap_c *ctree;
+ struct ip_set_iptreemap_d *dtree;
+ unsigned int a, b, c, d, inrange = 0, count = 0;
+
+ LOOP_WALK_BEGIN_COUNT(map, a, btree, inrange, count) {
+ LOOP_WALK_BEGIN_COUNT(btree, b, ctree, inrange, count) {
+ LOOP_WALK_BEGIN_COUNT(ctree, c, dtree, inrange, count) {
+ for (d = 0; d < 256; d++) {
+ if (test_bit(d, (void *) dtree->bitmap)) {
+ inrange = 1;
+ } else if (inrange) {
+ count++;
+ inrange = 0;
+ }
+ }
+ } LOOP_WALK_END_COUNT();
+ } LOOP_WALK_END_COUNT();
+ } LOOP_WALK_END_COUNT();
+
+ if (inrange)
+ count++;
+
+ return (count * sizeof(struct ip_set_req_iptreemap));
+}
+
+static inline size_t add_member(void *data, size_t offset, ip_set_ip_t start, ip_set_ip_t end)
+{
+ struct ip_set_req_iptreemap *entry = (struct ip_set_req_iptreemap *) (data + offset);
+
+ entry->start = start;
+ entry->end = end;
+
+ return sizeof(*entry);
+}
+
+static void list_members(const struct ip_set *set, void *data)
+{
+ struct ip_set_iptreemap *map = (struct ip_set_iptreemap *) set->data;
+ struct ip_set_iptreemap_b *btree;
+ struct ip_set_iptreemap_c *ctree;
+ struct ip_set_iptreemap_d *dtree;
+ unsigned int a, b, c, d, inrange = 0;
+ size_t offset = 0;
+ ip_set_ip_t start = 0, end = 0, ip;
+
+ LOOP_WALK_BEGIN(map, a, btree) {
+ LOOP_WALK_BEGIN(btree, b, ctree) {
+ LOOP_WALK_BEGIN(ctree, c, dtree) {
+ for (d = 0; d < 256; d++) {
+ if (test_bit(d, (void *) dtree->bitmap)) {
+ ip = ((a << 24) | (b << 16) | (c << 8) | d);
+ if (!inrange) {
+ inrange = 1;
+ start = ip;
+ } else if (end < ip - 1) {
+ offset += add_member(data, offset, start, end);
+ start = ip;
+ }
+ end = ip;
+ } else if (inrange) {
+ offset += add_member(data, offset, start, end);
+ inrange = 0;
+ }
+ }
+ } LOOP_WALK_END();
+ } LOOP_WALK_END();
+ } LOOP_WALK_END();
+
+ if (inrange)
+ add_member(data, offset, start, end);
+}
+
+static struct ip_set_type ip_set_iptreemap = {
+ .typename = SETTYPE_NAME,
+ .features = IPSET_TYPE_IP | IPSET_DATA_SINGLE,
+ .protocol_version = IP_SET_PROTOCOL_VERSION,
+ .create = create,
+ .destroy = destroy,
+ .flush = flush,
+ .reqsize = sizeof(struct ip_set_req_iptreemap),
+ .addip = addip,
+ .addip_kernel = addip_kernel,
+ .delip = delip,
+ .delip_kernel = delip_kernel,
+ .testip = testip,
+ .testip_kernel = testip_kernel,
+ .header_size = sizeof(struct ip_set_req_iptreemap_create),
+ .list_header = list_header,
+ .list_members_size = list_members_size,
+ .list_members = list_members,
+ .me = THIS_MODULE,
+};
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Sven Wegener <sven.wegener at stealer.net>");
+MODULE_DESCRIPTION("iptreemap type of IP sets");
+
+static int __init ip_set_iptreemap_init(void)
+{
+ int ret = -ENOMEM;
+ int a;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
+ cachep_b = kmem_cache_create("ip_set_iptreemap_b",
+ sizeof(struct ip_set_iptreemap_b),
+ 0, 0, NULL);
+#else
+ cachep_b = kmem_cache_create("ip_set_iptreemap_b",
+ sizeof(struct ip_set_iptreemap_b),
+ 0, 0, NULL, NULL);
+#endif
+ if (!cachep_b) {
+ ip_set_printk("Unable to create ip_set_iptreemap_b slab cache");
+ goto out;
+ }
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
+ cachep_c = kmem_cache_create("ip_set_iptreemap_c",
+ sizeof(struct ip_set_iptreemap_c),
+ 0, 0, NULL);
+#else
+ cachep_c = kmem_cache_create("ip_set_iptreemap_c",
+ sizeof(struct ip_set_iptreemap_c),
+ 0, 0, NULL, NULL);
+#endif
+ if (!cachep_c) {
+ ip_set_printk("Unable to create ip_set_iptreemap_c slab cache");
+ goto outb;
+ }
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
+ cachep_d = kmem_cache_create("ip_set_iptreemap_d",
+ sizeof(struct ip_set_iptreemap_d),
+ 0, 0, NULL);
+#else
+ cachep_d = kmem_cache_create("ip_set_iptreemap_d",
+ sizeof(struct ip_set_iptreemap_d),
+ 0, 0, NULL, NULL);
+#endif
+ if (!cachep_d) {
+ ip_set_printk("Unable to create ip_set_iptreemap_d slab cache");
+ goto outc;
+ }
+
+ fullbitmap_d = kmem_cache_alloc(cachep_d, GFP_KERNEL);
+ if (!fullbitmap_d)
+ goto outd;
+
+ fullbitmap_c = kmem_cache_alloc(cachep_c, GFP_KERNEL);
+ if (!fullbitmap_c)
+ goto outbitmapd;
+
+ fullbitmap_b = kmem_cache_alloc(cachep_b, GFP_KERNEL);
+ if (!fullbitmap_b)
+ goto outbitmapc;
+
+ ret = ip_set_register_set_type(&ip_set_iptreemap);
+ if (0 > ret)
+ goto outbitmapb;
+
+ /* Now init our global bitmaps */
+ memset(fullbitmap_d->bitmap, 0xff, sizeof(fullbitmap_d->bitmap));
+
+ for (a = 0; a < 256; a++)
+ fullbitmap_c->tree[a] = fullbitmap_d;
+
+ for (a = 0; a < 256; a++)
+ fullbitmap_b->tree[a] = fullbitmap_c;
+ memset(fullbitmap_b->dirty, 0, sizeof(fullbitmap_b->dirty));
+
+ return 0;
+
+outbitmapb:
+ kmem_cache_free(cachep_b, fullbitmap_b);
+outbitmapc:
+ kmem_cache_free(cachep_c, fullbitmap_c);
+outbitmapd:
+ kmem_cache_free(cachep_d, fullbitmap_d);
+outd:
+ kmem_cache_destroy(cachep_d);
+outc:
+ kmem_cache_destroy(cachep_c);
+outb:
+ kmem_cache_destroy(cachep_b);
+out:
+
+ return ret;
+}
+
+static void __exit ip_set_iptreemap_fini(void)
+{
+ ip_set_unregister_set_type(&ip_set_iptreemap);
+ kmem_cache_free(cachep_d, fullbitmap_d);
+ kmem_cache_free(cachep_c, fullbitmap_c);
+ kmem_cache_free(cachep_b, fullbitmap_b);
+ kmem_cache_destroy(cachep_d);
+ kmem_cache_destroy(cachep_c);
+ kmem_cache_destroy(cachep_b);
+}
+
+module_init(ip_set_iptreemap_init);
+module_exit(ip_set_iptreemap_fini);
Modified: trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_macipmap.c
===================================================================
--- trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_macipmap.c 2007-08-28 11:23:22 UTC (rev 7010)
+++ trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_macipmap.c 2007-08-28 11:29:12 UTC (rev 7011)
@@ -13,6 +13,7 @@
#include <linux/module.h>
#include <linux/ip.h>
#include <linux/skbuff.h>
+#include <linux/version.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ip_set.h>
#include <linux/errno.h>
@@ -69,12 +70,13 @@
ip_set_ip_t ip;
ip = ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr);
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr);
- DP("flag: %s src: %u.%u.%u.%u dst: %u.%u.%u.%u",
- flags[index] & IPSET_SRC ? "SRC" : "DST",
- NIPQUAD(skb->nh.iph->saddr),
- NIPQUAD(skb->nh.iph->daddr));
+#endif
if (ip < map->first_ip || ip > map->last_ip)
return 0;
@@ -86,8 +88,13 @@
(void *) &table[ip - map->first_ip].flags)) {
/* Is mac pointer valid?
* If so, compare... */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ return (skb_mac_header(skb) >= skb->head
+ && (skb_mac_header(skb) + ETH_HLEN) <= skb->data
+#else
return (skb->mac.raw >= skb->head
&& (skb->mac.raw + ETH_HLEN) <= skb->data
+#endif
&& (memcmp(eth_hdr(skb)->h_source,
&table[ip - map->first_ip].ethernet,
ETH_ALEN) == 0));
@@ -144,11 +151,21 @@
ip_set_ip_t ip;
ip = ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr);
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr);
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ if (!(skb_mac_header(skb) >= skb->head
+ && (skb_mac_header(skb) + ETH_HLEN) <= skb->data))
+#else
if (!(skb->mac.raw >= skb->head
&& (skb->mac.raw + ETH_HLEN) <= skb->data))
+#endif
return -EINVAL;
return __addip(set, ip, eth_hdr(skb)->h_source, hash_ip);
@@ -198,8 +215,13 @@
{
return __delip(set,
ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr),
+#endif
hash_ip);
}
@@ -337,17 +359,17 @@
MODULE_AUTHOR("Jozsef Kadlecsik <kadlec at blackhole.kfki.hu>");
MODULE_DESCRIPTION("macipmap type of IP sets");
-static int __init init(void)
+static int __init ip_set_macipmap_init(void)
{
init_max_malloc_size();
return ip_set_register_set_type(&ip_set_macipmap);
}
-static void __exit fini(void)
+static void __exit ip_set_macipmap_fini(void)
{
/* FIXME: possible race with ip_set_create() */
ip_set_unregister_set_type(&ip_set_macipmap);
}
-module_init(init);
-module_exit(fini);
+module_init(ip_set_macipmap_init);
+module_exit(ip_set_macipmap_fini);
Modified: trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_nethash.c
===================================================================
--- trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_nethash.c 2007-08-28 11:23:22 UTC (rev 7010)
+++ trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_nethash.c 2007-08-28 11:29:12 UTC (rev 7011)
@@ -10,6 +10,8 @@
#include <linux/module.h>
#include <linux/ip.h>
#include <linux/skbuff.h>
+#include <linux/version.h>
+#include <linux/jhash.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ip_set.h>
#include <linux/errno.h>
@@ -23,7 +25,6 @@
#include <linux/netfilter_ipv4/ip_set_malloc.h>
#include <linux/netfilter_ipv4/ip_set_nethash.h>
-#include <linux/netfilter_ipv4/ip_set_jhash.h>
static int limit = MAX_RANGE;
@@ -111,8 +112,13 @@
{
return __testip(set,
ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr),
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr),
+#endif
hash_ip);
}
@@ -142,7 +148,7 @@
__addip(struct ip_set_nethash *map, ip_set_ip_t ip, unsigned char cidr,
ip_set_ip_t *hash_ip)
{
- if (!ip || map->elements > limit)
+ if (!ip || map->elements >= limit)
return -ERANGE;
*hash_ip = pack(ip, cidr);
@@ -204,8 +210,13 @@
struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
int ret = -ERANGE;
ip_set_ip_t ip = ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr);
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr);
+#endif
if (map->cidr[0])
ret = __addip(map, ip, map->cidr[0], hash_ip);
@@ -333,8 +344,13 @@
struct ip_set_nethash *map = (struct ip_set_nethash *) set->data;
int ret = -ERANGE;
ip_set_ip_t ip = ntohl(flags[index] & IPSET_SRC
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ ? ip_hdr(skb)->saddr
+ : ip_hdr(skb)->daddr);
+#else
? skb->nh.iph->saddr
: skb->nh.iph->daddr);
+#endif
if (map->cidr[0])
ret = __delip(map, ip, map->cidr[0], hash_ip);
@@ -466,16 +482,16 @@
module_param(limit, int, 0600);
MODULE_PARM_DESC(limit, "maximal number of elements stored in the sets");
-static int __init init(void)
+static int __init ip_set_nethash_init(void)
{
return ip_set_register_set_type(&ip_set_nethash);
}
-static void __exit fini(void)
+static void __exit ip_set_nethash_fini(void)
{
/* FIXME: possible race with ip_set_create() */
ip_set_unregister_set_type(&ip_set_nethash);
}
-module_init(init);
-module_exit(fini);
+module_init(ip_set_nethash_init);
+module_exit(ip_set_nethash_fini);
Modified: trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_portmap.c
===================================================================
--- trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_portmap.c 2007-08-28 11:23:22 UTC (rev 7010)
+++ trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ip_set_portmap.c 2007-08-28 11:29:12 UTC (rev 7011)
@@ -12,6 +12,7 @@
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/skbuff.h>
+#include <linux/version.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ip_set.h>
#include <linux/errno.h>
@@ -27,9 +28,12 @@
static inline ip_set_ip_t
get_port(const struct sk_buff *skb, u_int32_t flags)
{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ struct iphdr *iph = ip_hdr(skb);
+#else
struct iphdr *iph = skb->nh.iph;
+#endif
u_int16_t offset = ntohs(iph->frag_off) & IP_OFFSET;
-
switch (iph->protocol) {
case IPPROTO_TCP: {
struct tcphdr tcph;
@@ -38,7 +42,11 @@
if (offset)
return INVALID_PORT;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ if (skb_copy_bits(skb, ip_hdr(skb)->ihl*4, &tcph, sizeof(tcph)) < 0)
+#else
if (skb_copy_bits(skb, skb->nh.iph->ihl*4, &tcph, sizeof(tcph)) < 0)
+#endif
/* No choice either */
return INVALID_PORT;
@@ -51,7 +59,11 @@
if (offset)
return INVALID_PORT;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
+ if (skb_copy_bits(skb, ip_hdr(skb)->ihl*4, &udph, sizeof(udph)) < 0)
+#else
if (skb_copy_bits(skb, skb->nh.iph->ihl*4, &udph, sizeof(udph)) < 0)
+#endif
/* No choice either */
return INVALID_PORT;
@@ -319,16 +331,16 @@
MODULE_AUTHOR("Jozsef Kadlecsik <kadlec at blackhole.kfki.hu>");
MODULE_DESCRIPTION("portmap type of IP sets");
-static int __init init(void)
+static int __init ip_set_portmap_init(void)
{
return ip_set_register_set_type(&ip_set_portmap);
}
-static void __exit fini(void)
+static void __exit ip_set_portmap_fini(void)
{
/* FIXME: possible race with ip_set_create() */
ip_set_unregister_set_type(&ip_set_portmap);
}
-module_init(init);
-module_exit(fini);
+module_init(ip_set_portmap_init);
+module_exit(ip_set_portmap_fini);
Modified: trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ipt_SET.c
===================================================================
--- trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ipt_SET.c 2007-08-28 11:23:22 UTC (rev 7010)
+++ trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ipt_SET.c 2007-08-28 11:29:12 UTC (rev 7011)
@@ -22,7 +22,7 @@
#include <net/protocol.h>
#include <net/checksum.h>
#include <linux/netfilter_ipv4.h>
-#include <linux/netfilter_ipv4/ip_nat_rule.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ipt_set.h>
static unsigned int
@@ -54,7 +54,11 @@
return IPT_CONTINUE;
}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
+static bool
+#else
static int
+#endif
checkentry(const char *tablename,
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
const void *e,
Modified: trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ipt_set.c
===================================================================
--- trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ipt_set.c 2007-08-28 11:23:22 UTC (rev 7010)
+++ trunk/patch-o-matic-ng/patchlets/set/linux-2.6/net/ipv4/netfilter/ipt_set.c 2007-08-28 11:29:12 UTC (rev 7011)
@@ -29,7 +29,11 @@
return inv;
}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
+static bool
+#else
static int
+#endif
match(const struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
@@ -37,7 +41,9 @@
const struct xt_match *match,
#endif
const void *matchinfo,
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
+ int offset, unsigned int protoff, bool *hotdrop)
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
int offset, unsigned int protoff, int *hotdrop)
#else
int offset, int *hotdrop)
@@ -50,7 +56,11 @@
info->match_set.flags[0] & IPSET_MATCH_INV);
}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,23)
+bool
+#else
static int
+#endif
checkentry(const char *tablename,
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,16)
const void *inf,
More information about the netfilter-cvslog
mailing list