ipset - remove binding support
RFC PATCH 1/1 ipset - remove binding support
Hi,
Whenever i'm playing with ipset (coding), i stumble over the binding stuff. This has been depreciated since 2.4.0 and i think it's time to start doing some work for the next major release.
So here is a patch that removes the binding support from ipset. I have tried to only remove stuff without changing to much else. Once binding is gone, some function calls and APIs can be simplified. But this should IMHO go into a separate patch.
Comments?
Andreas
Makefile +1 -4
@@ -13,9 +13,6 @@ endif ifndef IP_NF_SET_MAX IP_NF_SET_MAX=256 endif -ifndef IP_NF_SET_HASHSIZE -IP_NF_SET_HASHSIZE=1024 -endif ifndef V V=0 endif
@@ -89,7 +86,7 @@ modules: @[ -f $(KERNEL_DIR)/net/ipv4/netfilter/Kconfig ] || (echo "Error: The directory '$(KERNEL_DIR)' doesn't look like a Linux 2.6.x kernel source tree." && exit 1) @[ -f $(KBUILD_OUTPUT)/.config ] || (echo "Error: The kernel source in '$(KERNEL_DIR)' must be configured" && exit 1) @[ -f $(KBUILD_OUTPUT)/Module.symvers ] || echo "Warning: You should run 'make modules' in '$(KERNEL_DIR)' beforehand" - cd kernel; make -C $(KBUILD_OUTPUT) M=`pwd` V=$V IP_NF_SET_MAX=$(IP_NF_SET_MAX) IP_NF_SET_HASHSIZE=$(IP_NF_SET_HASHSIZE) modules + cd kernel; make -C $(KBUILD_OUTPUT) M=`pwd` V=$V IP_NF_SET_MAX=$(IP_NF_SET_MAX) modules modules_install: modules cd kernel; make -C $(KBUILD_OUTPUT) M=`pwd` modules_install
README +2 -4
@@ -7,12 +7,10 @@ This is the ipset source tree. Follow these steps to install ipset: # make KERNEL_DIR=<<where-you-built-your-kernel>> - You can specify the maximum number of sets (default 256) - and/or the hash size for bindings (default 1024) if you want: + You can specify the maximum number of sets (default 256) if you want: # make KERNEL_DIR=<<where-you-built-your-kernel>> \ - IP_NF_SET_MAX=<<your setsize number>> \ - IP_NF_SET_HASHSIZE=<<your hashsize number>> + IP_NF_SET_MAX=<<your setsize number>> 2. Install the binary and the modules
ipset.8 +10 -61
133 lines not on this page · raw message
ipset.c +43 -342
613 lines not on this page · raw message
ipset.h +0 -10
@@ -56,8 +56,6 @@ enum set_commands {CMD_ADD ,/* -A */ CMD_DEL ,/* -D */ CMD_TEST ,/* -T */ -CMD_BIND ,/* -B */ -CMD_UNBIND ,/* -U */ CMD_HELP ,/* -H */ CMD_VERSION ,/* -V */ NUMBER_OF_CMD = CMD_VERSION,
@@ -145,12 +143,6 @@ struct settype {/* Print save for all IPs */ void (*saveips) (struct set *set,void *data,size_t len,unsigned options); -/* Conver a single IP (binding) to string */ -char * (*bindip_tostring)(struct set *set,ip_set_ip_t ip,unsigned options); - -/* Parse an IP at restoring bindings. FIXME */ -void (*bindip_parse) (const char *str,ip_set_ip_t * ip); -/* Print usage */ void (*usage) (void );
@@ -167,8 +159,6 @@ extern void settype_register(struct settype *settype);extern void exit_error (int status,const char *msg, ...); -extern char *binding_ip_tostring (struct set *set, -ip_set_ip_t ip,unsigned options);extern char *ip_tostring (ip_set_ip_t ip,unsigned options);extern char *ip_tostring_numeric (ip_set_ip_t ip);extern void parse_ip (const char *str,ip_set_ip_t * ip);
ipset_iphash.c +0 -4
@@ -269,10 +269,6 @@ static struct settype settype_iphash = { .saveheader = &saveheader, .saveips = &saveips, -/* Bindings */ - .bindip_tostring = &binding_ip_tostring, - .bindip_parse = &parse_ip, - .usage = &usage, };
ipset_ipmap.c +0 -4
@@ -328,10 +328,6 @@ static struct settype settype_ipmap = { .saveheader = &saveheader, .saveips = &saveips, -/* Bindings */ - .bindip_tostring = &binding_ip_tostring, - .bindip_parse = &parse_ip, - .usage = &usage, };
ipset_ipporthash.c +0 -20
@@ -304,22 +304,6 @@ saveips(struct set *set, void *data, size_t len, unsigned options) } } -static char buffer[22 ]; - -static char * -unpack_ipport_tostring (struct set *set,ip_set_ip_t bip,unsigned options) -{ -struct ip_set_ipporthash *mysetdata = set->settype->header; -ip_set_ip_t ip, port; - - ip = (bip>>16 ) + mysetdata->first_ip; - port = (uint16_t ) bip; -sprintf (buffer,"%s,%s" , -ip_tostring (ip, options),port_tostring (port, options)); - -return buffer; -} -static void usage (void ) { printf
@@ -356,10 +340,6 @@ static struct settype settype_ipporthash = { .saveheader = &saveheader, .saveips = &saveips, -/* Bindings */ - .bindip_tostring = &unpack_ipport_tostring, - .bindip_parse = &parse_ip, - .usage = &usage, };
ipset_iptree.c +0 -4
@@ -211,10 +211,6 @@ static struct settype settype_iptree = { .saveheader = &saveheader, .saveips = &saveips, -/* Bindings */ - .bindip_tostring = &binding_ip_tostring, - .bindip_parse = &parse_ip, - .usage = &usage, };
ipset_iptreemap.c +0 -3
@@ -198,9 +198,6 @@ static struct settype settype_iptreemap = { .saveheader = &saveheader, .saveips = &saveips, - .bindip_tostring = &binding_ip_tostring, - .bindip_parse = &parse_ip, - .usage = &usage, };
ipset_macipmap.c +0 -4
@@ -333,10 +333,6 @@ static struct settype settype_macipmap = { .saveheader = &saveheader, .saveips = &saveips, -/* Bindings */ - .bindip_tostring = &binding_ip_tostring, - .bindip_parse = &parse_ip, - .usage = &usage, };
ipset_nethash.c +0 -33
@@ -263,35 +263,6 @@ saveips(struct set *set UNUSED, void *data, size_t len, unsigned options) } } -static char * -net_tostring(struct set *set UNUSED, ip_set_ip_t ip, unsigned options) -{ -return unpack_ip_tostring (ip, options); -} - -static void -parse_net (const char *str,ip_set_ip_t *ip) -{ -char *saved =ipset_strdup (str); -char *ptr, *tmp = saved; -ip_set_ip_t cidr; - - ptr =strsep (&tmp,"/" ); - -if (tmp ==NULL ) -exit_error (PARAMETER_PROBLEM , -"Missing cidr from `%s'" , str); - -if (string_to_number (tmp,1 ,31 , &cidr)) -exit_error (PARAMETER_PROBLEM , -"Out of range cidr `%s' specified" , str); - -parse_ip (ptr, ip); -ipset_free (saved); - - *ip =pack_ip_cidr (*ip, cidr); -} -static void usage (void ) { printf
@@ -326,10 +297,6 @@ static struct settype settype_nethash = { .saveheader = &saveheader, .saveips = &saveips, -/* Bindings */ - .bindip_tostring = &net_tostring, - .bindip_parse = &parse_net, - .usage = &usage, };
ipset_portmap.c +0 -11
@@ -162,13 +162,6 @@ printports_sorted(struct set *set, void *data, } } -static char * -binding_port_tostring(struct set *set UNUSED, -ip_set_ip_t ip,unsigned options) -{ -return port_tostring (ip, options); -} -static void saveheader (struct set *set,unsigned options) {
@@ -231,10 +224,6 @@ static struct settype settype_portmap = { .saveheader = &saveheader, .saveips = &saveports, -/* Bindings */ - .bindip_tostring = &binding_port_tostring, - .bindip_parse = &parse_port, - .usage = &usage, };
kernel/Config.in.ipset +0 -1
@@ -1,7 +1,6 @@ dep_tristate ' IP set support' CONFIG_IP_NF_SET $CONFIG_IP_NF_IPTABLES if [ "$CONFIG_IP_NF_SET" != "n" ]; then int ' Maximum number of sets' CONFIG_IP_NF_SET_MAX 256 - int ' Hash size for bindings of IP sets' CONFIG_IP_NF_SET_HASHSIZE 1024 dep_tristate ' set match support' CONFIG_IP_NF_MATCH_SET $CONFIG_IP_NF_SET dep_tristate ' SET target support' CONFIG_IP_NF_TARGET_SET $CONFIG_IP_NF_SET dep_tristate ' ipmap set type support' CONFIG_IP_NF_SET_IPMAP $CONFIG_IP_NF_SET
kernel/Kbuild +1 -2
@@ -1,6 +1,5 @@ EXTRA_CFLAGS := -I$(M)/include \ - -DCONFIG_IP_NF_SET_MAX=$(IP_NF_SET_MAX) \ - -DCONFIG_IP_NF_SET_HASHSIZE=$(IP_NF_SET_HASHSIZE) + -DCONFIG_IP_NF_SET_MAX=$(IP_NF_SET_MAX) obj-m += ip_set.o ipt_set.o ipt_SET.o obj-m += ip_set_ipmap.o ip_set_macipmap.o ip_set_portmap.o
kernel/Kconfig.ipset +0 -11
@@ -20,17 +20,6 @@ config IP_NF_SET_MAX The value can be overriden by the 'max_sets' module parameter of the 'ip_set' module. -config IP_NF_SET_HASHSIZE - int "Hash size for bindings of IP sets" - default 1024 - depends on IP_NF_SET - help - You can define here default value of the hash size for - bindings of IP sets. - - The value can be overriden by the 'hash_size' module - parameter of the 'ip_set' module. - config IP_NF_SET_IPMAP tristate "ipmap set support" depends on IP_NF_SET
kernel/include/linux/netfilter_ipv4/ip_set.h +7 -45
129 lines not on this page · raw message
kernel/ip_set.c +16 -523
728 lines not on this page · raw message
Re: [RFC][PATCH] ipset - remove hash_ip function parameter
Hi,
This is a follow up on my 'ipset - remove binding support' patch.
After binding support is gone, the hash_ip parameter for the add/del/test functions is no longer needed. This patch removes it.
Andreas
kernel/include/linux/netfilter_ipv4/ip_set.h +6 -14
@@ -321,7 +321,6 @@*/ int (*testip_kernel) (struct ip_set *set,const struct sk_buff * skb, -ip_set_ip_t *ip,const u_int32_t *flags,unsigned char index);
@@ -329,8 +328,7 @@* return 0 if not in set, 1 if in set. */ int (*testip) (struct ip_set *set, -const void *data,size_t size, -ip_set_ip_t *ip); +const void *data,size_t size);/* * Size of the data structure passed by when
@@ -344,8 +342,7 @@* If the address was not already in the set, 0 is returned. */ int (*addip) (struct ip_set *set, -const void *data,size_t size, -ip_set_ip_t *ip); +const void *data,size_t size);/* Add IP into set (kernel: iptables ... -j SET set src|dst) * Return -EEXIST if the address is already in the set,
@@ -354,7 +351,6 @@*/ int (*addip_kernel) (struct ip_set *set,const struct sk_buff * skb, -ip_set_ip_t *ip,const u_int32_t *flags,unsigned char index);
@@ -364,8 +360,7 @@* If the address really was in the set, 0 is returned. */ int (*delip) (struct ip_set *set, -const void *data,size_t size, -ip_set_ip_t *ip); +const void *data,size_t size);/* remove IP from set (kernel: iptables ... -j SET --entry x) * Return -EEXIST if the address is NOT in the set,
@@ -374,7 +369,6 @@*/ int (*delip_kernel) (struct ip_set *set,const struct sk_buff * skb, -ip_set_ip_t *ip,const u_int32_t *flags,unsigned char index);
@@ -477,12 +471,11 @@ #define UADT0(type, adt, args...) \ static int \ -FNAME(type,_u,adt)(struct ip_set *set, const void *data, size_t size, \ - ip_set_ip_t *hash_ip) \ +FNAME(type,_u,adt)(struct ip_set *set, const void *data, size_t size) \ { \ const STRUCT(ip_set_req_,type) *req = data; \ \ - return FNAME(type,_,adt)(set, hash_ip , ## args); \ + return FNAME(type,_,adt)(set, ## args); \ } #define UADT(type, adt, args...) \
@@ -492,14 +485,13 @@static int \FNAME (type ,_k ,adt )(struct ip_set *set, \const struct sk_buff *skb, \ -ip_set_ip_t *hash_ip, \const u_int32_t *flags, \unsigned char index) \ { \ip_set_ip_t ip =getfn (skb, flags[index]); \ \ KADT_CONDITION \ - return FNAME(type,_,adt)(set, hash_ip, ip , ##args); \ + return FNAME(type,_,adt)(set, ip , ##args); \ }#define REGISTER_MODULE (type) \
kernel/ip_set.c +8 -17
@@ -78,7 +78,6 @@ const u_int32_t *flags) {struct ip_set *set; -ip_set_ip_t ip;int res;unsigned char i =0 ;
@@ -89,7 +88,7 @@IP_SET_ASSERT (set);DP ("set %s, index %u" , set->name, index);read_lock_bh (&set->lock); - res = set->type->testip_kernel (set, skb, &ip, flags, i++); + res = set->type->testip_kernel (set, skb, flags, i++);read_unlock_bh (&set->lock); i += !!(set->type->features &IPSET_DATA_DOUBLE ); } while (res > 0
@@ -105,7 +104,6 @@ const u_int32_t *flags) {struct ip_set *set; -ip_set_ip_t ip;int res;unsigned char i =0 ;
@@ -117,7 +115,7 @@IP_SET_ASSERT (set);DP ("set %s, index %u" , set->name, index);write_lock_bh (&set->lock); - res = set->type->addip_kernel (set, skb, &ip, flags, i++); + res = set->type->addip_kernel (set, skb, flags, i++);write_unlock_bh (&set->lock); i += !!(set->type->features &IPSET_DATA_DOUBLE ); } while ((res == 0 || res == -EEXIST)
@@ -138,7 +136,6 @@ const u_int32_t *flags) {struct ip_set *set; -ip_set_ip_t ip;int res;unsigned char i =0 ;
@@ -149,7 +146,7 @@IP_SET_ASSERT (set);DP ("set %s, index %u" , set->name, index);write_lock_bh (&set->lock); - res = set->type->delip_kernel (set, skb, &ip, flags, i++); + res = set->type->delip_kernel (set, skb, flags, i++);write_unlock_bh (&set->lock); i += !!(set->type->features &IPSET_DATA_DOUBLE ); } while ((res == 0 || res == -EEXIST)
@@ -352,13 +349,12 @@static inline int __ip_set_testip (struct ip_set *set,const void *data, -size_t size, -ip_set_ip_t *ip) +size_t size) {int res;read_lock_bh (&set->lock); - res = set->type->testip (set, data, size, ip); + res = set->type->testip (set, data, size);read_unlock_bh (&set->lock);return res;
@@ -370,13 +366,12 @@ size_t size) {struct ip_set *set = ip_set_list[index]; -ip_set_ip_t ip;int res;IP_SET_ASSERT (set);do {write_lock_bh (&set->lock); - res = set->type->addip (set, data, size, &ip); + res = set->type->addip (set, data, size);write_unlock_bh (&set->lock); }while (res == -EAGAIN && set->type->retry
@@ -411,7 +406,6 @@ size_t size) {struct ip_set *set = ip_set_list[index]; -ip_set_ip_t ip;int res;IP_SET_ASSERT (set);
@@ -425,8 +419,7 @@write_lock_bh (&set->lock); res = set->type->delip (set, data +sizeof (struct ip_set_req_adt ), - size -sizeof (struct ip_set_req_adt ), - &ip); + size -sizeof (struct ip_set_req_adt ));write_unlock_bh (&set->lock);return res;
@@ -438,7 +431,6 @@ size_t size) {struct ip_set *set = ip_set_list[index]; -ip_set_ip_t ip;int res;IP_SET_ASSERT (set);
@@ -451,8 +443,7 @@ } res =__ip_set_testip (set, data +sizeof (struct ip_set_req_adt ), - size -sizeof (struct ip_set_req_adt ), - &ip); + size -sizeof (struct ip_set_req_adt ));return (res >0 ? -EEXIST : res); }
kernel/ip_set_iphash.c +15 -13
@@ -25,22 +25,23 @@static int limit =MAX_RANGE ;static inline __u32 -iphash_id (struct ip_set *set,ip_set_ip_t *hash_ip,ip_set_ip_t ip) +iphash_id (struct ip_set *set,ip_set_ip_t ip) {struct ip_set_iphash *map = set->data;__u32 id;u_int16_t i;ip_set_ip_t *elem; +ip_set_ip_t hash_ip; - *hash_ip = ip & map->netmask; + hash_ip = ip & map->netmask;DP ("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u, %u.%u.%u.%u" , - set->name,HIPQUAD (ip),HIPQUAD (*hash_ip),HIPQUAD (map->netmask)); + set->name,HIPQUAD (ip),HIPQUAD (hash_ip),HIPQUAD (map->netmask));for (i =0 ; i < map->probes; i++) { - id =jhash_ip (map, i, *hash_ip) % map->hashsize; + id =jhash_ip (map, i, hash_ip) % map->hashsize;DP ("hash key: %u" , id); elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id); -if (*elem == *hash_ip) +if (*elem == hash_ip)return id;/* No shortcut at testing - there can be deleted * entries. */
@@ -49,9 +50,9 @@ }static inline int -iphash_test (struct ip_set *set,ip_set_ip_t *hash_ip,ip_set_ip_t ip) +iphash_test (struct ip_set *set,ip_set_ip_t ip) { -return (ip &&iphash_id (set, hash_ip, ip) !=UINT_MAX ); +return (ip &&iphash_id (set, ip) !=UINT_MAX ); }#define KADT_CONDITION
@@ -82,16 +83,17 @@ }static inline int -iphash_add (struct ip_set *set,ip_set_ip_t *hash_ip,ip_set_ip_t ip) +iphash_add (struct ip_set *set,ip_set_ip_t ip) {struct ip_set_iphash *map = set->data; - +ip_set_ip_t hash_ip; +if (!ip || map->elements >= limit)return -ERANGE ; - *hash_ip = ip & map->netmask; + hash_ip = ip & map->netmask; -return __iphash_add (map, hash_ip); +return __iphash_add (map, &hash_ip); }UADT (iphash, add)
@@ -106,7 +108,7 @@ HASH_RETRY(iphash, ip_set_ip_t)static inline int -iphash_del (struct ip_set *set,ip_set_ip_t *hash_ip,ip_set_ip_t ip) +iphash_del (struct ip_set *set,ip_set_ip_t ip) {struct ip_set_iphash *map = set->data;ip_set_ip_t id, *elem;
@@ -114,7 +116,7 @@if (!ip)return -ERANGE ; - id =iphash_id (set, hash_ip, ip); + id =iphash_id (set, ip);if (id ==UINT_MAX )return -EEXIST ;
kernel/ip_set_ipmap.c +16 -13
@@ -26,17 +26,18 @@ }static inline int -ipmap_test (const struct ip_set *set,ip_set_ip_t *hash_ip,ip_set_ip_t ip) +ipmap_test (const struct ip_set *set,ip_set_ip_t ip) {const struct ip_set_ipmap *map = set->data; - +ip_set_ip_t hash_ip; +if (ip < map->first_ip || ip > map->last_ip)return -ERANGE ; - *hash_ip = ip & map->netmask; + hash_ip = ip & map->netmask;DP ("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u" , - set->name,HIPQUAD (ip),HIPQUAD (*hash_ip)); -return !!test_bit (ip_to_id (map, *hash_ip), map->members); + set->name,HIPQUAD (ip),HIPQUAD (hash_ip)); +return !!test_bit (ip_to_id (map, hash_ip), map->members); }#define KADT_CONDITION
@@ -45,16 +46,17 @@ KADT(ipmap, test, ipaddr)static inline int -ipmap_add (struct ip_set *set,ip_set_ip_t *hash_ip,ip_set_ip_t ip) +ipmap_add (struct ip_set *set,ip_set_ip_t ip) {struct ip_set_ipmap *map = set->data; +ip_set_ip_t hash_ip;if (ip < map->first_ip || ip > map->last_ip)return -ERANGE ; - *hash_ip = ip & map->netmask; -DP ("%u.%u.%u.%u, %u.%u.%u.%u" ,HIPQUAD (ip),HIPQUAD (*hash_ip)); -if (test_and_set_bit (ip_to_id (map, *hash_ip), map->members)) + hash_ip = ip & map->netmask; +DP ("%u.%u.%u.%u, %u.%u.%u.%u" ,HIPQUAD (ip),HIPQUAD (hash_ip)); +if (test_and_set_bit (ip_to_id (map, hash_ip), map->members))return -EEXIST ;return 0 ;
@@ -64,16 +66,17 @@ KADT(ipmap, add, ipaddr)static inline int -ipmap_del (struct ip_set *set,ip_set_ip_t *hash_ip,ip_set_ip_t ip) +ipmap_del (struct ip_set *set,ip_set_ip_t ip) {struct ip_set_ipmap *map = set->data; +ip_set_ip_t hash_ip;if (ip < map->first_ip || ip > map->last_ip)return -ERANGE ; - *hash_ip = ip & map->netmask; -DP ("%u.%u.%u.%u, %u.%u.%u.%u" ,HIPQUAD (ip),HIPQUAD (*hash_ip)); -if (!test_and_clear_bit (ip_to_id (map, *hash_ip), map->members)) + hash_ip = ip & map->netmask; +DP ("%u.%u.%u.%u, %u.%u.%u.%u" ,HIPQUAD (ip),HIPQUAD (hash_ip)); +if (!test_and_clear_bit (ip_to_id (map, hash_ip), map->members))return -EEXIST ;return 0 ;
kernel/ip_set_ipporthash.c +17 -14
@@ -28,26 +28,27 @@static int limit =MAX_RANGE ;static inline __u32 -ipporthash_id (struct ip_set *set,ip_set_ip_t *hash_ip, +ipporthash_id (struct ip_set *set,ip_set_ip_t ip,ip_set_ip_t port) {struct ip_set_ipporthash *map = set->data;__u32 id;u_int16_t i;ip_set_ip_t *elem; +ip_set_ip_t hash_ip; - *hash_ip =pack_ip_port (map, ip, port); + hash_ip =pack_ip_port (map, ip, port);DP ("set: %s, ipport:%u.%u.%u.%u:%u, %u.%u.%u.%u" , - set->name,HIPQUAD (ip), port,HIPQUAD (*hash_ip)); -if (!*hash_ip) + set->name,HIPQUAD (ip), port,HIPQUAD (hash_ip)); +if (!hash_ip)return UINT_MAX ;for (i =0 ; i < map->probes; i++) { - id =jhash_ip (map, i, *hash_ip) % map->hashsize; + id =jhash_ip (map, i, hash_ip) % map->hashsize;DP ("hash key: %u" , id); elem = HARRAY_ELEM(map->members, ip_set_ip_t *, id); -if (*elem == *hash_ip) +if (*elem == hash_ip)return id;/* No shortcut at testing - there can be deleted * entries. */
@@ -56,7 +57,7 @@ }static inline int -ipporthash_test (struct ip_set *set,ip_set_ip_t *hash_ip, +ipporthash_test (struct ip_set *set,ip_set_ip_t ip,ip_set_ip_t port) {struct ip_set_ipporthash *map = set->data;
@@ -64,7 +65,7 @@if (ip < map->first_ip || ip > map->last_ip)return -ERANGE ; -return (ipporthash_id (set, hash_ip, ip, port) !=UINT_MAX ); +return (ipporthash_id (set, ip, port) !=UINT_MAX ); }#define KADT_CONDITION \
@@ -104,21 +105,23 @@ }static inline int -ipporthash_add (struct ip_set *set,ip_set_ip_t *hash_ip, +ipporthash_add (struct ip_set *set,ip_set_ip_t ip,ip_set_ip_t port) {struct ip_set_ipporthash *map = set->data; +ip_set_ip_t hash_ip; +if (map->elements > limit)return -ERANGE ;if (ip < map->first_ip || ip > map->last_ip)return -ERANGE ; - *hash_ip =pack_ip_port (map, ip, port); + hash_ip =pack_ip_port (map, ip, port); -if (!*hash_ip) +if (!hash_ip)return -ERANGE ; -return __ipporthash_add (map, hash_ip); +return __ipporthash_add (map, &hash_ip); }UADT (ipporthash, add, req->port)
@@ -135,7 +138,7 @@ HASH_RETRY(ipporthash, ip_set_ip_t)static inline int -ipporthash_del (struct ip_set *set,ip_set_ip_t *hash_ip, +ipporthash_del (struct ip_set *set,ip_set_ip_t ip,ip_set_ip_t port) {struct ip_set_ipporthash *map = set->data;
@@ -145,7 +148,7 @@if (ip < map->first_ip || ip > map->last_ip)return -ERANGE ; - id =ipporthash_id (set, hash_ip, ip, port); + id =ipporthash_id (set, ip, port);if (id ==UINT_MAX )return -EEXIST ;
kernel/ip_set_ipportnethash.c +23 -22
143 lines not on this page · raw message
kernel/ip_set_iptree.c +6 -9
@@ -61,7 +61,7 @@ }while (0 ) static inline int -iptree_test (struct ip_set *set,ip_set_ip_t *hash_ip,ip_set_ip_t ip) +iptree_test (struct ip_set *set,ip_set_ip_t ip) {struct ip_set_iptree *map = set->data;struct ip_set_iptreeb *btree;
@@ -72,8 +72,7 @@if (!ip)return -ERANGE ; - *hash_ip = ip; -ABCD (a, b, c, d, hash_ip); +ABCD (a, b, c, d, &ip);DP ("%u %u %u %u timeout %u" , a, b, c, d, map->timeout);TESTIP_WALK (map, a, btree);TESTIP_WALK (btree, b, ctree);
@@ -105,7 +104,7 @@ }while (0 ) static inline int -iptree_add (struct ip_set *set,ip_set_ip_t *hash_ip, +iptree_add (struct ip_set *set,ip_set_ip_t ip,unsigned int timeout) {struct ip_set_iptree *map = set->data;
@@ -120,8 +119,7 @@* but it's probably overkill */ return -ERANGE ; - *hash_ip = ip; -ABCD (a, b, c, d, hash_ip); +ABCD (a, b, c, d, &ip);DP ("%u %u %u %u timeout %u" , a, b, c, d, timeout); ADDIP_WALK(map, a, btree, struct ip_set_iptreeb, branch_cachep); ADDIP_WALK(btree, b, ctree, struct ip_set_iptreec, branch_cachep);
@@ -152,7 +150,7 @@ }while (0 ) static inline int -iptree_del (struct ip_set *set,ip_set_ip_t *hash_ip,ip_set_ip_t ip) +iptree_del (struct ip_set *set,ip_set_ip_t ip) {struct ip_set_iptree *map = set->data;struct ip_set_iptreeb *btree;
@@ -163,8 +161,7 @@if (!ip)return -ERANGE ; - *hash_ip = ip; -ABCD (a, b, c, d, hash_ip); +ABCD (a, b, c, d, &ip);DELIP_WALK (map, a, btree);DELIP_WALK (btree, b, ctree);DELIP_WALK (ctree, c, dtree);
kernel/ip_set_iptreemap.c +10 -20
@@ -250,7 +250,7 @@ }static inline int -iptreemap_test (struct ip_set *set,ip_set_ip_t *hash_ip,ip_set_ip_t ip) +iptreemap_test (struct ip_set *set,ip_set_ip_t ip) {struct ip_set_iptreemap *map = set->data;struct ip_set_iptreemap_b *btree;
@@ -258,9 +258,7 @@struct ip_set_iptreemap_d *dtree;unsigned char a, b, c, d; - *hash_ip = ip; - -ABCD (a, b, c, d, hash_ip); +ABCD (a, b, c, d, &ip);TESTIP_WALK (map, a, btree, fullbitmap_b);TESTIP_WALK (btree, b, ctree, fullbitmap_c);
@@ -275,7 +273,7 @@ KADT(iptreemap, test, ipaddr)static inline int -__addip_single (struct ip_set *set,ip_set_ip_t *hash_ip,ip_set_ip_t ip) +__addip_single (struct ip_set *set,ip_set_ip_t ip) {struct ip_set_iptreemap *map = (struct ip_set_iptreemap *) set->data;struct ip_set_iptreemap_b *btree;
@@ -283,9 +281,7 @@struct ip_set_iptreemap_d *dtree;unsigned char a, b, c, d; - *hash_ip = ip; - -ABCD (a, b, c, d, hash_ip); +ABCD (a, b, c, d, &ip); ADDIP_WALK(map, a, btree, struct ip_set_iptreemap_b, cachep_b, fullbitmap_b); ADDIP_WALK(btree, b, ctree, struct ip_set_iptreemap_c, cachep_c, fullbitmap_c);
@@ -300,7 +296,7 @@ }static inline int -iptreemap_add (struct ip_set *set,ip_set_ip_t *hash_ip, +iptreemap_add (struct ip_set *set,ip_set_ip_t start,ip_set_ip_t end) {struct ip_set_iptreemap *map = set->data;
@@ -312,9 +308,7 @@unsigned char a2, b2, c2, d2;if (start == end) -return __addip_single (set, hash_ip, start); - - *hash_ip = start; +return __addip_single (set, start);ABCD (a1, b1, c1, d1, &start);ABCD (a2, b2, c2, d2, &end);
@@ -337,7 +331,7 @@ KADT(iptreemap, add, ipaddr, ip)static inline int -__delip_single (struct ip_set *set,ip_set_ip_t *hash_ip, +__delip_single (struct ip_set *set,ip_set_ip_t ip,unsigned int __nocast flags) {struct ip_set_iptreemap *map = set->data;
@@ -346,9 +340,7 @@struct ip_set_iptreemap_d *dtree;unsigned char a,b,c,d; - *hash_ip = ip; - -ABCD (a, b, c, d, hash_ip); +ABCD (a, b, c, d, &ip);DELIP_WALK (map, a, btree, cachep_b, fullbitmap_b, flags);DELIP_WALK (btree, b, ctree, cachep_c, fullbitmap_c, flags);
@@ -363,7 +355,7 @@ }static inline int -iptreemap_del (struct ip_set *set,ip_set_ip_t *hash_ip, +iptreemap_del (struct ip_set *set,ip_set_ip_t start,ip_set_ip_t end,unsigned int __nocast flags) {struct ip_set_iptreemap *map = set->data;
@@ -375,9 +367,7 @@unsigned char a2, b2, c2, d2;if (start == end) -return __delip_single (set, hash_ip, start, flags); - - *hash_ip = start; +return __delip_single (set, start, flags);ABCD (a1, b1, c1, d1, &start);ABCD (a2, b2, c2, d2, &end);
kernel/ip_set_macipmap.c +7 -13
@@ -22,8 +22,7 @@#include <linux/netfilter_ipv4/ip_set_macipmap.h> static int -macipmap_utest (struct ip_set *set,const void *data,size_t size, -ip_set_ip_t *hash_ip) +macipmap_utest (struct ip_set *set,const void *data,size_t size) {const struct ip_set_macipmap *map = set->data;const struct ip_set_macip *table = map->members;
@@ -32,9 +31,8 @@if (req->ip < map->first_ip || req->ip > map->last_ip)return -ERANGE ; - *hash_ip = req->ip;DP ("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u" , - set->name,HIPQUAD (req->ip),HIPQUAD (*hash_ip)); + set->name,HIPQUAD (req->ip),HIPQUAD (req->ip));if (test_bit (IPSET_MACIP_ISSET , (void *) &table[req->ip - map->first_ip].flags)) { return (memcmp(req->ethernet,
@@ -48,7 +46,6 @@static int macipmap_ktest (struct ip_set *set,const struct sk_buff *skb, -ip_set_ip_t *hash_ip,const u_int32_t *flags,unsigned char index) {
@@ -61,9 +58,8 @@if (ip < map->first_ip || ip > map->last_ip)return 0 ; - *hash_ip = ip;DP ("set: %s, ip:%u.%u.%u.%u, %u.%u.%u.%u" , - set->name,HIPQUAD (ip),HIPQUAD (*hash_ip)); + set->name,HIPQUAD (ip),HIPQUAD (ip));if (test_bit (IPSET_MACIP_ISSET , (void *) &table[ip - map->first_ip].flags)) {/* Is mac pointer valid?
@@ -80,7 +76,7 @@/* returns 0 on success */ static inline int -macipmap_add (struct ip_set *set,ip_set_ip_t *hash_ip, +macipmap_add (struct ip_set *set,ip_set_ip_t ip,const unsigned char *ethernet) {struct ip_set_macipmap *map = set->data;
@@ -92,8 +88,7 @@ (void *) &table[ip - map->first_ip].flags)) return -EEXIST; - *hash_ip = ip; -DP ("%u.%u.%u.%u, %u.%u.%u.%u" ,HIPQUAD (ip),HIPQUAD (*hash_ip)); +DP ("%u.%u.%u.%u, %u.%u.%u.%u" ,HIPQUAD (ip),HIPQUAD (ip));memcpy (&table[ip - map->first_ip].ethernet, ethernet,ETH_ALEN );return 0 ; }
@@ -107,7 +102,7 @@ KADT(macipmap, add, ipaddr, eth_hdr(skb)->h_source)static inline int -macipmap_del (struct ip_set *set,ip_set_ip_t *hash_ip,ip_set_ip_t ip) +macipmap_del (struct ip_set *set,ip_set_ip_t ip) {struct ip_set_macipmap *map = set->data;struct ip_set_macip *table = map->members;
@@ -118,8 +113,7 @@ (void *)&table[ip - map->first_ip].flags)) return -EEXIST; - *hash_ip = ip; -DP ("%u.%u.%u.%u, %u.%u.%u.%u" ,HIPQUAD (ip),HIPQUAD (*hash_ip)); +DP ("%u.%u.%u.%u, %u.%u.%u.%u" ,HIPQUAD (ip),HIPQUAD (ip));return 0 ; }
kernel/ip_set_nethash.c +22 -22
125 lines not on this page · raw message
kernel/ip_set_portmap.c +4 -8
@@ -23,16 +23,14 @@#include <linux/netfilter_ipv4/ip_set_getport.h> static inline int -portmap_test (const struct ip_set *set,ip_set_ip_t *hash_port, -ip_set_ip_t port) +portmap_test (const struct ip_set *set,ip_set_ip_t port) {const struct ip_set_portmap *map = set->data;if (port < map->first_ip || port > map->last_ip)return -ERANGE ; - *hash_port = port; -DP ("set: %s, port:%u, %u" , set->name, port, *hash_port); +DP ("set: %s, port:%u, %u" , set->name, port, port);return !!test_bit (port - map->first_ip, map->members); }
@@ -44,7 +42,7 @@ KADT(portmap, test, get_port)static inline int -portmap_add (struct ip_set *set,ip_set_ip_t *hash_port,ip_set_ip_t port) +portmap_add (struct ip_set *set,ip_set_ip_t port) {struct ip_set_portmap *map = set->data;
@@ -53,7 +51,6 @@if (test_and_set_bit (port - map->first_ip, map->members))return -EEXIST ; - *hash_port = port;DP ("port %u" , port);return 0 ; }
@@ -62,7 +59,7 @@ KADT(portmap, add, get_port)static inline int -portmap_del (struct ip_set *set,ip_set_ip_t *hash_port,ip_set_ip_t port) +portmap_del (struct ip_set *set,ip_set_ip_t port) {struct ip_set_portmap *map = set->data;
@@ -71,7 +68,6 @@if (!test_and_clear_bit (port - map->first_ip, map->members))return -EEXIST ; - *hash_port = port;DP ("port %u" , port);return 0 ; }
kernel/ip_set_setlist.c +3 -9
@@ -28,8 +28,7 @@ }static int -setlist_utest (struct ip_set *set,const void *data,size_t size, -ip_set_ip_t *hash_ip) +setlist_utest (struct ip_set *set,const void *data,size_t size) {const struct ip_set_setlist *map = set->data;const struct ip_set_req_setlist *req = data;
@@ -75,7 +74,6 @@static int setlist_ktest (struct ip_set *set,const struct sk_buff *skb, -ip_set_ip_t *hash_ip,const u_int32_t *flags,unsigned char index) {
@@ -109,8 +107,7 @@ }static int -setlist_uadd (struct ip_set *set,const void *data,size_t size, -ip_set_ip_t *hash_ip) +setlist_uadd (struct ip_set *set,const void *data,size_t size) {struct ip_set_setlist *map = set->data;const struct ip_set_req_setlist *req = data;
@@ -158,7 +155,6 @@static int setlist_kadd (struct ip_set *set,const struct sk_buff *skb, -ip_set_ip_t *hash_ip,const u_int32_t *flags,unsigned char index) {
@@ -184,8 +180,7 @@ }static int -setlist_udel (struct ip_set *set,const void *data,size_t size, -ip_set_ip_t *hash_ip) +setlist_udel (struct ip_set *set,const void *data,size_t size) {struct ip_set_setlist *map = set->data;const struct ip_set_req_setlist *req = data;
@@ -236,7 +231,6 @@static int setlist_kdel (struct ip_set *set,const struct sk_buff *skb, -ip_set_ip_t *hash_ip,const u_int32_t *flags,unsigned char index) {
Hi Andreas,
Quoted 8 lines · Andreas Schultz
Whenever i'm playing with ipset (coding), i stumble over the binding stuff. This has been depreciated since 2.4.0 and i think it's time to start doing some work for the next major release.
So here is a patch that removes the binding support from ipset. I have tried to only remove stuff without changing to much else. Once binding is gone, some function calls and APIs can be simplified. But this should IMHO go into a separate patch.
If ipset internal structure remained the same, then according to the planned course your patch (i.e. removing binding) would be the proper next step. However the internals are being completely rewritten, mainly due to changing the kernel-userspace communication channel from sockopt to netlink. According to the planned timetable the new version will be out in the first quarter of this year, as development release. (The current branch as stable one will be maintained for a while.)
So - unless you have already got something developed on top of ipset -, I'd better not apply your patch. But if you have got something ready, just ping me. Otherwise just give me some time and there'll be a new branch with a new API, without binding.
Best regards,
Jozsef
-
E-mail : [email protected], [email protected] PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
H-1525 Budapest 114, POB. 49, Hungary