• Sergey Popovich's avatar
    netfilter: ipset: netnet,netportnet: Fix value range support for IPv4 · 6e41ee68
    Sergey Popovich authored
    Ranges of values are broken with hash:net,net and hash:net,port,net.
    
    hash:net,net
    ============
    
       # ipset create test-nn hash:net,net
       # ipset add test-nn 10.0.10.1-10.0.10.127,10.0.0.0/8
    
       # ipset list test-nn
       Name: test-nn
       Type: hash:net,net
       Revision: 0
       Header: family inet hashsize 1024 maxelem 65536
       Size in memory: 16960
       References: 0
       Members:
       10.0.10.1,10.0.0.0/8
    
       # ipset test test-nn 10.0.10.65,10.0.0.1
       10.0.10.65,10.0.0.1 is NOT in set test-nn.
       # ipset test test-nn 10.0.10.1,10.0.0.1
       10.0.10.1,10.0.0.1 is in set test-nn.
    
    hash:net,port,net
    =================
    
       # ipset create test-npn hash:net,port,net
       # ipset add test-npn 10.0.10.1-10.0.10.127,tcp:80,10.0.0.0/8
       # ipset list test-npn
       Name: test-npn
       Type: hash:net,port,net
       Revision: 0
       Header: family inet hashsize 1024 maxelem 65536
       Size in memory: 17344
       References: 0
       Members:
       10.0.10.8/29,tcp:80,10.0.0.0
       10.0.10.16/28,tcp:80,10.0.0.0
       10.0.10.2/31,tcp:80,10.0.0.0
       10.0.10.64/26,tcp:80,10.0.0.0
       10.0.10.32/27,tcp:80,10.0.0.0
       10.0.10.4/30,tcp:80,10.0.0.0
       10.0.10.1,tcp:80,10.0.0.0
       # ipset list test-npn
       # ipset test test-npn 10.0.10.126,tcp:80,10.0.0.2
       10.0.10.126,tcp:80,10.0.0.2 is NOT in set test-npn.
       # ipset test test-npn 10.0.10.126,tcp:80,10.0.0.0
       10.0.10.126,tcp:80,10.0.0.0 is in set test-npn.
    
       # ipset create test-npn hash:net,port,net
       # ipset add test-npn 10.0.10.0/24,tcp:80-81,10.0.0.0/8
       # ipset list test-npn
       Name: test-npn
       Type: hash:net,port,net
       Revision: 0
       Header: family inet hashsize 1024 maxelem 65536
       Size in memory: 17024
       References: 0
       Members:
       10.0.10.0,tcp:80,10.0.0.0
       10.0.10.0,tcp:81,10.0.0.0
       # ipset test test-npn 10.0.10.126,tcp:80,10.0.0.0
       10.0.10.126,tcp:80,10.0.0.0 is NOT in set test-npn.
       # ipset test test-npn 10.0.10.0,tcp:80,10.0.0.0
       10.0.10.0,tcp:80,10.0.0.0 is in set test-npn.
    
    Correctly setup from..to variables where no IPSET_ATTR_IP_TO{,2}
    attribute is given, so in range processing loop we construct proper
    cidr value. Check whenever we have no ranges and can short cut in
    hash:net,net properly. Use unlikely() where appropriate, to comply
    with other modules.
    Signed-off-by: default avatarSergey Popovich <popovich_sergei@mail.ru>
    Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
    6e41ee68
ip_set_hash_netnet.c 12.9 KB