Sergey Popovich 35f6e63abe netfilter: ipset: Follow manual page behavior for SET target on list:set ... ipset(8) for list:set says: The match will try to find a matching entry in the sets and the target will try to add an entry to the first set to which it can be added. However real behavior is bit differ from described. Consider example: # ipset create test-1-v4 hash:ip family inet # ipset create test-1-v6 hash:ip family inet6 # ipset create test-1 list:set # ipset add test-1 test-1-v4 # ipset add test-1 test-1-v6 # iptables -A INPUT -p tcp --destination-port 25 -j SET --add-set test-1 src # ip6tables -A INPUT -p tcp --destination-port 25 -j SET --add-set test-1 src And then when iptables/ip6tables rule matches packet IPSET target tries to add src from packet to the list:set test-1 where first entry is test-1-v4 and the second one is test-1-v6. For IPv4, as it first entry in test-1 src added to test-1-v4 correctly, but for IPv6 src not added! Placing test-1-v6 to the first element of list:set makes behavior correct for IPv6, but brokes for IPv4. This is due to result, returned from ip_set_add() and ip_set_del() from net/netfilter/ipset/ip_set_core.c when set in list:set equires more parameters than given or address families do not match (which is this case). It seems wrong returning 0 from ip_set_add() and ip_set_del() in this case, as 0 should be returned only when an element successfuly added/deleted to/from the set, contrary to ip_set_test() which returns 0 when no entry exists and >0 when entry found in set. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ru> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>		2014-03-06 09:31:41 +01:00
..
ipset	netfilter: ipset: Follow manual page behavior for SET target on list:set	2014-03-06 09:31:41 +01:00
ipvs	ipvs: fix AF assignment in ip_vs_conn_new()	2014-02-04 21:13:47 +09:00
core.c	netfilter: pass hook ops to hookfn	2013-10-14 11:29:31 +02:00
Kconfig	netfilter: nf_tables: add reject module for NFPROTO_INET	2014-02-06 09:44:18 +01:00
Makefile	netfilter: nf_tables: add reject module for NFPROTO_INET	2014-02-06 09:44:18 +01:00
nf_conntrack_acct.c	netfilter: introduce nf_conn_acct structure	2013-11-03 21:48:49 +01:00
nf_conntrack_amanda.c
nf_conntrack_broadcast.c
nf_conntrack_core.c	netfilter: nf_conntrack: don't release a conntrack with non-zero refcnt	2014-02-05 17:46:06 +01:00
nf_conntrack_ecache.c
nf_conntrack_expect.c	netfilter: ctnetlink: fix incorrect NAT expectation dumping	2013-07-15 11:14:51 +02:00
nf_conntrack_extend.c
nf_conntrack_ftp.c	netfilter: Implement RFC 1123 for FTP conntrack	2013-05-27 13:32:43 +02:00
nf_conntrack_h323_asn1.c
nf_conntrack_h323_main.c	netfilter: nf_conntrack: fix rt6i_gateway checks for H.323 helper	2013-10-21 18:37:01 -04:00
nf_conntrack_h323_types.c
nf_conntrack_helper.c
nf_conntrack_irc.c
nf_conntrack_l3proto_generic.c
nf_conntrack_labels.c	netfilter: connlabels: remove unneeded includes	2013-07-31 16:39:18 +02:00
nf_conntrack_netbios_ns.c
nf_conntrack_netlink.c	netfilter: nft_ct: labels get support	2014-02-19 11:41:25 +01:00
nf_conntrack_pptp.c
nf_conntrack_proto.c	netfilter: nf_conntrack: remove dead code	2014-01-03 23:41:37 +01:00
nf_conntrack_proto_dccp.c	netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages	2014-01-06 17:40:02 +01:00
nf_conntrack_proto_generic.c
nf_conntrack_proto_gre.c
nf_conntrack_proto_sctp.c
nf_conntrack_proto_tcp.c	netfilter: add SYNPROXY core/target	2013-08-28 00:27:54 +02:00
nf_conntrack_proto_udp.c
nf_conntrack_proto_udplite.c
nf_conntrack_sane.c
nf_conntrack_seqadj.c	netfilter: only warn once on wrong seqadj usage	2014-01-06 14:23:17 +01:00
nf_conntrack_sip.c	netfilter: nf_ct_sip: consolidate NAT hook functions	2013-10-01 12:47:09 +02:00
nf_conntrack_snmp.c
nf_conntrack_standalone.c	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
nf_conntrack_tftp.c
nf_conntrack_timeout.c
nf_conntrack_timestamp.c	netfilter: nf_ct_timestamp: Fix BUG_ON after netns deletion	2013-12-20 14:58:29 +01:00
nf_internals.h	net: misc: Remove extern from function prototypes	2013-10-19 19:12:11 -04:00
nf_log.c	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
nf_nat_amanda.c
nf_nat_core.c	netfilter: nf_nat: add full port randomization support	2014-01-03 23:41:26 +01:00
nf_nat_ftp.c
nf_nat_helper.c	netfilter: nf_conntrack: make sequence number adjustments usuable without NAT	2013-08-28 00:26:48 +02:00
nf_nat_irc.c	netfilter: nf_nat: fix access to uninitialized buffer in IRC NAT helper	2014-01-06 14:17:17 +01:00
nf_nat_proto_common.c	netfilter: nf_nat: add full port randomization support	2014-01-03 23:41:26 +01:00
nf_nat_proto_dccp.c
nf_nat_proto_sctp.c	net/sctp: Refactor SCTP skb checksum computation	2013-07-27 20:07:15 -07:00
nf_nat_proto_tcp.c
nf_nat_proto_udp.c
nf_nat_proto_udplite.c
nf_nat_proto_unknown.c
nf_nat_sip.c	netfilter: nf_ct_sip: consolidate NAT hook functions	2013-10-01 12:47:09 +02:00
nf_nat_tftp.c
nf_queue.c	netfilter: move skb_gso_segment into nfnetlink_queue module	2013-04-29 20:09:05 +02:00
nf_sockopt.c
nf_synproxy_core.c	netfilter: nf_conntrack: don't release a conntrack with non-zero refcnt	2014-02-05 17:46:06 +01:00
nf_tables_api.c	netfilter: nf_tables: add optional user data area to rules	2014-02-27 16:56:00 +01:00
nf_tables_core.c	netfilter: nf_tables: unininline nft_trace_packet()	2014-02-07 17:50:27 +01:00
nf_tables_inet.c	netfilter: nf_tables: fix error path in the init functions	2014-01-09 23:25:48 +01:00
nfnetlink.c	netfilter: nfnetlink: add rcu_dereference_protected() helpers	2014-02-25 11:29:21 +01:00
nfnetlink_acct.c	netfilter: nfnetlink_acct: fix incomplete dumping of objects	2013-06-05 12:36:36 +02:00
nfnetlink_cthelper.c	netfilter: check return code from nla_parse_tested	2013-06-20 11:20:13 +02:00
nfnetlink_cttimeout.c	netfilter: cttimeout: allow to set/get default protocol timeouts	2013-10-01 13:17:39 +02:00
nfnetlink_log.c	netfilter: nfnetlink_log: remove unused code	2014-02-25 11:30:01 +01:00
nfnetlink_queue_core.c	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/jesse/openvswitch	2014-01-06 19:48:38 -05:00
nfnetlink_queue_ct.c	netfilter: nf_conntrack: make sequence number adjustments usuable without NAT	2013-08-28 00:26:48 +02:00
nft_bitwise.c	netfilter: nf_tables: expression ops overloading	2013-10-14 17:16:08 +02:00
nft_byteorder.c	netfilter: nf_tables: expression ops overloading	2013-10-14 17:16:08 +02:00
nft_cmp.c	netfilter: nf_tables: add compatibility layer for x_tables	2013-10-14 18:00:04 +02:00
nft_compat.c	netfilter: nf_tables: add support for multi family tables	2014-01-07 23:55:46 +01:00
nft_counter.c	netfilter: nf_tables: expression ops overloading	2013-10-14 17:16:08 +02:00
nft_ct.c	netfilter: nft_ct: labels get support	2014-02-19 11:41:25 +01:00
nft_expr_template.c	netfilter: nf_tables: expression ops overloading	2013-10-14 17:16:08 +02:00
nft_exthdr.c	netfilter: nft_exthdr: call ipv6_find_hdr() with explicitly initialized offset	2013-12-20 11:25:10 +01:00
nft_hash.c	Revert "netfilter: avoid get_random_bytes calls"	2014-01-06 14:00:55 +01:00
nft_immediate.c	netfilter: nf_tables: add compatibility layer for x_tables	2013-10-14 18:00:04 +02:00
nft_limit.c	netfilter: nf_tables: expression ops overloading	2013-10-14 17:16:08 +02:00
nft_log.c	netfilter: nf_tables: fix log/queue expressions for NFPROTO_INET	2014-02-06 11:41:38 +01:00
nft_lookup.c	net: Include appropriate header file in netfilter/nft_lookup.c	2014-02-09 17:32:50 -08:00
nft_meta.c	netfilter: nft_meta: fix lack of validation of the input register	2014-01-09 20:04:16 +01:00
nft_nat.c	netfilter: nft_nat: Fix endianness issue reported by sparse	2013-10-28 17:41:49 +01:00
nft_payload.c	netfilter: nf_tables: nft_payload: fix transport header base	2013-10-14 18:00:56 +02:00
nft_queue.c	netfilter: nf_tables: fix log/queue expressions for NFPROTO_INET	2014-02-06 11:41:38 +01:00
nft_rbtree.c	netfilter: nft_rbtree: fix data handling of end interval elements	2014-02-07 14:22:06 +01:00
nft_reject.c	netfilter: nft_reject: split up reject module into IPv4 and IPv6 specifc parts	2014-02-06 09:44:10 +01:00
nft_reject_inet.c	netfilter: nf_tables: add reject module for NFPROTO_INET	2014-02-06 09:44:18 +01:00
x_tables.c	netfilter: x_tables: fix ordering of jumpstack allocation and table update	2013-10-22 10:11:29 +02:00
xt_addrtype.c	netfilter: xt_addrtype: fix trivial typo	2013-07-31 16:36:25 +02:00
xt_AUDIT.c
xt_bpf.c
xt_cgroup.c	netfilter: x_tables: lightweight process control group matching	2014-01-03 23:41:44 +01:00
xt_CHECKSUM.c
xt_CLASSIFY.c
xt_cluster.c
xt_comment.c
xt_connbytes.c	netfilter: introduce nf_conn_acct structure	2013-11-03 21:48:49 +01:00
xt_connlabel.c
xt_connlimit.c	Revert "netfilter: avoid get_random_bytes calls"	2014-01-06 14:00:55 +01:00
xt_connmark.c	netfilter: Fix FSF address in file headers	2013-12-06 12:37:57 -05:00
xt_CONNSECMARK.c
xt_conntrack.c
xt_cpu.c
xt_CT.c	netfilter: nf_conntrack: don't release a conntrack with non-zero refcnt	2014-02-05 17:46:06 +01:00
xt_dccp.c
xt_devgroup.c
xt_dscp.c
xt_DSCP.c
xt_ecn.c
xt_esp.c
xt_hashlimit.c	Revert "netfilter: avoid get_random_bytes calls"	2014-01-06 14:00:55 +01:00
xt_helper.c
xt_hl.c
xt_HL.c
xt_HMARK.c
xt_IDLETIMER.c
xt_ipcomp.c	netfilter: xt_ipcomp: Use ntohs to ease sparse warning	2014-02-19 11:41:25 +01:00
xt_iprange.c
xt_ipvs.c
xt_l2tp.c	netfilter: introduce l2tp match extension	2014-01-09 21:36:39 +01:00
xt_LED.c
xt_length.c
xt_limit.c
xt_LOG.c	netfilter: xt_LOG: fix mark logging for IPv6 packets	2013-05-29 12:29:18 +02:00
xt_mac.c
xt_mark.c
xt_multiport.c
xt_nat.c
xt_NETMAP.c
xt_nfacct.c
xt_NFLOG.c	netfilter: log: netns NULL ptr bug when calling from conntrack	2013-05-15 14:11:07 +02:00
xt_NFQUEUE.c	netfilter: xt_NFQUEUE: separate reusable code	2013-12-07 23:20:45 +01:00
xt_osf.c	netfilter: Fix FSF address in file headers	2013-12-06 12:37:57 -05:00
xt_owner.c
xt_physdev.c
xt_pkttype.c
xt_policy.c
xt_quota.c
xt_RATEEST.c	Revert "netfilter: avoid get_random_bytes calls"	2014-01-06 14:00:55 +01:00
xt_rateest.c	net_sched: add 64bit rate estimators	2013-06-11 02:51:03 -07:00
xt_realm.c
xt_recent.c	Revert "netfilter: avoid get_random_bytes calls"	2014-01-06 14:00:55 +01:00
xt_REDIRECT.c
xt_repldata.h
xt_sctp.c
xt_SECMARK.c
xt_set.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-11-15 16:47:22 -08:00
xt_socket.c	netfilter: xt_socket: use sock_gen_put()	2013-10-17 10:27:25 +02:00
xt_state.c
xt_statistic.c	net: replace macros net_random and net_srandom with direct calls to prandom	2014-01-14 15:15:25 -08:00
xt_string.c
xt_TCPMSS.c	netfilter: xt_TCPMSS: lookup route from proper net namespace	2013-09-27 16:18:23 +02:00
xt_tcpmss.c
xt_TCPOPTSTRIP.c	netfilter: xt_TCPOPTSTRIP: fix possible off by one access	2013-08-01 11:45:15 +02:00
xt_tcpudp.c
xt_TEE.c	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
xt_time.c
xt_TPROXY.c	ipv6: make lookups simpler and faster	2013-10-09 00:01:25 -04:00
xt_TRACE.c
xt_u32.c