新版本的ipset

上周在儿童医院给小小看病等待叫号的间隙，收到了Netfilter邮件列表的推送消息，一览了ipset最新的6.23版本的新特性，很多正是我目前所需要的，特别是timeout和skbinfo参数的支持，具体的详情请自行查看manual，如果不想看那么多，我这里简单的贴一下：

编译

总之，相比较老版本的4.5，确实增加了不少新的东西，于是就迫不及待地下载，编译，试用，一般而言，这些步骤都是例行的，都不会遇到什么特别大的困难，特别是看了其README之后：

#ifdef HAVE_CHECKENTRY_BOOL
#define CHECK_OK    1
#define CHECK_FAIL(err) 0
#define CONST       const
#define FTYPE       bool
#define XT_PAR_NET(par) NULL
#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35) */
#define CHECK_OK    0
#define CHECK_FAIL(err) (err)
#define CONST
#define FTYPE       int
#define XT_PAR_NET(par) (par)->net
#endif

if test -f $ksourcedir/net/netfilter/xt_state.c &&     $GREP -q ‘bool state_mt_check‘ $ksourcedir/net/netfilter/xt_state.c; then
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
$as_echo "yes" >&6; }
    HAVE_CHECKENTRY_BOOL=define
else
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
$as_echo "no" >&6; }
    HAVE_CHECKENTRY_BOOL=undef
fi

if (par->target->checkentry != NULL && !par->target->checkentry(par))
    return -EINVAL;

diff -Nur ipset-6.23/kernel/include/linux/netfilter/ipset/ip_set.h ipset-6.23.new/kernel/include/linux/netfilter/ipset/ip_set.h
--- ipset-6.23/kernel/include/linux/netfilter/ipset/ip_set.h    2014-09-23 19:18:34.000000000 +0800
+++ ipset-6.23.new/kernel/include/linux/netfilter/ipset/ip_set.h        2014-11-13 16:27:15.000000000 +0800
@@ -26,6 +26,9 @@
 #define IP_SET_MODULE_DESC(a, b, c)                    _IP_SET_MODULE_DESC(a, __stringify(b), __stringify(c))
 
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,35)
+#define SIZE_MAX       (~(size_t)0)
+#endif
 /* Set features */
 enum ip_set_feature {
        IPSET_TYPE_IP_FLAG = 0,
diff -Nur ipset-6.23/kernel/net/netfilter/xt_set.c ipset-6.23.new/kernel/net/netfilter/xt_set.c
--- ipset-6.23/kernel/net/netfilter/xt_set.c    2014-09-23 19:18:34.000000000 +0800
+++ ipset-6.23.new/kernel/net/netfilter/xt_set.c        2014-11-13 16:26:50.000000000 +0800
@@ -28,12 +28,18 @@
 MODULE_ALIAS("ipt_SET");
 MODULE_ALIAS("ip6t_SET");
 
-#ifdef HAVE_CHECKENTRY_BOOL
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,35)
 #define CHECK_OK       1
 #define CHECK_FAIL(err)        0
 #define        CONST           const
 #define FTYPE          bool
+/* Only confirm version 2.6.32 :) */
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2,6,32)
+/* netns is not supported completly */
+#define        XT_PAR_NET(par) (&init_net)
+#else
 #define        XT_PAR_NET(par) NULL
+#endif
 #else /* LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35) */
 #define CHECK_OK       0
 #define CHECK_FAIL(err)        (err)
@@ -217,7 +223,7 @@
 
 /* Revision 0 interface: backward compatible with netfilter/iptables */
 
-#ifdef HAVE_XT_TARGET_PARAM
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,35)
 #undef xt_action_param
 #define xt_action_param        xt_target_param
 #define CAST_TO_MATCH  (const struct xt_match_param *)

编译后记：

1.关于命名空间

struct net {
    ...
    struct net_generic    *gen;
}

struct net_generic {
    unsigned int len;
    struct rcu_head rcu;

    void *ptr[0];
};

/*
 * Generic net pointers are to be used by modules to put some private
 * stuff on the struct net without explicit struct net modification
 *
 * The rules are simple:
 * 1. register the ops with register_pernet_gen_device to get the id
 *    of your private pointer;
 * 2. call net_assign_generic() to put the private data on the struct
 *    net (most preferably this should be done in the ->init callback
 *    of the ops registered);
 * 3. do not change this pointer while the net is alive;
 * 4. do not try to have any private reference on the net_generic object.
 *
 * After accomplishing all of the above, the private pointer can be
 * accessed with the net_generic() call.
 */

static inline struct ip_set_net *ip_set_pernet(struct net *net)
{
    return net_generic(net, ip_set_net_id);
}

2.我是不是该提交一个patch

于Linux-2.6.32内核上编译ipset-6.23的坎坷经历