[ANNOUNCE] ipset-2.3.2

[ANNOUNCE] ipset-2.3.2

[Jozsef Kadlecsik]

Hi,

I'm happy to announce ipset-2.3.2. Besides cosmetic changes and cleanups, 
this release includes the sources of both the userspace tool and the 
kernel modules: you can install ipset wihtout patch-o-matic-ng. Please 
read the README file for the instructions on how to install ipset without 
pom-ng.

You can download ipset from the home page or from the svn repository

	http://ipset.netfilter.org/
	https://svn.netfilter.org/netfilter/trunk/ipset

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: [ANNOUNCE] ipset-2.3.2

[Krzysztof Oledzki]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 364 bytes --]



On Wed, 2 Jul 2008, Jozsef Kadlecsik wrote:

> Hi,
Hi,

> I'm happy to announce ipset-2.3.2. Besides cosmetic changes and cleanups,
> this release includes the sources of both the userspace tool and the
> kernel modules: you can install ipset wihtout patch-o-matic-ng.

Is statically linking still supported?

Best regards,

 				Krzysztof Olędzki

Re: [ANNOUNCE] ipset-2.3.2

[Jozsef Kadlecsik]

On Wed, 2 Jul 2008, Krzysztof Oledzki wrote:

> Is statically linking still supported?

No, it has never been supported. (Probaly you mean iptables?)

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: [ANNOUNCE] ipset-2.3.2

[Jan Engelhardt]

On Wednesday 2008-07-02 15:37, Krzysztof Oledzki wrote:
> On Wed, 2 Jul 2008, Jozsef Kadlecsik wrote:
>
>> I'm happy to announce ipset-2.3.2. Besides cosmetic changes and cleanups,
>> this release includes the sources of both the userspace tool and the
>> kernel modules: you can install ipset wihtout patch-o-matic-ng.
>
> Is statically linking still supported?

Theoretically yes (with xtables-addons), but it is not automated as
of v1.5.4.1, so it is a hand-job modifying two kernel files (Makefile
and Kconfig) to include an .. include line to enter our directory.

Re: [ANNOUNCE] ipset-2.3.2

[Krzysztof Oledzki]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 526 bytes --]



On Wed, 2 Jul 2008, Jozsef Kadlecsik wrote:

> On Wed, 2 Jul 2008, Krzysztof Oledzki wrote:
>
>> Is statically linking still supported?
>
> No, it has never been supported. (Probaly you mean iptables?)

No, I mean kernel.

I ask because http://ipset.netfilter.org/install.html no longer points to 
a pom-ng file and it seems that 
ftp://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/ is currently 
abandoned - there have been no new files created since 2008-05-21.

Best regards,

 				Krzysztof Olędzki

Re: [ANNOUNCE] ipset-2.3.2

[Jozsef Kadlecsik]

On Wed, 2 Jul 2008, Krzysztof Oledzki wrote:

> > > Is statically linking still supported?
> > 
> > No, it has never been supported. (Probaly you mean iptables?)
> 
> No, I mean kernel.
> 
> I ask because http://ipset.netfilter.org/install.html no longer points to a
> pom-ng file and it seems that
> ftp://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/ is currently abandoned
> - there have been no new files created since 2008-05-21.

Oh, I see. I'll add back a pom-ng snapshot to ipset.netfilter.org. The 
pom-ng repository is available from svn - the snapshot creation was 
probably stopped when most of the repositories were moved to git.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: [ANNOUNCE] ipset-2.3.2

[Ludwig Nussel]

Jozsef Kadlecsik wrote:
> I'm happy to announce ipset-2.3.2. Besides cosmetic changes and cleanups, 
> this release includes the sources of both the userspace tool and the 
> kernel modules: you can install ipset wihtout patch-o-matic-ng. Please 
> read the README file for the instructions on how to install ipset without 
> pom-ng.

Ah, nice. I'd like to suggest to add the following patch. It
separates building the kernel modules and the user space parts. That
eases packaging for distributions as the kernel part has to be
compiled several times for different kernel flavors so the
integrated way is not really useful there :-)
Additionally IP_NF_SET_MAX and IP_NF_SET_HASHSIZE should be moved to
kernel/Kbuild for that purpose. Atm one has to extract them from the
Makefile and define them manually for the kernel module build pass.

btw is there a reason why the tarball has a date appended to the
release number? I just wonder whether the package version should be
2.3.2_20080702 or whether 2.3.2 suffices.

Signed-off-by: Ludwig Nussel <ludwig.nussel@suse.de>

---
 Makefile |   12 ++++++++----
 1 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/Makefile b/Makefile
index 253498e..3b4abe1 100644
--- a/Makefile
+++ b/Makefile
@@ -5,7 +5,7 @@
 ######################################################################
 
 ifndef KERNEL_DIR
-KERNEL_DIR=/usr/src/linux
+KERNEL_DIR=KERNEL_DIR=/lib/modules/$(shell uname -r)/build
 endif
 ifndef IP_NF_SET_MAX
 IP_NF_SET_MAX=256
@@ -36,7 +36,11 @@ SHARED_LIBS=$(foreach T, $(SETTYPES),libipset_$(T).so)
 INSTALL=$(DESTDIR)$(BINDIR)/ipset $(DESTDIR)$(MANDIR)/man8/ipset.8
 INSTALL+=$(foreach T, $(SETTYPES), $(DESTDIR)$(LIBDIR)/ipset/libipset_$(T).so)
 
-all: $(PROGRAMS) $(SHARED_LIBS)
+all: ipset modules
+
+ipset: $(PROGRAMS) $(SHARED_LIBS)
+
+modules:
 	cd kernel; make -C $(KERNEL_DIR) M=`pwd` IP_NF_SET_MAX=$(IP_NF_SET_MAX) IP_NF_SET_HASHSIZE=$(IP_NF_SET_HASHSIZE) modules
 
 .PHONY: tests
@@ -44,9 +48,9 @@ all: $(PROGRAMS) $(SHARED_LIBS)
 tests:
 	cd tests; ./runtest.sh
 
-ipset_install: all $(INSTALL)
+ipset_install: ipset $(INSTALL)
 
-modules_install:
+modules_install: modules
 	cd kernel; make -C $(KERNEL_DIR) M=`pwd` modules_install
 
 install: ipset_install modules_install
-- 
1.5.6


cu
Ludwig

-- 
 (o_   Ludwig Nussel
 //\   
 V_/_  http://www.suse.de/
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)

Re: [ANNOUNCE] ipset-2.3.2

[Ludwig Nussel]

Ludwig Nussel wrote:
> Jozsef Kadlecsik wrote:
> > I'm happy to announce ipset-2.3.2. Besides cosmetic changes and cleanups, 
> > this release includes the sources of both the userspace tool and the 
> > kernel modules: you can install ipset wihtout patch-o-matic-ng. Please 
> > read the README file for the instructions on how to install ipset without 
> > pom-ng.
> 
> Ah, nice. I'd like to suggest to add the following patch. It
> separates building the kernel modules and the user space parts. That
> [...]
> +ipset: $(PROGRAMS) $(SHARED_LIBS)

*grmbl* Not using targets that are also programs actually
produces a working binary.

Signed-off-by: Ludwig Nussel <ludwig.nussel@suse.de>

diff --git a/Makefile b/Makefile
index 3b4abe1..e049d4f 100644
--- a/Makefile
+++ b/Makefile
@@ -36,9 +36,9 @@ SHARED_LIBS=$(foreach T, $(SETTYPES),libipset_$(T).so)
 INSTALL=$(DESTDIR)$(BINDIR)/ipset $(DESTDIR)$(MANDIR)/man8/ipset.8
 INSTALL+=$(foreach T, $(SETTYPES), $(DESTDIR)$(LIBDIR)/ipset/libipset_$(T).so)
 
-all: ipset modules
+all: userspace modules
 
-ipset: $(PROGRAMS) $(SHARED_LIBS)
+userspace: $(PROGRAMS) $(SHARED_LIBS)
 
 modules:
 	cd kernel; make -C $(KERNEL_DIR) M=`pwd` IP_NF_SET_MAX=$(IP_NF_SET_MAX) IP_NF_SET_HASHSIZE=$(IP_NF_SET_HASHSIZE) modules
@@ -48,7 +48,7 @@ modules:
 tests:
 	cd tests; ./runtest.sh
 
-ipset_install: ipset $(INSTALL)
+ipset_install: userspace $(INSTALL)
 
 modules_install: modules
 	cd kernel; make -C $(KERNEL_DIR) M=`pwd` modules_install
-- 
1.5.6

-- 
 (o_   Ludwig Nussel
 //\   
 V_/_  http://www.suse.de/
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)

Re: [ANNOUNCE] ipset-2.3.2

[Jozsef Kadlecsik]

On Wed, 2 Jul 2008, Jozsef Kadlecsik wrote:

> On Wed, 2 Jul 2008, Krzysztof Oledzki wrote:
> 
> > > > Is statically linking still supported?
> > > 
> > > No, it has never been supported. (Probaly you mean iptables?)
> > 
> > No, I mean kernel.
> > 
> > I ask because http://ipset.netfilter.org/install.html no longer points to a
> > pom-ng file and it seems that
> > ftp://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/ is currently abandoned
> > - there have been no new files created since 2008-05-21.
> 
> Oh, I see. I'll add back a pom-ng snapshot to ipset.netfilter.org. The 
> pom-ng repository is available from svn - the snapshot creation was 
> probably stopped when most of the repositories were moved to git.

In ordert to cut the last ropes tying ipset to pom-ng, I added support to 
"patch" the kernel directly to the ipset package. 

So I have just released ipset-2.3.2a, which includes the required bits and 
files with and updated README file on how to compile modular and 
non-modular kernels with ipset support. Please give it a try and report me 
if something would be missing.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: [ANNOUNCE] ipset-2.3.2

[Jozsef Kadlecsik]

Hi,

On Thu, 3 Jul 2008, Ludwig Nussel wrote:

> Jozsef Kadlecsik wrote:
> > I'm happy to announce ipset-2.3.2. Besides cosmetic changes and cleanups, 
> 
> Ah, nice. I'd like to suggest to add the following patch. It
> separates building the kernel modules and the user space parts. That
> eases packaging for distributions as the kernel part has to be
> compiled several times for different kernel flavors so the
> integrated way is not really useful there :-)

Please check out ipset-2.3.2a, which has got 'binaries', 
'binaries_install' targets for the userspace part and 'modules', 
'modules_install' for the kernel modules.

> Additionally IP_NF_SET_MAX and IP_NF_SET_HASHSIZE should be moved to
> kernel/Kbuild for that purpose. Atm one has to extract them from the
> Makefile and define them manually for the kernel module build pass.

I wanted one "toplevel" Makefile which makes possible to compile and 
install the whole bunch in one "step". 

The defaults for IP_NF_SET_MAX and IP_NF_SET_HASHSIZE should be moved to 
kernel/Kbuild, yes.
 
> btw is there a reason why the tarball has a date appended to the
> release number? I just wonder whether the package version should be
> 2.3.2_20080702 or whether 2.3.2 suffices.

At the first glace it looks like a redundant information, but there should 
be a version number for the 'ipset' binary and a "version number" for the 
kernel modules. As the second one does not exist, the release date helps 
to distinguis releases where the kernel part changed alone.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: [ANNOUNCE] ipset-2.3.2

[Krzysztof Oledzki]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 1253 bytes --]



On Thu, 3 Jul 2008, Jozsef Kadlecsik wrote:

> On Wed, 2 Jul 2008, Jozsef Kadlecsik wrote:
>
>> On Wed, 2 Jul 2008, Krzysztof Oledzki wrote:
>>
>>>>> Is statically linking still supported?
>>>>
>>>> No, it has never been supported. (Probaly you mean iptables?)
>>>
>>> No, I mean kernel.
>>>
>>> I ask because http://ipset.netfilter.org/install.html no longer points to a
>>> pom-ng file and it seems that
>>> ftp://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/ is currently abandoned
>>> - there have been no new files created since 2008-05-21.
>>
>> Oh, I see. I'll add back a pom-ng snapshot to ipset.netfilter.org. The
>> pom-ng repository is available from svn - the snapshot creation was
>> probably stopped when most of the repositories were moved to git.
>
> In ordert to cut the last ropes tying ipset to pom-ng, I added support to
> "patch" the kernel directly to the ipset package.
>
> So I have just released ipset-2.3.2a, which includes the required bits and
> files with and updated README file on how to compile modular and
> non-modular kernels with ipset support. Please give it a try and report me
> if something would be missing.

Works For Me, thank you.

Best regards,

 				Krzysztof Olędzki

Re: [ANNOUNCE] ipset-2.3.2

[G.W. Haywood]

Hi there,

On Thu, 3 Jul 2008, Jozsef Kadlecsik wrote:

> ...  released ipset-2.3.2a, which includes the required bits and
> files with and updated README file on how to compile modular and
> non-modular kernels with ipset support. Please give it a try ...

----------------------------------------------------------------------
prompt$ >>> ./libc.so.6
GNU C Library stable release version 2.3.4, by Roland McGrath et al.
Copyright (C) 2004 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
Compiled by GNU CC version 3.3.4.
Compiled on a Linux 2.4.29 system on 2005-01-28.
Available extensions:
        GNU libio by Per Bothner
        crypt add-on version 2.1 by Michael Glad and others
        GNU Libidn by Simon Josefsson
        linuxthreads-0.10 by Xavier Leroy
        BIND-8.2.3-T5B
        libthread_db work sponsored by Alpha Processor Inc
        NIS(YP)/NIS+ NSS modules 0.19 by Thorsten Kukuk
For bug reporting instructions, please see:
<http://www.gnu.org/software/libc/bugs.html>.
----------------------------------------------------------------------
prompt$ >>> gcc -v
Using built-in specs.
Target: i686-pc-linux-gnu
Configured with: /home/ged/src/gcc-4.0.2/configure
Thread model: posix
gcc version 4.0.2
----------------------------------------------------------------------

I followed the instructions on the Web page:

http://ipset.netfilter.org/install.html

(it wasn't hard:)

Very smooth, no problems at all.  Thank you very much.

I suppose a 2.4 kernel is out of the question?

I only ask because the place I really _need_ ipsets is on a machine that's
still running a 2.4 kernel - the one that's sending this mail - currently
it has 45,000 ipsets. :)

--

73,
Ged.

Re: [ANNOUNCE] ipset-2.3.2

[Jozsef Kadlecsik]

On Thu, 3 Jul 2008, G.W. Haywood wrote:

> I suppose a 2.4 kernel is out of the question?
> 
> I only ask because the place I really _need_ ipsets is on a machine that's
> still running a 2.4 kernel - the one that's sending this mail - currently
> it has 45,000 ipsets. :)

Wow! Actually, it's not that hard to support 2.4 kernels, I was just lazy 
to keep it in 2.3.2. It'll put it back in the next days.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: [ANNOUNCE] ipset-2.3.2

[Ludwig Nussel]

Jozsef Kadlecsik wrote:
> On Thu, 3 Jul 2008, Ludwig Nussel wrote:
> 
> > Jozsef Kadlecsik wrote:
> > > I'm happy to announce ipset-2.3.2. Besides cosmetic changes and cleanups, 
> > 
> > Ah, nice. I'd like to suggest to add the following patch. It
> > separates building the kernel modules and the user space parts. That
> > eases packaging for distributions as the kernel part has to be
> > compiled several times for different kernel flavors so the
> > integrated way is not really useful there :-)
> 
> Please check out ipset-2.3.2a, which has got 'binaries', 
> 'binaries_install' targets for the userspace part and 'modules', 
> 'modules_install' for the kernel modules.

That one works without patching now, thanks!

AFAICS one has to manually add PF_EXT_SLIB+=set SET to
extensions/Makefile to have iptables actually compile with ipset
support. Is that the officially recommended way or did I miss some
option that makes this easier?

Do you have any plans to also support ipv6?

cu
Ludwig

-- 
 (o_   Ludwig Nussel
 //\   
 V_/_  http://www.suse.de/
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)

Re: [ANNOUNCE] ipset-2.3.2

[Jan Engelhardt]

On Friday 2008-07-04 15:53, Ludwig Nussel wrote:
>
>AFAICS one has to manually add PF_EXT_SLIB+=set SET to

Not in 1.4.1 and up, which is what you should be using.
Also, since you come from @suse.de, I might infer that ipset
is a candidate for the distro kernel in which case one would
rather want it as additional modules.

Re: [ANNOUNCE] ipset-2.3.2

[Ludwig Nussel]

Jan Engelhardt wrote:
> On Friday 2008-07-04 15:53, Ludwig Nussel wrote:
> >
> >AFAICS one has to manually add PF_EXT_SLIB+=set SET to
> 
> Not in 1.4.1 and up, which is what you should be using.

Ah, the build system was changed. We still have 1.4.0 in the repo.
Needs to be updated.

> Also, since you come from @suse.de, I might infer that ipset
> is a candidate for the distro kernel in which case one would
> rather want it as additional modules.

So far there has been no request to include ipset support in any
SUSE distribution. I've just created ipset add-on packages in the
openSUSE build service for personal interest.

cu
Ludwig

-- 
 (o_   Ludwig Nussel
 //\   
 V_/_  http://www.suse.de/
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)

Re: [ANNOUNCE] ipset-2.3.2

[Jan Engelhardt]

On Friday 2008-07-04 16:14, Ludwig Nussel wrote:

>> >AFAICS one has to manually add PF_EXT_SLIB+=set SET to
>> Not in 1.4.1 and up, which is what you should be using.
>Ah, the build system was changed. We still have 1.4.0 in the repo.
>Needs to be updated.

It is a bit unfortunate that opensuse 11 got out before 1.4.1..
(/me eyes Patrick ;-)

>> Also, since you come from @suse.de, I might infer that ipset
>> is a candidate for the distro kernel in which case one would
>> rather want it as additional modules.
>
>So far there has been no request to include ipset support in any
>SUSE distribution. I've just created ipset add-on packages in the
>openSUSE build service for personal interest.

I have completed importing ipset and wiring up the Makefile logic
in xtables-addons (ipset branch). As such, there is also a SUSE rpm
in my repo (/suser-jengelh/SUSE-11.0/*/xtables-addons-*-1.5.4.2).


Jozsef, where do we go from here? ipset in xt-a, ACCEPT or DROP?

Re: [ANNOUNCE] ipset-2.3.2

[Jozsef Kadlecsik]

On Fri, 4 Jul 2008, Ludwig Nussel wrote:

> Do you have any plans to also support ipv6?

Yes! A major rewriting of ipset is ongoing, with the following goals:

+ (nf)netlink as communication channel instead of sockopt
+ library-based userspace tool with flexible input and output interfaces
+ IPv6 support
+ besides single (IP address) and double (IP+port) data storage,
  new set types with triples (IP+port+IP)
+ linear set type with other sets as elements ("union" of sets)
+ timeout support, possibly for every set type
- bindings as a dead end will be dropped

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: [ANNOUNCE] ipset-2.3.2

[Jozsef Kadlecsik]

On Fri, 4 Jul 2008, Jan Engelhardt wrote:

> I have completed importing ipset and wiring up the Makefile logic
> in xtables-addons (ipset branch). As such, there is also a SUSE rpm
> in my repo (/suser-jengelh/SUSE-11.0/*/xtables-addons-*-1.5.4.2).
> 
> Jozsef, where do we go from here? ipset in xt-a, ACCEPT or DROP?

As xtables-addons works with kernel 2.6.18.5 or above I cannot depend on 
it. Even supporting 2.4 kernels is still required - and if there's a 
single user who needs it, I do support the 2.4 series in ipset.

If you want to maintain a copy of ipset in xtables-addons, just go ahead.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: [ANNOUNCE] ipset-2.3.2

[Jan Engelhardt]

On sometime, Jozsef Kadlecsik wrote:
>
>As xtables-addons works with kernel 2.6.18.5 or above I cannot depend 
>on it. Even supporting 2.4 kernels is still required - and if there's a 
>single user who needs it, I do support the 2.4 series in ipset.

I seem to be the first one to even try <= 2.6.21.

  CC [M]  /home/jengelh/Coding/xtables/xtables-addons/extensions/ipset/ip_set_macipmap.o
In file included from /home/jengelh/Coding/xtables/xtables-addons/extensions/ipset/ip_set_macipmap.c:26:
/home/jengelh/Coding/xtables/xtables-addons/extensions/ipset/ip_set_malloc.h:8: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘init_max_page_size’
In file included from /home/jengelh/Coding/xtables/xtables-addons/extensions/ipset/ip_set_macipmap.c:26:
/home/jengelh/Coding/xtables/xtables-addons/extensions/ipset/ip_set_malloc.h: In function ‘harray_malloc’:
/home/jengelh/Coding/xtables/xtables-addons/extensions/ipset/ip_set_malloc.h:87: warning: implicit declaration of function ‘init_max_page_size’
make[5]: *** [/home/jengelh/Coding/xtables/xtables-addons/extensions/ipset/ip_set_macipmap.o] Error 1
make[4]: *** [/home/jengelh/Coding/xtables/xtables-addons/extensions/ipset] Error 2
make[3]: *** [_module_/home/jengelh/Coding/xtables/xtables-addons/extensions] Error 2
make[3]: Leaving directory `/lo/linux18'
make[2]: *** [modules] Error 2
make[2]: Leaving directory `/home/jengelh/Coding/xtables/xtables-addons/extensions'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/home/jengelh/Coding/xtables/xtables-addons'
make: *** [all] Error 2



commit 35783b5c51d079439b737053e2ab88c2eb9ccea7
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Mon Jul 7 11:07:15 2008 +0200

    ipset: fixup compile errors with 2.6.18.x and 2.6.20 warnings
---
 extensions/ipset/ip_set_iptree.c    |    2 +-
 extensions/ipset/ip_set_iptreemap.c |    2 +-
 extensions/ipset/ip_set_malloc.h    |    2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/extensions/ipset/ip_set_iptree.c b/extensions/ipset/ip_set_iptree.c
index 82ed54b..5170294 100644
--- a/extensions/ipset/ip_set_iptree.c
+++ b/extensions/ipset/ip_set_iptree.c
@@ -35,7 +35,7 @@ static int limit = MAX_RANGE;
  * to delete the gc timer at destroying/flushing a set */
 #define IPTREE_DESTROY_SLEEP	100
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20)
 static struct kmem_cache *branch_cachep;
 static struct kmem_cache *leaf_cachep;
 #else
diff --git a/extensions/ipset/ip_set_iptreemap.c b/extensions/ipset/ip_set_iptreemap.c
index 4c4cc97..bc102fc 100644
--- a/extensions/ipset/ip_set_iptreemap.c
+++ b/extensions/ipset/ip_set_iptreemap.c
@@ -30,7 +30,7 @@
 #define IPTREEMAP_DEFAULT_GC_TIME (5 * 60)
 #define IPTREEMAP_DESTROY_SLEEP (100)
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20)
 static struct kmem_cache *cachep_b;
 static struct kmem_cache *cachep_c;
 static struct kmem_cache *cachep_d;
diff --git a/extensions/ipset/ip_set_malloc.h b/extensions/ipset/ip_set_malloc.h
index 30701f4..ddf6389 100644
--- a/extensions/ipset/ip_set_malloc.h
+++ b/extensions/ipset/ip_set_malloc.h
@@ -5,7 +5,7 @@
 
 static size_t max_malloc_size = 0, max_page_size = 0;
 
-static inline bool init_max_page_size(void)
+static inline unsigned int init_max_page_size(void)
 {
 	size_t page_size = 0;
 	
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [ANNOUNCE] ipset-2.3.2

[Jan Engelhardt]

On Saturday 2008-07-05 01:09, Jozsef Kadlecsik wrote:
>On Fri, 4 Jul 2008, Jan Engelhardt wrote:
>
>> I have completed importing ipset and wiring up the Makefile logic
>> in xtables-addons (ipset branch). As such, there is also a SUSE rpm
>> in my repo (/suser-jengelh/SUSE-11.0/*/xtables-addons-*-1.5.4.2).
>> 
>> Jozsef, where do we go from here? ipset in xt-a, ACCEPT or DROP?
>
>As xtables-addons works with kernel 2.6.18.5 or above I cannot depend on 
>it. Even supporting 2.4 kernels is still required - and if there's a 
>single user who needs it, I do support the 2.4 series in ipset.

That is the existing code that depends on it --
there is probably a way to make it work with < 2.6.17
but I had not yet looked into it.

ipset still uses its own glue code, so is exempt from the
2.6.18.5 rule.