[PATCH nf 0/7] netfilter: switch ipset to rhashtable

[Florian Westphal <fw@strlen.de>]

1) Replace memory allocation in ipset delete operations with in-place
substitution. Move empty CIDR ranges to the end of the array.
This addresses LLM findings of a patch from the rhashtable preparation
series.

2) Fix list_type ext_size memory accounting on set flush. As-is,
flush sets the value to 0, but call_rcu() destructor can subtract again.
Addresses drive-by LLM report.

3) Add rhashtable boilerplate stubs to netfilter ipset. Implement rhashtable
initialization and destruction routines.

4) Add rhltable boilerplate stubs to netfilter ipset. Prepare transitioning
certain hash sets from rhashtable to rhltable.  Was not part of RFC,
needed for the 'net,iface.t' set type.

5) Replace ipset hash tables with rhashtable.
This change will splat on debug kernels, fix is queued as
'rhashtable: fix false-positive lockdep splat on rhltable destruction'
in herbert/crypto-2.6.git.

6) Restore forceadd support to ipset rhashtable via random element
eviction.

7) Include dynamic CIDR storage memory size in userspace reports.
Another LLM finding during review of initial preparation patches.

Florian Westphal (7):
  netfilter: ipset: remove need to allocate memory on delete operations
  netfilter: ipset: let destroy callbacks adjust ext mem size
  netfilter: ipset: add rhashtable boilerplate stubs
  netfilter: ipset: add rhltable boilerplate stubs
  netfilter: ipset: replace internal hash table with rhashtable
  netfilter: ipset: re-add forceadd support for rhashtable
  netfilter: ipset: also report mem size for cidr storage to userspace

 net/netfilter/ipset/ip_set_bitmap_gen.h      |    2 +-
 net/netfilter/ipset/ip_set_hash_gen.h        | 1716 ++++++++----------
 net/netfilter/ipset/ip_set_hash_netiface.c   |   25 +-
 net/netfilter/ipset/ip_set_hash_netportnet.c |    1 -
 net/netfilter/ipset/ip_set_list_set.c        |    3 +-
 5 files changed, 734 insertions(+), 1013 deletions(-)

-- 
2.54.0