Re: [ANNOUNCE] ipset-5.0 released

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




I'm happy to announce the new branch of ipset and release it's first element, ipset-5.0.
I see that you have considered my suggestions and added port ranges to the hash sets. That will make my job much easier! Thank you!

Is there any difference between hash:net,ip and hash:ip,port? It seems as though I can specify subnets (CIDR format) of different sizes in both sets!

I also spotted another feature I previously missed when looked at 5.0-pre10 - nesting of datatypes (I think the default is 4, which would be enough for 99% of cases). That is absolutely brilliant as up until now I have used multiple --match-set directives to do that job, which can now be done 'internally' by ipset. It also addresses the issue of 'binding' (a feature dropped in earlier ipset releases and a feature I badly missed if I am being honest), but the implementation this time is much better. This set of features will be put to the test as I will be using them quite extensively!

I do have another question however: Currently the protocol part from the port ranges (hash sets) is not mandatory. Does that mean that if I omit it then the port range is matched *regardless* of the protocol (tcp or udp)? For example, if I have 10.1.1.0/24,80 would that match 10.1.1.1:tcp:80 *and* 10.1.1.1:udp:80? If so, that is very good news!

I downloaded the source to look at, but won't compile it just yet as I am waiting for this version to be integrated in the xtables tree and hoping that integration is flawless and without the silly compile-time errors as was the case with previous xtables releases (*nudges Jan*).

As part of that process I will try and create the .spec file needed to build the Fedora rpm package (it would be for FC13 as I am yet to migrate to FC14) and will submit it with them to integrate it with FC as soon as possible.

Final question from me: As part of the ipset-5.0 package you provide a netlink patch file. I have read the README and it seems that the only time that patch needs to be applied is if the kernel version is >= 2.6.31. Is that the case and are there any other constraints/requirements? Do I apply this patch if the kernel version is <= 2.6.31? It is important for me to know the answer to this question when I prepare the .spec file for building the rpm for Fedora.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux