Forceadd is a property for hash set types and is passed in duration creation. When sets with this property enabled are full each subsequent 'add' operation will attempt to evict a random entry from the set. The implementation tries to keep the overhead low by checking to see which bucket the new entry hashes to. If that bucket has any entries it will evict the first one and add the new entry. Ex usage: ipset create foo hash:ip forceadd The intended usecase is for things like 'ban' lists where you may not be concerned with possibly evicting something early, and more concerned with the size of the hash itself. Josh Hunt (2): ipset: add forceadd kernel support for hash set types ipset: add forceadd userspace support for hash set types include/libipset/data.h | 4 +- include/libipset/linux_ip_set.h | 1 + include/libipset/parse.h | 3 + kernel/include/uapi/linux/netfilter/ipset/ip_set.h | 1 + kernel/net/netfilter/ipset/ip_set_hash_gen.h | 26 +++- kernel/net/netfilter/ipset/ip_set_hash_ip.c | 4 +- kernel/net/netfilter/ipset/ip_set_hash_ipmark.c | 3 +- kernel/net/netfilter/ipset/ip_set_hash_ipport.c | 4 +- kernel/net/netfilter/ipset/ip_set_hash_ipportip.c | 4 +- kernel/net/netfilter/ipset/ip_set_hash_ipportnet.c | 4 +- kernel/net/netfilter/ipset/ip_set_hash_net.c | 4 +- kernel/net/netfilter/ipset/ip_set_hash_netiface.c | 4 +- kernel/net/netfilter/ipset/ip_set_hash_netnet.c | 3 +- kernel/net/netfilter/ipset/ip_set_hash_netport.c | 4 +- .../net/netfilter/ipset/ip_set_hash_netportnet.c | 4 +- lib/data.c | 8 + lib/debug.c | 1 + lib/ipset_hash_ip.c | 123 ++++++++++++++ lib/ipset_hash_ipmark.c | 142 ++++++++++++++++ lib/ipset_hash_ipport.c | 147 +++++++++++++++++ lib/ipset_hash_ipportip.c | 158 ++++++++++++++++++ lib/ipset_hash_ipportnet.c | 169 ++++++++++++++++++++ lib/ipset_hash_net.c | 119 ++++++++++++++ lib/ipset_hash_netiface.c | 125 +++++++++++++++ lib/ipset_hash_netnet.c | 125 +++++++++++++++ lib/ipset_hash_netport.c | 132 +++++++++++++++ lib/ipset_hash_netportnet.c | 149 +++++++++++++++++ lib/parse.c | 21 +++ lib/print.c | 4 + lib/session.c | 4 + src/ipset.8 | 7 + 31 files changed, 1494 insertions(+), 13 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
