netfilter: ipset: add forceadd kernel support for hash set types
authorJosh Hunt <johunt@akamai.com>
Sat, 1 Mar 2014 03:14:57 +0000 (22:14 -0500)
committerJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Thu, 6 Mar 2014 08:31:43 +0000 (09:31 +0100)
commit07cf8f5ae2657ac495b906c68ff3441ff8ba80ba
tree1492748285640e3445dfc7c0287836a84db60ffe
parent6843bc3c568128e8771ba35cfefe95b7ec1c93a8
netfilter: ipset: add forceadd kernel support for hash set types

Adds a new property for hash set types, where if a set is created
with the 'forceadd' option and the set becomes full the next addition
to the set may succeed and evict a random entry from the set.

To keep overhead low eviction is done very simply. It checks to see
which bucket the new entry would be added. If the bucket's pos value
is non-zero (meaning there's at least one entry in the bucket) it
replaces the first entry in the bucket. If pos is zero, then it continues
down the normal add process.

This property is useful if you have a set for 'ban' lists where it may
not matter if you release some entries from the set early.

Signed-off-by: Josh Hunt <johunt@akamai.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
14 files changed:
include/linux/netfilter/ipset/ip_set.h
include/uapi/linux/netfilter/ipset/ip_set.h
net/netfilter/ipset/ip_set_core.c
net/netfilter/ipset/ip_set_hash_gen.h
net/netfilter/ipset/ip_set_hash_ip.c
net/netfilter/ipset/ip_set_hash_ipmark.c
net/netfilter/ipset/ip_set_hash_ipport.c
net/netfilter/ipset/ip_set_hash_ipportip.c
net/netfilter/ipset/ip_set_hash_ipportnet.c
net/netfilter/ipset/ip_set_hash_net.c
net/netfilter/ipset/ip_set_hash_netiface.c
net/netfilter/ipset/ip_set_hash_netnet.c
net/netfilter/ipset/ip_set_hash_netport.c
net/netfilter/ipset/ip_set_hash_netportnet.c