netfilter: ipset: Support to match elements marked with "nomatch"
authorJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Fri, 21 Sep 2012 20:02:36 +0000 (22:02 +0200)
committerJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Sat, 22 Sep 2012 20:44:34 +0000 (22:44 +0200)
commit3e0304a583d72c747caa8afac76b8d514aa293f5
tree134fd8cc48ed72be16a7ca2f90b169de103bec2e
parent3ace95c0ac125a042cfb682d0a9bbdbf1e5a2c65
netfilter: ipset: Support to match elements marked with "nomatch"

Exceptions can now be matched and we can branch according to the
possible cases:

a. match in the set if the element is not flagged as "nomatch"
b. match in the set if the element is flagged with "nomatch"
c. no match

i.e.

iptables ... -m set --match-set ... -j ...
iptables ... -m set --match-set ... --nomatch-entries -j ...
...

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
include/linux/netfilter/ipset/ip_set.h
net/netfilter/ipset/ip_set_core.c
net/netfilter/ipset/ip_set_hash_ipportnet.c
net/netfilter/ipset/ip_set_hash_net.c
net/netfilter/ipset/ip_set_hash_netiface.c
net/netfilter/ipset/ip_set_hash_netport.c
net/netfilter/xt_set.c