From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH 0/3] ipset fixes
Date: Mon, 24 Sep 2012 00:26:01 +0200 [thread overview]
Message-ID: <20120923222601.GA5624@1984> (raw)
In-Reply-To: <alpine.DEB.2.00.1209221705440.18018@blackhole.kfki.hu>
On Sat, Sep 22, 2012 at 09:22:08PM +0200, Jozsef Kadlecsik wrote:
[...]
> > Please, could you develop how critical are these above? We're fairly
> > late in the release cycle, I'd prefer if we pass only really critical
> > fixes.
>
> > > netfilter: ipset: Check and reject crazy /0 input parameters
>
> This one is easy to trigger: bitmap:ip sets are allowed to be created from
> range 0/0, but with /16 subnets as elements:
>
> ipset new foo bitmap:ip range 0/0 netmask 16
>
> However if "netmask 16" is left out accidentally, the kernel does not
> reject it but creates a broken set and the system will crash when the
> first element is added.
I see, this crash seems to be triggered in really rare situation.
> If we are quite late in the release cycle, maybe it can wait and be added
> to nf-next only.
We can still push fixes, but at this stage we should focus on fixes
that really happen in normal cases / typical usage IMO.
> > > netfilter: ipset: Fix cidr book keeping for hash:*net* types
>
> You asked to check how critical the bug is, and it was just the perfect
> question :-). I have re-checked and I was mistaken. The new case (zero
> cidr size), which was not handled by the old code, somehow misled me. So
> the patch description should be rewritten - I'm going to send a new batch
> of the patches against nf-next tomorrow. Thanks!
Will check tomorrow, thanks again!
prev parent reply other threads:[~2012-09-23 22:26 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-21 20:38 [PATCH 0/3] ipset fixes Jozsef Kadlecsik
2012-09-22 10:34 ` Pablo Neira Ayuso
2012-09-22 19:22 ` Jozsef Kadlecsik
2012-09-23 22:26 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120923222601.GA5624@1984 \
--to=pablo@netfilter.org \
--cc=kadlec@blackhole.kfki.hu \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.