Re: [PATCH] BUG: libiptc chain references bug

[Pablo Neira Ayuso <pablo@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 931 bytes --]

Hi Jesper,

Jesper Dangaard Brouer wrote:
> 
> Correcting a chain references increment bug in libiptc.
> 
> The bug lies in function iptc_delete_entry() / TC_DELETE_ENTRY.  The
> problem is the construction of "r" the rule entry, that is used for
> comparison. The problem is that the function iptcc_map_target()
> increase the target chains references count.
> 
> The fix is to use function iptcc_delete_rule() to delete the "r" rule
> (as it decrement the counter again). To make it work a small NULL
> pointer check is also added iptcc_delete_rule().
> 
> Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk>

I don't like too much the is-the-rule-in-list checking in delete_entry, 
please, could you tell me what you think about the patch attached? I 
think it's cleaner. Thanks.

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of 
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris

[-- Attachment #2: x --]
[-- Type: text/plain, Size: 637 bytes --]

Based on Jesper Dangaard Brouer's patch.

Index: libiptc/libiptc.c
===================================================================
--- libiptc/libiptc.c	(revisión: 6644)
+++ libiptc/libiptc.c	(copia de trabajo)
@@ -1543,6 +1543,14 @@
 		c->num_rules--;
 		iptcc_delete_rule(i);
 
+		/* Since iptcc_map_target increments refcounting of
+		 * the target chain used by the fake rule, once we
+		 * have matched it against the real rule, do not forget
+		 * to drop the refcount that the fake rule holds */
+		if (r->type == IPTCC_R_JUMP
+		    && r->jump)
+			r->jump->references--;
+
 		set_changed(*handle);
 		free(r);
 		return 1;