* [PATCH 0/4] ipset patches for nf
@ 2013-09-16 18:47 Jozsef Kadlecsik
2013-09-16 18:47 ` [PATCH 1/4] netfilter: ipset: Skip really non-first fragments for IPv6 when getting port/protocol Jozsef Kadlecsik
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: Jozsef Kadlecsik @ 2013-09-16 18:47 UTC (permalink / raw)
To: netfilter-devel; +Cc: Pablo Neira Ayuso
Hi Pablo,
Next follows the ipset related fixes for the nf tree. Please consider applying them.
Best regards,
Jozsef
The following changes since commit d830f0fa1dd7ca447c38aec82cd44230e0b7ca75:
Phil Oester (1):
netfilter: nf_nat_proto_icmpv6:: fix wrong comparison in icmpv6_manip_pkt
are available in the git repository at:
git://blackhole.kfki.hu/nf master
Jozsef Kadlecsik (3):
netfilter: ipset: Skip really non-first fragments for IPv6 when getting port/protocol
netfilter: ipset: Consistent userspace testing with nomatch flag
netfilter: ipset: Validate the set family and not the set type family at swapping
Oliver Smith (1):
netfilter: ipset: Fix serious failure in CIDR tracking
include/linux/netfilter/ipset/ip_set.h | 6 +++-
net/netfilter/ipset/ip_set_core.c | 5 +--
net/netfilter/ipset/ip_set_getport.c | 4 +-
net/netfilter/ipset/ip_set_hash_gen.h | 28 +++++++++++++++-----------
net/netfilter/ipset/ip_set_hash_ipportnet.c | 4 +-
net/netfilter/ipset/ip_set_hash_net.c | 4 +-
net/netfilter/ipset/ip_set_hash_netiface.c | 4 +-
net/netfilter/ipset/ip_set_hash_netport.c | 4 +-
8 files changed, 32 insertions(+), 27 deletions(-)
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH 1/4] netfilter: ipset: Skip really non-first fragments for IPv6 when getting port/protocol 2013-09-16 18:47 [PATCH 0/4] ipset patches for nf Jozsef Kadlecsik @ 2013-09-16 18:47 ` Jozsef Kadlecsik 2013-09-16 18:47 ` [PATCH 2/4] netfilter: ipset: Consistent userspace testing with nomatch flag Jozsef Kadlecsik ` (3 subsequent siblings) 4 siblings, 0 replies; 6+ messages in thread From: Jozsef Kadlecsik @ 2013-09-16 18:47 UTC (permalink / raw) To: netfilter-devel; +Cc: Pablo Neira Ayuso Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> --- net/netfilter/ipset/ip_set_getport.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/net/netfilter/ipset/ip_set_getport.c b/net/netfilter/ipset/ip_set_getport.c index 6fdf88a..dac156f 100644 --- a/net/netfilter/ipset/ip_set_getport.c +++ b/net/netfilter/ipset/ip_set_getport.c @@ -116,12 +116,12 @@ ip_set_get_ip6_port(const struct sk_buff *skb, bool src, { int protoff; u8 nexthdr; - __be16 frag_off; + __be16 frag_off = 0; nexthdr = ipv6_hdr(skb)->nexthdr; protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr, &frag_off); - if (protoff < 0) + if (protoff < 0 || (frag_off & htons(~0x7)) != 0) return false; return get_port(skb, nexthdr, protoff, src, port, proto); -- 1.7.0.4 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/4] netfilter: ipset: Consistent userspace testing with nomatch flag 2013-09-16 18:47 [PATCH 0/4] ipset patches for nf Jozsef Kadlecsik 2013-09-16 18:47 ` [PATCH 1/4] netfilter: ipset: Skip really non-first fragments for IPv6 when getting port/protocol Jozsef Kadlecsik @ 2013-09-16 18:47 ` Jozsef Kadlecsik 2013-09-16 18:47 ` [PATCH 3/4] netfilter: ipset: Validate the set family and not the set type family at swapping Jozsef Kadlecsik ` (2 subsequent siblings) 4 siblings, 0 replies; 6+ messages in thread From: Jozsef Kadlecsik @ 2013-09-16 18:47 UTC (permalink / raw) To: netfilter-devel; +Cc: Pablo Neira Ayuso The "nomatch" commandline flag should invert the matching at testing, similarly to the --return-nomatch flag of the "set" match of iptables. Until now it worked with the elements with "nomatch" flag only. From now on it works with elements without the flag too, i.e: # ipset n test hash:net # ipset a test 10.0.0.0/24 nomatch # ipset t test 10.0.0.1 10.0.0.1 is NOT in set test. # ipset t test 10.0.0.1 nomatch 10.0.0.1 is in set test. # ipset a test 192.168.0.0/24 # ipset t test 192.168.0.1 192.168.0.1 is in set test. # ipset t test 192.168.0.1 nomatch 192.168.0.1 is NOT in set test. Before the patch the results were ... # ipset t test 192.168.0.1 192.168.0.1 is in set test. # ipset t test 192.168.0.1 nomatch 192.168.0.1 is in set test. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> --- include/linux/netfilter/ipset/ip_set.h | 6 ++++-- net/netfilter/ipset/ip_set_core.c | 3 +-- net/netfilter/ipset/ip_set_hash_ipportnet.c | 4 ++-- net/netfilter/ipset/ip_set_hash_net.c | 4 ++-- net/netfilter/ipset/ip_set_hash_netiface.c | 4 ++-- net/netfilter/ipset/ip_set_hash_netport.c | 4 ++-- 6 files changed, 13 insertions(+), 12 deletions(-) diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h index d80e275..9ac9fbd 100644 --- a/include/linux/netfilter/ipset/ip_set.h +++ b/include/linux/netfilter/ipset/ip_set.h @@ -296,10 +296,12 @@ ip_set_eexist(int ret, u32 flags) /* Match elements marked with nomatch */ static inline bool -ip_set_enomatch(int ret, u32 flags, enum ipset_adt adt) +ip_set_enomatch(int ret, u32 flags, enum ipset_adt adt, struct ip_set *set) { return adt == IPSET_TEST && - ret == -ENOTEMPTY && ((flags >> 16) & IPSET_FLAG_NOMATCH); + (set->type->features & IPSET_TYPE_NOMATCH) && + ((flags >> 16) & IPSET_FLAG_NOMATCH) && + (ret > 0 || ret == -ENOTEMPTY); } /* Check the NLA_F_NET_BYTEORDER flag */ diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c index f771390..c8c303c 100644 --- a/net/netfilter/ipset/ip_set_core.c +++ b/net/netfilter/ipset/ip_set_core.c @@ -1489,8 +1489,7 @@ ip_set_utest(struct sock *ctnl, struct sk_buff *skb, if (ret == -EAGAIN) ret = 1; - return (ret < 0 && ret != -ENOTEMPTY) ? ret : - ret > 0 ? 0 : -IPSET_ERR_EXIST; + return ret > 0 ? 0 : -IPSET_ERR_EXIST; } /* Get headed data of a set */ diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c index c6a5253..f15f3e2 100644 --- a/net/netfilter/ipset/ip_set_hash_ipportnet.c +++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c @@ -260,7 +260,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[], e.ip = htonl(ip); e.ip2 = htonl(ip2_from & ip_set_hostmask(e.cidr + 1)); ret = adtfn(set, &e, &ext, &ext, flags); - return ip_set_enomatch(ret, flags, adt) ? 1 : + return ip_set_enomatch(ret, flags, adt, set) ? -ret : ip_set_eexist(ret, flags) ? 0 : ret; } @@ -544,7 +544,7 @@ hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *tb[], if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) { ret = adtfn(set, &e, &ext, &ext, flags); - return ip_set_enomatch(ret, flags, adt) ? 1 : + return ip_set_enomatch(ret, flags, adt, set) ? -ret : ip_set_eexist(ret, flags) ? 0 : ret; } diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c index da740ce..223e9f5 100644 --- a/net/netfilter/ipset/ip_set_hash_net.c +++ b/net/netfilter/ipset/ip_set_hash_net.c @@ -199,7 +199,7 @@ hash_net4_uadt(struct ip_set *set, struct nlattr *tb[], if (adt == IPSET_TEST || !tb[IPSET_ATTR_IP_TO]) { e.ip = htonl(ip & ip_set_hostmask(e.cidr)); ret = adtfn(set, &e, &ext, &ext, flags); - return ip_set_enomatch(ret, flags, adt) ? 1 : + return ip_set_enomatch(ret, flags, adt, set) ? -ret: ip_set_eexist(ret, flags) ? 0 : ret; } @@ -396,7 +396,7 @@ hash_net6_uadt(struct ip_set *set, struct nlattr *tb[], ret = adtfn(set, &e, &ext, &ext, flags); - return ip_set_enomatch(ret, flags, adt) ? 1 : + return ip_set_enomatch(ret, flags, adt, set) ? -ret : ip_set_eexist(ret, flags) ? 0 : ret; } diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c index 84ae6f6..7d798d5 100644 --- a/net/netfilter/ipset/ip_set_hash_netiface.c +++ b/net/netfilter/ipset/ip_set_hash_netiface.c @@ -368,7 +368,7 @@ hash_netiface4_uadt(struct ip_set *set, struct nlattr *tb[], if (adt == IPSET_TEST || !tb[IPSET_ATTR_IP_TO]) { e.ip = htonl(ip & ip_set_hostmask(e.cidr)); ret = adtfn(set, &e, &ext, &ext, flags); - return ip_set_enomatch(ret, flags, adt) ? 1 : + return ip_set_enomatch(ret, flags, adt, set) ? -ret : ip_set_eexist(ret, flags) ? 0 : ret; } @@ -634,7 +634,7 @@ hash_netiface6_uadt(struct ip_set *set, struct nlattr *tb[], ret = adtfn(set, &e, &ext, &ext, flags); - return ip_set_enomatch(ret, flags, adt) ? 1 : + return ip_set_enomatch(ret, flags, adt, set) ? -ret : ip_set_eexist(ret, flags) ? 0 : ret; } diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c index 9a08698..09d6690 100644 --- a/net/netfilter/ipset/ip_set_hash_netport.c +++ b/net/netfilter/ipset/ip_set_hash_netport.c @@ -244,7 +244,7 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *tb[], if (adt == IPSET_TEST || !(with_ports || tb[IPSET_ATTR_IP_TO])) { e.ip = htonl(ip & ip_set_hostmask(e.cidr + 1)); ret = adtfn(set, &e, &ext, &ext, flags); - return ip_set_enomatch(ret, flags, adt) ? 1 : + return ip_set_enomatch(ret, flags, adt, set) ? -ret : ip_set_eexist(ret, flags) ? 0 : ret; } @@ -489,7 +489,7 @@ hash_netport6_uadt(struct ip_set *set, struct nlattr *tb[], if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) { ret = adtfn(set, &e, &ext, &ext, flags); - return ip_set_enomatch(ret, flags, adt) ? 1 : + return ip_set_enomatch(ret, flags, adt, set) ? -ret : ip_set_eexist(ret, flags) ? 0 : ret; } -- 1.7.0.4 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 3/4] netfilter: ipset: Validate the set family and not the set type family at swapping 2013-09-16 18:47 [PATCH 0/4] ipset patches for nf Jozsef Kadlecsik 2013-09-16 18:47 ` [PATCH 1/4] netfilter: ipset: Skip really non-first fragments for IPv6 when getting port/protocol Jozsef Kadlecsik 2013-09-16 18:47 ` [PATCH 2/4] netfilter: ipset: Consistent userspace testing with nomatch flag Jozsef Kadlecsik @ 2013-09-16 18:47 ` Jozsef Kadlecsik 2013-09-16 18:47 ` [PATCH 4/4] netfilter: ipset: Fix serious failure in CIDR tracking Jozsef Kadlecsik 2013-09-17 11:00 ` [PATCH 0/4] ipset patches for nf Pablo Neira Ayuso 4 siblings, 0 replies; 6+ messages in thread From: Jozsef Kadlecsik @ 2013-09-16 18:47 UTC (permalink / raw) To: netfilter-devel; +Cc: Pablo Neira Ayuso This closes netfilter bugzilla #843, reported by Quentin Armitage. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> --- net/netfilter/ipset/ip_set_core.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c index c8c303c..f2e30fb 100644 --- a/net/netfilter/ipset/ip_set_core.c +++ b/net/netfilter/ipset/ip_set_core.c @@ -1052,7 +1052,7 @@ ip_set_swap(struct sock *ctnl, struct sk_buff *skb, * Not an artificial restriction anymore, as we must prevent * possible loops created by swapping in setlist type of sets. */ if (!(from->type->features == to->type->features && - from->type->family == to->type->family)) + from->family == to->family)) return -IPSET_ERR_TYPE_MISMATCH; strncpy(from_name, from->name, IPSET_MAXNAMELEN); -- 1.7.0.4 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 4/4] netfilter: ipset: Fix serious failure in CIDR tracking 2013-09-16 18:47 [PATCH 0/4] ipset patches for nf Jozsef Kadlecsik ` (2 preceding siblings ...) 2013-09-16 18:47 ` [PATCH 3/4] netfilter: ipset: Validate the set family and not the set type family at swapping Jozsef Kadlecsik @ 2013-09-16 18:47 ` Jozsef Kadlecsik 2013-09-17 11:00 ` [PATCH 0/4] ipset patches for nf Pablo Neira Ayuso 4 siblings, 0 replies; 6+ messages in thread From: Jozsef Kadlecsik @ 2013-09-16 18:47 UTC (permalink / raw) To: netfilter-devel; +Cc: Pablo Neira Ayuso From: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> This fixes a serious bug affecting all hash types with a net element - specifically, if a CIDR value is deleted such that none of the same size exist any more, all larger (less-specific) values will then fail to match. Adding back any prefix with a CIDR equal to or more specific than the one deleted will fix it. Steps to reproduce: ipset -N test hash:net ipset -A test 1.1.0.0/16 ipset -A test 2.2.2.0/24 ipset -T test 1.1.1.1 #1.1.1.1 IS in set ipset -D test 2.2.2.0/24 ipset -T test 1.1.1.1 #1.1.1.1 IS NOT in set This is due to the fact that the nets counter was unconditionally decremented prior to the iteration that shifts up the entries. Now, we first check if there is a proceeding entry and if not, decrement it and return. Otherwise, we proceed to iterate and then zero the last element, which, in most cases, will already be zero. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> --- net/netfilter/ipset/ip_set_hash_gen.h | 28 ++++++++++++++++------------ 1 files changed, 16 insertions(+), 12 deletions(-) diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h index 57beb17..707bc52 100644 --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h @@ -325,18 +325,22 @@ mtype_add_cidr(struct htype *h, u8 cidr, u8 nets_length) static void mtype_del_cidr(struct htype *h, u8 cidr, u8 nets_length) { - u8 i, j; - - for (i = 0; i < nets_length - 1 && h->nets[i].cidr != cidr; i++) - ; - h->nets[i].nets--; - - if (h->nets[i].nets != 0) - return; - - for (j = i; j < nets_length - 1 && h->nets[j].nets; j++) { - h->nets[j].cidr = h->nets[j + 1].cidr; - h->nets[j].nets = h->nets[j + 1].nets; + u8 i, j, net_end = nets_length - 1; + + for (i = 0; i < nets_length; i++) { + if (h->nets[i].cidr != cidr) + continue; + if (h->nets[i].nets > 1 || i == net_end || + h->nets[i + 1].nets == 0) { + h->nets[i].nets--; + return; + } + for (j = i; j < net_end && h->nets[j].nets; j++) { + h->nets[j].cidr = h->nets[j + 1].cidr; + h->nets[j].nets = h->nets[j + 1].nets; + } + h->nets[j].nets = 0; + return; } } #endif -- 1.7.0.4 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 0/4] ipset patches for nf 2013-09-16 18:47 [PATCH 0/4] ipset patches for nf Jozsef Kadlecsik ` (3 preceding siblings ...) 2013-09-16 18:47 ` [PATCH 4/4] netfilter: ipset: Fix serious failure in CIDR tracking Jozsef Kadlecsik @ 2013-09-17 11:00 ` Pablo Neira Ayuso 4 siblings, 0 replies; 6+ messages in thread From: Pablo Neira Ayuso @ 2013-09-17 11:00 UTC (permalink / raw) To: Jozsef Kadlecsik; +Cc: netfilter-devel On Mon, Sep 16, 2013 at 08:47:55PM +0200, Jozsef Kadlecsik wrote: > Hi Pablo, > > Next follows the ipset related fixes for the nf tree. Please consider applying them. > > Best regards, > Jozsef > > The following changes since commit d830f0fa1dd7ca447c38aec82cd44230e0b7ca75: > Phil Oester (1): > netfilter: nf_nat_proto_icmpv6:: fix wrong comparison in icmpv6_manip_pkt > > are available in the git repository at: > > git://blackhole.kfki.hu/nf master Pulled, thanks Jozsef. ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-09-17 11:01 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2013-09-16 18:47 [PATCH 0/4] ipset patches for nf Jozsef Kadlecsik 2013-09-16 18:47 ` [PATCH 1/4] netfilter: ipset: Skip really non-first fragments for IPv6 when getting port/protocol Jozsef Kadlecsik 2013-09-16 18:47 ` [PATCH 2/4] netfilter: ipset: Consistent userspace testing with nomatch flag Jozsef Kadlecsik 2013-09-16 18:47 ` [PATCH 3/4] netfilter: ipset: Validate the set family and not the set type family at swapping Jozsef Kadlecsik 2013-09-16 18:47 ` [PATCH 4/4] netfilter: ipset: Fix serious failure in CIDR tracking Jozsef Kadlecsik 2013-09-17 11:00 ` [PATCH 0/4] ipset patches for nf Pablo Neira Ayuso
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).