From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH 0/3] ipset fixes
Date: Mon, 24 Sep 2012 00:26:01 +0200 [thread overview]
Message-ID: <20120923222601.GA5624@1984> (raw)
In-Reply-To: <alpine.DEB.2.00.1209221705440.18018@blackhole.kfki.hu>
On Sat, Sep 22, 2012 at 09:22:08PM +0200, Jozsef Kadlecsik wrote:
[...]
> > Please, could you develop how critical are these above? We're fairly
> > late in the release cycle, I'd prefer if we pass only really critical
> > fixes.
>
> > > netfilter: ipset: Check and reject crazy /0 input parameters
>
> This one is easy to trigger: bitmap:ip sets are allowed to be created from
> range 0/0, but with /16 subnets as elements:
>
> ipset new foo bitmap:ip range 0/0 netmask 16
>
> However if "netmask 16" is left out accidentally, the kernel does not
> reject it but creates a broken set and the system will crash when the
> first element is added.
I see, this crash seems to be triggered in really rare situation.
> If we are quite late in the release cycle, maybe it can wait and be added
> to nf-next only.
We can still push fixes, but at this stage we should focus on fixes
that really happen in normal cases / typical usage IMO.
> > > netfilter: ipset: Fix cidr book keeping for hash:*net* types
>
> You asked to check how critical the bug is, and it was just the perfect
> question :-). I have re-checked and I was mistaken. The new case (zero
> cidr size), which was not handled by the old code, somehow misled me. So
> the patch description should be rewritten - I'm going to send a new batch
> of the patches against nf-next tomorrow. Thanks!
Will check tomorrow, thanks again!
prev parent reply other threads:[~2012-09-23 22:26 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-21 20:38 [PATCH 0/3] ipset fixes Jozsef Kadlecsik
2012-09-22 10:34 ` Pablo Neira Ayuso
2012-09-22 19:22 ` Jozsef Kadlecsik
2012-09-23 22:26 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120923222601.GA5624@1984 \
--to=pablo@netfilter.org \
--cc=kadlec@blackhole.kfki.hu \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).