Re: [PATCH nf 0/2] nft_set_pipapo: Fix crash due to dangling entries in mapping table

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Feb 26, 2020 at 12:54:07PM +0100, Stefano Brivio wrote:
> On Wed, 26 Feb 2020 12:39:26 +0100
> Stefano Brivio <sbrivio@redhat.com> wrote:
> 
> > On Wed, 26 Feb 2020 12:34:43 +0100
> > Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > 
> > > I mean, to catch elements that represents subsets/supersets of another
> > > element (like in this example above), pipapo would need to make a
> > > lookup for already matching rules for this new element?  
> > 
> > Right, and that's what those two pipapo_get() calls in
> > nft_pipapo_insert() do.
> 
> Specifically, on re-reading your question: those find sets including
> the subset that we would be about to insert, and forbid the insertion.
> 
> But, given an already existing proper subset with none of the bounds
> overlapping ("more specific entry", by any measure), they won't return
> it, so insertion can proceed.

Thanks for explaining.

I see, the bounds are not found by pipapo_get(), they are not included
in the existing (subset) element range. We would need to tests for all
the existing (inner) elements in the range to catch for subsets.