From: Stefano Brivio <sbrivio@redhat.com>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Phil Sutter <phil@nwl.cc>,
netfilter-devel@vger.kernel.org, Florian Westphal <fw@strlen.de>
Subject: Re: [PATCH nf 0/2] nft_set_pipapo: Fix crash due to dangling entries in mapping table
Date: Wed, 26 Feb 2020 12:39:26 +0100 [thread overview]
Message-ID: <20200226123926.3c5b1831@redhat.com> (raw)
In-Reply-To: <20200226113443.vudkkqzxj5qussqz@salvia>
On Wed, 26 Feb 2020 12:34:43 +0100
Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, Feb 26, 2020 at 12:19:24PM +0100, Stefano Brivio wrote:
> > On Wed, 26 Feb 2020 12:10:56 +0100
> > Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> >
> > > On Wed, Feb 26, 2020 at 11:59:24AM +0100, Stefano Brivio wrote:
> > > [...]
> > > > One detail, unrelated to this patch, that I should probably document in
> > > > man pages and Wiki (I forgot, it occurred to me while testing): it is
> > > > allowed to insert an entry if a proper subset of it, with no
> > > > overlapping bounds, is already inserted. The reverse sequence is not
> > > > allowed. This can be used without ambiguity due to strict guarantees
> > > > about ordering. That is:
> > > >
> > > > # nft add element t s '{ 1.0.0.20-1.0.0.21 . 3.3.3.3 }'
> > > > # nft add element t s '{ 1.0.0.10-1.0.0.100 . 3.3.3.3 }'
> > >
> > > OK, so first element "shadows" the second one. And the first element
> > > will matching in case that address is 1.0.0.20 and 10.0.0.21. Right?
> >
> > Correct.
>
> So this is happening because the result bitmap contains the pipapo
> rules that represent the first element and the second. But when
> iterating over the result bitmap bits, the pipapo rule that represents
> the first element is taken as the matching one, right?
Right.
> I mean, to catch elements that represents subsets/supersets of another
> element (like in this example above), pipapo would need to make a
> lookup for already matching rules for this new element?
Right, and that's what those two pipapo_get() calls in
nft_pipapo_insert() do.
--
Stefano
next prev parent reply other threads:[~2020-02-26 11:39 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-21 2:04 [PATCH nf 0/2] nft_set_pipapo: Fix crash due to dangling entries in mapping table Stefano Brivio
2020-02-21 2:04 ` [PATCH nf 1/2] nft_set_pipapo: Actually fetch key data in nft_pipapo_remove() Stefano Brivio
2020-02-21 2:04 ` [PATCH nf 2/2] selftests: nft_concat_range: Add test for reported add/flush/add issue Stefano Brivio
2020-02-21 21:17 ` [PATCH nf 0/2] nft_set_pipapo: Fix crash due to dangling entries in mapping table Phil Sutter
2020-02-21 22:22 ` Stefano Brivio
2020-02-22 1:19 ` Phil Sutter
2020-02-23 21:22 ` Stefano Brivio
2020-02-25 12:39 ` Pablo Neira Ayuso
2020-02-25 12:45 ` Stefano Brivio
2020-02-25 13:13 ` Stefano Brivio
2020-02-25 13:42 ` Pablo Neira Ayuso
2020-02-25 14:34 ` Stefano Brivio
2020-02-25 18:48 ` Phil Sutter
2020-02-25 19:33 ` Stefano Brivio
2020-02-25 20:21 ` Pablo Neira Ayuso
2020-02-25 20:38 ` Stefano Brivio
2020-02-25 20:58 ` Pablo Neira Ayuso
2020-02-26 10:58 ` Pablo Neira Ayuso
2020-02-26 11:01 ` Pablo Neira Ayuso
2020-02-26 11:02 ` Stefano Brivio
2020-02-26 11:29 ` Pablo Neira Ayuso
2020-02-26 11:36 ` Stefano Brivio
2020-02-26 11:53 ` Pablo Neira Ayuso
2020-02-26 10:59 ` Stefano Brivio
2020-02-26 11:10 ` Pablo Neira Ayuso
2020-02-26 11:19 ` Stefano Brivio
2020-02-26 11:34 ` Pablo Neira Ayuso
2020-02-26 11:39 ` Stefano Brivio [this message]
2020-02-26 11:54 ` Stefano Brivio
2020-02-26 12:10 ` Pablo Neira Ayuso
2020-02-26 13:33 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200226123926.3c5b1831@redhat.com \
--to=sbrivio@redhat.com \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=phil@nwl.cc \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).