* [PATCH ipset] Fix IPv6 sets nftables translation
@ 2022-02-28 19:02 Pablo Neira Ayuso
2022-03-02 14:55 ` Florian Eckert
0 siblings, 1 reply; 2+ messages in thread
From: Pablo Neira Ayuso @ 2022-02-28 19:02 UTC (permalink / raw)
To: netfilter-devel; +Cc: kadlec, fe
The parser assumes the set is an IPv4 ipset because IPSET_OPT_FAMILY is
not set.
# ipset-translate restore < ./ipset-mwan3_set_connected_ipv6.dump
add table inet global
add set inet global mwan3_connected_v6 { type ipv6_addr; flags interval; }
flush set inet global mwan3_connected_v6
ipset v7.15: Error in line 4: Syntax error: '64' is out of range 0-32
Remove ipset_xlate_type_get(), call ipset_xlate_set_get() instead to
obtain the set type and family.
Reported-by: Florian Eckert <fe@dev.tdt.de>
Fixes: 325af556cd3a ("add ipset to nftables translation infrastructure")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
lib/ipset.c | 24 ++++++++++--------------
tests/xlate/xlate.t | 2 ++
tests/xlate/xlate.t.nft | 2 ++
3 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/lib/ipset.c b/lib/ipset.c
index 73e67db88e0d..50f86aee045b 100644
--- a/lib/ipset.c
+++ b/lib/ipset.c
@@ -949,18 +949,6 @@ ipset_xlate_set_get(struct ipset *ipset, const char *name)
return NULL;
}
-static const struct ipset_type *ipset_xlate_type_get(struct ipset *ipset,
- const char *name)
-{
- const struct ipset_xlate_set *set;
-
- set = ipset_xlate_set_get(ipset, name);
- if (!set)
- return NULL;
-
- return set->type;
-}
-
static int
ipset_parser(struct ipset *ipset, int oargc, char *oargv[])
{
@@ -1282,8 +1270,16 @@ ipset_parser(struct ipset *ipset, int oargc, char *oargv[])
if (!ipset->xlate) {
type = ipset_type_get(session, cmd);
} else {
- type = ipset_xlate_type_get(ipset, arg0);
- ipset_session_data_set(session, IPSET_OPT_TYPE, type);
+ const struct ipset_xlate_set *xlate_set;
+
+ xlate_set = ipset_xlate_set_get(ipset, arg0);
+ if (xlate_set) {
+ ipset_session_data_set(session, IPSET_OPT_TYPE,
+ xlate_set->type);
+ ipset_session_data_set(session, IPSET_OPT_FAMILY,
+ &xlate_set->family);
+ type = xlate_set->type;
+ }
}
if (type == NULL)
return ipset->standard_error(ipset, p);
diff --git a/tests/xlate/xlate.t b/tests/xlate/xlate.t
index b1e7d288e2a9..f09cb202bb6c 100644
--- a/tests/xlate/xlate.t
+++ b/tests/xlate/xlate.t
@@ -53,3 +53,5 @@ create bp1 bitmap:port range 1-1024
add bp1 22
create bim1 bitmap:ip,mac range 1.1.1.0/24
add bim1 1.1.1.1,aa:bb:cc:dd:ee:ff
+create hn6 hash:net family inet6
+add hn6 fe80::/64
diff --git a/tests/xlate/xlate.t.nft b/tests/xlate/xlate.t.nft
index 96eba3b0175e..0152a3081125 100644
--- a/tests/xlate/xlate.t.nft
+++ b/tests/xlate/xlate.t.nft
@@ -54,3 +54,5 @@ add set inet global bp1 { type inet_service; }
add element inet global bp1 { 22 }
add set inet global bim1 { type ipv4_addr . ether_addr; }
add element inet global bim1 { 1.1.1.1 . aa:bb:cc:dd:ee:ff }
+add set inet global hn6 { type ipv6_addr; flags interval; }
+add element inet global hn6 { fe80::/64 }
--
2.30.2
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH ipset] Fix IPv6 sets nftables translation
2022-02-28 19:02 [PATCH ipset] Fix IPv6 sets nftables translation Pablo Neira Ayuso
@ 2022-03-02 14:55 ` Florian Eckert
0 siblings, 0 replies; 2+ messages in thread
From: Florian Eckert @ 2022-03-02 14:55 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, kadlec
Thanks Pablo for the fix.
Works as expecected:
root@st-dev-07 /tmp/run/mwan3/iptables-log #
cat ipset-mwan3_set_connected_ipv6.dump && ipset-translate restore <
ipset-mwan3_set_connected_ipv6.dump
-! create mwan3_connected_ipv6 hash:net family inet6
flush mwan3_connected_ipv6
-! add mwan3_connected_ipv6 fe80::/64
-! add mwan3_connected_ipv6 fe80::/64
add table inet global
add set inet global mwan3_connected_ipv6 { type ipv6_addr; flags
interval; }
flush set inet global mwan3_connected_ipv6
add element inet global mwan3_connected_ipv6 { fe80::/64 }
add element inet global mwan3_connected_ipv6 { fe80::/64 }
On 2022-02-28 20:02, Pablo Neira Ayuso wrote:
> The parser assumes the set is an IPv4 ipset because IPSET_OPT_FAMILY is
> not set.
>
> # ipset-translate restore < ./ipset-mwan3_set_connected_ipv6.dump
> add table inet global
> add set inet global mwan3_connected_v6 { type ipv6_addr; flags
> interval; }
> flush set inet global mwan3_connected_v6
> ipset v7.15: Error in line 4: Syntax error: '64' is out of range 0-32
>
> Remove ipset_xlate_type_get(), call ipset_xlate_set_get() instead to
> obtain the set type and family.
>
> Reported-by: Florian Eckert <fe@dev.tdt.de>
> Fixes: 325af556cd3a ("add ipset to nftables translation
> infrastructure")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Tested-by: Florian Eckert <fe@dev.tdt.de>
> ---
> lib/ipset.c | 24 ++++++++++--------------
> tests/xlate/xlate.t | 2 ++
> tests/xlate/xlate.t.nft | 2 ++
> 3 files changed, 14 insertions(+), 14 deletions(-)
>
> diff --git a/lib/ipset.c b/lib/ipset.c
> index 73e67db88e0d..50f86aee045b 100644
> --- a/lib/ipset.c
> +++ b/lib/ipset.c
> @@ -949,18 +949,6 @@ ipset_xlate_set_get(struct ipset *ipset, const
> char *name)
> return NULL;
> }
>
> -static const struct ipset_type *ipset_xlate_type_get(struct ipset
> *ipset,
> - const char *name)
> -{
> - const struct ipset_xlate_set *set;
> -
> - set = ipset_xlate_set_get(ipset, name);
> - if (!set)
> - return NULL;
> -
> - return set->type;
> -}
> -
> static int
> ipset_parser(struct ipset *ipset, int oargc, char *oargv[])
> {
> @@ -1282,8 +1270,16 @@ ipset_parser(struct ipset *ipset, int oargc,
> char *oargv[])
> if (!ipset->xlate) {
> type = ipset_type_get(session, cmd);
> } else {
> - type = ipset_xlate_type_get(ipset, arg0);
> - ipset_session_data_set(session, IPSET_OPT_TYPE, type);
> + const struct ipset_xlate_set *xlate_set;
> +
> + xlate_set = ipset_xlate_set_get(ipset, arg0);
> + if (xlate_set) {
> + ipset_session_data_set(session, IPSET_OPT_TYPE,
> + xlate_set->type);
> + ipset_session_data_set(session, IPSET_OPT_FAMILY,
> + &xlate_set->family);
> + type = xlate_set->type;
> + }
> }
> if (type == NULL)
> return ipset->standard_error(ipset, p);
> diff --git a/tests/xlate/xlate.t b/tests/xlate/xlate.t
> index b1e7d288e2a9..f09cb202bb6c 100644
> --- a/tests/xlate/xlate.t
> +++ b/tests/xlate/xlate.t
> @@ -53,3 +53,5 @@ create bp1 bitmap:port range 1-1024
> add bp1 22
> create bim1 bitmap:ip,mac range 1.1.1.0/24
> add bim1 1.1.1.1,aa:bb:cc:dd:ee:ff
> +create hn6 hash:net family inet6
> +add hn6 fe80::/64
> diff --git a/tests/xlate/xlate.t.nft b/tests/xlate/xlate.t.nft
> index 96eba3b0175e..0152a3081125 100644
> --- a/tests/xlate/xlate.t.nft
> +++ b/tests/xlate/xlate.t.nft
> @@ -54,3 +54,5 @@ add set inet global bp1 { type inet_service; }
> add element inet global bp1 { 22 }
> add set inet global bim1 { type ipv4_addr . ether_addr; }
> add element inet global bim1 { 1.1.1.1 . aa:bb:cc:dd:ee:ff }
> +add set inet global hn6 { type ipv6_addr; flags interval; }
> +add element inet global hn6 { fe80::/64 }
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-03-02 15:11 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-02-28 19:02 [PATCH ipset] Fix IPv6 sets nftables translation Pablo Neira Ayuso
2022-03-02 14:55 ` Florian Eckert
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).