Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 17b14ca2 authored by Jozsef Kadlecsik's avatar Jozsef Kadlecsik
Browse files

netfilter: ipset: Fix range bug in hash:ip,port,net 

Due to the missing ininitalization at adding/deleting entries, when
a plain_ip,port,net element was the object, multiple elements were
added/deleted instead. The bug came from the missing dangling
default initialization.

The error-prone default initialization is corrected in all hash:* types.
parent f4a75d2e

net/netfilter/ipset/ip_set_hash_ip.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -173,6 +173,7 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[], 
		return adtfn(set, &nip, timeout, flags);

		return adtfn(set, &nip, timeout, flags);

	}

	}





	ip_to = ip;

	if (tb[IPSET_ATTR_IP_TO]) {

	if (tb[IPSET_ATTR_IP_TO]) {

		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);

		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);

		if (ret)

		if (ret)
@@ -185,8 +186,7 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[], 
		if (!cidr || cidr > 32)

		if (!cidr || cidr > 32)

			return -IPSET_ERR_INVALID_CIDR;

			return -IPSET_ERR_INVALID_CIDR;

		ip_set_mask_from_to(ip, ip_to, cidr);

		ip_set_mask_from_to(ip, ip_to, cidr);

	} else

	}

		ip_to = ip;





	hosts = h->netmask == 32 ? 1 : 2 << (32 - h->netmask - 1);

	hosts = h->netmask == 32 ? 1 : 2 << (32 - h->netmask - 1);

net/netfilter/ipset/ip_set_hash_ipport.c

+3 −4
Original line number Original line Diff line number Diff line
@@ -162,7 +162,7 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *tb[], 
	const struct ip_set_hash *h = set->data;

	const struct ip_set_hash *h = set->data;

	ipset_adtfn adtfn = set->variant->adt[adt];

	ipset_adtfn adtfn = set->variant->adt[adt];

	struct hash_ipport4_elem data = { };

	struct hash_ipport4_elem data = { };

	u32 ip, ip_to = 0, p = 0, port, port_to;

	u32 ip, ip_to, p = 0, port, port_to;

	u32 timeout = h->timeout;

	u32 timeout = h->timeout;

	bool with_ports = false;

	bool with_ports = false;

	int ret;

	int ret;
@@ -210,7 +210,7 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *tb[], 
		return ip_set_eexist(ret, flags) ? 0 : ret;

		return ip_set_eexist(ret, flags) ? 0 : ret;

	}

	}





	ip = ntohl(data.ip);

	ip_to = ip = ntohl(data.ip);

	if (tb[IPSET_ATTR_IP_TO]) {

	if (tb[IPSET_ATTR_IP_TO]) {

		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);

		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);

		if (ret)

		if (ret)
@@ -223,8 +223,7 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *tb[], 
		if (!cidr || cidr > 32)

		if (!cidr || cidr > 32)

			return -IPSET_ERR_INVALID_CIDR;

			return -IPSET_ERR_INVALID_CIDR;

		ip_set_mask_from_to(ip, ip_to, cidr);

		ip_set_mask_from_to(ip, ip_to, cidr);

	} else

	}

		ip_to = ip;





	port_to = port = ntohs(data.port);

	port_to = port = ntohs(data.port);

	if (with_ports && tb[IPSET_ATTR_PORT_TO]) {

	if (with_ports && tb[IPSET_ATTR_PORT_TO]) {

net/netfilter/ipset/ip_set_hash_ipportip.c

+3 −4
Original line number Original line Diff line number Diff line
@@ -166,7 +166,7 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[], 
	const struct ip_set_hash *h = set->data;

	const struct ip_set_hash *h = set->data;

	ipset_adtfn adtfn = set->variant->adt[adt];

	ipset_adtfn adtfn = set->variant->adt[adt];

	struct hash_ipportip4_elem data = { };

	struct hash_ipportip4_elem data = { };

	u32 ip, ip_to = 0, p = 0, port, port_to;

	u32 ip, ip_to, p = 0, port, port_to;

	u32 timeout = h->timeout;

	u32 timeout = h->timeout;

	bool with_ports = false;

	bool with_ports = false;

	int ret;

	int ret;
@@ -218,7 +218,7 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[], 
		return ip_set_eexist(ret, flags) ? 0 : ret;

		return ip_set_eexist(ret, flags) ? 0 : ret;

	}

	}





	ip = ntohl(data.ip);

	ip_to = ip = ntohl(data.ip);

	if (tb[IPSET_ATTR_IP_TO]) {

	if (tb[IPSET_ATTR_IP_TO]) {

		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);

		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);

		if (ret)

		if (ret)
@@ -231,8 +231,7 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[], 
		if (!cidr || cidr > 32)

		if (!cidr || cidr > 32)

			return -IPSET_ERR_INVALID_CIDR;

			return -IPSET_ERR_INVALID_CIDR;

		ip_set_mask_from_to(ip, ip_to, cidr);

		ip_set_mask_from_to(ip, ip_to, cidr);

	} else

	}

		ip_to = ip;





	port_to = port = ntohs(data.port);

	port_to = port = ntohs(data.port);

	if (with_ports && tb[IPSET_ATTR_PORT_TO]) {

	if (with_ports && tb[IPSET_ATTR_PORT_TO]) {

net/netfilter/ipset/ip_set_hash_ipportnet.c

+5 −2
Original line number Original line Diff line number Diff line
@@ -215,8 +215,8 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[], 
	const struct ip_set_hash *h = set->data;

	const struct ip_set_hash *h = set->data;

	ipset_adtfn adtfn = set->variant->adt[adt];

	ipset_adtfn adtfn = set->variant->adt[adt];

	struct hash_ipportnet4_elem data = { .cidr = HOST_MASK - 1 };

	struct hash_ipportnet4_elem data = { .cidr = HOST_MASK - 1 };

	u32 ip, ip_to = 0, p = 0, port, port_to;

	u32 ip, ip_to, p = 0, port, port_to;

	u32 ip2_from = 0, ip2_to, ip2_last, ip2;

	u32 ip2_from, ip2_to, ip2_last, ip2;

	u32 timeout = h->timeout;

	u32 timeout = h->timeout;

	bool with_ports = false;

	bool with_ports = false;

	u8 cidr;

	u8 cidr;
@@ -286,6 +286,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[], 
		return ip_set_eexist(ret, flags) ? 0 : ret;

		return ip_set_eexist(ret, flags) ? 0 : ret;

	}

	}





	ip_to = ip;

	if (tb[IPSET_ATTR_IP_TO]) {

	if (tb[IPSET_ATTR_IP_TO]) {

		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);

		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);

		if (ret)

		if (ret)
@@ -306,6 +307,8 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[], 
		if (port > port_to)

		if (port > port_to)

			swap(port, port_to);

			swap(port, port_to);

	}

	}



	ip2_to = ip2_from;

	if (tb[IPSET_ATTR_IP2_TO]) {

	if (tb[IPSET_ATTR_IP2_TO]) {

		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2_TO], &ip2_to);

		ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2_TO], &ip2_to);

		if (ret)

		if (ret)