Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7f81c951 authored by Jozsef Kadlecsik's avatar Jozsef Kadlecsik Committed by Pablo Neira Ayuso
Browse files

netfilter: ipset: hash:net,iface timeout bug fixed 



Timed out entries were still matched till the garbage collector
purged them out. The fix is verified in the testsuite.

Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 2a7cef2a

include/linux/netfilter/ipset/ip_set_ahash.h

+8 −0
Original line number Diff line number Diff line
@@ -1005,9 +1005,17 @@ type_pf_ttest_cidrs(struct ip_set *set, struct type_pf_elem *d, u32 timeout) 
		n = hbucket(t, key);

		for (i = 0; i < n->pos; i++) {

			data = ahash_tdata(n, i);

#ifdef IP_SET_HASH_WITH_MULTI

			if (type_pf_data_equal(data, d, &multi)) {

				if (!type_pf_data_expired(data))

					return type_pf_data_match(data);

				multi = 0;

			}

#else

			if (type_pf_data_equal(data, d, &multi) &&

			    !type_pf_data_expired(data))

				return type_pf_data_match(data);

#endif

		}

	}

	return 0;