Commit 7f4f7dd4 authored Sep 11, 2017 by Vishwanath Pai Committed by Pablo Neira Ayuso Sep 18, 2017

netfilter: ipset: ipset list may return wrong member count for set with timeout



Simple testcase:

$ ipset create test hash:ip timeout 5
$ ipset add test 1.2.3.4
$ ipset add test 1.2.2.2
$ sleep 5

$ ipset l
Name: test
Type: hash:ip
Revision: 5
Header: family inet hashsize 1024 maxelem 65536 timeout 5
Size in memory: 296
References: 0
Number of entries: 2
Members:

We return "Number of entries: 2" but no members are listed. That is
because mtype_list runs "ip_set_timeout_expired" and does not list the
expired entries, but set->elements is never upated (until mtype_gc
cleans it up later).

Reviewed-by: Joshua Hunt <johunt@akamai.com>
Signed-off-by: Vishwanath Pai <vpai@akamai.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent b0ade851

net/netfilter/ipset/ip_set_hash_gen.h

+13 −1

Original line number	Diff line number	Diff line
		@@ -1041,12 +1041,24 @@ mtype_test(struct ip_set set, void value, const struct ip_set_ext *ext,
		static int
		mtype_head(struct ip_set set, struct sk_buff skb)
		{
		const struct htype *h = set->data;
		struct htype *h = set->data;
		const struct htable *t;
		struct nlattr *nested;
		size_t memsize;
		u8 htable_bits;

		/* If any members have expired, set->elements will be wrong
		* mytype_expire function will update it with the right count.
		* we do not hold set->lock here, so grab it first.
		* set->elements can still be incorrect in the case of a huge set,
		* because elements might time out during the listing.
		*/
		if (SET_WITH_TIMEOUT(set)) {
		spin_lock_bh(&set->lock);
		mtype_expire(set, h);
		spin_unlock_bh(&set->lock);
		}

		rcu_read_lock_bh();
		t = rcu_dereference_bh_nfnl(h->table);
		memsize = mtype_ahash_memsize(h, t) + set->ext_size;