Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eafbd3fd authored by Jozsef Kadlecsik's avatar Jozsef Kadlecsik Committed by Patrick McHardy
Browse files

netfilter: ipset: set match and SET target fixes 



The SET target with --del-set did not work due to using wrongly
the internal dimension of --add-set instead of --del-set.
Also, the checkentries did not release the set references when
returned an error. Bugs reported by Lennert Buytenhek.

Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 0e8a835a

net/netfilter/xt_set.c

+16 −2
Original line number Diff line number Diff line
@@ -81,6 +81,7 @@ set_match_v0_checkentry(const struct xt_mtchk_param *par) 
	if (info->match_set.u.flags[IPSET_DIM_MAX-1] != 0) {

		pr_warning("Protocol error: set match dimension "

			   "is over the limit!\n");

		ip_set_nfnl_put(info->match_set.index);

		return -ERANGE;

	}
@@ -135,6 +136,8 @@ set_target_v0_checkentry(const struct xt_tgchk_param *par) 
		if (index == IPSET_INVALID_ID) {

			pr_warning("Cannot find del_set index %u as target\n",

				   info->del_set.index);

			if (info->add_set.index != IPSET_INVALID_ID)

				ip_set_nfnl_put(info->add_set.index);

			return -ENOENT;

		}

	}
@@ -142,6 +145,10 @@ set_target_v0_checkentry(const struct xt_tgchk_param *par) 
	    info->del_set.u.flags[IPSET_DIM_MAX-1] != 0) {

		pr_warning("Protocol error: SET target dimension "

			   "is over the limit!\n");

		if (info->add_set.index != IPSET_INVALID_ID)

			ip_set_nfnl_put(info->add_set.index);

		if (info->del_set.index != IPSET_INVALID_ID)

			ip_set_nfnl_put(info->del_set.index);

		return -ERANGE;

	}
@@ -192,6 +199,7 @@ set_match_checkentry(const struct xt_mtchk_param *par) 
	if (info->match_set.dim > IPSET_DIM_MAX) {

		pr_warning("Protocol error: set match dimension "

			   "is over the limit!\n");

		ip_set_nfnl_put(info->match_set.index);

		return -ERANGE;

	}
@@ -219,7 +227,7 @@ set_target(struct sk_buff *skb, const struct xt_action_param *par) 
	if (info->del_set.index != IPSET_INVALID_ID)

		ip_set_del(info->del_set.index,

			   skb, par->family,

			   info->add_set.dim,

			   info->del_set.dim,

			   info->del_set.flags);



	return XT_CONTINUE;
@@ -245,13 +253,19 @@ set_target_checkentry(const struct xt_tgchk_param *par) 
		if (index == IPSET_INVALID_ID) {

			pr_warning("Cannot find del_set index %u as target\n",

				   info->del_set.index);

			if (info->add_set.index != IPSET_INVALID_ID)

				ip_set_nfnl_put(info->add_set.index);

			return -ENOENT;

		}

	}

	if (info->add_set.dim > IPSET_DIM_MAX ||

	    info->del_set.flags > IPSET_DIM_MAX) {

	    info->del_set.dim > IPSET_DIM_MAX) {

		pr_warning("Protocol error: SET target dimension "

			   "is over the limit!\n");

		if (info->add_set.index != IPSET_INVALID_ID)

			ip_set_nfnl_put(info->add_set.index);

		if (info->del_set.index != IPSET_INVALID_ID)

			ip_set_nfnl_put(info->del_set.index);

		return -ERANGE;

	}