linux/net/netfilter/ipset
Oliver Smith 2cf55125c6 netfilter: ipset: Fix serious failure in CIDR tracking
This fixes a serious bug affecting all hash types with a net element -
specifically, if a CIDR value is deleted such that none of the same size
exist any more, all larger (less-specific) values will then fail to
match. Adding back any prefix with a CIDR equal to or more specific than
the one deleted will fix it.

Steps to reproduce:
ipset -N test hash:net
ipset -A test 1.1.0.0/16
ipset -A test 2.2.2.0/24
ipset -T test 1.1.1.1           #1.1.1.1 IS in set
ipset -D test 2.2.2.0/24
ipset -T test 1.1.1.1           #1.1.1.1 IS NOT in set

This is due to the fact that the nets counter was unconditionally
decremented prior to the iteration that shifts up the entries. Now, we
first check if there is a proceeding entry and if not, decrement it and
return. Otherwise, we proceed to iterate and then zero the last element,
which, in most cases, will already be zero.

Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
2013-09-16 20:36:09 +02:00
..
Kconfig netfilter: ipset: hash:net,iface type introduced 2011-06-16 19:00:48 +02:00
Makefile netfilter: ipset: hash:net,iface type introduced 2011-06-16 19:00:48 +02:00
ip_set_bitmap_gen.h netfilter: ipset: The bitmap types with counter support 2013-04-29 20:09:00 +02:00
ip_set_bitmap_ip.c netfilter: ipset: The bitmap types with counter support 2013-04-29 20:09:00 +02:00
ip_set_bitmap_ipmac.c netfilter: ipset: The bitmap types with counter support 2013-04-29 20:09:00 +02:00
ip_set_bitmap_port.c netfilter: ipset: The bitmap types with counter support 2013-04-29 20:09:00 +02:00
ip_set_core.c netfilter: ipset: Validate the set family and not the set type family at swapping 2013-09-16 20:36:05 +02:00
ip_set_getport.c netfilter: ipset: Skip really non-first fragments for IPv6 when getting port/protocol 2013-09-16 20:33:44 +02:00
ip_set_hash_gen.h netfilter: ipset: Fix serious failure in CIDR tracking 2013-09-16 20:36:09 +02:00
ip_set_hash_ip.c netfilter: ipset: The hash types with counter support 2013-04-29 20:09:01 +02:00
ip_set_hash_ipport.c netfilter: ipset: The hash types with counter support 2013-04-29 20:09:01 +02:00
ip_set_hash_ipportip.c netfilter: ipset: The hash types with counter support 2013-04-29 20:09:01 +02:00
ip_set_hash_ipportnet.c netfilter: ipset: Consistent userspace testing with nomatch flag 2013-09-16 20:35:55 +02:00
ip_set_hash_net.c netfilter: ipset: Consistent userspace testing with nomatch flag 2013-09-16 20:35:55 +02:00
ip_set_hash_netiface.c netfilter: ipset: Consistent userspace testing with nomatch flag 2013-09-16 20:35:55 +02:00
ip_set_hash_netport.c netfilter: ipset: Consistent userspace testing with nomatch flag 2013-09-16 20:35:55 +02:00
ip_set_list_set.c netfilter: ipset: set match: add support to match the counters 2013-04-29 20:09:03 +02:00
pfxlen.c net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules 2011-10-31 19:30:30 -04:00