netfilter: ipset: Permit CIDR equal to the host address CIDR in IPv6
authorSergey Popovich <popovich_sergei@mail.ua>
Fri, 12 Jun 2015 19:23:31 +0000 (21:23 +0200)
committerJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Sun, 14 Jun 2015 08:40:13 +0000 (10:40 +0200)
Permit userspace to supply CIDR length equal to the host address CIDR
length in netlink message. Prohibit any other CIDR length for IPv6
variant of the set.

Also return -IPSET_ERR_HASH_RANGE_UNSUPPORTED instead of generic
-IPSET_ERR_PROTOCOL in IPv6 variant of hash:ip,port,net when
IPSET_ATTR_IP_TO attribute is given.

Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
net/netfilter/ipset/ip_set_hash_ip.c
net/netfilter/ipset/ip_set_hash_ipmark.c
net/netfilter/ipset/ip_set_hash_ipport.c
net/netfilter/ipset/ip_set_hash_ipportip.c
net/netfilter/ipset/ip_set_hash_ipportnet.c

index 0d955a480dee1e44357814ba47f1c18f36b20cb5..2b08b1bf6e3fcb6626790e7ff13ab2a12ef7104b 100644 (file)
@@ -240,10 +240,16 @@ hash_ip6_uadt(struct ip_set *set, struct nlattr *tb[],
        struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
        int ret;
 
-       if (unlikely(!tb[IPSET_ATTR_IP] ||
-                    tb[IPSET_ATTR_IP_TO] ||
-                    tb[IPSET_ATTR_CIDR]))
+       if (unlikely(!tb[IPSET_ATTR_IP]))
                return -IPSET_ERR_PROTOCOL;
+       if (unlikely(tb[IPSET_ATTR_IP_TO]))
+               return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
+       if (unlikely(tb[IPSET_ATTR_CIDR])) {
+               u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+
+               if (cidr != HOST_MASK)
+                       return -IPSET_ERR_INVALID_CIDR;
+       }
 
        if (tb[IPSET_ATTR_LINENO])
                *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
index f4e14ec4684a3d307414307236e664def90126e3..68fe40ca4a1f8bba16b988e3c27e3ece9fa0891d 100644 (file)
@@ -235,10 +235,16 @@ hash_ipmark6_uadt(struct ip_set *set, struct nlattr *tb[],
        int ret;
 
        if (unlikely(!tb[IPSET_ATTR_IP] ||
-                    !ip_set_attr_netorder(tb, IPSET_ATTR_MARK) ||
-                    tb[IPSET_ATTR_IP_TO] ||
-                    tb[IPSET_ATTR_CIDR]))
+                    !ip_set_attr_netorder(tb, IPSET_ATTR_MARK)))
                return -IPSET_ERR_PROTOCOL;
+       if (unlikely(tb[IPSET_ATTR_IP_TO]))
+               return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
+       if (unlikely(tb[IPSET_ATTR_CIDR])) {
+               u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+
+               if (cidr != HOST_MASK)
+                       return -IPSET_ERR_INVALID_CIDR;
+       }
 
        if (tb[IPSET_ATTR_LINENO])
                *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
index 02d9dbaeea6bf3b5d80730955eb9e87bc0d18d84..9f036393a6e69ce037580346c6758313f361918d 100644 (file)
@@ -275,10 +275,16 @@ hash_ipport6_uadt(struct ip_set *set, struct nlattr *tb[],
 
        if (unlikely(!tb[IPSET_ATTR_IP] ||
                     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
-                    !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
-                    tb[IPSET_ATTR_IP_TO] ||
-                    tb[IPSET_ATTR_CIDR]))
+                    !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO)))
                return -IPSET_ERR_PROTOCOL;
+       if (unlikely(tb[IPSET_ATTR_IP_TO]))
+               return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
+       if (unlikely(tb[IPSET_ATTR_CIDR])) {
+               u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+
+               if (cidr != HOST_MASK)
+                       return -IPSET_ERR_INVALID_CIDR;
+       }
 
        if (tb[IPSET_ATTR_LINENO])
                *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
index 4e3b1c3f32b241613888a4864e65e0f2431f1412..aa0966b145a967ad79299cadfcf5c8cff8a7ef35 100644 (file)
@@ -286,10 +286,16 @@ hash_ipportip6_uadt(struct ip_set *set, struct nlattr *tb[],
 
        if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
                     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
-                    !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
-                    tb[IPSET_ATTR_IP_TO] ||
-                    tb[IPSET_ATTR_CIDR]))
+                    !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO)))
                return -IPSET_ERR_PROTOCOL;
+       if (unlikely(tb[IPSET_ATTR_IP_TO]))
+               return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
+       if (unlikely(tb[IPSET_ATTR_CIDR])) {
+               u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+
+               if (cidr != HOST_MASK)
+                       return -IPSET_ERR_INVALID_CIDR;
+       }
 
        if (tb[IPSET_ATTR_LINENO])
                *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
index 988567e7dbcee1dc43fbe192e0a3a6b98f9f23f6..f3c62565f38c86f3b4d8ad81c0c76a166d28a42d 100644 (file)
@@ -423,12 +423,16 @@ hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
        if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
                     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
                     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
-                    !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS) ||
-                    tb[IPSET_ATTR_IP_TO] ||
-                    tb[IPSET_ATTR_CIDR]))
+                    !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
                return -IPSET_ERR_PROTOCOL;
        if (unlikely(tb[IPSET_ATTR_IP_TO]))
                return -IPSET_ERR_HASH_RANGE_UNSUPPORTED;
+       if (unlikely(tb[IPSET_ATTR_CIDR])) {
+               u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+
+               if (cidr != HOST_MASK)
+                       return -IPSET_ERR_INVALID_CIDR;
+       }
 
        if (tb[IPSET_ATTR_LINENO])
                *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);