• Oliver Smith's avatar
    netfilter: ipset: Fix serious failure in CIDR tracking · 97d2a12a
    Oliver Smith authored
    commit 2cf55125
    
     upstream.
    
    This fixes a serious bug affecting all hash types with a net element -
    specifically, if a CIDR value is deleted such that none of the same size
    exist any more, all larger (less-specific) values will then fail to
    match. Adding back any prefix with a CIDR equal to or more specific than
    the one deleted will fix it.
    
    Steps to reproduce:
    ipset -N test hash:net
    ipset -A test 1.1.0.0/16
    ipset -A test 2.2.2.0/24
    ipset -T test 1.1.1.1           #1.1.1.1 IS in set
    ipset -D test 2.2.2.0/24
    ipset -T test 1.1.1.1           #1.1.1.1 IS NOT in set
    
    This is due to the fact that the nets counter was unconditionally
    decremented prior to the iteration that shifts up the entries. Now, we
    first check if there is a proceeding entry and if not, decrement it and
    return. Otherwise, we proceed to iterate and then zero the last element,
    which, in most cases, will already be zero.
    Signed-off-by: default avatarOliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>
    Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    97d2a12a
ip_set_hash_gen.h 28.9 KB