Commit a1028f77 authored by Oliver Smith's avatar Oliver Smith Committed by Greg Kroah-Hartman
Browse files

netfilter: ipset: Fix serious failure in CIDR tracking

commit 2cf55125


This fixes a serious bug affecting all hash types with a net element -
specifically, if a CIDR value is deleted such that none of the same size
exist any more, all larger (less-specific) values will then fail to
match. Adding back any prefix with a CIDR equal to or more specific than
the one deleted will fix it.

Steps to reproduce:
ipset -N test hash:net
ipset -A test
ipset -A test
ipset -T test           # IS in set
ipset -D test
ipset -T test           # IS NOT in set

This is due to the fact that the nets counter was unconditionally
decremented prior to the iteration that shifts up the entries. Now, we
first check if there is a proceeding entry and if not, decrement it and
return. Otherwise, we proceed to iterate and then zero the last element,
which, in most cases, will already be zero.
Signed-off-by: default avatarOliver Smith <>
Signed-off-by: default avatarJozsef Kadlecsik <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent 2236ad29
...@@ -325,18 +325,22 @@ mtype_add_cidr(struct htype *h, u8 cidr, u8 nets_length) ...@@ -325,18 +325,22 @@ mtype_add_cidr(struct htype *h, u8 cidr, u8 nets_length)
static void static void
mtype_del_cidr(struct htype *h, u8 cidr, u8 nets_length) mtype_del_cidr(struct htype *h, u8 cidr, u8 nets_length)
{ {
u8 i, j; u8 i, j, net_end = nets_length - 1;
for (i = 0; i < nets_length - 1 && h->nets[i].cidr != cidr; i++) for (i = 0; i < nets_length; i++) {
; if (h->nets[i].cidr != cidr)
h->nets[i].nets--; continue;
if (h->nets[i].nets > 1 || i == net_end ||
if (h->nets[i].nets != 0) h->nets[i + 1].nets == 0) {
return; h->nets[i].nets--;
for (j = i; j < nets_length - 1 && h->nets[j].nets; j++) { }
h->nets[j].cidr = h->nets[j + 1].cidr; for (j = i; j < net_end && h->nets[j].nets; j++) {
h->nets[j].nets = h->nets[j + 1].nets; h->nets[j].cidr = h->nets[j + 1].cidr;
h->nets[j].nets = h->nets[j + 1].nets;
h->nets[j].nets = 0;
} }
} }
#endif #endif
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment