lkml.org 
[lkml]   [2018]   [Aug]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 037/246] netfilter: ipset: forbid family for hash:mac sets
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Florent Fourcot <florent.fourcot@wifirst.fr>

    [ Upstream commit cbdebe481a14b42c45aa9f4ceb5ff19b55de2c57 ]

    Userspace `ipset` command forbids family option for hash:mac type:

    ipset create test hash:mac family inet4
    ipset v6.30: Unknown argument: `family'

    However, this check is not done in kernel itself. When someone use
    external netlink applications (pyroute2 python library for example), one
    can create hash:mac with invalid family and inconsistant results from
    userspace (`ipset` command cannot read set content anymore).

    This patch enforce the logic in kernel, and forbids insertion of
    hash:mac with a family set.

    Since IP_SET_PROTO_UNDEF is defined only for hash:mac, this patch has no
    impact on other hash:* sets

    Signed-off-by: Florent Fourcot <florent.fourcot@wifirst.fr>
    Signed-off-by: Victorien Molle <victorien.molle@wifirst.fr>
    Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/netfilter/ipset/ip_set_hash_gen.h | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    --- a/net/netfilter/ipset/ip_set_hash_gen.h
    +++ b/net/netfilter/ipset/ip_set_hash_gen.h
    @@ -1241,7 +1241,10 @@ IPSET_TOKEN(HTYPE, _create)(struct net *
    pr_debug("Create set %s with family %s\n",
    set->name, set->family == NFPROTO_IPV4 ? "inet" : "inet6");

    -#ifndef IP_SET_PROTO_UNDEF
    +#ifdef IP_SET_PROTO_UNDEF
    + if (set->family != NFPROTO_UNSPEC)
    + return -IPSET_ERR_INVALID_FAMILY;
    +#else
    if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
    return -IPSET_ERR_INVALID_FAMILY;
    #endif

    \
     
     \ /
      Last update: 2018-08-01 19:59    [W:4.058 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site