lkml.org 
[lkml]   [2019]   [Aug]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 24/98] netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets
    Date
    [ Upstream commit 1b4a75108d5bc153daf965d334e77e8e94534f96 ]

    In commit 8cc4ccf58379 ("ipset: Allow matching on destination MAC address
    for mac and ipmac sets"), ipset.git commit 1543514c46a7, I added to the
    KADT functions for sets matching on MAC addreses the copy of source or
    destination MAC address depending on the configured match.

    This was done correctly for hash:mac, but for hash:ip,mac and
    bitmap:ip,mac, copying and pasting the same code block presents an
    obvious problem: in these two set types, the MAC address is the second
    dimension, not the first one, and we are actually selecting the MAC
    address depending on whether the first dimension (IP address) specifies
    source or destination.

    Fix this by checking for the IPSET_DIM_TWO_SRC flag in option flags.

    This way, mixing source and destination matches for the two dimensions
    of ip,mac set types works as expected. With this setup:

    ip netns add A
    ip link add veth1 type veth peer name veth2 netns A
    ip addr add 192.0.2.1/24 dev veth1
    ip -net A addr add 192.0.2.2/24 dev veth2
    ip link set veth1 up
    ip -net A link set veth2 up

    dst=$(ip netns exec A cat /sys/class/net/veth2/address)

    ip netns exec A ipset create test_bitmap bitmap:ip,mac range 192.0.0.0/16
    ip netns exec A ipset add test_bitmap 192.0.2.1,${dst}
    ip netns exec A iptables -A INPUT -m set ! --match-set test_bitmap src,dst -j DROP

    ip netns exec A ipset create test_hash hash:ip,mac
    ip netns exec A ipset add test_hash 192.0.2.1,${dst}
    ip netns exec A iptables -A INPUT -m set ! --match-set test_hash src,dst -j DROP

    ipset correctly matches a test packet:

    # ping -c1 192.0.2.2 >/dev/null
    # echo $?
    0

    Reported-by: Chen Yi <yiche@redhat.com>
    Fixes: 8cc4ccf58379 ("ipset: Allow matching on destination MAC address for mac and ipmac sets")
    Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
    Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/ipset/ip_set_bitmap_ipmac.c | 2 +-
    net/netfilter/ipset/ip_set_hash_ipmac.c | 2 +-
    2 files changed, 2 insertions(+), 2 deletions(-)

    diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
    index 13ade5782847b..4f01321e793ce 100644
    --- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
    +++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
    @@ -230,7 +230,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,

    e.id = ip_to_id(map, ip);

    - if (opt->flags & IPSET_DIM_ONE_SRC)
    + if (opt->flags & IPSET_DIM_TWO_SRC)
    ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
    else
    ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
    diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
    index 75c21c8b76514..16ec822e40447 100644
    --- a/net/netfilter/ipset/ip_set_hash_ipmac.c
    +++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
    @@ -99,7 +99,7 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
    (skb_mac_header(skb) + ETH_HLEN) > skb->data)
    return -EINVAL;

    - if (opt->flags & IPSET_DIM_ONE_SRC)
    + if (opt->flags & IPSET_DIM_TWO_SRC)
    ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
    else
    ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-08-27 10:36    [W:4.252 / U:0.380 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site