lkml.org 
[lkml]   [2019]   [Aug]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 21/29] netfilter: ipset: Actually allow destination MAC address for hash:ip,mac sets too
    Date
    From: Stefano Brivio <sbrivio@redhat.com>

    [ Upstream commit b89d15480d0cacacae1a0fe0b3da01b529f2914f ]

    In commit 8cc4ccf58379 ("ipset: Allow matching on destination MAC address
    for mac and ipmac sets"), ipset.git commit 1543514c46a7, I removed the
    KADT check that prevents matching on destination MAC addresses for
    hash:mac sets, but forgot to remove the same check for hash:ip,mac set.

    Drop this check: functionality is now commented in man pages and there's
    no reason to restrict to source MAC address matching anymore.

    Reported-by: Chen Yi <yiche@redhat.com>
    Fixes: 8cc4ccf58379 ("ipset: Allow matching on destination MAC address for mac and ipmac sets")
    Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
    Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/ipset/ip_set_hash_ipmac.c | 4 ----
    1 file changed, 4 deletions(-)

    diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
    index fd87de3ed55b3..75c21c8b76514 100644
    --- a/net/netfilter/ipset/ip_set_hash_ipmac.c
    +++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
    @@ -95,10 +95,6 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
    struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } };
    struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);

    - /* MAC can be src only */
    - if (!(opt->flags & IPSET_DIM_TWO_SRC))
    - return 0;
    -
    if (skb_mac_header(skb) < skb->head ||
    (skb_mac_header(skb) + ETH_HLEN) > skb->data)
    return -EINVAL;
    --
    2.20.1
    \
     
     \ /
      Last update: 2019-08-29 12:53    [W:2.158 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site