netfilter: ipset: forbid family for hash:mac sets

Userspace `ipset` command forbids family option for hash:mac type:

ipset create test hash:mac family inet4
ipset v6.30: Unknown argument: `family'

However, this check is not done in kernel itself. When someone use
external netlink applications (pyroute2 python library for example), one
can create hash:mac with invalid family and inconsistant results from
userspace (`ipset` command cannot read set content anymore).

This patch enforce the logic in kernel, and forbids insertion of
hash:mac with a family set.

Since IP_SET_PROTO_UNDEF is defined only for hash:mac, this patch has no
impact on other hash:* sets

Signed-off-by: Florent Fourcot <florent.fourcot@wifirst.fr>
Signed-off-by: Victorien Molle <victorien.molle@wifirst.fr>
---
 net/netfilter/ipset/ip_set_hash_gen.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--
2.11.0

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Hi,

On Mon, 4 Jun 2018, Florent Fourcot wrote:

> Userspace `ipset` command forbids family option for hash:mac type:
> 
> ipset create test hash:mac family inet4
> ipset v6.30: Unknown argument: `family'
> 
> However, this check is not done in kernel itself. When someone use
> external netlink applications (pyroute2 python library for example), one
> can create hash:mac with invalid family and inconsistant results from
> userspace (`ipset` command cannot read set content anymore).
> 
> This patch enforce the logic in kernel, and forbids insertion of
> hash:mac with a family set.
> 
> Since IP_SET_PROTO_UNDEF is defined only for hash:mac, this patch has no
> impact on other hash:* sets
> 
> Signed-off-by: Florent Fourcot <florent.fourcot@wifirst.fr>
> Signed-off-by: Victorien Molle <victorien.molle@wifirst.fr>
> ---
>  net/netfilter/ipset/ip_set_hash_gen.h | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)

Patch is applied in the ipset git tree, thanks.

Best regards,
Jozsef


-
E-mail  : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
          H-1525 Budapest 114, POB. 49, Hungary
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html