| Message ID | 2035028.3MjN3UaUgL@tuxracer |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Jozsef Kadlecsik |
| Headers | show |
On Thu, 7 Nov 2013, Sergey Popovich wrote: > ipset(8) for list:set says: > The match will try to find a matching entry in the sets and the > target will try to add an entry to the first set to which it can > be added. > > However real behavior is bit differ from described. Consider example: > > # ipset create test-1-v4 hash:ip family inet > # ipset create test-1-v6 hash:ip family inet6 > # ipset create test-1 list:set > # ipset add test-1 test-1-v4 > # ipset add test-1 test-1-v6 > > # iptables -A INPUT -p tcp --destination-port 25 -j SET --add-set test-1 src > # ip6tables -A INPUT -p tcp --destination-port 25 -j SET --add-set test-1 src > > And then when iptables/ip6tables rule matches packet IPSET target > tries to add src from packet to the list:set test-1 where first > entry is test-1-v4 and the second one is test-1-v6. > > For IPv4, as it first entry in test-1 src added to test-1-v4 > correctly, but for IPv6 src not added! > > Placing test-1-v6 to the first element of list:set makes behavior > correct for IPv6, but brokes for IPv4. > > This is due to result, returned from ip_set_add() and ip_set_del() from > net/netfilter/ipset/ip_set_core.c when set in list:set equires more > parameters than given or address families do not match (which is this > case). > > It seems wrong returning 0 from ip_set_add() and ip_set_del() in > this case, as 0 should be returned only when an element successfuly > added/deleted to/from the set, contrary to ip_set_test() which > returns 0 when no entry exists and >0 when entry found in set. > > Signed-off-by: Sergey Popovich <popovich_sergei@mail.ru> Patch is applied, thanks. Best regards, Jozsef - E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/kernel/net/netfilter/ipset/ip_set_core.c b/kernel/net/netfilter/ipset/ip_set_core.c index e43d7db..31c18cf 100644 --- a/kernel/net/netfilter/ipset/ip_set_core.c +++ b/kernel/net/netfilter/ipset/ip_set_core.c @@ -516,7 +516,7 @@ ip_set_add(ip_set_id_t index, const struct sk_buff *skb, if (opt->dim < set->type->dimension || !(opt->family == set->family || set->family == NFPROTO_UNSPEC)) - return 0; + return -IPSET_ERR_TYPE_MISMATCH; write_lock_bh(&set->lock); ret = set->variant->kadt(set, skb, par, IPSET_ADD, opt); @@ -539,7 +539,7 @@ ip_set_del(ip_set_id_t index, const struct sk_buff *skb, if (opt->dim < set->type->dimension || !(opt->family == set->family || set->family == NFPROTO_UNSPEC)) - return 0; + return -IPSET_ERR_TYPE_MISMATCH; write_lock_bh(&set->lock); ret = set->variant->kadt(set, skb, par, IPSET_DEL, opt);
ipset(8) for list:set says: The match will try to find a matching entry in the sets and the target will try to add an entry to the first set to which it can be added. However real behavior is bit differ from described. Consider example: # ipset create test-1-v4 hash:ip family inet # ipset create test-1-v6 hash:ip family inet6 # ipset create test-1 list:set # ipset add test-1 test-1-v4 # ipset add test-1 test-1-v6 # iptables -A INPUT -p tcp --destination-port 25 -j SET --add-set test-1 src # ip6tables -A INPUT -p tcp --destination-port 25 -j SET --add-set test-1 src And then when iptables/ip6tables rule matches packet IPSET target tries to add src from packet to the list:set test-1 where first entry is test-1-v4 and the second one is test-1-v6. For IPv4, as it first entry in test-1 src added to test-1-v4 correctly, but for IPv6 src not added! Placing test-1-v6 to the first element of list:set makes behavior correct for IPv6, but brokes for IPv4. This is due to result, returned from ip_set_add() and ip_set_del() from net/netfilter/ipset/ip_set_core.c when set in list:set equires more parameters than given or address families do not match (which is this case). It seems wrong returning 0 from ip_set_add() and ip_set_del() in this case, as 0 should be returned only when an element successfuly added/deleted to/from the set, contrary to ip_set_test() which returns 0 when no entry exists and >0 when entry found in set. Signed-off-by: Sergey Popovich <popovich_sergei@mail.ru> --- kernel/net/netfilter/ipset/ip_set_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)