diff options
| author | Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> | 2014-11-03 07:35:36 +0100 |
|---|---|---|
| committer | Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> | 2014-11-03 07:35:36 +0100 |
| commit | 2cff85e32c975667d44a521a3841a2c68088d46d (patch) | |
| tree | 1b95ed4d13ebaf3a3656b36a3b923489670f5e90 /kernel/include/uapi | |
| parent | 111ccb23bda3468af36d82aeb0b703a9f2d0828b (diff) | |
Alignment problem between 64bit kernel 32bit userspace
Sven-Haegar Koch reported the issue:
sims:~# iptables -A OUTPUT -m set --match-set testset src -j ACCEPT
iptables: Invalid argument. Run `dmesg' for more information.
In syslog:
x_tables: ip_tables: set.3 match: invalid size 48 (kernel) != (user) 32
which was introduced by the counter extension in ipset.
The patch fixes the alignment issue with introducing a new set match
revision with the fixed underlying 'struct ip_set_counter_match'
structure.
Diffstat (limited to 'kernel/include/uapi')
| -rw-r--r-- | kernel/include/uapi/linux/netfilter/ipset/ip_set.h | 8 | ||||
| -rw-r--r-- | kernel/include/uapi/linux/netfilter/xt_set.h | 13 |
2 files changed, 18 insertions, 3 deletions
diff --git a/kernel/include/uapi/linux/netfilter/ipset/ip_set.h b/kernel/include/uapi/linux/netfilter/ipset/ip_set.h index ae4127d..337ecd5 100644 --- a/kernel/include/uapi/linux/netfilter/ipset/ip_set.h +++ b/kernel/include/uapi/linux/netfilter/ipset/ip_set.h @@ -257,11 +257,17 @@ enum { IPSET_COUNTER_GT, }; -struct ip_set_counter_match { +/* Backward compatibility for set match v3 */ +struct ip_set_counter_match0 { __u8 op; __u64 value; }; +struct ip_set_counter_match { + __aligned_u64 value; + __u8 op; +}; + /* Interface to iptables/ip6tables */ #define SO_IP_SET 83 diff --git a/kernel/include/uapi/linux/netfilter/xt_set.h b/kernel/include/uapi/linux/netfilter/xt_set.h index d6a1df1..d4e0234 100644 --- a/kernel/include/uapi/linux/netfilter/xt_set.h +++ b/kernel/include/uapi/linux/netfilter/xt_set.h @@ -66,8 +66,8 @@ struct xt_set_info_target_v2 { struct xt_set_info_match_v3 { struct xt_set_info match_set; - struct ip_set_counter_match packets; - struct ip_set_counter_match bytes; + struct ip_set_counter_match0 packets; + struct ip_set_counter_match0 bytes; __u32 flags; }; @@ -81,4 +81,13 @@ struct xt_set_info_target_v3 { __u32 timeout; }; +/* Revision 4 match */ + +struct xt_set_info_match_v4 { + struct xt_set_info match_set; + struct ip_set_counter_match packets; + struct ip_set_counter_match bytes; + __u32 flags; +}; + #endif /*_XT_SET_H*/ |