summaryrefslogtreecommitdiffstats
path: root/kernel/include/uapi
diff options
context:
space:
mode:
authorJozsef Kadlecsik <kadlec@blackhole.kfki.hu>2014-11-03 07:35:36 +0100
committerJozsef Kadlecsik <kadlec@blackhole.kfki.hu>2014-11-03 07:35:36 +0100
commit2cff85e32c975667d44a521a3841a2c68088d46d (patch)
tree1b95ed4d13ebaf3a3656b36a3b923489670f5e90 /kernel/include/uapi
parent111ccb23bda3468af36d82aeb0b703a9f2d0828b (diff)
Alignment problem between 64bit kernel 32bit userspace
Sven-Haegar Koch reported the issue: sims:~# iptables -A OUTPUT -m set --match-set testset src -j ACCEPT iptables: Invalid argument. Run `dmesg' for more information. In syslog: x_tables: ip_tables: set.3 match: invalid size 48 (kernel) != (user) 32 which was introduced by the counter extension in ipset. The patch fixes the alignment issue with introducing a new set match revision with the fixed underlying 'struct ip_set_counter_match' structure.
Diffstat (limited to 'kernel/include/uapi')
-rw-r--r--kernel/include/uapi/linux/netfilter/ipset/ip_set.h8
-rw-r--r--kernel/include/uapi/linux/netfilter/xt_set.h13
2 files changed, 18 insertions, 3 deletions
diff --git a/kernel/include/uapi/linux/netfilter/ipset/ip_set.h b/kernel/include/uapi/linux/netfilter/ipset/ip_set.h
index ae4127d..337ecd5 100644
--- a/kernel/include/uapi/linux/netfilter/ipset/ip_set.h
+++ b/kernel/include/uapi/linux/netfilter/ipset/ip_set.h
@@ -257,11 +257,17 @@ enum {
IPSET_COUNTER_GT,
};
-struct ip_set_counter_match {
+/* Backward compatibility for set match v3 */
+struct ip_set_counter_match0 {
__u8 op;
__u64 value;
};
+struct ip_set_counter_match {
+ __aligned_u64 value;
+ __u8 op;
+};
+
/* Interface to iptables/ip6tables */
#define SO_IP_SET 83
diff --git a/kernel/include/uapi/linux/netfilter/xt_set.h b/kernel/include/uapi/linux/netfilter/xt_set.h
index d6a1df1..d4e0234 100644
--- a/kernel/include/uapi/linux/netfilter/xt_set.h
+++ b/kernel/include/uapi/linux/netfilter/xt_set.h
@@ -66,8 +66,8 @@ struct xt_set_info_target_v2 {
struct xt_set_info_match_v3 {
struct xt_set_info match_set;
- struct ip_set_counter_match packets;
- struct ip_set_counter_match bytes;
+ struct ip_set_counter_match0 packets;
+ struct ip_set_counter_match0 bytes;
__u32 flags;
};
@@ -81,4 +81,13 @@ struct xt_set_info_target_v3 {
__u32 timeout;
};
+/* Revision 4 match */
+
+struct xt_set_info_match_v4 {
+ struct xt_set_info match_set;
+ struct ip_set_counter_match packets;
+ struct ip_set_counter_match bytes;
+ __u32 flags;
+};
+
#endif /*_XT_SET_H*/