summaryrefslogtreecommitdiffstats
path: root/tests/hash:ip6.t.list2
diff options
context:
space:
mode:
authorOliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>2013-09-14 11:05:53 +0200
committerJozsef Kadlecsik <kadlec@blackhole.kfki.hu>2013-09-15 14:14:23 +0200
commitf4ca2c3025daafe8fe99f098137e1dc03c6cae5a (patch)
tree181b58bb8793f27dc6f2b8fe72ca313a2381443f /tests/hash:ip6.t.list2
parent5b360d3eae1dd7c518bae6bf4620c409542db736 (diff)
netfilter: ipset: Fix serious failure in CIDR tracking
This fixes a serious bug affecting all hash types with a net element - specifically, if a CIDR value is deleted such that none of the same size exist any more, all larger (less-specific) values will then fail to match. Adding back any prefix with a CIDR equal to or more specific than the one deleted will fix it. Steps to reproduce: ipset -N test hash:net ipset -A test 1.1.0.0/16 ipset -A test 2.2.2.0/24 ipset -T test 1.1.1.1 #1.1.1.1 IS in set ipset -D test 2.2.2.0/24 ipset -T test 1.1.1.1 #1.1.1.1 IS NOT in set This is due to the fact that the nets counter was unconditionally decremented prior to the iteration that shifts up the entries. Now, we first check if there is a proceeding entry and if not, decrement it and return. Otherwise, we proceed to iterate and then zero the last element, which, in most cases, will already be zero. Signed-off-by: Oliver Smith <oliver@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Diffstat (limited to 'tests/hash:ip6.t.list2')
0 files changed, 0 insertions, 0 deletions