summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* ipset 7.21 releasedHEADv7.21masterJozsef Kadlecsik2024-02-123-1/+14
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* netfilter: ipset: Suppress false sparse warningsJozsef Kadlecsik2024-02-121-2/+2
| | | | | | | | Due to the code reorganization the functions in question now run by call_rcu(), not under rcu locking and pointer access. This produces false sparse warning which are suppressed by the patch. Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* tests: Verify module unload when sets with timeout were just destroyedJozsef Kadlecsik2024-02-052-3/+27
|
* netfilter: ipset: remove set destroy at ip_set module removalJozsef Kadlecsik2024-02-051-24/+3
| | | | | | | | | The ip_set module can only be removed when all set module type modules are already removed. A set type module can only be removed when all sets belonging to the given type are already removed. So it is not possible that there's any set defined at ip_set module removal. Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* netfilter: ipset: Cleanup the code of destroy operation and explain the two ↵Jozsef Kadlecsik2024-02-051-11/+33
| | | | | | stages in comments Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* netfilter: ipset: Missing gc cancellations fixedJozsef Kadlecsik2024-02-042-2/+4
| | | | | | | | | | | | | | | | | | The patch fdb8e12cc2cc ("netfilter: ipset: fix performance regression in swap operation") missed to add the calls to gc cancellations at the error path of create operations and at module unload. Also, because the half of the destroy operations now executed by a function registered by call_rcu(), neither NFNL_SUBSYS_IPSET mutex or rcu read lock is held and therefore the checking of them results false warnings. Reported-by: syzbot+52bbc0ad036f6f0d4a25@syzkaller.appspotmail.com Reported-by: Brad Spengler <spender@grsecurity.net> Reported-by: Стас Ничипорович <stasn77@gmail.com> Fixes: fdb8e12cc2cc ("netfilter: ipset: fix performance regression in swap operation") Tested-by: Brad Spengler <spender@grsecurity.net> Tested-by: Стас Ничипорович <stasn77@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* The "Fix hex literals in json output" broke save mode, restore itJozsef Kadlecsik2024-02-031-1/+2
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* Fix -Werror=format-extra-args warningJozsef Kadlecsik2024-02-031-2/+2
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* Workaround misleading -Wstringop-truncation warningJozsef Kadlecsik2024-02-031-1/+1
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* ipset 7.20 releasedv7.20Jozsef Kadlecsik2024-01-313-1/+20
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* Ignore *.order.cmd and *.symvers.cmd files in kernel buildsJozsef Kadlecsik2024-01-291-0/+2
|
* treewide: Convert del_timer*() to timer_shutdown*()Steven Rostedt (Google)2024-01-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Due to several bugs caused by timers being re-armed after they are shutdown and just before they are freed, a new state of timers was added called "shutdown". After a timer is set to this state, then it can no longer be re-armed. The following script was run to find all the trivial locations where del_timer() or del_timer_sync() is called in the same function that the object holding the timer is freed. It also ignores any locations where the timer->function is modified between the del_timer*() and the free(), as that is not considered a "trivial" case. This was created by using a coccinelle script and the following commands: $ cat timer.cocci @@ expression ptr, slab; identifier timer, rfield; @@ ( - del_timer(&ptr->timer); + timer_shutdown(&ptr->timer); | - del_timer_sync(&ptr->timer); + timer_shutdown_sync(&ptr->timer); ) ... when strict when != ptr->timer ( kfree_rcu(ptr, rfield); | kmem_cache_free(slab, ptr); | kfree(ptr); ) $ spatch timer.cocci . > /tmp/t.patch $ patch -p1 < /tmp/t.patch Link: https://lore.kernel.org/lkml/20221123201306.823305113@linutronix.de/ Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Acked-by: Pavel Machek <pavel@ucw.cz> [ LED ] Acked-by: Kalle Valo <kvalo@kernel.org> [ wireless ] Acked-by: Paolo Abeni <pabeni@redhat.com> [ networking ] Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* Use timer_shutdown_sync() when available, instead of del_timer_sync()Jozsef Kadlecsik2024-01-292-0/+15
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* netfilter: ipset: fix race condition between swap/destroy and kernel side ↵Jozsef Kadlecsik2024-01-295-19/+65
| | | | | | | | | | | | | | | | | | | | | | | add/del/test v4 The patch "netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test", commit 28628fa9 fixes a race condition. But the synchronize_rcu() added to the swap function unnecessarily slows it down: it can safely be moved to destroy and use call_rcu() instead. Eric Dumazet pointed out that simply calling the destroy functions as rcu callback does not work: sets with timeout use garbage collectors which need cancelling at destroy which can wait. Therefore the destroy functions are split into two: cancelling garbage collectors safely at executing the command received by netlink and moving the remaining part only into the rcu callback. Link: https://lore.kernel.org/lkml/C0829B10-EAA6-4809-874E-E1E9C05A8D84@automattic.com/ Fixes: 28628fa952fe ("netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test") Reported-by: Ale Crismani <ale.crismani@automattic.com> Reported-by: David Wang <00107082@163.com> Tested-by: David Wang <00107082@163.com> Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* Bash completion utility updatedJozsef Kadlecsik2023-12-141-3/+3
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* Fix json output for -name optionMark2023-12-121-3/+7
| | | | | | | | | | | | | | | | | | | | | When listing just the set names,json output generated key:value pairs in an array and not a map, which is invalid in json. Instead of [ "name" : "test" "name" : "test2" ] generate [ { "name" : "test" }, { "name" : "test2" } ] Fixes bugzilla #1726. Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* Fix hex literals in json outputJozsef Kadlecsik2023-12-123-23/+29
| | | | | | | | | Json does not allow 0x prefixes in hex numbers, so output hex numbers as quoted strings instead. Fixes bugzilla #1726, reported by Mark. Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* netfilter: ipset: fix race condition between swap/destroy and kernel side ↵Jozsef Kadlecsik2023-12-111-24/+6
| | | | | | | | | | add/del/test v3 Florian Westphal pointed out that all netfilter hooks run with rcu_read_lock() held and em_ipset.c wraps the entire ip_set_test() in rcu read lock/unlock pair. So there's no need to extend the rcu read locked area in ipset itself. Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* netfilter: ipset: fix race condition between swap/destroy and kernel side ↵Jozsef Kadlecsik2023-11-041-3/+3
| | | | | | | | | add/del/test v2 synchronize_rcu() is moved into ip_set_swap() in order not to burden ip_set_destroy() unnecessarily when all sets are destroyed Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* netfilter: ipset: fix race condition between swap/destroy and kernel side ↵Jozsef Kadlecsik2023-10-191-5/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | add/del/test Linkui Xiao reported that there's a race condition when ipset swap and destroy is called, which can lead to crash in add/del/test element operations. Swap then destroy are usual operations to replace a set with another one in a production system. The issue can in some cases be reproduced with the script: ipset create hash_ip1 hash:net family inet hashsize 1024 maxelem 1048576 ipset add hash_ip1 172.20.0.0/16 ipset add hash_ip1 192.168.0.0/16 iptables -A INPUT -m set --match-set hash_ip1 src -j ACCEPT while [ 1 ] do # ... Ongoing traffic... ipset create hash_ip2 hash:net family inet hashsize 1024 maxelem 1048576 ipset add hash_ip2 172.20.0.0/16 ipset swap hash_ip1 hash_ip2 ipset destroy hash_ip2 sleep 0.05 done In the race case the possible order of the operations are CPU0 CPU1 ip_set_test ipset swap hash_ip1 hash_ip2 ipset destroy hash_ip2 hash_net_kadt Swap replaces hash_ip1 with hash_ip2 and then destroy removes hash_ip2 which is the original hash_ip1. ip_set_test was called on hash_ip1 and because destroy removed it, hash_net_kadt crashes. The fix is to protect both the list of the sets and the set pointers in an extended RCU region and before calling destroy, wait to finish all started rcu_read_lock(). The first version of the patch was written by Linkui Xiao <xiaolinkui@kylinos.cn>. Closes: https://lore.kernel.org/all/69e7963b-e7f8-3ad0-210-7b86eebf7f78@netfilter.org/ Reported by: Linkui Xiao <xiaolinkui@kylinos.cn> Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* tests: increase timeout to cope with slow virtual test machineJozsef Kadlecsik2023-10-181-1/+1
|
* ipset 7.19 releasedv7.19Jozsef Kadlecsik2023-09-212-1/+4
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* build: Fix the double-prefix in pkgconfigSam James2023-09-212-1/+1
| | | | | | | | | Remove the extraneous pkgconfigdir definition and use the proper one from pkg.m4 via PKG_INSTALLDIR. Fixes: 326932be0c4f47756f9809cad5a103ac310f700d Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* Merge branch 'master' of ssh://git.netfilter.org:60084/ipsetJozsef Kadlecsik2023-09-191-1/+1
|\
| * bash-completion: fix syntax errorJeremy Sowden2023-08-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is a syntax error in a redirection: $ bash -x utils/ipset_bash_completion/ipset + shopt -s extglob utils/ipset_bash_completion/ipset: line 365: syntax error near unexpected token `(' utils/ipset_bash_completion/ipset: line 365: `done < <(PATH=${PATH}:/sbin ( command ip -o link show ) )' Move the environment variable assignment into the sub-shell. Fixes: da6242e17583 ("Updated utilities") Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1041605 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | ipset 7.18 releasedv7.18Jozsef Kadlecsik2023-09-193-1/+28
| | | | | | | | Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* | Add json output to list commandThomas Oberhammer2023-09-186-7/+97
| | | | | | | | Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* | netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAPJozsef Kadlecsik2023-09-181-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | Kyle Zeng reported that there is a race between IPSET_CMD_ADD and IPSET_CMD_SWAP in netfilter/ip_set, which can lead to the invocation of `__ip_set_put` on a wrong `set`, triggering the `BUG_ON(set->ref == 0);` check in it. The race is caused by using the wrong reference counter, i.e. the ref counter instead of ref_netlink. Reported-by: Kyle Zeng <zengyhkyle@gmail.com> Tested-by: Kyle Zeng <zengyhkyle@gmail.com> Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* | netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ↵Kyle Zeng2023-09-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ip_set_hash_netportnet.c The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to slab out-of-bound access. This patch adds back the IP_SET_HASH_WITH_NET0 macro to ip_set_hash_netportnet to address the issue. Fixes: 886503f34d63 ("netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net") Suggested-by: Jozsef Kadlecsik <kadlec@netfilter.org> Signed-off-by: Kyle Zeng <zengyhkyle@gmail.com> Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* | compatibility: handle strscpy_pad()Jozsef Kadlecsik2023-09-182-0/+26
| |
* | netfilter: ipset: refactor deprecated strncpyJustin Stitt2023-09-181-6/+6
| | | | | | | | | | | | | | | | | | Use `strscpy_pad` instead of `strncpy`. Link: https://github.com/KSPP/linux/issues/90 Cc: linux-hardening@vger.kernel.org Signed-off-by: Justin Stitt <justinstitt@google.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* | netfilter: ipset: remove rcu_read_lock_bh pair from ip_set_testFlorian Westphal2023-09-181-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | Callers already hold rcu_read_lock. Prior to RCU conversion this used to be a read_lock_bh(), but now the bh-disable isn't needed anymore. Cc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* | netfilter: ipset: Replace strlcpy with strscpyAzeem Shaikh2023-09-181-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). Direct replacement is safe here since return value from all callers of STRLCPY macro were ignored. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com> Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org> Reviewed-by: Kees Cook <keescook@chromium.org> Reviewed-by: Simon Horman <simon.horman@corigine.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20230613003437.3538694-1-azeemshaikh38@gmail.com Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* | netfilter: ipset: Add schedule point in call_ad().Kuniyuki Iwashima2023-09-181-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | syzkaller found a repro that causes Hung Task [0] with ipset. The repro first creates an ipset and then tries to delete a large number of IPs from the ipset concurrently: IPSET_ATTR_IPADDR_IPV4 : 172.20.20.187 IPSET_ATTR_CIDR : 2 The first deleting thread hogs a CPU with nfnl_lock(NFNL_SUBSYS_IPSET) held, and other threads wait for it to be released. Previously, the same issue existed in set->variant->uadt() that could run so long under ip_set_lock(set). Commit 5e29dc36bd5e ("netfilter: ipset: Rework long task execution when adding/deleting entries") tried to fix it, but the issue still exists in the caller with another mutex. While adding/deleting many IPs, we should release the CPU periodically to prevent someone from abusing ipset to hang the system. Note we need to increment the ipset's refcnt to prevent the ipset from being destroyed while rescheduling. [0]: INFO: task syz-executor174:268 blocked for more than 143 seconds. Not tainted 6.4.0-rc1-00145-gba79e9a73284 #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor174 state:D stack:0 pid:268 ppid:260 flags:0x0000000d Call trace: __switch_to+0x308/0x714 arch/arm64/kernel/process.c:556 context_switch kernel/sched/core.c:5343 [inline] __schedule+0xd84/0x1648 kernel/sched/core.c:6669 schedule+0xf0/0x214 kernel/sched/core.c:6745 schedule_preempt_disabled+0x58/0xf0 kernel/sched/core.c:6804 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6fc/0xdb0 kernel/locking/mutex.c:747 __mutex_lock_slowpath+0x14/0x20 kernel/locking/mutex.c:1035 mutex_lock+0x98/0xf0 kernel/locking/mutex.c:286 nfnl_lock net/netfilter/nfnetlink.c:98 [inline] nfnetlink_rcv_msg+0x480/0x70c net/netfilter/nfnetlink.c:295 netlink_rcv_skb+0x1c0/0x350 net/netlink/af_netlink.c:2546 nfnetlink_rcv+0x18c/0x199c net/netfilter/nfnetlink.c:658 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x664/0x8cc net/netlink/af_netlink.c:1365 netlink_sendmsg+0x6d0/0xa4c net/netlink/af_netlink.c:1913 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0x4b8/0x810 net/socket.c:2503 ___sys_sendmsg net/socket.c:2557 [inline] __sys_sendmsg+0x1f8/0x2a4 net/socket.c:2586 __do_sys_sendmsg net/socket.c:2595 [inline] __se_sys_sendmsg net/socket.c:2593 [inline] __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2593 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x84/0x270 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x134/0x24c arch/arm64/kernel/syscall.c:142 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193 el0_svc+0x2c/0x7c arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 Reported-by: syzkaller <syzkaller@googlegroups.com> Fixes: a7b4f989a629 ("netfilter: ipset: IP set core support") Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* | net: Kconfig: fix spellosRandy Dunlap2023-09-181-1/+1
|/ | | | | | | | | | | | | | | | Fix spelling in net/ Kconfig files. (reported by codespell) Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: Jozsef Kadlecsik <kadlec@netfilter.org> Cc: Florian Westphal <fw@strlen.de> Cc: coreteam@netfilter.org Cc: Jamal Hadi Salim <jhs@mojatatu.com> Cc: Cong Wang <xiyou.wangcong@gmail.com> Cc: Jiri Pirko <jiri@resnulli.us> Link: https://lore.kernel.org/r/20230124181724.18166-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
* tests: hash:ip,port.t: Replace VRRP by GRE protocolPhil Sutter2023-03-102-5/+5
| | | | | | | | Some systems may not have "vrrp" as alias to "carp" yet, so use a protocol which is less likely to cause problems for testing purposes. Fixes: a67aa712ed912 ("tests: hash:ip,port.t: 'vrrp' is printed as 'carp'") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: hash:ip,port.t: 'vrrp' is printed as 'carp'Phil Sutter2023-03-101-1/+1
| | | | | | | | | | | | % grep vrrp /etc/protocols | carp 112 CARP vrrp # Common Address Redundancy Protocol Nowadays, carp seems to be the preferred name for protocol 112. Simply change the expected output for lack of idea for a backwards compatible change which is not simply using another protocol. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: cidr.sh: Add ipcalc fallbackPhil Sutter2023-03-101-4/+28
| | | | | | If netmask is not available, ipcalc may be a viable replacement. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate: Make test input validPhil Sutter2023-03-103-5/+15
| | | | | | | | | | | | | Make sure ipset at least accepts the test input by running it against plain ipset once for sanity. This exposed two issues: * Set 'hip5' doesn't have comment support, so add the commented elements to 'hip6' instead (likely a typo). * Set 'bip1' range 2.0.0.1-2.1.0.1 exceeds the max allowed for bitmap sets. Reduce it accordingly. Fixes: 7587d1c4b5465 ("tests: add tests ipset to nftables") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: xlate: Test built binary by defaultPhil Sutter2023-03-102-6/+3
| | | | | | | | | Testing the host's iptables-translate by default is unintuitive. Since the ipset-translate symlink is created upon 'make install', add a local symlink to the repository pointing at a built binary in src/. Using this by default is consistent with the regular testsuite. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xlate: Drop dead codePhil Sutter2023-03-101-3/+0
| | | | | | | | Set type is not needed when manipulating elements, the assigned variable was unused in that case. Fixes: 325af556cd3a6 ("add ipset to nftables translation infrastructure") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xlate: Fix for fd leak in error pathPhil Sutter2023-03-101-1/+1
| | | | | | | A rather cosmetic issue though, the program will terminate anyway. Fixes: 325af556cd3a6 ("add ipset to nftables translation infrastructure") Signed-off-by: Phil Sutter <phil@nwl.cc>
* configure.ac: fix bashismsSam James2023-01-281-3/+3
| | | | | | | | | | | | | configure scripts need to be runnable with a POSIX-compliant /bin/sh. On many (but not all!) systems, /bin/sh is provided by Bash, so errors like this aren't spotted. Notably Debian defaults to /bin/sh provided by dash which doesn't tolerate such bashisms as '=='. This retains compatibility with bash. Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* lib/Makefile.am: fix pkgconfig dirSam James2023-01-281-1/+1
| | | | | Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.Gavrilov Ilia2023-01-281-2/+2
| | | | | | | | | | | | | | | | When first_ip is 0, last_ip is 0xFFFFFFFF, and netmask is 31, the value of an arithmetic expression 2 << (netmask - mask_bits - 1) is subject to overflow due to a failure casting operands to a larger data type before performing the arithmetic. Note that it's harmless since the value will be checked at the next step. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. Fixes: b9fed748185a ("netfilter: ipset: Check and reject crazy /0 input parameters") Signed-off-by: Ilia.Gavrilov <Ilia.Gavrilov@infotecs.ru> Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* ipset 7.17 releasedv7.17Jozsef Kadlecsik2022-12-303-1/+11
| | | | Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
* Tests: When verifying comments/timeouts, make sure entries don't expireJozsef Kadlecsik2022-12-302-2/+2
|
* Tests: Make sure the internal batches add the correct number of elementsJozsef Kadlecsik2022-12-301-0/+6
|
* Tests: Verify that hash:net,port,net type can handle 0/0 properlyJozsef Kadlecsik2022-12-301-0/+6
|
* netfilter: ipset: Rework long task execution when adding/deleting entriesJozsef Kadlecsik2022-12-3011-81/+68
| | | | | | | | | | | | | | | | | | | | | When adding/deleting large number of elements in one step in ipset, it can take a reasonable amount of time and can result in soft lockup errors. The patch 5f7b51bf09ba ("netfilter: ipset: Limit the maximal range of consecutive elements to add/delete") tried to fix it by limiting the max elements to process at all. However it was not enough, it is still possible that we get hung tasks. Lowering the limit is not reasonable, so the approach in this patch is as follows: rely on the method used at resizing sets and save the state when we reach a smaller internal batch limit, unlock/lock and proceed from the saved state. Thus we can avoid long continuous tasks and at the same time removed the limit to add/delete large number of elements in one step. The nfnl mutex is held during the whole operation which prevents one to issue other ipset commands in parallel. Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org> Reported-by: syzbot+9204e7399656300bf271@syzkaller.appspotmail.com Fixes: 5f7b51bf09ba ("netfilter: ipset: Limit the maximal range of consecutive elements to add/delete")