From 6a5878a3748d84d95e15b9a8b018e1bfc54fc894 Mon Sep 17 00:00:00 2001 From: "/C=EU/ST=EU/CN=Jozsef Kadlecsik/emailAddress=kadlec@blackhole.kfki.hu" Date: Sat, 15 Nov 2008 20:20:09 +0000 Subject: 2.4.5 - setlist type does not work properly together with swapping sets, bug reported by Thomas Jacob. - Include linux/capability.h explicitly in ip_set.c (Jan Engelhardt) --- kernel/ChangeLog | 5 + kernel/include/linux/netfilter_ipv4/ip_set.h | 7 +- .../include/linux/netfilter_ipv4/ip_set_setlist.h | 2 +- kernel/ip_set.c | 24 ++++- kernel/ip_set_setlist.c | 118 ++++++++++----------- kernel/ipt_SET.c | 4 +- kernel/ipt_set.c | 2 +- 7 files changed, 92 insertions(+), 70 deletions(-) (limited to 'kernel') diff --git a/kernel/ChangeLog b/kernel/ChangeLog index 292e19f..178339b 100644 --- a/kernel/ChangeLog +++ b/kernel/ChangeLog @@ -1,3 +1,8 @@ +2.4.5 + - setlist type does not work properly together with swapping + sets, bug reported by Thomas Jacob. + - Include linux/capability.h explicitly in ip_set.c (Jan Engelhardt) + 2.4.4 - Premature checking prevents to add valid elements to hash types, fixed (bug reported by JC Janos). diff --git a/kernel/include/linux/netfilter_ipv4/ip_set.h b/kernel/include/linux/netfilter_ipv4/ip_set.h index c29a460..ec3e59f 100644 --- a/kernel/include/linux/netfilter_ipv4/ip_set.h +++ b/kernel/include/linux/netfilter_ipv4/ip_set.h @@ -487,11 +487,12 @@ struct ip_set_hash { /* register and unregister set references */ extern ip_set_id_t ip_set_get_byname(const char name[IP_SET_MAXNAMELEN]); -extern ip_set_id_t ip_set_get_byindex(ip_set_id_t id); -extern void ip_set_put(ip_set_id_t id); +extern ip_set_id_t ip_set_get_byindex(ip_set_id_t index); +extern void ip_set_put_byindex(ip_set_id_t index); +extern ip_set_id_t ip_set_id(ip_set_id_t index); extern ip_set_id_t __ip_set_get_byname(const char name[IP_SET_MAXNAMELEN], struct ip_set **set); -extern void __ip_set_put_byid(ip_set_id_t id); +extern void __ip_set_put_byindex(ip_set_id_t index); /* API for iptables set match, and SET target */ extern int ip_set_addip_kernel(ip_set_id_t id, diff --git a/kernel/include/linux/netfilter_ipv4/ip_set_setlist.h b/kernel/include/linux/netfilter_ipv4/ip_set_setlist.h index 55f0afb..ca044d8 100644 --- a/kernel/include/linux/netfilter_ipv4/ip_set_setlist.h +++ b/kernel/include/linux/netfilter_ipv4/ip_set_setlist.h @@ -10,7 +10,7 @@ struct ip_set_setlist { uint8_t size; - ip_set_id_t id[0]; + ip_set_id_t index[0]; }; struct ip_set_req_setlist_create { diff --git a/kernel/ip_set.c b/kernel/ip_set.c index c4fcc69..f60a63e 100644 --- a/kernel/ip_set.c +++ b/kernel/ip_set.c @@ -21,6 +21,7 @@ #include #include #include +#include #include #include #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,27) @@ -378,7 +379,7 @@ __ip_set_get_byname(const char *name, struct ip_set **set) return index; } -void __ip_set_put_byid(ip_set_id_t index) +void __ip_set_put_byindex(ip_set_id_t index) { if (ip_set_list[index]) __ip_set_put(index); @@ -433,12 +434,26 @@ ip_set_get_byindex(ip_set_id_t index) return index; } +/* + * Find the set id belonging to the index. + * We are protected by the mutex, so we do not need to use + * ip_set_lock. There is no need to reference the sets either. + */ +ip_set_id_t +ip_set_id(ip_set_id_t index) +{ + if (index >= ip_set_max || !ip_set_list[index]) + return IP_SET_INVALID_ID; + + return ip_set_list[index]->id; +} + /* * If the given set pointer points to a valid set, decrement * reference count by 1. The caller shall not assume the index * to be valid, after calling this function. */ -void ip_set_put(ip_set_id_t index) +void ip_set_put_byindex(ip_set_id_t index) { down(&ip_set_app_mutex); if (ip_set_list[index]) @@ -2037,9 +2052,10 @@ EXPORT_SYMBOL(ip_set_unregister_set_type); EXPORT_SYMBOL(ip_set_get_byname); EXPORT_SYMBOL(ip_set_get_byindex); -EXPORT_SYMBOL(ip_set_put); +EXPORT_SYMBOL(ip_set_put_byindex); +EXPORT_SYMBOL(ip_set_id); EXPORT_SYMBOL(__ip_set_get_byname); -EXPORT_SYMBOL(__ip_set_put_byid); +EXPORT_SYMBOL(__ip_set_put_byindex); EXPORT_SYMBOL(ip_set_addip_kernel); EXPORT_SYMBOL(ip_set_delip_kernel); diff --git a/kernel/ip_set_setlist.c b/kernel/ip_set_setlist.c index 50bc368..a7d074f 100644 --- a/kernel/ip_set_setlist.c +++ b/kernel/ip_set_setlist.c @@ -17,14 +17,14 @@ #include /* - * before ==> id, ref - * after ==> ref, id + * before ==> index, ref + * after ==> ref, index */ static inline bool -next_id_eq(const struct ip_set_setlist *map, int i, ip_set_id_t id) +next_index_eq(const struct ip_set_setlist *map, int i, ip_set_id_t index) { - return i < map->size && map->id[i] == id; + return i < map->size && map->index[i] == index; } static int @@ -33,15 +33,15 @@ setlist_utest(struct ip_set *set, const void *data, size_t size, { const struct ip_set_setlist *map = set->data; const struct ip_set_req_setlist *req = data; - ip_set_id_t id, ref = IP_SET_INVALID_ID; + ip_set_id_t index, ref = IP_SET_INVALID_ID; int i, res = 0; struct ip_set *s; if (req->before && req->ref[0] == '\0') return -EINVAL; - id = __ip_set_get_byname(req->name, &s); - if (id == IP_SET_INVALID_ID) + index = __ip_set_get_byname(req->name, &s); + if (index == IP_SET_INVALID_ID) return -EEXIST; if (req->ref[0] != '\0') { ref = __ip_set_get_byname(req->ref, &s); @@ -51,24 +51,24 @@ setlist_utest(struct ip_set *set, const void *data, size_t size, } } for (i = 0; i < map->size - && map->id[i] != IP_SET_INVALID_ID; i++) { - if (req->before && map->id[i] == id) { - res = next_id_eq(map, i + 1, ref); + && map->index[i] != IP_SET_INVALID_ID; i++) { + if (req->before && map->index[i] == index) { + res = next_index_eq(map, i + 1, ref); break; } else if (!req->before) { if ((ref == IP_SET_INVALID_ID - && map->id[i] == id) - || (map->id[i] == ref - && next_id_eq(map, i + 1, id))) { + && map->index[i] == index) + || (map->index[i] == ref + && next_index_eq(map, i + 1, index))) { res = 1; break; } } } if (ref != IP_SET_INVALID_ID) - __ip_set_put_byid(ref); + __ip_set_put_byindex(ref); finish: - __ip_set_put_byid(id); + __ip_set_put_byindex(index); return res; } @@ -83,27 +83,27 @@ setlist_ktest(struct ip_set *set, int i, res = 0; for (i = 0; i < map->size - && map->id[i] != IP_SET_INVALID_ID + && map->index[i] != IP_SET_INVALID_ID && res == 0; i++) - res = ip_set_testip_kernel(map->id[i], skb, flags); + res = ip_set_testip_kernel(map->index[i], skb, flags); return res; } static inline int -insert_setlist(struct ip_set_setlist *map, int i, ip_set_id_t id) +insert_setlist(struct ip_set_setlist *map, int i, ip_set_id_t index) { ip_set_id_t tmp; int j; - printk("i: %u, last %u\n", i, map->id[map->size - 1]); - if (i >= map->size || map->id[map->size - 1] != IP_SET_INVALID_ID) + DP("i: %u, last %u\n", i, map->index[map->size - 1]); + if (i >= map->size || map->index[map->size - 1] != IP_SET_INVALID_ID) return -ERANGE; for (j = i; j < map->size - && id != IP_SET_INVALID_ID; j++) { - tmp = map->id[j]; - map->id[j] = id; - id = tmp; + && index != IP_SET_INVALID_ID; j++) { + tmp = map->index[j]; + map->index[j] = index; + index = tmp; } return 0; } @@ -114,15 +114,15 @@ setlist_uadd(struct ip_set *set, const void *data, size_t size, { struct ip_set_setlist *map = set->data; const struct ip_set_req_setlist *req = data; - ip_set_id_t id, ref = IP_SET_INVALID_ID; + ip_set_id_t index, ref = IP_SET_INVALID_ID; int i, res = -ERANGE; struct ip_set *s; if (req->before && req->ref[0] == '\0') return -EINVAL; - id = __ip_set_get_byname(req->name, &s); - if (id == IP_SET_INVALID_ID) + index = __ip_set_get_byname(req->name, &s); + if (index == IP_SET_INVALID_ID) return -EEXIST; /* "Loop detection" */ if (strcmp(s->type->typename, "setlist") == 0) @@ -136,22 +136,22 @@ setlist_uadd(struct ip_set *set, const void *data, size_t size, } } for (i = 0; i < map->size; i++) { - if (map->id[i] != ref) + if (map->index[i] != ref) continue; if (req->before) - res = insert_setlist(map, i, id); + res = insert_setlist(map, i, index); else res = insert_setlist(map, ref == IP_SET_INVALID_ID ? i : i + 1, - id); + index); break; } if (ref != IP_SET_INVALID_ID) - __ip_set_put_byid(ref); - /* In case of success, we keep the reference to the id */ + __ip_set_put_byindex(ref); + /* In case of success, we keep the reference to the set */ finish: if (res != 0) - __ip_set_put_byid(id); + __ip_set_put_byindex(index); return res; } @@ -166,9 +166,9 @@ setlist_kadd(struct ip_set *set, int i, res = -EINVAL; for (i = 0; i < map->size - && map->id[i] != IP_SET_INVALID_ID + && map->index[i] != IP_SET_INVALID_ID && res != 0; i++) - res = ip_set_addip_kernel(map->id[i], skb, flags); + res = ip_set_addip_kernel(map->index[i], skb, flags); return res; } @@ -178,8 +178,8 @@ unshift_setlist(struct ip_set_setlist *map, int i) int j; for (j = i; j < map->size - 1; j++) - map->id[j] = map->id[j+1]; - map->id[map->size-1] = IP_SET_INVALID_ID; + map->index[j] = map->index[j+1]; + map->index[map->size-1] = IP_SET_INVALID_ID; return 0; } @@ -189,15 +189,15 @@ setlist_udel(struct ip_set *set, const void *data, size_t size, { struct ip_set_setlist *map = set->data; const struct ip_set_req_setlist *req = data; - ip_set_id_t id, ref = IP_SET_INVALID_ID; + ip_set_id_t index, ref = IP_SET_INVALID_ID; int i, res = -EEXIST; struct ip_set *s; if (req->before && req->ref[0] == '\0') return -EINVAL; - id = __ip_set_get_byname(req->name, &s); - if (id == IP_SET_INVALID_ID) + index = __ip_set_get_byname(req->name, &s); + if (index == IP_SET_INVALID_ID) return -EEXIST; if (req->ref[0] != '\0') { ref = __ip_set_get_byname(req->ref, &s); @@ -205,31 +205,31 @@ setlist_udel(struct ip_set *set, const void *data, size_t size, goto finish; } for (i = 0; i < map->size - && map->id[i] != IP_SET_INVALID_ID; i++) { + && map->index[i] != IP_SET_INVALID_ID; i++) { if (req->before) { - if (map->id[i] == id - && next_id_eq(map, i + 1, ref)) { + if (map->index[i] == index + && next_index_eq(map, i + 1, ref)) { res = unshift_setlist(map, i); break; } } else if (ref == IP_SET_INVALID_ID) { - if (map->id[i] == id) { + if (map->index[i] == index) { res = unshift_setlist(map, i); break; } - } else if (map->id[i] == ref - && next_id_eq(map, i + 1, id)) { + } else if (map->index[i] == ref + && next_index_eq(map, i + 1, index)) { res = unshift_setlist(map, i + 1); break; } } if (ref != IP_SET_INVALID_ID) - __ip_set_put_byid(ref); + __ip_set_put_byindex(ref); finish: - __ip_set_put_byid(id); - /* In case of success, release the reference to the id */ + __ip_set_put_byindex(index); + /* In case of success, release the reference to the set */ if (res == 0) - __ip_set_put_byid(id); + __ip_set_put_byindex(index); return res; } @@ -244,9 +244,9 @@ setlist_kdel(struct ip_set *set, int i, res = -EINVAL; for (i = 0; i < map->size - && map->id[i] != IP_SET_INVALID_ID + && map->index[i] != IP_SET_INVALID_ID && res != 0; i++) - res = ip_set_delip_kernel(map->id[i], skb, flags); + res = ip_set_delip_kernel(map->index[i], skb, flags); return res; } @@ -263,7 +263,7 @@ setlist_create(struct ip_set *set, const void *data, size_t size) return -ENOMEM; map->size = req->size; for (i = 0; i < map->size; i++) - map->id[i] = IP_SET_INVALID_ID; + map->index[i] = IP_SET_INVALID_ID; set->data = map; return 0; @@ -276,8 +276,8 @@ setlist_destroy(struct ip_set *set) int i; for (i = 0; i < map->size - && map->id[i] != IP_SET_INVALID_ID; i++) - __ip_set_put_byid(map->id[i]); + && map->index[i] != IP_SET_INVALID_ID; i++) + __ip_set_put_byindex(map->index[i]); kfree(map); set->data = NULL; @@ -290,9 +290,9 @@ setlist_flush(struct ip_set *set) int i; for (i = 0; i < map->size - && map->id[i] != IP_SET_INVALID_ID; i++) { - __ip_set_put_byid(map->id[i]); - map->id[i] = IP_SET_INVALID_ID; + && map->index[i] != IP_SET_INVALID_ID; i++) { + __ip_set_put_byindex(map->index[i]); + map->index[i] = IP_SET_INVALID_ID; } } @@ -320,7 +320,7 @@ setlist_list_members(const struct ip_set *set, void *data) int i; for (i = 0; i < map->size; i++) - *((ip_set_id_t *)data + i) = map->id[i]; + *((ip_set_id_t *)data + i) = ip_set_id(map->index[i]); } IP_SET_TYPE(setlist, IPSET_TYPE_SETNAME | IPSET_DATA_SINGLE) diff --git a/kernel/ipt_SET.c b/kernel/ipt_SET.c index 960e557..a6cad1d 100644 --- a/kernel/ipt_SET.c +++ b/kernel/ipt_SET.c @@ -179,9 +179,9 @@ static void destroy(const struct xt_target *target, } #endif if (info->add_set.index != IP_SET_INVALID_ID) - ip_set_put(info->add_set.index); + ip_set_put_byindex(info->add_set.index); if (info->del_set.index != IP_SET_INVALID_ID) - ip_set_put(info->del_set.index); + ip_set_put_byindex(info->del_set.index); } #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17) diff --git a/kernel/ipt_set.c b/kernel/ipt_set.c index b08b3bb..114f973 100644 --- a/kernel/ipt_set.c +++ b/kernel/ipt_set.c @@ -175,7 +175,7 @@ static void destroy(const struct xt_match *match, return; } #endif - ip_set_put(info->match_set.index); + ip_set_put_byindex(info->match_set.index); } #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,17) -- cgit v1.2.3