All of lore.kernel.org
 help / color / mirror / Atom feed
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 06/14] netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net
Date: Tue,  6 Nov 2018 00:28:24 +0100	[thread overview]
Message-ID: <20181105232832.21896-7-pablo@netfilter.org> (raw)
In-Reply-To: <20181105232832.21896-1-pablo@netfilter.org>

From: Eric Westbrook <eric@westbrook.io>

Allow /0 as advertised for hash:net,port,net sets.

For "hash:net,port,net", ipset(8) says that "either subnet
is permitted to be a /0 should you wish to match port
between all destinations."

Make that statement true.

Before:

    # ipset create cidrzero hash:net,port,net
    # ipset add cidrzero 0.0.0.0/0,12345,0.0.0.0/0
    ipset v6.34: The value of the CIDR parameter of the IP address is invalid

    # ipset create cidrzero6 hash:net,port,net family inet6
    # ipset add cidrzero6 ::/0,12345,::/0
    ipset v6.34: The value of the CIDR parameter of the IP address is invalid

After:

    # ipset create cidrzero hash:net,port,net
    # ipset add cidrzero 0.0.0.0/0,12345,0.0.0.0/0
    # ipset test cidrzero 192.168.205.129,12345,172.16.205.129
    192.168.205.129,tcp:12345,172.16.205.129 is in set cidrzero.

    # ipset create cidrzero6 hash:net,port,net family inet6
    # ipset add cidrzero6 ::/0,12345,::/0
    # ipset test cidrzero6 fe80::1,12345,ff00::1
    fe80::1,tcp:12345,ff00::1 is in set cidrzero6.

See also:

  https://bugzilla.kernel.org/show_bug.cgi?id=200897
  https://github.com/ewestbrook/linux/commit/df7ff6efb0934ab6acc11f003ff1a7580d6c1d9c

Signed-off-by: Eric Westbrook <linux@westbrook.io>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/ipset/ip_set_hash_netportnet.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c
index d391485a6acd..613e18e720a4 100644
--- a/net/netfilter/ipset/ip_set_hash_netportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netportnet.c
@@ -213,13 +213,13 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
 
 	if (tb[IPSET_ATTR_CIDR]) {
 		e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
-		if (!e.cidr[0] || e.cidr[0] > HOST_MASK)
+		if (e.cidr[0] > HOST_MASK)
 			return -IPSET_ERR_INVALID_CIDR;
 	}
 
 	if (tb[IPSET_ATTR_CIDR2]) {
 		e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
-		if (!e.cidr[1] || e.cidr[1] > HOST_MASK)
+		if (e.cidr[1] > HOST_MASK)
 			return -IPSET_ERR_INVALID_CIDR;
 	}
 
@@ -493,13 +493,13 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
 
 	if (tb[IPSET_ATTR_CIDR]) {
 		e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
-		if (!e.cidr[0] || e.cidr[0] > HOST_MASK)
+		if (e.cidr[0] > HOST_MASK)
 			return -IPSET_ERR_INVALID_CIDR;
 	}
 
 	if (tb[IPSET_ATTR_CIDR2]) {
 		e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
-		if (!e.cidr[1] || e.cidr[1] > HOST_MASK)
+		if (e.cidr[1] > HOST_MASK)
 			return -IPSET_ERR_INVALID_CIDR;
 	}
 
-- 
2.11.0

  parent reply	other threads:[~2018-11-06  8:50 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-11-05 23:28 [PATCH 00/14] Netfilter fixes for net Pablo Neira Ayuso
2018-11-05 23:28 ` [PATCH 01/14] netfilter: ipv6: fix oops when defragmenting locally generated fragments Pablo Neira Ayuso
2018-11-05 23:28 ` [PATCH 02/14] netfilter: nft_osf: check if attribute is present Pablo Neira Ayuso
2018-11-05 23:28 ` [PATCH 03/14] netfilter: bridge: define INT_MIN & INT_MAX in userspace Pablo Neira Ayuso
2018-11-05 23:28 ` [PATCH 04/14] Revert "netfilter: nft_numgen: add map lookups for numgen random operations" Pablo Neira Ayuso
2018-11-05 23:28 ` [PATCH 05/14] netfilter: ipset: list:set: Decrease refcount synchronously on deletion and replace Pablo Neira Ayuso
2018-11-05 23:28 ` Pablo Neira Ayuso [this message]
2018-11-05 23:28 ` [PATCH 07/14] netfilter: ipset: fix ip_set_list allocation failure Pablo Neira Ayuso
2018-11-05 23:28 ` [PATCH 08/14] netfilter: ipset: Correct rcu_dereference() call in ip_set_put_comment() Pablo Neira Ayuso
2018-11-05 23:28 ` [PATCH 09/14] netfilter: xt_IDLETIMER: add sysfs filename checking routine Pablo Neira Ayuso
2018-11-05 23:28 ` [PATCH 10/14] netfilter: ipset: Fix calling ip_set() macro at dumping Pablo Neira Ayuso
2018-11-05 23:28 ` [PATCH 11/14] netfilter: conntrack: add nf_{tcp,udp,sctp,icmp,dccp,icmpv6,generic}_pernet() Pablo Neira Ayuso
2018-11-05 23:28 ` [PATCH 12/14] netfilter: nfnetlink_cttimeout: pass default timeout policy to obj_to_nlattr Pablo Neira Ayuso
2018-11-05 23:28 ` [PATCH 13/14] netfilter: nft_compat: ebtables 'nat' table is normal chain type Pablo Neira Ayuso
2018-11-05 23:28 ` [PATCH 14/14] netfilter: conntrack: fix calculation of next bucket number in early_drop Pablo Neira Ayuso
2018-11-06  1:19 ` [PATCH 00/14] Netfilter fixes for net David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181105232832.21896-7-pablo@netfilter.org \
    --to=pablo@netfilter.org \
    --cc=davem@davemloft.net \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.