Netdev Archive on lore.kernel.org
 help / color / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Stefano Brivio <sbrivio@redhat.com>, Chen Yi <yiche@redhat.com>,
	Jozsef Kadlecsik <kadlec@netfilter.org>,
	Sasha Levin <sashal@kernel.org>,
	netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
	netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.2 056/123] netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets
Date: Tue, 13 Aug 2019 22:09:40 -0400
Message-ID: <20190814021047.14828-56-sashal@kernel.org> (raw)
In-Reply-To: <20190814021047.14828-1-sashal@kernel.org>

From: Stefano Brivio <sbrivio@redhat.com>

[ Upstream commit 1b4a75108d5bc153daf965d334e77e8e94534f96 ]

In commit 8cc4ccf58379 ("ipset: Allow matching on destination MAC address
for mac and ipmac sets"), ipset.git commit 1543514c46a7, I added to the
KADT functions for sets matching on MAC addreses the copy of source or
destination MAC address depending on the configured match.

This was done correctly for hash:mac, but for hash:ip,mac and
bitmap:ip,mac, copying and pasting the same code block presents an
obvious problem: in these two set types, the MAC address is the second
dimension, not the first one, and we are actually selecting the MAC
address depending on whether the first dimension (IP address) specifies
source or destination.

Fix this by checking for the IPSET_DIM_TWO_SRC flag in option flags.

This way, mixing source and destination matches for the two dimensions
of ip,mac set types works as expected. With this setup:

  ip netns add A
  ip link add veth1 type veth peer name veth2 netns A
  ip addr add 192.0.2.1/24 dev veth1
  ip -net A addr add 192.0.2.2/24 dev veth2
  ip link set veth1 up
  ip -net A link set veth2 up

  dst=$(ip netns exec A cat /sys/class/net/veth2/address)

  ip netns exec A ipset create test_bitmap bitmap:ip,mac range 192.0.0.0/16
  ip netns exec A ipset add test_bitmap 192.0.2.1,${dst}
  ip netns exec A iptables -A INPUT -m set ! --match-set test_bitmap src,dst -j DROP

  ip netns exec A ipset create test_hash hash:ip,mac
  ip netns exec A ipset add test_hash 192.0.2.1,${dst}
  ip netns exec A iptables -A INPUT -m set ! --match-set test_hash src,dst -j DROP

ipset correctly matches a test packet:

  # ping -c1 192.0.2.2 >/dev/null
  # echo $?
  0

Reported-by: Chen Yi <yiche@redhat.com>
Fixes: 8cc4ccf58379 ("ipset: Allow matching on destination MAC address for mac and ipmac sets")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/ipset/ip_set_bitmap_ipmac.c | 2 +-
 net/netfilter/ipset/ip_set_hash_ipmac.c   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index b73c37b3a791f..cfe7b556775f1 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -227,7 +227,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
 
 	e.id = ip_to_id(map, ip);
 
-	if (opt->flags & IPSET_DIM_ONE_SRC)
+	if (opt->flags & IPSET_DIM_TWO_SRC)
 		ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
 	else
 		ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
index eb14434083203..24d8f4df4230c 100644
--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
+++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
@@ -93,7 +93,7 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
 	    (skb_mac_header(skb) + ETH_HLEN) > skb->data)
 		return -EINVAL;
 
-	if (opt->flags & IPSET_DIM_ONE_SRC)
+	if (opt->flags & IPSET_DIM_TWO_SRC)
 		ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
 	else
 		ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
-- 
2.20.1


  parent reply index

Thread overview: 50+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20190814021047.14828-1-sashal@kernel.org>
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 020/123] libbpf: sanitize VAR to conservative 1-byte INT Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 021/123] netfilter: ebtables: fix a memory leak bug in compat Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 025/123] bpf: sockmap, sock_map_delete needs to use xchg Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 026/123] bpf: sockmap, synchronize_rcu before free'ing map Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 027/123] bpf: sockmap, only create entry if ulp is not already enabled Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 028/123] selftests/bpf: fix sendmsg6_prog on s390 Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 030/123] bonding: Force slave speed check after link state recovery for 802.3ad Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 031/123] net: mvpp2: Don't check for 3 consecutive Idle frames for 10G links Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 032/123] selftests: forwarding: gre_multipath: Enable IPv4 forwarding Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 033/123] selftests: forwarding: gre_multipath: Fix flower filters Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 034/123] bpf: fix access to skb_shared_info->gso_segs Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 035/123] selftests/bpf: add another gso_segs access Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 036/123] libbpf: fix using uninitialized ioctl results Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 037/123] can: dev: call netif_carrier_off() in register_candev() Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 038/123] can: mcp251x: add error check when wq alloc failed Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 039/123] can: gw: Fix error path of cgw_module_init Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 042/123] libbpf: silence GCC8 warning about string truncation Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 043/123] st21nfca_connectivity_event_received: null check the allocation Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 044/123] st_nci_hci_connectivity_event_received: " Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 045/123] {nl,mac}80211: fix interface combinations on crypto controlled devices Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 049/123] net: usb: qmi_wwan: Add the BroadMobi BM818 card Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 050/123] qed: RDMA - Fix the hw_ver returned in device attributes Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 051/123] isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in start_isoc_chain() Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 053/123] mac80211_hwsim: Fix possible null-pointer dereferences in hwsim_dump_radio_nl() Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 054/123] net: stmmac: manage errors returned by of_get_mac_address() Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 055/123] netfilter: ipset: Actually allow destination MAC address for hash:ip,mac sets too Sasha Levin
2019-08-14  2:09 ` Sasha Levin [this message]
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 057/123] netfilter: ipset: Fix rename concurrency with listing Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 058/123] netfilter: ebtables: also count base chain policies Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 059/123] rxrpc: Fix potential deadlock Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 060/123] rxrpc: Fix the lack of notification when sendmsg() fails on a DATA packet Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 062/123] iwlwifi: mvm: avoid races in rate init and rate perform Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 063/123] iwlwifi: dbg_ini: move iwl_dbg_tlv_load_bin out of debug override ifdef Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 064/123] iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 065/123] iwlwifi: fix locking in delayed GTK setting Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 066/123] iwlwifi: mvm: send LQ command always ASYNC Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 068/123] enetc: Fix build error without PHYLIB Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 069/123] isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 070/123] net: phy: phy_led_triggers: Fix a possible null-pointer dereference in phy_led_trigger_change_speed() Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 073/123] net: usb: pegasus: fix improper read if get_registers() fail Sasha Levin
2019-08-14  2:09 ` [PATCH AUTOSEL 5.2 075/123] can: sja1000: force the string buffer NULL-terminated Sasha Levin
2019-08-14  2:10 ` [PATCH AUTOSEL 5.2 076/123] can: peak_usb: " Sasha Levin
2019-08-14  2:10 ` [PATCH AUTOSEL 5.2 078/123] net/ethernet/qlogic/qed: " Sasha Levin
2019-08-14  2:10 ` [PATCH AUTOSEL 5.2 079/123] enetc: Select PHYLIB while CONFIG_FSL_ENETC_VF is set Sasha Levin
2019-08-14  2:10 ` [PATCH AUTOSEL 5.2 102/123] net: cxgb3_main: Fix a resource leak in a error path in 'init_one()' Sasha Levin
2019-08-14  2:10 ` [PATCH AUTOSEL 5.2 103/123] net: stmmac: Fix issues when number of Queues >= 4 Sasha Levin
2019-08-14  2:10 ` [PATCH AUTOSEL 5.2 104/123] net: stmmac: tc: Do not return a fragment entry Sasha Levin
2019-08-14  2:10 ` [PATCH AUTOSEL 5.2 106/123] net: hisilicon: make hip04_tx_reclaim non-reentrant Sasha Levin
2019-08-14  2:10 ` [PATCH AUTOSEL 5.2 107/123] net: hisilicon: fix hip04-xmit never return TX_BUSY Sasha Levin
2019-08-14  2:10 ` [PATCH AUTOSEL 5.2 108/123] net: hisilicon: Fix dma_map_single failed on arm64 Sasha Levin

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190814021047.14828-56-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=coreteam@netfilter.org \
    --cc=kadlec@netfilter.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=sbrivio@redhat.com \
    --cc=stable@vger.kernel.org \
    --cc=yiche@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Netdev Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netdev/0 netdev/git/0.git
	git clone --mirror https://lore.kernel.org/netdev/1 netdev/git/1.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netdev netdev/ https://lore.kernel.org/netdev \
		netdev@vger.kernel.org netdev@archiver.kernel.org
	public-inbox-index netdev


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netdev


AGPL code for this site: git clone https://public-inbox.org/ public-inbox