Commit 774e4d34 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

Merge branch 'master' of git://blackhole.kfki.hu/nf 



Jozsef Kadlecsik says:

====================
ipset patches for nf

- Fix the error code in ip_set_sockfn_get() when copy_to_user() is used,
  from Dan Carpenter.
- The IPv6 part was missed when fixing copying the right MAC address
  in the patch "netfilter: ipset: Copy the right MAC address in bitmap:ip,mac
  and hash:ip,mac sets", it is completed now by Stefano Brivio.
- ipset nla_policies are fixed to fully support NL_VALIDATE_STRICT and
  the code is converted from deprecated parsings to verified ones.
====================

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parents 88c74984 12899756

net/netfilter/ipset/ip_set_core.c

+33 −16
Original line number Diff line number Diff line
@@ -296,7 +296,8 @@ ip_set_get_ipaddr4(struct nlattr *nla, __be32 *ipaddr) 


	if (unlikely(!flag_nested(nla)))

		return -IPSET_ERR_PROTOCOL;

	if (nla_parse_nested_deprecated(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy, NULL))

	if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla,

			     ipaddr_policy, NULL))

		return -IPSET_ERR_PROTOCOL;

	if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV4)))

		return -IPSET_ERR_PROTOCOL;
@@ -314,7 +315,8 @@ ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr) 
	if (unlikely(!flag_nested(nla)))

		return -IPSET_ERR_PROTOCOL;



	if (nla_parse_nested_deprecated(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy, NULL))

	if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla,

			     ipaddr_policy, NULL))

		return -IPSET_ERR_PROTOCOL;

	if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV6)))

		return -IPSET_ERR_PROTOCOL;
@@ -934,7 +936,8 @@ static int ip_set_create(struct net *net, struct sock *ctnl, 


	/* Without holding any locks, create private part. */

	if (attr[IPSET_ATTR_DATA] &&

	    nla_parse_nested_deprecated(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA], set->type->create_policy, NULL)) {

	    nla_parse_nested(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA],

			     set->type->create_policy, NULL)) {

		ret = -IPSET_ERR_PROTOCOL;

		goto put_out;

	}
@@ -1281,6 +1284,14 @@ dump_attrs(struct nlmsghdr *nlh) 
	}

}



static const struct nla_policy

ip_set_dump_policy[IPSET_ATTR_CMD_MAX + 1] = {

	[IPSET_ATTR_PROTOCOL]	= { .type = NLA_U8 },

	[IPSET_ATTR_SETNAME]	= { .type = NLA_NUL_STRING,

				    .len = IPSET_MAXNAMELEN - 1 },

	[IPSET_ATTR_FLAGS]	= { .type = NLA_U32 },

};



static int

dump_init(struct netlink_callback *cb, struct ip_set_net *inst)

{
@@ -1292,9 +1303,9 @@ dump_init(struct netlink_callback *cb, struct ip_set_net *inst) 
	ip_set_id_t index;

	int ret;



	ret = nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, attr,

	ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, attr,

			nlh->nlmsg_len - min_len,

				   ip_set_setname_policy, NULL);

			ip_set_dump_policy, NULL);

	if (ret)

		return ret;
@@ -1543,9 +1554,9 @@ call_ad(struct sock *ctnl, struct sk_buff *skb, struct ip_set *set, 
		memcpy(&errmsg->msg, nlh, nlh->nlmsg_len);

		cmdattr = (void *)&errmsg->msg + min_len;



		ret = nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, cmdattr,

					   nlh->nlmsg_len - min_len,

					   ip_set_adt_policy, NULL);

		ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr,

				nlh->nlmsg_len - min_len, ip_set_adt_policy,

				NULL);



		if (ret) {

			nlmsg_free(skb2);
@@ -1596,7 +1607,9 @@ static int ip_set_ad(struct net *net, struct sock *ctnl, 


	use_lineno = !!attr[IPSET_ATTR_LINENO];

	if (attr[IPSET_ATTR_DATA]) {

		if (nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA], set->type->adt_policy, NULL))

		if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX,

				     attr[IPSET_ATTR_DATA],

				     set->type->adt_policy, NULL))

			return -IPSET_ERR_PROTOCOL;

		ret = call_ad(ctnl, skb, set, tb, adt, flags,

			      use_lineno);
@@ -1606,7 +1619,8 @@ static int ip_set_ad(struct net *net, struct sock *ctnl, 
		nla_for_each_nested(nla, attr[IPSET_ATTR_ADT], nla_rem) {

			if (nla_type(nla) != IPSET_ATTR_DATA ||

			    !flag_nested(nla) ||

			    nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, nla, set->type->adt_policy, NULL))

			    nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, nla,

					     set->type->adt_policy, NULL))

				return -IPSET_ERR_PROTOCOL;

			ret = call_ad(ctnl, skb, set, tb, adt,

				      flags, use_lineno);
@@ -1655,7 +1669,8 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb, 
	if (!set)

		return -ENOENT;



	if (nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA], set->type->adt_policy, NULL))

	if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA],

			     set->type->adt_policy, NULL))

		return -IPSET_ERR_PROTOCOL;



	rcu_read_lock_bh();
@@ -1961,7 +1976,7 @@ static const struct nfnl_callback ip_set_netlink_subsys_cb[IPSET_MSG_MAX] = { 
	[IPSET_CMD_LIST]	= {

		.call		= ip_set_dump,

		.attr_count	= IPSET_ATTR_CMD_MAX,

		.policy		= ip_set_setname_policy,

		.policy		= ip_set_dump_policy,

	},

	[IPSET_CMD_SAVE]	= {

		.call		= ip_set_dump,
@@ -2069,8 +2084,9 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len) 
		}



		req_version->version = IPSET_PROTOCOL;

		ret = copy_to_user(user, req_version,

				   sizeof(struct ip_set_req_version));

		if (copy_to_user(user, req_version,

				 sizeof(struct ip_set_req_version)))

			ret = -EFAULT;

		goto done;

	}

	case IP_SET_OP_GET_BYNAME: {
@@ -2129,7 +2145,8 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len) 
	}	/* end of switch(op) */



copy:

	ret = copy_to_user(user, data, copylen);

	if (copy_to_user(user, data, copylen))

		ret = -EFAULT;



done:

	vfree(data);

net/netfilter/ipset/ip_set_hash_ipmac.c

+1 −1
Original line number Diff line number Diff line
@@ -209,7 +209,7 @@ hash_ipmac6_kadt(struct ip_set *set, const struct sk_buff *skb, 
	    (skb_mac_header(skb) + ETH_HLEN) > skb->data)

		return -EINVAL;



	if (opt->flags & IPSET_DIM_ONE_SRC)

	if (opt->flags & IPSET_DIM_TWO_SRC)

		ether_addr_copy(e.ether, eth_hdr(skb)->h_source);

	else

		ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);

net/netfilter/ipset/ip_set_hash_net.c

+1 −0
Original line number Diff line number Diff line
@@ -368,6 +368,7 @@ static struct ip_set_type hash_net_type __read_mostly = { 
		[IPSET_ATTR_IP_TO]	= { .type = NLA_NESTED },

		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },

		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },

		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },

		[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },

		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },

		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },

net/netfilter/ipset/ip_set_hash_netnet.c

+1 −0
Original line number Diff line number Diff line
@@ -476,6 +476,7 @@ static struct ip_set_type hash_netnet_type __read_mostly = { 
		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },

		[IPSET_ATTR_CIDR2]	= { .type = NLA_U8 },

		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },

		[IPSET_ATTR_LINENO]	= { .type = NLA_U32 },

		[IPSET_ATTR_CADT_FLAGS]	= { .type = NLA_U32 },

		[IPSET_ATTR_BYTES]	= { .type = NLA_U64 },

		[IPSET_ATTR_PACKETS]	= { .type = NLA_U64 },

CRA Git | Maintained and supported by SUSTech CRA and CCSE