Skip to content

GitLab

Switch branch/tag
  1. 10 Nov, 2016 3 commits
  3. 24 Apr, 2016 1 commit
  5. 28 Mar, 2016 1 commit
    • Vishwanath Pai's avatar
      netfilter: ipset: fix race condition in ipset save, swap and delete · 596cf3fe
      Vishwanath Pai authored 
      

This fix adds a new reference counter (ref_netlink) for the struct ip_set.
The other reference counter (ref) can be swapped out by ip_set_swap and we
need a separate counter to keep track of references for netlink events
like dump. Using the same ref counter for dump causes a race condition
which can be demonstrated by the following script:

ipset create hash_ip1 hash:ip family inet hashsize 1024 maxelem 500000 \
counters
ipset create hash_ip2 hash:ip family inet hashsize 300000 maxelem 500000 \
counters
ipset create hash_ip3 hash:ip family inet hashsize 1024 maxelem 500000 \
counters

ipset save &

ipset swap hash_ip3 hash_ip2
ipset destroy hash_ip3 /* will crash the machine */

Swap will exchange the values of ref so destroy will see ref = 0 instead of
ref = 1. With this fix in place swap will not succeed because ipset save
still has ref_netlink on the set (ip_set_swap doesn't swap ref_netlink).

Both delete and swap will error out if ref_netlink != 0 on the set.

Note: The changes to *_head functions is because previously we would
increment ref whenever we called these functions, we don't do that
anymore.
Reviewed-by: default avatarJoshua Hunt <johunt@akamai.com>
Signed-off-by: default avatarVishwanath Pai <vpai@akamai.com>
Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      596cf3fe
  7. 07 Nov, 2015 1 commit
  9. 14 Jun, 2015 4 commits
  11. 14 May, 2015 1 commit
    • Denys Vlasenko's avatar
      netfilter: ipset: deinline ip_set_put_extensions() · a3b1c1eb
      Denys Vlasenko authored 
      

On x86 allyesconfig build:
The function compiles to 489 bytes of machine code.
It has 25 callsites.

    text    data       bss       dec     hex filename
82441375 22255384 20627456 125324215 7784bb7 vmlinux.before
82434909 22255384 20627456 125317749 7783275 vmlinux
Signed-off-by: default avatarDenys Vlasenko <dvlasenk@redhat.com>
CC: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
CC: Eric W. Biederman <ebiederm@xmission.com>
CC: David S. Miller <davem@davemloft.net>
CC: Jan Engelhardt <jengelh@medozas.de>
CC: Jiri Pirko <jpirko@redhat.com>
CC: linux-kernel@vger.kernel.org
CC: netdev@vger.kernel.org
CC: netfilter-devel@vger.kernel.org
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      a3b1c1eb
  13. 13 May, 2015 1 commit
  15. 31 Mar, 2015 1 commit
  17. 15 Sep, 2014 2 commits
  19. 06 Mar, 2014 3 commits
  21. 03 Jan, 2014 1 commit
  23. 22 Oct, 2013 1 commit
  25. 30 Sep, 2013 10 commits
  27. 16 Sep, 2013 1 commit
    • Jozsef Kadlecsik's avatar
      netfilter: ipset: Consistent userspace testing with nomatch flag · 0f1799ba
      Jozsef Kadlecsik authored 
      

The "nomatch" commandline flag should invert the matching at testing,
similarly to the --return-nomatch flag of the "set" match of iptables.
Until now it worked with the elements with "nomatch" flag only. From
now on it works with elements without the flag too, i.e:

 # ipset n test hash:net
 # ipset a test 10.0.0.0/24 nomatch
 # ipset t test 10.0.0.1
 10.0.0.1 is NOT in set test.
 # ipset t test 10.0.0.1 nomatch
 10.0.0.1 is in set test.

 # ipset a test 192.168.0.0/24
 # ipset t test 192.168.0.1
 192.168.0.1 is in set test.
 # ipset t test 192.168.0.1 nomatch
 192.168.0.1 is NOT in set test.

 Before the patch the results were

 ...
 # ipset t test 192.168.0.1
 192.168.0.1 is in set test.
 # ipset t test 192.168.0.1 nomatch
 192.168.0.1 is in set test.
Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
      0f1799ba
  29. 29 Apr, 2013 4 commits
  31. 09 Oct, 2012 1 commit
  33. 22 Sep, 2012 3 commits
  35. 15 Apr, 2012 1 commit

Imprint & Privacy Policy