On Wed, 11 Sep 2013, Oliver wrote: > On Tuesday 10 September 2013 23:55:14 Jozsef Kadlecsik wrote: > > On Tue, 10 Sep 2013, Oliver wrote: > > > From: Oliver Smith <oliver@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> > > > > > > This fixes a serious bug affecting all hash types with a net element - > > > specifically, if a CIDR value is deleted such that none of the same size > > > exist any more, all larger (less-specific) values will then fail to > > > match. Adding back any prefix with a CIDR equal to or more specific than > > > the one deleted will fix it. > > > > > > Steps to reproduce: > > > ipset -N test hash:net > > > ipset -A test 1.1.0.0/16 > > > ipset -A test 2.2.2.0/24 > > > ipset -T test 1.1.1.1 #1.1.1.1 IS in set > > > ipset -D test 2.2.2.0/24 > > > ipset -T test 1.1.1.1 #1.1.1.1 IS NOT in set > > > > > > This is due to the fact that the nets counter was unconditionally > > > decremented prior to the iteration that shifts up the entries. Now, we > > > first check if there is a proceeding entry and if not, decrement it and > > > return. Otherwise, we proceed to iterate and then clean up the last > > > element afterwards. > > > > > > Signed-off-by: Oliver Smith <oliver@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> > > > > Good catch! But unconditionally checking the next entry may point over the > > array. > > Are you sure? In mtype_del_cidr() we only iterate up to (nets_length - 1) > rather than nets_length, so I didn't think that i+1 could end up going over > the end of the array. (nets_length - 1) is the last index in the array. In the first for loop "i" can reach this value, so "i+1" is over the array. Also, your patch decrements the nets[i] value only if the next entry is empty, that an error too. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
