diff options
| author |   Sergey Popovich <popovich_sergei@mail.ua> | 2015-06-12 21:23:31 +0200 |
|---|---|---|
| committer |   Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> | 2015-06-14 10:40:13 +0200 |
| commit | 2c227f278a92ca3a1515373cdf9cce3766433e40 (patch) | |
| tree | 01d4ede9b40c671b36e8e821936d9809bf1379b1 /net/netfilter/ipset/ip_set_hash_ipport.c | |
| parent | netfilter: ipset: Check extensions attributes before getting extensions. (diff) | |
| download | linux-dev-2c227f278a92ca3a1515373cdf9cce3766433e40.tar.xz linux-dev-2c227f278a92ca3a1515373cdf9cce3766433e40.zip | |
netfilter: ipset: Permit CIDR equal to the host address CIDR in IPv6
Permit userspace to supply CIDR length equal to the host address CIDR
length in netlink message. Prohibit any other CIDR length for IPv6
variant of the set.
Also return -IPSET_ERR_HASH_RANGE_UNSUPPORTED instead of generic
-IPSET_ERR_PROTOCOL in IPv6 variant of hash:ip,port,net when
IPSET_ATTR_IP_TO attribute is given.
Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Diffstat (limited to 'net/netfilter/ipset/ip_set_hash_ipport.c')
| -rw-r--r-- | net/netfilter/ipset/ip_set_hash_ipport.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/net/netfilter/ipset/ip_set_hash_ipport.c b/net/netfilter/ipset/ip_set_hash_ipport.c index 02d9dbaeea6b..9f036393a6e6 100644 --- a/net/netfilter/ipset/ip_set_hash_ipport.c +++ b/net/netfilter/ipset/ip_set_hash_ipport.c @@ -275,10 +275,16 @@ hash_ipport6_uadt(struct ip_set *set, struct nlattr *tb[], if (unlikely(!tb[IPSET_ATTR_IP] || !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) || - !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) || - tb[IPSET_ATTR_IP_TO] || - tb[IPSET_ATTR_CIDR])) + !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO))) return -IPSET_ERR_PROTOCOL; + if (unlikely(tb[IPSET_ATTR_IP_TO])) + return -IPSET_ERR_HASH_RANGE_UNSUPPORTED; + if (unlikely(tb[IPSET_ATTR_CIDR])) { + u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]); + + if (cidr != HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } if (tb[IPSET_ATTR_LINENO]) *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); |