path: root/tools/testing/selftests/timers/posix_timers.c
diff options
authorStefano Brivio <sbrivio@redhat.com>2020-10-29 16:39:46 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2020-10-31 11:11:11 +0100
commit7d10e62c2ff8e084c136c94d32d9a94de4d31248 (patch)
tree00b9dcd001fa5f7597e3bb406c9d90b3539fc30d /tools/testing/selftests/timers/posix_timers.c
parentnetfilter: nf_tables: missing validation from the abort path (diff)
netfilter: ipset: Update byte and packet counters regardless of whether they match
In ip_set_match_extensions(), for sets with counters, we take care of updating counters themselves by calling ip_set_update_counter(), and of checking if the given comparison and values match, by calling ip_set_match_counter() if needed. However, if a given comparison on counters doesn't match the configured values, that doesn't mean the set entry itself isn't matching. This fix restores the behaviour we had before commit 4750005a85f7 ("netfilter: ipset: Fix "don't update counters" mode when counters used at the matching"), without reintroducing the issue fixed there: back then, mtype_data_match() first updated counters in any case, and then took care of matching on counters. Now, if the IPSET_FLAG_SKIP_COUNTER_UPDATE flag is set, ip_set_update_counter() will anyway skip counter updates if desired. The issue observed is illustrated by this reproducer: ipset create c hash:ip counters ipset add c iptables -I INPUT -m set --match-set c src --bytes-gt 800 -j DROP if we now send packets from, bytes and packets counters for the entry as shown by 'ipset list' are always zero, and, no matter how many bytes we send, the rule will never match, because counters themselves are not updated. Reported-by: Mithil Mhatre <mmhatre@redhat.com> Fixes: 4750005a85f7 ("netfilter: ipset: Fix "don't update counters" mode when counters used at the matching") Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tools/testing/selftests/timers/posix_timers.c')
0 files changed, 0 insertions, 0 deletions