| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 16 Oct 2013 11:12:01 +0200 (CEST)
From: Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>
To: Thierry Reding <thierry.reding@...il.com>
cc: Jiri Kosina <jkosina@...e.cz>,
Pablo Neira Ayuso <pablo@...filter.org>,
Patrick McHardy <kaber@...sh.net>,
Maxime Jayat <maxime@...isandeveloppeur.fr>,
linux-next@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: linux-next: manual merge of the trivial tree
On Tue, 15 Oct 2013, Thierry Reding wrote:
> Today's linux-next merge of the trivial tree got conflicts in
>
> net/netfilter/xt_set.c
>
> caused by commits 3f79410 (treewide: Fix common typo in "identify") and
> bd3129f (netfilter: ipset: order matches and targets separatedly in
> xt_set.c).
>
> I fixed them up (see below). Please verify that the resolution looks
> good.
I don't really get it: patch bd3129f was part of a patchset, which was
applied to net-next and there it was complete.
There's none of the patchset in question in linux-next, so what's the
trivial tree? Where's lost what?
[The patch below doesn't look good, because it should contain the removed
part for the revision 1 match due to the reordering in the file.]
Best regards,
Jozsef
> ---
> diff --cc net/netfilter/xt_set.c
> index e7c4e0e,4b9d6b4..80c2e2d
> --- a/net/netfilter/xt_set.c
> +++ b/net/netfilter/xt_set.c
> @@@ -81,10 -81,10 +81,10 @@@ set_match_v0_checkentry(const struct xt
> struct xt_set_info_match_v0 *info = par->matchinfo;
> ip_set_id_t index;
>
> - index = ip_set_nfnl_get_byindex(info->match_set.index);
> + index = ip_set_nfnl_get_byindex(par->net, info->match_set.index);
>
> if (index == IPSET_INVALID_ID) {
> - pr_warning("Cannot find set indentified by id %u to match\n",
> + pr_warning("Cannot find set identified by id %u to match\n",
> info->match_set.index);
> return -ENOENT;
> }
> @@@ -106,104 -106,9 +106,104 @@@ set_match_v0_destroy(const struct xt_mt
> {
> struct xt_set_info_match_v0 *info = par->matchinfo;
>
> - ip_set_nfnl_put(info->match_set.index);
> + ip_set_nfnl_put(par->net, info->match_set.index);
> }
>
> +/* Revision 1 match */
> +
> +static bool
> +set_match_v1(const struct sk_buff *skb, struct xt_action_param *par)
> +{
> + const struct xt_set_info_match_v1 *info = par->matchinfo;
> + ADT_OPT(opt, par->family, info->match_set.dim,
> + info->match_set.flags, 0, UINT_MAX);
> +
> + if (opt.flags & IPSET_RETURN_NOMATCH)
> + opt.cmdflags |= IPSET_FLAG_RETURN_NOMATCH;
> +
> + return match_set(info->match_set.index, skb, par, &opt,
> + info->match_set.flags & IPSET_INV_MATCH);
> +}
> +
> +static int
> +set_match_v1_checkentry(const struct xt_mtchk_param *par)
> +{
> + struct xt_set_info_match_v1 *info = par->matchinfo;
> + ip_set_id_t index;
> +
> + index = ip_set_nfnl_get_byindex(par->net, info->match_set.index);
> +
> + if (index == IPSET_INVALID_ID) {
> - pr_warning("Cannot find set indentified by id %u to match\n",
> ++ pr_warning("Cannot find set identified by id %u to match\n",
> + info->match_set.index);
> + return -ENOENT;
> + }
> + if (info->match_set.dim > IPSET_DIM_MAX) {
> + pr_warning("Protocol error: set match dimension "
> + "is over the limit!\n");
> + ip_set_nfnl_put(par->net, info->match_set.index);
> + return -ERANGE;
> + }
> +
> + return 0;
> +}
> +
> +static void
> +set_match_v1_destroy(const struct xt_mtdtor_param *par)
> +{
> + struct xt_set_info_match_v1 *info = par->matchinfo;
> +
> + ip_set_nfnl_put(par->net, info->match_set.index);
> +}
> +
> +/* Revision 3 match */
> +
> +static bool
> +match_counter(u64 counter, const struct ip_set_counter_match *info)
> +{
> + switch (info->op) {
> + case IPSET_COUNTER_NONE:
> + return true;
> + case IPSET_COUNTER_EQ:
> + return counter == info->value;
> + case IPSET_COUNTER_NE:
> + return counter != info->value;
> + case IPSET_COUNTER_LT:
> + return counter < info->value;
> + case IPSET_COUNTER_GT:
> + return counter > info->value;
> + }
> + return false;
> +}
> +
> +static bool
> +set_match_v3(const struct sk_buff *skb, struct xt_action_param *par)
> +{
> + const struct xt_set_info_match_v3 *info = par->matchinfo;
> + ADT_OPT(opt, par->family, info->match_set.dim,
> + info->match_set.flags, info->flags, UINT_MAX);
> + int ret;
> +
> + if (info->packets.op != IPSET_COUNTER_NONE ||
> + info->bytes.op != IPSET_COUNTER_NONE)
> + opt.cmdflags |= IPSET_FLAG_MATCH_COUNTERS;
> +
> + ret = match_set(info->match_set.index, skb, par, &opt,
> + info->match_set.flags & IPSET_INV_MATCH);
> +
> + if (!(ret && opt.cmdflags & IPSET_FLAG_MATCH_COUNTERS))
> + return ret;
> +
> + if (!match_counter(opt.ext.packets, &info->packets))
> + return 0;
> + return match_counter(opt.ext.bytes, &info->bytes);
> +}
> +
> +#define set_match_v3_checkentry set_match_v1_checkentry
> +#define set_match_v3_destroy set_match_v1_destroy
> +
> +/* Revision 0 interface: backward compatible with netfilter/iptables */
> +
> static unsigned int
> set_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
> {
>
-
E-mail : kadlec@...ckhole.kfki.hu, kadlecsik.jozsef@...ner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
H-1525 Budapest 114, POB. 49, Hungary
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists