xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: ipset: Alignment problem between 64bit kernel 32bit userspace

Browse Source 
Sven-Haegar Koch reported the issue:

sims:~# iptables -A OUTPUT -m set --match-set testset src -j ACCEPT
iptables: Invalid argument. Run `dmesg' for more information.

In syslog:
x_tables: ip_tables: set.3 match: invalid size 48 (kernel) != (user) 32

which was introduced by the counter extension in ipset.

The patch fixes the alignment issue with introducing a new set match
revision with the fixed underlying 'struct ip_set_counter_match'
structure.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Jozsef Kadlecsik
2014-11-30 19:56:53 +01:00
committed by Pablo Neira Ayuso
parent 86ac79c7be
commit a51b9199b1
3 changed files with 88 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
include/uapi/linux/netfilter/ipset/ip_set.h
View File

@@ -256,11 +256,17 @@ enum {
IPSET_COUNTER_GT,
};
struct ip_set_counter_match {
/* Backward compatibility for set match v3 */
struct ip_set_counter_match0 {
__u8 op;
__u64 value;
};
struct ip_set_counter_match {
__aligned_u64 value;
__u8 op;
};
/* Interface to iptables/ip6tables */
#define SO_IP_SET 83

13
include/uapi/linux/netfilter/xt_set.h
View File

@@ -66,8 +66,8 @@ struct xt_set_info_target_v2 {
struct xt_set_info_match_v3 {
struct xt_set_info match_set;
struct ip_set_counter_match packets;
struct ip_set_counter_match bytes;
struct ip_set_counter_match0 packets;
struct ip_set_counter_match0 bytes;
__u32 flags;
};
@@ -81,4 +81,13 @@ struct xt_set_info_target_v3 {
__u32 timeout;
};
/* Revision 4 match */
struct xt_set_info_match_v4 {
struct xt_set_info match_set;
struct ip_set_counter_match packets;
struct ip_set_counter_match bytes;
__u32 flags;
};
#endif /*_XT_SET_H*/