84 lines
3.3 KiB
Diff
84 lines
3.3 KiB
Diff
From 7563a383e063cf6be846f150a25d85098adad32b Mon Sep 17 00:00:00 2001
|
|
From: Florian Westphal <fwestpha@redhat.com>
|
|
Date: Wed, 13 May 2026 17:16:33 +0200
|
|
Subject: [PATCH] netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-168848
|
|
Upstream Status: commit b7e8590987aa
|
|
|
|
commit b7e8590987aa94c9dc51518fad0e58cb887b1db5
|
|
Author: Florian Westphal <fw@strlen.de>
|
|
Date: Mon Mar 30 14:16:34 2026 +0200
|
|
|
|
netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
|
|
|
|
IPSET_ATTR_NAME and IPSET_ATTR_NAMEREF are of NLA_STRING type, they
|
|
cannot be treated like a c-string.
|
|
|
|
They either have to be switched to NLA_NUL_STRING, or the compare
|
|
operations need to use the nla functions.
|
|
|
|
Fixes: f830837f0eed ("netfilter: ipset: list:set set type support")
|
|
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
Signed-off-by: Florian Westphal <fwestpha@redhat.com>
|
|
|
|
diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
|
|
index e9f4f84..b983315 100644
|
|
--- a/include/linux/netfilter/ipset/ip_set.h
|
|
+++ b/include/linux/netfilter/ipset/ip_set.h
|
|
@@ -309,7 +309,7 @@ enum {
|
|
|
|
/* register and unregister set references */
|
|
extern ip_set_id_t ip_set_get_byname(struct net *net,
|
|
- const char *name, struct ip_set **set);
|
|
+ const struct nlattr *name, struct ip_set **set);
|
|
extern void ip_set_put_byindex(struct net *net, ip_set_id_t index);
|
|
extern void ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name);
|
|
extern ip_set_id_t ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index);
|
|
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
|
|
index cc20e6d..a4e1d79 100644
|
|
--- a/net/netfilter/ipset/ip_set_core.c
|
|
+++ b/net/netfilter/ipset/ip_set_core.c
|
|
@@ -821,7 +821,7 @@ EXPORT_SYMBOL_GPL(ip_set_del);
|
|
*
|
|
*/
|
|
ip_set_id_t
|
|
-ip_set_get_byname(struct net *net, const char *name, struct ip_set **set)
|
|
+ip_set_get_byname(struct net *net, const struct nlattr *name, struct ip_set **set)
|
|
{
|
|
ip_set_id_t i, index = IPSET_INVALID_ID;
|
|
struct ip_set *s;
|
|
@@ -830,7 +830,7 @@ ip_set_get_byname(struct net *net, const char *name, struct ip_set **set)
|
|
rcu_read_lock();
|
|
for (i = 0; i < inst->ip_set_max; i++) {
|
|
s = rcu_dereference(inst->ip_set_list)[i];
|
|
- if (s && STRNCMP(s->name, name)) {
|
|
+ if (s && nla_strcmp(name, s->name) == 0) {
|
|
__ip_set_get(s);
|
|
index = i;
|
|
*set = s;
|
|
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
|
|
index 13c7a08..34bb84d 100644
|
|
--- a/net/netfilter/ipset/ip_set_list_set.c
|
|
+++ b/net/netfilter/ipset/ip_set_list_set.c
|
|
@@ -367,7 +367,7 @@ list_set_uadt(struct ip_set *set, struct nlattr *tb[],
|
|
ret = ip_set_get_extensions(set, tb, &ext);
|
|
if (ret)
|
|
return ret;
|
|
- e.id = ip_set_get_byname(map->net, nla_data(tb[IPSET_ATTR_NAME]), &s);
|
|
+ e.id = ip_set_get_byname(map->net, tb[IPSET_ATTR_NAME], &s);
|
|
if (e.id == IPSET_INVALID_ID)
|
|
return -IPSET_ERR_NAME;
|
|
/* "Loop detection" */
|
|
@@ -389,7 +389,7 @@ list_set_uadt(struct ip_set *set, struct nlattr *tb[],
|
|
|
|
if (tb[IPSET_ATTR_NAMEREF]) {
|
|
e.refid = ip_set_get_byname(map->net,
|
|
- nla_data(tb[IPSET_ATTR_NAMEREF]),
|
|
+ tb[IPSET_ATTR_NAMEREF],
|
|
&s);
|
|
if (e.refid == IPSET_INVALID_ID) {
|
|
ret = -IPSET_ERR_NAMEREF;
|