NoaSoftware
/
TencentOS-kernel
forked from TencentOS/TencentOS-kernel
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
5,347 Commits 59 Branches 0 Tags 1.5 GiB
C 97.1%
Assembly 1.6%
C++ 0.6%
Makefile 0.3%
Perl 0.1%
Go to file
Stefano Brivio 2f6bf15c55 netfilter: ipset: Update byte and packet counters regardless of whether they match 
[ Upstream commit 7d10e62c2ff8e084c136c94d32d9a94de4d31248 ]

In ip_set_match_extensions(), for sets with counters, we take care of
updating counters themselves by calling ip_set_update_counter(), and of
checking if the given comparison and values match, by calling
ip_set_match_counter() if needed.

However, if a given comparison on counters doesn't match the configured
values, that doesn't mean the set entry itself isn't matching.

This fix restores the behaviour we had before commit 4750005a85f7
("netfilter: ipset: Fix "don't update counters" mode when counters used
at the matching"), without reintroducing the issue fixed there: back
then, mtype_data_match() first updated counters in any case, and then
took care of matching on counters.

Now, if the IPSET_FLAG_SKIP_COUNTER_UPDATE flag is set,
ip_set_update_counter() will anyway skip counter updates if desired.

The issue observed is illustrated by this reproducer:

  ipset create c hash:ip counters
  ipset add c 192.0.2.1
  iptables -I INPUT -m set --match-set c src --bytes-gt 800 -j DROP

if we now send packets from 192.0.2.1, bytes and packets counters
for the entry as shown by 'ipset list' are always zero, and, no
matter how many bytes we send, the rule will never match, because
counters themselves are not updated.

Reported-by: Mithil Mhatre <mmhatre@redhat.com>
Fixes: 4750005a85f7 ("netfilter: ipset: Fix "don't update counters" mode when counters used at the matching")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2021-03-16 16:40:35 +08:00
Documentation linkage: Introduce new macros for assembler symbols 2021-03-16 16:40:17 +08:00
LICENSES Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
arch arm64: dts: marvell: espressobin: Add ethernet switch aliases 2021-03-16 16:40:32 +08:00
block blk-cgroup: Pre-allocate tree node on blkg_conf_prep 2021-03-16 16:40:25 +08:00
certs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
crypto crypto: algif_skcipher - EBUSY on aio should be an error 2021-03-16 16:38:24 +08:00
drivers hv_balloon: disable warning when floor reached 2021-03-16 16:40:34 +08:00
fs xfs: set xefi_discard when creating a deferred agfl free log intent item 2021-03-16 16:40:35 +08:00
include netfilter: nf_tables: missing validation from the abort path 2021-03-16 16:40:35 +08:00
init printk: reduce LOG_BUF_SHIFT range for H8300 2021-03-16 16:39:45 +08:00
ipc ipc/util.c: sysvipc_find_ipc() incorrectly updates position index 2021-03-16 16:27:51 +08:00
kernel genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY 2021-03-16 16:40:34 +08:00
lib lib/crc32test: remove extra local_irq_disable/enable 2021-03-16 16:40:21 +08:00
mm mm: mempolicy: fix potential pte_unmap_unlock pte error 2021-03-16 16:40:21 +08:00
net netfilter: ipset: Update byte and packet counters regardless of whether they match 2021-03-16 16:40:35 +08:00
package config/arm64: OPEN CONFIG_PSI and phytium configs 2021-03-16 11:02:59 +08:00
samples samples/bpf: Fix possible deadlock in xdpsock 2021-03-16 16:39:46 +08:00
scripts scripts/setlocalversion: make git describe output more reliable 2021-03-16 16:39:28 +08:00
security evm: Check size of security.evm before using it 2021-03-16 16:39:34 +08:00
sound ASoC: codecs: wcd9335: Set digital gain range correctly 2021-03-16 16:40:35 +08:00
tools perf python scripting: Fix printable strings in python3 scripts 2021-03-16 16:40:08 +08:00
usr Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
virt KVM: arm64: Force PTE mapping on fault resulting in a device mapping 2021-03-16 16:40:33 +08:00
.clang-format Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.cocciconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.get_maintainer.ignore Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.gitattributes Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.gitignore Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
COPYING Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
CREDITS Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Kbuild Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Kconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
MAINTAINERS Documentation/llvm: add documentation on building w/ Clang/LLVM 2021-03-16 16:34:24 +08:00
Makefile kbuild: fix broken builds because of GZIP,BZIP2,LZOP variables 2021-03-16 16:35:20 +08:00
README Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
README.md Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
backport_remove_lists.txt Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tools_key.pub Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00

README.md

Tencent Linux Kernel 4.0