[prev in list] [next in list] [prev in thread] [next in thread] 

List:       netfilter
Subject:    Re: Strange behavior with ipset not matching on public range
From:       Jozsef Kadlecsik <kadlec () blackhole ! kfki ! hu>
Date:       2013-05-28 13:35:16
Message-ID: alpine.DEB.2.00.1305281534080.15994 () blackhole ! kfki ! hu
[Download RAW message or body]

On Tue, 28 May 2013, Jimmy Thrasibule wrote:

> > I think you should upgrade: some drivers doesn't zero pad interface names 
> > and than can fool ipset up to 6.12.1. It was fixed in 6.13.
> 
> Looking at the changelog, it looks like 6.13 is fixing an issue which
> can be the one I encounter. Do you have a link to this commit or a
> commit hash so I can report the bug to the Debian team?

commit ef5b6e127761667f78d99b7510a3876077fe9abe
Author: Florian Westphal <fw@strlen.de>
Date:   Sun Jun 17 09:56:46 2012 +0000

    netfilter: ipset: fix interface comparision in hash-netiface sets
    
    ifname_compare() assumes that skb->dev is zero-padded,
    e.g 'eth1\0\0\0\0\0...'. This isn't always the case. e1000 driver does
    
    strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1);
    
    in e1000_probe(), so once device is registered dev->name memory contains
    'eth1\0:0:3\0\0\0' (or something like that), which makes eth1 compare
    fail.
    
    Use plain strcmp() instead.
    
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
          H-1525 Budapest 114, POB. 49, Hungary
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
[prev in list] [next in list] [prev in thread] [next in thread]