|
 |
e34dd0 |
From afd566b56629bac4c8ca622413c8c001e2e7edfa Mon Sep 17 00:00:00 2001
|
|
|
e34dd0 |
From: Phil Sutter <psutter@redhat.com>
|
|
|
e34dd0 |
Date: Fri, 24 Jun 2022 16:02:59 +0200
|
|
|
e34dd0 |
Subject: [PATCH] intervals: do not report exact overlaps for new elements
|
|
|
e34dd0 |
|
|
|
e34dd0 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1917398
|
|
|
e34dd0 |
Upstream Status: nftables commit 87ba510fc704f
|
|
|
e34dd0 |
|
|
|
e34dd0 |
commit 87ba510fc704f766b5417d3bfc326e8ab9378c2a
|
|
|
e34dd0 |
Author: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
e34dd0 |
Date: Mon Jun 13 17:22:47 2022 +0200
|
|
|
e34dd0 |
|
|
|
e34dd0 |
intervals: do not report exact overlaps for new elements
|
|
|
e34dd0 |
|
|
|
e34dd0 |
Two new elements that represent an exact overlap should not trigger an error.
|
|
|
e34dd0 |
|
|
|
e34dd0 |
add table t
|
|
|
e34dd0 |
add set t s { type ipv4_addr; flags interval; }
|
|
|
e34dd0 |
add element t s { 1.0.1.0/24 }
|
|
|
e34dd0 |
...
|
|
|
e34dd0 |
add element t s { 1.0.1.0/24 }
|
|
|
e34dd0 |
|
|
|
e34dd0 |
result in a bogus error.
|
|
|
e34dd0 |
|
|
|
e34dd0 |
# nft -f set.nft
|
|
|
e34dd0 |
set.nft:1002:19-28: Error: conflicting intervals specified
|
|
|
e34dd0 |
add element t s { 1.0.1.0/24 }
|
|
|
e34dd0 |
^^^^^^^^^^
|
|
|
e34dd0 |
|
|
|
e34dd0 |
Fixes: 3da9643fb9ff ("intervals: add support to automerge with kernel elements")
|
|
|
e34dd0 |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
e34dd0 |
|
|
|
e34dd0 |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
e34dd0 |
---
|
|
|
e34dd0 |
src/intervals.c | 3 +--
|
|
|
e34dd0 |
tests/shell/testcases/sets/exact_overlap_0 | 22 ++++++++++++++++++++++
|
|
|
e34dd0 |
2 files changed, 23 insertions(+), 2 deletions(-)
|
|
|
e34dd0 |
create mode 100755 tests/shell/testcases/sets/exact_overlap_0
|
|
|
e34dd0 |
|
|
|
e34dd0 |
diff --git a/src/intervals.c b/src/intervals.c
|
|
|
e34dd0 |
index bc414d6..89f5c33 100644
|
|
|
e34dd0 |
--- a/src/intervals.c
|
|
|
e34dd0 |
+++ b/src/intervals.c
|
|
|
e34dd0 |
@@ -540,8 +540,7 @@ static int setelem_overlap(struct list_head *msgs, struct set *set,
|
|
|
e34dd0 |
}
|
|
|
e34dd0 |
|
|
|
e34dd0 |
if (mpz_cmp(prev_range.low, range.low) == 0 &&
|
|
|
e34dd0 |
- mpz_cmp(prev_range.high, range.high) == 0 &&
|
|
|
e34dd0 |
- (elem->flags & EXPR_F_KERNEL || prev->flags & EXPR_F_KERNEL))
|
|
|
e34dd0 |
+ mpz_cmp(prev_range.high, range.high) == 0)
|
|
|
e34dd0 |
goto next;
|
|
|
e34dd0 |
|
|
|
e34dd0 |
if (mpz_cmp(prev_range.low, range.low) <= 0 &&
|
|
|
e34dd0 |
diff --git a/tests/shell/testcases/sets/exact_overlap_0 b/tests/shell/testcases/sets/exact_overlap_0
|
|
|
e34dd0 |
new file mode 100755
|
|
|
e34dd0 |
index 0000000..1ce9304
|
|
|
e34dd0 |
--- /dev/null
|
|
|
e34dd0 |
+++ b/tests/shell/testcases/sets/exact_overlap_0
|
|
|
e34dd0 |
@@ -0,0 +1,22 @@
|
|
|
e34dd0 |
+#!/bin/bash
|
|
|
e34dd0 |
+
|
|
|
e34dd0 |
+RULESET="add table t
|
|
|
e34dd0 |
+add set t s { type ipv4_addr; flags interval; }
|
|
|
e34dd0 |
+add element t s { 1.0.1.0/24 }
|
|
|
e34dd0 |
+add element t s { 1.0.2.0/23 }
|
|
|
e34dd0 |
+add element t s { 1.0.8.0/21 }
|
|
|
e34dd0 |
+add element t s { 1.0.32.0/19 }
|
|
|
e34dd0 |
+add element t s { 1.1.0.0/24 }
|
|
|
e34dd0 |
+add element t s { 1.1.2.0/23 }
|
|
|
e34dd0 |
+add element t s { 1.1.4.0/22 }
|
|
|
e34dd0 |
+add element t s { 1.1.8.0/24 }
|
|
|
e34dd0 |
+add element t s { 1.1.9.0/24 }
|
|
|
e34dd0 |
+add element t s { 1.1.10.0/23 }
|
|
|
e34dd0 |
+add element t s { 1.1.12.0/22 }
|
|
|
e34dd0 |
+add element t s { 1.1.16.0/20 }
|
|
|
e34dd0 |
+add element t s { 1.1.32.0/19 }
|
|
|
e34dd0 |
+add element t s { 1.0.1.0/24 }"
|
|
|
e34dd0 |
+
|
|
|
e34dd0 |
+$NFT -f - <<< $RULESET || exit 1
|
|
|
e34dd0 |
+
|
|
|
e34dd0 |
+$NFT add element t s { 1.0.1.0/24 }
|
|
|
e34dd0 |
--
|
|
|
e34dd0 |
2.36.1
|
|
|
e34dd0 |
|