netfilter: ipset: Make possible to test elements marked with nomatch

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
index 7958e84a65afa22a8d6f406da674b2843e93b041..970187187f5b9bea58d6dc5397dd713f13e732b8 100644 (file)
--- a/include/linux/netfilter/ipset/ip_set.h
+++ b/include/linux/netfilter/ipset/ip_set.h
@@ -200,6 +200,14 @@ ip_set_eexist(int ret, u32 flags)
        return ret == -IPSET_ERR_EXIST && (flags & IPSET_FLAG_EXIST);
 }
 
+/* Match elements marked with nomatch */
+static inline bool
+ip_set_enomatch(int ret, u32 flags, enum ipset_adt adt)
+{
+       return adt == IPSET_TEST &&
+              ret == -ENOTEMPTY && ((flags >> 16) & IPSET_FLAG_NOMATCH);
+}
+
 /* Check the NLA_F_NET_BYTEORDER flag */
 static inline bool
 ip_set_attr_netorder(struct nlattr *tb[], int type)

diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index 10a30b4fc7dba7af7ad858c566791e982475436a..b4836c81fbb765dddda97792ffc6348dc568eae3 100644 (file)
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -279,10 +279,10 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
                timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
        }
 
-       if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
+       if (tb[IPSET_ATTR_CADT_FLAGS]) {
                u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
                if (cadt_flags & IPSET_FLAG_NOMATCH)
-                       flags |= (cadt_flags << 16);
+                       flags |= (IPSET_FLAG_NOMATCH << 16);
        }
 
        with_ports = with_ports && tb[IPSET_ATTR_PORT_TO];
@@ -292,7 +292,8 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
                data.ip = htonl(ip);
                data.ip2 = htonl(ip2_from & ip_set_hostmask(data.cidr + 1));
                ret = adtfn(set, &data, timeout, flags);
-               return ip_set_eexist(ret, flags) ? 0 : ret;
+               return ip_set_enomatch(ret, flags, adt) ? 1 :
+                      ip_set_eexist(ret, flags) ? 0 : ret;
        }
 
        ip_to = ip;
@@ -610,15 +611,16 @@ hash_ipportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
                timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
        }
 
-       if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
+       if (tb[IPSET_ATTR_CADT_FLAGS]) {
                u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
                if (cadt_flags & IPSET_FLAG_NOMATCH)
-                       flags |= (cadt_flags << 16);
+                       flags |= (IPSET_FLAG_NOMATCH << 16);
        }
 
        if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
                ret = adtfn(set, &data, timeout, flags);
-               return ip_set_eexist(ret, flags) ? 0 : ret;
+               return ip_set_enomatch(ret, flags, adt) ? 1 :
+                      ip_set_eexist(ret, flags) ? 0 : ret;
        }
 
        port = ntohs(data.port);

diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
index d6a59154d7104258d18335a39646fbf9e3b8f598..6dbe0afc5a8dc0a25031647689896ee325656f36 100644 (file)
--- a/net/netfilter/ipset/ip_set_hash_net.c
+++ b/net/netfilter/ipset/ip_set_hash_net.c
@@ -225,16 +225,17 @@ hash_net4_uadt(struct ip_set *set, struct nlattr *tb[],
                timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
        }
 
-       if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
+       if (tb[IPSET_ATTR_CADT_FLAGS]) {
                u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
                if (cadt_flags & IPSET_FLAG_NOMATCH)
-                       flags |= (cadt_flags << 16);
+                       flags |= (IPSET_FLAG_NOMATCH << 16);
        }
 
        if (adt == IPSET_TEST || !tb[IPSET_ATTR_IP_TO]) {
                data.ip = htonl(ip & ip_set_hostmask(data.cidr));
                ret = adtfn(set, &data, timeout, flags);
-               return ip_set_eexist(ret, flags) ? 0 : ret;
+               return ip_set_enomatch(ret, flags, adt) ? 1 :
+                      ip_set_eexist(ret, flags) ? 0 : ret;
        }
 
        ip_to = ip;
@@ -466,15 +467,16 @@ hash_net6_uadt(struct ip_set *set, struct nlattr *tb[],
                timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
        }
 
-       if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
+       if (tb[IPSET_ATTR_CADT_FLAGS]) {
                u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
                if (cadt_flags & IPSET_FLAG_NOMATCH)
-                       flags |= (cadt_flags << 16);
+                       flags |= (IPSET_FLAG_NOMATCH << 16);
        }
 
        ret = adtfn(set, &data, timeout, flags);
 
-       return ip_set_eexist(ret, flags) ? 0 : ret;
+       return ip_set_enomatch(ret, flags, adt) ? 1 :
+              ip_set_eexist(ret, flags) ? 0 : ret;
 }
 
 /* Create hash:ip type of sets */

diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index f2b0a3c30130ba66bc69fe24b39cb54cdbc0c77a..248162020d80185e5a1669843176298ebcc1f9f7 100644 (file)
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -396,13 +396,14 @@ hash_netiface4_uadt(struct ip_set *set, struct nlattr *tb[],
                u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
                if (cadt_flags & IPSET_FLAG_PHYSDEV)
                        data.physdev = 1;
-               if (adt == IPSET_ADD && (cadt_flags & IPSET_FLAG_NOMATCH))
-                       flags |= (cadt_flags << 16);
+               if (cadt_flags & IPSET_FLAG_NOMATCH)
+                       flags |= (IPSET_FLAG_NOMATCH << 16);
        }
        if (adt == IPSET_TEST || !tb[IPSET_ATTR_IP_TO]) {
                data.ip = htonl(ip & ip_set_hostmask(data.cidr));
                ret = adtfn(set, &data, timeout, flags);
-               return ip_set_eexist(ret, flags) ? 0 : ret;
+               return ip_set_enomatch(ret, flags, adt) ? 1 :
+                      ip_set_eexist(ret, flags) ? 0 : ret;
        }
 
        if (tb[IPSET_ATTR_IP_TO]) {
@@ -704,13 +705,14 @@ hash_netiface6_uadt(struct ip_set *set, struct nlattr *tb[],
                u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
                if (cadt_flags & IPSET_FLAG_PHYSDEV)
                        data.physdev = 1;
-               if (adt == IPSET_ADD && (cadt_flags & IPSET_FLAG_NOMATCH))
-                       flags |= (cadt_flags << 16);
+               if (cadt_flags & IPSET_FLAG_NOMATCH)
+                       flags |= (IPSET_FLAG_NOMATCH << 16);
        }
 
        ret = adtfn(set, &data, timeout, flags);
 
-       return ip_set_eexist(ret, flags) ? 0 : ret;
+       return ip_set_enomatch(ret, flags, adt) ? 1 :
+              ip_set_eexist(ret, flags) ? 0 : ret;
 }
 
 /* Create hash:ip type of sets */

diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c
index 349deb672a2d4fd8303ab43bdb3f0207c9124e0d..57b0550a0b0d531d7ddde131992c57fbf363b48f 100644 (file)
--- a/net/netfilter/ipset/ip_set_hash_netport.c
+++ b/net/netfilter/ipset/ip_set_hash_netport.c
@@ -272,16 +272,17 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *tb[],
 
        with_ports = with_ports && tb[IPSET_ATTR_PORT_TO];
 
-       if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
+       if (tb[IPSET_ATTR_CADT_FLAGS]) {
                u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
                if (cadt_flags & IPSET_FLAG_NOMATCH)
-                       flags |= (cadt_flags << 16);
+                       flags |= (IPSET_FLAG_NOMATCH << 16);
        }
 
        if (adt == IPSET_TEST || !(with_ports || tb[IPSET_ATTR_IP_TO])) {
                data.ip = htonl(ip & ip_set_hostmask(data.cidr + 1));
                ret = adtfn(set, &data, timeout, flags);
-               return ip_set_eexist(ret, flags) ? 0 : ret;
+               return ip_set_enomatch(ret, flags, adt) ? 1 :
+                      ip_set_eexist(ret, flags) ? 0 : ret;
        }
 
        port = port_to = ntohs(data.port);
@@ -561,15 +562,16 @@ hash_netport6_uadt(struct ip_set *set, struct nlattr *tb[],
                timeout = ip_set_timeout_uget(tb[IPSET_ATTR_TIMEOUT]);
        }
 
-       if (tb[IPSET_ATTR_CADT_FLAGS] && adt == IPSET_ADD) {
+       if (tb[IPSET_ATTR_CADT_FLAGS]) {
                u32 cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]);
                if (cadt_flags & IPSET_FLAG_NOMATCH)
-                       flags |= (cadt_flags << 16);
+                       flags |= (IPSET_FLAG_NOMATCH << 16);
        }
 
        if (adt == IPSET_TEST || !with_ports || !tb[IPSET_ATTR_PORT_TO]) {
                ret = adtfn(set, &data, timeout, flags);
-               return ip_set_eexist(ret, flags) ? 0 : ret;
+               return ip_set_enomatch(ret, flags, adt) ? 1 :
+                      ip_set_eexist(ret, flags) ? 0 : ret;
        }
 
        port = ntohs(data.port);