netfilter: nft_set_rbtree: Detect partial overlap with start endpoint match

Getting creative with nft and omitting the interval_overlap()
check from the set_overlap() function, without omitting
set_overlap() altogether, led to the observation of a partial
overlap that wasn't detected, and would actually result in
replacement of the end element of an existing interval.

This is due to the fact that we'll return -EEXIST on a matching,
pre-existing start element, instead of -ENOTEMPTY, and the error
is cleared by API if NLM_F_EXCL is not given. At this point, we
can insert a matching start, and duplicate the end element as long
as we don't end up into other intervals.

For instance, inserting interval 0 - 2 with an existing 0 - 3
interval would result in a single 0 - 2 interval, and a dangling
'3' end element. This is because nft will proceed after inserting
the '0' start element as no error is reported, and no further
conflicting intervals are detected on insertion of the end element.

This needs a different approach as it's a local condition that can
be detected by looking for duplicate ends coming from left and
right, separately. Track those and directly report -ENOTEMPTY on
duplicated end elements for a matching start.

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 27668f4e44ea1e3e28764b1396f00f9da9067221..217ab3644c25b1ae95c1609433fdb964c7d41349 100644 (file)
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -218,11 +218,11 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
                               struct nft_rbtree_elem *new,
                               struct nft_set_ext **ext)
 {
+       bool overlap = false, dup_end_left = false, dup_end_right = false;
        struct nft_rbtree *priv = nft_set_priv(set);
        u8 genmask = nft_genmask_next(net);
        struct nft_rbtree_elem *rbe;
        struct rb_node *parent, **p;
-       bool overlap = false;
        int d;
 
        /* Detect overlaps as we descend the tree. Set the flag in these cases:
@@ -262,6 +262,20 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
         *
         * which always happen as last step and imply that no further
         * overlapping is possible.
+        *
+        * Another special case comes from the fact that start elements matching
+        * an already existing start element are allowed: insertion is not
+        * performed but we return -EEXIST in that case, and the error will be
+        * cleared by the caller if NLM_F_EXCL is not present in the request.
+        * This way, request for insertion of an exact overlap isn't reported as
+        * error to userspace if not desired.
+        *
+        * However, if the existing start matches a pre-existing start, but the
+        * end element doesn't match the corresponding pre-existing end element,
+        * we need to report a partial overlap. This is a local condition that
+        * can be noticed without need for a tracking flag, by checking for a
+        * local duplicated end for a corresponding start, from left and right,
+        * separately.
         */
 
        parent = NULL;
@@ -281,19 +295,35 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
                                    !nft_set_elem_expired(&rbe->ext) && !*p)
                                        overlap = false;
                        } else {
+                               if (dup_end_left && !*p)
+                                       return -ENOTEMPTY;
+
                                overlap = nft_rbtree_interval_end(rbe) &&
                                          nft_set_elem_active(&rbe->ext,
                                                              genmask) &&
                                          !nft_set_elem_expired(&rbe->ext);
+
+                               if (overlap) {
+                                       dup_end_right = true;
+                                       continue;
+                               }
                        }
                } else if (d > 0) {
                        p = &parent->rb_right;
 
                        if (nft_rbtree_interval_end(new)) {
+                               if (dup_end_right && !*p)
+                                       return -ENOTEMPTY;
+
                                overlap = nft_rbtree_interval_end(rbe) &&
                                          nft_set_elem_active(&rbe->ext,
                                                              genmask) &&
                                          !nft_set_elem_expired(&rbe->ext);
+
+                               if (overlap) {
+                                       dup_end_left = true;
+                                       continue;
+                               }
                        } else if (nft_set_elem_active(&rbe->ext, genmask) &&
                                   !nft_set_elem_expired(&rbe->ext)) {
                                overlap = nft_rbtree_interval_end(rbe);
@@ -321,6 +351,8 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
                                p = &parent->rb_left;
                        }
                }
+
+               dup_end_left = dup_end_right = false;
        }
 
        if (overlap)