linux-stable.git/net/bridge/netfilter, branch linux-2.6.33.y Linux kernel stable tree bridge: netfilter: fix information leak 2011-04-14T23:53:01+00:00 Vasiliy Kulikov segoon@openwall.com 2011-02-14T15:49:23+00:00 9dc744817dd4c3c52b714a7eea73a8aeba18d1fd commit d846f71195d57b0bbb143382647c2c6638b04c5a upstream. Struct tmp is copied from userspace. It is not checked whether the "name" field is NULL terminated. This may lead to buffer overflow and passing contents of kernel stack as a module name to try_then_request_module() and, consequently, to modprobe commandline. It would be seen by all userspace processes. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit d846f71195d57b0bbb143382647c2c6638b04c5a upstream.

Struct tmp is copied from userspace.  It is not checked whether the "name"
field is NULL terminated.  This may lead to buffer overflow and passing
contents of kernel stack as a module name to try_then_request_module() and,
consequently, to modprobe commandline.  It would be seen by all userspace
processes.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
netfilter: ebtables: enforce CAP_NET_ADMIN 2010-01-08T16:31:24+00:00 Florian Westphal fwestphal@astaro.com 2010-01-08T16:31:24+00:00 dce766af541f6605fa9889892c0280bab31c66ab normal users are currently allowed to set/modify ebtables rules. Restrict it to processes with CAP_NET_ADMIN. Note that this cannot be reproduced with unmodified ebtables binary because it uses SOCK_RAW. Signed-off-by: Florian Westphal <fwestphal@astaro.com> Cc: stable@kernel.org Signed-off-by: Patrick McHardy <kaber@trash.net> 
normal users are currently allowed to set/modify ebtables rules.
Restrict it to processes with CAP_NET_ADMIN.

Note that this cannot be reproduced with unmodified ebtables binary
because it uses SOCK_RAW.

Signed-off-by: Florian Westphal <fwestphal@astaro.com>
Cc: stable@kernel.org
Signed-off-by: Patrick McHardy <kaber@trash.net>
net: Move && and || to end of previous line 2009-11-30T00:55:45+00:00 Joe Perches joe@perches.com 2009-11-30T00:55:45+00:00 f64f9e719261a87818dd192a3a2352e5b20fbd0f Not including net/atm/ Compiled tested x86 allyesconfig only Added a > 80 column line or two, which I ignored. Existing checkpatch plaints willfully, cheerfully ignored. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net> 
Not including net/atm/

Compiled tested x86 allyesconfig only
Added a > 80 column line or two, which I ignored.
Existing checkpatch plaints willfully, cheerfully ignored.

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
netfilter: ebt_ulog: fix checkentry return value 2009-09-01T12:34:01+00:00 Patrick McHardy kaber@trash.net 2009-09-01T12:34:01+00:00 8a56df0ae1690f8f42a3c6c4532f4b06f93febea Commit 19eda87 (netfilter: change return types of check functions for Ebtables extensions) broke the ebtables ulog module by missing a return value conversion. Signed-off-by: Patrick McHardy <kaber@trash.net> 
Commit 19eda87 (netfilter: change return types of check functions for
Ebtables extensions) broke the ebtables ulog module by missing a return
value conversion.

Signed-off-by: Patrick McHardy <kaber@trash.net>
netfilter: xtables: mark initial tables constant 2009-08-24T12:56:30+00:00 Jan Engelhardt jengelh@medozas.de 2009-08-24T12:56:30+00:00 35aad0ffdf548617940ca1e78be1f2e0bafc4496 The inputted table is never modified, so should be considered const. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net> 
The inputted table is never modified, so should be considered const.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Merge branch 'master' of git://dev.medozas.de/linux 2009-08-10T15:14:59+00:00 Patrick McHardy kaber@trash.net 2009-08-10T15:14:59+00:00 dc05a564ab1b3a1957927da50912964b61f7da69 






netfilter: xtables: switch hook PFs to nfproto
2009-08-10T11:35:21+00:00

Jan Engelhardt
jengelh@medozas.de

2009-06-13T04:20:29+00:00

24c232d8e911ef6189e02da411dc2b72cb03bfcf

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>





Signed-off-by: Jan Engelhardt <jengelh@medozas.de>







netfilter: ebtables: Use %pM conversion specifier
2009-08-10T08:10:55+00:00

Tobias Klauser
klto@zhaw.ch

2009-08-10T08:10:55+00:00

be39ee11cd1f67b51ac8e71d177a981eb34f2ab2

ebt_log uses its own implementation of print_mac to print MAC addresses.
This patch converts it to use the %pM conversion specifier for printk.

Signed-off-by: Tobias Klauser <klto@zhaw.ch>
Signed-off-by: Patrick McHardy <kaber@trash.net>





ebt_log uses its own implementation of print_mac to print MAC addresses.
This patch converts it to use the %pM conversion specifier for printk.

Signed-off-by: Tobias Klauser <klto@zhaw.ch>
Signed-off-by: Patrick McHardy <kaber@trash.net>







netfilter: x_tables: added hook number into match extension parameter structure.
2009-06-04T14:54:42+00:00

Evgeniy Polyakov
zbr@ioremap.net

2009-06-04T14:54:42+00:00

a5e78820966e17c2316866e00047e4e7e5480f04

Signed-off-by: Evgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: Patrick McHardy <kaber@trash.net>





Signed-off-by: Evgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: Patrick McHardy <kaber@trash.net>







netfilter: xtables: consolidate open-coded logic
2009-05-08T08:30:48+00:00

Jan Engelhardt
jengelh@medozas.de

2009-04-15T19:06:05+00:00

98e86403162d08a30b03426c54c2a8fca1f695d1

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>





Signed-off-by: Jan Engelhardt <jengelh@medozas.de>