linux-stable.git/net/ipv4, branch linux-2.6.14.y

[PATCH] Fix another crash in ip_nat_pptp (CVE-2006-0037)

2006-01-31T06:42:30+00:00

The PPTP NAT helper calculates the offset at which the packet needs
to be mangled as difference between two pointers to the header. With
non-linear skbs however the pointers may point to two seperate buffers
on the stack and the calculation results in a wrong offset beeing
used.

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix crash in ip_nat_pptp (CVE-2006-0036)

2006-01-31T06:42:30+00:00

When an inbound PPTP_IN_CALL_REQUEST packet is received the
PPTP NAT helper uses a NULL pointer in pointer arithmentic to
calculate the offset in the packet which needs to be mangled
and corrupts random memory or crashes.

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix NAT init order

2005-12-27T00:08:57+00:00

As noticed by Phil Oester, the GRE NAT protocol helper is initialized
before the NAT core, which makes registration fail.

Change the linking order to make NAT be initialized first.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix hardware checksum modification

2005-12-27T00:08:56+00:00

The skb_postpull_rcsum introduced a bug to the checksum modification.
Although the length pulled is offset bytes, the origin of the pulling
is the GRE header, not the IP header.

Signed-off-by: Herbert Xu 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix unbalanced read_unlock_bh in ctnetlink

2005-12-27T00:08:55+00:00

NFA_NEST calls NFA_PUT which jumps to nfattr_failure if the skb has no
room left. We call read_unlock_bh at nfattr_failure for the NFA_PUT
inside the locked section, so move NFA_NEST inside the locked section
too.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Krzysztof Piotr Oledzki 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix CTA_PROTO_NUM attribute size in ctnetlink

2005-12-27T00:08:55+00:00

CTA_PROTO_NUM is a u_int8_t.

Based on oryginal patch by Patrick McHardy 

Signed-off-by: Krzysztof Piotr Oledzki 
Signed-off-by: Greg Kroah-Hartman

[PATCH] NETLINK: Fix processing of fib_lookup netlink messages

2005-12-14T23:42:55+00:00

The receive path for fib_lookup netlink messages is lacking sanity
checks for header and payload and is thus vulnerable to malformed
netlink messages causing illegal memory references.

Signed-off-by: Thomas Graf 
Signed-off-by: Greg Kroah-Hartman

[PATCH] ip_conntrack: fix ftp/irc/tftp helpers on ports >= 32768

2005-11-24T22:10:11+00:00

Since we've converted the ftp/irc/tftp helpers to use the new
module_parm_array() some time ago, we ware accidentially using signed data
types - thus preventing those modules from being used on ports >= 32768.

This patch fixes it by using 'ushort' module parameters.

Thanks to Jan Nijs for reporting this bug.

Signed-off-by: Harald Welte 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] ip_conntrack TCP: Accept SYN+PUSH like SYN

2005-11-24T22:10:10+00:00

Some devices (e.g. Qlogic iSCSI HBA hardware like QLA4010 up to firmware
3.0.0.4) initiates TCP with SYN and PUSH flags set.

The Linux TCP/IP stack deals fine with that, but the connection tracking
code doesn't.

This patch alters TCP connection tracking to accept SYN+PUSH as a valid
flag combination.

Signed-off-by: Vlad Drukker 
Signed-off-by: Harald Welte 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] ctnetlink: Fix oops when no ICMP ID info in message

2005-11-24T22:10:10+00:00

This patch fixes an userspace triggered oops. If there is no ICMP_ID
info the reference to attr will be NULL.

Signed-off-by: Krzysztof Piotr Oledzki 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Harald Welte 
Signed-off-by: Chris Wright