linux-stable.git/net/ipv4, branch linux-2.6.18.y

[PATCH] IPSEC: Fix inetpeer leak in ipv4 xfrm dst entries.

2006-12-17T00:20:47+00:00

We grab a reference to the route's inetpeer entry but
forget to release it in xfrm4_dst_destroy().

Bug discovered by Kazunori MIYAZAWA 

Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] XFRM: Use output device disable_xfrm for forwarded packets

2006-12-17T00:20:47+00:00

Currently the behaviour of disable_xfrm is inconsistent between
locally generated and forwarded packets. For locally generated
packets disable_xfrm disables the policy lookup if it is set on
the output device, for forwarded traffic however it looks at the
input device. This makes it impossible to disable xfrm on all
devices but a dummy device and use normal routing to direct
traffic to that device.

Always use the output device when checking disable_xfrm.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] NETFILTER: ip_tables: revision support for compat code

2006-12-17T00:20:46+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] UDP: Make udp_encap_rcv use pskb_may_pull

2006-12-02T00:12:37+00:00

IPsec with NAT-T breaks on some notebooks using the latest e1000 chipset,
when header split is enabled. When receiving sufficiently large packets, the
driver puts everything up to and including the UDP header into the header
portion of the skb, and the rest goes into the paged part. udp_encap_rcv
forgets to use pskb_may_pull, and fails to decapsulate it. Instead, it
passes it up it to the IKE daemon.

Signed-off-by: Olaf Kirch 
Signed-off-by: Jean Delvare 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] NETFILTER: H.323 conntrack: fix crash with CONFIG_IP_NF_CT_ACCT

2006-12-02T00:12:36+00:00

H.323 connection tracking code calls ip_ct_refresh_acct() when
processing RCFs and URQs but passes NULL as the skb.
When CONFIG_IP_NF_CT_ACCT is enabled, the connection tracking core tries
to derefence the skb, which results in an obvious panic.
A similar fix was applied on the SIP connection tracking code some time
ago.

Signed-off-by: Faidon Liambotis 
Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright

[PATCH] NETFILTER: Honour source routing for LVS-NAT

2006-12-02T00:12:35+00:00

For policy routing, packets originating from this machine itself may be
routed differently to packets passing through. We want this packet to be
routed as if it came from this machine itself. So re-compute the routing
information using ip_route_me_harder().

This patch is derived from work by Ken Brownfield

This patch (-stable version) also includes commit
b4c4ed175ff0ee816df48571cfa9b73f521964b6 ([NETFILTER]: add type parameter
to ip_route_me_harder), which is a precondition for the fix.

Cc: Ken Brownfield 
Signed-off-by: Simon Horman 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] NETFILTER: arp_tables: missing unregistration on module unload

2006-12-02T00:12:35+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] NETFILTER: Missed and reordered checks in {arp,ip,ip6}_tables

2006-12-02T00:12:35+00:00

Backport fix for missing ruleset validation in {arp,ip,ip6}_tables
and a fix on top which fixes a regression in the first patch.

There is a number of issues in parsing user-provided table in
translate_table(). Malicious user with CAP_NET_ADMIN may crash system by
passing special-crafted table to the *_tables.

The first issue is that mark_source_chains() function is called before entry
content checks. In case of standard target, mark_source_chains() function
uses t->verdict field in order to determine new position. But the check, that
this field leads no further, than the table end, is in check_entry(), which
is called later, than mark_source_chains().

The second issue, that there is no check that target_offset points inside
entry. If so, *_ITERATE_MATCH macro will follow further, than the entry
ends. As a result, we'll have oops or memory disclosure.

And the third issue, that there is no check that the target is completely
inside entry. Results are the same, as in previous issue.

Upstream commit 590bdf7fd2292b47c428111cb1360e312eff207e introduced a
regression in match/target hook validation. mark_source_chains builds
a bitmask for each rule representing the hooks it can be reached from,
which is then used by the matches and targets to make sure they are
only called from valid hooks. The patch moved the match/target specific
validation before the mark_source_chains call, at which point the mask
is always zero.

This patch returns back to the old order and moves the standard checks
to mark_source_chains. This allows to get rid of a special case for
standard targets as a nice side-effect.

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright

[PATCH] NETFILTER: ip_tables: fix module refcount leaks in compat error paths

2006-12-02T00:12:35+00:00

Based on patch by myself with additional fixes from Dmitry Mishin .

Signed-off-by: Dmitry Mishin 
Acked-by: Vasily Averin 
Acked-by: Kirill Korotaev 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] NETFILTER: ip_tables: compat error way cleanup

2006-12-02T00:12:35+00:00

This patch adds forgotten compat_flush_offset() call to error way of
translate_compat_table().  May lead to table corruption on the next
compat_do_replace().

Signed-off-by: Vasily Averin 
Acked-by: Dmitry Mishin 
Acked-by: Kirill Korotaev 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright