linux-stable.git/net/ipv6, branch linux-2.6.16.y

sit: Add missing kfree_skb() on pskb_may_pull() failure. (CVE-2008-2136)

2008-07-14T18:09:23+00:00

Noticed by Paul Marks .

Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[IPV6]: Restore IPv6 when MTU is big enough

2008-01-15T23:02:02+00:00

[ Upstream commit: d31c7b8fa303eb81311f27b80595b8d2cbeef950 ]

Avaid provided test application, so bug got fixed.

IPv6 addrconf removes ipv6 inner device from netdev each time cmu
changes and new value is less than IPV6_MIN_MTU (1280 bytes).
When mtu is changed and new value is greater than IPV6_MIN_MTU,
it does not add ipv6 addresses and inner device bac.

This patch fixes that.

Tested with Avaid's application, which works ok now.

Signed-off-by: Evgeniy Polyakov 
Signed-off-by: Herbert Xu 
Signed-off-by: Adrian Bunk

[IPV6]: Fix unbalanced socket reference with MSG_CONFIRM.

2007-11-12T12:00:22+00:00

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[IPV6]: MSG_ERRQUEUE messages do not pass to connected raw sockets

2007-07-22T16:29:30+00:00

Taken from http://bugzilla.kernel.org/show_bug.cgi?id=8747

Problem Description:

It is related to the possibility to obtain MSG_ERRQUEUE messages from the udp
and raw sockets, both connected and unconnected.

There is a little typo in net/ipv6/icmp.c code, which prevents such messages
to be delivered to the errqueue of the correspond raw socket, when the socket
is CONNECTED.  The typo is due to swap of local/remote addresses.

Consider __raw_v6_lookup() function from net/ipv6/raw.c. When a raw socket is
looked up usual way, it is something like:

sk = __raw_v6_lookup(sk, nexthdr, daddr, saddr, IP6CB(skb)->iif);

where "daddr" is a destination address of the incoming packet (IOW our local
address), "saddr" is a source address of the incoming packet (the remote end).

But when the raw socket is looked up for some icmp error report, in
net/ipv6/icmp.c:icmpv6_notify() , daddr/saddr are obtained from the echoed
fragment of the "bad" packet, i.e.  "daddr" is the original destination
address of that packet, "saddr" is our local address.  Hence, for
icmpv6_notify() must use "saddr, daddr" in its arguments, not "daddr, saddr"
...

Steps to reproduce:

Create some raw socket, connect it to an address, and cause some error
situation: f.e. set ttl=1 where the remote address is more than 1 hop to reach.
Set IPV6_RECVERR .
Then send something and wait for the error (f.e. poll() with POLLERR|POLLIN).
You should receive "time exceeded" icmp message (because of "ttl=1"), but the
socket do not receive it.

If you do not connect your raw socket, you will receive MSG_ERRQUEUE
successfully.  (The reason is that for unconnected socket there are no actual
checks for local/remote addresses).

Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[IPV6]: Reverse sense of promisc tests in ip6_mc_input

2007-05-22T23:01:53+00:00

Reverse the sense of the promiscuous-mode tests in ip6_mc_input().

Signed-off-by: Corey Mutter 
Signed-off-by: David L Stevens 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[IPV6]: Send ICMPv6 error on scope violations.

2007-05-22T22:55:49+00:00

When an IPv6 router is forwarding a packet with a link-local scope source
address off-link, RFC 4007 requires it to send an ICMPv6 destination
unreachable with code 2 ("not neighbor"), but Linux doesn't. Fix below.

Signed-off-by: David L Stevens 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[IPV6]: Track device renames in snmp6.

2007-05-22T22:39:52+00:00

When network device's are renamed, the IPV6 snmp6 code
gets confused. It doesn't track name changes so it will OOPS
when network device's are removed.

The fix is trivial, just unregister/re-register in notify handler.

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[IPV6]: Fix slab corruption running ip6sic

2007-05-22T22:38:17+00:00

Signed-off-by: Andrew Morton 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk

[IPV6]: Disallow RH0 by default (CVE-2007-2242)

2007-04-30T23:31:47+00:00

A security issue is emerging.  Disallow Routing Header Type 0 by default
as we have been doing for IPv4.

This version already includes a fix for the original patch.

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: Adrian Bunk

[IPv6]: Fix incorrect length check in rawv6_sendmsg()

2007-04-13T20:58:26+00:00

In article <20070329.142644.70222545.davem@davemloft.net> (at Thu, 29 Mar 2007 14:26:44 -0700 (PDT)), David Miller  says:

> From: Sridhar Samudrala 
> Date: Thu, 29 Mar 2007 14:17:28 -0700
>
> > The check for length in rawv6_sendmsg() is incorrect.
> > As len is an unsigned int, (len < 0) will never be TRUE.
> > I think checking for IPV6_MAXPLEN(65535) is better.
> >
> > Is it possible to send ipv6 jumbo packets using raw
> > sockets? If so, we can remove this check.
>
> I don't see why such a limitation against jumbo would exist,
> does anyone else?
>
> Thanks for catching this Sridhar.  A good compiler should simply
> fail to compile "if (x < 0)" when 'x' is an unsigned type, don't
> you think :-)

Dave, we use "int" for returning value,
so we should fix this anyway, IMHO;
we should not allow len > INT_MAX.

Signed-off-by: YOSHIFUJI Hideaki 
Acked-by: Sridhar Samudrala 
Signed-off-by: David S. Miller 
Signed-off-by: Adrian Bunk