linux.git/net/ipv4/netfilter, branch v2.6.39

Fix common misspellings

2011-03-31T14:26:23+00:00

Fixes generated by 'codespell' and manually reviewed.

Signed-off-by: Lucas De Marchi

netfilter: ipt_CLUSTERIP: fix buffer overflow

2011-03-20T14:42:52+00:00

'buffer' string is copied from userspace.  It is not checked whether it is
zero terminated.  This may lead to overflow inside of simple_strtoul().
Changli Gao suggested to copy not more than user supplied 'size' bytes.

It was introduced before the git epoch.  Files "ipt_CLUSTERIP/*" are
root writable only by default, however, on some setups permissions might be
relaxed to e.g. network admin user.

Signed-off-by: Vasiliy Kulikov 
Acked-by: Changli Gao 
Signed-off-by: Patrick McHardy

netfilter: xtables: fix reentrancy

2011-03-20T14:40:06+00:00

commit f3c5c1bfd4308 (make ip_tables reentrant) introduced a race in
handling the stackptr restore, at the end of ipt_do_table()

We should do it before the call to xt_info_rdunlock_bh(), or we allow
cpu preemption and another cpu overwrites stackptr of original one.

A second fix is to change the underflow test to check the origptr value
instead of 0 to detect underflow, or else we allow a jump from different
hooks.

Signed-off-by: Eric Dumazet 
Cc: Jan Engelhardt 
Signed-off-by: Patrick McHardy

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6

2011-03-15T20:03:27+00:00

Conflicts:
	Documentation/feature-removal-schedule.txt

netfilter: ipt_addrtype: rename to xt_addrtype

2011-03-15T19:16:20+00:00

Followup patch will add ipv6 support.

ipt_addrtype.h is retained for compatibility reasons, but no longer used
by the kernel.

Signed-off-by: Florian Westphal 
Signed-off-by: Patrick McHardy

netfilter: ip_tables: fix infoleak to userspace

2011-03-15T12:36:05+00:00

Structures ipt_replace, compat_ipt_replace, and xt_get_revision are
copied from userspace.  Fields of these structs that are
zero-terminated strings are not checked.  When they are used as argument
to a format string containing "%s" in request_module(), some sensitive
information is leaked to userspace via argument of spawned modprobe
process.

The first and the third bugs were introduced before the git epoch; the
second was introduced in 2722971c (v2.6.17-rc1).  To trigger the bug
one should have CAP_NET_ADMIN.

Signed-off-by: Vasiliy Kulikov 
Signed-off-by: Patrick McHardy

netfilter: arp_tables: fix infoleak to userspace

2011-03-15T12:35:21+00:00

Structures ipt_replace, compat_ipt_replace, and xt_get_revision are
copied from userspace.  Fields of these structs that are
zero-terminated strings are not checked.  When they are used as argument
to a format string containing "%s" in request_module(), some sensitive
information is leaked to userspace via argument of spawned modprobe
process.

The first bug was introduced before the git epoch;  the second is
introduced by 6b7d31fc (v2.6.15-rc1);  the third is introduced by
6b7d31fc (v2.6.15-rc1).  To trigger the bug one should have
CAP_NET_ADMIN.

Signed-off-by: Vasiliy Kulikov 
Signed-off-by: Patrick McHardy

net: Put fl4_* macros to struct flowi4 and use them again.

2011-03-12T23:08:54+00:00

Signed-off-by: David S. Miller

netfilter: Use flowi4 in nf_nat_standalone.c

2011-03-12T23:08:50+00:00

Signed-off-by: David S. Miller

net: Make flowi ports AF dependent.

2011-03-12T23:08:46+00:00

Create two sets of port member accessors, one set prefixed by fl4_*
and the other prefixed by fl6_*

This will let us to create AF optimal flow instances.

It will work because every context in which we access the ports,
we have to be fully aware of which AF the flowi is anyways.

Signed-off-by: David S. Miller