linux.git/net/ipv6/netfilter, branch v2.6.16

[NETFILTER] ip_queue: Fix wrong skb->len == nlmsg_len assumption

2006-03-07T22:56:12+00:00

The size of the skb carrying the netlink message is not
equivalent to the length of the actual netlink message
due to padding. ip_queue matches the length of the payload
against the original packet size to determine if packet
mangling is desired, due to the above wrong assumption
arbitary packets may not be mangled depening on their
original size.

Signed-off-by: Thomas Graf 
Signed-off-by: David S. Miller

[NETFILTER]: Restore {ipt,ip6t,ebt}_LOG compatibility

2006-02-27T21:04:17+00:00

The nfnetlink_log infrastructure changes broke compatiblity of the LOG
targets. They currently use whatever log backend was registered first,
which means that if ipt_ULOG was loaded first, no messages will be printed
to the ring buffer anymore.

Restore compatiblity by using the old log functions by default and only use
the nf_log backend if the user explicitly said so.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: nf_conntrack: attach conntrack to TCP RST generated by ip6t_REJECT

2006-02-15T23:23:28+00:00

TCP RSTs generated by the REJECT target should be associated with the
conntrack of the original TCP packet. Since the conntrack entry is
usually not is the hash tables, it must be manually attached.

Signed-off-by: Yasuyuki Kozakai 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Prepare {ipt,ip6t}_policy match for x_tables unification

2006-02-05T07:51:28+00:00

The IPv4 and IPv6 version of the policy match are identical besides address
comparison and the data structure used for userspace communication. Unify
the data structures to break compatiblity now (before it is released), so
we can port it to x_tables in 2.6.17.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Fix ip6t_policy address matching

2006-02-05T07:51:27+00:00

Fix two bugs in ip6t_policy address matching:
- misorder arguments to ip6_masked_addrcmp, mask must be the second argument
- inversion incorrectly applied to the entire expression instead of just
  the address comparison

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Check policy length in policy match strict mode

2006-02-05T07:51:26+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Fix possible overflow in netfilters do_replace()

2006-02-05T07:51:25+00:00

netfilter's do_replace() can overflow on addition within SMP_ALIGN()
and/or on multiplication by NR_CPUS, resulting in a buffer overflow on
the copy_from_user().  In practice, the overflow on addition is
triggerable on all systems, whereas the multiplication one might require
much physical memory to be present due to the check above.  Either is
sufficient to overwrite arbitrary amounts of kernel memory.

I really hate adding the same check to all 4 versions of do_replace(),
but the code is duplicate...

Found by Solar Designer during security audit of OpenVZ.org

Signed-Off-By: Kirill Korotaev 
Signed-Off-By: Solar Designer 
Signed-off-by: Patrck McHardy 
Signed-off-by: David S. Miller

[NETFILTER] ip6tables: whitespace and indent cosmetic cleanup

2006-01-17T10:39:39+00:00

Signed-off-by: Yasuyuki Kozakai 
Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER] Makefile cleanup

2006-01-17T10:38:56+00:00

These are replaced with x_tables matches and no longer exist.

Signed-off-by: Yasuyuki Kozakai 
Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller

[NETFILTER] ip[6]t_policy: Fix compilation warnings

2006-01-17T10:26:34+00:00

ip[6]t_policy argument conversion slipped when merging with x_tables

Signed-off-by: Benoit Boissinot 
Signed-off-by: Harald Welte 
Signed-off-by: David S. Miller