linux.git/net/ipv6/netfilter, branch v2.6.17

[NETFILTER]: Fix do_add_counters race, possible oops or info leak (CVE-2006-0039)

2006-05-19T09:16:52+00:00

Solar Designer found a race condition in do_add_counters(). The beginning
of paddc is supposed to be the same as tmp which was sanity-checked
above, but it might not be the same in reality. In case the integer
overflow and/or the race condition are triggered, paddc->num_counters
might not match the allocation size for paddc. If the check below
(t->private->number != paddc->num_counters) nevertheless passes (perhaps
this requires the race condition to be triggered), IPT_ENTRY_ITERATE()
would read kernel memory beyond the allocation size, potentially causing
an oops or leaking sensitive data (e.g., passwords from host system or
from another VPS) via counter increments. This requires CAP_NET_ADMIN.

Signed-off-by: Solar Designer 
Signed-off-by: Kirill Korotaev 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: fix format specifier for netfilter log targets

2006-05-19T09:15:47+00:00

The prefix argument for nf_log_packet is a format specifier,
so don't pass the user defined string directly to it.

Signed-off-by: Philip Craig 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[IPV6]: Endian fix in net/ipv6/netfilter/ip6t_eui64.c:match().

2006-05-16T22:24:41+00:00

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller

[NETFILTER]: ip6_tables: remove broken comefrom debugging

2006-04-25T00:27:32+00:00

The introduction of x_tables broke comefrom debugging, remove it from
ip6_tables as well (ip_tables already got removed).

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[PATCH] for_each_possible_cpu: network codes

2006-04-11T13:18:31+00:00

for_each_cpu() actually iterates across all possible CPUs.  We've had mistakes
in the past where people were using for_each_cpu() where they should have been
iterating across only online or present CPUs.  This is inefficient and
possibly buggy.

We're renaming for_each_cpu() to for_each_possible_cpu() to avoid this in the
future.

This patch replaces for_each_cpu with for_each_possible_cpu under /net

Signed-off-by: KAMEZAWA Hiroyuki 
Acked-by: "David S. Miller" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[NETFILTER]: Convert conntrack/ipt_REJECT to new checksumming functions

2006-04-10T05:25:42+00:00

Besides removing lots of duplicate code, all converted users benefit
from improved HW checksum error handling. Tested with and without HW
checksums in almost all combinations.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Fix section mismatch warnings

2006-04-10T05:25:34+00:00

Fix section mismatch warnings caused by netfilter's init_or_cleanup
functions used in many places by splitting the init from the cleanup
parts.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Clean up hook registration

2006-04-10T05:25:33+00:00

Clean up hook registration by makeing use of the new mass registration and
unregistration helpers.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: x_tables: unify IPv4/IPv6 multiport match

2006-04-01T10:22:54+00:00

This unifies ipt_multiport and ip6t_multiport to xt_multiport.
As a result, this addes support for inversion and port range match
to IPv6 packets.

Signed-off-by: Yasuyuki Kozakai 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: x_tables: unify IPv4/IPv6 esp match

2006-04-01T10:22:30+00:00

This unifies ipt_esp and ip6t_esp to xt_esp. Please note that now
a user program needs to specify IPPROTO_ESP as protocol to use esp match
with IPv6. This means that ip6tables requires '-p esp' like iptables.

Signed-off-by: Yasuyuki Kozakai 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller