linux.git/net/ipv6/netfilter, branch v2.6.19

[NETFILTER]: ip6_tables: use correct nexthdr value in ipv6_find_hdr()

2006-11-16T05:18:50+00:00

nexthdr is NEXTHDR_FRAGMENT, the nexthdr value from the fragment header
is hp->nexthdr.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Use pskb_trim in {ip,ip6,nfnetlink}_queue

2006-11-16T05:18:48+00:00

Based on patch by James D. Nurmi:

I've got some code very dependant on nfnetlink_queue, and turned up a
large number of warns coming from skb_trim.  While it's quite possibly
my code, having not seen it on older kernels made me a bit suspect.

Anyhow, based on some googling I turned up this thread:
http://lkml.org/lkml/2006/8/13/56

And believe the issue to be related, so attached is a small patch to
the kernel -- not sure if this is completely correct, but for anyone
else hitting the WARN_ON(1) in skbuff.h, it might be helpful..

Signed-off-by: James D. Nurmi 

Ported to ip6_queue and nfnetlink_queue and added return value
checks.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Missed and reordered checks in {arp,ip,ip6}_tables

2006-10-30T23:24:44+00:00

There is a number of issues in parsing user-provided table in
translate_table(). Malicious user with CAP_NET_ADMIN may crash system by
passing special-crafted table to the *_tables.

The first issue is that mark_source_chains() function is called before entry
content checks. In case of standard target, mark_source_chains() function
uses t->verdict field in order to determine new position. But the check, that
this field leads no further, than the table end, is in check_entry(), which
is called later, than mark_source_chains().

The second issue, that there is no check that target_offset points inside
entry. If so, *_ITERATE_MATCH macro will follow further, than the entry
ends. As a result, we'll have oops or memory disclosure.

And the third issue, that there is no check that the target is completely
inside entry. Results are the same, as in previous issue.

Signed-off-by: Dmitry Mishin 
Acked-by: Kirill Korotaev 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: remove masq/NAT from ip6tables Kconfig help

2006-10-30T23:24:43+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Fix ip6_tables extension header bypass bug

2006-10-24T23:15:10+00:00

As reported by Mark Dowd , ip6_tables is susceptible
to a fragmentation attack causing false negatives on extension header matches.

When extension headers occur in the non-first fragment after the fragment
header (possibly with an incorrect nexthdr value in the fragment header)
a rule looking for this extension header will never match.

Drop fragments that are at offset 0 and don't contain the final protocol
header regardless of the ruleset, since this should not happen normally.
Since all extension headers are before the protocol header this makes sure
an extension header is either not present or in the first fragment, where
we can properly parse it.

With help from Yasuyuki KOZAKAI .

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Fix ip6_tables protocol bypass bug

2006-10-24T23:14:04+00:00

As reported by Mark Dowd , ip6_tables is susceptible
to a fragmentation attack causing false negatives on protocol matches.

When the protocol header doesn't follow the fragment header immediately,
the fragment header contains the protocol number of the next extension
header. When the extension header and the protocol header are sent in
a second fragment a rule like "ip6tables .. -p udp -j DROP" will never
match.

Drop fragments that are at offset 0 and don't contain the final protocol
header regardless of the ruleset, since this should not happen normally.

With help from Yasuyuki KOZAKAI .

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: make some netfilter globals __read_mostly

2006-09-22T22:19:58+00:00

Signed-off-by: Brian Haley 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: ip6t_HL: remove write-only variable

2006-09-22T22:19:55+00:00

Noticed by Alexey Dobriyan 

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: x_tables: small check_entry & module_refcount cleanup

2006-09-22T22:19:51+00:00

While standard_target has target->me == NULL, module_put() should be
called for it as for others, because there were try_module_get() before.

Signed-off-by: Dmitry Mishin 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: ip6table_mangle: reroute when nfmark changes in NF_IP6_LOCAL_OUT

2006-09-22T22:19:51+00:00

Now that IPv6 supports policy routing we need to reroute in NF_IP6_LOCAL_OUT
when the mark value changes.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller