linux.git/net/ipv6/netfilter, branch v2.6.37 Linux kernel source tree Merge git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6 2010-11-12T19:04:26+00:00 David S. Miller davem@davemloft.net 2010-11-12T19:04:26+00:00 7c13a0d9a1ac6875f6380763b947f4a5a016605f 






netfilter: ipv6: fix overlap check for fragments
2010-11-12T07:51:55+00:00

Shan Wei
shanwei@cn.fujitsu.com

2010-11-12T07:51:55+00:00

22e091e5253da1e9ad7c0a82c2c84446fc403efe

The type of FRAG6_CB(prev)->offset is int, skb->len is *unsigned* int,
and offset is int.

Without this patch, type conversion occurred to this expression, when
(FRAG6_CB(prev)->offset + prev->len) is less than offset.

Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>





The type of FRAG6_CB(prev)->offset is int, skb->len is *unsigned* int,
and offset is int.

Without this patch, type conversion occurred to this expression, when
(FRAG6_CB(prev)->offset + prev->len) is less than offset.

Signed-off-by: Shan Wei <shanwei@cn.fujitsu.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>







netfilter: ip6_tables: fix information leak to userspace
2010-11-04T01:55:39+00:00

Jan Engelhardt
jengelh@medozas.de

2010-11-04T01:55:39+00:00

cccbe5ef85284621d19e5b2b1c61cc0506bc9dee

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: David S. Miller <davem@davemloft.net>





Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: David S. Miller <davem@davemloft.net>







netfilter: Add missing CONFIG_SYSCTL checks in ipv6's nf_conntrack_reasm.c
2010-10-26T16:08:53+00:00

David S. Miller
davem@davemloft.net

2010-10-26T16:08:53+00:00

7932c2e55c707350ac166effea2f49afe2e47400

Reported-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>





Reported-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>







netfilter: fix module dependency issues with IPv6 defragmentation, ip6tables and xt_TPROXY
2010-10-25T20:58:36+00:00

KOVACS Krisztian
hidden@balabit.hu

2010-10-24T23:38:32+00:00

f6318e558806c925029dc101f14874be9f9fa78f

One of the previous tproxy related patches split IPv6 defragmentation and
connection tracking, but did not correctly add Kconfig stanzas to handle the
new dependencies correctly. This patch fixes that by making the config options
mirror the setup we have for IPv4: a distinct config option for defragmentation
that is automatically selected by both connection tracking and
xt_TPROXY/xt_socket.

The patch also changes the #ifdefs enclosing IPv6 specific code in xt_socket
and xt_TPROXY: we only compile these in case we have ip6tables support enabled.

Signed-off-by: KOVACS Krisztian <hidden@balabit.hu>
Signed-off-by: David S. Miller <davem@davemloft.net>





One of the previous tproxy related patches split IPv6 defragmentation and
connection tracking, but did not correctly add Kconfig stanzas to handle the
new dependencies correctly. This patch fixes that by making the config options
mirror the setup we have for IPv4: a distinct config option for defragmentation
that is automatically selected by both connection tracking and
xt_TPROXY/xt_socket.

The patch also changes the #ifdefs enclosing IPv6 specific code in xt_socket
and xt_TPROXY: we only compile these in case we have ip6tables support enabled.

Signed-off-by: KOVACS Krisztian <hidden@balabit.hu>
Signed-off-by: David S. Miller <davem@davemloft.net>







Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6
2010-10-21T15:21:34+00:00

David S. Miller
davem@davemloft.net

2010-10-21T15:21:34+00:00

9941fb62762253774cc6177d0b9172ece5133fe1












tproxy: split off ipv6 defragmentation to a separate module
2010-10-21T14:03:43+00:00

Balazs Scheidler
bazsi@balabit.hu

2010-10-21T14:03:43+00:00

e97c3e278e951501c2f385de70c3ceacdea78c4a

Like with IPv4, TProxy needs IPv6 defragmentation but does not
require connection tracking. Since defragmentation was coupled
with conntrack, I split off the two, creating an nf_defrag_ipv6 module,
similar to the already existing nf_defrag_ipv4.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
Signed-off-by: KOVACS Krisztian <hidden@balabit.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>





Like with IPv4, TProxy needs IPv6 defragmentation but does not
require connection tracking. Since defragmentation was coupled
with conntrack, I split off the two, creating an nf_defrag_ipv6 module,
similar to the already existing nf_defrag_ipv4.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
Signed-off-by: KOVACS Krisztian <hidden@balabit.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>







netfilter: fix kconfig unmet dependency warning
2010-10-18T09:13:30+00:00

Randy Dunlap
randy.dunlap@oracle.com

2010-10-18T09:13:30+00:00

76b6717bc6ccb715b04e36efc26566a6313ede5f

Fix netfilter kconfig unmet dependencies warning & spell out
"compatible" while there.

warning: (IP_NF_TARGET_TTL && NET && INET && NETFILTER && IP_NF_IPTABLES && NETFILTER_ADVANCED || IP6_NF_TARGET_HL && NET && INET && IPV6 && NETFILTER && IP6_NF_IPTABLES && NETFILTER_ADVANCED) selects NETFILTER_XT_TARGET_HL which has unmet direct dependencies ((IP_NF_MANGLE || IP6_NF_MANGLE) && NETFILTER_ADVANCED)

Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>





Fix netfilter kconfig unmet dependencies warning & spell out
"compatible" while there.

warning: (IP_NF_TARGET_TTL && NET && INET && NETFILTER && IP_NF_IPTABLES && NETFILTER_ADVANCED || IP6_NF_TARGET_HL && NET && INET && IPV6 && NETFILTER && IP6_NF_IPTABLES && NETFILTER_ADVANCED) selects NETFILTER_XT_TARGET_HL which has unmet direct dependencies ((IP_NF_MANGLE || IP6_NF_MANGLE) && NETFILTER_ADVANCED)

Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>







netfilter: xtables: resolve indirect macros 3/3
2010-10-13T16:00:46+00:00

Jan Engelhardt
jengelh@medozas.de

2010-10-13T14:28:00+00:00

243bf6e29eef642de0ff62f1ebf58bc2396d6d6e












netfilter: xtables: resolve indirect macros 2/3
2010-10-13T16:00:41+00:00

Jan Engelhardt
jengelh@medozas.de

2010-10-13T14:11:22+00:00

87a2e70db62fec7348c6e5545eb7b7650c33d81b

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>





Signed-off-by: Jan Engelhardt <jengelh@medozas.de>