linux.git/net/ipv6, branch v2.6.17

[IPV6] ROUTE: Don't try less preferred routes for on-link routes.

2006-05-26T20:23:41+00:00

In addition to the real on-link routes, NONEXTHOP routes
should be considered on-link.

Problem reported by Meelis Roos .

Signed-off-by: YOSHIFUJI Hideaki 
Acked-by: Meelis Roos 
Signed-off-by: David S. Miller

[NET]: Fix "ntohl(ntohs" bugs

2006-05-22T23:53:22+00:00

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller

[NETFILTER]: Fix do_add_counters race, possible oops or info leak (CVE-2006-0039)

2006-05-19T09:16:52+00:00

Solar Designer found a race condition in do_add_counters(). The beginning
of paddc is supposed to be the same as tmp which was sanity-checked
above, but it might not be the same in reality. In case the integer
overflow and/or the race condition are triggered, paddc->num_counters
might not match the allocation size for paddc. If the check below
(t->private->number != paddc->num_counters) nevertheless passes (perhaps
this requires the race condition to be triggered), IPT_ENTRY_ITERATE()
would read kernel memory beyond the allocation size, potentially causing
an oops or leaking sensitive data (e.g., passwords from host system or
from another VPS) via counter increments. This requires CAP_NET_ADMIN.

Signed-off-by: Solar Designer 
Signed-off-by: Kirill Korotaev 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: fix format specifier for netfilter log targets

2006-05-19T09:15:47+00:00

The prefix argument for nf_log_packet is a format specifier,
so don't pass the user defined string directly to it.

Signed-off-by: Philip Craig 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[IPV6]: Endian fix in net/ipv6/netfilter/ip6t_eui64.c:match().

2006-05-16T22:24:41+00:00

Signed-off-by: Alexey Dobriyan 
Signed-off-by: David S. Miller

[IPV6]: skb leakage in inet6_csk_xmit

2006-05-10T20:24:38+00:00

inet6_csk_xit does not free skb when routing fails.

Signed-off-by: Alexey Kuznetsov 
Signed-off-by: David S. Miller

[IPV6]: Fix race in route selection.

2006-04-30T01:33:22+00:00

We eliminated rt6_dflt_lock (to protect default router pointer)
at 2.6.17-rc1, and introduced rt6_select() for general router selection.
The function is called in the context of rt6_lock read-lock held,
but this means, we have some race conditions when we do round-robin.

Signed-off-by; YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller

[NETFILTER]: ip6_tables: remove broken comefrom debugging

2006-04-25T00:27:32+00:00

The introduction of x_tables broke comefrom debugging, remove it from
ip6_tables as well (ip_tables already got removed).

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[IPV6]: Clean up hop-by-hop options handler.

2006-04-18T22:57:53+00:00

- Removed unused argument (nhoff) for ipv6_parse_hopopts().
- Make ipv6_parse_hopopts() to align with other extension header
  handlers.
- Removed pointless assignment (hdr), which is not used afterwards.

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller

[IPV6] XFRM: Fix decoding session with preceding extension header(s).

2006-04-18T22:57:52+00:00

We did not correctly decode session with preceding extension
header(s).  This was because we had already pulled preceding
headers, skb->nh.raw + 40 + 1 - skb->data was minus, and
pskb_may_pull() failed.

We now have IP6CB(skb)->nhoff and skb->h.raw, and we can
start parsing / decoding upper layer protocol from current
position.

Tracked down by Noriaki TAKAMIYA 
and tested by Kazunori Miyazawa .

Signed-off-by: YOSHIFUJI Hideaki 
Signed-off-by: David S. Miller