linux.git/net/netfilter, branch v3.10-rc7

ipvs: info leak in __ip_vs_get_dest_entries()

2013-06-10T12:53:00+00:00

The entry struct has a 2 byte hole after ->port and another 4 byte
hole after ->stats.outpkts.  You must have CAP_NET_ADMIN in your
namespace to hit this information leak.

Signed-off-by: Dan Carpenter 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman 
Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink_queue: fix missing HW protocol

2013-06-07T16:55:20+00:00

Locally generated IPv4 and IPv6 traffic gets skb->protocol unset,
thus passing zero.

ip6tables -I OUTPUT -j NFQUEUE
libmnl/examples/netfilter# ./nf-queue 0 &
ping6 ::1
packet received (id=1 hw=0x0000 hook=3)
                         ^^^^^^

Signed-off-by: Pablo Neira Ayuso

netfilter: xt_TCPMSS: Fix violation of RFC879 in absence of MSS option

2013-06-05T11:59:22+00:00

The clamp-mss-to-pmtu option of the xt_TCPMSS target can cause issues
connecting to websites if there was no MSS option present in the
original SYN packet from the client. In these cases, it may add a
MSS higher than the default specified in RFC879. Fix this by never
setting a value > 536 if no MSS option was specified by the client.

This closes netfilter's bugzilla #662.

Signed-off-by: Phil Oester 
Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink_cttimeout: fix incomplete dumping of objects

2013-06-05T10:36:37+00:00

Fix broken incomplete object dumping if the list of objects does not
fit into one single netlink message.

Reported-by: Gabriel Lazar 
Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink_acct: fix incomplete dumping of objects

2013-06-05T10:36:36+00:00

Fix broken incomplete object dumping if the list of objects does not
fit into one single netlink message.

Reported-by: Gabriel Lazar 
Signed-off-by: Pablo Neira Ayuso

ipvs: ip_vs_sh: fix build

2013-05-29T15:50:39+00:00

kfree_rcu() requires offsetof(..., rcu_head) < 4096, which can
get violated with a sufficiently high CONFIG_IP_VS_SH_TAB_BITS.

Signed-off-by: Jan Beulich 
Signed-off-by: Simon Horman 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_LOG: fix mark logging for IPv6 packets

2013-05-29T10:29:18+00:00

In dump_ipv6_packet(), the "recurse" parameter is zero only if
dumping contents of a packet embedded into an ICMPv6 error
message. Therefore we want to log packet mark if recurse is
non-zero, not when it is zero.

Signed-off-by: Michal Kubecek 
Signed-off-by: Pablo Neira Ayuso

ipvs: Fix reuse connection if real server is dead

2013-05-27T11:00:45+00:00

Expire cached connection for new TCP/SCTP connection if real
server is down. Otherwise, IPVS uses the dead server for the
reused connection, instead of a new working one.

Signed-off-by: Grzegorz Lyczba 
Acked-by: Hans Schillstrom 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman 
Signed-off-by: Pablo Neira Ayuso

netfilter: add nf_ipv6_ops hook to fix xt_addrtype with IPv6

2013-05-23T09:58:55+00:00

Quoting https://bugzilla.netfilter.org/show_bug.cgi?id=812:

[ ip6tables -m addrtype ]
When I tried to use in the nat/PREROUTING it messes up the
routing cache even if the rule didn't matched at all.
[..]
If I remove the --limit-iface-in from the non-working scenario, so just
use the -m addrtype --dst-type LOCAL it works!

This happens when LOCAL type matching is requested with --limit-iface-in,
and the default ipv6 route is via the interface the packet we test
arrived on.

Because xt_addrtype uses ip6_route_output, the ipv6 routing implementation
creates an unwanted cached entry, and the packet won't make it to the
real/expected destination.

Silently ignoring --limit-iface-in makes the routing work but it breaks
rule matching (--dst-type LOCAL with limit-iface-in is supposed to only
match if the dst address is configured on the incoming interface;
without --limit-iface-in it will match if the address is reachable
via lo).

The test should call ipv6_chk_addr() instead.  However, this would add
a link-time dependency on ipv6.

There are two possible solutions:

1) Revert the commit that moved ipt_addrtype to xt_addrtype,
   and put ipv6 specific code into ip6t_addrtype.
2) add new "nf_ipv6_ops" struct to register pointers to ipv6 functions.

While the former might seem preferable, Pablo pointed out that there
are more xt modules with link-time dependeny issues regarding ipv6,
so lets go for 2).

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond packet boundary

2013-05-16T15:35:53+00:00

This target assumes that tcph->doff is well-formed, that may be well
not the case. Add extra sanity checkings to avoid possible crash due
to read/write out of the real packet boundary. After this patch, the
default action on malformed TCP packets is to drop them. Moreover,
fragments are skipped.

Reported-by: Rafal Kupka 
Signed-off-by: Pablo Neira Ayuso