Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-13 23:51:39 +00:00
Code Issues Packages Projects Releases Wiki Activity
51d8b1a652
linux/net
History
Patrick McHardy 51d8b1a652 [NETFILTER]: Fix ip6_tables protocol bypass bug 
As reported by Mark Dowd <Mark_Dowd@McAfee.com>, ip6_tables is susceptible
to a fragmentation attack causing false negatives on protocol matches.

When the protocol header doesn't follow the fragment header immediately,
the fragment header contains the protocol number of the next extension
header. When the extension header and the protocol header are sent in
a second fragment a rule like "ip6tables .. -p udp -j DROP" will never
match.

Drop fragments that are at offset 0 and don't contain the final protocol
header regardless of the ruleset, since this should not happen normally.

With help from Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-24 16:14:04 -07:00
..
802 [TR]: endiannness annotations 2006-09-28 17:53:59 -07:00
8021q [PATCH] Finish annotations of struct vlan_ethhdr 2006-10-10 16:15:34 -07:00
appletalk [ATALK]: endianness annotations 2006-09-28 17:53:58 -07:00
atm [ATM]: handle sysfs errors 2006-10-21 19:55:22 -07:00
ax25 [NET]: Conversions from kmalloc+memset to k(z|c)alloc. 2006-07-21 14:51:30 -07:00
bluetooth [Bluetooth] Fix HID disconnect NULL pointer dereference 2006-10-20 01:15:05 -07:00
bridge [BRIDGE]: flush forwarding table when device carrier off 2006-10-15 23:14:13 -07:00
core Merge branch 'we21-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into tmp 2006-10-21 14:11:15 -04:00
dccp [DCCP] ipv6: Fix opt_skb leak. 2006-10-21 19:55:21 -07:00
decnet [DECNET]: Fix input routing bug 2006-10-18 20:45:22 -07:00
econet [NET]: Conversions from kmalloc+memset to k(z|c)alloc. 2006-07-21 14:51:30 -07:00
ethernet [NET]: Annotate dst_ops protocol 2006-09-28 18:02:58 -07:00
ieee80211 [PATCH] sotftmac: fix a slab corruption in WEP restricted key association 2006-10-17 10:15:58 -04:00
ipv4 [IPV4] ipconfig: fix RARP ic_servaddr breakage 2006-10-24 15:18:36 -07:00
ipv6 [NETFILTER]: Fix ip6_tables protocol bypass bug 2006-10-24 16:14:04 -07:00
ipx [IPX]: Fix typo, ipxhdr() --> ipx_hdr() 2006-08-09 17:36:15 -07:00
irda [PATCH] strndup() would better take size_t, not int 2006-10-10 15:37:24 -07:00
key IPsec: correct semantics for SELinux policy matching 2006-10-11 23:59:37 -07:00
lapb [LAPB]: Fix windowsize check 2006-08-05 21:15:58 -07:00
llc [LLC]: multicast receive device match 2006-08-13 18:56:26 -07:00
netfilter [NETFILTER]: ctnetlink: Remove debugging messages 2006-10-15 23:14:11 -07:00
netlabel NetLabel: fix a cache race condition 2006-10-11 23:59:29 -07:00
netlink [GENL]: Provide more information to userspace about registered genl families 2006-09-22 15:18:51 -07:00
netrom [NETROM] lockdep: fix false positive 2006-07-12 13:59:02 -07:00
packet [NET]: Fix sk->sk_filter field access 2006-09-22 15:18:47 -07:00
rose [ROSE] lockdep: fix false positive 2006-07-12 13:58:59 -07:00
rxrpc [PATCH] kmemdup: some users 2006-10-01 00:39:19 -07:00
sched [PKT_SCHED] netem: Orphan SKB when adding to queue. 2006-10-22 21:00:33 -07:00
sctp [IPV6]: Make sure error handling is done when calling ip6_route_output(). 2006-10-18 19:55:27 -07:00
sunrpc [PATCH] knfsd: fix race that can disable NFS server 2006-10-20 10:26:44 -07:00
tipc [TIPC]: Updated TIPC version number to 1.6.2 2006-10-18 19:55:24 -07:00
unix [AF_UNIX]: Change max_dgram_qlen sysctl to __read_mostly 2006-09-22 15:18:42 -07:00
wanrouter [NET]: Conversions from kmalloc+memset to k(z|c)alloc. 2006-07-21 14:51:30 -07:00
x25 Remove obsolete #include <linux/config.h> 2006-06-30 19:25:36 +02:00
xfrm [XFRM]: Fix xfrm_state accounting 2006-10-24 15:34:00 -07:00
compat.c [NET]: File descriptor loss while receiving SCM_RIGHTS 2006-10-11 23:59:48 -07:00
Kconfig [NET] Kconfig: fix cut/paste error in TCPPROBE 2006-09-28 17:53:57 -07:00
Makefile [NetLabel]: core NetLabel subsystem 2006-09-22 14:53:34 -07:00
nonet.c [PATCH] Make most file operations structs in fs/ const 2006-03-28 09:16:06 -08:00
socket.c [PATCH] file: modify struct fown_struct to use a struct pid 2006-10-02 07:57:14 -07:00
sysctl_net.c Remove obsolete #include <linux/config.h> 2006-06-30 19:25:36 +02:00
TUNABLE