You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Dmitry Mishin 590bdf7fd2 [NETFILTER]: Missed and reordered checks in {arp,ip,ip6}_tables ... There is a number of issues in parsing user-provided table in translate_table(). Malicious user with CAP_NET_ADMIN may crash system by passing special-crafted table to the *_tables. The first issue is that mark_source_chains() function is called before entry content checks. In case of standard target, mark_source_chains() function uses t->verdict field in order to determine new position. But the check, that this field leads no further, than the table end, is in check_entry(), which is called later, than mark_source_chains(). The second issue, that there is no check that target_offset points inside entry. If so, *_ITERATE_MATCH macro will follow further, than the entry ends. As a result, we'll have oops or memory disclosure. And the third issue, that there is no check that the target is completely inside entry. Results are the same, as in previous issue. Signed-off-by: Dmitry Mishin <dim@openvz.org> Acked-by: Kirill Korotaev <dev@openvz.org> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>		19 years ago
..
netfilter	[NETFILTER]: Missed and reordered checks in {arp,ip,ip6}_tables	19 years ago
Kconfig	[IPV6]: Make IPV6_SUBTREES depend on IPV6_MULTIPLE_TABLES.	19 years ago
Makefile	[IPV6]: Seperate sit driver to extra module	19 years ago
addrconf.c	[IPV6]: Seperate sit driver to extra module (addrconf.c changes)	19 years ago
af_inet6.c	[IPV6]: Seperate sit driver to extra module	19 years ago
ah6.c	…
anycast.c	[IPV6] ADDRCONF: Convert addrconf_lock to RCU.	19 years ago
datagram.c	…
esp6.c	…
exthdrs.c	…
exthdrs_core.c	…
fib6_rules.c	[IPv6] rules: Use RT6_LOOKUP_F_HAS_SADDR and fix source based selectors	19 years ago
icmp.c	…
inet6_connection_sock.c	…
inet6_hashtables.c	[IPV4]: INET_MATCH() annotations	19 years ago
ip6_fib.c	[IPv6] fib: initialize tb6_lock in common place to give lockdep a key	19 years ago
ip6_flowlabel.c	[IPV6]: fix lockup via /proc/net/ip6_flowlabel	19 years ago
ip6_input.c	…
ip6_output.c	[IPV6] NDISC: Add proxy_ndp sysctl.	19 years ago
ip6_tunnel.c	…
ipcomp6.c	[XFRM]: BEET mode	19 years ago
ipv6_sockglue.c	[IPV6]: Disable SG for GSO unless we have checksum	19 years ago
ipv6_syms.c	[IPV6] ADDRCONF: Convert addrconf_lock to RCU.	19 years ago
mcast.c	…
mip6.c	Remove all inclusions of <linux/config.h>	19 years ago
ndisc.c	[IPV6]: Remove bogus WARN_ON in Proxy-NA handling.	19 years ago
netfilter.c	…
proc.c	…
protocol.c	…
raw.c	[NET]: fix uaccess handling	19 years ago
reassembly.c	…
route.c	[IPV6]: Fix route.c warnings when multiple tables are disabled.	19 years ago
sit.c	[IPV6] sit: Add missing MODULE_LICENSE	19 years ago
sysctl_net_ipv6.c	…
tcp_ipv6.c	[NET]: Use typesafe inet_twsk() inline function instead of cast.	19 years ago
tunnel6.c	…
udp.c	[UDP]: Fix MSG_PROBE crash	19 years ago
xfrm6_input.c	[XFRM]: xrfm_replay_check() annotations	19 years ago
xfrm6_mode_beet.c	[XFRM]: BEET mode	19 years ago
xfrm6_mode_ro.c	[IPSEC]: output mode to take an xfrm state as input param	19 years ago
xfrm6_mode_transport.c	[IPSEC]: output mode to take an xfrm state as input param	19 years ago
xfrm6_mode_tunnel.c	[IPSEC]: output mode to take an xfrm state as input param	19 years ago
xfrm6_output.c	[IPSEC]: output mode to take an xfrm state as input param	19 years ago
xfrm6_policy.c	[IPV6]: Make sure error handling is done when calling ip6_route_output().	19 years ago
xfrm6_state.c	[XFRM]: ports in struct xfrm_selector annotated	19 years ago
xfrm6_tunnel.c	[XFRM]: xrfm_replay_check() annotations	19 years ago