14 Aug, 2006

1 commit


04 Jul, 2006

1 commit


01 Jul, 2006

1 commit


30 Jun, 2006

2 commits

  • This patch encapsulates the usage of eff_cap (in netlink_skb_params) within
    the security framework by extending security_netlink_recv to include a required
    capability parameter and converting all direct usage of eff_caps outside
    of the lsm modules to use the interface. It also updates the SELinux
    implementation of the security_netlink_send and security_netlink_recv
    hooks to take advantage of the sid in the netlink_skb_params struct.
    This also enables SELinux to perform auditing of netlink capability checks.
    Please apply, for 2.6.18 if possible.

    Signed-off-by: Darrel Goeddel
    Signed-off-by: Stephen Smalley
    Acked-by: James Morris
    Signed-off-by: David S. Miller

    Darrel Goeddel
     
  • When xt_register_table fails the error is not properly propagated back.
    Based on patch by Lepton Wu .

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     

18 Jun, 2006

3 commits


19 May, 2006

2 commits

  • Solar Designer found a race condition in do_add_counters(). The beginning
    of paddc is supposed to be the same as tmp which was sanity-checked
    above, but it might not be the same in reality. In case the integer
    overflow and/or the race condition are triggered, paddc->num_counters
    might not match the allocation size for paddc. If the check below
    (t->private->number != paddc->num_counters) nevertheless passes (perhaps
    this requires the race condition to be triggered), IPT_ENTRY_ITERATE()
    would read kernel memory beyond the allocation size, potentially causing
    an oops or leaking sensitive data (e.g., passwords from host system or
    from another VPS) via counter increments. This requires CAP_NET_ADMIN.

    Signed-off-by: Solar Designer
    Signed-off-by: Kirill Korotaev
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Solar Designer
     
  • The prefix argument for nf_log_packet is a format specifier,
    so don't pass the user defined string directly to it.

    Signed-off-by: Philip Craig
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Philip Craig
     

17 May, 2006

1 commit


25 Apr, 2006

1 commit


11 Apr, 2006

1 commit

  • for_each_cpu() actually iterates across all possible CPUs. We've had mistakes
    in the past where people were using for_each_cpu() where they should have been
    iterating across only online or present CPUs. This is inefficient and
    possibly buggy.

    We're renaming for_each_cpu() to for_each_possible_cpu() to avoid this in the
    future.

    This patch replaces for_each_cpu with for_each_possible_cpu under /net

    Signed-off-by: KAMEZAWA Hiroyuki
    Acked-by: "David S. Miller"
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    KAMEZAWA Hiroyuki
     

10 Apr, 2006

3 commits


01 Apr, 2006

2 commits


29 Mar, 2006

1 commit

  • Every netfilter module uses `init' for its module_init() function and
    `fini' or `cleanup' for its module_exit() function.

    Problem is, this creates uninformative initcall_debug output and makes
    ctags rather useless.

    So go through and rename them all to $(filename)_init and
    $(filename)_fini.

    Signed-off-by: Andrew Morton
    Signed-off-by: David S. Miller

    Andrew Morton
     

23 Mar, 2006

2 commits


21 Mar, 2006

10 commits


08 Mar, 2006

1 commit

  • The size of the skb carrying the netlink message is not
    equivalent to the length of the actual netlink message
    due to padding. ip_queue matches the length of the payload
    against the original packet size to determine if packet
    mangling is desired, due to the above wrong assumption
    arbitary packets may not be mangled depening on their
    original size.

    Signed-off-by: Thomas Graf
    Signed-off-by: David S. Miller

    Thomas Graf
     

28 Feb, 2006

1 commit

  • The nfnetlink_log infrastructure changes broke compatiblity of the LOG
    targets. They currently use whatever log backend was registered first,
    which means that if ipt_ULOG was loaded first, no messages will be printed
    to the ring buffer anymore.

    Restore compatiblity by using the old log functions by default and only use
    the nf_log backend if the user explicitly said so.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     

16 Feb, 2006

1 commit


05 Feb, 2006

4 commits

  • The IPv4 and IPv6 version of the policy match are identical besides address
    comparison and the data structure used for userspace communication. Unify
    the data structures to break compatiblity now (before it is released), so
    we can port it to x_tables in 2.6.17.

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • Fix two bugs in ip6t_policy address matching:
    - misorder arguments to ip6_masked_addrcmp, mask must be the second argument
    - inversion incorrectly applied to the entire expression instead of just
    the address comparison

    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • netfilter's do_replace() can overflow on addition within SMP_ALIGN()
    and/or on multiplication by NR_CPUS, resulting in a buffer overflow on
    the copy_from_user(). In practice, the overflow on addition is
    triggerable on all systems, whereas the multiplication one might require
    much physical memory to be present due to the check above. Either is
    sufficient to overwrite arbitrary amounts of kernel memory.

    I really hate adding the same check to all 4 versions of do_replace(),
    but the code is duplicate...

    Found by Solar Designer during security audit of OpenVZ.org

    Signed-Off-By: Kirill Korotaev
    Signed-Off-By: Solar Designer
    Signed-off-by: Patrck McHardy
    Signed-off-by: David S. Miller

    Kirill Korotaev
     

17 Jan, 2006

2 commits