kernel/git/stable/linux-stable.git/net/ipv4, branch linux-2.6.15.y

[PATCH] TCP: Do not use inet->id of global tcp_socket when sending RST (CVE-2006-1242)

2006-03-28T07:00:23+00:00

The problem is in ip_push_pending_frames(), which uses: if (!df) { __ip_select_ident(iph, &rt->u.dst, 0); } else { iph->id = htons(inet->id++); } instead of ip_select_ident(). Right now I think the code is a nonsense. Most likely, I copied it from old ip_build_xmit(), where it was really special, we had to decide whether to generate unique ID when generating the first (well, the last) fragment. In ip_push_pending_frames() it does not make sense, it should use plain ip_select_ident() instead. Signed-off-by: Alexey Kuznetsov Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] Netfilter ip_queue: Fix wrong skb->len == nlmsg_len assumption

2006-03-28T07:00:21+00:00

The size of the skb carrying the netlink message is not equivalent to the length of the actual netlink message due to padding. ip_queue matches the length of the payload against the original packet size to determine if packet mangling is desired, due to the above wrong assumption arbitary packets may not be mangled depening on their original size. Signed-off-by: Thomas Graf Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix extra dst release when ip_options_echo fails

2006-02-06T23:36:33+00:00

When two ip_route_output_key lookups in icmp_send were combined I forgot to change the error path for ip_options_echo to not drop the dst reference since it now sits before the dst lookup. To fix it we simply jump past the ip_rt_put call. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Chris Wright

[PATCH] Fix another crash in ip_nat_pptp (CVE-2006-0037)

2006-01-15T06:15:29+00:00

The PPTP NAT helper calculates the offset at which the packet needs to be mangled as difference between two pointers to the header. With non-linear skbs however the pointers may point to two seperate buffers on the stack and the calculation results in a wrong offset beeing used. Signed-off-by: Patrick McHardy Signed-off-by: Chris Wright

[PATCH] Fix crash in ip_nat_pptp (CVE-2006-0036)

2006-01-15T06:15:29+00:00

When an inbound PPTP_IN_CALL_REQUEST packet is received the PPTP NAT helper uses a NULL pointer in pointer arithmentic to calculate the offset in the packet which needs to be mangled and corrupts random memory or crashes. Signed-off-by: Patrick McHardy Signed-off-by: Chris Wright

[XFRM]: Handle DCCP in xfrm{4,6}_decode_session

2005-12-19T22:03:46+00:00

Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller

[NETFILTER]: Fix NAT init order

2005-12-19T21:53:09+00:00

As noticed by Phil Oester, the GRE NAT protocol helper is initialized before the NAT core, which makes registration fail. Change the linking order to make NAT be initialized first. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller

[GRE]: Fix hardware checksum modification

2005-12-14T20:55:24+00:00

The skb_postpull_rcsum introduced a bug to the checksum modification. Although the length pulled is offset bytes, the origin of the pulling is the GRE header, not the IP header. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller

[NETFILTER]: ip_nat_tftp: Fix expectation NAT

2005-12-12T23:02:48+00:00

When a TFTP client is SNATed so that the port is also changed, the port is never changed back for the expected connection. Signed-off-by: Marcus Sundberg Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller

[TCP] Vegas: timestamp before clone

2005-12-07T00:24:52+00:00

We have to store the congestion control timestamp on the SKB before we clone it, not after. Else we get no timestamping information at all. tcp_transmit_skb() has been reworked so that we can do the timestamp still in one spot, instead of at all the call sites. Problem discovered, and initial fix, from Tom Young . Signed-off-by: David S. Miller