linux-toradex.git/net/netfilter, branch v3.10.8

netfilter: ctnetlink: send event when conntrack label was modified

2013-06-24T09:32:56+00:00

commit 0ceabd83875b72a29f33db4ab703d6ba40ea4c58
(netfilter: ctnetlink: deliver labels to userspace) sets the event bit
when we raced with another packet, instead of raising the event bit
when the label bit is set for the first time.

commit 9b21f6a90924dfe8e5e686c314ddb441fb06501e
(netfilter: ctnetlink: allow userspace to modify labels) forgot to update
the event mask in the "conntrack already exists" case.

Both issues result in CTA_LABELS attribute not getting included in the
conntrack event.

Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso

netfilter: nf_nat_sip: fix mangling

2013-06-24T09:32:40+00:00

In (b20ab9c netfilter: nf_ct_helper: better logging for dropped packets)
there were some missing brackets around the logging information, thus
always returning drop.

Closes https://bugzilla.kernel.org/show_bug.cgi?id=60061

Signed-off-by: Balazs Peter Odor 
Signed-off-by: Pablo Neira Ayuso

ipvs: SCTP ports should be writable in ICMP packets

2013-06-19T00:53:52+00:00

Make sure that SCTP ports are writable when embedded in ICMP
from client, so that ip_vs_nat_icmp can translate them safely.

Signed-off-by: Julian Anastasov 
Signed-off-by: Simon Horman

netfilter: xt_TCPMSS: Fix missing fragmentation handling

2013-06-12T09:06:19+00:00

Similar to commit bc6bcb59 ("netfilter: xt_TCPOPTSTRIP: fix
possible mangling beyond packet boundary"), add safe fragment
handling to xt_TCPMSS.

Signed-off-by: Phil Oester 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_TCPMSS: Fix IPv6 default MSS too

2013-06-12T09:04:41+00:00

As a followup to commit 409b545a ("netfilter: xt_TCPMSS: Fix violation
of RFC879 in absence of MSS option"), John Heffner points out that IPv6
has a higher MTU than IPv4, and thus a higher minimum MSS. Update TCPMSS
target to account for this, and update RFC comment.

While at it, point to more recent reference RFC1122 instead of RFC879.

Signed-off-by: Phil Oester 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_TCPOPTSTRIP: don't use tcp_hdr()

2013-06-10T23:55:07+00:00

In (bc6bcb5 netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond
packet boundary), the use of tcp_hdr was introduced. However, we
cannot assume that skb->transport_header is set for non-local packets.

Cc: Florian Westphal 
Reported-by: Phil Oester 
Signed-off-by: Pablo Neira Ayuso

ipvs: info leak in __ip_vs_get_dest_entries()

2013-06-10T12:53:00+00:00

The entry struct has a 2 byte hole after ->port and another 4 byte
hole after ->stats.outpkts.  You must have CAP_NET_ADMIN in your
namespace to hit this information leak.

Signed-off-by: Dan Carpenter 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman 
Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink_queue: fix missing HW protocol

2013-06-07T16:55:20+00:00

Locally generated IPv4 and IPv6 traffic gets skb->protocol unset,
thus passing zero.

ip6tables -I OUTPUT -j NFQUEUE
libmnl/examples/netfilter# ./nf-queue 0 &
ping6 ::1
packet received (id=1 hw=0x0000 hook=3)
                         ^^^^^^

Signed-off-by: Pablo Neira Ayuso

netfilter: xt_TCPMSS: Fix violation of RFC879 in absence of MSS option

2013-06-05T11:59:22+00:00

The clamp-mss-to-pmtu option of the xt_TCPMSS target can cause issues
connecting to websites if there was no MSS option present in the
original SYN packet from the client. In these cases, it may add a
MSS higher than the default specified in RFC879. Fix this by never
setting a value > 536 if no MSS option was specified by the client.

This closes netfilter's bugzilla #662.

Signed-off-by: Phil Oester 
Signed-off-by: Pablo Neira Ayuso

netfilter: nfnetlink_cttimeout: fix incomplete dumping of objects

2013-06-05T10:36:37+00:00

Fix broken incomplete object dumping if the list of objects does not
fit into one single netlink message.

Reported-by: Gabriel Lazar 
Signed-off-by: Pablo Neira Ayuso