davidlt/kernel-ark
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
d45e44d4be
kernel-ark/net/ipv6
History
Patrick McHardy 6d381634d2 [NETFILTER]: Fix ip6_tables extension header bypass bug 
As reported by Mark Dowd <Mark_Dowd@McAfee.com>, ip6_tables is susceptible
to a fragmentation attack causing false negatives on extension header matches.

When extension headers occur in the non-first fragment after the fragment
header (possibly with an incorrect nexthdr value in the fragment header)
a rule looking for this extension header will never match.

Drop fragments that are at offset 0 and don't contain the final protocol
header regardless of the ruleset, since this should not happen normally.
Since all extension headers are before the protocol header this makes sure
an extension header is either not present or in the first fragment, where
we can properly parse it.

With help from Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-24 16:15:10 -07:00
..
netfilter [NETFILTER]: Fix ip6_tables extension header bypass bug 2006-10-24 16:15:10 -07:00
addrconf.c [IPV6]: Seperate sit driver to extra module (addrconf.c changes) 2006-10-11 23:59:52 -07:00
af_inet6.c [IPV6]: Seperate sit driver to extra module 2006-10-11 23:59:50 -07:00
ah6.c [IPV6] MIP6: Several obvious clean-ups. 2006-09-22 15:17:58 -07:00
anycast.c [IPV6] ADDRCONF: Convert addrconf_lock to RCU. 2006-09-22 15:20:26 -07:00
datagram.c [IPV6] MIP6: Add socket option and ancillary data interface of routing header type 2. 2006-09-22 15:06:49 -07:00
esp6.c [IPSEC] esp: Defer output IV initialization to first use. 2006-09-22 15:17:35 -07:00
exthdrs_core.c [SELINUX]: Fix ipv6_skip_exthdr() invocation causing OOPS. 2005-04-24 20:16:19 -07:00
exthdrs.c [IPV6] MIP6: Fix to update IP6CB when cloned skbuff is received at HAO. 2006-09-22 15:18:46 -07:00
fib6_rules.c [IPv6] rules: Use RT6_LOOKUP_F_HAS_SADDR and fix source based selectors 2006-10-15 23:14:19 -07:00
icmp.c [IPV6] MIP6: Revert address to send ICMPv6 error. 2006-09-22 15:06:55 -07:00
inet6_connection_sock.c [IPV6]: Cache source address as well in ipv6_pinfo{}. 2006-09-22 14:55:45 -07:00
inet6_hashtables.c [IPV4]: INET_MATCH() annotations 2006-09-28 18:02:25 -07:00
ip6_fib.c [IPv6] fib: initialize tb6_lock in common place to give lockdep a key 2006-10-21 20:20:54 -07:00
ip6_flowlabel.c Remove obsolete #include <linux/config.h> 2006-06-30 19:25:36 +02:00
ip6_input.c [IPV6]: Allow to replace skbuff by TLV parser. 2006-09-22 15:06:51 -07:00
ip6_output.c [IPV6] NDISC: Add proxy_ndp sysctl. 2006-09-22 15:20:25 -07:00
ip6_tunnel.c [NET]: Conversions from kmalloc+memset to k(z|c)alloc. 2006-07-21 14:51:30 -07:00
ipcomp6.c [XFRM]: BEET mode 2006-10-04 00:31:09 -07:00
ipv6_sockglue.c [IPV6]: Disable SG for GSO unless we have checksum 2006-09-28 18:02:45 -07:00
ipv6_syms.c [IPV6] ADDRCONF: Convert addrconf_lock to RCU. 2006-09-22 15:20:26 -07:00
Kconfig [IPV6]: Make IPV6_SUBTREES depend on IPV6_MULTIPLE_TABLES. 2006-10-18 19:55:29 -07:00
Makefile [IPV6]: Seperate sit driver to extra module 2006-10-11 23:59:50 -07:00
mcast.c [NET/IPV4/IPV6]: Change some sysctl variables to __read_mostly 2006-09-22 14:55:03 -07:00
mip6.c Remove all inclusions of <linux/config.h> 2006-10-04 03:38:54 -04:00
ndisc.c [IPV6]: Remove bogus WARN_ON in Proxy-NA handling. 2006-10-15 23:14:20 -07:00
netfilter.c [NET]: Replace CHECKSUM_HW by CHECKSUM_PARTIAL/CHECKSUM_COMPLETE 2006-09-22 14:53:53 -07:00
proc.c Remove obsolete #include <linux/config.h> 2006-06-30 19:25:36 +02:00
protocol.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
raw.c [IPV6] MIP6: Add sending mobility header functions through raw socket. 2006-09-22 15:07:02 -07:00
reassembly.c [NET/IPV4/IPV6]: Change some sysctl variables to __read_mostly 2006-09-22 14:55:03 -07:00
route.c [IPV6]: Fix route.c warnings when multiple tables are disabled. 2006-10-18 21:20:57 -07:00
sit.c [IPV6] sit: Add missing MODULE_LICENSE 2006-10-15 23:14:21 -07:00
sysctl_net_ipv6.c Remove obsolete #include <linux/config.h> 2006-06-30 19:25:36 +02:00
tcp_ipv6.c [NET]: Use typesafe inet_twsk() inline function instead of cast. 2006-10-11 23:59:58 -07:00
tunnel6.c [INET]: Move no-tunnel ICMP error to tunnel4/tunnel6 2006-04-09 22:25:25 -07:00
udp.c [UDP]: Fix MSG_PROBE crash 2006-10-04 00:31:00 -07:00
xfrm6_input.c [XFRM]: xrfm_replay_check() annotations 2006-09-28 18:02:40 -07:00
xfrm6_mode_beet.c [XFRM]: BEET mode 2006-10-04 00:31:09 -07:00
xfrm6_mode_ro.c [IPSEC]: output mode to take an xfrm state as input param 2006-09-22 15:18:48 -07:00
xfrm6_mode_transport.c [IPSEC]: output mode to take an xfrm state as input param 2006-09-22 15:18:48 -07:00
xfrm6_mode_tunnel.c [IPSEC]: output mode to take an xfrm state as input param 2006-09-22 15:18:48 -07:00
xfrm6_output.c [IPSEC]: output mode to take an xfrm state as input param 2006-09-22 15:18:48 -07:00
xfrm6_policy.c [IPV6]: Make sure error handling is done when calling ip6_route_output(). 2006-10-18 19:55:27 -07:00
xfrm6_state.c [XFRM]: ports in struct xfrm_selector annotated 2006-09-28 18:02:33 -07:00
xfrm6_tunnel.c [XFRM]: xrfm_replay_check() annotations 2006-09-28 18:02:40 -07:00