Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-24 05:02:12 +00:00
Code Issues Packages Projects Releases Wiki Activity
5711b4e893
linux/net/ipv4/netfilter
History
Máté Eckl 5711b4e893 netfilter: nf_tproxy: fix possible non-linear access to transport header 
This patch fixes a silent out-of-bound read possibility that was present
because of the misuse of this function.

Mostly it was called with a struct udphdr *hp which had only the udphdr
part linearized by the skb_header_pointer, however
nf_tproxy_get_sock_v{4,6} uses it as a tcphdr pointer, so some reads for
tcp specific attributes may be invalid.

Fixes: a583636a83 ("inet: refactor inet[6]_lookup functions to take skb")
Signed-off-by: Máté Eckl <ecklm94@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2018-07-06 14:32:44 +02:00
..
arp_tables.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 2018-03-30 11:41:18 -04:00
arpt_mangle.c
arptable_filter.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
ip_tables.c netfilter: x_tables: set module owner for icmp(6) matches 2018-07-05 11:45:11 +02:00
ipt_ah.c netfilter: ipt_ah: return boolean instead of integer 2018-03-05 23:15:43 +01:00
ipt_CLUSTERIP.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
ipt_ECN.c netfilter: x_tables: use pr ratelimiting in all remaining spots 2018-02-14 21:05:38 +01:00
ipt_MASQUERADE.c netfilter: add NAT support for shifted portmap ranges 2018-04-24 10:29:12 +02:00
ipt_REJECT.c netfilter: x_tables: use pr ratelimiting in all remaining spots 2018-02-14 21:05:38 +01:00
ipt_rpfilter.c net/ipv4: Initialize proto and ports in flow struct 2018-05-17 14:55:21 -04:00
ipt_SYNPROXY.c netfilter: ctnetlink: synproxy support 2018-03-20 14:39:31 +01:00
iptable_filter.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
iptable_mangle.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
iptable_nat.c netfilter: nf_nat: add nat type hooks to nat core 2018-05-23 09:14:06 +02:00
iptable_raw.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
iptable_security.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
Kconfig netfilter: Libify xt_TPROXY 2018-06-03 00:02:05 +02:00
Makefile netfilter: Libify xt_TPROXY 2018-06-03 00:02:05 +02:00
nf_conntrack_l3proto_ipv4.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
nf_conntrack_proto_icmp.c netfilter: conntrack: timeouts can be const 2018-01-08 18:01:02 +01:00
nf_defrag_ipv4.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
nf_dup_ipv4.c netfilter: kill the fake untracked conntrack objects 2017-04-15 11:47:57 +02:00
nf_flow_table_ipv4.c netfilter: nf_flow_table: move init code to nf_flow_table_core.c 2018-04-24 10:28:45 +02:00
nf_log_arp.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
nf_log_ipv4.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
nf_nat_h323.c netfilter: add NAT support for shifted portmap ranges 2018-04-24 10:29:12 +02:00
nf_nat_l3proto_ipv4.c netfilter: nf_nat: add nat type hooks to nat core 2018-05-23 09:14:06 +02:00
nf_nat_masquerade_ipv4.c netfilter: nat: merge ipv4/ipv6 masquerade code into main nat module 2018-05-29 00:25:36 +02:00
nf_nat_pptp.c netfilter: add NAT support for shifted portmap ranges 2018-04-24 10:29:12 +02:00
nf_nat_proto_gre.c netfilter: add NAT support for shifted portmap ranges 2018-04-24 10:29:12 +02:00
nf_nat_proto_icmp.c netfilter: add NAT support for shifted portmap ranges 2018-04-24 10:29:12 +02:00
nf_nat_snmp_basic_main.c kbuild: rename *-asn1.[ch] to *.asn1.[ch] 2018-04-07 19:04:02 +09:00
nf_nat_snmp_basic.asn1 netfilter: nf_nat_snmp_basic: use asn1 decoder library 2018-01-19 13:59:07 +01:00
nf_reject_ipv4.c netfilter: nf_reject_ipv4: Fix use-after-free in send_reset 2017-11-01 12:15:29 +01:00
nf_socket_ipv4.c netfilter: nf_socket: Fix out of bounds access in nf_sk_lookup_slow_v{4,6} 2018-03-24 21:17:14 +01:00
nf_tproxy_ipv4.c netfilter: nf_tproxy: fix possible non-linear access to transport header 2018-07-06 14:32:44 +02:00
nft_chain_nat_ipv4.c netfilter: nf_nat: add nat type hooks to nat core 2018-05-23 09:14:06 +02:00
nft_chain_route_ipv4.c netfilter: nf_tables: nft_register_chain_type() returns void 2018-03-30 11:29:18 +02:00
nft_dup_ipv4.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-11-15 10:54:36 -05:00
nft_fib_ipv4.c netfilter: nf_tables: fib: use skb_header_pointer 2017-07-31 19:01:39 +02:00
nft_masq_ipv4.c netfilter: add NAT support for shifted portmap ranges 2018-04-24 10:29:12 +02:00
nft_redir_ipv4.c netfilter: nf_tables: fix mismatch in big-endian system 2017-03-13 13:30:28 +01:00
nft_reject_ipv4.c netfilter: nf_tables: use hook state from xt_action_param structure 2016-11-03 11:52:34 +01:00