leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
7fc3822536
linux/net/ipv6/netfilter
History
Alin Nastac 7fc3822536 netfilter: reject: skip csum verification for protocols that don't support it 
Some protocols have other means to verify the payload integrity
(AH, ESP, SCTP) while others are incompatible with nf_ip(6)_checksum
implementation because checksum is either optional or might be
partial (UDPLITE, DCCP, GRE). Because nf_ip(6)_checksum was used
to validate the packets, ip(6)tables REJECT rules were not capable
to generate ICMP(v6) errors for the protocols mentioned above.

This commit also fixes the incorrect pseudo-header protocol used
for IPv4 packets that carry other transport protocols than TCP or
UDP (pseudo-header used protocol 0 iso the proper value).

Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2019-02-13 10:03:53 +01:00
..
ip6_tables.c netfilter: x_tables: set module owner for icmp(6) matches 2018-07-05 11:45:11 +02:00
ip6t_ah.c
ip6t_eui64.c
ip6t_frag.c
ip6t_hbh.c
ip6t_ipv6header.c netfilter: xtables: avoid BUG_ON 2018-09-17 16:11:12 +02:00
ip6t_MASQUERADE.c netfilter: add missing error handling code for register functions 2018-11-27 00:35:19 +01:00
ip6t_mh.c
ip6t_NPT.c
ip6t_REJECT.c netfilter: x_tables: use pr ratelimiting in all remaining spots 2018-02-14 21:05:38 +01:00
ip6t_rpfilter.c netfilter: ip6t_rpfilter: set F_IFACE for linklocal addresses 2018-08-16 19:36:58 +02:00
ip6t_rt.c netfilter: xtables: avoid BUG_ON 2018-09-17 16:11:12 +02:00
ip6t_srh.c netfilter: ip6t_srh: extend SRH matching for previous, next and last SID 2018-05-06 23:33:03 +02:00
ip6t_SYNPROXY.c netfilter: ctnetlink: synproxy support 2018-03-20 14:39:31 +01:00
ip6table_filter.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
ip6table_mangle.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
ip6table_nat.c netfilter: nf_nat: add nat type hooks to nat core 2018-05-23 09:14:06 +02:00
ip6table_raw.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
ip6table_security.c net: Drop pernet_operations::async 2018-03-27 13:18:09 -04:00
Kconfig netfilter: conntrack: remove l3proto abstraction 2018-07-17 15:27:49 +02:00
Makefile netfilter: nat: remove nf_nat_l4proto struct 2018-12-17 23:33:31 +01:00
nf_conntrack_reasm.c net: IP6 defrag: use rbtrees in nf_conntrack_reasm.c 2019-01-25 21:37:11 -08:00
nf_defrag_ipv6_hooks.c ipv6: remove dependency of nf_defrag_ipv6 on ipv6 module 2018-07-18 11:26:53 +02:00
nf_dup_ipv6.c
nf_flow_table_ipv6.c netfilter: nf_flow_table: move init code to nf_flow_table_core.c 2018-04-24 10:28:45 +02:00
nf_log_ipv6.c netfilter: check if the socket netns is correct. 2018-06-28 22:21:32 +09:00
nf_nat_l3proto_ipv6.c netfilter: nat: remove module dependency on ipv6 core 2019-02-04 18:20:19 +01:00
nf_nat_masquerade_ipv6.c netfilter: nat: remove module dependency on ipv6 core 2019-02-04 18:20:19 +01:00
nf_reject_ipv6.c netfilter: reject: skip csum verification for protocols that don't support it 2019-02-13 10:03:53 +01:00
nf_socket_ipv6.c netfilter: nf_socket: Fix out of bounds access in nf_sk_lookup_slow_v{4,6} 2018-03-24 21:17:14 +01:00
nf_tproxy_ipv6.c netfilter: nf_tproxy: fix possible non-linear access to transport header 2018-07-06 14:32:44 +02:00
nft_chain_nat_ipv6.c netfilter: nf_nat: add nat type hooks to nat core 2018-05-23 09:14:06 +02:00
nft_chain_route_ipv6.c netfilter: nf_tables: nft_register_chain_type() returns void 2018-03-30 11:29:18 +02:00
nft_dup_ipv6.c
nft_fib_ipv6.c netfilter: ipv6: avoid indirect calls for IPV6=y case 2019-02-04 18:21:12 +01:00
nft_masq_ipv6.c netfilter: add missing error handling code for register functions 2018-11-27 00:35:19 +01:00
nft_redir_ipv6.c netfilter: add NAT support for shifted portmap ranges 2018-04-24 10:29:12 +02:00
nft_reject_ipv6.c