linux.git/net/ipv4, branch v2.6.17.10

H.323 helper: fix possible NULL-ptr dereference

2006-08-07T03:52:13+00:00

[NETFILTER]: H.323 helper: fix possible NULL-ptr dereference

An RCF message containing a timeout results in a NULL-ptr dereference if
no RRQ has been seen before.

Noticed by the "SATURN tool", reported by Thomas Dillig 
and Isil Dillig .

Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

Fix IPv4/DECnet routing rule dumping

2006-07-25T03:35:27+00:00

When more rules are present than fit in a single skb, the remaining
rules are incorrectly skipped.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] NETFILTER: SCTP conntrack: fix crash triggered by packet without chunks [CVE-2006-2934]

2006-06-30T17:37:31+00:00

When a packet without any chunks is received, the newconntrack variable
in sctp_packet contains an out of bounds value that is used to look up an
pointer from the array of timeouts, which is then dereferenced, resulting
in a crash. Make sure at least a single chunk is present.

Problem noticed by George A. Theall 

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright

[IPV4]: Increment ipInHdrErrors when TTL expires.

2006-06-12T20:09:59+00:00

Signed-off-by: Weidong 
Signed-off-by: David S. Miller

[TCP]: continued: reno sacked_out count fix

2006-06-12T04:18:56+00:00

From: Aki M Nyrhinen 

IMHO the current fix to the problem (in_flight underflow in reno)
is incorrect.  it treats the symptons but ignores the problem. the
problem is timing out packets other than the head packet when we
don't have sack. i try to explain (sorry if explaining the obvious).

with sack, scanning the retransmit queue for timed out packets is
fine because we know which packets in our retransmit queue have been
acked by the receiver.

without sack, we know only how many packets in our retransmit queue the
receiver has acknowledged, but no idea which packets.

think of a "typical" slow-start overshoot case, where for example
every third packet in a window get lost because a router buffer gets
full.

with sack, we check for timeouts on those every third packet (as the
rest have been sacked). the packet counting works out and if there
is no reordering, we'll retransmit exactly the packets that were 
lost.

without sack, however, we check for timeout on every packet and end up
retransmitting consecutive packets in the retransmit queue. in our
slow-start example, 2/3 of those retransmissions are unnecessary. these
unnecessary retransmissions eat the congestion window and evetually
prevent fast recovery from continuing, if enough packets were lost.

Signed-off-by: David S. Miller

[TCP]: Avoid skb_pull if possible when trimming head

2006-06-05T22:03:37+00:00

Trimming the head of an skb by calling skb_pull can cause the packet
to become unaligned if the length pulled is odd.  Since the length is
entirely arbitrary for a FIN packet carrying data, this is actually
quite common.

Unaligned data is not the end of the world, but we should avoid it if
it's easily done.  In this case it is trivial.  Since we're discarding
all of the head data it doesn't matter whether we move skb->data forward
or back.

However, it is still possible to have unaligned skb->data in general.
So network drivers should be prepared to handle it instead of crashing.

This patch also adds an unlikely marking on len < headlen since partial
ACKs on head data are extremely rare in the wild.  As the return value
of __pskb_trim_head is no longer ever NULL that has been removed.

Signed-off-by: Herbert Xu ~{PmV>HI~} 
Signed-off-by: David S. Miller

[TCP] tcp_highspeed: Fix problem observed by Xiaoliang (David) Wei

2006-06-03T00:51:08+00:00

When snd_cwnd is smaller than 38 and the connection is in
congestion avoidance phase (snd_cwnd > snd_ssthresh), the snd_cwnd
seems to stop growing.

The additive increase was confused because C array's are 0 based.

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller

[NETFILTER]: PPTP helper: fix sstate/cstate typo

2006-05-29T05:51:05+00:00

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: mark H.323 helper experimental

2006-05-29T05:50:40+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: Fix small information leak in SO_ORIGINAL_DST (CVE-2006-1343)

2006-05-29T05:50:18+00:00

It appears that sockaddr_in.sin_zero is not zeroed during
getsockopt(...SO_ORIGINAL_DST...) operation. This can lead
to an information leak (CVE-2006-1343).

Signed-off-by: Marcel Holtmann 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller