linux.git/net/netfilter/xt_TCPOPTSTRIP.c, branch v4.3

net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool

2015-08-18T04:33:06+00:00

inet_proto_csum_replace4,2,16 take a pseudohdr argument which indicates
the checksum field carries a pseudo header. This argument should be a
boolean instead of an int.

Signed-off-by: Tom Herbert 
Signed-off-by: David S. Miller

netfilter: xt_TCPOPTSTRIP: fix possible off by one access

2013-08-01T09:45:15+00:00

Fix a possible off by one access since optlen()
touches opt[offset+1] unsafely when i == tcp_hdrlen(skb) - 1.

This patch replaces tcp_hdrlen() by the local variable tcp_hdrlen
that stores the TCP header length, to save some cycles.

Reported-by: Julian Anastasov 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_TCPOPTSTRIP: don't use tcp_hdr()

2013-06-10T23:55:07+00:00

In (bc6bcb5 netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond
packet boundary), the use of tcp_hdr was introduced. However, we
cannot assume that skb->transport_header is set for non-local packets.

Cc: Florian Westphal 
Reported-by: Phil Oester 
Signed-off-by: Pablo Neira Ayuso

netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond packet boundary

2013-05-16T15:35:53+00:00

This target assumes that tcph->doff is well-formed, that may be well
not the case. Add extra sanity checkings to avoid possible crash due
to read/write out of the real packet boundary. After this patch, the
default action on malformed TCP packets is to drop them. Moreover,
fragments are skipped.

Reported-by: Rafal Kupka 
Signed-off-by: Pablo Neira Ayuso

net:netfilter: use IS_ENABLED

2011-12-16T20:49:52+00:00

Use IS_ENABLED(CONFIG_FOO)
instead of defined(CONFIG_FOO) || defined (CONFIG_FOO_MODULE)

Signed-off-by: Igor Maravić 
Signed-off-by: David S. Miller

ipv6: Add fragment reporting to ipv6_skip_exthdr().

2011-12-03T17:35:10+00:00

While parsing through IPv6 extension headers, fragment headers are
skipped making them invisible to the caller.  This reports the
fragment offset of the last header in order to make it possible to
determine whether the packet is fragmented and, if so whether it is
a first or last fragment.

Signed-off-by: Jesse Gross

netfilter: xtables: substitute temporary defines by final name

2010-05-11T16:31:17+00:00

Signed-off-by: Jan Engelhardt

netfilter: update my email address

2010-03-17T14:53:10+00:00

Signed-off-by: Jan Engelhardt

netfilter: xtables: move extension arguments into compound structure (4/6)

2008-10-08T09:35:19+00:00

This patch does this for target extensions' target functions.

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy

netfilter: x_tables: use NFPROTO_* in extensions

2008-10-08T09:35:01+00:00

Signed-off-by: Jan Engelhardt 
Signed-off-by: Patrick McHardy