[NETFILTER 00/04]: Netfilter fixes

[NETFILTER 00/04]: Netfilter fixes

[Patrick McHardy]

Hi Dave,

these patches fix an extraneous ";" in the new u32 match and three minor
bugs in the SIP conntrack helper. Please apply, thanks.


 net/ipv4/netfilter/nf_nat_sip.c  |    2 +-
 net/netfilter/nf_conntrack_sip.c |    8 ++++++--
 net/netfilter/xt_u32.c           |    2 +-
 3 files changed, 8 insertions(+), 4 deletions(-)

Eric Dumazet (1):
      [NETFILTER]: netfilter: xt_u32 bug correction

Patrick McHardy (3):
      [NETFILTER]: nf_conntrack_sip: check sname != NULL before calling strncmp
      [NETFILTER]: nf_conntrack_sip: fix SIP-URI parsing
      [NETFILTER]: nf_nat_sip: don't drop short packets

[NETFILTER 01/04]: netfilter: xt_u32 bug correction

[Patrick McHardy]

[NETFILTER]: netfilter: xt_u32 bug correction

An extraneous ";" makes xt_u32 match useless

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit 4cbeda3b69e71c535ea820f5a94f4232598e3eea
tree e104d542dfa81fbec1656bce46a32bd0d3cdf10c
parent 39d3520c92cf7a28c07229ca00cc35a1e8026c77
author Eric Dumazet <dada1@cosmosbay.com> Tue, 14 Aug 2007 18:35:02 +0200
committer Patrick McHardy <kaber@trash.net> Tue, 14 Aug 2007 18:35:02 +0200

 net/netfilter/xt_u32.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c
index 74f9b14..bec4279 100644
--- a/net/netfilter/xt_u32.c
+++ b/net/netfilter/xt_u32.c
@@ -36,7 +36,7 @@ static bool u32_match_it(const struct xt_u32 *data,
 		at  = 0;
 		pos = ct->location[0].number;
 
-		if (skb->len < 4 || pos > skb->len - 4);
+		if (skb->len < 4 || pos > skb->len - 4)
 			return false;
 
 		ret   = skb_copy_bits(skb, pos, &n, sizeof(n));

Re: [NETFILTER 01/04]: netfilter: xt_u32 bug correction

[Jan Engelhardt]

On Aug 14 2007 18:40, Patrick McHardy wrote:
>
>[NETFILTER]: netfilter: xt_u32 bug correction
>
>An extraneous ";" makes xt_u32 match useless
>
>Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
>Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Jan Engelhardt <jengelh@gmx.de>




	Jan
-- 

[NETFILTER 02/04]: nf_conntrack_sip: check sname != NULL before calling strncmp

[Patrick McHardy]

[NETFILTER]: nf_conntrack_sip: check sname != NULL before calling strncmp

The check got lost during the conversion to nf_conntrack.

Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit c58af8c25d20e59644356f78e055eeba9edb8aae
tree c7c95d0ba93d86f6ec33dc2ae12e532dc1ce77ab
parent 4cbeda3b69e71c535ea820f5a94f4232598e3eea
author Patrick McHardy <kaber@trash.net> Tue, 14 Aug 2007 18:37:01 +0200
committer Patrick McHardy <kaber@trash.net> Tue, 14 Aug 2007 18:37:01 +0200

 net/netfilter/nf_conntrack_sip.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 1276a44..5cc9636 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -330,7 +330,8 @@ int ct_sip_get_info(struct nf_conn *ct,
 
 	while (dptr <= limit) {
 		if ((strncmp(dptr, hnfo->lname, hnfo->lnlen) != 0) &&
-		    (strncmp(dptr, hnfo->sname, hnfo->snlen) != 0)) {
+		    (hnfo->sname == NULL ||
+		     strncmp(dptr, hnfo->sname, hnfo->snlen) != 0)) {
 			dptr++;
 			continue;
 		}

[NETFILTER 03/04]: nf_conntrack_sip: fix SIP-URI parsing

[Patrick McHardy]

[NETFILTER]: nf_conntrack_sip: fix SIP-URI parsing

The userinfo component of a SIP-URI is optional, continue parsing at the
beginning of the SIP-URI in case its not found.

Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit 492d0e43049e7f420c1c64044ab57abf278fbead
tree d5b5da1b2109b78f28fa8748bcb33e573be85e5a
parent c58af8c25d20e59644356f78e055eeba9edb8aae
author Patrick McHardy <kaber@trash.net> Tue, 14 Aug 2007 18:37:25 +0200
committer Patrick McHardy <kaber@trash.net> Tue, 14 Aug 2007 18:37:25 +0200

 net/netfilter/nf_conntrack_sip.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 5cc9636..d449fa4 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -295,6 +295,7 @@ static int epaddr_len(struct nf_conn *ct, const char *dptr,
 static int skp_epaddr_len(struct nf_conn *ct, const char *dptr,
 			  const char *limit, int *shift)
 {
+	const char *start = dptr;
 	int s = *shift;
 
 	/* Search for @, but stop at the end of the line.
@@ -309,8 +310,10 @@ static int skp_epaddr_len(struct nf_conn *ct, const char *dptr,
 	if (dptr <= limit && *dptr == '@') {
 		dptr++;
 		(*shift)++;
-	} else
+	} else {
+		dptr = start;
 		*shift = s;
+	}
 
 	return epaddr_len(ct, dptr, limit, shift);
 }

[NETFILTER 04/04]: nf_nat_sip: don't drop short packets

[Patrick McHardy]

[NETFILTER]: nf_nat_sip: don't drop short packets

Don't drop packets shorter than "SIP/2.0", just ignore them. Keep-alives
can validly be shorter for example.

Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit 12ad6c49be7b0cb1e9f32750e34cde5d29d40a48
tree 6dc3ff60e52adc58a3a02d725f819cc6811b1664
parent 492d0e43049e7f420c1c64044ab57abf278fbead
author Patrick McHardy <kaber@trash.net> Tue, 14 Aug 2007 18:37:58 +0200
committer Patrick McHardy <kaber@trash.net> Tue, 14 Aug 2007 18:37:58 +0200

 net/ipv4/netfilter/nf_nat_sip.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index a889ec3..e14d419 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -104,7 +104,7 @@ static unsigned int ip_nat_sip(struct sk_buff **pskb,
 	dataoff = ip_hdrlen(*pskb) + sizeof(struct udphdr);
 	datalen = (*pskb)->len - dataoff;
 	if (datalen < sizeof("SIP/2.0") - 1)
-		return NF_DROP;
+		return NF_ACCEPT;
 
 	addr_map_init(ct, &map);
 

Re: [NETFILTER 00/04]: Netfilter fixes

[David Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Tue, 14 Aug 2007 18:40:12 +0200 (MEST)

> Hi Dave,
> 
> these patches fix an extraneous ";" in the new u32 match and three minor
> bugs in the SIP conntrack helper. Please apply, thanks.

All applied, thanks Patrick.

[NETFILTER 00/04]: Netfilter fixes

[Patrick McHardy]

These patches fix a couple of bugs in netfilter: a bug in ct_extend,
causing invalid memory accesses when DNATing a connection to a port
using a connection tracking helper, the TCP connection reopening bug,
causing slowdowns by dropping connection reopening attempts, and
a typo and missing #include in xt_iprange.

Please apply, thanks.


 include/net/netfilter/nf_conntrack_extend.h |    2 +-
 net/ipv4/netfilter/nf_nat_core.c            |    6 ++--
 net/netfilter/nf_conntrack_extend.c         |    3 +-
 net/netfilter/nf_conntrack_proto_tcp.c      |   32 +++++++++++++++++++++-----
 net/netfilter/xt_iprange.c                  |    3 +-
 5 files changed, 34 insertions(+), 12 deletions(-)

Jan Engelhardt (1):
      [NETFILTER]: xt_iprange: add missing #include

Jozsef Kadlecsik (1):
      [NETFILTER]: nf_conntrack: TCP conntrack reopening fix

Patrick McHardy (2):
      [NETFILTER]: nf_conntrack: fix ct_extend ->move operation
      [NETFILTER]: xt_iprange: fix typo in address family

Re: [NETFILTER 00/04]: Netfilter fixes

[David Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Wed,  6 Feb 2008 14:33:59 +0100 (MET)

> These patches fix a couple of bugs in netfilter: a bug in ct_extend,
> causing invalid memory accesses when DNATing a connection to a port
> using a connection tracking helper, the TCP connection reopening bug,
> causing slowdowns by dropping connection reopening attempts, and
> a typo and missing #include in xt_iprange.
> 
> Please apply, thanks.

All applied, thanks Patrick.

[NETFILTER 00/04]: Netfilter fixes

[Patrick McHardy]

Hi Dave,

following are a few more netfilter fixes for 2.6.20, fixing a
nf_conntrack_ipv6 crash when dealing with fragments, hanging
connections when loading the nf_nat module, an incorrect value
for a TCP connection tracking flag and compilation of arp_tables
userspace. I'll also pass on the relevant ones to -stable.

Please apply, thanks.


 include/linux/netfilter/nf_conntrack_tcp.h |    2 +-
 include/linux/netfilter_arp/arp_tables.h   |    1 +
 net/ipv4/netfilter/nf_nat_standalone.c     |    2 +-
 net/ipv6/netfilter/nf_conntrack_reasm.c    |    2 ++
 4 files changed, 5 insertions(+), 2 deletions(-)

Bart De Schuymer:
      [NETFILTER]: arp_tables: fix userspace compilation

Patrick McHardy:
      [NETFILTER]: nf_conntrack_ipv6: fix crash when handling fragments
      [NETFILTER]: nf_nat: fix hanging connections when loading the NAT module
      [NETFILTER]: tcp conntrack: fix IP_CT_TCP_FLAG_CLOSE_INIT value

Re: [NETFILTER 00/04]: Netfilter fixes

[David Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Tue,  9 Jan 2007 17:29:52 +0100 (MET)

> Hi Dave,
> 
> following are a few more netfilter fixes for 2.6.20, fixing a
> nf_conntrack_ipv6 crash when dealing with fragments, hanging
> connections when loading the nf_nat module, an incorrect value
> for a TCP connection tracking flag and compilation of arp_tables
> userspace. I'll also pass on the relevant ones to -stable.
> 
> Please apply, thanks.

It all looks good, applied, thanks Patrick.

[NETFILTER 00/04]: Netfilter fixes

[Patrick McHardy]

Hi Dave,

following are a few small netfilter fixes for 2.6.19, fixing multiple
refcount leaks and a nf_conntrack helper assignment race which can
lead to use-after-free.

Please apply, thanks.


 net/ipv4/netfilter/ip_conntrack_core.c    |    6 +++---
 net/ipv4/netfilter/ip_conntrack_netlink.c |    1 +
 net/netfilter/nf_conntrack_core.c         |   19 +++++++++----------
 net/netfilter/nf_conntrack_netlink.c      |    9 +++++++++
 4 files changed, 22 insertions(+), 13 deletions(-)

Patrick McHardy:
      [NETFILTER]: ctnetlink: fix reference count leak

Yasuyuki Kozakai:
      [NETFILTER]: nfctnetlink: assign helper to newly created conntrack
      [NETFILTER]: nf_conntrack: fix the race on assign helper to new conntrack
      [NETFILTER]: conntrack: fix refcount leak when finding expectation

Re: [NETFILTER 00/04]: Netfilter fixes

[David Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Mon, 27 Nov 2006 19:20:53 +0100 (MET)

> following are a few small netfilter fixes for 2.6.19, fixing multiple
> refcount leaks and a nf_conntrack helper assignment race which can
> lead to use-after-free.
> 
> Please apply, thanks.

Applied, thanks a lot Patrick.

[NETFILTER 00/04]: Netfilter fixes

[Patrick McHardy]

Hi Dave,

following a few netfilter fixes for 2.6.19, fixing invalid use of skb_trim
in netfilter userspace queueing, conflicting optname values for ip6tables
revision support and another byteorder problem in nfnetlink_log.

Please apply, thanks.


 include/linux/in6.h                       |   12 +++++++++++-
 include/linux/netfilter/x_tables.h        |   16 ----------------
 include/linux/netfilter_arp/arp_tables.h  |   25 +++++++++++++------------
 include/linux/netfilter_ipv4/ip_tables.h  |   27 +++++++++++++++------------
 include/linux/netfilter_ipv6/ip6_tables.h |   27 +++++++++++++++------------
 net/ipv4/netfilter/ip_queue.c             |    7 ++++---
 net/ipv6/netfilter/ip6_queue.c            |    7 ++++---
 net/ipv6/netfilter/ip6_tables.c           |    2 +-
 net/netfilter/nfnetlink_log.c             |    2 +-
 net/netfilter/nfnetlink_queue.c           |    7 ++++---
 10 files changed, 68 insertions(+), 64 deletions(-)

Patrick McHardy:
      [NETFILTER]: nfnetlink_log: fix byteorder of NFULA_SEQ_GLOBAL
      [NETFILTER]: Use pskb_trim in {ip,ip6,nfnetlink}_queue
      [NETFILTER]: ip6_tables: use correct nexthdr value in ipv6_find_hdr()

Yasuyuki Kozakai:
      [NETFILTER]: ip6_tables: fixed conflicted optname for getsockopt

Re: [NETFILTER 00/04]: Netfilter fixes

[David Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Tue, 14 Nov 2006 08:03:26 +0100 (MET)

> following a few netfilter fixes for 2.6.19, fixing invalid use of skb_trim
> in netfilter userspace queueing, conflicting optname values for ip6tables
> revision support and another byteorder problem in nfnetlink_log.
> 
> Please apply, thanks.

All applied, thanks a lot Patrick.