You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Patrick McHardy 6d381634d2 [NETFILTER]: Fix ip6_tables extension header bypass bug ... As reported by Mark Dowd <Mark_Dowd@McAfee.com>, ip6_tables is susceptible to a fragmentation attack causing false negatives on extension header matches. When extension headers occur in the non-first fragment after the fragment header (possibly with an incorrect nexthdr value in the fragment header) a rule looking for this extension header will never match. Drop fragments that are at offset 0 and don't contain the final protocol header regardless of the ruleset, since this should not happen normally. Since all extension headers are before the protocol header this makes sure an extension header is either not present or in the first fragment, where we can properly parse it. With help from Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>		18 years ago
..
netfilter	[NETFILTER]: Fix ip6_tables extension header bypass bug	18 years ago
Kconfig	[IPV6]: Make IPV6_SUBTREES depend on IPV6_MULTIPLE_TABLES.	19 years ago
Makefile	[IPV6]: Seperate sit driver to extra module	19 years ago
addrconf.c	[IPV6]: Seperate sit driver to extra module (addrconf.c changes)	19 years ago
af_inet6.c	[IPV6]: Seperate sit driver to extra module	19 years ago
ah6.c	…
anycast.c	…
datagram.c	…
esp6.c	…
exthdrs.c	…
exthdrs_core.c	…
fib6_rules.c	[IPv6] rules: Use RT6_LOOKUP_F_HAS_SADDR and fix source based selectors	19 years ago
icmp.c	…
inet6_connection_sock.c	…
inet6_hashtables.c	…
ip6_fib.c	[IPv6] fib: initialize tb6_lock in common place to give lockdep a key	19 years ago
ip6_flowlabel.c	…
ip6_input.c	…
ip6_output.c	…
ip6_tunnel.c	…
ipcomp6.c	…
ipv6_sockglue.c	…
ipv6_syms.c	…
mcast.c	…
mip6.c	…
ndisc.c	[IPV6]: Remove bogus WARN_ON in Proxy-NA handling.	19 years ago
netfilter.c	…
proc.c	…
protocol.c	…
raw.c	…
reassembly.c	…
route.c	[IPV6]: Fix route.c warnings when multiple tables are disabled.	19 years ago
sit.c	[IPV6] sit: Add missing MODULE_LICENSE	19 years ago
sysctl_net_ipv6.c	…
tcp_ipv6.c	[NET]: Use typesafe inet_twsk() inline function instead of cast.	19 years ago
tunnel6.c	…
udp.c	…
xfrm6_input.c	…
xfrm6_mode_beet.c	…
xfrm6_mode_ro.c	…
xfrm6_mode_transport.c	…
xfrm6_mode_tunnel.c	…
xfrm6_output.c	…
xfrm6_policy.c	[IPV6]: Make sure error handling is done when calling ip6_route_output().	19 years ago
xfrm6_state.c	…
xfrm6_tunnel.c	…