Pablo Neira Ayuso beac5afa2d netfilter: nf_tables: ensure proper initialization of nft_pktinfo fields ...

This patch introduces nft_set_pktinfo_unspec() that ensures proper
initialization all of pktinfo fields for non-IP traffic. This is used
by the bridge, netdev and arp families.

This new function relies on nft_set_pktinfo_proto_unspec() to set a new
tprot_set field that indicates if transport protocol information is
available. Remain fields are zeroed.

The meta expression has been also updated to check to tprot_set in first
place given that zero is a valid tprot value. Even a handcrafted packet
may come with the IPPROTO_RAW (255) protocol number so we can't rely on
this value as tprot unset.

Reported-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2016-09-12 18:51:57 +02:00

..

arp_tables.c

netfilter: x_tables: speed up jump target validation

2016-07-18 21:35:23 +02:00

arpt_mangle.c

…

arptable_filter.c

netfilter: arp_tables: register table in initns

2016-04-07 11:58:49 +02:00

ip_tables.c

netfilter: x_tables: speed up jump target validation

2016-07-18 21:35:23 +02:00

ipt_ah.c

netfilter: ipv4: whitespace around operators

2015-10-16 19:19:23 +02:00

ipt_CLUSTERIP.c

netfilter: ipv4: whitespace around operators

2015-10-16 19:19:23 +02:00

ipt_ECN.c

net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool

2015-08-17 21:33:06 -07:00

ipt_MASQUERADE.c

netfilter: nf_nat: generalize IPv4 masquerading support for nf_tables

2014-09-09 16:31:29 +02:00

ipt_REJECT.c

ipv4: Push struct net down into nf_send_reset

2015-09-29 20:21:31 +02:00

ipt_rpfilter.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-10-24 06:54:12 -07:00

ipt_SYNPROXY.c

netfilter: ipv4: fix NULL dereference

2016-03-28 17:59:29 +02:00

iptable_filter.c

netfilter: xtables: don't hook tables by default

2016-03-02 20:05:24 +01:00

iptable_mangle.c

netfilter: x_tables: simplify ip{6}table_mangle_hook()

2016-07-01 16:37:02 +02:00

iptable_nat.c

netfilter: xtables: don't hook tables by default

2016-03-02 20:05:24 +01:00

iptable_raw.c

netfilter: xtables: don't hook tables by default

2016-03-02 20:05:24 +01:00

iptable_security.c

netfilter: xtables: don't hook tables by default

2016-03-02 20:05:24 +01:00

Kconfig

netfilter: remove ip_conntrack* sysctl compat code

2016-08-13 13:27:13 +02:00

Makefile

netfilter: remove ip_conntrack* sysctl compat code

2016-08-13 13:27:13 +02:00

nf_conntrack_l3proto_ipv4.c

netfilter: remove ip_conntrack* sysctl compat code

2016-08-13 13:27:13 +02:00

nf_conntrack_proto_icmp.c

netfilter: remove ip_conntrack* sysctl compat code

2016-08-13 13:27:13 +02:00

nf_defrag_ipv4.c

netfilter: nf_defrag_ipv4: Drop redundant ip_send_check()

2016-03-02 20:05:22 +01:00

nf_dup_ipv4.c

netfilter: nf_dup4: remove redundant checksum recalculation

2016-08-12 00:42:47 +02:00

nf_log_arp.c

netfilter: log: Check param to avoid overflow in nf_log_set

2016-08-30 11:52:32 +02:00

nf_log_ipv4.c

netfilter: log: Check param to avoid overflow in nf_log_set

2016-08-30 11:52:32 +02:00

nf_nat_h323.c

netfilter: nf_nat_h323: fix crash in nf_ct_unlink_expect_report()

2014-02-05 17:46:05 +01:00

nf_nat_l3proto_ipv4.c

netfilter: Allow calling into nat helper without skb_dst.

2016-03-14 23:47:27 +01:00

nf_nat_masquerade_ipv4.c

ipv4: Don't do expensive useless work during inetdev destroy.

2016-03-13 23:28:35 -04:00

nf_nat_pptp.c

netfilter: Fix removal of GRE expectation entries created by PPTP

2015-11-09 13:32:14 +01:00

nf_nat_proto_gre.c

netfilter: gre: Use consistent GRE and PTTP header structure instead of the ones defined by netfilter

2016-09-07 10:36:52 +02:00

nf_nat_proto_icmp.c

net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool

2015-08-17 21:33:06 -07:00

nf_nat_snmp_basic.c

net ipv4: use preferred log methods

2015-11-18 13:37:20 -05:00

nf_reject_ipv4.c

netfilter: nf_reject_ipv4: don't send tcp RST if the packet is non-TCP

2016-06-24 11:03:22 +02:00

nf_tables_arp.c

netfilter: nf_tables: ensure proper initialization of nft_pktinfo fields

2016-09-12 18:51:57 +02:00

nf_tables_ipv4.c

netfilter: nf_tables: release objects on netns destruction

2015-12-28 18:34:35 +01:00

nft_chain_nat_ipv4.c

netfilter: Pass priv instead of nf_hook_ops to netfilter hooks

2015-09-18 22:00:16 +02:00

nft_chain_route_ipv4.c

ipv4: Pass struct net into ip_route_me_harder

2015-09-29 20:21:32 +02:00

nft_dup_ipv4.c

netfilter: Pass net to nf_dup_ipv4 and nf_dup_ipv6

2015-09-18 21:59:11 +02:00

nft_masq_ipv4.c

netfilter: nft_masq: support port range

2016-03-02 20:05:27 +01:00

nft_redir_ipv4.c

netfilter: nf_tables: kill nft_pktinfo.ops

2015-09-18 21:58:01 +02:00

nft_reject_ipv4.c

ipv4: Push struct net down into nf_send_reset

2015-09-29 20:21:31 +02:00