KumiSystems/openwrtv4
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

kernel: merge regression fixes for the netfilter patches to the 3.1 kernel patches (patch by tripolar)

Browse source 
SVN-Revision: 28734
This commit is contained in:
Felix Fietkau 2011-11-03 20:02:31 +00:00
parent 44ba13b578
commit 82bd0a43f1
3 changed files with 12 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
target/linux/generic/patches-3.1/610-netfilter_match_bypass_default_checks.patch
View file

@ -20,7 +20,7 @@
if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
IPT_INV_SRCIP) ||
FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
@@ -134,6 +137,26 @@ ip_packet_match(const struct iphdr *ip,
@@ -134,6 +137,29 @@ ip_packet_match(const struct iphdr *ip,
return true;
}
@ -38,6 +38,9 @@
+ if (memcmp(ip->outiface_mask, iface_mask, IFNAMSIZ) != 0)
+ return;
+
+ if (ip->smsk.s_addr || ip->dmsk.s_addr)
+ return;
+
+ if (ip->proto)
+ return;
+
@ -47,7 +50,7 @@
static bool
ip_checkentry(const struct ipt_ip *ip)
{
@@ -561,7 +584,7 @@ static void cleanup_match(struct xt_entr
@@ -561,7 +587,7 @@ static void cleanup_match(struct xt_entr
}
static int
@ -56,7 +59,7 @@
{
const struct xt_entry_target *t;
@@ -570,6 +593,8 @@ check_entry(const struct ipt_entry *e, c
@@ -570,6 +596,8 @@ check_entry(const struct ipt_entry *e, c
return -EINVAL;
}
@ -65,7 +68,7 @@
if (e->target_offset + sizeof(struct xt_entry_target) >
e->next_offset)
return -EINVAL;
@@ -931,6 +956,7 @@ copy_entries_to_user(unsigned int total_
@@ -931,6 +959,7 @@ copy_entries_to_user(unsigned int total_
const struct xt_table_info *private = table->private;
int ret = 0;
const void *loc_cpu_entry;
@ -73,7 +76,7 @@
counters = alloc_counters(table);
if (IS_ERR(counters))
@@ -961,6 +987,14 @@ copy_entries_to_user(unsigned int total_
@@ -961,6 +990,14 @@ copy_entries_to_user(unsigned int total_
ret = -EFAULT;
goto free_counters;
}

6
target/linux/generic/patches-3.1/611-netfilter_match_bypass_default_table.patch
View file

@ -1,6 +1,6 @@
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -307,6 +307,33 @@ struct ipt_entry *ipt_next_entry(const s
@@ -310,6 +310,33 @@ struct ipt_entry *ipt_next_entry(const s
return (void *)entry + entry->next_offset;
}
@ -34,7 +34,7 @@
/* Returns one of the generic firewall policies, like NF_ACCEPT. */
unsigned int
ipt_do_table(struct sk_buff *skb,
@@ -331,6 +358,25 @@ ipt_do_table(struct sk_buff *skb,
@@ -334,6 +361,25 @@ ipt_do_table(struct sk_buff *skb,
ip = ip_hdr(skb);
indev = in ? in->name : nulldevname;
outdev = out ? out->name : nulldevname;
@ -60,7 +60,7 @@
/* We handle fragments by dealing with the first fragment as
* if it was a normal packet. All other fragments are treated
* normally, except that they will NEVER match rules that ask
@@ -345,18 +391,6 @@ ipt_do_table(struct sk_buff *skb,
@@ -348,18 +394,6 @@ ipt_do_table(struct sk_buff *skb,
acpar.family = NFPROTO_IPV4;
acpar.hooknum = hook;

2
target/linux/generic/patches-3.1/612-netfilter_match_reduce_memory_access.patch
View file

@ -9,7 +9,7 @@
+ (ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
IPT_INV_SRCIP) ||
- FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
+ FWINV(ipinfo->smsk.s_addr &&
+ FWINV(ipinfo->dmsk.s_addr &&
+ (ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
IPT_INV_DSTIP)) {
dprintf("Source or dest mismatch.\n");