Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7089fdd8 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 



Pablo Neira Ayuso says:

====================
The following patchset contains two Netfilter fixes for your net
tree, they are:

* Fix endianness in nft_reject, the NFTA_REJECT_TYPE netlink attributes
  was not converted to network byte order as needed by all nfnetlink
  subsystems, from Eric Leblond.

* Restrict SYNPROXY target to INPUT and FORWARD chains, this avoid a
  possible crash due to misconfigurations, from Patrick McHardy.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 37ab4fa7 a3adadf3

net/ipv4/netfilter/ipt_SYNPROXY.c

+1 −0
Original line number Diff line number Diff line
@@ -423,6 +423,7 @@ static void synproxy_tg4_destroy(const struct xt_tgdtor_param *par) 
static struct xt_target synproxy_tg4_reg __read_mostly = {

	.name		= "SYNPROXY",

	.family		= NFPROTO_IPV4,

	.hooks		= (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),

	.target		= synproxy_tg4,

	.targetsize	= sizeof(struct xt_synproxy_info),

	.checkentry	= synproxy_tg4_check,

net/ipv4/netfilter/nft_reject_ipv4.c

+1 −1
Original line number Diff line number Diff line
@@ -72,7 +72,7 @@ static int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr) 
{

	const struct nft_reject *priv = nft_expr_priv(expr);



	if (nla_put_be32(skb, NFTA_REJECT_TYPE, priv->type))

	if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))

		goto nla_put_failure;



	switch (priv->type) {

net/ipv6/netfilter/ip6t_SYNPROXY.c

+1 −0
Original line number Diff line number Diff line
@@ -446,6 +446,7 @@ static void synproxy_tg6_destroy(const struct xt_tgdtor_param *par) 
static struct xt_target synproxy_tg6_reg __read_mostly = {

	.name		= "SYNPROXY",

	.family		= NFPROTO_IPV6,

	.hooks		= (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),

	.target		= synproxy_tg6,

	.targetsize	= sizeof(struct xt_synproxy_info),

	.checkentry	= synproxy_tg6_check,