Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 882f88f6d13b8b500f0c3744cb9cc574f5e987ce..19b1b984d68743cd22d935421cbbe44b6360b5fc 100644 (file)
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -544,12 +544,16 @@ static void nl_fib_input(struct sock *sk, int len)
        struct sk_buff *skb = NULL;
         struct nlmsghdr *nlh = NULL;
        struct fib_result_nl *frn;
-       int err;
        u32 pid;     
        struct fib_table *tb;
        
-       skb = skb_recv_datagram(sk, 0, 0, &err);
+       skb = skb_dequeue(&sk->sk_receive_queue);
        nlh = (struct nlmsghdr *)skb->data;
+       if (skb->len < NLMSG_SPACE(0) || skb->len < nlh->nlmsg_len ||
+           nlh->nlmsg_len < NLMSG_LENGTH(sizeof(*frn))) {
+               kfree_skb(skb);
+               return;
+       }
        
        frn = (struct fib_result_nl *) NLMSG_DATA(nlh);
        tb = fib_get_table(frn->tb_id_in);

diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
index 625981676776deea3994337863841bf29f262b2f..aeb7353d4777312280da73363566964c45006fdc 100644 (file)
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -272,9 +272,9 @@ static const enum tcp_conntrack tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
  *     sCL -> sCL
  */
 /*          sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
-/*ack*/           { sIV, sIV, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
+/*ack*/           { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
 /*
- *     sSS -> sIV      Might be a half-open connection.
+ *     sSS -> sIG      Might be a half-open connection.
  *     sSR -> sSR      Might answer late resent SYN.
  *     sES -> sES      :-)
  *     sFW -> sCW      Normal close request answered by ACK.
@@ -917,8 +917,12 @@ static int tcp_packet(struct ip_conntrack *conntrack,
 
        switch (new_state) {
        case TCP_CONNTRACK_IGNORE:
-               /* Either SYN in ORIGINAL
-                * or SYN/ACK in REPLY. */
+               /* Ignored packets:
+                * 
+                * a) SYN in ORIGINAL
+                * b) SYN/ACK in REPLY
+                * c) ACK in reply direction after initial SYN in original.
+                */
                if (index == TCP_SYNACK_SET
                    && conntrack->proto.tcp.last_index == TCP_SYN_SET
                    && conntrack->proto.tcp.last_dir != dir
@@ -985,13 +989,20 @@ static int tcp_packet(struct ip_conntrack *conntrack,
                }
        case TCP_CONNTRACK_CLOSE:
                if (index == TCP_RST_SET
-                   && test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
-                   && conntrack->proto.tcp.last_index == TCP_SYN_SET
+                   && ((test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
+                        && conntrack->proto.tcp.last_index == TCP_SYN_SET)
+                       || (!test_bit(IPS_ASSURED_BIT, &conntrack->status)
+                           && conntrack->proto.tcp.last_index == TCP_ACK_SET))
                    && ntohl(th->ack_seq) == conntrack->proto.tcp.last_end) {
-                       /* RST sent to invalid SYN we had let trough
-                        * SYN was in window then, tear down connection.
+                       /* RST sent to invalid SYN or ACK we had let trough
+                        * at a) and c) above:
+                        *
+                        * a) SYN was in window then
+                        * c) we hold a half-open connection.
+                        *
+                        * Delete our connection entry.
                         * We skip window checking, because packet might ACK
-                        * segments we ignored in the SYN. */
+                        * segments we ignored. */
                        goto in_window;
                }
                /* Just fall trough */

diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index 2d44b07688af3794bfe51b4aa63bfb5417021aa7..261cbb4d4c49b812cc3bcdfce3b2cd737a136ef7 100644 (file)
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -532,6 +532,7 @@ match(const struct sk_buff *skb,
                        }
                        if(info->seconds && info->hit_count) {
                                for(pkt_count = 0, hits_found = 0; pkt_count < ip_pkt_list_tot; pkt_count++) {
+                                       if(r_list[location].last_pkts[pkt_count] == 0) break;
                                        if(time_before_eq(now,r_list[location].last_pkts[pkt_count]+info->seconds*HZ)) hits_found++;
                                }
                                if(hits_found >= info->hit_count) ans = !info->invert; else ans = info->invert;

diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 5a6fcf349bdfacfadf38e990db70f5422023226a..6035633d82256c5ea9197dbac1205279af3a5886 100644 (file)
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -280,9 +280,9 @@ static enum tcp_conntrack tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
  *     sCL -> sCL
  */
 /*          sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sLI   */
-/*ack*/           { sIV, sIV, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
+/*ack*/           { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIV },
 /*
- *     sSS -> sIV      Might be a half-open connection.
+ *     sSS -> sIG      Might be a half-open connection.
  *     sSR -> sSR      Might answer late resent SYN.
  *     sES -> sES      :-)
  *     sFW -> sCW      Normal close request answered by ACK.
@@ -912,8 +912,12 @@ static int tcp_packet(struct nf_conn *conntrack,
 
        switch (new_state) {
        case TCP_CONNTRACK_IGNORE:
-               /* Either SYN in ORIGINAL
-                * or SYN/ACK in REPLY. */
+               /* Ignored packets:
+                *
+                * a) SYN in ORIGINAL
+                * b) SYN/ACK in REPLY
+                * c) ACK in reply direction after initial SYN in original. 
+                */
                if (index == TCP_SYNACK_SET
                    && conntrack->proto.tcp.last_index == TCP_SYN_SET
                    && conntrack->proto.tcp.last_dir != dir
@@ -979,13 +983,20 @@ static int tcp_packet(struct nf_conn *conntrack,
                }
        case TCP_CONNTRACK_CLOSE:
                if (index == TCP_RST_SET
-                   && test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
-                   && conntrack->proto.tcp.last_index == TCP_SYN_SET
+                   && ((test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
+                        && conntrack->proto.tcp.last_index == TCP_SYN_SET)
+                       || (!test_bit(IPS_ASSURED_BIT, &conntrack->status)
+                           && conntrack->proto.tcp.last_index == TCP_ACK_SET))
                    && ntohl(th->ack_seq) == conntrack->proto.tcp.last_end) {
-                       /* RST sent to invalid SYN we had let trough
-                        * SYN was in window then, tear down connection.
+                       /* RST sent to invalid SYN or ACK we had let trough
+                        * at a) and c) above:
+                        *
+                        * a) SYN was in window then
+                        * c) we hold a half-open connection.
+                        *
+                        * Delete our connection entry.
                         * We skip window checking, because packet might ACK
-                        * segments we ignored in the SYN. */
+                        * segments we ignored. */
                        goto in_window;
                }
                /* Just fall trough */