iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/ipv4/netfilter
History
Lin Zhang 49f817d793 netfilter: SYNPROXY: skip non-tcp packet in {ipv4, ipv6}_synproxy_hook 
In function {ipv4,ipv6}_synproxy_hook we expect a normal tcp packet, but
the real server maybe reply an icmp error packet related to the exist
tcp conntrack, so we will access wrong tcp data.

Fix it by checking for the protocol field and only process tcp traffic.

Signed-off-by: Lin Zhang <xiaolou4617@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2017-10-09 13:08:39 +02:00
..
arp_tables.c
netfilter: xtables: add scheduling opportunity in get_counters
2017-09-08 18:55:27 +02:00
arpt_mangle.c
netfilter: arpt_mangle: fix return values of checkentry
2011-02-01 16:03:46 +01:00
arptable_filter.c
netfilter: arp_tables: register table in initns
2016-04-07 11:58:49 +02:00
ip_tables.c
netfilter: xtables: add scheduling opportunity in get_counters
2017-09-08 18:55:27 +02:00
ipt_ah.c
netfilter: ipv4: whitespace around operators
2015-10-16 19:19:23 +02:00
ipt_CLUSTERIP.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
2017-09-03 17:08:42 -07:00
ipt_ECN.c
net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool
2015-08-17 21:33:06 -07:00
ipt_MASQUERADE.c
netfilter: nat: add dependencies on conntrack module
2016-12-04 21:16:51 +01:00
ipt_REJECT.c
netfilter: x_tables: move hook state into xt_action_param structure
2016-11-03 10:56:21 +01:00
ipt_rpfilter.c
netfilter: rpfilter: fix incorrect loopback packet judgment
2017-01-16 14:23:01 +01:00
ipt_SYNPROXY.c
netfilter: SYNPROXY: skip non-tcp packet in {ipv4, ipv6}_synproxy_hook
2017-10-09 13:08:39 +02:00
iptable_filter.c
netfilter: xtables: don't hook tables by default
2016-03-02 20:05:24 +01:00
iptable_mangle.c
netfilter: x_tables: simplify ip{6}table_mangle_hook()
2016-07-01 16:37:02 +02:00
iptable_nat.c
netfilter: nf_hook_ops structs can be const
2017-07-31 19:10:44 +02:00
iptable_raw.c
netfilter: xtables: don't hook tables by default
2016-03-02 20:05:24 +01:00
iptable_security.c
netfilter: xtables: don't hook tables by default
2016-03-02 20:05:24 +01:00
Kconfig
netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c
2016-11-01 20:50:31 +01:00
Makefile
netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c
2016-11-01 20:50:31 +01:00
nf_conntrack_l3proto_ipv4.c
netfilter: conntrack: place print_tuple in procfs part
2017-08-24 18:52:32 +02:00
nf_conntrack_proto_icmp.c
net: Replace NF_CT_ASSERT() with WARN_ON().
2017-09-04 13:25:19 +02:00
nf_defrag_ipv4.c
netfilter: nf_hook_ops structs can be const
2017-07-31 19:10:44 +02:00
nf_dup_ipv4.c
netfilter: kill the fake untracked conntrack objects
2017-04-15 11:47:57 +02:00
nf_log_arp.c
netfilter: constify nf_loginfo structures
2017-08-02 14:25:59 +02:00
nf_log_ipv4.c
netfilter: constify nf_loginfo structures
2017-08-02 14:25:59 +02:00
nf_nat_h323.c
netfilter: nf_nat_h323: fix logical-not-parentheses warning
2017-08-24 18:48:05 +02:00
nf_nat_l3proto_ipv4.c
net: Replace NF_CT_ASSERT() with WARN_ON().
2017-09-04 13:25:19 +02:00
nf_nat_masquerade_ipv4.c
net: Replace NF_CT_ASSERT() with WARN_ON().
2017-09-04 13:25:19 +02:00
nf_nat_pptp.c
netfilter: pptp: attach nat extension when needed
2017-04-26 09:30:22 +02:00
nf_nat_proto_gre.c
netfilter: gre: Use consistent GRE and PTTP header structure instead of the ones defined by netfilter
2016-09-07 10:36:52 +02:00
nf_nat_proto_icmp.c
net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool
2015-08-17 21:33:06 -07:00
nf_nat_snmp_basic.c
netfilter: snmp: avoid stack size warning
2017-05-01 11:43:58 +02:00
nf_reject_ipv4.c
networking: make skb_put & friends return void pointers
2017-06-16 11:48:39 -04:00
nf_socket_ipv4.c
netfilter: remove nf_ct_is_untracked
2017-04-15 11:51:33 +02:00
nf_tables_arp.c
netfilter: nf_tables: only allow in/output for arp packets
2017-07-17 17:02:44 +02:00
nf_tables_ipv4.c
netfilter: Add the missed return value check of nft_register_chain_type
2016-09-12 19:54:45 +02:00
nft_chain_nat_ipv4.c
netfilter: Pass priv instead of nf_hook_ops to netfilter hooks
2015-09-18 22:00:16 +02:00
nft_chain_route_ipv4.c
netfilter: nft_chain_route: re-route before skb is queued to userspace
2016-09-06 18:02:37 +02:00
nft_dup_ipv4.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2016-11-15 10:54:36 -05:00
nft_fib_ipv4.c
netfilter: nf_tables: fib: use skb_header_pointer
2017-07-31 19:01:39 +02:00
nft_masq_ipv4.c
netfilter: nf_tables: fix mismatch in big-endian system
2017-03-13 13:30:28 +01:00
nft_redir_ipv4.c
netfilter: nf_tables: fix mismatch in big-endian system
2017-03-13 13:30:28 +01:00
nft_reject_ipv4.c
netfilter: nf_tables: use hook state from xt_action_param structure
2016-11-03 11:52:34 +01:00