Dave Johnson 9dd2ab609e netfilter: Wrong icmp6 checksum for ICMPV6_TIME_EXCEED in reverse SNATv6 path ...

When recalculating the outer ICMPv6 checksum for a reverse path NATv6
such as ICMPV6_TIME_EXCEED nf_nat_icmpv6_reply_translation() was
accessing data beyond the headlen of the skb for non-linear skb.  This
resulted in incorrect ICMPv6 checksum as garbage data was used.

Patch replaces csum_partial() with skb_checksum() which supports
non-linear skbs similar to nf_nat_icmp_reply_translation() from ipv4.

Signed-off-by: Dave Johnson <dave-kernel@centerclick.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2017-04-25 11:10:38 +02:00

..

ip6_tables.c

ip6tables: use match, target and data copy_to_user helpers

2017-01-09 17:24:54 +01:00

ip6t_ah.c

netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()

2012-05-09 12:53:47 +02:00

ip6t_eui64.c

netfilter: xtables: change hotdrop pointer to direct modification

2010-05-11 18:35:27 +02:00

ip6t_frag.c

netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()

2012-05-09 12:53:47 +02:00

ip6t_hbh.c

netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()

2012-05-09 12:53:47 +02:00

ip6t_ipv6header.c

netfilter: remove unnecessary break after return

2014-07-15 16:27:00 -07:00

ip6t_MASQUERADE.c

netfilter: x_tables: move hook state into xt_action_param structure

2016-11-03 10:56:21 +01:00

ip6t_mh.c

netfilter: xtables: change hotdrop pointer to direct modification

2010-05-11 18:35:27 +02:00

ip6t_NPT.c

xtables: extend matches and targets with .usersize

2017-01-09 17:24:55 +01:00

ip6t_REJECT.c

netfilter: x_tables: move hook state into xt_action_param structure

2016-11-03 10:56:21 +01:00

ip6t_rpfilter.c

netfilter: rpfilter: fix incorrect loopback packet judgment

2017-01-16 14:23:01 +01:00

ip6t_rt.c

netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()

2012-05-09 12:53:47 +02:00

ip6t_SYNPROXY.c

netfilter: add and use nf_ct_set helper

2017-02-02 14:31:54 +01:00

ip6table_filter.c

netfilter: xtables: don't hook tables by default

2016-03-02 20:05:24 +01:00

ip6table_mangle.c

netfilter: x_tables: simplify ip{6}table_mangle_hook()

2016-07-01 16:37:02 +02:00

ip6table_nat.c

netfilter: xtables: don't hook tables by default

2016-03-02 20:05:24 +01:00

ip6table_raw.c

netfilter: xtables: don't hook tables by default

2016-03-02 20:05:24 +01:00

ip6table_security.c

netfilter: xtables: don't hook tables by default

2016-03-02 20:05:24 +01:00

Kconfig

netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c

2016-11-01 20:50:31 +01:00

Makefile

netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c

2016-11-01 20:50:31 +01:00

nf_conntrack_l3proto_ipv6.c

netfilter: defrag: only register defrag functionality if needed

2016-12-06 21:42:00 +01:00

nf_conntrack_proto_icmpv6.c

netfilter: add and use nf_ct_set helper

2017-02-02 14:31:54 +01:00

nf_conntrack_reasm.c

ipv6: orphan skbs in reassembly unit

2017-03-01 20:55:57 -08:00

nf_defrag_ipv6_hooks.c

skbuff: add and use skb_nfct helper

2017-02-02 14:31:53 +01:00

nf_dup_ipv6.c

netfilter: merge ctinfo into nfct pointer storage area

2017-02-02 14:31:56 +01:00

nf_log_ipv6.c

lib/vsprintf.c: remove %Z support

2017-02-27 18:43:47 -08:00

nf_nat_l3proto_ipv6.c

netfilter: Wrong icmp6 checksum for ICMPV6_TIME_EXCEED in reverse SNATv6 path

2017-04-25 11:10:38 +02:00

nf_nat_masquerade_ipv6.c

netfilter: conntrack: resched in nf_ct_iterate_cleanup

2016-02-01 00:15:26 +01:00

nf_nat_proto_icmpv6.c

net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool

2015-08-17 21:33:06 -07:00

nf_reject_ipv6.c

netfilter: use fwmark_reflect in nf_send_reset

2017-01-09 18:01:03 +01:00

nf_socket_ipv6.c

netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c

2016-11-01 20:50:31 +01:00

nf_tables_ipv6.c

netfilter: Add the missed return value check of nft_register_chain_type

2016-09-12 19:54:45 +02:00

nft_chain_nat_ipv6.c

netfilter: Pass priv instead of nf_hook_ops to netfilter hooks

2015-09-18 22:00:16 +02:00

nft_chain_route_ipv6.c

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2016-09-25 23:34:19 +02:00

nft_dup_ipv6.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2016-11-15 10:54:36 -05:00

nft_fib_ipv6.c

netfilter: rpfilter: fix incorrect loopback packet judgment

2017-01-16 14:23:01 +01:00

nft_masq_ipv6.c

netfilter: nf_tables: fix mismatch in big-endian system

2017-03-13 13:30:28 +01:00

nft_redir_ipv6.c

netfilter: nf_tables: fix mismatch in big-endian system

2017-03-13 13:30:28 +01:00

nft_reject_ipv6.c

netfilter: nf_tables: use hook state from xt_action_param structure

2016-11-03 11:52:34 +01:00