Changli Gao [Tue, 24 Mar 2009 05:27:01 +0000 (13:27 +0800)]
libxt_fuzzy: need to account for kernel-level modified variables in .userspacesize
When reviewing the code, I found there maybe a bug in libxt_fuzzy.c.
If a user wants to delete this match, he will get an error reported,
and the command fails. As the fields after maximum_rate in
xt_fuzzy_mtinfo will be altered in kernel space, we should assign the
userspacesize with the value offsetof(struct xt_fuzzy_mtinfo,
packets_total) instead.
Jan Engelhardt [Sun, 8 Mar 2009 22:38:12 +0000 (23:38 +0100)]
Add a reworked IPv4 options match - xt_ipv4options
This revision 1 of ipv4options makes it possible to match the
presence or absence of any of the 32 possible IP options, either all
or any of the options the user specified.
Jan Engelhardt [Fri, 30 Jan 2009 05:33:21 +0000 (06:33 +0100)]
ipset: bump version to 2.4.7
Moving from ipset 2.4.5 to 2.4.7. Upstream changed, but
the Xtables-addons copy did not (issues were not present):
>2.4.7
> - Typo which broke compilation with kernels < 2.6.28
> fixed (reported by Richard Lucassen, Danny Rawlins)
>
>2.4.6
> - Compatibility fix for kernels >= 2.6.28
Jan Engelhardt [Sat, 10 Jan 2009 03:46:26 +0000 (04:46 +0100)]
ipp2p: remove log flooding
Syslog was flooded by lots of messages due to if (plen >= 5) firing
on any packet, when it should have been plen < 5. Incidentally, this
turned up that plen also takes on huge nonsense values, assuming
underflow - yet to be investigated.
John Haxby [Tue, 2 Dec 2008 17:46:36 +0000 (17:46 +0000)]
xt_SYSRQ: improve security
I want to be able to use SYSRQ to reboot, crash or partially diagnose
machines that become unresponsive for one reason or another. These
machines, typically, are blades or rack mounted machines that do not
have a PS/2 connection for a keyboard and the old method of wheeling
round a "crash trolley" that has a monitor and a keyboard on it no
longer works: USB keyboards rarely, if ever, work because by the time
the machine is responding only to a ping, udev is incapable of
setting up a new keyboard.
This patch extends the xt_SYSRQ module to avoid both disclosing the
sysrq password and preventing replay. This is done by changing the
request packet from the simple "<key><password>" to a slightly more
complex "<key>,<seqno>,<salt>,<hash>". The hash is the sha1 checksum
of "<key>,<seqno>,<salt>,<password>". A request can be constructed in
a small shell script (see manpage).
Verification of the hash in xt_SYSRQ follows much the same process.
The sequence number, seqno, is initialised to the current time (in
seconds) when the xt_SYSRQ module is loaded and is updated each time
a valid request is received. A request with a sequence number less
than the current sequence number or a wrong hash is silently ignored.
(Using the time for the sequence number assumes (requires) that time
doesn't go backwards on a reboot and that the requester and victim
have reasonably synchronized clocks.)
The random salt is there to prevent pre-computed dictionary attacks
difficult: dictionary attacks are still feasible if you capture a
packet because the hash is computed quickly -- taking perhaps several
milliseconds to compute a more complex hash in xt_SYSRQ when the
machine is unresponsive is probably not the best thing you could do.
However, cracking, say, a random 32 character password would take
some time and is probably beyond what the people in the target
untrustworthy environment are prepared to do or have the resources
for. It almost goes without saying that no two victim machines should
use the same password.
Finally, the module allocates all the resources it need at module
initialisation time on the assumption that if things are going badly
resource allocation is going to be troublesome.
James King [Wed, 27 Aug 2008 01:12:33 +0000 (18:12 -0700)]
ipset: adjust semaphore.h include for kernel >= 2.6.27
As of Linux kernel commit 2351ec533ed0dd56052ab96988d2161d5ecc8ed9,
semaphore.h was moved from asm/ to linux/, which breaks building of
ipset. Add compat glue to ip_set.c to fix building on 2.6.27 an
onwards.
projects / thirdparty / xtables-addons.git / log
