angler-fishThe Vulnerability History Project

[NETFILTER]: Introduce NF_INET_ hook values

      The IPv4 and IPv6 hook values are identical, yet some code tries to figure
out the "correct" value by looking at the address family. Introduce NF_INET_*
values for both IPv4 and IPv6. The old values are kept in a #ifndef __KERNEL__
section for userspace compatibility.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
by Billie the Angelfish 2007-11-20 02:53:30 UTC
commit 6e23ae2a48750bda407a4a58f52a4865d7308bf5
Linux Kernel VCC CVE-2021-22555
include/linux/netfilter.h
-9
include/linux/netfilter/x_tables.h
+2 -2
include/linux/netfilter_ipv4.h
+1 -1
include/linux/netfilter_ipv4/ip_tables.h
+4 -4
include/linux/netfilter_ipv6.h
+2 -1
include/linux/netfilter_ipv6/ip6_tables.h
+4 -4
include/net/netfilter/nf_nat.h
+1 -2
net/bridge/br_netfilter.c
+6 -6
net/compat.c
+3 -3
net/ipv4/ip_forward.c
+1 -1
net/ipv4/ip_input.c
+2 -2
net/ipv4/ip_output.c
+6 -6
net/ipv4/ipmr.c
+1 -1
net/ipv4/ipvs/ip_vs_core.c
+9 -9
net/ipv4/ipvs/ip_vs_xmit.c
+1 -1
net/ipv4/netfilter.c
+4 -4
net/ipv4/netfilter/ip_tables.c
+22 -22
net/ipv4/netfilter/ipt_MASQUERADE.c
+2 -2
net/ipv4/netfilter/ipt_NETMAP.c
+6 -7
net/ipv4/netfilter/ipt_REDIRECT.c
+4 -4
net/ipv4/netfilter/ipt_REJECT.c
+3 -3
net/ipv4/netfilter/ipt_SAME.c
+3 -4
net/ipv4/netfilter/ipt_owner.c
+1 -2
net/ipv4/netfilter/iptable_filter.c
+10 -12
net/ipv4/netfilter/iptable_mangle.c
+20 -20
net/ipv4/netfilter/iptable_raw.c
+7 -7
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+9 -9
net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+1 -1
net/ipv4/netfilter/nf_nat_core.c
+7 -7
net/ipv4/netfilter/nf_nat_h323.c
+4 -4
net/ipv4/netfilter/nf_nat_helper.c
+2 -2
net/ipv4/netfilter/nf_nat_pptp.c
+2 -2
net/ipv4/netfilter/nf_nat_rule.c
+13 -15
net/ipv4/netfilter/nf_nat_sip.c
+2 -2
net/ipv4/netfilter/nf_nat_standalone.c
+7 -7
net/ipv4/raw.c
+1 -1
net/ipv4/xfrm4_input.c
+1 -1
net/ipv4/xfrm4_output.c
+2 -2
net/ipv4/xfrm4_state.c
+1 -1
net/ipv6/ip6_input.c
+2 -4
net/ipv6/ip6_output.c
+6 -8
net/ipv6/mcast.c
+3 -3
net/ipv6/ndisc.c
+2 -4
net/ipv6/netfilter.c
+3 -3
net/ipv6/netfilter/ip6_tables.c
+13 -13
net/ipv6/netfilter/ip6t_REJECT.c
+3 -3
net/ipv6/netfilter/ip6t_eui64.c
+2 -2
net/ipv6/netfilter/ip6t_owner.c
+1 -2
net/ipv6/netfilter/ip6table_filter.c
+10 -12
net/ipv6/netfilter/ip6table_mangle.c
+20 -20
net/ipv6/netfilter/ip6table_raw.c
+7 -7
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+6 -6
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+1 -1
net/ipv6/raw.c
+1 -1
net/ipv6/xfrm6_input.c
+1 -1
net/ipv6/xfrm6_output.c
+1 -1
net/ipv6/xfrm6_state.c
+1 -1
net/netfilter/nf_conntrack_netlink.c
+4 -4
net/netfilter/nf_conntrack_proto_tcp.c
+3 -1
net/netfilter/nf_conntrack_proto_udp.c
+3 -1
net/netfilter/nf_conntrack_proto_udplite.c
+2 -1
net/netfilter/xt_CLASSIFY.c
+6 -6
net/netfilter/xt_TCPMSS.c
+6 -6
net/netfilter/xt_mac.c
+6 -6
net/netfilter/xt_physdev.c
+3 -3
net/netfilter/xt_policy.c
+3 -2
net/netfilter/xt_realm.c
+2 -2
net/sched/sch_ingress.c
+2 -2
security/selinux/hooks.c
+2 -2
expand_less