From: Sapan Bhatia Date: Wed, 30 Jul 2008 18:28:02 +0000 (+0000) Subject: Unbroke peercred-setting. I forgot that a uid that equals -1 is actually > 0. X-Git-Tag: linux-2.6-22-19~2 X-Git-Url: http://git.onelab.eu/?p=linux-2.6.git;a=commitdiff_plain;h=e44cdf7cfc8d56aad7ace7aacbc7c20efc8c5f14 Unbroke peercred-setting. I forgot that a uid that equals -1 is actually > 0. --- diff --git a/linux-2.6-522-iptables-connection-tagging.patch b/linux-2.6-522-iptables-connection-tagging.patch index 6011425b1..802a6cafb 100644 --- a/linux-2.6-522-iptables-connection-tagging.patch +++ b/linux-2.6-522-iptables-connection-tagging.patch @@ -1,6 +1,6 @@ diff -Nurb linux-2.6.22-521/include/linux/netfilter/xt_MARK.h linux-2.6.22-522/include/linux/netfilter/xt_MARK.h --- linux-2.6.22-521/include/linux/netfilter/xt_MARK.h 2007-07-08 19:32:17.000000000 -0400 -+++ linux-2.6.22-522/include/linux/netfilter/xt_MARK.h 2008-07-27 22:06:25.000000000 -0400 ++++ linux-2.6.22-522/include/linux/netfilter/xt_MARK.h 2008-07-28 16:36:24.000000000 -0400 @@ -11,6 +11,7 @@ XT_MARK_SET=0, XT_MARK_AND, @@ -11,7 +11,7 @@ diff -Nurb linux-2.6.22-521/include/linux/netfilter/xt_MARK.h linux-2.6.22-522/i struct xt_mark_target_info_v1 { diff -Nurb linux-2.6.22-521/include/linux/netfilter/xt_SETXID.h linux-2.6.22-522/include/linux/netfilter/xt_SETXID.h --- linux-2.6.22-521/include/linux/netfilter/xt_SETXID.h 1969-12-31 19:00:00.000000000 -0500 -+++ linux-2.6.22-522/include/linux/netfilter/xt_SETXID.h 2008-07-27 22:06:25.000000000 -0400 ++++ linux-2.6.22-522/include/linux/netfilter/xt_SETXID.h 2008-07-28 16:36:24.000000000 -0400 @@ -0,0 +1,14 @@ +#ifndef _XT_SETXID_H_target +#define _XT_SETXID_H_target @@ -29,7 +29,7 @@ diff -Nurb linux-2.6.22-521/include/linux/netfilter/xt_SETXID.h linux-2.6.22-522 +#endif /*_XT_SETXID_H_target*/ diff -Nurb linux-2.6.22-521/include/linux/netfilter_ipv4/ipt_MARK.h linux-2.6.22-522/include/linux/netfilter_ipv4/ipt_MARK.h --- linux-2.6.22-521/include/linux/netfilter_ipv4/ipt_MARK.h 2007-07-08 19:32:17.000000000 -0400 -+++ linux-2.6.22-522/include/linux/netfilter_ipv4/ipt_MARK.h 2008-07-27 22:06:25.000000000 -0400 ++++ linux-2.6.22-522/include/linux/netfilter_ipv4/ipt_MARK.h 2008-07-28 16:36:24.000000000 -0400 @@ -12,6 +12,7 @@ #define IPT_MARK_SET XT_MARK_SET #define IPT_MARK_AND XT_MARK_AND @@ -40,7 +40,7 @@ diff -Nurb linux-2.6.22-521/include/linux/netfilter_ipv4/ipt_MARK.h linux-2.6.22 diff -Nurb linux-2.6.22-521/include/linux/netfilter_ipv4/ipt_SETXID.h linux-2.6.22-522/include/linux/netfilter_ipv4/ipt_SETXID.h --- linux-2.6.22-521/include/linux/netfilter_ipv4/ipt_SETXID.h 1969-12-31 19:00:00.000000000 -0500 -+++ linux-2.6.22-522/include/linux/netfilter_ipv4/ipt_SETXID.h 2008-07-27 22:06:25.000000000 -0400 ++++ linux-2.6.22-522/include/linux/netfilter_ipv4/ipt_SETXID.h 2008-07-28 16:36:24.000000000 -0400 @@ -0,0 +1,13 @@ +#ifndef _IPT_SETXID_H_target +#define _IPT_SETXID_H_target @@ -57,7 +57,7 @@ diff -Nurb linux-2.6.22-521/include/linux/netfilter_ipv4/ipt_SETXID.h linux-2.6. +#endif /*_IPT_SETXID_H_target*/ diff -Nurb linux-2.6.22-521/include/net/netfilter/nf_conntrack.h linux-2.6.22-522/include/net/netfilter/nf_conntrack.h --- linux-2.6.22-521/include/net/netfilter/nf_conntrack.h 2007-07-08 19:32:17.000000000 -0400 -+++ linux-2.6.22-522/include/net/netfilter/nf_conntrack.h 2008-07-27 22:06:25.000000000 -0400 ++++ linux-2.6.22-522/include/net/netfilter/nf_conntrack.h 2008-07-28 16:36:24.000000000 -0400 @@ -131,6 +131,9 @@ /* Storage reserved for other modules: */ union nf_conntrack_proto proto; @@ -70,7 +70,7 @@ diff -Nurb linux-2.6.22-521/include/net/netfilter/nf_conntrack.h linux-2.6.22-52 }; diff -Nurb linux-2.6.22-521/net/netfilter/Kconfig linux-2.6.22-522/net/netfilter/Kconfig --- linux-2.6.22-521/net/netfilter/Kconfig 2007-07-08 19:32:17.000000000 -0400 -+++ linux-2.6.22-522/net/netfilter/Kconfig 2008-07-27 22:06:25.000000000 -0400 ++++ linux-2.6.22-522/net/netfilter/Kconfig 2008-07-28 16:36:24.000000000 -0400 @@ -389,6 +389,13 @@ To compile it as a module, choose M here. If unsure, say N. @@ -87,7 +87,7 @@ diff -Nurb linux-2.6.22-521/net/netfilter/Kconfig linux-2.6.22-522/net/netfilter depends on NETFILTER_XTABLES diff -Nurb linux-2.6.22-521/net/netfilter/Makefile linux-2.6.22-522/net/netfilter/Makefile --- linux-2.6.22-521/net/netfilter/Makefile 2007-07-08 19:32:17.000000000 -0400 -+++ linux-2.6.22-522/net/netfilter/Makefile 2008-07-27 22:06:25.000000000 -0400 ++++ linux-2.6.22-522/net/netfilter/Makefile 2008-07-28 16:36:24.000000000 -0400 @@ -37,6 +37,7 @@ obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o @@ -98,7 +98,7 @@ diff -Nurb linux-2.6.22-521/net/netfilter/Makefile linux-2.6.22-522/net/netfilte obj-$(CONFIG_NETFILTER_XT_TARGET_DSCP) += xt_DSCP.o diff -Nurb linux-2.6.22-521/net/netfilter/nf_conntrack_core.c linux-2.6.22-522/net/netfilter/nf_conntrack_core.c --- linux-2.6.22-521/net/netfilter/nf_conntrack_core.c 2007-07-08 19:32:17.000000000 -0400 -+++ linux-2.6.22-522/net/netfilter/nf_conntrack_core.c 2008-07-27 22:06:25.000000000 -0400 ++++ linux-2.6.22-522/net/netfilter/nf_conntrack_core.c 2008-07-28 16:36:24.000000000 -0400 @@ -726,6 +726,8 @@ /* Overload tuple linked list to put us in unconfirmed list. */ @@ -110,7 +110,7 @@ diff -Nurb linux-2.6.22-521/net/netfilter/nf_conntrack_core.c linux-2.6.22-522/n diff -Nurb linux-2.6.22-521/net/netfilter/xt_MARK.c linux-2.6.22-522/net/netfilter/xt_MARK.c --- linux-2.6.22-521/net/netfilter/xt_MARK.c 2007-07-08 19:32:17.000000000 -0400 -+++ linux-2.6.22-522/net/netfilter/xt_MARK.c 2008-07-28 16:21:20.000000000 -0400 ++++ linux-2.6.22-522/net/netfilter/xt_MARK.c 2008-07-30 14:28:03.000000000 -0400 @@ -5,13 +5,18 @@ * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as @@ -212,7 +212,7 @@ diff -Nurb linux-2.6.22-521/net/netfilter/xt_MARK.c linux-2.6.22-522/net/netfilt switch (markinfo->mode) { case XT_MARK_SET: -@@ -58,13 +122,102 @@ +@@ -58,13 +122,103 @@ case XT_MARK_OR: mark = (*pskb)->mark | markinfo->mark; break; @@ -255,12 +255,13 @@ diff -Nurb linux-2.6.22-521/net/netfilter/xt_MARK.c linux-2.6.22-522/net/netfilt + + + if (connection_sk /* Well, some kind of TCP socket */) { -+ if (connection_sk->sk_peercred.uid < 1) { ++ if (connection_sk->sk_peercred.uid == 0 || connection_sk->sk_peercred.uid == (__u32) -1) { + /* Normal case - the peercred on the socket is not set */ + connection_sk->sk_peercred.gid = connection_sk->sk_peercred.uid = ct->xid[!dir]; ++ printk(KERN_CRIT "Setting peercred to %d\n",connection_sk->sk_peercred.uid); + } + else /* Exceptional case - the peercred was set using SET_PEERCRED. Somebody wants us -+ to mark packets with some arbitrary value.*/ ++ to mark packets with some arbitrary value.*/ + mark=connection_sk->sk_peercred.uid; + + /* Has this connection already been tagged? */ @@ -272,7 +273,7 @@ diff -Nurb linux-2.6.22-521/net/netfilter/xt_MARK.c linux-2.6.22-522/net/netfilt + if (mark==-1 && (connection_sk->sk_nid != 0)) + mark = ct->xid[dir]; + -+ ++ + if (connection_sk->sk_state == TCP_TIME_WAIT) { + inet_twsk_put(inet_twsk(connection_sk)); + break; @@ -283,7 +284,7 @@ diff -Nurb linux-2.6.22-521/net/netfilter/xt_MARK.c linux-2.6.22-522/net/netfilt + + /* Covers CoDemux case */ + if (mark < 1 && (ct->xid[dir]>0)) { -+ mark = ct->xid[dir]; ++ mark = ct->xid[dir]; } + if (mark < 1 && (ct->xid[!dir]>0)) { @@ -316,7 +317,7 @@ diff -Nurb linux-2.6.22-521/net/netfilter/xt_MARK.c linux-2.6.22-522/net/netfilt static int checkentry_v0(const char *tablename, const void *entry, -@@ -92,7 +245,8 @@ +@@ -92,7 +246,8 @@ if (markinfo->mode != XT_MARK_SET && markinfo->mode != XT_MARK_AND @@ -328,7 +329,7 @@ diff -Nurb linux-2.6.22-521/net/netfilter/xt_MARK.c linux-2.6.22-522/net/netfilt return 0; diff -Nurb linux-2.6.22-521/net/netfilter/xt_SETXID.c linux-2.6.22-522/net/netfilter/xt_SETXID.c --- linux-2.6.22-521/net/netfilter/xt_SETXID.c 1969-12-31 19:00:00.000000000 -0500 -+++ linux-2.6.22-522/net/netfilter/xt_SETXID.c 2008-07-27 22:06:25.000000000 -0400 ++++ linux-2.6.22-522/net/netfilter/xt_SETXID.c 2008-07-28 16:36:24.000000000 -0400 @@ -0,0 +1,79 @@ +#include +#include diff --git a/linux-2.6-526-tun-tap.patch b/linux-2.6-526-tun-tap.patch index cfc495404..1b13d0369 100644 --- a/linux-2.6-526-tun-tap.patch +++ b/linux-2.6-526-tun-tap.patch @@ -103,7 +103,7 @@ diff -Nurb linux-2.6.22-525/drivers/net/vnet_tun.c linux-2.6.22-526/drivers/net/ + else { + if (in_interrupt() && print_once) { + print_once=0; -+ printk(KERN_EMERG "vnet_tun: get-sk_xid called in interrupt context!\n"); ++ printk(KERN_EMERG "vnet_tun: get-sk_xid called in interrupt context! Stephen: Don't Panic.\n"); + } + return current->xid; + }