aboutsummaryrefslogtreecommitdiffstats
path: root/main/linux-grsec
diff options
context:
space:
mode:
authorNatanael Copa <ncopa@alpinelinux.org>2011-04-04 08:20:39 +0000
committerNatanael Copa <ncopa@alpinelinux.org>2011-04-04 08:20:39 +0000
commita32f693958e666984f43724968338c14d189f102 (patch)
tree5d11e004f3dbf2f6d8bc3f9163891fddff494a87 /main/linux-grsec
parentc558cedf21428f8855fab4d5a6d92e25cd9c6034 (diff)
downloadaports-a32f693958e666984f43724968338c14d189f102.tar.bz2
aports-a32f693958e666984f43724968338c14d189f102.tar.xz
main/linux-grsec: fix for multicast
Diffstat (limited to 'main/linux-grsec')
-rw-r--r--main/linux-grsec/APKBUILD4
-rw-r--r--main/linux-grsec/net-gre-provide-multicast-mappings-for-ipv4-and-ipv6.patch98
2 files changed, 101 insertions, 1 deletions
diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 5a4a86f2c3..3e7a6bc50c 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -4,7 +4,7 @@ _flavor=grsec
pkgname=linux-${_flavor}
pkgver=2.6.38.2
_kernver=2.6.38
-pkgrel=2
+pkgrel=3
pkgdesc="Linux kernel with grsecurity"
url=http://grsecurity.net
depends="mkinitfs linux-firmware"
@@ -17,6 +17,7 @@ source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
grsecurity-2.2.2-2.6.38.2-201103281752.patch
0004-arp-flush-arp-cache-on-device-change.patch
+ net-gre-provide-multicast-mappings-for-ipv4-and-ipv6.patch
kernelconfig.x86
kernelconfig.x86_64
@@ -139,5 +140,6 @@ md5sums="7d471477bfa67546f902da62227fa976 linux-2.6.38.tar.bz2
599badab31c4920d4122133208c810d7 patch-2.6.38.2.bz2
fac4f5fb386192c544fae27db6db18a7 grsecurity-2.2.2-2.6.38.2-201103281752.patch
776adeeb5272093574f8836c5037dd7d 0004-arp-flush-arp-cache-on-device-change.patch
+aa1b82da0cabfb41c5e6da5bddf60bab net-gre-provide-multicast-mappings-for-ipv4-and-ipv6.patch
47ff0feca681cd53a037b7f5c9b46c3d kernelconfig.x86
2d70a4c38d97ca1a5280ca8d4e535628 kernelconfig.x86_64"
diff --git a/main/linux-grsec/net-gre-provide-multicast-mappings-for-ipv4-and-ipv6.patch b/main/linux-grsec/net-gre-provide-multicast-mappings-for-ipv4-and-ipv6.patch
new file mode 100644
index 0000000000..a9bff5dcfd
--- /dev/null
+++ b/main/linux-grsec/net-gre-provide-multicast-mappings-for-ipv4-and-ipv6.patch
@@ -0,0 +1,98 @@
+From: Timo Teräs <timo.teras@iki.fi>
+Date: Mon, 28 Mar 2011 22:40:53 +0000 (+0000)
+Subject: net: gre: provide multicast mappings for ipv4 and ipv6
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fdavem%2Fnet-2.6.git;a=commitdiff_plain;h=93ca3bb5df9bc8b2c60485e1cc6507c3d7c8e1fa
+
+net: gre: provide multicast mappings for ipv4 and ipv6
+
+My commit 6d55cb91a0020ac0 (gre: fix hard header destination
+address checking) broke multicast.
+
+The reason is that ip_gre used to get ipgre_header() calls with
+zero destination if we have NOARP or multicast destination. Instead
+the actual target was decided at ipgre_tunnel_xmit() time based on
+per-protocol dissection.
+
+Instead of allowing the "abuse" of ->header() calls with invalid
+destination, this creates multicast mappings for ip_gre. This also
+fixes "ip neigh show nud noarp" to display the proper multicast
+mappings used by the gre device.
+
+Reported-by: Doug Kehn <rdkehn@yahoo.com>
+Signed-off-by: Timo Teräs <timo.teras@iki.fi>
+Acked-by: Doug Kehn <rdkehn@yahoo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
+index 04977ee..fccc218 100644
+--- a/include/net/if_inet6.h
++++ b/include/net/if_inet6.h
+@@ -286,5 +286,21 @@ static inline void ipv6_ib_mc_map(const struct in6_addr *addr,
+ buf[9] = broadcast[9];
+ memcpy(buf + 10, addr->s6_addr + 6, 10);
+ }
++
++static inline int ipv6_ipgre_mc_map(const struct in6_addr *addr,
++ const unsigned char *broadcast, char *buf)
++{
++ if ((broadcast[0] | broadcast[1] | broadcast[2] | broadcast[3]) != 0) {
++ memcpy(buf, broadcast, 4);
++ } else {
++ /* v4mapped? */
++ if ((addr->s6_addr32[0] | addr->s6_addr32[1] |
++ (addr->s6_addr32[2] ^ htonl(0x0000ffff))) != 0)
++ return -EINVAL;
++ memcpy(buf, &addr->s6_addr32[3], 4);
++ }
++ return 0;
++}
++
+ #endif
+ #endif
+diff --git a/include/net/ip.h b/include/net/ip.h
+index a4f6311..7c41658 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -339,6 +339,14 @@ static inline void ip_ib_mc_map(__be32 naddr, const unsigned char *broadcast, ch
+ buf[16] = addr & 0x0f;
+ }
+
++static inline void ip_ipgre_mc_map(__be32 naddr, const unsigned char *broadcast, char *buf)
++{
++ if ((broadcast[0] | broadcast[1] | broadcast[2] | broadcast[3]) != 0)
++ memcpy(buf, broadcast, 4);
++ else
++ memcpy(buf, &naddr, sizeof(naddr));
++}
++
+ #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+ #include <linux/ipv6.h>
+ #endif
+diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
+index 090d273..1b74d3b 100644
+--- a/net/ipv4/arp.c
++++ b/net/ipv4/arp.c
+@@ -215,6 +215,9 @@ int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir)
+ case ARPHRD_INFINIBAND:
+ ip_ib_mc_map(addr, dev->broadcast, haddr);
+ return 0;
++ case ARPHRD_IPGRE:
++ ip_ipgre_mc_map(addr, dev->broadcast, haddr);
++ return 0;
+ default:
+ if (dir) {
+ memcpy(haddr, dev->broadcast, dev->addr_len);
+diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
+index 0e49c9d..92f952d 100644
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -341,6 +341,8 @@ int ndisc_mc_map(struct in6_addr *addr, char *buf, struct net_device *dev, int d
+ case ARPHRD_INFINIBAND:
+ ipv6_ib_mc_map(addr, dev->broadcast, buf);
+ return 0;
++ case ARPHRD_IPGRE:
++ return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
+ default:
+ if (dir) {
+ memcpy(buf, dev->broadcast, dev->addr_len);