From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 0/6] Netfilter fixes for net
Date: Mon, 9 Jul 2018 19:18:58 +0200 [thread overview]
Message-ID: <20180709171904.2460-1-pablo@netfilter.org> (raw)
Hi David,
The following patchset contains Netfilter fixes for your net tree:
1) Missing module autoloadfor icmp and icmpv6 x_tables matches,
from Florian Westphal.
2) Possible non-linear access to TCP header from tproxy, from
Mate Eckl.
3) Do not allow rbtree to be used for single elements, this patch
moves all set backend into one single module since such thing
can only happen if hashtable module is explicitly blacklisted,
which should not ever be done.
4) Reject error and standard targets from nft_compat for sanity
reasons, they are never used from there.
5) Don't crash on double hashsize module parameter, from Andrey
Ryabinin.
6) Drop dst on skb before placing it in the fragmentation
reassembly queue, from Florian Westphal.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit d461e3da905332189aad546b2ad9adbe6071c7cc:
smsc75xx: Add workaround for gigabit link up hardware errata. (2018-07-04 22:12:59 +0900)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 84379c9afe011020e797e3f50a662b08a6355dcf:
netfilter: ipv6: nf_defrag: drop skb dst before queueing (2018-07-09 18:04:12 +0200)
----------------------------------------------------------------
Andrey Ryabinin (1):
netfilter: nf_conntrack: Fix possible possible crash on module loading.
Florian Westphal (3):
netfilter: x_tables: set module owner for icmp(6) matches
netfilter: nft_compat: explicitly reject ERROR and standard target
netfilter: ipv6: nf_defrag: drop skb dst before queueing
Máté Eckl (1):
netfilter: nf_tproxy: fix possible non-linear access to transport header
Pablo Neira Ayuso (1):
netfilter: nf_tables: place all set backends in one single module
include/net/netfilter/nf_tables_core.h | 6 ++++++
include/net/netfilter/nf_tproxy.h | 4 ++--
net/ipv4/netfilter/ip_tables.c | 1 +
net/ipv4/netfilter/nf_tproxy_ipv4.c | 18 ++++++++++++------
net/ipv6/netfilter/ip6_tables.c | 1 +
net/ipv6/netfilter/nf_conntrack_reasm.c | 2 ++
net/ipv6/netfilter/nf_tproxy_ipv6.c | 18 ++++++++++++------
net/netfilter/Kconfig | 25 +++++++------------------
net/netfilter/Makefile | 7 ++++---
net/netfilter/nf_conntrack_core.c | 2 +-
net/netfilter/nf_tables_set_core.c | 28 ++++++++++++++++++++++++++++
net/netfilter/nft_compat.c | 13 +++++++++++++
net/netfilter/nft_set_bitmap.c | 19 +------------------
net/netfilter/nft_set_hash.c | 29 +++--------------------------
net/netfilter/nft_set_rbtree.c | 19 +------------------
net/netfilter/xt_TPROXY.c | 8 ++++----
16 files changed, 98 insertions(+), 102 deletions(-)
create mode 100644 net/netfilter/nf_tables_set_core.c
next reply other threads:[~2018-07-09 17:18 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-09 17:18 Pablo Neira Ayuso [this message]
2018-07-09 17:18 ` [PATCH 1/6] netfilter: x_tables: set module owner for icmp(6) matches Pablo Neira Ayuso
2018-07-09 17:19 ` [PATCH 2/6] netfilter: nf_tproxy: fix possible non-linear access to transport header Pablo Neira Ayuso
2018-07-09 17:19 ` [PATCH 3/6] netfilter: nf_tables: place all set backends in one single module Pablo Neira Ayuso
2018-07-09 17:19 ` [PATCH 4/6] netfilter: nft_compat: explicitly reject ERROR and standard target Pablo Neira Ayuso
2018-07-09 17:19 ` [PATCH 5/6] netfilter: nf_conntrack: Fix possible possible crash on module loading Pablo Neira Ayuso
2018-07-09 17:19 ` [PATCH 6/6] netfilter: ipv6: nf_defrag: drop skb dst before queueing Pablo Neira Ayuso
2018-07-09 21:24 ` [PATCH 0/6] Netfilter fixes for net David Miller
-- strict thread matches above, loose matches on Subject: below --
2020-08-24 11:39 Pablo Neira Ayuso
2020-08-24 13:37 ` David Miller
2020-05-14 12:19 Pablo Neira Ayuso
2020-05-14 20:15 ` David Miller
2020-02-26 22:54 Pablo Neira Ayuso
2020-02-27 0:32 ` David Miller
2020-01-31 19:24 Pablo Neira Ayuso
2020-02-01 20:59 ` Jakub Kicinski
2019-02-05 19:04 Pablo Neira Ayuso
2019-02-05 19:23 ` David Miller
2018-10-01 22:37 Pablo Neira Ayuso
2018-10-01 22:41 ` David Miller
2018-06-27 15:22 Pablo Neira Ayuso
2018-06-28 4:33 ` David Miller
2018-02-01 18:02 Pablo Neira Ayuso
2018-02-01 19:45 ` David Miller
2017-02-27 11:35 Pablo Neira Ayuso
2017-02-27 14:19 ` David Miller
2017-01-05 11:19 Pablo Neira Ayuso
2017-01-05 16:52 ` David Miller
2016-08-18 17:29 Pablo Neira Ayuso
2016-08-19 1:49 ` David Miller
2016-02-16 17:02 Pablo Neira Ayuso
2016-02-16 17:56 ` David Miller
2016-01-20 17:03 Pablo Neira Ayuso
2016-01-21 2:57 ` David Miller
2015-12-14 11:25 [PATCH 0/6] netfilter " Pablo Neira Ayuso
2015-12-14 16:09 ` David Miller
2015-09-03 9:50 [PATCH 0/6] Netfilter " Pablo Neira Ayuso
2015-09-06 4:59 ` David Miller
2015-03-22 18:46 Pablo Neira Ayuso
2015-03-22 20:57 ` David Miller
2014-05-09 10:56 Pablo Neira Ayuso
2014-05-09 17:17 ` David Miller
2014-02-19 11:41 Pablo Neira Ayuso
2014-02-19 18:16 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180709171904.2460-1-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).