* [PATCH 0/4] Netfilter fixes for net
@ 2015-05-16 18:47 Pablo Neira Ayuso
2015-05-16 18:47 ` [PATCH 1/4] ipvs: fix memory leak in ip_vs_ctl.c Pablo Neira Ayuso
` (4 more replies)
0 siblings, 5 replies; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-05-16 18:47 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for your net tree, they are:
1) Fix a leak in IPVS, the sysctl table is not released accordingly when
destroying a netns, patch from Tommi Rantala.
2) Fix a build error when TPROXY and socket are built-in but IPv6 defrag is
compiled as module, from Florian Westphal.
3) Fix TCP tracket wrt. RFC5961 challenge ACK when in LAST_ACK state, patch
from Jesper Dangaard Brouer.
4) Fix a bogus WARN_ON() in nf_tables when deleting a set element that stores
a map, from Mirek Kratochvil.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 39376ccb1968ba9f83e2a880a8bf02ad5dea44e1:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf (2015-04-27 23:12:34 -0400)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
for you to fetch changes up to 960bd2c26421d321e890f1936938196ead41976f:
netfilter: nf_tables: fix bogus warning in nft_data_uninit() (2015-05-15 22:07:30 +0200)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m
Jesper Dangaard Brouer (1):
conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition
Mirek Kratochvil (1):
netfilter: nf_tables: fix bogus warning in nft_data_uninit()
Tommi Rantala (1):
ipvs: fix memory leak in ip_vs_ctl.c
include/uapi/linux/netfilter/nf_conntrack_tcp.h | 3 ++
net/netfilter/Kconfig | 2 ++
net/netfilter/ipvs/ip_vs_ctl.c | 3 ++
net/netfilter/nf_conntrack_proto_tcp.c | 35 +++++++++++++++++++++--
net/netfilter/nf_tables_api.c | 4 +--
5 files changed, 42 insertions(+), 5 deletions(-)
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH 1/4] ipvs: fix memory leak in ip_vs_ctl.c
2015-05-16 18:47 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
@ 2015-05-16 18:47 ` Pablo Neira Ayuso
2015-05-16 18:47 ` [PATCH 2/4] netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m Pablo Neira Ayuso
` (3 subsequent siblings)
4 siblings, 0 replies; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-05-16 18:47 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Tommi Rantala <tt.rantala@gmail.com>
Fix memory leak introduced in commit a0840e2e165a ("IPVS: netns,
ip_vs_ctl local vars moved to ipvs struct."):
unreferenced object 0xffff88005785b800 (size 2048):
comm "(-localed)", pid 1434, jiffies 4294755650 (age 1421.089s)
hex dump (first 32 bytes):
bb 89 0b 83 ff ff ff ff b0 78 f0 4e 00 88 ff ff .........x.N....
04 00 00 00 a4 01 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8262ea8e>] kmemleak_alloc+0x4e/0xb0
[<ffffffff811fba74>] __kmalloc_track_caller+0x244/0x430
[<ffffffff811b88a0>] kmemdup+0x20/0x50
[<ffffffff823276b7>] ip_vs_control_net_init+0x1f7/0x510
[<ffffffff8231d630>] __ip_vs_init+0x100/0x250
[<ffffffff822363a1>] ops_init+0x41/0x190
[<ffffffff82236583>] setup_net+0x93/0x150
[<ffffffff82236cc2>] copy_net_ns+0x82/0x140
[<ffffffff810ab13d>] create_new_namespaces+0xfd/0x190
[<ffffffff810ab49a>] unshare_nsproxy_namespaces+0x5a/0xc0
[<ffffffff810833e3>] SyS_unshare+0x173/0x310
[<ffffffff8265cbd7>] system_call_fastpath+0x12/0x6f
[<ffffffffffffffff>] 0xffffffffffffffff
Fixes: a0840e2e165a ("IPVS: netns, ip_vs_ctl local vars moved to ipvs struct.")
Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
---
net/netfilter/ipvs/ip_vs_ctl.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 4953267..285eae3 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3823,6 +3823,9 @@ static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
cancel_work_sync(&ipvs->defense_work.work);
unregister_net_sysctl_table(ipvs->sysctl_hdr);
ip_vs_stop_estimator(net, &ipvs->tot_stats);
+
+ if (!net_eq(net, &init_net))
+ kfree(ipvs->sysctl_tbl);
}
#else
--
1.7.10.4
^ permalink raw reply related [flat|nested] 31+ messages in thread
* [PATCH 2/4] netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m
2015-05-16 18:47 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
2015-05-16 18:47 ` [PATCH 1/4] ipvs: fix memory leak in ip_vs_ctl.c Pablo Neira Ayuso
@ 2015-05-16 18:47 ` Pablo Neira Ayuso
2015-05-16 19:07 ` Sergei Shtylyov
2015-05-16 18:47 ` [PATCH 3/4] conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition Pablo Neira Ayuso
` (2 subsequent siblings)
4 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-05-16 18:47 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Florian Westphal <fw@strlen.de>
With TPROXY=y but DEFRAG_IPV6=m we get build failure:
net/built-in.o: In function `tproxy_tg_init':
net/netfilter/xt_TPROXY.c:588: undefined reference to `nf_defrag_ipv6_enable'
If DEFRAG_IPV6 is modular, TPROXY must be too.
(or both must be builtin).
This enforces =m for both.
Reported-and-tested-by: Liu Hua <liusdu@126.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/Kconfig | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index f70e34a..a0f3e6a3 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -863,6 +863,7 @@ config NETFILTER_XT_TARGET_TPROXY
depends on NETFILTER_XTABLES
depends on NETFILTER_ADVANCED
depends on (IPV6 || IPV6=n)
+ depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
depends on IP_NF_MANGLE
select NF_DEFRAG_IPV4
select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
@@ -1356,6 +1357,7 @@ config NETFILTER_XT_MATCH_SOCKET
depends on NETFILTER_ADVANCED
depends on !NF_CONNTRACK || NF_CONNTRACK
depends on (IPV6 || IPV6=n)
+ depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
select NF_DEFRAG_IPV4
select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
help
--
1.7.10.4
^ permalink raw reply related [flat|nested] 31+ messages in thread
* Re: [PATCH 2/4] netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m
2015-05-16 18:47 ` [PATCH 2/4] netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m Pablo Neira Ayuso
@ 2015-05-16 19:07 ` Sergei Shtylyov
2015-05-16 19:24 ` Pablo Neira Ayuso
0 siblings, 1 reply; 31+ messages in thread
From: Sergei Shtylyov @ 2015-05-16 19:07 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel; +Cc: davem, netdev
Hello.
On 05/16/2015 09:47 PM, Pablo Neira Ayuso wrote:
> From: Florian Westphal <fw@strlen.de>
> With TPROXY=y but DEFRAG_IPV6=m we get build failure:
> net/built-in.o: In function `tproxy_tg_init':
> net/netfilter/xt_TPROXY.c:588: undefined reference to `nf_defrag_ipv6_enable'
> If DEFRAG_IPV6 is modular, TPROXY must be too.
> (or both must be builtin).
> This enforces =m for both.
> Reported-and-tested-by: Liu Hua <liusdu@126.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
> net/netfilter/Kconfig | 2 ++
> 1 file changed, 2 insertions(+)
> diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
> index f70e34a..a0f3e6a3 100644
> --- a/net/netfilter/Kconfig
> +++ b/net/netfilter/Kconfig
> @@ -863,6 +863,7 @@ config NETFILTER_XT_TARGET_TPROXY
> depends on NETFILTER_XTABLES
> depends on NETFILTER_ADVANCED
> depends on (IPV6 || IPV6=n)
> + depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
> depends on IP_NF_MANGLE
> select NF_DEFRAG_IPV4
> select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
> @@ -1356,6 +1357,7 @@ config NETFILTER_XT_MATCH_SOCKET
> depends on NETFILTER_ADVANCED
> depends on !NF_CONNTRACK || NF_CONNTRACK
> depends on (IPV6 || IPV6=n)
> + depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
Parens not needed here and in the previous hunk.
WBR, Sergei
^ permalink raw reply [flat|nested] 31+ messages in thread
* Re: [PATCH 2/4] netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m
2015-05-16 19:07 ` Sergei Shtylyov
@ 2015-05-16 19:24 ` Pablo Neira Ayuso
0 siblings, 0 replies; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-05-16 19:24 UTC (permalink / raw)
To: Sergei Shtylyov; +Cc: netfilter-devel, davem, netdev
On Sat, May 16, 2015 at 10:07:27PM +0300, Sergei Shtylyov wrote:
> Hello.
>
> On 05/16/2015 09:47 PM, Pablo Neira Ayuso wrote:
>
> >From: Florian Westphal <fw@strlen.de>
>
> >With TPROXY=y but DEFRAG_IPV6=m we get build failure:
>
> >net/built-in.o: In function `tproxy_tg_init':
> >net/netfilter/xt_TPROXY.c:588: undefined reference to `nf_defrag_ipv6_enable'
>
> >If DEFRAG_IPV6 is modular, TPROXY must be too.
> >(or both must be builtin).
>
> >This enforces =m for both.
>
> >Reported-and-tested-by: Liu Hua <liusdu@126.com>
> >Signed-off-by: Florian Westphal <fw@strlen.de>
> >Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> >---
> > net/netfilter/Kconfig | 2 ++
> > 1 file changed, 2 insertions(+)
>
> >diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
> >index f70e34a..a0f3e6a3 100644
> >--- a/net/netfilter/Kconfig
> >+++ b/net/netfilter/Kconfig
> >@@ -863,6 +863,7 @@ config NETFILTER_XT_TARGET_TPROXY
> > depends on NETFILTER_XTABLES
> > depends on NETFILTER_ADVANCED
> > depends on (IPV6 || IPV6=n)
> >+ depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
> > depends on IP_NF_MANGLE
> > select NF_DEFRAG_IPV4
> > select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
> >@@ -1356,6 +1357,7 @@ config NETFILTER_XT_MATCH_SOCKET
> > depends on NETFILTER_ADVANCED
> > depends on !NF_CONNTRACK || NF_CONNTRACK
> > depends on (IPV6 || IPV6=n)
> >+ depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
>
> Parens not needed here and in the previous hunk.
OK, but we've been using parens in quite many other spots in the
Netfilter Kconfig files. So if you don't mind, we'll send follow up
large patch to sort out this for net-next.
Thank you.
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH 3/4] conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition
2015-05-16 18:47 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
2015-05-16 18:47 ` [PATCH 1/4] ipvs: fix memory leak in ip_vs_ctl.c Pablo Neira Ayuso
2015-05-16 18:47 ` [PATCH 2/4] netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m Pablo Neira Ayuso
@ 2015-05-16 18:47 ` Pablo Neira Ayuso
2015-05-16 18:47 ` [PATCH 4/4] netfilter: nf_tables: fix bogus warning in nft_data_uninit() Pablo Neira Ayuso
2015-05-16 20:45 ` [PATCH 0/4] Netfilter fixes for net David Miller
4 siblings, 0 replies; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-05-16 18:47 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Jesper Dangaard Brouer <brouer@redhat.com>
In compliance with RFC5961, the network stack send challenge ACK in
response to spurious SYN packets, since commit 0c228e833c88 ("tcp:
Restore RFC5961-compliant behavior for SYN packets").
This pose a problem for netfilter conntrack in state LAST_ACK, because
this challenge ACK is (falsely) seen as ACKing last FIN, causing a
false state transition (into TIME_WAIT).
The challenge ACK is hard to distinguish from real last ACK. Thus,
solution introduce a flag that tracks the potential for seeing a
challenge ACK, in case a SYN packet is let through and current state
is LAST_ACK.
When conntrack transition LAST_ACK to TIME_WAIT happens, this flag is
used for determining if we are expecting a challenge ACK.
Scapy based reproducer script avail here:
https://github.com/netoptimizer/network-testing/blob/master/scapy/tcp_hacks_3WHS_LAST_ACK.py
Fixes: 0c228e833c88 ("tcp: Restore RFC5961-compliant behavior for SYN packets")
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/uapi/linux/netfilter/nf_conntrack_tcp.h | 3 ++
net/netfilter/nf_conntrack_proto_tcp.c | 35 +++++++++++++++++++++--
2 files changed, 35 insertions(+), 3 deletions(-)
diff --git a/include/uapi/linux/netfilter/nf_conntrack_tcp.h b/include/uapi/linux/netfilter/nf_conntrack_tcp.h
index 9993a42..ef9f80f 100644
--- a/include/uapi/linux/netfilter/nf_conntrack_tcp.h
+++ b/include/uapi/linux/netfilter/nf_conntrack_tcp.h
@@ -42,6 +42,9 @@ enum tcp_conntrack {
/* The field td_maxack has been set */
#define IP_CT_TCP_FLAG_MAXACK_SET 0x20
+/* Marks possibility for expected RFC5961 challenge ACK */
+#define IP_CT_EXP_CHALLENGE_ACK 0x40
+
struct nf_ct_tcp_flags {
__u8 flags;
__u8 mask;
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 5caa0c4..70383de 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -202,7 +202,7 @@ static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
* sES -> sES :-)
* sFW -> sCW Normal close request answered by ACK.
* sCW -> sCW
- * sLA -> sTW Last ACK detected.
+ * sLA -> sTW Last ACK detected (RFC5961 challenged)
* sTW -> sTW Retransmitted last ACK. Remain in the same state.
* sCL -> sCL
*/
@@ -261,7 +261,7 @@ static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
* sES -> sES :-)
* sFW -> sCW Normal close request answered by ACK.
* sCW -> sCW
- * sLA -> sTW Last ACK detected.
+ * sLA -> sTW Last ACK detected (RFC5961 challenged)
* sTW -> sTW Retransmitted last ACK.
* sCL -> sCL
*/
@@ -906,6 +906,7 @@ static int tcp_packet(struct nf_conn *ct,
1 : ct->proto.tcp.last_win;
ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_scale =
ct->proto.tcp.last_wscale;
+ ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
ct->proto.tcp.last_flags;
memset(&ct->proto.tcp.seen[dir], 0,
@@ -923,7 +924,9 @@ static int tcp_packet(struct nf_conn *ct,
* may be in sync but we are not. In that case, we annotate
* the TCP options and let the packet go through. If it is a
* valid SYN packet, the server will reply with a SYN/ACK, and
- * then we'll get in sync. Otherwise, the server ignores it. */
+ * then we'll get in sync. Otherwise, the server potentially
+ * responds with a challenge ACK if implementing RFC5961.
+ */
if (index == TCP_SYN_SET && dir == IP_CT_DIR_ORIGINAL) {
struct ip_ct_tcp_state seen = {};
@@ -939,6 +942,13 @@ static int tcp_packet(struct nf_conn *ct,
ct->proto.tcp.last_flags |=
IP_CT_TCP_FLAG_SACK_PERM;
}
+ /* Mark the potential for RFC5961 challenge ACK,
+ * this pose a special problem for LAST_ACK state
+ * as ACK is intrepretated as ACKing last FIN.
+ */
+ if (old_state == TCP_CONNTRACK_LAST_ACK)
+ ct->proto.tcp.last_flags |=
+ IP_CT_EXP_CHALLENGE_ACK;
}
spin_unlock_bh(&ct->lock);
if (LOG_INVALID(net, IPPROTO_TCP))
@@ -970,6 +980,25 @@ static int tcp_packet(struct nf_conn *ct,
nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
"nf_ct_tcp: invalid state ");
return -NF_ACCEPT;
+ case TCP_CONNTRACK_TIME_WAIT:
+ /* RFC5961 compliance cause stack to send "challenge-ACK"
+ * e.g. in response to spurious SYNs. Conntrack MUST
+ * not believe this ACK is acking last FIN.
+ */
+ if (old_state == TCP_CONNTRACK_LAST_ACK &&
+ index == TCP_ACK_SET &&
+ ct->proto.tcp.last_dir != dir &&
+ ct->proto.tcp.last_index == TCP_SYN_SET &&
+ (ct->proto.tcp.last_flags & IP_CT_EXP_CHALLENGE_ACK)) {
+ /* Detected RFC5961 challenge ACK */
+ ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
+ spin_unlock_bh(&ct->lock);
+ if (LOG_INVALID(net, IPPROTO_TCP))
+ nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
+ "nf_ct_tcp: challenge-ACK ignored ");
+ return NF_ACCEPT; /* Don't change state */
+ }
+ break;
case TCP_CONNTRACK_CLOSE:
if (index == TCP_RST_SET
&& (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)
--
1.7.10.4
^ permalink raw reply related [flat|nested] 31+ messages in thread
* [PATCH 4/4] netfilter: nf_tables: fix bogus warning in nft_data_uninit()
2015-05-16 18:47 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
` (2 preceding siblings ...)
2015-05-16 18:47 ` [PATCH 3/4] conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition Pablo Neira Ayuso
@ 2015-05-16 18:47 ` Pablo Neira Ayuso
2015-05-16 20:45 ` [PATCH 0/4] Netfilter fixes for net David Miller
4 siblings, 0 replies; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-05-16 18:47 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Mirek Kratochvil <exa.exa@gmail.com>
The values 0x00000000-0xfffffeff are reserved for userspace datatype. When,
deleting set elements with maps, a bogus warning is triggered.
WARNING: CPU: 0 PID: 11133 at net/netfilter/nf_tables_api.c:4481 nft_data_uninit+0x35/0x40 [nf_tables]()
This fixes the check accordingly to enum definition in
include/linux/netfilter/nf_tables.h
Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1013
Signed-off-by: Mirek Kratochvil <exa.exa@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index ad9d11f..34ded09 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4472,9 +4472,9 @@ EXPORT_SYMBOL_GPL(nft_data_init);
*/
void nft_data_uninit(const struct nft_data *data, enum nft_data_types type)
{
- switch (type) {
- case NFT_DATA_VALUE:
+ if (type < NFT_DATA_VERDICT)
return;
+ switch (type) {
case NFT_DATA_VERDICT:
return nft_verdict_uninit(data);
default:
--
1.7.10.4
^ permalink raw reply related [flat|nested] 31+ messages in thread
* Re: [PATCH 0/4] Netfilter fixes for net
2015-05-16 18:47 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
` (3 preceding siblings ...)
2015-05-16 18:47 ` [PATCH 4/4] netfilter: nf_tables: fix bogus warning in nft_data_uninit() Pablo Neira Ayuso
@ 2015-05-16 20:45 ` David Miller
4 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2015-05-16 20:45 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sat, 16 May 2015 20:47:14 +0200
> The following patchset contains Netfilter fixes for your net tree, they are:
>
> 1) Fix a leak in IPVS, the sysctl table is not released accordingly when
> destroying a netns, patch from Tommi Rantala.
>
> 2) Fix a build error when TPROXY and socket are built-in but IPv6 defrag is
> compiled as module, from Florian Westphal.
>
> 3) Fix TCP tracket wrt. RFC5961 challenge ACK when in LAST_ACK state, patch
> from Jesper Dangaard Brouer.
>
> 4) Fix a bogus WARN_ON() in nf_tables when deleting a set element that stores
> a map, from Mirek Kratochvil.
Pulled, thanks Pablo.
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH 0/4] Netfilter fixes for net
@ 2020-10-13 23:45 Pablo Neira Ayuso
2020-10-14 3:07 ` Jakub Kicinski
0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2020-10-13 23:45 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Extend nf_queue selftest to cover re-queueing, non-gso mode and
delayed queueing, from Florian Westphal.
2) Clear skb->tstamp in IPVS forwarding path, from Julian Anastasov.
3) Provide netlink extended error reporting for EEXIST case.
4) Missing VLAN offload tag and proto in log target.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Absolutely nothing urgent in this batch, you might consider pulling this
once net-next.git gets merged into net.git so this shows up in 5.10-rc.
Thank you.
----------------------------------------------------------------
The following changes since commit 874fb9e2ca949b443cc419a4f2227cafd4381d39:
ipv4: Restore flowi4_oif update before call to xfrm_lookup_route (2020-10-10 11:38:59 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 0d9826bc18ce356e8909919ad681ad65d0a6061e:
netfilter: nf_log: missing vlan offload tag and proto (2020-10-14 01:25:14 +0200)
----------------------------------------------------------------
Florian Westphal (1):
selftests: netfilter: extend nfqueue test case
Julian Anastasov (1):
ipvs: clear skb->tstamp in forwarding path
Pablo Neira Ayuso (2):
netfilter: nftables: extend error reporting for chain updates
netfilter: nf_log: missing vlan offload tag and proto
include/net/netfilter/nf_log.h | 1 +
net/ipv4/netfilter/nf_log_arp.c | 19 ++++++-
net/ipv4/netfilter/nf_log_ipv4.c | 6 ++-
net/ipv6/netfilter/nf_log_ipv6.c | 8 +--
net/netfilter/ipvs/ip_vs_xmit.c | 6 +++
net/netfilter/nf_log_common.c | 12 +++++
net/netfilter/nf_tables_api.c | 19 +++++--
tools/testing/selftests/netfilter/nf-queue.c | 61 ++++++++++++++++++----
tools/testing/selftests/netfilter/nft_queue.sh | 70 +++++++++++++++++++++-----
9 files changed, 168 insertions(+), 34 deletions(-)
^ permalink raw reply [flat|nested] 31+ messages in thread
* Re: [PATCH 0/4] Netfilter fixes for net
2020-10-13 23:45 Pablo Neira Ayuso
@ 2020-10-14 3:07 ` Jakub Kicinski
0 siblings, 0 replies; 31+ messages in thread
From: Jakub Kicinski @ 2020-10-14 3:07 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev
On Wed, 14 Oct 2020 01:45:55 +0200 Pablo Neira Ayuso wrote:
> Hi,
>
> The following patchset contains Netfilter fixes for net:
>
> 1) Extend nf_queue selftest to cover re-queueing, non-gso mode and
> delayed queueing, from Florian Westphal.
>
> 2) Clear skb->tstamp in IPVS forwarding path, from Julian Anastasov.
>
> 3) Provide netlink extended error reporting for EEXIST case.
>
> 4) Missing VLAN offload tag and proto in log target.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
>
> Absolutely nothing urgent in this batch, you might consider pulling this
> once net-next.git gets merged into net.git so this shows up in 5.10-rc.
Pulled, thanks!
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH 0/4] Netfilter fixes for net
@ 2020-10-07 0:10 Pablo Neira Ayuso
2020-10-09 19:19 ` Jakub Kicinski
0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2020-10-07 0:10 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter selftests fixes from
Fabian Frederick:
1) Extend selftest nft_meta.sh to check for meta cpu.
2) Fix selftest nft_meta.sh error reporting.
3) Fix shellcheck warnings in selftest nft_meta.sh.
4) Extend selftest nft_meta.sh to check for meta time.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you!
----------------------------------------------------------------
The following changes since commit 25b8ab916dd7a1f490b603d68c7765c06f9ed9e1:
Merge tag 'mac80211-for-net-2020-09-21' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 (2020-09-21 14:54:35 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 48d072c4e8cdb542ade06727c31d7851bcc40a89:
selftests: netfilter: add time counter check (2020-09-30 11:49:18 +0200)
----------------------------------------------------------------
Fabian Frederick (4):
selftests: netfilter: add cpu counter check
selftests: netfilter: fix nft_meta.sh error reporting
selftests: netfilter: remove unused cnt and simplify command testing
selftests: netfilter: add time counter check
tools/testing/selftests/netfilter/nft_meta.sh | 32 +++++++++++++++++++++------
1 file changed, 25 insertions(+), 7 deletions(-)
^ permalink raw reply [flat|nested] 31+ messages in thread
* Re: [PATCH 0/4] Netfilter fixes for net
2020-10-07 0:10 Pablo Neira Ayuso
@ 2020-10-09 19:19 ` Jakub Kicinski
0 siblings, 0 replies; 31+ messages in thread
From: Jakub Kicinski @ 2020-10-09 19:19 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev
On Wed, 7 Oct 2020 02:10:23 +0200 Pablo Neira Ayuso wrote:
> The following patchset contains Netfilter selftests fixes from
> Fabian Frederick:
>
> 1) Extend selftest nft_meta.sh to check for meta cpu.
>
> 2) Fix selftest nft_meta.sh error reporting.
>
> 3) Fix shellcheck warnings in selftest nft_meta.sh.
>
> 4) Extend selftest nft_meta.sh to check for meta time.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thank you!
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH 0/4] Netfilter fixes for net
@ 2020-06-14 21:52 Pablo Neira Ayuso
2020-06-15 20:27 ` David Miller
0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2020-06-14 21:52 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix bogus EEXIST on element insertions to the rbtree with timeouts,
from Stefano Brivio.
2) Preempt BUG splat in the pipapo element insertion path, also from
Stefano.
3) Release filter from the ctnetlink error path.
4) Release flowtable hooks from the deletion path.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you.
----------------------------------------------------------------
The following changes since commit af7b4801030c07637840191c69eb666917e4135d:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2020-06-07 17:27:45 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 3003055f50663095472144994dac0339076031a8:
netfilter: nf_tables: hook list memleak in flowtable deletion (2020-06-12 17:48:21 +0200)
----------------------------------------------------------------
Pablo Neira Ayuso (2):
netfilter: ctnetlink: memleak in filter initialization error path
netfilter: nf_tables: hook list memleak in flowtable deletion
Stefano Brivio (2):
netfilter: nft_set_rbtree: Don't account for expired elements on insertion
netfilter: nft_set_pipapo: Disable preemption before getting per-CPU pointer
net/netfilter/nf_conntrack_netlink.c | 32 ++++++++++++++++++++++----------
net/netfilter/nf_tables_api.c | 31 ++++++++++++++++++++++++-------
net/netfilter/nft_set_pipapo.c | 6 +++++-
net/netfilter/nft_set_rbtree.c | 21 ++++++++++++++-------
4 files changed, 65 insertions(+), 25 deletions(-)
^ permalink raw reply [flat|nested] 31+ messages in thread
* Re: [PATCH 0/4] Netfilter fixes for net
2020-06-14 21:52 Pablo Neira Ayuso
@ 2020-06-15 20:27 ` David Miller
0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2020-06-15 20:27 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev, kuba
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sun, 14 Jun 2020 23:52:57 +0200
> The following patchset contains Netfilter fixes for net:
>
> 1) Fix bogus EEXIST on element insertions to the rbtree with timeouts,
> from Stefano Brivio.
>
> 2) Preempt BUG splat in the pipapo element insertion path, also from
> Stefano.
>
> 3) Release filter from the ctnetlink error path.
>
> 4) Release flowtable hooks from the deletion path.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks Pablo.
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH 0/4] Netfilter fixes for net
@ 2020-03-20 13:51 Pablo Neira Ayuso
2020-03-21 2:34 ` David Miller
0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-20 13:51 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi,
The following patchset contains Netfilter fixes for net:
1) Refetch IP header pointer after pskb_may_pull() in flowtable,
from Haishuang Yan.
2) Fix memleak in flowtable offload in nf_flow_table_free(),
from Paul Blakey.
3) Set control.addr_type mask in flowtable offload, from Edward Cree.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you.
----------------------------------------------------------------
The following changes since commit 3c025b6317272ee8493ee20fa5035c087626af48:
Merge branch 'wireguard-fixes' (2020-03-18 18:51:43 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 15ff197237e76c4dab06b7b518afaa4ebb1c43e0:
netfilter: flowtable: populate addr_type mask (2020-03-19 21:20:04 +0100)
----------------------------------------------------------------
Edward Cree (1):
netfilter: flowtable: populate addr_type mask
Haishuang Yan (2):
netfilter: flowtable: reload ip{v6}h in nf_flow_nat_ip{v6}
netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6}
Paul Blakey (1):
netfilter: flowtable: Fix flushing of offloaded flows on free
net/netfilter/nf_flow_table_core.c | 3 +++
net/netfilter/nf_flow_table_ip.c | 14 ++++++++++----
net/netfilter/nf_flow_table_offload.c | 1 +
3 files changed, 14 insertions(+), 4 deletions(-)
^ permalink raw reply [flat|nested] 31+ messages in thread
* Re: [PATCH 0/4] Netfilter fixes for net
2020-03-20 13:51 Pablo Neira Ayuso
@ 2020-03-21 2:34 ` David Miller
0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2020-03-21 2:34 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 20 Mar 2020 14:51:30 +0100
> The following patchset contains Netfilter fixes for net:
>
> 1) Refetch IP header pointer after pskb_may_pull() in flowtable,
> from Haishuang Yan.
>
> 2) Fix memleak in flowtable offload in nf_flow_table_free(),
> from Paul Blakey.
>
> 3) Set control.addr_type mask in flowtable offload, from Edward Cree.
Pulled, thanks Pablo.
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH 0/4] Netfilter fixes for net
@ 2019-12-26 16:39 Pablo Neira Ayuso
2019-12-26 21:11 ` David Miller
0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2019-12-26 16:39 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix endianness issue in flowtable TCP flags dissector,
from Arnd Bergmann.
2) Extend flowtable test script with dnat rules, from Florian Westphal.
3) Reject padding in ebtables user entries and validate computed user
offset, reported by syzbot, from Florian Westphal.
4) Fix endianness in nft_tproxy, from Phil Sutter.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 0fd260056ef84ede8f444c66a3820811691fe884:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf (2019-12-19 14:20:47 -0800)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 8cb4ec44de42b99b92399b4d1daf3dc430ed0186:
netfilter: nft_tproxy: Fix port selector on Big Endian (2019-12-20 02:12:28 +0100)
----------------------------------------------------------------
Arnd Bergmann (1):
netfilter: nf_flow_table: fix big-endian integer overflow
Florian Westphal (2):
selftests: netfilter: extend flowtable test script with dnat rule
netfilter: ebtables: compat: reject all padding in matches/watchers
Phil Sutter (1):
netfilter: nft_tproxy: Fix port selector on Big Endian
net/bridge/netfilter/ebtables.c | 33 +++++++++---------
net/netfilter/nf_flow_table_offload.c | 2 +-
net/netfilter/nft_tproxy.c | 4 +--
tools/testing/selftests/netfilter/nft_flowtable.sh | 39 +++++++++++++++++++---
4 files changed, 53 insertions(+), 25 deletions(-)
^ permalink raw reply [flat|nested] 31+ messages in thread
* Re: [PATCH 0/4] Netfilter fixes for net
2019-12-26 16:39 Pablo Neira Ayuso
@ 2019-12-26 21:11 ` David Miller
0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2019-12-26 21:11 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 26 Dec 2019 17:39:52 +0100
> The following patchset contains Netfilter fixes for net:
>
> 1) Fix endianness issue in flowtable TCP flags dissector,
> from Arnd Bergmann.
>
> 2) Extend flowtable test script with dnat rules, from Florian Westphal.
>
> 3) Reject padding in ebtables user entries and validate computed user
> offset, reported by syzbot, from Florian Westphal.
>
> 4) Fix endianness in nft_tproxy, from Phil Sutter.
>
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thank you.
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH 0/4] Netfilter fixes for net
@ 2017-05-29 11:34 Pablo Neira Ayuso
2017-05-30 3:20 ` David Miller
0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2017-05-29 11:34 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for your net tree,
they are:
1) Conntrack SCTP CRC32c checksum mangling may operate on non-linear
skbuff, patch from Davide Caratti.
2) nf_tables rb-tree set backend does not handle element re-addition
after deletion in the same transaction, leading to infinite loop.
3) Atomically unclear the IPS_SRC_NAT_DONE_BIT on nat module removal,
from Liping Zhang.
4) Conntrack hashtable resizing while ctnetlink dump is progress leads
to a dead reference to released objects in the lists, also from
Liping.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 6d18c732b95c0a9d35e9f978b4438bba15412284:
bridge: start hello_timer when enabling KERNEL_STP in br_stp_start (2017-05-21 13:33:28 -0400)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to fefa92679dbe0c613e62b6c27235dcfbe9640ad1:
netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize (2017-05-24 11:26:01 +0200)
----------------------------------------------------------------
Davide Caratti (1):
netfilter: conntrack: fix false CRC32c mismatch using paged skb
Liping Zhang (2):
netfilter: nat: use atomic bit op to clear the _SRC_NAT_DONE_BIT
netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize
Pablo Neira Ayuso (1):
netfilter: nft_set_rbtree: handle element re-addition after deletion
net/netfilter/nf_conntrack_netlink.c | 7 ++++++-
net/netfilter/nf_conntrack_proto_sctp.c | 9 ++++++---
net/netfilter/nf_nat_core.c | 2 +-
net/netfilter/nft_set_rbtree.c | 22 +++++++++++-----------
4 files changed, 24 insertions(+), 16 deletions(-)
^ permalink raw reply [flat|nested] 31+ messages in thread
* Re: [PATCH 0/4] Netfilter fixes for net
2017-05-29 11:34 Pablo Neira Ayuso
@ 2017-05-30 3:20 ` David Miller
0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2017-05-30 3:20 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 29 May 2017 13:34:28 +0200
> Hi David,
>
> The following patchset contains Netfilter fixes for your net tree,
> they are:
>
> 1) Conntrack SCTP CRC32c checksum mangling may operate on non-linear
> skbuff, patch from Davide Caratti.
>
> 2) nf_tables rb-tree set backend does not handle element re-addition
> after deletion in the same transaction, leading to infinite loop.
>
> 3) Atomically unclear the IPS_SRC_NAT_DONE_BIT on nat module removal,
> from Liping Zhang.
>
> 4) Conntrack hashtable resizing while ctnetlink dump is progress leads
> to a dead reference to released objects in the lists, also from
> Liping.
>
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks a lot Pablo.
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH 0/4] Netfilter fixes for net
@ 2017-03-03 19:22 Pablo Neira Ayuso
2017-03-04 4:41 ` David Miller
0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2017-03-03 19:22 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for your net tree,
they are:
1) Missing check for full sock in ip_route_me_harder(), from
Florian Westphal.
2) Incorrect sip helper structure initilization that breaks it when
several ports are used, from Christophe Leroy.
3) Fix incorrect assumption when looking up for matching with adjacent
intervals in the nft_set_rbtree.
4) Fix broken netlink event error reporting in nf_tables that results
in misleading ESRCH errors propagated to userspace listeners.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 2f44f75257d57f0d5668dba3a6ada0f4872132c9:
Merge branch 'qed-fixes' (2017-02-27 09:22:10 -0500)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 25e94a997b324b5f167f56d56d7106d38b78c9de:
netfilter: nf_tables: don't call nfnetlink_set_err() if nfnetlink_send() fails (2017-03-03 13:48:34 +0100)
----------------------------------------------------------------
Christophe Leroy (1):
netfilter: nf_conntrack_sip: fix wrong memory initialisation
Florian Westphal (1):
netfilter: use skb_to_full_sk in ip_route_me_harder
Pablo Neira Ayuso (2):
netfilter: nft_set_rbtree: incorrect assumption on lower interval lookups
netfilter: nf_tables: don't call nfnetlink_set_err() if nfnetlink_send() fails
include/net/netfilter/nf_tables.h | 6 +-
net/ipv4/netfilter.c | 7 +-
net/netfilter/nf_conntrack_sip.c | 2 -
net/netfilter/nf_tables_api.c | 133 ++++++++++++++++----------------------
net/netfilter/nft_set_rbtree.c | 9 ++-
5 files changed, 66 insertions(+), 91 deletions(-)
^ permalink raw reply [flat|nested] 31+ messages in thread
* Re: [PATCH 0/4] Netfilter fixes for net
2017-03-03 19:22 Pablo Neira Ayuso
@ 2017-03-04 4:41 ` David Miller
0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2017-03-04 4:41 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 3 Mar 2017 20:22:21 +0100
> The following patchset contains Netfilter fixes for your net tree,
> they are:
>
> 1) Missing check for full sock in ip_route_me_harder(), from
> Florian Westphal.
>
> 2) Incorrect sip helper structure initilization that breaks it when
> several ports are used, from Christophe Leroy.
>
> 3) Fix incorrect assumption when looking up for matching with adjacent
> intervals in the nft_set_rbtree.
>
> 4) Fix broken netlink event error reporting in nf_tables that results
> in misleading ESRCH errors propagated to userspace listeners.
>
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks a lot Pablo.
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH 0/4] Netfilter fixes for net
@ 2016-09-13 9:05 Pablo Neira Ayuso
2016-09-13 15:17 ` David Miller
0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2016-09-13 9:05 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for your net tree,
they are:
1) Endianess fix for the new nf_tables netlink trace infrastructure,
NFTA_TRACE_POLICY endianess was not correct, patch from Liping Zhang.
2) Fix broken re-route after userspace queueing in nf_tables route
chain. This patch is large but it is simple since it is just getting
this code in sync with iptable_mangle. Also from Liping.
3) NAT mangling via ctnetlink lies to userspace when nf_nat_setup_info()
fails to setup the NAT conntrack extension. This problem has been
there since the beginning, but it can now show up after rhashtable
conversion.
4) Fix possible NULL pointer dereference due to failures in allocating
the synproxy and seqadj conntrack extensions, from Gao feng.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 6e1ce3c3451291142a57c4f3f6f999a29fb5b3bc:
af_unix: split 'u->readlock' into two: 'iolock' and 'bindlock' (2016-09-04 13:29:29 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 4440a2ab3b9f40dddbe006331ef0659c76859296:
netfilter: synproxy: Check oom when adding synproxy and seqadj ct extensions (2016-09-13 10:50:56 +0200)
----------------------------------------------------------------
Gao Feng (1):
netfilter: synproxy: Check oom when adding synproxy and seqadj ct extensions
Liping Zhang (2):
netfilter: nf_tables_trace: fix endiness when dump chain policy
netfilter: nft_chain_route: re-route before skb is queued to userspace
Pablo Neira Ayuso (1):
netfilter: nf_nat: handle NF_DROP from nfnetlink_parse_nat_setup()
include/net/netfilter/nf_conntrack_synproxy.h | 14 ++++++++++++++
net/ipv4/netfilter/nft_chain_route_ipv4.c | 11 +++++++----
net/ipv6/netfilter/nft_chain_route_ipv6.c | 10 +++++++---
net/netfilter/nf_conntrack_core.c | 6 +++---
net/netfilter/nf_nat_core.c | 5 +++--
net/netfilter/nf_tables_trace.c | 2 +-
6 files changed, 35 insertions(+), 13 deletions(-)
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH 0/4] Netfilter fixes for net
@ 2015-10-19 18:22 Pablo Neira Ayuso
2015-10-22 2:27 ` David Miller
0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-10-19 18:22 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains four Netfilter fixes for net, they are:
1) Fix Kconfig dependencies of new nf_dup_ipv4 and nf_dup_ipv6.
2) Remove bogus test nh_scope in IPv4 rpfilter match that is breaking
--accept-local, from Xin Long.
3) Wait for RCU grace period after dropping the pending packets in the
nfqueue, from Florian Westphal.
4) Fix sleeping allocation while holding spin_lock_bh, from Nikolay Borisov.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit b84f78782052ee4516903e5d0566a5eee365b771:
net: Initialize flow flags in input path (2015-09-29 21:52:32 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 00db674bedd68ff8b5afae9030ff5e04d45d1b4a:
netfilter: ipset: Fix sleeping memory allocation in atomic context (2015-10-17 13:01:24 +0200)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: sync with packet rx also after removing queue entries
Nikolay Borisov (1):
netfilter: ipset: Fix sleeping memory allocation in atomic context
Pablo Neira Ayuso (1):
netfilter: fix Kconfig dependencies for nf_dup_ipv{4,6}
lucien (1):
netfilter: ipt_rpfilter: remove the nh_scope test in rpfilter_lookup_reverse
net/ipv4/netfilter/Kconfig | 1 +
net/ipv4/netfilter/ipt_rpfilter.c | 4 +---
net/ipv6/netfilter/Kconfig | 1 +
net/netfilter/core.c | 2 ++
net/netfilter/ipset/ip_set_list_set.c | 2 +-
5 files changed, 6 insertions(+), 4 deletions(-)
^ permalink raw reply [flat|nested] 31+ messages in thread
* Re: [PATCH 0/4] Netfilter fixes for net
2015-10-19 18:22 Pablo Neira Ayuso
@ 2015-10-22 2:27 ` David Miller
0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2015-10-22 2:27 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 19 Oct 2015 20:22:51 +0200
> The following patchset contains four Netfilter fixes for net, they are:
>
> 1) Fix Kconfig dependencies of new nf_dup_ipv4 and nf_dup_ipv6.
>
> 2) Remove bogus test nh_scope in IPv4 rpfilter match that is breaking
> --accept-local, from Xin Long.
>
> 3) Wait for RCU grace period after dropping the pending packets in the
> nfqueue, from Florian Westphal.
>
> 4) Fix sleeping allocation while holding spin_lock_bh, from Nikolay Borisov.
>
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks a lot Pablo.
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH 0/4] Netfilter fixes for net
@ 2015-09-18 9:17 Pablo Neira Ayuso
2015-09-21 5:32 ` David Miller
0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-09-18 9:17 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patch contains Netfilter fixes for your net tree, they are:
1) nf_log_unregister() should only set to NULL the logger that is being
unregistered, instead of everything else. Patch from Florian Westphal.
2) Fix a crash when accessing physoutdev from PREROUTING in br_netfilter.
This is partially reverting the patch to shrink nf_bridge_info to 32 bytes.
Also from Florian.
3) Use existing match/target extensions in the internal nft_compat extension
lists when the extension is family unspecific (ie. NFPROTO_UNSPEC).
4) Wait for rcu grace period before leaving nf_log_unregister().
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit e8684c88774c0ddfeefdbed0aa469b25b9962f3e:
irda: ali-ircc: Fix deadlock in ali_ircc_sir_change_speed() (2015-09-11 16:18:33 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
for you to fetch changes up to ad5001cc7cdf9aaee5eb213fdee657e4a3c94776:
netfilter: nf_log: wait for rcu grace after logger unregistration (2015-09-17 13:37:31 +0200)
----------------------------------------------------------------
Florian Westphal (2):
netfilter: nf_log: don't zap all loggers on unregister
netfilter: bridge: fix routing of bridge frames with call-iptables=1
Pablo Neira Ayuso (2):
netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC
netfilter: nf_log: wait for rcu grace after logger unregistration
include/linux/skbuff.h | 6 +++---
net/netfilter/nf_log.c | 9 +++++++--
net/netfilter/nft_compat.c | 24 ++++++++++++++++++------
3 files changed, 28 insertions(+), 11 deletions(-)
^ permalink raw reply [flat|nested] 31+ messages in thread
* Re: [PATCH 0/4] Netfilter fixes for net
2015-09-18 9:17 Pablo Neira Ayuso
@ 2015-09-21 5:32 ` David Miller
0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2015-09-21 5:32 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 18 Sep 2015 11:17:52 +0200
> The following patch contains Netfilter fixes for your net tree, they are:
>
> 1) nf_log_unregister() should only set to NULL the logger that is being
> unregistered, instead of everything else. Patch from Florian Westphal.
>
> 2) Fix a crash when accessing physoutdev from PREROUTING in br_netfilter.
> This is partially reverting the patch to shrink nf_bridge_info to 32 bytes.
> Also from Florian.
>
> 3) Use existing match/target extensions in the internal nft_compat extension
> lists when the extension is family unspecific (ie. NFPROTO_UNSPEC).
>
> 4) Wait for rcu grace period before leaving nf_log_unregister().
>
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks Pablo.
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH 0/4] Netfilter fixes for net
@ 2014-08-11 17:06 Pablo Neira Ayuso
0 siblings, 0 replies; 31+ messages in thread
From: Pablo Neira Ayuso @ 2014-08-11 17:06 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains fixes for your net tree, they are:
1) Unitialize the set element key and data from the commit path,
otherwise this leaks chain refcount if the transaction is aborted,
reported by Thomas Graf.
2) Fix crash when updating chains without no counters in nf_tables,
this slipped through in the new transaction infrastructure, reported
by Matteo Croce.
3) Replace all mutex_lock_interruptible() by mutex_lock() in the Netfilter
tree, suggested by Patrick McHardy. This implicitly fixes the problem
that Eric Dumazet reported in: http://patchwork.ozlabs.org/patch/373076/
4) Fix error return code in nf_tables when deleting set element in
nf_tables if the transaction cannot be allocated, from Julia Lawall.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 33caee39925b887a99a2400dc5c980097c3573f9:
Merge branch 'akpm' (patchbomb from Andrew Morton) (2014-08-06 21:14:42 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
for you to fetch changes up to 609ccf087747de48ef52160f93e0df864c532a61:
netfilter: nf_tables: fix error return code (2014-08-08 16:47:29 +0200)
----------------------------------------------------------------
Julia Lawall (1):
netfilter: nf_tables: fix error return code
Pablo Neira Ayuso (3):
netfilter: nf_tables: uninitialize element key/data from the commit path
netfilter: nf_tables: don't update chain with unset counters
netfilter: don't use mutex_lock_interruptible()
net/bridge/netfilter/ebtables.c | 10 ++-------
net/netfilter/core.c | 11 ++-------
net/netfilter/ipvs/ip_vs_ctl.c | 19 ++++------------
net/netfilter/nf_sockopt.c | 8 ++-----
net/netfilter/nf_tables_api.c | 30 ++++++++++++++-----------
net/netfilter/x_tables.c | 47 ++++++++++-----------------------------
6 files changed, 39 insertions(+), 86 deletions(-)
^ permalink raw reply [flat|nested] 31+ messages in thread
* [PATCH 0/4] netfilter fixes for net
@ 2013-04-12 10:13 Pablo Neira Ayuso
2013-04-12 18:28 ` David Miller
0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2013-04-12 10:13 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains late netfilter fixes for your net
tree, they are:
* Don't drop segmented TCP packets in the SIP helper, we've got reports
from users that this was breaking communications when the SIP phone
messages are larger than the MTU, from Patrick McHardy.
* Fix refcount leak in the ipset list set, from Jozsef Kadlecsik.
* On hash set resizing, the nomatch flag was lost, thus entirely inverting
the logic of the set matching, from Jozsef Kadlecsik.
* Fix crash on NAT modules removal. Timer expiration may race with the
module cleanup exit path while deleting conntracks, from Florian
Westphal.
The following changes since commit 53f63189b1110559dce8c1ee29e8abc3e31f7630:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (2013-04-05 14:04:10 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
for you to fetch changes up to c2d421e171868586939c328dfb91bab840fe4c49:
netfilter: nf_nat: fix race when unloading protocol modules (2013-04-12 11:46:31 +0200)
Please, consider pulling this.
Thanks!
P.S: Jozsef has several updates for net-next that depend on these fixes,
could you pull from your net tree into your net-next tree, please? Thanks.
----------------------------------------------------------------
Florian Westphal (1):
netfilter: nf_nat: fix race when unloading protocol modules
Jozsef Kadlecsik (2):
netfilter: ipset: list:set: fix reference counter update
netfilter: ipset: hash:*net*: nomatch flag not excluded on set resize
Patrick McHardy (1):
netfilter: nf_ct_sip: don't drop packets with offsets pointing outside the packet
include/linux/netfilter/ipset/ip_set_ahash.h | 30 ++++++++++++++-----
net/netfilter/ipset/ip_set_hash_ipportnet.c | 18 ++++++++++++
net/netfilter/ipset/ip_set_hash_net.c | 22 ++++++++++++--
net/netfilter/ipset/ip_set_hash_netiface.c | 22 ++++++++++++--
net/netfilter/ipset/ip_set_hash_netport.c | 18 ++++++++++++
net/netfilter/ipset/ip_set_list_set.c | 10 +++++--
net/netfilter/nf_conntrack_sip.c | 6 ++--
net/netfilter/nf_nat_core.c | 40 +++++---------------------
8 files changed, 115 insertions(+), 51 deletions(-)
^ permalink raw reply [flat|nested] 31+ messages in thread
* Re: [PATCH 0/4] netfilter fixes for net
2013-04-12 10:13 [PATCH 0/4] netfilter " Pablo Neira Ayuso
@ 2013-04-12 18:28 ` David Miller
0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2013-04-12 18:28 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 12 Apr 2013 12:13:15 +0200
> The following patchset contains late netfilter fixes for your net
> tree, they are:
>
> * Don't drop segmented TCP packets in the SIP helper, we've got reports
> from users that this was breaking communications when the SIP phone
> messages are larger than the MTU, from Patrick McHardy.
>
> * Fix refcount leak in the ipset list set, from Jozsef Kadlecsik.
>
> * On hash set resizing, the nomatch flag was lost, thus entirely inverting
> the logic of the set matching, from Jozsef Kadlecsik.
>
> * Fix crash on NAT modules removal. Timer expiration may race with the
> module cleanup exit path while deleting conntracks, from Florian
> Westphal.
Pulled, thanks Pablo.
^ permalink raw reply [flat|nested] 31+ messages in thread
end of thread, other threads:[~2020-10-14 3:07 UTC | newest]
Thread overview: 31+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-05-16 18:47 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
2015-05-16 18:47 ` [PATCH 1/4] ipvs: fix memory leak in ip_vs_ctl.c Pablo Neira Ayuso
2015-05-16 18:47 ` [PATCH 2/4] netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m Pablo Neira Ayuso
2015-05-16 19:07 ` Sergei Shtylyov
2015-05-16 19:24 ` Pablo Neira Ayuso
2015-05-16 18:47 ` [PATCH 3/4] conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition Pablo Neira Ayuso
2015-05-16 18:47 ` [PATCH 4/4] netfilter: nf_tables: fix bogus warning in nft_data_uninit() Pablo Neira Ayuso
2015-05-16 20:45 ` [PATCH 0/4] Netfilter fixes for net David Miller
-- strict thread matches above, loose matches on Subject: below --
2020-10-13 23:45 Pablo Neira Ayuso
2020-10-14 3:07 ` Jakub Kicinski
2020-10-07 0:10 Pablo Neira Ayuso
2020-10-09 19:19 ` Jakub Kicinski
2020-06-14 21:52 Pablo Neira Ayuso
2020-06-15 20:27 ` David Miller
2020-03-20 13:51 Pablo Neira Ayuso
2020-03-21 2:34 ` David Miller
2019-12-26 16:39 Pablo Neira Ayuso
2019-12-26 21:11 ` David Miller
2017-05-29 11:34 Pablo Neira Ayuso
2017-05-30 3:20 ` David Miller
2017-03-03 19:22 Pablo Neira Ayuso
2017-03-04 4:41 ` David Miller
2016-09-13 9:05 Pablo Neira Ayuso
2016-09-13 15:17 ` David Miller
2015-10-19 18:22 Pablo Neira Ayuso
2015-10-22 2:27 ` David Miller
2015-09-18 9:17 Pablo Neira Ayuso
2015-09-21 5:32 ` David Miller
2014-08-11 17:06 Pablo Neira Ayuso
2013-04-12 10:13 [PATCH 0/4] netfilter " Pablo Neira Ayuso
2013-04-12 18:28 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.