From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org, kuba@kernel.org
Subject: [PATCH net 0/8] Netfilter/IPVS fixes for net
Date: Thu, 21 Oct 2021 12:08:13 +0200 [thread overview]
Message-ID: <20211021100821.964677-1-pablo@netfilter.org> (raw)
Hi,
The following patchset contains Netfilter fixes for net:
1) Crash due to missing initialization of timer data in
xt_IDLETIMER, from Juhee Kang.
2) NF_CONNTRACK_SECMARK should be bool in Kconfig, from Vegard Nossum.
3) Skip netdev events on netns removal, from Florian Westphal.
4) Add testcase to show port shadowing via UDP, also from Florian.
5) Remove pr_debug() code in ip6t_rt, this fixes a crash due to
unsafe access to non-linear skbuff, from Xin Long.
6) Make net/ipv4/vs/debug_level read-only from non-init netns,
from Antoine Tenart.
7) Remove bogus invocation to bash in selftests/netfilter/nft_flowtable.sh
also from Florian.
There will be a relatively simple conflict between net-next and net
after this pull-request, as reported by Stephen Rothwell.
diff --cc net/netfilter/ipvs/ip_vs_ctl.c
index 29ec3ef63edc,cbea5a68afb5..000000000000
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@@ -4090,11 -4096,8 +4096,13 @@@ static int __net_init ip_vs_control_net
tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
+ ipvs->sysctl_run_estimation = 1;
+ tbl[idx++].data = &ipvs->sysctl_run_estimation;
+#ifdef CONFIG_IP_VS_DEBUG
+ /* Global sysctls must be ro in non-init netns */
+ if (!net_eq(net, &init_net))
+ tbl[idx++].mode = 0444;
+#endif
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 8d6c414cd2fb74aa6812e9bfec6178f8246c4f3a:
net: prefer socket bound to interface when not in VRF (2021-10-07 07:27:55 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to d9aaaf223297f6146d9d7f36caca927c92ab855a:
netfilter: ebtables: allocate chainstack on CPU local nodes (2021-10-18 00:23:57 +0200)
----------------------------------------------------------------
Antoine Tenart (1):
netfilter: ipvs: make global sysctl readonly in non-init netns
Davidlohr Bueso (1):
netfilter: ebtables: allocate chainstack on CPU local nodes
Florian Westphal (3):
netfilter: nf_tables: skip netdev events generated on netns removal
selftests: nft_nat: add udp hole punch test case
selftests: netfilter: remove stray bash debug line
Juhee Kang (1):
netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value
Vegard Nossum (1):
netfilter: Kconfig: use 'default y' instead of 'm' for bool config option
Xin Long (1):
netfilter: ip6t_rt: fix rt0_hdr parsing in rt_mt6
net/bridge/netfilter/ebtables.c | 4 +-
net/ipv6/netfilter/ip6t_rt.c | 48 +------
net/netfilter/Kconfig | 2 +-
net/netfilter/ipvs/ip_vs_ctl.c | 5 +
net/netfilter/nft_chain_filter.c | 9 +-
net/netfilter/xt_IDLETIMER.c | 2 +-
tools/testing/selftests/netfilter/nft_flowtable.sh | 1 -
tools/testing/selftests/netfilter/nft_nat.sh | 145 +++++++++++++++++++++
8 files changed, 164 insertions(+), 52 deletions(-)
next reply other threads:[~2021-10-21 10:08 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-21 10:08 Pablo Neira Ayuso [this message]
2021-10-21 10:08 ` [PATCH net 1/8] netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value Pablo Neira Ayuso
2021-10-21 11:40 ` patchwork-bot+netdevbpf
2021-10-21 10:08 ` [PATCH net 2/8] netfilter: Kconfig: use 'default y' instead of 'm' for bool config option Pablo Neira Ayuso
2021-10-21 10:08 ` [PATCH net 3/8] netfilter: nf_tables: skip netdev events generated on netns removal Pablo Neira Ayuso
2021-10-21 10:08 ` [PATCH net 4/8] selftests: nft_nat: add udp hole punch test case Pablo Neira Ayuso
2021-10-21 10:08 ` [PATCH net 5/8] netfilter: ip6t_rt: fix rt0_hdr parsing in rt_mt6 Pablo Neira Ayuso
2021-10-21 10:08 ` [PATCH net 6/8] netfilter: ipvs: make global sysctl readonly in non-init netns Pablo Neira Ayuso
2021-10-21 10:08 ` [PATCH net 7/8] selftests: netfilter: remove stray bash debug line Pablo Neira Ayuso
2021-10-21 10:08 ` [PATCH net 8/8] netfilter: ebtables: allocate chainstack on CPU local nodes Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211021100821.964677-1-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.