* [PATCH 0/7] Netfilter fixes for net
@ 2018-03-24 20:34 Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 1/7] netfilter: nf_tables: meter: pick a set backend that supports updates Pablo Neira Ayuso
` (7 more replies)
0 siblings, 8 replies; 38+ messages in thread
From: Pablo Neira Ayuso @ 2018-03-24 20:34 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for your net tree,
they are:
1) Don't pick fixed hash implementation for NFT_SET_EVAL sets, otherwise
userspace hits EOPNOTSUPP with valid rules using the meter statement,
from Florian Westphal.
2) If you send a batch that flushes the existing ruleset (that contains
a NAT chain) and the new ruleset definition comes with a new NAT
chain, don't bogusly hit EBUSY. Also from Florian.
3) Missing netlink policy attribute validation, from Florian.
4) Detach conntrack template from skbuff if IP_NODEFRAG is set on,
from Paolo Abeni.
5) Cache device names in flowtable object, otherwise we may end up
walking over devices going aways given no rtnl_lock is held.
6) Fix incorrect net_device ingress with ingress hooks.
7) Fix crash when trying to read more data than available in UDP
packets from the nf_socket infrastructure, from Subash.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 36fe095606f881e6a3c7f9283c986aec6083f3e6:
Merge branch 'phy-relax-error-checking' (2018-03-19 21:14:27 -0400)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 32c1733f0dd4bd11d6e65512bf4dc337c0452c8e:
netfilter: nf_socket: Fix out of bounds access in nf_sk_lookup_slow_v{4,6} (2018-03-24 21:17:14 +0100)
----------------------------------------------------------------
Florian Westphal (3):
netfilter: nf_tables: meter: pick a set backend that supports updates
netfilter: nf_tables: permit second nat hook if colliding hook is going away
netfilter: nf_tables: add missing netlink attrs to policies
Pablo Neira Ayuso (2):
netfilter: nf_tables: cache device name in flowtable object
netfilter: nf_tables: do not hold reference on netdevice from preparation phase
Paolo Abeni (1):
netfilter: drop template ct when conntrack is skipped.
Subash Abhinov Kasiviswanathan (1):
netfilter: nf_socket: Fix out of bounds access in nf_sk_lookup_slow_v{4,6}
include/net/netfilter/nf_tables.h | 4 +
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 14 +++-
net/ipv4/netfilter/nf_socket_ipv4.c | 6 +-
net/ipv6/netfilter/nf_socket_ipv6.c | 6 +-
net/netfilter/nf_tables_api.c | 106 +++++++++++++++++++------
net/netfilter/nft_set_hash.c | 2 +-
6 files changed, 109 insertions(+), 29 deletions(-)
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 1/7] netfilter: nf_tables: meter: pick a set backend that supports updates
2018-03-24 20:34 [PATCH 0/7] Netfilter fixes for net Pablo Neira Ayuso
@ 2018-03-24 20:34 ` Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 2/7] netfilter: nf_tables: permit second nat hook if colliding hook is going away Pablo Neira Ayuso
` (6 subsequent siblings)
7 siblings, 0 replies; 38+ messages in thread
From: Pablo Neira Ayuso @ 2018-03-24 20:34 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Florian Westphal <fw@strlen.de>
in nftables, 'meter' can be used to instantiate a hash-table at run
time:
rule add filter forward iif "internal" meter hostacct { ip saddr counter}
nft list meter ip filter hostacct
table ip filter {
meter hostacct {
type ipv4_addr
elements = { 192.168.0.1 : counter packets 8 bytes 2672, ..
because elemets get added on the fly, the kernel must chose a set
backend type that implements the ->update() function, otherwise
rule insertion fails with EOPNOTSUPP.
Therefore, skip set types that lack ->update, and also
make sure we do not discard a (bad) candidate when we did yet
find any candidate at all. This could happen when userspace prefers
low memory footprint -- the set implementation currently checked might
not be a fit at all. Make sure we pick it anyway (!bops). In
case next candidate is a better fix, it will be chosen instead.
But in case nothing else is found we at least have a non-ideal
match rather than no match at all.
Fixes: 6c03ae210ce3 ("netfilter: nft_set_hash: add non-resizable hashtable implementation")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 5 ++++-
net/netfilter/nft_set_hash.c | 2 +-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index c4acc7340eb1..36f69acaf51f 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2446,6 +2446,9 @@ EXPORT_SYMBOL_GPL(nft_unregister_set);
static bool nft_set_ops_candidate(const struct nft_set_ops *ops, u32 flags)
{
+ if ((flags & NFT_SET_EVAL) && !ops->update)
+ return false;
+
return (flags & ops->features) == (flags & NFT_SET_FEATURES);
}
@@ -2510,7 +2513,7 @@ nft_select_set_ops(const struct nft_ctx *ctx,
if (est.space == best.space &&
est.lookup < best.lookup)
break;
- } else if (est.size < best.size) {
+ } else if (est.size < best.size || !bops) {
break;
}
continue;
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index d40591fe1b2f..fc9c6d5d64cd 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -674,7 +674,7 @@ static const struct nft_set_ops *
nft_hash_select_ops(const struct nft_ctx *ctx, const struct nft_set_desc *desc,
u32 flags)
{
- if (desc->size && !(flags & NFT_SET_TIMEOUT)) {
+ if (desc->size && !(flags & (NFT_SET_EVAL | NFT_SET_TIMEOUT))) {
switch (desc->klen) {
case 4:
return &nft_hash_fast_ops;
--
2.11.0
^ permalink raw reply related [flat|nested] 38+ messages in thread
* [PATCH 2/7] netfilter: nf_tables: permit second nat hook if colliding hook is going away
2018-03-24 20:34 [PATCH 0/7] Netfilter fixes for net Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 1/7] netfilter: nf_tables: meter: pick a set backend that supports updates Pablo Neira Ayuso
@ 2018-03-24 20:34 ` Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 3/7] netfilter: nf_tables: add missing netlink attrs to policies Pablo Neira Ayuso
` (5 subsequent siblings)
7 siblings, 0 replies; 38+ messages in thread
From: Pablo Neira Ayuso @ 2018-03-24 20:34 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Florian Westphal <fw@strlen.de>
Sergei Trofimovich reported that restoring an nft ruleset doesn't work
anymore unless old rule content is flushed first.
The problem stems from a recent change designed to prevent multiple nat
hooks at the same hook point locations and nftables transaction model.
A 'flush ruleset' won't take effect until the entire transaction has
completed.
So, if one has a nft.rules file that contains a 'flush ruleset',
followed by a nat hook register request, then 'nft -f file' will work,
but running 'nft -f file' again will fail with -EBUSY.
Reason is that nftables will place the flush/removal requests in the
transaction list, but it will not act on the removal until after all new
rules are in place.
The netfilter core will therefore get request to register a new nat
hook before the old one is removed -- this now fails as the netfilter
core can't know the existing hook is staged for removal.
To fix this, we can search the transaction log when a hook collision
is detected. The collision is okay if
1. there is a delete request pending for the nat hook that is already
registered.
2. there is no second add request for a matching nat hook.
This is required to only apply the exception once.
Fixes: f92b40a8b2645 ("netfilter: core: only allow one nat hook per hook point")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 64 ++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 63 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 36f69acaf51f..cc8ca00e6e6e 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -74,15 +74,77 @@ static void nft_trans_destroy(struct nft_trans *trans)
kfree(trans);
}
+/* removal requests are queued in the commit_list, but not acted upon
+ * until after all new rules are in place.
+ *
+ * Therefore, nf_register_net_hook(net, &nat_hook) runs before pending
+ * nf_unregister_net_hook().
+ *
+ * nf_register_net_hook thus fails if a nat hook is already in place
+ * even if the conflicting hook is about to be removed.
+ *
+ * If collision is detected, search commit_log for DELCHAIN matching
+ * the new nat hooknum; if we find one collision is temporary:
+ *
+ * Either transaction is aborted (new/colliding hook is removed), or
+ * transaction is committed (old hook is removed).
+ */
+static bool nf_tables_allow_nat_conflict(const struct net *net,
+ const struct nf_hook_ops *ops)
+{
+ const struct nft_trans *trans;
+ bool ret = false;
+
+ if (!ops->nat_hook)
+ return false;
+
+ list_for_each_entry(trans, &net->nft.commit_list, list) {
+ const struct nf_hook_ops *pending_ops;
+ const struct nft_chain *pending;
+
+ if (trans->msg_type != NFT_MSG_NEWCHAIN &&
+ trans->msg_type != NFT_MSG_DELCHAIN)
+ continue;
+
+ pending = trans->ctx.chain;
+ if (!nft_is_base_chain(pending))
+ continue;
+
+ pending_ops = &nft_base_chain(pending)->ops;
+ if (pending_ops->nat_hook &&
+ pending_ops->pf == ops->pf &&
+ pending_ops->hooknum == ops->hooknum) {
+ /* other hook registration already pending? */
+ if (trans->msg_type == NFT_MSG_NEWCHAIN)
+ return false;
+
+ ret = true;
+ }
+ }
+
+ return ret;
+}
+
static int nf_tables_register_hook(struct net *net,
const struct nft_table *table,
struct nft_chain *chain)
{
+ struct nf_hook_ops *ops;
+ int ret;
+
if (table->flags & NFT_TABLE_F_DORMANT ||
!nft_is_base_chain(chain))
return 0;
- return nf_register_net_hook(net, &nft_base_chain(chain)->ops);
+ ops = &nft_base_chain(chain)->ops;
+ ret = nf_register_net_hook(net, ops);
+ if (ret == -EBUSY && nf_tables_allow_nat_conflict(net, ops)) {
+ ops->nat_hook = false;
+ ret = nf_register_net_hook(net, ops);
+ ops->nat_hook = true;
+ }
+
+ return ret;
}
static void nf_tables_unregister_hook(struct net *net,
--
2.11.0
^ permalink raw reply related [flat|nested] 38+ messages in thread
* [PATCH 3/7] netfilter: nf_tables: add missing netlink attrs to policies
2018-03-24 20:34 [PATCH 0/7] Netfilter fixes for net Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 1/7] netfilter: nf_tables: meter: pick a set backend that supports updates Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 2/7] netfilter: nf_tables: permit second nat hook if colliding hook is going away Pablo Neira Ayuso
@ 2018-03-24 20:34 ` Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 4/7] netfilter: drop template ct when conntrack is skipped Pablo Neira Ayuso
` (4 subsequent siblings)
7 siblings, 0 replies; 38+ messages in thread
From: Pablo Neira Ayuso @ 2018-03-24 20:34 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Florian Westphal <fw@strlen.de>
Fixes: 8aeff920dcc9 ("netfilter: nf_tables: add stateful object reference to set elements")
Fixes: f25ad2e907f1 ("netfilter: nf_tables: prepare for expressions associated to set elements")
Fixes: 1a94e38d254b ("netfilter: nf_tables: add NFTA_RULE_ID attribute")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index cc8ca00e6e6e..14777c404071 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1973,6 +1973,7 @@ static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
[NFTA_RULE_POSITION] = { .type = NLA_U64 },
[NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
.len = NFT_USERDATA_MAXLEN },
+ [NFTA_RULE_ID] = { .type = NLA_U32 },
};
static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
@@ -3380,6 +3381,8 @@ static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
[NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
[NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
.len = NFT_USERDATA_MAXLEN },
+ [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
+ [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING },
};
static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
--
2.11.0
^ permalink raw reply related [flat|nested] 38+ messages in thread
* [PATCH 4/7] netfilter: drop template ct when conntrack is skipped.
2018-03-24 20:34 [PATCH 0/7] Netfilter fixes for net Pablo Neira Ayuso
` (2 preceding siblings ...)
2018-03-24 20:34 ` [PATCH 3/7] netfilter: nf_tables: add missing netlink attrs to policies Pablo Neira Ayuso
@ 2018-03-24 20:34 ` Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 5/7] netfilter: nf_tables: cache device name in flowtable object Pablo Neira Ayuso
` (3 subsequent siblings)
7 siblings, 0 replies; 38+ messages in thread
From: Pablo Neira Ayuso @ 2018-03-24 20:34 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Paolo Abeni <pabeni@redhat.com>
The ipv4 nf_ct code currently skips the nf_conntrak_in() call
for fragmented packets. As a results later matches/target can end
up manipulating template ct entry instead of 'real' ones.
Exploiting the above, syzbot found a way to trigger the following
splat:
WARNING: CPU: 1 PID: 4242 at net/netfilter/xt_cluster.c:55
xt_cluster_mt+0x6c1/0x840 net/netfilter/xt_cluster.c:127
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 4242 Comm: syzkaller027971 Not tainted 4.16.0-rc2+ #243
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x24d lib/dump_stack.c:53
panic+0x1e4/0x41c kernel/panic.c:183
__warn+0x1dc/0x200 kernel/panic.c:547
report_bug+0x211/0x2d0 lib/bug.c:184
fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
fixup_bug arch/x86/kernel/traps.c:247 [inline]
do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
invalid_op+0x58/0x80 arch/x86/entry/entry_64.S:957
RIP: 0010:xt_cluster_hash net/netfilter/xt_cluster.c:55 [inline]
RIP: 0010:xt_cluster_mt+0x6c1/0x840 net/netfilter/xt_cluster.c:127
RSP: 0018:ffff8801d2f6f2d0 EFLAGS: 00010293
RAX: ffff8801af700540 RBX: 0000000000000000 RCX: ffffffff84a2d1e1
RDX: 0000000000000000 RSI: ffff8801d2f6f478 RDI: ffff8801cafd336a
RBP: ffff8801d2f6f2e8 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801b03b3d18
R13: ffff8801cafd3300 R14: dffffc0000000000 R15: ffff8801d2f6f478
ipt_do_table+0xa91/0x19b0 net/ipv4/netfilter/ip_tables.c:296
iptable_filter_hook+0x65/0x80 net/ipv4/netfilter/iptable_filter.c:41
nf_hook_entry_hookfn include/linux/netfilter.h:120 [inline]
nf_hook_slow+0xba/0x1a0 net/netfilter/core.c:483
nf_hook include/linux/netfilter.h:243 [inline]
NF_HOOK include/linux/netfilter.h:286 [inline]
raw_send_hdrinc.isra.17+0xf39/0x1880 net/ipv4/raw.c:432
raw_sendmsg+0x14cd/0x26b0 net/ipv4/raw.c:669
inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:763
sock_sendmsg_nosec net/socket.c:629 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:639
SYSC_sendto+0x361/0x5c0 net/socket.c:1748
SyS_sendto+0x40/0x50 net/socket.c:1716
do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x441b49
RSP: 002b:00007ffff5ca8b18 EFLAGS: 00000216 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000441b49
RDX: 0000000000000030 RSI: 0000000020ff7000 RDI: 0000000000000003
RBP: 00000000006cc018 R08: 000000002066354c R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000216 R12: 0000000000403470
R13: 0000000000403500 R14: 0000000000000000 R15: 0000000000000000
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..
Instead of adding checks for template ct on every target/match
manipulating skb->_nfct, simply drop the template ct when skipping
nf_conntrack_in().
Fixes: 7b4fdf77a450ec ("netfilter: don't track fragmented packets")
Reported-and-tested-by: syzbot+0346441ae0545cfcea3a@syzkaller.appspotmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index b50721d9d30e..9db988f9a4d7 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -154,8 +154,20 @@ static unsigned int ipv4_conntrack_local(void *priv,
struct sk_buff *skb,
const struct nf_hook_state *state)
{
- if (ip_is_fragment(ip_hdr(skb))) /* IP_NODEFRAG setsockopt set */
+ if (ip_is_fragment(ip_hdr(skb))) { /* IP_NODEFRAG setsockopt set */
+ enum ip_conntrack_info ctinfo;
+ struct nf_conn *tmpl;
+
+ tmpl = nf_ct_get(skb, &ctinfo);
+ if (tmpl && nf_ct_is_template(tmpl)) {
+ /* when skipping ct, clear templates to avoid fooling
+ * later targets/matches
+ */
+ skb->_nfct = 0;
+ nf_ct_put(tmpl);
+ }
return NF_ACCEPT;
+ }
return nf_conntrack_in(state->net, PF_INET, state->hook, skb);
}
--
2.11.0
^ permalink raw reply related [flat|nested] 38+ messages in thread
* [PATCH 5/7] netfilter: nf_tables: cache device name in flowtable object
2018-03-24 20:34 [PATCH 0/7] Netfilter fixes for net Pablo Neira Ayuso
` (3 preceding siblings ...)
2018-03-24 20:34 ` [PATCH 4/7] netfilter: drop template ct when conntrack is skipped Pablo Neira Ayuso
@ 2018-03-24 20:34 ` Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 6/7] netfilter: nf_tables: do not hold reference on netdevice from preparation phase Pablo Neira Ayuso
` (2 subsequent siblings)
7 siblings, 0 replies; 38+ messages in thread
From: Pablo Neira Ayuso @ 2018-03-24 20:34 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Devices going away have to grab the nfnl_lock from the netdev event path
to avoid races with control plane updates.
However, netlink dumps in netfilter do not hold nfnl_lock mutex. Cache
the device name into the objects to avoid an use-after-free situation
for a device that is going away.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_tables.h | 4 ++++
net/netfilter/nf_tables_api.c | 15 +++++++++------
2 files changed, 13 insertions(+), 6 deletions(-)
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 663b015dace5..30eb0652b025 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1068,6 +1068,8 @@ struct nft_object_ops {
int nft_register_obj(struct nft_object_type *obj_type);
void nft_unregister_obj(struct nft_object_type *obj_type);
+#define NFT_FLOWTABLE_DEVICE_MAX 8
+
/**
* struct nft_flowtable - nf_tables flow table
*
@@ -1080,6 +1082,7 @@ void nft_unregister_obj(struct nft_object_type *obj_type);
* @genmask: generation mask
* @use: number of references to this flow table
* @handle: unique object handle
+ * @dev_name: array of device names
* @data: rhashtable and garbage collector
* @ops: array of hooks
*/
@@ -1093,6 +1096,7 @@ struct nft_flowtable {
u32 genmask:2,
use:30;
u64 handle;
+ char *dev_name[NFT_FLOWTABLE_DEVICE_MAX];
/* runtime data below here */
struct nf_hook_ops *ops ____cacheline_aligned;
struct nf_flowtable data;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 14777c404071..977d43e00f98 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4932,8 +4932,6 @@ nf_tables_flowtable_lookup_byhandle(const struct nft_table *table,
return ERR_PTR(-ENOENT);
}
-#define NFT_FLOWTABLE_DEVICE_MAX 8
-
static int nf_tables_parse_devices(const struct nft_ctx *ctx,
const struct nlattr *attr,
struct net_device *dev_array[], int *len)
@@ -5006,7 +5004,7 @@ static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
dev_array, &n);
if (err < 0)
- goto err1;
+ return err;
ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL);
if (!ops) {
@@ -5026,6 +5024,8 @@ static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
flowtable->ops[i].priv = &flowtable->data.rhashtable;
flowtable->ops[i].hook = flowtable->data.type->hook;
flowtable->ops[i].dev = dev_array[i];
+ flowtable->dev_name[i] = kstrdup(dev_array[i]->name,
+ GFP_KERNEL);
}
err = 0;
@@ -5203,8 +5203,10 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
err5:
i = flowtable->ops_len;
err4:
- for (k = i - 1; k >= 0; k--)
+ for (k = i - 1; k >= 0; k--) {
+ kfree(flowtable->dev_name[k]);
nf_unregister_net_hook(net, &flowtable->ops[k]);
+ }
kfree(flowtable->ops);
err3:
@@ -5294,9 +5296,9 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
goto nla_put_failure;
for (i = 0; i < flowtable->ops_len; i++) {
- if (flowtable->ops[i].dev &&
+ if (flowtable->dev_name[i][0] &&
nla_put_string(skb, NFTA_DEVICE_NAME,
- flowtable->ops[i].dev->name))
+ flowtable->dev_name[i]))
goto nla_put_failure;
}
nla_nest_end(skb, nest_devs);
@@ -5538,6 +5540,7 @@ static void nft_flowtable_event(unsigned long event, struct net_device *dev,
continue;
nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
+ flowtable->dev_name[i][0] = '\0';
flowtable->ops[i].dev = NULL;
break;
}
--
2.11.0
^ permalink raw reply related [flat|nested] 38+ messages in thread
* [PATCH 6/7] netfilter: nf_tables: do not hold reference on netdevice from preparation phase
2018-03-24 20:34 [PATCH 0/7] Netfilter fixes for net Pablo Neira Ayuso
` (4 preceding siblings ...)
2018-03-24 20:34 ` [PATCH 5/7] netfilter: nf_tables: cache device name in flowtable object Pablo Neira Ayuso
@ 2018-03-24 20:34 ` Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 7/7] netfilter: nf_socket: Fix out of bounds access in nf_sk_lookup_slow_v{4,6} Pablo Neira Ayuso
2018-03-24 21:10 ` [PATCH 0/7] Netfilter fixes for net David Miller
7 siblings, 0 replies; 38+ messages in thread
From: Pablo Neira Ayuso @ 2018-03-24 20:34 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
The netfilter netdevice event handler hold the nfnl_lock mutex, this
avoids races with a device going away while such device is being
attached to hooks from the netlink control plane. Therefore, either
control plane bails out with ENOENT or netdevice event path waits until
the hook that is attached to net_device is registered.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 19 ++++---------------
1 file changed, 4 insertions(+), 15 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 977d43e00f98..530e12ae52d7 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1288,8 +1288,6 @@ static void nf_tables_chain_destroy(struct nft_chain *chain)
free_percpu(basechain->stats);
if (basechain->stats)
static_branch_dec(&nft_counters_enabled);
- if (basechain->ops.dev != NULL)
- dev_put(basechain->ops.dev);
kfree(chain->name);
kfree(basechain);
} else {
@@ -1356,7 +1354,7 @@ static int nft_chain_parse_hook(struct net *net,
}
nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
- dev = dev_get_by_name(net, ifname);
+ dev = __dev_get_by_name(net, ifname);
if (!dev) {
module_put(type->owner);
return -ENOENT;
@@ -1373,8 +1371,6 @@ static int nft_chain_parse_hook(struct net *net,
static void nft_chain_release_hook(struct nft_chain_hook *hook)
{
module_put(hook->type->owner);
- if (hook->dev != NULL)
- dev_put(hook->dev);
}
static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
@@ -4948,7 +4944,7 @@ static int nf_tables_parse_devices(const struct nft_ctx *ctx,
}
nla_strlcpy(ifname, tmp, IFNAMSIZ);
- dev = dev_get_by_name(ctx->net, ifname);
+ dev = __dev_get_by_name(ctx->net, ifname);
if (!dev) {
err = -ENOENT;
goto err1;
@@ -5007,10 +5003,8 @@ static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
return err;
ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL);
- if (!ops) {
- err = -ENOMEM;
- goto err1;
- }
+ if (!ops)
+ return -ENOMEM;
flowtable->hooknum = hooknum;
flowtable->priority = priority;
@@ -5028,11 +5022,6 @@ static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
GFP_KERNEL);
}
- err = 0;
-err1:
- for (i = 0; i < n; i++)
- dev_put(dev_array[i]);
-
return err;
}
--
2.11.0
^ permalink raw reply related [flat|nested] 38+ messages in thread
* [PATCH 7/7] netfilter: nf_socket: Fix out of bounds access in nf_sk_lookup_slow_v{4,6}
2018-03-24 20:34 [PATCH 0/7] Netfilter fixes for net Pablo Neira Ayuso
` (5 preceding siblings ...)
2018-03-24 20:34 ` [PATCH 6/7] netfilter: nf_tables: do not hold reference on netdevice from preparation phase Pablo Neira Ayuso
@ 2018-03-24 20:34 ` Pablo Neira Ayuso
2018-03-24 21:10 ` [PATCH 0/7] Netfilter fixes for net David Miller
7 siblings, 0 replies; 38+ messages in thread
From: Pablo Neira Ayuso @ 2018-03-24 20:34 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
skb_header_pointer will copy data into a buffer if data is non linear,
otherwise it will return a pointer in the linear section of the data.
nf_sk_lookup_slow_v{4,6} always copies data of size udphdr but later
accesses memory within the size of tcphdr (th->doff) in case of TCP
packets. This causes a crash when running with KASAN with the following
call stack -
BUG: KASAN: stack-out-of-bounds in xt_socket_lookup_slow_v4+0x524/0x718
net/netfilter/xt_socket.c:178
Read of size 2 at addr ffffffe3d417a87c by task syz-executor/28971
CPU: 2 PID: 28971 Comm: syz-executor Tainted: G B W O 4.9.65+ #1
Call trace:
[<ffffff9467e8d390>] dump_backtrace+0x0/0x428 arch/arm64/kernel/traps.c:76
[<ffffff9467e8d7e0>] show_stack+0x28/0x38 arch/arm64/kernel/traps.c:226
[<ffffff946842d9b8>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffff946842d9b8>] dump_stack+0xd4/0x124 lib/dump_stack.c:51
[<ffffff946811d4b0>] print_address_description+0x68/0x258 mm/kasan/report.c:248
[<ffffff946811d8c8>] kasan_report_error mm/kasan/report.c:347 [inline]
[<ffffff946811d8c8>] kasan_report.part.2+0x228/0x2f0 mm/kasan/report.c:371
[<ffffff946811df44>] kasan_report+0x5c/0x70 mm/kasan/report.c:372
[<ffffff946811bebc>] check_memory_region_inline mm/kasan/kasan.c:308 [inline]
[<ffffff946811bebc>] __asan_load2+0x84/0x98 mm/kasan/kasan.c:739
[<ffffff94694d6f04>] __tcp_hdrlen include/linux/tcp.h:35 [inline]
[<ffffff94694d6f04>] xt_socket_lookup_slow_v4+0x524/0x718 net/netfilter/xt_socket.c:178
Fix this by copying data into appropriate size headers based on protocol.
Fixes: a583636a83ea ("inet: refactor inet[6]_lookup functions to take skb")
Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/ipv4/netfilter/nf_socket_ipv4.c | 6 ++++--
net/ipv6/netfilter/nf_socket_ipv6.c | 6 ++++--
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/netfilter/nf_socket_ipv4.c b/net/ipv4/netfilter/nf_socket_ipv4.c
index e9293bdebba0..4824b1e183a1 100644
--- a/net/ipv4/netfilter/nf_socket_ipv4.c
+++ b/net/ipv4/netfilter/nf_socket_ipv4.c
@@ -108,10 +108,12 @@ struct sock *nf_sk_lookup_slow_v4(struct net *net, const struct sk_buff *skb,
int doff = 0;
if (iph->protocol == IPPROTO_UDP || iph->protocol == IPPROTO_TCP) {
- struct udphdr _hdr, *hp;
+ struct tcphdr _hdr;
+ struct udphdr *hp;
hp = skb_header_pointer(skb, ip_hdrlen(skb),
- sizeof(_hdr), &_hdr);
+ iph->protocol == IPPROTO_UDP ?
+ sizeof(*hp) : sizeof(_hdr), &_hdr);
if (hp == NULL)
return NULL;
diff --git a/net/ipv6/netfilter/nf_socket_ipv6.c b/net/ipv6/netfilter/nf_socket_ipv6.c
index ebb2bf84232a..f14de4b6d639 100644
--- a/net/ipv6/netfilter/nf_socket_ipv6.c
+++ b/net/ipv6/netfilter/nf_socket_ipv6.c
@@ -116,9 +116,11 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb,
}
if (tproto == IPPROTO_UDP || tproto == IPPROTO_TCP) {
- struct udphdr _hdr, *hp;
+ struct tcphdr _hdr;
+ struct udphdr *hp;
- hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
+ hp = skb_header_pointer(skb, thoff, tproto == IPPROTO_UDP ?
+ sizeof(*hp) : sizeof(_hdr), &_hdr);
if (hp == NULL)
return NULL;
--
2.11.0
^ permalink raw reply related [flat|nested] 38+ messages in thread
* Re: [PATCH 0/7] Netfilter fixes for net
2018-03-24 20:34 [PATCH 0/7] Netfilter fixes for net Pablo Neira Ayuso
` (6 preceding siblings ...)
2018-03-24 20:34 ` [PATCH 7/7] netfilter: nf_socket: Fix out of bounds access in nf_sk_lookup_slow_v{4,6} Pablo Neira Ayuso
@ 2018-03-24 21:10 ` David Miller
7 siblings, 0 replies; 38+ messages in thread
From: David Miller @ 2018-03-24 21:10 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sat, 24 Mar 2018 21:34:16 +0100
> The following patchset contains Netfilter fixes for your net tree,
> they are:
...
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thank you.
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 0/7] Netfilter fixes for net
@ 2020-10-22 17:29 Pablo Neira Ayuso
2020-10-22 19:16 ` Jakub Kicinski
0 siblings, 1 reply; 38+ messages in thread
From: Pablo Neira Ayuso @ 2020-10-22 17:29 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi Jakub,
The following patchset contains Netfilter fixes for net:
1) Update debugging in IPVS tcp protocol handler to make it easier
to understand, from longguang.yue
2) Update TCP tracker to deal with keepalive packet after
re-registration, from Franceso Ruggeri.
3) Missing IP6SKB_FRAGMENTED from netfilter fragment reassembly,
from Georg Kohmann.
4) Fix bogus packet drop in ebtables nat extensions, from
Thimothee Cocault.
5) Fix typo in flowtable documentation.
6) Reset skb timestamp in nft_fwd_netdev.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit df6afe2f7c19349de2ee560dc62ea4d9ad3ff889:
nexthop: Fix performance regression in nexthop deletion (2020-10-19 20:07:15 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to c77761c8a59405cb7aa44188b30fffe13fbdd02d:
netfilter: nf_fwd_netdev: clear timestamp in forwarding path (2020-10-22 14:49:36 +0200)
----------------------------------------------------------------
Francesco Ruggeri (1):
netfilter: conntrack: connection timeout after re-register
Georg Kohmann (1):
netfilter: Drop fragmented ndisc packets assembled in netfilter
Jeremy Sowden (1):
docs: nf_flowtable: fix typo.
Pablo Neira Ayuso (1):
netfilter: nf_fwd_netdev: clear timestamp in forwarding path
Saeed Mirzamohammadi (1):
netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create
Timothée COCAULT (1):
netfilter: ebtables: Fixes dropping of small packets in bridge nat
longguang.yue (1):
ipvs: adjust the debug info in function set_tcp_state
Documentation/networking/nf_flowtable.rst | 2 +-
include/net/netfilter/nf_tables.h | 6 ++++++
net/bridge/netfilter/ebt_dnat.c | 2 +-
net/bridge/netfilter/ebt_redirect.c | 2 +-
net/bridge/netfilter/ebt_snat.c | 2 +-
net/ipv6/netfilter/nf_conntrack_reasm.c | 1 +
net/netfilter/ipvs/ip_vs_proto_tcp.c | 10 ++++++----
net/netfilter/nf_conntrack_proto_tcp.c | 19 +++++++++++++------
net/netfilter/nf_dup_netdev.c | 1 +
net/netfilter/nf_tables_api.c | 6 +++---
net/netfilter/nf_tables_offload.c | 4 ++--
net/netfilter/nft_fwd_netdev.c | 1 +
12 files changed, 37 insertions(+), 19 deletions(-)
^ permalink raw reply [flat|nested] 38+ messages in thread
* Re: [PATCH 0/7] Netfilter fixes for net
2020-10-22 17:29 Pablo Neira Ayuso
@ 2020-10-22 19:16 ` Jakub Kicinski
0 siblings, 0 replies; 38+ messages in thread
From: Jakub Kicinski @ 2020-10-22 19:16 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev
On Thu, 22 Oct 2020 19:29:18 +0200 Pablo Neira Ayuso wrote:
> Hi Jakub,
>
> The following patchset contains Netfilter fixes for net:
>
> 1) Update debugging in IPVS tcp protocol handler to make it easier
> to understand, from longguang.yue
>
> 2) Update TCP tracker to deal with keepalive packet after
> re-registration, from Franceso Ruggeri.
>
> 3) Missing IP6SKB_FRAGMENTED from netfilter fragment reassembly,
> from Georg Kohmann.
>
> 4) Fix bogus packet drop in ebtables nat extensions, from
> Thimothee Cocault.
>
> 5) Fix typo in flowtable documentation.
>
> 6) Reset skb timestamp in nft_fwd_netdev.
Pulled, please remember about that [PATCH net] tag if you can, thanks!
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 0/7] Netfilter fixes for net
@ 2020-06-25 18:26 Pablo Neira Ayuso
2020-06-25 19:59 ` David Miller
0 siblings, 1 reply; 38+ messages in thread
From: Pablo Neira Ayuso @ 2020-06-25 18:26 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net, they are:
1) Unaligned atomic access in ipset, from Russell King.
2) Missing module description, from Rob Gill.
3) Patches to fix a module unload causing NULL pointer dereference in
xtables, from David Wilder. For the record, I posting here his cover
letter explaining the problem:
A crash happened on ppc64le when running ltp network tests triggered by
"rmmod iptable_mangle".
See previous discussion in this thread:
https://lists.openwall.net/netdev/2020/06/03/161 .
In the crash I found in iptable_mangle_hook() that
state->net->ipv4.iptable_mangle=NULL causing a NULL pointer dereference.
net->ipv4.iptable_mangle is set to NULL in +iptable_mangle_net_exit() and
called when ip_mangle modules is unloaded. A rmmod task was found running
in the crash dump. A 2nd crash showed the same problem when running
"rmmod iptable_filter" (net->ipv4.iptable_filter=NULL).
To fix this I added .pre_exit hook in all iptable_foo.c. The pre_exit will
un-register the underlying hook and exit would do the table freeing. The
netns core does an unconditional +synchronize_rcu after the pre_exit hooks
insuring no packets are in flight that have picked up the pointer before
completing the un-register.
These patches include changes for both iptables and ip6tables.
We tested this fix with ltp running iptables01.sh and iptables01.sh -6 a
loop for 72 hours.
4) Add a selftest for conntrack helper assignment, from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you.
----------------------------------------------------------------
The following changes since commit 67c20de35a3cc2e2cd940f95ebd85ed0a765315a:
net: Add MODULE_DESCRIPTION entries to network modules (2020-06-20 21:33:57 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 619ae8e0697a6fb85b99b19137590c7c337c579e:
selftests: netfilter: add test case for conntrack helper assignment (2020-06-25 00:50:31 +0200)
----------------------------------------------------------------
David Wilder (4):
netfilter: iptables: Split ipt_unregister_table() into pre_exit and exit helpers.
netfilter: iptables: Add a .pre_exit hook in all iptable_foo.c.
netfilter: ip6tables: Split ip6t_unregister_table() into pre_exit and exit helpers.
netfilter: ip6tables: Add a .pre_exit hook in all ip6table_foo.c.
Florian Westphal (1):
selftests: netfilter: add test case for conntrack helper assignment
Rob Gill (1):
netfilter: Add MODULE_DESCRIPTION entries to kernel modules
Russell King (1):
netfilter: ipset: fix unaligned atomic access
include/linux/netfilter_ipv4/ip_tables.h | 6 +
include/linux/netfilter_ipv6/ip6_tables.h | 3 +
net/bridge/netfilter/nft_meta_bridge.c | 1 +
net/bridge/netfilter/nft_reject_bridge.c | 1 +
net/ipv4/netfilter/ip_tables.c | 15 +-
net/ipv4/netfilter/ipt_SYNPROXY.c | 1 +
net/ipv4/netfilter/iptable_filter.c | 10 +-
net/ipv4/netfilter/iptable_mangle.c | 10 +-
net/ipv4/netfilter/iptable_nat.c | 10 +-
net/ipv4/netfilter/iptable_raw.c | 10 +-
net/ipv4/netfilter/iptable_security.c | 11 +-
net/ipv4/netfilter/nf_flow_table_ipv4.c | 1 +
net/ipv4/netfilter/nft_dup_ipv4.c | 1 +
net/ipv4/netfilter/nft_fib_ipv4.c | 1 +
net/ipv4/netfilter/nft_reject_ipv4.c | 1 +
net/ipv6/netfilter/ip6_tables.c | 15 +-
net/ipv6/netfilter/ip6t_SYNPROXY.c | 1 +
net/ipv6/netfilter/ip6table_filter.c | 10 +-
net/ipv6/netfilter/ip6table_mangle.c | 10 +-
net/ipv6/netfilter/ip6table_nat.c | 10 +-
net/ipv6/netfilter/ip6table_raw.c | 10 +-
net/ipv6/netfilter/ip6table_security.c | 10 +-
net/ipv6/netfilter/nf_flow_table_ipv6.c | 1 +
net/ipv6/netfilter/nft_dup_ipv6.c | 1 +
net/ipv6/netfilter/nft_fib_ipv6.c | 1 +
net/ipv6/netfilter/nft_reject_ipv6.c | 1 +
net/netfilter/ipset/ip_set_core.c | 2 +
net/netfilter/nf_dup_netdev.c | 1 +
net/netfilter/nf_flow_table_core.c | 1 +
net/netfilter/nf_flow_table_inet.c | 1 +
net/netfilter/nf_synproxy_core.c | 1 +
net/netfilter/nfnetlink.c | 1 +
net/netfilter/nft_compat.c | 1 +
net/netfilter/nft_connlimit.c | 1 +
net/netfilter/nft_counter.c | 1 +
net/netfilter/nft_ct.c | 1 +
net/netfilter/nft_dup_netdev.c | 1 +
net/netfilter/nft_fib_inet.c | 1 +
net/netfilter/nft_fib_netdev.c | 1 +
net/netfilter/nft_flow_offload.c | 1 +
net/netfilter/nft_hash.c | 1 +
net/netfilter/nft_limit.c | 1 +
net/netfilter/nft_log.c | 1 +
net/netfilter/nft_masq.c | 1 +
net/netfilter/nft_nat.c | 1 +
net/netfilter/nft_numgen.c | 1 +
net/netfilter/nft_objref.c | 1 +
net/netfilter/nft_osf.c | 1 +
net/netfilter/nft_queue.c | 1 +
net/netfilter/nft_quota.c | 1 +
net/netfilter/nft_redir.c | 1 +
net/netfilter/nft_reject.c | 1 +
net/netfilter/nft_reject_inet.c | 1 +
net/netfilter/nft_synproxy.c | 1 +
net/netfilter/nft_tunnel.c | 1 +
net/netfilter/xt_nat.c | 1 +
tools/testing/selftests/netfilter/Makefile | 2 +-
.../selftests/netfilter/nft_conntrack_helper.sh | 175 +++++++++++++++++++++
58 files changed, 344 insertions(+), 16 deletions(-)
create mode 100755 tools/testing/selftests/netfilter/nft_conntrack_helper.sh
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 0/7] Netfilter fixes for net
@ 2020-04-07 22:29 Pablo Neira Ayuso
2020-04-08 1:08 ` David Miller
0 siblings, 1 reply; 38+ messages in thread
From: Pablo Neira Ayuso @ 2020-04-07 22:29 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for net, they are:
1) Fix spurious overlap condition in the rbtree tree, from Stefano Brivio.
2) Fix possible uninitialized pointer dereference in nft_lookup.
3) IDLETIMER v1 target matches the Android layout, from
Maciej Zenczykowski.
4) Dangling pointer in nf_tables_set_alloc_name, from Eric Dumazet.
5) Fix RCU warning splat in ipset find_set_type(), from Amol Grover.
6) Report EOPNOTSUPP on unsupported set flags and object types in sets.
7) Add NFT_SET_CONCAT flag to provide consistent error reporting
when users defines set with ranges in concatenations in old kernels.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you.
----------------------------------------------------------------
The following changes since commit 0452800f6db4ed0a42ffb15867c0acfd68829f6a:
net: dsa: mt7530: fix null pointer dereferencing in port5 setup (2020-04-03 16:10:32 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to ef516e8625ddea90b3a0313f3a0b0baa83db7ac2:
netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag (2020-04-07 18:23:04 +0200)
----------------------------------------------------------------
Amol Grover (1):
netfilter: ipset: Pass lockdep expression to RCU lists
Eric Dumazet (1):
netfilter: nf_tables: do not leave dangling pointer in nf_tables_set_alloc_name
Maciej Żenczykowski (1):
netfilter: xt_IDLETIMER: target v1 - match Android layout
Pablo Neira Ayuso (3):
netfilter: nf_tables: do not update stateful expressions if lookup is inverted
netfilter: nf_tables: report EOPNOTSUPP on unsupported flags/object type
netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag
Stefano Brivio (1):
netfilter: nft_set_rbtree: Drop spurious condition for overlap detection on insertion
include/net/netfilter/nf_tables.h | 2 +-
include/uapi/linux/netfilter/nf_tables.h | 2 ++
include/uapi/linux/netfilter/xt_IDLETIMER.h | 1 +
net/netfilter/ipset/ip_set_core.c | 3 ++-
net/netfilter/nf_tables_api.c | 7 ++++---
net/netfilter/nft_lookup.c | 12 +++++++-----
net/netfilter/nft_set_bitmap.c | 1 -
net/netfilter/nft_set_rbtree.c | 23 +++++++++++------------
net/netfilter/xt_IDLETIMER.c | 3 +++
9 files changed, 31 insertions(+), 23 deletions(-)
^ permalink raw reply [flat|nested] 38+ messages in thread
* Re: [PATCH 0/7] Netfilter fixes for net
2020-04-07 22:29 Pablo Neira Ayuso
@ 2020-04-08 1:08 ` David Miller
0 siblings, 0 replies; 38+ messages in thread
From: David Miller @ 2020-04-08 1:08 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed, 8 Apr 2020 00:29:29 +0200
> The following patchset contains Netfilter fixes for net, they are:
>
> 1) Fix spurious overlap condition in the rbtree tree, from Stefano Brivio.
>
> 2) Fix possible uninitialized pointer dereference in nft_lookup.
>
> 3) IDLETIMER v1 target matches the Android layout, from
> Maciej Zenczykowski.
>
> 4) Dangling pointer in nf_tables_set_alloc_name, from Eric Dumazet.
>
> 5) Fix RCU warning splat in ipset find_set_type(), from Amol Grover.
>
> 6) Report EOPNOTSUPP on unsupported set flags and object types in sets.
>
> 7) Add NFT_SET_CONCAT flag to provide consistent error reporting
> when users defines set with ranges in concatenations in old kernels.
>
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks.
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 0/7] Netfilter fixes for net
@ 2020-03-24 22:32 Pablo Neira Ayuso
2020-03-25 0:31 ` David Miller
0 siblings, 1 reply; 38+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-24 22:32 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi,
The following patchset contains Netfilter fixes for net:
1) A new selftest for nf_queue, from Florian Westphal. This test
covers two recent fixes: 07f8e4d0fddb ("tcp: also NULL skb->dev
when copy was needed") and b738a185beaa ("tcp: ensure skb->dev is
NULL before leaving TCP stack").
2) The fwd action breaks with ifb. For safety in next extensions,
make sure the fwd action only runs from ingress until it is extended
to be used from a different hook.
3) The pipapo set type now reports EEXIST in case of subrange overlaps.
Update the rbtree set to validate range overlaps, so far this
validation is only done only from userspace. From Stefano Brivio.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you.
----------------------------------------------------------------
The following changes since commit 749f6f6843115b424680f1aada3c0dd613ad807c:
net: phy: dp83867: w/a for fld detect threshold bootstrapping issue (2020-03-21 20:09:57 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to a64d558d8cf98424cc5eb9ae6631782cd8bf789c:
selftests: netfilter: add nfqueue test case (2020-03-24 20:00:12 +0100)
----------------------------------------------------------------
Florian Westphal (1):
selftests: netfilter: add nfqueue test case
Pablo Neira Ayuso (3):
netfilter: nf_tables: Allow set back-ends to report partial overlaps on insertion
netfilter: nft_fwd_netdev: validate family and chain type
netfilter: nft_fwd_netdev: allow to redirect to ifb via ingress
Stefano Brivio (3):
netfilter: nft_set_pipapo: Separate partial and complete overlap cases on insertion
netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start()
netfilter: nft_set_rbtree: Detect partial overlaps on insertion
net/netfilter/nf_tables_api.c | 5 +
net/netfilter/nft_fwd_netdev.c | 13 +
net/netfilter/nft_set_pipapo.c | 34 ++-
net/netfilter/nft_set_rbtree.c | 87 +++++-
tools/testing/selftests/netfilter/Makefile | 6 +-
tools/testing/selftests/netfilter/config | 6 +
tools/testing/selftests/netfilter/nf-queue.c | 352 +++++++++++++++++++++++++
tools/testing/selftests/netfilter/nft_queue.sh | 332 +++++++++++++++++++++++
8 files changed, 818 insertions(+), 17 deletions(-)
create mode 100644 tools/testing/selftests/netfilter/nf-queue.c
create mode 100755 tools/testing/selftests/netfilter/nft_queue.sh
^ permalink raw reply [flat|nested] 38+ messages in thread
* Re: [PATCH 0/7] Netfilter fixes for net
2020-03-24 22:32 Pablo Neira Ayuso
@ 2020-03-25 0:31 ` David Miller
0 siblings, 0 replies; 38+ messages in thread
From: David Miller @ 2020-03-25 0:31 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 24 Mar 2020 23:32:13 +0100
> The following patchset contains Netfilter fixes for net:
>
> 1) A new selftest for nf_queue, from Florian Westphal. This test
> covers two recent fixes: 07f8e4d0fddb ("tcp: also NULL skb->dev
> when copy was needed") and b738a185beaa ("tcp: ensure skb->dev is
> NULL before leaving TCP stack").
>
> 2) The fwd action breaks with ifb. For safety in next extensions,
> make sure the fwd action only runs from ingress until it is extended
> to be used from a different hook.
>
> 3) The pipapo set type now reports EEXIST in case of subrange overlaps.
> Update the rbtree set to validate range overlaps, so far this
> validation is only done only from userspace. From Stefano Brivio.
>
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks Pablo.
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 0/7] Netfilter fixes for net
@ 2020-01-25 17:34 Pablo Neira Ayuso
2020-01-25 20:40 ` David Miller
0 siblings, 1 reply; 38+ messages in thread
From: Pablo Neira Ayuso @ 2020-01-25 17:34 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi,
The following patchset contains Netfilter fixes for net:
1) Missing netlink attribute sanity check for NFTA_OSF_DREG,
from Florian Westphal.
2) Use bitmap infrastructure in ipset to fix KASAN slab-out-of-bounds
reads, from Jozsef Kadlecsik.
3) Missing initial CLOSED state in new sctp connection through
ctnetlink events, from Jiri Wiesner.
4) Missing check for NFT_CHAIN_HW_OFFLOAD in nf_tables offload
indirect block infrastructure, from wenxu.
5) Add __nft_chain_type_get() to sanity check family and chain type.
6) Autoload modules from the nf_tables abort path to fix races
reported by syzbot.
7) Remove unnecessary skb->csum update on inet_proto_csum_replace16(),
from Praveen Chaudhary.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you.
----------------------------------------------------------------
The following changes since commit e02d9c4c68dc0ca08ded9487720bba775c09669b:
Merge branch 'bnxt_en-fixes' (2020-01-18 14:38:30 +0100)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 189c9b1e94539b11c80636bc13e9cf47529e7bba:
net: Fix skb->csum update in inet_proto_csum_replace16(). (2020-01-24 20:54:30 +0100)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: nft_osf: add missing check for DREG attribute
Jiri Wiesner (1):
netfilter: conntrack: sctp: use distinct states for new SCTP connections
Kadlecsik József (1):
netfilter: ipset: use bitmap infrastructure completely
Pablo Neira Ayuso (2):
netfilter: nf_tables: add __nft_chain_type_get()
netfilter: nf_tables: autoload modules from the abort path
Praveen Chaudhary (1):
net: Fix skb->csum update in inet_proto_csum_replace16().
wenxu (1):
netfilter: nf_tables_offload: fix check the chain offload flag
include/linux/netfilter/ipset/ip_set.h | 7 --
include/linux/netfilter/nfnetlink.h | 2 +-
include/net/netns/nftables.h | 1 +
net/core/utils.c | 20 +++-
net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +-
net/netfilter/ipset/ip_set_bitmap_ip.c | 6 +-
net/netfilter/ipset/ip_set_bitmap_ipmac.c | 6 +-
net/netfilter/ipset/ip_set_bitmap_port.c | 6 +-
net/netfilter/nf_conntrack_proto_sctp.c | 6 +-
net/netfilter/nf_tables_api.c | 155 +++++++++++++++++++++---------
net/netfilter/nf_tables_offload.c | 2 +-
net/netfilter/nfnetlink.c | 6 +-
net/netfilter/nft_osf.c | 3 +
13 files changed, 146 insertions(+), 76 deletions(-)
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 0/7] Netfilter fixes for net
@ 2019-08-14 9:24 Pablo Neira Ayuso
2019-08-15 21:02 ` David Miller
0 siblings, 1 reply; 38+ messages in thread
From: Pablo Neira Ayuso @ 2019-08-14 9:24 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi,
This patchset contains Netfilter fixes for net:
1) Extend selftest to cover flowtable with ipsec, from Florian Westphal.
2) Fix interaction of ipsec with flowtable, also from Florian.
3) User-after-free with bound set to rule that fails to load.
4) Adjust state and timeout for flows that expire.
5) Timeout update race with flows in teardown state.
6) Ensure conntrack id hash calculation use invariants as input,
from Dirk Morris.
7) Do not push flows into flowtable for TCP fin/rst packets.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 5e5412c365a32e452daa762eac36121cb8a370bb:
net/socket: fix GCC8+ Wpacked-not-aligned warnings (2019-08-03 11:02:46 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to dfe42be15fde16232340b8b2a57c359f51cc10d9:
netfilter: nft_flow_offload: skip tcp rst and fin packets (2019-08-14 11:09:07 +0200)
----------------------------------------------------------------
Dirk Morris (1):
netfilter: conntrack: Use consistent ct id hash calculation
Florian Westphal (2):
selftests: netfilter: extend flowtable test script for ipsec
netfilter: nf_flow_table: fix offload for flows that are subject to xfrm
Pablo Neira Ayuso (4):
netfilter: nf_tables: use-after-free in failing rule with bound set
netfilter: nf_flow_table: conntrack picks up expired flows
netfilter: nf_flow_table: teardown flow timeout race
netfilter: nft_flow_offload: skip tcp rst and fin packets
include/net/netfilter/nf_tables.h | 9 +++-
net/netfilter/nf_conntrack_core.c | 16 ++++----
net/netfilter/nf_flow_table_core.c | 43 +++++++++++++------
net/netfilter/nf_flow_table_ip.c | 43 +++++++++++++++++++
net/netfilter/nf_tables_api.c | 15 ++++---
net/netfilter/nft_flow_offload.c | 9 ++--
tools/testing/selftests/netfilter/nft_flowtable.sh | 48 ++++++++++++++++++++++
7 files changed, 153 insertions(+), 30 deletions(-)
^ permalink raw reply [flat|nested] 38+ messages in thread
* Re: [PATCH 0/7] Netfilter fixes for net
2019-08-14 9:24 Pablo Neira Ayuso
@ 2019-08-15 21:02 ` David Miller
0 siblings, 0 replies; 38+ messages in thread
From: David Miller @ 2019-08-15 21:02 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed, 14 Aug 2019 11:24:33 +0200
> This patchset contains Netfilter fixes for net:
>
> 1) Extend selftest to cover flowtable with ipsec, from Florian Westphal.
>
> 2) Fix interaction of ipsec with flowtable, also from Florian.
>
> 3) User-after-free with bound set to rule that fails to load.
>
> 4) Adjust state and timeout for flows that expire.
>
> 5) Timeout update race with flows in teardown state.
>
> 6) Ensure conntrack id hash calculation use invariants as input,
> from Dirk Morris.
>
> 7) Do not push flows into flowtable for TCP fin/rst packets.
>
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks.
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 0/7] Netfilter fixes for net
@ 2019-01-14 21:29 Pablo Neira Ayuso
2019-01-15 21:32 ` David Miller
0 siblings, 1 reply; 38+ messages in thread
From: Pablo Neira Ayuso @ 2019-01-14 21:29 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
This is the first batch of Netfilter fixes for your net tree:
1) Fix endless loop in nf_tables rules netlink dump, from Phil Sutter.
2) Reference counter leak in object from the error path, from Taehee Yoo.
3) Selective rule dump requires table and chain.
4) Fix DNAT with nft_flow_offload reverse route lookup, from wenxu.
5) Use GFP_KERNEL_ACCOUNT in vmalloc allocation from ebtables, from
Shakeel Butt.
6) Set ifindex from route to fix interaction with VRF slave device,
also from wenxu.
7) Use nfct_help() to check for conntrack helper, IPS_HELPER status
flag is only set from explicit helpers via -j CT, from Henry Yen.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit a0071840d2040ea1b27e5a008182b09b88defc15:
lan743x: Remove phy_read from link status change function (2019-01-08 16:26:12 -0500)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 2314e879747e82896f51cce4488f6a00f3e1af7b:
netfilter: nft_flow_offload: fix checking method of conntrack helper (2019-01-14 12:50:59 +0100)
----------------------------------------------------------------
Henry Yen (1):
netfilter: nft_flow_offload: fix checking method of conntrack helper
Pablo Neira Ayuso (1):
netfilter: nf_tables: selective rule dump needs table to be specified
Phil Sutter (1):
netfilter: nf_tables: Fix for endless loop when dumping ruleset
Shakeel Butt (1):
netfilter: ebtables: account ebt_table_info to kmemcg
Taehee Yoo (1):
netfilter: nf_tables: fix leaking object reference count
wenxu (2):
netfilter: nft_flow_offload: Fix reverse route lookup
netfilter: nft_flow_offload: fix interaction with vrf slave device
include/net/netfilter/nf_flow_table.h | 1 -
net/bridge/netfilter/ebtables.c | 6 ++++--
net/netfilter/nf_flow_table_core.c | 5 +++--
net/netfilter/nf_tables_api.c | 14 +++++++-------
net/netfilter/nft_flow_offload.c | 13 ++++++++-----
5 files changed, 22 insertions(+), 17 deletions(-)
^ permalink raw reply [flat|nested] 38+ messages in thread
* Re: [PATCH 0/7] Netfilter fixes for net
2019-01-14 21:29 Pablo Neira Ayuso
@ 2019-01-15 21:32 ` David Miller
0 siblings, 0 replies; 38+ messages in thread
From: David Miller @ 2019-01-15 21:32 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 14 Jan 2019 22:29:33 +0100
> This is the first batch of Netfilter fixes for your net tree:
>
> 1) Fix endless loop in nf_tables rules netlink dump, from Phil Sutter.
>
> 2) Reference counter leak in object from the error path, from Taehee Yoo.
>
> 3) Selective rule dump requires table and chain.
>
> 4) Fix DNAT with nft_flow_offload reverse route lookup, from wenxu.
>
> 5) Use GFP_KERNEL_ACCOUNT in vmalloc allocation from ebtables, from
> Shakeel Butt.
>
> 6) Set ifindex from route to fix interaction with VRF slave device,
> also from wenxu.
>
> 7) Use nfct_help() to check for conntrack helper, IPS_HELPER status
> flag is only set from explicit helpers via -j CT, from Henry Yen.
>
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks Pablo.
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 0/7] Netfilter fixes for net
@ 2016-08-30 11:26 Pablo Neira Ayuso
2016-08-31 5:02 ` David Miller
0 siblings, 1 reply; 38+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-30 11:26 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for your net tree,
they are:
1) Allow nf_tables reject expression from input, forward and output hooks,
since only there the routing information is available, otherwise we crash.
2) Fix unsafe list iteration when flushing timeout and accouting objects.
3) Fix refcount leak on timeout policy parsing failure.
4) Unlink timeout object for unconfirmed conntracks too
5) Missing validation of pkttype mangling from bridge family.
6) Fix refcount leak on ebtables on second lookup for the specific
bridge match extension, this patch from Sabrina Dubroca.
7) Remove unnecessary ip_hdr() in nf_tables_netdev family.
Patches from 1-5 and 7 from Liping Zhang.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 51af96b53469f3b8cfcfe0504d0ff87239175b78:
mlxsw: router: Enable neighbors to be created on stacked devices (2016-08-24 09:39:04 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to c73c2484901139c28383b58eabcbf4d613e91518:
netfilter: nf_tables_netdev: remove redundant ip_hdr assignment (2016-08-30 11:41:04 +0200)
----------------------------------------------------------------
Liping Zhang (6):
netfilter: nft_reject: restrict to INPUT/FORWARD/OUTPUT
netfilter: nfnetlink: use list_for_each_entry_safe to delete all objects
netfilter: cttimeout: put back l4proto when replacing timeout policy
netfilter: cttimeout: unlink timeout objs in the unconfirmed ct lists
netfilter: nft_meta: improve the validity check of pkttype set expr
netfilter: nf_tables_netdev: remove redundant ip_hdr assignment
Sabrina Dubroca (1):
netfilter: ebtables: put module reference when an incorrect extension is found
include/net/netfilter/nft_meta.h | 4 +++
include/net/netfilter/nft_reject.h | 4 +++
net/bridge/netfilter/ebtables.c | 2 ++
net/bridge/netfilter/nft_meta_bridge.c | 1 +
net/ipv4/netfilter/nft_reject_ipv4.c | 1 +
net/ipv6/netfilter/nft_reject_ipv6.c | 1 +
net/netfilter/nf_tables_netdev.c | 1 -
net/netfilter/nfnetlink_acct.c | 6 ++---
net/netfilter/nfnetlink_cttimeout.c | 49 +++++++++++++++++++---------------
net/netfilter/nft_meta.c | 17 +++++++++---
net/netfilter/nft_reject.c | 16 +++++++++++
net/netfilter/nft_reject_inet.c | 7 ++++-
12 files changed, 79 insertions(+), 30 deletions(-)
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 0/7] Netfilter fixes for net
@ 2016-06-17 18:25 Pablo Neira Ayuso
2016-06-18 2:50 ` David Miller
0 siblings, 1 reply; 38+ messages in thread
From: Pablo Neira Ayuso @ 2016-06-17 18:25 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for your net tree,
they are rather small patches but fixing several outstanding bugs in
nf_conntrack and nf_tables, as well as minor problems with missing
SYNPROXY header uapi installation:
1) Oneliner not to leak conntrack kmemcache on module removal, this
problem was introduced in the previous merge window, patch from
Florian Westphal.
2) Two fixes for insufficient ruleset loop validation, one due to
incorrect flag check in nf_tables_bind_set() and another related to
silly wrong generation mask logic from the walk path, from Liping
Zhang.
3) Fix double-free of anonymous sets on error, this fix simplifies the
code to let the abort path take care of releasing the set object,
also from Liping Zhang.
4) The introduction of helper function for transactions broke the skip
inactive rules logic from the nft_do_chain(), again from Liping
Zhang.
5) Two patches to install uapi xt_SYNPROXY.h header and calm down
kbuild robot due to missing #include <linux/types.h>.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 61e0979a497b07f5a82f3050e37ecc7093e2971d:
Merge branch 'ovs-notifications' (2016-06-14 22:21:45 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 1463847e93fe693e89c52b03ab4ede6800d717c1:
netfilter: xt_SYNPROXY: include missing <linux/types.h> (2016-06-17 13:47:40 +0200)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: conntrack: destroy kmemcache on module removal
Liping Zhang (3):
netfilter: nf_tables: fix wrong check of NFT_SET_MAP in nf_tables_bind_set
netfilter: nf_tables: fix wrong destroy anonymous sets if binding fails
netfilter: nf_tables: fix a wrong check to skip the inactive rules
Pablo Neira Ayuso (3):
netfilter: nf_tables: reject loops from set element jump to chain
netfilter: xt_SYNPROXY: add missing header to Kbuild
netfilter: xt_SYNPROXY: include missing <linux/types.h>
include/net/netfilter/nf_tables.h | 1 +
include/uapi/linux/netfilter/Kbuild | 1 +
include/uapi/linux/netfilter/xt_SYNPROXY.h | 2 ++
net/netfilter/nf_conntrack_core.c | 2 ++
net/netfilter/nf_tables_api.c | 24 +++++++++++-------------
net/netfilter/nf_tables_core.c | 2 +-
net/netfilter/nft_hash.c | 3 +--
net/netfilter/nft_rbtree.c | 3 +--
8 files changed, 20 insertions(+), 18 deletions(-)
^ permalink raw reply [flat|nested] 38+ messages in thread
* Re: [PATCH 0/7] Netfilter fixes for net
2016-06-17 18:25 Pablo Neira Ayuso
@ 2016-06-18 2:50 ` David Miller
0 siblings, 0 replies; 38+ messages in thread
From: David Miller @ 2016-06-18 2:50 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 17 Jun 2016 20:25:12 +0200
> The following patchset contains Netfilter fixes for your net tree,
> they are rather small patches but fixing several outstanding bugs in
> nf_conntrack and nf_tables, as well as minor problems with missing
> SYNPROXY header uapi installation:
...
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks Pablo.
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 0/7] Netfilter fixes for net
@ 2016-06-01 12:03 Pablo Neira Ayuso
2016-06-02 0:54 ` David Miller
0 siblings, 1 reply; 38+ messages in thread
From: Pablo Neira Ayuso @ 2016-06-01 12:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for your net tree,
they are:
1) Fix incorrect timestamp in nfnetlink_queue introduced when addressing
y2038 safe timestamp, from Florian Westphal.
2) Get rid of leftover conntrack definition from the previous merge
window, oneliner from Florian.
3) Make nf_queue handler pernet to resolve race on dereferencing the
hook state structure with netns removal, from Eric Biederman.
4) Ensure clean exit on unregistered helper ports, from Taehee Yoo.
5) Restore FLOWI_FLAG_KNOWN_NH in nf_dup_ipv6. This got lost while
generalizing xt_TEE to add packet duplication support in nf_tables,
from Paolo Abeni.
6) Insufficient netlink NFTA_SET_TABLE attribute check in
nf_tables_getset(), from Phil Turnbull.
7) Reject helper registration on duplicated ports via modparams.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 1b7cc307a88377b0c948f9cbc36d026b272fe6e3:
Merge branch 'bnxt_en-fixes' (2016-05-11 23:46:09 -0400)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 893e093c786c4256d52809eed697e9d70a6f6643:
netfilter: nf_ct_helper: bail out on duplicated helpers (2016-05-31 11:57:18 +0200)
----------------------------------------------------------------
Eric W. Biederman (1):
netfilter: nf_queue: Make the queue_handler pernet
Florian Westphal (2):
netfilter: nfnetlink_queue: fix timestamp attribute
netfilter: conntrack: remove leftover binary sysctl define
Pablo Neira Ayuso (1):
netfilter: nf_ct_helper: bail out on duplicated helpers
Paolo Abeni (1):
netfilter: nf_dup_ipv6: set again FLOWI_FLAG_KNOWN_NH at flowi6_flags
Phil Turnbull (1):
netfilter: nf_tables: validate NFTA_SET_TABLE parameter
Taehee Yoo (1):
netfilter: nf_ct_helper: Fix helper unregister count.
include/net/netfilter/nf_queue.h | 4 ++--
include/net/netns/netfilter.h | 2 ++
net/ipv6/netfilter/nf_dup_ipv6.c | 1 +
net/netfilter/nf_conntrack_ftp.c | 1 +
net/netfilter/nf_conntrack_helper.c | 9 ++++-----
net/netfilter/nf_conntrack_irc.c | 1 +
net/netfilter/nf_conntrack_sane.c | 1 +
net/netfilter/nf_conntrack_sip.c | 1 +
net/netfilter/nf_conntrack_standalone.c | 2 --
net/netfilter/nf_conntrack_tftp.c | 1 +
net/netfilter/nf_queue.c | 17 ++++++++---------
net/netfilter/nf_tables_api.c | 2 ++
net/netfilter/nfnetlink_queue.c | 20 +++++++++++++-------
13 files changed, 37 insertions(+), 25 deletions(-)
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 0/7] Netfilter fixes for net
@ 2015-07-08 9:48 Pablo Neira Ayuso
2015-07-09 7:03 ` David Miller
0 siblings, 1 reply; 38+ messages in thread
From: Pablo Neira Ayuso @ 2015-07-08 9:48 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for your net tree. This batch
mostly comes with patches to address fallout from the previous merge window
cycle, they are:
1) Use entry->state.hook_list from nf_queue() instead of the global nf_hooks
which is not valid when used from NFPROTO_NETDEV, this should cause no
problems though since we have no userspace queueing for that family, but
let's fix this now for the sake of correctness. Patch from Eric W. Biederman.
2) Fix compilation breakage in bridge netfilter if CONFIG_NF_DEFRAG_IPV4 is not
set, from Bernhard Thaler.
3) Use percpu jumpstack in arptables too, now that there's a single copy of the
rule blob we can't store the return address there anymore. Patch from
Florian Westphal.
4) Fix a skb leak in the xmit path of bridge netfilter, problem there since
2.6.37 although it should be not possible to hit invalid traffic there, also
from Florian.
5) Eric Leblond reports that when loading a large ruleset with many missing
modules after a fresh boot, nf_tables can take long time commit it. Fix this
by processing the full batch until the end, even on missing modules, then
abort only once and restart processing.
6) Add bridge netfilter files to the MAINTAINER files.
7) Fix a net_device refcount leak in the new IPV6 bridge netfilter code, from
Julien Grall.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 4da3064d1775810f10f7ddc1c34c3f1ff502a654:
Merge tag 'devicetree-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/glikely/linux (2015-07-01 19:40:18 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
for you to fetch changes up to 86e8971800381c3a8d8d9327f83b1f97ccb04a4f:
netfilter: bridge: Use __in6_dev_get rather than in6_dev_get in br_validate_ipv6 (2015-07-08 11:02:16 +0200)
----------------------------------------------------------------
Bernhard Thaler (1):
netfilter: bridge: fix CONFIG_NF_DEFRAG_IPV4/6 related warnings/errors
Eric W. Biederman (1):
netfilter: nf_queue: Don't recompute the hook_list head
Florian Westphal (2):
netfilter: arptables: use percpu jumpstack
netfilter: bridge: don't leak skb in error paths
Julien Grall (1):
netfilter: bridge: Use __in6_dev_get rather than in6_dev_get in br_validate_ipv6
Pablo Neira Ayuso (2):
netfilter: nfnetlink: keep going batch handling on missing modules
MAINTAINER: add bridge netfilter
MAINTAINERS | 1 +
net/bridge/br_netfilter_hooks.c | 16 +++++++++++-----
net/bridge/br_netfilter_ipv6.c | 2 +-
net/ipv4/netfilter/arp_tables.c | 25 ++++++++++++++++---------
net/netfilter/nf_queue.c | 2 +-
net/netfilter/nfnetlink.c | 38 +++++++++++++++++++++++++-------------
6 files changed, 55 insertions(+), 29 deletions(-)
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 0/7] netfilter fixes for net
@ 2014-10-20 8:10 Pablo Neira Ayuso
2014-10-20 15:58 ` David Miller
0 siblings, 1 reply; 38+ messages in thread
From: Pablo Neira Ayuso @ 2014-10-20 8:10 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains netfilter fixes for your net tree,
they are:
1) Fix missing MODULE_LICENSE() in the new nf_reject_ipv{4,6} modules.
2) Restrict nat and masq expressions to the nat chain type. Otherwise,
users may crash their kernel if they attach a nat/masq rule to a non
nat chain.
3) Fix hook validation in nft_compat when non-base chains are used.
Basically, initialize hook_mask to zero.
4) Make sure you use match/targets in nft_compat from the right chain
type. The existing validation relies on the table name which can be
avoided by
5) Better netlink attribute validation in nft_nat. This expression has
to reject the configuration when no address and proto configurations
are specified.
6) Interpret NFTA_NAT_REG_*_MAX if only if NFTA_NAT_REG_*_MIN is set.
Yet another sanity check to reject incorrect configurations from
userspace.
7) Conditional NAT attribute dumping depending on the existing
configuration.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 01d2d484e49e9bc0ed9b5fdaf345a0e2bf35ffed:
Merge branch 'bcmgenet_systemport' (2014-10-10 15:39:22 -0400)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
for you to fetch changes up to 1e2d56a5d33a7e1fcd21ed3859f52596d02708b0:
netfilter: nft_nat: dump attributes if they are set (2014-10-18 14:16:13 +0200)
----------------------------------------------------------------
Pablo Neira Ayuso (7):
netfilter: missing module license in the nf_reject_ipvX modules
netfilter: nf_tables: restrict nat/masq expressions to nat chain type
netfilter: nft_compat: fix hook validation for non-base chains
netfilter: nft_compat: validate chain type in match/target
netfilter: nft_nat: insufficient attribute validation
netfilter: nft_nat: NFTA_NAT_REG_ADDR_MAX depends on NFTA_NAT_REG_ADDR_MIN
netfilter: nft_nat: dump attributes if they are set
include/net/netfilter/nf_tables.h | 3 ++
include/net/netfilter/nft_masq.h | 3 ++
net/ipv4/netfilter/nf_reject_ipv4.c | 3 ++
net/ipv4/netfilter/nft_masq_ipv4.c | 1 +
net/ipv6/netfilter/nf_reject_ipv6.c | 4 ++
net/ipv6/netfilter/nft_masq_ipv6.c | 1 +
net/netfilter/nf_tables_api.c | 14 ++++++
net/netfilter/nft_compat.c | 79 ++++++++++++++++++++++++++++----
net/netfilter/nft_masq.c | 12 +++++
net/netfilter/nft_nat.c | 86 ++++++++++++++++++++++-------------
10 files changed, 165 insertions(+), 41 deletions(-)
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 0/7] netfilter fixes for net
@ 2013-11-21 9:05 Pablo Neira Ayuso
2013-11-21 17:45 ` David Miller
0 siblings, 1 reply; 38+ messages in thread
From: Pablo Neira Ayuso @ 2013-11-21 9:05 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David!
The following patchset contains fixes for your net tree, they are:
* Remove extra quote from connlimit configuration in Kconfig, from
Randy Dunlap.
* Fix missing mss option in syn packets sent to the backend in our
new synproxy target, from Martin Topholm.
* Use window scale announced by client when sending the forged
syn to the backend, from Martin Topholm.
* Fix IPv6 address comparison in ebtables, from Luís Fernando
Cornachioni Estrozi.
* Fix wrong endianess in sequence adjustment which breaks helpers
in NAT configurations, from Phil Oester.
* Fix the error path handling of nft_compat, from me.
* Make sure the global conntrack counter is decremented after the
object has been released, also from me.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
Thanks!
----------------------------------------------------------------
The following changes since commit 42a2d923cc349583ebf6fdd52a7d35e1c2f7e6bd:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next (2013-11-13 17:40:34 +0900)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
for you to fetch changes up to acab78b99633f12aa2b697474562e19c5718a1ca:
netfilter: ebt_ip6: fix source and destination matching (2013-11-19 15:33:29 +0100)
----------------------------------------------------------------
Luís Fernando Cornachioni Estrozi (1):
netfilter: ebt_ip6: fix source and destination matching
Martin Topholm (2):
netfilter: synproxy: send mss option to backend
netfilter: synproxy: correct wscale option passing
Pablo Neira Ayuso (2):
netfilter: nft_compat: fix error path in nft_parse_compat()
netfilter: nf_conntrack: decrement global counter after object release
Phil Oester (1):
netfilter: fix wrong byte order in nf_ct_seqadj_set internal information
Randy Dunlap (1):
netfilter: fix connlimit Kconfig prompt string
net/bridge/netfilter/ebt_ip6.c | 8 +++++---
net/ipv4/netfilter/ipt_SYNPROXY.c | 1 +
net/ipv6/netfilter/ip6t_SYNPROXY.c | 1 +
net/netfilter/Kconfig | 2 +-
net/netfilter/nf_conntrack_core.c | 3 ++-
net/netfilter/nf_conntrack_seqadj.c | 4 ++--
net/netfilter/nf_synproxy_core.c | 7 ++++---
net/netfilter/nft_compat.c | 19 +++++++++++++------
8 files changed, 29 insertions(+), 16 deletions(-)
^ permalink raw reply [flat|nested] 38+ messages in thread
* Re: [PATCH 0/7] netfilter fixes for net
2013-11-21 9:05 Pablo Neira Ayuso
@ 2013-11-21 17:45 ` David Miller
0 siblings, 0 replies; 38+ messages in thread
From: David Miller @ 2013-11-21 17:45 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 21 Nov 2013 10:05:21 +0100
> The following patchset contains fixes for your net tree, they are:
>
> * Remove extra quote from connlimit configuration in Kconfig, from
> Randy Dunlap.
>
> * Fix missing mss option in syn packets sent to the backend in our
> new synproxy target, from Martin Topholm.
>
> * Use window scale announced by client when sending the forged
> syn to the backend, from Martin Topholm.
>
> * Fix IPv6 address comparison in ebtables, from Luís Fernando
> Cornachioni Estrozi.
>
> * Fix wrong endianess in sequence adjustment which breaks helpers
> in NAT configurations, from Phil Oester.
>
> * Fix the error path handling of nft_compat, from me.
>
> * Make sure the global conntrack counter is decremented after the
> object has been released, also from me.
Pulled, thanks a lot Pablo.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 0/7] netfilter fixes for net
@ 2013-09-17 22:21 Pablo Neira Ayuso
2013-09-18 0:23 ` David Miller
0 siblings, 1 reply; 38+ messages in thread
From: Pablo Neira Ayuso @ 2013-09-17 22:21 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Resending pull request email, previous one was missing the pull request
information itself, sorry.
--
Hi David,
The following patchset contains Netfilter fixes for you net tree,
mostly targeted to ipset, they are:
* Fix ICMPv6 NAT due to wrong comparison, code instead of type, from
Phil Oester.
* Fix RCU race in conntrack extensions release path, from Michal Kubecek.
* Fix missing inversion in the userspace ipset test command match if
the nomatch option is specified, from Jozsef Kadlecsik.
* Skip layer 4 protocol matching in ipset in case of IPv6 fragments,
also from Jozsef Kadlecsik.
* Fix sequence adjustment in nfnetlink_queue due to using the netlink
skb instead of the network skb, from Gao feng.
* Make sure we cannot swap of sets with different layer 3 family in
ipset, from Jozsef Kadlecsik.
* Fix possible bogus matching in ipset if hash sets with net elements
are used, from Oliver Smith.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
Thanks!
----------------------------------------------------------------
The following changes since commit c19d65c95c6d472d69829fea7d473228493d5245:
bnx2x: Fix configuration of doorbell block (2013-09-09 17:06:14 -0400)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
for you to fetch changes up to 0a0d80eb39aa465b7bdf6f7754d0ba687eb3d2a7:
netfilter: nfnetlink_queue: use network skb for sequence adjustment (2013-09-17 13:05:12 +0200)
----------------------------------------------------------------
Gao feng (1):
netfilter: nfnetlink_queue: use network skb for sequence adjustment
Jozsef Kadlecsik (3):
netfilter: ipset: Skip really non-first fragments for IPv6 when getting port/protocol
netfilter: ipset: Consistent userspace testing with nomatch flag
netfilter: ipset: Validate the set family and not the set type family at swapping
Michal Kubeček (1):
netfilter: nf_conntrack: use RCU safe kfree for conntrack extensions
Oliver Smith (1):
netfilter: ipset: Fix serious failure in CIDR tracking
Phil Oester (1):
netfilter: nf_nat_proto_icmpv6:: fix wrong comparison in icmpv6_manip_pkt
include/linux/netfilter/ipset/ip_set.h | 6 ++++--
include/net/netfilter/nf_conntrack_extend.h | 2 +-
net/ipv6/netfilter/nf_nat_proto_icmpv6.c | 4 ++--
net/netfilter/ipset/ip_set_core.c | 5 ++---
net/netfilter/ipset/ip_set_getport.c | 4 ++--
net/netfilter/ipset/ip_set_hash_gen.h | 28 +++++++++++++++------------
net/netfilter/ipset/ip_set_hash_ipportnet.c | 4 ++--
net/netfilter/ipset/ip_set_hash_net.c | 4 ++--
net/netfilter/ipset/ip_set_hash_netiface.c | 4 ++--
net/netfilter/ipset/ip_set_hash_netport.c | 4 ++--
net/netfilter/nfnetlink_queue_core.c | 2 +-
11 files changed, 36 insertions(+), 31 deletions(-)
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 38+ messages in thread
* Re: [PATCH 0/7] netfilter fixes for net
2013-09-17 22:21 Pablo Neira Ayuso
@ 2013-09-18 0:23 ` David Miller
0 siblings, 0 replies; 38+ messages in thread
From: David Miller @ 2013-09-18 0:23 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel, netdev
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed, 18 Sep 2013 00:21:59 +0200
> The following patchset contains Netfilter fixes for you net tree,
> mostly targeted to ipset, they are:
...
> You can pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
Looks good, pulled, thanks a lot.
^ permalink raw reply [flat|nested] 38+ messages in thread
* [PATCH 0/7] netfilter fixes for net
@ 2013-09-17 22:07 Pablo Neira Ayuso
0 siblings, 0 replies; 38+ messages in thread
From: Pablo Neira Ayuso @ 2013-09-17 22:07 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter fixes for you net tree,
they are:
* Fix ICMPv6 NAT due to wrong comparison, code instead of type, from
Phil Oester.
* Fix RCU race in conntrack extensions release path, from Michal Kubecek.
* Fix missing inversion in the userspace ipset test command match if
the nomatch option is specified, from Jozsef Kadlecsik.
* Skip layer 4 protocol matching in ipset in case of IPv6 fragments,
also from Jozsef Kadlecsik.
* Fix sequence adjustment in nfnetlink_queue due to using the netlink
skb instead of the network skb, from Gao feng.
* Make sure we cannot swap of sets with different layer 3 family in
ipset, from Jozsef Kadlecsik.
* Fix possible bogus matching in ipset if hash sets with net elements
are used, from Oliver Smith.
Gao feng (1):
netfilter: nfnetlink_queue: use network skb for sequence adjustment
Jozsef Kadlecsik (3):
netfilter: ipset: Skip really non-first fragments for IPv6 when getting port/protocol
netfilter: ipset: Consistent userspace testing with nomatch flag
netfilter: ipset: Validate the set family and not the set type family at swapping
Michal Kubeček (1):
netfilter: nf_conntrack: use RCU safe kfree for conntrack extensions
Oliver Smith (1):
netfilter: ipset: Fix serious failure in CIDR tracking
Phil Oester (1):
netfilter: nf_nat_proto_icmpv6:: fix wrong comparison in icmpv6_manip_pkt
include/linux/netfilter/ipset/ip_set.h | 6 ++++--
include/net/netfilter/nf_conntrack_extend.h | 2 +-
net/ipv6/netfilter/nf_nat_proto_icmpv6.c | 4 ++--
net/netfilter/ipset/ip_set_core.c | 5 ++---
net/netfilter/ipset/ip_set_getport.c | 4 ++--
net/netfilter/ipset/ip_set_hash_gen.h | 28 +++++++++++++++------------
net/netfilter/ipset/ip_set_hash_ipportnet.c | 4 ++--
net/netfilter/ipset/ip_set_hash_net.c | 4 ++--
net/netfilter/ipset/ip_set_hash_netiface.c | 4 ++--
net/netfilter/ipset/ip_set_hash_netport.c | 4 ++--
net/netfilter/nfnetlink_queue_core.c | 2 +-
11 files changed, 36 insertions(+), 31 deletions(-)
--
1.7.10.4
^ permalink raw reply [flat|nested] 38+ messages in thread
end of thread, other threads:[~2020-10-22 19:16 UTC | newest]
Thread overview: 38+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-03-24 20:34 [PATCH 0/7] Netfilter fixes for net Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 1/7] netfilter: nf_tables: meter: pick a set backend that supports updates Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 2/7] netfilter: nf_tables: permit second nat hook if colliding hook is going away Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 3/7] netfilter: nf_tables: add missing netlink attrs to policies Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 4/7] netfilter: drop template ct when conntrack is skipped Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 5/7] netfilter: nf_tables: cache device name in flowtable object Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 6/7] netfilter: nf_tables: do not hold reference on netdevice from preparation phase Pablo Neira Ayuso
2018-03-24 20:34 ` [PATCH 7/7] netfilter: nf_socket: Fix out of bounds access in nf_sk_lookup_slow_v{4,6} Pablo Neira Ayuso
2018-03-24 21:10 ` [PATCH 0/7] Netfilter fixes for net David Miller
-- strict thread matches above, loose matches on Subject: below --
2020-10-22 17:29 Pablo Neira Ayuso
2020-10-22 19:16 ` Jakub Kicinski
2020-06-25 18:26 Pablo Neira Ayuso
2020-06-25 19:59 ` David Miller
2020-04-07 22:29 Pablo Neira Ayuso
2020-04-08 1:08 ` David Miller
2020-03-24 22:32 Pablo Neira Ayuso
2020-03-25 0:31 ` David Miller
2020-01-25 17:34 Pablo Neira Ayuso
2020-01-25 20:40 ` David Miller
2019-08-14 9:24 Pablo Neira Ayuso
2019-08-15 21:02 ` David Miller
2019-01-14 21:29 Pablo Neira Ayuso
2019-01-15 21:32 ` David Miller
2016-08-30 11:26 Pablo Neira Ayuso
2016-08-31 5:02 ` David Miller
2016-06-17 18:25 Pablo Neira Ayuso
2016-06-18 2:50 ` David Miller
2016-06-01 12:03 Pablo Neira Ayuso
2016-06-02 0:54 ` David Miller
2015-07-08 9:48 Pablo Neira Ayuso
2015-07-09 7:03 ` David Miller
2014-10-20 8:10 [PATCH 0/7] netfilter " Pablo Neira Ayuso
2014-10-20 15:58 ` David Miller
2013-11-21 9:05 Pablo Neira Ayuso
2013-11-21 17:45 ` David Miller
2013-09-17 22:21 Pablo Neira Ayuso
2013-09-18 0:23 ` David Miller
2013-09-17 22:07 Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).