From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 0/7] Netfilter fixes for net
Date: Tue, 30 Aug 2016 13:26:16 +0200 [thread overview]
Message-ID: <1472556383-6787-1-git-send-email-pablo@netfilter.org> (raw)
Hi David,
The following patchset contains Netfilter fixes for your net tree,
they are:
1) Allow nf_tables reject expression from input, forward and output hooks,
since only there the routing information is available, otherwise we crash.
2) Fix unsafe list iteration when flushing timeout and accouting objects.
3) Fix refcount leak on timeout policy parsing failure.
4) Unlink timeout object for unconfirmed conntracks too
5) Missing validation of pkttype mangling from bridge family.
6) Fix refcount leak on ebtables on second lookup for the specific
bridge match extension, this patch from Sabrina Dubroca.
7) Remove unnecessary ip_hdr() in nf_tables_netdev family.
Patches from 1-5 and 7 from Liping Zhang.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit 51af96b53469f3b8cfcfe0504d0ff87239175b78:
mlxsw: router: Enable neighbors to be created on stacked devices (2016-08-24 09:39:04 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to c73c2484901139c28383b58eabcbf4d613e91518:
netfilter: nf_tables_netdev: remove redundant ip_hdr assignment (2016-08-30 11:41:04 +0200)
----------------------------------------------------------------
Liping Zhang (6):
netfilter: nft_reject: restrict to INPUT/FORWARD/OUTPUT
netfilter: nfnetlink: use list_for_each_entry_safe to delete all objects
netfilter: cttimeout: put back l4proto when replacing timeout policy
netfilter: cttimeout: unlink timeout objs in the unconfirmed ct lists
netfilter: nft_meta: improve the validity check of pkttype set expr
netfilter: nf_tables_netdev: remove redundant ip_hdr assignment
Sabrina Dubroca (1):
netfilter: ebtables: put module reference when an incorrect extension is found
include/net/netfilter/nft_meta.h | 4 +++
include/net/netfilter/nft_reject.h | 4 +++
net/bridge/netfilter/ebtables.c | 2 ++
net/bridge/netfilter/nft_meta_bridge.c | 1 +
net/ipv4/netfilter/nft_reject_ipv4.c | 1 +
net/ipv6/netfilter/nft_reject_ipv6.c | 1 +
net/netfilter/nf_tables_netdev.c | 1 -
net/netfilter/nfnetlink_acct.c | 6 ++---
net/netfilter/nfnetlink_cttimeout.c | 49 +++++++++++++++++++---------------
net/netfilter/nft_meta.c | 17 +++++++++---
net/netfilter/nft_reject.c | 16 +++++++++++
net/netfilter/nft_reject_inet.c | 7 ++++-
12 files changed, 79 insertions(+), 30 deletions(-)
next reply other threads:[~2016-08-30 11:26 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-08-30 11:26 Pablo Neira Ayuso [this message]
2016-08-30 11:26 ` [PATCH 1/7] netfilter: nft_reject: restrict to INPUT/FORWARD/OUTPUT Pablo Neira Ayuso
2016-08-30 11:26 ` [PATCH 2/7] netfilter: nfnetlink: use list_for_each_entry_safe to delete all objects Pablo Neira Ayuso
2016-08-30 11:26 ` [PATCH 3/7] netfilter: cttimeout: put back l4proto when replacing timeout policy Pablo Neira Ayuso
2016-08-30 11:26 ` [PATCH 4/7] netfilter: cttimeout: unlink timeout objs in the unconfirmed ct lists Pablo Neira Ayuso
2016-08-30 11:26 ` [PATCH 5/7] netfilter: nft_meta: improve the validity check of pkttype set expr Pablo Neira Ayuso
2016-08-30 11:26 ` [PATCH 6/7] netfilter: ebtables: put module reference when an incorrect extension is found Pablo Neira Ayuso
2016-08-30 11:26 ` [PATCH 7/7] netfilter: nf_tables_netdev: remove redundant ip_hdr assignment Pablo Neira Ayuso
2016-08-31 5:02 ` [PATCH 0/7] Netfilter fixes for net David Miller
-- strict thread matches above, loose matches on Subject: below --
2020-10-22 17:29 Pablo Neira Ayuso
2020-10-22 19:16 ` Jakub Kicinski
2020-06-25 18:26 Pablo Neira Ayuso
2020-06-25 19:59 ` David Miller
2020-04-07 22:29 Pablo Neira Ayuso
2020-04-08 1:08 ` David Miller
2020-03-24 22:32 Pablo Neira Ayuso
2020-03-25 0:31 ` David Miller
2020-01-25 17:34 Pablo Neira Ayuso
2020-01-25 20:40 ` David Miller
2019-08-14 9:24 Pablo Neira Ayuso
2019-08-15 21:02 ` David Miller
2019-01-14 21:29 Pablo Neira Ayuso
2019-01-15 21:32 ` David Miller
2016-06-17 18:25 Pablo Neira Ayuso
2016-06-18 2:50 ` David Miller
2016-06-01 12:03 Pablo Neira Ayuso
2016-06-02 0:54 ` David Miller
2015-07-08 9:48 Pablo Neira Ayuso
2015-07-09 7:03 ` David Miller
2014-10-20 8:10 [PATCH 0/7] netfilter " Pablo Neira Ayuso
2014-10-20 15:58 ` David Miller
2013-11-21 9:05 Pablo Neira Ayuso
2013-11-21 17:45 ` David Miller
2013-09-17 22:21 Pablo Neira Ayuso
2013-09-18 0:23 ` David Miller
2013-09-17 22:07 Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1472556383-6787-1-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).