Netfilter-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH 0/4] Netfilter fixes for net
@ 2015-05-16 18:47 Pablo Neira Ayuso
  2015-05-16 18:47 ` [PATCH 1/4] ipvs: fix memory leak in ip_vs_ctl.c Pablo Neira Ayuso
                   ` (4 more replies)
  0 siblings, 5 replies; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-05-16 18:47 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains Netfilter fixes for your net tree, they are:

1) Fix a leak in IPVS, the sysctl table is not released accordingly when
   destroying a netns, patch from Tommi Rantala.

2) Fix a build error when TPROXY and socket are built-in but IPv6 defrag is
   compiled as module, from Florian Westphal.

3) Fix TCP tracket wrt. RFC5961 challenge ACK when in LAST_ACK state, patch
   from Jesper Dangaard Brouer.

4) Fix a bogus WARN_ON() in nf_tables when deleting a set element that stores
   a map, from Mirek Kratochvil.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 39376ccb1968ba9f83e2a880a8bf02ad5dea44e1:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf (2015-04-27 23:12:34 -0400)

are available in the git repository at:


  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to 960bd2c26421d321e890f1936938196ead41976f:

  netfilter: nf_tables: fix bogus warning in nft_data_uninit() (2015-05-15 22:07:30 +0200)

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m

Jesper Dangaard Brouer (1):
      conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition

Mirek Kratochvil (1):
      netfilter: nf_tables: fix bogus warning in nft_data_uninit()

Tommi Rantala (1):
      ipvs: fix memory leak in ip_vs_ctl.c

 include/uapi/linux/netfilter/nf_conntrack_tcp.h |    3 ++
 net/netfilter/Kconfig                           |    2 ++
 net/netfilter/ipvs/ip_vs_ctl.c                  |    3 ++
 net/netfilter/nf_conntrack_proto_tcp.c          |   35 +++++++++++++++++++++--
 net/netfilter/nf_tables_api.c                   |    4 +--
 5 files changed, 42 insertions(+), 5 deletions(-)

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 1/4] ipvs: fix memory leak in ip_vs_ctl.c
  2015-05-16 18:47 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
@ 2015-05-16 18:47 ` Pablo Neira Ayuso
  2015-05-16 18:47 ` [PATCH 2/4] netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m Pablo Neira Ayuso
                   ` (3 subsequent siblings)
  4 siblings, 0 replies; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-05-16 18:47 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

From: Tommi Rantala <tt.rantala@gmail.com>

Fix memory leak introduced in commit a0840e2e165a ("IPVS: netns,
ip_vs_ctl local vars moved to ipvs struct."):

unreferenced object 0xffff88005785b800 (size 2048):
  comm "(-localed)", pid 1434, jiffies 4294755650 (age 1421.089s)
  hex dump (first 32 bytes):
    bb 89 0b 83 ff ff ff ff b0 78 f0 4e 00 88 ff ff  .........x.N....
    04 00 00 00 a4 01 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff8262ea8e>] kmemleak_alloc+0x4e/0xb0
    [<ffffffff811fba74>] __kmalloc_track_caller+0x244/0x430
    [<ffffffff811b88a0>] kmemdup+0x20/0x50
    [<ffffffff823276b7>] ip_vs_control_net_init+0x1f7/0x510
    [<ffffffff8231d630>] __ip_vs_init+0x100/0x250
    [<ffffffff822363a1>] ops_init+0x41/0x190
    [<ffffffff82236583>] setup_net+0x93/0x150
    [<ffffffff82236cc2>] copy_net_ns+0x82/0x140
    [<ffffffff810ab13d>] create_new_namespaces+0xfd/0x190
    [<ffffffff810ab49a>] unshare_nsproxy_namespaces+0x5a/0xc0
    [<ffffffff810833e3>] SyS_unshare+0x173/0x310
    [<ffffffff8265cbd7>] system_call_fastpath+0x12/0x6f
    [<ffffffffffffffff>] 0xffffffffffffffff

Fixes: a0840e2e165a ("IPVS: netns, ip_vs_ctl local vars moved to ipvs struct.")
Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
---
 net/netfilter/ipvs/ip_vs_ctl.c |    3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 4953267..285eae3 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3823,6 +3823,9 @@ static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
 	cancel_work_sync(&ipvs->defense_work.work);
 	unregister_net_sysctl_table(ipvs->sysctl_hdr);
 	ip_vs_stop_estimator(net, &ipvs->tot_stats);
+
+	if (!net_eq(net, &init_net))
+		kfree(ipvs->sysctl_tbl);
 }
 
 #else
-- 
1.7.10.4

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 2/4] netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m
  2015-05-16 18:47 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
  2015-05-16 18:47 ` [PATCH 1/4] ipvs: fix memory leak in ip_vs_ctl.c Pablo Neira Ayuso
@ 2015-05-16 18:47 ` Pablo Neira Ayuso
  2015-05-16 19:07   ` Sergei Shtylyov
  2015-05-16 18:47 ` [PATCH 3/4] conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition Pablo Neira Ayuso
                   ` (2 subsequent siblings)
  4 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-05-16 18:47 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

From: Florian Westphal <fw@strlen.de>

With TPROXY=y but DEFRAG_IPV6=m we get build failure:

net/built-in.o: In function `tproxy_tg_init':
net/netfilter/xt_TPROXY.c:588: undefined reference to `nf_defrag_ipv6_enable'

If DEFRAG_IPV6 is modular, TPROXY must be too.
(or both must be builtin).

This enforces =m for both.

Reported-and-tested-by: Liu Hua <liusdu@126.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/Kconfig |    2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index f70e34a..a0f3e6a3 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -863,6 +863,7 @@ config NETFILTER_XT_TARGET_TPROXY
 	depends on NETFILTER_XTABLES
 	depends on NETFILTER_ADVANCED
 	depends on (IPV6 || IPV6=n)
+	depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
 	depends on IP_NF_MANGLE
 	select NF_DEFRAG_IPV4
 	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
@@ -1356,6 +1357,7 @@ config NETFILTER_XT_MATCH_SOCKET
 	depends on NETFILTER_ADVANCED
 	depends on !NF_CONNTRACK || NF_CONNTRACK
 	depends on (IPV6 || IPV6=n)
+	depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
 	select NF_DEFRAG_IPV4
 	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
 	help
-- 
1.7.10.4

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 3/4] conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition
  2015-05-16 18:47 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
  2015-05-16 18:47 ` [PATCH 1/4] ipvs: fix memory leak in ip_vs_ctl.c Pablo Neira Ayuso
  2015-05-16 18:47 ` [PATCH 2/4] netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m Pablo Neira Ayuso
@ 2015-05-16 18:47 ` Pablo Neira Ayuso
  2015-05-16 18:47 ` [PATCH 4/4] netfilter: nf_tables: fix bogus warning in nft_data_uninit() Pablo Neira Ayuso
  2015-05-16 20:45 ` [PATCH 0/4] Netfilter fixes for net David Miller
  4 siblings, 0 replies; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-05-16 18:47 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

From: Jesper Dangaard Brouer <brouer@redhat.com>

In compliance with RFC5961, the network stack send challenge ACK in
response to spurious SYN packets, since commit 0c228e833c88 ("tcp:
Restore RFC5961-compliant behavior for SYN packets").

This pose a problem for netfilter conntrack in state LAST_ACK, because
this challenge ACK is (falsely) seen as ACKing last FIN, causing a
false state transition (into TIME_WAIT).

The challenge ACK is hard to distinguish from real last ACK.  Thus,
solution introduce a flag that tracks the potential for seeing a
challenge ACK, in case a SYN packet is let through and current state
is LAST_ACK.

When conntrack transition LAST_ACK to TIME_WAIT happens, this flag is
used for determining if we are expecting a challenge ACK.

Scapy based reproducer script avail here:
 https://github.com/netoptimizer/network-testing/blob/master/scapy/tcp_hacks_3WHS_LAST_ACK.py

Fixes: 0c228e833c88 ("tcp: Restore RFC5961-compliant behavior for SYN packets")
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/uapi/linux/netfilter/nf_conntrack_tcp.h |    3 ++
 net/netfilter/nf_conntrack_proto_tcp.c          |   35 +++++++++++++++++++++--
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/include/uapi/linux/netfilter/nf_conntrack_tcp.h b/include/uapi/linux/netfilter/nf_conntrack_tcp.h
index 9993a42..ef9f80f 100644
--- a/include/uapi/linux/netfilter/nf_conntrack_tcp.h
+++ b/include/uapi/linux/netfilter/nf_conntrack_tcp.h
@@ -42,6 +42,9 @@ enum tcp_conntrack {
 /* The field td_maxack has been set */
 #define IP_CT_TCP_FLAG_MAXACK_SET		0x20
 
+/* Marks possibility for expected RFC5961 challenge ACK */
+#define IP_CT_EXP_CHALLENGE_ACK 		0x40
+
 struct nf_ct_tcp_flags {
 	__u8 flags;
 	__u8 mask;
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 5caa0c4..70383de 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -202,7 +202,7 @@ static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
  *	sES -> sES	:-)
  *	sFW -> sCW	Normal close request answered by ACK.
  *	sCW -> sCW
- *	sLA -> sTW	Last ACK detected.
+ *	sLA -> sTW	Last ACK detected (RFC5961 challenged)
  *	sTW -> sTW	Retransmitted last ACK. Remain in the same state.
  *	sCL -> sCL
  */
@@ -261,7 +261,7 @@ static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
  *	sES -> sES	:-)
  *	sFW -> sCW	Normal close request answered by ACK.
  *	sCW -> sCW
- *	sLA -> sTW	Last ACK detected.
+ *	sLA -> sTW	Last ACK detected (RFC5961 challenged)
  *	sTW -> sTW	Retransmitted last ACK.
  *	sCL -> sCL
  */
@@ -906,6 +906,7 @@ static int tcp_packet(struct nf_conn *ct,
 					1 : ct->proto.tcp.last_win;
 			ct->proto.tcp.seen[ct->proto.tcp.last_dir].td_scale =
 				ct->proto.tcp.last_wscale;
+			ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
 			ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
 				ct->proto.tcp.last_flags;
 			memset(&ct->proto.tcp.seen[dir], 0,
@@ -923,7 +924,9 @@ static int tcp_packet(struct nf_conn *ct,
 		 * may be in sync but we are not. In that case, we annotate
 		 * the TCP options and let the packet go through. If it is a
 		 * valid SYN packet, the server will reply with a SYN/ACK, and
-		 * then we'll get in sync. Otherwise, the server ignores it. */
+		 * then we'll get in sync. Otherwise, the server potentially
+		 * responds with a challenge ACK if implementing RFC5961.
+		 */
 		if (index == TCP_SYN_SET && dir == IP_CT_DIR_ORIGINAL) {
 			struct ip_ct_tcp_state seen = {};
 
@@ -939,6 +942,13 @@ static int tcp_packet(struct nf_conn *ct,
 				ct->proto.tcp.last_flags |=
 					IP_CT_TCP_FLAG_SACK_PERM;
 			}
+			/* Mark the potential for RFC5961 challenge ACK,
+			 * this pose a special problem for LAST_ACK state
+			 * as ACK is intrepretated as ACKing last FIN.
+			 */
+			if (old_state == TCP_CONNTRACK_LAST_ACK)
+				ct->proto.tcp.last_flags |=
+					IP_CT_EXP_CHALLENGE_ACK;
 		}
 		spin_unlock_bh(&ct->lock);
 		if (LOG_INVALID(net, IPPROTO_TCP))
@@ -970,6 +980,25 @@ static int tcp_packet(struct nf_conn *ct,
 			nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
 				  "nf_ct_tcp: invalid state ");
 		return -NF_ACCEPT;
+	case TCP_CONNTRACK_TIME_WAIT:
+		/* RFC5961 compliance cause stack to send "challenge-ACK"
+		 * e.g. in response to spurious SYNs.  Conntrack MUST
+		 * not believe this ACK is acking last FIN.
+		 */
+		if (old_state == TCP_CONNTRACK_LAST_ACK &&
+		    index == TCP_ACK_SET &&
+		    ct->proto.tcp.last_dir != dir &&
+		    ct->proto.tcp.last_index == TCP_SYN_SET &&
+		    (ct->proto.tcp.last_flags & IP_CT_EXP_CHALLENGE_ACK)) {
+			/* Detected RFC5961 challenge ACK */
+			ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
+			spin_unlock_bh(&ct->lock);
+			if (LOG_INVALID(net, IPPROTO_TCP))
+				nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
+				      "nf_ct_tcp: challenge-ACK ignored ");
+			return NF_ACCEPT; /* Don't change state */
+		}
+		break;
 	case TCP_CONNTRACK_CLOSE:
 		if (index == TCP_RST_SET
 		    && (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)
-- 
1.7.10.4

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 4/4] netfilter: nf_tables: fix bogus warning in nft_data_uninit()
  2015-05-16 18:47 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
                   ` (2 preceding siblings ...)
  2015-05-16 18:47 ` [PATCH 3/4] conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition Pablo Neira Ayuso
@ 2015-05-16 18:47 ` Pablo Neira Ayuso
  2015-05-16 20:45 ` [PATCH 0/4] Netfilter fixes for net David Miller
  4 siblings, 0 replies; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-05-16 18:47 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

From: Mirek Kratochvil <exa.exa@gmail.com>

The values 0x00000000-0xfffffeff are reserved for userspace datatype. When,
deleting set elements with maps, a bogus warning is triggered.

WARNING: CPU: 0 PID: 11133 at net/netfilter/nf_tables_api.c:4481 nft_data_uninit+0x35/0x40 [nf_tables]()

This fixes the check accordingly to enum definition in
include/linux/netfilter/nf_tables.h

Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1013
Signed-off-by: Mirek Kratochvil <exa.exa@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_tables_api.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index ad9d11f..34ded09 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4472,9 +4472,9 @@ EXPORT_SYMBOL_GPL(nft_data_init);
  */
 void nft_data_uninit(const struct nft_data *data, enum nft_data_types type)
 {
-	switch (type) {
-	case NFT_DATA_VALUE:
+	if (type < NFT_DATA_VERDICT)
 		return;
+	switch (type) {
 	case NFT_DATA_VERDICT:
 		return nft_verdict_uninit(data);
 	default:
-- 
1.7.10.4

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [PATCH 2/4] netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m
  2015-05-16 18:47 ` [PATCH 2/4] netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m Pablo Neira Ayuso
@ 2015-05-16 19:07   ` Sergei Shtylyov
  2015-05-16 19:24     ` Pablo Neira Ayuso
  0 siblings, 1 reply; 31+ messages in thread
From: Sergei Shtylyov @ 2015-05-16 19:07 UTC (permalink / raw)
  To: Pablo Neira Ayuso, netfilter-devel; +Cc: davem, netdev

Hello.

On 05/16/2015 09:47 PM, Pablo Neira Ayuso wrote:

> From: Florian Westphal <fw@strlen.de>

> With TPROXY=y but DEFRAG_IPV6=m we get build failure:

> net/built-in.o: In function `tproxy_tg_init':
> net/netfilter/xt_TPROXY.c:588: undefined reference to `nf_defrag_ipv6_enable'

> If DEFRAG_IPV6 is modular, TPROXY must be too.
> (or both must be builtin).

> This enforces =m for both.

> Reported-and-tested-by: Liu Hua <liusdu@126.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
>   net/netfilter/Kconfig |    2 ++
>   1 file changed, 2 insertions(+)

> diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
> index f70e34a..a0f3e6a3 100644
> --- a/net/netfilter/Kconfig
> +++ b/net/netfilter/Kconfig
> @@ -863,6 +863,7 @@ config NETFILTER_XT_TARGET_TPROXY
>   	depends on NETFILTER_XTABLES
>   	depends on NETFILTER_ADVANCED
>   	depends on (IPV6 || IPV6=n)
> +	depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
>   	depends on IP_NF_MANGLE
>   	select NF_DEFRAG_IPV4
>   	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
> @@ -1356,6 +1357,7 @@ config NETFILTER_XT_MATCH_SOCKET
>   	depends on NETFILTER_ADVANCED
>   	depends on !NF_CONNTRACK || NF_CONNTRACK
>   	depends on (IPV6 || IPV6=n)
> +	depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)

    Parens not needed here and in the previous hunk.

WBR, Sergei


^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [PATCH 2/4] netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m
  2015-05-16 19:07   ` Sergei Shtylyov
@ 2015-05-16 19:24     ` Pablo Neira Ayuso
  0 siblings, 0 replies; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-05-16 19:24 UTC (permalink / raw)
  To: Sergei Shtylyov; +Cc: netfilter-devel, davem, netdev

On Sat, May 16, 2015 at 10:07:27PM +0300, Sergei Shtylyov wrote:
> Hello.
> 
> On 05/16/2015 09:47 PM, Pablo Neira Ayuso wrote:
> 
> >From: Florian Westphal <fw@strlen.de>
> 
> >With TPROXY=y but DEFRAG_IPV6=m we get build failure:
> 
> >net/built-in.o: In function `tproxy_tg_init':
> >net/netfilter/xt_TPROXY.c:588: undefined reference to `nf_defrag_ipv6_enable'
> 
> >If DEFRAG_IPV6 is modular, TPROXY must be too.
> >(or both must be builtin).
> 
> >This enforces =m for both.
> 
> >Reported-and-tested-by: Liu Hua <liusdu@126.com>
> >Signed-off-by: Florian Westphal <fw@strlen.de>
> >Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> >---
> >  net/netfilter/Kconfig |    2 ++
> >  1 file changed, 2 insertions(+)
> 
> >diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
> >index f70e34a..a0f3e6a3 100644
> >--- a/net/netfilter/Kconfig
> >+++ b/net/netfilter/Kconfig
> >@@ -863,6 +863,7 @@ config NETFILTER_XT_TARGET_TPROXY
> >  	depends on NETFILTER_XTABLES
> >  	depends on NETFILTER_ADVANCED
> >  	depends on (IPV6 || IPV6=n)
> >+	depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
> >  	depends on IP_NF_MANGLE
> >  	select NF_DEFRAG_IPV4
> >  	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
> >@@ -1356,6 +1357,7 @@ config NETFILTER_XT_MATCH_SOCKET
> >  	depends on NETFILTER_ADVANCED
> >  	depends on !NF_CONNTRACK || NF_CONNTRACK
> >  	depends on (IPV6 || IPV6=n)
> >+	depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
> 
>    Parens not needed here and in the previous hunk.

OK, but we've been using parens in quite many other spots in the
Netfilter Kconfig files. So if you don't mind, we'll send follow up
large patch to sort out this for net-next.

Thank you.

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2015-05-16 18:47 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
                   ` (3 preceding siblings ...)
  2015-05-16 18:47 ` [PATCH 4/4] netfilter: nf_tables: fix bogus warning in nft_data_uninit() Pablo Neira Ayuso
@ 2015-05-16 20:45 ` David Miller
  4 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2015-05-16 20:45 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sat, 16 May 2015 20:47:14 +0200

> The following patchset contains Netfilter fixes for your net tree, they are:
> 
> 1) Fix a leak in IPVS, the sysctl table is not released accordingly when
>    destroying a netns, patch from Tommi Rantala.
> 
> 2) Fix a build error when TPROXY and socket are built-in but IPv6 defrag is
>    compiled as module, from Florian Westphal.
> 
> 3) Fix TCP tracket wrt. RFC5961 challenge ACK when in LAST_ACK state, patch
>    from Jesper Dangaard Brouer.
> 
> 4) Fix a bogus WARN_ON() in nf_tables when deleting a set element that stores
>    a map, from Mirek Kratochvil.

Pulled, thanks Pablo.

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2020-10-13 23:45 Pablo Neira Ayuso
@ 2020-10-14  3:07 ` Jakub Kicinski
  0 siblings, 0 replies; 31+ messages in thread
From: Jakub Kicinski @ 2020-10-14  3:07 UTC (permalink / raw)
  To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev

On Wed, 14 Oct 2020 01:45:55 +0200 Pablo Neira Ayuso wrote:
> Hi,
> 
> The following patchset contains Netfilter fixes for net:
> 
> 1) Extend nf_queue selftest to cover re-queueing, non-gso mode and
>    delayed queueing, from Florian Westphal.
> 
> 2) Clear skb->tstamp in IPVS forwarding path, from Julian Anastasov.
> 
> 3) Provide netlink extended error reporting for EEXIST case.
> 
> 4) Missing VLAN offload tag and proto in log target.
> 
> Please, pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
> 
> Absolutely nothing urgent in this batch, you might consider pulling this
> once net-next.git gets merged into net.git so this shows up in 5.10-rc.

Pulled, thanks!

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2020-10-13 23:45 Pablo Neira Ayuso
  2020-10-14  3:07 ` Jakub Kicinski
  0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2020-10-13 23:45 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev, kuba

Hi,

The following patchset contains Netfilter fixes for net:

1) Extend nf_queue selftest to cover re-queueing, non-gso mode and
   delayed queueing, from Florian Westphal.

2) Clear skb->tstamp in IPVS forwarding path, from Julian Anastasov.

3) Provide netlink extended error reporting for EEXIST case.

4) Missing VLAN offload tag and proto in log target.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Absolutely nothing urgent in this batch, you might consider pulling this
once net-next.git gets merged into net.git so this shows up in 5.10-rc.

Thank you.

----------------------------------------------------------------

The following changes since commit 874fb9e2ca949b443cc419a4f2227cafd4381d39:

  ipv4: Restore flowi4_oif update before call to xfrm_lookup_route (2020-10-10 11:38:59 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 0d9826bc18ce356e8909919ad681ad65d0a6061e:

  netfilter: nf_log: missing vlan offload tag and proto (2020-10-14 01:25:14 +0200)

----------------------------------------------------------------
Florian Westphal (1):
      selftests: netfilter: extend nfqueue test case

Julian Anastasov (1):
      ipvs: clear skb->tstamp in forwarding path

Pablo Neira Ayuso (2):
      netfilter: nftables: extend error reporting for chain updates
      netfilter: nf_log: missing vlan offload tag and proto

 include/net/netfilter/nf_log.h                 |  1 +
 net/ipv4/netfilter/nf_log_arp.c                | 19 ++++++-
 net/ipv4/netfilter/nf_log_ipv4.c               |  6 ++-
 net/ipv6/netfilter/nf_log_ipv6.c               |  8 +--
 net/netfilter/ipvs/ip_vs_xmit.c                |  6 +++
 net/netfilter/nf_log_common.c                  | 12 +++++
 net/netfilter/nf_tables_api.c                  | 19 +++++--
 tools/testing/selftests/netfilter/nf-queue.c   | 61 ++++++++++++++++++----
 tools/testing/selftests/netfilter/nft_queue.sh | 70 +++++++++++++++++++++-----
 9 files changed, 168 insertions(+), 34 deletions(-)

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2020-10-07  0:10 Pablo Neira Ayuso
@ 2020-10-09 19:19 ` Jakub Kicinski
  0 siblings, 0 replies; 31+ messages in thread
From: Jakub Kicinski @ 2020-10-09 19:19 UTC (permalink / raw)
  To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev

On Wed,  7 Oct 2020 02:10:23 +0200 Pablo Neira Ayuso wrote:
> The following patchset contains Netfilter selftests fixes from
> Fabian Frederick:
> 
> 1) Extend selftest nft_meta.sh to check for meta cpu.
> 
> 2) Fix selftest nft_meta.sh error reporting.
> 
> 3) Fix shellcheck warnings in selftest nft_meta.sh.
> 
> 4) Extend selftest nft_meta.sh to check for meta time.
> 
> Please, pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thank you!

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2020-10-07  0:10 Pablo Neira Ayuso
  2020-10-09 19:19 ` Jakub Kicinski
  0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2020-10-07  0:10 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev, kuba

Hi,

The following patchset contains Netfilter selftests fixes from
Fabian Frederick:

1) Extend selftest nft_meta.sh to check for meta cpu.

2) Fix selftest nft_meta.sh error reporting.

3) Fix shellcheck warnings in selftest nft_meta.sh.

4) Extend selftest nft_meta.sh to check for meta time.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thank you!

----------------------------------------------------------------

The following changes since commit 25b8ab916dd7a1f490b603d68c7765c06f9ed9e1:

  Merge tag 'mac80211-for-net-2020-09-21' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 (2020-09-21 14:54:35 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 48d072c4e8cdb542ade06727c31d7851bcc40a89:

  selftests: netfilter: add time counter check (2020-09-30 11:49:18 +0200)

----------------------------------------------------------------
Fabian Frederick (4):
      selftests: netfilter: add cpu counter check
      selftests: netfilter: fix nft_meta.sh error reporting
      selftests: netfilter: remove unused cnt and simplify command testing
      selftests: netfilter: add time counter check

 tools/testing/selftests/netfilter/nft_meta.sh | 32 +++++++++++++++++++++------
 1 file changed, 25 insertions(+), 7 deletions(-)

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2020-06-14 21:52 Pablo Neira Ayuso
@ 2020-06-15 20:27 ` David Miller
  0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2020-06-15 20:27 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev, kuba

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sun, 14 Jun 2020 23:52:57 +0200

> The following patchset contains Netfilter fixes for net:
> 
> 1) Fix bogus EEXIST on element insertions to the rbtree with timeouts,
>    from Stefano Brivio.
> 
> 2) Preempt BUG splat in the pipapo element insertion path, also from
>    Stefano.
> 
> 3) Release filter from the ctnetlink error path.
> 
> 4) Release flowtable hooks from the deletion path.
> 
> Please, pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks Pablo.

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2020-06-14 21:52 Pablo Neira Ayuso
  2020-06-15 20:27 ` David Miller
  0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2020-06-14 21:52 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev, kuba

Hi,

The following patchset contains Netfilter fixes for net:

1) Fix bogus EEXIST on element insertions to the rbtree with timeouts,
   from Stefano Brivio.

2) Preempt BUG splat in the pipapo element insertion path, also from
   Stefano.

3) Release filter from the ctnetlink error path.

4) Release flowtable hooks from the deletion path.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thank you.

----------------------------------------------------------------

The following changes since commit af7b4801030c07637840191c69eb666917e4135d:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2020-06-07 17:27:45 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 3003055f50663095472144994dac0339076031a8:

  netfilter: nf_tables: hook list memleak in flowtable deletion (2020-06-12 17:48:21 +0200)

----------------------------------------------------------------
Pablo Neira Ayuso (2):
      netfilter: ctnetlink: memleak in filter initialization error path
      netfilter: nf_tables: hook list memleak in flowtable deletion

Stefano Brivio (2):
      netfilter: nft_set_rbtree: Don't account for expired elements on insertion
      netfilter: nft_set_pipapo: Disable preemption before getting per-CPU pointer

 net/netfilter/nf_conntrack_netlink.c | 32 ++++++++++++++++++++++----------
 net/netfilter/nf_tables_api.c        | 31 ++++++++++++++++++++++++-------
 net/netfilter/nft_set_pipapo.c       |  6 +++++-
 net/netfilter/nft_set_rbtree.c       | 21 ++++++++++++++-------
 4 files changed, 65 insertions(+), 25 deletions(-)

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2020-03-20 13:51 Pablo Neira Ayuso
@ 2020-03-21  2:34 ` David Miller
  0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2020-03-21  2:34 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 20 Mar 2020 14:51:30 +0100

> The following patchset contains Netfilter fixes for net:
> 
> 1) Refetch IP header pointer after pskb_may_pull() in flowtable,
>    from Haishuang Yan.
> 
> 2) Fix memleak in flowtable offload in nf_flow_table_free(),
>    from Paul Blakey.
> 
> 3) Set control.addr_type mask in flowtable offload, from Edward Cree.

Pulled, thanks Pablo.

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2020-03-20 13:51 Pablo Neira Ayuso
  2020-03-21  2:34 ` David Miller
  0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-20 13:51 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi,

The following patchset contains Netfilter fixes for net:

1) Refetch IP header pointer after pskb_may_pull() in flowtable,
   from Haishuang Yan.

2) Fix memleak in flowtable offload in nf_flow_table_free(),
   from Paul Blakey.

3) Set control.addr_type mask in flowtable offload, from Edward Cree.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thank you.

----------------------------------------------------------------

The following changes since commit 3c025b6317272ee8493ee20fa5035c087626af48:

  Merge branch 'wireguard-fixes' (2020-03-18 18:51:43 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 15ff197237e76c4dab06b7b518afaa4ebb1c43e0:

  netfilter: flowtable: populate addr_type mask (2020-03-19 21:20:04 +0100)

----------------------------------------------------------------
Edward Cree (1):
      netfilter: flowtable: populate addr_type mask

Haishuang Yan (2):
      netfilter: flowtable: reload ip{v6}h in nf_flow_nat_ip{v6}
      netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6}

Paul Blakey (1):
      netfilter: flowtable: Fix flushing of offloaded flows on free

 net/netfilter/nf_flow_table_core.c    |  3 +++
 net/netfilter/nf_flow_table_ip.c      | 14 ++++++++++----
 net/netfilter/nf_flow_table_offload.c |  1 +
 3 files changed, 14 insertions(+), 4 deletions(-)

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2019-12-26 16:39 Pablo Neira Ayuso
@ 2019-12-26 21:11 ` David Miller
  0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2019-12-26 21:11 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 26 Dec 2019 17:39:52 +0100

> The following patchset contains Netfilter fixes for net:
> 
> 1) Fix endianness issue in flowtable TCP flags dissector,
>    from Arnd Bergmann.
> 
> 2) Extend flowtable test script with dnat rules, from Florian Westphal.
> 
> 3) Reject padding in ebtables user entries and validate computed user
>    offset, reported by syzbot, from Florian Westphal.
> 
> 4) Fix endianness in nft_tproxy, from Phil Sutter.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thank you.

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2019-12-26 16:39 Pablo Neira Ayuso
  2019-12-26 21:11 ` David Miller
  0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2019-12-26 16:39 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi,

The following patchset contains Netfilter fixes for net:

1) Fix endianness issue in flowtable TCP flags dissector,
   from Arnd Bergmann.

2) Extend flowtable test script with dnat rules, from Florian Westphal.

3) Reject padding in ebtables user entries and validate computed user
   offset, reported by syzbot, from Florian Westphal.

4) Fix endianness in nft_tproxy, from Phil Sutter.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks.

----------------------------------------------------------------

The following changes since commit 0fd260056ef84ede8f444c66a3820811691fe884:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf (2019-12-19 14:20:47 -0800)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 8cb4ec44de42b99b92399b4d1daf3dc430ed0186:

  netfilter: nft_tproxy: Fix port selector on Big Endian (2019-12-20 02:12:28 +0100)

----------------------------------------------------------------
Arnd Bergmann (1):
      netfilter: nf_flow_table: fix big-endian integer overflow

Florian Westphal (2):
      selftests: netfilter: extend flowtable test script with dnat rule
      netfilter: ebtables: compat: reject all padding in matches/watchers

Phil Sutter (1):
      netfilter: nft_tproxy: Fix port selector on Big Endian

 net/bridge/netfilter/ebtables.c                    | 33 +++++++++---------
 net/netfilter/nf_flow_table_offload.c              |  2 +-
 net/netfilter/nft_tproxy.c                         |  4 +--
 tools/testing/selftests/netfilter/nft_flowtable.sh | 39 +++++++++++++++++++---
 4 files changed, 53 insertions(+), 25 deletions(-)

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2017-05-29 11:34 Pablo Neira Ayuso
@ 2017-05-30  3:20 ` David Miller
  0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2017-05-30  3:20 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 29 May 2017 13:34:28 +0200

> Hi David,
> 
> The following patchset contains Netfilter fixes for your net tree,
> they are:
> 
> 1) Conntrack SCTP CRC32c checksum mangling may operate on non-linear
>    skbuff, patch from Davide Caratti.
> 
> 2) nf_tables rb-tree set backend does not handle element re-addition
>    after deletion in the same transaction, leading to infinite loop.
> 
> 3) Atomically unclear the IPS_SRC_NAT_DONE_BIT on nat module removal,
>    from Liping Zhang.
> 
> 4) Conntrack hashtable resizing while ctnetlink dump is progress leads
>    to a dead reference to released objects in the lists, also from
>    Liping.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks a lot Pablo.

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2017-05-29 11:34 Pablo Neira Ayuso
  2017-05-30  3:20 ` David Miller
  0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2017-05-29 11:34 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Conntrack SCTP CRC32c checksum mangling may operate on non-linear
   skbuff, patch from Davide Caratti.

2) nf_tables rb-tree set backend does not handle element re-addition
   after deletion in the same transaction, leading to infinite loop.

3) Atomically unclear the IPS_SRC_NAT_DONE_BIT on nat module removal,
   from Liping Zhang.

4) Conntrack hashtable resizing while ctnetlink dump is progress leads
   to a dead reference to released objects in the lists, also from
   Liping.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 6d18c732b95c0a9d35e9f978b4438bba15412284:

  bridge: start hello_timer when enabling KERNEL_STP in br_stp_start (2017-05-21 13:33:28 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to fefa92679dbe0c613e62b6c27235dcfbe9640ad1:

  netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize (2017-05-24 11:26:01 +0200)

----------------------------------------------------------------
Davide Caratti (1):
      netfilter: conntrack: fix false CRC32c mismatch using paged skb

Liping Zhang (2):
      netfilter: nat: use atomic bit op to clear the _SRC_NAT_DONE_BIT
      netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize

Pablo Neira Ayuso (1):
      netfilter: nft_set_rbtree: handle element re-addition after deletion

 net/netfilter/nf_conntrack_netlink.c    |  7 ++++++-
 net/netfilter/nf_conntrack_proto_sctp.c |  9 ++++++---
 net/netfilter/nf_nat_core.c             |  2 +-
 net/netfilter/nft_set_rbtree.c          | 22 +++++++++++-----------
 4 files changed, 24 insertions(+), 16 deletions(-)

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2017-03-03 19:22 Pablo Neira Ayuso
@ 2017-03-04  4:41 ` David Miller
  0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2017-03-04  4:41 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri,  3 Mar 2017 20:22:21 +0100

> The following patchset contains Netfilter fixes for your net tree,
> they are:
> 
> 1) Missing check for full sock in ip_route_me_harder(), from
>    Florian Westphal.
> 
> 2) Incorrect sip helper structure initilization that breaks it when
>    several ports are used, from Christophe Leroy.
> 
> 3) Fix incorrect assumption when looking up for matching with adjacent
>    intervals in the nft_set_rbtree.
> 
> 4) Fix broken netlink event error reporting in nf_tables that results
>    in misleading ESRCH errors propagated to userspace listeners.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks a lot Pablo.

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2017-03-03 19:22 Pablo Neira Ayuso
  2017-03-04  4:41 ` David Miller
  0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2017-03-03 19:22 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Missing check for full sock in ip_route_me_harder(), from
   Florian Westphal.

2) Incorrect sip helper structure initilization that breaks it when
   several ports are used, from Christophe Leroy.

3) Fix incorrect assumption when looking up for matching with adjacent
   intervals in the nft_set_rbtree.

4) Fix broken netlink event error reporting in nf_tables that results
   in misleading ESRCH errors propagated to userspace listeners.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 2f44f75257d57f0d5668dba3a6ada0f4872132c9:

  Merge branch 'qed-fixes' (2017-02-27 09:22:10 -0500)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 25e94a997b324b5f167f56d56d7106d38b78c9de:

  netfilter: nf_tables: don't call nfnetlink_set_err() if nfnetlink_send() fails (2017-03-03 13:48:34 +0100)

----------------------------------------------------------------
Christophe Leroy (1):
      netfilter: nf_conntrack_sip: fix wrong memory initialisation

Florian Westphal (1):
      netfilter: use skb_to_full_sk in ip_route_me_harder

Pablo Neira Ayuso (2):
      netfilter: nft_set_rbtree: incorrect assumption on lower interval lookups
      netfilter: nf_tables: don't call nfnetlink_set_err() if nfnetlink_send() fails

 include/net/netfilter/nf_tables.h |   6 +-
 net/ipv4/netfilter.c              |   7 +-
 net/netfilter/nf_conntrack_sip.c  |   2 -
 net/netfilter/nf_tables_api.c     | 133 ++++++++++++++++----------------------
 net/netfilter/nft_set_rbtree.c    |   9 ++-
 5 files changed, 66 insertions(+), 91 deletions(-)

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2016-09-13  9:05 Pablo Neira Ayuso
@ 2016-09-13 15:17 ` David Miller
  0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2016-09-13 15:17 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 13 Sep 2016 11:05:13 +0200

> The following patchset contains Netfilter fixes for your net tree,
> they are:
 ...
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks Pablo.

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2016-09-13  9:05 Pablo Neira Ayuso
  2016-09-13 15:17 ` David Miller
  0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2016-09-13  9:05 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Endianess fix for the new nf_tables netlink trace infrastructure,
   NFTA_TRACE_POLICY endianess was not correct, patch from Liping Zhang.

2) Fix broken re-route after userspace queueing in nf_tables route
   chain. This patch is large but it is simple since it is just getting
   this code in sync with iptable_mangle. Also from Liping.

3) NAT mangling via ctnetlink lies to userspace when nf_nat_setup_info()
   fails to setup the NAT conntrack extension. This problem has been
   there since the beginning, but it can now show up after rhashtable
   conversion.

4) Fix possible NULL pointer dereference due to failures in allocating
   the synproxy and seqadj conntrack extensions, from Gao feng.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 6e1ce3c3451291142a57c4f3f6f999a29fb5b3bc:

  af_unix: split 'u->readlock' into two: 'iolock' and 'bindlock' (2016-09-04 13:29:29 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 4440a2ab3b9f40dddbe006331ef0659c76859296:

  netfilter: synproxy: Check oom when adding synproxy and seqadj ct extensions (2016-09-13 10:50:56 +0200)

----------------------------------------------------------------
Gao Feng (1):
      netfilter: synproxy: Check oom when adding synproxy and seqadj ct extensions

Liping Zhang (2):
      netfilter: nf_tables_trace: fix endiness when dump chain policy
      netfilter: nft_chain_route: re-route before skb is queued to userspace

Pablo Neira Ayuso (1):
      netfilter: nf_nat: handle NF_DROP from nfnetlink_parse_nat_setup()

 include/net/netfilter/nf_conntrack_synproxy.h | 14 ++++++++++++++
 net/ipv4/netfilter/nft_chain_route_ipv4.c     | 11 +++++++----
 net/ipv6/netfilter/nft_chain_route_ipv6.c     | 10 +++++++---
 net/netfilter/nf_conntrack_core.c             |  6 +++---
 net/netfilter/nf_nat_core.c                   |  5 +++--
 net/netfilter/nf_tables_trace.c               |  2 +-
 6 files changed, 35 insertions(+), 13 deletions(-)

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2015-10-19 18:22 Pablo Neira Ayuso
@ 2015-10-22  2:27 ` David Miller
  0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2015-10-22  2:27 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 19 Oct 2015 20:22:51 +0200

> The following patchset contains four Netfilter fixes for net, they are:
> 
> 1) Fix Kconfig dependencies of new nf_dup_ipv4 and nf_dup_ipv6.
> 
> 2) Remove bogus test nh_scope in IPv4 rpfilter match that is breaking
>    --accept-local, from Xin Long.
> 
> 3) Wait for RCU grace period after dropping the pending packets in the
>    nfqueue, from Florian Westphal.
> 
> 4) Fix sleeping allocation while holding spin_lock_bh, from Nikolay Borisov.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks a lot Pablo.

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2015-10-19 18:22 Pablo Neira Ayuso
  2015-10-22  2:27 ` David Miller
  0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-10-19 18:22 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains four Netfilter fixes for net, they are:

1) Fix Kconfig dependencies of new nf_dup_ipv4 and nf_dup_ipv6.

2) Remove bogus test nh_scope in IPv4 rpfilter match that is breaking
   --accept-local, from Xin Long.

3) Wait for RCU grace period after dropping the pending packets in the
   nfqueue, from Florian Westphal.

4) Fix sleeping allocation while holding spin_lock_bh, from Nikolay Borisov.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit b84f78782052ee4516903e5d0566a5eee365b771:

  net: Initialize flow flags in input path (2015-09-29 21:52:32 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 00db674bedd68ff8b5afae9030ff5e04d45d1b4a:

  netfilter: ipset: Fix sleeping memory allocation in atomic context (2015-10-17 13:01:24 +0200)

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: sync with packet rx also after removing queue entries

Nikolay Borisov (1):
      netfilter: ipset: Fix sleeping memory allocation in atomic context

Pablo Neira Ayuso (1):
      netfilter: fix Kconfig dependencies for nf_dup_ipv{4,6}

lucien (1):
      netfilter: ipt_rpfilter: remove the nh_scope test in rpfilter_lookup_reverse

 net/ipv4/netfilter/Kconfig            | 1 +
 net/ipv4/netfilter/ipt_rpfilter.c     | 4 +---
 net/ipv6/netfilter/Kconfig            | 1 +
 net/netfilter/core.c                  | 2 ++
 net/netfilter/ipset/ip_set_list_set.c | 2 +-
 5 files changed, 6 insertions(+), 4 deletions(-)

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2015-09-18  9:17 Pablo Neira Ayuso
@ 2015-09-21  5:32 ` David Miller
  0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2015-09-21  5:32 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 18 Sep 2015 11:17:52 +0200

> The following patch contains Netfilter fixes for your net tree, they are:
> 
> 1) nf_log_unregister() should only set to NULL the logger that is being
>    unregistered, instead of everything else. Patch from Florian Westphal.
> 
> 2) Fix a crash when accessing physoutdev from PREROUTING in br_netfilter.
>    This is partially reverting the patch to shrink nf_bridge_info to 32 bytes.
>    Also from Florian.
> 
> 3) Use existing match/target extensions in the internal nft_compat extension
>    lists when the extension is family unspecific (ie. NFPROTO_UNSPEC).
> 
> 4) Wait for rcu grace period before leaving nf_log_unregister().
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks Pablo.

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2015-09-18  9:17 Pablo Neira Ayuso
  2015-09-21  5:32 ` David Miller
  0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2015-09-18  9:17 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patch contains Netfilter fixes for your net tree, they are:

1) nf_log_unregister() should only set to NULL the logger that is being
   unregistered, instead of everything else. Patch from Florian Westphal.

2) Fix a crash when accessing physoutdev from PREROUTING in br_netfilter.
   This is partially reverting the patch to shrink nf_bridge_info to 32 bytes.
   Also from Florian.

3) Use existing match/target extensions in the internal nft_compat extension
   lists when the extension is family unspecific (ie. NFPROTO_UNSPEC).

4) Wait for rcu grace period before leaving nf_log_unregister().

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit e8684c88774c0ddfeefdbed0aa469b25b9962f3e:

  irda: ali-ircc: Fix deadlock in ali_ircc_sir_change_speed() (2015-09-11 16:18:33 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to ad5001cc7cdf9aaee5eb213fdee657e4a3c94776:

  netfilter: nf_log: wait for rcu grace after logger unregistration (2015-09-17 13:37:31 +0200)

----------------------------------------------------------------
Florian Westphal (2):
      netfilter: nf_log: don't zap all loggers on unregister
      netfilter: bridge: fix routing of bridge frames with call-iptables=1

Pablo Neira Ayuso (2):
      netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC
      netfilter: nf_log: wait for rcu grace after logger unregistration

 include/linux/skbuff.h     |    6 +++---
 net/netfilter/nf_log.c     |    9 +++++++--
 net/netfilter/nft_compat.c |   24 ++++++++++++++++++------
 3 files changed, 28 insertions(+), 11 deletions(-)

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2014-08-11 17:06 Pablo Neira Ayuso
  0 siblings, 0 replies; 31+ messages in thread
From: Pablo Neira Ayuso @ 2014-08-11 17:06 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains fixes for your net tree, they are:

1) Unitialize the set element key and data from the commit path,
   otherwise this leaks chain refcount if the transaction is aborted,
   reported by Thomas Graf.

2) Fix crash when updating chains without no counters in nf_tables,
   this slipped through in the new transaction infrastructure, reported
   by Matteo Croce.

3) Replace all mutex_lock_interruptible() by mutex_lock() in the Netfilter
   tree, suggested by Patrick McHardy. This implicitly fixes the problem
   that Eric Dumazet reported in: http://patchwork.ozlabs.org/patch/373076/

4) Fix error return code in nf_tables when deleting set element in
   nf_tables if the transaction cannot be allocated, from Julia Lawall.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 33caee39925b887a99a2400dc5c980097c3573f9:

  Merge branch 'akpm' (patchbomb from Andrew Morton) (2014-08-06 21:14:42 -0700)

are available in the git repository at:


  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to 609ccf087747de48ef52160f93e0df864c532a61:

  netfilter: nf_tables: fix error return code (2014-08-08 16:47:29 +0200)

----------------------------------------------------------------
Julia Lawall (1):
      netfilter: nf_tables: fix error return code

Pablo Neira Ayuso (3):
      netfilter: nf_tables: uninitialize element key/data from the commit path
      netfilter: nf_tables: don't update chain with unset counters
      netfilter: don't use mutex_lock_interruptible()

 net/bridge/netfilter/ebtables.c |   10 ++-------
 net/netfilter/core.c            |   11 ++-------
 net/netfilter/ipvs/ip_vs_ctl.c  |   19 ++++------------
 net/netfilter/nf_sockopt.c      |    8 ++-----
 net/netfilter/nf_tables_api.c   |   30 ++++++++++++++-----------
 net/netfilter/x_tables.c        |   47 ++++++++++-----------------------------
 6 files changed, 39 insertions(+), 86 deletions(-)

^ permalink raw reply	[flat|nested] 31+ messages in thread

* Re: [PATCH 0/4] netfilter fixes for net
  2013-04-12 10:13 [PATCH 0/4] netfilter " Pablo Neira Ayuso
@ 2013-04-12 18:28 ` David Miller
  0 siblings, 0 replies; 31+ messages in thread
From: David Miller @ 2013-04-12 18:28 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 12 Apr 2013 12:13:15 +0200

> The following patchset contains late netfilter fixes for your net
> tree, they are:
> 
> * Don't drop segmented TCP packets in the SIP helper, we've got reports
>   from users that this was breaking communications when the SIP phone
>   messages are larger than the MTU, from Patrick McHardy.
> 
> * Fix refcount leak in the ipset list set, from Jozsef Kadlecsik.
> 
> * On hash set resizing, the nomatch flag was lost, thus entirely inverting
>   the logic of the set matching, from Jozsef Kadlecsik.
> 
> * Fix crash on NAT modules removal. Timer expiration may race with the
>   module cleanup exit path while deleting conntracks, from Florian
>   Westphal.

Pulled, thanks Pablo.

^ permalink raw reply	[flat|nested] 31+ messages in thread

* [PATCH 0/4] netfilter fixes for net
@ 2013-04-12 10:13 Pablo Neira Ayuso
  2013-04-12 18:28 ` David Miller
  0 siblings, 1 reply; 31+ messages in thread
From: Pablo Neira Ayuso @ 2013-04-12 10:13 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains late netfilter fixes for your net
tree, they are:

* Don't drop segmented TCP packets in the SIP helper, we've got reports
  from users that this was breaking communications when the SIP phone
  messages are larger than the MTU, from Patrick McHardy.

* Fix refcount leak in the ipset list set, from Jozsef Kadlecsik.

* On hash set resizing, the nomatch flag was lost, thus entirely inverting
  the logic of the set matching, from Jozsef Kadlecsik.

* Fix crash on NAT modules removal. Timer expiration may race with the
  module cleanup exit path while deleting conntracks, from Florian
  Westphal.

The following changes since commit 53f63189b1110559dce8c1ee29e8abc3e31f7630:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (2013-04-05 14:04:10 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to c2d421e171868586939c328dfb91bab840fe4c49:

  netfilter: nf_nat: fix race when unloading protocol modules (2013-04-12 11:46:31 +0200)

Please, consider pulling this.
Thanks!

P.S: Jozsef has several updates for net-next that depend on these fixes,
could you pull from your net tree into your net-next tree, please? Thanks.

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: nf_nat: fix race when unloading protocol modules

Jozsef Kadlecsik (2):
      netfilter: ipset: list:set: fix reference counter update
      netfilter: ipset: hash:*net*: nomatch flag not excluded on set resize

Patrick McHardy (1):
      netfilter: nf_ct_sip: don't drop packets with offsets pointing outside the packet

 include/linux/netfilter/ipset/ip_set_ahash.h |   30 ++++++++++++++-----
 net/netfilter/ipset/ip_set_hash_ipportnet.c  |   18 ++++++++++++
 net/netfilter/ipset/ip_set_hash_net.c        |   22 ++++++++++++--
 net/netfilter/ipset/ip_set_hash_netiface.c   |   22 ++++++++++++--
 net/netfilter/ipset/ip_set_hash_netport.c    |   18 ++++++++++++
 net/netfilter/ipset/ip_set_list_set.c        |   10 +++++--
 net/netfilter/nf_conntrack_sip.c             |    6 ++--
 net/netfilter/nf_nat_core.c                  |   40 +++++---------------------
 8 files changed, 115 insertions(+), 51 deletions(-)


^ permalink raw reply	[flat|nested] 31+ messages in thread

end of thread, back to index

Thread overview: 31+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-05-16 18:47 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
2015-05-16 18:47 ` [PATCH 1/4] ipvs: fix memory leak in ip_vs_ctl.c Pablo Neira Ayuso
2015-05-16 18:47 ` [PATCH 2/4] netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m Pablo Neira Ayuso
2015-05-16 19:07   ` Sergei Shtylyov
2015-05-16 19:24     ` Pablo Neira Ayuso
2015-05-16 18:47 ` [PATCH 3/4] conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition Pablo Neira Ayuso
2015-05-16 18:47 ` [PATCH 4/4] netfilter: nf_tables: fix bogus warning in nft_data_uninit() Pablo Neira Ayuso
2015-05-16 20:45 ` [PATCH 0/4] Netfilter fixes for net David Miller
  -- strict thread matches above, loose matches on Subject: below --
2020-10-13 23:45 Pablo Neira Ayuso
2020-10-14  3:07 ` Jakub Kicinski
2020-10-07  0:10 Pablo Neira Ayuso
2020-10-09 19:19 ` Jakub Kicinski
2020-06-14 21:52 Pablo Neira Ayuso
2020-06-15 20:27 ` David Miller
2020-03-20 13:51 Pablo Neira Ayuso
2020-03-21  2:34 ` David Miller
2019-12-26 16:39 Pablo Neira Ayuso
2019-12-26 21:11 ` David Miller
2017-05-29 11:34 Pablo Neira Ayuso
2017-05-30  3:20 ` David Miller
2017-03-03 19:22 Pablo Neira Ayuso
2017-03-04  4:41 ` David Miller
2016-09-13  9:05 Pablo Neira Ayuso
2016-09-13 15:17 ` David Miller
2015-10-19 18:22 Pablo Neira Ayuso
2015-10-22  2:27 ` David Miller
2015-09-18  9:17 Pablo Neira Ayuso
2015-09-21  5:32 ` David Miller
2014-08-11 17:06 Pablo Neira Ayuso
2013-04-12 10:13 [PATCH 0/4] netfilter " Pablo Neira Ayuso
2013-04-12 18:28 ` David Miller

Netfilter-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netfilter-devel/0 netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ https://lore.kernel.org/netfilter-devel \
		netfilter-devel@vger.kernel.org
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netfilter-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git