Netfilter-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH 0/7] Netfilter updates for net-next
@ 2020-08-02 18:31 Pablo Neira Ayuso
  2020-08-02 18:31 ` [PATCH 1/7] netfilter: nf_tables: Fix a use after free in nft_immediate_destroy() Pablo Neira Ayuso
                   ` (7 more replies)
  0 siblings, 8 replies; 9+ messages in thread
From: Pablo Neira Ayuso @ 2020-08-02 18:31 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi,

1) UAF in chain binding support from previous batch, from Dan Carpenter.

2) Queue up delayed work to expire connections with no destination,
   from Andrew Sy Kim.

3) Use fallthrough pseudo-keyword, from Gustavo A. R. Silva.

4) Replace HTTP links with HTTPS, from Alexander A. Klimov.

5) Remove superfluous null header checks in ip6tables, from
   Gaurav Singh.

6) Add extended netlink error reporting for expression.

7) Report EEXIST on overlapping chain, set elements and flowtable
   devices.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git

Thank you.

----------------------------------------------------------------

The following changes since commit 4ff91fa0a3acd072c9a46ebe08a6e2471ddd3c95:

  Merge branch 'udp_tunnel-NIC-RX-port-offload-infrastructure' (2020-07-14 17:04:28 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git HEAD

for you to fetch changes up to 77a92189ecfd061616ad531d386639aab7baaad9:

  netfilter: nf_tables: report EEXIST on overlaps (2020-08-02 19:53:45 +0200)

----------------------------------------------------------------
Alexander A. Klimov (1):
      netfilter: Replace HTTP links with HTTPS ones

Andrew Sy Kim (1):
      ipvs: queue delayed work to expire no destination connections if expire_nodest_conn=1

Dan Carpenter (1):
      netfilter: nf_tables: Fix a use after free in nft_immediate_destroy()

Gaurav Singh (1):
      netfilter: ip6tables: Remove redundant null checks

Gustavo A. R. Silva (1):
      netfilter: Use fallthrough pseudo-keyword

Pablo Neira Ayuso (2):
      netfilter: nf_tables: extended netlink error reporting for expressions
      netfilter: nf_tables: report EEXIST on overlaps

 include/net/ip_vs.h                        | 29 ++++++++++++++++++
 include/uapi/linux/netfilter/xt_connmark.h |  2 +-
 net/bridge/netfilter/ebtables.c            |  2 +-
 net/decnet/netfilter/dn_rtmsg.c            |  2 +-
 net/ipv6/netfilter/ip6t_ah.c               |  3 +-
 net/ipv6/netfilter/ip6t_frag.c             |  3 +-
 net/ipv6/netfilter/ip6t_hbh.c              |  3 +-
 net/ipv6/netfilter/ip6t_rt.c               |  3 +-
 net/netfilter/Kconfig                      |  2 +-
 net/netfilter/ipset/ip_set_core.c          |  2 +-
 net/netfilter/ipvs/ip_vs_conn.c            | 39 +++++++++++++++++++++++++
 net/netfilter/ipvs/ip_vs_core.c            | 47 +++++++++++++-----------------
 net/netfilter/ipvs/ip_vs_ctl.c             | 22 ++++++++++++++
 net/netfilter/nf_conntrack_h323_asn1.c     |  6 ++--
 net/netfilter/nf_conntrack_proto.c         |  2 +-
 net/netfilter/nf_conntrack_proto_tcp.c     |  2 +-
 net/netfilter/nf_conntrack_standalone.c    |  2 +-
 net/netfilter/nf_nat_core.c                | 12 ++++----
 net/netfilter/nf_synproxy_core.c           |  6 ++--
 net/netfilter/nf_tables_api.c              | 31 +++++++++++---------
 net/netfilter/nf_tables_core.c             |  2 +-
 net/netfilter/nfnetlink_acct.c             |  2 +-
 net/netfilter/nfnetlink_cttimeout.c        |  2 +-
 net/netfilter/nft_cmp.c                    |  4 +--
 net/netfilter/nft_ct.c                     |  6 ++--
 net/netfilter/nft_fib.c                    |  2 +-
 net/netfilter/nft_immediate.c              |  4 +--
 net/netfilter/nft_payload.c                |  2 +-
 net/netfilter/nft_set_pipapo.c             |  4 +--
 net/netfilter/utils.c                      |  8 ++---
 net/netfilter/x_tables.c                   |  2 +-
 net/netfilter/xt_CONNSECMARK.c             |  2 +-
 net/netfilter/xt_connmark.c                |  2 +-
 net/netfilter/xt_nfacct.c                  |  2 +-
 net/netfilter/xt_time.c                    |  2 +-
 35 files changed, 173 insertions(+), 93 deletions(-)

^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, back to index

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-08-02 18:31 [PATCH 0/7] Netfilter updates for net-next Pablo Neira Ayuso
2020-08-02 18:31 ` [PATCH 1/7] netfilter: nf_tables: Fix a use after free in nft_immediate_destroy() Pablo Neira Ayuso
2020-08-02 18:31 ` [PATCH 2/7] ipvs: queue delayed work to expire no destination connections if expire_nodest_conn=1 Pablo Neira Ayuso
2020-08-02 18:31 ` [PATCH 3/7] netfilter: Use fallthrough pseudo-keyword Pablo Neira Ayuso
2020-08-02 18:31 ` [PATCH 4/7] netfilter: Replace HTTP links with HTTPS ones Pablo Neira Ayuso
2020-08-02 18:31 ` [PATCH 5/7] netfilter: ip6tables: Remove redundant null checks Pablo Neira Ayuso
2020-08-02 18:31 ` [PATCH 6/7] netfilter: nf_tables: extended netlink error reporting for expressions Pablo Neira Ayuso
2020-08-02 18:31 ` [PATCH 7/7] netfilter: nf_tables: report EEXIST on overlaps Pablo Neira Ayuso
2020-08-03 23:03 ` [PATCH 0/7] Netfilter updates for net-next David Miller

Netfilter-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netfilter-devel/0 netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ https://lore.kernel.org/netfilter-devel \
		netfilter-devel@vger.kernel.org
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netfilter-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git