Netfilter-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH 0/4] Netfilter fixes for net
@ 2020-10-07  0:10 Pablo Neira Ayuso
  2020-10-07  0:10 ` [PATCH 1/4] selftests: netfilter: add cpu counter check Pablo Neira Ayuso
                   ` (4 more replies)
  0 siblings, 5 replies; 29+ messages in thread
From: Pablo Neira Ayuso @ 2020-10-07  0:10 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev, kuba

Hi,

The following patchset contains Netfilter selftests fixes from
Fabian Frederick:

1) Extend selftest nft_meta.sh to check for meta cpu.

2) Fix selftest nft_meta.sh error reporting.

3) Fix shellcheck warnings in selftest nft_meta.sh.

4) Extend selftest nft_meta.sh to check for meta time.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thank you!

----------------------------------------------------------------

The following changes since commit 25b8ab916dd7a1f490b603d68c7765c06f9ed9e1:

  Merge tag 'mac80211-for-net-2020-09-21' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 (2020-09-21 14:54:35 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 48d072c4e8cdb542ade06727c31d7851bcc40a89:

  selftests: netfilter: add time counter check (2020-09-30 11:49:18 +0200)

----------------------------------------------------------------
Fabian Frederick (4):
      selftests: netfilter: add cpu counter check
      selftests: netfilter: fix nft_meta.sh error reporting
      selftests: netfilter: remove unused cnt and simplify command testing
      selftests: netfilter: add time counter check

 tools/testing/selftests/netfilter/nft_meta.sh | 32 +++++++++++++++++++++------
 1 file changed, 25 insertions(+), 7 deletions(-)

^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 1/4] selftests: netfilter: add cpu counter check
  2020-10-07  0:10 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
@ 2020-10-07  0:10 ` Pablo Neira Ayuso
  2020-10-07  0:10 ` [PATCH 2/4] selftests: netfilter: fix nft_meta.sh error reporting Pablo Neira Ayuso
                   ` (3 subsequent siblings)
  4 siblings, 0 replies; 29+ messages in thread
From: Pablo Neira Ayuso @ 2020-10-07  0:10 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev, kuba

From: Fabian Frederick <fabf@skynet.be>

run task on first CPU with netfilter counters reset and check
cpu meta after another ping

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 tools/testing/selftests/netfilter/nft_meta.sh | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/tools/testing/selftests/netfilter/nft_meta.sh b/tools/testing/selftests/netfilter/nft_meta.sh
index d250b84dd5bc..17b2d6eaa204 100755
--- a/tools/testing/selftests/netfilter/nft_meta.sh
+++ b/tools/testing/selftests/netfilter/nft_meta.sh
@@ -33,6 +33,7 @@ table inet filter {
 	counter infproto4count {}
 	counter il4protocounter {}
 	counter imarkcounter {}
+	counter icpu0counter {}
 
 	counter oifcount {}
 	counter oifnamecount {}
@@ -54,6 +55,7 @@ table inet filter {
 		meta nfproto ipv4 counter name "infproto4count"
 		meta l4proto icmp counter name "il4protocounter"
 		meta mark 42 counter name "imarkcounter"
+		meta cpu 0 counter name "icpu0counter"
 	}
 
 	chain output {
@@ -119,6 +121,18 @@ check_one_counter omarkcounter "1" true
 
 if [ $ret -eq 0 ];then
 	echo "OK: nftables meta iif/oif counters at expected values"
+else
+	exit $ret
+fi
+
+#First CPU execution and counter
+taskset -p 01 $$ > /dev/null
+ip netns exec "$ns0" nft reset counters > /dev/null
+ip netns exec "$ns0" ping -q -c 1 127.0.0.1 > /dev/null
+check_one_counter icpu0counter "2" true
+
+if [ $ret -eq 0 ];then
+	echo "OK: nftables meta cpu counter at expected values"
 fi
 
 exit $ret
-- 
2.20.1


^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 2/4] selftests: netfilter: fix nft_meta.sh error reporting
  2020-10-07  0:10 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
  2020-10-07  0:10 ` [PATCH 1/4] selftests: netfilter: add cpu counter check Pablo Neira Ayuso
@ 2020-10-07  0:10 ` Pablo Neira Ayuso
  2020-10-07  0:10 ` [PATCH 3/4] selftests: netfilter: remove unused cnt and simplify command testing Pablo Neira Ayuso
                   ` (2 subsequent siblings)
  4 siblings, 0 replies; 29+ messages in thread
From: Pablo Neira Ayuso @ 2020-10-07  0:10 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev, kuba

From: Fabian Frederick <fabf@skynet.be>

When some test directly done with check_one_counter() fails,
counter variable is undefined. This patch calls ip with cname
which avoids errors like:
FAIL: oskuidcounter, want "packets 2", got
Error: syntax error, unexpected newline, expecting string
list counter inet filter
                        ^
Error is now correctly rendered:
FAIL: oskuidcounter, want "packets 2", got
table inet filter {
	counter oskuidcounter {
		packets 1 bytes 84
	}
}

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 tools/testing/selftests/netfilter/nft_meta.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/netfilter/nft_meta.sh b/tools/testing/selftests/netfilter/nft_meta.sh
index 17b2d6eaa204..1f5b46542c14 100755
--- a/tools/testing/selftests/netfilter/nft_meta.sh
+++ b/tools/testing/selftests/netfilter/nft_meta.sh
@@ -90,7 +90,7 @@ check_one_counter()
 	if [ $? -ne 0 ];then
 		echo "FAIL: $cname, want \"$want\", got"
 		ret=1
-		ip netns exec "$ns0" nft list counter inet filter $counter
+		ip netns exec "$ns0" nft list counter inet filter $cname
 	fi
 }
 
-- 
2.20.1


^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 3/4] selftests: netfilter: remove unused cnt and simplify command testing
  2020-10-07  0:10 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
  2020-10-07  0:10 ` [PATCH 1/4] selftests: netfilter: add cpu counter check Pablo Neira Ayuso
  2020-10-07  0:10 ` [PATCH 2/4] selftests: netfilter: fix nft_meta.sh error reporting Pablo Neira Ayuso
@ 2020-10-07  0:10 ` Pablo Neira Ayuso
  2020-10-07  0:10 ` [PATCH 4/4] selftests: netfilter: add time counter check Pablo Neira Ayuso
  2020-10-09 19:19 ` [PATCH 0/4] Netfilter fixes for net Jakub Kicinski
  4 siblings, 0 replies; 29+ messages in thread
From: Pablo Neira Ayuso @ 2020-10-07  0:10 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev, kuba

From: Fabian Frederick <fabf@skynet.be>

cnt was not used in nft_meta.sh
This patch also fixes 2 shellcheck SC2181 warnings:
"check exit code directly with e.g. 'if mycmd;', not indirectly with
$?."

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 tools/testing/selftests/netfilter/nft_meta.sh | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/netfilter/nft_meta.sh b/tools/testing/selftests/netfilter/nft_meta.sh
index 1f5b46542c14..18a1abca3262 100755
--- a/tools/testing/selftests/netfilter/nft_meta.sh
+++ b/tools/testing/selftests/netfilter/nft_meta.sh
@@ -7,8 +7,7 @@ ksft_skip=4
 sfx=$(mktemp -u "XXXXXXXX")
 ns0="ns0-$sfx"
 
-nft --version > /dev/null 2>&1
-if [ $? -ne 0 ];then
+if ! nft --version > /dev/null 2>&1; then
 	echo "SKIP: Could not run test without nft tool"
 	exit $ksft_skip
 fi
@@ -86,8 +85,7 @@ check_one_counter()
 	local want="packets $2"
 	local verbose="$3"
 
-	cnt=$(ip netns exec "$ns0" nft list counter inet filter $cname | grep -q "$want")
-	if [ $? -ne 0 ];then
+	if ! ip netns exec "$ns0" nft list counter inet filter $cname | grep -q "$want"; then
 		echo "FAIL: $cname, want \"$want\", got"
 		ret=1
 		ip netns exec "$ns0" nft list counter inet filter $cname
-- 
2.20.1


^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 4/4] selftests: netfilter: add time counter check
  2020-10-07  0:10 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
                   ` (2 preceding siblings ...)
  2020-10-07  0:10 ` [PATCH 3/4] selftests: netfilter: remove unused cnt and simplify command testing Pablo Neira Ayuso
@ 2020-10-07  0:10 ` Pablo Neira Ayuso
  2020-10-09 19:19 ` [PATCH 0/4] Netfilter fixes for net Jakub Kicinski
  4 siblings, 0 replies; 29+ messages in thread
From: Pablo Neira Ayuso @ 2020-10-07  0:10 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev, kuba

From: Fabian Frederick <fabf@skynet.be>

Check packets are correctly placed in current year.
Also do a NULL check for another one.

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 tools/testing/selftests/netfilter/nft_meta.sh | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/netfilter/nft_meta.sh b/tools/testing/selftests/netfilter/nft_meta.sh
index 18a1abca3262..087f0e6e71ce 100755
--- a/tools/testing/selftests/netfilter/nft_meta.sh
+++ b/tools/testing/selftests/netfilter/nft_meta.sh
@@ -23,6 +23,8 @@ ip -net "$ns0" addr add 127.0.0.1 dev lo
 
 trap cleanup EXIT
 
+currentyear=$(date +%G)
+lastyear=$((currentyear-1))
 ip netns exec "$ns0" nft -f /dev/stdin <<EOF
 table inet filter {
 	counter iifcount {}
@@ -33,6 +35,8 @@ table inet filter {
 	counter il4protocounter {}
 	counter imarkcounter {}
 	counter icpu0counter {}
+	counter ilastyearcounter {}
+	counter icurrentyearcounter {}
 
 	counter oifcount {}
 	counter oifnamecount {}
@@ -55,6 +59,8 @@ table inet filter {
 		meta l4proto icmp counter name "il4protocounter"
 		meta mark 42 counter name "imarkcounter"
 		meta cpu 0 counter name "icpu0counter"
+		meta time "$lastyear-01-01" - "$lastyear-12-31" counter name ilastyearcounter
+		meta time "$currentyear-01-01" - "$currentyear-12-31" counter name icurrentyearcounter
 	}
 
 	chain output {
@@ -100,8 +106,7 @@ check_lo_counters()
 
 	for counter in iifcount iifnamecount iifgroupcount iiftypecount infproto4count \
 		       oifcount oifnamecount oifgroupcount oiftypecount onfproto4count \
-		       il4protocounter \
-		       ol4protocounter \
+		       il4protocounter icurrentyearcounter ol4protocounter \
 	     ; do
 		check_one_counter "$counter" "$want" "$verbose"
 	done
@@ -116,6 +121,7 @@ check_one_counter oskuidcounter "1" true
 check_one_counter oskgidcounter "1" true
 check_one_counter imarkcounter "1" true
 check_one_counter omarkcounter "1" true
+check_one_counter ilastyearcounter "0" true
 
 if [ $ret -eq 0 ];then
 	echo "OK: nftables meta iif/oif counters at expected values"
-- 
2.20.1


^ permalink raw reply	[flat|nested] 29+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2020-10-07  0:10 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
                   ` (3 preceding siblings ...)
  2020-10-07  0:10 ` [PATCH 4/4] selftests: netfilter: add time counter check Pablo Neira Ayuso
@ 2020-10-09 19:19 ` Jakub Kicinski
  4 siblings, 0 replies; 29+ messages in thread
From: Jakub Kicinski @ 2020-10-09 19:19 UTC (permalink / raw)
  To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev

On Wed,  7 Oct 2020 02:10:23 +0200 Pablo Neira Ayuso wrote:
> The following patchset contains Netfilter selftests fixes from
> Fabian Frederick:
> 
> 1) Extend selftest nft_meta.sh to check for meta cpu.
> 
> 2) Fix selftest nft_meta.sh error reporting.
> 
> 3) Fix shellcheck warnings in selftest nft_meta.sh.
> 
> 4) Extend selftest nft_meta.sh to check for meta time.
> 
> Please, pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thank you!

^ permalink raw reply	[flat|nested] 29+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2020-10-13 23:45 Pablo Neira Ayuso
@ 2020-10-14  3:07 ` Jakub Kicinski
  0 siblings, 0 replies; 29+ messages in thread
From: Jakub Kicinski @ 2020-10-14  3:07 UTC (permalink / raw)
  To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev

On Wed, 14 Oct 2020 01:45:55 +0200 Pablo Neira Ayuso wrote:
> Hi,
> 
> The following patchset contains Netfilter fixes for net:
> 
> 1) Extend nf_queue selftest to cover re-queueing, non-gso mode and
>    delayed queueing, from Florian Westphal.
> 
> 2) Clear skb->tstamp in IPVS forwarding path, from Julian Anastasov.
> 
> 3) Provide netlink extended error reporting for EEXIST case.
> 
> 4) Missing VLAN offload tag and proto in log target.
> 
> Please, pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
> 
> Absolutely nothing urgent in this batch, you might consider pulling this
> once net-next.git gets merged into net.git so this shows up in 5.10-rc.

Pulled, thanks!

^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2020-10-13 23:45 Pablo Neira Ayuso
  2020-10-14  3:07 ` Jakub Kicinski
  0 siblings, 1 reply; 29+ messages in thread
From: Pablo Neira Ayuso @ 2020-10-13 23:45 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev, kuba

Hi,

The following patchset contains Netfilter fixes for net:

1) Extend nf_queue selftest to cover re-queueing, non-gso mode and
   delayed queueing, from Florian Westphal.

2) Clear skb->tstamp in IPVS forwarding path, from Julian Anastasov.

3) Provide netlink extended error reporting for EEXIST case.

4) Missing VLAN offload tag and proto in log target.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Absolutely nothing urgent in this batch, you might consider pulling this
once net-next.git gets merged into net.git so this shows up in 5.10-rc.

Thank you.

----------------------------------------------------------------

The following changes since commit 874fb9e2ca949b443cc419a4f2227cafd4381d39:

  ipv4: Restore flowi4_oif update before call to xfrm_lookup_route (2020-10-10 11:38:59 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 0d9826bc18ce356e8909919ad681ad65d0a6061e:

  netfilter: nf_log: missing vlan offload tag and proto (2020-10-14 01:25:14 +0200)

----------------------------------------------------------------
Florian Westphal (1):
      selftests: netfilter: extend nfqueue test case

Julian Anastasov (1):
      ipvs: clear skb->tstamp in forwarding path

Pablo Neira Ayuso (2):
      netfilter: nftables: extend error reporting for chain updates
      netfilter: nf_log: missing vlan offload tag and proto

 include/net/netfilter/nf_log.h                 |  1 +
 net/ipv4/netfilter/nf_log_arp.c                | 19 ++++++-
 net/ipv4/netfilter/nf_log_ipv4.c               |  6 ++-
 net/ipv6/netfilter/nf_log_ipv6.c               |  8 +--
 net/netfilter/ipvs/ip_vs_xmit.c                |  6 +++
 net/netfilter/nf_log_common.c                  | 12 +++++
 net/netfilter/nf_tables_api.c                  | 19 +++++--
 tools/testing/selftests/netfilter/nf-queue.c   | 61 ++++++++++++++++++----
 tools/testing/selftests/netfilter/nft_queue.sh | 70 +++++++++++++++++++++-----
 9 files changed, 168 insertions(+), 34 deletions(-)

^ permalink raw reply	[flat|nested] 29+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2020-06-14 21:52 Pablo Neira Ayuso
@ 2020-06-15 20:27 ` David Miller
  0 siblings, 0 replies; 29+ messages in thread
From: David Miller @ 2020-06-15 20:27 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev, kuba

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sun, 14 Jun 2020 23:52:57 +0200

> The following patchset contains Netfilter fixes for net:
> 
> 1) Fix bogus EEXIST on element insertions to the rbtree with timeouts,
>    from Stefano Brivio.
> 
> 2) Preempt BUG splat in the pipapo element insertion path, also from
>    Stefano.
> 
> 3) Release filter from the ctnetlink error path.
> 
> 4) Release flowtable hooks from the deletion path.
> 
> Please, pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks Pablo.

^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2020-06-14 21:52 Pablo Neira Ayuso
  2020-06-15 20:27 ` David Miller
  0 siblings, 1 reply; 29+ messages in thread
From: Pablo Neira Ayuso @ 2020-06-14 21:52 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev, kuba

Hi,

The following patchset contains Netfilter fixes for net:

1) Fix bogus EEXIST on element insertions to the rbtree with timeouts,
   from Stefano Brivio.

2) Preempt BUG splat in the pipapo element insertion path, also from
   Stefano.

3) Release filter from the ctnetlink error path.

4) Release flowtable hooks from the deletion path.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thank you.

----------------------------------------------------------------

The following changes since commit af7b4801030c07637840191c69eb666917e4135d:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2020-06-07 17:27:45 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 3003055f50663095472144994dac0339076031a8:

  netfilter: nf_tables: hook list memleak in flowtable deletion (2020-06-12 17:48:21 +0200)

----------------------------------------------------------------
Pablo Neira Ayuso (2):
      netfilter: ctnetlink: memleak in filter initialization error path
      netfilter: nf_tables: hook list memleak in flowtable deletion

Stefano Brivio (2):
      netfilter: nft_set_rbtree: Don't account for expired elements on insertion
      netfilter: nft_set_pipapo: Disable preemption before getting per-CPU pointer

 net/netfilter/nf_conntrack_netlink.c | 32 ++++++++++++++++++++++----------
 net/netfilter/nf_tables_api.c        | 31 ++++++++++++++++++++++++-------
 net/netfilter/nft_set_pipapo.c       |  6 +++++-
 net/netfilter/nft_set_rbtree.c       | 21 ++++++++++++++-------
 4 files changed, 65 insertions(+), 25 deletions(-)

^ permalink raw reply	[flat|nested] 29+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2020-03-20 13:51 Pablo Neira Ayuso
@ 2020-03-21  2:34 ` David Miller
  0 siblings, 0 replies; 29+ messages in thread
From: David Miller @ 2020-03-21  2:34 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 20 Mar 2020 14:51:30 +0100

> The following patchset contains Netfilter fixes for net:
> 
> 1) Refetch IP header pointer after pskb_may_pull() in flowtable,
>    from Haishuang Yan.
> 
> 2) Fix memleak in flowtable offload in nf_flow_table_free(),
>    from Paul Blakey.
> 
> 3) Set control.addr_type mask in flowtable offload, from Edward Cree.

Pulled, thanks Pablo.

^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2020-03-20 13:51 Pablo Neira Ayuso
  2020-03-21  2:34 ` David Miller
  0 siblings, 1 reply; 29+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-20 13:51 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi,

The following patchset contains Netfilter fixes for net:

1) Refetch IP header pointer after pskb_may_pull() in flowtable,
   from Haishuang Yan.

2) Fix memleak in flowtable offload in nf_flow_table_free(),
   from Paul Blakey.

3) Set control.addr_type mask in flowtable offload, from Edward Cree.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thank you.

----------------------------------------------------------------

The following changes since commit 3c025b6317272ee8493ee20fa5035c087626af48:

  Merge branch 'wireguard-fixes' (2020-03-18 18:51:43 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 15ff197237e76c4dab06b7b518afaa4ebb1c43e0:

  netfilter: flowtable: populate addr_type mask (2020-03-19 21:20:04 +0100)

----------------------------------------------------------------
Edward Cree (1):
      netfilter: flowtable: populate addr_type mask

Haishuang Yan (2):
      netfilter: flowtable: reload ip{v6}h in nf_flow_nat_ip{v6}
      netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6}

Paul Blakey (1):
      netfilter: flowtable: Fix flushing of offloaded flows on free

 net/netfilter/nf_flow_table_core.c    |  3 +++
 net/netfilter/nf_flow_table_ip.c      | 14 ++++++++++----
 net/netfilter/nf_flow_table_offload.c |  1 +
 3 files changed, 14 insertions(+), 4 deletions(-)

^ permalink raw reply	[flat|nested] 29+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2019-12-26 16:39 Pablo Neira Ayuso
@ 2019-12-26 21:11 ` David Miller
  0 siblings, 0 replies; 29+ messages in thread
From: David Miller @ 2019-12-26 21:11 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 26 Dec 2019 17:39:52 +0100

> The following patchset contains Netfilter fixes for net:
> 
> 1) Fix endianness issue in flowtable TCP flags dissector,
>    from Arnd Bergmann.
> 
> 2) Extend flowtable test script with dnat rules, from Florian Westphal.
> 
> 3) Reject padding in ebtables user entries and validate computed user
>    offset, reported by syzbot, from Florian Westphal.
> 
> 4) Fix endianness in nft_tproxy, from Phil Sutter.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thank you.

^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2019-12-26 16:39 Pablo Neira Ayuso
  2019-12-26 21:11 ` David Miller
  0 siblings, 1 reply; 29+ messages in thread
From: Pablo Neira Ayuso @ 2019-12-26 16:39 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi,

The following patchset contains Netfilter fixes for net:

1) Fix endianness issue in flowtable TCP flags dissector,
   from Arnd Bergmann.

2) Extend flowtable test script with dnat rules, from Florian Westphal.

3) Reject padding in ebtables user entries and validate computed user
   offset, reported by syzbot, from Florian Westphal.

4) Fix endianness in nft_tproxy, from Phil Sutter.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks.

----------------------------------------------------------------

The following changes since commit 0fd260056ef84ede8f444c66a3820811691fe884:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf (2019-12-19 14:20:47 -0800)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 8cb4ec44de42b99b92399b4d1daf3dc430ed0186:

  netfilter: nft_tproxy: Fix port selector on Big Endian (2019-12-20 02:12:28 +0100)

----------------------------------------------------------------
Arnd Bergmann (1):
      netfilter: nf_flow_table: fix big-endian integer overflow

Florian Westphal (2):
      selftests: netfilter: extend flowtable test script with dnat rule
      netfilter: ebtables: compat: reject all padding in matches/watchers

Phil Sutter (1):
      netfilter: nft_tproxy: Fix port selector on Big Endian

 net/bridge/netfilter/ebtables.c                    | 33 +++++++++---------
 net/netfilter/nf_flow_table_offload.c              |  2 +-
 net/netfilter/nft_tproxy.c                         |  4 +--
 tools/testing/selftests/netfilter/nft_flowtable.sh | 39 +++++++++++++++++++---
 4 files changed, 53 insertions(+), 25 deletions(-)

^ permalink raw reply	[flat|nested] 29+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2017-05-29 11:34 Pablo Neira Ayuso
@ 2017-05-30  3:20 ` David Miller
  0 siblings, 0 replies; 29+ messages in thread
From: David Miller @ 2017-05-30  3:20 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 29 May 2017 13:34:28 +0200

> Hi David,
> 
> The following patchset contains Netfilter fixes for your net tree,
> they are:
> 
> 1) Conntrack SCTP CRC32c checksum mangling may operate on non-linear
>    skbuff, patch from Davide Caratti.
> 
> 2) nf_tables rb-tree set backend does not handle element re-addition
>    after deletion in the same transaction, leading to infinite loop.
> 
> 3) Atomically unclear the IPS_SRC_NAT_DONE_BIT on nat module removal,
>    from Liping Zhang.
> 
> 4) Conntrack hashtable resizing while ctnetlink dump is progress leads
>    to a dead reference to released objects in the lists, also from
>    Liping.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks a lot Pablo.

^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2017-05-29 11:34 Pablo Neira Ayuso
  2017-05-30  3:20 ` David Miller
  0 siblings, 1 reply; 29+ messages in thread
From: Pablo Neira Ayuso @ 2017-05-29 11:34 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Conntrack SCTP CRC32c checksum mangling may operate on non-linear
   skbuff, patch from Davide Caratti.

2) nf_tables rb-tree set backend does not handle element re-addition
   after deletion in the same transaction, leading to infinite loop.

3) Atomically unclear the IPS_SRC_NAT_DONE_BIT on nat module removal,
   from Liping Zhang.

4) Conntrack hashtable resizing while ctnetlink dump is progress leads
   to a dead reference to released objects in the lists, also from
   Liping.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 6d18c732b95c0a9d35e9f978b4438bba15412284:

  bridge: start hello_timer when enabling KERNEL_STP in br_stp_start (2017-05-21 13:33:28 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to fefa92679dbe0c613e62b6c27235dcfbe9640ad1:

  netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize (2017-05-24 11:26:01 +0200)

----------------------------------------------------------------
Davide Caratti (1):
      netfilter: conntrack: fix false CRC32c mismatch using paged skb

Liping Zhang (2):
      netfilter: nat: use atomic bit op to clear the _SRC_NAT_DONE_BIT
      netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize

Pablo Neira Ayuso (1):
      netfilter: nft_set_rbtree: handle element re-addition after deletion

 net/netfilter/nf_conntrack_netlink.c    |  7 ++++++-
 net/netfilter/nf_conntrack_proto_sctp.c |  9 ++++++---
 net/netfilter/nf_nat_core.c             |  2 +-
 net/netfilter/nft_set_rbtree.c          | 22 +++++++++++-----------
 4 files changed, 24 insertions(+), 16 deletions(-)

^ permalink raw reply	[flat|nested] 29+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2017-03-03 19:22 Pablo Neira Ayuso
@ 2017-03-04  4:41 ` David Miller
  0 siblings, 0 replies; 29+ messages in thread
From: David Miller @ 2017-03-04  4:41 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri,  3 Mar 2017 20:22:21 +0100

> The following patchset contains Netfilter fixes for your net tree,
> they are:
> 
> 1) Missing check for full sock in ip_route_me_harder(), from
>    Florian Westphal.
> 
> 2) Incorrect sip helper structure initilization that breaks it when
>    several ports are used, from Christophe Leroy.
> 
> 3) Fix incorrect assumption when looking up for matching with adjacent
>    intervals in the nft_set_rbtree.
> 
> 4) Fix broken netlink event error reporting in nf_tables that results
>    in misleading ESRCH errors propagated to userspace listeners.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks a lot Pablo.

^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2017-03-03 19:22 Pablo Neira Ayuso
  2017-03-04  4:41 ` David Miller
  0 siblings, 1 reply; 29+ messages in thread
From: Pablo Neira Ayuso @ 2017-03-03 19:22 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Missing check for full sock in ip_route_me_harder(), from
   Florian Westphal.

2) Incorrect sip helper structure initilization that breaks it when
   several ports are used, from Christophe Leroy.

3) Fix incorrect assumption when looking up for matching with adjacent
   intervals in the nft_set_rbtree.

4) Fix broken netlink event error reporting in nf_tables that results
   in misleading ESRCH errors propagated to userspace listeners.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 2f44f75257d57f0d5668dba3a6ada0f4872132c9:

  Merge branch 'qed-fixes' (2017-02-27 09:22:10 -0500)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 25e94a997b324b5f167f56d56d7106d38b78c9de:

  netfilter: nf_tables: don't call nfnetlink_set_err() if nfnetlink_send() fails (2017-03-03 13:48:34 +0100)

----------------------------------------------------------------
Christophe Leroy (1):
      netfilter: nf_conntrack_sip: fix wrong memory initialisation

Florian Westphal (1):
      netfilter: use skb_to_full_sk in ip_route_me_harder

Pablo Neira Ayuso (2):
      netfilter: nft_set_rbtree: incorrect assumption on lower interval lookups
      netfilter: nf_tables: don't call nfnetlink_set_err() if nfnetlink_send() fails

 include/net/netfilter/nf_tables.h |   6 +-
 net/ipv4/netfilter.c              |   7 +-
 net/netfilter/nf_conntrack_sip.c  |   2 -
 net/netfilter/nf_tables_api.c     | 133 ++++++++++++++++----------------------
 net/netfilter/nft_set_rbtree.c    |   9 ++-
 5 files changed, 66 insertions(+), 91 deletions(-)

^ permalink raw reply	[flat|nested] 29+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2016-09-13  9:05 Pablo Neira Ayuso
@ 2016-09-13 15:17 ` David Miller
  0 siblings, 0 replies; 29+ messages in thread
From: David Miller @ 2016-09-13 15:17 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 13 Sep 2016 11:05:13 +0200

> The following patchset contains Netfilter fixes for your net tree,
> they are:
 ...
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks Pablo.

^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2016-09-13  9:05 Pablo Neira Ayuso
  2016-09-13 15:17 ` David Miller
  0 siblings, 1 reply; 29+ messages in thread
From: Pablo Neira Ayuso @ 2016-09-13  9:05 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Endianess fix for the new nf_tables netlink trace infrastructure,
   NFTA_TRACE_POLICY endianess was not correct, patch from Liping Zhang.

2) Fix broken re-route after userspace queueing in nf_tables route
   chain. This patch is large but it is simple since it is just getting
   this code in sync with iptable_mangle. Also from Liping.

3) NAT mangling via ctnetlink lies to userspace when nf_nat_setup_info()
   fails to setup the NAT conntrack extension. This problem has been
   there since the beginning, but it can now show up after rhashtable
   conversion.

4) Fix possible NULL pointer dereference due to failures in allocating
   the synproxy and seqadj conntrack extensions, from Gao feng.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 6e1ce3c3451291142a57c4f3f6f999a29fb5b3bc:

  af_unix: split 'u->readlock' into two: 'iolock' and 'bindlock' (2016-09-04 13:29:29 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 4440a2ab3b9f40dddbe006331ef0659c76859296:

  netfilter: synproxy: Check oom when adding synproxy and seqadj ct extensions (2016-09-13 10:50:56 +0200)

----------------------------------------------------------------
Gao Feng (1):
      netfilter: synproxy: Check oom when adding synproxy and seqadj ct extensions

Liping Zhang (2):
      netfilter: nf_tables_trace: fix endiness when dump chain policy
      netfilter: nft_chain_route: re-route before skb is queued to userspace

Pablo Neira Ayuso (1):
      netfilter: nf_nat: handle NF_DROP from nfnetlink_parse_nat_setup()

 include/net/netfilter/nf_conntrack_synproxy.h | 14 ++++++++++++++
 net/ipv4/netfilter/nft_chain_route_ipv4.c     | 11 +++++++----
 net/ipv6/netfilter/nft_chain_route_ipv6.c     | 10 +++++++---
 net/netfilter/nf_conntrack_core.c             |  6 +++---
 net/netfilter/nf_nat_core.c                   |  5 +++--
 net/netfilter/nf_tables_trace.c               |  2 +-
 6 files changed, 35 insertions(+), 13 deletions(-)

^ permalink raw reply	[flat|nested] 29+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2015-10-19 18:22 Pablo Neira Ayuso
@ 2015-10-22  2:27 ` David Miller
  0 siblings, 0 replies; 29+ messages in thread
From: David Miller @ 2015-10-22  2:27 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 19 Oct 2015 20:22:51 +0200

> The following patchset contains four Netfilter fixes for net, they are:
> 
> 1) Fix Kconfig dependencies of new nf_dup_ipv4 and nf_dup_ipv6.
> 
> 2) Remove bogus test nh_scope in IPv4 rpfilter match that is breaking
>    --accept-local, from Xin Long.
> 
> 3) Wait for RCU grace period after dropping the pending packets in the
>    nfqueue, from Florian Westphal.
> 
> 4) Fix sleeping allocation while holding spin_lock_bh, from Nikolay Borisov.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks a lot Pablo.

^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2015-10-19 18:22 Pablo Neira Ayuso
  2015-10-22  2:27 ` David Miller
  0 siblings, 1 reply; 29+ messages in thread
From: Pablo Neira Ayuso @ 2015-10-19 18:22 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains four Netfilter fixes for net, they are:

1) Fix Kconfig dependencies of new nf_dup_ipv4 and nf_dup_ipv6.

2) Remove bogus test nh_scope in IPv4 rpfilter match that is breaking
   --accept-local, from Xin Long.

3) Wait for RCU grace period after dropping the pending packets in the
   nfqueue, from Florian Westphal.

4) Fix sleeping allocation while holding spin_lock_bh, from Nikolay Borisov.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit b84f78782052ee4516903e5d0566a5eee365b771:

  net: Initialize flow flags in input path (2015-09-29 21:52:32 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 00db674bedd68ff8b5afae9030ff5e04d45d1b4a:

  netfilter: ipset: Fix sleeping memory allocation in atomic context (2015-10-17 13:01:24 +0200)

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: sync with packet rx also after removing queue entries

Nikolay Borisov (1):
      netfilter: ipset: Fix sleeping memory allocation in atomic context

Pablo Neira Ayuso (1):
      netfilter: fix Kconfig dependencies for nf_dup_ipv{4,6}

lucien (1):
      netfilter: ipt_rpfilter: remove the nh_scope test in rpfilter_lookup_reverse

 net/ipv4/netfilter/Kconfig            | 1 +
 net/ipv4/netfilter/ipt_rpfilter.c     | 4 +---
 net/ipv6/netfilter/Kconfig            | 1 +
 net/netfilter/core.c                  | 2 ++
 net/netfilter/ipset/ip_set_list_set.c | 2 +-
 5 files changed, 6 insertions(+), 4 deletions(-)

^ permalink raw reply	[flat|nested] 29+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2015-09-18  9:17 Pablo Neira Ayuso
@ 2015-09-21  5:32 ` David Miller
  0 siblings, 0 replies; 29+ messages in thread
From: David Miller @ 2015-09-21  5:32 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 18 Sep 2015 11:17:52 +0200

> The following patch contains Netfilter fixes for your net tree, they are:
> 
> 1) nf_log_unregister() should only set to NULL the logger that is being
>    unregistered, instead of everything else. Patch from Florian Westphal.
> 
> 2) Fix a crash when accessing physoutdev from PREROUTING in br_netfilter.
>    This is partially reverting the patch to shrink nf_bridge_info to 32 bytes.
>    Also from Florian.
> 
> 3) Use existing match/target extensions in the internal nft_compat extension
>    lists when the extension is family unspecific (ie. NFPROTO_UNSPEC).
> 
> 4) Wait for rcu grace period before leaving nf_log_unregister().
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks Pablo.

^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2015-09-18  9:17 Pablo Neira Ayuso
  2015-09-21  5:32 ` David Miller
  0 siblings, 1 reply; 29+ messages in thread
From: Pablo Neira Ayuso @ 2015-09-18  9:17 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patch contains Netfilter fixes for your net tree, they are:

1) nf_log_unregister() should only set to NULL the logger that is being
   unregistered, instead of everything else. Patch from Florian Westphal.

2) Fix a crash when accessing physoutdev from PREROUTING in br_netfilter.
   This is partially reverting the patch to shrink nf_bridge_info to 32 bytes.
   Also from Florian.

3) Use existing match/target extensions in the internal nft_compat extension
   lists when the extension is family unspecific (ie. NFPROTO_UNSPEC).

4) Wait for rcu grace period before leaving nf_log_unregister().

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit e8684c88774c0ddfeefdbed0aa469b25b9962f3e:

  irda: ali-ircc: Fix deadlock in ali_ircc_sir_change_speed() (2015-09-11 16:18:33 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to ad5001cc7cdf9aaee5eb213fdee657e4a3c94776:

  netfilter: nf_log: wait for rcu grace after logger unregistration (2015-09-17 13:37:31 +0200)

----------------------------------------------------------------
Florian Westphal (2):
      netfilter: nf_log: don't zap all loggers on unregister
      netfilter: bridge: fix routing of bridge frames with call-iptables=1

Pablo Neira Ayuso (2):
      netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC
      netfilter: nf_log: wait for rcu grace after logger unregistration

 include/linux/skbuff.h     |    6 +++---
 net/netfilter/nf_log.c     |    9 +++++++--
 net/netfilter/nft_compat.c |   24 ++++++++++++++++++------
 3 files changed, 28 insertions(+), 11 deletions(-)

^ permalink raw reply	[flat|nested] 29+ messages in thread

* Re: [PATCH 0/4] Netfilter fixes for net
  2015-05-16 18:47 Pablo Neira Ayuso
@ 2015-05-16 20:45 ` David Miller
  0 siblings, 0 replies; 29+ messages in thread
From: David Miller @ 2015-05-16 20:45 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sat, 16 May 2015 20:47:14 +0200

> The following patchset contains Netfilter fixes for your net tree, they are:
> 
> 1) Fix a leak in IPVS, the sysctl table is not released accordingly when
>    destroying a netns, patch from Tommi Rantala.
> 
> 2) Fix a build error when TPROXY and socket are built-in but IPv6 defrag is
>    compiled as module, from Florian Westphal.
> 
> 3) Fix TCP tracket wrt. RFC5961 challenge ACK when in LAST_ACK state, patch
>    from Jesper Dangaard Brouer.
> 
> 4) Fix a bogus WARN_ON() in nf_tables when deleting a set element that stores
>    a map, from Mirek Kratochvil.

Pulled, thanks Pablo.

^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2015-05-16 18:47 Pablo Neira Ayuso
  2015-05-16 20:45 ` David Miller
  0 siblings, 1 reply; 29+ messages in thread
From: Pablo Neira Ayuso @ 2015-05-16 18:47 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains Netfilter fixes for your net tree, they are:

1) Fix a leak in IPVS, the sysctl table is not released accordingly when
   destroying a netns, patch from Tommi Rantala.

2) Fix a build error when TPROXY and socket are built-in but IPv6 defrag is
   compiled as module, from Florian Westphal.

3) Fix TCP tracket wrt. RFC5961 challenge ACK when in LAST_ACK state, patch
   from Jesper Dangaard Brouer.

4) Fix a bogus WARN_ON() in nf_tables when deleting a set element that stores
   a map, from Mirek Kratochvil.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 39376ccb1968ba9f83e2a880a8bf02ad5dea44e1:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf (2015-04-27 23:12:34 -0400)

are available in the git repository at:


  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to 960bd2c26421d321e890f1936938196ead41976f:

  netfilter: nf_tables: fix bogus warning in nft_data_uninit() (2015-05-15 22:07:30 +0200)

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: avoid build error if TPROXY/SOCKET=y && NF_DEFRAG_IPV6=m

Jesper Dangaard Brouer (1):
      conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition

Mirek Kratochvil (1):
      netfilter: nf_tables: fix bogus warning in nft_data_uninit()

Tommi Rantala (1):
      ipvs: fix memory leak in ip_vs_ctl.c

 include/uapi/linux/netfilter/nf_conntrack_tcp.h |    3 ++
 net/netfilter/Kconfig                           |    2 ++
 net/netfilter/ipvs/ip_vs_ctl.c                  |    3 ++
 net/netfilter/nf_conntrack_proto_tcp.c          |   35 +++++++++++++++++++++--
 net/netfilter/nf_tables_api.c                   |    4 +--
 5 files changed, 42 insertions(+), 5 deletions(-)

^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 0/4] Netfilter fixes for net
@ 2014-08-11 17:06 Pablo Neira Ayuso
  0 siblings, 0 replies; 29+ messages in thread
From: Pablo Neira Ayuso @ 2014-08-11 17:06 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains fixes for your net tree, they are:

1) Unitialize the set element key and data from the commit path,
   otherwise this leaks chain refcount if the transaction is aborted,
   reported by Thomas Graf.

2) Fix crash when updating chains without no counters in nf_tables,
   this slipped through in the new transaction infrastructure, reported
   by Matteo Croce.

3) Replace all mutex_lock_interruptible() by mutex_lock() in the Netfilter
   tree, suggested by Patrick McHardy. This implicitly fixes the problem
   that Eric Dumazet reported in: http://patchwork.ozlabs.org/patch/373076/

4) Fix error return code in nf_tables when deleting set element in
   nf_tables if the transaction cannot be allocated, from Julia Lawall.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 33caee39925b887a99a2400dc5c980097c3573f9:

  Merge branch 'akpm' (patchbomb from Andrew Morton) (2014-08-06 21:14:42 -0700)

are available in the git repository at:


  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to 609ccf087747de48ef52160f93e0df864c532a61:

  netfilter: nf_tables: fix error return code (2014-08-08 16:47:29 +0200)

----------------------------------------------------------------
Julia Lawall (1):
      netfilter: nf_tables: fix error return code

Pablo Neira Ayuso (3):
      netfilter: nf_tables: uninitialize element key/data from the commit path
      netfilter: nf_tables: don't update chain with unset counters
      netfilter: don't use mutex_lock_interruptible()

 net/bridge/netfilter/ebtables.c |   10 ++-------
 net/netfilter/core.c            |   11 ++-------
 net/netfilter/ipvs/ip_vs_ctl.c  |   19 ++++------------
 net/netfilter/nf_sockopt.c      |    8 ++-----
 net/netfilter/nf_tables_api.c   |   30 ++++++++++++++-----------
 net/netfilter/x_tables.c        |   47 ++++++++++-----------------------------
 6 files changed, 39 insertions(+), 86 deletions(-)

^ permalink raw reply	[flat|nested] 29+ messages in thread

* Re: [PATCH 0/4] netfilter fixes for net
  2013-04-12 10:13 [PATCH 0/4] netfilter " Pablo Neira Ayuso
@ 2013-04-12 18:28 ` David Miller
  0 siblings, 0 replies; 29+ messages in thread
From: David Miller @ 2013-04-12 18:28 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel, netdev

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 12 Apr 2013 12:13:15 +0200

> The following patchset contains late netfilter fixes for your net
> tree, they are:
> 
> * Don't drop segmented TCP packets in the SIP helper, we've got reports
>   from users that this was breaking communications when the SIP phone
>   messages are larger than the MTU, from Patrick McHardy.
> 
> * Fix refcount leak in the ipset list set, from Jozsef Kadlecsik.
> 
> * On hash set resizing, the nomatch flag was lost, thus entirely inverting
>   the logic of the set matching, from Jozsef Kadlecsik.
> 
> * Fix crash on NAT modules removal. Timer expiration may race with the
>   module cleanup exit path while deleting conntracks, from Florian
>   Westphal.

Pulled, thanks Pablo.

^ permalink raw reply	[flat|nested] 29+ messages in thread

* [PATCH 0/4] netfilter fixes for net
@ 2013-04-12 10:13 Pablo Neira Ayuso
  2013-04-12 18:28 ` David Miller
  0 siblings, 1 reply; 29+ messages in thread
From: Pablo Neira Ayuso @ 2013-04-12 10:13 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains late netfilter fixes for your net
tree, they are:

* Don't drop segmented TCP packets in the SIP helper, we've got reports
  from users that this was breaking communications when the SIP phone
  messages are larger than the MTU, from Patrick McHardy.

* Fix refcount leak in the ipset list set, from Jozsef Kadlecsik.

* On hash set resizing, the nomatch flag was lost, thus entirely inverting
  the logic of the set matching, from Jozsef Kadlecsik.

* Fix crash on NAT modules removal. Timer expiration may race with the
  module cleanup exit path while deleting conntracks, from Florian
  Westphal.

The following changes since commit 53f63189b1110559dce8c1ee29e8abc3e31f7630:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (2013-04-05 14:04:10 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to c2d421e171868586939c328dfb91bab840fe4c49:

  netfilter: nf_nat: fix race when unloading protocol modules (2013-04-12 11:46:31 +0200)

Please, consider pulling this.
Thanks!

P.S: Jozsef has several updates for net-next that depend on these fixes,
could you pull from your net tree into your net-next tree, please? Thanks.

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: nf_nat: fix race when unloading protocol modules

Jozsef Kadlecsik (2):
      netfilter: ipset: list:set: fix reference counter update
      netfilter: ipset: hash:*net*: nomatch flag not excluded on set resize

Patrick McHardy (1):
      netfilter: nf_ct_sip: don't drop packets with offsets pointing outside the packet

 include/linux/netfilter/ipset/ip_set_ahash.h |   30 ++++++++++++++-----
 net/netfilter/ipset/ip_set_hash_ipportnet.c  |   18 ++++++++++++
 net/netfilter/ipset/ip_set_hash_net.c        |   22 ++++++++++++--
 net/netfilter/ipset/ip_set_hash_netiface.c   |   22 ++++++++++++--
 net/netfilter/ipset/ip_set_hash_netport.c    |   18 ++++++++++++
 net/netfilter/ipset/ip_set_list_set.c        |   10 +++++--
 net/netfilter/nf_conntrack_sip.c             |    6 ++--
 net/netfilter/nf_nat_core.c                  |   40 +++++---------------------
 8 files changed, 115 insertions(+), 51 deletions(-)


^ permalink raw reply	[flat|nested] 29+ messages in thread

end of thread, back to index

Thread overview: 29+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-07  0:10 [PATCH 0/4] Netfilter fixes for net Pablo Neira Ayuso
2020-10-07  0:10 ` [PATCH 1/4] selftests: netfilter: add cpu counter check Pablo Neira Ayuso
2020-10-07  0:10 ` [PATCH 2/4] selftests: netfilter: fix nft_meta.sh error reporting Pablo Neira Ayuso
2020-10-07  0:10 ` [PATCH 3/4] selftests: netfilter: remove unused cnt and simplify command testing Pablo Neira Ayuso
2020-10-07  0:10 ` [PATCH 4/4] selftests: netfilter: add time counter check Pablo Neira Ayuso
2020-10-09 19:19 ` [PATCH 0/4] Netfilter fixes for net Jakub Kicinski
  -- strict thread matches above, loose matches on Subject: below --
2020-10-13 23:45 Pablo Neira Ayuso
2020-10-14  3:07 ` Jakub Kicinski
2020-06-14 21:52 Pablo Neira Ayuso
2020-06-15 20:27 ` David Miller
2020-03-20 13:51 Pablo Neira Ayuso
2020-03-21  2:34 ` David Miller
2019-12-26 16:39 Pablo Neira Ayuso
2019-12-26 21:11 ` David Miller
2017-05-29 11:34 Pablo Neira Ayuso
2017-05-30  3:20 ` David Miller
2017-03-03 19:22 Pablo Neira Ayuso
2017-03-04  4:41 ` David Miller
2016-09-13  9:05 Pablo Neira Ayuso
2016-09-13 15:17 ` David Miller
2015-10-19 18:22 Pablo Neira Ayuso
2015-10-22  2:27 ` David Miller
2015-09-18  9:17 Pablo Neira Ayuso
2015-09-21  5:32 ` David Miller
2015-05-16 18:47 Pablo Neira Ayuso
2015-05-16 20:45 ` David Miller
2014-08-11 17:06 Pablo Neira Ayuso
2013-04-12 10:13 [PATCH 0/4] netfilter " Pablo Neira Ayuso
2013-04-12 18:28 ` David Miller

Netfilter-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netfilter-devel/0 netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ https://lore.kernel.org/netfilter-devel \
		netfilter-devel@vger.kernel.org
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netfilter-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git