* [PATCH net 0/3] Netfilter fixes for net
@ 2021-12-17 8:53 Pablo Neira Ayuso
2021-12-17 8:53 ` [PATCH net 1/3] netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy() Pablo Neira Ayuso
` (2 more replies)
0 siblings, 3 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2021-12-17 8:53 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=y, Size: 1578 bytes --]
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix UAF in set catch-all element, from Eric Dumazet.
2) Fix MAC mangling for multicast/loopback traffic in nfnetlink_queue
and nfnetlink_log, from Ignacy Gawędzki.
3) Remove expired entries from ctnetlink dump path regardless the tuple
direction, from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 1d1c950faa81e1c287c9e14f307f845b190eb578:
Merge tag 'wireless-drivers-2021-12-15' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers (2021-12-15 14:43:07 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 76f12e632a15a20c8de3532d64a0708cf0e32f11:
netfilter: ctnetlink: remove expired entries first (2021-12-16 14:10:52 +0100)
----------------------------------------------------------------
Eric Dumazet (1):
netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()
Florian Westphal (1):
netfilter: ctnetlink: remove expired entries first
Ignacy Gawędzki (1):
netfilter: fix regression in looped (broad|multi)cast's MAC handling
net/netfilter/nf_conntrack_netlink.c | 5 +++--
net/netfilter/nf_tables_api.c | 4 ++--
net/netfilter/nfnetlink_log.c | 3 ++-
net/netfilter/nfnetlink_queue.c | 3 ++-
4 files changed, 9 insertions(+), 6 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 1/3] netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()
2021-12-17 8:53 [PATCH net 0/3] Netfilter fixes for net Pablo Neira Ayuso
@ 2021-12-17 8:53 ` Pablo Neira Ayuso
2021-12-17 11:00 ` patchwork-bot+netdevbpf
2021-12-17 8:53 ` [PATCH net 2/3] netfilter: fix regression in looped (broad|multi)cast's MAC handling Pablo Neira Ayuso
2021-12-17 8:53 ` [PATCH net 3/3] netfilter: ctnetlink: remove expired entries first Pablo Neira Ayuso
2 siblings, 1 reply; 42+ messages in thread
From: Pablo Neira Ayuso @ 2021-12-17 8:53 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
From: Eric Dumazet <edumazet@google.com>
We need to use list_for_each_entry_safe() iterator
because we can not access @catchall after kfree_rcu() call.
syzbot reported:
BUG: KASAN: use-after-free in nft_set_catchall_destroy net/netfilter/nf_tables_api.c:4486 [inline]
BUG: KASAN: use-after-free in nft_set_destroy net/netfilter/nf_tables_api.c:4504 [inline]
BUG: KASAN: use-after-free in nft_set_destroy+0x3fd/0x4f0 net/netfilter/nf_tables_api.c:4493
Read of size 8 at addr ffff8880716e5b80 by task syz-executor.3/8871
CPU: 1 PID: 8871 Comm: syz-executor.3 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0x8d/0x2ed mm/kasan/report.c:247
__kasan_report mm/kasan/report.c:433 [inline]
kasan_report.cold+0x83/0xdf mm/kasan/report.c:450
nft_set_catchall_destroy net/netfilter/nf_tables_api.c:4486 [inline]
nft_set_destroy net/netfilter/nf_tables_api.c:4504 [inline]
nft_set_destroy+0x3fd/0x4f0 net/netfilter/nf_tables_api.c:4493
__nft_release_table+0x79f/0xcd0 net/netfilter/nf_tables_api.c:9626
nft_rcv_nl_event+0x4f8/0x670 net/netfilter/nf_tables_api.c:9688
notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
blocking_notifier_call_chain kernel/notifier.c:318 [inline]
blocking_notifier_call_chain+0x67/0x90 kernel/notifier.c:306
netlink_release+0xcb6/0x1dd0 net/netlink/af_netlink.c:788
__sock_release+0xcd/0x280 net/socket.c:649
sock_close+0x18/0x20 net/socket.c:1314
__fput+0x286/0x9f0 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
exit_to_user_mode_prepare+0x27e/0x290 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f75fbf28adb
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffd8da7ec10 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f75fbf28adb
RDX: 00007f75fc08e828 RSI: ffffffffffffffff RDI: 0000000000000003
RBP: 00007f75fc08a960 R08: 0000000000000000 R09: 00007f75fc08e830
R10: 00007ffd8da7ed10 R11: 0000000000000293 R12: 00000000002067c3
R13: 00007ffd8da7ed10 R14: 00007f75fc088f60 R15: 0000000000000032
</TASK>
Allocated by task 8886:
kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc mm/kasan/common.c:513 [inline]
____kasan_kmalloc mm/kasan/common.c:472 [inline]
__kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:522
kasan_kmalloc include/linux/kasan.h:269 [inline]
kmem_cache_alloc_trace+0x1ea/0x4a0 mm/slab.c:3575
kmalloc include/linux/slab.h:590 [inline]
nft_setelem_catchall_insert net/netfilter/nf_tables_api.c:5544 [inline]
nft_setelem_insert net/netfilter/nf_tables_api.c:5562 [inline]
nft_add_set_elem+0x232e/0x2f40 net/netfilter/nf_tables_api.c:5936
nf_tables_newsetelem+0x6ff/0xbb0 net/netfilter/nf_tables_api.c:6032
nfnetlink_rcv_batch+0x1710/0x25f0 net/netfilter/nfnetlink.c:513
nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]
nfnetlink_rcv+0x3af/0x420 net/netfilter/nfnetlink.c:652
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x904/0xdf0 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:704 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:724
____sys_sendmsg+0x6e8/0x810 net/socket.c:2409
___sys_sendmsg+0xf3/0x170 net/socket.c:2463
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2492
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
Freed by task 15335:
kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:46
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free mm/kasan/common.c:328 [inline]
__kasan_slab_free+0xd1/0x110 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:235 [inline]
__cache_free mm/slab.c:3445 [inline]
kmem_cache_free_bulk+0x67/0x1e0 mm/slab.c:3766
kfree_bulk include/linux/slab.h:446 [inline]
kfree_rcu_work+0x51c/0xa10 kernel/rcu/tree.c:3273
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Last potentially related work creation:
kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38
__kasan_record_aux_stack+0xb5/0xe0 mm/kasan/generic.c:348
kvfree_call_rcu+0x74/0x990 kernel/rcu/tree.c:3550
nft_set_catchall_destroy net/netfilter/nf_tables_api.c:4489 [inline]
nft_set_destroy net/netfilter/nf_tables_api.c:4504 [inline]
nft_set_destroy+0x34a/0x4f0 net/netfilter/nf_tables_api.c:4493
__nft_release_table+0x79f/0xcd0 net/netfilter/nf_tables_api.c:9626
nft_rcv_nl_event+0x4f8/0x670 net/netfilter/nf_tables_api.c:9688
notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
blocking_notifier_call_chain kernel/notifier.c:318 [inline]
blocking_notifier_call_chain+0x67/0x90 kernel/notifier.c:306
netlink_release+0xcb6/0x1dd0 net/netlink/af_netlink.c:788
__sock_release+0xcd/0x280 net/socket.c:649
sock_close+0x18/0x20 net/socket.c:1314
__fput+0x286/0x9f0 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
exit_to_user_mode_prepare+0x27e/0x290 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
The buggy address belongs to the object at ffff8880716e5b80
which belongs to the cache kmalloc-64 of size 64
The buggy address is located 0 bytes inside of
64-byte region [ffff8880716e5b80, ffff8880716e5bc0)
The buggy address belongs to the page:
page:ffffea0001c5b940 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880716e5c00 pfn:0x716e5
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffffea0000911848 ffffea00007c4d48 ffff888010c40200
raw: ffff8880716e5c00 ffff8880716e5000 000000010000001e 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x242040(__GFP_IO|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 3638, ts 211086074437, free_ts 211031029429
prep_new_page mm/page_alloc.c:2418 [inline]
get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4149
__alloc_pages+0x1b2/0x500 mm/page_alloc.c:5369
__alloc_pages_node include/linux/gfp.h:570 [inline]
kmem_getpages mm/slab.c:1377 [inline]
cache_grow_begin+0x75/0x470 mm/slab.c:2593
cache_alloc_refill+0x27f/0x380 mm/slab.c:2965
____cache_alloc mm/slab.c:3048 [inline]
____cache_alloc mm/slab.c:3031 [inline]
__do_cache_alloc mm/slab.c:3275 [inline]
slab_alloc mm/slab.c:3316 [inline]
__do_kmalloc mm/slab.c:3700 [inline]
__kmalloc+0x3b3/0x4d0 mm/slab.c:3711
kmalloc include/linux/slab.h:595 [inline]
kzalloc include/linux/slab.h:724 [inline]
tomoyo_get_name+0x234/0x480 security/tomoyo/memory.c:173
tomoyo_parse_name_union+0xbc/0x160 security/tomoyo/util.c:260
tomoyo_update_path_number_acl security/tomoyo/file.c:687 [inline]
tomoyo_write_file+0x629/0x7f0 security/tomoyo/file.c:1034
tomoyo_write_domain2+0x116/0x1d0 security/tomoyo/common.c:1152
tomoyo_add_entry security/tomoyo/common.c:2042 [inline]
tomoyo_supervisor+0xbc7/0xf00 security/tomoyo/common.c:2103
tomoyo_audit_path_number_log security/tomoyo/file.c:235 [inline]
tomoyo_path_number_perm+0x419/0x590 security/tomoyo/file.c:734
security_file_ioctl+0x50/0xb0 security/security.c:1541
__do_sys_ioctl fs/ioctl.c:868 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__x64_sys_ioctl+0xb3/0x200 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1338 [inline]
free_pcp_prepare+0x374/0x870 mm/page_alloc.c:1389
free_unref_page_prepare mm/page_alloc.c:3309 [inline]
free_unref_page+0x19/0x690 mm/page_alloc.c:3388
slab_destroy mm/slab.c:1627 [inline]
slabs_destroy+0x89/0xc0 mm/slab.c:1647
cache_flusharray mm/slab.c:3418 [inline]
___cache_free+0x4cc/0x610 mm/slab.c:3480
qlink_free mm/kasan/quarantine.c:146 [inline]
qlist_free_all+0x4e/0x110 mm/kasan/quarantine.c:165
kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:272
__kasan_slab_alloc+0x97/0xb0 mm/kasan/common.c:444
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook mm/slab.h:519 [inline]
slab_alloc_node mm/slab.c:3261 [inline]
kmem_cache_alloc_node+0x2ea/0x590 mm/slab.c:3599
__alloc_skb+0x215/0x340 net/core/skbuff.c:414
alloc_skb include/linux/skbuff.h:1126 [inline]
nlmsg_new include/net/netlink.h:953 [inline]
rtmsg_ifinfo_build_skb+0x72/0x1a0 net/core/rtnetlink.c:3808
rtmsg_ifinfo_event net/core/rtnetlink.c:3844 [inline]
rtmsg_ifinfo_event net/core/rtnetlink.c:3835 [inline]
rtmsg_ifinfo+0x83/0x120 net/core/rtnetlink.c:3853
netdev_state_change net/core/dev.c:1395 [inline]
netdev_state_change+0x114/0x130 net/core/dev.c:1386
linkwatch_do_dev+0x10e/0x150 net/core/link_watch.c:167
__linkwatch_run_queue+0x233/0x6a0 net/core/link_watch.c:213
linkwatch_event+0x4a/0x60 net/core/link_watch.c:252
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
Memory state around the buggy address:
ffff8880716e5a80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8880716e5b00: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
>ffff8880716e5b80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff8880716e5c00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8880716e5c80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index c0851fec11d4..c20772822637 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4481,9 +4481,9 @@ struct nft_set_elem_catchall {
static void nft_set_catchall_destroy(const struct nft_ctx *ctx,
struct nft_set *set)
{
- struct nft_set_elem_catchall *catchall;
+ struct nft_set_elem_catchall *next, *catchall;
- list_for_each_entry_rcu(catchall, &set->catchall_list, list) {
+ list_for_each_entry_safe(catchall, next, &set->catchall_list, list) {
list_del_rcu(&catchall->list);
nft_set_elem_destroy(set, catchall->elem, true);
kfree_rcu(catchall);
--
2.30.2
^ permalink raw reply related [flat|nested] 42+ messages in thread
* Re: [PATCH net 1/3] netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()
2021-12-17 8:53 ` [PATCH net 1/3] netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy() Pablo Neira Ayuso
@ 2021-12-17 11:00 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 42+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-12-17 11:00 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, kuba
Hello:
This series was applied to netdev/net.git (master)
by Pablo Neira Ayuso <pablo@netfilter.org>:
On Fri, 17 Dec 2021 09:53:01 +0100 you wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> We need to use list_for_each_entry_safe() iterator
> because we can not access @catchall after kfree_rcu() call.
>
> syzbot reported:
>
> [...]
Here is the summary with links:
- [net,1/3] netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()
https://git.kernel.org/netdev/net/c/0f7d9b31ce7a
- [net,2/3] netfilter: fix regression in looped (broad|multi)cast's MAC handling
https://git.kernel.org/netdev/net/c/ebb966d3bdfe
- [net,3/3] netfilter: ctnetlink: remove expired entries first
https://git.kernel.org/netdev/net/c/76f12e632a15
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 2/3] netfilter: fix regression in looped (broad|multi)cast's MAC handling
2021-12-17 8:53 [PATCH net 0/3] Netfilter fixes for net Pablo Neira Ayuso
2021-12-17 8:53 ` [PATCH net 1/3] netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy() Pablo Neira Ayuso
@ 2021-12-17 8:53 ` Pablo Neira Ayuso
2021-12-17 8:53 ` [PATCH net 3/3] netfilter: ctnetlink: remove expired entries first Pablo Neira Ayuso
2 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2021-12-17 8:53 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
From: Ignacy Gawędzki <ignacy.gawedzki@green-communications.fr>
In commit 5648b5e1169f ("netfilter: nfnetlink_queue: fix OOB when mac
header was cleared"), the test for non-empty MAC header introduced in
commit 2c38de4c1f8da7 ("netfilter: fix looped (broad|multi)cast's MAC
handling") has been replaced with a test for a set MAC header.
This breaks the case when the MAC header has been reset (using
skb_reset_mac_header), as is the case with looped-back multicast
packets. As a result, the packets ending up in NFQUEUE get a bogus
hwaddr interpreted from the first bytes of the IP header.
This patch adds a test for a non-empty MAC header in addition to the
test for a set MAC header. The same two tests are also implemented in
nfnetlink_log.c, where the initial code of commit 2c38de4c1f8da7
("netfilter: fix looped (broad|multi)cast's MAC handling") has not been
touched, but where supposedly the same situation may happen.
Fixes: 5648b5e1169f ("netfilter: nfnetlink_queue: fix OOB when mac header was cleared")
Signed-off-by: Ignacy Gawędzki <ignacy.gawedzki@green-communications.fr>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nfnetlink_log.c | 3 ++-
net/netfilter/nfnetlink_queue.c | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 691ef4cffdd9..7f83f9697fc1 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -556,7 +556,8 @@ __build_packet_message(struct nfnl_log_net *log,
goto nla_put_failure;
if (indev && skb->dev &&
- skb->mac_header != skb->network_header) {
+ skb_mac_header_was_set(skb) &&
+ skb_mac_header_len(skb) != 0) {
struct nfulnl_msg_packet_hw phw;
int len;
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 5837e8efc9c2..f0b9e21a2452 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -560,7 +560,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
goto nla_put_failure;
if (indev && entskb->dev &&
- skb_mac_header_was_set(entskb)) {
+ skb_mac_header_was_set(entskb) &&
+ skb_mac_header_len(entskb) != 0) {
struct nfqnl_msg_packet_hw phw;
int len;
--
2.30.2
^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net 3/3] netfilter: ctnetlink: remove expired entries first
2021-12-17 8:53 [PATCH net 0/3] Netfilter fixes for net Pablo Neira Ayuso
2021-12-17 8:53 ` [PATCH net 1/3] netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy() Pablo Neira Ayuso
2021-12-17 8:53 ` [PATCH net 2/3] netfilter: fix regression in looped (broad|multi)cast's MAC handling Pablo Neira Ayuso
@ 2021-12-17 8:53 ` Pablo Neira Ayuso
2 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2021-12-17 8:53 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
From: Florian Westphal <fw@strlen.de>
When dumping conntrack table to userspace via ctnetlink, check if the ct has
already expired before doing any of the 'skip' checks.
This expires dead entries faster.
/proc handler also removes outdated entries first.
Reported-by: Vitaly Zuevsky <vzuevsky@ns1.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_netlink.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 81d03acf68d4..ec4164c32d27 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1195,8 +1195,6 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
}
hlist_nulls_for_each_entry(h, n, &nf_conntrack_hash[cb->args[0]],
hnnode) {
- if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
- continue;
ct = nf_ct_tuplehash_to_ctrack(h);
if (nf_ct_is_expired(ct)) {
if (i < ARRAY_SIZE(nf_ct_evict) &&
@@ -1208,6 +1206,9 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
if (!net_eq(net, nf_ct_net(ct)))
continue;
+ if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
+ continue;
+
if (cb->args[1]) {
if (ct != last)
continue;
--
2.30.2
^ permalink raw reply related [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2024-04-18 1:09 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2024-04-18 1:09 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
Patch #1 amends a missing spot where the set iterator type is unset.
This is fixing a issue in the previous pull request.
Patch #2 fixes the delete set command abort path by restoring state
of the elements. Reverse logic for the activate (abort) case
otherwise element state is not restored, this requires to move
the check for active/inactive elements to the set iterator
callback. From the deactivate path, toggle the next generation
bit and from the activate (abort) path, clear the next generation
bitmask.
Patch #3 skips elements already restored by delete set command from the
abort path in case there is a previous delete element command in
the batch. Check for the next generation bit just like it is done
via set iteration to restore maps.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-04-18
Thanks.
----------------------------------------------------------------
The following changes since commit 75ce9506ee3dc66648a7d74ab3b0acfa364d6d43:
octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation (2024-04-15 10:45:03 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-04-18
for you to fetch changes up to 86a1471d7cde792941109b93b558b5dc078b9ee9:
netfilter: nf_tables: fix memleak in map from abort path (2024-04-18 02:41:32 +0200)
----------------------------------------------------------------
netfilter pull request 24-04-18
----------------------------------------------------------------
Pablo Neira Ayuso (3):
netfilter: nf_tables: missing iterator type in lookup walk
netfilter: nf_tables: restore set elements when delete set fails
netfilter: nf_tables: fix memleak in map from abort path
net/netfilter/nf_tables_api.c | 60 +++++++++++++++++++++++++++++++++++++-----
net/netfilter/nft_lookup.c | 1 +
net/netfilter/nft_set_bitmap.c | 4 +--
net/netfilter/nft_set_hash.c | 8 ++----
net/netfilter/nft_set_pipapo.c | 8 +++---
net/netfilter/nft_set_rbtree.c | 4 +--
6 files changed, 62 insertions(+), 23 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2024-03-21 0:06 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2024-03-21 0:06 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net. There is a
larger batch of fixes still pending that will follow up asap, this is
what I deemed to be more urgent at this time:
1) Use clone view in pipapo set backend to release elements from destroy
path, otherwise it is possible to destroy elements twice.
2) Incorrect check for internal table flags lead to bogus transaction
objects.
3) Fix counters memleak in netdev basechain update error path,
from Quan Tian.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-03-21
Thanks.
----------------------------------------------------------------
The following changes since commit 9c6a59543a3965071d65b0f9ea43aa396ce2ed14:
Merge branch 'octeontx2-pf-mbox-fixes' (2024-03-20 10:49:08 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-03-21
for you to fetch changes up to 1c2e3b462542241d2e6f4d32f8356608ff51f487:
netfilter: nf_tables: Fix a memory leak in nf_tables_updchain (2024-03-21 00:46:03 +0100)
----------------------------------------------------------------
netfilter pull request 24-03-21
----------------------------------------------------------------
Pablo Neira Ayuso (2):
netfilter: nft_set_pipapo: release elements in clone only from destroy path
netfilter: nf_tables: do not compare internal table flags on updates
Quan Tian (1):
netfilter: nf_tables: Fix a memory leak in nf_tables_updchain
net/netfilter/nf_tables_api.c | 29 +++++++++++++++--------------
net/netfilter/nft_set_pipapo.c | 5 +----
2 files changed, 16 insertions(+), 18 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2024-02-29 0:01 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2024-02-29 0:01 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, fw
Hi,
The following patchset contains Netfilter fixes for net:
Patch #1 restores NFPROTO_INET with nft_compat, from Ignat Korchagin.
Patch #2 fixes an issue with bridge netfilter and broadcast/multicast
packets.
There is a day 0 bug in br_netfilter when used with connection tracking.
Conntrack assumes that an nf_conn structure that is not yet added to
hash table ("unconfirmed"), is only visible by the current cpu that is
processing the sk_buff.
For bridge this isn't true, sk_buff can get cloned in between, and
clones can be processed in parallel on different cpu.
This patch disables NAT and conntrack helpers for multicast packets.
Patch #3 adds a selftest to cover for the br_netfilter bug.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-02-29
Thanks.
----------------------------------------------------------------
The following changes since commit 359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79:
l2tp: pass correct message length to ip6_append_data (2024-02-22 10:42:17 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-02-29
for you to fetch changes up to 6523cf516c55db164f8f73306027b1caebb5628e:
selftests: netfilter: add bridge conntrack + multicast test case (2024-02-29 00:22:48 +0100)
----------------------------------------------------------------
netfilter pull request 24-02-29
----------------------------------------------------------------
Florian Westphal (2):
netfilter: bridge: confirm multicast packets before passing them up the stack
selftests: netfilter: add bridge conntrack + multicast test case
Ignat Korchagin (1):
netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
include/linux/netfilter.h | 1 +
net/bridge/br_netfilter_hooks.c | 96 +++++++++++
net/bridge/netfilter/nf_conntrack_bridge.c | 30 ++++
net/netfilter/nf_conntrack_core.c | 1 +
net/netfilter/nft_compat.c | 20 +++
tools/testing/selftests/netfilter/Makefile | 3 +-
.../selftests/netfilter/bridge_netfilter.sh | 188 +++++++++++++++++++++
7 files changed, 338 insertions(+), 1 deletion(-)
create mode 100644 tools/testing/selftests/netfilter/bridge_netfilter.sh
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2024-02-14 23:38 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2024-02-14 23:38 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, fw
Hi,
The following batch contains Netfilter fixes for net:
1) Missing : in kdoc field in nft_set_pipapo.
2) Restore default DNAT behavior When a DNAT rule is configured via
iptables with different port ranges, from Kyle Swenson.
3) Restore flowtable hardware offload for bidirectional flows
by setting NF_FLOW_HW_BIDIRECTIONAL flag, from Felix Fietkau.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-02-15
Thanks.
----------------------------------------------------------------
The following changes since commit 9b23fceb4158a3636ce4a2bda28ab03dcfa6a26f:
ethernet: cpts: fix function pointer cast warnings (2024-02-14 12:50:53 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-02-15
for you to fetch changes up to 84443741faab9045d53f022a9ac6a6633067a481:
netfilter: nf_tables: fix bidirectional offload regression (2024-02-15 00:20:00 +0100)
----------------------------------------------------------------
netfilter pull request 24-02-15
----------------------------------------------------------------
Felix Fietkau (1):
netfilter: nf_tables: fix bidirectional offload regression
Kyle Swenson (1):
netfilter: nat: restore default DNAT behavior
Pablo Neira Ayuso (1):
netfilter: nft_set_pipapo: fix missing : in kdoc
net/netfilter/nf_nat_core.c | 5 ++++-
net/netfilter/nft_flow_offload.c | 1 +
net/netfilter/nft_set_pipapo.h | 4 ++--
3 files changed, 7 insertions(+), 3 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] netfilter fixes for net
@ 2023-07-26 15:23 Florian Westphal
0 siblings, 0 replies; 42+ messages in thread
From: Florian Westphal @ 2023-07-26 15:23 UTC (permalink / raw)
To: netdev
Cc: Paolo Abeni, David S. Miller, Eric Dumazet, Jakub Kicinski,
netfilter-devel
Hello,
Here are three netfilter fixes for the *net* tree:
1. On-demand overlap detection in 'rbtree' set can cause memory leaks.
This is broken since 6.2.
2. An earlier fix in 6.4 to address an imbalance in refcounts during
transaction error unwinding was incomplete, from Pablo Neira.
3. Disallow adding a rule to a deleted chain, also from Pablo.
Broken since 5.9.
The following changes since commit d4a7ce642100765119a872d4aba1bf63e3a22c8a:
igc: Fix Kernel Panic during ndo_tx_timeout callback (2023-07-26 09:54:40 +0100)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-07-26
for you to fetch changes up to 0ebc1064e4874d5987722a2ddbc18f94aa53b211:
netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (2023-07-26 16:48:49 +0200)
----------------------------------------------------------------
netfilter pull request 2023-07-26
----------------------------------------------------------------
Florian Westphal (1):
netfilter: nft_set_rbtree: fix overlap expiration walk
Pablo Neira Ayuso (2):
netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
net/netfilter/nf_tables_api.c | 5 +++--
net/netfilter/nft_immediate.c | 27 ++++++++++++++++++---------
net/netfilter/nft_set_rbtree.c | 20 ++++++++++++++------
3 files changed, 35 insertions(+), 17 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2023-06-08 19:57 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2023-06-08 19:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Add commit and abort set operation to pipapo set abort path.
2) Bail out immediately in case of ENOMEM in nfnetlink batch.
3) Incorrect error path handling when creating a new rule leads to
dangling pointer in set transaction list.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-06-08
Thanks.
----------------------------------------------------------------
The following changes since commit ab39b113e74751958aac1b125a14ee42bd7d3efd:
Merge tag 'for-net-2023-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth (2023-06-06 21:36:57 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-06-08
for you to fetch changes up to 1240eb93f0616b21c675416516ff3d74798fdc97:
netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (2023-06-08 21:49:26 +0200)
----------------------------------------------------------------
netfilter pull request 23-06-08
----------------------------------------------------------------
Pablo Neira Ayuso (3):
netfilter: nf_tables: integrate pipapo into commit protocol
netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM
netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
include/net/netfilter/nf_tables.h | 4 ++-
net/netfilter/nf_tables_api.c | 59 ++++++++++++++++++++++++++++++++++++++-
net/netfilter/nfnetlink.c | 3 +-
net/netfilter/nft_set_pipapo.c | 55 ++++++++++++++++++++++++++----------
4 files changed, 103 insertions(+), 18 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2023-05-17 12:37 Florian Westphal
0 siblings, 0 replies; 42+ messages in thread
From: Florian Westphal @ 2023-05-17 12:37 UTC (permalink / raw)
To: netdev
Cc: Paolo Abeni, David S. Miller, Eric Dumazet, Jakub Kicinski,
netfilter-devel
Hi,
This PR has three patches for your *net* tree:
1. Silence warning about unused variable when CONFIG_NF_NAT=n, from Tom Rix.
2. nftables: Fix possible out-of-bounds access, from myself.
3. nftables: fix null deref+UAF during element insertion into rbtree,
also from myself.
The following changes since commit ab87603b251134441a67385ecc9d3371be17b7a7:
net: wwan: t7xx: Ensure init is completed before system sleep (2023-05-17 13:02:25 +0100)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-05-17
for you to fetch changes up to 61ae320a29b0540c16931816299eb86bf2b66c08:
netfilter: nft_set_rbtree: fix null deref on element insertion (2023-05-17 14:18:28 +0200)
----------------------------------------------------------------
Florian Westphal (2):
netfilter: nf_tables: fix nft_trans type confusion
netfilter: nft_set_rbtree: fix null deref on element insertion
Tom Rix (1):
netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT
net/netfilter/nf_conntrack_netlink.c | 4 ++++
net/netfilter/nf_tables_api.c | 4 +---
net/netfilter/nft_set_rbtree.c | 20 +++++++++++++-------
--
2.39.3
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2023-05-03 6:32 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2023-05-03 6:32 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Hit ENOENT when trying to update an unexisting base chain.
2) Fix libmnl pkg-config usage in selftests, from Jeremy Sowden.
3) KASAN reports use-after-free when deleting a set element for an
anonymous set that was already removed in the same transaction,
reported by P. Sondej and P. Krysiuk.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit c6d96df9fa2c1d19525239d4262889cce594ce6c:
net: ethernet: mtk_eth_soc: drop generic vlan rx offload, only use DSA untagging (2023-05-02 20:19:52 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-05-03
for you to fetch changes up to c1592a89942e9678f7d9c8030efa777c0d57edab:
netfilter: nf_tables: deactivate anonymous set from preparation phase (2023-05-03 08:24:32 +0200)
----------------------------------------------------------------
netfilter pull request 23-05-03
----------------------------------------------------------------
Jeremy Sowden (1):
selftests: netfilter: fix libmnl pkg-config usage
Pablo Neira Ayuso (2):
netfilter: nf_tables: hit ENOENT on unexisting chain/flowtable update with missing attributes
netfilter: nf_tables: deactivate anonymous set from preparation phase
include/net/netfilter/nf_tables.h | 1 +
net/netfilter/nf_tables_api.c | 41 +++++++++++++++++++++---------
net/netfilter/nft_dynset.c | 2 +-
net/netfilter/nft_lookup.c | 2 +-
net/netfilter/nft_objref.c | 2 +-
tools/testing/selftests/netfilter/Makefile | 7 +++--
6 files changed, 38 insertions(+), 17 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2023-03-07 10:04 Pablo Neira Ayuso
2023-03-07 12:57 ` Paolo Abeni
0 siblings, 1 reply; 42+ messages in thread
From: Pablo Neira Ayuso @ 2023-03-07 10:04 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Restore ctnetlink zero mark in events and dump, from Ivan Delalande.
2) Fix deadlock due to missing disabled bh in tproxy, from Florian Westphal.
3) Safer maximum chain load in conntrack, from Eric Dumazet.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 528125268588a18a2f257002af051b62b14bb282:
Merge branch 'nfp-ipsec-csum' (2023-03-03 08:28:44 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to c77737b736ceb50fdf150434347dbd81ec76dbb1:
netfilter: conntrack: adopt safer max chain length (2023-03-07 10:58:06 +0100)
----------------------------------------------------------------
Eric Dumazet (1):
netfilter: conntrack: adopt safer max chain length
Florian Westphal (1):
netfilter: tproxy: fix deadlock due to missing BH disable
Ivan Delalande (1):
netfilter: ctnetlink: revert to dumping mark regardless of event type
include/net/netfilter/nf_tproxy.h | 7 +++++++
net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 +-
net/ipv6/netfilter/nf_tproxy_ipv6.c | 2 +-
net/netfilter/nf_conntrack_core.c | 4 ++--
net/netfilter/nf_conntrack_netlink.c | 14 +++++++-------
5 files changed, 18 insertions(+), 11 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2023-03-07 10:04 Pablo Neira Ayuso
@ 2023-03-07 12:57 ` Paolo Abeni
2023-03-07 17:26 ` Jakub Kicinski
0 siblings, 1 reply; 42+ messages in thread
From: Paolo Abeni @ 2023-03-07 12:57 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel; +Cc: davem, netdev, kuba, edumazet
On Tue, 2023-03-07 at 11:04 +0100, Pablo Neira Ayuso wrote:
> Hi,
>
> The following patchset contains Netfilter fixes for net:
>
> 1) Restore ctnetlink zero mark in events and dump, from Ivan Delalande.
>
> 2) Fix deadlock due to missing disabled bh in tproxy, from Florian Westphal.
>
> 3) Safer maximum chain load in conntrack, from Eric Dumazet.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
>
> Thanks.
>
> ----------------------------------------------------------------
>
> The following changes since commit 528125268588a18a2f257002af051b62b14bb282:
>
> Merge branch 'nfp-ipsec-csum' (2023-03-03 08:28:44 +0000)
>
> are available in the Git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
It's not clear to me the root cause, but pulling from the above ref.
yields nothing. I have to replace 'HEAD' with main to get the expected
patches.
Cheers,
Paolo
^ permalink raw reply [flat|nested] 42+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2023-03-07 12:57 ` Paolo Abeni
@ 2023-03-07 17:26 ` Jakub Kicinski
2023-03-08 9:34 ` Pablo Neira Ayuso
0 siblings, 1 reply; 42+ messages in thread
From: Jakub Kicinski @ 2023-03-07 17:26 UTC (permalink / raw)
To: Paolo Abeni, Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, edumazet
On Tue, 07 Mar 2023 13:57:07 +0100 Paolo Abeni wrote:
> On Tue, 2023-03-07 at 11:04 +0100, Pablo Neira Ayuso wrote:
> > The following changes since commit 528125268588a18a2f257002af051b62b14bb282:
> >
> > Merge branch 'nfp-ipsec-csum' (2023-03-03 08:28:44 +0000)
> >
> > are available in the Git repository at:
> >
> > git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
>
> It's not clear to me the root cause, but pulling from the above ref.
> yields nothing. I have to replace 'HEAD' with main to get the expected
> patches.
Possibly netfilter folks did not update HEAD to point to main?
ssh git@gitolite.kernel.org symbolic-ref \
pub/scm/linux/kernel/git/netfilter/nf \
HEAD refs/heads/main
^ permalink raw reply [flat|nested] 42+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2023-03-07 17:26 ` Jakub Kicinski
@ 2023-03-08 9:34 ` Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2023-03-08 9:34 UTC (permalink / raw)
To: Jakub Kicinski; +Cc: Paolo Abeni, netfilter-devel, davem, netdev, edumazet
On Tue, Mar 07, 2023 at 09:26:04AM -0800, Jakub Kicinski wrote:
> On Tue, 07 Mar 2023 13:57:07 +0100 Paolo Abeni wrote:
> > On Tue, 2023-03-07 at 11:04 +0100, Pablo Neira Ayuso wrote:
> > > The following changes since commit 528125268588a18a2f257002af051b62b14bb282:
> > >
> > > Merge branch 'nfp-ipsec-csum' (2023-03-03 08:28:44 +0000)
> > >
> > > are available in the Git repository at:
> > >
> > > git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
> >
> > It's not clear to me the root cause, but pulling from the above ref.
> > yields nothing. I have to replace 'HEAD' with main to get the expected
> > patches.
>
> Possibly netfilter folks did not update HEAD to point to main?
>
> ssh git@gitolite.kernel.org symbolic-ref \
> pub/scm/linux/kernel/git/netfilter/nf \
> HEAD refs/heads/main
Fixed, thanks.
I will also review my pull request scripts to check if someone got
unadjusted after the switch to the main branch.
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2023-03-01 22:20 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2023-03-01 22:20 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix bogus error report in selftests/netfilter/nft_nat.sh,
from Hangbin Liu.
2) Initialize last and quota expressions from template when
expr_ops::clone is called, otherwise, states are not restored
accordingly when loading a dynamic set with elements using
these two expressions.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 8f9850dd8d23c1290cb642ce9548a440da5771ec:
net: phy: unlock on error in phy_probe() (2023-02-28 12:40:12 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to aabef97a35160461e9c576848ded737558d89055:
netfilter: nft_quota: copy content when cloning expression (2023-03-01 17:23:23 +0100)
----------------------------------------------------------------
Hangbin Liu (1):
selftests: nft_nat: ensuring the listening side is up before starting the client
Pablo Neira Ayuso (2):
netfilter: nft_last: copy content when cloning expression
netfilter: nft_quota: copy content when cloning expression
net/netfilter/nft_last.c | 4 ++++
net/netfilter/nft_quota.c | 6 +++++-
tools/testing/selftests/netfilter/nft_nat.sh | 2 ++
3 files changed, 11 insertions(+), 1 deletion(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2023-01-13 16:41 Pablo Neira Ayuso
2023-01-18 3:03 ` Jakub Kicinski
0 siblings, 1 reply; 42+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-13 16:41 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
[ Resend Cc'ing netdev, previous PR did not CC netdev accidentally. ]
Hi,
The following patchset contains Netfilter fixes for net:
1) Increase timeout to 120 seconds for netfilter selftests to fix
nftables transaction tests, from Florian Westphal.
2) Fix overflow in bitmap_ip_create() due to integer arithmetics
in a 64-bit bitmask, from Gavrilov Ilia.
3) Fix incorrect arithmetics in nft_payload with double-tagged
vlan matching.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 8fed75653a670a4d3be0ab9949aed5e2968a03ef:
Merge tag 'mlx5-fixes-2023-01-09' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux (2023-01-11 12:55:09 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 696e1a48b1a1b01edad542a1ef293665864a4dd0:
netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits (2023-01-11 19:18:04 +0100)
----------------------------------------------------------------
Florian Westphal (1):
selftests: netfilter: fix transaction test script timeout handling
Gavrilov Ilia (1):
netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
Pablo Neira Ayuso (1):
netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
net/netfilter/ipset/ip_set_bitmap_ip.c | 4 ++--
net/netfilter/nft_payload.c | 2 +-
tools/testing/selftests/netfilter/nft_trans_stress.sh | 16 +++++++++-------
tools/testing/selftests/netfilter/settings | 1 +
4 files changed, 13 insertions(+), 10 deletions(-)
create mode 100644 tools/testing/selftests/netfilter/settings
^ permalink raw reply [flat|nested] 42+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2023-01-13 16:41 Pablo Neira Ayuso
@ 2023-01-18 3:03 ` Jakub Kicinski
0 siblings, 0 replies; 42+ messages in thread
From: Jakub Kicinski @ 2023-01-18 3:03 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, pabeni, edumazet
On Fri, 13 Jan 2023 17:41:03 +0100 Pablo Neira Ayuso wrote:
> 1) Increase timeout to 120 seconds for netfilter selftests to fix
> nftables transaction tests, from Florian Westphal.
>
> 2) Fix overflow in bitmap_ip_create() due to integer arithmetics
> in a 64-bit bitmask, from Gavrilov Ilia.
>
> 3) Fix incorrect arithmetics in nft_payload with double-tagged
> vlan matching.
FWIW pulled yesterday, thanks!
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2023-01-11 21:22 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2023-01-11 21:22 UTC (permalink / raw)
To: netfilter-devel
Hi,
The following patchset contains Netfilter fixes for net:
1) Increase timeout to 120 seconds for netfilter selftests to fix
nftables transaction tests, from Florian Westphal.
2) Fix overflow in bitmap_ip_create() due to integer arithmetics
in a 64-bit bitmask, from Gavrilov Ilia.
3) Fix incorrect arithmetics in nft_payload with double-tagged
vlan matching.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 8fed75653a670a4d3be0ab9949aed5e2968a03ef:
Merge tag 'mlx5-fixes-2023-01-09' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux (2023-01-11 12:55:09 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 696e1a48b1a1b01edad542a1ef293665864a4dd0:
netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits (2023-01-11 19:18:04 +0100)
----------------------------------------------------------------
Florian Westphal (1):
selftests: netfilter: fix transaction test script timeout handling
Gavrilov Ilia (1):
netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
Pablo Neira Ayuso (1):
netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
net/netfilter/ipset/ip_set_bitmap_ip.c | 4 ++--
net/netfilter/nft_payload.c | 2 +-
tools/testing/selftests/netfilter/nft_trans_stress.sh | 16 +++++++++-------
tools/testing/selftests/netfilter/settings | 1 +
4 files changed, 13 insertions(+), 10 deletions(-)
create mode 100644 tools/testing/selftests/netfilter/settings
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-11-22 21:28 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2022-11-22 21:28 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patch contains another round of Netfilter fixes for net:
1) Fix regression in ipset hash:ip with IPv4 range, from Vishwanath Pai.
This is fixing up a bug introduced in the 6.0 release.
2) The "netfilter: ipset: enforce documented limit to prevent allocating
huge memory" patch contained a wrong condition which makes impossible to
add up to 64 clashing elements to a hash:net,iface type of set while it
is the documented feature of the set type. The patch fixes the condition
and thus makes possible to add the elements while keeps preventing
allocating huge memory, from Jozsef Kadlecsik. This has been broken
for several releases.
3) Missing locking when updating the flow block list which might lead
a reader to crash. This has been broken since the introduction of the
flowtable hardware offload support.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit badbda1a01860c80c6ab60f329ef46c713653a27:
octeontx2-af: cn10k: mcs: Fix copy and paste bug in mcs_bbe_intr_handler() (2022-11-21 13:04:28 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to bcd9e3c1656d0f7dd9743598c65c3ae24efb38d0:
netfilter: flowtable_offload: add missing locking (2022-11-22 22:17:12 +0100)
----------------------------------------------------------------
Felix Fietkau (1):
netfilter: flowtable_offload: add missing locking
Jozsef Kadlecsik (1):
netfilter: ipset: restore allowing 64 clashing elements in hash:net,iface
Vishwanath Pai (1):
netfilter: ipset: regression in ip_set_hash_ip.c
net/netfilter/ipset/ip_set_hash_gen.h | 2 +-
net/netfilter/ipset/ip_set_hash_ip.c | 8 +++-----
net/netfilter/nf_flow_table_offload.c | 4 ++++
3 files changed, 8 insertions(+), 6 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-11-09 11:28 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2022-11-09 11:28 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix deadlock in nfnetlink due to missing mutex release in error path,
from Ziyang Xuan.
2) Clean up pending autoload module list from nf_tables_exit_net() path,
from Shigeru Yoshida.
3) Fixes for the netfilter's reverse path selftest, from Phil Sutter.
All of these bugs have been around for several releases.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit ce9e57feeed81d17d5e80ed86f516ff0d39c3867:
drivers: net: xgene: disable napi when register irq failed in xgene_enet_open() (2022-11-08 15:15:55 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 58bb78ce02269c0cf5b1f2bd2e4a605500b44c6b:
selftests: netfilter: Fix and review rpath.sh (2022-11-09 10:29:57 +0100)
----------------------------------------------------------------
Phil Sutter (1):
selftests: netfilter: Fix and review rpath.sh
Shigeru Yoshida (1):
netfilter: Cleanup nft_net->module_list from nf_tables_exit_net()
Ziyang Xuan (1):
netfilter: nfnetlink: fix potential dead lock in nfnetlink_rcv_msg()
net/netfilter/nf_tables_api.c | 3 ++-
net/netfilter/nfnetlink.c | 1 +
tools/testing/selftests/netfilter/rpath.sh | 14 ++++++++------
3 files changed, 11 insertions(+), 7 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] netfilter fixes for net
@ 2022-10-12 12:18 Florian Westphal
0 siblings, 0 replies; 42+ messages in thread
From: Florian Westphal @ 2022-10-12 12:18 UTC (permalink / raw)
To: netdev
Cc: Paolo Abeni, Eric Dumazet, David S. Miller, Jakub Kicinski,
netfilter-devel, Florian Westphal
Hello,
This series from Phil Sutter for the *net* tree fixes a problem with a change
from the 6.1 development phase: the change to nft_fib should have used
the more recent flowic_l3mdev field. Pointed out by Guillaume Nault.
This also makes the older iptables module follow the same pattern.
Also add selftest case and avoid test failure in nft_fib.sh when the
host environment has set rp_filter=1.
Please consider pulling this from
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git master
----------------------------------------------------------------
The following changes since commit 739cfa34518ef3a6789f5f77239073972a387359:
net/mlx5: Make ASO poll CQ usable in atomic context (2022-10-12 09:16:05 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git master
for you to fetch changes up to 6a91e7270936c5a504af7e0a197d7021e169d281:
selftests: netfilter: Fix nft_fib.sh for all.rp_filter=1 (2022-10-12 14:08:15 +0200)
----------------------------------------------------------------
Phil Sutter (3):
selftests: netfilter: Test reverse path filtering
netfilter: rpfilter/fib: Populate flowic_l3mdev field
selftests: netfilter: Fix nft_fib.sh for all.rp_filter=1
net/ipv4/netfilter/ipt_rpfilter.c | 2 +-
net/ipv4/netfilter/nft_fib_ipv4.c | 2 +-
net/ipv6/netfilter/ip6t_rpfilter.c | 9 +-
net/ipv6/netfilter/nft_fib_ipv6.c | 5 +-
tools/testing/selftests/netfilter/Makefile | 2 +-
tools/testing/selftests/netfilter/nft_fib.sh | 1 +
tools/testing/selftests/netfilter/rpath.sh | 147 +++++++++++++++++++++++++++
7 files changed, 156 insertions(+), 12 deletions(-)
create mode 100755 tools/testing/selftests/netfilter/rpath.sh
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-07-11 9:33 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2022-07-11 9:33 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) refcount_inc_not_zero() is not semantically equivalent to
atomic_int_not_zero(), from Florian Westphal. My understanding was
that refcount_*() API provides a wrapper to easier debugging of
reference count leaks, however, there are semantic differences
between these two APIs, where refcount_inc_not_zero() needs a barrier.
Reason for this subtle difference to me is unknown.
2) packet logging is not correct for ARP and IP packets, from the
ARP family and netdev/egress respectively. Use skb_network_offset()
to reach the headers accordingly.
3) set element extension length have been growing over time, replace
a BUG_ON by EINVAL which might be triggerable from userspace.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 280e3a857d96f9ca8e24632788e1e7a0fec4e9f7:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf (2022-07-03 12:29:18 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to c39ba4de6b0a843bec5d46c2b6f2064428dada5e:
netfilter: nf_tables: replace BUG_ON by element length check (2022-07-09 16:25:09 +0200)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: conntrack: fix crash due to confirmed bit load reordering
Pablo Neira Ayuso (2):
netfilter: nf_log: incorrect offset to network header
netfilter: nf_tables: replace BUG_ON by element length check
include/net/netfilter/nf_tables.h | 14 ++++---
net/netfilter/nf_conntrack_core.c | 22 ++++++++++
net/netfilter/nf_conntrack_netlink.c | 1 +
net/netfilter/nf_conntrack_standalone.c | 3 ++
net/netfilter/nf_log_syslog.c | 8 ++--
net/netfilter/nf_tables_api.c | 72 +++++++++++++++++++++++----------
6 files changed, 90 insertions(+), 30 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-06-29 17:13 Pablo Neira Ayuso
2022-06-30 3:20 ` patchwork-bot+netdevbpf
0 siblings, 1 reply; 42+ messages in thread
From: Pablo Neira Ayuso @ 2022-06-29 17:13 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet
Hi,
The following patchset contains Netfilter fixes for net:
1) Restore set counter when one of the CPU loses race to add elements
to sets.
2) After NF_STOLEN, skb might be there no more, update nftables trace
infra to avoid access to skb in this case. From Florian Westphal.
3) nftables bridge might register a prerouting hook with zero priority,
br_netfilter incorrectly skips it. Also from Florian.
Florian Westphal (2):
netfilter: nf_tables: avoid skb access on nf_stolen
netfilter: br_netfilter: do not skip all hooks with 0 priority
Pablo Neira Ayuso (1):
netfilter: nft_dynset: restore set element counter when failing to update
include/net/netfilter/nf_tables.h | 16 ++++++-----
net/bridge/br_netfilter_hooks.c | 21 ++++++++++++---
net/netfilter/nf_tables_core.c | 24 ++++++++++++++---
net/netfilter/nf_tables_trace.c | 44 +++++++++++++++++--------------
net/netfilter/nft_set_hash.c | 2 ++
5 files changed, 75 insertions(+), 32 deletions(-)
--
2.30.2
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit cb8092d70a6f5f01ec1490fce4d35efed3ed996c:
tipc: move bc link creation back to tipc_node_create (2022-06-27 11:51:56 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to c2577862eeb0be94f151f2f1fff662b028061b00:
netfilter: br_netfilter: do not skip all hooks with 0 priority (2022-06-27 19:23:27 +0200)
----------------------------------------------------------------
Florian Westphal (2):
netfilter: nf_tables: avoid skb access on nf_stolen
netfilter: br_netfilter: do not skip all hooks with 0 priority
Pablo Neira Ayuso (1):
netfilter: nft_dynset: restore set element counter when failing to update
include/net/netfilter/nf_tables.h | 16 ++++++++------
net/bridge/br_netfilter_hooks.c | 21 ++++++++++++++++---
net/netfilter/nf_tables_core.c | 24 ++++++++++++++++++---
net/netfilter/nf_tables_trace.c | 44 +++++++++++++++++++++------------------
net/netfilter/nft_set_hash.c | 2 ++
5 files changed, 75 insertions(+), 32 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2022-06-29 17:13 Pablo Neira Ayuso
@ 2022-06-30 3:20 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 42+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-06-30 3:20 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev, kuba, pabeni, edumazet
Hello:
This series was applied to netdev/net.git (master)
by Pablo Neira Ayuso <pablo@netfilter.org>:
On Wed, 29 Jun 2022 19:13:51 +0200 you wrote:
> Hi,
>
> The following patchset contains Netfilter fixes for net:
>
> 1) Restore set counter when one of the CPU loses race to add elements
> to sets.
>
> [...]
Here is the summary with links:
- [net,1/3] netfilter: nft_dynset: restore set element counter when failing to update
https://git.kernel.org/netdev/net/c/05907f10e235
- [net,2/3] netfilter: nf_tables: avoid skb access on nf_stolen
https://git.kernel.org/netdev/net/c/e34b9ed96ce3
- [net,3/3] netfilter: br_netfilter: do not skip all hooks with 0 priority
https://git.kernel.org/netdev/net/c/c2577862eeb0
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-04-28 14:21 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2022-04-28 14:21 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
This patchset contains Netfilter fixes for net:
1) Fix incorrect TCP connection tracking window reset for non-syn
packets, from Florian Westphal.
2) Incorrect dependency on CONFIG_NFT_FLOW_OFFLOAD, from Volodymyr Mytnyk.
3) Fix nft_socket from the output path, from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit a1bde8c92d27d178a988bfd13d229c170b8135aa:
Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net -queue (2022-04-27 10:58:39 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 743b83f15d4069ea57c3e40996bf4a1077e0cdc1:
netfilter: nft_socket: only do sk lookups when indev is available (2022-04-28 16:15:23 +0200)
----------------------------------------------------------------
Florian Westphal (2):
netfilter: nf_conntrack_tcp: re-init for syn packets only
netfilter: nft_socket: only do sk lookups when indev is available
Volodymyr Mytnyk (1):
netfilter: conntrack: fix udp offload timeout sysctl
net/netfilter/nf_conntrack_proto_tcp.c | 21 ++++---------
net/netfilter/nf_conntrack_standalone.c | 2 +-
net/netfilter/nft_socket.c | 52 ++++++++++++++++++++++++---------
3 files changed, 45 insertions(+), 30 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-03-28 8:20 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2022-03-28 8:20 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Incorrect output device in nf_egress hook, from Phill Sutter.
2) Preserve liberal flag in TCP conntrack state, reported by Sven Auhagen.
3) Use GFP_KERNEL_ACCOUNT flag for nf_tables objects, from Vasily Averin.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit f92fcb5c00dc924a4661d5bf68de7937040f26b8:
Merge branch 'ice-avoid-sleeping-scheduling-in-atomic-contexts' (2022-03-23 10:40:44 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 33758c891479ea1c736abfee64b5225925875557:
memcg: enable accounting for nft objects (2022-03-28 10:11:23 +0200)
----------------------------------------------------------------
Pablo Neira Ayuso (1):
netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
Phil Sutter (1):
netfilter: egress: Report interface as outgoing
Vasily Averin (1):
memcg: enable accounting for nft objects
include/linux/netfilter_netdev.h | 2 +-
net/netfilter/core.c | 2 +-
net/netfilter/nf_conntrack_proto_tcp.c | 17 +++++++++----
net/netfilter/nf_tables_api.c | 44 +++++++++++++++++-----------------
4 files changed, 37 insertions(+), 28 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-03-17 20:25 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2022-03-17 20:25 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix PPPoE and QinQ with flowtable inet family.
2) Missing register validation in nf_tables.
3) Initialize registers to avoid stack memleak to userspace.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit dea2d93a8ba437460c5f21bdfa4ada57fa1d2179:
Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue (2022-03-16 10:07:43 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 4c905f6740a365464e91467aa50916555b28213d:
netfilter: nf_tables: initialize registers in nft_do_chain() (2022-03-17 15:50:27 +0100)
----------------------------------------------------------------
Pablo Neira Ayuso (3):
netfilter: flowtable: Fix QinQ and pppoe support for inet table
netfilter: nf_tables: validate registers coming from userspace.
netfilter: nf_tables: initialize registers in nft_do_chain()
include/net/netfilter/nf_flow_table.h | 18 ++++++++++++++++++
net/netfilter/nf_flow_table_inet.c | 17 +++++++++++++++++
net/netfilter/nf_flow_table_ip.c | 18 ------------------
net/netfilter/nf_tables_api.c | 22 +++++++++++++++++-----
net/netfilter/nf_tables_core.c | 2 +-
5 files changed, 53 insertions(+), 24 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2022-03-12 22:03 Pablo Neira Ayuso
2022-03-14 22:54 ` Jakub Kicinski
0 siblings, 1 reply; 42+ messages in thread
From: Pablo Neira Ayuso @ 2022-03-12 22:03 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net coming late
in the 5.17-rc process:
1) Revert port remap to mitigate shadowing service ports, this is causing
problems in existing setups and this mitigation can be achieved with
explicit ruleset, eg.
... tcp sport < 16386 tcp dport >= 32768 masquerade random
This patches provided a built-in policy similar to the one described above.
2) Disable register tracking infrastructure in nf_tables. Florian reported
two issues:
- Existing expressions with no implemented .reduce interface
that causes data-store on register should cancel the tracking.
- Register clobbering might be possible storing data on registers that
are larger than 32-bits.
This might lead to generating incorrect ruleset bytecode. These two
issues are scheduled to be addressed in the next release cycle.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit f8e9bd34cedd89b93b1167aa32ab8ecd6c2ccf4a:
Merge branch 'smc-fix' (2022-03-03 10:34:18 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to ed5f85d4229010235eab1e3d9acf6970d9304963:
netfilter: nf_tables: disable register tracking (2022-03-12 16:07:38 +0100)
----------------------------------------------------------------
Florian Westphal (2):
Revert "netfilter: nat: force port remap to prevent shadowing well-known ports"
Revert "netfilter: conntrack: tag conntracks picked up in local out hook"
Pablo Neira Ayuso (1):
netfilter: nf_tables: disable register tracking
include/net/netfilter/nf_conntrack.h | 1 -
net/netfilter/nf_conntrack_core.c | 3 --
net/netfilter/nf_nat_core.c | 43 ++--------------------------
net/netfilter/nf_tables_api.c | 9 ++++--
tools/testing/selftests/netfilter/nft_nat.sh | 5 ++--
5 files changed, 12 insertions(+), 49 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2022-03-12 22:03 Pablo Neira Ayuso
@ 2022-03-14 22:54 ` Jakub Kicinski
2022-03-14 23:07 ` Florian Westphal
0 siblings, 1 reply; 42+ messages in thread
From: Jakub Kicinski @ 2022-03-14 22:54 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev
On Sat, 12 Mar 2022 23:03:12 +0100 Pablo Neira Ayuso wrote:
> 1) Revert port remap to mitigate shadowing service ports, this is causing
> problems in existing setups and this mitigation can be achieved with
> explicit ruleset, eg.
>
> ... tcp sport < 16386 tcp dport >= 32768 masquerade random
>
> This patches provided a built-in policy similar to the one described above.
>
> 2) Disable register tracking infrastructure in nf_tables. Florian reported
> two issues:
>
> - Existing expressions with no implemented .reduce interface
> that causes data-store on register should cancel the tracking.
> - Register clobbering might be possible storing data on registers that
> are larger than 32-bits.
>
> This might lead to generating incorrect ruleset bytecode. These two
> issues are scheduled to be addressed in the next release cycle.
Minor nit for the future - it'd still be useful to have Fixes tags even
for reverts or current release fixes so that lowly backporters (myself
included) do not have to dig into history to double confirm patches
are not needed in the production kernels we maintain. Thanks!
^ permalink raw reply [flat|nested] 42+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2022-03-14 22:54 ` Jakub Kicinski
@ 2022-03-14 23:07 ` Florian Westphal
2022-03-14 23:18 ` Jakub Kicinski
0 siblings, 1 reply; 42+ messages in thread
From: Florian Westphal @ 2022-03-14 23:07 UTC (permalink / raw)
To: Jakub Kicinski; +Cc: Pablo Neira Ayuso, netfilter-devel, davem, netdev
Jakub Kicinski <kuba@kernel.org> wrote:
> Minor nit for the future - it'd still be useful to have Fixes tags even
> for reverts or current release fixes so that lowly backporters (myself
> included) do not have to dig into history to double confirm patches
> are not needed in the production kernels we maintain. Thanks!
Understood, will do so next time.
For the record, the tags would have been:
Fixes: 878aed8db324 ("netfilter: nat: force port remap to prevent shadowing well-known ports")
Fixes: 4a6fbdd801e8 ("netfilter: conntrack: tag conntracks picked up in local out hook")
Fixes: 12e4ecfa244b ("netfilter: nf_tables: add register tracking infrastructure")
... all were merged v5.17-rc1 onwards.
^ permalink raw reply [flat|nested] 42+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2022-03-14 23:07 ` Florian Westphal
@ 2022-03-14 23:18 ` Jakub Kicinski
0 siblings, 0 replies; 42+ messages in thread
From: Jakub Kicinski @ 2022-03-14 23:18 UTC (permalink / raw)
To: Florian Westphal; +Cc: Pablo Neira Ayuso, netfilter-devel, davem, netdev
On Tue, 15 Mar 2022 00:07:19 +0100 Florian Westphal wrote:
> Jakub Kicinski <kuba@kernel.org> wrote:
> > Minor nit for the future - it'd still be useful to have Fixes tags even
> > for reverts or current release fixes so that lowly backporters (myself
> > included) do not have to dig into history to double confirm patches
> > are not needed in the production kernels we maintain. Thanks!
>
> Understood, will do so next time.
>
> For the record, the tags would have been:
>
> Fixes: 878aed8db324 ("netfilter: nat: force port remap to prevent shadowing well-known ports")
> Fixes: 4a6fbdd801e8 ("netfilter: conntrack: tag conntracks picked up in local out hook")
> Fixes: 12e4ecfa244b ("netfilter: nf_tables: add register tracking infrastructure")
>
> ... all were merged v5.17-rc1 onwards.
Thanks!
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2021-06-10 16:54 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2021-06-10 16:54 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix a crash when stateful expression with its own gc callback
is used in a set definition.
2) Skip IPv6 packets from any link-local address in IPv6 fib expression.
Add a selftest for this scenario, from Florian Westphal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you!
----------------------------------------------------------------
The following changes since commit f2386cf7c5f4ff5d7b584f5d92014edd7df6c676:
net: lantiq: disable interrupt before sheduling NAPI (2021-06-08 19:16:32 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 12f36e9bf678a81d030ca1b693dcda62b55af7c5:
netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local (2021-06-09 21:11:03 +0200)
----------------------------------------------------------------
Florian Westphal (2):
selftests: netfilter: add fib test case
netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local
Pablo Neira Ayuso (1):
netfilter: nf_tables: initialize set before expression setup
net/ipv6/netfilter/nft_fib_ipv6.c | 22 ++-
net/netfilter/nf_tables_api.c | 85 ++++++-----
tools/testing/selftests/netfilter/Makefile | 2 +-
tools/testing/selftests/netfilter/nft_fib.sh | 221 +++++++++++++++++++++++++++
4 files changed, 283 insertions(+), 47 deletions(-)
create mode 100755 tools/testing/selftests/netfilter/nft_fib.sh
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2021-02-02 15:21 Pablo Neira Ayuso
2021-02-02 15:25 ` Pablo Neira Ayuso
0 siblings, 1 reply; 42+ messages in thread
From: Pablo Neira Ayuso @ 2021-02-02 15:21 UTC (permalink / raw)
To: netfilter-devel; +Cc: fw
Hi,
The following patchset contains Netfilter fixes for net:
1) Honor stateful expressions defined in the set from the dynset
extension. The set definition provides a stateful expression
that must be used by the dynset expression in case it is specified.
2) Missing timeout extension in the set element in the dynset
extension leads to inconsistent ruleset listing, not allowing
the user to restore timeout and expiration on ruleset reload.
3) Do not dump the stateful expression from the dynset extension
if it coming from the set definition.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit c8a8ead01736419a14c3106e1f26a79d74fc84c7:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf (2021-01-12 20:25:29 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to ce5379963b2884e9d23bea0c5674a7251414c84b:
netfilter: nft_dynset: dump expressions when set definition contains no expressions (2021-01-16 19:54:42 +0100)
----------------------------------------------------------------
Pablo Neira Ayuso (3):
netfilter: nft_dynset: honor stateful expressions in set definition
netfilter: nft_dynset: add timeout extension to template
netfilter: nft_dynset: dump expressions when set definition contains no expressions
include/net/netfilter/nf_tables.h | 2 ++
net/netfilter/nf_tables_api.c | 5 ++---
net/netfilter/nft_dynset.c | 41 +++++++++++++++++++++++++--------------
3 files changed, 30 insertions(+), 18 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2021-02-02 15:21 Pablo Neira Ayuso
@ 2021-02-02 15:25 ` Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2021-02-02 15:25 UTC (permalink / raw)
To: netfilter-devel; +Cc: fw
Please, scratch this.
My robot resent an old pull request that was stale on my submission
folder.
Sorry for the noise.
On Tue, Feb 02, 2021 at 04:21:52PM +0100, Pablo Neira Ayuso wrote:
> Hi,
>
> The following patchset contains Netfilter fixes for net:
>
> 1) Honor stateful expressions defined in the set from the dynset
> extension. The set definition provides a stateful expression
> that must be used by the dynset expression in case it is specified.
>
> 2) Missing timeout extension in the set element in the dynset
> extension leads to inconsistent ruleset listing, not allowing
> the user to restore timeout and expiration on ruleset reload.
>
> 3) Do not dump the stateful expression from the dynset extension
> if it coming from the set definition.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
>
> Thanks!
>
> ----------------------------------------------------------------
>
> The following changes since commit c8a8ead01736419a14c3106e1f26a79d74fc84c7:
>
> Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf (2021-01-12 20:25:29 -0800)
>
> are available in the Git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
>
> for you to fetch changes up to ce5379963b2884e9d23bea0c5674a7251414c84b:
>
> netfilter: nft_dynset: dump expressions when set definition contains no expressions (2021-01-16 19:54:42 +0100)
>
> ----------------------------------------------------------------
> Pablo Neira Ayuso (3):
> netfilter: nft_dynset: honor stateful expressions in set definition
> netfilter: nft_dynset: add timeout extension to template
> netfilter: nft_dynset: dump expressions when set definition contains no expressions
>
> include/net/netfilter/nf_tables.h | 2 ++
> net/netfilter/nf_tables_api.c | 5 ++---
> net/netfilter/nft_dynset.c | 41 +++++++++++++++++++++++++--------------
> 3 files changed, 30 insertions(+), 18 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2021-01-27 13:25 Pablo Neira Ayuso
0 siblings, 0 replies; 42+ messages in thread
From: Pablo Neira Ayuso @ 2021-01-27 13:25 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Honor stateful expressions defined in the set from the dynset
extension. The set definition provides a stateful expression
that must be used by the dynset expression in case it is specified.
2) Missing timeout extension in the set element in the dynset
extension leads to inconsistent ruleset listing, not allowing
the user to restore timeout and expiration on ruleset reload.
3) Do not dump the stateful expression from the dynset extension
if it coming from the set definition.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit c8a8ead01736419a14c3106e1f26a79d74fc84c7:
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf (2021-01-12 20:25:29 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to ce5379963b2884e9d23bea0c5674a7251414c84b:
netfilter: nft_dynset: dump expressions when set definition contains no expressions (2021-01-16 19:54:42 +0100)
----------------------------------------------------------------
Pablo Neira Ayuso (3):
netfilter: nft_dynset: honor stateful expressions in set definition
netfilter: nft_dynset: add timeout extension to template
netfilter: nft_dynset: dump expressions when set definition contains no expressions
include/net/netfilter/nf_tables.h | 2 ++
net/netfilter/nf_tables_api.c | 5 ++---
net/netfilter/nft_dynset.c | 41 +++++++++++++++++++++++++--------------
3 files changed, 30 insertions(+), 18 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2021-01-12 22:20 Pablo Neira Ayuso
2021-01-13 4:26 ` Jakub Kicinski
0 siblings, 1 reply; 42+ messages in thread
From: Pablo Neira Ayuso @ 2021-01-12 22:20 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi,
The following patchset contains Netfilter fixes for net:
1) Pass conntrack -f to specify family in netfilter conntrack helper
selftests, from Chen Yi.
2) Honor hashsize modparam from nf_conntrack_buckets sysctl,
from Jesper D. Brouer.
3) Fix memleak in nf_nat_init() error path, from Dinghao Liu.
Chen Yi (1):
selftests: netfilter: Pass family parameter "-f" to conntrack tool
Dinghao Liu (1):
netfilter: nf_nat: Fix memleak in nf_nat_init
Jesper Dangaard Brouer (1):
netfilter: conntrack: fix reading nf_conntrack_buckets
net/netfilter/nf_conntrack_standalone.c | 3 +++
net/netfilter/nf_nat_core.c | 1 +
.../selftests/netfilter/nft_conntrack_helper.sh | 12 +++++++++---
3 files changed, 13 insertions(+), 3 deletions(-)
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
----------------------------------------------------------------
The following changes since commit c49243e8898233de18edfaaa5b7b261ea457f221:
Merge branch 'net-fix-issues-around-register_netdevice-failures' (2021-01-08 19:27:44 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 869f4fdaf4ca7bb6e0d05caf6fa1108dddc346a7:
netfilter: nf_nat: Fix memleak in nf_nat_init (2021-01-11 00:34:11 +0100)
----------------------------------------------------------------
Chen Yi (1):
selftests: netfilter: Pass family parameter "-f" to conntrack tool
Dinghao Liu (1):
netfilter: nf_nat: Fix memleak in nf_nat_init
Jesper Dangaard Brouer (1):
netfilter: conntrack: fix reading nf_conntrack_buckets
net/netfilter/nf_conntrack_standalone.c | 3 +++
net/netfilter/nf_nat_core.c | 1 +
tools/testing/selftests/netfilter/nft_conntrack_helper.sh | 12 +++++++++---
3 files changed, 13 insertions(+), 3 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2021-01-12 22:20 Pablo Neira Ayuso
@ 2021-01-13 4:26 ` Jakub Kicinski
0 siblings, 0 replies; 42+ messages in thread
From: Jakub Kicinski @ 2021-01-13 4:26 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev
On Tue, 12 Jan 2021 23:20:30 +0100 Pablo Neira Ayuso wrote:
> The following patchset contains Netfilter fixes for net:
>
> 1) Pass conntrack -f to specify family in netfilter conntrack helper
> selftests, from Chen Yi.
>
> 2) Honor hashsize modparam from nf_conntrack_buckets sysctl,
> from Jesper D. Brouer.
>
> 3) Fix memleak in nf_nat_init() error path, from Dinghao Liu.
Pulled, thanks!
^ permalink raw reply [flat|nested] 42+ messages in thread
* [PATCH net 0/3] Netfilter fixes for net
@ 2021-01-03 19:29 Pablo Neira Ayuso
2021-01-04 23:04 ` Jakub Kicinski
0 siblings, 1 reply; 42+ messages in thread
From: Pablo Neira Ayuso @ 2021-01-03 19:29 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba
Hi Jakub, David,
The following patchset contains Netfilter fixes for net:
1) Missing sanitization of rateest userspace string, bug has been
triggered by syzbot, patch from Florian Westphal.
2) Report EOPNOTSUPP on missing set features in nft_dynset, otherwise
error reporting to userspace via EINVAL is misleading since this is
reserved for malformed netlink requests.
3) New binaries with old kernels might silently accept several set
element expressions. New binaries set on the NFT_SET_EXPR and
NFT_DYNSET_F_EXPR flags to request for several expressions per
element, hence old kernels which do not support for this bail out
with EOPNOTSUPP.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks!
P.S: Best wishes for 2021.
----------------------------------------------------------------
The following changes since commit 1f45dc22066797479072978feeada0852502e180:
ibmvnic: continue fatal error reset after passive init (2020-12-23 12:56:10 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to b4e70d8dd9ea6bd5d5fb3122586f652326ca09cd:
netfilter: nftables: add set expression flags (2020-12-28 10:50:26 +0100)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: xt_RATEEST: reject non-null terminated string from userspace
Pablo Neira Ayuso (2):
netfilter: nft_dynset: report EOPNOTSUPP on missing set feature
netfilter: nftables: add set expression flags
include/uapi/linux/netfilter/nf_tables.h | 3 +++
net/netfilter/nf_tables_api.c | 6 +++++-
net/netfilter/nft_dynset.c | 15 ++++++++++-----
net/netfilter/xt_RATEEST.c | 3 +++
4 files changed, 21 insertions(+), 6 deletions(-)
^ permalink raw reply [flat|nested] 42+ messages in thread
* Re: [PATCH net 0/3] Netfilter fixes for net
2021-01-03 19:29 Pablo Neira Ayuso
@ 2021-01-04 23:04 ` Jakub Kicinski
0 siblings, 0 replies; 42+ messages in thread
From: Jakub Kicinski @ 2021-01-04 23:04 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, davem, netdev
On Sun, 3 Jan 2021 20:29:17 +0100 Pablo Neira Ayuso wrote:
> Hi Jakub, David,
>
> The following patchset contains Netfilter fixes for net:
>
> 1) Missing sanitization of rateest userspace string, bug has been
> triggered by syzbot, patch from Florian Westphal.
>
> 2) Report EOPNOTSUPP on missing set features in nft_dynset, otherwise
> error reporting to userspace via EINVAL is misleading since this is
> reserved for malformed netlink requests.
>
> 3) New binaries with old kernels might silently accept several set
> element expressions. New binaries set on the NFT_SET_EXPR and
> NFT_DYNSET_F_EXPR flags to request for several expressions per
> element, hence old kernels which do not support for this bail out
> with EOPNOTSUPP.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Pulled, thanks!
> P.S: Best wishes for 2021.
Happy 2021!
^ permalink raw reply [flat|nested] 42+ messages in thread
end of thread, other threads:[~2024-04-18 1:09 UTC | newest]
Thread overview: 42+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-17 8:53 [PATCH net 0/3] Netfilter fixes for net Pablo Neira Ayuso
2021-12-17 8:53 ` [PATCH net 1/3] netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy() Pablo Neira Ayuso
2021-12-17 11:00 ` patchwork-bot+netdevbpf
2021-12-17 8:53 ` [PATCH net 2/3] netfilter: fix regression in looped (broad|multi)cast's MAC handling Pablo Neira Ayuso
2021-12-17 8:53 ` [PATCH net 3/3] netfilter: ctnetlink: remove expired entries first Pablo Neira Ayuso
-- strict thread matches above, loose matches on Subject: below --
2024-04-18 1:09 [PATCH net 0/3] Netfilter fixes for net Pablo Neira Ayuso
2024-03-21 0:06 Pablo Neira Ayuso
2024-02-29 0:01 Pablo Neira Ayuso
2024-02-14 23:38 Pablo Neira Ayuso
2023-07-26 15:23 [PATCH net 0/3] netfilter " Florian Westphal
2023-06-08 19:57 [PATCH net 0/3] Netfilter " Pablo Neira Ayuso
2023-05-17 12:37 Florian Westphal
2023-05-03 6:32 Pablo Neira Ayuso
2023-03-07 10:04 Pablo Neira Ayuso
2023-03-07 12:57 ` Paolo Abeni
2023-03-07 17:26 ` Jakub Kicinski
2023-03-08 9:34 ` Pablo Neira Ayuso
2023-03-01 22:20 Pablo Neira Ayuso
2023-01-13 16:41 Pablo Neira Ayuso
2023-01-18 3:03 ` Jakub Kicinski
2023-01-11 21:22 Pablo Neira Ayuso
2022-11-22 21:28 Pablo Neira Ayuso
2022-11-09 11:28 Pablo Neira Ayuso
2022-10-12 12:18 [PATCH net 0/3] netfilter " Florian Westphal
2022-07-11 9:33 [PATCH net 0/3] Netfilter " Pablo Neira Ayuso
2022-06-29 17:13 Pablo Neira Ayuso
2022-06-30 3:20 ` patchwork-bot+netdevbpf
2022-04-28 14:21 Pablo Neira Ayuso
2022-03-28 8:20 Pablo Neira Ayuso
2022-03-17 20:25 Pablo Neira Ayuso
2022-03-12 22:03 Pablo Neira Ayuso
2022-03-14 22:54 ` Jakub Kicinski
2022-03-14 23:07 ` Florian Westphal
2022-03-14 23:18 ` Jakub Kicinski
2021-06-10 16:54 Pablo Neira Ayuso
2021-02-02 15:21 Pablo Neira Ayuso
2021-02-02 15:25 ` Pablo Neira Ayuso
2021-01-27 13:25 Pablo Neira Ayuso
2021-01-12 22:20 Pablo Neira Ayuso
2021-01-13 4:26 ` Jakub Kicinski
2021-01-03 19:29 Pablo Neira Ayuso
2021-01-04 23:04 ` Jakub Kicinski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).