nftables 1.0.6.y stable branch updates

nftables 1.0.6.y stable branch updates

[Pablo Neira Ayuso]

Hi,

I have updated the 1.0.6.y -stable branch:

https://git.netfilter.org/nftables/log/?h=1.0.6.y

This branch contains 254 selected commits out of the 753 commits
available between v1.0.6 and git HEAD.

I have run _current_ tests/shell and tests/py in git HEAD on this
branch, with the following results:

- tests/shell:

W: [DUMP FAIL]  223/440 testcases/sets/meter_0
W: [DUMP FAIL]  162/440 testcases/sets/0022type_selective_flush_0
W: [FAILED]     107/440 testcases/sets/0038meter_list_0

These tests fail because 1.0.6.y does not include the code to convert
meters to dynamic sets, it should be possible to make it later, this
requires no kernel update.

- tests/py. The following tests fail:

- numgen inc compatibility with ipv4_addr datatype: this is a
  userspace feature that is missing, this requires not kernel updates
  and it should be possible to backport it.
- icmpv6 match extension: there is an extension to improve matching
  capabilities of icmpv6 that is also not backports. This requires not
  kernel update, it should be possible to support it.
- last statement: that tells you when last match on rule/element has
  happened. This does not require a kernel update, it should be
  possible to support it.
- inner matching: this feature requires kernel >= 6.3.
- bitwise multiregister: this feature requires kernel >= 6.13.

Comments welcome.

Thanks.

nftables 1.0.6.y stable branch updates (strike 2)

[Pablo Neira Ayuso]

Hi,

I have updated the 1.0.6.y -stable branch:

https://git.netfilter.org/nftables/log/?h=1.0.6.y

This branch contains 334 selected commits out of the 887 commits
available between v1.0.6 and git HEAD.

I have backported tests/shell and tests/py based on git HEAD on this
branch, so this stable branch is self-contained.

- tests/shell displays:
  I: results: [OK] 428 [SKIPPED] 23 [FAILED] 0 [TOTAL] 451

- tests/py: No errors. This includes -j for json testing.

I have tested with libnftnl 1.2.4 and Linux kernel 6.1-stable.

I might still collect a few more recent fixes in git HEAD from the
last two months.

Proposed plan is to release this -stable 1.0.6.y after nftables 1.1.4
comes out, in the first two weeks of Aug 2025.

Re: nftables 1.0.6.y stable branch updates (strike 2)

[Pablo Neira Ayuso]

Hi,

On Fri, Aug 01, 2025 at 01:16:21AM +0200, Pablo Neira Ayuso wrote:
> Hi,
> 
> I have updated the 1.0.6.y -stable branch:
> 
> https://git.netfilter.org/nftables/log/?h=1.0.6.y
> 
> This branch contains 334 selected commits out of the 887 commits
> available between v1.0.6 and git HEAD.

For the record: I have just updated this branch again to include 52
more backported recent fixes.

[...]
> Proposed plan is to release this -stable 1.0.6.y after nftables 1.1.4
> comes out, in the first two weeks of Aug 2025.

A new nftables 1.1.5 release might happen due to a regression in the
JSON parser, release time for this 1.0.6.y -stable branch is expected
before Sep 2025.