From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PULL_REQUEST,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A2F3C282CB for ; Tue, 5 Feb 2019 19:04:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 459722175B for ; Tue, 5 Feb 2019 19:04:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727524AbfBETE0 (ORCPT ); Tue, 5 Feb 2019 14:04:26 -0500 Received: from mail.us.es ([193.147.175.20]:38130 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726334AbfBETE0 (ORCPT ); Tue, 5 Feb 2019 14:04:26 -0500 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id 44E3047C43 for ; Tue, 5 Feb 2019 20:04:24 +0100 (CET) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 2A6F2DA874 for ; Tue, 5 Feb 2019 20:04:24 +0100 (CET) Received: by antivirus1-rhel7.int (Postfix, from userid 99) id 1D667DA86F; Tue, 5 Feb 2019 20:04:24 +0100 (CET) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 1E77ADA85E; Tue, 5 Feb 2019 20:04:22 +0100 (CET) Received: from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int (F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); Tue, 05 Feb 2019 20:04:22 +0100 (CET) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int) Received: from salvia.here (sys.soleta.eu [212.170.55.40]) (Authenticated sender: pneira@us.es) by entrada.int (Postfix) with ESMTPA id E21254265A4C; Tue, 5 Feb 2019 20:04:21 +0100 (CET) X-SMTPAUTHUS: auth mail.us.es From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, netdev@vger.kernel.org Subject: [PATCH 0/6] Netfilter fixes for net Date: Tue, 5 Feb 2019 20:04:09 +0100 Message-Id: <20190205190415.25041-1-pablo@netfilter.org> X-Mailer: git-send-email 2.11.0 X-Virus-Scanned: ClamAV using ClamSMTP Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Hi David, The following patchset contains Netfilter fixes for net: 1) Use CONFIG_NF_TABLES_INET from seltests, not NF_TABLES_INET. From Naresh Kamboju. 2) Add a test to cover masquerading and redirect case, from Florian Westphal. 3) Two packets coming from the same socket may race to set up NAT, ending up with different tuples and the packet losing race being dropped. Update nf_conntrack_tuple_taken() to exercise clash resolution for this case. From Martynas Pumputis and Florian Westphal. 4) Unbind anonymous sets from the commit and abort path, this fixes a splat due to double set list removal/release in case that the transaction needs to be aborted. 5) Do not preserve original output interface for packets that are redirected in the output chain when ip6_route_me_harder() is called. Otherwise packets end up going not going to the loopback device. From Eli Cooper. 6) Fix bogus splat in nft_compat with CONFIG_REFCOUNT_FULL=y, this also simplifies the existing logic to deal with the list insertions of the xtables extensions. From Florian Westphal. Diffstat look rather larger than usual because of the new selftest, but Florian and I consider that having tests soon into the tree is good to improve coverage. If there's a different policy in this regard, please, let me know. You can pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git Thanks! ---------------------------------------------------------------- The following changes since commit cfe4bd7a257f6d6f81d3458d8c9d9ec4957539e6: sctp: check and update stream->out_curr when allocating stream_out (2019-02-03 14:27:47 -0800) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD for you to fetch changes up to 947e492c0fc2132ae5fca081a9c2952ccaab0404: netfilter: nft_compat: don't use refcount_inc on newly allocated entry (2019-02-05 14:10:33 +0100) ---------------------------------------------------------------- Eli Cooper (1): netfilter: ipv6: Don't preserve original oif for loopback address Florian Westphal (2): selftests: netfilter: add simple masq/redirect test cases netfilter: nft_compat: don't use refcount_inc on newly allocated entry Martynas Pumputis (1): netfilter: nf_nat: skip nat clash resolution for same-origin entries Naresh Kamboju (1): selftests: netfilter: fix config fragment CONFIG_NF_TABLES_INET Pablo Neira Ayuso (1): netfilter: nf_tables: unbind set in rule from commit path include/net/netfilter/nf_tables.h | 17 +- net/ipv6/netfilter.c | 4 +- net/netfilter/nf_conntrack_core.c | 16 + net/netfilter/nf_tables_api.c | 85 ++- net/netfilter/nft_compat.c | 62 +-- net/netfilter/nft_dynset.c | 18 +- net/netfilter/nft_immediate.c | 6 +- net/netfilter/nft_lookup.c | 18 +- net/netfilter/nft_objref.c | 18 +- tools/testing/selftests/netfilter/Makefile | 2 +- tools/testing/selftests/netfilter/config | 2 +- tools/testing/selftests/netfilter/nft_nat.sh | 762 +++++++++++++++++++++++++++ 12 files changed, 888 insertions(+), 122 deletions(-) create mode 100755 tools/testing/selftests/netfilter/nft_nat.sh