[PATCH 00/11] Netfilter/IPVS fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi David,

The following patchset contains Netfilter/IPVS fixes for your net tree:

1) Fix crash when dumping rules after conversion to RCU,
   from Florian Westphal.

2) Fix incorrect hook reinjection from nf_queue in case NF_REPEAT,
   from Jagdish Motwani.

3) Fix check for route existence in fib extension, from Phil Sutter.

4) Fix use after free in ip_vs_in() hook, from YueHaibing.

5) Check for veth existence from netfilter selftests,
   from Jeffrin Jose T.

6) Checksum corruption in UDP NAT helpers due to typo,
   from Florian Westphal.

7) Pass up packets to classic forwarding path regardless of
   IPv4 DF bit, patch for the flowtable infrastructure from Florian.

8) Set liberal TCP tracking for flows that are placed in the
   flowtable, in case they need to go back to classic forwarding path,
   also from Florian.

9) Don't add flow with sequence adjustment to flowtable, from Florian.

10) Skip IPv4 options from IPv6 datapath in flowtable, from Florian.

11) Add selftest for the flowtable infrastructure, from Florian.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks.

----------------------------------------------------------------

The following changes since commit ee8a2b95b737d5989efeb477d5a1ef5e6955b830:

  Merge branch 'mlxsw-Two-port-module-fixes' (2019-05-18 13:13:40 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 2de03b45236f3af1800755614fd434d347adf046:

  selftests: netfilter: add flowtable test script (2019-05-22 10:56:11 +0200)

----------------------------------------------------------------
Florian Westphal (7):
      netfilter: nf_tables: fix oops during rule dump
      netfilter: nat: fix udp checksum corruption
      netfilter: nf_flow_table: ignore DF bit setting
      netfilter: nft_flow_offload: set liberal tracking mode for tcp
      netfilter: nft_flow_offload: don't offload when sequence numbers need adjustment
      netfilter: nft_flow_offload: IPCB is only valid for ipv4 family
      selftests: netfilter: add flowtable test script

Jagdish Motwani (1):
      netfilter: nf_queue: fix reinject verdict handling

Jeffrin Jose T (1):
      selftests: netfilter: missing error check when setting up veth interface

Phil Sutter (1):
      netfilter: nft_fib: Fix existence check support

YueHaibing (1):
      ipvs: Fix use-after-free in ip_vs_in

 include/net/netfilter/nft_fib.h                    |   2 +-
 net/ipv4/netfilter/nft_fib_ipv4.c                  |  23 +-
 net/ipv6/netfilter/nft_fib_ipv6.c                  |  16 +-
 net/netfilter/ipvs/ip_vs_core.c                    |   2 +-
 net/netfilter/nf_flow_table_ip.c                   |   3 +-
 net/netfilter/nf_nat_helper.c                      |   2 +-
 net/netfilter/nf_queue.c                           |   1 +
 net/netfilter/nf_tables_api.c                      |  20 +-
 net/netfilter/nft_fib.c                            |   6 +-
 net/netfilter/nft_flow_offload.c                   |  31 +-
 tools/testing/selftests/netfilter/Makefile         |   2 +-
 tools/testing/selftests/netfilter/nft_flowtable.sh | 324 +++++++++++++++++++++
 tools/testing/selftests/netfilter/nft_nat.sh       |   6 +-
 13 files changed, 375 insertions(+), 63 deletions(-)
 create mode 100755 tools/testing/selftests/netfilter/nft_flowtable.sh