[PATCH 0/3] Netfilter fixes for net

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contains three Netfilter fixes for your net tree,
they are:

* fix incorrect comparison in the new netnet hash ipset type, from
  Dave Jones.

* fix splat in hashlimit due to missing removal of the content of its
  proc entry in netnamespaces, from Sergey Popovich.

* fix missing rule flushing operation by table in nf_tables. Table
  flushing was already discussed back in October but this got lost and
  no patch has hit the tree to address this issue so far, from me.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

Thanks!

----------------------------------------------------------------

The following changes since commit 2c7a9dc1641664173211c4ebc5db510a08684c46:

  be2net: Avoid programming permenant MAC by BE3-R VFs (2013-11-23 15:11:07 -0800)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to cf9dc09d0949f0b5953fb08caa10bba0dc7ee71f:

  netfilter: nf_tables: fix missing rules flushing per table (2013-12-07 22:55:48 +0100)

----------------------------------------------------------------
Dave Jones (1):
      netfilter: ipset: fix incorret comparison in hash_netnet4_data_equal()

Pablo Neira Ayuso (1):
      netfilter: nf_tables: fix missing rules flushing per table

Sergey Popovich (1):
      netfilter: xt_hashlimit: fix proc entry leak in netns destroy path

 net/netfilter/ipset/ip_set_hash_netnet.c |    2 +-
 net/netfilter/nf_tables_api.c            |   46 +++++++++++++++++++++---------
 net/netfilter/xt_hashlimit.c             |   25 +++++++---------
 3 files changed, 45 insertions(+), 28 deletions(-)

[PATCH 1/3] netfilter: ipset: fix incorret comparison in hash_netnet4_data_equal()

[Pablo Neira Ayuso]

From: Dave Jones <davej@redhat.com>

Both sides of the comparison are the same, looks like a cut-and-paste error.

Spotted by Coverity.

Signed-off-by: Dave Jones <davej@fedoraproject.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/ipset/ip_set_hash_netnet.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/ipset/ip_set_hash_netnet.c b/net/netfilter/ipset/ip_set_hash_netnet.c
index 2bc2dec..6226803 100644
--- a/net/netfilter/ipset/ip_set_hash_netnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netnet.c
@@ -59,7 +59,7 @@ hash_netnet4_data_equal(const struct hash_netnet4_elem *ip1,
 		     u32 *multi)
 {
 	return ip1->ipcmp == ip2->ipcmp &&
-	       ip2->ccmp == ip2->ccmp;
+	       ip1->ccmp == ip2->ccmp;
 }
 
 static inline int
-- 
1.7.10.4

[PATCH 2/3] netfilter: xt_hashlimit: fix proc entry leak in netns destroy path

[Pablo Neira Ayuso]

From: Sergey Popovich <popovich_sergei@mail.ru>

In (32263dd1b netfilter: xt_hashlimit: fix namespace destroy path)
the hashlimit_net_exit() function is always called right before
hashlimit_mt_destroy() to release netns data. If you use xt_hashlimit
with IPv4 and IPv6 together, this produces the following splat via
netconsole in the netns destroy path:

 Pid: 9499, comm: kworker/u:0 Tainted: G        WC O 3.2.0-5-netctl-amd64-core2
 Call Trace:
  [<ffffffff8104708d>] ? warn_slowpath_common+0x78/0x8c
  [<ffffffff81047139>] ? warn_slowpath_fmt+0x45/0x4a
  [<ffffffff81144a99>] ? remove_proc_entry+0xd8/0x22e
  [<ffffffff810ebbaa>] ? kfree+0x5b/0x6c
  [<ffffffffa043c501>] ? hashlimit_net_exit+0x45/0x8d [xt_hashlimit]
  [<ffffffff8128ab30>] ? ops_exit_list+0x1c/0x44
  [<ffffffff8128b28e>] ? cleanup_net+0xf1/0x180
  [<ffffffff810369fc>] ? should_resched+0x5/0x23
  [<ffffffff8105b8f9>] ? process_one_work+0x161/0x269
  [<ffffffff8105aea5>] ? cwq_activate_delayed_work+0x3c/0x48
  [<ffffffff8105c8c2>] ? worker_thread+0xc2/0x145
  [<ffffffff8105c800>] ? manage_workers.isra.25+0x15b/0x15b
  [<ffffffff8105fa01>] ? kthread+0x76/0x7e
  [<ffffffff813581f4>] ? kernel_thread_helper+0x4/0x10
  [<ffffffff8105f98b>] ? kthread_worker_fn+0x139/0x139
  [<ffffffff813581f0>] ? gs_change+0x13/0x13
 ---[ end trace d8c3cc0ad163ef79 ]---
 ------------[ cut here ]------------
 WARNING: at /usr/src/linux-3.2.52/debian/build/source_netctl/fs/proc/generic.c:849
 remove_proc_entry+0x217/0x22e()
 Hardware name:
 remove_proc_entry: removing non-empty directory 'net/ip6t_hashlimit', leaking at least 'IN-REJECT'

This is due to lack of removal net/ip6t_hashlimit/* entries in
hashlimit_proc_net_exit(), since only IPv4 entries are deleted. Fix
it by always removing the IPv4 and IPv6 entries and their parent
directories in the netns destroy path.

Signed-off-by: Sergey Popovich <popovich_sergei@mail.ru>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/xt_hashlimit.c |   25 +++++++++++--------------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 9ff035c..a3910fc 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -325,21 +325,24 @@ static void htable_gc(unsigned long htlong)
 	add_timer(&ht->timer);
 }
 
-static void htable_destroy(struct xt_hashlimit_htable *hinfo)
+static void htable_remove_proc_entry(struct xt_hashlimit_htable *hinfo)
 {
 	struct hashlimit_net *hashlimit_net = hashlimit_pernet(hinfo->net);
 	struct proc_dir_entry *parent;
 
-	del_timer_sync(&hinfo->timer);
-
 	if (hinfo->family == NFPROTO_IPV4)
 		parent = hashlimit_net->ipt_hashlimit;
 	else
 		parent = hashlimit_net->ip6t_hashlimit;
 
-	if(parent != NULL)
+	if (parent != NULL)
 		remove_proc_entry(hinfo->name, parent);
+}
 
+static void htable_destroy(struct xt_hashlimit_htable *hinfo)
+{
+	del_timer_sync(&hinfo->timer);
+	htable_remove_proc_entry(hinfo);
 	htable_selective_cleanup(hinfo, select_all);
 	kfree(hinfo->name);
 	vfree(hinfo);
@@ -883,21 +886,15 @@ static int __net_init hashlimit_proc_net_init(struct net *net)
 static void __net_exit hashlimit_proc_net_exit(struct net *net)
 {
 	struct xt_hashlimit_htable *hinfo;
-	struct proc_dir_entry *pde;
 	struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
 
-	/* recent_net_exit() is called before recent_mt_destroy(). Make sure
-	 * that the parent xt_recent proc entry is is empty before trying to
-	 * remove it.
+	/* hashlimit_net_exit() is called before hashlimit_mt_destroy().
+	 * Make sure that the parent ipt_hashlimit and ip6t_hashlimit proc
+	 * entries is empty before trying to remove it.
 	 */
 	mutex_lock(&hashlimit_mutex);
-	pde = hashlimit_net->ipt_hashlimit;
-	if (pde == NULL)
-		pde = hashlimit_net->ip6t_hashlimit;
-
 	hlist_for_each_entry(hinfo, &hashlimit_net->htables, node)
-		remove_proc_entry(hinfo->name, pde);
-
+		htable_remove_proc_entry(hinfo);
 	hashlimit_net->ipt_hashlimit = NULL;
 	hashlimit_net->ip6t_hashlimit = NULL;
 	mutex_unlock(&hashlimit_mutex);
-- 
1.7.10.4

[PATCH 3/3] netfilter: nf_tables: fix missing rules flushing per table

[Pablo Neira Ayuso]

This patch allows you to atomically remove all rules stored in
a table via the NFT_MSG_DELRULE command. You only need to indicate
the specific table and no chain to flush all rules stored in that
table.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_tables_api.c |   46 +++++++++++++++++++++++++++++------------
 1 file changed, 33 insertions(+), 13 deletions(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index dcddc49..f93b7d0 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1717,6 +1717,19 @@ nf_tables_delrule_one(struct nft_ctx *ctx, struct nft_rule *rule)
 	return -ENOENT;
 }
 
+static int nf_table_delrule_by_chain(struct nft_ctx *ctx)
+{
+	struct nft_rule *rule;
+	int err;
+
+	list_for_each_entry(rule, &ctx->chain->rules, list) {
+		err = nf_tables_delrule_one(ctx, rule);
+		if (err < 0)
+			return err;
+	}
+	return 0;
+}
+
 static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
 			     const struct nlmsghdr *nlh,
 			     const struct nlattr * const nla[])
@@ -1725,8 +1738,8 @@ static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
 	const struct nft_af_info *afi;
 	struct net *net = sock_net(skb->sk);
 	const struct nft_table *table;
-	struct nft_chain *chain;
-	struct nft_rule *rule, *tmp;
+	struct nft_chain *chain = NULL;
+	struct nft_rule *rule;
 	int family = nfmsg->nfgen_family, err = 0;
 	struct nft_ctx ctx;
 
@@ -1738,22 +1751,29 @@ static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
 	if (IS_ERR(table))
 		return PTR_ERR(table);
 
-	chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
-	if (IS_ERR(chain))
-		return PTR_ERR(chain);
+	if (nla[NFTA_RULE_CHAIN]) {
+		chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
+		if (IS_ERR(chain))
+			return PTR_ERR(chain);
+	}
 
 	nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
 
-	if (nla[NFTA_RULE_HANDLE]) {
-		rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
-		if (IS_ERR(rule))
-			return PTR_ERR(rule);
+	if (chain) {
+		if (nla[NFTA_RULE_HANDLE]) {
+			rule = nf_tables_rule_lookup(chain,
+						     nla[NFTA_RULE_HANDLE]);
+			if (IS_ERR(rule))
+				return PTR_ERR(rule);
 
-		err = nf_tables_delrule_one(&ctx, rule);
-	} else {
-		/* Remove all rules in this chain */
-		list_for_each_entry_safe(rule, tmp, &chain->rules, list) {
 			err = nf_tables_delrule_one(&ctx, rule);
+		} else {
+			err = nf_table_delrule_by_chain(&ctx);
+		}
+	} else {
+		list_for_each_entry(chain, &table->chains, list) {
+			ctx.chain = chain;
+			err = nf_table_delrule_by_chain(&ctx);
 			if (err < 0)
 				break;
 		}
-- 
1.7.10.4

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sun,  8 Dec 2013 00:13:27 +0100

> The following patchset contains three Netfilter fixes for your net tree,
> they are:
> 
> * fix incorrect comparison in the new netnet hash ipset type, from
>   Dave Jones.
> 
> * fix splat in hashlimit due to missing removal of the content of its
>   proc entry in netnamespaces, from Sergey Popovich.
> 
> * fix missing rule flushing operation by table in nf_tables. Table
>   flushing was already discussed back in October but this got lost and
>   no patch has hit the tree to address this issue so far, from me.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

Pulled, thanks Pablo.

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi,

The following patchset contains Netfilter fixes for net:

1) Uninitialized when used in __nf_conntrack_update(), from
   Nathan Chancellor.

2) Comparison of unsigned expression in nf_confirm_cthelper().

3) Remove 'const' type qualifier with no effect.

This batch is addressing fallout from the previous pull request.

Please, pull this updates from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thank you.

----------------------------------------------------------------

The following changes since commit a4976a3ef844c510ae9120290b23e9f3f47d6bce:

  crypto: chelsio/chtls: properly set tp->lsndtime (2020-05-26 23:24:00 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 4946ea5c1237036155c3b3a24f049fd5f849f8f6:

  netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build (2020-05-27 13:39:08 +0200)

----------------------------------------------------------------
Nathan Chancellor (1):
      netfilter: conntrack: Pass value of ctinfo to __nf_conntrack_update

Pablo Neira Ayuso (2):
      netfilter: conntrack: comparison of unsigned in cthelper confirmation
      netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build

 include/linux/netfilter/nf_conntrack_pptp.h | 2 +-
 net/netfilter/nf_conntrack_core.c           | 8 ++++----
 net/netfilter/nf_conntrack_pptp.c           | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 28 May 2020 00:40:15 +0200

> The following patchset contains Netfilter fixes for net:
> 
> 1) Uninitialized when used in __nf_conntrack_update(), from
>    Nathan Chancellor.
> 
> 2) Comparison of unsigned expression in nf_confirm_cthelper().
> 
> 3) Remove 'const' type qualifier with no effect.
> 
> This batch is addressing fallout from the previous pull request.
> 
> Please, pull this updates from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks.

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

1) Module autoload for masquerade and redirection does not work.

2) Leak in unqueued packets in nf_ct_frag6_queue(). Ignore duplicated
   fragments, pretend they are placed into the queue. Patches from
   Guillaume Nault.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 100f6d8e09905c59be45b6316f8f369c0be1b2d8:

  net: correct zerocopy refcnt with udp MSG_MORE (2019-05-30 15:54:04 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 8a3dca632538c550930ce8bafa8c906b130d35cf:

  netfilter: ipv6: nf_defrag: accept duplicate fragments again (2019-06-07 14:49:01 +0200)

----------------------------------------------------------------
Guillaume Nault (2):
      netfilter: ipv6: nf_defrag: fix leakage of unqueued fragments
      netfilter: ipv6: nf_defrag: accept duplicate fragments again

Pablo Neira Ayuso (1):
      netfilter: nf_tables: fix module autoload with inet family

 net/ipv6/netfilter/nf_conntrack_reasm.c | 22 ++++++++++++----------
 net/netfilter/nft_masq.c                |  3 +--
 net/netfilter/nft_redir.c               |  3 +--
 3 files changed, 14 insertions(+), 14 deletions(-)

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Fix chain filtering when dumping rules via nf_tables_dump_rules().

2) Fix accidental change in NF_CT_STATE_UNTRACKED_BIT through uapi,
   introduced when removing the untracked conntrack object, from
   Florian Westphal.

3) Fix potential nul-dereference when releasing dump filter in
   nf_tables_dump_obj_done(), patch from Hangbin Liu.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit b4681c2829e24943aadd1a7bb3a30d41d0a20050:

  ipv4: Fix use-after-free when flushing FIB tables (2017-12-20 15:12:39 -0500)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 8bea728dce8972e534e6b99fd550f7b5cc3864e8:

  netfilter: nf_tables: fix potential NULL-ptr deref in nf_tables_dump_obj_done() (2017-12-26 17:16:47 +0100)

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: uapi: correct UNTRACKED conntrack state bit number

Hangbin Liu (1):
      netfilter: nf_tables: fix potential NULL-ptr deref in nf_tables_dump_obj_done()

Pablo Neira Ayuso (1):
      netfilter: nf_tables: fix chain filter in nf_tables_dump_rules()

 include/uapi/linux/netfilter/nf_conntrack_common.h | 2 +-
 net/netfilter/nf_tables_api.c                      | 8 +++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri,  5 Jan 2018 16:08:22 +0100

> The following patchset contains Netfilter fixes for your net tree,
> they are:
> 
> 1) Fix chain filtering when dumping rules via nf_tables_dump_rules().
> 
> 2) Fix accidental change in NF_CT_STATE_UNTRACKED_BIT through uapi,
>    introduced when removing the untracked conntrack object, from
>    Florian Westphal.
> 
> 3) Fix potential nul-dereference when releasing dump filter in
>    nf_tables_dump_obj_done(), patch from Hangbin Liu.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks Pablo.

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contain Netfilter simple fixes for your net tree,
two one-liner and one two-liner:

1) Oneliner to fix missing spinlock definition that triggers
   'BUG: spinlock bad magic on CPU#' when spinlock debugging is enabled,
   from Florian Westphal.

2) Fix missing workqueue cancelation on IDLETIMER removal,
   from Liping Zhang.

3) Fix insufficient validation of netlink of NFACCT_QUOTA in
   nfnetlink_acct, from Phil Turnbull.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit f28f20da704d399fb1e4d8838ffd697a357d9cc8:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (2016-04-26 16:25:51 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to eda3fc50daa93b08774a18d51883c5a5d8d85e15:

  netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter (2016-05-05 16:47:08 +0200)

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: conntrack: init all_locks to avoid debug warning

Liping Zhang (1):
      netfilter: IDLETIMER: fix race condition when destroy the target

Phil Turnbull (1):
      netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter

 net/netfilter/nf_conntrack_core.c | 2 +-
 net/netfilter/nfnetlink_acct.c    | 2 ++
 net/netfilter/xt_IDLETIMER.c      | 1 +
 3 files changed, 4 insertions(+), 1 deletion(-)

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon,  9 May 2016 21:52:00 +0200

> The following patchset contain Netfilter simple fixes for your net tree,
> two one-liner and one two-liner:
> 
> 1) Oneliner to fix missing spinlock definition that triggers
>    'BUG: spinlock bad magic on CPU#' when spinlock debugging is enabled,
>    from Florian Westphal.
> 
> 2) Fix missing workqueue cancelation on IDLETIMER removal,
>    from Liping Zhang.
> 
> 3) Fix insufficient validation of netlink of NFACCT_QUOTA in
>    nfnetlink_acct, from Phil Turnbull.

Pulled, thanks.

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contains Netfilter fixes for your net tree. More
specifically, they are:

1) Fix missing filter table per-netns registration in arptables, from
   Florian Westphal.

2) Resolve out of bound access when parsing TCP options in
   nf_conntrack_tcp, patch from Jozsef Kadlecsik.

3) Prefer NFPROTO_BRIDGE extensions over NFPROTO_UNSPEC in ebtables,
   this resolves conflict between xt_limit and ebt_limit, from Phil Sutter.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 0a1a37b6d62e6864a77a82e925217c720f91f963:

  net: add the AF_KCM entries to family name tables (2016-04-06 16:59:01 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to bcf4934288402be3464110109a4dae3bd6fb3e93:

  netfilter: ebtables: Fix extension lookup with identical name (2016-04-13 01:16:57 +0200)

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: arp_tables: register table in initns

Jozsef Kadlecsik (1):
      netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP options

Phil Sutter (1):
      netfilter: ebtables: Fix extension lookup with identical name

 net/bridge/netfilter/ebtables.c        | 6 +++++-
 net/ipv4/netfilter/arptable_filter.c   | 6 ++++++
 net/netfilter/nf_conntrack_proto_tcp.c | 4 ++++
 3 files changed, 15 insertions(+), 1 deletion(-)

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 14 Apr 2016 00:54:51 +0200

> The following patchset contains Netfilter fixes for your net tree. More
> specifically, they are:
> 
> 1) Fix missing filter table per-netns registration in arptables, from
>    Florian Westphal.
> 
> 2) Resolve out of bound access when parsing TCP options in
>    nf_conntrack_tcp, patch from Jozsef Kadlecsik.
> 
> 3) Prefer NFPROTO_BRIDGE extensions over NFPROTO_UNSPEC in ebtables,
>    this resolves conflict between xt_limit and ebt_limit, from Phil Sutter.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks Pablo.

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contains Netfilter fixes for your net tree,
they are:

1) Fix crash when TEE target is used with no --oif, from Eric Dumazet.

2) Oneliner to fix a crash on the redirect traffic to localhost
   infrastructure when interface has not yet an address, from
   Munehisa Kamata.

3) Oneliner not to request module all the time from nfnetlink due to
   wrong type value, from Florian Westphal.

I'll make sure these patches 1 and 2 hit -stable.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 104eb270e665f4fcd8cb8c8ab4c4d4538c604e92:

  net: sun4i-emac: Properly free resources on probe failure and remove (2015-10-21 19:47:45 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to dbc3617f4c1f9fcbe63612048cb9583fea1e11ab:

  netfilter: nfnetlink: don't probe module if it exists (2015-10-28 03:40:50 +0100)

----------------------------------------------------------------
Eric Dumazet (1):
      netfilter: xt_TEE: fix NULL dereference

Florian Westphal (1):
      netfilter: nfnetlink: don't probe module if it exists

Munehisa Kamata (1):
      netfilter: nf_nat_redirect: add missing NULL pointer check

 net/netfilter/nf_nat_redirect.c | 2 +-
 net/netfilter/nfnetlink.c       | 2 +-
 net/netfilter/xt_TEE.c          | 6 ++++--
 3 files changed, 6 insertions(+), 4 deletions(-)

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed,  4 Nov 2015 15:00:35 +0100

> The following patchset contains Netfilter fixes for your net tree,
> they are:
> 
> 1) Fix crash when TEE target is used with no --oif, from Eric Dumazet.
> 
> 2) Oneliner to fix a crash on the redirect traffic to localhost
>    infrastructure when interface has not yet an address, from
>    Munehisa Kamata.
> 
> 3) Oneliner not to request module all the time from nfnetlink due to
>    wrong type value, from Florian Westphal.
> 
> I'll make sure these patches 1 and 2 hit -stable.

Pulled.

Since net-next got merged, and I fast-forwarded net to Linus's
tree, there were some minor conflicts.

Please double check my work.

Thanks.

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contain Netfilter fixes for your net tree, they are:

1) Fix a race in nfnetlink_log and nfnetlink_queue that can lead to a crash.
   This problem is due to wrong order in the per-net registration and netlink
   socket events. Patch from Francesco Ruggeri.

2) Make sure that counters that userspace pass us are higher than 0 in all the
   x_tables frontends. Discovered via Trinity, patch from Dave Jones.

3) Revert a patch for br_netfilter to rely on the conntrack status bits. This
   breaks stateless IPv6 NAT transformations. Patch from Florian Westphal.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 13c3ed6a92724d8c8cb148a14b0ae190ddfe7413:

  vxlan: correct typo in call to unregister_netdevice_queue (2015-05-18 16:57:09 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to faecbb45ebefb20260ad4a631e011e93c896cb73:

  Revert "netfilter: bridge: query conntrack about skb dnat" (2015-05-20 13:51:25 +0200)

----------------------------------------------------------------
Dave Jones (1):
      netfilter: ensure number of counters is >0 in do_replace()

Florian Westphal (1):
      Revert "netfilter: bridge: query conntrack about skb dnat"

Francesco Ruggeri (1):
      netfilter: nfnetlink_{log,queue}: Register pernet in first place

 include/linux/skbuff.h               |    1 +
 net/bridge/br_netfilter.c            |   27 +++++++++------------------
 net/bridge/netfilter/ebtables.c      |    4 ++++
 net/ipv4/netfilter/arp_tables.c      |    6 ++++++
 net/ipv4/netfilter/ip_tables.c       |    6 ++++++
 net/ipv6/netfilter/ip6_tables.c      |    6 ++++++
 net/netfilter/nfnetlink_log.c        |   19 ++++++++++---------
 net/netfilter/nfnetlink_queue_core.c |   18 +++++++++---------
 8 files changed, 51 insertions(+), 36 deletions(-)

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 22 May 2015 12:34:03 +0200

> The following patchset contain Netfilter fixes for your net tree, they are:
> 
> 1) Fix a race in nfnetlink_log and nfnetlink_queue that can lead to a crash.
>    This problem is due to wrong order in the per-net registration and netlink
>    socket events. Patch from Francesco Ruggeri.
> 
> 2) Make sure that counters that userspace pass us are higher than 0 in all the
>    x_tables frontends. Discovered via Trinity, patch from Dave Jones.
> 
> 3) Revert a patch for br_netfilter to rely on the conntrack status bits. This
>    breaks stateless IPv6 NAT transformations. Patch from Florian Westphal.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Pulled, thanks Pablo.

[PATCH 0/3] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contains three Netfilter fixes for your net tree,
they are:

* Fix missing generation sequence initialization which results in a splat
  if lockdep is enabled, it was introduced in the recent works to improve
  nf_conntrack scalability, from Andrey Vagin.

* Don't flush the GRE keymap list in nf_conntrack when the pptp helper is
  disabled otherwise this crashes due to a double release, from Andrey
  Vagin.

* Fix nf_tables cmp fast in big endian, from Patrick McHardy.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 6859e7df6d9045a461412777e63bd8cef12f9705:

  netdev: remove potentially harmful checks (2014-04-07 15:52:07 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to b855d416dc17061ebb271ea7ef1201d100531770:

  netfilter: nf_tables: fix nft_cmp_fast failure on big endian for size < 4 (2014-04-14 10:38:02 +0200)

----------------------------------------------------------------
Andrey Vagin (2):
      netfilter: nf_conntrack: flush net_gre->keymap_list only from gre helper
      netfilter: nf_conntrack: initialize net.ct.generation

Patrick McHardy (1):
      netfilter: nf_tables: fix nft_cmp_fast failure on big endian for size < 4

 include/linux/netfilter/nf_conntrack_proto_gre.h |    1 -
 include/net/netfilter/nf_tables_core.h           |   10 ++++++++++
 net/netfilter/nf_conntrack_core.c                |    1 +
 net/netfilter/nf_conntrack_pptp.c                |   20 +-------------------
 net/netfilter/nf_conntrack_proto_gre.c           |    3 +--
 net/netfilter/nf_tables_core.c                   |    3 +--
 net/netfilter/nft_cmp.c                          |    2 +-
 7 files changed, 15 insertions(+), 25 deletions(-)

Re: [PATCH 0/3] Netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 15 Apr 2014 00:43:32 +0200

> The following patchset contains three Netfilter fixes for your net tree,
> they are:
> 
> * Fix missing generation sequence initialization which results in a splat
>   if lockdep is enabled, it was introduced in the recent works to improve
>   nf_conntrack scalability, from Andrey Vagin.
> 
> * Don't flush the GRE keymap list in nf_conntrack when the pptp helper is
>   disabled otherwise this crashes due to a double release, from Andrey
>   Vagin.
> 
> * Fix nf_tables cmp fast in big endian, from Patrick McHardy.

Pulled, thanks a lot Pablo.

[PATCH 0/3] netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contains three netfilter fixes for your net
tree, they are:

* A couple of fixes to resolve info leak to userspace due to uninitialized
  memory area in ulogd, from Mathias Krause.

* Fix instruction ordering issues that may lead to the access of
  uninitialized data in x_tables. The problem involves the table update
 (producer) and the main packet matching (consumer) routines. Detected in
  SMP ARMv7, from Will Deacon.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

Thanks!

----------------------------------------------------------------

The following changes since commit c31eeaced22ce8bd61268a3c595d542bb38c0a4f:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (2013-10-01 12:58:48 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to b416c144f46af1a30ddfa4e4319a8f077381ad63:

  netfilter: x_tables: fix ordering of jumpstack allocation and table update (2013-10-22 10:11:29 +0200)

----------------------------------------------------------------
Mathias Krause (2):
      netfilter: ebt_ulog: fix info leaks
      netfilter: ipt_ULOG: fix info leaks

Will Deacon (1):
      netfilter: x_tables: fix ordering of jumpstack allocation and table update

 net/bridge/netfilter/ebt_ulog.c |    9 +++------
 net/ipv4/netfilter/arp_tables.c |    5 +++++
 net/ipv4/netfilter/ip_tables.c  |    5 +++++
 net/ipv4/netfilter/ipt_ULOG.c   |    7 +------
 net/ipv6/netfilter/ip6_tables.c |    5 +++++
 net/netfilter/x_tables.c        |    7 ++++++-
 6 files changed, 25 insertions(+), 13 deletions(-)

Re: [PATCH 0/3] netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed, 23 Oct 2013 11:15:21 +0200

> The following patchset contains three netfilter fixes for your net
> tree, they are:
> 
> * A couple of fixes to resolve info leak to userspace due to uninitialized
>   memory area in ulogd, from Mathias Krause.
> 
> * Fix instruction ordering issues that may lead to the access of
>   uninitialized data in x_tables. The problem involves the table update
>  (producer) and the main packet matching (consumer) routines. Detected in
>   SMP ARMv7, from Will Deacon.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

Pulled, thanks Pablo.

[PATCH 0/3] netfilter fixes for net

[Pablo Neira Ayuso]

Hi David,

The following patchset contains Netfilter fixes. They are targeted to the
TCP option targets, that have receive some scrinity in the last week. The
changes are:

* Fix TCPOPTSTRIP, it stopped working in the forward chain as tcp_hdr
  uses skb->transport_header, and we cannot use that in the forwarding
  case, from myself.

* Fix default IPv6 MSS in TCPMSS in case of absence of TCP MSS options,
  from Phil Oester.

* Fix missing fragmentation handling again in TCPMSS, from Phil Oester.

You can pull these changes from:

git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

Thanks!

----------------------------------------------------------------
The following changes since commit a8241c63517ec0b900695daa9003cddc41c536a1:

  ipvs: info leak in __ip_vs_get_dest_entries() (2013-06-10 14:53:00 +0200)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

for you to fetch changes up to b396966c4688522863572927cb30aa874b3ec504:

  netfilter: xt_TCPMSS: Fix missing fragmentation handling (2013-06-12 11:06:19 +0200)

----------------------------------------------------------------
Pablo Neira Ayuso (1):
      netfilter: xt_TCPOPTSTRIP: don't use tcp_hdr()

Phil Oester (2):
      netfilter: xt_TCPMSS: Fix IPv6 default MSS too
      netfilter: xt_TCPMSS: Fix missing fragmentation handling

 net/netfilter/xt_TCPMSS.c      |   25 ++++++++++++++++++-------
 net/netfilter/xt_TCPOPTSTRIP.c |    6 ++++--
 2 files changed, 22 insertions(+), 9 deletions(-)

Re: [PATCH 0/3] netfilter fixes for net

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 17 Jun 2013 21:34:36 +0200

> The following patchset contains Netfilter fixes. They are targeted to the
> TCP option targets, that have receive some scrinity in the last week. The
> changes are:
> 
> * Fix TCPOPTSTRIP, it stopped working in the forward chain as tcp_hdr
>   uses skb->transport_header, and we cannot use that in the forwarding
>   case, from myself.
> 
> * Fix default IPv6 MSS in TCPMSS in case of absence of TCP MSS options,
>   from Phil Oester.
> 
> * Fix missing fragmentation handling again in TCPMSS, from Phil Oester.
> 
> You can pull these changes from:
> 
> git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master

Pulled, thanks Pablo.