[PATCH 0/3] netfilter updates for net-next

[PATCH 0/3] netfilter updates for net-next

[pablo]

From: Pablo Neira Ayuso <pablo@netfilter.org>

Hi David,

The following three patches contain updates for your net-next tree,
they include:

* Little cleanup for IPVS the use of a strange notation to assign the
  conntrack object, from Alan Cox.

* getsockopt support to obtain the original IPv6 address after NAT,
  similar to the one that IPv4 provides, from Florian Westphal.

* Another little cleanup for nf_nat to save a couple of lines by using
  PTR_RET, from Wu Fengguang.

You can pull these changes from:

git://1984.lsi.us.es/nf-next master

Thanks!

Alan Cox (1):
  ipvs: remove silly double assignment

Florian Westphal (1):
  netfilter: ipv6: add getsockopt to retrieve origdst

Wu Fengguang (1):
  netfilter: nf_nat: use PTR_RET

 include/uapi/linux/in6.h                       |    1 +
 include/uapi/linux/netfilter_ipv6/ip6_tables.h |    3 ++
 net/ipv4/netfilter/iptable_nat.c               |    4 +-
 net/ipv6/netfilter/ip6table_nat.c              |    4 +-
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |   61 ++++++++++++++++++++++++
 net/netfilter/ipvs/ip_vs_nfct.c                |    2 +-
 net/netfilter/ipvs/ip_vs_xmit.c                |    8 ++--
 7 files changed, 72 insertions(+), 11 deletions(-)

-- 
1.7.10.4

Re: [PATCH 0/3] netfilter updates for net-next

[Pablo Neira Ayuso]

On Tue, Nov 13, 2012 at 01:06:40AM +0100, pablo@netfilter.org wrote:
> From: Pablo Neira Ayuso <pablo@netfilter.org>
> 
> Hi David,
> 
> The following three patches contain updates for your net-next tree,
> they include:
> 
> * Little cleanup for IPVS the use of a strange notation to assign the
>   conntrack object, from Alan Cox.
> 
> * getsockopt support to obtain the original IPv6 address after NAT,
>   similar to the one that IPv4 provides, from Florian Westphal.
> 
> * Another little cleanup for nf_nat to save a couple of lines by using
>   PTR_RET, from Wu Fengguang.

Please, hold on with this pull request. We need a follow-up patch to
resolve an issue regarding the getsockopt to obtain original address
with IPv6 NAT.

I'll send you a new pull request.

Sorry for the inconvenience.

Re: [PATCH 0/3] netfilter updates for net-next

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 13 Nov 2012 13:40:02 +0100

> On Tue, Nov 13, 2012 at 01:06:40AM +0100, pablo@netfilter.org wrote:
>> From: Pablo Neira Ayuso <pablo@netfilter.org>
>> 
>> Hi David,
>> 
>> The following three patches contain updates for your net-next tree,
>> they include:
>> 
>> * Little cleanup for IPVS the use of a strange notation to assign the
>>   conntrack object, from Alan Cox.
>> 
>> * getsockopt support to obtain the original IPv6 address after NAT,
>>   similar to the one that IPv4 provides, from Florian Westphal.
>> 
>> * Another little cleanup for nf_nat to save a couple of lines by using
>>   PTR_RET, from Wu Fengguang.
> 
> Please, hold on with this pull request. We need a follow-up patch to
> resolve an issue regarding the getsockopt to obtain original address
> with IPv6 NAT.
> 
> I'll send you a new pull request.

Ok.

[PATCH 0/3] Netfilter updates for net-next

[Pablo Neira Ayuso]

Hi David,

The following patchset contains three Netfilter updates, they are:

* Fix wrong usage of skb_header_pointer in the DCCP protocol helper that
  has been there for quite some time. It was resulting in copying the dccp
  header to a pointer allocated in the stack. Fortunately, this pointer
  provides room for the dccp header is 4 bytes long, so no crashes have been
  reported so far. From Daniel Borkmann.

* Use format string to print in the invocation of nf_log_packet(), again
  in the DCCP helper. Also from Daniel Borkmann.

* Revert "netfilter: avoid get_random_bytes call" as prandom32 does not
  guarantee enough entropy when being calling this at boot time, that may
  happen when reloading the rule.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git master

Thanks!

P.S: I still have a pending pull request that should land anytime soon with
several nftables updates from Patrick, will send them asap to reach your merge
window.

----------------------------------------------------------------

The following changes since commit b912b2f8fc71df4c3ffa7a9fe2c2227e8bcdaa07:

  net/mlx4_core: Warn if device doesn't have enough PCI bandwidth (2014-01-05 20:37:05 -0500)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git master

for you to fetch changes up to b22f5126a24b3b2f15448c3f2a254fc10cbc2b92:

  netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages (2014-01-06 17:40:02 +0100)

----------------------------------------------------------------
Daniel Borkmann (2):
      netfilter: nf_conntrack_dccp: use %s format string for buffer
      netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages

Pablo Neira Ayuso (1):
      Revert "netfilter: avoid get_random_bytes calls"

 net/netfilter/nf_conntrack_proto_dccp.c |   10 +++++-----
 net/netfilter/nfnetlink_log.c           |    8 ++++++++
 net/netfilter/nft_hash.c                |    2 +-
 net/netfilter/xt_RATEEST.c              |    2 +-
 net/netfilter/xt_connlimit.c            |    2 +-
 net/netfilter/xt_hashlimit.c            |    2 +-
 net/netfilter/xt_recent.c               |    2 +-
 7 files changed, 18 insertions(+), 10 deletions(-)

-- 
1.7.10.4

Re: [PATCH 0/3] Netfilter updates for net-next

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed,  8 Jan 2014 20:13:21 +0100

> The following patchset contains three Netfilter updates, they are:
> 
> * Fix wrong usage of skb_header_pointer in the DCCP protocol helper that
>   has been there for quite some time. It was resulting in copying the dccp
>   header to a pointer allocated in the stack. Fortunately, this pointer
>   provides room for the dccp header is 4 bytes long, so no crashes have been
>   reported so far. From Daniel Borkmann.
> 
> * Use format string to print in the invocation of nf_log_packet(), again
>   in the DCCP helper. Also from Daniel Borkmann.
> 
> * Revert "netfilter: avoid get_random_bytes call" as prandom32 does not
>   guarantee enough entropy when being calling this at boot time, that may
>   happen when reloading the rule.
> 
> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git master

Pulled, thanks Pablo.

[PATCH 0/3] Netfilter updates for net-next

[Pablo Neira Ayuso]

Hi David,

This small batch contains several Netfilter fixes for your net-next
tree, more specifically:

* Fix compilation warning in nft_ct in NF_CONNTRACK_MARK is not set,
  from Kristian Evensen.

* Add dependency to IPV6 for NF_TABLES_INET. This one has been reported
  by the several robots that are testing .config combinations, from Paul
  Gortmaker.

* Fix default base chain policy setting in nf_tables, from myself.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git

Thanks!

----------------------------------------------------------------

The following changes since commit 11b57f90257c1d6a91cee720151b69e0c2020cf6:

  xen-netback: stop vif thread spinning if frontend is unresponsive (2014-01-09 23:05:46 -0500)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git 

for you to fetch changes up to 847c8e2959f7f8f1462e33c0a720c6267b984ed8:

  netfilter: nft_ct: fix compilation warning if NF_CONNTRACK_MARK is not set (2014-01-15 11:00:14 +0100)

----------------------------------------------------------------
Kristian Evensen (1):
      netfilter: nft_ct: fix compilation warning if NF_CONNTRACK_MARK is not set

Pablo Neira Ayuso (1):
      netfilter: nf_tables: fix missing byteorder conversion in policy

Paul Gortmaker (1):
      netfilter: Add dependency on IPV6 for NF_TABLES_INET

 net/netfilter/Kconfig         |    2 +-
 net/netfilter/nf_tables_api.c |    2 +-
 net/netfilter/nft_ct.c        |    2 ++
 3 files changed, 4 insertions(+), 2 deletions(-)

[PATCH 0/3] Netfilter updates for net-next

[Pablo Neira Ayuso]

[ Wrong tree, very sorry for that, previous was pointing to net-next
  instead of nftables. Resending pull request ]

Hi David,

This small batch contains several Netfilter fixes for your net-next
tree, more specifically:

* Fix compilation warning in nft_ct in NF_CONNTRACK_MARK is not set,
  from Kristian Evensen.

* Add dependency to IPV6 for NF_TABLES_INET. This one has been reported
  by the several robots that are testing .config combinations, from Paul
  Gortmaker.

* Fix default base chain policy setting in nf_tables, from myself.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nftables.git master

Thanks!

----------------------------------------------------------------

The following changes since commit 11b57f90257c1d6a91cee720151b69e0c2020cf6:

  xen-netback: stop vif thread spinning if frontend is unresponsive (2014-01-09 23:05:46 -0500)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nftables.git master

for you to fetch changes up to 847c8e2959f7f8f1462e33c0a720c6267b984ed8:

  netfilter: nft_ct: fix compilation warning if NF_CONNTRACK_MARK is not set (2014-01-15 11:00:14 +0100)

----------------------------------------------------------------
Kristian Evensen (1):
      netfilter: nft_ct: fix compilation warning if NF_CONNTRACK_MARK is not set

Pablo Neira Ayuso (1):
      netfilter: nf_tables: fix missing byteorder conversion in policy

Paul Gortmaker (1):
      netfilter: Add dependency on IPV6 for NF_TABLES_INET

Re: [PATCH 0/3] Netfilter updates for net-next

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 16 Jan 2014 10:04:50 +0100

>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git

I think you didn't push your changes there:

git pull --no-ff git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git
>From git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
 * branch            HEAD       -> FETCH_HEAD
Already up-to-date.

Re: [PATCH 0/3] Netfilter updates for net-next

[David Miller]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 16 Jan 2014 10:10:00 +0100

> You can pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nftables.git master

Yes, that works a lot better.

Pulled, thank you.