netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 00/12] Netfilter fixes for net
@ 2017-12-13 18:45 Pablo Neira Ayuso
  2017-12-13 18:45 ` [PATCH 01/12] netfilter: remove redundant assignment to e Pablo Neira Ayuso
                   ` (12 more replies)
  0 siblings, 13 replies; 16+ messages in thread
From: Pablo Neira Ayuso @ 2017-12-13 18:45 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The follow patchset contains Netfilter fixes for your net tree,
they are:

1) Fix compilation warning in x_tables with clang due to useless
   redundant reassignment, from Colin Ian King.

2) Add bugtrap to net_exit to catch uninitialized lists, patch
   from Vasily Averin.

3) Fix out of bounds memory reads in H323 conntrack helper, this
   comes with an initial patch to remove replace the obscure
   CHECK_BOUND macro as a dependency. From Eric Sesterhenn.

4) Reduce retransmission timeout when window is 0 in TCP conntrack,
   from Florian Westphal.

6) ctnetlink clamp timeout to INT_MAX if timeout is too large,
   otherwise timeout wraps around and it results in killing the
   entry that is being added immediately.

7) Missing CAP_NET_ADMIN checks in cthelper and xt_osf, due to
   no netns support. From Kevin Cernekee.

8) Missing maximum number of instructions checks in xt_bpf, patch
   from Jann Horn.

9) With no CONFIG_PROC_FS ipt_CLUSTERIP compilation breaks,
   patch from Arnd Bergmann.

10) Missing netlink attribute policy in nftables exthdr, from
    Florian Westphal.

11) Enable conntrack with IPv6 MASQUERADE rules, as a357b3f80bc8
    should have done in first place, from Konstantin Khlebnikov.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks a lot!

----------------------------------------------------------------

The following changes since commit 32a72bbd5da2411eab591bf9bc2e39349106193a:

  net: vxge: Fix some indentation issues (2017-11-20 11:36:30 +0900)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 23715275e4fb6f64358a499d20928a9e93819f2f:

  netfilter: ip6t_MASQUERADE: add dependency on conntrack module (2017-12-11 17:04:50 +0100)

----------------------------------------------------------------
Arnd Bergmann (1):
      netfilter: ipt_CLUSTERIP: fix clusterip_net_exit build regression

Colin Ian King (1):
      netfilter: remove redundant assignment to e

Eric Sesterhenn (2):
      netfilter: nf_ct_h323: Convert CHECK_BOUND macro to function
      netfilter: nf_ct_h323: Extend nf_h323_error_boundary to work on bits as well

Florian Westphal (2):
      netfilter: conntrack: lower timeout to RETRANS seconds if window is 0
      netfilter: exthdr: add missign attributes to policy

Jann Horn (1):
      netfilter: xt_bpf: add overflow checks

Jay Elliott (1):
      netfilter: conntrack: clamp timeouts to INT_MAX

Kevin Cernekee (2):
      netfilter: nfnetlink_cthelper: Add missing permission checks
      netfilter: xt_osf: Add missing permission checks

Konstantin Khlebnikov (1):
      netfilter: ip6t_MASQUERADE: add dependency on conntrack module

Vasily Averin (1):
      netfilter: exit_net cleanup check added

 net/ipv4/netfilter/arp_tables.c        |   1 -
 net/ipv4/netfilter/ip_tables.c         |   1 -
 net/ipv4/netfilter/ipt_CLUSTERIP.c     |   3 +-
 net/ipv6/netfilter/ip6_tables.c        |   1 -
 net/ipv6/netfilter/ip6t_MASQUERADE.c   |   8 ++-
 net/netfilter/nf_conntrack_h323_asn1.c | 128 +++++++++++++++++++++++++--------
 net/netfilter/nf_conntrack_netlink.c   |  12 +++-
 net/netfilter/nf_conntrack_proto_tcp.c |   3 +
 net/netfilter/nf_tables_api.c          |   7 ++
 net/netfilter/nfnetlink_cthelper.c     |  10 +++
 net/netfilter/nfnetlink_log.c          |   5 ++
 net/netfilter/nfnetlink_queue.c        |   5 ++
 net/netfilter/nft_exthdr.c             |   2 +
 net/netfilter/x_tables.c               |   9 +++
 net/netfilter/xt_bpf.c                 |   6 ++
 net/netfilter/xt_osf.c                 |   7 ++
 16 files changed, 170 insertions(+), 38 deletions(-)

^ permalink raw reply	[flat|nested] 16+ messages in thread
* [PATCH 00/12] Netfilter fixes for net
@ 2018-09-11  0:20 Pablo Neira Ayuso
  2018-09-12  4:21 ` David Miller
  0 siblings, 1 reply; 16+ messages in thread
From: Pablo Neira Ayuso @ 2018-09-11  0:20 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains Netfilter fixes for you net tree:

1) Remove duplicated include at the end of UDP conntrack, from Yue Haibing.

2) Restore conntrack dependency on xt_cluster, from Martin Willi.

3) Fix splat with GSO skbs from the checksum target, from Florian Westphal.

4) Rework ct timeout support, the template strategy to attach custom timeouts
   is not correct since it will not work in conjunction with conntrack zones
   and we have a possible free after use when removing the rule due to missing
   refcounting. To fix these problems, do not use conntrack template at all
   and set custom timeout on the already valid conntrack object. This
   fix comes with a preparation patch to simplify timeout adjustment by
   initializating the first position of the timeout array for all of the
   existing trackers. Patchset from Florian Westphal.

5) Fix missing dependency on from IPv4 chain NAT type, from Florian.

6) Release chain reference counter from the flush path, from Taehee Yoo.

7) After flushing an iptables ruleset, conntrack hooks are unregistered
   and entries are left stale to be cleaned up by the timeout garbage
   collector. No TCP tracking is done on established flows by this time.
   If ruleset is reloaded, then hooks are registered again and TCP
   tracking is restored, which considers packets to be invalid. Clear
   window tracking to exercise TCP flow pickup from the middle given that
   history is lost for us. Again from Florian.

8) Fix crash from netlink interface with CONFIG_NF_CONNTRACK_TIMEOUT=y
   and CONFIG_NF_CT_NETLINK_TIMEOUT=n.

9) Broken CT target due to returning incorrect type from
   ctnl_timeout_find_get().

10) Solve conntrack clash on NF_REPEAT verdicts too, from Michal Vaner.

11) Missing conversion of hashlimit sysctl interface to new API, from
    Cong Wang.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks.

----------------------------------------------------------------

The following changes since commit 0d092f06faa46b95a8e07b9bb5737b7c0f1176ee:

  Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth (2018-08-22 22:43:11 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 1286df269f498165061e0cf8092ca212545dbb5a:

  netfilter: xt_hashlimit: use s->file instead of s->private (2018-09-11 01:35:32 +0200)

----------------------------------------------------------------
Cong Wang (1):
      netfilter: xt_hashlimit: use s->file instead of s->private

Florian Westphal (5):
      netfilter: xt_checksum: ignore gso skbs
      netfilter: conntrack: place 'new' timeout in first location too
      netfilter: nf_tables: rework ct timeout set support
      netfilter: kconfig: nat related expression depend on nftables core
      netfilter: conntrack: reset tcp maxwin on re-register

Martin Willi (1):
      netfilter: xt_cluster: add dependency on conntrack module

Michal 'vorner' Vaner (1):
      netfilter: nfnetlink_queue: Solve the NFQUEUE/conntrack clash for NF_REPEAT

Pablo Neira Ayuso (2):
      netfilter: conntrack: timeout interface depend on CONFIG_NF_CONNTRACK_TIMEOUT
      netfilter: cttimeout: ctnl_timeout_find_get() returns incorrect pointer to type

Taehee Yoo (1):
      netfilter: nf_tables: release chain in flushing set

Yue Haibing (1):
      netfilter: conntrack: remove duplicated include from nf_conntrack_proto_udp.c

 include/net/netfilter/nf_conntrack_timeout.h |  2 +-
 net/ipv4/netfilter/Kconfig                   |  8 ++--
 net/netfilter/Kconfig                        | 12 +++---
 net/netfilter/nf_conntrack_proto.c           | 26 ++++++++++++
 net/netfilter/nf_conntrack_proto_dccp.c      | 19 ++++++---
 net/netfilter/nf_conntrack_proto_generic.c   |  8 ++--
 net/netfilter/nf_conntrack_proto_gre.c       |  8 ++--
 net/netfilter/nf_conntrack_proto_icmp.c      |  8 ++--
 net/netfilter/nf_conntrack_proto_icmpv6.c    |  8 ++--
 net/netfilter/nf_conntrack_proto_sctp.c      | 21 ++++++----
 net/netfilter/nf_conntrack_proto_tcp.c       | 19 ++++++---
 net/netfilter/nf_conntrack_proto_udp.c       | 21 +++++-----
 net/netfilter/nf_tables_api.c                |  1 +
 net/netfilter/nfnetlink_cttimeout.c          |  6 +--
 net/netfilter/nfnetlink_queue.c              |  1 +
 net/netfilter/nft_ct.c                       | 59 ++++++++++++++--------------
 net/netfilter/xt_CHECKSUM.c                  | 22 ++++++++++-
 net/netfilter/xt_cluster.c                   | 14 ++++++-
 net/netfilter/xt_hashlimit.c                 | 18 ++++-----
 19 files changed, 181 insertions(+), 100 deletions(-)

^ permalink raw reply	[flat|nested] 16+ messages in thread
end of thread, other threads:[~2018-09-12  4:21 UTC | newest]

Thread overview: 16+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-12-13 18:45 [PATCH 00/12] Netfilter fixes for net Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 01/12] netfilter: remove redundant assignment to e Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 02/12] netfilter: exit_net cleanup check added Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 03/12] netfilter: nf_ct_h323: Convert CHECK_BOUND macro to function Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 04/12] netfilter: nf_ct_h323: Extend nf_h323_error_boundary to work on bits as well Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 05/12] netfilter: conntrack: lower timeout to RETRANS seconds if window is 0 Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 06/12] netfilter: conntrack: clamp timeouts to INT_MAX Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 07/12] netfilter: nfnetlink_cthelper: Add missing permission checks Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 08/12] netfilter: xt_bpf: add overflow checks Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 09/12] netfilter: xt_osf: Add missing permission checks Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 10/12] netfilter: ipt_CLUSTERIP: fix clusterip_net_exit build regression Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 11/12] netfilter: exthdr: add missign attributes to policy Pablo Neira Ayuso
2017-12-13 18:45 ` [PATCH 12/12] netfilter: ip6t_MASQUERADE: add dependency on conntrack module Pablo Neira Ayuso
2017-12-13 19:13 ` [PATCH 00/12] Netfilter fixes for net David Miller
  -- strict thread matches above, loose matches on Subject: below --
2018-09-11  0:20 Pablo Neira Ayuso
2018-09-12  4:21 ` David Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).