netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 00/15] Netfilter/IPVS fixes for net
@ 2018-06-11  9:22 Pablo Neira Ayuso
  2018-06-11  9:22 ` [PATCH 01/15] netfilter: xt_CT: Reject the non-null terminated string from user space Pablo Neira Ayuso
                   ` (15 more replies)
  0 siblings, 16 replies; 21+ messages in thread
From: Pablo Neira Ayuso @ 2018-06-11  9:22 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains Netfilter/IPVS fixes for your net tree:

1) Reject non-null terminated helper names from xt_CT, from Gao Feng.

2) Fix KASAN splat due to out-of-bound access from commit phase, from
   Alexey Kodanev.

3) Missing conntrack hook registration on IPVS FTP helper, from Julian
   Anastasov.

4) Incorrect skbuff allocation size in bridge nft_reject, from Taehee Yoo.

5) Fix inverted check on packet xmit to non-local addresses, also from
   Julian.

6) Fix ebtables alignment compat problems, from Alin Nastac.

7) Hook mask checks are not correct in xt_set, from Serhey Popovych.

8) Fix timeout listing of element in ipsets, from Jozsef.

9) Cap maximum timeout value in ipset, also from Jozsef.

10) Don't allow family option for hash:mac sets, from Florent Fourcot.

11) Restrict ebtables to work with NFPROTO_BRIDGE targets only, this
    Florian.

12) Another bug reported by KASAN in the rbtree set backend, from
    Taehee Yoo.

13) Missing __IPS_MAX_BIT update doesn't include IPS_OFFLOAD_BIT.
    From Gao Feng.

14) Missing initialization of match/target in ebtables, from Florian
    Westphal.

15) Remove useless nft_dup.h file in include path, from C. Labbe.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks.

----------------------------------------------------------------

The following changes since commit 664088f8d68178809b848ca450f2797efb34e8e7:

  net-sysfs: Fix memory leak in XPS configuration (2018-05-31 23:02:42 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to d8e87fc6d11c31525430a388317b52f4a98a5328:

  netfilter: remove include/net/netfilter/nft_dup.h (2018-06-08 12:42:24 +0200)

----------------------------------------------------------------
Alexey Kodanev (1):
      netfilter: nf_tables: check msg_type before nft_trans_set(trans)

Alin Nastac (1):
      netfilter: ebtables: fix compat entry padding

Corentin Labbe (1):
      netfilter: remove include/net/netfilter/nft_dup.h

Florent Fourcot (1):
      netfilter: ipset: forbid family for hash:mac sets

Florian Westphal (2):
      netfilter: ebtables: reject non-bridge targets
      netfilter: x_tables: initialise match/target check parameter struct

Gao Feng (2):
      netfilter: xt_CT: Reject the non-null terminated string from user space
      netfilter: nf_conntrack: Increase __IPS_MAX_BIT with new bit IPS_OFFLOAD_BIT

Jozsef Kadlecsik (2):
      netfilter: ipset: List timing out entries with "timeout 1" instead of zero
      netfilter: ipset: Limit max timeout value

Julian Anastasov (2):
      ipvs: register conntrack hooks for ftp
      ipvs: fix check on xmit to non-local addresses

Pablo Neira Ayuso (1):
      Merge git://blackhole.kfki.hu/nf

Serhey Popovych (1):
      netfilter: xt_set: Check hook mask correctly

Taehee Yoo (2):
      netfilter: nft_reject_bridge: fix skb allocation size in nft_reject_br_send_v6_unreach
      netfilter: nft_set_rbtree: fix parameter of __nft_rbtree_lookup()

 include/linux/netfilter/ipset/ip_set_timeout.h     | 20 ++++++++++-----
 include/net/ip_vs.h                                | 30 ++++++++++++++++++++++
 include/net/netfilter/nft_dup.h                    | 10 --------
 include/uapi/linux/netfilter/nf_conntrack_common.h |  2 +-
 net/bridge/netfilter/ebtables.c                    | 25 ++++++++++++++----
 net/bridge/netfilter/nft_reject_bridge.c           |  2 +-
 net/ipv4/netfilter/ip_tables.c                     |  1 +
 net/ipv6/netfilter/ip6_tables.c                    |  1 +
 net/netfilter/ipset/ip_set_hash_gen.h              |  5 +++-
 net/netfilter/ipvs/ip_vs_ctl.c                     |  4 +++
 net/netfilter/ipvs/ip_vs_xmit.c                    |  2 +-
 net/netfilter/nf_tables_api.c                      | 11 ++++----
 net/netfilter/nft_set_rbtree.c                     |  2 +-
 net/netfilter/xt_CT.c                              | 10 ++++++++
 net/netfilter/xt_set.c                             | 10 ++++----
 15 files changed, 99 insertions(+), 36 deletions(-)
 delete mode 100644 include/net/netfilter/nft_dup.h

^ permalink raw reply	[flat|nested] 21+ messages in thread
* [PATCH 00/15] Netfilter/IPVS fixes for net
@ 2018-08-17 19:38 Pablo Neira Ayuso
  2018-08-18 17:01 ` David Miller
  0 siblings, 1 reply; 21+ messages in thread
From: Pablo Neira Ayuso @ 2018-08-17 19:38 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains Netfilter/IPVS fixes for your net tree:

1) Infinite loop in IPVS when net namespace is released, from
   Tan Hu.

2) Do not show negative timeouts in ip_vs_conn by using the new
   jiffies_delta_to_msecs(), patches from Matteo Croce.

3) Set F_IFACE flag for linklocal addresses in ip6t_rpfilter,
   from Florian Westphal.

4) Fix overflow in set size allocation, from Taehee Yoo.

5) Use netlink_dump_start() from ctnetlink to fix memleak from
   the error path, again from Florian.

6) Register nfnetlink_subsys in last place, otherwise netns
   init path may lose race and see net->nft uninitialized data.
   This also reverts previous attempt to fix this by increase
   netns refcount, patches from Florian.

7) Remove conntrack entries on layer 4 protocol tracker module
   removal, from Florian.

8) Use GFP_KERNEL_ACCOUNT for xtables blob allocation, from
   Michal Hocko.

9) Get tproxy documentation in sync with existing codebase,
   from Mate Eckl.

10) Honor preset layer 3 protocol via ctx->family in the new nft_ct
    timeout infrastructure, from Harsha Sharma.

11) Let uapi nfnetlink_osf.h compile standalone with no errors,
    from Dmitry V. Levin.

12) Missing braces compilation warning in nft_tproxy, patch from
    Mate Eclk.

13) Disregard bogus check to bail out on non-anonymous sets from
    the dynamic set update extension.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks.

----------------------------------------------------------------

The following changes since commit 9a76aba02a37718242d7cdc294f0a3901928aa57:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next (2018-08-15 15:04:25 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to feb9f55c33e5114127238a2c87c069b4f30d1f23:

  netfilter: nft_dynset: allow dynamic updates of non-anonymous set (2018-08-16 19:37:11 +0200)

----------------------------------------------------------------
Dmitry V. Levin (1):
      netfilter: uapi: fix linux/netfilter/nf_osf.h userspace compilation errors

Florian Westphal (5):
      netfilter: ip6t_rpfilter: set F_IFACE for linklocal addresses
      netfilter: fix memory leaks on netlink_dump_start error
      netfilter: nf_tables: fix register ordering
      netfilter: nf_tables: don't prevent event handler from device cleanup on netns exit
      netfilter: conntrack: fix removal of conntrack entries when l4tracker is removed

Harsha Sharma (1):
      netfilter: nft_ct: make l3 protocol field optional for timeout object

Matteo Croce (2):
      jiffies: add utility function to calculate delta in ms
      ipvs: don't show negative times in ip_vs_conn

Michal Hocko (1):
      netfilter: x_tables: do not fail xt_alloc_table_info too easilly

Máté Eckl (2):
      netfilter: doc: Add nf_tables part in tproxy.txt
      netfilter: nft_tproxy: Fix missing-braces warning

Pablo Neira Ayuso (1):
      netfilter: nft_dynset: allow dynamic updates of non-anonymous set

Taehee Yoo (1):
      netfilter: nft_set: fix allocation size overflow in privsize callback.

Tan Hu (1):
      ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest()

 Documentation/networking/tproxy.txt          | 34 ++++++++++++++++++++-----
 include/linux/jiffies.h                      |  5 ++++
 include/net/netfilter/nf_tables.h            |  6 ++---
 include/uapi/linux/netfilter/nfnetlink_osf.h |  2 ++
 include/uapi/linux/netfilter/xt_osf.h        |  2 --
 net/ipv6/netfilter/ip6t_rpfilter.c           | 12 ++++++++-
 net/netfilter/ipvs/ip_vs_conn.c              | 22 ++++++++++------
 net/netfilter/ipvs/ip_vs_core.c              | 15 ++++++++---
 net/netfilter/nf_conntrack_netlink.c         | 26 ++++++++++++-------
 net/netfilter/nf_conntrack_proto.c           | 15 +++++++----
 net/netfilter/nf_tables_api.c                | 38 ++++++++++++++++++----------
 net/netfilter/nfnetlink_acct.c               | 29 ++++++++++-----------
 net/netfilter/nft_chain_filter.c             | 14 +++++-----
 net/netfilter/nft_ct.c                       |  7 ++---
 net/netfilter/nft_dynset.c                   |  2 --
 net/netfilter/nft_set_bitmap.c               |  6 ++---
 net/netfilter/nft_set_hash.c                 |  8 +++---
 net/netfilter/nft_set_rbtree.c               |  4 +--
 net/netfilter/nft_tproxy.c                   |  4 ++-
 net/netfilter/x_tables.c                     |  7 +----
 20 files changed, 163 insertions(+), 95 deletions(-)

^ permalink raw reply	[flat|nested] 21+ messages in thread
* [PATCH 00/15] Netfilter/IPVS fixes for net
@ 2018-05-13 22:36 Pablo Neira Ayuso
  2018-05-14  1:05 ` David Miller
  0 siblings, 1 reply; 21+ messages in thread
From: Pablo Neira Ayuso @ 2018-05-13 22:36 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev

Hi David,

The following patchset contains Netfilter/IPVS fixes for your net tree,
they are:

1) Fix handling of simultaneous open TCP connection in conntrack,
   from Jozsef Kadlecsik.

2) Insufficient sanitify check of xtables extension names, from
   Florian Westphal.

3) Skip unnecessary synchronize_rcu() call when transaction log
   is already empty, from Florian Westphal.

4) Incorrect destination mac validation in ebt_stp, from Stephen
   Hemminger.

5) xtables module reference counter leak in nft_compat, from
   Florian Westphal.

6) Incorrect connection reference counting logic in IPVS
   one-packet scheduler, from Julian Anastasov.

7) Wrong stats for 32-bits CPU in IPVS, also from Julian.

8) Calm down sparse error in netfilter core, also from Florian.

9) Use nla_strlcpy to fix compilation warning in nfnetlink_acct
   and nfnetlink_cthelper, again from Florian.

10) Missing module alias in icmp and icmp6 xtables extensions,
    from Florian Westphal.

11) Base chain statistics in nf_tables may be unset/null, from Florian.

12) Fix handling of large matchinfo size in nft_compat, this includes
    one preparation for before this fix. From Florian.

13) Fix bogus EBUSY error when deleting chains due to incorrect reference
    counting from the preparation phase of the two-phase commit protocol.

You can pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks.

----------------------------------------------------------------

The following changes since commit 25eb0ea7174c6e84f21fa59dccbddd0318b17b12:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf (2018-04-25 22:55:33 -0400)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to f0dfd7a2b35b02030949100247d851b793cb275f:

  netfilter: nf_tables: fix memory leak on error exit return (2018-05-14 00:21:59 +0200)

----------------------------------------------------------------
Colin Ian King (1):
      netfilter: nf_tables: fix memory leak on error exit return

Florian Westphal (9):
      netfilter: x_tables: check name length in find_match/target, too
      netfilter: nf_tables: skip synchronize_rcu if transaction log is empty
      netfilter: nf_tables: nft_compat: fix refcount leak on xt module
      netfilter: core: add missing __rcu annotation
      netfilter: prefer nla_strlcpy for dealing with NLA_STRING attributes
      netfilter: x_tables: add module alias for icmp matches
      netfilter: nf_tables: don't assume chain stats are set when jumplabel is set
      netfilter: nft_compat: prepare for indirect info storage
      netfilter: nft_compat: fix handling of large matchinfo size

Jozsef Kadlecsik (1):
      netfilter: Fix handling simultaneous open in TCP conntrack

Julian Anastasov (2):
      ipvs: fix refcount usage for conns in ops mode
      ipvs: fix stats update from local clients

Pablo Neira Ayuso (1):
      netfilter: nf_tables: bogus EBUSY in chain deletions

Stephen Hemminger (1):
      netfilter: bridge: stp fix reference to uninitialized data

 include/net/netfilter/nf_tables.h               |   5 +
 include/uapi/linux/netfilter/nf_conntrack_tcp.h |   3 +
 net/bridge/netfilter/ebt_stp.c                  |   4 +-
 net/ipv4/netfilter/ip_tables.c                  |   1 +
 net/ipv6/netfilter/ip6_tables.c                 |   1 +
 net/netfilter/core.c                            |   3 +-
 net/netfilter/ipvs/ip_vs_conn.c                 |  17 +-
 net/netfilter/ipvs/ip_vs_core.c                 |  12 ++
 net/netfilter/nf_conntrack_proto_tcp.c          |  11 ++
 net/netfilter/nf_tables_api.c                   |  77 +++++++--
 net/netfilter/nf_tables_core.c                  |  21 ++-
 net/netfilter/nfnetlink_acct.c                  |   2 +-
 net/netfilter/nfnetlink_cthelper.c              |   7 +-
 net/netfilter/nft_compat.c                      | 201 ++++++++++++++++++------
 net/netfilter/nft_immediate.c                   |  15 +-
 net/netfilter/x_tables.c                        |   6 +
 16 files changed, 299 insertions(+), 87 deletions(-)

^ permalink raw reply	[flat|nested] 21+ messages in thread
end of thread, other threads:[~2018-08-18 17:01 UTC | newest]

Thread overview: 21+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-06-11  9:22 [PATCH 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
2018-06-11  9:22 ` [PATCH 01/15] netfilter: xt_CT: Reject the non-null terminated string from user space Pablo Neira Ayuso
2018-06-11  9:22 ` [PATCH 02/15] netfilter: nf_tables: check msg_type before nft_trans_set(trans) Pablo Neira Ayuso
2018-06-11  9:22 ` [PATCH 03/15] ipvs: register conntrack hooks for ftp Pablo Neira Ayuso
2018-06-11  9:22 ` [PATCH 04/15] netfilter: nft_reject_bridge: fix skb allocation size in nft_reject_br_send_v6_unreach Pablo Neira Ayuso
2018-06-11  9:22 ` [PATCH 05/15] ipvs: fix check on xmit to non-local addresses Pablo Neira Ayuso
2018-06-11  9:22 ` [PATCH 06/15] netfilter: ebtables: fix compat entry padding Pablo Neira Ayuso
2018-06-11  9:22 ` [PATCH 07/15] netfilter: xt_set: Check hook mask correctly Pablo Neira Ayuso
2018-06-11  9:22 ` [PATCH 08/15] netfilter: ipset: List timing out entries with "timeout 1" instead of zero Pablo Neira Ayuso
2018-06-11  9:22 ` [PATCH 09/15] netfilter: ipset: Limit max timeout value Pablo Neira Ayuso
2018-06-11  9:22 ` [PATCH 10/15] netfilter: ipset: forbid family for hash:mac sets Pablo Neira Ayuso
2018-06-11  9:22 ` [PATCH 11/15] netfilter: ebtables: reject non-bridge targets Pablo Neira Ayuso
2018-06-11  9:22 ` [PATCH 12/15] netfilter: nft_set_rbtree: fix parameter of __nft_rbtree_lookup() Pablo Neira Ayuso
2018-06-11  9:22 ` [PATCH 13/15] netfilter: nf_conntrack: Increase __IPS_MAX_BIT with new bit IPS_OFFLOAD_BIT Pablo Neira Ayuso
2018-06-11  9:22 ` [PATCH 14/15] netfilter: x_tables: initialise match/target check parameter struct Pablo Neira Ayuso
2018-06-11  9:22 ` [PATCH 15/15] netfilter: remove include/net/netfilter/nft_dup.h Pablo Neira Ayuso
2018-06-11 23:31 ` [PATCH 00/15] Netfilter/IPVS fixes for net David Miller
  -- strict thread matches above, loose matches on Subject: below --
2018-08-17 19:38 Pablo Neira Ayuso
2018-08-18 17:01 ` David Miller
2018-05-13 22:36 Pablo Neira Ayuso
2018-05-14  1:05 ` David Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).