From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-21.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,INCLUDES_PULL_REQUEST, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79E5BC07E95 for ; Wed, 7 Jul 2021 16:18:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 638E861C99 for ; Wed, 7 Jul 2021 16:18:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230154AbhGGQVb (ORCPT ); Wed, 7 Jul 2021 12:21:31 -0400 Received: from mail.netfilter.org ([217.70.188.207]:55096 "EHLO mail.netfilter.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230070AbhGGQV3 (ORCPT ); Wed, 7 Jul 2021 12:21:29 -0400 Received: from localhost.localdomain (unknown [90.77.255.23]) by mail.netfilter.org (Postfix) with ESMTPSA id 1C3FA61836; Wed, 7 Jul 2021 18:18:36 +0200 (CEST) From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, netdev@vger.kernel.org, kuba@kernel.org Subject: [PATCH net 00/11] Netfilter fixes for net Date: Wed, 7 Jul 2021 18:18:33 +0200 Message-Id: <20210707161844.20827-1-pablo@netfilter.org> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Hi, The following patchset contains Netfilter fixes for net: 1) Do not refresh timeout in SYN_SENT for syn retransmissions. Add selftest for unreplied TCP connection, from Florian Westphal. 2) Fix null dereference from error path with hardware offload in nftables. 3) Remove useless nf_ct_gre_keymap_flush() from netns exit path, from Vasily Averin. 4) Missing rcu read-lock side in ctnetlink helper info dump, also from Vasily. 5) Do not mark RST in the reply direction coming after SYN packet for an out-of-sync entry, from Ali Abdallah and Florian Westphal. 6) Add tcp_ignore_invalid_rst sysctl to allow to disable out of segment RSTs, from Ali. 7) KCSAN fix for nf_conntrack_all_lock(), from Manfred Spraul. 8) Honor NFTA_LAST_SET in nft_last. 9) Fix incorrect arithmetics when restore last_jiffies in nft_last. Please, pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git Thanks. ---------------------------------------------------------------- The following changes since commit 5140aaa4604ba96685dc04b4d2dde3384bbaecef: s390: iucv: Avoid field over-reading memcpy() (2021-07-01 15:54:01 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD for you to fetch changes up to d322957ebfb9c21c2c72b66680f7c3ccd724e081: netfilter: uapi: refer to nfnetlink_conntrack.h, not nf_conntrack_netlink.h (2021-07-07 17:39:15 +0200) ---------------------------------------------------------------- Ali Abdallah (2): netfilter: conntrack: improve RST handling when tuple is re-used netfilter: conntrack: add new sysctl to disable RST check Colin Ian King (1): netfilter: nf_tables: Fix dereference of null pointer flow Duncan Roe (1): netfilter: uapi: refer to nfnetlink_conntrack.h, not nf_conntrack_netlink.h Florian Westphal (2): selftest: netfilter: add test case for unreplied tcp connections netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state Manfred Spraul (1): netfilter: conntrack: Mark access for KCSAN Pablo Neira Ayuso (2): netfilter: nft_last: honor NFTA_LAST_SET on restoration netfilter: nft_last: incorrect arithmetics when restoring last used Vasily Averin (2): netfilter: conntrack: nf_ct_gre_keymap_flush() removal netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo Documentation/networking/nf_conntrack-sysctl.rst | 6 + include/net/netfilter/nf_conntrack_core.h | 1 - include/net/netns/conntrack.h | 1 + include/uapi/linux/netfilter/nfnetlink_log.h | 2 +- include/uapi/linux/netfilter/nfnetlink_queue.h | 4 +- net/netfilter/nf_conntrack_core.c | 11 +- net/netfilter/nf_conntrack_netlink.c | 3 + net/netfilter/nf_conntrack_proto.c | 7 - net/netfilter/nf_conntrack_proto_gre.c | 13 -- net/netfilter/nf_conntrack_proto_tcp.c | 69 ++++++--- net/netfilter/nf_conntrack_standalone.c | 10 ++ net/netfilter/nf_tables_api.c | 3 +- net/netfilter/nft_last.c | 12 +- tools/testing/selftests/netfilter/Makefile | 2 +- .../selftests/netfilter/conntrack_tcp_unreplied.sh | 167 +++++++++++++++++++++ 15 files changed, 262 insertions(+), 49 deletions(-) create mode 100755 tools/testing/selftests/netfilter/conntrack_tcp_unreplied.sh