From: "Rafał Miłecki" <zajec5@gmail.com>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: netfilter-devel@vger.kernel.org,
Network Development <netdev@vger.kernel.org>,
David Miller <davem@davemloft.net>
Subject: Re: [PATCH 00/47] Netfilter/IPVS updates for net-next
Date: Tue, 3 Apr 2018 08:13:49 +0200 [thread overview]
Message-ID: <fbd3cd82-cece-74cb-2305-bbb6980b52cc@gmail.com> (raw)
In-Reply-To: <20180330113729.18335-1-pablo@netfilter.org>
Hi Pablo,
> The following patchset contains Netfilter/IPVS updates for your net-next
> tree. This batch comes with more input sanitization for xtables to
> address bug reports from fuzzers, preparation works to the flowtable
> infrastructure and assorted updates. In no particular order, they are:
>
> 1) Make sure userspace provides a valid standard target verdict, from
> Florian Westphal.
>
> 2) Sanitize error target size, also from Florian.
>
> 3) Validate that last rule in basechain matches underflow/policy since
> userspace assumes this when decoding the ruleset blob that comes
> from the kernel, from Florian.
>
> 4) Consolidate hook entry checks through xt_check_table_hooks(),
> patch from Florian.
>
> 5) Cap ruleset allocations at 512 mbytes, 134217728 rules and reject
> very large compat offset arrays, so we have a reasonable upper limit
> and fuzzers don't exercise the oom-killer. Patches from Florian.
>
> 6) Several WARN_ON checks on xtables mutex helper, from Florian.
>
> 7) xt_rateest now has a hashtable per net, from Cong Wang.
>
> 8) Consolidate counter allocation in xt_counters_alloc(), from Florian.
>
> 9) Earlier xt_table_unlock() call in {ip,ip6,arp,eb}tables, patch
> from Xin Long.
>
> 10) Set FLOW_OFFLOAD_DIR_* to IP_CT_DIR_* definitions, patch from
> Felix Fietkau.
>
> 11) Consolidate code through flow_offload_fill_dir(), also from Felix.
>
> 12) Inline ip6_dst_mtu_forward() just like ip_dst_mtu_maybe_forward()
> to remove a dependency with flowtable and ipv6.ko, from Felix.
>
> 13) Cache mtu size in flow_offload_tuple object, this is safe for
> forwarding as f87c10a8aa1e describes, from Felix.
>
> 14) Rename nf_flow_table.c to nf_flow_table_core.o, to simplify too
> modular infrastructure, from Felix.
I see you mentioned changes from Felix in the pull request but:
1) I don't see any commits from Felix listed below
2) I don't think you sent any of these patches
Can you take a look at what has happened to them, please?
next prev parent reply other threads:[~2018-04-03 6:13 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-30 11:36 [PATCH 00/47] Netfilter/IPVS updates for net-next Pablo Neira Ayuso
2018-03-30 11:36 ` [PATCH 01/47] netfilter: nf_tables: nf_tables_obj_lookup_byhandle() can be static Pablo Neira Ayuso
2018-03-30 11:36 ` [PATCH 02/47] netfilter: nfnetlink_acct: remove useless parameter Pablo Neira Ayuso
2018-03-30 11:36 ` [PATCH 03/47] netfilter: xt_cluster: get rid of xt_cluster_ipv6_is_multicast Pablo Neira Ayuso
2018-03-30 11:36 ` [PATCH 04/47] netfilter: nf_conntrack_broadcast: remove useless parameter Pablo Neira Ayuso
2018-03-30 11:36 ` [PATCH 05/47] netfilter: ipt_ah: return boolean instead of integer Pablo Neira Ayuso
2018-03-30 11:36 ` [PATCH 06/47] netfilter: unlock xt_table earlier in __do_replace Pablo Neira Ayuso
2018-03-30 11:36 ` [PATCH 07/47] netfilter: x_tables: check standard verdicts in core Pablo Neira Ayuso
2018-03-30 11:36 ` [PATCH 08/47] netfilter: x_tables: check error target size too Pablo Neira Ayuso
2018-03-30 11:36 ` [PATCH 09/47] netfilter: x_tables: move hook entry checks into core Pablo Neira Ayuso
2018-03-30 15:43 ` [PATCH 00/47] Netfilter/IPVS updates for net-next David Miller
2018-04-03 6:13 ` Rafał Miłecki [this message]
2018-04-03 10:19 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=fbd3cd82-cece-74cb-2305-bbb6980b52cc@gmail.com \
--to=zajec5@gmail.com \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).