| Message ID | 20181105232832.21896-1-pablo@netfilter.org |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: Tue, 6 Nov 2018 00:28:18 +0100 > The following patchset contains the first batch of Netfilter fixes for > your net tree: ... > You can pull these changes from: > > git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git Pulled, thank you.
Hi David, The following patchset contains the first batch of Netfilter fixes for your net tree: 1) Fix splat with IPv6 defragmenting locally generated fragments, from Florian Westphal. 2) Fix Incorrect check for missing attribute in nft_osf. 3) Missing INT_MIN & INT_MAX definition for netfilter bridge uapi header, from Jiri Slaby. 4) Revert map lookup in nft_numgen, this is already possible with the existing infrastructure without this extension. 5) Fix wrong listing of set reference counter, make counter synchronous again, from Stefano Brivio. 6) Fix CIDR 0 in hash:net,port,net, from Eric Westbrook. 7) Fix allocation failure with large set, use kvcalloc(). From Andrey Ryabinin. 8) No need to disable BH when fetch ip set comment, patch from Jozsef Kadlecsik. 9) Sanity check for valid sysfs entry in xt_IDLETIMER, from Taehee Yoo. 10) Fix suspicious rcu usage via ip_set() macro at netlink dump, from Jozsef Kadlecsik. 11) Fix setting default timeout via nfnetlink_cttimeout, this comes with preparation patch to add nf_{tcp,udp,...}_pernet() helper. 12) Allow ebtables table nat to be of filter type via nft_compat. From Florian Westphal. 13) Incorrect calculation of next bucket in early_drop, do no bump hash value, update bucket counter instead. From Vasily Khoruzhick. You can pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git Thanks! ---------------------------------------------------------------- The following changes since commit 4f3ebb04d05fe36f74ef17c6ee06559626d47964: Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue (2018-10-24 16:27:33 -0700) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD for you to fetch changes up to f393808dc64149ccd0e5a8427505ba2974a59854: netfilter: conntrack: fix calculation of next bucket number in early_drop (2018-11-03 14:16:28 +0100) ---------------------------------------------------------------- Andrey Ryabinin (1): netfilter: ipset: fix ip_set_list allocation failure Eric Westbrook (1): netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net Florian Westphal (2): netfilter: ipv6: fix oops when defragmenting locally generated fragments netfilter: nft_compat: ebtables 'nat' table is normal chain type Jiri Slaby (1): netfilter: bridge: define INT_MIN & INT_MAX in userspace Jozsef Kadlecsik (2): netfilter: ipset: Correct rcu_dereference() call in ip_set_put_comment() netfilter: ipset: Fix calling ip_set() macro at dumping Pablo Neira Ayuso (4): netfilter: nft_osf: check if attribute is present Revert "netfilter: nft_numgen: add map lookups for numgen random operations" netfilter: conntrack: add nf_{tcp,udp,sctp,icmp,dccp,icmpv6,generic}_pernet() netfilter: nfnetlink_cttimeout: pass default timeout policy to obj_to_nlattr Stefano Brivio (1): netfilter: ipset: list:set: Decrease refcount synchronously on deletion and replace Taehee Yoo (1): netfilter: xt_IDLETIMER: add sysfs filename checking routine Vasily Khoruzhick (1): netfilter: conntrack: fix calculation of next bucket number in early_drop include/linux/netfilter/ipset/ip_set.h | 2 +- include/linux/netfilter/ipset/ip_set_comment.h | 4 +- include/net/netfilter/nf_conntrack_l4proto.h | 39 ++++++++ include/uapi/linux/netfilter/nf_tables.h | 4 +- include/uapi/linux/netfilter_bridge.h | 4 + net/ipv6/netfilter/nf_conntrack_reasm.c | 13 ++- net/netfilter/ipset/ip_set_core.c | 43 +++++---- net/netfilter/ipset/ip_set_hash_netportnet.c | 8 +- net/netfilter/ipset/ip_set_list_set.c | 17 ++-- net/netfilter/nf_conntrack_core.c | 13 ++- net/netfilter/nf_conntrack_proto_dccp.c | 13 +-- net/netfilter/nf_conntrack_proto_generic.c | 11 +-- net/netfilter/nf_conntrack_proto_icmp.c | 11 +-- net/netfilter/nf_conntrack_proto_icmpv6.c | 11 +-- net/netfilter/nf_conntrack_proto_sctp.c | 11 +-- net/netfilter/nf_conntrack_proto_tcp.c | 15 +-- net/netfilter/nf_conntrack_proto_udp.c | 11 +-- net/netfilter/nfnetlink_cttimeout.c | 47 +++++++-- net/netfilter/nft_compat.c | 21 ++-- net/netfilter/nft_numgen.c | 127 ------------------------- net/netfilter/nft_osf.c | 2 +- net/netfilter/xt_IDLETIMER.c | 20 ++++ 22 files changed, 200 insertions(+), 247 deletions(-)