| Message ID | 20190814092440.20087-1-pablo@netfilter.org |
|---|---|
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: Wed, 14 Aug 2019 11:24:33 +0200 > This patchset contains Netfilter fixes for net: > > 1) Extend selftest to cover flowtable with ipsec, from Florian Westphal. > > 2) Fix interaction of ipsec with flowtable, also from Florian. > > 3) User-after-free with bound set to rule that fails to load. > > 4) Adjust state and timeout for flows that expire. > > 5) Timeout update race with flows in teardown state. > > 6) Ensure conntrack id hash calculation use invariants as input, > from Dirk Morris. > > 7) Do not push flows into flowtable for TCP fin/rst packets. > > You can pull these changes from: > > git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git Pulled, thanks.
Hi, This patchset contains Netfilter fixes for net: 1) Extend selftest to cover flowtable with ipsec, from Florian Westphal. 2) Fix interaction of ipsec with flowtable, also from Florian. 3) User-after-free with bound set to rule that fails to load. 4) Adjust state and timeout for flows that expire. 5) Timeout update race with flows in teardown state. 6) Ensure conntrack id hash calculation use invariants as input, from Dirk Morris. 7) Do not push flows into flowtable for TCP fin/rst packets. You can pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git Thanks. ---------------------------------------------------------------- The following changes since commit 5e5412c365a32e452daa762eac36121cb8a370bb: net/socket: fix GCC8+ Wpacked-not-aligned warnings (2019-08-03 11:02:46 -0700) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD for you to fetch changes up to dfe42be15fde16232340b8b2a57c359f51cc10d9: netfilter: nft_flow_offload: skip tcp rst and fin packets (2019-08-14 11:09:07 +0200) ---------------------------------------------------------------- Dirk Morris (1): netfilter: conntrack: Use consistent ct id hash calculation Florian Westphal (2): selftests: netfilter: extend flowtable test script for ipsec netfilter: nf_flow_table: fix offload for flows that are subject to xfrm Pablo Neira Ayuso (4): netfilter: nf_tables: use-after-free in failing rule with bound set netfilter: nf_flow_table: conntrack picks up expired flows netfilter: nf_flow_table: teardown flow timeout race netfilter: nft_flow_offload: skip tcp rst and fin packets include/net/netfilter/nf_tables.h | 9 +++- net/netfilter/nf_conntrack_core.c | 16 ++++---- net/netfilter/nf_flow_table_core.c | 43 +++++++++++++------ net/netfilter/nf_flow_table_ip.c | 43 +++++++++++++++++++ net/netfilter/nf_tables_api.c | 15 ++++--- net/netfilter/nft_flow_offload.c | 9 ++-- tools/testing/selftests/netfilter/nft_flowtable.sh | 48 ++++++++++++++++++++++ 7 files changed, 153 insertions(+), 30 deletions(-)