Re: [PATCH 00/12] Netfilter/IPVS fixes for net
From: Pablo Neira AyusoDate: Mon, 23 Apr 2018 19:57:02 +0200 > The following patchset contains Netfilter/IPVS fixes for your net tree, > they are: ... > You can pull these changes from: > > git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git Pulled, thank you. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
[PATCH 00/12] Netfilter/IPVS fixes for net
Hi David, The following patchset contains Netfilter/IPVS fixes for your net tree, they are: 1) Fix SIP conntrack with phones sending session descriptions for different media types but same port numbers, from Florian Westphal. 2) Fix incorrect rtnl_lock mutex logic from IPVS sync thread, from Julian Anastasov. 3) Skip compat array allocation in ebtables if there is no entries, also from Florian. 4) Do not lose left/right bits when shifting marks from xt_connmark, from Jack Ma. 5) Silence false positive memleak in conntrack extensions, from Cong Wang. 6) Fix CONFIG_NF_REJECT_IPV6=m link problems, from Arnd Bergmann. 7) Cannot kfree rule that is already in list in nf_tables, switch order so this error handling is not required, from Florian Westphal. 8) Release set name in error path, from Florian. 9) include kmemleak.h in nf_conntrack_extend.c, from Stepheh Rothwell. 10) NAT chain and extensions depend on NF_TABLES. 11) Out of bound access when renaming chains, from Taehee Yoo. 12) Incorrect casting in xt_connmark leads to wrong bitshifting. You can pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git Thanks. The following changes since commit a2ac99905f1ea8b15997a6ec39af69aa28a3653b: vhost-net: set packet weight of tx polling to 2 * vq size (2018-04-09 11:01:37 -0400) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD for you to fetch changes up to 5a786232eb69a1f870ddc0cfd69d5bdef241a2ea: netfilter: xt_connmark: do not cast xt_connmark_tginfo1 to xt_connmark_tginfo2 (2018-04-19 16:19:28 +0200) Arnd Bergmann (1): netfilter: fix CONFIG_NF_REJECT_IPV6=m link error Cong Wang (1): netfilter: conntrack: silent a memory leak warning Florian Westphal (4): netfilter: nf_conntrack_sip: allow duplicate SDP expectations netfilter: ebtables: don't attempt to allocate 0-sized compat array netfilter: nf_tables: can't fail after linking rule into active rule list netfilter: nf_tables: free set name in error path Jack Ma (1): netfilter: xt_connmark: Add bit mapping for bit-shift operation. Julian Anastasov (1): ipvs: fix rtnl_lock lockups caused by start_sync_thread Pablo Neira Ayuso (2): netfilter: nf_tables: NAT chain and extensions require NF_TABLES netfilter: xt_connmark: do not cast xt_connmark_tginfo1 to xt_connmark_tginfo2 Stephen Rothwell (1): netfilter: conntrack: include kmemleak.h for kmemleak_not_leak() Taehee Yoo (1): netfilter: nf_tables: fix out-of-bounds in nft_chain_commit_update net/bridge/netfilter/ebtables.c | 11 +-- net/ipv6/netfilter/Kconfig | 55 ++--- net/netfilter/Kconfig | 1 + net/netfilter/ipvs/ip_vs_ctl.c | 8 -- net/netfilter/ipvs/ip_vs_sync.c | 155 +++- net/netfilter/nf_conntrack_expect.c | 5 +- net/netfilter/nf_conntrack_extend.c | 2 + net/netfilter/nf_conntrack_sip.c| 16 +++- net/netfilter/nf_tables_api.c | 69 net/netfilter/xt_connmark.c | 49 +++- 10 files changed, 200 insertions(+), 171 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH 00/12] Netfilter/IPVS fixes for net
From: Pablo Neira AyusoDate: Mon, 9 Oct 2017 18:25:34 +0200 > The following patchset contains Netfilter/IPVS fixes for your net tree, > they are: ... > You can pull these changes from: > > git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git Pulled, thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
[PATCH 00/12] Netfilter/IPVS fixes for net
Hi David, The following patchset contains Netfilter/IPVS fixes for your net tree, they are: 1) Fix packet drops due to incorrect ECN handling in IPVS, from Vadim Fedorenko. 2) Fix splat with mark restoration in xt_socket with non-full-sock, patch from Subash Abhinov Kasiviswanathan. 3) ipset bogusly bails out when adding IPv4 range containing more than 2^31 addresses, from Jozsef Kadlecsik. 4) Incorrect pernet unregistration order in ipset, from Florian Westphal. 5) Races between dump and swap in ipset results in BUG_ON splats, from Ross Lagerwall. 6) Fix chain renames in nf_tables, from JingPiao Chen. 7) Fix race in pernet codepath with ebtables table registration, from Artem Savkov. 8) Memory leak in error path in set name allocation in nf_tables, patch from Arvind Yadav. 9) Don't dump chain counters if they are not available, this fixes a crash when listing the ruleset. 10) Fix out of bound memory read in strlcpy() in x_tables compat code, from Eric Dumazet. 11) Make sure we only process TCP packets in SYNPROXY hooks, patch from Lin Zhang. 12) Cannot load rules incrementally anymore after xt_bpf with pinned objects, added in revision 1. From Shmulik Ladkani. You can pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git Thanks! The following changes since commit b4391db42308c9940944b5d7be5ca4b78fb88dd0: netlink: fix nla_put_{u8,u16,u32} for KASAN (2017-09-25 20:18:27 -0700) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD for you to fetch changes up to 98589a0998b8b13c4a8fa1ccb0e62751a019faa5: netfilter: xt_bpf: Fix XT_BPF_MODE_FD_PINNED mode of 'xt_bpf_info_v1' (2017-10-09 15:18:04 +0200) Artem Savkov (1): netfilter: ebtables: fix race condition in frame_filter_net_init() Arvind Yadav (1): netfilter: nf_tables: Release memory obtained by kasprintf Eric Dumazet (1): netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user Florian Westphal (1): netfilter: ipset: pernet ops must be unregistered last JingPiao Chen (1): netfilter: nf_tables: fix update chain error Jozsef Kadlecsik (1): netfilter: ipset: Fix adding an IPv4 range containing more than 2^31 addresses Lin Zhang (1): netfilter: SYNPROXY: skip non-tcp packet in {ipv4, ipv6}_synproxy_hook Pablo Neira Ayuso (1): netfilter: nf_tables: do not dump chain counters if not enabled Ross Lagerwall (1): netfilter: ipset: Fix race between dump and swap Shmulik Ladkani (1): netfilter: xt_bpf: Fix XT_BPF_MODE_FD_PINNED mode of 'xt_bpf_info_v1' Subash Abhinov Kasiviswanathan (1): netfilter: xt_socket: Restore mark from full sockets only Vadim Fedorenko (1): netfilter: ipvs: full-functionality option for ECN encapsulation in tunnel include/linux/bpf.h | 5 + include/linux/netfilter_bridge/ebtables.h| 7 --- include/uapi/linux/netfilter/xt_bpf.h| 1 + kernel/bpf/inode.c | 1 + net/bridge/netfilter/ebtable_broute.c| 4 ++-- net/bridge/netfilter/ebtable_filter.c| 4 ++-- net/bridge/netfilter/ebtable_nat.c | 4 ++-- net/bridge/netfilter/ebtables.c | 17 net/ipv4/netfilter/ipt_SYNPROXY.c| 3 ++- net/ipv6/netfilter/ip6t_SYNPROXY.c | 2 +- net/netfilter/ipset/ip_set_core.c| 29 +--- net/netfilter/ipset/ip_set_hash_ip.c | 22 +++-- net/netfilter/ipset/ip_set_hash_ipmark.c | 2 +- net/netfilter/ipset/ip_set_hash_ipport.c | 2 +- net/netfilter/ipset/ip_set_hash_ipportip.c | 2 +- net/netfilter/ipset/ip_set_hash_ipportnet.c | 4 ++-- net/netfilter/ipset/ip_set_hash_net.c| 2 +- net/netfilter/ipset/ip_set_hash_netiface.c | 2 +- net/netfilter/ipset/ip_set_hash_netnet.c | 4 ++-- net/netfilter/ipset/ip_set_hash_netport.c| 2 +- net/netfilter/ipset/ip_set_hash_netportnet.c | 4 ++-- net/netfilter/ipvs/ip_vs_xmit.c | 8 ++-- net/netfilter/nf_tables_api.c| 10 ++ net/netfilter/x_tables.c | 4 ++-- net/netfilter/xt_bpf.c | 22 +++-- net/netfilter/xt_socket.c| 4 ++-- 26 files changed, 107 insertions(+), 64 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH 00/12] Netfilter/IPVS fixes for net
From: David MillerDate: Mon, 22 May 2017 19:54:44 -0400 (EDT) > From: Pablo Neira Ayuso > Date: Mon, 22 May 2017 00:25:38 +0200 > >> Could you merge net into net-next as well? I have several patches for >> net-next that need to apply on these fixes. No rush BTW. > > Sure, no problem. > > As soon as Linus takes in my pull request from today, I will do this > and let you know. This is now done. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH 00/12] Netfilter/IPVS fixes for net
From: Pablo Neira AyusoDate: Mon, 22 May 2017 00:25:38 +0200 > Could you merge net into net-next as well? I have several patches for > net-next that need to apply on these fixes. No rush BTW. Sure, no problem. As soon as Linus takes in my pull request from today, I will do this and let you know. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH 00/12] Netfilter/IPVS fixes for net
On Sun, May 21, 2017 at 01:00:33PM -0400, David Miller wrote: > From: Pablo Neira Ayuso> Date: Fri, 19 May 2017 10:33:41 +0200 > > > The following patchset contains Netfilter/IPVS fixes for your net tree, > > they are: > ... > > You can pull these changes from: > > > > git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git > > Pulled, thanks Pablo. Thanks David! Could you merge net into net-next as well? I have several patches for net-next that need to apply on these fixes. No rush BTW. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH 00/12] Netfilter/IPVS fixes for net
From: Pablo Neira AyusoDate: Fri, 19 May 2017 10:33:41 +0200 > The following patchset contains Netfilter/IPVS fixes for your net tree, > they are: ... > You can pull these changes from: > > git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git Pulled, thanks Pablo. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
[PATCH 00/12] Netfilter/IPVS fixes for net
Hi David, The following patchset contains Netfilter/IPVS fixes for your net tree, they are: 1) When using IPVS in direct-routing mode, normal traffic from the LVS host to a back-end server is sometimes incorrectly NATed on the way back into the LVS host. Patch to fix this from Julian Anastasov. 2) Calm down clang compilation warning in ctnetlink due to type mismatch, from Matthias Kaehlcke. 3) Do not re-setup NAT for conntracks that are already confirmed, this is fixing a problem that was introduced in the previous nf-next batch. Patch from Liping Zhang. 4) Do not allow conntrack helper removal from userspace cthelper infrastructure if already in used. This comes with an initial patch to introduce nf_conntrack_helper_put() that is required by this fix. From Liping Zhang. 5) Zero the pad when copying data to userspace, otherwise iptables fails to remove rules. This is a follow up on the patchset that sorts out the internal match/target structure pointer leak to userspace. Patch from the same author, Willem de Bruijn. This also comes with a build failure when CONFIG_COMPAT is not on, coming in the last patch of this series. 6) SYNPROXY crashes with conntrack entries that are created via ctnetlink, more specifically via conntrackd state sync. Patch from Eric Leblond. 7) RCU safe iteration on set element dumping in nf_tables, from Liping Zhang. 8) Missing sanitization of immediate date for the bitwise and cmp expressions in nf_tables. 9) Refcounting logic for chain and objects from set elements does not integrate into the nf_tables 2-phase commit protocol. 10) Missing sanitization of target verdict in ebtables arpreply target, from Gao Feng. You can pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git Thanks! The following changes since commit 1c4d5f51a812a82de97beee24f48ed05c65ebda5: vmxnet3: ensure that adapter is in proper state during force_close (2017-05-12 12:23:52 -0400) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD for you to fetch changes up to 751a9c763849f5859cb69ea44b0430d00672f637: netfilter: xtables: fix build failure from COMPAT_XT_ALIGN outside CONFIG_COMPAT (2017-05-18 13:10:03 +0200) Eric Leblond (1): netfilter: synproxy: fix conntrackd interaction Gao Feng (1): ebtables: arpreply: Add the standard target sanity check Julian Anastasov (1): ipvs: SNAT packet replies only for NATed connections Liping Zhang (4): netfilter: don't setup nat info for confirmed ct netfilter: introduce nf_conntrack_helper_put helper function netfilter: nfnl_cthelper: reject del request if helper obj is in use netfilter: nf_tables: can't assume lock is acquired when dumping set elems Matthias Kaehlcke (1): netfilter: ctnetlink: Make some parameters integer to avoid enum mismatch Pablo Neira Ayuso (3): Merge tag 'ipvs-fixes-for-v4.12' of http://git.kernel.org/.../horms/ipvs netfilter: nf_tables: missing sanitization in data from userspace netfilter: nf_tables: revisit chain/object refcounting from elements Willem de Bruijn (2): netfilter: xtables: zero padding in data_to_user netfilter: xtables: fix build failure from COMPAT_XT_ALIGN outside CONFIG_COMPAT include/linux/netfilter/x_tables.h | 2 +- include/linux/netfilter_bridge/ebtables.h | 5 + include/net/netfilter/nf_conntrack_helper.h | 4 + include/net/netfilter/nf_tables.h | 2 +- net/bridge/netfilter/ebt_arpreply.c | 3 + net/bridge/netfilter/ebtables.c | 9 +- net/netfilter/ipvs/ip_vs_core.c | 19 +++- net/netfilter/nf_conntrack_helper.c | 12 +++ net/netfilter/nf_conntrack_netlink.c| 11 +- net/netfilter/nf_nat_core.c | 4 + net/netfilter/nf_tables_api.c | 160 ++-- net/netfilter/nfnetlink_cthelper.c | 17 +-- net/netfilter/nft_bitwise.c | 19 +++- net/netfilter/nft_cmp.c | 12 ++- net/netfilter/nft_ct.c | 4 +- net/netfilter/nft_immediate.c | 5 +- net/netfilter/nft_range.c | 4 +- net/netfilter/nft_set_hash.c| 2 +- net/netfilter/x_tables.c| 24 +++-- net/netfilter/xt_CT.c | 6 +- net/openvswitch/conntrack.c | 4 +- 21 files changed, 249 insertions(+), 79 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html