Netdev Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH net 0/9,v2] Netfilter fixes for net
@ 2021-08-06 15:11 Pablo Neira Ayuso
  2021-08-06 15:11 ` [PATCH net 1/9] netfilter: ipset: Limit the maximal range of consecutive elements to add/delete Pablo Neira Ayuso
                   ` (9 more replies)
  0 siblings, 10 replies; 15+ messages in thread
From: Pablo Neira Ayuso @ 2021-08-06 15:11 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev, kuba

Hi,

The following patchset contains Netfilter fixes for net:

1) Restrict range element expansion in ipset to avoid soft lockup,
   from Jozsef Kadlecsik.

2) Memleak in error path for nf_conntrack_bridge for IPv4 packets,
   from Yajun Deng.

3) Simplify conntrack garbage collection strategy to avoid frequent
   wake-ups, from Florian Westphal.

4) Fix NFNLA_HOOK_FUNCTION_NAME string, do not include module name.

5) Missing chain family netlink attribute in chain description
   in nfnetlink_hook.

6) Incorrect sequence number on nfnetlink_hook dumps.

7) Use netlink request family in reply message for consistency.

8) Remove offload_pickup sysctl, use conntrack for established state
   instead, from Florian Westphal.

9) Translate NFPROTO_INET/ingress to NFPROTO_NETDEV/ingress, since
   NFPROTO_INET is not exposed through nfnetlink_hook.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

v2: This batch includes the missing rcu_read_unlock() for patch 3/9.

Thanks!

----------------------------------------------------------------

The following changes since commit c7d102232649226a69dddd58a4942cf13cff4f7c:

  Merge tag 'net-5.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2021-07-30 16:01:36 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 269fc69533de73a9065c0b7971bcd109880290b3:

  netfilter: nfnetlink_hook: translate inet ingress to netdev (2021-08-06 17:07:41 +0200)

----------------------------------------------------------------
Florian Westphal (2):
      netfilter: conntrack: collect all entries in one cycle
      netfilter: conntrack: remove offload_pickup sysctl again

Jozsef Kadlecsik (1):
      netfilter: ipset: Limit the maximal range of consecutive elements to add/delete

Pablo Neira Ayuso (5):
      netfilter: nfnetlink_hook: strip off module name from hookfn
      netfilter: nfnetlink_hook: missing chain family
      netfilter: nfnetlink_hook: use the sequence number of the request message
      netfilter: nfnetlink_hook: Use same family as request message
      netfilter: nfnetlink_hook: translate inet ingress to netdev

Yajun Deng (1):
      netfilter: nf_conntrack_bridge: Fix memory leak when error

 Documentation/networking/nf_conntrack-sysctl.rst | 10 ----
 include/linux/netfilter/ipset/ip_set.h           |  3 +
 include/net/netns/conntrack.h                    |  2 -
 include/uapi/linux/netfilter/nfnetlink_hook.h    |  9 +++
 net/bridge/netfilter/nf_conntrack_bridge.c       |  6 ++
 net/netfilter/ipset/ip_set_hash_ip.c             |  9 ++-
 net/netfilter/ipset/ip_set_hash_ipmark.c         | 10 +++-
 net/netfilter/ipset/ip_set_hash_ipport.c         |  3 +
 net/netfilter/ipset/ip_set_hash_ipportip.c       |  3 +
 net/netfilter/ipset/ip_set_hash_ipportnet.c      |  3 +
 net/netfilter/ipset/ip_set_hash_net.c            | 11 +++-
 net/netfilter/ipset/ip_set_hash_netiface.c       | 10 +++-
 net/netfilter/ipset/ip_set_hash_netnet.c         | 16 +++++-
 net/netfilter/ipset/ip_set_hash_netport.c        | 11 +++-
 net/netfilter/ipset/ip_set_hash_netportnet.c     | 16 +++++-
 net/netfilter/nf_conntrack_core.c                | 71 ++++++++----------------
 net/netfilter/nf_conntrack_proto_tcp.c           |  1 -
 net/netfilter/nf_conntrack_proto_udp.c           |  1 -
 net/netfilter/nf_conntrack_standalone.c          | 16 ------
 net/netfilter/nf_flow_table_core.c               | 11 +++-
 net/netfilter/nfnetlink_hook.c                   | 24 ++++++--
 21 files changed, 151 insertions(+), 95 deletions(-)

^ permalink raw reply	[flat|nested] 15+ messages in thread
* [PATCH net 0/9] Netfilter fixes for net
@ 2021-08-06 11:51 Pablo Neira Ayuso
  2021-08-06 11:52 ` [PATCH net 3/9] netfilter: conntrack: collect all entries in one cycle Pablo Neira Ayuso
  0 siblings, 1 reply; 15+ messages in thread
From: Pablo Neira Ayuso @ 2021-08-06 11:51 UTC (permalink / raw)
  To: netfilter-devel; +Cc: davem, netdev, kuba

Hi,

The following patchset contains Netfilter fixes for net:

1) Restrict range element expansion in ipset to avoid soft lockup,
   from Jozsef Kadlecsik.

2) Memleak in error path for nf_conntrack_bridge for IPv4 packets,
   from Yajun Deng.

3) Simplify conntrack garbage collection strategy to avoid frequent
   wake-ups, from Florian Westphal.

4) Fix NFNLA_HOOK_FUNCTION_NAME string, do not include module name.

5) Missing chain family netlink attribute in chain description
   in nfnetlink_hook.

6) Incorrect sequence number on nfnetlink_hook dumps.

7) Use netlink request family in reply message for consistency.

8) Remove offload_pickup sysctl, use conntrack for established state
   instead, from Florian Westphal.

9) Translate NFPROTO_INET/ingress to NFPROTO_NETDEV/ingress, since
   NFPROTO_INET is not exposed through nfnetlink_hook.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit c7d102232649226a69dddd58a4942cf13cff4f7c:

  Merge tag 'net-5.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2021-07-30 16:01:36 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to 80c904e92f26540b7dae116caa22e043bfa63b45:

  netfilter: nfnetlink_hook: translate inet ingress to netdev (2021-08-06 12:49:08 +0200)

----------------------------------------------------------------
Florian Westphal (2):
      netfilter: conntrack: collect all entries in one cycle
      netfilter: conntrack: remove offload_pickup sysctl again

Jozsef Kadlecsik (1):
      netfilter: ipset: Limit the maximal range of consecutive elements to add/delete

Pablo Neira Ayuso (5):
      netfilter: nfnetlink_hook: strip off module name from hookfn
      netfilter: nfnetlink_hook: missing chain family
      netfilter: nfnetlink_hook: use the sequence number of the request message
      netfilter: nfnetlink_hook: Use same family as request message
      netfilter: nfnetlink_hook: translate inet ingress to netdev

Yajun Deng (1):
      netfilter: nf_conntrack_bridge: Fix memory leak when error

 Documentation/networking/nf_conntrack-sysctl.rst | 10 ----
 include/linux/netfilter/ipset/ip_set.h           |  3 ++
 include/net/netns/conntrack.h                    |  2 -
 include/uapi/linux/netfilter/nfnetlink_hook.h    |  9 ++++
 net/bridge/netfilter/nf_conntrack_bridge.c       |  6 +++
 net/netfilter/ipset/ip_set_hash_ip.c             |  9 +++-
 net/netfilter/ipset/ip_set_hash_ipmark.c         | 10 +++-
 net/netfilter/ipset/ip_set_hash_ipport.c         |  3 ++
 net/netfilter/ipset/ip_set_hash_ipportip.c       |  3 ++
 net/netfilter/ipset/ip_set_hash_ipportnet.c      |  3 ++
 net/netfilter/ipset/ip_set_hash_net.c            | 11 +++-
 net/netfilter/ipset/ip_set_hash_netiface.c       | 10 +++-
 net/netfilter/ipset/ip_set_hash_netnet.c         | 16 +++++-
 net/netfilter/ipset/ip_set_hash_netport.c        | 11 +++-
 net/netfilter/ipset/ip_set_hash_netportnet.c     | 16 +++++-
 net/netfilter/nf_conntrack_core.c                | 67 +++++++-----------------
 net/netfilter/nf_conntrack_proto_tcp.c           |  1 -
 net/netfilter/nf_conntrack_proto_udp.c           |  1 -
 net/netfilter/nf_conntrack_standalone.c          | 16 ------
 net/netfilter/nf_flow_table_core.c               | 11 ++--
 net/netfilter/nfnetlink_hook.c                   | 24 ++++++---
 21 files changed, 148 insertions(+), 94 deletions(-)

^ permalink raw reply	[flat|nested] 15+ messages in thread

end of thread, other threads:[~2021-08-06 22:33 UTC | newest]

Thread overview: 15+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-06 15:11 [PATCH net 0/9,v2] Netfilter fixes for net Pablo Neira Ayuso
2021-08-06 15:11 ` [PATCH net 1/9] netfilter: ipset: Limit the maximal range of consecutive elements to add/delete Pablo Neira Ayuso
2021-08-06 15:11 ` [PATCH net 2/9] netfilter: nf_conntrack_bridge: Fix memory leak when error Pablo Neira Ayuso
2021-08-06 15:11 ` [PATCH net 3/9] netfilter: conntrack: collect all entries in one cycle Pablo Neira Ayuso
2021-08-06 15:11 ` [PATCH net 4/9] netfilter: nfnetlink_hook: strip off module name from hookfn Pablo Neira Ayuso
2021-08-06 15:11 ` [PATCH net 5/9] netfilter: nfnetlink_hook: missing chain family Pablo Neira Ayuso
2021-08-06 15:11 ` [PATCH net 6/9] netfilter: nfnetlink_hook: use the sequence number of the request message Pablo Neira Ayuso
2021-08-06 15:11 ` [PATCH net 7/9] netfilter: nfnetlink_hook: Use same family as " Pablo Neira Ayuso
2021-08-06 15:11 ` [PATCH net 8/9] netfilter: conntrack: remove offload_pickup sysctl again Pablo Neira Ayuso
2021-08-06 15:11 ` [PATCH net 9/9] netfilter: nfnetlink_hook: translate inet ingress to netdev Pablo Neira Ayuso
2021-08-06 22:33 ` [PATCH net 0/9,v2] Netfilter fixes for net Jakub Kicinski
  -- strict thread matches above, loose matches on Subject: below --
2021-08-06 11:51 [PATCH net 0/9] " Pablo Neira Ayuso
2021-08-06 11:52 ` [PATCH net 3/9] netfilter: conntrack: collect all entries in one cycle Pablo Neira Ayuso
2021-08-06 13:27   ` Jakub Kicinski
2021-08-06 14:59     ` Pablo Neira Ayuso
2021-08-06 15:06       ` Jakub Kicinski

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).