iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/ipv4
History
Jakub Kicinski 925781a471 netfilter pull request 24-01-18 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEN9lkrMBJgcdVAPub1V2XiooUIOQFAmWpTnYACgkQ1V2XiooU
 IOQYpw//ZL9MkD3EIAB/D7dtqj7Oz9XssIqN/RDqq1NEFojH6u1OxRB2cYOxtvRD
 iAUf3LLPY/NucEFoEHmNWg3mmG9mwwkXMIikJrGa9QmEfr/a5XBQSfSUB3rf8F9F
 bLvQ056Zb0g+jJTi8iOYOouN1O4LIhfZveVJQf72tmw3Gqw87Sc1HGJL1x/QHhvb
 0vWzCb2AQOOyRVSLE3uYJYXI3AU/owM+axBUDk8RNmgkeJLDdwN8E56UQIW1X6Y9
 i0Xp5QZfH4KGj8Ffy/mcCmYYItGldVViZuvqB8qBKV6+PhMNbqHuQQsRLbL5M0GS
 oFeRmaUfuJfxLF9lm3SUDtELFXNlzeW4kK/wOGUMcXlg3fZHmJx+TfWg9N86ANqC
 ripNA8hrQO6wuBIk7DByykS8tkCWyS17s4r2hxU/3uTAHv9KxsLymE82YrDzGL1e
 Er9qd4waGnfZWCgLirJ/YMmPvVP33yJ3JSmjclp/3m54pijiejzsuUNDlUiMG1EE
 ekAawU91X/NuTGAtr+JGUG5TyHwWxodIKxPWGSf7Zes39jJzqDGydA56+A5w2Qdr
 aWSzDY1fMEfb9gegpd42lW+hhN+ZLzZuKuA8m3SxCXQx7/1dU+AzV21B93endzlL
 VxRO10W5LqxODsm0jl8rOdcOvBsC1gqLaf9kZQlGU6BG1AHYfEs=
 =DHHp
 -----END PGP SIGNATURE-----

Merge tag 'nf-24-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following batch contains Netfilter fixes for net. Slightly larger
than usual because this batch includes several patches to tighten the
nf_tables control plane to reject inconsistent configuration:

1) Restrict NFTA_SET_POLICY to NFT_SET_POL_PERFORMANCE and
   NFT_SET_POL_MEMORY.

2) Bail out if a nf_tables expression registers more than 16 netlink
   attributes which is what struct nft_expr_info allows.

3) Bail out if NFT_EXPR_STATEFUL provides no .clone interface, remove
   existing fallback to memcpy() when cloning which might accidentally
   duplicate memory reference to the same object.

4) Fix br_netfilter interaction with neighbour layer. This requires
   three preparation patches:

   - Use nf_bridge_get_physinif() in nfnetlink_log
   - Use nf_bridge_info_exists() to check in br_netfilter context
     is available in nf_queue.
   - Pass net to nf_bridge_get_physindev()

   And finally, the fix which replaces physindev with physinif
   in nf_bridge_info.

   Patches from Pavel Tikhomirov.

5) Catch-all deactivation happens in the transaction, hence this
   oneliner to check for the next generation. This bug uncovered after
   the removal of the _BUSY bit, which happened in set elements back in
   summer 2023.

6) Ensure set (total) key length size and concat field length description
   is consistent, otherwise bail out.

7) Skip set element with the _DEAD flag on from the netlink dump path.
   A tests occasionally shows that dump is mismatching because GC might
   lose race to get rid of this element while a netlink dump is in
   progress.

8) Reject NFT_SET_CONCAT for field_count < 1.

9) Use IP6_INC_STATS in ipvs to fix preemption BUG splat, patch
   from Fedor Pchelkin.

* tag 'nf-24-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  ipvs: avoid stat macros calls from preemptible context
  netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description
  netfilter: nf_tables: skip dead set elements in netlink dump
  netfilter: nf_tables: do not allow mismatch field size and set key length
  netfilter: nf_tables: check if catch-all set element is active in next generation
  netfilter: bridge: replace physindev with physinif in nf_bridge_info
  netfilter: propagate net to nf_bridge_get_physindev
  netfilter: nf_queue: remove excess nf_bridge variable
  netfilter: nfnetlink_log: use proper helper for fetching physinif
  netfilter: nft_limit: do not ignore unsupported flags
  netfilter: nf_tables: bail out if stateful expression provides no .clone
  netfilter: nf_tables: validate .maxattr at expression registration
  netfilter: nf_tables: reject invalid set policy
====================

Link: https://lore.kernel.org/r/20240118161726.14838-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2024-01-18 12:45:05 -08:00
..
netfilter
netfilter: bridge: replace physindev with physinif in nf_bridge_info
2024-01-17 12:02:49 +01:00
af_inet.c
sctp: support MSG_ERRQUEUE flag in recvmsg()
2023-12-13 18:30:24 -08:00
ah4.c
net: ipv4: stop checking crypto_ahash_alignmask
2023-10-27 18:04:29 +08:00
arp.c
neighbour: annotate lockless accesses to n->nud_state
2023-03-15 00:37:32 -07:00
bpf_tcp_ca.c
Revert BPF token-related functionality
2023-12-19 08:23:03 -08:00
cipso_ipv4.c
inet: move inet->is_icsk to inet->inet_flags
2023-08-16 11:09:17 +01:00
datagram.c
inet: implement lockless getsockopt(IP_MULTICAST_IF)
2023-10-01 19:39:19 +01:00
devinet.c
net: ipv4: fix one memleak in __inet_del_ifa()
2023-09-08 08:02:17 +01:00
esp4_offload.c
xfrm: Support GRO for IPv4 ESP in UDP encapsulation
2023-10-06 07:30:40 +02:00
esp4.c
net: ipv4: fix typo in comments
2023-10-25 10:38:07 +01:00
fib_frontend.c
ipv4: Fix incorrect table ID in IOCTL path
2023-03-16 17:26:31 -07:00
fib_lookup.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2022-02-17 11:44:20 -08:00
fib_notifier.c
…
fib_rules.c
fib: remove unnecessary input parameters in fib_default_rule_add
2024-01-03 16:42:48 -08:00
fib_semantics.c
ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr
2023-10-18 18:11:31 -07:00
fib_trie.c
Kill sched.h dependency on rcupdate.h
2023-12-27 11:50:20 -05:00
fou_bpf.c
bpf: Add __bpf_kfunc_{start,end}_defs macros
2023-11-01 22:33:53 -07:00
fou_core.c
bpf,fou: Add bpf_skb_{set,get}_fou_encap kfuncs
2023-04-12 16:40:39 -07:00
fou_nl.c
net: ynl: prefix uAPI header include with uapi/
2023-05-26 10:30:14 +01:00
fou_nl.h
net: ynl: prefix uAPI header include with uapi/
2023-05-26 10:30:14 +01:00
gre_demux.c
…
gre_offload.c
net: move gso declarations and functions to their own files
2023-06-10 00:11:41 -07:00
icmp.c
xfrm: pass struct net to xfrm_decode_session wrappers
2023-10-06 08:31:53 +02:00
igmp.c
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
2023-11-24 15:25:56 +00:00
inet_connection_sock.c
tcp: Remove dead code and fields for bhash2.
2023-12-22 22:15:35 +00:00
inet_diag.c
tcp: Link sk and twsk to tb2->owners using skc_bind_node.
2023-12-22 22:15:35 +00:00
inet_fragment.c
net: dropreason: add SKB_DROP_REASON_FRAG_REASM_TIMEOUT
2022-10-31 20:14:27 -07:00
inet_hashtables.c
tcp: Remove dead code and fields for bhash2.
2023-12-22 22:15:35 +00:00
inet_timewait_sock.c
tcp: Link sk and twsk to tb2->owners using skc_bind_node.
2023-12-22 22:15:35 +00:00
inetpeer.c
inetpeer: Fix data-races around sysctl.
2022-07-08 12:10:33 +01:00
ip_forward.c
net: fix IPSTATS_MIB_OUTFORWDATAGRAMS increment after fragment check
2023-10-13 09:58:45 -07:00
ip_fragment.c
networking: Update to register_net_sysctl_sz
2023-08-15 15:26:18 -07:00
ip_gre.c
ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit()
2023-12-06 10:08:05 +01:00
ip_input.c
ipv4: ignore dst hint for multipath routes
2023-09-01 08:11:51 +01:00
ip_options.c
ipv4: drop fragmentation code from ip_options_build()
2022-01-29 17:53:07 +00:00
ip_output.c
net: fix IPSTATS_MIB_OUTPKGS increment in OutForwDatagrams.
2023-10-20 12:01:00 +01:00
ip_sockglue.c
bpfilter: remove bpfilter
2024-01-04 10:23:10 -08:00
ip_tunnel_core.c
tunnels: fix kasan splat when generating ipv4 pmtu error
2023-08-04 18:24:52 -07:00
ip_tunnel.c
bpf-next-for-netdev
2023-04-13 16:43:38 -07:00
ip_vti.c
xfrm: pass struct net to xfrm_decode_session wrappers
2023-10-06 08:31:53 +02:00
ipcomp.c
xfrm: ipcomp: add extack to ipcomp{4,6}_init_state
2022-09-29 07:18:00 +02:00
ipconfig.c
net: ipconfig: move ic_nameservers_fallback into #ifdef block
2023-05-22 11:17:55 +01:00
ipip.c
ipip,ip_tunnel,sit: Add FOU support for externally controlled ipip devices
2023-04-12 16:40:39 -07:00
ipmr_base.c
ipmr: adopt rcu_read_lock() in mr_dump()
2022-06-24 11:34:38 +01:00
ipmr.c
fib: remove unnecessary input parameters in fib_default_rule_add
2024-01-03 16:42:48 -08:00
Kconfig
net/tcp: Add TCP-AO config and structures
2023-10-27 10:35:44 +01:00
Makefile
bpfilter: remove bpfilter
2024-01-04 10:23:10 -08:00
metrics.c
ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
2023-01-23 21:37:25 -08:00
netfilter.c
xfrm: pass struct net to xfrm_decode_session wrappers
2023-10-06 08:31:53 +02:00
netlink.c
…
nexthop.c
nexthop: Do not increment dump sentinel at the end of the dump
2023-08-15 18:54:53 -07:00
ping.c
bpf-next-for-netdev
2023-10-16 21:05:33 -07:00
proc.c
net/tcp: Ignore specific ICMPs for TCP-AO connections
2023-10-27 10:35:45 +01:00
protocol.c
…
raw_diag.c
net: fill in MODULE_DESCRIPTION()s for SOCK_DIAG modules
2023-11-19 20:09:13 +00:00
raw.c
inet: implement lockless getsockopt(IP_MULTICAST_IF)
2023-10-01 19:39:19 +01:00
route.c
ipv4: Correct/silence an endian warning in __ip_do_redirect
2023-11-21 12:55:22 +01:00
syncookies.c
tcp: Factorise cookie-dependent fields initialisation in cookie_v[46]_check()
2023-11-29 20:16:38 -08:00
sysctl_net_ipv4.c
Use READ/WRITE_ONCE() for IP local_port_range.
2023-12-08 10:44:42 -08:00
tcp_ao.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2023-12-07 17:53:17 -08:00
tcp_bbr.c
net: implement lockless SO_MAX_PACING_RATE
2023-10-01 19:09:54 +01:00
tcp_bic.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_bpf.c
tcp_bpf: properly release resources on error paths
2023-10-18 18:09:31 -07:00
tcp_cdg.c
Random number generator fixes for Linux 6.1-rc1.
2022-10-16 15:27:07 -07:00
tcp_cong.c
net: Update an existing TCP congestion control algorithm.
2023-03-22 22:53:00 -07:00
tcp_cubic.c
bpf: Add __bpf_kfunc tag to all kfuncs
2023-02-02 00:25:14 +01:00
tcp_dctcp.c
bpf: Add __bpf_kfunc tag to all kfuncs
2023-02-02 00:25:14 +01:00
tcp_dctcp.h
…
tcp_diag.c
net: fill in MODULE_DESCRIPTION()s for SOCK_DIAG modules
2023-11-19 20:09:13 +00:00
tcp_fastopen.c
inet: move inet->defer_connect to inet->inet_flags
2023-08-16 11:09:18 +01:00
tcp_highspeed.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_htcp.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_hybla.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_illinois.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_input.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2023-12-14 17:14:41 -08:00
tcp_ipv4.c
tcp: Revert no longer abort SYN_SENT when receiving some ICMP
2024-01-08 19:08:51 -08:00
tcp_lp.c
tcp: rename tcp_time_stamp() to tcp_time_stamp_ts()
2023-10-23 09:35:01 +01:00
tcp_metrics.c
tcp_metrics: optimize tcp_metrics_flush_all()
2023-10-03 10:05:22 +02:00
tcp_minisocks.c
net/tcp: Consistently align TCP-AO option in the header
2023-12-06 12:36:55 +01:00
tcp_nv.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_offload.c
net: move gso declarations and functions to their own files
2023-06-10 00:11:41 -07:00
tcp_output.c
net: Remove acked SYN flag from packet in the transmit queue correctly
2023-12-12 15:56:02 -08:00
tcp_plb.c
prandom: remove prandom_u32_max()
2022-12-20 03:13:45 +01:00
tcp_rate.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2022-04-28 13:02:01 -07:00
tcp_recovery.c
tcp: fix excessive TLP and RACK timeouts from HZ rounding
2023-10-17 17:25:42 -07:00
tcp_scalable.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_sigpool.c
net/tcp_sigpool: Use kref_get_unless_zero()
2024-01-01 14:42:05 +00:00
tcp_timer.c
tcp: use tp->total_rto to track number of linear timeouts in SYN_SENT state
2023-11-16 23:35:12 +00:00
tcp_ulp.c
net/ulp: use consistent error code when blocking ULP
2023-01-19 09:26:16 -08:00
tcp_vegas.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_vegas.h
…
tcp_veno.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_westwood.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_yeah.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp.c
Networking changes for 6.8.
2024-01-11 10:07:29 -08:00
tunnel4.c
…
udp_bpf.c
bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()
2023-03-03 17:25:15 +01:00
udp_diag.c
net: fill in MODULE_DESCRIPTION()s for SOCK_DIAG modules
2023-11-19 20:09:13 +00:00
udp_impl.h
sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)
2023-06-24 15:50:13 -07:00
udp_offload.c
udp: move udp->gro_enabled to udp->udp_flags
2023-09-14 16:16:36 +02:00
udp_tunnel_core.c
ipv4: use tunnel flow flags for tunnel route lookups
2023-10-16 09:57:52 +01:00
udp_tunnel_nic.c
udp_tunnel: Use flex array to simplify code
2023-10-03 11:39:34 +02:00
udp_tunnel_stub.c
…
udp.c
bpf: Avoid iter->offset making backward progress in bpf_iter_udp
2024-01-13 11:01:44 -08:00
udplite.c
udplite: remove UDPLITE_BIT
2023-09-14 16:16:36 +02:00
xfrm4_input.c
xfrm Fix use after free in __xfrm6_udp_encap_rcv.
2023-10-23 07:10:39 +02:00
xfrm4_output.c
…
xfrm4_policy.c
sysctl-6.6-rc1
2023-08-29 17:39:15 -07:00
xfrm4_protocol.c
net: xfrm: unexport __init-annotated xfrm4_protocol_init()
2022-06-08 10:10:13 -07:00
xfrm4_state.c
…
xfrm4_tunnel.c
xfrm: tunnel: add extack to ipip_init_state, xfrm6_tunnel_init_state
2022-09-29 07:18:00 +02:00