| Message ID | 20201031181437.12472-1-pablo@netfilter.org (mailing list archive) |
|---|---|
| State | Not Applicable |
| Delegated to: | Netdev Maintainers |
| Headers | show |
On Sat, 31 Oct 2020 19:14:32 +0100 Pablo Neira Ayuso wrote: > Hi, > > The following patchset contains Netfilter fixes for net: > > 1) Incorrect netlink report logic in flowtable and genID. > > 2) Add a selftest to check that wireguard passes the right sk > to ip_route_me_harder, from Jason A. Donenfeld. > > 3) Pass the actual sk to ip_route_me_harder(), also from Jason. > > 4) Missing expression validation of updates via nft --check. > > 5) Update byte and packet counters regardless of whether they > match, from Stefano Brivio. Pulled, thanks Pablo!
Hi, The following patchset contains Netfilter fixes for net: 1) Incorrect netlink report logic in flowtable and genID. 2) Add a selftest to check that wireguard passes the right sk to ip_route_me_harder, from Jason A. Donenfeld. 3) Pass the actual sk to ip_route_me_harder(), also from Jason. 4) Missing expression validation of updates via nft --check. 5) Update byte and packet counters regardless of whether they match, from Stefano Brivio. Please, pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git Thanks. ---------------------------------------------------------------- The following changes since commit 07e0887302450a62f51dba72df6afb5fabb23d1c: Merge tag 'fallthrough-fixes-clang-5.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux (2020-10-29 13:02:52 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD for you to fetch changes up to 7d10e62c2ff8e084c136c94d32d9a94de4d31248: netfilter: ipset: Update byte and packet counters regardless of whether they match (2020-10-31 11:11:11 +0100) ---------------------------------------------------------------- Jason A. Donenfeld (2): wireguard: selftests: check that route_me_harder packets use the right sk netfilter: use actual socket sk rather than skb sk when routing harder Pablo Neira Ayuso (2): netfilter: nftables: fix netlink report logic in flowtable and genid netfilter: nf_tables: missing validation from the abort path Stefano Brivio (1): netfilter: ipset: Update byte and packet counters regardless of whether they match include/linux/netfilter/nfnetlink.h | 9 ++++++++- include/linux/netfilter_ipv4.h | 2 +- include/linux/netfilter_ipv6.h | 10 +++++----- net/ipv4/netfilter.c | 8 +++++--- net/ipv4/netfilter/iptable_mangle.c | 2 +- net/ipv4/netfilter/nf_reject_ipv4.c | 2 +- net/ipv6/netfilter.c | 6 +++--- net/ipv6/netfilter/ip6table_mangle.c | 2 +- net/netfilter/ipset/ip_set_core.c | 3 ++- net/netfilter/ipvs/ip_vs_core.c | 4 ++-- net/netfilter/nf_nat_proto.c | 4 ++-- net/netfilter/nf_synproxy_core.c | 2 +- net/netfilter/nf_tables_api.c | 19 ++++++++++++------- net/netfilter/nfnetlink.c | 22 ++++++++++++++++++---- net/netfilter/nft_chain_route.c | 4 ++-- net/netfilter/utils.c | 4 ++-- tools/testing/selftests/wireguard/netns.sh | 8 ++++++++ .../testing/selftests/wireguard/qemu/kernel.config | 2 ++ 18 files changed, 76 insertions(+), 37 deletions(-)