The following set contains changes for your *net-next* tree:
- make conntrack ignore packets that are delayed (containing
data already acked). The current behaviour to flag them as INVALID
causes more harm than good, let them pass so peer can send an
immediate ACK for the most recent sequence number.
- make conntrack recognize when both peers have sent 'invalid' FINs:
This helps cleaning out stale connections faster for those cases where
conntrack is no longer in sync with the actual connection state.
- Now that DECNET is gone, we don't need to reserve space for DECNET
related information.
- compact common 'find a free port number for the new inbound
connection' code and move it to a helper, then cap number of tries
the new helper will make until it gives up.
- replace various instances of strlcpy with strscpy, from Wolfram Sang.
----------------------------------------------------------------
The following changes since commit 016eb59012b576f5a7b7b415d757717dc8cb3c6b:
Merge branch 'macsec-offload-mlx5' (2022-09-07 14:02:09 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git
for you to fetch changes up to adda60cc2bb0fa46bed004070f29f90db96afbb3:
netfilter: nat: avoid long-running port range loop (2022-09-07 16:46:04 +0200)
----------------------------------------------------------------
Florian Westphal (7):
netfilter: conntrack: prepare tcp_in_window for ternary return value
netfilter: conntrack: ignore overly delayed tcp packets
netfilter: conntrack: remove unneeded indent level
netfilter: conntrack: reduce timeout when receiving out-of-window fin or rst
netfilter: remove NFPROTO_DECNET
netfilter: nat: move repetitive nat port reserve loop to a helper
netfilter: nat: avoid long-running port range loop
Wolfram Sang (1):
netfilter: move from strlcpy with unused retval to strscpy
include/net/netfilter/nf_nat_helper.h | 1 +
include/uapi/linux/netfilter.h | 2 +
net/ipv4/netfilter/nf_nat_h323.c | 60 +-----
net/netfilter/ipset/ip_set_core.c | 4 +-
net/netfilter/ipvs/ip_vs_ctl.c | 8 +-
net/netfilter/nf_conntrack_proto_tcp.c | 321 +++++++++++++++++++++------------
net/netfilter/nf_log.c | 4 +-
net/netfilter/nf_nat_amanda.c | 14 +-
net/netfilter/nf_nat_ftp.c | 17 +-
net/netfilter/nf_nat_helper.c | 31 ++++
net/netfilter/nf_nat_irc.c | 16 +-
net/netfilter/nf_nat_sip.c | 14 +-
net/netfilter/nf_tables_api.c | 2 +-
net/netfilter/nft_osf.c | 2 +-
net/netfilter/x_tables.c | 20 +-
net/netfilter/xt_RATEEST.c | 2 +-
16 files changed, 266 insertions(+), 252 deletions(-)
The following set contains changes for your *net-next* tree: - make conntrack ignore packets that are delayed (containing data already acked). The current behaviour to flag them as INVALID causes more harm than good, let them pass so peer can send an immediate ACK for the most recent sequence number. - make conntrack recognize when both peers have sent 'invalid' FINs: This helps cleaning out stale connections faster for those cases where conntrack is no longer in sync with the actual connection state. - Now that DECNET is gone, we don't need to reserve space for DECNET related information. - compact common 'find a free port number for the new inbound connection' code and move it to a helper, then cap number of tries the new helper will make until it gives up. - replace various instances of strlcpy with strscpy, from Wolfram Sang. ---------------------------------------------------------------- The following changes since commit 016eb59012b576f5a7b7b415d757717dc8cb3c6b: Merge branch 'macsec-offload-mlx5' (2022-09-07 14:02:09 +0100) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git for you to fetch changes up to adda60cc2bb0fa46bed004070f29f90db96afbb3: netfilter: nat: avoid long-running port range loop (2022-09-07 16:46:04 +0200) ---------------------------------------------------------------- Florian Westphal (7): netfilter: conntrack: prepare tcp_in_window for ternary return value netfilter: conntrack: ignore overly delayed tcp packets netfilter: conntrack: remove unneeded indent level netfilter: conntrack: reduce timeout when receiving out-of-window fin or rst netfilter: remove NFPROTO_DECNET netfilter: nat: move repetitive nat port reserve loop to a helper netfilter: nat: avoid long-running port range loop Wolfram Sang (1): netfilter: move from strlcpy with unused retval to strscpy include/net/netfilter/nf_nat_helper.h | 1 + include/uapi/linux/netfilter.h | 2 + net/ipv4/netfilter/nf_nat_h323.c | 60 +----- net/netfilter/ipset/ip_set_core.c | 4 +- net/netfilter/ipvs/ip_vs_ctl.c | 8 +- net/netfilter/nf_conntrack_proto_tcp.c | 321 +++++++++++++++++++++------------ net/netfilter/nf_log.c | 4 +- net/netfilter/nf_nat_amanda.c | 14 +- net/netfilter/nf_nat_ftp.c | 17 +- net/netfilter/nf_nat_helper.c | 31 ++++ net/netfilter/nf_nat_irc.c | 16 +- net/netfilter/nf_nat_sip.c | 14 +- net/netfilter/nf_tables_api.c | 2 +- net/netfilter/nft_osf.c | 2 +- net/netfilter/x_tables.c | 20 +- net/netfilter/xt_RATEEST.c | 2 +- 16 files changed, 266 insertions(+), 252 deletions(-)