Hi,
The following patchset contains Netfilter fixes for net:
1) Update nf_tables kdoc to keep it in sync with the code, from George Guo.
2) Handle NETDEV_UNREGISTER event for inet/ingress basechain.
3) Reject configuration that cause nft_limit to overflow, from Florian Westphal.
4) Restrict anonymous set/map names to 16 bytes, from Florian Westphal.
5) Disallow to encode queue number and error in verdicts. This reverts
a patch which seems to have introduced an early attempt to support for
nfqueue maps, which is these days supported via nft_queue expression.
6) Sanitize family via .validate for expressions that explicitly refer
to NF_INET_* hooks.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-01-24
Thanks.
----------------------------------------------------------------
The following changes since commit 32f2a0afa95fae0d1ceec2ff06e0e816939964b8:
net/sched: flower: Fix chain template offload (2024-01-24 01:33:59 +0000)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-01-24
for you to fetch changes up to d0009effa8862c20a13af4cb7475d9771b905693:
netfilter: nf_tables: validate NFPROTO_* family (2024-01-24 20:02:40 +0100)
----------------------------------------------------------------
netfilter pull request 24-01-24
----------------------------------------------------------------
Florian Westphal (3):
netfilter: nft_limit: reject configurations that cause integer overflow
netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
netfilter: nf_tables: reject QUEUE/DROP verdict parameters
George Guo (1):
netfilter: nf_tables: cleanup documentation
Pablo Neira Ayuso (2):
netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
netfilter: nf_tables: validate NFPROTO_* family
include/net/netfilter/nf_tables.h | 49 +++++++++++++++++++++++++++++++--------
net/netfilter/nf_tables_api.c | 20 ++++++++--------
net/netfilter/nft_chain_filter.c | 11 +++++++--
net/netfilter/nft_compat.c | 12 ++++++++++
net/netfilter/nft_flow_offload.c | 5 ++++
net/netfilter/nft_limit.c | 23 ++++++++++++------
net/netfilter/nft_nat.c | 5 ++++
net/netfilter/nft_rt.c | 5 ++++
net/netfilter/nft_socket.c | 5 ++++
net/netfilter/nft_synproxy.c | 7 ++++--
net/netfilter/nft_tproxy.c | 5 ++++
net/netfilter/nft_xfrm.c | 5 ++++
12 files changed, 121 insertions(+), 31 deletions(-)
Hi, The following patchset contains Netfilter fixes for net: 1) Update nf_tables kdoc to keep it in sync with the code, from George Guo. 2) Handle NETDEV_UNREGISTER event for inet/ingress basechain. 3) Reject configuration that cause nft_limit to overflow, from Florian Westphal. 4) Restrict anonymous set/map names to 16 bytes, from Florian Westphal. 5) Disallow to encode queue number and error in verdicts. This reverts a patch which seems to have introduced an early attempt to support for nfqueue maps, which is these days supported via nft_queue expression. 6) Sanitize family via .validate for expressions that explicitly refer to NF_INET_* hooks. Please, pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-01-24 Thanks. ---------------------------------------------------------------- The following changes since commit 32f2a0afa95fae0d1ceec2ff06e0e816939964b8: net/sched: flower: Fix chain template offload (2024-01-24 01:33:59 +0000) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-01-24 for you to fetch changes up to d0009effa8862c20a13af4cb7475d9771b905693: netfilter: nf_tables: validate NFPROTO_* family (2024-01-24 20:02:40 +0100) ---------------------------------------------------------------- netfilter pull request 24-01-24 ---------------------------------------------------------------- Florian Westphal (3): netfilter: nft_limit: reject configurations that cause integer overflow netfilter: nf_tables: restrict anonymous set and map names to 16 bytes netfilter: nf_tables: reject QUEUE/DROP verdict parameters George Guo (1): netfilter: nf_tables: cleanup documentation Pablo Neira Ayuso (2): netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain netfilter: nf_tables: validate NFPROTO_* family include/net/netfilter/nf_tables.h | 49 +++++++++++++++++++++++++++++++-------- net/netfilter/nf_tables_api.c | 20 ++++++++-------- net/netfilter/nft_chain_filter.c | 11 +++++++-- net/netfilter/nft_compat.c | 12 ++++++++++ net/netfilter/nft_flow_offload.c | 5 ++++ net/netfilter/nft_limit.c | 23 ++++++++++++------ net/netfilter/nft_nat.c | 5 ++++ net/netfilter/nft_rt.c | 5 ++++ net/netfilter/nft_socket.c | 5 ++++ net/netfilter/nft_synproxy.c | 7 ++++-- net/netfilter/nft_tproxy.c | 5 ++++ net/netfilter/nft_xfrm.c | 5 ++++ 12 files changed, 121 insertions(+), 31 deletions(-)