| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20211021100821.964677-1-pablo@netfilter.org>
Date: Thu, 21 Oct 2021 12:08:13 +0200
From: Pablo Neira Ayuso <pablo@...filter.org>
To: netfilter-devel@...r.kernel.org
Cc: davem@...emloft.net, netdev@...r.kernel.org, kuba@...nel.org
Subject: [PATCH net 0/8] Netfilter/IPVS fixes for net
Hi,
The following patchset contains Netfilter fixes for net:
1) Crash due to missing initialization of timer data in
xt_IDLETIMER, from Juhee Kang.
2) NF_CONNTRACK_SECMARK should be bool in Kconfig, from Vegard Nossum.
3) Skip netdev events on netns removal, from Florian Westphal.
4) Add testcase to show port shadowing via UDP, also from Florian.
5) Remove pr_debug() code in ip6t_rt, this fixes a crash due to
unsafe access to non-linear skbuff, from Xin Long.
6) Make net/ipv4/vs/debug_level read-only from non-init netns,
from Antoine Tenart.
7) Remove bogus invocation to bash in selftests/netfilter/nft_flowtable.sh
also from Florian.
There will be a relatively simple conflict between net-next and net
after this pull-request, as reported by Stephen Rothwell.
diff --cc net/netfilter/ipvs/ip_vs_ctl.c
index 29ec3ef63edc,cbea5a68afb5..000000000000
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@@ -4090,11 -4096,8 +4096,13 @@@ static int __net_init ip_vs_control_net
tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
+ ipvs->sysctl_run_estimation = 1;
+ tbl[idx++].data = &ipvs->sysctl_run_estimation;
+#ifdef CONFIG_IP_VS_DEBUG
+ /* Global sysctls must be ro in non-init netns */
+ if (!net_eq(net, &init_net))
+ tbl[idx++].mode = 0444;
+#endif
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 8d6c414cd2fb74aa6812e9bfec6178f8246c4f3a:
net: prefer socket bound to interface when not in VRF (2021-10-07 07:27:55 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to d9aaaf223297f6146d9d7f36caca927c92ab855a:
netfilter: ebtables: allocate chainstack on CPU local nodes (2021-10-18 00:23:57 +0200)
----------------------------------------------------------------
Antoine Tenart (1):
netfilter: ipvs: make global sysctl readonly in non-init netns
Davidlohr Bueso (1):
netfilter: ebtables: allocate chainstack on CPU local nodes
Florian Westphal (3):
netfilter: nf_tables: skip netdev events generated on netns removal
selftests: nft_nat: add udp hole punch test case
selftests: netfilter: remove stray bash debug line
Juhee Kang (1):
netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value
Vegard Nossum (1):
netfilter: Kconfig: use 'default y' instead of 'm' for bool config option
Xin Long (1):
netfilter: ip6t_rt: fix rt0_hdr parsing in rt_mt6
net/bridge/netfilter/ebtables.c | 4 +-
net/ipv6/netfilter/ip6t_rt.c | 48 +------
net/netfilter/Kconfig | 2 +-
net/netfilter/ipvs/ip_vs_ctl.c | 5 +
net/netfilter/nft_chain_filter.c | 9 +-
net/netfilter/xt_IDLETIMER.c | 2 +-
tools/testing/selftests/netfilter/nft_flowtable.sh | 1 -
tools/testing/selftests/netfilter/nft_nat.sh | 145 +++++++++++++++++++++
8 files changed, 164 insertions(+), 52 deletions(-)
Powered by blists - more mailing lists