[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20250323100922.59983-1-pablo@netfilter.org>
Date: Sun, 23 Mar 2025 11:09:15 +0100
From: Pablo Neira Ayuso <pablo@...filter.org>
To: netfilter-devel@...r.kernel.org
Cc: davem@...emloft.net,
netdev@...r.kernel.org,
kuba@...nel.org,
pabeni@...hat.com,
edumazet@...gle.com,
fw@...len.de,
horms@...nel.org
Subject: [PATCH net-next 0/7] Netfilter updates for net-next
Hi,
The following batch contains Netfilter updates for net-next:
1) Use kvmalloc in xt_hashlimit, from Denis Kirjanov.
2) Tighten nf_conntrack sysctl accepted values for nf_conntrack_max
and nf_ct_expect_max, from Nicolas Bouchinet.
3) Avoid lookup in nft_fib if socket is available, from Florian Westphal.
4) Initialize struct lsm_context in nfnetlink_queue to avoid
hypothetical ENOMEM errors, Chenyuan Yang.
5) Use strscpy() instead of _pad when initializing xtables table name,
kzalloc is already used to initialized the table memory area.
From Thorsten Blum.
6) Missing socket lookup by conntrack information for IPv6 traffic
in nft_socket, there is a similar chunk in IPv4, this was never
added when IPv6 NAT was introduced. From Maxim Mikityanskiy.
7) Fix clang issues with nf_tables CONFIG_MITIGATION_RETPOLINE,
from WangYuli.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-25-03-23
Thanks.
----------------------------------------------------------------
The following changes since commit 71ca3561c268a07888ba9ce089ab8c3f54710cd4:
Merge branch 'mptcp-pm-code-reorganisation' (2025-03-10 13:36:18 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git tags/nf-next-25-03-23
for you to fetch changes up to e3a4182edd1ae60e7e3539ff3b3784af9830d223:
netfilter: nf_tables: Only use nf_skip_indirect_calls() when MITIGATION_RETPOLINE (2025-03-23 10:53:47 +0100)
----------------------------------------------------------------
netfilter pull request 25-03-23
----------------------------------------------------------------
Chenyuan Yang (1):
netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error
Denis Kirjanov (1):
netfilter: xt_hashlimit: replace vmalloc calls with kvmalloc
Florian Westphal (1):
netfilter: fib: avoid lookup if socket is available
Maxim Mikityanskiy (1):
netfilter: socket: Lookup orig tuple for IPv6 SNAT
Nicolas Bouchinet (1):
netfilter: conntrack: Bound nf_conntrack sysctl writes
Thorsten Blum (1):
netfilter: xtables: Use strscpy() instead of strscpy_pad()
WangYuli (1):
netfilter: nf_tables: Only use nf_skip_indirect_calls() when MITIGATION_RETPOLINE
include/net/netfilter/nft_fib.h | 21 +++++++++++++++++++++
net/ipv4/netfilter/nft_fib_ipv4.c | 11 +++++------
net/ipv6/netfilter/nf_socket_ipv6.c | 23 +++++++++++++++++++++++
net/ipv6/netfilter/nft_fib_ipv6.c | 19 ++++++++++---------
net/netfilter/nf_conntrack_standalone.c | 12 +++++++++---
net/netfilter/nf_tables_core.c | 11 ++++-------
net/netfilter/nfnetlink_queue.c | 2 +-
net/netfilter/xt_hashlimit.c | 12 +++++-------
net/netfilter/xt_repldata.h | 2 +-
9 files changed, 79 insertions(+), 34 deletions(-)
Powered by blists - more mailing lists