netdev - [PATCH net 0/3] netfilter: updates for net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251029135617.18274-1-fw@strlen.de>
Date: Wed, 29 Oct 2025 14:56:14 +0100
From: Florian Westphal <fw@...len.de>
To: <netdev@...r.kernel.org>
Cc: Paolo Abeni <pabeni@...hat.com>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>,
	<netfilter-devel@...r.kernel.org>,
	pablo@...filter.org
Subject: [PATCH net 0/3] netfilter: updates for net

Hi,

The following patchset contains Netfilter fixes for *net*:

1) its not possible to attach conntrack labels via ctnetlink
   unless one creates a dummy 'ct labels set' rule in nftables.
   This is an oversight, the 'ruleset tests presence, userspace
   (netlink) sets' use-case is valid and should 'just work'.
   Always broken since this got added in Linux 4.7.

2) nft_connlimit reads count value without holding the relevant
   lock, add a READ_ONCE annotation.  From Fernando Fernandez Mancera.

3) There is a long-standing bug (since 4.12) in nftables helper infra
   when NAT is in use: if the helper gets assigned after the nat binding
   was set up, we fail to initialise the 'seqadj' extension, which is
   needed in case NAT payload rewrites need to add (or remove) from the
   packet payload.  Fix from Andrii Melnychenko.

Please, pull these changes from:
The following changes since commit 8df206f7b63611dbaeb8628661d87fe994dcdf71:

  Merge branch 'bug-fixes-for-the-hibmcge-ethernet-driver' (2025-10-28 19:11:07 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-25-10-29

for you to fetch changes up to 90918e3b6404c2a37837b8f11692471b4c512de2:

  netfilter: nft_ct: add seqadj extension for natted connections (2025-10-29 14:47:59 +0100)

----------------------------------------------------------------
netfilter pull request nf-25-10-29

----------------------------------------------------------------

Andrii Melnychenko (1):
  netfilter: nft_ct: add seqadj extension for natted connections

Fernando Fernandez Mancera (1):
  netfilter: nft_connlimit: fix possible data race on connection count

Florian Westphal (1):
  netfilter: nft_ct: enable labels for get case too

 net/netfilter/nft_connlimit.c |  2 +-
 net/netfilter/nft_ct.c        | 30 +++++++++++++++++++++++++++---
 2 files changed, 28 insertions(+), 4 deletions(-)

-- 
2.51.0