Hi David,
The following patchset contains Netfilter/IPVS updates for net-next,
they are:
1) Count pre-established connections as active in "least connection"
schedulers such that pre-established connections to avoid overloading
backend servers on peak demands, from Michal Kubecek via Simon Horman.
2) Address a race condition when resizing the conntrack table by caching
the bucket size when fulling iterating over the hashtable in these
three possible scenarios: 1) dump via /proc/net/nf_conntrack,
2) unlinking userspace helper and 3) unlinking custom conntrack timeout.
From Liping Zhang.
3) Revisit early_drop() path to perform lockless traversal on conntrack
eviction under stress, use del_timer() as synchronization point to
avoid two CPUs evicting the same entry, from Florian Westphal.
4) Move NAT hlist_head to nf_conn object, this simplifies the existing
NAT extension and it doesn't increase size since recent patches to
align nf_conn, from Florian.
5) Use rhashtable for the by-source NAT hashtable, also from Florian.
6) Don't allow --physdev-is-out from OUTPUT chain, just like
--physdev-out is not either, from Hangbin Liu.
7) Automagically set on nf_conntrack counters if the user tries to
match ct bytes/packets from nftables, from Liping Zhang.
8) Remove possible_net_t fields in nf_tables set objects since we just
simply pass the net pointer to the backend set type implementations.
9) Fix possible off-by-one in h323, from Toby DiPasquale.
10) early_drop() may be called from ctnetlink patch, so we must hold
rcu read size lock from them too, this amends Florian's patch #3
coming in this batch, from Liping Zhang.
11) Use binary search to validate jump offset in x_tables, this
addresses the O(n!) validation that was introduced recently
resolve security issues with unpriviledge namespaces, from Florian.
12) Fix reference leak to connlabel in error path of nft_ct, from Zhang.
13) Three updates for nft_log: Fix log prefix leak in error path. Bail
out on loglevel larger than debug in nft_log and set on the new
NF_LOG_F_COPY_LEN flag when snaplen is specified. Again from Zhang.
14) Allow to filter rule dumps in nf_tables based on table and chain
names.
15) Simplify connlabel to always use 128 bits to store labels and
get rid of unused function in xt_connlabel, from Florian.
16) Replace set_expect_timeout() by mod_timer() from the h323 conntrack
helper, by Gao Feng.
17) Put back x_tables module reference in nft_compat on error, from
Liping Zhang.
18) Add a reference count to the x_tables extensions cache in
nft_compat, so we can remove them when unused and avoid a crash
if the extensions are rmmod, again from Zhang.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git
Thanks!
----------------------------------------------------------------
The following changes since commit a90a6e55f34f28190e4dc2a6a3660ef157827a8f:
Merge tag 'mac80211-next-for-davem-2016-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next (2016-07-06 22:32:15 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git HEAD
for you to fetch changes up to 4b512e1c1f8de6b9ceb796ecef8658e0a083cab7:
netfilter: nft_compat: fix crash when related match/target module is removed (2016-07-23 12:25:00 +0200)
----------------------------------------------------------------
Florian Westphal (7):
netfilter: conntrack: simplify early_drop
netfilter: move nat hlist_head to nf_conn
netfilter: nat: convert nat bysrc hash to rhashtable
netfilter: constify arg to is_dying/confirmed
netfilter: x_tables: speed up jump target validation
netfilter: conntrack: support a fixed size of 128 distinct labels
netfilter: connlabels: move set helper to xt_connlabel
Gao Feng (2):
netfilter: Add helper array register/unregister functions
netfilter: h323: Use mod_timer instead of set_expect_timeout
Hangbin Liu (1):
netfilter: physdev: physdev-is-out should not work with OUTPUT chain
Liping Zhang (11):
netfilter: conntrack: fix race between nf_conntrack proc read and hash resize
netfilter: cttimeout: unlink timeout obj again when hash resize happen
netfilter: nf_ct_helper: unlink helper again when hash resize happen
netfilter: nft_ct: make byte/packet expr more friendly
netfilter: conntrack: protect early_drop by rcu read lock
netfilter: nft_ct: fix unpaired nf_connlabels_get/put call
netfilter: nft_log: fix possible memory leak if log expr init fail
netfilter: nft_log: check the validity of log level
netfilter: nft_log: fix snaplen does not truncate packets
netfilter: nft_compat: put back match/target module if init fail
netfilter: nft_compat: fix crash when related match/target module is removed
Michal Kubecek (1):
ipvs: count pre-established TCP states as active
Pablo Neira Ayuso (3):
netfilter: nf_tables: get rid of possible_net_t from set and basechain
Merge tag 'ipvs-for-v4.8' of https://git.kernel.org/.../horms/ipvs-next
netfilter: nf_tables: allow to filter out rules by table and chain
Toby DiPasquale (1):
netfilter: nf_conntrack_h323: fix off-by-one in DecodeQ931
include/linux/netfilter/x_tables.h | 4 +
include/net/netfilter/nf_conntrack.h | 9 +-
include/net/netfilter/nf_conntrack_core.h | 2 +
include/net/netfilter/nf_conntrack_extend.h | 3 -
include/net/netfilter/nf_conntrack_helper.h | 15 +++
include/net/netfilter/nf_conntrack_labels.h | 18 +--
include/net/netfilter/nf_nat.h | 3 +-
include/net/netfilter/nf_tables.h | 21 +--
net/ipv4/netfilter/arp_tables.c | 47 ++++---
net/ipv4/netfilter/ip_tables.c | 45 ++++---
.../netfilter/nf_conntrack_l3proto_ipv4_compat.c | 14 +-
net/ipv6/netfilter/ip6_tables.c | 45 ++++---
net/netfilter/ipvs/ip_vs_proto_tcp.c | 25 +++-
net/netfilter/nf_conntrack_core.c | 115 +++++++++-------
net/netfilter/nf_conntrack_extend.c | 15 +--
net/netfilter/nf_conntrack_ftp.c | 58 +++-----
net/netfilter/nf_conntrack_h323_asn1.c | 3 +-
net/netfilter/nf_conntrack_h323_main.c | 15 +--
net/netfilter/nf_conntrack_helper.c | 76 ++++++++++-
net/netfilter/nf_conntrack_irc.c | 36 ++---
net/netfilter/nf_conntrack_labels.c | 28 +---
net/netfilter/nf_conntrack_netlink.c | 10 +-
net/netfilter/nf_conntrack_sane.c | 57 +++-----
net/netfilter/nf_conntrack_sip.c | 75 ++++-------
net/netfilter/nf_conntrack_standalone.c | 14 +-
net/netfilter/nf_conntrack_tftp.c | 48 +++----
net/netfilter/nf_nat_core.c | 149 ++++++++++-----------
net/netfilter/nf_tables_api.c | 48 ++++++-
net/netfilter/nfnetlink_cttimeout.c | 20 ++-
net/netfilter/nft_compat.c | 75 ++++++-----
net/netfilter/nft_ct.c | 41 +++---
net/netfilter/nft_hash.c | 20 +--
net/netfilter/nft_log.c | 34 +++--
net/netfilter/nft_lookup.c | 2 +-
net/netfilter/nft_rbtree.c | 26 ++--
net/netfilter/x_tables.c | 50 +++++++
net/netfilter/xt_connlabel.c | 29 ++--
net/netfilter/xt_physdev.c | 8 +-
net/openvswitch/conntrack.c | 4 +-
39 files changed, 718 insertions(+), 589 deletions(-)
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
