Hi David,
The following patchset contains Netfilter fixes for your net tree:
1) rbtree lookup from control plane returns the left-hand side element
of the range when the interval end flag is set on.
2) osf extension is not supported from the input path, reject this from
the control plane, from Fernando Fernandez Mancera.
3) xt_TEE is leaving output interface unset due to a recent incorrect
netns rework, from Taehee Yoo.
4) xt_TEE allows to select an interface which does not belong to this
netnamespace, from Taehee Yoo.
5) Zero private extension area in nft_compat, just like we do in x_tables,
otherwise we leak kernel memory to userspace.
6) Missing .checkentry and .destroy entries in new DNAT extensions breaks
it since we never load nf_conntrack dependencies, from Paolo Abeni.
7) Do not remove flowtable hook from netns exit path, the netdevice handler
already deals with this, also from Taehee Yoo.
8) Only cleanup flowtable entries that reside in this netnamespace, also
from Taehee Yoo.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 9a4890bd6d6325a1c88564a20ab310b2d56f6094:
rds: RDS (tcp) hangs on sendto() to unresponding address (2018-10-10 22:19:52 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to a3fb3698cadf27dc142b24394c401625e14d80d0:
netfilter: nf_flow_table: do not remove offload when other netns's interface is down (2018-10-19 13:30:48 +0200)
----------------------------------------------------------------
Fernando Fernandez Mancera (1):
netfilter: nft_osf: usage from output path is not valid
Pablo Neira Ayuso (2):
netfilter: nft_set_rbtree: allow loose matching of closing element in interval
netfilter: nft_compat: do not dump private area
Paolo Abeni (1):
netfilter: xt_nat: fix DNAT target for shifted portmap ranges
Taehee Yoo (4):
netfilter: xt_TEE: fix wrong interface selection
netfilter: xt_TEE: add missing code to get interface index in checkentry.
netfilter: nf_flow_table: remove flowtable hook flush routine in netns exit routine
netfilter: nf_flow_table: do not remove offload when other netns's interface is down
net/netfilter/nf_flow_table_core.c | 9 +++--
net/netfilter/nf_tables_api.c | 3 --
net/netfilter/nft_compat.c | 24 +++++++++++-
net/netfilter/nft_osf.c | 10 +++++
net/netfilter/nft_set_rbtree.c | 10 ++++-
net/netfilter/xt_TEE.c | 76 +++++++++++++++++++++++++++++---------
net/netfilter/xt_nat.c | 2 +
7 files changed, 107 insertions(+), 27 deletions(-)
