Hi David,
The following patchset contains Netfilter/IPVS fixes for your net tree:
1) Fix crash when dumping rules after conversion to RCU,
from Florian Westphal.
2) Fix incorrect hook reinjection from nf_queue in case NF_REPEAT,
from Jagdish Motwani.
3) Fix check for route existence in fib extension, from Phil Sutter.
4) Fix use after free in ip_vs_in() hook, from YueHaibing.
5) Check for veth existence from netfilter selftests,
from Jeffrin Jose T.
6) Checksum corruption in UDP NAT helpers due to typo,
from Florian Westphal.
7) Pass up packets to classic forwarding path regardless of
IPv4 DF bit, patch for the flowtable infrastructure from Florian.
8) Set liberal TCP tracking for flows that are placed in the
flowtable, in case they need to go back to classic forwarding path,
also from Florian.
9) Don't add flow with sequence adjustment to flowtable, from Florian.
10) Skip IPv4 options from IPv6 datapath in flowtable, from Florian.
11) Add selftest for the flowtable infrastructure, from Florian.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit ee8a2b95b737d5989efeb477d5a1ef5e6955b830:
Merge branch 'mlxsw-Two-port-module-fixes' (2019-05-18 13:13:40 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 2de03b45236f3af1800755614fd434d347adf046:
selftests: netfilter: add flowtable test script (2019-05-22 10:56:11 +0200)
----------------------------------------------------------------
Florian Westphal (7):
netfilter: nf_tables: fix oops during rule dump
netfilter: nat: fix udp checksum corruption
netfilter: nf_flow_table: ignore DF bit setting
netfilter: nft_flow_offload: set liberal tracking mode for tcp
netfilter: nft_flow_offload: don't offload when sequence numbers need adjustment
netfilter: nft_flow_offload: IPCB is only valid for ipv4 family
selftests: netfilter: add flowtable test script
Jagdish Motwani (1):
netfilter: nf_queue: fix reinject verdict handling
Jeffrin Jose T (1):
selftests: netfilter: missing error check when setting up veth interface
Phil Sutter (1):
netfilter: nft_fib: Fix existence check support
YueHaibing (1):
ipvs: Fix use-after-free in ip_vs_in
include/net/netfilter/nft_fib.h | 2 +-
net/ipv4/netfilter/nft_fib_ipv4.c | 23 +-
net/ipv6/netfilter/nft_fib_ipv6.c | 16 +-
net/netfilter/ipvs/ip_vs_core.c | 2 +-
net/netfilter/nf_flow_table_ip.c | 3 +-
net/netfilter/nf_nat_helper.c | 2 +-
net/netfilter/nf_queue.c | 1 +
net/netfilter/nf_tables_api.c | 20 +-
net/netfilter/nft_fib.c | 6 +-
net/netfilter/nft_flow_offload.c | 31 +-
tools/testing/selftests/netfilter/Makefile | 2 +-
tools/testing/selftests/netfilter/nft_flowtable.sh | 324 +++++++++++++++++++++
tools/testing/selftests/netfilter/nft_nat.sh | 6 +-
13 files changed, 375 insertions(+), 63 deletions(-)
create mode 100755 tools/testing/selftests/netfilter/nft_flowtable.sh
