Hi,
The following patchset contains Netfilter fixes for net:
1) Allow conntrack entries with l3num == NFPROTO_IPV4 or == NFPROTO_IPV6
only via ctnetlink, from Will McVicker.
2) Batch notifications to userspace to improve netlink socket receive
utilization.
3) Restore mark based dump filtering via ctnetlink, from Martin Willi.
4) nf_conncount_init() fails with -EPROTO with CONFIG_IPV6, from
Eelco Chaudron.
5) Containers fail to match on meta skuid and skgid, use socket user_ns
to retrieve meta skuid and skgid.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thank you.
----------------------------------------------------------------
The following changes since commit 19162fd4063a3211843b997a454b505edb81d5ce:
hv_netvsc: Fix hibernation for mlx5 VF driver (2020-09-07 21:04:36 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 0c92411bb81de9bc516d6924f50289d8d5f880e5:
netfilter: nft_meta: use socket user_ns to retrieve skuid and skgid (2020-09-08 13:04:56 +0200)
----------------------------------------------------------------
Eelco Chaudron (1):
netfilter: conntrack: nf_conncount_init is failing with IPv6 disabled
Martin Willi (1):
netfilter: ctnetlink: fix mark based dump filtering regression
Pablo Neira Ayuso (2):
netfilter: nf_tables: coalesce multiple notifications into one skbuff
netfilter: nft_meta: use socket user_ns to retrieve skuid and skgid
Will McVicker (1):
netfilter: ctnetlink: add a range check for l3/l4 protonum
include/net/netns/nftables.h | 1 +
net/netfilter/nf_conntrack_netlink.c | 22 +++---------
net/netfilter/nf_conntrack_proto.c | 2 ++
net/netfilter/nf_tables_api.c | 70 +++++++++++++++++++++++++++++-------
net/netfilter/nft_meta.c | 4 +--
5 files changed, 67 insertions(+), 32 deletions(-)
