Hi,
The following patchset contains Netfilter fixes for net:
1) Incorrect netlink report logic in flowtable and genID.
2) Add a selftest to check that wireguard passes the right sk
to ip_route_me_harder, from Jason A. Donenfeld.
3) Pass the actual sk to ip_route_me_harder(), also from Jason.
4) Missing expression validation of updates via nft --check.
5) Update byte and packet counters regardless of whether they
match, from Stefano Brivio.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 07e0887302450a62f51dba72df6afb5fabb23d1c:
Merge tag 'fallthrough-fixes-clang-5.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux (2020-10-29 13:02:52 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to 7d10e62c2ff8e084c136c94d32d9a94de4d31248:
netfilter: ipset: Update byte and packet counters regardless of whether they match (2020-10-31 11:11:11 +0100)
----------------------------------------------------------------
Jason A. Donenfeld (2):
wireguard: selftests: check that route_me_harder packets use the right sk
netfilter: use actual socket sk rather than skb sk when routing harder
Pablo Neira Ayuso (2):
netfilter: nftables: fix netlink report logic in flowtable and genid
netfilter: nf_tables: missing validation from the abort path
Stefano Brivio (1):
netfilter: ipset: Update byte and packet counters regardless of whether they match
include/linux/netfilter/nfnetlink.h | 9 ++++++++-
include/linux/netfilter_ipv4.h | 2 +-
include/linux/netfilter_ipv6.h | 10 +++++-----
net/ipv4/netfilter.c | 8 +++++---
net/ipv4/netfilter/iptable_mangle.c | 2 +-
net/ipv4/netfilter/nf_reject_ipv4.c | 2 +-
net/ipv6/netfilter.c | 6 +++---
net/ipv6/netfilter/ip6table_mangle.c | 2 +-
net/netfilter/ipset/ip_set_core.c | 3 ++-
net/netfilter/ipvs/ip_vs_core.c | 4 ++--
net/netfilter/nf_nat_proto.c | 4 ++--
net/netfilter/nf_synproxy_core.c | 2 +-
net/netfilter/nf_tables_api.c | 19 ++++++++++++-------
net/netfilter/nfnetlink.c | 22 ++++++++++++++++++----
net/netfilter/nft_chain_route.c | 4 ++--
net/netfilter/utils.c | 4 ++--
tools/testing/selftests/wireguard/netns.sh | 8 ++++++++
.../testing/selftests/wireguard/qemu/kernel.config | 2 ++
18 files changed, 76 insertions(+), 37 deletions(-)
