Hi,
The following patchset contains Netfilter fixes for net:
1) Do not refresh timeout in SYN_SENT for syn retransmissions.
Add selftest for unreplied TCP connection, from Florian Westphal.
2) Fix null dereference from error path with hardware offload
in nftables.
3) Remove useless nf_ct_gre_keymap_flush() from netns exit path,
from Vasily Averin.
4) Missing rcu read-lock side in ctnetlink helper info dump,
also from Vasily.
5) Do not mark RST in the reply direction coming after SYN packet
for an out-of-sync entry, from Ali Abdallah and Florian Westphal.
6) Add tcp_ignore_invalid_rst sysctl to allow to disable out of
segment RSTs, from Ali.
7) KCSAN fix for nf_conntrack_all_lock(), from Manfred Spraul.
8) Honor NFTA_LAST_SET in nft_last.
9) Fix incorrect arithmetics when restore last_jiffies in nft_last.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 5140aaa4604ba96685dc04b4d2dde3384bbaecef:
s390: iucv: Avoid field over-reading memcpy() (2021-07-01 15:54:01 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD
for you to fetch changes up to d322957ebfb9c21c2c72b66680f7c3ccd724e081:
netfilter: uapi: refer to nfnetlink_conntrack.h, not nf_conntrack_netlink.h (2021-07-07 17:39:15 +0200)
----------------------------------------------------------------
Ali Abdallah (2):
netfilter: conntrack: improve RST handling when tuple is re-used
netfilter: conntrack: add new sysctl to disable RST check
Colin Ian King (1):
netfilter: nf_tables: Fix dereference of null pointer flow
Duncan Roe (1):
netfilter: uapi: refer to nfnetlink_conntrack.h, not nf_conntrack_netlink.h
Florian Westphal (2):
selftest: netfilter: add test case for unreplied tcp connections
netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state
Manfred Spraul (1):
netfilter: conntrack: Mark access for KCSAN
Pablo Neira Ayuso (2):
netfilter: nft_last: honor NFTA_LAST_SET on restoration
netfilter: nft_last: incorrect arithmetics when restoring last used
Vasily Averin (2):
netfilter: conntrack: nf_ct_gre_keymap_flush() removal
netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo
Documentation/networking/nf_conntrack-sysctl.rst | 6 +
include/net/netfilter/nf_conntrack_core.h | 1 -
include/net/netns/conntrack.h | 1 +
include/uapi/linux/netfilter/nfnetlink_log.h | 2 +-
include/uapi/linux/netfilter/nfnetlink_queue.h | 4 +-
net/netfilter/nf_conntrack_core.c | 11 +-
net/netfilter/nf_conntrack_netlink.c | 3 +
net/netfilter/nf_conntrack_proto.c | 7 -
net/netfilter/nf_conntrack_proto_gre.c | 13 --
net/netfilter/nf_conntrack_proto_tcp.c | 69 ++++++---
net/netfilter/nf_conntrack_standalone.c | 10 ++
net/netfilter/nf_tables_api.c | 3 +-
net/netfilter/nft_last.c | 12 +-
tools/testing/selftests/netfilter/Makefile | 2 +-
.../selftests/netfilter/conntrack_tcp_unreplied.sh | 167 +++++++++++++++++++++
15 files changed, 262 insertions(+), 49 deletions(-)
create mode 100755 tools/testing/selftests/netfilter/conntrack_tcp_unreplied.sh
