Hi,
The following patchset contains Netfilter fixes for net:
1) Use signed integer in ipv6_skip_exthdr() called from nf_confirm().
Reported by static analysis tooling, patch from Florian Westphal.
2) Missing set type checks in nf_tables: Validate that set declaration
matches the an existing set type, otherwise bail out with EEXIST.
Currently, nf_tables silently accepts the re-declaration with a
different type but it bails out later with EINVAL when the user adds
entries to the set. This fix is relatively large because it requires
two preparation patches that are included in this batch.
3) Do not ignore updates of timeout and gc_interval parameters in
existing sets.
4) Fix a hang when 0/0 subnets is added to a hash:net,port,net type of
ipset. Except hash:net,port,net and hash:net,iface, the set types don't
support 0/0 and the auxiliary functions rely on this fact. So 0/0 needs
a special handling in hash:net,port,net which was missing (hash:net,iface
was not affected by this bug), from Jozsef Kadlecsik.
5) When adding/deleting large number of elements in one step in ipset,
it can take a reasonable amount of time and can result in soft lockup
errors. This patch is a complete rework of the previous version in order
to use a smaller internal batch limit and at the same time removing
the external hard limit to add arbitrary number of elements in one step.
Also from Jozsef Kadlecsik.
Except for patch #1, which fixes a bug introduced in the previous net-next
development cycle, anything else has been broken for several releases.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git
Thanks.
----------------------------------------------------------------
The following changes since commit 19e72b064fc32cd58f6fc0b1eb64ac2e4f770e76:
net: fec: check the return value of build_skb() (2022-12-20 11:33:24 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git HEAD
for you to fetch changes up to 5e29dc36bd5e2166b834ceb19990d9e68a734d7d:
netfilter: ipset: Rework long task execution when adding/deleting entries (2023-01-02 15:10:05 +0100)
----------------------------------------------------------------
Florian Westphal (1):
netfilter: conntrack: fix ipv6 exthdr error check
Jozsef Kadlecsik (2):
netfilter: ipset: fix hash:net,port,net hang with /0 subnet
netfilter: ipset: Rework long task execution when adding/deleting entries
Pablo Neira Ayuso (4):
netfilter: nf_tables: consolidate set description
netfilter: nf_tables: add function to create set stateful expressions
netfilter: nf_tables: perform type checking for existing sets
netfilter: nf_tables: honor set timeout and garbage collection updates
include/linux/netfilter/ipset/ip_set.h | 2 +-
include/net/netfilter/nf_tables.h | 25 ++-
net/netfilter/ipset/ip_set_core.c | 7 +-
net/netfilter/ipset/ip_set_hash_ip.c | 14 +-
net/netfilter/ipset/ip_set_hash_ipmark.c | 13 +-
net/netfilter/ipset/ip_set_hash_ipport.c | 13 +-
net/netfilter/ipset/ip_set_hash_ipportip.c | 13 +-
net/netfilter/ipset/ip_set_hash_ipportnet.c | 13 +-
net/netfilter/ipset/ip_set_hash_net.c | 17 +-
net/netfilter/ipset/ip_set_hash_netiface.c | 15 +-
net/netfilter/ipset/ip_set_hash_netnet.c | 23 +--
net/netfilter/ipset/ip_set_hash_netport.c | 19 +-
net/netfilter/ipset/ip_set_hash_netportnet.c | 40 ++--
net/netfilter/nf_conntrack_proto.c | 7 +-
net/netfilter/nf_tables_api.c | 261 ++++++++++++++++++---------
15 files changed, 293 insertions(+), 189 deletions(-)
