Hi,
The following patchset contains Netfilter fixes for net:
1) Fix mangling of TCP options with non-linear skbuff, from Xiao Liang.
2) OOB read in xt_sctp due to missing sanitization of array length field.
From Wander Lairson Costa.
3) OOB read in xt_u32 due to missing sanitization of array length field.
Also from Wander Lairson Costa.
All of them above, always broken for several releases.
4) Missing audit log for set element reset command, from Phil Sutter.
5) Missing audit log for rule reset command, also from Phil.
These audit log support are missing in 6.5.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-08-31
Thanks.
----------------------------------------------------------------
The following changes since commit bd6c11bc43c496cddfc6cf603b5d45365606dbd5:
Merge tag 'net-next-6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next (2023-08-29 11:33:01 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-08-31
for you to fetch changes up to ea078ae9108e25fc881c84369f7c03931d22e555:
netfilter: nf_tables: Audit log rule reset (2023-08-31 01:29:28 +0200)
----------------------------------------------------------------
netfilter pull request 23-08-31
----------------------------------------------------------------
Phil Sutter (2):
netfilter: nf_tables: Audit log setelem reset
netfilter: nf_tables: Audit log rule reset
Wander Lairson Costa (2):
netfilter: xt_sctp: validate the flag_info count
netfilter: xt_u32: validate user space input
Xiao Liang (1):
netfilter: nft_exthdr: Fix non-linear header modification
include/linux/audit.h | 2 ++
kernel/auditsc.c | 2 ++
net/netfilter/nf_tables_api.c | 49 ++++++++++++++++++++++++++++++++++++++++---
net/netfilter/nft_exthdr.c | 20 +++++++-----------
net/netfilter/xt_sctp.c | 2 ++
net/netfilter/xt_u32.c | 21 +++++++++++++++++++
6 files changed, 81 insertions(+), 15 deletions(-)
