Hi,
The following patchset contains Netfilter fixes for net:
Patch #1 restores NFPROTO_INET with nft_compat, from Ignat Korchagin.
Patch #2 fixes an issue with bridge netfilter and broadcast/multicast
packets.
There is a day 0 bug in br_netfilter when used with connection tracking.
Conntrack assumes that an nf_conn structure that is not yet added to
hash table ("unconfirmed"), is only visible by the current cpu that is
processing the sk_buff.
For bridge this isn't true, sk_buff can get cloned in between, and
clones can be processed in parallel on different cpu.
This patch disables NAT and conntrack helpers for multicast packets.
Patch #3 adds a selftest to cover for the br_netfilter bug.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-02-29
Thanks.
----------------------------------------------------------------
The following changes since commit 359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79:
l2tp: pass correct message length to ip6_append_data (2024-02-22 10:42:17 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-02-29
for you to fetch changes up to 6523cf516c55db164f8f73306027b1caebb5628e:
selftests: netfilter: add bridge conntrack + multicast test case (2024-02-29 00:22:48 +0100)
----------------------------------------------------------------
netfilter pull request 24-02-29
----------------------------------------------------------------
Florian Westphal (2):
netfilter: bridge: confirm multicast packets before passing them up the stack
selftests: netfilter: add bridge conntrack + multicast test case
Ignat Korchagin (1):
netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
include/linux/netfilter.h | 1 +
net/bridge/br_netfilter_hooks.c | 96 +++++++++++
net/bridge/netfilter/nf_conntrack_bridge.c | 30 ++++
net/netfilter/nf_conntrack_core.c | 1 +
net/netfilter/nft_compat.c | 20 +++
tools/testing/selftests/netfilter/Makefile | 3 +-
.../selftests/netfilter/bridge_netfilter.sh | 188 +++++++++++++++++++++
7 files changed, 338 insertions(+), 1 deletion(-)
create mode 100644 tools/testing/selftests/netfilter/bridge_netfilter.sh
