kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity

netfilter pull request 26-08-18

Browse source 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEjF9xRqF1emXiQiqU1w0aZmrPKyEFAmqDlHcACgkQ1w0aZmrP
 KyES3w/8C0DTvpbwLOr/QDgbgbo39u78Ih/OxXBqxtXth8bc84DFGXgFxJdHlujI
 g18zRn9/r4Jo2K56nkJDlUiVVJKOsxuhW5WFCG49qgc3cq4DDwhh85DNg3XFgQLs
 q+UPf6UHADChfDbBzLezuHKY/Cot8BvpfirQhcQT2kfgv8XmHp3UNidyu2GM3Zqp
 E31MhRm/ei+IR2R3hhNOs14/cEP3tAY4jTgN4Z3hs63SKw6nZpGDpVtdEHLHWAn0
 1b4EawsPlhGp8fjGGNq2hYCeyVKTQrfe3jS/roJ3IfU3Wq/k5XKufSUcG2WNQgRX
 KifhAXlabcW+tNabay6IWoClIzQPuV+SxcNtswvx+XAnrQ0h9qZb2YDYQlpAE2KP
 uZ4CWMyzhognmUtpfB957RV3/Q8qG3pleqwz+LpVeGGm6VX/cT20g460X7eyq9+e
 Ux27fCfSNkC4UHhR+iqM8BAqpsI47OS/X+PC2enCzmSh+JIfEsBeOcUylHVT+p14
 mF4USETDzWaXN9yHK1bnbANzG/sRo8KT/pS7taN7+vk5Czje50tckqjgZ0bX5ZAK
 tOxZGKBajDEjntOWLEEpMvFknkxsI7H55YGU9Glhsbfrf/gfxv61+XSCe8kQ2+a8
 QbRuMepR45Vfz04ZiHJoalTi7B9FTsGC3dXCGuL9Es8xf8xObPw=
 =qmiO
 -----END PGP SIGNATURE-----

Merge tag 'nf-next-26-08-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

Pablo Neira Ayuso says:

====================
Netfilter/IPVS fixes for net-next

This contains fixes for nf_tables, revisit issues with expectation
infra updates reported by sashiko, an ipset fix for deletions in the
hash:net type and tne fix for the IPVS FTP helper.

1) Validate layer 4 header mangling done via nfnetlink_queue and
   nft_payload, this is a follow up to recent similar validation
   at layer 3. From Zhiling Zou.

2) Do not allocate memory on delete operations in ipset hash:net
   type, delete operation must always succeed. From Florian Westphal.

3) Deliver nft_obj overquota packet path notification directly via
   nfnetlink, do not use the control plane batch logic.
   From Fourie Zhang.

4) Follow up to controlidate check for reinserted dead expectations,
   to cover the nf_conntrack_expect_related_pair() function too.

5) Do not expose expectation dead flag to userspace via ctnetlink.

6) Make commit set_update_list per-netns to prepare to publish
   set clone earlier.

7) Publish the set clone earlier from commit path to address set
   lookup failures during table re-creation, this is targetting
   the rbtree and pipapo set backends.

8) Fix an integer overflow in the IPVS FTP helper. A similar fix
   was already proposed for the conntrack FTP helper months ago.
   From Joas Antonio dos Santos.

* tag 'nf-next-26-08-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
  ipvs: fix integer overflow in ftp helper port/address parsing
  netfilter: nf_tables: call set ops .commit when building new ruleset blob
  netfilter: nf_tables: move set_update_list to nftables per-netns
  netfilter: ctnetlink: do not expose expectation DEAD flag
  netfilter: nf_conntrack_expect: consolidate check for insertion of dead expectation
  netfilter: nf_tables: don't queue packet path object notifications
  netfilter: ipset: remove need to allocate memory on delete operations
  netfilter: validate L4 headers after userspace packet writes
====================

Link: https://patch.msgid.link/20260817232957.1281637-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2026-08-20 11:36:56 -07:00
commit 066ae87fe9
10 changed files with 302 additions and 114 deletions
Download patch file Download diff file Expand all files Collapse all files