kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity

netfilter pull request nf-next-26-07-02

Browse source 
-----BEGIN PGP SIGNATURE-----
 
 iQJdBAABCABHFiEEgKkgxbID4Gn1hq6fcJGo2a1f9gAFAmpGOrIbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyDRxmd0BzdHJsZW4uZGUACgkQcJGo2a1f9gA+vQ//
 eYDf4mJOdBusDUnc1FA4XXDtALhr3BNXs6EXckL4yUzK9SlYhZj7CfTxiyZlOW8U
 emh4dOnIvuTLvEdr7OsY7jn+kUoN7jxuRzZ289mCj0JstlJsF4IEERAeKAHsQXTr
 ro2pkovbsVKHx2aQGIIvQSN4y4Hv/nuAixGTDVTOOcTjDs2kh8DwvS2Tp4mKHwLO
 4yITfrPqK349Kk5ojGr5I9rD/IThAxkg9WMgZD/me8rxnWg/g8ZVOYfOXrCGQwFL
 SegIdWNWO3CFD1C1Ls6UYaxjCh8A+LmgbWGLRUbFELmaMzRWEZq2OmVGZuQu366s
 lUc8uHTMTZwwBTD6e1/DadYOXPkbn9/Uz025KwQggvAcw5O8qqIf2Ow57ETr5CwN
 2HqVp2zSwxcgW6OFD2iVElCjk6MMA9sIOa/Iz64bz1dEHuSzvOslMgrZuPtGrRrZ
 aXp+VsF5OZuK2DiYCIgv1vK8Xr+vfeaztYMeMmcMawAbglHlShbWt6c9jMRTC2Qt
 yj31wWIxFB4qlA9mAc9XE4A89J7y/WgpQF2s7uHvZokvVi1dsz5YQqJqRCo0732G
 GmsB7+8oduldllokezsTKBCS5tUxiuN3YqYI3+7O+5+6JqVu2t7ZV7H1jvWgQePj
 0RmOM5Jt6P2L/mdTKHIc5GcGUNCo63WzpaceNsgEA3U=
 =yph7
 -----END PGP SIGNATURE-----

Merge tag 'nf-next-26-07-02' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

Florian Westphal says:

====================
netfilter: updates for net-next

The following patchset contains Netfilter updates for *net-next*.

1) Update nfnetlink_hook to dump the individual NAT type chains
instead of the nat base chains to userspace. From Phil Sutter.

2) Replace strlcpy/strlcat() with snprintf() in x_tables, from Ian Bridges.

3) Start replacing u_int8_t and u_int16t with u8 and u16 in netfilter.
From Carlos Grillet.

4) Replace strcpy() with strscpy() in netfilter, from David Laight.

5) Remove redundant NULL check before kvfree().

6) Add parameter validation to xt_tcpmss. Ensure mss_min <= mss_max and
invert <= 1.  From Feng Wu.

7) Add checkentry for xt_dscp 'tos' match. Implement tos_mt_check() to reject
invalid invert values.  Also from Feng Wu.

8) Stop hashing nf_conntrack_helper by tuple. Switch to hashing by name and
L4 protocol.

9) Remove tuples from conntrack helper definitions and port usage from
broadcast helpers. Add netlink policy validation to prevent protocol
number truncation.

10) Remove obsolete netfilter conntrack module parameters.

11) Bound num_counters in ebtables: do_replace() by MAX_EBT_ENTRIES to prevent
oversized vmalloc_array() allocations.  From Jiayuan Chen.

12) Make expectations created via nft_ct rules work with NAT.

netfilter pull request nf-next-26-07-02

* tag 'nf-next-26-07-02' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
  netfilter: nft_ct: support expectation creation for natted flows
  netfilter: ebtables: bound num_counters like nentries in do_replace()
  netfilter: conntrack: remove obsolete module parameters
  netfilter: conntrack: get rid of tuple in helper definitions
  netfilter: nf_conntrack_helper: do not hash by tuple
  netfilter: xt_dscp: add checkentry for tos match
  netfilter: xt_tcpmss: add checkentry for parameter validation
  netfilter: remove redundant null check before kvfree()
  netfilter: avoid strcpy usage
  netfilter: replace u_int8_t and u_int16t with u8 and u16
  netfilter: x_tables: replace strlcat() with snprintf()
  netfilter: nfnetlink_hook: Dump nat type chains
====================

Link: https://patch.msgid.link/20260702105003.13550-1-fw@strlen.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Paolo Abeni 2026-07-03 22:00:23 +02:00
commit b73bc9ca36
36 changed files with 246 additions and 260 deletions
Download patch file Download diff file Expand all files Collapse all files

7
include/linux/netfilter.h
View file

2
include/linux/netfilter/nf_conntrack_h323.h
View file

2
include/linux/netfilter/nf_conntrack_pptp.h
View file

2
include/linux/netfilter/nf_conntrack_sane.h
View file

2
include/linux/netfilter/nf_conntrack_tftp.h
View file

2
include/net/ip_vs.h
View file

10
include/net/netfilter/nf_conntrack_helper.h
View file

12
net/bridge/netfilter/ebtables.c
View file

2
net/ipv4/netfilter/nf_nat_snmp_basic_main.c
View file

2
net/netfilter/ipvs/ip_vs_nfct.c
View file

6
net/netfilter/nf_conntrack_amanda.c
View file

2
net/netfilter/nf_conntrack_broadcast.c
View file

32
net/netfilter/nf_conntrack_ftp.c
View file

12
net/netfilter/nf_conntrack_h323_main.c
View file

77
net/netfilter/nf_conntrack_helper.c
View file

27
net/netfilter/nf_conntrack_irc.c
View file

2
net/netfilter/nf_conntrack_netbios_ns.c
View file

6
net/netfilter/nf_conntrack_ovs.c
View file

2
net/netfilter/nf_conntrack_pptp.c
View file

34
net/netfilter/nf_conntrack_sane.c
View file

45
net/netfilter/nf_conntrack_sip.c
View file

4
net/netfilter/nf_conntrack_snmp.c
View file

33
net/netfilter/nf_conntrack_tftp.c
View file

6
net/netfilter/nf_nat_core.c
View file

8
net/netfilter/nf_nat_proto.c
View file

21
net/netfilter/nfnetlink_cthelper.c
View file

2
net/netfilter/nfnetlink_cttimeout.c
View file

37
net/netfilter/nfnetlink_hook.c
View file

35
net/netfilter/nft_ct.c
View file

3
net/netfilter/nft_set_rbtree.c
View file

30
net/netfilter/x_tables.c
View file

8
net/netfilter/xt_TCPOPTSTRIP.c
View file

12
net/netfilter/xt_dscp.c
View file

2
net/netfilter/xt_recent.c
View file

13
net/netfilter/xt_tcpmss.c
View file

4
net/sched/act_ct.c
View file