Jakub Kicinski 10905b4a68 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf ... Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Protect nft_ct template with global mutex, from Pavel Skripkin. 2) Two recent commits switched inet rt and nexthop exception hashes from jhash to siphash. If those two spots are problematic then conntrack is affected as well, so switch voer to siphash too. While at it, add a hard upper limit on chain lengths and reject insertion if this is hit. Patches from Florian Westphal. 3) Fix use-after-scope in nf_socket_ipv6 reported by KASAN, from Benjamin Hesmans. * git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf: netfilter: socket: icmp6: fix use-after-scope netfilter: refuse insertion if chain has grown too large netfilter: conntrack: switch to siphash netfilter: conntrack: sanitize table size default settings netfilter: nft_ct: protect nft_ct_pcpu_template_refcnt with mutex ==================== Link: https://lore.kernel.org/r/20210903163020.13741-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2021-09-03 16:20:37 -07:00
..
ipset	netfilter: ipset: Limit the maximal range of consecutive elements to add/delete	2021-08-04 10:41:03 +02:00
ipvs	Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net	2021-06-07 13:01:52 -07:00
Kconfig	netfilter: nfnetlink_hook: add depends-on nftables	2021-06-09 21:29:12 +02:00
Makefile	netfilter: add netfilter hooks to SRv6 data plane	2021-08-30 01:51:36 +02:00
core.c	…
nf_conncount.c	…
nf_conntrack_acct.c	…
nf_conntrack_amanda.c	…
nf_conntrack_broadcast.c	…
nf_conntrack_core.c	netfilter: refuse insertion if chain has grown too large	2021-08-30 11:52:21 +02:00
nf_conntrack_ecache.c	netfilter: ecache: remove nf_exp_event_notifier structure	2021-08-25 12:50:38 +02:00
nf_conntrack_expect.c	netfilter: conntrack: switch to siphash	2021-08-30 11:49:55 +02:00
nf_conntrack_extend.c	…
nf_conntrack_ftp.c	netfilter: remove BUG_ON() after skb_header_pointer()	2021-05-05 23:45:48 +02:00
nf_conntrack_h323_asn1.c	…
nf_conntrack_h323_main.c	netfilter: fix clang-12 fmt string warnings	2021-06-01 23:53:51 +02:00
nf_conntrack_h323_types.c	…
nf_conntrack_helper.c	netfilter: nftables: add nf_ct_pernet() helper function	2021-06-07 12:23:37 +02:00
nf_conntrack_irc.c	netfilter: remove BUG_ON() after skb_header_pointer()	2021-05-05 23:45:48 +02:00
nf_conntrack_labels.c	…
nf_conntrack_netbios_ns.c	…
nf_conntrack_netlink.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2021-09-03 16:20:37 -07:00
nf_conntrack_pptp.c	netfilter: remove BUG_ON() after skb_header_pointer()	2021-05-05 23:45:48 +02:00
nf_conntrack_proto.c	netfilter: conntrack: nf_ct_gre_keymap_flush() removal	2021-07-02 02:07:01 +02:00
nf_conntrack_proto_dccp.c	netfilter: conntrack: pass hook state to log functions	2021-06-18 14:47:43 +02:00
nf_conntrack_proto_generic.c	…
nf_conntrack_proto_gre.c	netfilter: conntrack: nf_ct_gre_keymap_flush() removal	2021-07-02 02:07:01 +02:00
nf_conntrack_proto_icmp.c	netfilter: conntrack: pass hook state to log functions	2021-06-18 14:47:43 +02:00
nf_conntrack_proto_icmpv6.c	netfilter: conntrack: pass hook state to log functions	2021-06-18 14:47:43 +02:00
nf_conntrack_proto_sctp.c	netfilter: conntrack: pass hook state to log functions	2021-06-18 14:47:43 +02:00
nf_conntrack_proto_tcp.c	netfilter: conntrack: remove offload_pickup sysctl again	2021-08-06 17:07:41 +02:00
nf_conntrack_proto_udp.c	netfilter: conntrack: remove offload_pickup sysctl again	2021-08-06 17:07:41 +02:00
nf_conntrack_sane.c	netfilter: remove BUG_ON() after skb_header_pointer()	2021-05-05 23:45:48 +02:00
nf_conntrack_seqadj.c	…
nf_conntrack_sip.c	…
nf_conntrack_snmp.c	…
nf_conntrack_standalone.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2021-09-03 16:20:37 -07:00
nf_conntrack_tftp.c	…
nf_conntrack_timeout.c	…
nf_conntrack_timestamp.c	…
nf_dup_netdev.c	…
nf_flow_table_core.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-08-13 06:41:22 -07:00
nf_flow_table_inet.c	…
nf_flow_table_ip.c	…
nf_flow_table_offload.c	net: Fix offloading indirect devices dependency on qdisc order creation	2021-08-19 13:19:30 +01:00
nf_hooks_lwtunnel.c	netfilter: add netfilter hooks to SRv6 data plane	2021-08-30 01:51:36 +02:00
nf_internals.h	…
nf_log.c	…
nf_log_syslog.c	netfilter: nf_log_syslog: Unset bridge logger in pernet exit	2021-04-26 03:20:47 +02:00
nf_nat_amanda.c	…
nf_nat_core.c	netfilter: conntrack: switch to siphash	2021-08-30 11:49:55 +02:00
nf_nat_ftp.c	…
nf_nat_helper.c	…
nf_nat_irc.c	…
nf_nat_masquerade.c	…
nf_nat_proto.c	…
nf_nat_redirect.c	…
nf_nat_sip.c	…
nf_nat_tftp.c	…
nf_queue.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2021-08-11 10:22:26 +01:00
nf_sockopt.c	…
nf_synproxy_core.c	netfilter: synproxy: Fix out of bounds when parsing TCP options	2021-06-10 14:26:18 -07:00
nf_tables_api.c	netfilter: nf_tables: fix audit memory leak in nf_tables_commit	2021-07-17 02:25:18 +02:00
nf_tables_core.c	netfilter: nf_tables: add last expression	2021-06-17 03:23:00 +02:00
nf_tables_offload.c	net: Fix offloading indirect devices dependency on qdisc order creation	2021-08-19 13:19:30 +01:00
nf_tables_trace.c	netfilter: nf_tables: add and use nft_thoff helper	2021-05-29 01:04:54 +02:00
nfnetlink.c	netfilter: add new hook nfnl subsystem	2021-06-07 12:41:10 +02:00
nfnetlink_acct.c	netfilter: use nfnetlink_unicast()	2021-05-29 01:04:53 +02:00
nfnetlink_cthelper.c	Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net	2021-06-07 13:01:52 -07:00
nfnetlink_cttimeout.c	netfilter: use nfnetlink_unicast()	2021-05-29 01:04:53 +02:00
nfnetlink_hook.c	netfilter: nfnetlink_hook: translate inet ingress to netdev	2021-08-06 17:07:41 +02:00
nfnetlink_log.c	netfilter: nfnetlink: add struct nfgenmsg to struct nfnl_info and use it	2021-06-07 12:23:36 +02:00
nfnetlink_osf.c	netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check	2021-05-05 22:26:09 +02:00
nfnetlink_queue.c	netfilter: nf_queue: move hookfn registration out of struct net	2021-08-10 17:32:00 +02:00
nft_bitwise.c	…
nft_byteorder.c	…
nft_chain_filter.c	netfilter: nf_tables: remove unused arg in nft_set_pktinfo_unspec()	2021-05-29 01:04:54 +02:00
nft_chain_nat.c	netfilter: nf_tables: remove unused arg in nft_set_pktinfo_unspec()	2021-05-29 01:04:54 +02:00
nft_chain_route.c	netfilter: nf_tables: remove unused arg in nft_set_pktinfo_unspec()	2021-05-29 01:04:54 +02:00
nft_cmp.c	…
nft_compat.c	netfilter: nft_compat: use nfnetlink_unicast()	2021-08-01 12:00:49 +02:00
nft_connlimit.c	…
nft_counter.c	…
nft_ct.c	netfilter: nft_ct: protect nft_ct_pcpu_template_refcnt with mutex	2021-08-11 11:22:19 +02:00
nft_dup_netdev.c	…
nft_dynset.c	netfilter: nftables: add nft_pernet() helper function	2021-04-26 03:58:17 +02:00
nft_exthdr.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-06-29 15:45:27 -07:00
nft_fib.c	…
nft_fib_inet.c	…
nft_fib_netdev.c	…
nft_flow_offload.c	netfilter: nf_tables: add and use nft_thoff helper	2021-05-29 01:04:54 +02:00
nft_fwd_netdev.c	…
nft_hash.c	…
nft_immediate.c	…
nft_last.c	netfilter: nft_last: avoid possible false sharing	2021-07-23 14:18:02 +02:00
nft_limit.c	…
nft_log.c	…
nft_lookup.c	netfilter: nf_tables: prefer direct calls for set lookups	2021-05-29 01:04:27 +02:00
nft_masq.c	…
nft_meta.c	…
nft_nat.c	netfilter: nft_nat: allow to specify layer 4 protocol NAT only	2021-07-23 14:18:03 +02:00
nft_numgen.c	…
nft_objref.c	netfilter: add and use nft_set_do_lookup helper	2021-05-28 21:11:41 +02:00
nft_osf.c	netfilter: nft_osf: check for TCP packet before further processing	2021-06-16 20:51:50 +02:00
nft_payload.c	netfilter: nf_tables: add and use nft_thoff helper	2021-05-29 01:04:54 +02:00
nft_queue.c	…
nft_quota.c	…
nft_range.c	…
nft_redir.c	…
nft_reject.c	…
nft_reject_inet.c	netfilter: nf_tables: add and use nft_sk helper	2021-05-29 01:04:53 +02:00
nft_reject_netdev.c	…
nft_rt.c	…
nft_set_bitmap.c	netfilter: nf_tables: prefer direct calls for set lookups	2021-05-29 01:04:27 +02:00
nft_set_hash.c	netfilter: nf_tables: prefer direct calls for set lookups	2021-05-29 01:04:27 +02:00
nft_set_pipapo.c	netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version	2021-05-14 01:42:52 +02:00
nft_set_pipapo.h	netfilter: nf_tables: prefer direct calls for set lookups	2021-05-29 01:04:27 +02:00
nft_set_pipapo_avx2.c	netfilter: nft_set_pipapo_avx2: fix up description warnings	2021-06-01 23:53:51 +02:00
nft_set_pipapo_avx2.h	netfilter: nf_tables: prefer direct calls for set lookups	2021-05-29 01:04:27 +02:00
nft_set_rbtree.c	netfilter: nf_tables: prefer direct calls for set lookups	2021-05-29 01:04:27 +02:00
nft_socket.c	netfilter: nft_socket: fix build with CONFIG_SOCK_CGROUP_DATA=n	2021-04-27 22:34:05 +02:00
nft_synproxy.c	netfilter: nf_tables: add and use nft_thoff helper	2021-05-29 01:04:54 +02:00
nft_tproxy.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-06-29 15:45:27 -07:00
nft_tunnel.c	…
nft_xfrm.c	…
utils.c	…
x_tables.c	netfilter: x_tables: never register tables by default	2021-08-09 10:22:01 +02:00
xt_AUDIT.c	netfilter: fix clang-12 fmt string warnings	2021-06-01 23:53:51 +02:00
xt_CHECKSUM.c	…
xt_CLASSIFY.c	…
xt_CONNSECMARK.c	…
xt_CT.c	netfilter: remove xt pernet data	2021-08-01 12:00:51 +02:00
xt_DSCP.c	…
xt_HL.c	…
xt_HMARK.c	…
xt_IDLETIMER.c	…
xt_LED.c	…
xt_LOG.c	…
xt_MASQUERADE.c	…
xt_NETMAP.c	…
xt_NFLOG.c	…
xt_NFQUEUE.c	…
xt_RATEEST.c	…
xt_REDIRECT.c	…
xt_SECMARK.c	netfilter: xt_SECMARK: add new revision to fix structure layout	2021-05-03 23:02:44 +02:00
xt_TCPMSS.c	…
xt_TCPOPTSTRIP.c	…
xt_TEE.c	…
xt_TPROXY.c	netfilter: disable defrag once its no longer needed	2021-04-26 03:20:07 +02:00
xt_TRACE.c	…
xt_addrtype.c	…
xt_bpf.c	bpf: Refactor BPF_PROG_RUN into a function	2021-08-17 00:45:07 +02:00
xt_cgroup.c	…
xt_cluster.c	…
xt_comment.c	…
xt_connbytes.c	…
xt_connlabel.c	…
xt_connlimit.c	…
xt_connmark.c	…
xt_conntrack.c	…
xt_cpu.c	…
xt_dccp.c	…
xt_devgroup.c	…
xt_dscp.c	…
xt_ecn.c	…
xt_esp.c	…
xt_hashlimit.c	…
xt_helper.c	…
xt_hl.c	…
xt_ipcomp.c	…
xt_iprange.c	…
xt_ipvs.c	…
xt_l2tp.c	…
xt_length.c	…
xt_limit.c	netfilter: x_tables: improve limit_mt scalability	2021-05-29 01:04:52 +02:00
xt_mac.c	…
xt_mark.c	…
xt_multiport.c	…
xt_nat.c	…
xt_nfacct.c	…
xt_osf.c	…
xt_owner.c	…
xt_physdev.c	…
xt_pkttype.c	…
xt_policy.c	…
xt_quota.c	…
xt_rateest.c	…
xt_realm.c	…
xt_recent.c	…
xt_repldata.h	…
xt_sctp.c	…
xt_set.c	…
xt_socket.c	netfilter: disable defrag once its no longer needed	2021-04-26 03:20:07 +02:00
xt_state.c	…
xt_statistic.c	…
xt_string.c	…
xt_tcpmss.c	…
xt_tcpudp.c	…
xt_time.c	…
xt_u32.c	…