David S. Miller 23416e2304 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf ... Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following patchset contains Netfilter/IPVS fixes for your net tree, they are: 1) When using IPVS in direct-routing mode, normal traffic from the LVS host to a back-end server is sometimes incorrectly NATed on the way back into the LVS host. Patch to fix this from Julian Anastasov. 2) Calm down clang compilation warning in ctnetlink due to type mismatch, from Matthias Kaehlcke. 3) Do not re-setup NAT for conntracks that are already confirmed, this is fixing a problem that was introduced in the previous nf-next batch. Patch from Liping Zhang. 4) Do not allow conntrack helper removal from userspace cthelper infrastructure if already in used. This comes with an initial patch to introduce nf_conntrack_helper_put() that is required by this fix. From Liping Zhang. 5) Zero the pad when copying data to userspace, otherwise iptables fails to remove rules. This is a follow up on the patchset that sorts out the internal match/target structure pointer leak to userspace. Patch from the same author, Willem de Bruijn. This also comes with a build failure when CONFIG_COMPAT is not on, coming in the last patch of this series. 6) SYNPROXY crashes with conntrack entries that are created via ctnetlink, more specifically via conntrackd state sync. Patch from Eric Leblond. 7) RCU safe iteration on set element dumping in nf_tables, from Liping Zhang. 8) Missing sanitization of immediate date for the bitwise and cmp expressions in nf_tables. 9) Refcounting logic for chain and objects from set elements does not integrate into the nf_tables 2-phase commit protocol. 10) Missing sanitization of target verdict in ebtables arpreply target, from Gao Feng. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>		2017-05-21 13:00:02 -04:00
..
ipset	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-05-01 10:47:53 -04:00
ipvs	ipvs: SNAT packet replies only for NATed connections	2017-05-08 11:38:35 +02:00
Kconfig	…
Makefile	…
core.c	netfilter: nf_queue: only call synchronize_net twice if nf_queue is active	2017-05-01 11:19:12 +02:00
nf_conntrack_acct.c	netfilter: conntrack: mark extension structs as const	2017-04-26 09:30:22 +02:00
nf_conntrack_amanda.c	netfilter: helper: add build-time asserts for helper data size	2017-04-19 17:55:16 +02:00
nf_conntrack_broadcast.c	…
nf_conntrack_core.c	Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-05-10 10:30:46 -07:00
nf_conntrack_ecache.c	netfilter: conntrack: mark extension structs as const	2017-04-26 09:30:22 +02:00
nf_conntrack_expect.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-05-01 10:47:53 -04:00
nf_conntrack_extend.c	netfilter: nf_ct_ext: invoke destroy even when ext is not attached	2017-05-01 11:48:49 +02:00
nf_conntrack_ftp.c	netfilter: helpers: remove data_len usage for inkernel helpers	2017-04-19 17:55:17 +02:00
nf_conntrack_h323_asn1.c	…
nf_conntrack_h323_main.c	netfilter: helpers: remove data_len usage for inkernel helpers	2017-04-19 17:55:17 +02:00
nf_conntrack_h323_types.c	…
nf_conntrack_helper.c	netfilter: nfnl_cthelper: reject del request if helper obj is in use	2017-05-15 12:42:29 +02:00
nf_conntrack_irc.c	netfilter: helpers: remove data_len usage for inkernel helpers	2017-04-19 17:55:17 +02:00
nf_conntrack_l3proto_generic.c	…
nf_conntrack_labels.c	netfilter: conntrack: mark extension structs as const	2017-04-26 09:30:22 +02:00
nf_conntrack_netbios_ns.c	netfilter: helper: add build-time asserts for helper data size	2017-04-19 17:55:16 +02:00
nf_conntrack_netlink.c	netfilter: synproxy: fix conntrackd interaction	2017-05-15 12:51:39 +02:00
nf_conntrack_pptp.c	netfilter: pptp: attach nat extension when needed	2017-04-26 09:30:22 +02:00
nf_conntrack_proto.c	netfilter: nf_conntrack: remove double assignment	2017-04-14 01:54:23 +02:00
nf_conntrack_proto_dccp.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-05-01 10:47:53 -04:00
nf_conntrack_proto_generic.c	…
nf_conntrack_proto_gre.c	…
nf_conntrack_proto_sctp.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-05-01 10:47:53 -04:00
nf_conntrack_proto_tcp.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-05-01 10:47:53 -04:00
nf_conntrack_proto_udp.c	…
nf_conntrack_sane.c	netfilter: helpers: remove data_len usage for inkernel helpers	2017-04-19 17:55:17 +02:00
nf_conntrack_seqadj.c	netfilter: conntrack: mark extension structs as const	2017-04-26 09:30:22 +02:00
nf_conntrack_sip.c	netfilter: helpers: remove data_len usage for inkernel helpers	2017-04-19 17:55:17 +02:00
nf_conntrack_snmp.c	…
nf_conntrack_standalone.c	netfilter: Use seq_puts()/seq_putc() where possible	2017-04-07 17:29:21 +02:00
nf_conntrack_tftp.c	netfilter: helpers: remove data_len usage for inkernel helpers	2017-04-19 17:55:17 +02:00
nf_conntrack_timeout.c	netfilter: conntrack: mark extension structs as const	2017-04-26 09:30:22 +02:00
nf_conntrack_timestamp.c	netfilter: conntrack: mark extension structs as const	2017-04-26 09:30:22 +02:00
nf_dup_netdev.c	…
nf_internals.h	netfilter: nf_queue: only call synchronize_net twice if nf_queue is active	2017-05-01 11:19:12 +02:00
nf_log.c	netfilter: nf_log: don't call synchronize_rcu in nf_log_unset	2017-05-01 11:19:07 +02:00
nf_log_common.c	…
nf_log_netdev.c	…
nf_nat_amanda.c	netfilter: nat: nf_nat_mangle_{udp,tcp}_packet returns boolean	2017-04-06 22:01:38 +02:00
nf_nat_core.c	netfilter: don't setup nat info for confirmed ct	2017-05-15 12:42:28 +02:00
nf_nat_ftp.c	…
nf_nat_helper.c	netfilter: nat: nf_nat_mangle_{udp,tcp}_packet returns boolean	2017-04-06 22:01:38 +02:00
nf_nat_irc.c	netfilter: nat: nf_nat_mangle_{udp,tcp}_packet returns boolean	2017-04-06 22:01:38 +02:00
nf_nat_proto_common.c	…
nf_nat_proto_dccp.c	…
nf_nat_proto_sctp.c	netfilter: nf_nat_sctp: fix ICMP packet to be dropped accidently	2017-03-08 18:04:06 +01:00
nf_nat_proto_tcp.c	…
nf_nat_proto_udp.c	…
nf_nat_proto_unknown.c	…
nf_nat_redirect.c	netfilter: make it safer during the inet6_dev->addr_list traversal	2017-04-08 23:52:16 +02:00
nf_nat_sip.c	…
nf_nat_tftp.c	…
nf_queue.c	netfilter: nf_queue: only call synchronize_net twice if nf_queue is active	2017-05-01 11:19:12 +02:00
nf_sockopt.c	…
nf_synproxy_core.c	netfilter: tcp: Use TCP_MAX_WSCALE instead of literal 14	2017-04-19 17:55:17 +02:00
nf_tables_api.c	netfilter: nf_tables: revisit chain/object refcounting from elements	2017-05-15 12:51:41 +02:00
nf_tables_core.c	…
nf_tables_inet.c	…
nf_tables_netdev.c	netfilter: nf_tables: add nft_is_base_chain() helper	2017-04-06 18:32:04 +02:00
nf_tables_trace.c	netfilter: Add nfnl_msg_type() helper function	2017-04-07 16:31:36 +02:00
nfnetlink.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-05-01 10:47:53 -04:00
nfnetlink_acct.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-05-01 10:47:53 -04:00
nfnetlink_cthelper.c	netfilter: nfnl_cthelper: reject del request if helper obj is in use	2017-05-15 12:42:29 +02:00
nfnetlink_cttimeout.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-05-01 10:47:53 -04:00
nfnetlink_log.c	netfilter: nf_log: don't call synchronize_rcu in nf_log_unset	2017-05-01 11:19:07 +02:00
nfnetlink_queue.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-05-01 10:47:53 -04:00
nft_bitwise.c	netfilter: nf_tables: revisit chain/object refcounting from elements	2017-05-15 12:51:41 +02:00
nft_byteorder.c	…
nft_cmp.c	netfilter: nf_tables: revisit chain/object refcounting from elements	2017-05-15 12:51:41 +02:00
nft_compat.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-05-01 10:47:53 -04:00
nft_counter.c	netfilter: provide nft_ctx in object init function	2017-03-13 13:42:00 +01:00
nft_ct.c	netfilter: introduce nf_conntrack_helper_put helper function	2017-05-15 12:42:29 +02:00
nft_dup_netdev.c	…
nft_dynset.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2017-05-03 10:11:26 -04:00
nft_exthdr.c	netfilter: Remove exceptional & on function name	2017-04-07 18:24:47 +02:00
nft_fib.c	netfilter: nft_fib: Support existence check	2017-03-13 13:45:36 +01:00
nft_fib_inet.c	…
nft_fwd_netdev.c	…
nft_hash.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-05-01 10:47:53 -04:00
nft_immediate.c	netfilter: nf_tables: revisit chain/object refcounting from elements	2017-05-15 12:51:41 +02:00
nft_limit.c	netfilter: limit: use per-rule spinlock to improve the scalability	2017-03-13 19:30:31 +01:00
nft_log.c	…
nft_lookup.c	netfilter: nf_tables: add nft_set_lookup()	2017-03-06 18:23:23 +01:00
nft_masq.c	netfilter: nf_tables: validate the expr explicitly after init successfully	2017-03-06 18:22:12 +01:00
nft_meta.c	netfilter: Remove exceptional & on function name	2017-04-07 18:24:47 +02:00
nft_nat.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-03-23 16:41:27 -07:00
nft_numgen.c	netfilter: Remove exceptional & on function name	2017-04-07 18:24:47 +02:00
nft_objref.c	netfilter: nf_tables: add nft_set_lookup()	2017-03-06 18:23:23 +01:00
nft_payload.c	…
nft_queue.c	netfilter: Remove exceptional & on function name	2017-04-07 18:24:47 +02:00
nft_quota.c	netfilter: provide nft_ctx in object init function	2017-03-13 13:42:00 +01:00
nft_range.c	netfilter: nf_tables: revisit chain/object refcounting from elements	2017-05-15 12:51:41 +02:00
nft_redir.c	netfilter: nf_tables: validate the expr explicitly after init successfully	2017-03-06 18:22:12 +01:00
nft_reject.c	netfilter: nf_tables: validate the expr explicitly after init successfully	2017-03-06 18:22:12 +01:00
nft_reject_inet.c	netfilter: nf_tables: validate the expr explicitly after init successfully	2017-03-06 18:22:12 +01:00
nft_rt.c	…
nft_set_bitmap.c	netfilter: nft_set_bitmap: free dummy elements when destroy the set	2017-04-24 20:05:25 +02:00
nft_set_hash.c	netfilter: nf_tables: can't assume lock is acquired when dumping set elems	2017-05-15 12:51:39 +02:00
nft_set_rbtree.c	netfilter: nft_set_rbtree: use per-set rwlock to improve the scalability	2017-03-13 19:30:43 +01:00
x_tables.c	netfilter: xtables: fix build failure from COMPAT_XT_ALIGN outside CONFIG_COMPAT	2017-05-18 13:10:03 +02:00
xt_AUDIT.c	audit: normalize NETFILTER_PKT	2017-05-02 10:16:04 -04:00
xt_CHECKSUM.c	…
xt_CLASSIFY.c	…
xt_CONNSECMARK.c	…
xt_CT.c	netfilter: introduce nf_conntrack_helper_put helper function	2017-05-15 12:42:29 +02:00
xt_DSCP.c	…
xt_HL.c	…
xt_HMARK.c	netfilter: remove nf_ct_is_untracked	2017-04-15 11:51:33 +02:00
xt_IDLETIMER.c	…
xt_LED.c	…
xt_LOG.c	…
xt_NETMAP.c	…
xt_NFLOG.c	…
xt_NFQUEUE.c	…
xt_RATEEST.c	…
xt_REDIRECT.c	…
xt_SECMARK.c	…
xt_TCPMSS.c	netfilter: xt_TCPMSS: add more sanity tests on tcph->doff	2017-04-08 22:24:19 +02:00
xt_TCPOPTSTRIP.c	…
xt_TEE.c	…
xt_TPROXY.c	netfilter: make it safer during the inet6_dev->addr_list traversal	2017-04-08 23:52:16 +02:00
xt_TRACE.c	…
xt_addrtype.c	…
xt_bpf.c	…
xt_cgroup.c	…
xt_cluster.c	netfilter: remove nf_ct_is_untracked	2017-04-15 11:51:33 +02:00
xt_comment.c	…
xt_connbytes.c	…
xt_connlabel.c	netfilter: remove nf_ct_is_untracked	2017-04-15 11:51:33 +02:00
xt_connlimit.c	…
xt_connmark.c	netfilter: remove nf_ct_is_untracked	2017-04-15 11:51:33 +02:00
xt_conntrack.c	netfilter: kill the fake untracked conntrack objects	2017-04-15 11:47:57 +02:00
xt_cpu.c	…
xt_dccp.c	…
xt_devgroup.c	…
xt_dscp.c	…
xt_ecn.c	…
xt_esp.c	…
xt_hashlimit.c	netfilter: Remove unnecessary cast on void pointer	2017-04-07 17:29:17 +02:00
xt_helper.c	…
xt_hl.c	…
xt_ipcomp.c	…
xt_iprange.c	…
xt_ipvs.c	netfilter: remove nf_ct_is_untracked	2017-04-15 11:51:33 +02:00
xt_l2tp.c	…
xt_length.c	…
xt_limit.c	netfilter: limit: use per-rule spinlock to improve the scalability	2017-03-13 19:30:31 +01:00
xt_mac.c	…
xt_mark.c	…
xt_multiport.c	…
xt_nat.c	…
xt_nfacct.c	…
xt_osf.c	…
xt_owner.c	…
xt_physdev.c	…
xt_pkttype.c	…
xt_policy.c	…
xt_quota.c	…
xt_rateest.c	…
xt_realm.c	…
xt_recent.c	treewide: use kv[mz]alloc* rather than opencoded variants	2017-05-08 17:15:13 -07:00
xt_repldata.h	…
xt_sctp.c	…
xt_set.c	…
xt_socket.c	netfilter: xt_socket: Fix broken IPv6 handling	2017-04-24 20:06:29 +02:00
xt_state.c	netfilter: kill the fake untracked conntrack objects	2017-04-15 11:47:57 +02:00
xt_statistic.c	…
xt_string.c	…
xt_tcpmss.c	…
xt_tcpudp.c	…
xt_time.c	…
xt_u32.c	…