| Message ID | 20200908150947.12623-1-pablo@netfilter.org |
|---|---|
| Headers | show |
| Series | Netfilter fixes for net | expand |
From: Pablo Neira Ayuso <pablo@netfilter.org> Date: Tue, 8 Sep 2020 17:09:42 +0200 > The following patchset contains Netfilter fixes for net: > > 1) Allow conntrack entries with l3num == NFPROTO_IPV4 or == NFPROTO_IPV6 > only via ctnetlink, from Will McVicker. > > 2) Batch notifications to userspace to improve netlink socket receive > utilization. > > 3) Restore mark based dump filtering via ctnetlink, from Martin Willi. > > 4) nf_conncount_init() fails with -EPROTO with CONFIG_IPV6, from > Eelco Chaudron. > > 5) Containers fail to match on meta skuid and skgid, use socket user_ns > to retrieve meta skuid and skgid. > > Please, pull these changes from: > > git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git Pulled, thanks Pablo.
Hi, The following patchset contains Netfilter fixes for net: 1) Allow conntrack entries with l3num == NFPROTO_IPV4 or == NFPROTO_IPV6 only via ctnetlink, from Will McVicker. 2) Batch notifications to userspace to improve netlink socket receive utilization. 3) Restore mark based dump filtering via ctnetlink, from Martin Willi. 4) nf_conncount_init() fails with -EPROTO with CONFIG_IPV6, from Eelco Chaudron. 5) Containers fail to match on meta skuid and skgid, use socket user_ns to retrieve meta skuid and skgid. Please, pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git Thank you. ---------------------------------------------------------------- The following changes since commit 19162fd4063a3211843b997a454b505edb81d5ce: hv_netvsc: Fix hibernation for mlx5 VF driver (2020-09-07 21:04:36 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD for you to fetch changes up to 0c92411bb81de9bc516d6924f50289d8d5f880e5: netfilter: nft_meta: use socket user_ns to retrieve skuid and skgid (2020-09-08 13:04:56 +0200) ---------------------------------------------------------------- Eelco Chaudron (1): netfilter: conntrack: nf_conncount_init is failing with IPv6 disabled Martin Willi (1): netfilter: ctnetlink: fix mark based dump filtering regression Pablo Neira Ayuso (2): netfilter: nf_tables: coalesce multiple notifications into one skbuff netfilter: nft_meta: use socket user_ns to retrieve skuid and skgid Will McVicker (1): netfilter: ctnetlink: add a range check for l3/l4 protonum include/net/netns/nftables.h | 1 + net/netfilter/nf_conntrack_netlink.c | 22 +++--------- net/netfilter/nf_conntrack_proto.c | 2 ++ net/netfilter/nf_tables_api.c | 70 +++++++++++++++++++++++++++++------- net/netfilter/nft_meta.c | 4 +-- 5 files changed, 67 insertions(+), 32 deletions(-)