Commit 33d12dc9 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

1) Remove leftovers from flowtable modules, from Geert Uytterhoeven.

2) Missing refcount increment of conntrack template in nft_ct,
   from Florian Westphal.

3) Reduce nft_zone selftest time, also from Florian.

4) Add selftest to cover stateless NAT on fragments, from Florian Westphal.

5) Do not set net_device when for reject packets from the bridge path,
   from Phil Sutter.

6) Cancel register tracking info on nft_byteorder operations.

7) Extend nft_concat_range selftest to cover set reload with no elements,
   from Florian Westphal.

8) Remove useless update of pointer in chain blob builder, reported
   by kbuild test robot.

* git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf:
  netfilter: nf_tables: remove assignment with no effect in chain blob builder
  selftests: nft_concat_range: add test for reload with no element add/del
  netfilter: nft_byteorder: track register operations
  netfilter: nft_reject_bridge: Fix for missing reply from prerouting
  selftests: netfilter: check stateless nat udp checksum fixup
  selftests: netfilter: reduce zone stress test running time
  netfilter: nft_ct: fix use after free when attaching zone template
  netfilter: Remove flowtable relics
====================

Link: https://lore.kernel.org/r/20220127235235.656931-1-pablo@netfilter.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 5aac9108 b07f4137

net/bridge/netfilter/nft_reject_bridge.c

+4 −4
Original line number Diff line number Diff line
@@ -49,7 +49,7 @@ static void nft_reject_br_send_v4_tcp_reset(struct net *net, 
{

	struct sk_buff *nskb;



	nskb = nf_reject_skb_v4_tcp_reset(net, oldskb, dev, hook);

	nskb = nf_reject_skb_v4_tcp_reset(net, oldskb, NULL, hook);

	if (!nskb)

		return;
@@ -65,7 +65,7 @@ static void nft_reject_br_send_v4_unreach(struct net *net, 
{

	struct sk_buff *nskb;



	nskb = nf_reject_skb_v4_unreach(net, oldskb, dev, hook, code);

	nskb = nf_reject_skb_v4_unreach(net, oldskb, NULL, hook, code);

	if (!nskb)

		return;
@@ -81,7 +81,7 @@ static void nft_reject_br_send_v6_tcp_reset(struct net *net, 
{

	struct sk_buff *nskb;



	nskb = nf_reject_skb_v6_tcp_reset(net, oldskb, dev, hook);

	nskb = nf_reject_skb_v6_tcp_reset(net, oldskb, NULL, hook);

	if (!nskb)

		return;
@@ -98,7 +98,7 @@ static void nft_reject_br_send_v6_unreach(struct net *net, 
{

	struct sk_buff *nskb;



	nskb = nf_reject_skb_v6_unreach(net, oldskb, dev, hook, code);

	nskb = nf_reject_skb_v6_unreach(net, oldskb, NULL, hook, code);

	if (!nskb)

		return;

net/ipv4/netfilter/Kconfig

+0 −4
Original line number Diff line number Diff line
@@ -58,10 +58,6 @@ config NF_TABLES_ARP 


endif # NF_TABLES



config NF_FLOW_TABLE_IPV4

	tristate

	select NF_FLOW_TABLE_INET



config NF_DUP_IPV4

	tristate "Netfilter IPv4 packet duplication to alternate destination"

	depends on !NF_CONNTRACK || NF_CONNTRACK

net/ipv6/netfilter/Kconfig

+0 −4
Original line number Diff line number Diff line
@@ -47,10 +47,6 @@ config NFT_FIB_IPV6 
endif # NF_TABLES_IPV6

endif # NF_TABLES



config NF_FLOW_TABLE_IPV6

	tristate

	select NF_FLOW_TABLE_INET



config NF_DUP_IPV6

	tristate "Netfilter IPv6 packet duplication to alternate destination"

	depends on !NF_CONNTRACK || NF_CONNTRACK

net/ipv6/netfilter/Makefile

+0 −3
Original line number Diff line number Diff line
@@ -28,9 +28,6 @@ obj-$(CONFIG_NFT_REJECT_IPV6) += nft_reject_ipv6.o 
obj-$(CONFIG_NFT_DUP_IPV6) += nft_dup_ipv6.o

obj-$(CONFIG_NFT_FIB_IPV6) += nft_fib_ipv6.o



# flow table support

obj-$(CONFIG_NF_FLOW_TABLE_IPV6) += nf_flow_table_ipv6.o



# matches

obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o

obj-$(CONFIG_IP6_NF_MATCH_EUI64) += ip6t_eui64.o

net/ipv6/netfilter/nf_flow_table_ipv6.c

deleted100644 → 0
+0 −0

Empty file deleted.