diff options
author | Jakub Kicinski <kuba@kernel.org> | 2024-01-25 08:03:16 +0300 |
---|---|---|
committer | Jakub Kicinski <kuba@kernel.org> | 2024-01-25 08:03:17 +0300 |
commit | a717932db11ed895f32421d46e82746f5c52c5c0 (patch) | |
tree | 7ef8f8a636adb268c3348d53a98b66efb961ba9a /tools | |
parent | f6cc4b6a3ae53df425771000e9c9540cce9b7bb1 (diff) | |
parent | d0009effa8862c20a13af4cb7475d9771b905693 (diff) | |
download | linux-a717932db11ed895f32421d46e82746f5c52c5c0.tar.xz |
Merge tag 'nf-24-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neira Ayuso says:
====================
Netfilter fixes for net
The following patchset contains Netfilter fixes for net:
1) Update nf_tables kdoc to keep it in sync with the code, from George Guo.
2) Handle NETDEV_UNREGISTER event for inet/ingress basechain.
3) Reject configuration that cause nft_limit to overflow,
from Florian Westphal.
4) Restrict anonymous set/map names to 16 bytes, from Florian Westphal.
5) Disallow to encode queue number and error in verdicts. This reverts
a patch which seems to have introduced an early attempt to support for
nfqueue maps, which is these days supported via nft_queue expression.
6) Sanitize family via .validate for expressions that explicitly refer
to NF_INET_* hooks.
* tag 'nf-24-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
netfilter: nf_tables: validate NFPROTO_* family
netfilter: nf_tables: reject QUEUE/DROP verdict parameters
netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
netfilter: nft_limit: reject configurations that cause integer overflow
netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
netfilter: nf_tables: cleanup documentation
====================
Link: https://lore.kernel.org/r/20240124191248.75463-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'tools')
0 files changed, 0 insertions, 0 deletions