Pablo Neira AyusoandGreg Kroah-Hartman 8a13595600 netfilter: nft_set_rbtree: skip elements in transaction from garbage collection ...

[ Upstream commit 5d235d6ce7 ]

Skip interference with an ongoing transaction, do not perform garbage
collection on inactive elements. Reset annotated previous end interval
if the expired element is marked as busy (control plane removed the
element right before expiration).

Fixes: 8d8540c4f5 ("netfilter: nft_set_rbtree: add timeout support")
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-02-01 08:27:26 +01:00

..

ipset

netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.

2023-01-18 11:48:52 +01:00

ipvs

ipvs: fix WARNING in ip_vs_app_net_cleanup()

2022-11-10 18:15:29 +01:00

core.c

net: netfilter: use kfree_drop_reason() for NF_DROP

2022-07-29 17:25:16 +02:00

Kconfig

netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y

2022-09-05 10:30:11 +02:00

Makefile

…

nf_conncount.c

…

nf_conntrack_acct.c

…

nf_conntrack_amanda.c

…

nf_conntrack_broadcast.c

…

nf_conntrack_core.c

netfilter: conntrack: Fix data-races around ct mark

2022-12-02 17:41:04 +01:00

nf_conntrack_ecache.c

…

nf_conntrack_expect.c

netfilter: conntrack: convert to refcount_t api

2022-04-27 14:39:01 +02:00

nf_conntrack_extend.c

…

nf_conntrack_ftp.c

…

nf_conntrack_h323_asn1.c

…

nf_conntrack_h323_main.c

…

nf_conntrack_h323_types.c

…

nf_conntrack_helper.c

netfilter: conntrack: Add and use nf_ct_set_auto_assign_helper_warned()

2022-04-08 14:23:42 +02:00

nf_conntrack_irc.c

netfilter: nf_conntrack_irc: Tighten matching on DCC message

2022-09-28 11:11:46 +02:00

nf_conntrack_labels.c

…

nf_conntrack_netbios_ns.c

…

nf_conntrack_netlink.c

netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark

2022-12-14 11:37:23 +01:00

nf_conntrack_pptp.c

…

nf_conntrack_proto_dccp.c

…

nf_conntrack_proto_generic.c

…

nf_conntrack_proto_gre.c

…

nf_conntrack_proto_icmp.c

…

nf_conntrack_proto_icmpv6.c

netfilter: conntrack: set icmpv6 redirects as RELATED

2022-12-31 13:14:14 +01:00

nf_conntrack_proto_sctp.c

netfilter: conntrack: don't refresh sctp entries in closed state

2022-02-23 12:03:17 +01:00

nf_conntrack_proto_tcp.c

netfilter: conntrack: work around exceeded receive window

2022-09-15 11:30:01 +02:00

nf_conntrack_proto_udp.c

…

nf_conntrack_proto.c

…

nf_conntrack_sane.c

…

nf_conntrack_seqadj.c

…

nf_conntrack_sip.c

netfilter: nf_conntrack_sip: fix ct_sip_walk_headers

2022-09-28 11:11:46 +02:00

nf_conntrack_snmp.c

…

nf_conntrack_standalone.c

netfilter: conntrack: Fix data-races around ct mark

2022-12-02 17:41:04 +01:00

nf_conntrack_tftp.c

…

nf_conntrack_timeout.c

…

nf_conntrack_timestamp.c

…

nf_dup_netdev.c

…

nf_flow_table_core.c

netfilter: flowtable: fix stuck flows on cleanup due to pending work

2022-08-31 17:16:42 +02:00

nf_flow_table_inet.c

netfilter: flowtable: Fix QinQ and pppoe support for inet table

2022-04-08 14:23:40 +02:00

nf_flow_table_ip.c

netfilter: flowtable: move dst_check to packet path

2022-05-25 09:57:33 +02:00

nf_flow_table_offload.c

netfilter: flowtable: really fix NAT IPv6 offload

2022-12-31 13:14:36 +01:00

nf_hooks_lwtunnel.c

…

nf_internals.h

…

nf_log_syslog.c

netfilter: nf_log: incorrect offset to network header

2022-07-21 21:24:23 +02:00

nf_log.c

…

nf_nat_amanda.c

…

nf_nat_core.c

…

nf_nat_ftp.c

…

nf_nat_helper.c

…

nf_nat_irc.c

…

nf_nat_masquerade.c

…

nf_nat_proto.c

…

nf_nat_redirect.c

…

nf_nat_sip.c

…

nf_nat_tftp.c

…

nf_queue.c

netfilter: nf_queue: handle socket prefetch

2022-03-08 19:12:45 +01:00

nf_sockopt.c

…

nf_synproxy_core.c

ip: Fix data-races around sysctl_ip_default_ttl.

2022-07-29 17:25:09 +02:00

nf_tables_api.c

netfilter: nf_tables: honor set timeout and garbage collection updates

2023-01-12 11:59:09 +01:00

nf_tables_core.c

netfilter: nft_cmp: optimize comparison for 16-bytes

2022-08-31 17:16:41 +02:00

nf_tables_offload.c

netfilter: nf_tables: bail out early if hardware offload is not supported

2022-06-14 18:36:17 +02:00

nf_tables_trace.c

netfilter: nf_tables: convert pktinfo->tprot_set to flags field

2022-07-12 16:34:55 +02:00

nfnetlink_acct.c

…

nfnetlink_cthelper.c

…

nfnetlink_cttimeout.c

…

nfnetlink_hook.c

…

nfnetlink_log.c

…

nfnetlink_osf.c

netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find()

2022-09-28 11:11:47 +02:00

nfnetlink_queue.c

netfilter: nf_queue: do not allow packet truncation below transport header offset

2022-08-03 12:03:53 +02:00

nfnetlink.c

netfilter: nfnetlink: fix potential dead lock in nfnetlink_rcv_msg()

2022-11-16 09:58:20 +01:00

nft_bitwise.c

netfilter: nf_tables: upfront validation of data via nft_data_init()

2022-08-31 17:16:41 +02:00

nft_byteorder.c

…

nft_chain_filter.c

…

nft_chain_nat.c

…

nft_chain_route.c

…

nft_cmp.c

netfilter: nf_tables: upfront validation of data via nft_data_init()

2022-08-31 17:16:41 +02:00

nft_compat.c

…

nft_connlimit.c

…

nft_counter.c

…

nft_ct.c

netfilter: conntrack: Fix data-races around ct mark

2022-12-02 17:41:04 +01:00

nft_dup_netdev.c

netfilter: nf_tables_offload: incorrect flow offload action array size

2022-03-02 11:47:51 +01:00

nft_dynset.c

…

nft_exthdr.c

netfilter: nft_payload: don't allow th access for fragments

2022-07-12 16:34:56 +02:00

nft_fib_inet.c

…

nft_fib_netdev.c

…

nft_fib.c

…

nft_flow_offload.c

netfilter: flowtable: fix TCP flow teardown

2022-05-25 09:57:33 +02:00

nft_fwd_netdev.c

netfilter: nf_tables_offload: incorrect flow offload action array size

2022-03-02 11:47:51 +01:00

nft_hash.c

…

nft_immediate.c

netfilter: nf_tables: upfront validation of data via nft_data_init()

2022-08-31 17:16:41 +02:00

nft_last.c

…

nft_limit.c

…

nft_log.c

…

nft_lookup.c

…

nft_masq.c

…

nft_meta.c

netfilter: nf_tables: convert pktinfo->tprot_set to flags field

2022-07-12 16:34:55 +02:00

nft_nat.c

netfilter: nat: really support inet nat without l3 address

2022-06-14 18:36:16 +02:00

nft_numgen.c

netfilter: use get_random_u32 instead of prandom

2022-06-29 09:03:21 +02:00

nft_objref.c

…

nft_osf.c

netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families

2022-08-31 17:16:41 +02:00

nft_payload.c

netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits

2023-01-18 11:48:46 +01:00

nft_queue.c

…

nft_quota.c

…

nft_range.c

netfilter: nf_tables: upfront validation of data via nft_data_init()

2022-08-31 17:16:41 +02:00

nft_redir.c

…

nft_reject_inet.c

…

nft_reject_netdev.c

…

nft_reject.c

…

nft_rt.c

…

nft_set_bitmap.c

…

nft_set_hash.c

netfilter: nft_dynset: restore set element counter when failing to update

2022-07-07 17:53:27 +02:00

nft_set_pipapo_avx2.c

…

nft_set_pipapo_avx2.h

…

nft_set_pipapo.c

netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one

2022-12-14 11:37:22 +01:00

nft_set_pipapo.h

…

nft_set_rbtree.c

netfilter: nft_set_rbtree: skip elements in transaction from garbage collection

2023-02-01 08:27:26 +01:00

nft_socket.c

netfilter: nft_socket: only do sk lookups when indev is available

2022-05-09 09:14:43 +02:00

nft_synproxy.c

netfilter: nft_synproxy: unregister hooks on init error path

2022-02-23 12:03:10 +01:00

nft_tproxy.c

…

nft_tunnel.c

netfilter: nft_tunnel: restrict it to netdev family

2022-08-31 17:16:41 +02:00

nft_xfrm.c

…

utils.c

…

x_tables.c

…

xt_addrtype.c

…

xt_AUDIT.c

…

xt_bpf.c

…

xt_cgroup.c

…

xt_CHECKSUM.c

…

xt_CLASSIFY.c

…

xt_cluster.c

…

xt_comment.c

…

xt_connbytes.c

…

xt_connlabel.c

…

xt_connlimit.c

…

xt_connmark.c

netfilter: conntrack: Fix data-races around ct mark

2022-12-02 17:41:04 +01:00

xt_CONNSECMARK.c

…

xt_conntrack.c

…

xt_cpu.c

…

xt_CT.c

netfilter: conntrack: convert to refcount_t api

2022-04-27 14:39:01 +02:00

xt_dccp.c

…

xt_devgroup.c

…

xt_dscp.c

…

xt_DSCP.c

…

xt_ecn.c

…

xt_esp.c

…

xt_hashlimit.c

…

xt_helper.c

…

xt_hl.c

…

xt_HL.c

…

xt_HMARK.c

…

xt_IDLETIMER.c

…

xt_ipcomp.c

…

xt_iprange.c

…

xt_ipvs.c

…

xt_l2tp.c

…

xt_LED.c

…

xt_length.c

…

xt_limit.c

…

xt_LOG.c

…

xt_mac.c

…

xt_mark.c

…

xt_MASQUERADE.c

…

xt_multiport.c

…

xt_nat.c

…

xt_NETMAP.c

…

xt_nfacct.c

…

xt_NFLOG.c

…

xt_NFQUEUE.c

…

xt_osf.c

…

xt_owner.c

…

xt_physdev.c

…

xt_pkttype.c

…

xt_policy.c

…

xt_quota.c

…

xt_rateest.c

…

xt_RATEEST.c

…

xt_realm.c

…

xt_recent.c

…

xt_REDIRECT.c

…

xt_repldata.h

…

xt_sctp.c

…

xt_SECMARK.c

…

xt_set.c

…

xt_socket.c

netfilter: xt_socket: missing ifdef CONFIG_IP6_NF_IPTABLES dependency

2022-03-02 11:47:51 +01:00

xt_state.c

…

xt_statistic.c

…

xt_string.c

…

xt_tcpmss.c

…

xt_TCPMSS.c

…

xt_TCPOPTSTRIP.c

…

xt_tcpudp.c

…

xt_TEE.c

…

xt_time.c

…

xt_TPROXY.c

…

xt_TRACE.c

…

xt_u32.c

…