Merge tag 'nf-26-10-19' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Pablo Neira Ayuso says:

====================
Netfilter/IPVS fixes for net

The following patchset contains Netfilter/IPVS for net:

1) Fix IPv6 nexthdr offset truncation in fragment reassembly,
   this has been uncovered by LLM, from Jeremy Jean.

2) Restrict checksums in nfqueue to known protocols and offset,
   after this patch the plan is to re-enable nfqueue in userns,
   this came via LLM report. from Florian Westhphal.

3) Fix races when handling overload flag in IPVS, this patch
   is not perfect but Julian considers this improves the situation.
   This was uncovered by LLM. From Julian Anastasov.

4) Error handling for IPVS sync_threshold sysctl, from Joel Granados.

5) Use skb_vlan_tag_get_id() to retrieve the VLAN id, discard tci
   bits, when handling VLAN in the flowtable, from Shuangfeng He.

6) Initialize IPCB for inet/ingress reject, uncovered by LLM.

7) Restrict completion of binary search array to anonymous set.

8) Restrict DCCP option matching to avoid out-of-bound read,
   from Sung Byeongchan.

9) Reset transport header offset in flowtable after tunnel
   decapsulation to fix issue with qdisc xmit path,
   from Lorenzo Bianconi.

10) Fix inverted matching in ctnetlink dump filtering,
    from Liu Chao.

* tag 'nf-26-10-19' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: nf_conntrack_netlink: fix inverted IPv6 tuple filter
  netfilter: flowtable: reset transport header after nf_flow_encap_pop()
  netfilter: xt_dccp: handle reserved options as single-byte
  netfilter: nft_set_rbtree: narrow down range completion to anonymous sets
  netfilter: nf_reject: initialize IPCB at inet ingress
  netfilter: flowtable: use the vlan id, not the full tci, in the tuple key
  ipvs: skip committing sync_threshold when proc_dointvec fails
  ipvs: fix more races around the overload flag
  netfilter: nft_payload: restrict checksum offsets to known values
  netfilter: nf_conntrack: avoid truncating IPv6 nexthdr offset
====================

Link: https://patch.msgid.link/20261019150249.1879516-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

0 files changed, 0 insertions, 0 deletions