github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-29 21:06:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
2bb824660e
linux/net/netfilter
History
Minghao Zhang bf80e68022 netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets 
Commit be0502a3f2 ("netfilter: conntrack: tcp: only close if RST
matches exact sequence") keeps an established conntrack entry in
ESTABLISHED when an in-window RST does not match the expected sequence
number exactly, so the endpoint can validate the RST with a challenge
ACK.

The timeout selection nevertheless uses the CLOSE timeout for every RST
packet.  The bug is that timeout selection is based on the packet type,
not on the state transition result: even when RST validation keeps
new_state in ESTABLISHED, the timeout is still forced to
TCP_CONNTRACK_CLOSE.

Linux TCP independently rate limits challenge ACKs per socket.  A second
non-exact RST can therefore arrive after the first challenge ACK has
restored the timeout but before the rate limit expires.  The second RST
lowers the timeout to 10 seconds again while the endpoint suppresses the
second challenge ACK, allowing the conntrack entry to expire while both
TCP endpoints remain established.

Using the ESTABLISHED timeout for such RSTs would avoid this short
expiration window, but it could also retain stale entries for the
five-day default because conntrack cannot reliably match the endpoint's
exact TCP state.

Use the UNACK timeout for RST packets that leave the conntrack entry in
TCP_CONNTRACK_ESTABLISHED.  Exact-match RSTs and accepted RST packet
trains still fall through to timeouts[new_state], which preserves the
CLOSE timeout when conntrack accepts the RST as closing the flow.

This avoids the aggressive 10-second expiration window for non-exact
RSTs while preserving the short timeout for RSTs that conntrack accepts
as closing the flow.

Suggested-by: Florian Westphal <fw@strlen.de>
Reported-by: Minghao Zhang <zhangmh25@mails.tsinghua.edu.cn>
Reported-by: Jianjun Chen <jianjun@tsinghua.edu.cn>
Signed-off-by: Minghao Zhang <zhangmh25@mails.tsinghua.edu.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-07-31 14:47:03 +02:00
..
ipset netfilter: ipset: do not update comments from kernel-side hash adds 2026-07-23 17:58:46 +02:00
ipvs Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-30 12:53:19 -07:00
core.c netfilter: remove nf_ipv6_ops and use direct function calls 2026-03-29 11:21:24 -07:00
Kconfig netfilter: conntrack: add deprecation warnings for irc and pptp trackers 2026-06-23 13:10:34 +02:00
Makefile netfilter: allow nfnetlink built-in only 2026-05-24 22:55:47 +02:00
nf_bpf_link.c netfilter: bpf: defer hook memory release until rcu readers are done 2026-03-19 10:26:31 +01:00
nf_conncount.c netfilter: conncount: normalize tuple and zone on successful ct lookup 2026-07-31 14:47:03 +02:00
nf_conntrack_acct.c
nf_conntrack_amanda.c netfilter: conntrack_helper: pass master conntrack to helper functions 2026-07-24 11:45:19 +02:00
nf_conntrack_bpf.c bpf: Guard conntrack opts error writes 2026-06-22 16:04:34 -07:00
nf_conntrack_broadcast.c netfilter: nf_conntrack_expect: store event cache in expectation 2026-07-24 11:45:19 +02:00
nf_conntrack_core.c netfilter: nf_conntrack_expect: use conntrack GC to reap expectations 2026-06-21 00:18:27 +02:00
nf_conntrack_ecache.c netfilter: nf_conntrack_expect: store event cache in expectation 2026-07-24 11:45:19 +02:00
nf_conntrack_expect.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-30 12:53:19 -07:00
nf_conntrack_extend.c netfilter: conntrack: revert ct extension genid infrastructure 2026-06-05 16:16:44 +02:00
nf_conntrack_ftp.c netfilter: conntrack_helper: pass master conntrack to helper functions 2026-07-24 11:45:19 +02:00
nf_conntrack_h323_asn1.c netfilter: nf_conntrack_h323: Correct indentation when H323_TRACE defined 2026-04-08 07:51:31 +02:00
nf_conntrack_h323_main.c netfilter: conntrack: remove obsolete module parameters 2026-07-02 12:17:14 +02:00
nf_conntrack_h323_types.c
nf_conntrack_helper.c netfilter: conntrack: remove obsolete module parameters 2026-07-02 12:17:14 +02:00
nf_conntrack_irc.c netfilter: conntrack_helper: pass master conntrack to helper functions 2026-07-24 11:45:19 +02:00
nf_conntrack_labels.c
nf_conntrack_netbios_ns.c netfilter: conntrack: remove obsolete module parameters 2026-07-02 12:17:14 +02:00
nf_conntrack_netlink.c netfilter: nf_conntrack_expect: store event cache in expectation 2026-07-24 11:45:19 +02:00
nf_conntrack_ovs.c netfilter: conntrack: get rid of tuple in helper definitions 2026-07-02 12:17:14 +02:00
nf_conntrack_pptp.c netfilter: conntrack: remove obsolete module parameters 2026-07-02 12:17:14 +02:00
nf_conntrack_proto_generic.c netfilter: nf_conntrack: Add allow_clash to generic protocol handler 2026-01-20 16:23:37 +01:00
nf_conntrack_proto_gre.c netfilter: conntrack: check NULL when retrieving ct extension 2026-06-14 12:51:55 +02:00
nf_conntrack_proto_icmp.c netfilter: nf_conntrack: enable icmp clash support 2026-01-20 16:23:37 +01:00
nf_conntrack_proto_icmpv6.c netfilter: nf_conntrack: enable icmp clash support 2026-01-20 16:23:37 +01:00
nf_conntrack_proto_sctp.c netfilter: skip recording stale or retransmitted INIT 2026-04-28 17:52:19 -07:00
nf_conntrack_proto_tcp.c netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets 2026-07-31 14:47:03 +02:00
nf_conntrack_proto_udp.c udp: Support BIG TCP GSO packets where they can occur 2026-07-22 13:47:02 +02:00
nf_conntrack_proto.c netfilter: nf_conntrack_helper: add refcounting from datapath 2026-06-05 16:16:44 +02:00
nf_conntrack_sane.c netfilter: conntrack: remove obsolete module parameters 2026-07-02 12:17:14 +02:00
nf_conntrack_seqadj.c netfilter: conntrack: check NULL when retrieving ct extension 2026-06-14 12:51:55 +02:00
nf_conntrack_sip.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-30 12:53:19 -07:00
nf_conntrack_snmp.c netfilter: conntrack: remove obsolete module parameters 2026-07-02 12:17:14 +02:00
nf_conntrack_standalone.c netfilter: conntrack: remove UDP-Lite conntrack support 2026-04-10 12:16:26 +02:00
nf_conntrack_tftp.c netfilter: conntrack_helper: pass master conntrack to helper functions 2026-07-24 11:45:19 +02:00
nf_conntrack_timeout.c netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount 2026-06-05 13:11:55 +02:00
nf_conntrack_timestamp.c
nf_dup_netdev.c netfilter pull request 26-06-14 2026-06-15 14:09:57 -07:00
nf_flow_table_bpf.c bpf: Remove redundant KF_TRUSTED_ARGS flag from all kfuncs 2026-01-02 12:04:28 -08:00
nf_flow_table_core.c netfilter: flowtable: tear down flow entries with stale dst from GC 2026-07-24 11:22:30 +02:00
nf_flow_table_inet.c net: netfilter: move nf flowtable bpf initialization in nf_flow_table_module_init() 2024-09-12 15:41:03 +02:00
nf_flow_table_ip.c netfilter: flowtable: tear down flow entries with stale dst from GC 2026-07-24 11:22:30 +02:00
nf_flow_table_offload.c netfilter: flowtable: IPIP tunnel hardware offload is not yet support 2026-07-08 15:33:44 +02:00
nf_flow_table_path.c netfilter: flowtable: release tunnel route on error when building forward path 2026-07-31 14:47:03 +02:00
nf_flow_table_procfs.c
nf_flow_table_xdp.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
nf_hooks_lwtunnel.c
nf_internals.h
nf_log_syslog.c net: Use helpers to get/set UDP len tree-wide 2026-07-22 13:47:02 +02:00
nf_log.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
nf_nat_amanda.c netfilter: conntrack_helper: pass master conntrack to helper functions 2026-07-24 11:45:19 +02:00
nf_nat_bpf.c bpf: Remove redundant KF_TRUSTED_ARGS flag from all kfuncs 2026-01-02 12:04:28 -08:00
nf_nat_core.c netfilter: nfnetlink_hook: Dump nat type chains 2026-07-02 12:17:14 +02:00
nf_nat_ftp.c netfilter: conntrack_helper: pass master conntrack to helper functions 2026-07-24 11:45:19 +02:00
nf_nat_helper.c net: Use helpers to get/set UDP len tree-wide 2026-07-22 13:47:02 +02:00
nf_nat_irc.c netfilter: conntrack_helper: pass master conntrack to helper functions 2026-07-24 11:45:19 +02:00
nf_nat_masquerade.c netfilter: remove nf_ipv6_ops and use direct function calls 2026-03-29 11:21:24 -07:00
nf_nat_ovs.c netfilter: nf_conntrack: don't rely on implicit includes 2026-01-20 16:23:37 +01:00
nf_nat_proto.c netfilter: nfnetlink_hook: Dump nat type chains 2026-07-02 12:17:14 +02:00
nf_nat_redirect.c
nf_nat_sip.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-30 12:53:19 -07:00
nf_nat_tftp.c netfilter: conntrack_helper: pass master conntrack to helper functions 2026-07-24 11:45:19 +02:00
nf_queue.c netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst 2026-06-19 12:19:58 +02:00
nf_sockopt.c
nf_synproxy_core.c netfilter: synproxy: fix unaligned memory access in timestamp adjustment 2026-06-05 13:11:55 +02:00
nf_tables_api.c netfilter: nf_tables: make nft_object rhltable per table 2026-07-23 17:59:30 +02:00
nf_tables_core.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nf_tables_offload.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nf_tables_trace.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nfnetlink_acct.c netfilter: add more netlink-based policy range checks 2026-04-08 07:51:30 +02:00
nfnetlink_cthelper.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-10 10:20:05 +02:00
nfnetlink_cttimeout.c netfilter: avoid strcpy usage 2026-07-02 12:17:14 +02:00
nfnetlink_hook.c netfilter: nfnetlink_hook: Dump nat type chains 2026-07-02 12:17:14 +02:00
nfnetlink_log.c netfilter: handle unreadable frags 2026-07-08 15:33:44 +02:00
nfnetlink_osf.c netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures 2026-06-05 13:11:54 +02:00
nfnetlink_queue.c netfilter: handle unreadable frags 2026-07-08 15:33:44 +02:00
nfnetlink.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
nft_bitwise.c netfilter: nf_tables: fix dst corruption in same register operation 2026-05-22 12:28:46 +02:00
nft_byteorder.c netfilter: nft_byteorder: remove multi-register support 2026-06-01 13:43:53 +02:00
nft_chain_filter.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-03-12 12:53:34 -07:00
nft_chain_nat.c
nft_chain_route.c
nft_cmp.c netfilter: nf_tables: add netlink policy based cap on registers 2026-04-08 07:51:31 +02:00
nft_compat.c netfilter: nft_compat: ebtables emulation must reject non-bridge targets 2026-06-23 08:11:22 +02:00
nft_connlimit.c netfilter: add more netlink-based policy range checks 2026-04-08 07:51:30 +02:00
nft_counter.c netfilter: nf_tables: remove register tracking infrastructure 2026-02-25 19:36:26 -08:00
nft_ct_fast.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_ct.c netfilter: nft_ct: support expectation creation for natted flows 2026-07-02 12:17:14 +02:00
nft_dup_netdev.c netfilter: nf_tables: remove register tracking infrastructure 2026-02-25 19:36:26 -08:00
nft_dynset.c netfilter: add more netlink-based policy range checks 2026-04-08 07:51:30 +02:00
nft_exthdr.c netfilter pull request 26-06-14 2026-06-15 14:09:57 -07:00
nft_fib_inet.c netfilter: nf_tables: remove register tracking infrastructure 2026-02-25 19:36:26 -08:00
nft_fib_netdev.c netfilter: nft_fib: reject fib expression on the netdev egress hook 2026-06-30 06:37:12 +02:00
nft_fib.c netfilter: nft_fib: reject fib expression on the netdev egress hook 2026-06-30 06:37:12 +02:00
nft_flow_offload.c netfilter: nf_tables: remove register tracking infrastructure 2026-02-25 19:36:26 -08:00
nft_fwd_netdev.c netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them 2026-06-14 13:07:03 +02:00
nft_hash.c netfilter: nf_tables: add netlink policy based cap on registers 2026-04-08 07:51:31 +02:00
nft_immediate.c netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it 2026-04-08 07:51:31 +02:00
nft_inner.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_last.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-02-26 10:23:00 -08:00
nft_limit.c netfilter: add more netlink-based policy range checks 2026-04-08 07:51:30 +02:00
nft_log.c netfilter: add more netlink-based policy range checks 2026-04-08 07:51:30 +02:00
nft_lookup.c netfilter: nft_lookup: fix catchall element handling with inverted lookups 2026-07-08 15:33:37 +02:00
nft_masq.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_meta.c netfilter: nf_tables: call skb_valid_dst() before skb_dst() 2026-07-31 14:47:03 +02:00
nft_nat.c netfilter: nf_tables: remove register tracking infrastructure 2026-02-25 19:36:26 -08:00
nft_numgen.c netfilter: nf_tables: add netlink policy based cap on registers 2026-04-08 07:51:31 +02:00
nft_objref.c netfilter: nf_tables: add netlink policy based cap on registers 2026-04-08 07:51:31 +02:00
nft_osf.c netfilter: nf_tables: skip L4 header parsing for non-first fragments 2026-04-30 17:59:01 +02:00
nft_payload.c netfilter: nft_payload: fix mask build for partial field offload 2026-07-23 18:17:55 +02:00
nft_queue.c netfilter: add more netlink-based policy range checks 2026-04-08 07:51:30 +02:00
nft_quota.c netfilter: add more netlink-based policy range checks 2026-04-08 07:51:30 +02:00
nft_range.c netfilter: nf_tables: add netlink policy based cap on registers 2026-04-08 07:51:31 +02:00
nft_redir.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_reject_inet.c netfilter: nf_tables: remove register tracking infrastructure 2026-02-25 19:36:26 -08:00
nft_reject_netdev.c netfilter: nf_tables: remove register tracking infrastructure 2026-02-25 19:36:26 -08:00
nft_reject.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_rt.c netfilter: nf_tables: call skb_valid_dst() before skb_dst() 2026-07-31 14:47:03 +02:00
nft_set_bitmap.c netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation 2025-09-10 20:28:24 +02:00
nft_set_hash.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_set_pipapo_avx2.c netfilter: nft_set_pipapo_avx2: restore performance optimization 2026-05-24 22:55:48 +02:00
nft_set_pipapo_avx2.h netfilter: nft_set_pipapo: use avx2 algorithm for insertions too 2025-08-20 13:52:37 +02:00
nft_set_pipapo.c netfilter: nft_set_pipapo: don't leak bad clone into future transaction 2026-06-30 06:37:07 +02:00
nft_set_pipapo.h netfilter: nft_set_pipapo: don't leak bad clone into future transaction 2026-06-30 06:37:07 +02:00
nft_set_rbtree.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-10 10:20:05 +02:00
nft_socket.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_synproxy.c netfilter: nft_synproxy: stop bypassing the priv->info snapshot 2026-06-23 08:11:22 +02:00
nft_tproxy.c netfilter: nf_tables: skip L4 header parsing for non-first fragments 2026-04-30 17:59:01 +02:00
nft_tunnel.c netfilter: nf_tables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths 2026-06-14 12:50:01 +02:00
nft_xfrm.c netfilter: nf_tables: call skb_valid_dst() before skb_dst() 2026-07-31 14:47:03 +02:00
utils.c netfilter: remove nf_ipv6_ops and use direct function calls 2026-03-29 11:21:24 -07:00
x_tables.c netfilter: x_tables: replace strlcat() with snprintf() 2026-07-02 12:17:14 +02:00
xt_addrtype.c netfilter: x_tables: add .check_hooks to matches and targets 2026-04-30 08:03:22 +02:00
xt_AUDIT.c audit: add audit_log_nf_skb helper function 2025-12-16 11:04:14 -05:00
xt_bpf.c
xt_cgroup.c netfilter: x_tables: ensure names are nul-terminated 2026-04-01 11:55:29 +02:00
xt_CHECKSUM.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-09 23:20:46 +02:00
xt_CLASSIFY.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-09 23:20:46 +02:00
xt_cluster.c netfilter: xt_cluster: reject template conntracks in hash match 2026-06-19 12:22:14 +02:00
xt_comment.c
xt_connbytes.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
xt_connlabel.c
xt_connlimit.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
xt_connmark.c netfilter: xt_connmark: reject invalid shift parameters 2026-07-03 14:45:21 +02:00
xt_CONNSECMARK.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-09 23:20:46 +02:00
xt_conntrack.c
xt_cpu.c netfilter: xt_cpu: prefer raw_smp_processor_id 2026-05-22 12:28:46 +02:00
xt_CT.c netfilter: nf_conntrack_helper: add refcounting from datapath 2026-06-05 16:16:44 +02:00
xt_dccp.c netfilter: add deprecation warning for dccp support 2026-04-08 07:51:27 +02:00
xt_devgroup.c netfilter: x_tables: add .check_hooks to matches and targets 2026-04-30 08:03:22 +02:00
xt_dscp.c netfilter: xt_dscp: add checkentry for tos match 2026-07-02 12:17:14 +02:00
xt_DSCP.c
xt_ecn.c netfilter: xtables: fix L4 header parsing for non-first fragments 2026-04-30 17:59:01 +02:00
xt_esp.c
xt_hashlimit.c netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH 2026-07-23 18:01:25 +02:00
xt_helper.c
xt_hl.c netfilter: xt_HL: add pr_fmt and checkentry validation 2026-04-10 12:16:26 +02:00
xt_HL.c
xt_HMARK.c
xt_IDLETIMER.c netfilter: xt_IDLETIMER: Switch to alarm_start_timer() 2026-05-01 21:36:14 +02:00
xt_ipcomp.c
xt_iprange.c
xt_ipvs.c
xt_l2tp.c
xt_LED.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xt_length.c
xt_limit.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xt_LOG.c
xt_mac.c netfilter: xtables: restrict several matches to inet family 2026-04-20 23:27:52 +02:00
xt_mark.c netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds 2025-05-22 17:16:02 +02:00
xt_MASQUERADE.c
xt_multiport.c netfilter: xt_multiport: validate range encoding in checkentry 2026-04-08 13:33:38 +02:00
xt_nat.c netfilter: xt_nat: reject unsupported target families 2026-07-10 16:28:47 +02:00
xt_NETMAP.c
xt_nfacct.c netfilter: xt_nfacct: don't assume acct name is null-terminated 2025-07-25 18:40:43 +02:00
xt_NFLOG.c netfilter: xtables: fix typo causing some targets not to load on IPv6 2024-10-21 11:31:26 +02:00
xt_NFQUEUE.c netfilter: xt_NFQUEUE: prefer raw_smp_processor_id 2026-06-01 13:43:52 +02:00
xt_osf.c netfilter: xtables: fix L4 header parsing for non-first fragments 2026-04-30 17:59:01 +02:00
xt_owner.c netfilter: xtables: restrict several matches to inet family 2026-04-20 23:27:52 +02:00
xt_physdev.c netfilter: xt_physdev: masks are not c-strings 2026-07-10 16:28:47 +02:00
xt_pkttype.c
xt_policy.c netfilter: x_tables: add .check_hooks to matches and targets 2026-04-30 08:03:22 +02:00
xt_quota.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xt_rateest.c netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() 2026-07-03 14:45:21 +02:00
xt_RATEEST.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xt_realm.c netfilter: xtables: restrict several matches to inet family 2026-04-20 23:27:52 +02:00
xt_recent.c netfilter: avoid strcpy usage 2026-07-02 12:17:14 +02:00
xt_REDIRECT.c
xt_repldata.h netfilter: xtables: Use strscpy() instead of strscpy_pad() 2025-03-23 10:53:47 +01:00
xt_sctp.c
xt_SECMARK.c netfilter: xtables: avoid NFPROTO_UNSPEC where needed 2024-10-09 23:20:46 +02:00
xt_set.c netfilter: x_tables: add .check_hooks to matches and targets 2026-04-30 08:03:22 +02:00
xt_socket.c netfilter: xt_socket: enable defrag after all other checks 2026-04-10 12:16:26 +02:00
xt_state.c
xt_statistic.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xt_string.c
xt_tcpmss.c netfilter: xt_tcpmss: extend checkentry to ipv6 2026-07-24 11:21:35 +02:00
xt_TCPMSS.c netfilter: x_tables: add .check_hooks to matches and targets 2026-04-30 08:03:22 +02:00
xt_TCPOPTSTRIP.c netfilter: replace u_int8_t and u_int16t with u8 and u16 2026-07-02 12:17:14 +02:00
xt_tcpudp.c netfilter: x_tables: guard option walkers against 1-byte tail reads 2026-03-10 14:10:42 +01:00
xt_TEE.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xt_time.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-03-19 14:16:00 -07:00
xt_TPROXY.c netfilter: xtables: fix L4 header parsing for non-first fragments 2026-04-30 17:59:01 +02:00
xt_TRACE.c netfilter: xtables: fix typo causing some targets not to load on IPv6 2024-10-21 11:31:26 +02:00
xt_u32.c netfilter: handle unreadable frags 2026-07-08 15:33:44 +02:00