linux/net/bridge
Paolo Abeni b73bc9ca36 netfilter pull request nf-next-26-07-02
-----BEGIN PGP SIGNATURE-----
 
 iQJdBAABCABHFiEEgKkgxbID4Gn1hq6fcJGo2a1f9gAFAmpGOrIbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyDRxmd0BzdHJsZW4uZGUACgkQcJGo2a1f9gA+vQ//
 eYDf4mJOdBusDUnc1FA4XXDtALhr3BNXs6EXckL4yUzK9SlYhZj7CfTxiyZlOW8U
 emh4dOnIvuTLvEdr7OsY7jn+kUoN7jxuRzZ289mCj0JstlJsF4IEERAeKAHsQXTr
 ro2pkovbsVKHx2aQGIIvQSN4y4Hv/nuAixGTDVTOOcTjDs2kh8DwvS2Tp4mKHwLO
 4yITfrPqK349Kk5ojGr5I9rD/IThAxkg9WMgZD/me8rxnWg/g8ZVOYfOXrCGQwFL
 SegIdWNWO3CFD1C1Ls6UYaxjCh8A+LmgbWGLRUbFELmaMzRWEZq2OmVGZuQu366s
 lUc8uHTMTZwwBTD6e1/DadYOXPkbn9/Uz025KwQggvAcw5O8qqIf2Ow57ETr5CwN
 2HqVp2zSwxcgW6OFD2iVElCjk6MMA9sIOa/Iz64bz1dEHuSzvOslMgrZuPtGrRrZ
 aXp+VsF5OZuK2DiYCIgv1vK8Xr+vfeaztYMeMmcMawAbglHlShbWt6c9jMRTC2Qt
 yj31wWIxFB4qlA9mAc9XE4A89J7y/WgpQF2s7uHvZokvVi1dsz5YQqJqRCo0732G
 GmsB7+8oduldllokezsTKBCS5tUxiuN3YqYI3+7O+5+6JqVu2t7ZV7H1jvWgQePj
 0RmOM5Jt6P2L/mdTKHIc5GcGUNCo63WzpaceNsgEA3U=
 =yph7
 -----END PGP SIGNATURE-----

Merge tag 'nf-next-26-07-02' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

Florian Westphal says:

====================
netfilter: updates for net-next

The following patchset contains Netfilter updates for *net-next*.

1) Update nfnetlink_hook to dump the individual NAT type chains
instead of the nat base chains to userspace. From Phil Sutter.

2) Replace strlcpy/strlcat() with snprintf() in x_tables, from Ian Bridges.

3) Start replacing u_int8_t and u_int16t with u8 and u16 in netfilter.
From Carlos Grillet.

4) Replace strcpy() with strscpy() in netfilter, from David Laight.

5) Remove redundant NULL check before kvfree().

6) Add parameter validation to xt_tcpmss. Ensure mss_min <= mss_max and
invert <= 1.  From Feng Wu.

7) Add checkentry for xt_dscp 'tos' match. Implement tos_mt_check() to reject
invalid invert values.  Also from Feng Wu.

8) Stop hashing nf_conntrack_helper by tuple. Switch to hashing by name and
L4 protocol.

9) Remove tuples from conntrack helper definitions and port usage from
broadcast helpers. Add netlink policy validation to prevent protocol
number truncation.

10) Remove obsolete netfilter conntrack module parameters.

11) Bound num_counters in ebtables: do_replace() by MAX_EBT_ENTRIES to prevent
oversized vmalloc_array() allocations.  From Jiayuan Chen.

12) Make expectations created via nft_ct rules work with NAT.

netfilter pull request nf-next-26-07-02

* tag 'nf-next-26-07-02' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
  netfilter: nft_ct: support expectation creation for natted flows
  netfilter: ebtables: bound num_counters like nentries in do_replace()
  netfilter: conntrack: remove obsolete module parameters
  netfilter: conntrack: get rid of tuple in helper definitions
  netfilter: nf_conntrack_helper: do not hash by tuple
  netfilter: xt_dscp: add checkentry for tos match
  netfilter: xt_tcpmss: add checkentry for parameter validation
  netfilter: remove redundant null check before kvfree()
  netfilter: avoid strcpy usage
  netfilter: replace u_int8_t and u_int16t with u8 and u16
  netfilter: x_tables: replace strlcat() with snprintf()
  netfilter: nfnetlink_hook: Dump nat type chains
====================

Link: https://patch.msgid.link/20260702105003.13550-1-fw@strlen.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-03 22:00:24 +02:00
..
netfilter netfilter: ebtables: bound num_counters like nentries in do_replace() 2026-07-02 12:17:14 +02:00
br_arp_nd_proxy.c net: bridge: use atomic ops to read/change p->flags (I) 2026-06-12 18:03:46 -07:00
br_cfm_netlink.c bridge: cfm: reject invalid CCM interval at configuration time 2026-06-11 15:16:12 -07:00
br_cfm.c bridge: cfm: reject invalid CCM interval at configuration time 2026-06-11 15:16:12 -07:00
br_device.c bridge: Add missing READ_ONCE() annotations around FDB destination port 2026-05-19 18:13:01 -07:00
br_fdb.c net: bridge: use atomic ops to read/change p->flags (I) 2026-06-12 18:03:46 -07:00
br_forward.c net: bridge: use atomic ops to read/change p->flags (I) 2026-06-12 18:03:46 -07:00
br_if.c bridge: stp: Fix a potential use-after-free when deleting a bridge 2026-06-30 15:14:35 +02:00
br_input.c net: bridge: use atomic ops to read/change p->flags (II) 2026-06-12 18:03:46 -07:00
br_ioctl.c bridge: provide lockless access to p->config_pending 2026-06-05 17:46:18 -07:00
br_mdb.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
br_mrp_netlink.c net: bridge: use atomic ops to read/change p->flags (II) 2026-06-12 18:03:46 -07:00
br_mrp_switchdev.c bridge: mrp: Extend br_mrp_switchdev to detect better the errors 2021-02-16 14:47:46 -08:00
br_mrp.c net: bridge: use atomic ops to read/change p->flags (II) 2026-06-12 18:03:46 -07:00
br_mst.c net: bridge: fix MST static key usage 2025-11-06 07:32:17 -08:00
br_multicast_eht.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
br_multicast.c net: bridge: use atomic ops to read/change p->flags (III) 2026-06-12 18:03:46 -07:00
br_netfilter_hooks.c netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() 2026-05-16 13:22:50 +02:00
br_netfilter_ipv6.c netfilter: remove nf_ipv6_ops and use direct function calls 2026-03-29 11:21:24 -07:00
br_netlink_tunnel.c net: bridge: fix an inconsistent indentation 2024-06-05 10:04:47 +01:00
br_netlink.c net: bridge: use atomic ops to read/change p->flags (III) 2026-06-12 18:03:46 -07:00
br_nf_core.c bridge: netfilter: Fix forwarding of fragmented packets 2025-05-16 16:02:06 -07:00
br_private_cfm.h bridge: cfm: Kernel space implementation of CFM. CCM frame RX added. 2020-10-29 18:39:43 -07:00
br_private_mcast_eht.h net: bridge: multicast: use multicast contexts instead of bridge or port 2021-07-20 05:41:19 -07:00
br_private_mrp.h net: bridge: mrp: Update the Test frames for MRA 2021-06-28 15:46:10 -07:00
br_private_stp.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
br_private_tunnel.h bridge: always declare tunnel functions 2023-05-17 21:28:58 -07:00
br_private.h bridge: use BR_PROMISC_BIT 2026-06-05 17:46:17 -07:00
br_stp_bpdu.c net: bridge: use atomic ops to read/change p->flags (III) 2026-06-12 18:03:46 -07:00
br_stp_if.c bridge: provide lockless access to p->config_pending 2026-06-05 17:46:18 -07:00
br_stp_timer.c bridge: add a READ_ONCE() in br_timer_value() 2026-06-05 17:46:16 -07:00
br_stp.c bridge: stp: Fix a potential use-after-free when deleting a bridge 2026-06-30 15:14:35 +02:00
br_switchdev.c net: bridge: use atomic ops to read/change p->flags (III) 2026-06-12 18:03:46 -07:00
br_sysfs_br.c mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
br_sysfs_if.c bridge: use atomic ops to read/change p->flags in sysfs 2026-06-12 18:03:45 -07:00
br_vlan_options.c net: bridge: use atomic ops to read/change p->flags (III) 2026-06-12 18:03:46 -07:00
br_vlan_tunnel.c bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress 2026-01-04 09:45:35 -08:00
br_vlan.c bridge: Add per-VLAN netlink handling for neigh_forward_grat 2026-05-14 12:42:11 +02:00
br.c net: remove unused ATM protocols and legacy ATM device drivers 2026-04-23 12:21:14 -07:00
Kconfig ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs 2026-03-29 11:21:22 -07:00
Makefile netfilter: add option for GCOV profiling 2026-05-24 22:55:47 +02:00