1. 19 Oct, 2023 38 commits
  2. 18 Oct, 2023 2 commits
    • Phil Sutter's avatar
      net: skb_find_text: Ignore patterns extending past 'to' · c4eee56e
      Phil Sutter authored
      Assume that caller's 'to' offset really represents an upper boundary for
      the pattern search, so patterns extending past this offset are to be
      rejected.
      
      The old behaviour also was kind of inconsistent when it comes to
      fragmentation (or otherwise non-linear skbs): If the pattern started in
      between 'to' and 'from' offsets but extended to the next fragment, it
      was not found if 'to' offset was still within the current fragment.
      
      Test the new behaviour in a kselftest using iptables' string match.
      Suggested-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      Fixes: f72b948d ("[NET]: skb_find_text ignores to argument")
      Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
      Reviewed-by: default avatarFlorian Westphal <fw@strlen.de>
      Reviewed-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c4eee56e
    • David S. Miller's avatar
      Merge tag 'nf-next-23-10-18' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next · 37fb1c81
      David S. Miller authored
      Florian Westphal says:
      
      ====================
      netfilter next pull request 2023-10-18
      
      This series contains initial netfilter skb drop_reason support, from
      myself.
      
      First few patches fix up a few spots to make sure we won't trip
      when followup patches embed error numbers in the upper bits
      (we already do this in some places).
      
      Then, nftables and bridge netfilter get converted to call kfree_skb_reason
      directly to let tooling pinpoint exact location of packet drops,
      rather than the existing NF_DROP catchall in nf_hook_slow().
      
      I would like to eventually convert all netfilter modules, but as some
      callers cannot deal with NF_STOLEN (notably act_ct), more preparation
      work is needed for this.
      
      Last patch gets rid of an ugly 'de-const' cast in nftables.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      37fb1c81