Florian Westphal d9d7b48941 netfilter: nft_flow_offload: clear tcp MAXACK flag before moving to slowpath ...

This state reset is racy, no locks are held here.

Since commit
8437a6209f76 ("netfilter: nft_flow_offload: set liberal tracking mode for tcp"),
the window checks are disabled for normal data packets, but MAXACK flag
is checked when validating TCP resets.

Clear the flag so tcp reset validation checks are ignored.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2025-01-19 16:41:54 +01:00

..

ipset

netfilter: ipset: Fix for recursive locking warning

2024-12-19 00:28:47 +01:00

ipvs

ipvs: speed up reads from ip_vs_conn proc file

2025-01-05 18:41:31 +01:00

core.c

net/netfilter: make use of the helper macro LIST_HEAD()

2024-09-06 18:10:21 -07:00

Kconfig

…

Makefile

netfilter: Add bpf_xdp_flow_lookup kfunc

2024-07-01 17:03:01 +02:00

nf_bpf_link.c

netfilter: bpf: Pass string literal as format argument of request_module()

2024-11-14 12:39:50 +01:00

nf_conncount.c

netfilter: move nf_ct_netns_get out of nf_conncount_init

2024-08-19 18:44:51 +02:00

nf_conntrack_acct.c

…

nf_conntrack_amanda.c

…

nf_conntrack_bpf.c

net: netfilter: Make ct zone opts configurable for bpf ct helpers

2024-05-22 15:00:56 -07:00

nf_conntrack_broadcast.c

…

nf_conntrack_core.c

netfilter: conntrack: clamp maximum hashtable size to INT_MAX

2025-01-09 13:29:45 +01:00

nf_conntrack_ecache.c

netfilter: conntrack: add conntrack event timestamp

2025-01-09 14:42:16 +01:00

nf_conntrack_expect.c

…

nf_conntrack_extend.c

…

nf_conntrack_ftp.c

…

nf_conntrack_h323_asn1.c

netfilter: nf_conntrack_h323: Add protection for bmp length out of range

2024-03-07 03:10:35 +01:00

nf_conntrack_h323_main.c

…

nf_conntrack_h323_types.c

…

nf_conntrack_helper.c

…

nf_conntrack_irc.c

…

nf_conntrack_labels.c

…

nf_conntrack_netbios_ns.c

…

nf_conntrack_netlink.c

netfilter: conntrack: add conntrack event timestamp

2025-01-09 14:42:16 +01:00

nf_conntrack_ovs.c

…

nf_conntrack_pptp.c

…

nf_conntrack_proto_dccp.c

netfilter: conntrack: dccp: try not to drop skb in conntrack

2024-05-06 11:13:56 +02:00

nf_conntrack_proto_generic.c

…

nf_conntrack_proto_gre.c

…

nf_conntrack_proto_icmp.c

…

nf_conntrack_proto_icmpv6.c

netfilter: conntrack: fix ct-state for ICMPv6 Multicast Router Discovery

2024-05-06 11:13:56 +02:00

nf_conntrack_proto_sctp.c

…

nf_conntrack_proto_tcp.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

nf_conntrack_proto_udp.c

…

nf_conntrack_proto.c

…

nf_conntrack_sane.c

…

nf_conntrack_seqadj.c

…

nf_conntrack_sip.c

…

nf_conntrack_snmp.c

…

nf_conntrack_standalone.c

sysctl: treewide: constify the ctl_table argument of proc_handlers

2024-07-24 20:59:29 +02:00

nf_conntrack_tftp.c

…

nf_conntrack_timeout.c

…

nf_conntrack_timestamp.c

…

nf_dup_netdev.c

…

nf_flow_table_bpf.c

netfilter: Add bpf_xdp_flow_lookup kfunc

2024-07-01 17:03:01 +02:00

nf_flow_table_core.c

netfilter: nft_flow_offload: clear tcp MAXACK flag before moving to slowpath

2025-01-19 16:41:54 +01:00

nf_flow_table_inet.c

net: netfilter: move nf flowtable bpf initialization in nf_flow_table_module_init()

2024-09-12 15:41:03 +02:00

nf_flow_table_ip.c

netfilter: flowtable: validate vlan header

2024-08-22 12:14:18 +02:00

nf_flow_table_offload.c

netfilter: flowtable: initialise extack before use

2024-08-14 23:37:16 +02:00

nf_flow_table_procfs.c

…

nf_flow_table_xdp.c

netfilter: nf_tables: Add flowtable map for xdp offload

2024-07-01 17:01:53 +02:00

nf_hooks_lwtunnel.c

sysctl: treewide: constify the ctl_table argument of proc_handlers

2024-07-24 20:59:29 +02:00

nf_internals.h

netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core

2024-06-19 18:41:59 +02:00

nf_log_syslog.c

…

nf_log.c

sysctl: treewide: constify the ctl_table argument of proc_handlers

2024-07-24 20:59:29 +02:00

nf_nat_amanda.c

…

nf_nat_bpf.c

…

nf_nat_core.c

net: convert to nla_get_*_default()

2024-11-11 10:32:06 -08:00

nf_nat_ftp.c

…

nf_nat_helper.c

…

nf_nat_irc.c

…

nf_nat_masquerade.c

…

nf_nat_ovs.c

…

nf_nat_proto.c

…

nf_nat_redirect.c

…

nf_nat_sip.c

…

nf_nat_tftp.c

…

nf_queue.c

…

nf_sockopt.c

…

nf_synproxy_core.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

nf_tables_api.c

netfilter: nf_tables: Tolerate chains with no remaining hooks

2025-01-19 16:41:54 +01:00

nf_tables_core.c

netfilter: nf_tables: don't initialize registers in nft_do_chain()

2024-08-20 12:37:25 +02:00

nf_tables_offload.c

netfilter: nf_tables: do not store nft_ctx in transaction objects

2024-06-25 20:40:47 +02:00

nf_tables_trace.c

net: add and use skb_get_hash_net

2024-06-12 14:33:38 -07:00

nfnetlink_acct.c

…

nfnetlink_cthelper.c

…

nfnetlink_cttimeout.c

netfilter: cttimeout: remove 'l3num' attr check

2024-06-26 00:54:53 +02:00

nfnetlink_hook.c

…

nfnetlink_log.c

…

nfnetlink_osf.c

…

nfnetlink_queue.c

netfilter: nfnetlink_queue: unbreak SCTP traffic

2024-08-19 18:44:50 +02:00

nfnetlink.c

netfilter: nfnetlink: Report extack policy errors for batched ops

2024-11-14 12:39:40 +01:00

nft_bitwise.c

netfilter: bitwise: add support for doing AND, OR and XOR directly

2024-11-15 12:07:04 +01:00

nft_byteorder.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

nft_chain_filter.c

netfilter: nf_tables: Simplify chain netdev notifier

2025-01-19 16:41:54 +01:00

nft_chain_nat.c

…

nft_chain_route.c

…

nft_cmp.c

netfilter: nf_tables: pass context structure to nft_parse_register_load

2024-08-20 12:37:24 +02:00

nft_compat.c

netfilter: nf_tables: missing objects with no memcg accounting

2024-09-26 13:03:02 +02:00

nft_connlimit.c

netfilter: nf_tables: allow clone callbacks to sleep

2024-05-10 11:13:45 +02:00

nft_counter.c

netfilter: nft_counter: Use u64_stats_t for statistic.

2024-09-03 10:47:16 +02:00

nft_ct_fast.c

…

nft_ct.c

netfilter: nf_tables: pass context structure to nft_parse_register_load

2024-08-20 12:37:24 +02:00

nft_dup_netdev.c

netfilter: nf_tables: pass context structure to nft_parse_register_load

2024-08-20 12:37:24 +02:00

nft_dynset.c

netfilter: nf_tables: set element timeout update support

2024-09-03 18:19:44 +02:00

nft_exthdr.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

nft_fib_inet.c

…

nft_fib_netdev.c

…

nft_fib.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00

nft_flow_offload.c

netfilter: flow_offload: Convert nft_flow_route() to dscp_t.

2024-11-15 11:00:29 +01:00

nft_fwd_netdev.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00

nft_hash.c

netfilter: nf_tables: pass context structure to nft_parse_register_load

2024-08-20 12:37:24 +02:00

nft_immediate.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00

nft_inner.c

netfilter: nft_inner: incorrect percpu area handling under softirq

2024-12-03 22:10:58 +01:00

nft_last.c

netfilter: nf_tables: allow clone callbacks to sleep

2024-05-10 11:13:45 +02:00

nft_limit.c

netfilter: nf_tables: allow clone callbacks to sleep

2024-05-10 11:13:45 +02:00

nft_log.c

netfilter: nf_tables: missing objects with no memcg accounting

2024-09-26 13:03:02 +02:00

nft_lookup.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00

nft_masq.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00

nft_meta.c

netfilter: nf_tables: missing objects with no memcg accounting

2024-09-26 13:03:02 +02:00

nft_nat.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00

nft_numgen.c

netfilter: nf_tables: missing objects with no memcg accounting

2024-09-26 13:03:02 +02:00

nft_objref.c

netfilter: nf_tables: pass context structure to nft_parse_register_load

2024-08-20 12:37:24 +02:00

nft_osf.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00

nft_payload.c

netfilter: nft_payload: sanitize offset and length before calling skb_checksum()

2024-10-31 10:54:49 +01:00

nft_queue.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00

nft_quota.c

netfilter: nf_tables: allow clone callbacks to sleep

2024-05-10 11:13:45 +02:00

nft_range.c

netfilter: nf_tables: pass context structure to nft_parse_register_load

2024-08-20 12:37:24 +02:00

nft_redir.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00

nft_reject_inet.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00

nft_reject_netdev.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00

nft_reject.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00

nft_rt.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00

nft_set_bitmap.c

netfilter: nf_tables: avoid false-positive lockdep splats in set walker

2024-11-05 22:06:22 +01:00

nft_set_hash.c

netfilter: nft_set_hash: skip duplicated elements pending gc run

2024-12-04 21:37:41 +01:00

nft_set_pipapo_avx2.c

netfilter: nft_set_pipapo_avx2: disable softinterrupts

2024-07-24 10:01:59 +02:00

nft_set_pipapo_avx2.h

…

nft_set_pipapo.c

netfilter: nf_tables: missing objects with no memcg accounting

2024-09-26 13:03:02 +02:00

nft_set_pipapo.h

netfilter: nf_set_pipapo: fix initial map fill

2024-07-17 19:00:47 +02:00

nft_set_rbtree.c

netfilter: nf_tables: fix set size with rbtree backend

2025-01-19 16:41:41 +01:00

nft_socket.c

netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level

2024-11-28 13:14:24 +01:00

nft_synproxy.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00

nft_tproxy.c

netfilter: nf_tables: drop unused 3rd argument from validate callback ops

2024-09-03 10:47:17 +02:00

nft_tunnel.c

net: convert to nla_get_*_default()

2024-11-11 10:32:06 -08:00

nft_xfrm.c

xfrm: add generic iptfs defines and functionality

2024-12-05 10:01:28 +01:00

utils.c

…

x_tables.c

netfilter: Fix use-after-free in get_info()

2024-10-30 13:17:36 +01:00

xt_addrtype.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-09 23:20:46 +02:00

xt_AUDIT.c

…

xt_bpf.c

…

xt_cgroup.c

…

xt_CHECKSUM.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-09 23:20:46 +02:00

xt_CLASSIFY.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-09 23:20:46 +02:00

xt_cluster.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-09 23:20:46 +02:00

xt_comment.c

…

xt_connbytes.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-09 23:20:46 +02:00

xt_connlabel.c

…

xt_connlimit.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-09 23:20:46 +02:00

xt_connmark.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-09 23:20:46 +02:00

xt_CONNSECMARK.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-09 23:20:46 +02:00

xt_conntrack.c

…

xt_cpu.c

…

xt_CT.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-09 23:20:46 +02:00

xt_dccp.c

…

xt_devgroup.c

…

xt_dscp.c

…

xt_DSCP.c

…

xt_ecn.c

…

xt_esp.c

…

xt_hashlimit.c

netfilter: xt_hashlimit: htable_selective_cleanup() optimization

2025-01-05 18:41:32 +01:00

xt_helper.c

…

xt_hl.c

…

xt_HL.c

…

xt_HMARK.c

…

xt_IDLETIMER.c

netfilter: IDLETIMER: Fix for possible ABBA deadlock

2024-12-11 23:15:19 +01:00

xt_ipcomp.c

…

xt_iprange.c

…

xt_ipvs.c

…

xt_l2tp.c

…

xt_LED.c

netfilter: x_tables: fix LED ID check in led_tg_check()

2024-11-28 13:14:24 +01:00

xt_length.c

…

xt_limit.c

…

xt_LOG.c

…

xt_mac.c

…

xt_mark.c

netfilter: xtables: fix typo causing some targets not to load on IPv6

2024-10-21 11:31:26 +02:00

xt_MASQUERADE.c

…

xt_multiport.c

…

xt_nat.c

…

xt_NETMAP.c

…

xt_nfacct.c

…

xt_NFLOG.c

netfilter: xtables: fix typo causing some targets not to load on IPv6

2024-10-21 11:31:26 +02:00

xt_NFQUEUE.c

…

xt_osf.c

…

xt_owner.c

…

xt_physdev.c

…

xt_pkttype.c

…

xt_policy.c

…

xt_quota.c

…

xt_rateest.c

…

xt_RATEEST.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-09 23:20:46 +02:00

xt_realm.c

…

xt_recent.c

netfilter: xt_recent: Lift restrictions on max hitcount value

2024-06-28 17:57:50 +02:00

xt_REDIRECT.c

…

xt_repldata.h

…

xt_sctp.c

…

xt_SECMARK.c

netfilter: xtables: avoid NFPROTO_UNSPEC where needed

2024-10-09 23:20:46 +02:00

xt_set.c

…

xt_socket.c

…

xt_state.c

…

xt_statistic.c

…

xt_string.c

…

xt_tcpmss.c

…

xt_TCPMSS.c

…

xt_TCPOPTSTRIP.c

…

xt_tcpudp.c

…

xt_TEE.c

…

xt_time.c

…

xt_TPROXY.c

…

xt_TRACE.c

netfilter: xtables: fix typo causing some targets not to load on IPv6

2024-10-21 11:31:26 +02:00

xt_u32.c

…