Re: [PATCH v3 0/17] netfilter: nf_flow_table: refactoring, TCP state tracking, sending flows to slow path

[Rafał Miłecki]

On Mon, 5 Mar 2018 23:11:38 +0100, Pablo Neira Ayuso wrote:
> On Mon, Feb 26, 2018 at 10:15:07AM +0100, Felix Fietkau wrote:
> > Fixes issues with connections hanging after >30 seconds idle time.
> >
> > Changes since v2:
> > - Include the previous patch series
> > - Rebase to current nf.git
> > - Provide longer description for the teardown state and the changes
> >   for passing flows back to the slow path
> >
> > Changes since v1:
> > - Fix up connection tracking state earlier to improve processing of TCP
> >   FIN/RST that trigger the bump to the slow path.
> > - Fix the value of ct->proto.tcp.state, reset the window values to force
> >   the tcp window check to resync
>
> Series applied, thanks Felix.

Hi Pablo,

I just noticed net-next.git already got net.git merged and contains
Felix's DNAT fix.

Just letting you know, in case you have a moment to look at remaining
patches. Thanks a lot for taking care of Felix's work! I'm really
excited about this feature hitting OpenWrt/LEDE :)
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 00/47] Netfilter/IPVS updates for net-next

[Rafał Miłecki]

Hi Pablo,

> The following patchset contains Netfilter/IPVS updates for your net-next
> tree. This batch comes with more input sanitization for xtables to
> address bug reports from fuzzers, preparation works to the flowtable
> infrastructure and assorted updates. In no particular order, they are:
>
> 1) Make sure userspace provides a valid standard target verdict, from
>Florian Westphal.
>
> 2) Sanitize error target size, also from Florian.
>
> 3) Validate that last rule in basechain matches underflow/policy since
>userspace assumes this when decoding the ruleset blob that comes
>from the kernel, from Florian.
>
> 4) Consolidate hook entry checks through xt_check_table_hooks(),
>patch from Florian.
>
> 5) Cap ruleset allocations at 512 mbytes, 134217728 rules and reject
>very large compat offset arrays, so we have a reasonable upper limit
>and fuzzers don't exercise the oom-killer. Patches from Florian.
>
> 6) Several WARN_ON checks on xtables mutex helper, from Florian.
>
> 7) xt_rateest now has a hashtable per net, from Cong Wang.
>
> 8) Consolidate counter allocation in xt_counters_alloc(), from Florian.
>
> 9) Earlier xt_table_unlock() call in {ip,ip6,arp,eb}tables, patch
>from Xin Long.
>
> 10) Set FLOW_OFFLOAD_DIR_* to IP_CT_DIR_* definitions, patch from
> Felix Fietkau.
>
> 11) Consolidate code through flow_offload_fill_dir(), also from Felix.
>
> 12) Inline ip6_dst_mtu_forward() just like ip_dst_mtu_maybe_forward()
> to remove a dependency with flowtable and ipv6.ko, from Felix.
>
> 13) Cache mtu size in flow_offload_tuple object, this is safe for
> forwarding as f87c10a8aa1e describes, from Felix.
>
> 14) Rename nf_flow_table.c to nf_flow_table_core.o, to simplify too
> modular infrastructure, from Felix.

I see you mentioned changes from Felix in the pull request but:
1) I don't see any commits from Felix listed below
2) I don't think you sent any of these patches

Can you take a look at what has happened to them, please?
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html