Netfilter fixes for net

Hi David,

The following patchset contains the first batch of Netfilter fixes for your net tree:

1) Fix splat with IPv6 defragmenting locally generated fragments, from Florian Westphal.

2) Fix Incorrect check for missing attribute in nft_osf.

3) Missing INT_MIN & INT_MAX definition for netfilter bridge uapi header, from Jiri Slaby.

4) Revert map lookup in nft_numgen, this is already possible with the existing infrastructure without this extension.

5) Fix wrong listing of set reference counter, make counter synchronous again, from Stefano Brivio.

6) Fix CIDR 0 in hash:net,port,net, from Eric Westbrook.

7) Fix allocation failure with large set, use kvcalloc(). From Andrey Ryabinin.

8) No need to disable BH when fetch ip set comment, patch from Jozsef Kadlecsik.

9) Sanity check for valid sysfs entry in xt_IDLETIMER, from Taehee Yoo.

10) Fix suspicious rcu usage via ip_set() macro at netlink dump, from Jozsef Kadlecsik.

11) Fix setting default timeout via nfnetlink_cttimeout, this comes with preparation patch to add nf_{tcp,udp,...}_pernet() helper.

12) Allow ebtables table nat to be of filter type via nft_compat. From Florian Westphal.

13) Incorrect calculation of next bucket in early_drop, do no bump hash value, update bucket counter instead. From Vasily Khoruzhick.

You can pull these changes from:

git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git

Thanks!

----------------------------------------------------------------

The following changes since commit 4f3ebb04d05fe36f74ef17c6ee06559626d47964:

Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue (2018-10-24 16:27:33 -0700)

are available in the git repository at:

git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git HEAD

for you to fetch changes up to f393808dc64149ccd0e5a8427505ba2974a59854:

netfilter: conntrack: fix calculation of next bucket number in early_drop (2018-11-03 14:16:28 +0100)

----------------------------------------------------------------
Andrey Ryabinin (1):
netfilter: ipset: fix ip_set_list allocation failure

Eric Westbrook (1):
netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net

Florian Westphal (2):
netfilter: ipv6: fix oops when defragmenting locally generated fragments
netfilter: nft_compat: ebtables 'nat' table is normal chain type

Jiri Slaby (1):
netfilter: bridge: define INT_MIN & INT_MAX in userspace

Jozsef Kadlecsik (2):
netfilter: ipset: Correct rcu_dereference() call in ip_set_put_comment()
netfilter: ipset: Fix calling ip_set() macro at dumping

Pablo Neira Ayuso (4):
netfilter: nft_osf: check if attribute is present
Revert "netfilter: nft_numgen: add map lookups for numgen random operations"
netfilter: conntrack: add nf_{tcp,udp,sctp,icmp,dccp,icmpv6,generic}_pernet()
netfilter: nfnetlink_cttimeout: pass default timeout policy to obj_to_nlattr

Stefano Brivio (1):
netfilter: ipset: list:set: Decrease refcount synchronously on deletion and replace

Taehee Yoo (1):
netfilter: xt_IDLETIMER: add sysfs filename checking routine

Vasily Khoruzhick (1):
netfilter: conntrack: fix calculation of next bucket number in early_drop

 include/linux/netfilter/ipset/ip_set.h         |   2 +-
 include/linux/netfilter/ipset/ip_set_comment.h |   4 +-
 include/net/netfilter/nf_conntrack_l4proto.h   |  39 ++++++++
 include/uapi/linux/netfilter/nf_tables.h       |   4 +-
 include/uapi/linux/netfilter_bridge.h          |   4 +
 net/ipv6/netfilter/nf_conntrack_reasm.c        |  13 ++-
 net/netfilter/ipset/ip_set_core.c              |  43 +++++----
 net/netfilter/ipset/ip_set_hash_netportnet.c   |   8 +-
 net/netfilter/ipset/ip_set_list_set.c          |  17 ++--
 net/netfilter/nf_conntrack_core.c              |  13 ++-
 net/netfilter/nf_conntrack_proto_dccp.c        |  13 +--
 net/netfilter/nf_conntrack_proto_generic.c     |  11 +--
 net/netfilter/nf_conntrack_proto_icmp.c        |  11 +--
 net/netfilter/nf_conntrack_proto_icmpv6.c      |  11 +--
 net/netfilter/nf_conntrack_proto_sctp.c        |  11 +--
 net/netfilter/nf_conntrack_proto_tcp.c         |  15 +--
 net/netfilter/nf_conntrack_proto_udp.c         |  11 +--
 net/netfilter/nfnetlink_cttimeout.c            |  47 +++++++--
 net/netfilter/nft_compat.c                     |  21 ++--
 net/netfilter/nft_numgen.c                     | 127 -------------------------
 net/netfilter/nft_osf.c                        |   2 +-
 net/netfilter/xt_IDLETIMER.c                   |  20 ++++
 22 files changed, 200 insertions(+), 247 deletions(-)