Hi,
The following patchset contains Netfilter fixes for net:
1) Zero out the remainder in nft_pipapo AVX2 implementation, otherwise
next lookup could bogusly report a mismatch. This is followed by two
patches to update nft_pipapo selftests to cover for the previous bug.
From Florian Westphal.
2) Check for reverse tuple too in case of esoteric NAT collisions for
UDP traffic and extend selftest coverage. Also from Florian.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-25-06-05
Thanks.
----------------------------------------------------------------
The following changes since commit 12c331b29c7397ac3b03584e12902990693bc248:
gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (2025-06-04 12:06:13 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-25-06-05
for you to fetch changes up to 3c3c3248496a3a1848ec5d923f2eee0edf60226e:
selftests: netfilter: nft_nat.sh: add test for reverse clash with nat (2025-06-05 10:50:05 +0200)
----------------------------------------------------------------
netfilter pull request 25-06-05
----------------------------------------------------------------
Florian Westphal (5):
netfilter: nf_set_pipapo_avx2: fix initial map fill
selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing
selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug
netfilter: nf_nat: also check reverse tuple to obtain clashing entry
selftests: netfilter: nft_nat.sh: add test for reverse clash with nat
net/netfilter/nf_nat_core.c | 12 ++-
net/netfilter/nft_set_pipapo_avx2.c | 21 ++++-
.../selftests/net/netfilter/nft_concat_range.sh | 102 ++++++++++++++++++---
tools/testing/selftests/net/netfilter/nft_nat.sh | 81 +++++++++++++++-
4 files changed, 193 insertions(+), 23 deletions(-)
