Re: [PATCH net 0/4] net/sched: reset conntrack after packet munging

On Thu, Aug 20, 2026 at 7:42 AM Florian Westphal [off-list ref] wrote:

Jamal Hadi Salim [off-list ref] wrote:

quoted

I apologize for the delayed response in the private exchange, but let
me repeat my thoughts here...
As you said, the munging can be done by an ebpf program (at different
attachment points, not just cls/act using multiple helpers).

Yes, and that is ALSO buggy.  For BPF its even worse because if you
permit arbitrary writes at any point in the stack you will also
invalidate e.g. addresses/offsets stored in skb->cb[].

There are a lot of helpers that could cause a mess.

quoted

"Packet rewrites are still possible with BPF. However, unlike pedit,
that needs privileges in the initial namespace."
That's only true in the default setup, but with BPF "token delegation"
it no longer holds (will be reachable via unshare -Urn).

I have not tried to verify what i am claiming since we "last talked" -
but could try it out when i get time (weekend looks promising).
If what i am saying is true then you will have many places in ebpf to
fix, which is not ideal.

*shrug*

quoted

But even if not true, you can still do it with CAP_BPF - which leads
to the same outcome. Unless we are saying as a general rule we should
prioritize where/how we fix things based on whether they are
reproducible via 1)namespace -urn  vs 2) require root permission
(assume this includes CAP_BPF)

I think 2) is very different from 1).

I agree. In fact, on the tc side we prioritize fixing bugs
reproducible using unshare -urn over those that require root.
The question is: Should that influence how and where we fix bugs? It
is something i am struggling with.
Example: If the ebpf one could be reproduced with unshare -urn would
it have been fine to make the fix sit in netfilter?

quoted

With that thought in mind, the question is: is there a single hook
entry point where this could be done?

No.

quoted

Example: nf_conntrack_in() or nf_confirm() as the choke point which
catches all?

Those are too late.  You would need a new, unconditional sanitizer hook
at INT_MIN, in all of IPV4/IPV6/Bridge, plus additional code in core.c
to refuse installation of custom hooks before the sanitizer hook.

Yeah, that is a bit much.

And that doesn't solve BPF (can sit anywhere) or OVS (no idea here if
its affected or not).

OVS is very likely affected.
I saw your other email and you are the expert, but I am itchy to try
the nf_confirm() approach.
At minimal it should fix the PoC imo.

cheers,
jamal