Re: [PATCH net 0/4] net/sched: reset conntrack after packet munging

On Thu, Aug 20, 2026 at 8:09 AM Florian Westphal [off-list ref] wrote:

Jamal Hadi Salim [off-list ref] wrote:

quoted

Example: If the ebpf one could be reproduced with unshare -urn would
it have been fine to make the fix sit in netfilter?

I don't know how to 'fix netfilter'.  We would have to remove skb->nfct
and re-parse at every turn.  Is that a viable option...? Don't think so.

quoted

quoted

And that doesn't solve BPF (can sit anywhere) or OVS (no idea here if
its affected or not).

OVS is very likely affected.
I saw your other email and you are the expert, but I am itchy to try
the nf_confirm() approach.
At minimal it should fix the PoC imo.

As I said, I don't see any existing function that could be used
to add the required re-validation.  nf_confirm() is the last step
in the pipeline, its way too late.

Sigh - couldnt help myself. Attached  fixes the poc from kyle - i know
you are hinting there are other scenarios where it wont work.

 nf_conntrack_in() doesn't work
either because you can install matches earlier than that, e.g. via
-t raw -m conntrack in classic iptables, or via 'hook prerouting
type filter priority -2147483647' or something like that in
nftables.

The only other option is playing whack-a-mole, accepting the original
proposed patch for nft_ct, but I can already tell this will not be
enough and revalidation will have to be added everywhere.

whack-a-mole is what i was worrying about. Someone will come up with a
scenario for ebpf and likely ovs and you will have to fix multiple
spots until the next one.

cheers,
jamal