Re: [PATCH net 0/4] net/sched: reset conntrack after packet munging

On Thu, Aug 20, 2026 at 9:10 AM Florian Westphal [off-list ref] wrote:

Jamal Hadi Salim [off-list ref] wrote:

quoted

Sigh - couldnt help myself. Attached  fixes the poc from kyle - i know
you are hinting there are other scenarios where it wont work.

Yes, e.g. what if pedit inflated th->doff?
nf_conntrack_in() checked that this was fine, but now the pipeline
can re-neg on that.

True.
So my question to you then is: what about BPF, OVS, future thingy? Are
you going to fix each individually?
Or is the answer there "these are different" because they require
root/CAP_BPF they are not worth fixing?

cheers,
jamal