[PATCH net-next 00/15] Netfilter/IPVS updates for net-next
flat view
WARM1d
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: 2026-10-11 22:00:00
Also in:
netfilter-devel
Revision v1 of 55 in this series.
Revisions (55)
Hi,
The following patchset contains Netfilter/IPVS updates for net-next:
1) Disable br_netfilter in userns and schedule it for removal in 2027,
from Florian Westphal.
2) Prepare the flowtable to support for IPv4 over IPv6 tunneling and
vice-versa, this includes 5 patches from Lorenzo Bianconi.
3) Update selftest nft_queue.sh to make it more stable on debug
kernels, from Jakub Kicinski.
4) Fix a overflow in IPVS sync messages which can only happen in very
old 2.6 kernels, from Julian Anastasov.
5) Flush conntrack gc worker when existing netns to address a unlikely
UaF, from Florian Westphal.
6) Switch nf_tables chain types to use rcu, otherwise module removal
can trigger UaF, also from Florian.
7) Add two new helper functions to validate that socket is of inet type,
coming in 2 patches from Florian Westphal.
8) Remove redundant parsing in nft_exthdr for the tcp options case,
from Fernando F. Mancera.
9) Remove redundant skb_header_pointer() calls in nft_exthdr for tcp
options, from Fernando F. Mancera.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-26-10-11
Thanks.
----------------------------------------------------------------
The following changes since commit a5e7d8e446af9803e37a3b6a4d416fb41178348f:
Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue (2026-10-05 17:51:32 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-26-10-11
for you to fetch changes up to b4074bbf5c23b05bd34022ade979f3d5f4e86516:
netfilter: nft_exthdr: avoid 60 bytes stack buffer in TCP option mangling (2026-10-11 23:29:26 +0200)
----------------------------------------------------------------
netfilter pull request 26-10-11
----------------------------------------------------------------
Fernando Fernandez Mancera (2):
netfilter: nft_exthdr: remove redundant op parsing in tcp_set_init
netfilter: nft_exthdr: avoid 60 bytes stack buffer in TCP option mangling
Florian Westphal (5):
netfilter: disable br_netfilter in user namespaces
netfilter: conntrack: fix unlikely UaF in gc worker
netfilter: nf_tables: switch chain_types array to rcu
netfilter: add nf_skb_sk helper and use it
netfilter: add nf_sk_to_full_sk helper and use it
Jakub Kicinski (1):
selftests: netfilter: nft_queue.sh: only queue icmp echo request/reply
Julian Anastasov (1):
ipvs: fix buffer overflow when sending sync messages
Lorenzo Bianconi (6):
netfilter: flowtable: recognize IPv4/IPv6 in tunnel proto matching
netfilter: flowtable: set inner protocol when popping tunnel header
netfilter: flowtable: populate tunnel tuple regardless of inner protocol
netfilter: flowtable: add encap_proto to flow_offload_tunnel
netfilter: flowtable: refactor MTU check for tunnel offload
netfilter: flowtable: unify tunnel push for IPv4 and IPv6
Documentation/networking/bridge.rst | 5 +-
include/linux/netdevice.h | 1 +
include/net/netfilter/nf_flow_table.h | 1 +
include/net/netfilter/nf_socket.h | 35 ++++
net/bridge/br_netfilter_hooks.c | 33 +++-
net/ipv4/ipip.c | 1 +
net/ipv4/netfilter.c | 3 +-
net/ipv6/ip6_tunnel.c | 1 +
net/ipv6/netfilter.c | 3 +-
net/netfilter/ipvs/ip_vs_sync.c | 23 ++-
net/netfilter/nf_conntrack_core.c | 5 +
net/netfilter/nf_flow_table_ip.c | 215 +++++++++++++--------
net/netfilter/nf_flow_table_path.c | 2 +
net/netfilter/nf_tables_api.c | 94 ++++++---
net/netfilter/nft_chain_nat.c | 1 +
net/netfilter/nft_exthdr.c | 34 ++--
net/netfilter/nft_socket.c | 16 +-
net/netfilter/xt_socket.c | 26 +--
tools/testing/selftests/net/netfilter/nft_queue.sh | 2 +-
19 files changed, 336 insertions(+), 165 deletions(-)