Re: [PATCH net-next 00/15] Netfilter/IPVS updates for net-next

Hi,

+Cc: lorenzo@kernel.org

This is a report on sashiko's findings:

https://sashiko.dev/#/patchset/20261011215953.1334630-1-pablo%40netfilter.org

On Sun, Oct 11, 2026 at 11:59:38PM +0200, Pablo Neira Ayuso wrote:

Hi,

The following patchset contains Netfilter/IPVS updates for net-next:

1) Disable br_netfilter in userns and schedule it for removal in 2027,
   from Florian Westphal.

2) Prepare the flowtable to support for IPv4 over IPv6 tunneling and
   vice-versa, this includes 5 patches from Lorenzo Bianconi.

I am afraid this preparation series is enabling more than it should,
sashiko reports type confusion is possible, for example:

  1/5 netfilter: flowtable: recognize IPv4/IPv6 in tunnel proto matching

this adds the initial pre-processing of IPv6-over-IPv4.

But then, nf_flow_offload_lookup() expects to handle IPv4, not an IPv6
packet.

I will repost this PR keeping them back.

3) Update selftest nft_queue.sh to make it more stable on debug
   kernels, from Jakub Kicinski.

4) Fix a overflow in IPVS sync messages which can only happen in very
   old 2.6 kernels, from Julian Anastasov.

5) Flush conntrack gc worker when existing netns to address a unlikely
   UaF, from Florian Westphal.

6) Switch nf_tables chain types to use rcu, otherwise module removal
   can trigger UaF, also from Florian.

7) Add two new helper functions to validate that socket is of inet type,
   coming in 2 patches from Florian Westphal.

sashiko reports:

"If an IPv4 packet from an AF_INET socket is encapsulated by an IPv6 tunnel,
the tunnel preserves the AF_INET socket in skb->sk while transmitting the
outer IPv6 packet on the LOCAL_OUT path."

This sounds like an unrelated issue, I don't know yet how that can
happen TBH.

8) Remove redundant parsing in nft_exthdr for the tcp options case,
   from Fernando F. Mancera.

9) Remove redundant skb_header_pointer() calls in nft_exthdr for tcp
   options, from Fernando F. Mancera.

Sashiko here reports this now drops malformed packets instead of
NFT_BREAK, which is fine, maybe just extend it to tell about this in
the patch description.

I plan to drop the flowtable preparation patches and resubmit.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-26-10-11

Thanks.

----------------------------------------------------------------

The following changes since commit a5e7d8e446af9803e37a3b6a4d416fb41178348f:

  Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue (2026-10-05 17:51:32 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-26-10-11

for you to fetch changes up to b4074bbf5c23b05bd34022ade979f3d5f4e86516:

  netfilter: nft_exthdr: avoid 60 bytes stack buffer in TCP option mangling (2026-10-11 23:29:26 +0200)

----------------------------------------------------------------
netfilter pull request 26-10-11

----------------------------------------------------------------
Fernando Fernandez Mancera (2):
      netfilter: nft_exthdr: remove redundant op parsing in tcp_set_init
      netfilter: nft_exthdr: avoid 60 bytes stack buffer in TCP option mangling

Florian Westphal (5):
      netfilter: disable br_netfilter in user namespaces
      netfilter: conntrack: fix unlikely UaF in gc worker
      netfilter: nf_tables: switch chain_types array to rcu
      netfilter: add nf_skb_sk helper and use it
      netfilter: add nf_sk_to_full_sk helper and use it

Jakub Kicinski (1):
      selftests: netfilter: nft_queue.sh: only queue icmp echo request/reply

Julian Anastasov (1):
      ipvs: fix buffer overflow when sending sync messages

Lorenzo Bianconi (6):
      netfilter: flowtable: recognize IPv4/IPv6 in tunnel proto matching
      netfilter: flowtable: set inner protocol when popping tunnel header
      netfilter: flowtable: populate tunnel tuple regardless of inner protocol
      netfilter: flowtable: add encap_proto to flow_offload_tunnel
      netfilter: flowtable: refactor MTU check for tunnel offload
      netfilter: flowtable: unify tunnel push for IPv4 and IPv6

 Documentation/networking/bridge.rst                |   5 +-
 include/linux/netdevice.h                          |   1 +
 include/net/netfilter/nf_flow_table.h              |   1 +
 include/net/netfilter/nf_socket.h                  |  35 ++++
 net/bridge/br_netfilter_hooks.c                    |  33 +++-
 net/ipv4/ipip.c                                    |   1 +
 net/ipv4/netfilter.c                               |   3 +-
 net/ipv6/ip6_tunnel.c                              |   1 +
 net/ipv6/netfilter.c                               |   3 +-
 net/netfilter/ipvs/ip_vs_sync.c                    |  23 ++-
 net/netfilter/nf_conntrack_core.c                  |   5 +
 net/netfilter/nf_flow_table_ip.c                   | 215 +++++++++++++--------
 net/netfilter/nf_flow_table_path.c                 |   2 +
 net/netfilter/nf_tables_api.c                      |  94 ++++++---
 net/netfilter/nft_chain_nat.c                      |   1 +
 net/netfilter/nft_exthdr.c                         |  34 ++--
 net/netfilter/nft_socket.c                         |  16 +-
 net/netfilter/xt_socket.c                          |  26 +--
 tools/testing/selftests/net/netfilter/nft_queue.sh |   2 +-
 19 files changed, 336 insertions(+), 165 deletions(-)