[PATCH net-next 00/26] Netfilter updates for net-next

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following batch contains Netfilter updates for net-next,
specifically 26 patches: 5 patches adding/updating selftests,
4 fixes, 3 PREEMPT_RT fixes, and 14 patches to enhance nf_tables):

1) Improve selftest coverage for pipapo 4 bit group format, from
   Florian Westphal.

2) Fix incorrect dependencies when compiling a kernel without
   legacy ip{6}tables support, also from Florian.

3) Two patches to fix nft_fib vrf issues, including selftest updates
   to improve coverage, also from Florian Westphal.

4) Fix incorrect nesting in nft_tunnel's GENEVE support, from
   Fernando F. Mancera.

5) Three patches to fix PREEMPT_RT issues with nf_dup infrastructure
   and nft_inner to match in inner headers, from Sebastian Andrzej Siewior.

6) Integrate conntrack information into nft trace infrastructure,
   from Florian Westphal.

7) A series of 13 patches to allow to specify wildcard netdevice in
   netdev basechain and flowtables, eg.

   table netdev filter {
       chain ingress {
           type filter hook ingress devices = { eth0, eth1, vlan* } priority 0; policy accept;
       }
   }

   This also allows for runtime hook registration on NETDEV_{UN}REGISTER
   event, from Phil Sutter.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-25-05-22

Thanks.

----------------------------------------------------------------

The following changes since commit f685204c57e87d2a88b159c7525426d70ee745c9:

  Merge branch 'queue_api-reduce-risk-of-name-collision-over-txq' (2025-05-19 20:09:07 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git tags/nf-next-25-05-22

for you to fetch changes up to abc77025d71fcc1dc7315eda8d7ca50860d56f47:

  selftests: netfilter: Torture nftables netdev hooks (2025-05-22 17:47:32 +0200)

----------------------------------------------------------------
netfilter pull request 25-05-22

----------------------------------------------------------------
Fernando Fernandez Mancera (1):
      netfilter: nft_tunnel: fix geneve_opt dump

Florian Westphal (9):
      selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation
      netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft only builds
      selftests: netfilter: nft_fib.sh: add 'type' mode tests
      selftests: netfilter: move fib vrf test to nft_fib.sh
      netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
      netfilter: nf_tables: nft_fib: consistent l3mdev handling
      selftests: netfilter: nft_fib.sh: add type and oif tests with and without VRFs
      netfilter: conntrack: make nf_conntrack_id callable without a module dependency
      netfilter: nf_tables: add packets conntrack state to debug trace info

Phil Sutter (13):
      netfilter: nf_tables: Introduce functions freeing nft_hook objects
      netfilter: nf_tables: Introduce nft_hook_find_ops{,_rcu}()
      netfilter: nf_tables: Introduce nft_register_flowtable_ops()
      netfilter: nf_tables: Pass nf_hook_ops to nft_unregister_flowtable_hook()
      netfilter: nf_tables: Have a list of nf_hook_ops in nft_hook
      netfilter: nf_tables: Prepare for handling NETDEV_REGISTER events
      netfilter: nf_tables: Respect NETDEV_REGISTER events
      netfilter: nf_tables: Wrap netdev notifiers
      netfilter: nf_tables: Handle NETDEV_CHANGENAME events
      netfilter: nf_tables: Sort labels in nft_netdev_hook_alloc()
      netfilter: nf_tables: Support wildcard netdev hook specs
      netfilter: nf_tables: Add notifications for hook changes
      selftests: netfilter: Torture nftables netdev hooks

Sebastian Andrzej Siewior (3):
      netfilter: nf_dup{4, 6}: Move duplication check to task_struct
      netfilter: nft_inner: Use nested-BH locking for nft_pcpu_tun_ctx
      netfilter: nf_dup_netdev: Move the recursion counter struct netdev_xmit

 include/linux/netdevice_xmit.h                     |   3 +
 include/linux/netfilter.h                          |  15 +-
 include/linux/sched.h                              |   1 +
 include/net/netfilter/nf_tables.h                  |  12 +-
 include/net/netfilter/nft_fib.h                    |  16 +
 include/uapi/linux/netfilter/nf_tables.h           |  18 +
 include/uapi/linux/netfilter/nfnetlink.h           |   2 +
 net/ipv4/netfilter/ip_tables.c                     |   2 +-
 net/ipv4/netfilter/nf_dup_ipv4.c                   |   6 +-
 net/ipv4/netfilter/nft_fib_ipv4.c                  |  11 +-
 net/ipv6/netfilter/ip6_tables.c                    |   2 +-
 net/ipv6/netfilter/nf_dup_ipv6.c                   |   6 +-
 net/ipv6/netfilter/nft_fib_ipv6.c                  |  17 +-
 net/netfilter/core.c                               |   3 -
 net/netfilter/nf_conntrack_core.c                  |   6 +
 net/netfilter/nf_dup_netdev.c                      |  22 +-
 net/netfilter/nf_tables_api.c                      | 402 ++++++++++----
 net/netfilter/nf_tables_offload.c                  |  51 +-
 net/netfilter/nf_tables_trace.c                    |  54 +-
 net/netfilter/nfnetlink.c                          |   1 +
 net/netfilter/nft_chain_filter.c                   |  94 +++-
 net/netfilter/nft_flow_offload.c                   |   2 +-
 net/netfilter/nft_inner.c                          |  18 +-
 net/netfilter/nft_tunnel.c                         |   8 +-
 net/netfilter/xt_TCPOPTSTRIP.c                     |   4 +-
 net/netfilter/xt_mark.c                            |   2 +-
 tools/testing/selftests/net/netfilter/Makefile     |   1 +
 .../selftests/net/netfilter/conntrack_vrf.sh       |  34 --
 .../selftests/net/netfilter/nft_concat_range.sh    | 165 +++++-
 tools/testing/selftests/net/netfilter/nft_fib.sh   | 612 ++++++++++++++++++++-
 .../net/netfilter/nft_interface_stress.sh          | 151 +++++
 31 files changed, 1511 insertions(+), 230 deletions(-)
 create mode 100755 tools/testing/selftests/net/netfilter/nft_interface_stress.sh