[PATCH net 0/3] netfilter: updates for net

[Florian Westphal <fw@strlen.de>]

Hi,

The following patchset contains Netfilter fixes for *net*:

1) its not possible to attach conntrack labels via ctnetlink
   unless one creates a dummy 'ct labels set' rule in nftables.
   This is an oversight, the 'ruleset tests presence, userspace
   (netlink) sets' use-case is valid and should 'just work'.
   Always broken since this got added in Linux 4.7.

2) nft_connlimit reads count value without holding the relevant
   lock, add a READ_ONCE annotation.  From Fernando Fernandez Mancera.

3) There is a long-standing bug (since 4.12) in nftables helper infra
   when NAT is in use: if the helper gets assigned after the nat binding
   was set up, we fail to initialise the 'seqadj' extension, which is
   needed in case NAT payload rewrites need to add (or remove) from the
   packet payload.  Fix from Andrii Melnychenko.

Please, pull these changes from:
The following changes since commit 8df206f7b63611dbaeb8628661d87fe994dcdf71:

  Merge branch 'bug-fixes-for-the-hibmcge-ethernet-driver' (2025-10-28 19:11:07 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-25-10-29

for you to fetch changes up to 90918e3b6404c2a37837b8f11692471b4c512de2:

  netfilter: nft_ct: add seqadj extension for natted connections (2025-10-29 14:47:59 +0100)

----------------------------------------------------------------
netfilter pull request nf-25-10-29

----------------------------------------------------------------

Andrii Melnychenko (1):
  netfilter: nft_ct: add seqadj extension for natted connections

Fernando Fernandez Mancera (1):
  netfilter: nft_connlimit: fix possible data race on connection count

Florian Westphal (1):
  netfilter: nft_ct: enable labels for get case too

 net/netfilter/nft_connlimit.c |  2 +-
 net/netfilter/nft_ct.c        | 30 +++++++++++++++++++++++++++---
 2 files changed, 28 insertions(+), 4 deletions(-)

-- 
2.51.0