[PATCH net-next 0/7] Netfilter/IPVS updates for net-next

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following patchset contains Netfilter/IPVS updates for net-next,
just a small batch with accumulated pending updates:

1) In IPVS, use system_dfl_long_wq instead of system_long_wq, from
   Ismael Luceno.

2) Add missing .checkentry in xt_tcpmss for IPv6, this is a follow up
   to a recent harderning, from Florian Westphal.

3) Address a sashiko report in the NAT SIP helper, from Florian Westphal.

4) Tear down flow entries with stale routes using the GC, this is to
   detect route updates when hardware offload is enabled.

5) Pass master conntrack as parameter to functions instead of using
   exp->master as preparation work to turn exp->master into a cookie.

6) Move expectation event_mask to the nf_conntrack_expect object,
   again as preparation work to turn exp->master into a cookie.

7) In IPVS, use kzalloc_obj{s}() typesafe allocations, from Subasri S.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-26-07-24

Thanks.

----------------------------------------------------------------

The following changes since commit 89d8006259b81dd25c962f6cc8d7ab268d6ea426:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-07-23 14:07:40 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-26-07-24

for you to fetch changes up to cca2780b61947fd27ec621541edd0902e193a609:

  ipvs: use type-safe allocation helpers in ip_vs_rht_alloc (2026-07-24 11:45:19 +0200)

----------------------------------------------------------------
netfilter pull request 26-07-24

----------------------------------------------------------------
Florian Westphal (2):
      netfilter: xt_tcpmss: extend checkentry to ipv6
      netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet

Ismael Luceno (1):
      ipvs: Move defense_work and est_reload_work to system_dfl_long_wq

Pablo Neira Ayuso (3):
      netfilter: flowtable: tear down flow entries with stale dst from GC
      netfilter: conntrack_helper: pass master conntrack to helper functions
      netfilter: nf_conntrack_expect: store event cache in expectation

Subasri S (1):
      ipvs: use type-safe allocation helpers in ip_vs_rht_alloc

 include/linux/netfilter/nf_conntrack_amanda.h | 1 +
 include/linux/netfilter/nf_conntrack_ftp.h    | 1 +
 include/linux/netfilter/nf_conntrack_irc.h    | 1 +
 include/linux/netfilter/nf_conntrack_tftp.h   | 1 +
 include/net/netfilter/nf_conntrack_expect.h   | 3 +++
 include/net/netfilter/nf_flow_table.h         | 8 ++++++++
 net/netfilter/ipvs/ip_vs_core.c               | 9 ++++-----
 net/netfilter/ipvs/ip_vs_ctl.c                | 6 +++---
 net/netfilter/ipvs/ip_vs_est.c                | 2 +-
 net/netfilter/nf_conntrack_amanda.c           | 2 +-
 net/netfilter/nf_conntrack_broadcast.c        | 6 ++++++
 net/netfilter/nf_conntrack_ecache.c           | 7 +------
 net/netfilter/nf_conntrack_expect.c           | 5 +++++
 net/netfilter/nf_conntrack_ftp.c              | 2 +-
 net/netfilter/nf_conntrack_irc.c              | 2 +-
 net/netfilter/nf_conntrack_netlink.c          | 5 +++++
 net/netfilter/nf_conntrack_tftp.c             | 2 +-
 net/netfilter/nf_flow_table_core.c            | 2 ++
 net/netfilter/nf_flow_table_ip.c              | 8 --------
 net/netfilter/nf_nat_amanda.c                 | 7 ++++---
 net/netfilter/nf_nat_ftp.c                    | 4 ++--
 net/netfilter/nf_nat_irc.c                    | 2 +-
 net/netfilter/nf_nat_sip.c                    | 5 +++++
 net/netfilter/nf_nat_tftp.c                   | 5 ++---
 net/netfilter/xt_tcpmss.c                     | 1 +
 25 files changed, 61 insertions(+), 36 deletions(-)