[PATCH net-next 0/7] netlink: specs: conntrack: minor spec fixes

[PATCH net-next 0/7] netlink: specs: conntrack: minor spec fixes

[Jakub Kicinski]

Clashiko raised a bunch of pre-existing issues on a recent series
from Ilya. Let's fix those and whatever else pops out in AI review
and looks relatively legitimate.

Jakub Kicinski (7):
  netlink: specs: conntrack: timestamp is a nest, not a be64
  netlink: specs: conntrack: fix the get reply attribute lists
  netlink: specs: conntrack: fix SCTP conntrack state names
  netlink: specs: conntrack: fix the nat-attrs attribute IDs
  netlink: specs: conntrack: describe CTA_HELP_INFO
  netlink: specs: conntrack: fix the per-CPU stats reply
  netlink: specs: conntrack: tweak definition of obsolete attrs

 Documentation/netlink/specs/conntrack.yaml | 54 ++++++++++++++--------
 1 file changed, 36 insertions(+), 18 deletions(-)

-- 
2.55.0

[PATCH net-next 1/7] netlink: specs: conntrack: timestamp is a nest, not a be64

[Jakub Kicinski]

ctnetlink_dump_timestamp() wraps CTA_TIMESTAMP_START
and CTA_TIMESTAMP_STOP in a nest, but the spec declares CTA_TIMESTAMP
as a flat be64. ynl picks reply attributes out of the attribute set rather
than the operation's attribute list, so the mistyped attribute stops
the whole dump:

  Error decoding 'timestamp' from 'conntrack-attrs'
  Traceback (most recent call last):
    File "tools/net/ynl/pyynl/cli.py", line 314, in main
      reply = ynl.dump(args.dump, attrs)
    File "tools/net/ynl/pyynl/lib/ynl.py", line 1082, in _decode
      decoded = attr.as_scalar(attr_spec['type'], attr_spec.byte_order)
    File "tools/net/ynl/pyynl/lib/ynl.py", line 291, in as_scalar
      return format_.unpack(self.raw)[0]
  struct.error: unpack requires a buffer of 8 bytes

The tstamp extension is only attached when CONFIG_NF_CONNTRACK_TIMESTAMP
is enabled and nf_conntrack_timestamp is turned on, which is off by default
and is why every dump does not hit this.

stop is omitted for live entries, so it stays optional like every other
member here.  The pad member mirrors counter-attrs, which covers the same
nla_put_be64() padding.

Reported-by: Sashiko <netdev-bot+sashiko@kernel.org>
Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826220444.4054714-1-i.maximets@ovn.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 Documentation/netlink/specs/conntrack.yaml | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml
index b1eb102ab843..2b7f16cc4133 100644
--- a/Documentation/netlink/specs/conntrack.yaml
+++ b/Documentation/netlink/specs/conntrack.yaml
@@ -345,6 +345,20 @@ doc: >-
       -
         name: secctx-name
         type: string
+  -
+    name: timestamp-attrs
+    attributes:
+      -
+        name: start
+        type: u64
+        byte-order: big-endian
+      -
+        name: stop
+        type: u64
+        byte-order: big-endian
+      -
+        name: pad
+        type: pad
   -
     name: synproxy-attrs
     attributes:
@@ -458,8 +472,8 @@ doc: >-
         nested-attributes: secctx-attrs
       -
         name: timestamp
-        type: u64
-        byte-order: big-endian
+        type: nest
+        nested-attributes: timestamp-attrs
       -
         name: mark-mask
         type: u32
-- 
2.55.0

[PATCH net-next 2/7] netlink: specs: conntrack: fix the get reply attribute lists

[Jakub Kicinski]

CTA_NAT_SRC and CTA_NAT_DST are input-only.  The only references to either
are cda[] reads in ctnetlink_setup_nat() and the rejection in
ctnetlink_change_conntrack(); no path ever puts them into a message, so
neither belongs in a reply.  nat-dst was listed twice on top of that.

CTA_TIMESTAMP is the opposite case - both the do and the dump reach
ctnetlink_fill_info() with extinfo set, so ctnetlink_dump_extinfo() ->
ctnetlink_dump_timestamp() emits it, but the lists never named it.

Reported-by: Sashiko <netdev-bot+sashiko@kernel.org>
Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826220444.4054714-1-i.maximets@ovn.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 Documentation/netlink/specs/conntrack.yaml | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml
index 2b7f16cc4133..174697ce125e 100644
--- a/Documentation/netlink/specs/conntrack.yaml
+++ b/Documentation/netlink/specs/conntrack.yaml
@@ -596,20 +596,18 @@ doc: >-
             - status
             - protoinfo
             - help
-            - nat-src
-            - nat-dst
             - timeout
             - mark
             - counters-orig
             - counters-reply
             - use
             - id
-            - nat-dst
             - tuple-master
             - seq-adj-orig
             - seq-adj-reply
             - zone
             - secctx
+            - timestamp
             - labels
             - synproxy
       dump:
@@ -632,20 +630,18 @@ doc: >-
             - status
             - protoinfo
             - help
-            - nat-src
-            - nat-dst
             - timeout
             - mark
             - counters-orig
             - counters-reply
             - use
             - id
-            - nat-dst
             - tuple-master
             - seq-adj-orig
             - seq-adj-reply
             - zone
             - secctx
+            - timestamp
             - labels
             - synproxy
     -
-- 
2.55.0

[PATCH net-next 3/7] netlink: specs: conntrack: fix SCTP conntrack state names

[Jakub Kicinski]

Correct the names of constants:

Value 1 is SCTP_CONNTRACK_CLOSED, not "cloned".
Value 6 is SCTP_CONNTRACK_SHUTDOWN_RECD, not "shutdown-received".
Value 8 is SCTP_CONNTRACK_HEARTBEAT_SENT, there is no "shutdown-heartbeat"
state.

Note that there's also a value of 9 (HEARTBEAT_ACKED) but sctp_nla_policy
caps the attribute at HEARTBEAT_SENT and HEARTBEAT_ACKED is marked no
longer used in the header.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 Documentation/netlink/specs/conntrack.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml
index 174697ce125e..105b53d4b76a 100644
--- a/Documentation/netlink/specs/conntrack.yaml
+++ b/Documentation/netlink/specs/conntrack.yaml
@@ -72,14 +72,14 @@ doc: >-
     type: enum
     entries:
       - none
-      - cloned
+      - closed
       - cookie-wait
       - cookie-echoed
       - established
       - shutdown-sent
-      - shutdown-received
+      - shutdown-recd
       - shutdown-ack-sent
-      - shutdown-heartbeat-sent
+      - heartbeat-sent
   -
     name: nf-ct-status
     type: flags
-- 
2.55.0

[PATCH net-next 4/7] netlink: specs: conntrack: fix the nat-attrs attribute IDs

[Jakub Kicinski]

The enum for attr IDs says:

     CTA_NAT_V4_MINIP,
  #define CTA_NAT_MINIP CTA_NAT_V4_MINIP
     CTA_NAT_V4_MAXIP,
  #define CTA_NAT_MAXIP CTA_NAT_V4_MAXIP
     CTA_NAT_PROTO,
     CTA_NAT_V6_MINIP,
     CTA_NAT_V6_MAXIP,

Move nat-proto to the right place in the YAML spec to make sure
the attr IDs match.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 Documentation/netlink/specs/conntrack.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml
index 105b53d4b76a..0d1528507c4b 100644
--- a/Documentation/netlink/specs/conntrack.yaml
+++ b/Documentation/netlink/specs/conntrack.yaml
@@ -314,16 +314,16 @@ doc: >-
         name: nat-v4-maxip
         type: u32
         byte-order: big-endian
+      -
+        name: nat-proto
+        type: nest
+        nested-attributes: nat-proto-attrs
       -
         name: nat-v6-minip
         type: binary
       -
         name: nat-v6-maxip
         type: binary
-      -
-        name: nat-proto
-        type: nest
-        nested-attributes: nat-proto-attrs
   -
     name: seqadj-attrs
     attributes:
-- 
2.55.0

[PATCH net-next 5/7] netlink: specs: conntrack: describe CTA_HELP_INFO

[Jakub Kicinski]

nfnl_cthelper_to_nlattr() seems to output CTA_HELP_INFO but the spec
doesn't have a definition for it, add one.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 Documentation/netlink/specs/conntrack.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml
index 0d1528507c4b..ec90d3d05841 100644
--- a/Documentation/netlink/specs/conntrack.yaml
+++ b/Documentation/netlink/specs/conntrack.yaml
@@ -292,6 +292,12 @@ doc: >-
         name: help-name
         type: string
         doc: helper name
+      -
+        name: help-info
+        type: binary
+        doc: >-
+          Private data of a user space helper, only present for helpers
+          registered via nfnetlink_cthelper with a non-zero data length.
   -
     name: nat-proto-attrs
     attributes:
-- 
2.55.0

[PATCH net-next 6/7] netlink: specs: conntrack: fix the per-CPU stats reply

[Jakub Kicinski]

ctnetlink_ct_stat_cpu_fill_info() emits CTA_STATS_INVALID but
does not emit CTA_STATS_SEARCHED. Update the attr list, and
remove the false annotation of invalid as obsolete.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 Documentation/netlink/specs/conntrack.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml
index ec90d3d05841..9ba93370275d 100644
--- a/Documentation/netlink/specs/conntrack.yaml
+++ b/Documentation/netlink/specs/conntrack.yaml
@@ -530,7 +530,7 @@ doc: >-
         name: invalid
         type: u32
         byte-order: big-endian
-        doc: obsolete
+        doc: packets which could not be tracked
       -
         name: ignore
         type: u32
@@ -661,8 +661,8 @@ doc: >-
         reply:
           value: 0x104
           attributes:
-            - searched
             - found
+            - invalid
             - insert
             - insert-failed
             - drop
-- 
2.55.0

[PATCH net-next 7/7] netlink: specs: conntrack: tweak definition of obsolete attrs

[Jakub Kicinski]

CTA_SECMARK, CTA_COUNTERS32_{PACKETS,BYTES} are all obsolete
be32 attrs. Since they are obsolete we don't bother with
the byte-order annotation, but let's be consistent about
marking them as u32 with doc: obsolete.

The attrs were obsoleted by:
commit 584015727a3b ("netfilter: accounting rework: ct_extend + 64bit counters (v4)")
commit 1cc63249adfa ("conntrack: export lsm context rather than internal secid via netlink")

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 Documentation/netlink/specs/conntrack.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml
index 9ba93370275d..1d163130241a 100644
--- a/Documentation/netlink/specs/conntrack.yaml
+++ b/Documentation/netlink/specs/conntrack.yaml
@@ -116,9 +116,11 @@ doc: >-
       -
         name: packets-old
         type: u32
+        doc: obsolete
       -
         name: bytes-old
         type: u32
+        doc: obsolete
       -
         name: pad
         type: pad
@@ -465,7 +467,7 @@ doc: >-
         nested-attributes: seqadj-attrs
       -
         name: secmark
-        type: binary
+        type: u32
         doc: obsolete
       -
         name: zone
-- 
2.55.0

Re: [PATCH net-next 0/7] netlink: specs: conntrack: minor spec fixes

[Hangbin Liu]

Hi Jakub,
On Wed, Sep 09, 2026 at 05:38:44PM -0700, Jakub Kicinski wrote:
> Clashiko raised a bunch of pre-existing issues on a recent series
> from Ilya. Let's fix those and whatever else pops out in AI review
> and looks relatively legitimate.
> 
> Jakub Kicinski (7):
>   netlink: specs: conntrack: timestamp is a nest, not a be64
>   netlink: specs: conntrack: fix the get reply attribute lists
>   netlink: specs: conntrack: fix SCTP conntrack state names
>   netlink: specs: conntrack: fix the nat-attrs attribute IDs
>   netlink: specs: conntrack: describe CTA_HELP_INFO
>   netlink: specs: conntrack: fix the per-CPU stats reply
>   netlink: specs: conntrack: tweak definition of obsolete attrs
> 
>  Documentation/netlink/specs/conntrack.yaml | 54 ++++++++++++++--------
>  1 file changed, 36 insertions(+), 18 deletions(-)
> 
> -- 
> 2.55.0
> 

All the changes look reasonable to me and the change matches the conntrack code.
For the series

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>

BTW, I'm still working on rt lwtunnel encap support. I noticed some sections
in your change have documentation while others do not. Are there any mandatory
requirements for documentation at this point?

Thanks
Hangbin