Re: [RFC nf 0/2] netfilter: add restrictions/validations for packet rewrites

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Jun 04, 2026 at 12:33:13AM +0200, Pablo Neira Ayuso wrote:
> Hi Florian,
> 
> On Wed, May 27, 2026 at 02:11:42PM +0200, Florian Westphal wrote:
> > This is a followup to the recent patch that disabled packet manipulation
> > via nfqueue or nft_payload in user namespaces.
> > 
> > This adds additional *restrictions*.
> > For nfqueue, do minimal header checks in case userspace provides payload
> > replacement data.
> > 
> > For nft_payload, restrict the offset/length combinations.
> > 
> > Several of these checks could be done at rule insertion time (i.e.
> > control plane).
> > Risk is that this may cause ruleset load failures for existing rulesets.
> > With this change such writes are silently skipped and packet passes
> > unchanged.
> > 
> > Restriction is added for link and network bases only.
> > 
> > Open questions:
> > - target tree: nf or nf-next?
> >
> > - should there be an immediate followup ('patch 3') that reverts
> >   the userns restrictions again?
> >
> > - should nft_payload reject those requests it can validate there from
> >   the control plane?
> 
> Ideally, better from control plane.
> 
> If anyone is breaking with ilegals field, they should come here to
> explain? Data plane validation might look safer ... but it will just
> drop packets and it will take a bit more time to the user to debug.
> 
> But your approach is more conservative, it just leave the packet
> untouch, so it is basically ignoring the invalid mangling.

Hm. Actually, it is harder than it seems to do this from control plane
because dscp needs to deal with bitwise to ensure that ihl and version
are not modified.