Re: [RFC nf 0/2] netfilter: add restrictions/validations for packet rewrites

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Jun 04, 2026 at 01:11:17AM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > If anyone is breaking with ilegals field, they should come here to
> > > explain? Data plane validation might look safer ... but it will just
> > > drop packets and it will take a bit more time to the user to debug.
> > > But your approach is more conservative, it just leave the packet
> > > untouch, so it is basically ignoring the invalid mangling.
> 
> Yes, ignore resp. BREAK verdict.
> 
> > Hm. Actually, it is harder than it seems to do this from control plane
> > because dscp needs to deal with bitwise to ensure that ihl and version
> > are not modified.
> 
> Yes, there are cases like those where control plane valition is not
> possible.  I will address the AI comments and resubmit w.o. RFC tag.

It should be possible with some sort of register tracking. At ruleset
load time, the hardware offload infrastructure already do something
similar, and I added infrastructure for this for a different purpose.

But this can be done later, the datapath checks now should be fine to
start with.