From: Florian Westphal <fw@strlen.de>
To: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: netdev@vger.kernel.org, jiri@resnulli.us, victor@mojatatu.com
Subject: Re: [PATCH net 0/4] net/sched: reset conntrack after packet munging
Date: Thu, 20 Aug 2026 19:37:10 +0200 [thread overview]
Message-ID: <aoc7RqoGX09plRrt@strlen.de> (raw)
In-Reply-To: <CAM0EoMnLj_5HQrxSWPhJcks1bedi_OMEr6-_=q2+c_cWDn=8Cg@mail.gmail.com>
Jamal Hadi Salim <jhs@mojatatu.com> wrote:
> > Yes, e.g. what if pedit inflated th->doff?
> > nf_conntrack_in() checked that this was fine, but now the pipeline
> > can re-neg on that.
>
> True.
> So my question to you then is: what about BPF, OVS, future thingy? Are
> you going to fix each individually?
I see no alternative? I mean, what are you suggesting?
We can apply the patch from Kyle, that will stop the reproducer.
But I can tell you that we'll need hundreds of followup patches
all over.
I mean, we always relied on IP stack having checked that iph->ihl is
fine, the ipv6 header is complete, etc.
And that isn't exclusive to netfilter.
My best suggestion is to remove skb->_nfct and reparse everywhere,
but I will NOT make such a patch, IMO conntrack and netfilter might
as well be axed then. Hey, would solve a few bugs.
next prev parent reply other threads:[~2026-08-20 17:37 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-19 20:42 [PATCH net 0/4] net/sched: reset conntrack after packet munging Florian Westphal
2026-08-19 20:42 ` [PATCH net 1/4] selftests/tc-testing: pass mp_pm via initialiser Florian Westphal
2026-08-19 20:42 ` [PATCH net 2/4] net/sched: act_pedit: drop conntrack on network/transport header changes Florian Westphal
2026-08-19 20:42 ` [PATCH net 3/4] selftests: tc-testing: add act_ct test for ct reset handling Florian Westphal
2026-08-19 20:42 ` [PATCH net 4/4] net/sched: act_nat: discard any conntrack entry post modification Florian Westphal
2026-08-20 11:09 ` [PATCH net 0/4] net/sched: reset conntrack after packet munging Jamal Hadi Salim
2026-08-20 11:32 ` Jamal Hadi Salim
2026-08-20 11:44 ` Florian Westphal
2026-08-20 11:42 ` Florian Westphal
2026-08-20 11:58 ` Jamal Hadi Salim
2026-08-20 12:09 ` Florian Westphal
2026-08-20 12:41 ` Jamal Hadi Salim
2026-08-20 13:10 ` Florian Westphal
2026-08-20 16:54 ` Jamal Hadi Salim
2026-08-20 17:37 ` Florian Westphal [this message]
2026-08-20 19:02 ` Jamal Hadi Salim
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aoc7RqoGX09plRrt@strlen.de \
--to=fw@strlen.de \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=netdev@vger.kernel.org \
--cc=victor@mojatatu.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.