[PATCH net 00/13] Netfilter/IPVS fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following batch contains Netfilter/IPVS fixes for net. This batch
includes a mix of IPVS follow ups related to Sashiko reports, as well as
crash fixes for connection tracking expectation, helpers, ipset and
nf_tables mostly for old bugs. This also includes a fix for the
flowtable tunnel selftest.

1) Use s32 instead of s16 to calculate the remaining payload containing
   SIP messages, otherwise underflow is possible allowing out-of-bound
   memory access beyond the skb->data area. From Xiang Mei.

2) Fix the counter check in the flowtable selftest for tunnels, from
   Lorenzo Bianconi.

3) Add and use nf_ct_expect_related_pair() to add the RTP and RTCP
   expectations under the expectation lock, this is required by the SIP
   and H.323 NAT helpers. This fixes a possible reinsertion of an
   expectation with the DEAD flag set on while looping to find
   consecutive ports.

4) Fix ipset UaF during table resize by blocking comment updates on
   kernel-side adds. From David Lee.

5) Do not propagate the IP_VS_CONN_F_ONE_PACKET flag when using IPVS
   state synchronization, otherwise reaching stale freed from
   ip_vs_conn struct is possible, Zhiling Zou.

6) Adjust the hn1 hash node when the forwarding method changes between
   MASQ and non-MASQ for an already hashed connection.  This can leave
   stale hash nodes pointing to a freed struct ip_vs_conn and trigger
   UaF while reading /proc/net/ip_vs_conn. From Julian Anastasov.

7) nft_object rhltable needs to be per table, just like chain rhltable,
   otherwise UaF from object lookup path while netns is being released.
   There is also the nlevent path that can reach stale objects. Placing
   this rhltable under the table hierarchy fixes this issue.

8) Reject invalid combined usage of hashlimit tables with and without
   XT_HASHLIMIT_RATE_MATCH flag mode, otherwise access to uninitialized
   .burst field of dsthash_ent is possible.

9) Fix checksum validations in IPVS performed from LOCAL_IN,
   from Julian Anastasov.

10) Fix incorrect packet offset to layer 4 protocol in IPVS, uncovered
    by Sashiko, from Julian Anastasov.

11) Skip the mangling of ICMP replies for non-first fragments, also
    reported by Sashiko. Also from Julian.

12) Clear ip_vs_conn flags under the spinlock to fix a possible data
    race. From Julian Anastasov.

13) Fix incorrect calculation of the payload bitmask in the nf_tables
    hardware offload support, leading to UBSAN splat. From Xiang Mei.

Julian Anastasov clarifies that some of the IPVS patches might still
result in pre-existing issues reports by Sashiko, they are ready to
follow up on that.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-07-22

Thanks.

----------------------------------------------------------------

The following changes since commit fca68249b6f5e84859b200b54cb5e0aef98f2b3a:

  Merge branch 'net-fix-two-issues-in-sk_clone-error-path' (2026-07-21 09:15:01 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-07-22

for you to fetch changes up to 09e0d3e6d4f401e8216227657d5e412553785607:

  netfilter: nft_payload: fix mask build for partial field offload (2026-07-22 20:47:50 +0200)

----------------------------------------------------------------
netfilter pull request 26-07-22

----------------------------------------------------------------
David Lee (1):
      netfilter: ipset: do not update comments from kernel-side hash adds

Julian Anastasov (5):
      ipvs: adjust double hashing when fwd method changes
      ipvs: fix the checksum validations
      ipvs: fix places with wrong packet offsets
      ipvs: do not mangle ICMP replies for non-first fragments
      ipvs: clear the nfct flag under lock

Lorenzo Bianconi (1):
      selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests

Pablo Neira Ayuso (3):
      netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()
      netfilter: nf_tables: make nft_object rhltable per table
      netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

Xiang Mei (1):
      netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

Xiang Mei (Microsoft) (1):
      netfilter: nft_payload: fix mask build for partial field offload

Zhiling Zou (1):
      ipvs: do not propagate one-packet flag to synced conns

 include/linux/netfilter/nf_conntrack_sip.h         |   2 +-
 include/net/ip_vs.h                                |  48 +++++-
 include/net/netfilter/nf_conntrack_expect.h        |   3 +
 include/net/netfilter/nf_tables.h                  |   4 +-
 net/ipv4/netfilter/nf_nat_h323.c                   |  22 +--
 net/netfilter/ipset/ip_set_hash_gen.h              |   2 +-
 net/netfilter/ipvs/ip_vs_app.c                     |   4 +-
 net/netfilter/ipvs/ip_vs_conn.c                    | 192 ++++++++++++++++-----
 net/netfilter/ipvs/ip_vs_core.c                    | 190 ++++++++++----------
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |  19 +-
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |  48 ++----
 net/netfilter/ipvs/ip_vs_proto_udp.c               |  54 ++----
 net/netfilter/ipvs/ip_vs_xmit.c                    |  42 +++--
 net/netfilter/nf_conntrack_expect.c                |  35 +++-
 net/netfilter/nf_conntrack_sip.c                   |   2 +-
 net/netfilter/nf_nat_sip.c                         |  22 +--
 net/netfilter/nf_tables_api.c                      |  34 ++--
 net/netfilter/nft_payload.c                        |  12 +-
 net/netfilter/xt_hashlimit.c                       |  16 +-
 .../selftests/net/netfilter/nft_flowtable.sh       |  14 +-
 20 files changed, 452 insertions(+), 313 deletions(-)