[PATCH net-next 00/12] Netfilter updates for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following patchset contains Netfilter updates for net-next.
This includes an enhancement to detect ct memleaks easier via
DEBUG_NET and flowtable preparation patches for IPv4 over IPV6
and vice-versa. This also includes a fix for the nft_ct custom
expectation support.

1) Add DEBUG_NET_WARN_ON_ONCE to nf_ct_set() to spot ct memleaks.

2) Pass struct net_device_path_ctx to dev_fill_forward_path() to
   make it easier to pass more parameters to this function.
   From Lorenzo Bianconi.

3) Add ether_type field to net_device_path context structucture.

4) Rename tun.l3_proto field to tun.inner_proto.

5) Rename ctx.tun.proto to ctx.tun.inner_proto.

6) Store ether_type in flowtable context.

7) Move IPv4 and IPv6 xmit path to a helper function.

8) Move encapsulation header parser out of the flowtable lookup
   function.

9) Rework nft_ct custom expectation support to address a possible
   reallocation of ct extension area while expectation list also
   contains expectations. Move datapath to a ct helper to fix it.

10) Ensure timeout is always lowered for the non-closing RST case
    in the TCP connection tracking.

11) Bail out when inserting already dead expectation, this should
    not ever happen, hence report it via DEBUG_NET.

12) Comestic updates for improving the conntrack selftest dump and
    flush userspace program, from Qingshuang Fu.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-26-08-10

Thanks.

----------------------------------------------------------------

The following changes since commit 001b5d347d8ba39b2dccaefcc57967b18caec8fe:

  Merge branch 'net-devmem-allow-rx-buf-size-page_size-per-binding' (2026-08-07 18:32:41 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git tags/nf-next-26-08-10

for you to fetch changes up to 736fb8632217bd27da6b2e3f1f8cbbe3193fc2d8:

  selftests: netfilter: conntrack_dump_flush: remove unused variables and fix typo (2026-08-10 21:20:44 +0200)

----------------------------------------------------------------
netfilter pull request 26-08-10

----------------------------------------------------------------
Lorenzo Bianconi (1):
      net: pass net_device_path_ctx to dev_fill_forward_path()

Pablo Neira Ayuso (10):
      netfilter: add DEBUG_NET_WARN_ON_ONCE to skb_set_nfct()
      net: netfilter: add ether_type to net_device_path_ctx and use it
      netfilter: flowtable: rename tun.l3_proto to tun.inner_proto
      netfilter: flowtable: rename ctx.tun.proto to ctx.tun.inner_proto
      netfilter: flowtable: store ethertype in flowtable context
      netfilter: flowtable: move ipv4 and ipv6 xmit path to function
      netfilter: flowtable: detach layer 2 encapsulation parser from lookup
      netfilter: nft_ct: move custom expectation support to helper
      netfilter: conntrack: always lower timeout for non-closing RST packets
      netfilter: nf_conntrack_expect: bail out on insert dead expectations

Qingshuang Fu (1):
      selftests: netfilter: conntrack_dump_flush: remove unused variables and fix typo

 drivers/net/ethernet/airoha/airoha_ppe.c           |   7 +-
 drivers/net/ethernet/mediatek/mtk_ppe_offload.c    |   7 +-
 include/linux/netdevice.h                          |   5 +-
 include/linux/skbuff.h                             |   1 +
 include/net/ip_vs.h                                |   2 +-
 include/net/netfilter/nf_conntrack_helper.h        |   1 +
 include/net/netfilter/nf_flow_table.h              |   2 +-
 net/core/dev.c                                     |  18 +--
 net/ipv4/ipip.c                                    |   5 +-
 net/ipv6/ip6_tunnel.c                              |   5 +-
 net/netfilter/nf_conntrack_core.c                  |   2 +-
 net/netfilter/nf_conntrack_expect.c                |   6 +
 net/netfilter/nf_conntrack_helper.c                |  14 +-
 net/netfilter/nf_conntrack_proto_tcp.c             |   3 +-
 net/netfilter/nf_flow_table_ip.c                   | 167 ++++++++++++---------
 net/netfilter/nf_flow_table_path.c                 |  17 ++-
 net/netfilter/nft_ct.c                             | 167 +++++++++++++++------
 net/openvswitch/conntrack.c                        |  12 +-
 net/sched/act_ct.c                                 |   6 +-
 .../selftests/net/netfilter/conntrack_dump_flush.c |  31 ++--
 20 files changed, 305 insertions(+), 173 deletions(-)