[PATCH net-next 0/8] Netfilter/IPVS fixes for net-next

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following patchset contains Netfilter/IPVS fixes for net-next,
I am targetting this tree since 7.2 has been already released.
This contains fixes for nf_tables, revisit issues with expectation
infra updates reported by sashiko, an ipset fix for deletions in the
hash:net type and tne fix for the IPVS FTP helper.

1) Validate layer 4 header mangling done via nfnetlink_queue and
   nft_payload, this is a follow up to recent similar validation
   at layer 3. From Zhiling Zou.

2) Do not allocate memory on delete operations in ipset hash:net
   type, delete operation must always succeed. From Florian Westphal.

3) Deliver nft_obj overquota packet path notification directly via
   nfnetlink, do not use the control plane batch logic.
   From Fourie Zhang.

4) Follow up to controlidate check for reinserted dead expectations,
   to cover the nf_conntrack_expect_related_pair() function too.

5) Do not expose expectation dead flag to userspace via ctnetlink.

6) Make commit set_update_list per-netns to prepare to publish
   set clone earlier.

7) Publish the set clone earlier from commit path to address set
   lookup failures during table re-creation, this is targetting
   the rbtree and pipapo set backends.

8) Fix an integer overflow in the IPVS FTP helper. A similar fix
   was already proposed for the conntrack FTP helper months ago.
   From Joas Antonio dos Santos. 

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-26-08-18

Thanks.

----------------------------------------------------------------

The following changes since commit e6a5d573d24cd375e09d24f136523cb3cc85c9d3:

  net: dsa: drop explicit NULL comparisons (2026-08-14 13:57:27 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-26-08-18

for you to fetch changes up to e625a9477d12baaff4025c5f9989184a907ea8fc:

  ipvs: fix integer overflow in ftp helper port/address parsing (2026-08-18 00:56:43 +0200)

----------------------------------------------------------------
netfilter pull request 26-08-18

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: ipset: remove need to allocate memory on delete operations

Fourie Zhang (1):
      netfilter: nf_tables: don't queue packet path object notifications

Joas Antonio dos Santos (1):
      ipvs: fix integer overflow in ftp helper port/address parsing

Pablo Neira Ayuso (4):
      netfilter: nf_conntrack_expect: consolidate check for insertion of dead expectation
      netfilter: ctnetlink: do not expose expectation DEAD flag
      netfilter: nf_tables: move set_update_list to nftables per-netns
      netfilter: nf_tables: call set ops .commit when building new ruleset blob

Zhiling Zou (1):
      netfilter: validate L4 headers after userspace packet writes

 include/net/netfilter/nf_tables.h            |   1 +
 net/netfilter/ipset/ip_set_hash_gen.h        | 168 +++++++++++++++++++--------
 net/netfilter/ipset/ip_set_hash_netiface.c   |   1 -
 net/netfilter/ipset/ip_set_hash_netportnet.c |   1 -
 net/netfilter/ipvs/ip_vs_ftp.c               |  10 +-
 net/netfilter/nf_conntrack_expect.c          |  11 +-
 net/netfilter/nf_conntrack_netlink.c         |   2 +-
 net/netfilter/nf_tables_api.c                | 137 +++++++++++++---------
 net/netfilter/nfnetlink_queue.c              |  72 +++++++++++-
 net/netfilter/nft_payload.c                  |  13 +++
 10 files changed, 302 insertions(+), 114 deletions(-)