[PATCH net-next 00/15] Netfilter/IPVS updates for net-next

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following patchset contains Netfilter/IPVS updates for net-next:

1) Disable br_netfilter in userns and schedule it for removal in 2027,
   from Florian Westphal.

2) Prepare the flowtable to support for IPv4 over IPv6 tunneling and
   vice-versa, this includes 5 patches from Lorenzo Bianconi.

3) Update selftest nft_queue.sh to make it more stable on debug
   kernels, from Jakub Kicinski.

4) Fix a overflow in IPVS sync messages which can only happen in very
   old 2.6 kernels, from Julian Anastasov.

5) Flush conntrack gc worker when existing netns to address a unlikely
   UaF, from Florian Westphal.

6) Switch nf_tables chain types to use rcu, otherwise module removal
   can trigger UaF, also from Florian.

7) Add two new helper functions to validate that socket is of inet type,
   coming in 2 patches from Florian Westphal.

8) Remove redundant parsing in nft_exthdr for the tcp options case,
   from Fernando F. Mancera.

9) Remove redundant skb_header_pointer() calls in nft_exthdr for tcp
   options, from Fernando F. Mancera.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-26-10-11

Thanks.

----------------------------------------------------------------

The following changes since commit a5e7d8e446af9803e37a3b6a4d416fb41178348f:

  Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue (2026-10-05 17:51:32 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-26-10-11

for you to fetch changes up to b4074bbf5c23b05bd34022ade979f3d5f4e86516:

  netfilter: nft_exthdr: avoid 60 bytes stack buffer in TCP option mangling (2026-10-11 23:29:26 +0200)

----------------------------------------------------------------
netfilter pull request 26-10-11

----------------------------------------------------------------
Fernando Fernandez Mancera (2):
      netfilter: nft_exthdr: remove redundant op parsing in tcp_set_init
      netfilter: nft_exthdr: avoid 60 bytes stack buffer in TCP option mangling

Florian Westphal (5):
      netfilter: disable br_netfilter in user namespaces
      netfilter: conntrack: fix unlikely UaF in gc worker
      netfilter: nf_tables: switch chain_types array to rcu
      netfilter: add nf_skb_sk helper and use it
      netfilter: add nf_sk_to_full_sk helper and use it

Jakub Kicinski (1):
      selftests: netfilter: nft_queue.sh: only queue icmp echo request/reply

Julian Anastasov (1):
      ipvs: fix buffer overflow when sending sync messages

Lorenzo Bianconi (6):
      netfilter: flowtable: recognize IPv4/IPv6 in tunnel proto matching
      netfilter: flowtable: set inner protocol when popping tunnel header
      netfilter: flowtable: populate tunnel tuple regardless of inner protocol
      netfilter: flowtable: add encap_proto to flow_offload_tunnel
      netfilter: flowtable: refactor MTU check for tunnel offload
      netfilter: flowtable: unify tunnel push for IPv4 and IPv6

 Documentation/networking/bridge.rst                |   5 +-
 include/linux/netdevice.h                          |   1 +
 include/net/netfilter/nf_flow_table.h              |   1 +
 include/net/netfilter/nf_socket.h                  |  35 ++++
 net/bridge/br_netfilter_hooks.c                    |  33 +++-
 net/ipv4/ipip.c                                    |   1 +
 net/ipv4/netfilter.c                               |   3 +-
 net/ipv6/ip6_tunnel.c                              |   1 +
 net/ipv6/netfilter.c                               |   3 +-
 net/netfilter/ipvs/ip_vs_sync.c                    |  23 ++-
 net/netfilter/nf_conntrack_core.c                  |   5 +
 net/netfilter/nf_flow_table_ip.c                   | 215 +++++++++++++--------
 net/netfilter/nf_flow_table_path.c                 |   2 +
 net/netfilter/nf_tables_api.c                      |  94 ++++++---
 net/netfilter/nft_chain_nat.c                      |   1 +
 net/netfilter/nft_exthdr.c                         |  34 ++--
 net/netfilter/nft_socket.c                         |  16 +-
 net/netfilter/xt_socket.c                          |  26 +--
 tools/testing/selftests/net/netfilter/nft_queue.sh |   2 +-
 19 files changed, 336 insertions(+), 165 deletions(-)