[PATCH net 00/10] Netfilter/IPVS fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following patchset contains Netfilter/IPVS for net:

1) Fix IPv6 nexthdr offset truncation in fragment reassembly,
   this has been uncovered by LLM, from Jeremy Jean.

2) Restrict checksums in nfqueue to known protocols and offset,
   after this patch the plan is to re-enable nfqueue in userns,
   this came via LLM report. from Florian Westhphal.

3) Fix races when handling overload flag in IPVS, this patch
   is not perfect but Julian considers this improves the situation.
   This was uncovered by LLM. From Julian Anastasov.

4) Error handling for IPVS sync_threshold sysctl, from Joel Granados.

5) Use skb_vlan_tag_get_id() to retrieve the VLAN id, discard tci
   bits, when handling VLAN in the flowtable, from Shuangfeng He.

6) Initialize IPCB for inet/ingress reject, uncovered by LLM.

7) Restrict completion of binary search array to anonymous set.

8) Restrict DCCP option matching to avoid out-of-bound read,
   from Sung Byeongchan.

9) Reset transport header offset in flowtable after tunnel
   decapsulation to fix issue with qdisc xmit path,
   from Lorenzo Bianconi.

10) Fix inverted matching in ctnetlink dump filtering,
    from Liu Chao.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-10-19

Thanks.

----------------------------------------------------------------

The following changes since commit ab699d296e066eb64f51d2a8a1d42237a3b186c8:

  Merge branch 'net-always-dissect-gso-packets-in-__virtio_net_hdr_to_skb' (2026-10-06 15:35:42 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-10-19

for you to fetch changes up to cd37ab22a74e05aae5c16c67295cbf5188b16268:

  netfilter: nf_conntrack_netlink: fix inverted IPv6 tuple filter (2026-10-19 14:14:03 +0200)

----------------------------------------------------------------
netfilter pull request 26-10-19

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: nft_payload: restrict checksum offsets to known values

Joel Granados (1):
      ipvs: skip committing sync_threshold when proc_dointvec fails

Julian Anastasov (1):
      ipvs: fix more races around the overload flag

Jérémy Jean (1):
      netfilter: nf_conntrack: avoid truncating IPv6 nexthdr offset

Kyle Zeng (1):
      netfilter: nf_reject: initialize IPCB at inet ingress

Liu Chao (1):
      netfilter: nf_conntrack_netlink: fix inverted IPv6 tuple filter

Lorenzo Bianconi (1):
      netfilter: flowtable: reset transport header after nf_flow_encap_pop()

Pablo Neira Ayuso (1):
      netfilter: nft_set_rbtree: narrow down range completion to anonymous sets

Shuangfeng He (1):
      netfilter: flowtable: use the vlan id, not the full tci, in the tuple key

Sung Byeongchan (1):
      netfilter: xt_dccp: handle reserved options as single-byte

 include/net/ip_vs.h                     | 50 +++++++++++++++++++++------------
 net/ipv4/netfilter/nf_reject_ipv4.c     |  5 ++++
 net/ipv6/netfilter/nf_conntrack_reasm.c |  2 +-
 net/ipv6/netfilter/nf_reject_ipv6.c     |  5 ++++
 net/netfilter/ipvs/ip_vs_conn.c         |  8 +++---
 net/netfilter/ipvs/ip_vs_ctl.c          | 41 ++++++++++++++-------------
 net/netfilter/ipvs/ip_vs_dh.c           | 16 ++---------
 net/netfilter/ipvs/ip_vs_fo.c           |  2 +-
 net/netfilter/ipvs/ip_vs_lblc.c         |  4 +--
 net/netfilter/ipvs/ip_vs_lblcr.c        |  8 +++---
 net/netfilter/ipvs/ip_vs_lc.c           |  2 +-
 net/netfilter/ipvs/ip_vs_mh.c           |  2 +-
 net/netfilter/ipvs/ip_vs_nq.c           |  2 +-
 net/netfilter/ipvs/ip_vs_ovf.c          |  2 +-
 net/netfilter/ipvs/ip_vs_rr.c           |  2 +-
 net/netfilter/ipvs/ip_vs_sed.c          |  4 +--
 net/netfilter/ipvs/ip_vs_sh.c           |  2 +-
 net/netfilter/ipvs/ip_vs_twos.c         |  4 +--
 net/netfilter/ipvs/ip_vs_wlc.c          |  4 +--
 net/netfilter/ipvs/ip_vs_wrr.c          |  2 +-
 net/netfilter/nf_conntrack_netlink.c    |  8 +++---
 net/netfilter/nf_flow_table_ip.c        |  6 ++--
 net/netfilter/nft_payload.c             | 40 +++++++++++++++++++++-----
 net/netfilter/nft_set_rbtree.c          |  3 +-
 net/netfilter/xt_dccp.c                 |  2 +-
 25 files changed, 134 insertions(+), 92 deletions(-)