Re: [PATCH net 00/10] netfilter: updates for net

[Florian Westphal <fw@strlen.de>]

Florian Westphal <fw@strlen.de> wrote:

TL;DR: please ignore sashiko findings.

> 5) Disable netfilter payload mangling in user namespaces (nft_payload.c
>    and nf_queue).
>    TCP option mangling via nft_exthdr.c remains enabled.
>    There will be followups here to restrict resp. revalidate
>    headers.

sashiko says this breaks existing deployments, but we have little other
choice at this time.  Revalidation is being worked on, but it will take
time (and wll not be perfect either).

> 6) Fix an out-of-bounds read in ebtables's compat_mtw_from_user function.

AI complains about futher issues but this will be turned off for userns in
-next and then removed some time later this year. Given this is off in both
debian and fedora kernels for long time already I think noone will miss it.

> 10) Fix destination corruption in shift operations when source and destination
>     registers overlap.  Reject partial register overlap for all operations
>     from control plane.  From Fernando Fernandez Mancera.

sashiko says there is similar bogosity in nft_byteoder but that code is
queued up for removal in -next already.