Re: [PATCH net-next 00/15] Netfilter/IPVS updates for net-next

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Oct 15, 2026 at 11:48:39AM +0200, Fernando Fernandez Mancera wrote:
> On 10/14/26 1:11 AM, Pablo Neira Ayuso wrote:
> > Hi,
> > 
> > +Cc: lorenzo@kernel.org
> > 
> > This is a report on sashiko's findings:
> > 
> > https://sashiko.dev/#/patchset/20261011215953.1334630-1-pablo%40netfilter.org
> > 
> > On Sun, Oct 11, 2026 at 11:59:38PM +0200, Pablo Neira Ayuso wrote:
> > > Hi,
> > > 
> > > The following patchset contains Netfilter/IPVS updates for net-next:
> > > 
> > > 1) Disable br_netfilter in userns and schedule it for removal in 2027,
> > >     from Florian Westphal.
> > > 
> > > 2) Prepare the flowtable to support for IPv4 over IPv6 tunneling and
> > >     vice-versa, this includes 5 patches from Lorenzo Bianconi.
> > 
> > I am afraid this preparation series is enabling more than it should,
> > sashiko reports type confusion is possible, for example:
> > 
> >    1/5 netfilter: flowtable: recognize IPv4/IPv6 in tunnel proto matching
> > 
> > this adds the initial pre-processing of IPv6-over-IPv4.
> > 
> > But then, nf_flow_offload_lookup() expects to handle IPv4, not an IPv6
> > packet.
> > 
> > I will repost this PR keeping them back.
> > 
> > > 3) Update selftest nft_queue.sh to make it more stable on debug
> > >     kernels, from Jakub Kicinski.
> > > 
> > > 4) Fix a overflow in IPVS sync messages which can only happen in very
> > >     old 2.6 kernels, from Julian Anastasov.
> > > 
> > > 5) Flush conntrack gc worker when existing netns to address a unlikely
> > >     UaF, from Florian Westphal.
> > > 
> > > 6) Switch nf_tables chain types to use rcu, otherwise module removal
> > >     can trigger UaF, also from Florian.
> > > 
> > > 7) Add two new helper functions to validate that socket is of inet type,
> > >     coming in 2 patches from Florian Westphal.
> > 
> > sashiko reports:
> > 
> > "If an IPv4 packet from an AF_INET socket is encapsulated by an IPv6 tunnel,
> > the tunnel preserves the AF_INET socket in skb->sk while transmitting the
> > outer IPv6 packet on the LOCAL_OUT path."
> > 
> > This sounds like an unrelated issue, I don't know yet how that can
> > happen TBH.
> > 
> > > 8) Remove redundant parsing in nft_exthdr for the tcp options case,
> > >     from Fernando F. Mancera.
> > > 
> > > 9) Remove redundant skb_header_pointer() calls in nft_exthdr for tcp
> > >     options, from Fernando F. Mancera.
> > 
> > Sashiko here reports this now drops malformed packets instead of
> > NFT_BREAK, which is fine, maybe just extend it to tell about this in
> > the patch description.
> 
> Hi Pablo,
> 
> Should I re-post a v2 of this patch or will you ammend the commit message to
> add this bit?

I will amend the commit message here, no problem.