Re: [PATCH v2 nf] netfilter: disable br_netfilter in user namespaces

On 27/08/2026 21:14, Florian Westphal wrote:
> br_netfilter has way too many bugs, schedule for removal and disable
> the feature in user namespaces.
> 
> In particular, we get more and more gadgets to have bridge ports escape
> rcu_read_lock() protection, then underlying device gets reconfigured
> (macvlan or something else), then reinject into network stack causes
> crash because net_device is assumed to still have bridge rx data
> associated with it.
> 
> br_netfilter is an ancient kludge that emulates ip stack from within the
> bridge and then calls into ipv4/ipv6 netfilter hooks to have bridged
> frames processed via iptables/ip6tables by setting the 'call-iptables'
> sysctls to 1. It is NOT related to ebtables or nftables 'bridge' family
> at all.
> 
> Note that in addition to call-iptables, sysctls, the bridge itself exposes
> call-iptables per port via netlink and sysfs ('BROPT_NF_CALL_IPTABLES')
> toggles.
> 
> Those are still available, the brnet structure is scoped to br_netfilter;
> exposing it bridge-wide is a big no-no.
> 
> This relies on brnf_device_event() no longer registering the base
> br_netfilter hooks, so while BROPT_NF_CALL_IPTABLES can be set, it
> has no effect because the hooks that evaluate this feature bit
> are never registered.
> 
> brnf_init_net can no longer depend on CONFIG_SYSCTL, else such builds
> never disable support in user namespaces.
> 
> v2: avoid silly UaF, compilers are too forgiving...
> 
> Cc: Nikolay Aleksandrov<[email protected]>
> Signed-off-by: Florian Westphal<[email protected]>
> ---
>   net/bridge/br_netfilter_hooks.c | 33 +++++++++++++++++++++++----------
>   1 file changed, 23 insertions(+), 10 deletions(-)
> 

The patch looks good, thanks!
2 minor nits:
BROPT_NF_CALL_IPTABLES is per bridge, not per port. Also please update the
Netfilter section of Documentation/networking/bridge.rst that it won't work
in non-init ns and is scheduled for removal.

Cheers,
  Nik