Re: [PATCH nf v3] netfilter: disable br_netfilter in user namespaces

On 31/08/2026 18:11, Florian Westphal wrote:
> br_netfilter has way too many bugs, schedule for removal and disable
> the feature in user namespaces.
> 
> In particular, we get more and more gadgets to have bridge ports escape
> rcu_read_lock() protection, then underlying device gets reconfigured
> (macvlan or something else), then reinject into network stack causes
> crash because net_device is assumed to still have bridge rx data
> associated with it.
> 
> br_netfilter is an ancient kludge that emulates ip stack from within the
> bridge and then calls into ipv4/ipv6 netfilter hooks to have bridged
> frames processed via iptables/ip6tables by setting the 'call-iptables'
> sysctls to 1. It is NOT related to ebtables or nftables 'bridge' family
> at all.
> 
> Note that in addition to call-iptables, sysctls, the bridge also exposes
> call-iptables per bridge device via netlink and sysfs
> ('BROPT_NF_CALL_IPTABLES') toggles.
> 
> Those are still available, the brnet structure is scoped to br_netfilter;
> exposing it bridge-wide is a big no-no.
> 
> This relies on brnf_device_event() no longer registering the base
> br_netfilter hooks, so while BROPT_NF_CALL_IPTABLES can be set, it
> has no effect because the hooks that evaluate this feature bit
> are never registered.
> 
> brnf_init_net can no longer depend on CONFIG_SYSCTL, else such builds
> never disable support in user namespaces.
> 
> Cc: Nikolay Aleksandrov <[email protected]>
> Signed-off-by: Florian Westphal <[email protected]>
> ---
>   v3: also update Documentation, correct changelog: toggle is
>   per bridge device, not per bridge port (Nik)
> 
>   Documentation/networking/bridge.rst |  5 +++--
>   net/bridge/br_netfilter_hooks.c     | 33 ++++++++++++++++++++---------
>   2 files changed, 26 insertions(+), 12 deletions(-)
> 

LGTM, thanks!
Reviewed-by: Nikolay Aleksandrov <[email protected]>