Re: [PATCH net 0/4] net/sched: reset conntrack after packet munging

On Thu, Aug 20, 2026 at 7:42 AM Florian Westphal <[email protected]> wrote:
>
> Jamal Hadi Salim <[email protected]> wrote:
> > I apologize for the delayed response in the private exchange, but let
> > me repeat my thoughts here...
> > As you said, the munging can be done by an ebpf program (at different
> > attachment points, not just cls/act using multiple helpers).
>
> Yes, and that is ALSO buggy.  For BPF its even worse because if you
> permit arbitrary writes at any point in the stack you will also
> invalidate e.g. addresses/offsets stored in skb->cb[].
>

There are a lot of helpers that could cause a mess.

> > "Packet rewrites are still possible with BPF. However, unlike pedit,
> > that needs privileges in the initial namespace."
> > That's only true in the default setup, but with BPF "token delegation"
> > it no longer holds (will be reachable via unshare -Urn).
> >
> > I have not tried to verify what i am claiming since we "last talked" -
> > but could try it out when i get time (weekend looks promising).
> > If what i am saying is true then you will have many places in ebpf to
> > fix, which is not ideal.
>
> *shrug*
>
> > But even if not true, you can still do it with CAP_BPF - which leads
> > to the same outcome. Unless we are saying as a general rule we should
> > prioritize where/how we fix things based on whether they are
> > reproducible via 1)namespace -urn  vs 2) require root permission
> > (assume this includes CAP_BPF)
>
> I think 2) is very different from 1).
>

I agree. In fact, on the tc side we prioritize fixing bugs
reproducible using unshare -urn over those that require root.
The question is: Should that influence how and where we fix bugs? It
is something i am struggling with.
Example: If the ebpf one could be reproduced with unshare -urn would
it have been fine to make the fix sit in netfilter?

> > With that thought in mind, the question is: is there a single hook
> > entry point where this could be done?
>
> No.
>
> > Example: nf_conntrack_in() or nf_confirm() as the choke point which
> > catches all?
>
> Those are too late.  You would need a new, unconditional sanitizer hook
> at INT_MIN, in all of IPV4/IPV6/Bridge, plus additional code in core.c
> to refuse installation of custom hooks before the sanitizer hook.
>

Yeah, that is a bit much.

> And that doesn't solve BPF (can sit anywhere) or OVS (no idea here if
> its affected or not).

OVS is very likely affected.
I saw your other email and you are the expert, but I am itchy to try
the nf_confirm() approach.
At minimal it should fix the PoC imo.

cheers,
jamal