Re: [PATCH net 0/4] net/sched: reset conntrack after packet munging

On Thu, Aug 20, 2026 at 8:09 AM Florian Westphal <[email protected]> wrote:
>
> Jamal Hadi Salim <[email protected]> wrote:
> > Example: If the ebpf one could be reproduced with unshare -urn would
> > it have been fine to make the fix sit in netfilter?
>
> I don't know how to 'fix netfilter'.  We would have to remove skb->nfct
> and re-parse at every turn.  Is that a viable option...? Don't think so.
>
> > > And that doesn't solve BPF (can sit anywhere) or OVS (no idea here if
> > > its affected or not).
> >
> > OVS is very likely affected.
> > I saw your other email and you are the expert, but I am itchy to try
> > the nf_confirm() approach.
> > At minimal it should fix the PoC imo.
>
> As I said, I don't see any existing function that could be used
> to add the required re-validation.  nf_confirm() is the last step
> in the pipeline, its way too late.

Sigh - couldnt help myself. Attached  fixes the poc from kyle - i know
you are hinting there are other scenarios where it wont work.


>  nf_conntrack_in() doesn't work
> either because you can install matches earlier than that, e.g. via
> -t raw -m conntrack in classic iptables, or via 'hook prerouting
> type filter priority -2147483647' or something like that in
> nftables.
>
> The only other option is playing whack-a-mole, accepting the original
> proposed patch for nft_ct, but I can already tell this will not be
> enough and revalidation will have to be added everywhere.

whack-a-mole is what i was worrying about. Someone will come up with a
scenario for ebpf and likely ovs and you will have to fix multiple
spots until the next one.

cheers,
jamal