Re: [PATCH net 0/4] net/sched: reset conntrack after packet munging

On Thu, Aug 20, 2026 at 9:10 AM Florian Westphal <[email protected]> wrote:
>
> Jamal Hadi Salim <[email protected]> wrote:
> > Sigh - couldnt help myself. Attached  fixes the poc from kyle - i know
> > you are hinting there are other scenarios where it wont work.
>
> Yes, e.g. what if pedit inflated th->doff?
> nf_conntrack_in() checked that this was fine, but now the pipeline
> can re-neg on that.

True.
So my question to you then is: what about BPF, OVS, future thingy? Are
you going to fix each individually?
Or is the answer there "these are different" because they require
root/CAP_BPF they are not worth fixing?

cheers,
jamal