netdev - Re: [PATCH net-next,v2 00/16] Netfilter updates for net-next

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aSjGCWTaL4z47foL@lore-desk>
Date: Thu, 27 Nov 2025 22:43:37 +0100
From: Lorenzo Bianconi <lorenzo.bianconi@...hat.com>
To: Paolo Abeni <pabeni@...hat.com>
Cc: Pablo Neira Ayuso <pablo@...filter.org>,
	netfilter-devel@...r.kernel.org, davem@...emloft.net,
	netdev@...r.kernel.org, kuba@...nel.org, edumazet@...gle.com,
	fw@...len.de, horms@...nel.org
Subject: Re: [PATCH net-next,v2 00/16] Netfilter updates for net-next

> On 11/26/25 9:55 PM, Pablo Neira Ayuso wrote:
> > v2: - Move ifidx to avoid adding a hole, per Eric Dumazet.
> >     - Update pppoe xmit inline patch description, per Qingfang Deng.
> > 
> > -o-
> > 
> > Hi,
> > 
> > The following batch contains Netfilter updates for net-next:
> >  
> > 1) Move the flowtable path discovery code to its own file, the
> >    nft_flow_offload.c mixes the nf_tables evaluation with the path
> >    discovery logic, just split this in two for clarity.
> >  
> > 2) Consolidate flowtable xmit path by using dev_queue_xmit() and the
> >    real device behind the layer 2 vlan/pppoe device. This allows to
> >    inline encapsulation. After this update, hw_ifidx can be removed
> >    since both ifidx and hw_ifidx now point to the same device.
> >  
> > 3) Support for IPIP encapsulation in the flowtable, extend selftest
> >    to cover for this new layer 3 offload, from Lorenzo Bianconi.
> >  
> > 4) Push down the skb into the conncount API to fix duplicates in the
> >    conncount list for packets with non-confirmed conntrack entries,
> >    this is due to an optimization introduced in d265929930e2
> >    ("netfilter: nf_conncount: reduce unnecessary GC").
> >    From Fernando Fernandez Mancera.
> >  
> > 5) In conncount, disable BH when performing garbage collection 
> >    to consolidate existing behaviour in the conncount API, also
> >    from Fernando.
> >  
> > 6) A matching packet with a confirmed conntrack invokes GC if
> >    conncount reaches the limit in an attempt to release slots.
> >    This allows the existing extensions to be used for real conntrack
> >    counting, not just limiting new connections, from Fernando.
> >  
> > 7) Support for updating ct count objects in nf_tables, from Fernando.
> >  
> > 8) Extend nft_flowtables.sh selftest to send IPv6 TCP traffic,
> >    from Lorenzo Bianconi.
> >  
> > 9) Fixes for UAPI kernel-doc documentation, from Randy Dunlap.
> > 
> > Please, pull these changes from:
> > 
> >   git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-25-11-26
> > 
> > Thanks.
> 
> The AI review tool found a few possible issue on this PR:
> 
> https://netdev-ai.bots.linux.dev/ai-review.html?id=fd5a6706-c2f8-4cf2-a220-0c01492fdb90
> 
> I'm still digging the report, but I think that at least first item
> reported (possibly wrong ifidx used in nf_flow_offload_ipv6_hook() by
> patch "netfilter: flowtable: consolidate xmit path") makes sense.
> 
> I *think* that at least for that specific point it would be better to
> follow-up on net (as opposed to a v3 and possibly miss the cycle), but
> could you please have a look at that report, too?

I think in nf_flow_offload_ipv6_hook() for the FLOW_OFFLOAD_XMIT_NEIGH case we
should use tuplehash->tuple.ifidx instead of tuplehash->tuple.out.ifidx.
Something like:

diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index e128b0fe9a7b..78883343e5d6 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -951,7 +951,7 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
 	switch (tuplehash->tuple.xmit_type) {
 	case FLOW_OFFLOAD_XMIT_NEIGH:
 		rt = dst_rt6_info(tuplehash->tuple.dst_cache);
-		xmit.outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.out.ifidx);
+		xmit.outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.ifidx);
 		if (!xmit.outdev) {
 			flow_offload_teardown(flow);
 			return NF_DROP;

Regards,
Lorenzo

> 
> Thanks,
> 
> Paolo
> 
> 

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)