Merge tag 'nf-next-26-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains Netfilter/IPVS updates for net-next:

1) Disable br_netfilter in userns and schedule it for removal in 2027,
   from Florian Westphal.

2) Update selftest nft_queue.sh to make it more stable on debug
   kernels, from Jakub Kicinski.

3) Fix a overflow in IPVS sync messages which can only happen in very
   old 2.6 kernels, from Julian Anastasov.

4) Finer grain packet drop in nfnetlink_queue when dependency objects
   are going away, from Antonio Ojea.

5) Add a selftest for the nfnetlink_queue packet drop case, also
   from Antonio Ojea.

6) Flush conntrack gc worker when existing netns to address a unlikely
   UaF, from Florian Westphal.

7) Switch nf_tables chain types to use rcu, otherwise module removal
   can trigger UaF, also from Florian.

8) Remove redundant parsing in nft_exthdr for the tcp options case,
   from Fernando F. Mancera.

9) Remove redundant skb_header_pointer() calls in nft_exthdr for tcp
   options, from Fernando F. Mancera.

10) Fix conntrack_vrf.sh selftest return value in zone subtest,
    from Florian Westphal.

11) Restrict raw table in nft_compat to specific family, hook and
    priority, from Florian Westphal.

Prepare the flowtable to support for IPv4 over IPv6 tunneling and
vice-versa, this includes 4 patches from Lorenzo Bianconi.

12) Explicitly set inner protocol when popping header, this is not
    needed for the existing IPIP and IP6IP6 case because skb->protocol
    remains the same.

13) Simplify tuple tunnel information fill up when parsing outer
    tunnel IP headers.

14) Add a new encap_proto which determines the outer tunnel protocol
    family.

15) Prepare flowtable forwarding path to deal with mixed IPv4-IPv6
    tunnels.

* tag 'nf-next-26-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
  netfilter: flowtable: unify tunnel push for IPv4 and IPv6
  netfilter: flowtable: add encap_proto to flow_offload_tunnel
  netfilter: flowtable: populate tunnel tuple regardless of inner protocol
  netfilter: flowtable: set inner protocol when popping tunnel header
  netfilter: nft_compat: restrict raw table targets/matches
  selftests: netfilter: fix return value in zone subtest
  netfilter: nft_exthdr: avoid 60 bytes stack buffer in TCP option mangling
  netfilter: nft_exthdr: remove redundant op parsing in tcp_set_init
  netfilter: nf_tables: switch chain_types array to rcu
  netfilter: conntrack: fix unlikely UaF in gc worker
  selftests: netfilter: nft_queue: check the scope of the hook drop flush
  netfilter: nf_queue: limit the hook drop flush to the unregistered hook point
  ipvs: fix buffer overflow when sending sync messages
  selftests: netfilter: nft_queue.sh: only queue icmp echo request/reply
  netfilter: disable br_netfilter in user namespaces
====================

Link: https://patch.msgid.link/20261018005638.1776148-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

1 files changed, 1 insertions, 0 deletions

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index f064c9c989ee..53d5e9c9a674 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -913,6 +913,7 @@ struct net_device_path {
 			};
 
 			u8	inner_proto;
+			u8	encap_proto;
 		} tun;
 		struct {
 			enum {