kernel/linux.git/net/netfilter, branch master

netfilter: require Ethernet MAC header before using eth_hdr()

2026-04-10T10:16:27+00:00

`ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`. Suggested-by: Florian Westphal Tested-by: Ren Wei Signed-off-by: Zhengchuan Liang Signed-off-by: Ren Wei Signed-off-by: Florian Westphal

netfilter: nft_fwd_netdev: check ttl/hl before forwarding

2026-04-10T10:16:27+00:00

Drop packets if their ttl/hl is too small for forwarding. Fixes: d32de98ea70f ("netfilter: nft_fwd_netdev: allow to forward packets via neighbour layer") Signed-off-by: Florian Westphal

netfilter: x_tables: Avoid a couple -Wflex-array-member-not-at-end warnings

2026-04-10T10:16:27+00:00

-Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Use the TRAILING_OVERLAP() helper to fix the following warnings: 1 net/netfilter/x_tables.c:816:39: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] 1 net/netfilter/x_tables.c:811:39: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] This helper creates a union between a flexible-array member (FAM) and a set of members that would otherwise follow it. This overlays the trailing members onto the FAM while preserving the original memory layout. Signed-off-by: Gustavo A. R. Silva Signed-off-by: Florian Westphal

netfilter: conntrack: remove UDP-Lite conntrack support

2026-04-10T10:16:26+00:00

UDP-Lite (RFC 3828) socket support was recently retired from the core networking stack. As a follow-up of that, drop the connection tracker and NAT support for UDP-Lite in Netfilter. This patch removes CONFIG_NF_CT_PROTO_UDPLITE and scrubs UDP-Lite awareness from the conntrack core, NAT core, nft_ct, and ctnetlink. Please note that stateless packet inspection, matching, ipsets or logging support for IPPROTO_UDPLITE is preserved. As conntrack no longer extracts UDP-Lite ports or tracks its L4 state, when performing NAT the UDP-Lite checksum cannot be updated anymore. That is an expected and acceptable consequence of removing UDP-Lite conntrack module. Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal

netfilter: xt_socket: enable defrag after all other checks

2026-04-10T10:16:26+00:00

Originally this did not matter because defrag was enabled once per netns and only disabled again on netns dismantle. When this got changed I should have adjusted checkentry to not leave defrag enabled on error. Fixes: de8c12110a13 ("netfilter: disable defrag once its no longer needed") Signed-off-by: Florian Westphal

netfilter: xt_HL: add pr_fmt and checkentry validation

2026-04-10T10:16:26+00:00

Add pr_fmt to prefix log messages with the module name for easier debugging in dmesg. Add checkentry functions for IPv4 (ttl_mt_check) and IPv6 (hl_mt6_check) to validate the match mode at rule registration time, rejecting invalid modes with -EINVAL. The evaluation function returns false in case the mode is unknown, so this is a cleanup, not a bug fix. Signed-off-by: Marino Dzalto Signed-off-by: Florian Westphal

netfilter: nfnetlink: prefer skb_mac_header helpers

2026-04-10T10:16:26+00:00

This adds implicit DEBUG_WARN_ON_ONCE for debug configurations. No other changes intended. Signed-off-by: Florian Westphal

netfilter: x_physdev: reject empty or not-nul terminated device names

2026-04-10T10:16:26+00:00

Reject names that lack a \0 character and reject the empty string as well. iptables allows this but it fails to re-parse iptables-save output that contain such rules. Signed-off-by: Florian Westphal

ipvs: add conn_lfactor and svc_lfactor sysctl vars

2026-04-10T10:16:26+00:00

Allow the default load factor for the connection and service tables to be configured. Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal

ipvs: add ip_vs_status info

2026-04-10T10:16:25+00:00

Add /proc/net/ip_vs_status to show current state of IPVS. The motivation for this new /proc interface is to provide the output for the users to help them decide when to tune the load factor for hash tables, which is possible with the new sysctl knobs coming in followup patch. The output also includes information for the kthreads used for stats. Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal