Pablo Neira Ayuso says:
====================
Netfilter/IPVS fixes for net-next
This contains fixes for nf_tables, revisit issues with expectation
infra updates reported by sashiko, an ipset fix for deletions in the
hash:net type and tne fix for the IPVS FTP helper.
1) Validate layer 4 header mangling done via nfnetlink_queue and
nft_payload, this is a follow up to recent similar validation
at layer 3. From Zhiling Zou.
2) Do not allocate memory on delete operations in ipset hash:net
type, delete operation must always succeed. From Florian Westphal.
3) Deliver nft_obj overquota packet path notification directly via
nfnetlink, do not use the control plane batch logic.
From Fourie Zhang.
4) Follow up to controlidate check for reinserted dead expectations,
to cover the nf_conntrack_expect_related_pair() function too.
5) Do not expose expectation dead flag to userspace via ctnetlink.
6) Make commit set_update_list per-netns to prepare to publish
set clone earlier.
7) Publish the set clone earlier from commit path to address set
lookup failures during table re-creation, this is targetting
the rbtree and pipapo set backends.
8) Fix an integer overflow in the IPVS FTP helper. A similar fix
was already proposed for the conntrack FTP helper months ago.
From Joas Antonio dos Santos.
* tag 'nf-next-26-08-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:
ipvs: fix integer overflow in ftp helper port/address parsing
netfilter: nf_tables: call set ops .commit when building new ruleset blob
netfilter: nf_tables: move set_update_list to nftables per-netns
netfilter: ctnetlink: do not expose expectation DEAD flag
netfilter: nf_conntrack_expect: consolidate check for insertion of dead expectation
netfilter: nf_tables: don't queue packet path object notifications
netfilter: ipset: remove need to allocate memory on delete operations
netfilter: validate L4 headers after userspace packet writes
====================
Link: https://patch.msgid.link/20260817232957.1281637-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
066ae87fe9