linux/include/uapi/linux
David Carlier 8f15b5071b netfilter: ctnetlink: use netlink policy range checks
Replace manual range and mask validations with netlink policy
annotations in ctnetlink code paths, so that the netlink core rejects
invalid values early and can generate extack errors.

- CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at
  policy level, removing the manual >= TCP_CONNTRACK_MAX check.
- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE
  (14). The normal TCP option parsing path already clamps to this value,
  but the ctnetlink path accepted 0-255, causing undefined behavior when
  used as a u32 shift count.
- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with
  CTA_FILTER_F_ALL, removing the manual mask checks.
- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding
  a new mask define grouping all valid expect flags.

Extracted from a broader nf-next patch by Florian Westphal, scoped to
ctnetlink for the fixes tree.

Fixes: c8e2078cfe ("[NETFILTER]: ctnetlink: add support for internal tcp connection tracking flags handling")
Signed-off-by: David Carlier <devnexen@gmail.com>
Co-developed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-03-26 13:28:17 +01:00
..
android
byteorder
caif
can
cifs
counter
dvb
genwqe
hdlc
hsi
iio
io_uring io_uring/bpf_filter: pass in expected filter payload size 2026-02-16 15:56:31 -07:00
isdn
media
misc
mmc
netfilter netfilter: ctnetlink: use netlink policy range checks 2026-03-26 13:28:17 +01:00
netfilter_arp
netfilter_bridge
netfilter_ipv4
netfilter_ipv6
nfsd
raid
sched
spi
sunrpc
surface_aggregator
tc_act
tc_ematch
usb
a.out.h
acct.h
acrn.h
adb.h
adfs_fs.h
affs_hardblocks.h
agpgart.h
aio_abi.h
am437x-vpfe.h
amt.h
apm_bios.h
arcfb.h
arm_sdei.h
aspeed-lpc-ctrl.h
aspeed-p2a-ctrl.h
aspeed-video.h
atalk.h
atm.h
atm_eni.h
atm_he.h
atm_idt77105.h
atm_nicstar.h
atm_tcp.h
atm_zatm.h
atmapi.h
atmarp.h
atmbr2684.h
atmclip.h
atmdev.h
atmioc.h
atmlec.h
atmmpc.h
atmppp.h
atmsap.h
atmsvc.h
audit.h
auto_dev-ioctl.h
auto_fs.h
auto_fs4.h
auxvec.h
ax25.h
batadv_packet.h
batman_adv.h
baycom.h
bcm933xx_hcs.h
bfs_fs.h
binfmts.h
bits.h
blk-crypto.h
blkdev.h
blkpg.h
blktrace_api.h
blkzoned.h block: make the new blkzoned UAPI constants discoverable 2026-01-21 07:47:44 -07:00
bpf.h bpf: add new BPF_CGROUP_ITER_CHILDREN control option 2026-01-27 09:05:54 -08:00
bpf_common.h
bpf_perf_event.h
bpqether.h
bsg.h
bt-bmc.h
btf.h
btrfs.h btrfs: add definitions and constants for remap-tree 2026-02-03 07:54:02 +01:00
btrfs_tree.h btrfs: allow mounting filesystems with remap-tree incompat flag 2026-02-03 07:54:35 +01:00
cachefiles.h
can.h
capability.h
capi.h
cciss_defs.h
cciss_ioctl.h
ccs.h
cdrom.h
cec-funcs.h
cec.h
cfm_bridge.h
cgroupstats.h
chio.h
close_range.h
cn_proc.h
coda.h
coff.h
comedi.h comedi: Fix getting range information for subdevices 16 to 255 2026-01-16 16:42:15 +01:00
connector.h
const.h
coredump.h
coresight-stm.h
counter.h
cramfs_fs.h
cryptouser.h
cuda.h
cxl_mem.h
cyclades.h
cycx_cfm.h
dcbnl.h
dccp.h
dev_energymodel.h PM: EM: Add dump to get-perf-domains in the EM YNL spec 2026-01-09 21:44:46 +01:00
devlink.h
dlm.h
dlm_device.h
dlm_plock.h
dlmconstants.h
dm-ioctl.h
dm-log-userspace.h
dma-buf.h dma-buf: Include ioctl.h in UAPI header 2026-03-03 08:55:39 +01:00
dma-heap.h
dns_resolver.h
dpll.h dpll: expose fractional frequency offset in ppt 2026-01-29 18:21:16 -08:00
dqblk_xfs.h
dw100.h
edd.h
efs_fs_sb.h
elf-em.h
elf-fdpic.h
elf.h riscv/ptrace: expose riscv CFI status and state via ptrace and in core files 2026-01-29 02:38:40 -07:00
errno.h
errqueue.h
erspan.h
ethtool.h net: ethtool: Add support for 80Gbps speed 2026-01-19 12:09:58 -08:00
ethtool_netlink.h
ethtool_netlink_generated.h
eventfd.h
eventpoll.h
exfat.h
ext4.h ext4: fix ext4_tune_sb_params padding 2026-01-18 11:22:53 -05:00
f2fs.h
fadvise.h
falloc.h
fanotify.h
fb.h
fcntl.h
fd.h
fdreg.h
fib_rules.h
fiemap.h
filter.h
firewire-cdev.h
firewire-constants.h
fou.h
fpga-dfl.h
fs.h fs: add FS_XFLAG_VERITY for fs-verity files 2026-01-29 16:00:57 +01:00
fscrypt.h
fsi.h
fsl_hypervisor.h
fsl_mc.h
fsmap.h
fsverity.h
fuse.h
futex.h
gameport.h
gen_stats.h
genetlink.h
gfs2_ondisk.h
gpib.h
gpib_ioctl.h
gpio.h
gsmmux.h
gtp.h
handshake.h
hash_info.h
hdlc.h
hdlcdrv.h
hdreg.h
hid.h
hiddev.h
hidraw.h
hpet.h
hsr_netlink.h
hw_breakpoint.h
hyperv.h hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed 2026-01-16 15:00:54 -07:00
i2c-dev.h
i2c.h
i2o-dev.h
i8k.h
icmp.h
icmpv6.h
idxd.h
if.h
if_addr.h
if_addrlabel.h
if_alg.h crypto: af_alg - Annotate struct af_alg_iv with __counted_by 2026-01-14 14:43:18 -08:00
if_arcnet.h
if_arp.h
if_bonding.h
if_bridge.h
if_eql.h
if_ether.h
if_fc.h
if_fddi.h
if_hippi.h
if_infiniband.h
if_link.h geneve: add netlink support for GRO hint 2026-01-23 11:31:14 -08:00
if_ltalk.h
if_macsec.h
if_packet.h
if_phonet.h
if_plip.h
if_ppp.h
if_pppol2tp.h
if_pppox.h
if_slip.h
if_team.h
if_tun.h
if_tunnel.h
if_vlan.h
if_x25.h
if_xdp.h
ife.h
igmp.h
ila.h
in.h
in6.h
in_route.h
inet_diag.h
inotify.h
input-event-codes.h
input.h
io_uring.h io_uring: correct comment for IORING_SETUP_TASKRUN_FLAG 2026-02-28 04:56:20 -07:00
ioam6.h
ioam6_genl.h
ioam6_iptunnel.h
ioctl.h
iommufd.h iommufd: Introduce data struct for AMD nested domain allocation 2026-01-18 10:56:12 +01:00
ioprio.h
ip.h
ip6_tunnel.h
ip_vs.h
ipc.h
ipmi.h
ipmi_bmc.h
ipmi_msgdefs.h
ipmi_ssif_bmc.h
ipsec.h
ipv6.h
ipv6_route.h
irqnr.h
iso_fs.h
isst_if.h
ivtv.h
ivtvfb.h
jffs2.h
joystick.h
kcm.h
kcmp.h
kcov.h
kd.h
kdev_t.h
kernel-page-flags.h
kernel.h
kernelcapi.h
kexec.h
keyboard.h
keyctl.h
kfd_ioctl.h drm/amdkfd: add extended capabilities to device snapshot 2026-01-27 18:13:28 -05:00
kfd_sysfs.h
kvm.h KVM generic changes for 7.0 2026-03-11 18:01:55 +01:00
kvm_para.h
l2tp.h
landlock.h landlock: Minor reword of docs for TCP access rights 2026-02-06 17:54:40 +01:00
libc-compat.h
limits.h
lirc.h
liveupdate.h
llc.h
loadpin.h
lockd_netlink.h
loop.h
lp.h
lsm.h
lwtunnel.h
magic.h fs: add immutable rootfs 2026-01-12 16:52:09 +01:00
major.h
map_benchmark.h
map_to_7segment.h
map_to_14segment.h
matroxfb.h
max2175.h
mctp.h
mdio.h
media-bus-format.h
media.h
mei.h
mei_uuid.h
membarrier.h
memfd.h
mempolicy.h mm/mempolicy: fix mpol_rebind_nodemask() for MPOL_F_NUMA_BALANCING 2026-01-26 20:02:32 -08:00
mii.h
minix_fs.h
mman.h
mmtimer.h
module.h
mount.h mount: add OPEN_TREE_NAMESPACE 2026-01-16 19:21:40 +01:00
mpls.h
mpls_iptunnel.h
mptcp.h
mptcp_pm.h mptcp: fix kdoc warnings 2026-02-06 20:35:06 -08:00
mqueue.h
mroute.h
mroute6.h
mrp_bridge.h
msdos_fs.h
msg.h
mshv.h mshv: Add SMT_ENABLED_GUEST partition creation flag 2026-02-18 23:54:37 +00:00
mtio.h
nbd-netlink.h
nbd.h
ncsi.h
ndctl.h
neighbour.h
net.h
net_dropmon.h
net_namespace.h
net_shaper.h
net_tstamp.h
netconf.h
netdev.h Revert "Merge branch 'netkit-support-for-io_uring-zero-copy-and-af_xdp'" 2026-01-20 18:06:01 -08:00
netdevice.h
netfilter.h
netfilter_arp.h
netfilter_bridge.h include: uapi: netfilter_bridge.h: Cover for musl libc 2026-02-17 15:04:20 +01:00
netfilter_ipv4.h netfilter: uapi: Use UAPI definition of INT_MAX and INT_MIN 2026-01-17 15:24:05 -08:00
netfilter_ipv6.h netfilter: uapi: Use UAPI definition of INT_MAX and INT_MIN 2026-01-17 15:24:05 -08:00
netlink.h
netlink_diag.h
netrom.h
nexthop.h
nfc.h
nfs.h NFS: NFSERR_INVAL is not defined by NFSv2 2026-01-26 10:10:58 -05:00
nfs2.h
nfs3.h
nfs4.h
nfs4_mount.h
nfs_fs.h
nfs_idmap.h
nfs_mount.h
nfsacl.h
nfsd_netlink.h nfsd: add controls to set the minimum number of threads per pool 2026-01-28 10:15:42 -05:00
nilfs2_api.h
nilfs2_ondisk.h
nitro_enclaves.h
nl80211-vnd-intel.h
nl80211.h wifi: cfg80211: add initial UHR support 2026-02-02 10:11:07 +01:00
npcm-video.h
nsfs.h
nsm.h
ntsync.h
nubus.h
nvme_ioctl.h
nvram.h
omap3isp.h
omapfb.h
oom.h
openat2.h
openvswitch.h
ovpn.h
packet_diag.h
papr_pdsm.h
param.h
parport.h
patchkey.h
pci.h
pci_regs.h PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value 2026-02-27 10:24:25 -06:00
pcitest.h misc: pci_endpoint_test: Add BAR subrange mapping test case 2026-01-29 17:42:29 -06:00
perf_event.h Performance events changes for v7.0: 2026-02-10 12:00:46 -08:00
personality.h
pfkeyv2.h
pfrut.h
pg.h
phantom.h
phonet.h
pidfd.h
pkt_cls.h
pkt_sched.h net/sched: sch_cake: share shaper state across sub-instances of cake_mq 2026-01-13 11:54:29 +01:00
pktcdvd.h
pmu.h
poll.h
posix_acl.h
posix_acl_xattr.h
posix_types.h
ppdev.h
ppp-comp.h
ppp-ioctl.h
ppp_defs.h
pps.h
pps_gen.h
pr.h
prctl.h RISC-V updates for v7.0 2026-02-12 19:17:44 -08:00
psample.h
psci.h
psp-dbc.h
psp-sev.h
psp-sfs.h
psp.h
ptp_clock.h
ptrace.h
pwm.h
qemu_fw_cfg.h
qnx4_fs.h
qnxtypes.h
qrtr.h
quota.h
radeonfb.h
random.h
rds.h
reboot.h
remoteproc_cdev.h
resource.h
rfkill.h
rio_cm_cdev.h
rio_mport_cdev.h
rkisp1-config.h
romfs_fs.h
rose.h
route.h
rpl.h
rpl_iptunnel.h
rpmsg.h
rpmsg_types.h
rseq.h rseq: slice ext: Ensure rseq feature size differs from original rseq size 2026-02-23 11:19:19 +01:00
rtc.h
rtnetlink.h
rxrpc.h
scc.h
sched.h
scif_ioctl.h
screen_info.h
sctp.h
seccomp.h
securebits.h
sed-opal.h
seg6.h
seg6_genl.h
seg6_hmac.h
seg6_iptunnel.h
seg6_local.h
selinux_netlink.h
sem.h
serial.h
serial_core.h
serial_reg.h
serio.h
sev-guest.h
shm.h ipc/shm: uapi: remove dependency on libc 2026-01-26 19:07:10 -08:00
signal.h
signalfd.h
smc.h
smc_diag.h
smiapp.h
snmp.h
sock_diag.h
socket.h
sockios.h
sonet.h
sonypi.h
sound.h
soundcard.h
stat.h
stddef.h compiler_types.h: Attributes: Add __counted_by_ptr macro 2026-01-17 11:00:28 -08:00
stm.h
string.h
suspend_ioctls.h
swab.h
switchtec_ioctl.h
sync_file.h
synclink.h
sysctl.h mm.git review status for linus..mm-stable 2026-02-12 11:32:37 -08:00
sysinfo.h
target_core_user.h
taskstats.h delayacct: fix uapi timespec64 definition 2026-02-08 00:13:32 -08:00
tcp.h tcp: accecn: add tcpi_ecn_mode and tcpi_option2 in tcp_info 2026-02-03 15:13:25 +01:00
tcp_metrics.h
tdx-guest.h
tee.h
termios.h
thermal.h
thp7312.h
time.h
time_types.h
timerfd.h
times.h
timex.h
tiocl.h
tipc.h
tipc_config.h
tipc_netlink.h
tipc_sockets_diag.h
tls.h
toshiba.h
tps6594_pfsm.h
trace_mmap.h
tty.h
tty_flags.h
typelimits.h uapi: add INT_MAX and INT_MIN constants 2026-01-17 15:24:05 -08:00
types.h
ublk_cmd.h ublk: add UBLK_F_NO_AUTO_PART_SCAN feature flag 2026-01-31 06:36:41 -07:00
udf_fs_i.h
udmabuf.h
udp.h
uhid.h
uinput.h
uio.h
uleds.h
ultrasound.h
um_timetravel.h
un.h
unistd.h
unix_diag.h
usbdevice_fs.h
usbip.h
user_events.h
userfaultfd.h
userio.h
utime.h
utsname.h
uuid.h
uvcvideo.h
v4l2-common.h
v4l2-controls.h media: v4l2-ctrls: Add hevc_ext_sps_[ls]t_rps controls 2026-01-21 14:43:09 +01:00
v4l2-dv-timings.h
v4l2-mediabus.h
v4l2-subdev.h
vbox_err.h
vbox_vmmdev_types.h virt: vbox: uapi: Mark inner unions in packed structs as packed 2026-01-16 15:00:54 -07:00
vboxguest.h
vdpa.h
vduse.h vduse: avoid adding implicit padding 2026-02-09 12:21:32 -05:00
vesa.h
veth.h
vfio.h iommu: Introduce pci_dev_reset_iommu_prepare/done() 2026-01-10 10:26:44 +01:00
vfio_ccw.h
vfio_zdev.h
vhost.h
vhost_types.h
videodev2.h media: v4l2-ctrls: Add hevc_ext_sps_[ls]t_rps controls 2026-01-21 14:43:09 +01:00
virtio_9p.h
virtio_balloon.h
virtio_blk.h
virtio_bt.h
virtio_config.h
virtio_console.h
virtio_crypto.h
virtio_fs.h
virtio_gpio.h
virtio_gpu.h
virtio_i2c.h
virtio_ids.h
virtio_input.h
virtio_iommu.h
virtio_mem.h
virtio_mmio.h
virtio_net.h
virtio_pci.h
virtio_pcidev.h
virtio_pmem.h
virtio_ring.h
virtio_rng.h
virtio_rtc.h
virtio_scmi.h
virtio_scsi.h
virtio_snd.h
virtio_spi.h
virtio_types.h
virtio_vsock.h
vm_sockets.h
vm_sockets_diag.h
vmclock-abi.h ptp: vmclock: support device notifications 2026-02-02 18:06:00 -08:00
vmcore.h
vsockmon.h
vt.h
vtpm_proxy.h
wait.h
watch_queue.h
watchdog.h
wireguard.h
wireless.h
wmi.h
wwan.h
x25.h
xattr.h
xdp_diag.h
xfrm.h
xilinx-v4l2-controls.h
zorro.h
zorro_ids.h