From 68fd293d99e469159bb131e1a965f076adbc160d Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Wed, 9 Sep 2026 17:38:45 -0700 Subject: [PATCH 1/7] netlink: specs: conntrack: timestamp is a nest, not a be64 ctnetlink_dump_timestamp() wraps CTA_TIMESTAMP_START and CTA_TIMESTAMP_STOP in a nest, but the spec declares CTA_TIMESTAMP as a flat be64. ynl picks reply attributes out of the attribute set rather than the operation's attribute list, so the mistyped attribute stops the whole dump: Error decoding 'timestamp' from 'conntrack-attrs' Traceback (most recent call last): File "tools/net/ynl/pyynl/cli.py", line 314, in main reply = ynl.dump(args.dump, attrs) File "tools/net/ynl/pyynl/lib/ynl.py", line 1082, in _decode decoded = attr.as_scalar(attr_spec['type'], attr_spec.byte_order) File "tools/net/ynl/pyynl/lib/ynl.py", line 291, in as_scalar return format_.unpack(self.raw)[0] struct.error: unpack requires a buffer of 8 bytes The tstamp extension is only attached when CONFIG_NF_CONNTRACK_TIMESTAMP is enabled and nf_conntrack_timestamp is turned on, which is off by default and is why every dump does not hit this. stop is omitted for live entries, so it stays optional like every other member here. The pad member mirrors counter-attrs, which covers the same nla_put_be64() padding. Reported-by: Sashiko Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826220444.4054714-1-i.maximets@ovn.org Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/20260910003852.2184031-2-kuba@kernel.org Signed-off-by: Jakub Kicinski --- Documentation/netlink/specs/conntrack.yaml | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml index b1eb102ab843..2b7f16cc4133 100644 --- a/Documentation/netlink/specs/conntrack.yaml +++ b/Documentation/netlink/specs/conntrack.yaml @@ -345,6 +345,20 @@ attribute-sets: - name: secctx-name type: string + - + name: timestamp-attrs + attributes: + - + name: start + type: u64 + byte-order: big-endian + - + name: stop + type: u64 + byte-order: big-endian + - + name: pad + type: pad - name: synproxy-attrs attributes: @@ -458,8 +472,8 @@ attribute-sets: nested-attributes: secctx-attrs - name: timestamp - type: u64 - byte-order: big-endian + type: nest + nested-attributes: timestamp-attrs - name: mark-mask type: u32 From 19be13c9c1e940c041c52ddeeb93d3f9150865f6 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Wed, 9 Sep 2026 17:38:46 -0700 Subject: [PATCH 2/7] netlink: specs: conntrack: fix the get reply attribute lists CTA_NAT_SRC and CTA_NAT_DST are input-only. The only references to either are cda[] reads in ctnetlink_setup_nat() and the rejection in ctnetlink_change_conntrack(); no path ever puts them into a message, so neither belongs in a reply. nat-dst was listed twice on top of that. CTA_TIMESTAMP is the opposite case - both the do and the dump reach ctnetlink_fill_info() with extinfo set, so ctnetlink_dump_extinfo() -> ctnetlink_dump_timestamp() emits it, but the lists never named it. Reported-by: Sashiko Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826220444.4054714-1-i.maximets@ovn.org Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/20260910003852.2184031-3-kuba@kernel.org Signed-off-by: Jakub Kicinski --- Documentation/netlink/specs/conntrack.yaml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml index 2b7f16cc4133..174697ce125e 100644 --- a/Documentation/netlink/specs/conntrack.yaml +++ b/Documentation/netlink/specs/conntrack.yaml @@ -596,20 +596,18 @@ operations: - status - protoinfo - help - - nat-src - - nat-dst - timeout - mark - counters-orig - counters-reply - use - id - - nat-dst - tuple-master - seq-adj-orig - seq-adj-reply - zone - secctx + - timestamp - labels - synproxy dump: @@ -632,20 +630,18 @@ operations: - status - protoinfo - help - - nat-src - - nat-dst - timeout - mark - counters-orig - counters-reply - use - id - - nat-dst - tuple-master - seq-adj-orig - seq-adj-reply - zone - secctx + - timestamp - labels - synproxy - From 924c8a610d3acb186248dd7256e8787cf6a0e422 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Wed, 9 Sep 2026 17:38:47 -0700 Subject: [PATCH 3/7] netlink: specs: conntrack: fix SCTP conntrack state names Correct the names of constants: Value 1 is SCTP_CONNTRACK_CLOSED, not "cloned". Value 6 is SCTP_CONNTRACK_SHUTDOWN_RECD, not "shutdown-received". Value 8 is SCTP_CONNTRACK_HEARTBEAT_SENT, there is no "shutdown-heartbeat" state. Note that there's also a value of 9 (HEARTBEAT_ACKED) but sctp_nla_policy caps the attribute at HEARTBEAT_SENT and HEARTBEAT_ACKED is marked no longer used in the header. Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/20260910003852.2184031-4-kuba@kernel.org Signed-off-by: Jakub Kicinski --- Documentation/netlink/specs/conntrack.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml index 174697ce125e..105b53d4b76a 100644 --- a/Documentation/netlink/specs/conntrack.yaml +++ b/Documentation/netlink/specs/conntrack.yaml @@ -72,14 +72,14 @@ definitions: type: enum entries: - none - - cloned + - closed - cookie-wait - cookie-echoed - established - shutdown-sent - - shutdown-received + - shutdown-recd - shutdown-ack-sent - - shutdown-heartbeat-sent + - heartbeat-sent - name: nf-ct-status type: flags From 58c7df883ada6d97107cffc07e3b3bb965a761a8 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Wed, 9 Sep 2026 17:38:48 -0700 Subject: [PATCH 4/7] netlink: specs: conntrack: fix the nat-attrs attribute IDs The enum for attr IDs says: CTA_NAT_V4_MINIP, #define CTA_NAT_MINIP CTA_NAT_V4_MINIP CTA_NAT_V4_MAXIP, #define CTA_NAT_MAXIP CTA_NAT_V4_MAXIP CTA_NAT_PROTO, CTA_NAT_V6_MINIP, CTA_NAT_V6_MAXIP, Move nat-proto to the right place in the YAML spec to make sure the attr IDs match. Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/20260910003852.2184031-5-kuba@kernel.org Signed-off-by: Jakub Kicinski --- Documentation/netlink/specs/conntrack.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml index 105b53d4b76a..0d1528507c4b 100644 --- a/Documentation/netlink/specs/conntrack.yaml +++ b/Documentation/netlink/specs/conntrack.yaml @@ -314,16 +314,16 @@ attribute-sets: name: nat-v4-maxip type: u32 byte-order: big-endian + - + name: nat-proto + type: nest + nested-attributes: nat-proto-attrs - name: nat-v6-minip type: binary - name: nat-v6-maxip type: binary - - - name: nat-proto - type: nest - nested-attributes: nat-proto-attrs - name: seqadj-attrs attributes: From 6c98fd455ed507f82047816e07d5856db987cacd Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Wed, 9 Sep 2026 17:38:49 -0700 Subject: [PATCH 5/7] netlink: specs: conntrack: describe CTA_HELP_INFO nfnl_cthelper_to_nlattr() seems to output CTA_HELP_INFO but the spec doesn't have a definition for it, add one. Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/20260910003852.2184031-6-kuba@kernel.org Signed-off-by: Jakub Kicinski --- Documentation/netlink/specs/conntrack.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml index 0d1528507c4b..ec90d3d05841 100644 --- a/Documentation/netlink/specs/conntrack.yaml +++ b/Documentation/netlink/specs/conntrack.yaml @@ -292,6 +292,12 @@ attribute-sets: name: help-name type: string doc: helper name + - + name: help-info + type: binary + doc: >- + Private data of a user space helper, only present for helpers + registered via nfnetlink_cthelper with a non-zero data length. - name: nat-proto-attrs attributes: From f869aa4ceaa2daeb4320a0d83fa212dad3709785 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Wed, 9 Sep 2026 17:38:50 -0700 Subject: [PATCH 6/7] netlink: specs: conntrack: fix the per-CPU stats reply ctnetlink_ct_stat_cpu_fill_info() emits CTA_STATS_INVALID but does not emit CTA_STATS_SEARCHED. Update the attr list, and remove the false annotation of invalid as obsolete. Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/20260910003852.2184031-7-kuba@kernel.org Signed-off-by: Jakub Kicinski --- Documentation/netlink/specs/conntrack.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml index ec90d3d05841..9ba93370275d 100644 --- a/Documentation/netlink/specs/conntrack.yaml +++ b/Documentation/netlink/specs/conntrack.yaml @@ -530,7 +530,7 @@ attribute-sets: name: invalid type: u32 byte-order: big-endian - doc: obsolete + doc: packets which could not be tracked - name: ignore type: u32 @@ -661,8 +661,8 @@ operations: reply: value: 0x104 attributes: - - searched - found + - invalid - insert - insert-failed - drop From 55edd9e55711e7e47060fb998a96e968a895fc20 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Wed, 9 Sep 2026 17:38:51 -0700 Subject: [PATCH 7/7] netlink: specs: conntrack: tweak definition of obsolete attrs CTA_SECMARK, CTA_COUNTERS32_{PACKETS,BYTES} are all obsolete be32 attrs. Since they are obsolete we don't bother with the byte-order annotation, but let's be consistent about marking them as u32 with doc: obsolete. The attrs were obsoleted by: commit 584015727a3b ("netfilter: accounting rework: ct_extend + 64bit counters (v4)") commit 1cc63249adfa ("conntrack: export lsm context rather than internal secid via netlink") Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/20260910003852.2184031-8-kuba@kernel.org Signed-off-by: Jakub Kicinski --- Documentation/netlink/specs/conntrack.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml index 9ba93370275d..1d163130241a 100644 --- a/Documentation/netlink/specs/conntrack.yaml +++ b/Documentation/netlink/specs/conntrack.yaml @@ -116,9 +116,11 @@ attribute-sets: - name: packets-old type: u32 + doc: obsolete - name: bytes-old type: u32 + doc: obsolete - name: pad type: pad @@ -465,7 +467,7 @@ attribute-sets: nested-attributes: seqadj-attrs - name: secmark - type: binary + type: u32 doc: obsolete - name: zone