Re: [PATCH v3] netfilter: nf_tables: Implement jump limit for nft_table_validate

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

On Mon, May 12, 2025 at 10:08:56PM -0400, Shaun Brady wrote:
[...]
> Add a new counter, total_jump_counter, to nft_ctx.  On every call to
> nft_table_validate() (rule addition time, versus packet inspection time)
> start the counter at the current sum of all jump counts in all other
> tables with the same family, as well as netdev.

What about the bridge family? If bridged frames are passed up to the
IP stack, then these hooks can have basechains with jumps too.

Maybe it is better to have a global limit for all tables, regardless
the family, in a non-init-netns?

> Increment said counter for every jump encountered during table
> validation.  If the counter ever exceeds the namespaces jump limit
> *during validation*, gracefully reject the rule with -EMLINK (the same
> behavior as exceeding NFT_JUMP_STACK_SIZE).
> 
> This allows immediate feedback to the user about a bad chain, versus the
> original idea (from the bug report) of allowing the addition to the
> table.  It keeps the in memory ruleset consistent, versus catching the
> failure during packet inspection at some unknown point in the future and
> arbitrarily denying the packet.

Agreed, I also prefer to enforce this limit from control plane.

Thanks