Re: [PATCH nf 1/2] netfilter: nf_tables: limit maximum number of jumps/gotos per netns

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> Add a new sysctl:
> 
>    net.netfilter.nf_tables_jump_max_netns
> 
> which is 65535 by default, because iptables-nft rulesets are more likely
> to have more jumps/gotos compared to native nftables rulesets.

I have existing / real-world iptables dumps that exceed 64k :-/
I'll forward you one of them.

Seems this patch misses a reset somewhere to deal with
chains/tables being deleted:

sysctl net.netfilter.nf_tables_jumps_max_netns=256000
net.netfilter.nf_tables_jumps_max_netns = 256000
iptables-nft-restore < kubernetes-huge-may-2018.txt; echo $?
0
iptables-nft-restore < kubernetes-huge-may-2018.txt
iptables-nft-restore v1.8.11 (nf_tables):
line 52222: RULE_APPEND failed (Too many links): rule in chain KUBE-SVC-FCXG7AJXWMSO3TT5

works after 'nft flush ruleset'.

I also have a hunch that a followup patch that sepearates ip and ip6
families (since they are mutually exclusive) will be needed sooner than
later.

If even a random old iptables-dump exceeds the 64k limit I would expect
combined ip+ip6tables rulesets to be even more brittle.