Re: [PATCH nf 1/2] netfilter: nf_tables: limit maximum number of jumps/gotos per netns

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> iptables needs higher value, while nftables with vmaps could set a
> much lower value, because vmap counts as a single immediate jump.

Agreed.  nftables can use something like 100 :-)

> > I have existing / real-world iptables dumps that exceed 64k :-/
> 
> OK, so k8s can load this ruleset inside userns (because netns can
> still rise this value). But your concern is the default value, right?

Yes, exactly.  If you have a system that runs iptables-restore on
startup then after kernel update that might fail.

I see that init_net is exempted from any limits and thats a good choice.
I'm concerned about containers here.

> I can take look, you mean:
> 
> - IPv4 count => count jumps in all table except ipv6.
> - IPv6 count => count jumps in all table except ipv4.

Yes, exactly.  That should remove a bit of pressure to
use a super-large default value.

> Here, IIRC, I needed ~8 million jumps (_not_ net jump counts in the
> rule, I mean number of jumps according to nft_jump_count_check()) in
> the input chain to see softlockup with KASAN+KMEMLEAK.
> 
> 256k is still far from 8 million.

Agreed.

> > If even a random old iptables-dump exceeds the 64k limit I would expect
> > combined ip+ip6tables rulesets to be even more brittle.
> 
> Yes, the problem here to set this default value is iptables,
> nftables can set it very small, but iptables needs a large one.

Right.

> I guess native nftables users can safely shrink the default value we
> are going to set here.

Yes, absolutely.  nft --omptimize could eventually yell at users when
it sees too many jumps :)