Re: [PATCH nf] netfilter: conntrack: add dead flag to helpers

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, May 13, 2026 at 05:38:43PM +0200, Pablo Neira Ayuso wrote:
> On Wed, May 13, 2026 at 05:29:27PM +0200, Pablo Neira Ayuso wrote:
> > On Wed, May 13, 2026 at 12:05:02PM +0200, Florian Westphal wrote:
[...]
> > > 3. synchronize_rcu() -> all skbs that had this helper have
> > >    left RCU protection
> > > 4. nf_ct_expect_iterate_destroy() removes all not-yet-found
> > >    exp entries from table
> > > 5. nf_ct_iterate_destroy() -> clear exp from nf_conn's that are
> > >    *in conntrack table*
> > > 
> > > That still means we could have a NEW conntrack queued via nfqueue.
> > > I think we also need to toss nfqueued packets after step 3) and
> > > need to refuse queueing to userspace if the flag is set (-> drop).
> > 
> > Those conntrack entries would now have help->helper == NULL because of
> > the unhelp call.
> 
> Oh, wait, _NEW_ conntracks are unreachable, so yes, that can happen.
> 
> Tossing nfqueued packets here is convenient when helper goes away.

Hm, but nf_ct_iterate_destroy() already deals with unconfirmed conntrack.