Re: [PATCH nf,v2] netfilter: conntrack: add dead flag to helpers

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, May 14, 2026 at 04:43:17PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > Add a new NF_CT_HELPER_F_DEAD helper flag to notify the packet path that
> > this helper is going away. Thus, helpers are effectively disabled and no
> > new expectations are created while removing the expectations created by
> > this helper as well as unhelping the existing conntrack entries.
> > 
> > Add the check for NF_CT_HELPER_F_DEAD in the packet path to:
> > - Conntrack confirmation path which invokes the helper callback.
> > - Propagation of helper to conntrack via expectation.
> > - OVS ct helper invocation.
> 
> Not sure this is enough.  New conntracks are not in any hash table /
> unreachable, and synchronize_rcu() doesn't guarantee they get confirmed
> (can get queued).

nf_ct_iterate_destroy() calls nf_queue_nf_hook_drop() for each netns.

> > +	WRITE_ONCE(me->flags, me->flags | NF_CT_HELPER_F_DEAD);
> 
> How does this avoid race with nfnl_cthelper_update() ?

Hm. I overlook that these flags are toggled, I will propose a new
approach.