Re: [PATCH nf-next v2] netfilter: nft_ct: support expectation creation for natted flows

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Jun 30, 2026 at 01:04:42PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > +#if IS_ENABLED(CONFIG_NF_NAT)
> > > +	nf_ct_expect_iterate_destroy(expect_iter_nat, NULL);
> > > +	synchronize_rcu();
> > > +#endif
> > 
> > Not sure sashiko is signalling a real issue here.
> 
> I could use the nf_nat_helper_register/unregister interface which would
> support dump/restore via ctnetlink / conntrackd. 
> Not sure its worth it.
> 
> This isn't using nat-follow-master directly to avoid a module dependency
> on the nat core.
> 
> > static void __exit nf_nat_cleanup(void) 
> > {
> >         struct nf_nat_proto_clean clean = {}; 
> >             
> >         nf_ct_iterate_destroy(nf_nat_proto_clean, &clean);
> > 
> > all NATted master conntracks are destroyed here, including their
> > expectations, which might have the expectations using
> > nat_follow_master.
> 
> Yes, but users can remove nft_ct and leave nf nat core loaded,
> so above function won't run.  The expect_iter_nat cb will zap
> expectations that are still in the table that point to the
> internal expectfn (i.e. into the module thats going away).

Right.

> The alternative to the manual nf_ct_iterate_destroy() is to use
> nf_ct_helper_expectfn_destroy() and a real struct nf_ct_helper_expectfn.

For the scenario you describe, I think it should be possible to
register a dummy helper for this expectation type, with a NULL
callback. Helper unregistration should deal with removing the pending
expectations that are left behind on module removal.

By adding this dummy helper, this special type of expectations gets
aligned with the existing helpers.

I can take a look if you busy with something else, let me know.

Thanks Florian.

> > And nf_nat_cleanup() can only be called if all there is no more nat
> > chains in place, correct?
> 
> Yes, but I don't think thats related to the sashiko comment at
> https://sashiko.dev/#/patchset/20260630060311.2504-1-fw%40strlen.de