From: Florian Westphal <fw@strlen.de>
To: netdev@vger.kernel.org
Cc: Paolo Abeni <pabeni@redhat.com>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>,
netfilter-devel@vger.kernel.org, pablo@netfilter.org
Subject: Re: [PATCH net 5/9] netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master
Date: Wed, 1 Jul 2026 07:04:47 +0200 [thread overview]
Message-ID: <akSf7y4cm8S485nh@strlen.de> (raw)
In-Reply-To: <20260630045243.2657-6-fw@strlen.de>
Florian Westphal <fw@strlen.de> wrote:
> From: Pablo Neira Ayuso <pablo@netfilter.org>
>
> If userspace helper policy updates sets maximum number of expectation to
> zero, cap it to NF_CT_EXPECT_MAX_CNT (255) on updates too.
>
> Fixes: 397c8300972f ("netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> Signed-off-by: Florian Westphal <fw@strlen.de>
Pablo, can you please check
https://sashiko.dev/#/message/20260630045243.2657-6-fw%40strlen.de
?
AFAICS the comment is correct, but it should be handled in a
followup patch rather than a v2.
next prev parent reply other threads:[~2026-07-01 5:04 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-30 4:52 [PATCH net 0/9] netfilter: updates for net Florian Westphal
2026-06-30 4:52 ` [PATCH net 1/9] netfilter: nf_conntrack_expect: zero at allocation time Florian Westphal
2026-07-01 17:10 ` patchwork-bot+netdevbpf
2026-06-30 4:52 ` [PATCH net 2/9] netfilter: nft_set_pipapo: don't leak bad clone into future transaction Florian Westphal
2026-06-30 4:52 ` [PATCH net 3/9] netfilter: ipset: fix race between dump and ip_set_list resize Florian Westphal
2026-07-01 5:09 ` Florian Westphal
2026-07-01 20:33 ` Xiang Mei
2026-06-30 4:52 ` [PATCH net 4/9] netfilter: nf_conntrack_sip: validate skb_dst() before accessing it Florian Westphal
2026-07-01 6:36 ` Florian Westphal
2026-07-01 11:01 ` Pablo Neira Ayuso
2026-07-01 12:23 ` Pablo Neira Ayuso
2026-06-30 4:52 ` [PATCH net 5/9] netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master Florian Westphal
2026-07-01 5:04 ` Florian Westphal [this message]
2026-06-30 4:52 ` [PATCH net 6/9] netfilter: nft_fib: reject fib expression on the netdev egress hook Florian Westphal
2026-06-30 4:52 ` [PATCH net 7/9] netfilter: nfnetlink_queue: restrict writes to network header Florian Westphal
2026-06-30 4:52 ` [PATCH net 8/9] netfilter: nftables: restrict linklayer and network header writes Florian Westphal
2026-06-30 4:52 ` [PATCH net 9/9] netfilter: nftables: restrict checkum update offset Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=akSf7y4cm8S485nh@strlen.de \
--to=fw@strlen.de \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.