Re: [PATCH net] netfilter: conntrack: avoid recursive master destruction

[Florian Westphal <fw@strlen.de>]

Daehyeon Ko <4ncienth@gmail.com> wrote:
> Conntrack entries created through ctnetlink can reference another
> confirmed entry as their master.  There is no limit on the resulting
> chain depth.

I don't think this should be allowed.  I.e. (totally untested):

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2359,6 +2359,12 @@ ctnetlink_create_conntrack(struct net *net,
                        goto err2;
                }
                master_ct = nf_ct_tuplehash_to_ctrack(master_h);
+               if (master_ct->master) {
+                       nf_ct_put(master_ct);
+                       err = -EOPNOTSUPP;
+                       goto err2;
+               }
+
                __set_bit(IPS_EXPECTED_BIT, &ct->status);
                ct->master = master_ct;