Re: [PATCH net] netfilter: conntrack: avoid recursive master destruction

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, Oct 02, 2026 at 02:39:41PM +0900, Daehyeon Ko wrote:
> Thanks for taking a look.
> 
> I think this check is reasonable for CTA_TUPLE_MASTER, but it does not seem
> to make master chains impossible by itself.  There is another master writer
> in init_conntrack(): expectation fulfillment assigns exp->master to the new
> conntrack.
> 
> In particular, ctnetlink_glue_attach_expect() can attach an expectation
> from an NFQUEUE verdict and set assign_helper.  The expected child then has
> both a master and a helper, so it can serve as the master of another
> userspace-helper expectation.  That path does not pass through the proposed
> check and has no cumulative depth bound.

Then, just restrict glue_attach_expect() to reject this too.

> This helper propagation was intentionally restored by dcb0f9aefdd6
> ("netfilter: nf_conntrack_expect: restore helper propagation via
> expectation") for SIP, H.323 and userspace helpers.  Restricting all nested
> masters would therefore need a wider helper/expectation compatibility
> change.
> 
> For that reason I think nf_ct_destroy() still needs to be stack-safe.  The
> creation-time check could be added separately if nested conntrackd restore
> should also be rejected.  Does that match your intended invariant?
> 
> Thanks,
> Daehyeon