Re: [PATCH nf v2] netfilter: nf_conntrack: limit expectation master chain depth

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Tue, Nov 10, 2026 at 02:34:43PM +0100, Florian Westphal wrote:
> > A conntrack can point to a master conntrack, which itself may point to
> > another master, and so on.  There is currently no bound on how deep this
> > chain can grow.
> > 
> > Force a max depth in nf_ct_expect_alloc(): walk the master chain and
> > reject allocation if it would exceed 8 levels of nesting.
> > 
> > Also add ctnetlink_find_get_master and use it so that ctnetlink create
> > paths return -EMLINK instead of falling through to nf_ct_expect_alloc()
> > and returning a misleading -ENOMEM.
> > 
> > This prevents unbounded ct->master->master->... chains.
> > 
> > This also restricts the number of call forward/redirects that h323 and sip
> > helpers will follow.
> 
> "Should ctnetlink_glue_attach_expect() or ctnetlink_alloc_expect() also
> check nf_ct_master_acceptable(ct) and return -EMLINK?"

I saw that but there are many patches in flight in this area, so I don't
want to meddle with those.

> It would be great to collapse this patch to v3 too:
> https://patchwork.ozlabs.org/project/netfilter-devel/patch/20261101225435.447072-1-pablo@netfilter.org/

?

Not following.

ct_expect_help() calls nf_ct_expect_alloc(), so I don't see how nft_ct
can create long chains after this patch.