Re: [PATCH net v3] netfilter: conntrack: avoid recursive master destruction

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > That said, ignoring the source of the problem is not good.
> > 
> > I see no point whatsoever for a expected connection to have a
> > non-control connection as its master.
> 
> I would prefer if chain length is limited too, ie. tighten this
> interface based on the LLM feedback.

Thanks, working on this now.  Tentative plan:

#define NF_CT_MAX_EXPECT_CHAIN_LEN     4

static inline bool nf_ct_master_acceptable(const struct nf_conn *m)
{
       unsigned int depth = 0;

       while (m->master) {
               if (++depth > NF_CT_MAX_EXPECT_CHAIN_LEN)
                       return false;
               m = m->master;
       }

       return true;
}

 struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)
 {
        struct nf_conntrack_expect *new;
 
+       if (!nf_ct_master_acceptable(me))
+               return NULL;
+

I'll make an independent submission for this.