Re: [PATCH net v3] netfilter: conntrack: avoid recursive master destruction

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Oct 07, 2026 at 01:26:27PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > That said, ignoring the source of the problem is not good.
> > > 
> > > I see no point whatsoever for a expected connection to have a
> > > non-control connection as its master.
> > 
> > I would prefer if chain length is limited too, ie. tighten this
> > interface based on the LLM feedback.
> 
> Thanks, working on this now.  Tentative plan:
> 
> #define NF_CT_MAX_EXPECT_CHAIN_LEN     4

4 is a reasonable number, but I think 2 is just enough, which is what
H.323 and SIP need, in case you consider tightening this even further
Userspace helpers are simple, they don't use this feature. It is true
that conntrackd needs this feature for flow synchronization as the LLM
suggests.

> static inline bool nf_ct_master_acceptable(const struct nf_conn *m)
> {
>        unsigned int depth = 0;
> 
>        while (m->master) {
>                if (++depth > NF_CT_MAX_EXPECT_CHAIN_LEN)
>                        return false;
>                m = m->master;
>        }
> 
>        return true;
> }
> 
>  struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)
>  {
>         struct nf_conntrack_expect *new;
>  
> +       if (!nf_ct_master_acceptable(me))
> +               return NULL;
> +
> 
> I'll make an independent submission for this.

Thanks Florian.