Re: [PATCH nf] netfilter: nf_tables: limit maximum number of jumps/gotos per netns

[Shaun Brady <brady.1345@gmail.com>]

On Wed, Oct 22, 2025 at 01:40:39AM +0200, Pablo Neira Ayuso wrote:
> This is set from the init_netns via:
> 
>    net.netfilter.nf_tables_jump_max_netns
> 
> which is 65536 by default.
> 
> According to Shawn Brady: "The compile time limit of 65536 was chosen to
> account for any normal use case, and when this value (and associated
> stressing loop table) was tested against a 1CPU/256MB machine, the
> system remained functional."

Hey, thanks for the call out.  Assuming a v2, the spelling is "Shaun
Brady".

> After the commit phase, jump_count[0] is set to jump_count[1] if it is
> >= 0. Otherwise, in case of abort, jump_count[1] is reset to -1 to
> prepare for handling the next batch.
> 

Oh, I like this change.  While I believe my old patch series behaved
correctly, this seems safer/more straight forward.

Would it make sense to name two separate variables something like
jump_count_pre/_post for clarity or will that cause packing issues?

I had a heck of a time getting the requested torture test to walk over
the abort code path with an existing rule set.  I'm interested in
learning more about abort states from your tests.

Thanks!


SB