Re: [PATCH nf] netfilter: nf_conntrack_expect: zero at allocation time

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Florian,

On Fri, Jun 26, 2026 at 01:58:43PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Thu, Jun 25, 2026 at 02:13:53AM +0200, Florian Westphal wrote:
> > > There are occasional LLM hints wrt. leaking uninitialized data to
> > > userspace via ctnetlink.  Just zero at allocation time, expectations are
> > > not frequently used these days.
> > 
> > Fine with me. IIRC hints came because of real issue, ie. paths where
> > I was missing to initial something.
> 
> 
> > > @@ -389,6 +389,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
> > >  #if IS_ENABLED(CONFIG_NF_NAT)
> > >  	memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
> > >  	memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
> > > +	exp->dir = 0;
> > 
> > Hm. But now area is expect is zeroed, right?
> > 
> > Maybe nf_ct_expect_init() needs to be updated to remove needless
> > zeroing too?
> 
> See:
> > > Intentionally keeps _init as-is because we could theoretically support
> > > re-init, so add the missing exp->dir there.
> 
> If you say we are guaranteed to always have:
> 
> exp = nf_ct_expect_alloc(ct);
> nf_ct_expect_init(exp)

IIRC, this API was already around when I came here...

> then we could remove it.  But then I'd question why we even have this
> alloc / init split and not:
> 
> exp = nf_ct_expect_new(rtp_exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
>                        &ct->tuplehash[!dir].tuple.src.u3,
>                        &ct->tuplehash[!dir].tuple.dst.u3,
>                        IPPROTO_UDP, NULL, &rtp_port);

... so yes, that's possible.

IIRC, there are only two spots that opencode the expectation
initilization:

- ctnetlink_alloc_expect()
- nf_conntrack_broadcast.c

Let me complete my series to turn exp->master into a cookie. I started
a series for nf-next to achieve this, I am ready to post the initial
preparation patches that reduce the number of exp->master references
in the tree.