Re: [PATCH nf-next v2] netfilter: nft_ct: support expectation creation for natted flows

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > +#if IS_ENABLED(CONFIG_NF_NAT)
> > +	nf_ct_expect_iterate_destroy(expect_iter_nat, NULL);
> > +	synchronize_rcu();
> > +#endif
> 
> Not sure sashiko is signalling a real issue here.

I could use the nf_nat_helper_register/unregister interface which would
support dump/restore via ctnetlink / conntrackd. 
Not sure its worth it.

This isn't using nat-follow-master directly to avoid a module dependency
on the nat core.

> static void __exit nf_nat_cleanup(void) 
> {
>         struct nf_nat_proto_clean clean = {}; 
>             
>         nf_ct_iterate_destroy(nf_nat_proto_clean, &clean);
> 
> all NATted master conntracks are destroyed here, including their
> expectations, which might have the expectations using
> nat_follow_master.

Yes, but users can remove nft_ct and leave nf nat core loaded,
so above function won't run.  The expect_iter_nat cb will zap
expectations that are still in the table that point to the
internal expectfn (i.e. into the module thats going away).

The alternative to the manual nf_ct_iterate_destroy() is to use
nf_ct_helper_expectfn_destroy() and a real struct nf_ct_helper_expectfn.

> And nf_nat_cleanup() can only be called if all there is no more nat
> chains in place, correct?

Yes, but I don't think thats related to the sashiko comment at
https://sashiko.dev/#/patchset/20260630060311.2504-1-fw%40strlen.de