Re: [PATCH nf 1/1] netfilter: ecache: bound destroy event redelivery

[Florian Westphal <fw@strlen.de>]

Ren Wei <weir@nebusec.ai> wrote:
> From: Ruide Cao <caoruide123@gmail.com>
> 
> A conntrack whose destroy event cannot be delivered is kept on the
> per-netns ecache list while the workqueue retries the notification.
> The worker stops at the first failure and retries every 10 ms without
> a lifetime limit. A listener that enables NETLINK_BROADCAST_ERROR and
> never drains its receive queue can therefore retain conntracks and
> keep the worker busy indefinitely.

Yes, that's by design.  This feature intentionally blocks new
conntracks.

> +	if (!cnet->ecache.retry_deadline)
> +		cnet->ecache.retry_deadline = jiffies + ECACHE_RETRY_TIMEOUT;
> +
> +	if (time_after_eq(jiffies, cnet->ecache.retry_deadline)) {
> +		hlist_nulls_for_each_entry_safe(h, n, &cnet->ecache.dying_list,
> +						hnnode) {
> +			struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
> +
> +			hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);
> +			hlist_nulls_add_head(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode,
> +					     &evicted_list);
> +		}
> +		ret = STATE_DONE;
> +		goto out_unlock;
> +	}

I doubt this is correct.  Userspace that can deal with missing destroy
events SHOULD NOT enable reliable event delivery mode.