Re: [PATCH net 5/9] netfilter: nfnetlink_cthelper: cap to maximum number of... | netdev

[PATCH net 0/9] netfilter: updates for net · Florian Westphal <fw@strlen.de> · 2026-06-30
[PATCH net 1/9] netfilter: nf_conntrack_expect: zero at allocation time · Florian Westphal <fw@strlen.de> · 2026-06-30
Re: [PATCH net 1/9] netfilter: nf_conntrack_expect: zero at allocation time · patchwork-bot+netdevbpf@kernel.org · 2026-07-01
[PATCH net 2/9] netfilter: nft_set_pipapo: don't leak bad clone into future transaction · Florian Westphal <fw@strlen.de> · 2026-06-30
[PATCH net 3/9] netfilter: ipset: fix race between dump and ip_set_list resize · Florian Westphal <fw@strlen.de> · 2026-06-30
Re: [PATCH net 3/9] netfilter: ipset: fix race between dump and ip_set_list resize · Florian Westphal <fw@strlen.de> · 2026-07-01
Re: [PATCH net 3/9] netfilter: ipset: fix race between dump and ip_set_list resize · Xiang Mei <hidden> · 2026-07-01
[PATCH net 4/9] netfilter: nf_conntrack_sip: validate skb_dst() before accessing it · Florian Westphal <fw@strlen.de> · 2026-06-30
Re: [PATCH net 4/9] netfilter: nf_conntrack_sip: validate skb_dst() before accessing it · Florian Westphal <fw@strlen.de> · 2026-07-01
Re: [PATCH net 4/9] netfilter: nf_conntrack_sip: validate skb_dst() before accessing it · Pablo Neira Ayuso <pablo@netfilter.org> · 2026-07-01
Re: [PATCH net 4/9] netfilter: nf_conntrack_sip: validate skb_dst() before accessing it · Pablo Neira Ayuso <pablo@netfilter.org> · 2026-07-01
[PATCH net 5/9] netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master · Florian Westphal <fw@strlen.de> · 2026-06-30
Re: [PATCH net 5/9] netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master · Florian Westphal <fw@strlen.de> · 2026-07-01
[PATCH net 6/9] netfilter: nft_fib: reject fib expression on the netdev egress hook · Florian Westphal <fw@strlen.de> · 2026-06-30
[PATCH net 7/9] netfilter: nfnetlink_queue: restrict writes to network header · Florian Westphal <fw@strlen.de> · 2026-06-30
[PATCH net 8/9] netfilter: nftables: restrict linklayer and network header writes · Florian Westphal <fw@strlen.de> · 2026-06-30
[PATCH net 9/9] netfilter: nftables: restrict checkum update offset · Florian Westphal <fw@strlen.de> · 2026-06-30

Re: [PATCH net 5/9] netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master

From: Florian Westphal <fw@strlen.de>
Date: 2026-07-01 05:04:49
Also in: netfilter-devel

Florian Westphal [off-list ref] wrote:

From: Pablo Neira Ayuso <pablo@netfilter.org>

If userspace helper policy updates sets maximum number of expectation to
zero, cap it to NF_CT_EXPECT_MAX_CNT (255) on updates too.

Fixes: 397c8300972f ("netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>

Pablo, can you please check

https://sashiko.dev/#/message/20260630045243.2657-6-fw%40strlen.de

?

AFAICS the comment is correct, but it should be handled in a
followup patch rather than a v2.

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help