Re: [PATCH] netfilter: nft_ct: validate timeout object protocol

Kyle Zeng [off-list ref] wrote:

nft_ct_timeout_obj_eval() only compares the timeout object protocol with
packet metadata. A packet header can be changed after conntrack attaches
an entry, so this metadata does not necessarily describe the entry.

I think all of these patches are wrong.  *How* can a packet header
change?  And if so, why is it enough to compare with the ct?

And why is that enough to somehow make it safe?

Are you going to add checks everywhere?