Re: [PATCH nf 1/1] netfilter: nf_dup: prevent asynchronous duplicate recursion

zihan xi [off-list ref] wrote:

If you do prefer to keep a small nf_dup-only change, I can prepare either:

1. disable IPv4/IPv6 dup in network namespaces owned by a non-initial user
   namespace; or

I think this is the better option, someone would have to explain
the use-case for DUP in a user netns.