Re: [PATCH nf 1/1] netfilter: nf_dup: prevent asynchronous duplicate recursion

zihan xi <[email protected]> Thu, 3 Sep 2026 16:09:03 +0800

Newsgroups	gmane.comp.security.firewalls.netfilter.devel,gmane.linux.network,gmane.linux.kernel,gmane.linux.kernel.stable
Message-ID	<CAANe3eS22cFoqz1DWAkLXkskZqO3istpX6ARSKvBKBBVKKKdtQ@mail.gmail.com>

On Thu, Sep 3, 2026 at 2:58 PM Florian Westphal <[email protected]> wrote:
>
> zihan xi <[email protected]> wrote:
> > If you do prefer to keep a small nf_dup-only change, I can prepare either:
> >
> > 1. disable IPv4/IPv6 dup in network namespaces owned by a non-initial user
> >    namespace; or
>
> I think this is the better option, someone would have to explain
> the use-case for DUP in a user netns.

Thanks. I will take this option and send a v2 that skips IPv4/IPv6
duplication when the network namespace is owned by a non-initial user
namespace.

Best regards,
Zihan Xi