| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20250414030455.25322-1-xiafei_xupt@163.com>
Date: Mon, 14 Apr 2025 11:04:55 +0800
From: lvxiafei <xiafei_xupt@....com>
To: fw@...len.de
Cc: coreteam@...filter.org,
davem@...emloft.net,
edumazet@...gle.com,
horms@...nel.org,
kadlec@...filter.org,
kuba@...nel.org,
linux-kernel@...r.kernel.org,
lvxiafei@...setime.com,
netdev@...r.kernel.org,
netfilter-devel@...r.kernel.org,
pabeni@...hat.com,
pablo@...filter.org,
xiafei_xupt@....com
Subject: Re: [PATCH V5] netfilter: netns nf_conntrack: per-netns net.netfilter.nf_conntrack_max sysctl
On Sun, 13 Apr 2025 11:07:55 +0200 Florian Westphal <fw@...len.de> wrote:
> Is there a reason you did not follow my suggstion in
> https://lore.kernel.org/netdev/20250410105352.GB6272@breakpoint.cc/
>
> to disable net->ct.sysctl_max == 0 for non init netns?
in https://lore.kernel.org/netdev/20250410105352.GB6272@breakpoint.cc/
> > min(nf_conntrack_max, net->ct.sysctl_max) is the upper limit of ct_count
> > At the same time, when net->ct.sysctl_max == 0, the original intention is no limit,
> > but it can be limited by nf_conntrack_max in different netns.
>
> Sounds good to me.
It seems that there are two ways to change it:
1. Disallow net->ct.sysctl_max == 0
2. Allow net->ct.sysctl_max == 0
the original intention is no limit, but it can be limited by init_net netns
in different netns. When init_net is modified, it will change dynamically.
+----------------+-------------+----------------+
| init_net netns | other netns | limit behavior |
+----------------+-------------+----------------+
| not 0 | 0 | init_net |
+----------------+-------------+----------------+
Powered by blists - more mailing lists