Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > On Wed, Jul 04, 2018 at 07:52:18PM +0200, Florian Westphal wrote: > > Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > > On Wed, Jul 04, 2018 at 07:39:54PM +0200, Pablo Neira Ayuso wrote: > > > > On Thu, Jun 28, 2018 at 05:55:49PM +0200, Florian Westphal wrote: > > > > > nft_compat relies on xt_request_find_match/target to increment > > > > > refcount of the module that provides the match/target. > > > > > > > > > > The builtin modules/targets currently did't set the module owner so it > > > > > was possible to rmmod ip(6)tables while extensions were still in use. > > > > > > > > Applied, thanks. > > > > > > Oh, wait this one too. > > > > > > The following are not supported by nft_compat: > > > > > > * ebt_standard_target > > > * ipt_builtin_tg > > > * ip6t_builtin_tg > > > > > > So I think we only need it for icmp and icmpv6. > > > > Hmm, how is that not supported? > > We use native. Ok, so userspace doesn't generate request to use them at the moment. > > I don't see anything that prevents their use. > > Can you elaborate? > > We don't use standard targets from nft_compat, we use native immediate > to express the verdict / jumps and so on. Alright, but that means its either this patch or a different patch that explicitly rejects them from nft_compat, right? -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
