On Wed, Jul 04, 2018 at 07:58:17PM +0200, Florian Westphal wrote: > Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > On Wed, Jul 04, 2018 at 07:52:18PM +0200, Florian Westphal wrote: > > > Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > > > On Wed, Jul 04, 2018 at 07:39:54PM +0200, Pablo Neira Ayuso wrote: > > > > > On Thu, Jun 28, 2018 at 05:55:49PM +0200, Florian Westphal wrote: > > > > > > nft_compat relies on xt_request_find_match/target to increment > > > > > > refcount of the module that provides the match/target. > > > > > > > > > > > > The builtin modules/targets currently did't set the module owner so it > > > > > > was possible to rmmod ip(6)tables while extensions were still in use. > > > > > > > > > > Applied, thanks. > > > > > > > > Oh, wait this one too. > > > > > > > > The following are not supported by nft_compat: > > > > > > > > * ebt_standard_target > > > > * ipt_builtin_tg > > > > * ip6t_builtin_tg > > > > > > > > So I think we only need it for icmp and icmpv6. > > > > > > Hmm, how is that not supported? > > > > We use native. > > Ok, so userspace doesn't generate request to use them at the moment. Will not ever, nft_compat will basically reject them, we would need to extend them to support the standard and error targets, but it is not worth given we use native. > > > I don't see anything that prevents their use. > > > Can you elaborate? > > > > We don't use standard targets from nft_compat, we use native immediate > > to express the verdict / jumps and so on. > > Alright, but that means its either this patch or a different patch > that explicitly rejects them from nft_compat, right? You can make an explicit reject, not sure it is required, it would be good to make sure this is indeed necessary. I think this patch should only update icmp and icmpv6, which are the ones that are causing problems there. A follow up patch with missing validation, if needed, would be also great. Thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
