Re: [PATCH nf,v2] netfilter: nf_tables: unbind set in rule from commit path

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Feb 01, 2019 at 06:29:22PM +0100, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> > Moreover, this patch adds the unbind step to deliver the event from the
> > commit path.  This should not be done from the worker thread, since we
> > have no guarantees of in-order delivery to the listener.
> 
> Right, they indeed should occur during finalization of commit phase, not
> worker.
> 
> > This patch removes the assumption that both activate and deactivate
> > callbacks need to be provided.
> 
> The assumption was that deactive has side effects that might need to
> be undone in case another rule in the batch triggers an abort.
> 
> AFAICS after this patch .deactivate has no effect if we're still
> in the preparation phase so no reactive needed either in case of abort.
> 
> IOW, looks good to me, thanks for fixing this.

Thanks Florian, just noticed a small issue with event order (DELSET
should come after DELRULE for anonymous sets as it uses to be before
this patch) just sent a v3.



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux