On Fri, Feb 15, 2019 at 02:15:37PM +0100, Phil Sutter wrote:
> Hi,
>
> On Fri, Feb 15, 2019 at 10:50:42AM +0100, Pablo Neira Ayuso wrote:
> [...]
> > > From the flush path, we can skip requests for deletion of rules that
> > > have been already deleted, ie. we add no transaction since there is
> > > already one in place.
>
> Thanks for the quick fix!
>
> > nft_delrule_by_chain() is always called from flush path. We can apply
> > this smaller fix I think.
>
> > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> > index 5a92f23f179f..4893f248dfdc 100644
> > --- a/net/netfilter/nf_tables_api.c
> > +++ b/net/netfilter/nf_tables_api.c
> > @@ -313,6 +313,9 @@ static int nft_delrule_by_chain(struct nft_ctx *ctx)
> > int err;
> >
> > list_for_each_entry(rule, &ctx->chain->rules, list) {
> > + if (!nft_is_active_next(ctx->net, rule))
> > + continue;
> > +
> > err = nft_delrule(ctx, rule);
> > if (err < 0)
> > return err;
>
> Successfully tested with my ebtables-nft bug:
>
> | # ebtables-nft -N foo
> | # ebtables-nft -F
>
> (Batch then contains policy rule delete and chain flush.)
>
> Acked-by: Phil Sutter <phil@xxxxxx>
OK, I have pushed this out to nf.git.
Thanks Phil.
