Re: RFC: nftables does not allow to delete a rule twice

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Feb 15, 2019 at 03:33:02PM +0100, Pablo Neira Ayuso wrote:
> On Fri, Feb 15, 2019 at 02:15:37PM +0100, Phil Sutter wrote:
> > Hi,
> > 
> > On Fri, Feb 15, 2019 at 10:50:42AM +0100, Pablo Neira Ayuso wrote:
> > [...]
> > > > From the flush path, we can skip requests for deletion of rules that
> > > > have been already deleted, ie. we add no transaction since there is
> > > > already one in place.
> > 
> > Thanks for the quick fix!
> > 
> > > nft_delrule_by_chain() is always called from flush path. We can apply
> > > this smaller fix I think.
> > 
> > > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> > > index 5a92f23f179f..4893f248dfdc 100644
> > > --- a/net/netfilter/nf_tables_api.c
> > > +++ b/net/netfilter/nf_tables_api.c
> > > @@ -313,6 +313,9 @@ static int nft_delrule_by_chain(struct nft_ctx *ctx)
> > >  	int err;
> > >  
> > >  	list_for_each_entry(rule, &ctx->chain->rules, list) {
> > > +		if (!nft_is_active_next(ctx->net, rule))
> > > +			continue;
> > > +
> > >  		err = nft_delrule(ctx, rule);
> > >  		if (err < 0)
> > >  			return err;
> > 
> > Successfully tested with my ebtables-nft bug:
> > 
> > | # ebtables-nft -N foo
> > | # ebtables-nft -F
> > 
> > (Batch then contains policy rule delete and chain flush.)
> > 
> > Acked-by: Phil Sutter <phil@xxxxxx>
> 
> OK, I have pushed this out to nf.git.

Nice, thanks! If this has soaked into stable for a while, we may drop
nft_abort_policy_rule() again, I guess. :)

Cheers, Phil



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux