On Fri, Feb 15, 2019 at 06:07:06PM +0100, Phil Sutter wrote:
> On Fri, Feb 15, 2019 at 03:33:02PM +0100, Pablo Neira Ayuso wrote:
> > On Fri, Feb 15, 2019 at 02:15:37PM +0100, Phil Sutter wrote:
> > > Hi,
> > >
> > > On Fri, Feb 15, 2019 at 10:50:42AM +0100, Pablo Neira Ayuso wrote:
> > > [...]
> > > > > From the flush path, we can skip requests for deletion of rules that
> > > > > have been already deleted, ie. we add no transaction since there is
> > > > > already one in place.
> > >
> > > Thanks for the quick fix!
> > >
> > > > nft_delrule_by_chain() is always called from flush path. We can apply
> > > > this smaller fix I think.
> > >
> > > > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> > > > index 5a92f23f179f..4893f248dfdc 100644
> > > > --- a/net/netfilter/nf_tables_api.c
> > > > +++ b/net/netfilter/nf_tables_api.c
> > > > @@ -313,6 +313,9 @@ static int nft_delrule_by_chain(struct nft_ctx *ctx)
> > > > int err;
> > > >
> > > > list_for_each_entry(rule, &ctx->chain->rules, list) {
> > > > + if (!nft_is_active_next(ctx->net, rule))
> > > > + continue;
> > > > +
> > > > err = nft_delrule(ctx, rule);
> > > > if (err < 0)
> > > > return err;
> > >
> > > Successfully tested with my ebtables-nft bug:
> > >
> > > | # ebtables-nft -N foo
> > > | # ebtables-nft -F
> > >
> > > (Batch then contains policy rule delete and chain flush.)
> > >
> > > Acked-by: Phil Sutter <phil@xxxxxx>
> >
> > OK, I have pushed this out to nf.git.
>
> Nice, thanks! If this has soaked into stable for a while, we may drop
> nft_abort_policy_rule() again, I guess. :)
Yes, it would be good indeed to remove that function once this
fix propagates to -stable kernels. Thanks!
