Re: [PATCH iptabes-nft] iptables-nft: allow removal of empty builtin chains

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


On Sat, Aug 14, 2021 at 10:53:14PM +0200, Florian Westphal wrote:
> Jan Engelhardt <jengelh@xxxxxxx> wrote:
> > 
> > On Saturday 2021-08-14 19:46, Florian Westphal wrote:
> > > Conservative change:
> > > iptables-nft -X will not remove empty builtin chains.
> > > OTOH, maybe it would be better to auto-remove those too, if empty.
> > > Comments?
> > 
> > How are chain policies expressed in nft, as a property on the
> > chain (like legacy), or as a separate rule?
> > That is significant when removing "empty" chains.
> Indeed.  Since this removes the base chain, it implicitly reverts
> a DROP policy too.

User still has to iptables -F on that given chain before deleting,

If NLM_F_NONREC is used, the EBUSY is reported when trying to delete
a chain with rules.

My assumption is that the user will perform:

iptables-nft -F -t filter
iptables-nft -D -t filter

to follow the classic iptables-like approach (which requires usual -F
+ -X on every table).

I mean, by when the user has an empty basechain with default policy to
DROP, if they remove the chain, then they are really meaning to remove
the chain and this default policy to DROP.

Or am I missing anything else?

[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux