On Mon, Jun 19, 2023 at 10:58:52AM +0200, Pablo Neira Ayuso wrote: > On Mon, Jun 19, 2023 at 10:55:59AM +0200, Pablo Neira Ayuso wrote: > > On Sun, Jun 18, 2023 at 04:59:38PM +0200, Pablo Neira Ayuso wrote: > > > Hi Phil, > > > > > > On Fri, Jun 16, 2023 at 05:56:11PM +0200, Phil Sutter wrote: > > > > When deleting a base chain, iptables-nft simply submits the whole chain > > > > to the kernel, including the NFTA_CHAIN_HOOK attribute. The new code > > > > added by fixed commit then turned this into a chain update, destroying > > > > the hook but not the chain itself. > > > > > > > > Detect the situation by checking if the chain's hook list becomes empty > > > > after removing all submitted hooks from it. A base chain without hooks > > > > is pointless, so revert back to deleting the chain. > > > > > > > > Note the 'goto err_chain_del_hook', error path takes care of undoing the > > > > hook_list modification and releasing the unused chain_hook. > > > > > > Could you give a try to this alternative patch? Ah, I guess my fix breaks temporary removal of a single interface from a netdev chain? > > This is the full patch. Works fine, iptables testsuite is back to normal again. :) > I forgot to mangle the patch description describing the new approach. > From 3da13f15a02e065e12080f2d66f81289aa6ebd69 Mon Sep 17 00:00:00 2001 > From: Phil Sutter <phil@xxxxxx> > Date: Fri, 16 Jun 2023 17:56:11 +0200 > Subject: [PATCH] netfilter: nf_tables: Fix for deleting base chains with > payload > > When deleting a base chain, iptables-nft simply submits the whole chain > to the kernel, including the NFTA_CHAIN_HOOK attribute. The new code > added by fixed commit then turned this into a chain update, destroying > the hook but not the chain itself. Detect the situation by checking if > the chain is either the netdev or inet/ingress type. I'd change the last sentence to "Avoid the situation by applying the new logic to base chains in netdev family or inet family ingress hook." But feel free to push as-is, I'm just nit-picking here. :) Thanks, Phil
