Re: [PATCH nf] netfilter: nf_tables: fix updating/deleting devices in an existing netdev chain

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sun, Mar 10, 2024 at 11:31:59PM +0100, Pablo Neira Ayuso wrote:
> On Sun, Mar 10, 2024 at 11:03:40PM +0100, Florian Westphal wrote:
> > Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> > > Updating netdev basechain is broken in many ways.
> > > 
> > > Keeping a list of pending hooks to be added/deleted in the transaction
> > > object does not mix well with table flag updates (ie. setting dormant
> > > flag in table) which operate on the existing basechain hook list.
> > > Instead, add/delete hook to/from the basechain hook list and allocate
> > > one transaction object per new device to refers to the hook to
> > > add/delete.
> > > 
> > > Add an 'inactive' flag that is set on to identify devices that has been
> > > already deleted, so double deletion in one batch is not possible.
> > 
> > Do you think it makes sense to remove dormant flag support
> > for the netdev family?
> > 
> > It would avoid the register/unregister entanglements and might
> > reduce headaches down the road.
> > 
> > IOW, do you think dormant flag toggling is useful for netdev family?
> 
> I would disable it for the netdev family, yes.

As a side note, the flowtable already does not support for the dormant flag.




[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux