Follow-up to commit 72ac1c0937df ("netfilter: nf_queue: limit the hook
drop flush to the unregistered hook point"), merged into net-next with
the nf-next-26-10-18 pull request, as requested in the review of that
pull request. The series is based on net-next main, which has that
commit; nf-next main does not have it yet.The hook drop flush now only covers the hook point of the hook being unregistered. Two module exit paths relied on the old flush of every queued packet and need an explicit one: - br_netfilter queues packets from the ip, ip6 and arp forward and postrouting hook points with an okfn inside the module, so a verdict after rmmod br_netfilter jumps into freed module text (patch 1). The hook removal moves to a pre_exit callback so that the grace period the pernet core runs before exit separates it from the flush. The patch also moves the nf_queue_nf_hook_drop() declaration to nf_queue.h so that code outside net/netfilter can call it. - packets queued from forward keep their conntrack reference, so rmmod nf_conntrack blocks in nf_conntrack_cleanup_net_list() until userspace sends a verdict (patch 2). Patches 3 and 4 address the review comments on the nft_queue.sh test added with that commit. Patch 3 fixes a pre-existing problem that affects the whole script: test_queue() resets the failure flag, so a failure in any test that runs before the bridge tests leaves the exit status at 0. Patch 4 makes test_hook_drop_scope fail when its setup does not complete and adds the keep cases that tell the family check and the hook check apart. Both kernel changes were reproduced in virtme-ng with the modules built as modules, before and after; the details are in each patch. nft_queue.sh passes with all four patches applied. Review of the pull request: https://lore.kernel.org/netfilter-devel/[email protected]/ https://lore.kernel.org/netfilter-devel/[email protected]/ Request for the follow-up: https://lore.kernel.org/netfilter-devel/[email protected]/ Antonio Ojea (4): netfilter: br_netfilter: flush nfqueue entries when the hooks are removed netfilter: conntrack: flush nfqueue entries before waiting for the conntrack count selftests: netfilter: nft_queue.sh: fix the exit status on failure selftests: netfilter: nft_queue.sh: harden test_hook_drop_scope include/net/netfilter/nf_queue.h | 5 +++ net/bridge/br_netfilter_hooks.c | 21 +++++++-- net/netfilter/nf_conntrack_core.c | 7 +++ net/netfilter/nf_internals.h | 3 -- net/netfilter/nft_ct.c | 1 + .../selftests/net/netfilter/nft_queue.sh | 45 +++++++++++++------ 6 files changed, 63 insertions(+), 19 deletions(-) base-commit: 279d5c8afcd38bd841832a39bfe1aa4f8518d98e -- 2.56.0.218.g1ec904b173-goog
