On Sat, Feb 25, 2017 at 10:02:03PM -0600, Dan Williams wrote: > Checking a rule that includes a jump to a module-based target currently > sets the "changed" flag on the handle, which then causes TC_COMMIT() to > run through the whole SO_SET_REPLACE/SO_SET_ADD_COUNTERS path. This > seems wrong for simply checking rules, an operation which is documented > as "...does not alter the existing iptables configuration..." but yet > it clearly could do so. > > Fix that by ensuring that rule check operations for module targets > don't set the changed flag, and thus exit early from TC_COMMIT().
Thanks for explaining. How are you hitting this problem? I'm curious to see if I can reproduce it. Thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
