On Fri, Feb 15, 2019 at 03:33:02PM +0100, Pablo Neira Ayuso wrote:
> On Fri, Feb 15, 2019 at 02:15:37PM +0100, Phil Sutter wrote:
> > Hi,
> >
> > On Fri, Feb 15, 2019 at 10:50:42AM +0100, Pablo Neira Ayuso wrote:
> > [...]
> > > > From the flush path, we can skip requests for deletion of rules that
> > > > have been already deleted, ie. we add no transaction since there is
> > > > already one in place.
> >
> > Thanks for the quick fix!
> >
> > > nft_delrule_by_chain() is always called from flush path. We can apply
> > > this smaller fix I think.
> >
> > > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> > > index 5a92f23f179f..4893f248dfdc 100644
> > > --- a/net/netfilter/nf_tables_api.c
> > > +++ b/net/netfilter/nf_tables_api.c
> > > @@ -313,6 +313,9 @@ static int nft_delrule_by_chain(struct nft_ctx *ctx)
> > > int err;
> > >
> > > list_for_each_entry(rule, &ctx->chain->rules, list) {
> > > + if (!nft_is_active_next(ctx->net, rule))
> > > + continue;
> > > +
> > > err = nft_delrule(ctx, rule);
> > > if (err < 0)
> > > return err;
> >
> > Successfully tested with my ebtables-nft bug:
> >
> > | # ebtables-nft -N foo
> > | # ebtables-nft -F
> >
> > (Batch then contains policy rule delete and chain flush.)
> >
> > Acked-by: Phil Sutter <[email protected]>
>
> OK, I have pushed this out to nf.git.
Nice, thanks! If this has soaked into stable for a while, we may drop
nft_abort_policy_rule() again, I guess. :)
Cheers, Phil
