[prev in list] [next in list] [prev in thread] [next in thread] 

List:       netfilter-devel
Subject:    Re: [iptables PATCH v2 04/24] nft: Fix for add and delete of same rule in single batch
From:       Pablo Neira Ayuso <pablo () netfilter ! org>
Date:       2019-09-30 16:36:54
Message-ID: 20190930163654.fdvjkbnxizxjohcc () salvia
[Download RAW message or body]

On Fri, Sep 27, 2019 at 04:20:27PM +0200, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > Another corner-case found when extending restore ordering test: If a
> > delete command in a dump referenced a rule added earlier within the same
> > dump, kernel would reject the resulting NFT_MSG_DELRULE command.
> > 
> > Catch this by assigning the rule to delete a RULE_ID value if it doesn't
> > have a handle yet. Since __nft_rule_del() does not duplicate the
> > nftnl_rule object when creating the NFT_COMPAT_RULE_DELETE command, this
> > RULE_ID value is added to both NEWRULE and DELRULE commands - exactly
> > what is needed to establish the reference.
> 
> Acked-by: Florian Westphal <fw@strlen.de>

Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
[prev in list] [next in list] [prev in thread] [next in thread]