No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Florian Westphal ae6153b50f netfilter: nf_tables: permit second nat hook if colliding hook is going away
Sergei Trofimovich reported that restoring an nft ruleset doesn't work
anymore unless old rule content is flushed first.

The problem stems from a recent change designed to prevent multiple nat
hooks at the same hook point locations and nftables transaction model.

A 'flush ruleset' won't take effect until the entire transaction has
completed.

So, if one has a nft.rules file that contains a 'flush ruleset',
followed by a nat hook register request, then 'nft -f file' will work,
but running 'nft -f file' again will fail with -EBUSY.

Reason is that nftables will place the flush/removal requests in the
transaction list, but it will not act on the removal until after all new
rules are in place.

The netfilter core will therefore get request to register a new nat
hook before the old one is removed -- this now fails as the netfilter
core can't know the existing hook is staged for removal.

To fix this, we can search the transaction log when a hook collision
is detected.  The collision is okay if

 1. there is a delete request pending for the nat hook that is already
    registered.
 2. there is no second add request for a matching nat hook.
    This is required to only apply the exception once.

Fixes: f92b40a8b2 ("netfilter: core: only allow one nat hook per hook point")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2018-03-20 13:55:03 +01:00
arch Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 2018-03-07 20:27:51 -05:00
block for-linus-20180302 2018-03-02 09:35:36 -08:00
certs
crypto
Documentation net: dsa: mv88e6xxx: Fix binding documentation for MDIO busses 2018-03-16 15:01:34 -04:00
drivers net: phy: relax error checking when creating sysfs link netdev->phydev 2018-03-19 21:14:27 -04:00
firmware
fs sysfs: symlink: export sysfs_create_link_nowarn() 2018-03-19 21:14:26 -04:00
include vlan: Fix out of order vlan headers with reorder header off 2018-03-16 10:03:47 -04:00
init
ipc
kernel Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-03-05 11:29:24 -08:00
lib test_rhashtable: add test case for rhltable with duplicate objects 2018-03-07 10:44:03 -05:00
LICENSES
mm
net netfilter: nf_tables: permit second nat hook if colliding hook is going away 2018-03-20 13:55:03 +01:00
samples
scripts Kbuild fixes for v4.16 2018-03-03 10:37:01 -08:00
security
sound
tools Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 2018-03-07 20:27:51 -05:00
usr
virt
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS Kbuild fixes for v4.16 2018-03-03 10:37:01 -08:00
Makefile Linux 4.16-rc4 2018-03-04 14:54:11 -08:00
README

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.