Re: [PATCH v5 1/2] netfilter: nf_tables: Implement jump limit for nft_table_validate

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Jul 22, 2025 at 04:11:36AM +0200, Pablo Neira Ayuso wrote:
> 
> This function is called from abort path too. I suspect total_jump_count
> for this table will not be OK in such case. And this selftest does cover
> many cases.
> 

Your suspicion was correct.  It took a bit to run over the abort path
that used validation (I think it would just be userland sending abort),
but it looked like it updated the total before the roll back.

My solution was to send in the abort state, and when
action != NFNL_ABORT_VALIDATE, we don't update the totals.

Another alternative would be to just run validate again at the end of
the abort (after the rollback), but that seemed wrong to do the costly
validate twice.

See v6 patch (just sent) that also addresses your other feedback.



Thanks!


SB




[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux