All of lore.kernel.org
 help / color / mirror / Atom feed
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Kristian Evensen <kristian.evensen@gmail.com>
Cc: Felix Kaechele <felix@kaechele.ca>,
	Netfilter Development Mailing list 
	<netfilter-devel@vger.kernel.org>
Subject: Re: [PATCH 08/13] netfilter: ctnetlink: Resolve conntrack L3-protocol flush regression
Date: Tue, 25 Jun 2019 21:40:51 +0200	[thread overview]
Message-ID: <20190625194051.vvpczvdubil2kkse@salvia> (raw)
In-Reply-To: <CAKfDRXjun=cVovtn70jxwTc9pa0hhDHUSdZjLHJC1Xw2AMG+rA@mail.gmail.com>

On Tue, Jun 25, 2019 at 01:52:32PM +0200, Kristian Evensen wrote:
> Hi,
> 
> I am sorry for the trouble that my change has caused. I do not know
> what the correct action would be, but I am just trying to figure out
> what is going on. In your first email, you wrote:
> 
> > this patch is giving me some trouble as it breaks deletion of conntrack
> > entries in software that doesn't set the version flag to anything else
> > but 0.
> 
> I might be a bit slow, but I have some trouble understanding this
> sentence. Is what you are saying that software that sets version to
> anything but 0 breaks? According to the discussion triggered by the
> patch adding the feature that we fix here (see the thread [PATCH
> 07/31] netfilter: ctnetlink: Support L3 protocol-filter on flush),
> using the version field is the correct solution. Pablo wrote:
> 
> > The version field was meant to deal with this case.
> >
> > It has been not unused so far because we had no good reason.
> 
> So I guess Nicholas worry was correct, that there are applications
> that leave version uninitialized and they trigger the regression. I
> will let others decide if not setting version counts as a regression
> or incorrect API usage. If an uninitialized version counts as a
> regression, I am fine with reverting and will try to come up with
> another approach. However, I guess we now might have users that depend
> on the new behavior of flush as well.

What kind of application is leaving this uninitialized?

The software you're pointing to is using libnetfilter_conntrack.

  parent reply	other threads:[~2019-06-25 19:40 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-05-13  9:56 [PATCH 00/13] Netfilter fixes for net Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 01/13] netfilter: nf_tables: delay chain policy update until transaction is complete Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 02/13] netfilter: nft_flow_offload: add entry to flowtable after confirmation Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 03/13] netfilter: nf_flow_table: fix netdev refcnt leak Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 04/13] netfilter: nf_flow_table: check ttl value in flow offload data path Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 05/13] netfilter: nf_conntrack_h323: restore boundary check correctness Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 06/13] netfilter: nf_tables: fix base chain stat rcu_dereference usage Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 07/13] netfilter: nf_flow_table: fix missing error check for rhashtable_insert_fast Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 08/13] netfilter: ctnetlink: Resolve conntrack L3-protocol flush regression Pablo Neira Ayuso
2019-06-24  3:44   ` Felix Kaechele
2019-06-24 23:58     ` Pablo Neira Ayuso
2019-06-25  3:02       ` Felix Kaechele
2019-06-25  8:08         ` Pablo Neira Ayuso
2019-06-25 11:33           ` Felix Kaechele
2019-06-25 11:52             ` Kristian Evensen
2019-06-25 14:45               ` Felix Kaechele
2019-06-25 15:08                 ` Kristian Evensen
2019-06-25 16:16                   ` Felix Kaechele
2019-06-25 19:45                     ` Pablo Neira Ayuso
2019-06-25 15:45                 ` Kristian Evensen
2019-06-25 19:40               ` Pablo Neira Ayuso [this message]
2019-06-25 19:41             ` Pablo Neira Ayuso
2019-06-25 15:01       ` Nicolas Dichtel
2019-06-25 19:44         ` Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 09/13] netfilter: nf_conntrack_h323: Remove deprecated config check Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 10/13] netfilter: nf_flow_table: do not flow offload deleted conntrack entries Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 11/13] netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 12/13] netfilter: nf_tables: remove NFT_CT_TIMEOUT Pablo Neira Ayuso
2019-05-13  9:56 ` [PATCH 13/13] netfilter: nf_tables: correct NFT_LOGLEVEL_MAX value Pablo Neira Ayuso
2019-05-13 16:02 ` [PATCH 00/13] Netfilter fixes for net David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190625194051.vvpczvdubil2kkse@salvia \
    --to=pablo@netfilter.org \
    --cc=felix@kaechele.ca \
    --cc=kristian.evensen@gmail.com \
    --cc=netfilter-devel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.