From: Florian Westphal <fw@strlen.de>
To: Antonio Ojea <aojea@google.com>
Cc: netfilter-devel@vger.kernel.org, Pablo Neira Ayuso <pablo@netfilter.org>
Subject: Re: [PATCH nf-next 1/2] netfilter: nf_queue: limit the hook drop flush to the unregistered hook point
Date: Mon, 28 Sep 2026 16:11:05 +0200 [thread overview]
Message-ID: <arp1eSHB_m2cFy6n@strlen.de> (raw)
In-Reply-To: <20260926100351.2987307-1-aojea@google.com>
Antonio Ojea <aojea@google.com> wrote:
> Unregistering a netfilter hook calls nf_queue_nf_hook_drop(), which makes
> nfqnl_nf_hook_drop() walk every nfqueue instance of the network namespace
> and flush it, reinjecting every packet that waits for a verdict with
> NF_DROP. Deleting an nftables base chain of any table, family and hook
> point therefore drops the packets queued by hooks of unrelated tables,
> families and hook points. The verdict that userspace sends for them
> afterwards fails with -ENOENT.
Looks good, but please rebase on top of current nf-next, as-is this
patch doesn't compile (there is another nfqnl_nf_hook_drop() call that
needs to be converted to 2-args scheme.
2nd patch doesn't apply cleanly.
next prev parent reply other threads:[~2026-09-28 14:11 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-25 12:58 nf_queue: hook changes drop or re-queue packets waiting in any nfqueue Antonio Ojea
2026-09-25 14:09 ` Florian Westphal
2026-09-26 10:03 ` [PATCH nf-next 1/2] netfilter: nf_queue: limit the hook drop flush to the unregistered hook point Antonio Ojea
2026-09-28 14:11 ` Florian Westphal [this message]
2026-09-26 10:03 ` [PATCH nf-next 2/2] selftests: netfilter: nft_queue: check the scope of the hook drop flush Antonio Ojea
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=arp1eSHB_m2cFy6n@strlen.de \
--to=fw@strlen.de \
--cc=aojea@google.com \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.