Re: [nf_tables] rbtree interval set: in one batch, re-adding element E0 makes deleting an unrelated interval E1 fail with -ENOENT

Pablo Neira Ayuso <[email protected]>
Newsgroups gmane.linux.network,gmane.comp.security.firewalls.netfilter.devel
Message-ID <antTASZYV9q81Ucc@chamomile>
On Tue, Aug 11, 2026 at 05:22:01PM +0800, Wei Fang wrote:
[...]
> Problem
> -------
> On an interval set that already contains two intervals, one batch
> that does both of the following fails on the second operation:
> 
> 1. re-add element E0 without NLM_F_EXCL (update semantics);
> 2. delete a different interval E1.
> 
> The delete returns -ENOENT.  Sending the same two operations in
> separate messages succeeds.  A transaction must not change what an
> operation does: batched and unbatched execution must behave the same.
> 
> Steps to reproduce
> ------------------
> One batch on an ipv4_addr INTERVAL set with two existing intervals:
> 
> 1. re-add E0 = [10.0.1.0..10.0.2.0) without NLM_F_EXCL;
> 2. delete E1 = [10.0.2.0..10.0.3.0).
> 
> Raw netlink is required: the nft CLI re-sorts interval elements and
> hides the ordering.

What do you mean by "hides the ordering"? It sounds negative, actually
what is does is to pass a list of elements to the kernel that make
sense when interpreting the interval?

Ordering is paramount in this loose interface, your program does:

        ...
        put_interval_elem(&q, 0, E1_END, 1);
        put_interval_elem(&q, 1, E1, 0);

Deleting E1_END element before E1, makes no sense, the interval
representation is reversed.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.