Revert NFTSet feature
This reverts PR #22587 and its follow-up commit. More specifically,
2299b1cae3 (partially),
e176f855278d5098d3fecc5aa24ba702147d42e0,
ceb46a31a01b3d3d1d6095d857e29ea214a2776b, and
51bb9076ab8c050bebb64db5035852385accda35.
The PR was merged without final approval, and has several issues:
- OSS fuzz reported issues in the conf parser,
- It calls synchrnous netlink call, it should not be especially in PID1,
- The importance of NFTSet for CGroup and DynamicUser may be
questionable, at least, there was no justification PID1 should support
it.
- For networkd, it should be implemented with Request object,
- There is no test for the feature.
Fixes #23711.
Fixes #23717.
Fixes #23719.
Fixes #23720.
Fixes #23721.
Fixes #23759.
This commit is contained in:
@@ -750,38 +750,3 @@ int parse_loadavg_fixed_point(const char *s, loadavg_t *ret) {
|
||||
|
||||
return store_loadavg_fixed_point(i, f, ret);
|
||||
}
|
||||
|
||||
static bool nft_first_char_bad(const char c) {
|
||||
if ((c >= 'a' && c <= 'z') ||
|
||||
(c >= 'A' && c <= 'Z'))
|
||||
return false;
|
||||
return true;
|
||||
}
|
||||
|
||||
static bool nft_next_char_bad(const char c) {
|
||||
if ((c >= 'a' && c <= 'z') ||
|
||||
(c >= 'A' && c <= 'Z') ||
|
||||
(c >= '0' && c <= '9') ||
|
||||
c == '/' || c == '\\' || c == '_' || c == '.')
|
||||
return false;
|
||||
return true;
|
||||
}
|
||||
|
||||
/* Limitations are described in https://www.netfilter.org/projects/nftables/manpage.html and
|
||||
* https://bugzilla.netfilter.org/show_bug.cgi?id=1175 */
|
||||
bool nft_identifier_bad(const char *id) {
|
||||
assert(id);
|
||||
|
||||
size_t len;
|
||||
len = strlen(id);
|
||||
if (len == 0 || len > 31)
|
||||
return true;
|
||||
|
||||
if (nft_first_char_bad(id[0]))
|
||||
return true;
|
||||
|
||||
for (size_t i = 1; i < len; i++)
|
||||
if (nft_next_char_bad(id[i]))
|
||||
return true;
|
||||
return false;
|
||||
}
|
||||
|
||||
@@ -146,5 +146,3 @@ int parse_oom_score_adjust(const char *s, int *ret);
|
||||
* to a loadavg_t. */
|
||||
int store_loadavg_fixed_point(unsigned long i, unsigned long f, loadavg_t *ret);
|
||||
int parse_loadavg_fixed_point(const char *s, loadavg_t *ret);
|
||||
|
||||
bool nft_identifier_bad(const char *id);
|
||||
|
||||
Reference in New Issue
Block a user