Skip to content

network, core: revert NFTSet and NetLabel features#23774

Merged
yuwata merged 2 commits intosystemd:mainfrom
yuwata:netlabel-nftset-follow-ups
Jun 22, 2022
Merged

network, core: revert NFTSet and NetLabel features#23774
yuwata merged 2 commits intosystemd:mainfrom
yuwata:netlabel-nftset-follow-ups

Conversation

@yuwata
Copy link
Copy Markdown
Member

@yuwata yuwata commented Jun 17, 2022

Unfortunately, NetLabel and NFTSet features are merged without final approval.

NFTSet feature has several major design issues.

  • It calls netlink method synchronously. Especially in system manager, it should be called asynchronously.
  • The conf parser has many issues, as already reported by oss-fuzz.

Let's re-introduce these features carefully in later another PRs.

Fixes #23711.
Fixes #23717.
Fixes #23719.
Fixes #23720.
Fixes #23721.
Fixes #23759.

Closes #23676.

@yuwata yuwata force-pushed the netlabel-nftset-follow-ups branch 2 times, most recently from fa3cfe1 to bf0a503 Compare June 18, 2022 06:26
@keszybz
Copy link
Copy Markdown
Member

keszybz commented Jun 21, 2022

Is this ready for review?

yuwata added 2 commits June 22, 2022 22:23
This reverts PR systemd#22587 and its follow-up commit. More specifically,
2299b1c (partially),
e176f85,
ceb46a3, and
51bb907.

The PR was merged without final approval, and has several issues:
- OSS fuzz reported issues in the conf parser,
- It calls synchrnous netlink call, it should not be especially in PID1,
- The importance of NFTSet for CGroup and DynamicUser may be
  questionable, at least, there was no justification PID1 should support
  it.
- For networkd, it should be implemented with Request object,
- There is no test for the feature.

Fixes systemd#23711.
Fixes systemd#23717.
Fixes systemd#23719.
Fixes systemd#23720.
Fixes systemd#23721.
Fixes systemd#23759.
This reverts PR systemd#23269 and its follow-up commit. Especially,
2299b1c (partially), and
3cf6383.

The PR was merged without final approval, and has several issues:
- The NetLabel for static addresses are not assigned, as labels are
  stored in the Address objects managed by Network, instead of Link.
- If NetLabel is specified for a static address, then the address
  section will be invalid and the address will not be configured,
- It should be implemented with Request object,
- There is no test about the feature.
@yuwata yuwata force-pushed the netlabel-nftset-follow-ups branch from bf0a503 to a32badc Compare June 22, 2022 13:36
@yuwata yuwata changed the title network, core: revert NFTSet feature and follow-ups for NetLabel network, core: revert NFTSet and NetLabel features Jun 22, 2022
@yuwata yuwata marked this pull request as ready for review June 22, 2022 13:40
@yuwata
Copy link
Copy Markdown
Member Author

yuwata commented Jun 22, 2022

@keszybz I've decided that, at least tentatively, we should revert both PRs. And I will open PR for cleaning up nfnl later. Hopefully, this should not conflict your PR.

@topimiettinen Sorry for the decision, but please re-submit PRs about the features. Please read the commit messages what issues exist in the PRs.

@keszybz
Copy link
Copy Markdown
Member

keszybz commented Jun 22, 2022

Agreed. Let's merge this when tests pass.

@keszybz keszybz added the good-to-merge/waiting-for-ci 👍 PR is good to merge, but CI hasn't passed at time of review. Please merge if you see CI has passed label Jun 22, 2022
@yuwata yuwata merged commit 4635567 into systemd:main Jun 22, 2022
@yuwata yuwata deleted the netlabel-nftset-follow-ups branch June 22, 2022 16:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

good-to-merge/waiting-for-ci 👍 PR is good to merge, but CI hasn't passed at time of review. Please merge if you see CI has passed network pid1 sd-netlink

Development

Successfully merging this pull request may close these issues.

OSS-Fuzz issue 47984 OSS-Fuzz issue 47977 OSS-Fuzz issue 47973 OSS-Fuzz issue 47963 re-review #22587 and #23269

2 participants