<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:pablo@netfilter.org" title="Pablo Neira Ayuso <pablo@netfilter.org>"> <span class="fn">Pablo Neira Ayuso</span></a>
</span> changed
<a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - Hard lockup when inserting nft rules (esp. ct rule)"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1082">bug 1082</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Status</td>
<td>NEW
</td>
<td>ASSIGNED
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - Hard lockup when inserting nft rules (esp. ct rule)"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1082#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - Hard lockup when inserting nft rules (esp. ct rule)"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1082">bug 1082</a>
from <span class="vcard"><a class="email" href="mailto:pablo@netfilter.org" title="Pablo Neira Ayuso <pablo@netfilter.org>"> <span class="fn">Pablo Neira Ayuso</span></a>
</span></b>
<pre>(In reply to Wang Jian from <a href="show_bug.cgi?id=1082#c0">comment #0</a>)
[...]
<span class="quote">> The ruleset is loaded without problem before we begin to transit vpn links.
> After we transit all links, we want to update the ruleset to add a new open
> IP. But loading the modified ruleset causes this machine hard lockup
> immediately. </span >
What do you mean by loading the "modified ruleset"? So as soon as you invoke
some specific command you experience problems?
<span class="quote">> After quick pinpoints, we are sure:
>
> 1. The unmodified ruleset can cause lockup too
> 2. The lockup is caused by the last "ct state" rule (if commented, no lockup)</span >
This is confusing.
Now you say that the lockup only happens if the last rule using 'reject' is
there?
<span class="quote">> We move most of vpn links to a backup server after work time, which has the
> same hardware and software. Loading ruleset in this backup server doesn't
> cause hard lockup. Loading ruleset in the aforementioned now unloaded server
> doesn't cause hard lockup, either.</span >
I'm getting confused here. So the backup server does not experience any problem
at all with this ruleset?
<span class="quote">> We are sure:
>
> 3. Certain traffic load is a factor for the hard lockup</span >
Please provide more specific information to make sure this is a bug in
nftables, such as backtraces.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>