|
 |
f1d1c0 |
From a44bd9f4b6cf77cb75c5f596908100270893e8d5 Mon Sep 17 00:00:00 2001
|
|
|
f1d1c0 |
From: Phil Sutter <psutter@redhat.com>
|
|
|
f1d1c0 |
Date: Fri, 17 Jan 2020 12:50:23 +0100
|
|
|
f1d1c0 |
Subject: [PATCH] cache: Fix for doubled output after reset command
|
|
|
f1d1c0 |
|
|
|
f1d1c0 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1790793
|
|
|
f1d1c0 |
Upstream Status: nftables commit 7def18395d118
|
|
|
f1d1c0 |
|
|
|
f1d1c0 |
commit 7def18395d118e22a009de7e2e8de7f77906580b
|
|
|
f1d1c0 |
Author: Phil Sutter <phil@nwl.cc>
|
|
|
f1d1c0 |
Date: Tue Jan 14 17:25:35 2020 +0100
|
|
|
f1d1c0 |
|
|
|
f1d1c0 |
cache: Fix for doubled output after reset command
|
|
|
f1d1c0 |
|
|
|
f1d1c0 |
Reset command causes a dump of the objects to reset and adds those to
|
|
|
f1d1c0 |
cache. Yet it ignored if the object in question was already there and up
|
|
|
f1d1c0 |
to now CMD_RESET was flagged as NFT_CACHE_FULL.
|
|
|
f1d1c0 |
|
|
|
f1d1c0 |
Tackle this from two angles: First, reduce cache requirements of reset
|
|
|
f1d1c0 |
command to the necessary bits which is table cache. This alone would
|
|
|
f1d1c0 |
suffice if there wasn't interactive mode (and other libnftables users):
|
|
|
f1d1c0 |
A cache containing the objects to reset might be in place already, so
|
|
|
f1d1c0 |
add dumped objects to cache only if they don't exist already.
|
|
|
f1d1c0 |
|
|
|
f1d1c0 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
f1d1c0 |
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
f1d1c0 |
---
|
|
|
f1d1c0 |
src/cache.c | 4 +++-
|
|
|
f1d1c0 |
src/rule.c | 3 ++-
|
|
|
f1d1c0 |
tests/shell/testcases/sets/0024named_objects_0 | 12 +++++++++++-
|
|
|
f1d1c0 |
3 files changed, 16 insertions(+), 3 deletions(-)
|
|
|
f1d1c0 |
|
|
|
f1d1c0 |
diff --git a/src/cache.c b/src/cache.c
|
|
|
f1d1c0 |
index 0c28a28..05f0d68 100644
|
|
|
f1d1c0 |
--- a/src/cache.c
|
|
|
f1d1c0 |
+++ b/src/cache.c
|
|
|
f1d1c0 |
@@ -138,8 +138,10 @@ unsigned int cache_evaluate(struct nft_ctx *nft, struct list_head *cmds)
|
|
|
f1d1c0 |
case CMD_GET:
|
|
|
f1d1c0 |
flags = evaluate_cache_get(cmd, flags);
|
|
|
f1d1c0 |
break;
|
|
|
f1d1c0 |
- case CMD_LIST:
|
|
|
f1d1c0 |
case CMD_RESET:
|
|
|
f1d1c0 |
+ flags |= NFT_CACHE_TABLE;
|
|
|
f1d1c0 |
+ break;
|
|
|
f1d1c0 |
+ case CMD_LIST:
|
|
|
f1d1c0 |
case CMD_EXPORT:
|
|
|
f1d1c0 |
case CMD_MONITOR:
|
|
|
f1d1c0 |
flags |= NFT_CACHE_FULL;
|
|
|
f1d1c0 |
diff --git a/src/rule.c b/src/rule.c
|
|
|
f1d1c0 |
index d985d3a..3ca1805 100644
|
|
|
f1d1c0 |
--- a/src/rule.c
|
|
|
f1d1c0 |
+++ b/src/rule.c
|
|
|
f1d1c0 |
@@ -2554,7 +2554,8 @@ static int do_command_reset(struct netlink_ctx *ctx, struct cmd *cmd)
|
|
|
f1d1c0 |
ret = netlink_reset_objs(ctx, cmd, type, dump);
|
|
|
f1d1c0 |
list_for_each_entry_safe(obj, next, &ctx->list, list) {
|
|
|
f1d1c0 |
table = table_lookup(&obj->handle, &ctx->nft->cache);
|
|
|
f1d1c0 |
- list_move(&obj->list, &table->objs);
|
|
|
f1d1c0 |
+ if (!obj_lookup(table, obj->handle.obj.name, obj->type))
|
|
|
f1d1c0 |
+ list_move(&obj->list, &table->objs);
|
|
|
f1d1c0 |
}
|
|
|
f1d1c0 |
if (ret < 0)
|
|
|
f1d1c0 |
return ret;
|
|
|
f1d1c0 |
diff --git a/tests/shell/testcases/sets/0024named_objects_0 b/tests/shell/testcases/sets/0024named_objects_0
|
|
|
f1d1c0 |
index 3bd16f2..21200c3 100755
|
|
|
f1d1c0 |
--- a/tests/shell/testcases/sets/0024named_objects_0
|
|
|
f1d1c0 |
+++ b/tests/shell/testcases/sets/0024named_objects_0
|
|
|
f1d1c0 |
@@ -35,4 +35,14 @@ table inet x {
|
|
|
f1d1c0 |
set -e
|
|
|
f1d1c0 |
$NFT -f - <<< "$RULESET"
|
|
|
f1d1c0 |
|
|
|
f1d1c0 |
-$NFT reset counter inet x user321
|
|
|
f1d1c0 |
+EXPECTED="table inet x {
|
|
|
f1d1c0 |
+ counter user321 {
|
|
|
f1d1c0 |
+ packets 12 bytes 1433
|
|
|
f1d1c0 |
+ }
|
|
|
f1d1c0 |
+}"
|
|
|
f1d1c0 |
+
|
|
|
f1d1c0 |
+GET="$($NFT reset counter inet x user321)"
|
|
|
f1d1c0 |
+if [ "$EXPECTED" != "$GET" ] ; then
|
|
|
f1d1c0 |
+ $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
|
|
|
f1d1c0 |
+ exit 1
|
|
|
f1d1c0 |
+fi
|
|
|
f1d1c0 |
--
|
|
|
f1d1c0 |
1.8.3.1
|
|
|
f1d1c0 |
|