Re: [PATCH nf] netfilter: nf_tables: return immediately on empty commit

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Florian,

On Thu, Mar 07, 2019 at 11:20:11PM +0100, Florian Westphal wrote:
> When running 'nft flush ruleset' while no rules exist, we will increment
> the generation counter and announce a new genid to userspace, yet
> nothing had changed in the first place.
> 
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  net/netfilter/nf_tables_api.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index dcd9cb68d826..1904e081853c 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -6536,6 +6536,11 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
>  	struct nft_chain *chain;
>  	struct nft_table *table;
>  
> +	if (list_empty(&net->nft.commit_list)) {
> +		mutex_unlock(&net->nft.commit_mutex);
> +		return 0;
> +	}

This looks good to catch this case.

I think we should probably address these too:

term1# nft add table x
term1# nft add table x

term2# nft monitor
add table ip x
# new generation 1587 by process 14422 (nft)
# new generation 1588 by process 14423 (nft)

So re-insertion of existing objects should not trigger unnecessary
generation counter bump. We can probably count the number of events
that have been sent from the commit path before we bump it.