netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Eric Garver <eric@garver.life>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH nft] tests: shell: check that rule add with index works with echo
Date: Thu, 5 Sep 2019 17:54:18 +0200	[thread overview]
Message-ID: <20190905155418.z2lpiet466ceixjy@salvia> (raw)
In-Reply-To: <20190903232713.14394-1-eric@garver.life>

On Tue, Sep 03, 2019 at 07:27:13PM -0400, Eric Garver wrote:
> If --echo is used the rule cache will not be populated. This causes
> rules added using the "index" keyword to be simply appended to the
> chain. The bug was introduced in commit 3ab02db5f836 ("cache: add
> NFT_CACHE_UPDATE and NFT_CACHE_FLUSHED flags").
> 
> Signed-off-by: Eric Garver <eric@garver.life>
> ---
> I think the issue is in cache_evaluate(). It sets the flags to
> NFT_CACHE_FULL and then bails early, but I'm not sure of the best way to
> fix it. So I'll start by submitting a test case. :)
> ---
>  tests/shell/testcases/cache/0007_echo_cache_init_0 | 14 ++++++++++++++
>  .../cache/dumps/0007_echo_cache_init_0.nft         |  7 +++++++
>  2 files changed, 21 insertions(+)
>  create mode 100755 tests/shell/testcases/cache/0007_echo_cache_init_0
>  create mode 100644 tests/shell/testcases/cache/dumps/0007_echo_cache_init_0.nft
> 
> diff --git a/tests/shell/testcases/cache/0007_echo_cache_init_0 b/tests/shell/testcases/cache/0007_echo_cache_init_0
> new file mode 100755
> index 000000000000..280a0d06bdc3
> --- /dev/null
> +++ b/tests/shell/testcases/cache/0007_echo_cache_init_0
> @@ -0,0 +1,14 @@
> +#!/bin/bash
> +
> +set -e
> +
> +$NFT -i >/dev/null <<EOF
> +add table inet t
> +add chain inet t c
> +add rule inet t c accept comment "first"
> +add rule inet t c accept comment "third"
> +EOF
> +
> +# make sure the rule cache gets initialized when using echo option
> +#
> +$NFT --echo add rule inet t c index 0 accept comment '"second"' >/dev/null

Looks like the problem is index == 0?

                if (cmd->handle.index.id ||
                    cmd->handle.position.id)
                        flags |= NFT_CACHE_RULE | NFT_CACHE_UPDATE;

We might need to set up a flag, eg. cmd->handle.flags &
NFT_HANDLE_INDEX, similarly with position, given that index.id can be
zero. Alternatively, initialize index id to -1, assuming we'll never
get to ~0U index.

  parent reply	other threads:[~2019-09-05 15:54 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-09-03 23:27 [PATCH nft] tests: shell: check that rule add with index works with echo Eric Garver
2019-09-04  8:13 ` Phil Sutter
2019-09-04 19:17   ` Pablo Neira Ayuso
2019-09-04 19:31     ` Pablo Neira Ayuso
2019-09-05 15:54 ` Pablo Neira Ayuso [this message]
2019-09-05 16:13   ` Eric Garver
2019-09-05 17:25     ` Pablo Neira Ayuso

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190905155418.z2lpiet466ceixjy@salvia \
    --to=pablo@netfilter.org \
    --cc=eric@garver.life \
    --cc=netfilter-devel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).