Re: [PATCH nft 2/2,v2] cache: recycle existing cache with incremental updates

[Phil Sutter <phil@nwl.cc>]

On Mon, Jul 22, 2024 at 11:34:01PM +0200, Pablo Neira Ayuso wrote:
> On Mon, Jul 22, 2024 at 04:48:40PM -0400, Eric Garver wrote:
> > On Tue, May 28, 2024 at 05:28:17PM +0200, Pablo Neira Ayuso wrote:
> > > Cache tracking has improved over time by incrementally adding/deleting
> > > objects when evaluating commands that are going to be sent to the kernel.
> > > 
> > > nft_cache_is_complete() already checks that the cache contains objects
> > > that are required to handle this batch of commands by comparing cache
> > > flags.
> > > 
> > > Infer from the current generation ID if no other transaction has
> > > invalidated the existing cache, this allows to skip unnecessary cache
> > > flush then refill situations which slow down incremental updates.
> > > 
> > > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > > ---
> > > v2: no changes
> > 
> > Hi Pablo,
> > 
> > This patch introduced a regression with the index keyword. It seems to
> > be triggered by adding a rule with "insert", then referencing the new
> > rule with by "add"-ing another rule using index.
> > 
> > https://github.com/firewalld/firewalld/issues/1366#issuecomment-2243772215
> 
> I can reproduce it:
> 
> # nft -i
> nft> add table inet foo
> nft> add chain inet foo bar { type filter hook input priority filter; }
> nft> add rule inet foo bar accept
> nft> insert rule inet foo bar index 0 accept
> nft> add rule inet foo bar index 0 accept
> Error: Could not process rule: No such file or directory
> add rule inet foo bar index 0 accept
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Thanks for providing instructions.

> Cache woes. Maybe a bug in
> 
> commit e5382c0d08e3c6d8246afa95b7380f0d6b8c1826
> Author: Phil Sutter <phil@nwl.cc>
> Date:   Fri Jun 7 19:21:21 2019 +0200

I'll have a look later today.

Cheers, Phil