Re: [RFC] nftables 0.9.8 -stable backports

[Jeremy Sowden <jeremy@azazel.net>]

[-- Attachment #1: Type: text/plain, Size: 2674 bytes --]

On 2023-10-10, at 10:54:51 +0200, Pablo Neira Ayuso wrote:
> On Mon, Oct 09, 2023 at 01:36:29PM +0200, Pablo Neira Ayuso wrote:
> > This is a small batch offering fixes for nftables 0.9.8. It only
> > includes the fixes for the implicit chain regression in recent
> > kernels.
> > 
> > This is a few dependency patches that are missing in 0.9.8 are
> > required:
> > 
> >         3542e49cf539 ("evaluate: init cmd pointer for new on-stack context")
> >         a3ac2527724d ("src: split chain list in table")
> >         4e718641397c ("cache: rename chain_htable to cache_chain_ht")
> > 
> > a3ac2527724d is fixing an issue with the cache that is required by the
> > fixes. Then, the backport fixes for the implicit chain regression with
> > Linux -stable:
> > 
> >         3975430b12d9 ("src: expand table command before evaluation")
> >         27c753e4a8d4 ("rule: expand standalone chain that contains rules")
> >         784597a4ed63 ("rule: add helper function to expand chain rules into commands")
> > 
> > I tested with tests/shell at the time of the nftables 0.9.8 release
> > (*I did not use git HEAD tests/shell as I did for 1.0.6*).
> > 
> > I have kept back the backport of this patch intentionally:
> > 
> >         56c90a2dd2eb ("evaluate: expand sets and maps before evaluation")
> > 
> > this depends on the new src/interval.c code, in 0.9.8 overlap and
> > automerge come a later stage and cache is not updated incrementally,
> > I tried the tests coming in this patch and it works fine.
> > 
> > I did run a few more tests with rulesets that I have been collecting
> > from people that occasionally send them to me for my personal ruleset
> > repo.
> > 
> > I: results: [OK] 266 [FAILED] 0 [TOTAL] 266
> > 
> > This has been tested with latest Linux kernel 5.10 -stable.
> 
> Amendment:
> 
> I: results: [OK] 264 [FAILED] 2 [TOTAL] 266
> 
> But this is because stateful expression in sets are not available in 5.10.
> 
> W: [FAILED]     ././testcases/sets/0059set_update_multistmt_0
> W: [FAILED]     ././testcases/sets/0060set_multistmt_0
>
> and tests/shell in 0.9.8 has not feature detection support.

This is very helpful.  Thanks.

My immediate interest is getting the implicit chain regression fixes
into Debian 11, so for that I'm going to cherry-pick:

  4e718641397c ("cache: rename chain_htable to cache_chain_ht")
  a3ac2527724d ("src: split chain list in table")
  784597a4ed63 ("rule: add helper function to expand chain rules into commands")
  27c753e4a8d4 ("rule: expand standalone chain that contains rules")
  3975430b12d9 ("src: expand table command before evaluation")

J.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]