Re: [RFC] nftables 0.9.8 -stable backports

[Jeremy Sowden <jeremy@azazel.net>]

[-- Attachment #1: Type: text/plain, Size: 3256 bytes --]

On 2023-10-11, at 00:21:16 +0200, Pablo Neira Ayuso wrote:
> On Tue, Oct 10, 2023 at 09:08:38PM +0100, Jeremy Sowden wrote:
> > On 2023-10-10, at 10:54:51 +0200, Pablo Neira Ayuso wrote:
> > > On Mon, Oct 09, 2023 at 01:36:29PM +0200, Pablo Neira Ayuso wrote:
> > > > This is a small batch offering fixes for nftables 0.9.8. It only
> > > > includes the fixes for the implicit chain regression in recent
> > > > kernels.
> > > > 
> > > > This is a few dependency patches that are missing in 0.9.8 are
> > > > required:
> > > > 
> > > >         3542e49cf539 ("evaluate: init cmd pointer for new on-stack context")
> > > >         a3ac2527724d ("src: split chain list in table")
> > > >         4e718641397c ("cache: rename chain_htable to cache_chain_ht")
> > > > 
> > > > a3ac2527724d is fixing an issue with the cache that is required by the
> > > > fixes. Then, the backport fixes for the implicit chain regression with
> > > > Linux -stable:
> > > > 
> > > >         3975430b12d9 ("src: expand table command before evaluation")
> > > >         27c753e4a8d4 ("rule: expand standalone chain that contains rules")
> > > >         784597a4ed63 ("rule: add helper function to expand chain rules into commands")
> > > > 
> > > > I tested with tests/shell at the time of the nftables 0.9.8 release
> > > > (*I did not use git HEAD tests/shell as I did for 1.0.6*).
> > > > 
> > > > I have kept back the backport of this patch intentionally:
> > > > 
> > > >         56c90a2dd2eb ("evaluate: expand sets and maps before evaluation")
> > > > 
> > > > this depends on the new src/interval.c code, in 0.9.8 overlap and
> > > > automerge come a later stage and cache is not updated incrementally,
> > > > I tried the tests coming in this patch and it works fine.
> > > > 
> > > > I did run a few more tests with rulesets that I have been collecting
> > > > from people that occasionally send them to me for my personal ruleset
> > > > repo.
> > > > 
> > > > I: results: [OK] 266 [FAILED] 0 [TOTAL] 266
> > > > 
> > > > This has been tested with latest Linux kernel 5.10 -stable.
> > > 
> > > Amendment:
> > > 
> > > I: results: [OK] 264 [FAILED] 2 [TOTAL] 266
> > > 
> > > But this is because stateful expression in sets are not available in 5.10.
> > > 
> > > W: [FAILED]     ././testcases/sets/0059set_update_multistmt_0
> > > W: [FAILED]     ././testcases/sets/0060set_multistmt_0
> > >
> > > and tests/shell in 0.9.8 has not feature detection support.
> > 
> > This is very helpful.  Thanks.
> > 
> > My immediate interest is getting the implicit chain regression fixes
> > into Debian 11, so for that I'm going to cherry-pick:
> > 
> >   4e718641397c ("cache: rename chain_htable to cache_chain_ht")
> >   a3ac2527724d ("src: split chain list in table")
> >   784597a4ed63 ("rule: add helper function to expand chain rules into commands")
> >   27c753e4a8d4 ("rule: expand standalone chain that contains rules")
> >   3975430b12d9 ("src: expand table command before evaluation")
> 
> This is also needed:
> 
>     3542e49cf539 ("evaluate: init cmd pointer for new on-stack context")
> 
> otherwise the test with implicit chain in 0.9.8 crashes, it is a
> dependency patch.

Thanks.

J.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]