Re: [PATCH nft 2/2,v2] cache: recycle existing cache with incremental updates

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Jul 22, 2024 at 04:48:40PM -0400, Eric Garver wrote:
> On Tue, May 28, 2024 at 05:28:17PM +0200, Pablo Neira Ayuso wrote:
> > Cache tracking has improved over time by incrementally adding/deleting
> > objects when evaluating commands that are going to be sent to the kernel.
> > 
> > nft_cache_is_complete() already checks that the cache contains objects
> > that are required to handle this batch of commands by comparing cache
> > flags.
> > 
> > Infer from the current generation ID if no other transaction has
> > invalidated the existing cache, this allows to skip unnecessary cache
> > flush then refill situations which slow down incremental updates.
> > 
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
> > v2: no changes
> 
> Hi Pablo,
> 
> This patch introduced a regression with the index keyword. It seems to
> be triggered by adding a rule with "insert", then referencing the new
> rule with by "add"-ing another rule using index.
> 
> https://github.com/firewalld/firewalld/issues/1366#issuecomment-2243772215

I can reproduce it:

# nft -i
nft> add table inet foo
nft> add chain inet foo bar { type filter hook input priority filter; }
nft> add rule inet foo bar accept
nft> insert rule inet foo bar index 0 accept
nft> add rule inet foo bar index 0 accept
Error: Could not process rule: No such file or directory
add rule inet foo bar index 0 accept
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Cache woes. Maybe a bug in

commit e5382c0d08e3c6d8246afa95b7380f0d6b8c1826
Author: Phil Sutter <phil@nwl.cc>
Date:   Fri Jun 7 19:21:21 2019 +0200

    src: Support intra-transaction rule references

that uncover now that cache is not flushed and sync with kernel so often?