diff mbox series

[nft] cache: revisit reset command flags

Message ID 20240815153519.1589974-1-pablo@netfilter.org
State Changes Requested
Headers show
Series [nft] cache: revisit reset command flags | expand

Commit Message

Pablo Neira Ayuso Aug. 15, 2024, 3:35 p.m. UTC 
- reset rules => fetch full cache, rules can refer to objects
- reset counter,quota => fetch only table and objects

... otherwise, default to cache full fetch, which is slow but safe.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1763
Fixes: 1694df2de79f ("Implement 'reset rule' and 'reset rules' commands")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
I plan to send v2 to extend tests.

A few more comments:

- nft reset ruleset seems to be missing?
- nft reset rules lists the entire ruleset, i guess this expected
  nft reset counters comes with memleak, ASAN reports

 src/cache.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)
diff mbox series

Patch

diff --git a/src/cache.c b/src/cache.c
index 233147649263..d91e4b682e1f 100644
--- a/src/cache.c
+++ b/src/cache.c
@@ -278,16 +278,21 @@  static unsigned int evaluate_cache_reset(struct cmd *cmd, unsigned int flags,
 			if (cmd->handle.chain.name)
 				filter->list.chain = cmd->handle.chain.name;
 		}
-		flags |= NFT_CACHE_SET | NFT_CACHE_FLOWTABLE |
-			 NFT_CACHE_OBJECT | NFT_CACHE_CHAIN;
+		flags |= NFT_CACHE_FULL;
+		break;
+	case CMD_OBJ_COUNTER:
+	case CMD_OBJ_COUNTERS:
+	case CMD_OBJ_QUOTA:
+	case CMD_OBJ_QUOTAS:
+		flags |= NFT_CACHE_TABLE | NFT_CACHE_OBJECT;
 		break;
 	case CMD_OBJ_ELEMENTS:
 	case CMD_OBJ_SET:
 	case CMD_OBJ_MAP:
-		flags |= NFT_CACHE_SET;
+		flags |= NFT_CACHE_SETELEM | NFT_CACHE_CHAIN | NFT_CACHE_OBJECT;
 		break;
 	default:
-		flags |= NFT_CACHE_TABLE;
+		flags |= NFT_CACHE_FULL;
 		break;
 	}
 	flags |= NFT_CACHE_REFRESH;