Hi Pablo, On Mon, Mar 02, 2020 at 08:26:04PM +0100, Pablo Neira Ayuso wrote: > On Mon, Mar 02, 2020 at 06:53:56PM +0100, Phil Sutter wrote: > > If transaction needed a refresh in nft_action(), restore with flush > > would fetch a full cache instead of merely refreshing table list > > contained in "fake" cache. > > > > To fix this, nft_rebuild_cache() must distinguish between fake cache and > > full rule cache. Therefore introduce NFT_CL_FAKE to be distinguished > > from NFT_CL_RULES. > > Please, refresh me: Why do we need this "fake cache" in first place? In short: It is a middle-ground between needlessly fetching a full cache and hitting ENOENT because we may not delete a table that doesn't exist. Long version: A) Full cache is not needed for iptables-nft-restore without --noflush. It is supposed to drop whatever is there and push the rule set it is fed with. Yet it shall only affect its "own" tables, so simple 'flush ruleset' at start of transaction is not OK. B) Simple 'delete table' at each '*table' line may cause ENOENT if table does not exist, so list of existing tables must be fetched from kernel. Since that may change, the whole nft_rebuild_cache() thing was created. At NFWS we discussed 'create'/'destroy' commands as alternatives to 'add'/'delete' which cause errors if existing/missing and change the latter to not do that. With this in place, iptables-nft-restore could get by without a cache at all. Another option would be to do a sequence of add/delete/add for each table line which works because 'add' command is accepted even if table already exists. Cheers, Phil
