On Tue, Oct 10, 2023 at 09:08:38PM +0100, Jeremy Sowden wrote:
> On 2023-10-10, at 10:54:51 +0200, Pablo Neira Ayuso wrote:
> > On Mon, Oct 09, 2023 at 01:36:29PM +0200, Pablo Neira Ayuso wrote:
> > > This is a small batch offering fixes for nftables 0.9.8. It only
> > > includes the fixes for the implicit chain regression in recent
> > > kernels.
> > >
> > > This is a few dependency patches that are missing in 0.9.8 are
> > > required:
> > >
> > > 3542e49cf539 ("evaluate: init cmd pointer for new on-stack context")
> > > a3ac2527724d ("src: split chain list in table")
> > > 4e718641397c ("cache: rename chain_htable to cache_chain_ht")
> > >
> > > a3ac2527724d is fixing an issue with the cache that is required by the
> > > fixes. Then, the backport fixes for the implicit chain regression with
> > > Linux -stable:
> > >
> > > 3975430b12d9 ("src: expand table command before evaluation")
> > > 27c753e4a8d4 ("rule: expand standalone chain that contains rules")
> > > 784597a4ed63 ("rule: add helper function to expand chain rules into commands")
> > >
> > > I tested with tests/shell at the time of the nftables 0.9.8 release
> > > (*I did not use git HEAD tests/shell as I did for 1.0.6*).
> > >
> > > I have kept back the backport of this patch intentionally:
> > >
> > > 56c90a2dd2eb ("evaluate: expand sets and maps before evaluation")
> > >
> > > this depends on the new src/interval.c code, in 0.9.8 overlap and
> > > automerge come a later stage and cache is not updated incrementally,
> > > I tried the tests coming in this patch and it works fine.
> > >
> > > I did run a few more tests with rulesets that I have been collecting
> > > from people that occasionally send them to me for my personal ruleset
> > > repo.
> > >
> > > I: results: [OK] 266 [FAILED] 0 [TOTAL] 266
> > >
> > > This has been tested with latest Linux kernel 5.10 -stable.
> >
> > Amendment:
> >
> > I: results: [OK] 264 [FAILED] 2 [TOTAL] 266
> >
> > But this is because stateful expression in sets are not available in 5.10.
> >
> > W: [FAILED] ././testcases/sets/0059set_update_multistmt_0
> > W: [FAILED] ././testcases/sets/0060set_multistmt_0
> >
> > and tests/shell in 0.9.8 has not feature detection support.
>
> This is very helpful. Thanks.
>
> My immediate interest is getting the implicit chain regression fixes
> into Debian 11, so for that I'm going to cherry-pick:
>
> 4e718641397c ("cache: rename chain_htable to cache_chain_ht")
> a3ac2527724d ("src: split chain list in table")
> 784597a4ed63 ("rule: add helper function to expand chain rules into commands")
> 27c753e4a8d4 ("rule: expand standalone chain that contains rules")
> 3975430b12d9 ("src: expand table command before evaluation")
This is also needed:
3542e49cf539 ("evaluate: init cmd pointer for new on-stack context")
otherwise the test with implicit chain in 0.9.8 crashes, it is a
dependency patch.
