On Wed, Oct 11, 2023 at 10:46:13AM +0100, Jeremy Sowden wrote:
> On 2023-10-11, at 00:21:16 +0200, Pablo Neira Ayuso wrote:
> > On Tue, Oct 10, 2023 at 09:08:38PM +0100, Jeremy Sowden wrote:
> > > On 2023-10-10, at 10:54:51 +0200, Pablo Neira Ayuso wrote:
> > > > On Mon, Oct 09, 2023 at 01:36:29PM +0200, Pablo Neira Ayuso wrote:
> > > > > This is a small batch offering fixes for nftables 0.9.8. It only
> > > > > includes the fixes for the implicit chain regression in recent
> > > > > kernels.
> > > > >
> > > > > This is a few dependency patches that are missing in 0.9.8 are
> > > > > required:
> > > > >
> > > > > 3542e49cf539 ("evaluate: init cmd pointer for new on-stack context")
> > > > > a3ac2527724d ("src: split chain list in table")
> > > > > 4e718641397c ("cache: rename chain_htable to cache_chain_ht")
> > > > >
> > > > > a3ac2527724d is fixing an issue with the cache that is required by the
> > > > > fixes. Then, the backport fixes for the implicit chain regression with
> > > > > Linux -stable:
> > > > >
> > > > > 3975430b12d9 ("src: expand table command before evaluation")
> > > > > 27c753e4a8d4 ("rule: expand standalone chain that contains rules")
> > > > > 784597a4ed63 ("rule: add helper function to expand chain rules into commands")
> > > > >
> > > > > I tested with tests/shell at the time of the nftables 0.9.8 release
> > > > > (*I did not use git HEAD tests/shell as I did for 1.0.6*).
> > > > >
> > > > > I have kept back the backport of this patch intentionally:
> > > > >
> > > > > 56c90a2dd2eb ("evaluate: expand sets and maps before evaluation")
> > > > >
> > > > > this depends on the new src/interval.c code, in 0.9.8 overlap and
> > > > > automerge come a later stage and cache is not updated incrementally,
> > > > > I tried the tests coming in this patch and it works fine.
> > > > >
> > > > > I did run a few more tests with rulesets that I have been collecting
> > > > > from people that occasionally send them to me for my personal ruleset
> > > > > repo.
> > > > >
> > > > > I: results: [OK] 266 [FAILED] 0 [TOTAL] 266
> > > > >
> > > > > This has been tested with latest Linux kernel 5.10 -stable.
> > > >
> > > > Amendment:
> > > >
> > > > I: results: [OK] 264 [FAILED] 2 [TOTAL] 266
> > > >
> > > > But this is because stateful expression in sets are not available in 5.10.
> > > >
> > > > W: [FAILED] ././testcases/sets/0059set_update_multistmt_0
> > > > W: [FAILED] ././testcases/sets/0060set_multistmt_0
> > > >
> > > > and tests/shell in 0.9.8 has not feature detection support.
> > >
> > > This is very helpful. Thanks.
> > >
> > > My immediate interest is getting the implicit chain regression fixes
> > > into Debian 11, so for that I'm going to cherry-pick:
> > >
> > > 4e718641397c ("cache: rename chain_htable to cache_chain_ht")
> > > a3ac2527724d ("src: split chain list in table")
> > > 784597a4ed63 ("rule: add helper function to expand chain rules into commands")
> > > 27c753e4a8d4 ("rule: expand standalone chain that contains rules")
> > > 3975430b12d9 ("src: expand table command before evaluation")
> >
> > This is also needed:
> >
> > 3542e49cf539 ("evaluate: init cmd pointer for new on-stack context")
> >
> > otherwise the test with implicit chain in 0.9.8 crashes, it is a
> > dependency patch.
>
Wrong commit id, this:
4e718641397c ("evaluate: init cmd pointer for new on-stack context")
Sorry.
