On Mon, Jul 22, 2024 at 04:48:40PM -0400, Eric Garver wrote: > On Tue, May 28, 2024 at 05:28:17PM +0200, Pablo Neira Ayuso wrote: > > Cache tracking has improved over time by incrementally adding/deleting > > objects when evaluating commands that are going to be sent to the kernel. > > > > nft_cache_is_complete() already checks that the cache contains objects > > that are required to handle this batch of commands by comparing cache > > flags. > > > > Infer from the current generation ID if no other transaction has > > invalidated the existing cache, this allows to skip unnecessary cache > > flush then refill situations which slow down incremental updates. > > > > Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> > > --- > > v2: no changes > > Hi Pablo, > > This patch introduced a regression with the index keyword. It seems to > be triggered by adding a rule with "insert", then referencing the new > rule with by "add"-ing another rule using index. > > https://github.com/firewalld/firewalld/issues/1366#issuecomment-2243772215 I can reproduce it: # nft -i nft> add table inet foo nft> add chain inet foo bar { type filter hook input priority filter; } nft> add rule inet foo bar accept nft> insert rule inet foo bar index 0 accept nft> add rule inet foo bar index 0 accept Error: Could not process rule: No such file or directory add rule inet foo bar index 0 accept ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Cache woes. Maybe a bug in commit e5382c0d08e3c6d8246afa95b7380f0d6b8c1826 Author: Phil Sutter <phil@xxxxxx> Date: Fri Jun 7 19:21:21 2019 +0200 src: Support intra-transaction rule references that uncover now that cache is not flushed and sync with kernel so often?
