On Mon, Jul 22, 2024 at 11:34:01PM +0200, Pablo Neira Ayuso wrote: > On Mon, Jul 22, 2024 at 04:48:40PM -0400, Eric Garver wrote: > > On Tue, May 28, 2024 at 05:28:17PM +0200, Pablo Neira Ayuso wrote: > > > Cache tracking has improved over time by incrementally adding/deleting > > > objects when evaluating commands that are going to be sent to the kernel. > > > > > > nft_cache_is_complete() already checks that the cache contains objects > > > that are required to handle this batch of commands by comparing cache > > > flags. > > > > > > Infer from the current generation ID if no other transaction has > > > invalidated the existing cache, this allows to skip unnecessary cache > > > flush then refill situations which slow down incremental updates. > > > > > > Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> > > > --- > > > v2: no changes > > > > Hi Pablo, > > > > This patch introduced a regression with the index keyword. It seems to > > be triggered by adding a rule with "insert", then referencing the new > > rule with by "add"-ing another rule using index. > > > > https://github.com/firewalld/firewalld/issues/1366#issuecomment-2243772215 > > I can reproduce it: > > # nft -i > nft> add table inet foo > nft> add chain inet foo bar { type filter hook input priority filter; } > nft> add rule inet foo bar accept > nft> insert rule inet foo bar index 0 accept > nft> add rule inet foo bar index 0 accept > Error: Could not process rule: No such file or directory > add rule inet foo bar index 0 accept > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Thanks for providing instructions. > Cache woes. Maybe a bug in > > commit e5382c0d08e3c6d8246afa95b7380f0d6b8c1826 > Author: Phil Sutter <phil@xxxxxx> > Date: Fri Jun 7 19:21:21 2019 +0200 I'll have a look later today. Cheers, Phil
