]> git.ipfire.org Git - thirdparty/nftables.git/commit
evaluate: remove table from cache on delete table
authorPablo Neira Ayuso <pablo@netfilter.org>
Tue, 28 Jul 2020 17:32:44 +0000 (19:32 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 29 Jul 2020 21:40:58 +0000 (23:40 +0200)
commit7840b9224d5b84c41a8f5a5ddd919c7f7614901f
treee5bc163dceb70623cbaa0a86f96cc117e90a2514
parentac4b25b3ca045fbbed86773a91da52d9d7ee3091
evaluate: remove table from cache on delete table

The following ruleset crashes nft if loaded twice, via nft -ef:

 add table inet filter
 delete table inet filter

 table inet filter {
        chain input {
                type filter hook input priority filter; policy drop;
                iifname { "eth0" } counter accept
        }
 }

If the table contains anonymous sets, such as __set0, then delete + add
table might result in nft reusing the existing stale __set0 in the cache.
The problem is that nft gets confused and it reuses the existing stale
__set0 instead of the new anonymous set __set0 with the same name.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
src/evaluate.c
tests/shell/testcases/sets/0053echo_0 [new file with mode: 0755]
tests/shell/testcases/sets/dumps/0053echo_0.nft [new file with mode: 0644]