cache: Fix for doubled output after reset command

Reset command causes a dump of the objects to reset and adds those to
cache. Yet it ignored if the object in question was already there and up
to now CMD_RESET was flagged as NFT_CACHE_FULL.

Tackle this from two angles: First, reduce cache requirements of reset
command to the necessary bits which is table cache. This alone would
suffice if there wasn't interactive mode (and other libnftables users):
A cache containing the objects to reset might be in place already, so
add dumped objects to cache only if they don't exist already.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/cache.c b/src/cache.c
index 0c28a28d3b55421b8696621f873c3fc1c40416f0..05f0d68edf03ae63d29591eca68914d291ac0a2d 100644 (file)
--- a/src/cache.c
+++ b/src/cache.c
@@ -138,8 +138,10 @@ unsigned int cache_evaluate(struct nft_ctx *nft, struct list_head *cmds)
                case CMD_GET:
                        flags = evaluate_cache_get(cmd, flags);
                        break;
-               case CMD_LIST:
                case CMD_RESET:
+                       flags |= NFT_CACHE_TABLE;
+                       break;
+               case CMD_LIST:
                case CMD_EXPORT:
                case CMD_MONITOR:
                        flags |= NFT_CACHE_FULL;

diff --git a/src/rule.c b/src/rule.c
index 57f1fc838399dabfd5d49b31b8dd100803767861..883b070720259695751ccfca0d9711e6df922aaf 100644 (file)
--- a/src/rule.c
+++ b/src/rule.c
@@ -2582,7 +2582,8 @@ static int do_command_reset(struct netlink_ctx *ctx, struct cmd *cmd)
        ret = netlink_reset_objs(ctx, cmd, type, dump);
        list_for_each_entry_safe(obj, next, &ctx->list, list) {
                table = table_lookup(&obj->handle, &ctx->nft->cache);
-               list_move(&obj->list, &table->objs);
+               if (!obj_lookup(table, obj->handle.obj.name, obj->type))
+                       list_move(&obj->list, &table->objs);
        }
        if (ret < 0)
                return ret;

diff --git a/tests/shell/testcases/sets/0024named_objects_0 b/tests/shell/testcases/sets/0024named_objects_0
index 3bd16f2fd028b2959016732c30b24d5a7979da0f..21200c3cca3cd45bdb85580253e4a6d2dedcdfa0 100755 (executable)
--- a/tests/shell/testcases/sets/0024named_objects_0
+++ b/tests/shell/testcases/sets/0024named_objects_0
@@ -35,4 +35,14 @@ table inet x {
 set -e
 $NFT -f - <<< "$RULESET"
 
-$NFT reset counter inet x user321
+EXPECTED="table inet x {
+       counter user321 {
+               packets 12 bytes 1433
+       }
+}"
+
+GET="$($NFT reset counter inet x user321)"
+if [ "$EXPECTED" != "$GET" ] ; then
+       $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+       exit 1
+fi