nft: cache: Optimize caching for flush command

When flushing all chains and verbose mode is not enabled,
nft_rule_flush() uses a shortcut: It doesn't specify a chain name for
NFT_MSG_DELRULE, so the kernel will flush all existing chains without
user space needing to know which they are.

The above allows to avoid a chain cache, but there's a caveat:
nft_xt_builtin_init() will create base chains as it assumes they are
missing and thereby possibly overrides any non-default chain policies.

Solve this by making nft_xt_builtin_init() cache-aware: If a command
doesn't need a chain cache, there's no need to bother with creating any
non-existing builtin chains, either. For the sake of completeness, also
do nothing if cache is not initialized (although that shouldn't happen).

Signed-off-by: Phil Sutter <phil@nwl.cc>

diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c
index 23f2761f2bf3f72d88146df30bc557d047225b7d..9c0901e78703a357d611757b8c34909e449401e7 100644 (file)
--- a/iptables/nft-cmd.c
+++ b/iptables/nft-cmd.c
@@ -167,7 +167,10 @@ int nft_cmd_rule_flush(struct nft_handle *h, const char *chain,
        if (!cmd)
                return 0;
 
-       nft_cache_level_set(h, NFT_CL_CHAINS, cmd);
+       if (chain || verbose)
+               nft_cache_level_set(h, NFT_CL_CHAINS, cmd);
+       else
+               nft_cache_level_set(h, NFT_CL_TABLES, cmd);
 
        return 1;
 }

diff --git a/iptables/nft.c b/iptables/nft.c
index b807de88206b7283db9f60e429fbfbe308eabffb..b505d70a03331ad6eec6e429921e4331ebdd5b5b 100644 (file)
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -737,6 +737,9 @@ static int nft_xt_builtin_init(struct nft_handle *h, const char *table)
 {
        const struct builtin_table *t;
 
+       if (!h->cache_init)
+               return 0;
+
        t = nft_table_builtin_find(h, table);
        if (t == NULL)
                return -1;
@@ -747,6 +750,9 @@ static int nft_xt_builtin_init(struct nft_handle *h, const char *table)
        if (nft_table_builtin_add(h, t) < 0)
                return -1;
 
+       if (h->cache_req.level < NFT_CL_CHAINS)
+               return 0;
+
        nft_chain_builtin_init(h, t);
 
        h->cache->table[t->type].initialized = true;

diff --git a/iptables/tests/shell/testcases/nft-only/0006-policy-override_0 b/iptables/tests/shell/testcases/nft-only/0006-policy-override_0
new file mode 100755 (executable)
index 0000000..68e2019
--- /dev/null
+++ b/iptables/tests/shell/testcases/nft-only/0006-policy-override_0
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
+
+# make sure none of the commands invoking nft_xt_builtin_init() override
+# non-default chain policies via needless chain add.
+
+RC=0
+
+do_test() {
+       $XT_MULTI $@
+       $XT_MULTI iptables -S | grep -q -- '-P FORWARD DROP' && return
+
+       echo "command '$@' kills chain policies"
+       $XT_MULTI iptables -P FORWARD DROP
+       RC=1
+}
+
+$XT_MULTI iptables -P FORWARD DROP
+
+do_test iptables -A OUTPUT -j ACCEPT
+do_test iptables -F
+do_test iptables -N foo
+do_test iptables -E foo foo2
+do_test iptables -I OUTPUT -j ACCEPT
+do_test iptables -nL
+do_test iptables -S
+
+exit $RC