cache: do not skip populating anonymous set with -t

--terse does not apply to anonymous set, add a NFT_CACHE_TERSE bit
to skip named sets only.

Moreover, prioritize specific listing filter over --terse to avoid a
bogus:

  netlink: Error: Unknown set '__set0' in lookup expression

when invoking:

  # nft -ta list set inet filter example

Extend existing test to improve coverage.

Fixes: 9628d52e46ac ("cache: disable NFT_CACHE_SETELEM_BIT on --terse listing only")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/cache.h b/include/cache.h
index e5c509e8510cafed5e0da030219bb0a738b54fda..3a9a5e81971144265060f20549b40580d1c3ff6a 100644 (file)
--- a/include/cache.h
+++ b/include/cache.h
@@ -32,6 +32,7 @@ enum cache_level_flags {
                                  NFT_CACHE_CHAIN_BIT |
                                  NFT_CACHE_RULE_BIT,
        NFT_CACHE_FULL          = __NFT_CACHE_MAX_BIT - 1,
+       NFT_CACHE_TERSE         = (1 << 27),
        NFT_CACHE_SETELEM_MAYBE = (1 << 28),
        NFT_CACHE_REFRESH       = (1 << 29),
        NFT_CACHE_UPDATE        = (1 << 30),

diff --git a/src/cache.c b/src/cache.c
index fe31e3f02163c5b16fe0da1098fe8946e576e358..6d20716d73110d2256a9d45010345b8d330ff0f3 100644 (file)
--- a/src/cache.c
+++ b/src/cache.c
@@ -215,10 +215,10 @@ static unsigned int evaluate_cache_list(struct nft_ctx *nft, struct cmd *cmd,
                        filter->list.table = cmd->handle.table.name;
                        filter->list.set = cmd->handle.set.name;
                }
-               if (nft_output_terse(&nft->output))
-                       flags |= (NFT_CACHE_FULL & ~NFT_CACHE_SETELEM_BIT);
-               else if (filter->list.table && filter->list.set)
+               if (filter->list.table && filter->list.set)
                        flags |= NFT_CACHE_TABLE | NFT_CACHE_SET | NFT_CACHE_SETELEM;
+               else if (nft_output_terse(&nft->output))
+                       flags |= NFT_CACHE_FULL | NFT_CACHE_TERSE;
                else
                        flags |= NFT_CACHE_FULL;
                break;
@@ -234,7 +234,7 @@ static unsigned int evaluate_cache_list(struct nft_ctx *nft, struct cmd *cmd,
                break;
        case CMD_OBJ_RULESET:
                if (nft_output_terse(&nft->output))
-                       flags |= (NFT_CACHE_FULL & ~NFT_CACHE_SETELEM_BIT);
+                       flags |= NFT_CACHE_FULL | NFT_CACHE_TERSE;
                else
                        flags |= NFT_CACHE_FULL;
                break;
@@ -830,6 +830,9 @@ static int cache_init_objects(struct netlink_ctx *ctx, unsigned int flags,
                        list_for_each_entry(set, &table->set_cache.list, cache.list) {
                                if (cache_filter_find(filter, &set->handle))
                                        continue;
+                               if (!set_is_anonymous(set->flags) &&
+                                   flags & NFT_CACHE_TERSE)
+                                       continue;
 
                                ret = netlink_list_setelems(ctx, &set->handle,
                                                            set);

diff --git a/tests/shell/testcases/listing/0022terse_0 b/tests/shell/testcases/listing/0022terse_0
index 14d31875fe88609ff14d4564e53c990f236a5015..4841771cd527018dd4f1c1ff0b902921a2c6a4fd 100755 (executable)
--- a/tests/shell/testcases/listing/0022terse_0
+++ b/tests/shell/testcases/listing/0022terse_0
@@ -9,7 +9,7 @@ RULESET="table inet filter {
 
        chain input {
                type filter hook prerouting priority filter; policy accept;
-               ip saddr @example drop
+               ip saddr != { 10.10.10.100, 10.10.10.111 } ip saddr @example drop
        }
 }"
 
@@ -31,7 +31,7 @@ EXPECTED="table inet filter {
 
        chain input {
                type filter hook prerouting priority filter; policy accept;
-               ip saddr @example drop
+               ip saddr != { 10.10.10.100, 10.10.10.111 } ip saddr @example drop
        }
 }"