diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-07-21 01:50:06 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-07-21 14:20:18 +0200 |
commit | 40ef308e19b6db02017a8a650406b0c6d37be750 (patch) | |
tree | 1454397990893d59b6d4a9e90a0424202eaa8817 | |
parent | 6c3fbd20c9aeeefd75543d759370af11787873c9 (diff) |
rule: flush set cache before flush command
Flush the set cache before adding the flush command to the netlink batch.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r-- | src/rule.c | 16 | ||||
-rwxr-xr-x | tests/shell/testcases/sets/0052overlap_0 | 16 | ||||
-rw-r--r-- | tests/shell/testcases/sets/dumps/0052overlap_0.nft | 8 |
3 files changed, 40 insertions, 0 deletions
@@ -2692,6 +2692,21 @@ static int do_command_reset(struct netlink_ctx *ctx, struct cmd *cmd) return do_list_obj(ctx, cmd, type); } +static void flush_set_cache(struct netlink_ctx *ctx, struct cmd *cmd) +{ + struct table *table; + struct set *set; + + table = table_lookup(&cmd->handle, &ctx->nft->cache); + assert(table); + set = set_lookup(table, cmd->handle.set.name); + assert(set); + if (set->init != NULL) { + expr_free(set->init); + set->init = NULL; + } +} + static int do_command_flush(struct netlink_ctx *ctx, struct cmd *cmd) { switch (cmd->obj) { @@ -2701,6 +2716,7 @@ static int do_command_flush(struct netlink_ctx *ctx, struct cmd *cmd) case CMD_OBJ_SET: case CMD_OBJ_MAP: case CMD_OBJ_METER: + flush_set_cache(ctx, cmd); return mnl_nft_setelem_flush(ctx, cmd); case CMD_OBJ_RULESET: return mnl_nft_table_del(ctx, cmd); diff --git a/tests/shell/testcases/sets/0052overlap_0 b/tests/shell/testcases/sets/0052overlap_0 new file mode 100755 index 00000000..c2960945 --- /dev/null +++ b/tests/shell/testcases/sets/0052overlap_0 @@ -0,0 +1,16 @@ +#!/bin/bash + +set -e + +EXPECTED="add table ip filter +add set ip filter w_all {type ipv4_addr; flags interval; auto-merge} +add element ip filter w_all {10.10.10.10, 10.10.10.11} +" + +$NFT -f - <<< "$EXPECTED" + +EXPECTED="flush set ip filter w_all +add element ip filter w_all {10.10.10.10, 10.10.10.253} +" + +$NFT -f - <<< "$EXPECTED" diff --git a/tests/shell/testcases/sets/dumps/0052overlap_0.nft b/tests/shell/testcases/sets/dumps/0052overlap_0.nft new file mode 100644 index 00000000..1cc02ada --- /dev/null +++ b/tests/shell/testcases/sets/dumps/0052overlap_0.nft @@ -0,0 +1,8 @@ +table ip filter { + set w_all { + type ipv4_addr + flags interval + auto-merge + elements = { 10.10.10.10, 10.10.10.253 } + } +} |