* [nft PATCH 1/2] src/parser_bison: fix ruleid_spec ambiguity
@ 2016-03-18 19:14 Arturo Borrero Gonzalez
2016-03-18 19:14 ` [nft PATCH 2/2] tests/shell: add testcases for Netfilter bug #965 Arturo Borrero Gonzalez
0 siblings, 1 reply; 4+ messages in thread
From: Arturo Borrero Gonzalez @ 2016-03-18 19:14 UTC (permalink / raw)
To: netfilter-devel; +Cc: sander.contrib, pablo
Currently, parser allows both 'handle' and 'position' as part of the
same grammar rule. But we don't combine them in any case actually.
As a result of this, deleting rules using "position" keyword deletes all
rules for chain.
Split the ruleid_spec in two types:
* one for handles
* one for positions
This change complies with the syntax/grammar described currently in the wiki.
Netfilter bug: http://bugzilla.netfilter.org/show_bug.cgi?id=965
Reported-by: Jesper Sander Lindgren <sander.contrib@gmail.com>
Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
---
0 files changed
diff --git a/src/parser_bison.y b/src/parser_bison.y
index 9e86f26..5ff69ef 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -419,8 +419,8 @@ static void location_update(struct location *loc, struct location *rhs, int n)
%type <cmd> base_cmd add_cmd replace_cmd create_cmd insert_cmd delete_cmd list_cmd flush_cmd rename_cmd export_cmd monitor_cmd describe_cmd
%destructor { cmd_free($$); } base_cmd add_cmd replace_cmd create_cmd insert_cmd delete_cmd list_cmd flush_cmd rename_cmd export_cmd monitor_cmd describe_cmd
-%type <handle> table_spec chain_spec chain_identifier ruleid_spec ruleset_spec
-%destructor { handle_free(&$$); } table_spec chain_spec chain_identifier ruleid_spec ruleset_spec
+%type <handle> table_spec chain_spec chain_identifier rulehandle_spec ruleposition_spec ruleset_spec
+%destructor { handle_free(&$$); } table_spec chain_spec chain_identifier rulehandle_spec ruleposition_spec ruleset_spec
%type <handle> set_spec set_identifier
%destructor { handle_free(&$$); } set_spec set_identifier
%type <val> handle_spec family_spec family_spec_explicit position_spec chain_policy prio_spec
@@ -704,11 +704,11 @@ add_cmd : TABLE table_spec
close_scope(state);
$$ = cmd_alloc(CMD_ADD, CMD_OBJ_CHAIN, &$2, &@$, $5);
}
- | RULE ruleid_spec rule
+ | RULE ruleposition_spec rule
{
$$ = cmd_alloc(CMD_ADD, CMD_OBJ_RULE, &$2, &@$, $3);
}
- | /* empty */ ruleid_spec rule
+ | /* empty */ ruleposition_spec rule
{
$$ = cmd_alloc(CMD_ADD, CMD_OBJ_RULE, &$1, &@$, $2);
}
@@ -732,7 +732,7 @@ add_cmd : TABLE table_spec
}
;
-replace_cmd : RULE ruleid_spec rule
+replace_cmd : RULE rulehandle_spec rule
{
$$ = cmd_alloc(CMD_REPLACE, CMD_OBJ_RULE, &$2, &@$, $3);
}
@@ -763,7 +763,7 @@ create_cmd : TABLE table_spec
}
;
-insert_cmd : RULE ruleid_spec rule
+insert_cmd : RULE ruleposition_spec rule
{
$$ = cmd_alloc(CMD_INSERT, CMD_OBJ_RULE, &$2, &@$, $3);
}
@@ -777,7 +777,7 @@ delete_cmd : TABLE table_spec
{
$$ = cmd_alloc(CMD_DELETE, CMD_OBJ_CHAIN, &$2, &@$, NULL);
}
- | RULE ruleid_spec
+ | RULE rulehandle_spec
{
$$ = cmd_alloc(CMD_DELETE, CMD_OBJ_RULE, &$2, &@$, NULL);
}
@@ -1236,11 +1236,19 @@ position_spec : /* empty */
}
;
-ruleid_spec : chain_spec handle_spec position_spec
+rulehandle_spec : chain_spec handle_spec
{
$$ = $1;
$$.handle = $2;
- $$.position = $3;
+ $$.position = 0;
+ }
+ ;
+
+ruleposition_spec : chain_spec position_spec
+ {
+ $$ = $1;
+ $$.handle = 0;
+ $$.position = $2;
}
;
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [nft PATCH 2/2] tests/shell: add testcases for Netfilter bug #965
2016-03-18 19:14 [nft PATCH 1/2] src/parser_bison: fix ruleid_spec ambiguity Arturo Borrero Gonzalez
@ 2016-03-18 19:14 ` Arturo Borrero Gonzalez
2016-03-19 15:57 ` Arturo Borrero Gonzalez
0 siblings, 1 reply; 4+ messages in thread
From: Arturo Borrero Gonzalez @ 2016-03-18 19:14 UTC (permalink / raw)
To: netfilter-devel; +Cc: sander.contrib, pablo
Testscases for Netfilter bug #965:
* add rule at position
* insert rule at position
* replace rule with given handle
* delete rule with given handle
* don't allow to delete rules with position keyword
Netfilter Bugzilla: http://bugzilla.netfilter.org/show_bug.cgi?id=965
Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
---
.../testcases/rule_management/0001addposition_0 | 27 ++++++++++++++++++++
.../testcases/rule_management/0002insertposition_0 | 27 ++++++++++++++++++++
tests/shell/testcases/rule_management/0003insert_0 | 27 ++++++++++++++++++++
.../shell/testcases/rule_management/0004replace_0 | 24 ++++++++++++++++++
.../shell/testcases/rule_management/0005replace_1 | 11 ++++++++
.../shell/testcases/rule_management/0006replace_1 | 11 ++++++++
tests/shell/testcases/rule_management/0007delete_0 | 25 +++++++++++++++++++
tests/shell/testcases/rule_management/0008delete_1 | 11 ++++++++
tests/shell/testcases/rule_management/0009delete_1 | 11 ++++++++
9 files changed, 174 insertions(+)
create mode 100755 tests/shell/testcases/rule_management/0001addposition_0
create mode 100755 tests/shell/testcases/rule_management/0002insertposition_0
create mode 100755 tests/shell/testcases/rule_management/0003insert_0
create mode 100755 tests/shell/testcases/rule_management/0004replace_0
create mode 100755 tests/shell/testcases/rule_management/0005replace_1
create mode 100755 tests/shell/testcases/rule_management/0006replace_1
create mode 100755 tests/shell/testcases/rule_management/0007delete_0
create mode 100755 tests/shell/testcases/rule_management/0008delete_1
create mode 100755 tests/shell/testcases/rule_management/0009delete_1
diff --git a/tests/shell/testcases/rule_management/0001addposition_0 b/tests/shell/testcases/rule_management/0001addposition_0
new file mode 100755
index 0000000..f6294ad
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0001addposition_0
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+$NFT add rule t c accept # should have handle 2
+$NFT add rule t c accept # should have handle 3
+$NFT add rule t c position 2 drop
+
+EXPECTED="table ip t {
+ chain c {
+ accept
+ drop
+ accept
+ }
+}"
+
+GET="$($NFT list ruleset)"
+
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi
diff --git a/tests/shell/testcases/rule_management/0002insertposition_0 b/tests/shell/testcases/rule_management/0002insertposition_0
new file mode 100755
index 0000000..49fcf7c
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0002insertposition_0
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+$NFT add rule t c accept # should have handle 2
+$NFT add rule t c accept # should have handle 3
+$NFT insert rule t c position 2 drop
+
+EXPECTED="table ip t {
+ chain c {
+ drop
+ accept
+ accept
+ }
+}"
+
+GET="$($NFT list ruleset)"
+
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi
diff --git a/tests/shell/testcases/rule_management/0003insert_0 b/tests/shell/testcases/rule_management/0003insert_0
new file mode 100755
index 0000000..407a293
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0003insert_0
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+$NFT insert rule t c accept
+$NFT insert rule t c drop
+$NFT insert rule t c masquerade
+
+EXPECTED="table ip t {
+ chain c {
+ masquerade
+ drop
+ accept
+ }
+}"
+
+GET="$($NFT list ruleset)"
+
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi
diff --git a/tests/shell/testcases/rule_management/0004replace_0 b/tests/shell/testcases/rule_management/0004replace_0
new file mode 100755
index 0000000..92acc30
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0004replace_0
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+$NFT add rule t c accept # should have handle 2
+$NFT replace rule t c handle 2 drop
+
+EXPECTED="table ip t {
+ chain c {
+ drop
+ }
+}"
+
+GET="$($NFT list ruleset)"
+
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi
diff --git a/tests/shell/testcases/rule_management/0005replace_1 b/tests/shell/testcases/rule_management/0005replace_1
new file mode 100755
index 0000000..e82995a
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0005replace_1
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+# kernel should return ENOENT
+$NFT replace rule t c handle 2 drop 2>/dev/null
+echo "E: missing kernel ENOENT" >&2
diff --git a/tests/shell/testcases/rule_management/0006replace_1 b/tests/shell/testcases/rule_management/0006replace_1
new file mode 100755
index 0000000..5dfcba0
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0006replace_1
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+# position keyword with replace action is not allowed, this should fail
+$NFT replace rule t c position 2 drop 2>/dev/null
+echo "E: allowed replace with position specification" >&2
diff --git a/tests/shell/testcases/rule_management/0007delete_0 b/tests/shell/testcases/rule_management/0007delete_0
new file mode 100755
index 0000000..8b00cd3
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0007delete_0
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+$NFT add rule t c accept # should have handle 2
+$NFT add rule t c drop # should have handle 3
+$NFT delete rule t c handle 2
+
+EXPECTED="table ip t {
+ chain c {
+ drop
+ }
+}"
+
+GET="$($NFT list ruleset)"
+
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi
diff --git a/tests/shell/testcases/rule_management/0008delete_1 b/tests/shell/testcases/rule_management/0008delete_1
new file mode 100755
index 0000000..3dce219
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0008delete_1
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+# this should fail, we don't allow delete with position
+$NFT delete rule t c position 2 drop 2>/dev/null
+echo "E: allowed position spec with delete action" >&2
diff --git a/tests/shell/testcases/rule_management/0009delete_1 b/tests/shell/testcases/rule_management/0009delete_1
new file mode 100755
index 0000000..87fec60
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0009delete_1
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+# kernel ENOENT
+$NFT delete rule t c handle 3333 2>/dev/null
+echo "E: missing kernel ENOENT" >&2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [nft PATCH 2/2] tests/shell: add testcases for Netfilter bug #965
2016-03-18 19:14 ` [nft PATCH 2/2] tests/shell: add testcases for Netfilter bug #965 Arturo Borrero Gonzalez
@ 2016-03-19 15:57 ` Arturo Borrero Gonzalez
0 siblings, 0 replies; 4+ messages in thread
From: Arturo Borrero Gonzalez @ 2016-03-19 15:57 UTC (permalink / raw)
To: Netfilter Development Mailing list; +Cc: sander.contrib, Pablo Neira Ayuso
On 18 March 2016 at 20:14, Arturo Borrero Gonzalez
<arturo.borrero.glez@gmail.com> wrote:
> Testscases for Netfilter bug #965:
> * add rule at position
> * insert rule at position
> * replace rule with given handle
> * delete rule with given handle
> * don't allow to delete rules with position keyword
>
> Netfilter Bugzilla: http://bugzilla.netfilter.org/show_bug.cgi?id=965
> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
sorry for the duplicated patches, something was wrong with my email config.
--
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
* [nft PATCH 2/2] tests/shell: add testcases for Netfilter bug #965
2016-03-18 19:29 [nft PATCH 1/2] src/parser_bison: fix ruleid_spec ambiguity Arturo Borrero Gonzalez
@ 2016-03-18 19:29 ` Arturo Borrero Gonzalez
0 siblings, 0 replies; 4+ messages in thread
From: Arturo Borrero Gonzalez @ 2016-03-18 19:29 UTC (permalink / raw)
To: netfilter-devel; +Cc: sander.contrib, pablo
Testscases for Netfilter bug #965:
* add rule at position
* insert rule at position
* replace rule with given handle
* delete rule with given handle
* don't allow to delete rules with position keyword
Netfilter Bugzilla: http://bugzilla.netfilter.org/show_bug.cgi?id=965
Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
---
.../testcases/rule_management/0001addposition_0 | 27 ++++++++++++++++++++
.../testcases/rule_management/0002insertposition_0 | 27 ++++++++++++++++++++
tests/shell/testcases/rule_management/0003insert_0 | 27 ++++++++++++++++++++
.../shell/testcases/rule_management/0004replace_0 | 24 ++++++++++++++++++
.../shell/testcases/rule_management/0005replace_1 | 11 ++++++++
.../shell/testcases/rule_management/0006replace_1 | 11 ++++++++
tests/shell/testcases/rule_management/0007delete_0 | 25 +++++++++++++++++++
tests/shell/testcases/rule_management/0008delete_1 | 11 ++++++++
tests/shell/testcases/rule_management/0009delete_1 | 11 ++++++++
9 files changed, 174 insertions(+)
create mode 100755 tests/shell/testcases/rule_management/0001addposition_0
create mode 100755 tests/shell/testcases/rule_management/0002insertposition_0
create mode 100755 tests/shell/testcases/rule_management/0003insert_0
create mode 100755 tests/shell/testcases/rule_management/0004replace_0
create mode 100755 tests/shell/testcases/rule_management/0005replace_1
create mode 100755 tests/shell/testcases/rule_management/0006replace_1
create mode 100755 tests/shell/testcases/rule_management/0007delete_0
create mode 100755 tests/shell/testcases/rule_management/0008delete_1
create mode 100755 tests/shell/testcases/rule_management/0009delete_1
diff --git a/tests/shell/testcases/rule_management/0001addposition_0 b/tests/shell/testcases/rule_management/0001addposition_0
new file mode 100755
index 0000000..f6294ad
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0001addposition_0
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+$NFT add rule t c accept # should have handle 2
+$NFT add rule t c accept # should have handle 3
+$NFT add rule t c position 2 drop
+
+EXPECTED="table ip t {
+ chain c {
+ accept
+ drop
+ accept
+ }
+}"
+
+GET="$($NFT list ruleset)"
+
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi
diff --git a/tests/shell/testcases/rule_management/0002insertposition_0 b/tests/shell/testcases/rule_management/0002insertposition_0
new file mode 100755
index 0000000..49fcf7c
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0002insertposition_0
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+$NFT add rule t c accept # should have handle 2
+$NFT add rule t c accept # should have handle 3
+$NFT insert rule t c position 2 drop
+
+EXPECTED="table ip t {
+ chain c {
+ drop
+ accept
+ accept
+ }
+}"
+
+GET="$($NFT list ruleset)"
+
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi
diff --git a/tests/shell/testcases/rule_management/0003insert_0 b/tests/shell/testcases/rule_management/0003insert_0
new file mode 100755
index 0000000..407a293
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0003insert_0
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+$NFT insert rule t c accept
+$NFT insert rule t c drop
+$NFT insert rule t c masquerade
+
+EXPECTED="table ip t {
+ chain c {
+ masquerade
+ drop
+ accept
+ }
+}"
+
+GET="$($NFT list ruleset)"
+
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi
diff --git a/tests/shell/testcases/rule_management/0004replace_0 b/tests/shell/testcases/rule_management/0004replace_0
new file mode 100755
index 0000000..92acc30
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0004replace_0
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+$NFT add rule t c accept # should have handle 2
+$NFT replace rule t c handle 2 drop
+
+EXPECTED="table ip t {
+ chain c {
+ drop
+ }
+}"
+
+GET="$($NFT list ruleset)"
+
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi
diff --git a/tests/shell/testcases/rule_management/0005replace_1 b/tests/shell/testcases/rule_management/0005replace_1
new file mode 100755
index 0000000..e82995a
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0005replace_1
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+# kernel should return ENOENT
+$NFT replace rule t c handle 2 drop 2>/dev/null
+echo "E: missing kernel ENOENT" >&2
diff --git a/tests/shell/testcases/rule_management/0006replace_1 b/tests/shell/testcases/rule_management/0006replace_1
new file mode 100755
index 0000000..5dfcba0
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0006replace_1
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+# position keyword with replace action is not allowed, this should fail
+$NFT replace rule t c position 2 drop 2>/dev/null
+echo "E: allowed replace with position specification" >&2
diff --git a/tests/shell/testcases/rule_management/0007delete_0 b/tests/shell/testcases/rule_management/0007delete_0
new file mode 100755
index 0000000..8b00cd3
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0007delete_0
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+$NFT add rule t c accept # should have handle 2
+$NFT add rule t c drop # should have handle 3
+$NFT delete rule t c handle 2
+
+EXPECTED="table ip t {
+ chain c {
+ drop
+ }
+}"
+
+GET="$($NFT list ruleset)"
+
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi
diff --git a/tests/shell/testcases/rule_management/0008delete_1 b/tests/shell/testcases/rule_management/0008delete_1
new file mode 100755
index 0000000..3dce219
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0008delete_1
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+# this should fail, we don't allow delete with position
+$NFT delete rule t c position 2 drop 2>/dev/null
+echo "E: allowed position spec with delete action" >&2
diff --git a/tests/shell/testcases/rule_management/0009delete_1 b/tests/shell/testcases/rule_management/0009delete_1
new file mode 100755
index 0000000..87fec60
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0009delete_1
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+# kernel ENOENT
+$NFT delete rule t c handle 3333 2>/dev/null
+echo "E: missing kernel ENOENT" >&2
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-03-19 15:58 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-03-18 19:14 [nft PATCH 1/2] src/parser_bison: fix ruleid_spec ambiguity Arturo Borrero Gonzalez
2016-03-18 19:14 ` [nft PATCH 2/2] tests/shell: add testcases for Netfilter bug #965 Arturo Borrero Gonzalez
2016-03-19 15:57 ` Arturo Borrero Gonzalez
2016-03-18 19:29 [nft PATCH 1/2] src/parser_bison: fix ruleid_spec ambiguity Arturo Borrero Gonzalez
2016-03-18 19:29 ` [nft PATCH 2/2] tests/shell: add testcases for Netfilter bug #965 Arturo Borrero Gonzalez
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).