netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH nft] tests: shell: check that rule add with index works with echo
@ 2019-09-03 23:27 Eric Garver
  2019-09-04  8:13 ` Phil Sutter
  2019-09-05 15:54 ` Pablo Neira Ayuso
  0 siblings, 2 replies; 7+ messages in thread
From: Eric Garver @ 2019-09-03 23:27 UTC (permalink / raw)
  To: netfilter-devel; +Cc: Pablo Neira Ayuso

If --echo is used the rule cache will not be populated. This causes
rules added using the "index" keyword to be simply appended to the
chain. The bug was introduced in commit 3ab02db5f836 ("cache: add
NFT_CACHE_UPDATE and NFT_CACHE_FLUSHED flags").

Signed-off-by: Eric Garver <eric@garver.life>
---
I think the issue is in cache_evaluate(). It sets the flags to
NFT_CACHE_FULL and then bails early, but I'm not sure of the best way to
fix it. So I'll start by submitting a test case. :)
---
 tests/shell/testcases/cache/0007_echo_cache_init_0 | 14 ++++++++++++++
 .../cache/dumps/0007_echo_cache_init_0.nft         |  7 +++++++
 2 files changed, 21 insertions(+)
 create mode 100755 tests/shell/testcases/cache/0007_echo_cache_init_0
 create mode 100644 tests/shell/testcases/cache/dumps/0007_echo_cache_init_0.nft

diff --git a/tests/shell/testcases/cache/0007_echo_cache_init_0 b/tests/shell/testcases/cache/0007_echo_cache_init_0
new file mode 100755
index 000000000000..280a0d06bdc3
--- /dev/null
+++ b/tests/shell/testcases/cache/0007_echo_cache_init_0
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -e
+
+$NFT -i >/dev/null <<EOF
+add table inet t
+add chain inet t c
+add rule inet t c accept comment "first"
+add rule inet t c accept comment "third"
+EOF
+
+# make sure the rule cache gets initialized when using echo option
+#
+$NFT --echo add rule inet t c index 0 accept comment '"second"' >/dev/null
diff --git a/tests/shell/testcases/cache/dumps/0007_echo_cache_init_0.nft b/tests/shell/testcases/cache/dumps/0007_echo_cache_init_0.nft
new file mode 100644
index 000000000000..c774ee72a683
--- /dev/null
+++ b/tests/shell/testcases/cache/dumps/0007_echo_cache_init_0.nft
@@ -0,0 +1,7 @@
+table inet t {
+	chain c {
+		accept comment "first"
+		accept comment "second"
+		accept comment "third"
+	}
+}
-- 
2.20.1


^ permalink raw reply related	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2019-09-05 17:25 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-03 23:27 [PATCH nft] tests: shell: check that rule add with index works with echo Eric Garver
2019-09-04  8:13 ` Phil Sutter
2019-09-04 19:17   ` Pablo Neira Ayuso
2019-09-04 19:31     ` Pablo Neira Ayuso
2019-09-05 15:54 ` Pablo Neira Ayuso
2019-09-05 16:13   ` Eric Garver
2019-09-05 17:25     ` Pablo Neira Ayuso

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).