|
 |
3a00e5 |
From 176353549f03fd10c731d93e9b37aa05eb210ecb Mon Sep 17 00:00:00 2001
|
|
|
3a00e5 |
From: Florian Westphal <fw@strlen.de>
|
|
|
3a00e5 |
Date: Wed, 24 Feb 2021 11:08:02 +0100
|
|
|
3a00e5 |
Subject: [PATCH] iptables-nft: fix -Z option
|
|
|
3a00e5 |
|
|
|
3a00e5 |
it zeroes the rule counters, so it needs fully populated cache.
|
|
|
3a00e5 |
Add a test case to cover this.
|
|
|
3a00e5 |
|
|
|
3a00e5 |
Fixes: 9d07514ac5c7a ("nft: calculate cache requirements from list of commands")
|
|
|
3a00e5 |
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
|
3a00e5 |
Acked-by: Phil Sutter <phil@nwl.cc>
|
|
|
3a00e5 |
(cherry picked from commit 5f1fcacebf9b4529950b6e3f88327049a0ea7cd2)
|
|
|
3a00e5 |
---
|
|
|
3a00e5 |
iptables/nft-cmd.c | 2 +-
|
|
|
3a00e5 |
.../testcases/iptables/0007-zero-counters_0 | 64 +++++++++++++++++++
|
|
|
3a00e5 |
2 files changed, 65 insertions(+), 1 deletion(-)
|
|
|
3a00e5 |
create mode 100755 iptables/tests/shell/testcases/iptables/0007-zero-counters_0
|
|
|
3a00e5 |
|
|
|
3a00e5 |
diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c
|
|
|
3a00e5 |
index 8dccdd734b156..a0c76a795e59c 100644
|
|
|
3a00e5 |
--- a/iptables/nft-cmd.c
|
|
|
3a00e5 |
+++ b/iptables/nft-cmd.c
|
|
|
3a00e5 |
@@ -188,7 +188,7 @@ int nft_cmd_chain_zero_counters(struct nft_handle *h, const char *chain,
|
|
|
3a00e5 |
if (!cmd)
|
|
|
3a00e5 |
return 0;
|
|
|
3a00e5 |
|
|
|
3a00e5 |
- nft_cache_level_set(h, NFT_CL_CHAINS, cmd);
|
|
|
3a00e5 |
+ nft_cache_level_set(h, NFT_CL_RULES, cmd);
|
|
|
3a00e5 |
|
|
|
3a00e5 |
return 1;
|
|
|
3a00e5 |
}
|
|
|
3a00e5 |
diff --git a/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0
|
|
|
3a00e5 |
new file mode 100755
|
|
|
3a00e5 |
index 0000000000000..36da1907e3b22
|
|
|
3a00e5 |
--- /dev/null
|
|
|
3a00e5 |
+++ b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0
|
|
|
3a00e5 |
@@ -0,0 +1,64 @@
|
|
|
3a00e5 |
+#!/bin/bash
|
|
|
3a00e5 |
+
|
|
|
3a00e5 |
+RC=0
|
|
|
3a00e5 |
+COUNTR=$RANDOM$RANDOM
|
|
|
3a00e5 |
+
|
|
|
3a00e5 |
+$XT_MULTI iptables-restore -c <
|
|
|
3a00e5 |
+*filter
|
|
|
3a00e5 |
+:INPUT ACCEPT [1:23]
|
|
|
3a00e5 |
+:FOO - [0:0]
|
|
|
3a00e5 |
+[12:345] -A INPUT -i lo -p icmp -m comment --comment "$COUNTR"
|
|
|
3a00e5 |
+[22:123] -A FOO -m comment --comment one
|
|
|
3a00e5 |
+[44:123] -A FOO -m comment --comment two
|
|
|
3a00e5 |
+COMMIT
|
|
|
3a00e5 |
+EOF
|
|
|
3a00e5 |
+EXPECT="*filter
|
|
|
3a00e5 |
+:INPUT ACCEPT [0:0]
|
|
|
3a00e5 |
+:FORWARD ACCEPT [0:0]
|
|
|
3a00e5 |
+:OUTPUT ACCEPT [0:0]
|
|
|
3a00e5 |
+:FOO - [0:0]
|
|
|
3a00e5 |
+[0:0] -A INPUT -i lo -p icmp -m comment --comment "$COUNTR"
|
|
|
3a00e5 |
+[0:0] -A FOO -m comment --comment one
|
|
|
3a00e5 |
+[0:0] -A FOO -m comment --comment two
|
|
|
3a00e5 |
+COMMIT"
|
|
|
3a00e5 |
+
|
|
|
3a00e5 |
+COUNTER=$($XT_MULTI iptables-save -c |grep "comment $COUNTR"| cut -f 1 -d " ")
|
|
|
3a00e5 |
+if [ $COUNTER != "[12:345]" ]; then
|
|
|
3a00e5 |
+ echo "Counter $COUNTER is wrong, expected 12:345"
|
|
|
3a00e5 |
+ RC=1
|
|
|
3a00e5 |
+fi
|
|
|
3a00e5 |
+
|
|
|
3a00e5 |
+$XT_MULTI iptables -Z FOO
|
|
|
3a00e5 |
+COUNTER=$($XT_MULTI iptables-save -c |grep "comment $COUNTR"| cut -f 1 -d " ")
|
|
|
3a00e5 |
+if [ $COUNTER = "[0:0]" ]; then
|
|
|
3a00e5 |
+ echo "Counter $COUNTER is wrong, should not have been zeroed"
|
|
|
3a00e5 |
+ RC=1
|
|
|
3a00e5 |
+fi
|
|
|
3a00e5 |
+
|
|
|
3a00e5 |
+for c in one two; do
|
|
|
3a00e5 |
+ COUNTER=$($XT_MULTI iptables-save -c |grep "comment $c"| cut -f 1 -d " ")
|
|
|
3a00e5 |
+ if [ $COUNTER != "[0:0]" ]; then
|
|
|
3a00e5 |
+ echo "Counter $COUNTER is wrong, should have been zeroed at rule $c"
|
|
|
3a00e5 |
+ RC=1
|
|
|
3a00e5 |
+ fi
|
|
|
3a00e5 |
+done
|
|
|
3a00e5 |
+
|
|
|
3a00e5 |
+$XT_MULTI iptables -Z
|
|
|
3a00e5 |
+COUNTER=$($XT_MULTI iptables-save -c |grep "comment $COUNTR"| cut -f 1 -d " ")
|
|
|
3a00e5 |
+
|
|
|
3a00e5 |
+if [ $COUNTER != "[0:0]" ]; then
|
|
|
3a00e5 |
+ echo "Counter $COUNTER is wrong, expected 0:0 after -Z"
|
|
|
3a00e5 |
+ RC=1
|
|
|
3a00e5 |
+fi
|
|
|
3a00e5 |
+
|
|
|
3a00e5 |
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables-save -c | grep -v '^#')
|
|
|
3a00e5 |
+if [ $? -ne 0 ]; then
|
|
|
3a00e5 |
+ echo "Diff error: counters were not zeroed"
|
|
|
3a00e5 |
+ RC=1
|
|
|
3a00e5 |
+fi
|
|
|
3a00e5 |
+
|
|
|
3a00e5 |
+$XT_MULTI iptables -D INPUT -i lo -p icmp -m comment --comment "$COUNTR"
|
|
|
3a00e5 |
+$XT_MULTI iptables -D FOO -m comment --comment one
|
|
|
3a00e5 |
+$XT_MULTI iptables -D FOO -m comment --comment two
|
|
|
3a00e5 |
+$XT_MULTI iptables -X FOO
|
|
|
3a00e5 |
+exit $RC
|
|
|
3a00e5 |
--
|
|
|
3a00e5 |
2.31.1
|
|
|
3a00e5 |
|