diff mbox

[nft,2/2] tests/shell: add testcases for Netfilter bug #965

Message ID 145832847321.11442.4869938717972076465.stgit@nostromo
State Superseded
Delegated to: Pablo Neira
Headers show

Commit Message

Arturo Borrero March 18, 2016, 7:14 p.m. UTC 
Testscases for Netfilter bug #965:
 * add rule at position
 * insert rule at position
 * replace rule with given handle
 * delete rule with given handle
 * don't allow to delete rules with position keyword

Netfilter Bugzilla: http://bugzilla.netfilter.org/show_bug.cgi?id=965
Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
---
 .../testcases/rule_management/0001addposition_0    |   27 ++++++++++++++++++++
 .../testcases/rule_management/0002insertposition_0 |   27 ++++++++++++++++++++
 tests/shell/testcases/rule_management/0003insert_0 |   27 ++++++++++++++++++++
 .../shell/testcases/rule_management/0004replace_0  |   24 ++++++++++++++++++
 .../shell/testcases/rule_management/0005replace_1  |   11 ++++++++
 .../shell/testcases/rule_management/0006replace_1  |   11 ++++++++
 tests/shell/testcases/rule_management/0007delete_0 |   25 +++++++++++++++++++
 tests/shell/testcases/rule_management/0008delete_1 |   11 ++++++++
 tests/shell/testcases/rule_management/0009delete_1 |   11 ++++++++
 9 files changed, 174 insertions(+)
 create mode 100755 tests/shell/testcases/rule_management/0001addposition_0
 create mode 100755 tests/shell/testcases/rule_management/0002insertposition_0
 create mode 100755 tests/shell/testcases/rule_management/0003insert_0
 create mode 100755 tests/shell/testcases/rule_management/0004replace_0
 create mode 100755 tests/shell/testcases/rule_management/0005replace_1
 create mode 100755 tests/shell/testcases/rule_management/0006replace_1
 create mode 100755 tests/shell/testcases/rule_management/0007delete_0
 create mode 100755 tests/shell/testcases/rule_management/0008delete_1
 create mode 100755 tests/shell/testcases/rule_management/0009delete_1


--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Arturo Borrero March 19, 2016, 3:57 p.m. UTC | #1 
On 18 March 2016 at 20:14, Arturo Borrero Gonzalez
<arturo.borrero.glez@gmail.com> wrote:
> Testscases for Netfilter bug #965:
>  * add rule at position
>  * insert rule at position
>  * replace rule with given handle
>  * delete rule with given handle
>  * don't allow to delete rules with position keyword
>
> Netfilter Bugzilla: http://bugzilla.netfilter.org/show_bug.cgi?id=965
> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>

sorry for the duplicated patches, something was wrong with my email config.
diff mbox

Patch

diff --git a/tests/shell/testcases/rule_management/0001addposition_0 b/tests/shell/testcases/rule_management/0001addposition_0
new file mode 100755
index 0000000..f6294ad
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0001addposition_0
@@ -0,0 +1,27 @@ 
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+$NFT add rule t c accept	# should have handle 2
+$NFT add rule t c accept	# should have handle 3
+$NFT add rule t c position 2 drop
+
+EXPECTED="table ip t {
+	chain c {
+		accept 
+		drop 
+		accept 
+	}
+}"
+
+GET="$($NFT list ruleset)"
+
+if [ "$EXPECTED" != "$GET" ] ; then
+	DIFF="$(which diff)"
+	[ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+	exit 1
+fi
diff --git a/tests/shell/testcases/rule_management/0002insertposition_0 b/tests/shell/testcases/rule_management/0002insertposition_0
new file mode 100755
index 0000000..49fcf7c
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0002insertposition_0
@@ -0,0 +1,27 @@ 
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+$NFT add rule t c accept	# should have handle 2
+$NFT add rule t c accept	# should have handle 3
+$NFT insert rule t c position 2 drop
+
+EXPECTED="table ip t {
+	chain c {
+		drop 
+		accept 
+		accept 
+	}
+}"
+
+GET="$($NFT list ruleset)"
+
+if [ "$EXPECTED" != "$GET" ] ; then
+	DIFF="$(which diff)"
+	[ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+	exit 1
+fi
diff --git a/tests/shell/testcases/rule_management/0003insert_0 b/tests/shell/testcases/rule_management/0003insert_0
new file mode 100755
index 0000000..407a293
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0003insert_0
@@ -0,0 +1,27 @@ 
+#!/bin/bash
+
+# tests for Netfilter bug #965
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+$NFT insert rule t c accept
+$NFT insert rule t c drop
+$NFT insert rule t c masquerade
+
+EXPECTED="table ip t {
+	chain c {
+		masquerade 
+		drop 
+		accept 
+	}
+}"
+
+GET="$($NFT list ruleset)"
+
+if [ "$EXPECTED" != "$GET" ] ; then
+	DIFF="$(which diff)"
+	[ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+	exit 1
+fi
diff --git a/tests/shell/testcases/rule_management/0004replace_0 b/tests/shell/testcases/rule_management/0004replace_0
new file mode 100755
index 0000000..92acc30
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0004replace_0
@@ -0,0 +1,24 @@ 
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+$NFT add rule t c accept	# should have handle 2
+$NFT replace rule t c handle 2 drop
+
+EXPECTED="table ip t {
+	chain c {
+		drop 
+	}
+}"
+
+GET="$($NFT list ruleset)"
+
+if [ "$EXPECTED" != "$GET" ] ; then
+	DIFF="$(which diff)"
+	[ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+	exit 1
+fi
diff --git a/tests/shell/testcases/rule_management/0005replace_1 b/tests/shell/testcases/rule_management/0005replace_1
new file mode 100755
index 0000000..e82995a
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0005replace_1
@@ -0,0 +1,11 @@ 
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+# kernel should return ENOENT
+$NFT replace rule t c handle 2 drop 2>/dev/null
+echo "E: missing kernel ENOENT" >&2
diff --git a/tests/shell/testcases/rule_management/0006replace_1 b/tests/shell/testcases/rule_management/0006replace_1
new file mode 100755
index 0000000..5dfcba0
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0006replace_1
@@ -0,0 +1,11 @@ 
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+# position keyword with replace action is not allowed, this should fail
+$NFT replace rule t c position 2 drop 2>/dev/null
+echo "E: allowed replace with position specification" >&2
diff --git a/tests/shell/testcases/rule_management/0007delete_0 b/tests/shell/testcases/rule_management/0007delete_0
new file mode 100755
index 0000000..8b00cd3
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0007delete_0
@@ -0,0 +1,25 @@ 
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+$NFT add rule t c accept	# should have handle 2
+$NFT add rule t c drop		# should have handle 3
+$NFT delete rule t c handle 2
+
+EXPECTED="table ip t {
+	chain c {
+		drop 
+	}
+}"
+
+GET="$($NFT list ruleset)"
+
+if [ "$EXPECTED" != "$GET" ] ; then
+	DIFF="$(which diff)"
+	[ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+	exit 1
+fi
diff --git a/tests/shell/testcases/rule_management/0008delete_1 b/tests/shell/testcases/rule_management/0008delete_1
new file mode 100755
index 0000000..3dce219
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0008delete_1
@@ -0,0 +1,11 @@ 
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+# this should fail, we don't allow delete with position
+$NFT delete rule t c position 2 drop 2>/dev/null
+echo "E: allowed position spec with delete action" >&2
diff --git a/tests/shell/testcases/rule_management/0009delete_1 b/tests/shell/testcases/rule_management/0009delete_1
new file mode 100755
index 0000000..87fec60
--- /dev/null
+++ b/tests/shell/testcases/rule_management/0009delete_1
@@ -0,0 +1,11 @@ 
+#!/bin/bash
+
+# tests for Netfilter bug #965 and the related fix
+# (regarding rule management with a given position/handle spec)
+
+set -e
+$NFT add table t
+$NFT add chain t c
+# kernel ENOENT
+$NFT delete rule t c handle 3333 2>/dev/null
+echo "E: missing kernel ENOENT" >&2