summaryrefslogtreecommitdiffstats
path: root/iptables/tests/shell
diff options
context:
space:
mode:
authorPhil Sutter <phil@nwl.cc>2018-08-16 18:07:07 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2018-08-16 19:43:47 +0200
commit6f29aa8e3486e2c12ab48425a7e9b01dd6417665 (patch)
tree9c418bb7565c400c1e3155ccd2d745c89c81128a /iptables/tests/shell
parent7bccf30750cb7ad7d56921c220a95a7781316a7b (diff)
xtables: Make 'iptables -S nonexisting' return non-zero
To be consistent with legacy iptables, calling -S with a non-existing chain should lead to an error message. This is how some scripts find out whether a user-defined chain exists or not. Make sure doing the same for an existing chain does succeed, even if an invalid rule number was given. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables/tests/shell')
-rwxr-xr-xiptables/tests/shell/testcases/ip6tables/0003-list-rules_064
-rwxr-xr-xiptables/tests/shell/testcases/iptables/0003-list-rules_016
2 files changed, 80 insertions, 0 deletions
diff --git a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
new file mode 100755
index 00000000..c98bdd6e
--- /dev/null
+++ b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
@@ -0,0 +1,64 @@
+#!/bin/bash
+
+set -e
+
+$XT_MULTI ip6tables -N foo
+$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT
+$XT_MULTI ip6tables -A FORWARD -i eth42 -o eth23 -g foo
+$XT_MULTI ip6tables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT
+
+EXPECT='-P INPUT ACCEPT
+-P FORWARD ACCEPT
+-P OUTPUT ACCEPT
+-N foo
+-A FORWARD -i eth23 -o eth42 -j ACCEPT
+-A FORWARD -i eth42 -o eth23 -g foo'
+
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S)
+
+EXPECT='-P INPUT ACCEPT -c 0 0
+-P FORWARD ACCEPT -c 0 0
+-P OUTPUT ACCEPT -c 0 0
+-N foo
+-A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
+-A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S)
+
+EXPECT='-P FORWARD ACCEPT
+-A FORWARD -i eth23 -o eth42 -j ACCEPT
+-A FORWARD -i eth42 -o eth23 -g foo'
+
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S FORWARD)
+
+EXPECT='-P FORWARD ACCEPT -c 0 0
+-A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
+-A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S FORWARD)
+
+EXPECT='-P OUTPUT ACCEPT
+-A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT'
+
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -t nat -S OUTPUT)
+
+EXPECT='-P OUTPUT ACCEPT -c 0 0
+-A OUTPUT -o eth123 -m mark --mark 0x42 -c 0 0 -j ACCEPT'
+
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -t nat -S OUTPUT)
+
+# some of the following commands are supposed to fail
+set +e
+
+$XT_MULTI ip6tables -S nonexistent && {
+ echo "list-rules in non-existent chain should fail"
+ exit 1
+}
+$XT_MULTI ip6tables -S nonexistent 23 && {
+ echo "list-rules in non-existent chain with given rule number should fail"
+ exit 1
+}
+$XT_MULTI ip6tables -S FORWARD 234 || {
+ echo "list-rules in existent chain with invalid rule number should succeed"
+ exit 1
+}
diff --git a/iptables/tests/shell/testcases/iptables/0003-list-rules_0 b/iptables/tests/shell/testcases/iptables/0003-list-rules_0
index 2e87ce5a..d335d442 100755
--- a/iptables/tests/shell/testcases/iptables/0003-list-rules_0
+++ b/iptables/tests/shell/testcases/iptables/0003-list-rules_0
@@ -46,3 +46,19 @@ EXPECT='-P OUTPUT ACCEPT -c 0 0
-A OUTPUT -o eth123 -m mark --mark 0x42 -c 0 0 -j ACCEPT'
diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -t nat -S OUTPUT)
+
+# some of the following commands are supposed to fail
+set +e
+
+$XT_MULTI iptables -S nonexistent && {
+ echo "list-rules in non-existent chain should fail"
+ exit 1
+}
+$XT_MULTI iptables -S nonexistent 23 && {
+ echo "list-rules in non-existent chain with given rule number should fail"
+ exit 1
+}
+$XT_MULTI iptables -S FORWARD 234 || {
+ echo "list-rules in existent chain with invalid rule number should succeed"
+ exit 1
+}