diff options
| -rw-r--r-- | iptables/nft.c | 3 | ||||
| -rwxr-xr-x | iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 | 18 |
2 files changed, 16 insertions, 5 deletions
diff --git a/iptables/nft.c b/iptables/nft.c index a2c43e83..0249cbbe 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -2199,6 +2199,9 @@ static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule *r) nftnl_rule_list_del(r); + if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE)) + nftnl_rule_set_u32(r, NFTNL_RULE_ID, ++h->rule_id); + obj = batch_rule_add(h, NFT_COMPAT_RULE_DELETE, r); if (!obj) { nftnl_rule_free(r); diff --git a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 index 51f2422e..3f1d229e 100755 --- a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 +++ b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 @@ -14,7 +14,7 @@ ipt_show() { $XT_MULTI iptables-restore <<EOF *filter --A FORWARD -m comment --comment "appended rule" -j ACCEPT +-A FORWARD -m comment --comment "rule 4" -j ACCEPT -I FORWARD 1 -m comment --comment "rule 1" -j ACCEPT -I FORWARD 2 -m comment --comment "rule 2" -j ACCEPT -I FORWARD 3 -m comment --comment "rule 3" -j ACCEPT @@ -24,7 +24,7 @@ EOF EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT -A FORWARD -m comment --comment "rule 2" -j ACCEPT -A FORWARD -m comment --comment "rule 3" -j ACCEPT --A FORWARD -m comment --comment "appended rule" -j ACCEPT' +-A FORWARD -m comment --comment "rule 4" -j ACCEPT' diff -u -Z <(echo -e "$EXPECT") <(ipt_show) @@ -32,11 +32,14 @@ diff -u -Z <(echo -e "$EXPECT") <(ipt_show) $XT_MULTI iptables-restore --noflush <<EOF *filter +-A FORWARD -m comment --comment "rule 5" -j ACCEPT -I FORWARD 1 -m comment --comment "rule 0.5" -j ACCEPT -I FORWARD 3 -m comment --comment "rule 1.5" -j ACCEPT -I FORWARD 5 -m comment --comment "rule 2.5" -j ACCEPT -I FORWARD 7 -m comment --comment "rule 3.5" -j ACCEPT --I FORWARD 9 -m comment --comment "appended rule 2" -j ACCEPT +-I FORWARD 9 -m comment --comment "rule 4.5" -j ACCEPT +-I FORWARD 11 -m comment --comment "rule 5.5" -j ACCEPT +-A FORWARD -m comment --comment "rule 6" -j ACCEPT COMMIT EOF @@ -47,8 +50,11 @@ EXPECT='-A FORWARD -m comment --comment "rule 0.5" -j ACCEPT -A FORWARD -m comment --comment "rule 2.5" -j ACCEPT -A FORWARD -m comment --comment "rule 3" -j ACCEPT -A FORWARD -m comment --comment "rule 3.5" -j ACCEPT --A FORWARD -m comment --comment "appended rule" -j ACCEPT --A FORWARD -m comment --comment "appended rule 2" -j ACCEPT' +-A FORWARD -m comment --comment "rule 4" -j ACCEPT +-A FORWARD -m comment --comment "rule 4.5" -j ACCEPT +-A FORWARD -m comment --comment "rule 5" -j ACCEPT +-A FORWARD -m comment --comment "rule 5.5" -j ACCEPT +-A FORWARD -m comment --comment "rule 6" -j ACCEPT' diff -u -Z <(echo -e "$EXPECT") <(ipt_show) @@ -78,6 +84,8 @@ diff -u -Z <(echo -e "$EXPECT") <(ipt_show) $XT_MULTI iptables-restore --noflush <<EOF *filter +-A FORWARD -m comment --comment "appended rule 4" -j ACCEPT +-D FORWARD 7 -D FORWARD -m comment --comment "appended rule 1" -j ACCEPT -D FORWARD 3 -I FORWARD 3 -m comment --comment "manually replaced rule 2" -j ACCEPT |