From 7ea0b7d809229973d950ed99845bdd0b2eb4cbb7 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 15 Jan 2019 23:23:05 +0100 Subject: xtables: Fix for inserting rule at wrong position iptables-restore allows to insert rules at a certain position which is problematic for iptables-nft to realize since rule position is not determined by number but handle of previous or following rule and in case the rules surrounding the new one are new as well, they don't have a handle to refer to yet. Fix this by making use of NFTNL_RULE_POSITION_ID attribute: When inserting before a rule which does not have a handle, refer to it using its NFTNL_RULE_ID value. If the latter doesn't exist either, assign a new one to it. The last used rule ID value is tracked in a new field of struct nft_handle which is incremented before each use. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- .../testcases/ipt-restore/0003-restore-ordering_0 | 117 +++++++++++++++++++++ 1 file changed, 117 insertions(+) create mode 100755 iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 (limited to 'iptables/tests/shell/testcases/ipt-restore') diff --git a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 new file mode 100755 index 00000000..51f2422e --- /dev/null +++ b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 @@ -0,0 +1,117 @@ +#!/bin/bash + +# Make sure iptables-restore does the right thing +# when encountering INSERT rules with index. + +set -e + +# show rules, drop uninteresting policy settings +ipt_show() { + $XT_MULTI iptables -S | grep -v '^-P' +} + +# basic issue reproducer + +$XT_MULTI iptables-restore <