From 4e3c11a6f5a94f746ed54f0ae96e8c750be1b64a Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 31 Jul 2020 18:20:17 +0200 Subject: nft: Fix for ruleset flush while restoring If ruleset is flushed while an instance of iptables-nft-restore is running and has seen a COMMIT line once, it doesn't notice the disappeared table while handling the next COMMIT. This is due to table existence being tracked via 'initialized' boolean which is only reset by nft_table_flush(). To fix this, drop the dedicated 'initialized' boolean and switch users to the recently introduced 'exists' one. As a side-effect, this causes base chain existence being checked for each command calling nft_xt_builtin_init() as the old 'initialized' bit was used to track if that function has been called before or not. Signed-off-by: Phil Sutter Acked-by: Pablo Neira Ayuso --- .../testcases/nft-only/0007-mid-restore-flush_0 | 23 ++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100755 iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 (limited to 'iptables/tests/shell') diff --git a/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 b/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 new file mode 100755 index 00000000..43880ffb --- /dev/null +++ b/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 @@ -0,0 +1,23 @@ +#!/bin/bash + +[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } +nft -v >/dev/null || { echo "skip $XT_MULTI (no nft)"; exit 0; } + +coproc $XT_MULTI iptables-restore --noflush + +cat >&"${COPROC[1]}" <&"${COPROC[1]}" +sleep 1 + +[[ -n $COPROC_PID ]] && kill $COPROC_PID +wait -- cgit v1.2.3