summaryrefslogtreecommitdiffstats
path: root/tests
diff options
context:
space:
mode:
authorPhil Sutter <phil@nwl.cc>2019-11-12 20:00:15 +0100
committerPhil Sutter <phil@nwl.cc>2019-11-14 11:55:59 +0100
commitdecc12ec2dc319a9bb1fb5f629258c6c3a087db1 (patch)
treefed83acb56e111b8e4acd98edbcf5e95985d79bc /tests
parentead5aaf4fed074f126ab1b32536e234bf6bf2276 (diff)
segtree: Check ranges when deleting elements
Make sure any intervals to delete actually exist, otherwise reject the command. Without this, it is possible to mess up rbtree contents: | # nft list ruleset | table ip t { | set s { | type ipv4_addr | flags interval | auto-merge | elements = { 192.168.1.0-192.168.1.254, 192.168.1.255 } | } | } | # nft delete element t s '{ 192.168.1.0/24 }' | # nft list ruleset | table ip t { | set s { | type ipv4_addr | flags interval | auto-merge | elements = { 192.168.1.255-255.255.255.255 } | } | } Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests')
-rwxr-xr-xtests/shell/testcases/sets/0039delete_interval_017
1 files changed, 17 insertions, 0 deletions
diff --git a/tests/shell/testcases/sets/0039delete_interval_0 b/tests/shell/testcases/sets/0039delete_interval_0
new file mode 100755
index 00000000..19df16ec
--- /dev/null
+++ b/tests/shell/testcases/sets/0039delete_interval_0
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+# Make sure nft allows to delete existing ranges only
+
+RULESET="
+table t {
+ set s {
+ type ipv4_addr
+ flags interval
+ elements = { 192.168.1.0-192.168.1.254, 192.168.1.255 }
+ }
+}"
+
+$NFT -f - <<< "$RULESET" || { echo "E: Can't load basic ruleset" 1>&2; exit 1; }
+
+$NFT delete element t s '{ 192.168.1.0/24 }' 2>/dev/null || exit 0
+echo "E: Deletion of non-existing range allowed" 1>&2