diff options
| -rw-r--r-- | src/rule.c | 15 | ||||
| -rwxr-xr-x | tests/shell/testcases/include/0020include_chain_0 | 23 | ||||
| -rw-r--r-- | tests/shell/testcases/include/dumps/0020include_chain_0.nft | 6 |
3 files changed, 41 insertions, 3 deletions
@@ -1312,11 +1312,12 @@ void cmd_add_loc(struct cmd *cmd, uint16_t offset, const struct location *loc) static void nft_cmd_expand_chain(struct chain *chain, struct list_head *new_cmds) { - struct rule *rule; + struct rule *rule, *next; struct handle h; struct cmd *new; - list_for_each_entry(rule, &chain->rules, list) { + list_for_each_entry_safe(rule, next, &chain->rules, list) { + list_del(&rule->list); memset(&h, 0, sizeof(h)); handle_merge(&h, &rule->handle); if (chain->flags & CHAIN_F_BINDING) { @@ -1324,7 +1325,7 @@ static void nft_cmd_expand_chain(struct chain *chain, struct list_head *new_cmds rule->handle.chain.location = chain->location; } new = cmd_alloc(CMD_ADD, CMD_OBJ_RULE, &h, - &rule->location, rule_get(rule)); + &rule->location, rule); list_add_tail(&new->list, new_cmds); } } @@ -1385,6 +1386,14 @@ void nft_cmd_expand(struct cmd *cmd) list_splice(&new_cmds, &cmd->list); break; + case CMD_OBJ_CHAIN: + chain = cmd->chain; + if (!chain || list_empty(&chain->rules)) + break; + + nft_cmd_expand_chain(chain, &new_cmds); + list_splice(&new_cmds, &cmd->list); + break; case CMD_OBJ_SET: case CMD_OBJ_MAP: set = cmd->set; diff --git a/tests/shell/testcases/include/0020include_chain_0 b/tests/shell/testcases/include/0020include_chain_0 new file mode 100755 index 00000000..8f78e8c6 --- /dev/null +++ b/tests/shell/testcases/include/0020include_chain_0 @@ -0,0 +1,23 @@ +#!/bin/bash + +set -e + +tmpfile1=$(mktemp -p .) +if [ ! -w $tmpfile1 ] ; then + echo "Failed to create tmp file" >&2 + exit 0 +fi + +trap "rm -rf $tmpfile1" EXIT # cleanup if aborted + +RULESET="table inet filter { } +include \"$tmpfile1\"" + +RULESET2="chain inet filter input2 { + type filter hook input priority filter; policy accept; + ip saddr 1.2.3.4 tcp dport { 22, 443, 123 } drop +}" + +echo "$RULESET2" > $tmpfile1 + +$NFT -o -f - <<< $RULESET diff --git a/tests/shell/testcases/include/dumps/0020include_chain_0.nft b/tests/shell/testcases/include/dumps/0020include_chain_0.nft new file mode 100644 index 00000000..3ad6db14 --- /dev/null +++ b/tests/shell/testcases/include/dumps/0020include_chain_0.nft @@ -0,0 +1,6 @@ +table inet filter { + chain input2 { + type filter hook input priority filter; policy accept; + ip saddr 1.2.3.4 tcp dport { 22, 123, 443 } drop + } +} |