path: root/iptables/tests
diff options
authorPhil Sutter <>2020-07-31 18:20:17 +0200
committerPhil Sutter <>2020-08-14 09:04:00 +0200
commit4e3c11a6f5a94f746ed54f0ae96e8c750be1b64a (patch)
tree96f165fcfc95cdfc029c3cbcd5b3de2ef31bce37 /iptables/tests
parentca69b0290dc509d72118f0a054a5c740cb913875 (diff)
nft: Fix for ruleset flush while restoring
If ruleset is flushed while an instance of iptables-nft-restore is running and has seen a COMMIT line once, it doesn't notice the disappeared table while handling the next COMMIT. This is due to table existence being tracked via 'initialized' boolean which is only reset by nft_table_flush(). To fix this, drop the dedicated 'initialized' boolean and switch users to the recently introduced 'exists' one. As a side-effect, this causes base chain existence being checked for each command calling nft_xt_builtin_init() as the old 'initialized' bit was used to track if that function has been called before or not. Signed-off-by: Phil Sutter <> Acked-by: Pablo Neira Ayuso <>
Diffstat (limited to 'iptables/tests')
1 files changed, 23 insertions, 0 deletions
diff --git a/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 b/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0
new file mode 100755
index 00000000..43880ffb
--- /dev/null
+++ b/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0
@@ -0,0 +1,23 @@
+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
+nft -v >/dev/null || { echo "skip $XT_MULTI (no nft)"; exit 0; }
+coproc $XT_MULTI iptables-restore --noflush
+cat >&"${COPROC[1]}" <<EOF
+:foo [0:0]
+:foo [0:0]
+$XT_MULTI iptables-save | grep -q ':foo'
+nft flush ruleset
+echo "COMMIT" >&"${COPROC[1]}"
+sleep 1
+[[ -n $COPROC_PID ]] && kill $COPROC_PID