blob: 5482b7ea17298950fcdc572d7411a1c8b105e7aa (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
|
#!/bin/bash
# Make sure iptables-restore does the right thing
# when encountering INSERT rules with index.
set -e
# show rules, drop uninteresting policy settings
ipt_show() {
$XT_MULTI iptables -S | grep -v '^-P'
}
# basic issue reproducer
$XT_MULTI iptables-restore <<EOF
*filter
-A FORWARD -m comment --comment "rule 4" -j ACCEPT
-I FORWARD 1 -m comment --comment "rule 1" -j ACCEPT
-I FORWARD 2 -m comment --comment "rule 2" -j ACCEPT
-I FORWARD 3 -m comment --comment "rule 3" -j ACCEPT
COMMIT
EOF
EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT
-A FORWARD -m comment --comment "rule 2" -j ACCEPT
-A FORWARD -m comment --comment "rule 3" -j ACCEPT
-A FORWARD -m comment --comment "rule 4" -j ACCEPT'
diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
# insert rules into existing ruleset
$XT_MULTI iptables-restore --noflush <<EOF
*filter
-A FORWARD -m comment --comment "rule 5" -j ACCEPT
-I FORWARD 1 -m comment --comment "rule 0.5" -j ACCEPT
-I FORWARD 3 -m comment --comment "rule 1.5" -j ACCEPT
-I FORWARD 5 -m comment --comment "rule 2.5" -j ACCEPT
-I FORWARD 7 -m comment --comment "rule 3.5" -j ACCEPT
-I FORWARD 9 -m comment --comment "rule 4.5" -j ACCEPT
-I FORWARD 11 -m comment --comment "rule 5.5" -j ACCEPT
-A FORWARD -m comment --comment "rule 6" -j ACCEPT
COMMIT
EOF
EXPECT='-A FORWARD -m comment --comment "rule 0.5" -j ACCEPT
-A FORWARD -m comment --comment "rule 1" -j ACCEPT
-A FORWARD -m comment --comment "rule 1.5" -j ACCEPT
-A FORWARD -m comment --comment "rule 2" -j ACCEPT
-A FORWARD -m comment --comment "rule 2.5" -j ACCEPT
-A FORWARD -m comment --comment "rule 3" -j ACCEPT
-A FORWARD -m comment --comment "rule 3.5" -j ACCEPT
-A FORWARD -m comment --comment "rule 4" -j ACCEPT
-A FORWARD -m comment --comment "rule 4.5" -j ACCEPT
-A FORWARD -m comment --comment "rule 5" -j ACCEPT
-A FORWARD -m comment --comment "rule 5.5" -j ACCEPT
-A FORWARD -m comment --comment "rule 6" -j ACCEPT'
diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
# insert rules in between added ones
$XT_MULTI iptables-restore <<EOF
*filter
-A FORWARD -m comment --comment "appended rule 1" -j ACCEPT
-A FORWARD -m comment --comment "appended rule 2" -j ACCEPT
-A FORWARD -m comment --comment "appended rule 3" -j ACCEPT
-I FORWARD 1 -m comment --comment "rule 1" -j ACCEPT
-I FORWARD 3 -m comment --comment "rule 2" -j ACCEPT
-I FORWARD 5 -m comment --comment "rule 3" -j ACCEPT
COMMIT
EOF
EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT
-A FORWARD -m comment --comment "appended rule 1" -j ACCEPT
-A FORWARD -m comment --comment "rule 2" -j ACCEPT
-A FORWARD -m comment --comment "appended rule 2" -j ACCEPT
-A FORWARD -m comment --comment "rule 3" -j ACCEPT
-A FORWARD -m comment --comment "appended rule 3" -j ACCEPT'
diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
# test rule deletion in dump files
$XT_MULTI iptables-restore --noflush <<EOF
*filter
-A FORWARD -m comment --comment "appended rule 4" -j ACCEPT
-D FORWARD 7
-D FORWARD -m comment --comment "appended rule 1" -j ACCEPT
-D FORWARD 3
-I FORWARD 3 -m comment --comment "manually replaced rule 2" -j ACCEPT
COMMIT
EOF
EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT
-A FORWARD -m comment --comment "rule 2" -j ACCEPT
-A FORWARD -m comment --comment "manually replaced rule 2" -j ACCEPT
-A FORWARD -m comment --comment "rule 3" -j ACCEPT
-A FORWARD -m comment --comment "appended rule 3" -j ACCEPT'
diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
# test rule replacement in dump files
$XT_MULTI iptables-restore <<EOF
*filter
-A FORWARD -m comment --comment "rule 1" -j ACCEPT
-A FORWARD -m comment --comment "rule to be replaced" -j ACCEPT
-A FORWARD -m comment --comment "rule 3" -j ACCEPT
COMMIT
EOF
$XT_MULTI iptables-restore --noflush <<EOF
*filter
-R FORWARD 2 -m comment --comment "replacement" -j ACCEPT
-I FORWARD 2 -m comment --comment "insert referencing replaced rule" -j ACCEPT
COMMIT
EOF
EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT
-A FORWARD -m comment --comment "insert referencing replaced rule" -j ACCEPT
-A FORWARD -m comment --comment replacement -j ACCEPT
-A FORWARD -m comment --comment "rule 3" -j ACCEPT'
diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
# test adding, referencing and deleting the same rule in a batch
$XT_MULTI iptables-restore <<EOF
*filter
-A FORWARD -m comment --comment "first rule" -j ACCEPT
-A FORWARD -m comment --comment "referenced rule" -j ACCEPT
-I FORWARD 2 -m comment --comment "referencing rule" -j ACCEPT
-D FORWARD -m comment --comment "referenced rule" -j ACCEPT
COMMIT
EOF
EXPECT='-A FORWARD -m comment --comment "first rule" -j ACCEPT
-A FORWARD -m comment --comment "referencing rule" -j ACCEPT'
diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
|
