diff options
| author | Phil Sutter <phil@nwl.cc> | 2019-11-12 20:00:15 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2019-11-14 11:55:59 +0100 |
| commit | decc12ec2dc319a9bb1fb5f629258c6c3a087db1 (patch) | |
| tree | fed83acb56e111b8e4acd98edbcf5e95985d79bc /tests/shell/testcases/sets | |
| parent | ead5aaf4fed074f126ab1b32536e234bf6bf2276 (diff) | |
segtree: Check ranges when deleting elements
Make sure any intervals to delete actually exist, otherwise reject the
command. Without this, it is possible to mess up rbtree contents:
| # nft list ruleset
| table ip t {
| set s {
| type ipv4_addr
| flags interval
| auto-merge
| elements = { 192.168.1.0-192.168.1.254, 192.168.1.255 }
| }
| }
| # nft delete element t s '{ 192.168.1.0/24 }'
| # nft list ruleset
| table ip t {
| set s {
| type ipv4_addr
| flags interval
| auto-merge
| elements = { 192.168.1.255-255.255.255.255 }
| }
| }
Signed-off-by: Phil Sutter <phil@nwl.cc>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests/shell/testcases/sets')
| -rwxr-xr-x | tests/shell/testcases/sets/0039delete_interval_0 | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/tests/shell/testcases/sets/0039delete_interval_0 b/tests/shell/testcases/sets/0039delete_interval_0 new file mode 100755 index 00000000..19df16ec --- /dev/null +++ b/tests/shell/testcases/sets/0039delete_interval_0 @@ -0,0 +1,17 @@ +#!/bin/bash + +# Make sure nft allows to delete existing ranges only + +RULESET=" +table t { + set s { + type ipv4_addr + flags interval + elements = { 192.168.1.0-192.168.1.254, 192.168.1.255 } + } +}" + +$NFT -f - <<< "$RULESET" || { echo "E: Can't load basic ruleset" 1>&2; exit 1; } + +$NFT delete element t s '{ 192.168.1.0/24 }' 2>/dev/null || exit 0 +echo "E: Deletion of non-existing range allowed" 1>&2 |