From d3c8051cb767693a6902ed9350e923b25198310c Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Sat, 5 Jun 2021 11:32:46 +0200 Subject: rule: rework CMD_OBJ_SETELEMS logic Do not clone the set and zap the elements during the set and map expansion to the CMD_OBJ_SETELEMS command. Instead, update the CMD_OBJ_SET command to add the set to the kernel (without elements) and let CMD_OBJ_SETELEMS add the elements. The CMD_OBJ_SET command calls set_to_intervals() to update set->init->size (NFTNL_SET_DESC_SIZE) before adding the set to the kernel. Updating the set size from do_add_setelems() comes too late, it might result in spurious ENFILE errors for interval sets. Moreover, skip CMD_OBJ_SETELEMS if the set definition specifies no elements. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1500 Fixes: c9eae091983a ("src: add CMD_OBJ_SETELEMS") Signed-off-by: Pablo Neira Ayuso --- tests/shell/testcases/nft-f/0026listing_0 | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100755 tests/shell/testcases/nft-f/0026listing_0 (limited to 'tests/shell/testcases/nft-f') diff --git a/tests/shell/testcases/nft-f/0026listing_0 b/tests/shell/testcases/nft-f/0026listing_0 new file mode 100755 index 00000000..0f2f27c6 --- /dev/null +++ b/tests/shell/testcases/nft-f/0026listing_0 @@ -0,0 +1,14 @@ +#!/bin/bash + +# This is like "flush ruleset" except only flushes THIS ruleset, not ALL rulesets. +# In particular, it leaves the dynamic sshguard/fail2ban deny lists untouched. +RULESET="add table A +delete table A +table A { + chain B { + tcp dport {1,2} accept + } +} +list ruleset" + +exec $NFT -f - <<< "$RULESET" -- cgit v1.2.3