From decc12ec2dc319a9bb1fb5f629258c6c3a087db1 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 12 Nov 2019 20:00:15 +0100 Subject: segtree: Check ranges when deleting elements Make sure any intervals to delete actually exist, otherwise reject the command. Without this, it is possible to mess up rbtree contents: | # nft list ruleset | table ip t { | set s { | type ipv4_addr | flags interval | auto-merge | elements = { 192.168.1.0-192.168.1.254, 192.168.1.255 } | } | } | # nft delete element t s '{ 192.168.1.0/24 }' | # nft list ruleset | table ip t { | set s { | type ipv4_addr | flags interval | auto-merge | elements = { 192.168.1.255-255.255.255.255 } | } | } Signed-off-by: Phil Sutter Acked-by: Pablo Neira Ayuso --- tests/shell/testcases/sets/0039delete_interval_0 | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100755 tests/shell/testcases/sets/0039delete_interval_0 (limited to 'tests') diff --git a/tests/shell/testcases/sets/0039delete_interval_0 b/tests/shell/testcases/sets/0039delete_interval_0 new file mode 100755 index 00000000..19df16ec --- /dev/null +++ b/tests/shell/testcases/sets/0039delete_interval_0 @@ -0,0 +1,17 @@ +#!/bin/bash + +# Make sure nft allows to delete existing ranges only + +RULESET=" +table t { + set s { + type ipv4_addr + flags interval + elements = { 192.168.1.0-192.168.1.254, 192.168.1.255 } + } +}" + +$NFT -f - <<< "$RULESET" || { echo "E: Can't load basic ruleset" 1>&2; exit 1; } + +$NFT delete element t s '{ 192.168.1.0/24 }' 2>/dev/null || exit 0 +echo "E: Deletion of non-existing range allowed" 1>&2 -- cgit v1.2.3