[iptables PATCH 1/2] tests: iptables-test: Properly assert rule deletion errors

[iptables PATCH 1/2] tests: iptables-test: Properly assert rule deletion errors

[Phil Sutter]

Capture any non-zero return code, iptables not necessarily returns 1 on
error.

A known issue with trying to delete a rule by spec is the unsupported
--set-counters option. Strip it before deleting the rule.

Fixes: c8b7aaabbe1fc ("add iptables unit test infrastructure")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 iptables-test.py | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/iptables-test.py b/iptables-test.py
index 0d2f30dfb0d7c..413e3fdccc9e3 100755
--- a/iptables-test.py
+++ b/iptables-test.py
@@ -58,10 +58,23 @@ STDERR_IS_TTY = sys.stderr.isatty()
 def delete_rule(iptables, rule, filename, lineno, netns = None):
     '''
     Removes an iptables rule
+
+    Remove any --set-counters arguments, --delete rejects them.
     '''
+    delrule = rule.split()
+    for i in range(len(delrule)):
+        if delrule[i] in ['-c', '--set-counters']:
+            delrule.pop(i)
+            if ',' in delrule.pop(i):
+                break
+            if len(delrule) > i and delrule[i].isnumeric():
+                delrule.pop(i)
+            break
+    rule = " ".join(delrule)
+
     cmd = iptables + " -D " + rule
     ret = execute_cmd(cmd, filename, lineno, netns)
-    if ret == 1:
+    if ret != 0:
         reason = "cannot delete: " + iptables + " -I " + rule
         print_error(reason, filename, lineno)
         return -1
-- 
2.47.0

[iptables PATCH 2/2] tests: iptables-test: Extend fast mode docs a bit

[Phil Sutter]

To make things less confusing for new readers, describe at least what
the two significant functions do.

Fixes: 0e80cfea3762b ("tests: iptables-test: Implement fast test mode")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 iptables-test.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/iptables-test.py b/iptables-test.py
index 413e3fdccc9e3..141fec7b4ed16 100755
--- a/iptables-test.py
+++ b/iptables-test.py
@@ -241,10 +241,14 @@ STDERR_IS_TTY = sys.stderr.isatty()
 
 def fast_run_possible(filename):
     '''
-    Keep things simple, run only for simple test files:
+    Return true if fast test run is possible.
+
+    To keep things simple, run only for simple test files:
     - no external commands
     - no multiple tables
     - no variant-specific results
+
+    :param filename: test file to inspect
     '''
     table = None
     rulecount = 0
@@ -267,6 +271,9 @@ STDERR_IS_TTY = sys.stderr.isatty()
     '''
     Run a test file, but fast
 
+    Add all non-failing rules at once by use of iptables-restore, then check
+    all rules' listing at once by use of iptables-save.
+
     :param filename: name of the file with the test rules
     :param netns: network namespace to perform test run in
     '''
-- 
2.47.0

Re: [iptables PATCH 1/2] tests: iptables-test: Properly assert rule deletion errors

[Phil Sutter]

On Tue, Nov 05, 2024 at 09:36:10PM +0100, Phil Sutter wrote:
> Capture any non-zero return code, iptables not necessarily returns 1 on
> error.
> 
> A known issue with trying to delete a rule by spec is the unsupported
> --set-counters option. Strip it before deleting the rule.
> 
> Fixes: c8b7aaabbe1fc ("add iptables unit test infrastructure")
> Signed-off-by: Phil Sutter <phil@nwl.cc>

Series applied.