Linux Netfilter development
 help / color / mirror / Atom feed
* [nft PATCH] tests: shell: Test odd netdev hook updates
@ 2026-08-27 20:42 Phil Sutter
  2026-09-01  7:54 ` Fernando Fernandez Mancera
  0 siblings, 1 reply; 5+ messages in thread
From: Phil Sutter @ 2026-08-27 20:42 UTC (permalink / raw)
  To: Pablo Neira Ayuso; +Cc: netfilter-devel, Fernando Fernandez Mancera

These should cover what Fernando fixes in his kernel patch "netfilter:
nf_tables: fix device name and prefix match in hook lookup" as well as
some bonus cases I came up with.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 .../chains/netdev_chain_update_wildcard_hook  | 45 +++++++++++++++++++
 .../testcases/flowtable/update_wildcard_hook  | 45 +++++++++++++++++++
 2 files changed, 90 insertions(+)
 create mode 100755 tests/shell/testcases/chains/netdev_chain_update_wildcard_hook
 create mode 100755 tests/shell/testcases/flowtable/update_wildcard_hook

diff --git a/tests/shell/testcases/chains/netdev_chain_update_wildcard_hook b/tests/shell/testcases/chains/netdev_chain_update_wildcard_hook
new file mode 100755
index 0000000000000..1381f4be2a5f1
--- /dev/null
+++ b/tests/shell/testcases/chains/netdev_chain_update_wildcard_hook
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# NFT_TEST_REQUIRES(NFT_TEST_HAVE_ifname_based_hooks)
+
+RC=0
+
+die() {
+	echo "FAIL: $@"
+	((RC++))
+	$NFT list ruleset
+}
+
+$NFT add table netdev t || die "add table failed"
+
+do_chain() { # (cmd, devspec, thp)
+	$NFT $1 chain netdev t c "{ $3 devices = { $2 }; }"
+}
+
+thp='type filter hook ingress priority 0;'
+
+do_chain add foo* "$thp" || die "initial add chain failed"
+do_chain create foo* "$thp" && die "duplicated create initial chain allowed"
+do_chain add foo* || die "duplicated hook add failed"
+
+do_chain add "bar*, bar*" && die "duplicate wildcard add allowed"
+do_chain add "bar, bar" && die "duplicate device add allowed"
+
+do_chain add foo && die "update with non-wildcard allowed"
+do_chain add fo* && die "update with shorter wildcard allowed"
+do_chain add fooo* && die "update with longer wildcard allowed"
+
+# add after testing delete in case deletion is allowed when it should not
+
+do_chain delete foo && die "delete non-wildcard hook allowed"
+do_chain add foo* || die "duplicated hook add failed"
+
+do_chain delete fo* && die "delete shorter wildcard allowed"
+do_chain add foo* || die "duplicated hook add failed"
+
+do_chain delete fooo* && die "delete longer wildcard allowed"
+do_chain add foo* || die "duplicated hook add failed"
+
+do_chain delete foo* || die "delete initial chain hook failed"
+
+exit $RC
diff --git a/tests/shell/testcases/flowtable/update_wildcard_hook b/tests/shell/testcases/flowtable/update_wildcard_hook
new file mode 100755
index 0000000000000..a67c8bffe0687
--- /dev/null
+++ b/tests/shell/testcases/flowtable/update_wildcard_hook
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# NFT_TEST_REQUIRES(NFT_TEST_HAVE_ifname_based_hooks)
+
+RC=0
+
+die() {
+	echo "FAIL: $@"
+	((RC++))
+	$NFT list ruleset
+}
+
+$NFT add table t || die "add table failed"
+
+do_ft() { # (cmd, devspec, thp)
+	$NFT $1 flowtable t ft "{ $3 devices = { $2 }; }"
+}
+
+thp='hook ingress priority 0;'
+
+do_ft add foo* "$thp" || die "initial add flowtable failed"
+do_ft create foo* "$thp" && die "duplicated create initial flowtable allowed"
+do_ft add foo* || die "duplicated hook add failed"
+
+do_ft add "bar*, bar*" && die "duplicate wildcard add allowed"
+do_ft add "bar, bar" && die "duplicate device add allowed"
+
+do_ft add foo && die "update with non-wildcard allowed"
+do_ft add fo* && die "update with shorter wildcard allowed"
+do_ft add fooo* && die "update with longer wildcard allowed"
+
+# add after testing delete in case deletion is allowed when it should not
+
+do_ft delete foo && die "delete non-wildcard hook allowed"
+do_ft add foo* || die "duplicated hook add failed"
+
+do_ft delete fo* && die "delete shorter wildcard allowed"
+do_ft add foo* || die "duplicated hook add failed"
+
+do_ft delete fooo* && die "delete longer wildcard allowed"
+do_ft add foo* || die "duplicated hook add failed"
+
+do_ft delete foo* || die "delete initial flowtable hook failed"
+
+exit $RC
-- 
2.54.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-09-03  8:11 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-27 20:42 [nft PATCH] tests: shell: Test odd netdev hook updates Phil Sutter
2026-09-01  7:54 ` Fernando Fernandez Mancera
2026-09-01  9:53   ` Phil Sutter
2026-09-01 14:56     ` Pablo Neira Ayuso
2026-09-03  8:10       ` Phil Sutter

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox