From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 5 Feb 2026 02:31:18 +0000 (+0100)
Subject: tests: shell: double chain update with same device
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=27344750dad34b65030478a2c4f08f21cf10b34c;p=thirdparty%2Fnftables.git

tests: shell: double chain update with same device

For Linux kernel patch:

  cf5fb87fcdaa ("netfilter: nf_tables: reject duplicate device on updates")

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
---

diff --git a/tests/shell/testcases/transactions/chain_update_dup b/tests/shell/testcases/transactions/chain_update_dup
new file mode 100755
index 00000000..5d529dd1
--- /dev/null
+++ b/tests/shell/testcases/transactions/chain_update_dup
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+ip link add dummy0 type dummy
+
+$NFT -f /dev/stdin <<EOF
+table netdev t {
+	chain c {
+		type filter hook ingress priority 0;
+	}
+}
+EOF
+
+$NFT -f /dev/stdin <<EOF
+add chain netdev t c { devices = { dummy0 }; }
+add chain netdev t c { devices = { dummy0 }; }
+EOF
+
+ip link del dummy0
+
+sleep 4
+
+$NFT flush ruleset
diff --git a/tests/shell/testcases/transactions/dumps/chain_update_dup.nodump b/tests/shell/testcases/transactions/dumps/chain_update_dup.nodump
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/shell/testcases/transactions/dumps/flowtable_update_dup.nodump b/tests/shell/testcases/transactions/dumps/flowtable_update_dup.nodump
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/shell/testcases/transactions/flowtable_update_dup b/tests/shell/testcases/transactions/flowtable_update_dup
new file mode 100755
index 00000000..434d8de5
--- /dev/null
+++ b/tests/shell/testcases/transactions/flowtable_update_dup
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+ip link add dummy0 type dummy
+
+$NFT -f /dev/stdin <<EOF
+table inet t {
+	flowtable f {
+		hook ingress priority 0;
+	}
+}
+EOF
+
+$NFT -f /dev/stdin <<EOF
+add flowtable inet t f { devices = { dummy0 }; }
+add flowtable inet t f { devices = { dummy0 }; }
+EOF
+
+ip link del dummy0
+
+sleep 4
+
+$NFT flush ruleset