]> git.ipfire.org Git - thirdparty/nftables.git/commitdiff
tests: shell: add test for buggy catchall element abort path
authorFlorian Westphal <fw@strlen.de>
Thu, 16 Apr 2026 10:01:22 +0000 (12:01 +0200)
committerFlorian Westphal <fw@strlen.de>
Thu, 16 Apr 2026 10:08:26 +0000 (12:08 +0200)
Kernel fails to unwind state of all pending catchall elements, check for
this bug.

Signed-off-by: Florian Westphal <fw@strlen.de>
tests/shell/testcases/maps/dumps/map_catchall_refcount_underflow.nodump [new file with mode: 0644]
tests/shell/testcases/maps/map_catchall_refcount_underflow [new file with mode: 0755]

diff --git a/tests/shell/testcases/maps/dumps/map_catchall_refcount_underflow.nodump b/tests/shell/testcases/maps/dumps/map_catchall_refcount_underflow.nodump
new file mode 100644 (file)
index 0000000..e69de29
diff --git a/tests/shell/testcases/maps/map_catchall_refcount_underflow b/tests/shell/testcases/maps/map_catchall_refcount_underflow
new file mode 100755 (executable)
index 0000000..e0c90a6
--- /dev/null
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# NFT_TEST_REQUIRES(NFT_TEST_HAVE_catchall_element)
+
+# testcase for kernel commit
+# 7cb9a23d7ae4 ("netfilter: nf_tables: always walk all pending catchall elements")
+
+set -e
+$NFT -f - <<EOF
+table inet t {
+        map s {
+                type ipv4_addr : verdict
+                elements = { * : accept }
+        }
+
+        chain c {
+        }
+}
+EOF
+
+$NFT --check -f - <<EOF
+delete element inet t s { * }
+add element inet t s  { * : jump c }
+delete map inet t s
+EOF