117 lines
3.5 KiB
Diff
117 lines
3.5 KiB
Diff
From 42c3e9df13adbd54053eaacbfe7337844a243a2b Mon Sep 17 00:00:00 2001
|
|
From: Florian Westphal <fwestpha@redhat.com>
|
|
Date: Wed, 13 May 2026 16:57:34 +0200
|
|
Subject: [PATCH] selftests: netfilter: nft_concat_range.sh: add check for
|
|
double-create bug
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-168848
|
|
Upstream Status: commit 94bd247bc25b
|
|
|
|
commit 94bd247bc25b7f1560f96e9c912db3ec1fc878ea
|
|
Author: Florian Westphal <fw@strlen.de>
|
|
Date: Wed Sep 10 01:39:48 2025 +0200
|
|
|
|
selftests: netfilter: nft_concat_range.sh: add check for double-create bug
|
|
|
|
Add a test case for bug resolved with:
|
|
'netfilter: nft_set_pipapo_avx2: fix skip of expired entries'.
|
|
|
|
It passes on nf.git (it uses the generic/C version for insertion
|
|
duplicate check) but fails on unpatched nf-next if AVX2 is supported:
|
|
|
|
cannot create same element twice 0s [FAIL]
|
|
Could create element twice in same transaction
|
|
table inet filter { # handle 8
|
|
[..]
|
|
elements = { 1.2.3.4 . 1.2.4.1 counter packets 0 bytes 0,
|
|
1.2.4.1 . 1.2.3.4 counter packets 0 bytes 0,
|
|
1.2.3.4 . 1.2.4.1 counter packets 0 bytes 0,
|
|
1.2.4.1 . 1.2.3.4 counter packets 0 bytes 0 }
|
|
|
|
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
|
|
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
|
|
Signed-off-by: Florian Westphal <fwestpha@redhat.com>
|
|
|
|
diff --git a/tools/testing/selftests/net/netfilter/nft_concat_range.sh b/tools/testing/selftests/net/netfilter/nft_concat_range.sh
|
|
index 20e76b3..ad97c62 100755
|
|
--- a/tools/testing/selftests/net/netfilter/nft_concat_range.sh
|
|
+++ b/tools/testing/selftests/net/netfilter/nft_concat_range.sh
|
|
@@ -29,7 +29,7 @@ TYPES="net_port port_net net6_port port_proto net6_port_mac net6_port_mac_proto
|
|
net6_port_net6_port net_port_mac_proto_net"
|
|
|
|
# Reported bugs, also described by TYPE_ variables below
|
|
-BUGS="flush_remove_add reload net_port_proto_match avx2_mismatch"
|
|
+BUGS="flush_remove_add reload net_port_proto_match avx2_mismatch doublecreate"
|
|
|
|
# List of possible paths to pktgen script from kernel tree for performance tests
|
|
PKTGEN_SCRIPT_PATHS="
|
|
@@ -408,6 +408,18 @@ perf_duration 0
|
|
"
|
|
|
|
|
|
+TYPE_doublecreate="
|
|
+display cannot create same element twice
|
|
+type_spec ipv4_addr . ipv4_addr
|
|
+chain_spec ip saddr . ip daddr
|
|
+dst addr4
|
|
+proto icmp
|
|
+
|
|
+race_repeat 0
|
|
+
|
|
+perf_duration 0
|
|
+"
|
|
+
|
|
# Set template for all tests, types and rules are filled in depending on test
|
|
set_template='
|
|
flush ruleset
|
|
@@ -1900,6 +1912,48 @@ test_bug_avx2_mismatch()
|
|
fi
|
|
}
|
|
|
|
+test_bug_doublecreate()
|
|
+{
|
|
+ local elements="1.2.3.4 . 1.2.4.1, 1.2.4.1 . 1.2.3.4"
|
|
+ local ret=1
|
|
+ local i
|
|
+
|
|
+ setup veth send_"${proto}" set || return ${ksft_skip}
|
|
+
|
|
+ add "{ $elements }" || return 1
|
|
+ # expected to work: 'add' on existing should be no-op.
|
|
+ add "{ $elements }" || return 1
|
|
+
|
|
+ # 'create' should return an error.
|
|
+ if nft create element inet filter test "{ $elements }" 2>/dev/null; then
|
|
+ err "Could create an existing element"
|
|
+ return 1
|
|
+ fi
|
|
+nft -f - <<EOF 2>/dev/null
|
|
+flush set inet filter test
|
|
+create element inet filter test { $elements }
|
|
+create element inet filter test { $elements }
|
|
+EOF
|
|
+ ret=$?
|
|
+ if [ $ret -eq 0 ]; then
|
|
+ err "Could create element twice in one transaction"
|
|
+ err "$(nft -a list ruleset)"
|
|
+ return 1
|
|
+ fi
|
|
+
|
|
+nft -f - <<EOF 2>/dev/null
|
|
+flush set inet filter test
|
|
+create element inet filter test { $elements }
|
|
+EOF
|
|
+ ret=$?
|
|
+ if [ $ret -ne 0 ]; then
|
|
+ err "Could not flush and re-create element in one transaction"
|
|
+ return 1
|
|
+ fi
|
|
+
|
|
+ return 0
|
|
+}
|
|
+
|
|
test_reported_issues() {
|
|
eval test_bug_"${subtest}"
|
|
}
|