NFT_SET_OBJECT tells there is an object map.
# nft list ruleset
table inet filter {
map countermap {
type ipv4_addr : counter
}
}
The following command fails:
# nft flush set inet filter countermap
This patch checks for NFT_SET_OBJECT from new set_is_literal() and
map_is_literal() functions. This patch also adds tests for this.
Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>
---
include/rule.h | 15 +++++++++++++++
src/evaluate.c | 13 +++++--------
tests/shell/testcases/listing/0017objects_0 | 19 +++++++++++++++++++
tests/shell/testcases/listing/0018data_0 | 19 +++++++++++++++++++
tests/shell/testcases/listing/0019set_0 | 19 +++++++++++++++++++
5 files changed, 77 insertions(+), 8 deletions(-)
create mode 100755 tests/shell/testcases/listing/0017objects_0
create mode 100755 tests/shell/testcases/listing/0018data_0
create mode 100755 tests/shell/testcases/listing/0019set_0
diff --git a/include/rule.h b/include/rule.h
index bee1d4474216..42d29b7c910e 100644
--- a/include/rule.h
+++ b/include/rule.h
@@ -337,6 +337,21 @@ static inline bool set_is_map(uint32_t set_flags)
return set_is_datamap(set_flags) || set_is_objmap(set_flags);
}
+static inline bool set_is_anonymous(uint32_t set_flags)
+{
+ return set_flags & NFT_SET_ANONYMOUS;
+}
+
+static inline bool set_is_literal(uint32_t set_flags)
+{
+ return !(set_is_anonymous(set_flags) || set_is_map(set_flags));
+}
+
+static inline bool map_is_literal(uint32_t set_flags)
+{
+ return !(set_is_anonymous(set_flags) || !set_is_map(set_flags));
+}
+
#include <statement.h>
struct counter {
diff --git a/src/evaluate.c b/src/evaluate.c
index e1a827e723ae..f915187165cc 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -3630,8 +3630,8 @@ static int cmd_evaluate_list(struct eval_ctx *ctx, struct
cmd *cmd)
if (set == NULL)
return set_not_found(ctx,
&ctx->cmd->handle.set.location,
ctx->cmd->handle.set.name);
- else if (set->flags & (NFT_SET_MAP | NFT_SET_ANONYMOUS))
- return cmd_error(ctx, &ctx->cmd->handle.set.location,
+ else if (!set_is_literal(set->flags))
+ return cmd_error(ctx, &ctx->cmd->handle.set.location,
"%s", strerror(ENOENT));
return 0;
@@ -3659,8 +3659,7 @@ static int cmd_evaluate_list(struct eval_ctx *ctx, struct
cmd *cmd)
if (set == NULL)
return set_not_found(ctx,
&ctx->cmd->handle.set.location,
ctx->cmd->handle.set.name);
- else if (!(set->flags & NFT_SET_MAP) ||
- set->flags & NFT_SET_ANONYMOUS)
+ else if (!map_is_literal(set->flags))
return cmd_error(ctx, &ctx->cmd->handle.set.location,
"%s", strerror(ENOENT));
@@ -3752,10 +3751,9 @@ static int cmd_evaluate_flush(struct eval_ctx *ctx,
struct cmd *cmd)
if (set == NULL)
return set_not_found(ctx,
&ctx->cmd->handle.set.location,
ctx->cmd->handle.set.name);
- else if (set->flags & (NFT_SET_MAP | NFT_SET_ANONYMOUS))
+ else if (!set_is_literal(set->flags))
return cmd_error(ctx, &ctx->cmd->handle.set.location,
"%s", strerror(ENOENT));
-
return 0;
case CMD_OBJ_MAP:
table = table_lookup(&cmd->handle, &ctx->nft->cache);
@@ -3766,8 +3764,7 @@ static int cmd_evaluate_flush(struct eval_ctx *ctx,
struct cmd *cmd)
if (set == NULL)
return set_not_found(ctx,
&ctx->cmd->handle.set.location,
ctx->cmd->handle.set.name);
- else if (!(set->flags & NFT_SET_MAP) ||
- set->flags & NFT_SET_ANONYMOUS)
+ else if (!map_is_literal(set->flags))
return cmd_error(ctx, &ctx->cmd->handle.set.location,
"%s", strerror(ENOENT));
diff --git a/tests/shell/testcases/listing/0017objects_0
b/tests/shell/testcases/listing/0017objects_0
new file mode 100755
index 000000000000..14d614382e1b
--- /dev/null
+++ b/tests/shell/testcases/listing/0017objects_0
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+EXPECTED="table inet filter {
+ map countermap {
+ type ipv4_addr : counter
+ }
+}"
+
+set -e
+
+$NFT -f - <<< $EXPECTED
+$NFT flush map inet filter countermap
+
+GET="$($NFT list map inet filter countermap)"
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi
diff --git a/tests/shell/testcases/listing/0018data_0
b/tests/shell/testcases/listing/0018data_0
new file mode 100755
index 000000000000..767fe13ae65a
--- /dev/null
+++ b/tests/shell/testcases/listing/0018data_0
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+EXPECTED="table inet filter {
+ map ipmap {
+ type ipv4_addr : ipv4_addr
+ }
+}"
+
+set -e
+
+$NFT -f - <<< $EXPECTED
+$NFT flush map inet filter ipmap
+
+GET="$($NFT list map inet filter ipmap)"
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi
diff --git a/tests/shell/testcases/listing/0019set_0
b/tests/shell/testcases/listing/0019set_0
new file mode 100755
index 000000000000..04eb0faf74af
--- /dev/null
+++ b/tests/shell/testcases/listing/0019set_0
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+EXPECTED="table inet filter {
+ set ipset {
+ type ipv4_addr
+ }
+}"
+
+set -e
+
+$NFT -f - <<< $EXPECTED
+$NFT flush set inet filter ipset
+
+GET="$($NFT list set inet filter ipset)"
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi
--
2.11.0
