Re: [nft PATCH] tests: shell: Test odd netdev hook updates

On 8/27/26 10:42 PM, Phil Sutter wrote:
> These should cover what Fernando fixes in his kernel patch "netfilter:
> nf_tables: fix device name and prefix match in hook lookup" as well as
> some bonus cases I came up with.
> 
> Signed-off-by: Phil Sutter <[email protected]>

Thanks Phil! These tests cover a lot of different cases.

Reviewed-by: Fernando Fernandez Mancera <[email protected]>

>   .../chains/netdev_chain_update_wildcard_hook  | 45 +++++++++++++++++++
>   .../testcases/flowtable/update_wildcard_hook  | 45 +++++++++++++++++++
>   2 files changed, 90 insertions(+)
>   create mode 100755 tests/shell/testcases/chains/netdev_chain_update_wildcard_hook
>   create mode 100755 tests/shell/testcases/flowtable/update_wildcard_hook
> 
> diff --git a/tests/shell/testcases/chains/netdev_chain_update_wildcard_hook b/tests/shell/testcases/chains/netdev_chain_update_wildcard_hook
> new file mode 100755
> index 0000000000000..1381f4be2a5f1
> --- /dev/null
> +++ b/tests/shell/testcases/chains/netdev_chain_update_wildcard_hook
> @@ -0,0 +1,45 @@
> +#!/bin/bash
> +
> +# NFT_TEST_REQUIRES(NFT_TEST_HAVE_ifname_based_hooks)
> +
> +RC=0
> +
> +die() {
> +	echo "FAIL: $@"
> +	((RC++))
> +	$NFT list ruleset
> +}
> +
> +$NFT add table netdev t || die "add table failed"
> +
> +do_chain() { # (cmd, devspec, thp)
> +	$NFT $1 chain netdev t c "{ $3 devices = { $2 }; }"
> +}
> +
> +thp='type filter hook ingress priority 0;'
> +
> +do_chain add foo* "$thp" || die "initial add chain failed"
> +do_chain create foo* "$thp" && die "duplicated create initial chain allowed"
> +do_chain add foo* || die "duplicated hook add failed"
> +
> +do_chain add "bar*, bar*" && die "duplicate wildcard add allowed"
> +do_chain add "bar, bar" && die "duplicate device add allowed"
> +
> +do_chain add foo && die "update with non-wildcard allowed"
> +do_chain add fo* && die "update with shorter wildcard allowed"
> +do_chain add fooo* && die "update with longer wildcard allowed"
> +
> +# add after testing delete in case deletion is allowed when it should not
> +
> +do_chain delete foo && die "delete non-wildcard hook allowed"
> +do_chain add foo* || die "duplicated hook add failed"
> +
> +do_chain delete fo* && die "delete shorter wildcard allowed"
> +do_chain add foo* || die "duplicated hook add failed"
> +
> +do_chain delete fooo* && die "delete longer wildcard allowed"
> +do_chain add foo* || die "duplicated hook add failed"
> +
> +do_chain delete foo* || die "delete initial chain hook failed"
> +
> +exit $RC
> diff --git a/tests/shell/testcases/flowtable/update_wildcard_hook b/tests/shell/testcases/flowtable/update_wildcard_hook
> new file mode 100755
> index 0000000000000..a67c8bffe0687
> --- /dev/null
> +++ b/tests/shell/testcases/flowtable/update_wildcard_hook
> @@ -0,0 +1,45 @@
> +#!/bin/bash
> +
> +# NFT_TEST_REQUIRES(NFT_TEST_HAVE_ifname_based_hooks)
> +
> +RC=0
> +
> +die() {
> +	echo "FAIL: $@"
> +	((RC++))
> +	$NFT list ruleset
> +}
> +
> +$NFT add table t || die "add table failed"
> +
> +do_ft() { # (cmd, devspec, thp)
> +	$NFT $1 flowtable t ft "{ $3 devices = { $2 }; }"
> +}
> +
> +thp='hook ingress priority 0;'
> +
> +do_ft add foo* "$thp" || die "initial add flowtable failed"
> +do_ft create foo* "$thp" && die "duplicated create initial flowtable allowed"
> +do_ft add foo* || die "duplicated hook add failed"
> +
> +do_ft add "bar*, bar*" && die "duplicate wildcard add allowed"
> +do_ft add "bar, bar" && die "duplicate device add allowed"
> +
> +do_ft add foo && die "update with non-wildcard allowed"
> +do_ft add fo* && die "update with shorter wildcard allowed"
> +do_ft add fooo* && die "update with longer wildcard allowed"
> +
> +# add after testing delete in case deletion is allowed when it should not
> +
> +do_ft delete foo && die "delete non-wildcard hook allowed"
> +do_ft add foo* || die "duplicated hook add failed"
> +
> +do_ft delete fo* && die "delete shorter wildcard allowed"
> +do_ft add foo* || die "duplicated hook add failed"
> +
> +do_ft delete fooo* && die "delete longer wildcard allowed"
> +do_ft add foo* || die "duplicated hook add failed"
> +
> +do_ft delete foo* || die "delete initial flowtable hook failed"
> +
> +exit $RC