Simple test to make sure iptables-restore does not touch tables it is not supposed to. Signed-off-by: Phil Sutter <phil@xxxxxx> --- .../ipt-restore/0007-flush-noflush_0 | 42 +++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100755 iptables/tests/shell/testcases/ipt-restore/0007-flush-noflush_0 diff --git a/iptables/tests/shell/testcases/ipt-restore/0007-flush-noflush_0 b/iptables/tests/shell/testcases/ipt-restore/0007-flush-noflush_0 new file mode 100755 index 0000000000000..029db2235b9a4 --- /dev/null +++ b/iptables/tests/shell/testcases/ipt-restore/0007-flush-noflush_0 @@ -0,0 +1,42 @@ +#!/bin/bash + +# Make sure iptables-restore without --noflush does not flush tables other than +# those contained in the dump it's reading from + +set -e + +$XT_MULTI iptables-restore <<EOF +*nat +-A POSTROUTING -j ACCEPT +COMMIT +EOF + +EXPECT="*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +-A POSTROUTING -j ACCEPT +COMMIT" +diff -u -Z <(echo -e "$EXPECT" | sort) <($XT_MULTI iptables-save | grep -v '^#' | sort) + +$XT_MULTI iptables-restore <<EOF +*filter +-A FORWARD -j ACCEPT +COMMIT +EOF + +EXPECT="*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +-A FORWARD -j ACCEPT +COMMIT +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +-A POSTROUTING -j ACCEPT +COMMIT" +diff -u -Z <(echo -e "$EXPECT" | sort) <($XT_MULTI iptables-save | grep -v '^#' | sort) -- 2.23.0
