From ddefbbff16a96dc450f40707bbf4473284c75f43 Mon Sep 17 00:00:00 2001
From: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
Date: Tue, 20 Apr 2021 17:26:08 +0300
Subject: [PATCH] zdtm: add combined nftables/iptables netns-nft-ipt test

Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
---
 test/zdtm/static/Makefile           |  3 +-
 test/zdtm/static/netns-nft-ipt.c    | 81 +++++++++++++++++++++++++++++
 test/zdtm/static/netns-nft-ipt.desc |  8 +++
 3 files changed, 91 insertions(+), 1 deletion(-)
 create mode 100644 test/zdtm/static/netns-nft-ipt.c
 create mode 100644 test/zdtm/static/netns-nft-ipt.desc

diff --git a/test/zdtm/static/Makefile b/test/zdtm/static/Makefile
index 598e8d3b9..b021b18fb 100644
--- a/test/zdtm/static/Makefile
+++ b/test/zdtm/static/Makefile
@@ -314,7 +314,8 @@ TST_FILE	=				\
 		file_locks07			\
 		file_locks08			\
 		netns-nf			\
-		netns-nft				\
+		netns-nft			\
+		netns-nft-ipt			\
 		maps_file_prot			\
 		socket_close_data01		\
 		fifo_upon_unix_socket00		\
diff --git a/test/zdtm/static/netns-nft-ipt.c b/test/zdtm/static/netns-nft-ipt.c
new file mode 100644
index 000000000..02c2a2f58
--- /dev/null
+++ b/test/zdtm/static/netns-nft-ipt.c
@@ -0,0 +1,81 @@
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#include "zdtmtst.h"
+
+const char *test_doc	= "Check that both nftables & iptables rules (some) are C/R properly";
+const char *test_author	= "Alexander Mikhalitsyn <alexander@mihalicyn.com>";
+
+char *filename;
+TEST_OPTION(filename, string, "file name", 1);
+
+int main(int argc, char **argv)
+{
+	char cmd[128];
+
+	test_init(argc, argv);
+
+	/* create nft table */
+	if (system("nft add table inet netns-nft-zdtm-test")) {
+		pr_perror("Can't create nft table");
+		return -1;
+	}
+
+	/* create input chain in table */
+	if (system("nft add chain inet netns-nft-zdtm-test input { type filter hook input priority 0 \\; }")) {
+		pr_perror("Can't create input chain in nft table");
+		return -1;
+	}
+
+	/* block ICMPv4 traffic */
+	if (system("nft add rule inet netns-nft-zdtm-test input meta nfproto ipv4 icmp type { echo-request } reject")) {
+		pr_perror("Can't set input rule");
+		return -1;
+	}
+
+	/* save resulting nft table */
+	sprintf(cmd, "nft list table inet netns-nft-zdtm-test > pre-%s", filename);
+	if (system(cmd)) {
+		pr_perror("Can't get nft table");
+		return -1;
+	}
+
+	if (system("iptables -A INPUT -t filter --protocol icmp -j DROP")) {
+		pr_perror("Can't set input rule");
+		return -1;
+	}
+
+	sprintf(cmd, "iptables -L >> pre-%s", filename);
+	if (system(cmd)) {
+		pr_perror("Can't save iptables");
+		return -1;
+	}
+
+	test_daemon();
+	test_waitsig();
+
+	/* get nft table */
+	sprintf(cmd, "nft list table inet netns-nft-zdtm-test > post-%s", filename);
+	if (system(cmd)) {
+		fail("Can't get nft table");
+		return -1;
+	}
+
+	sprintf(cmd, "iptables -L >> post-%s", filename);
+	if (system(cmd)) {
+		fail("Can't get iptables");
+		return -1;
+	}
+
+	/* compare nft table before/after c/r */
+	sprintf(cmd, "diff pre-%s post-%s", filename, filename);
+	if (system(cmd)) {
+		fail("nft table differ");
+		return -1;
+	}
+
+	pass();
+	return 0;
+}
diff --git a/test/zdtm/static/netns-nft-ipt.desc b/test/zdtm/static/netns-nft-ipt.desc
new file mode 100644
index 000000000..76f2f14b6
--- /dev/null
+++ b/test/zdtm/static/netns-nft-ipt.desc
@@ -0,0 +1,8 @@
+{  'feature': 'nftables has_ipt_legacy',
+   'deps': [   '/bin/sh',
+               '/usr/sbin/nft',
+               '/sbin/iptables|/usr/sbin/iptables',
+               '/usr/lib64/xtables/libxt_standard.so|/usr/lib/iptables/libxt_standard.so|/lib/xtables/libxt_standard.so|/usr/lib/powerpc64le-linux-gnu/xtables/libxt_standard.so|/usr/lib/x86_64-linux-gnu/xtables/libxt_standard.so|/usr/lib/s390x-linux-gnu/xtables/libxt_standard.so|/usr/lib/xtables/libxt_standard.so|/usr/lib/aarch64-linux-gnu/xtables/libxt_standard.so',
+               '/usr/bin/diff'],
+    'flags': 'suid',
+    'flavor': 'ns uns'}