From dc9733e097959f4e167244549f58cd3bef7af79b Mon Sep 17 00:00:00 2001 From: Arturo Borrero Gonzalez Date: Thu, 27 Jun 2013 20:09:34 +0200 Subject: test: add testbench for XML This patch add a testbench for XML parsing, which may be extended to test JSON as well. To use it: $ cd test/ $ make nft-parsing-test $ ./nft-parsing-test xmlfiles/ This testbench supersedes old .sh test scripts, so they are deleted. [ I have mangled this patch to rename/mangle files, to colorize the test output and not to compile XML inconditionally --pablo ] Signed-off-by: Arturo Borrero Gonzalez Signed-off-by: Pablo Neira Ayuso --- Makefile.am | 2 +- configure.ac | 2 +- examples/chain.xml | 11 --- examples/rule.xml | 85 ------------------------ examples/table.xml | 6 -- test/nft-chain-xml-add.sh | 123 ---------------------------------- test/nft-rule-xml-add.sh | 125 ----------------------------------- test/nft-table-xml-add.sh | 75 --------------------- tests/Makefile.am | 6 ++ tests/nft-parsing-test.c | 111 +++++++++++++++++++++++++++++++ tests/xmlfiles/01-table.xml | 6 ++ tests/xmlfiles/02-table.xml | 6 ++ tests/xmlfiles/10-chain.xml | 11 +++ tests/xmlfiles/11-chain.xml | 11 +++ tests/xmlfiles/12-chain.xml | 11 +++ tests/xmlfiles/20-rule-bitwise.xml | 25 +++++++ tests/xmlfiles/21-rule-byteorder.xml | 12 ++++ tests/xmlfiles/22-rule-cmp.xml | 13 ++++ tests/xmlfiles/23-rule-counter.xml | 8 +++ tests/xmlfiles/24-rule-ct.xml | 10 +++ tests/xmlfiles/25-rule-exthdr.xml | 9 +++ tests/xmlfiles/26-rule-immediate.xml | 12 ++++ tests/xmlfiles/26-rule-limit.xml | 7 ++ tests/xmlfiles/28-rule-log.xml | 9 +++ tests/xmlfiles/29-rule-lookup.xml | 8 +++ tests/xmlfiles/30-rule-match.xml | 6 ++ tests/xmlfiles/31-rule-meta.xml | 7 ++ tests/xmlfiles/32-rule-nat6.xml | 11 +++ tests/xmlfiles/33-rule-nat4.xml | 11 +++ tests/xmlfiles/34-rule-payload.xml | 9 +++ tests/xmlfiles/35-rule-target.xml | 6 ++ 31 files changed, 327 insertions(+), 427 deletions(-) delete mode 100644 examples/chain.xml delete mode 100644 examples/rule.xml delete mode 100644 examples/table.xml delete mode 100755 test/nft-chain-xml-add.sh delete mode 100755 test/nft-rule-xml-add.sh delete mode 100755 test/nft-table-xml-add.sh create mode 100644 tests/Makefile.am create mode 100644 tests/nft-parsing-test.c create mode 100644 tests/xmlfiles/01-table.xml create mode 100644 tests/xmlfiles/02-table.xml create mode 100644 tests/xmlfiles/10-chain.xml create mode 100644 tests/xmlfiles/11-chain.xml create mode 100644 tests/xmlfiles/12-chain.xml create mode 100644 tests/xmlfiles/20-rule-bitwise.xml create mode 100644 tests/xmlfiles/21-rule-byteorder.xml create mode 100644 tests/xmlfiles/22-rule-cmp.xml create mode 100644 tests/xmlfiles/23-rule-counter.xml create mode 100644 tests/xmlfiles/24-rule-ct.xml create mode 100644 tests/xmlfiles/25-rule-exthdr.xml create mode 100644 tests/xmlfiles/26-rule-immediate.xml create mode 100644 tests/xmlfiles/26-rule-limit.xml create mode 100644 tests/xmlfiles/28-rule-log.xml create mode 100644 tests/xmlfiles/29-rule-lookup.xml create mode 100644 tests/xmlfiles/30-rule-match.xml create mode 100644 tests/xmlfiles/31-rule-meta.xml create mode 100644 tests/xmlfiles/32-rule-nat6.xml create mode 100644 tests/xmlfiles/33-rule-nat4.xml create mode 100644 tests/xmlfiles/34-rule-payload.xml create mode 100644 tests/xmlfiles/35-rule-target.xml diff --git a/Makefile.am b/Makefile.am index 6999f51..d5f6e40 100644 --- a/Makefile.am +++ b/Makefile.am @@ -2,7 +2,7 @@ include $(top_srcdir)/Make_global.am ACLOCAL_AMFLAGS = -I m4 -SUBDIRS = src include examples +SUBDIRS = src include examples tests DIST_SUBDIRS = src include examples pkgconfigdir = $(libdir)/pkgconfig diff --git a/configure.ac b/configure.ac index 0eec5bd..c8075e9 100644 --- a/configure.ac +++ b/configure.ac @@ -38,5 +38,5 @@ regular_CFLAGS="-Wall -Waggregate-return -Wmissing-declarations \ -Wformat=2 -pipe" AC_SUBST([regular_CPPFLAGS]) AC_SUBST([regular_CFLAGS]) -AC_CONFIG_FILES([Makefile src/Makefile include/Makefile include/libnftables/Makefile include/linux/Makefile include/linux/netfilter/Makefile examples/Makefile libnftables.pc doxygen.cfg]) +AC_CONFIG_FILES([Makefile src/Makefile include/Makefile include/libnftables/Makefile include/linux/Makefile include/linux/netfilter/Makefile examples/Makefile tests/Makefile libnftables.pc doxygen.cfg]) AC_OUTPUT diff --git a/examples/chain.xml b/examples/chain.xml deleted file mode 100644 index 01ccb85..0000000 --- a/examples/chain.xml +++ /dev/null @@ -1,11 +0,0 @@ - - - filter - filter
- 1 - 0 - 4 - 1 - 10 - - diff --git a/examples/rule.xml b/examples/rule.xml deleted file mode 100644 index b1de25a..0000000 --- a/examples/rule.xml +++ /dev/null @@ -1,85 +0,0 @@ - - - 0 - 127 - 0 - 0 - - 1 - 4 - - - 1 - eq - - - 1 - 0x04000000 - - - - - 1 - 1 - 12 - 4 - - - 1 - eq - - - 1 - 0x96d60496 - - - - - 1 - 1 - 16 - 4 - - - 1 - eq - - - 1 - 0x96d60329 - - - - - 1 - 1 - 9 - 1 - - - 1 - eq - - - 1 - 0x06000000 - - - - - state - 0 - - - - - 123123 - 321321 - - - LOG - 0 - - - - diff --git a/examples/table.xml b/examples/table.xml deleted file mode 100644 index a397d52..0000000 --- a/examples/table.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - 2 - 0 - -
diff --git a/test/nft-chain-xml-add.sh b/test/nft-chain-xml-add.sh deleted file mode 100755 index ed39d54..0000000 --- a/test/nft-chain-xml-add.sh +++ /dev/null @@ -1,123 +0,0 @@ -#!/bin/bash - -# -# (C) 2013 by Arturo Borrero Gonzalez -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. -# - -# This is a small testbench for adding nftables chains to kernel -# in XML format. - -BINARY="../examples/nft-chain-xml-add" -NFT=$( which nft ) -MKTEMP=$( which mktemp) -TMPFILE=$( $MKTEMP ) - -if [ ! -x "$BINARY" ] ; then - echo "E: Binary not found $BINARY" - exit 1 -fi - -if [ ! -x "$MKTEMP" ] ; then - echo "E: mktemp not found and is neccesary" - exit 1 -fi - -if [ ! -w "$TMPFILE" ] ; then - echo "E: Unable to create temp file via mktemp" - exit 1 -fi - -[ ! -x "$NFT" ] && echo "W: nftables main binary not found but continuing anyway $NFT" - -XML=" - - filter - filter
- 0 - 0 - NF_INET_LOCAL_IN - accept - ip - -" - -$NFT delete chain ip filter test1 2>/dev/null >&2 -echo $XML > $TMPFILE -if ! $BINARY "$TMPFILE" ; then - echo "E: Unable to add XML:" - echo "$XML" - exit 1 -fi - -# This is valid (as long as the table exist) -XML=" - - filter - filter
- 1 - 0 - NF_INET_POST_ROUTING - accept - ip6 - -" - -$NFT delete chain ip6 filter test2 2>/dev/null >&2 -echo $XML > $TMPFILE -if ! $BINARY "$TMPFILE" ; then - echo "E: Unable to add XML:" - echo "$XML" - rm -rf $TMPFILE 2>/dev/null - exit 1 -fi - -# This is valid (as long as the table exist) -XML=" - - filter - filter
- 0 - 0 - NF_INET_FORWARD - drop - ip - -" - -$NFT delete chain ip6 filter test3 2>/dev/null >&2 -echo $XML > $TMPFILE -if ! $BINARY "$TMPFILE" ; then - echo "E: Unable to add XML:" - echo "$XML" - rm -rf $TMPFILE 2>/dev/null - exit 1 -fi - -# This is invalid -XML=" - - asdasd - filter - filter
- asdasd - asdasd - asdasd - asdasd - asdasd - - " - -if $BINARY "$XML" 2>/dev/null; then - echo "E: Accepted invalid XML:" - echo "$XML" - rm -rf $TMPFILE 2>/dev/null - exit 1 -fi - -rm -rf $TMPFILE 2>/dev/null -echo "I: Test OK" diff --git a/test/nft-rule-xml-add.sh b/test/nft-rule-xml-add.sh deleted file mode 100755 index 2a052b2..0000000 --- a/test/nft-rule-xml-add.sh +++ /dev/null @@ -1,125 +0,0 @@ -#!/bin/bash - -# -# (C) 2013 by Arturo Borrero Gonzalez -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. - -# This is a small testbench for adding nftables rules to kernel -# in XML format. - -BINARY="../examples/nft-rule-xml-add" -NFT="$( which nft )" -MKTEMP="$( which mktemp )" -TMPFILE="$( $MKTEMP )" - -if [ ! -x "$BINARY" ] ; then - echo "E: Binary not found $BINARY" - exit 1 -fi - -if [ ! -x "$MKTEMP" ] ; then - echo "E: mktemp not found. Is mandatory." - exit 1 -fi - -if [ ! -w "$TMPFILE" ] ; then - echo "E: Unable to create tempfile with mktemp" - exit 1 -fi - -[ ! -x "$NFT" ] && echo "W: nftables main binary not found but continuing anyway $NFT" - -XML=" - 0 - 0 - 0 - - 1 - iif - - - 1 - eq - - - 4 - 0x04000000 - - - - - 1 - transport - 12 - 4 - - - 1 - eq - - - 4 - 0x96d60496 - - - - - 1 - link - 16 - 4 - - - 1 - eq - - - 4 - 0x96d60329 - - - - - 1 - network - 9 - 1 - - - 1 - eq - - - 4 - 0x06000000 - - - - - state - - - 123123 - 321321 - - - LOG - -" - -$NFT add table filter 2>/dev/null >&2 -$NFT add chain filter INPUT 2>/dev/null >&2 - -echo $XML > $TMPFILE -if ! $BINARY "$TMPFILE" ; then - echo "E: Unable to add XML." - rm -rf $TMPFILE 2>/dev/null - exit 1 -fi - -rm -rf $TMPFILE 2>/dev/null -echo "I: Test OK" diff --git a/test/nft-table-xml-add.sh b/test/nft-table-xml-add.sh deleted file mode 100755 index 30b65e1..0000000 --- a/test/nft-table-xml-add.sh +++ /dev/null @@ -1,75 +0,0 @@ -#!/bin/bash - -# -# (C) 2013 by Arturo Borrero Gonzalez -# -# This program is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. -# - -# This is a small testbench for adding nftables tables to kernel -# in XML format. - -BINARY="../examples/nft-table-xml-add" -NFT="$( which nft )" -MKTEMP="$( which mktemp)" -TMPFILE="$( $MKTEMP )" - -if [ ! -x "$BINARY" ] ; then - echo "E: Binary not found $BINARY" - exit 1 -fi - -if [ ! -x "$MKTEMP" ] ; then - echo "E: mktemp not found and is neccesary" - exit 1 -fi - -if [ ! -w "$TMPFILE" ] ; then - echo "E: Unable to create temp file via mktemp" - exit 1 -fi - - -if [ ! -x "$NFT" ] ; then - echo "W: nftables main binary not found but continuing anyway $NFT" -fi - -# This is valid -XML=" - - ip - 0 - -
" - -$NFT delete table filter_test 2>/dev/null >&2 -echo $XML > $TMPFILE -if ! $BINARY "$TMPFILE" ; then - echo "E: Unable to add XML:" - echo "$XML" - rm -rf $TMPFILE 2>/dev/null - exit 1 -fi - -# This is valid -XML=" - - ip6 - 0 - -
" - -$NFT delete table filter6_test 2>/dev/null >&2 -echo $XML > $TMPFILE -if ! $BINARY "$TMPFILE" ; then - echo "E: Unable to add XML:" - echo "$XML" - rm -rf $TMPFILE 2>/dev/null - exit 1 -fi - -rm -rf $TMPFILE 2>/dev/null -echo "I: Test OK" diff --git a/tests/Makefile.am b/tests/Makefile.am new file mode 100644 index 0000000..6941c3c --- /dev/null +++ b/tests/Makefile.am @@ -0,0 +1,6 @@ +include $(top_srcdir)/Make_global.am + +check_PROGRAMS = nft-parsing-test + +nft_parsing_test_SOURCES = nft-parsing-test.c +nft_parsing_test_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} ${LIBXML_LIBS} diff --git a/tests/nft-parsing-test.c b/tests/nft-parsing-test.c new file mode 100644 index 0000000..55bb9ec --- /dev/null +++ b/tests/nft-parsing-test.c @@ -0,0 +1,111 @@ +#include +#include +#include +#include +#include +#include + +#include /*nlmsghdr*/ +#include +#include +#include + +#ifdef XML_PARSING +#include +#endif + +static int test_xml(const char *filename) +{ +#ifdef XML_PARSING + int ret = -1; + struct nft_table *t = NULL; + struct nft_chain *c = NULL; + struct nft_rule *r = NULL; + FILE *fp; + mxml_node_t *tree = NULL;; + char *xml = NULL; + + fp = fopen(filename, "r"); + tree = mxmlLoadFile(NULL, fp, MXML_NO_CALLBACK); + fclose(fp); + + if (tree == NULL) + return -1; + + xml = mxmlSaveAllocString(tree, MXML_NO_CALLBACK); + if (xml == NULL) + return -1; + + /* Check what parsing should be done */ + if (strcmp(tree->value.opaque, "table") == 0) { + t = nft_table_alloc(); + if (t != NULL) { + if (nft_table_parse(t, NFT_TABLE_PARSE_XML, xml) == 0) + ret = 0; + + nft_table_free(t); + } + } else if (strcmp(tree->value.opaque, "chain") == 0) { + c = nft_chain_alloc(); + if (c != NULL) { + if (nft_chain_parse(c, NFT_CHAIN_PARSE_XML, xml) == 0) + ret = 0; + + nft_chain_free(c); + } + } else if (strcmp(tree->value.opaque, "rule") == 0) { + r = nft_rule_alloc(); + if (r != NULL) { + if (nft_rule_parse(r, NFT_RULE_PARSE_XML, xml) == 0) + ret = 0; + + nft_rule_free(r); + } + } + + return ret; +#else + errno = EOPNOTSUPP; + return -1; +#endif +} + +int main(int argc, char *argv[]) +{ + DIR *d; + struct dirent *dent; + char path[PATH_MAX]; + + if (argc != 2) { + fprintf(stderr, "Usage: %s \n", argv[0]); + exit(EXIT_FAILURE); + } + + d = opendir(argv[1]); + if (d == NULL) { + perror("opendir"); + exit(EXIT_FAILURE); + } + + while ((dent = readdir(d)) != NULL) { + int len = strlen(dent->d_name); + + if (strcmp(dent->d_name, ".") == 0 || + strcmp(dent->d_name, "..") == 0) + continue; + + snprintf(path, sizeof(path), "%s/%s", argv[1], dent->d_name); + + if (strcmp(&dent->d_name[len-4], ".xml") == 0) { + printf("parsing %s: ", path); + if (test_xml(path) < 0) + printf("\033[31mFAILED\033[37m (%s)\n", + strerror(errno)); + else + printf("\033[32mOK\033[37m \n"); + } + } + + closedir(d); + return 0; +} diff --git a/tests/xmlfiles/01-table.xml b/tests/xmlfiles/01-table.xml new file mode 100644 index 0000000..d1f4692 --- /dev/null +++ b/tests/xmlfiles/01-table.xml @@ -0,0 +1,6 @@ + + + ip + 0 + +
diff --git a/tests/xmlfiles/02-table.xml b/tests/xmlfiles/02-table.xml new file mode 100644 index 0000000..55e5c2d --- /dev/null +++ b/tests/xmlfiles/02-table.xml @@ -0,0 +1,6 @@ + + + ip6 + 0 + +
diff --git a/tests/xmlfiles/10-chain.xml b/tests/xmlfiles/10-chain.xml new file mode 100644 index 0000000..04b050d --- /dev/null +++ b/tests/xmlfiles/10-chain.xml @@ -0,0 +1,11 @@ + + + filter + filter
+ 0 + 1 + NF_INET_LOCAL_IN + accept + ip + + diff --git a/tests/xmlfiles/11-chain.xml b/tests/xmlfiles/11-chain.xml new file mode 100644 index 0000000..7baa88f --- /dev/null +++ b/tests/xmlfiles/11-chain.xml @@ -0,0 +1,11 @@ + + + filter + filter
+ 0 + 1 + NF_INET_FORWARD + drop + ip6 + + diff --git a/tests/xmlfiles/12-chain.xml b/tests/xmlfiles/12-chain.xml new file mode 100644 index 0000000..1480659 --- /dev/null +++ b/tests/xmlfiles/12-chain.xml @@ -0,0 +1,11 @@ + + + nat + nat
+ 0 + 1 + NF_INET_POST_ROUTING + accept + ip + + diff --git a/tests/xmlfiles/20-rule-bitwise.xml b/tests/xmlfiles/20-rule-bitwise.xml new file mode 100644 index 0000000..411e28f --- /dev/null +++ b/tests/xmlfiles/20-rule-bitwise.xml @@ -0,0 +1,25 @@ + + 0 + + 2 + 2 + + + 16 + 0xffffffff + 0xffffffff + 0xffffffff + 0x000000ff + + + + + 16 + 0xfaceb00c + 0xc1cac1ca + 0xcafecafe + 0xdeadbeef + + + + diff --git a/tests/xmlfiles/21-rule-byteorder.xml b/tests/xmlfiles/21-rule-byteorder.xml new file mode 100644 index 0000000..44f9b78 --- /dev/null +++ b/tests/xmlfiles/21-rule-byteorder.xml @@ -0,0 +1,12 @@ + + 123 + 123 + 123 + + 3 + 4 + hton + 4 + 4 + + diff --git a/tests/xmlfiles/22-rule-cmp.xml b/tests/xmlfiles/22-rule-cmp.xml new file mode 100644 index 0000000..c135bcd --- /dev/null +++ b/tests/xmlfiles/22-rule-cmp.xml @@ -0,0 +1,13 @@ + + 0 + + 1 + eq + + + 4 + 0x01010101 + + + + diff --git a/tests/xmlfiles/23-rule-counter.xml b/tests/xmlfiles/23-rule-counter.xml new file mode 100644 index 0000000..e6ff78a --- /dev/null +++ b/tests/xmlfiles/23-rule-counter.xml @@ -0,0 +1,8 @@ + + 0 + 127 + + 123123 + 321321 + + diff --git a/tests/xmlfiles/24-rule-ct.xml b/tests/xmlfiles/24-rule-ct.xml new file mode 100644 index 0000000..8fff41a --- /dev/null +++ b/tests/xmlfiles/24-rule-ct.xml @@ -0,0 +1,10 @@ + + 0 + 0 + 0 + + 4 + 1 + state + + diff --git a/tests/xmlfiles/25-rule-exthdr.xml b/tests/xmlfiles/25-rule-exthdr.xml new file mode 100644 index 0000000..48abd57 --- /dev/null +++ b/tests/xmlfiles/25-rule-exthdr.xml @@ -0,0 +1,9 @@ + + 0 + + 1 + mh + 2 + 16 + + diff --git a/tests/xmlfiles/26-rule-immediate.xml b/tests/xmlfiles/26-rule-immediate.xml new file mode 100644 index 0000000..d58a13d --- /dev/null +++ b/tests/xmlfiles/26-rule-immediate.xml @@ -0,0 +1,12 @@ + + 0 + + 1 + + + 4 + 0xaabbccdd + + + + diff --git a/tests/xmlfiles/26-rule-limit.xml b/tests/xmlfiles/26-rule-limit.xml new file mode 100644 index 0000000..92a2bd9 --- /dev/null +++ b/tests/xmlfiles/26-rule-limit.xml @@ -0,0 +1,7 @@ + + 0 + + 123123 + 321321 + + diff --git a/tests/xmlfiles/28-rule-log.xml b/tests/xmlfiles/28-rule-log.xml new file mode 100644 index 0000000..e33ff25 --- /dev/null +++ b/tests/xmlfiles/28-rule-log.xml @@ -0,0 +1,9 @@ + + 0 + + 10 + 4000000 + 1222222 + prefixtest + + diff --git a/tests/xmlfiles/29-rule-lookup.xml b/tests/xmlfiles/29-rule-lookup.xml new file mode 100644 index 0000000..f67ecb9 --- /dev/null +++ b/tests/xmlfiles/29-rule-lookup.xml @@ -0,0 +1,8 @@ + + 0 + + 2 + 1 + set_name_test + + diff --git a/tests/xmlfiles/30-rule-match.xml b/tests/xmlfiles/30-rule-match.xml new file mode 100644 index 0000000..1738aa1 --- /dev/null +++ b/tests/xmlfiles/30-rule-match.xml @@ -0,0 +1,6 @@ + + 0 + + state + + diff --git a/tests/xmlfiles/31-rule-meta.xml b/tests/xmlfiles/31-rule-meta.xml new file mode 100644 index 0000000..7e2f57a --- /dev/null +++ b/tests/xmlfiles/31-rule-meta.xml @@ -0,0 +1,7 @@ + + 0 + + 1 + oifname + + diff --git a/tests/xmlfiles/32-rule-nat6.xml b/tests/xmlfiles/32-rule-nat6.xml new file mode 100644 index 0000000..e84bf1c --- /dev/null +++ b/tests/xmlfiles/32-rule-nat6.xml @@ -0,0 +1,11 @@ + + 0 + + ip6 + snat + 1 + 2 + 3 + 4 + + diff --git a/tests/xmlfiles/33-rule-nat4.xml b/tests/xmlfiles/33-rule-nat4.xml new file mode 100644 index 0000000..0dc213e --- /dev/null +++ b/tests/xmlfiles/33-rule-nat4.xml @@ -0,0 +1,11 @@ + + 0 + + 1 + 2 + 3 + 4 + ip + dnat + + diff --git a/tests/xmlfiles/34-rule-payload.xml b/tests/xmlfiles/34-rule-payload.xml new file mode 100644 index 0000000..a7846d6 --- /dev/null +++ b/tests/xmlfiles/34-rule-payload.xml @@ -0,0 +1,9 @@ + + 0 + + 1 + transport + 12 + 4 + + diff --git a/tests/xmlfiles/35-rule-target.xml b/tests/xmlfiles/35-rule-target.xml new file mode 100644 index 0000000..2a4f5e9 --- /dev/null +++ b/tests/xmlfiles/35-rule-target.xml @@ -0,0 +1,6 @@ + + 0 + + LOG + + -- cgit v1.2.3