path: root/tests/py/inet/reject.t.json
Commit message (Collapse)AuthorAgeFilesLines
* JSON: Make match op mandatory, introduce 'in' operatorPhil Sutter2018-08-301-0/+5
| | | | | | | | This special operator is required for cases where missing operator does not lead to same results as equal operator, i.e. with bitmasks on RHS. Signed-off-by: Phil Sutter <> Signed-off-by: Pablo Neira Ayuso <>
* JSON: Make meta statement/expression extensiblePhil Sutter2018-08-301-5/+5
| | | | | | | | | | Lessons learned from fwd statement: We must not assume a given statement/expression may not receive further properties in the future. Therefore make meta value an object with a property "key" instead of just a string containing the key name. Signed-off-by: Phil Sutter <> Signed-off-by: Pablo Neira Ayuso <>
* evaluate: reject: Allow icmpx in inet/bridge familiesPhil Sutter2018-08-141-0/+42
| | | | | | | | | | | | | | | | | | | Commit 3e6ab2b335142 added restraints on reject types for bridge and inet families but aparently those were too strict: If a rule in e.g. inet family contained a match which introduced a protocol dependency, icmpx type rejects were disallowed for no obvious reason. Allow icmpx type rejects in inet family regardless of protocol dependency since we either have IPv4 or IPv6 traffic in there and for both icmpx is fine. Merge restraints in bridge family with those for TCP reset since it already does what is needed, namely checking that ether proto is either IPv4 or IPv6. Fixes: 3e6ab2b335142 ("evaluate: reject: check in bridge and inet the network context in reject") Signed-off-by: Phil Sutter <> Signed-off-by: Pablo Neira Ayuso <>
* tests/py: Support testing JSON input and output as wellPhil Sutter2018-05-111-0/+240
This extends by optional JSON testing capabilities, activated via '-j'/'--enable-json' parameter). JSON testing happens for all rules which are supposed to work: After a rule has been added and the existing tests (payload, ruleset listing output) have been performed, basically the same test is done again using a recorded JSON equivalent and (if necessary) a recorded listing output. The code tries to ease new test case creation overhead by auto-generating JSON equivalent input via listing the (non-JSON) rule in JSON format. Also, differing netlink debug and listing output are stored in *.got files to assist in analyzing/fixing failing test cases. Signed-off-by: Phil Sutter <> Signed-off-by: Pablo Neira Ayuso <>