summaryrefslogtreecommitdiffstats
path: root/tests/py/inet
Commit message (Collapse)AuthorAgeFilesLines
* src: meta: always prefix 'meta' for almost all tokensFlorian Westphal2018-07-212-3/+3
| | | | | | | | | | | | | | | | | | got following bug report: nft add ... ct mark set mark and 0x10 ... always sets 0. What reporter meant to write instead was 'ct mark', not 'mark'. We can't just remove support for 'mark' and force 'meta mark', but we can start to discourage it by printing meta prefix too. Later on, we could start to print deprecation warning if needed. Followup patch can also change "iifname" etc. to "meta iifname". Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_delinearize: Refactor meta_may_dependency_kill()Phil Sutter2018-06-264-0/+216
| | | | | | | | | | | | | | | | The original intent was to fix a bug: The following rule in inet table: | meta nfproto ipv4 icmpv6 type echo-reply Was added correctly but when printing the meta match was falsely removed. The fix is to deny dependency killing if RHS family of nfproto match doesn't match RHS family of l4proto match. Adding this to the already large conditional led to even more unreadable code, therefore this patch tries to clean that up (and also removes the partial code duplication. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* JSON: Add support for socket expressionPhil Sutter2018-06-111-0/+28
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Call verdict maps 'vmap' in JSON as wellPhil Sutter2018-06-113-5/+5
| | | | | | | This way JSON format is more consistent with the standard one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* test: py: Add test cases for socket matchingMáté Eckl2018-06-062-0/+39
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Add missing JSON equivalent for rule in inet/tcp.tPhil Sutter2018-06-011-0/+16
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Add missing JSON equivalent for inet/sets.tPhil Sutter2018-06-011-0/+37
| | | | | | | | | This adds the missing JSON variant for the two rules which are supposed to work. Fixes: 2efbdf7b8fcf7 ("tests: py: allow to specify sets with a timeout") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: fix race in deleting elementPablo Neira Ayuso2018-05-251-1/+1
| | | | | | | | | Sometimes we may hit this because script is too slow to remove the element with timeout from the set. inet/sets.t: ERROR: line 18: I cannot delete element dead::beef timeout 1s from the set set2 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fix printing of "tcp flags syn" and "tcp flags == syn" expressionsSabrina Dubroca2018-05-252-0/+8
| | | | | | | | | | | | | | | | | | | | | | Commit 6979625686ec ("relational: Eliminate meta OPs") introduced some bugs when printing bitmask types. First, during the post-processing phase of delinearization, the expression for "tcp flags syn" (PAYLOAD & flag != 0) gets converted to PAYLOAD == flag, which is not equivalent. This should be PAYLOAD (IMPL) flag. Then, during output, the "==" sign from "tcp flags == syn" is dropped, because the bitmask condition in must_print_eq_op() was removed. Let's restore it, so that "tcp flags == syn" doesn't get printed as "tcp flags syn". An extra check for value types is added, so that we don't start printing "==" for sets such as "tcp flags {syn,ack}" Finally, add a regression test for this particular case. Fixes: 6979625686ec ("relational: Eliminate meta OPs") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: Support testing JSON input and output as wellPhil Sutter2018-05-1134-0/+7526
| | | | | | | | | | | | | | | | | | This extends nft-test.py by optional JSON testing capabilities, activated via '-j'/'--enable-json' parameter). JSON testing happens for all rules which are supposed to work: After a rule has been added and the existing tests (payload, ruleset listing output) have been performed, basically the same test is done again using a recorded JSON equivalent and (if necessary) a recorded listing output. The code tries to ease new test case creation overhead by auto-generating JSON equivalent input via listing the (non-JSON) rule in JSON format. Also, differing netlink debug and listing output are stored in *.got files to assist in analyzing/fixing failing test cases. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: allow to specify sets with a timeoutFlorian Westphal2018-05-094-0/+66
| | | | | | | | | | | Not usable yet, as the set timeout netlink output isn't captured so far, but it adds groundwork to add this as a follow-up. Set definition syntax changes a little, if you want to add multiple elements they now have to be separated by "," just like in nftables. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: Fix expected output in {bridge,inet}/icmpX.tPhil Sutter2018-05-061-1/+1
| | | | | | | | The first expression in that rule is not eliminated in evaluation phase, so there is no reason why it should be while delinearizing. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use ibrname and obrnamePablo Neira Ayuso2018-04-191-2/+2
| | | | | | | | | Legacy tool name is 'brctl' and so the 'br' prefix is already known. If we use ibrname and obrname it looks consistent with iifname and oifname. So let's this instead of ibridgename and obridgename since Florian likes this too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename ibrportname, obrportnameFlorian Westphal2018-04-171-0/+2
| | | | | | | | | | | | | | | For bridge, iifname is the port name, whereas 'ibrport' is the logical name of the bridge ("br0") the port ("iifname") is enslaved to. So, 'ibrport' is a misnomer. libnftl calls these 'bri_iifname' and 'bri_oifname', which is good but using 'briiifname' in nft is rather ugly, so use 'ibridgename' and 'obridgename' instead. Old names are still recognized, listing shows the new names. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: Use libnftables instead of calling nft binaryPhil Sutter2018-04-112-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds a simple nftables Python class in py/nftables.py which gives access to libnftables API via ctypes module. nft-test.py is extended to make use of the above class instead of calling nft binary. Since command line formatting had to be touched anyway, this patch also streamlines things a bit by introducing __str__ methods to classes Table and Chain and making extensive use of format strings instead of onerously adding all string parts together. Since the called commands don't see a shell anymore, all shell meta character escaping done in testcases is removed. The visible effects of this change are: * Four new warnings in ip/flowtable.t due to changing objref IDs (will be addressed later in a patch to libnftnl). * Reported command line in warning and error messages changed slightly for obvious reasons. * Reduction of a full test run's runtime by a factor of four. Status diff after running with 'time': < 83 test files, 77 files passed, 1724 unit tests, 0 error, 33 warning < 87.23user 696.13system 15:11.82elapsed 85%CPU (0avgtext+0avgdata 9604maxresident)k < 8inputs+36800outputs (0major+35171235minor)pagefaults 0swaps > 83 test files, 77 files passed, 1724 unit tests, 4 error, 33 warning > 6.80user 30.18system 3:45.86elapsed 16%CPU (0avgtext+0avgdata 14064maxresident)k > 0inputs+35808outputs (0major+2874minor)pagefaults 0swaps Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: add secpath supportFlorian Westphal2018-01-162-0/+11
| | | | | | | | | This can be used to check if a packet has a secpath attached to it, i.e. was subject to ipsec processing. Example: add rule inet raw prerouting meta secpath exists accept Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: nft removes required inet dependency expressionsFlorian Westphal2017-10-266-1/+78
| | | | | | | | | | | +inet/meta.t: line: 10: 'add rule inet t input meta nfproto ipv6 tcp dport 22': 'meta nfproto ipv6 tcp dport 22' mismatches 'tcp dport 22' +inet/meta.t: line: 11: 'add rule inet t input meta nfproto ipv4 tcp dport 22': 'meta nfproto ipv4 tcp dport 22' mismatches 'tcp dport 22' +inet/meta.t: line: 13: 'add rule inet t input meta nfproto ipv6 meta l4proto tcp': 'meta nfproto ipv6 meta l4proto 6' mismatches 'meta l4proto 6' +inet/ip_tcp.t: line: 20: 'src/nft add rule inet test input ether type ip tcp dport 22': 'ether type ip tcp dport 22' mismatches 'tcp dport 22' All of these are actual errors, i.e. meaning of rule is changed. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: nft removes required payload protocol expressionsFlorian Westphal2017-10-264-0/+144
| | | | | | | | | | | | | This test fails with 'ip protocol tcp tcp dport 22' mismatches 'tcp dport 22' ip protocol tcp tcp dport 22 is *ONLY* same as 'tcp dport 22' in the ip family. For netdev/inet/bridge, the dependency is required, as it restricts matching to ipv4. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add test case that checks icmp6 in-ipv4Florian Westphal2017-10-262-0/+12
| | | | | | | | | | | | | nft does not handle this correctly. This test fails. In: inet input ip protocol ipv6-icmp meta l4proto ipv6-icmp icmpv6 type 1 Out: meta l4proto 58 icmpv6 type destination-unreachable which loses the "ipv4" dependency, i.e. listing should show the rule as-is. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: icmpX: fix expected outputFlorian Westphal2017-10-261-1/+1
| | | | | | | | | | | both of these rules succeed, but they should fail instead. nft removes the ip6 nexthdr' clause, but this is not correct, it is an explicit test for the ipv6 nexthdr value. Implicit dependencies use meta l4proto to skip extension headers (if any), ipv6 nexthdr does not. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: rt: fix test casesFlorian Westphal2017-09-292-5/+9
| | | | | | | | | | nfproto meta dependency is no longer needed, keep one test since we still support this syntax. When meta is not provided, no need to add a dependency because nft_rt already checks pf number before checking skb->dst. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: ct: adjust test case commandsFlorian Westphal2017-09-292-4/+7
| | | | | | use 'ip saddr', 'ip6 saddr', etc. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: update inet/bridge icmp test caseFlorian Westphal2017-09-291-2/+2
| | | | | | | | after previous change nft now culls the dependency chain: 'icmpv6 type echo-request' is shown as-is, and not 'meta nfproto ipv6 meta l4proto 58 icmpv6 type echo-request' anymore. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: convert expr_rt byteorder when evaluating statment argFlorian Westphal2017-08-281-0/+1
| | | | | | | | | | | | | | expr_rt might write data in host byte order, so make sure to convert if needed. This makes 'tcp option maxseg size rt mtu' actually work, right now such rules are no-ops because nft_exthdr never increases the mss. While at it, extend the example to not bother testing non-syn packets. Reported-by: Matteo Croce <technoboy85@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add tcp option set support / tcp mss mangling test casesFlorian Westphal2017-08-224-1/+15
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: restrict meta nfproto test cases to inet familyFlorian Westphal2017-06-182-0/+35
| | | | | | | Followup patch will reject meta nfproto for non-inet families. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: remove two non-sensical rulesFlorian Westphal2017-06-182-25/+0
| | | | | | | | | | | | | | | meta nfproto returns the hook family that the current packet is being evaluted in, e.g. NFPROTO_NETDEV in case we're called from the netdev context. This makes no sense, if we add a rule to netdev, bridge, ip, ... table then thats where it will be evaluated, no runtime test needed. Only exception: inet family, in this case, nfproto will be either ipv4 or ipv6. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: restrict ct saddr test to inet familyFlorian Westphal2017-06-182-0/+23
| | | | | | | | | | | | | | | | any/ct.t: ERROR: line 94: src/nft add rule --debug=netlink ip6 test-ip6 output meta nfproto ipv4 ct original saddr 1.2.3.4: This rule should not have failed. Actually, this failure is "ok; we can't find upper layer protocol in this case, but even if we'd "fix" this it is still non-sensical, meta nfproto ipv4, but family is ipv6 --> rule would never match. First move this to an inet-specific test. A followup patch will reject meta nfproto for all families except inet. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Add test for ambiguity while setting the valueShyam Saini2017-06-182-0/+4
| | | | | | | | | | | | | | | | | | | | | This test checks bug identified and fixed in the commit mentioned below In a statement if there are multiple src data then it would be totally ambiguous to decide which value to set. Before the commit was made it returned 134(BUG), but now it returns 1 i.e, an error message. Following rules tests ambiguity while setting the value: $ sudo nft add rule ip test-ip4 output ct mark set {0x11333, 0x11} <cmdline>:1:41-55: Error: you cannot use a set here, unknown value to use add rule ip test-ip4 output ct mark set {0x11333, 0x11} ~~~~~~~~~~~~^^^^^^^^^^^^^^^ Test: 986dea8 ("evaluate: avoid reference to multiple src data in statements which set values") Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: fix up meta l4proto change for ip familyFlorian Westphal2017-05-1942-6721/+16
| | | | | | | We can delete some of the payload files now as ip/ip6/inet produce same implicit meta l4proto dep. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: fix up meta l4proto change for ip6 familyFlorian Westphal2017-05-1911-255/+255
| | | | | | | | | | | | After previous commit nft generates meta l4proto for ipv6 dependencies instead of checking the (first) nexthdr value. This fixes up all tests cases accordingly except one which fails with ip6/reject.t: ... 12: 'ip6 nexthdr 6 reject with tcp reset' mismatches 'meta l4proto 6 reject with tcp reset' This will be fixed by removing the implicit dependency in a followup patch. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add ip reject with tcp and check for mark tooFlorian Westphal2017-05-182-2/+4
| | | | | | | ... to avoid resetting e.g. the ssh session to the vm that runs nft-test.py. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: Adjust for changed exthdr debug outputPhil Sutter2017-03-131-2/+2
| | | | | | | | Debug output from libnftnl has changed to include 'present' keyword if NFT_EXTHDR_F_PRESENT flag is set in expression. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fib: Support existence checkPhil Sutter2017-03-132-0/+13
| | | | | | | | | | | | | | | | | This allows to check whether a FIB entry exists for a given packet by comparing the expression with a boolean keyword like so: | fib daddr oif exists The implementation requires introduction of a generic expression flag EXPR_F_BOOLEAN which allows relational expression to signal it's LHS that a boolean comparison is being done (indicated by boolean type on RHS). In contrast to exthdr existence checks, fib expression can't know this in beforehand because the LHS syntax is absolutely identical to a non-boolean comparison. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: Implement existence checkPhil Sutter2017-03-102-0/+17
| | | | | | | | | | | This allows to check for existence of an IPv6 extension or TCP option header by using the following syntax: | exthdr frag exists | tcpopt window exists Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: revisit tcp options supportPablo Neira Ayuso2017-02-282-21/+20
| | | | | | | | | | | | | | | | | | | Rework syntax, add tokens so we can extend the grammar more easily. This has triggered several syntax changes with regards to the original patch, specifically: tcp option sack0 left 1 There is no space between sack and the block number anymore, no more offset field, now they are a single field. Just like we do with rt, rt0 and rt2. This simplifies our grammar and that is good since it makes our life easier when extending it later on to accomodate new features. I have also renamed sack_permitted to sack-permitted. I couldn't find any option using underscore so far, so let's keep it consistent with what we have. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Add basic tests for ip, ip6 and inetManuel Messner2017-02-122-0/+219
| | | | | Signed-off-by: Manuel Messner <mm@skelett.io> Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: explicit network ctx assignment for icmp/icmp6 in special familiesArturo Borrero Gonzalez2017-01-272-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the inet, bridge and netdev families, we can add rules like these: % nft add rule inet t c ip protocol icmp icmp type echo-request % nft add rule inet t c ip6 nexthdr icmpv6 icmpv6 type echo-request However, when we print the ruleset: % nft list ruleset table inet t { chain c { icmpv6 type echo-request icmp type echo-request } } These rules we obtain can't be added again: % nft add rule inet t c icmp type echo-request <cmdline>:1:19-27: Error: conflicting protocols specified: inet-service vs. icmp add rule inet t c icmp type echo-request ^^^^^^^^^ % nft add rule inet t c icmpv6 type echo-request <cmdline>:1:19-29: Error: conflicting protocols specified: inet-service vs. icmpv6 add rule inet t c icmpv6 type echo-request ^^^^^^^^^^^ Since I wouldn't expect an IP packet carrying ICMPv6, or IPv6 packet carrying ICMP, if the link layer is inet, the network layer protocol context can be safely update to 'ip' or 'ip6'. Moreover, nft currently generates a 'meta nfproto ipvX' depedency when using icmp or icmp6 in the inet family, and similar in netdev and bridge families. While at it, a bit of code factorization is introduced. Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1073 Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: update quota and payloadPablo Neira Ayuso2016-12-144-8/+8
| | | | | | Include new consumed field for quota, and check for csum_flags in payload. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Test TCP flags match with parenthesesPhil Sutter2016-11-305-0/+33
| | | | | | | | This should test the fix in commit 7222680eb328b ("parser_bison: Allow parens on RHS of relational_expr"). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: Unmask negative set lookupAnatole Denis2016-11-2940-80/+2574
| | | | | | | | Many testcases were masked because of bug #888. This series of patches unmasks them Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Replace tests/files/expr-rt with Python based tests, and replace ether typeAnders K. Pedersen2016-10-292-0/+22
| | | | | | | with meta nfproto, which generates a bit fewer instructions. Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add fib expressionFlorian Westphal2016-10-282-0/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds the 'fib' expression which can be used to obtain the output interface from the route table based on either source or destination address of a packet. This can be used to e.g. add reverse path filtering: # drop if not coming from the same interface packet # arrived on # nft add rule x prerouting fib saddr . iif oif eq 0 drop # accept only if from eth0 # nft add rule x prerouting fib saddr . iif oif eq "eth0" accept # accept if from any valid interface # nft add rule x prerouting fib saddr oif accept Querying of address type is also supported. This can be used to e.g. only accept packets to addresses configured in the same interface: # fib daddr . iif type local Its also possible to use mark and verdict map, e.g.: # nft add rule x prerouting meta mark set 0xdead fib daddr . mark type vmap { blackhole : drop, prohibit : drop, unicast : accept } Signed-off-by: Florian Westphal <fw@strlen.de>
* src: use new range expression for != [a,b] intervalsPablo Neira Ayuso2016-10-1732-216/+108
| | | | | | | Use new range expression in the kernel to fix wrong bytecode generation. This patch also adjust tests so we don't hit problems there. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: quote user-defined strings when used from rule selectorsPablo Neira Ayuso2016-08-185-10/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The following selectors display strings using quotes: * meta iifname * meta oifname * meta ibriport * meta obriport However, the following do not: * meta oif * meta iif * meta skuid * meta skgid * meta iifgroup * meta oifgroup * meta rtclassid * ct label Given they refer to user-defined values, neither keywords nor internal built-in known values, let's quote the output of this. This patch modifies symbolic_constant_print() so we can signal this to indicate if the string needs to be quoted. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add basic payload testsFlorian Westphal2016-07-215-0/+73
| | | | | | | | | | payload set operations should work at least for byte-sized quantities >= 2 byte. Before adding support for odd-sized writes (ecn, dscp, ip6 flowlabel ...) add a bunch of tests to cover current state. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: update for changed set name in payloadPablo Neira Ayuso2016-05-1339-810/+810
| | | | | | | Original patch posted in the mailing list from Patrick, I have refreshed this so it applies on top of current HEAD. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: fix payload of dccp type in set elementsPablo Neira Ayuso2016-05-114-4/+4
| | | | | | This value needs to be lshift one bit to be correct. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft-test: don't zap remainder of rule after handling a setFlorian Westphal2016-03-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | Don't delete the part after the set, i.e. given chain input { type filter hook input priority 0; policy accept; vlan id { 1, 2, 4, 100, 4095} vlan pcp 1-3 } don't remove the vlan pcp 1-3 part. This exposes following bug: bridge/vlan.t: WARNING: line: 32: 'nft add rule --debug=netlink bridge test-bridge input vlan id { 1, 2, 4, 100, 4095 } vlan pcp 1-3': 'vlan id { 1, 2, 4, 100, 4095 } vlan pcp 1-3' mismatches 'vlan id { 4, 1, 2, 4095, 100} vlan pcp 0-0' We do not shift the range, so on reverse translation we get a 0-0 output. The bug will be fixes in a followup commit. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: enable tests for dccp typesPablo Neira Ayuso2016-03-075-4/+111
| | | | | | This patch make sure we test dccp type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-14 15:39:34 +0000