summaryrefslogtreecommitdiffstats
path: root/tests/py/inet
Commit message (Collapse)AuthorAgeFilesLines
...
* tests/py: Add a test sanitizer and fix its findingsPhil Sutter2021-02-0411-212/+24
| | | | | | | | | | | | | | | | This is just basic housekeeping: - Remove duplicate tests in any of the *.t files - Remove explicit output if equal to command itself in *.t files - Remove duplicate payload records in any of the *.t.payload* files - Remove stale payload records (for which no commands exist in the respective *.t file - Remove duplicate/stale entries in any of the *.t.json files In some cases, tests were added instead of removing a stale payload record if it fit nicely into the sequence of tests. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Do not abbreviate reject statement objectPhil Sutter2021-02-031-6/+9
| | | | | | | | | No need to reduce output size, also this way output is more predictable. While being at it, drop some pointless chunks from tests/py/bridge/reject.t.json.output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* reject: Unify inet, netdev and bridge delinearizationPhil Sutter2021-01-272-196/+32
| | | | | | | | | | | | | | Postprocessing for inet family did not attempt to kill any existing payload dependency, although it is perfectly fine to do so. The mere culprit is to not abbreviate default code rejects as that would drop needed protocol info as a side-effect. Since postprocessing is then almost identical to that of bridge and netdev families, merge them. While being at it, extend tests/py/netdev/reject.t by a few more tests taken from inet/reject.t so this covers icmpx rejects as well. Cc: Jose M. Guisado Gomez <guigom@riseup.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: Fix for changed concatenated ranges outputPhil Sutter2020-12-153-3/+3
| | | | | | | Payload didn't change but libnftnl was fixed to print the key_end data reg of concat-range elements, too. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: update format of registers in bitwise payloads.Jeremy Sowden2020-11-166-13/+13
| | | | | | | | | libnftnl has been changed to bring the format of registers in bitwise dumps in line with those in other types of expression. Update the expected output of Python test-cases. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: remove duplicate payloads.Jeremy Sowden2020-11-094-221/+0
| | | | | | | | | nft-test.py only needs one payload per rule, but a number of rules have duplicates, typically one per address family, so just keep the last payload for rules listed more than once. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: avoid warning and add missing json test casesFlorian Westphal2020-11-052-2/+57
| | | | | | make dnat.t pass in json mode. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: json: add missing test case outputFlorian Westphal2020-11-051-0/+74
| | | | | | | | | | | | Fix warnings and errors when running nf-test.py -j due to missing json test case updates. This also makes bridge/reject.t pass in json mode. No code changes. Fixes: 8615ed93f6e4c4 ("evaluate: enable reject with 802.1q") Fixes: fae0a0972d7a71 ("tests: py: Enable anonymous set rule with concatenated ranges in inet/sets.t") Fixes: 2a20b5bdbde8a1 ("datatype: add frag-needed (ipv4) to reject options") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: add missing test JSON output for TCP flag tests.Jeremy Sowden2020-10-122-0/+186
| | | | | | Fixes: 3926a3369bb5 ("mergesort: unbreak listing with binops") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: context tracking for multiple transport protocolsPablo Neira Ayuso2020-09-152-0/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch extends the protocol context infrastructure to track multiple transport protocols when they are specified from sets. This removes errors like: "transport protocol mapping is only valid after transport protocol match" when invoking: # nft add rule x z meta l4proto { tcp, udp } dnat to 1.1.1.1:80 This patch also catches conflicts like: # nft add rule x z ip protocol { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80 Error: conflicting protocols specified: udp vs. tcp add rule x z ip protocol { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80 ^^^^^^^^^ and: # nft add rule x z meta l4proto { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80 Error: conflicting protocols specified: udp vs. tcp add rule x z meta l4proto { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80 ^^^^^^^^^ Note that: - the singleton protocol context tracker is left in place until the existing users are updated to use this new multiprotocol tracker. Moving forward, it would be good to consolidate things around this new multiprotocol context tracker infrastructure. - link and network layers are not updated to use this infrastructure yet. The code that deals with vlan conflicts relies on forcing protocol context updates to the singleton protocol base. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: added "socket wildcard" testcasesBalazs Scheidler2020-08-293-0/+62
| | | | | Signed-off-by: Balazs Scheidler <bazsi77@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mergesort: unbreak listing with binopsPablo Neira Ayuso2020-08-202-0/+23
| | | | | | | | | | | | | tcp flags == {syn, syn|ack} tcp flags & (fin|syn|rst|psh|ack|urg) == {ack, psh|ack, fin, fin|psh|ack} results in: BUG: Unknown expression binop nft: mergesort.c:47: expr_msort_cmp: Assertion `0' failed. Aborted (core dumped) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Enable anonymous set rule with concatenated ranges in inet/sets.tStefano Brivio2020-05-284-1/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 64b9aa3803dd ("tests/py: Add tests involving concatenated ranges") introduced a rule, commented out, adding an anonymous set including concatenated ranges. Now that they are properly handled, we can enable it. Note that this introduces a new warning. In the output below, '\' marks newlines I introduced to keep lines short: inet/sets.t: WARNING: line 24: \ 'add rule inet test-inet input ip daddr . tcp dport \ { 10.0.0.0/8 . 10-23, 192.168.1.1-192.168.3.8 . 80-443 } accept': \ 'ip daddr . tcp dport \ { 10.0.0.0/8 . 10-23, 192.168.1.1-192.168.3.8 . 80-443 } accept' \ mismatches 'meta nfproto ipv4 ip daddr . tcp dport \ { 10.0.0.0/8 . 10-23, 192.168.1.1-192.168.3.8 . 80-443} accept' which is similar to the existing warning, also introduced by commit 64b9aa3803dd: inet/sets.t: WARNING: line 23: \ 'add rule inet test-inet input \ ip saddr . ip daddr . tcp dport @set3 accept': \ 'ip saddr . ip daddr . tcp dport @set3 accept' mismatches \ 'meta nfproto ipv4 ip saddr . ip daddr . tcp dport @set3 accept' This is mentioned in the commit message for 64b9aa3803dd itself: * Payload dependency killing ignores the concatenated IP header expressions on LHS, so rule output is asymmetric. which means that for family inet, 'meta nfproto ipv4' is added to the output of the rule, on top of what was passed as input, but not for families bridge and netdev. For this reason, it's not possible in this case to specify a single expected output, differing from the input, and, also, 'meta nfproto ipv4' can only be passed as input for family inet as it's not relevant for the other families. As an alternative, we could split the rules from this test into tests for the corresponding families, as this test case itself is under the 'inet' directory, but I consider this beyond the scope of this patchset. v2: Enable rule in py/inet/sets.t instead of adding a new test in shell/sets (Phil Sutter) Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* tests: py: remove range test with service namesPablo Neira Ayuso2020-04-281-1/+0
| | | | | | | Service names printing are not default these days, using service names with ranges is misleading. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: broken error reporting with mappingsPablo Neira Ayuso2020-04-111-0/+2
| | | | | | | | | | | | | Segfault on error reporting when intervals overlap. ip saddr vmap { 10.0.1.0-10.0.1.255 : accept, 10.0.1.1-10.0.2.255 : drop } Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1415 Fixes: 4d6ad0f310d6 ("segtree: check for overlapping elements at insertion") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: update nat expressions payload to include proto flagsPablo Neira Ayuso2020-03-201-2/+2
| | | | | | | Update tests according to 6c84577b0d23 ("evaluate: add range specified flag setting (missing NF_NAT_RANGE_PROTO_SPECIFIED)") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Move tcpopt.t to any/ directoryPhil Sutter2020-03-104-719/+0
| | | | | | | Merge tcpopt.t files in ip, ip6 and inet into a common one, they were just marignally different. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/py: Add tests involving concatenated rangesPhil Sutter2020-03-105-0/+77
| | | | | | | | | | | | | | | Very basic testing, just a set definition, a rule which references it and another one with an anonymous set. Sadly this is already enough to expose some pending issues: * Payload dependency killing ignores the concatenated IP header expressions on LHS, so rule output is asymmetric. * Anonymous sets don't accept concatenated ranges yet, so the second rule is manually disabled for now. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: add bit-shift tests.Jeremy Sowden2020-02-073-0/+29
| | | | | | | | Add a couple of Python test-cases for setting the CT mark to a bitwise expression derived from the packet mark and vice versa. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xfrm: spi is big-endianFlorian Westphal2020-01-141-1/+0
| | | | | | | the kernel stores spi in a __be32, so fix up the byteorder annotation. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add missing json outputsFernando Fernandez Mancera2019-07-171-0/+25
| | | | | | Fixes: 1188a69604c3 ("src: introduce SYNPROXY matching") Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce SYNPROXY matchingFernando Fernandez Mancera2019-07-173-0/+156
| | | | | | | | | | | | | | | | | | | | Add support for "synproxy" statement. For example (for TCP port 8888): table ip x { chain y { type filter hook prerouting priority raw; policy accept; tcp dport 8888 tcp flags syn notrack } chain z { type filter hook input priority filter; policy accept; tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm ct state invalid drop } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: fix up two broken json test casesFlorian Westphal2019-07-171-0/+23
| | | | | | | | | Forgot to add a json test case for the recently added ct ip addr in map case. Fix up rawpayload.t for json, it needs to expect new "th dport" when listing. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* src/ct: provide fixed data lengh sizes for ip/ip6 keysFlorian Westphal2019-07-122-0/+10
| | | | | | | | | | | | | | | | | | nft can load but not list this: table inet filter { chain input { ct original ip daddr {1.2.3.4} accept } } Problem is that the ct template length is 0, so we believe the right hand side is a concatenation because left->len < set->key->len is true. nft then calls abort() during concatenation parsing. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1222 Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: support for NFT_CT_{SRC,DST}_{IP,IP6}Pablo Neira Ayuso2019-06-213-6/+3
| | | | | | | | | | | | | | | | | These keys are available since kernel >= 4.17. You can still use NFT_CT_{SRC,DST}, however, you need to specify 'meta protocol' in first place to provide layer 3 context. Note that NFT_CT_{SRC,DST} are broken with set, maps and concatenations. This patch is implicitly fixing these cases. If your kernel is < 4.17, you can still use address matching via explicit meta nfproto: meta nfproto ipv4 ct original saddr 1.2.3.4 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: prefer meta protocol as bridge l3 dependencyFlorian Westphal2019-06-192-6/+6
| | | | | | | | | | | | | | | | | | | On families other than 'ip', the rule ip protocol icmp needs a dependency on the ip protocol so we do not treat e.g. an ipv6 header as ip. Bridge currently uses eth_hdr.type for this, but that will cause the rule above to not match in case the ip packet is within a VLAN tagged frame -- ether.type will appear as ETH_P_8021Q. Due to vlan tag stripping, skb->protocol will be ETH_P_IP -- so prefer to use this instead. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "tests: py: remove single-value-anon-set test cases"Pablo Neira Ayuso2019-05-2424-0/+1711
| | | | This reverts commit d03bcb669c0c645190df9bd166f53380bcac7862.
* tests: py: remove single-value-anon-set test casesFlorian Westphal2019-05-1924-1711/+0
| | | | | | | | future change will rewrite all single-element anon sets to a cmp op. Retain a few test cases to later check that the rewrite is correct, but remove all others. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: Fix JSON expected output after expr merge changePhil Sutter2019-05-091-42/+2
| | | | | | | | Looks like original patch missed this one. Fixes: 88ba0c92754d8 ("tests: fix up expected payloads after expr merge change") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Fix tproxy support regarding latest changesPhil Sutter2019-05-093-2/+82
| | | | | | | | | | | | | | | | | | | Family may be specified also if no address is given at the same time, make parser/printer tolerant to that. Also fix for missing/incorrect JSON equivalents in tests/py. While being at it, fix two issues in non-JSON tests: * Ruleset is printed in numeric mode, so use 'l4proto 6' instead of 'l4proto tcp' in rules to avoid having to specify expected output for that unrelated bit. * In ip and ip6 family tables, family parameter is not deserialized on output. Fixes: 3edb96200690b ("parser_bison: missing tproxy syntax with port only for inet family") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Fix JSON equivalents of osf testsPhil Sutter2019-05-091-2/+57
| | | | | | Fixes: 12adf747a3f62 ("tests: py: add osf tests with versions") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Support nat in inet familyPhil Sutter2019-05-092-0/+297
| | | | | | | | Add the missing bits to JSON parser, printer, man page and testsuite. Fixes: fbe27464dee45 ("src: add nat support for the inet family") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nat support for the inet familyFlorian Westphal2019-04-094-0/+133
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | consider a simple ip6 nat table: table ip6 nat { chain output { type nat hook output priority 0; policy accept; dnat to dead:2::99 } Now consider same ruleset, but using 'table inet nat': nft now lacks context to determine address family to parse 'to $address'. This adds code to make the following work: table inet nat { [ .. ] # detect af from network protocol context: ip6 daddr dead::2::1 dnat to dead:2::99 # use new dnat ip6 keyword: dnat ip6 to dead:2::99 } On list side, the keyword is only shown in the inet family, else the short version (dnat to ...) is used as the family is redundant when the table already mandates the ip protocol version supported. Address mismatches such as table ip6 { .. dnat ip to 1.2.3.4 are detected/handled during the evaluation phase. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add osf tests with versionsFernando Fernandez Mancera2019-04-083-0/+85
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: missing tproxy syntax with port only for inet familyPablo Neira Ayuso2019-04-042-2/+29
| | | | | | | | | | | | | | | | | # nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy ip to :2000 Error: syntax error, unexpected colon add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy ip to :2000 ^ Syntax with no protocol for tproxy complains with: # nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000 Error: Conflicting network layer protocols. add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000 ^^^^^^^^^^^^^^^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1310 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: fix up expected payloads after expr merge changeFlorian Westphal2019-01-252-8/+14
| | | | | | | | nft currently doesn't do payload merging anymore in some cases, so fix up the expected output. Fixes: ce2651222911 ("payload: refine payload expr merging") Signed-off-by: Florian Westphal <fw@strlen.de>
* json: Fix osf ttl supportPhil Sutter2018-10-241-3/+32
| | | | | | | | | | | | | | Having to use numerical values for ttl property in JSON is not practical as these values are arbitrary and meaningful only in netfilter. Instead align JSON output/input with standard API, accepting names for TTL matching strategy. Also add missing documentation in libnftables-json man page and fix JSON equivalent in tests/py. Fixes: 03eafe098d5ee ("osf: add ttl option support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* osf: add ttl option supportFernando Fernandez Mancera2018-10-233-2/+72
| | | | | | | | | | | | | | Add support for ttl option in "osf" expression. Example: table ip foo { chain bar { type filter hook input priority filter; policy accept; osf ttl skip name "Linux" } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Add missing JSON bits for inet/meta.tPhil Sutter2018-10-152-3/+20
| | | | | | | | Those were forgotten when renaming meta secpath to meta ipsec. Fixes: 8f55ed41d0070 ("src: rename meta secpath to meta ipsec") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: Fix for ECN keyword in LHS of relationalPhil Sutter2018-10-044-0/+48
| | | | | | | | | | | | | | | | | | | | Of all possible TCP flags, 'ecn' is special since it is recognized by lex as a keyword (there is a a field in IPv4 and IPv6 headers with the same name). Therefore it is listed in keyword_expr, but that was sufficient for RHS only. The following statement reproduces the issue: | tcp flags & (syn | ecn) == (syn | ecn) The solution is to limit binop expressions to accept an RHS expression on RHS ("real" LHS expressions don't make much sense there anyway), which then allows keyword_expr to occur there. In order to maintain the recursive behaviour if braces are present, allow primary_rhs_expr to consist of a basic_rhs_expr enclosed in braces. This in turn requires for braced RHS part in relational_expr to be dropped, otherwise bison complains about shift/reduce conflict. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ipsec (xfrm) expressionMáté Eckl2018-09-213-0/+197
| | | | | | | | | | | | | | | | This allows matching on ipsec tunnel/beet addresses in xfrm state associated with a packet, ipsec request id and the SPI. Examples: ipsec in ip saddr 192.168.1.0/24 ipsec out ip6 daddr @endpoints ipsec in spi 1-65536 Joint work with Florian Westphal. Cc: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: rename meta secpath to meta ipsecFlorian Westphal2018-09-212-3/+3
| | | | | | | for symmetry with 'rt ipsec'. "meta secpath" still works. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: fix json output for osf, socket and tproxy expressionsFlorian Westphal2018-09-033-15/+33
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* JSON: Make match op mandatory, introduce 'in' operatorPhil Sutter2018-08-3035-0/+298
| | | | | | | | This special operator is required for cases where missing operator does not lead to same results as equal operator, i.e. with bitmasks on RHS. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Rename mangle statement propertiesPhil Sutter2018-08-305-16/+16
| | | | | | | Instead of the generic "left" and "right", use "key" and "value". Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Rename (v)map expression propertiesPhil Sutter2018-08-305-18/+18
| | | | | | | | Change the rather generic "left" and "right" into "key" and "data" as suggested at NFWS. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Review payload expressionPhil Sutter2018-08-3027-347/+347
| | | | | | | | | | | For raw payloads, property "name" is not needed, it's clearly identified by base/offset/len properties. In non-raw payload expressions, rename property "name" to "protocol" as suggested during NFWS. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Make meta statement/expression extensiblePhil Sutter2018-08-3015-49/+49
| | | | | | | | | | Lessons learned from fwd statement: We must not assume a given statement/expression may not receive further properties in the future. Therefore make meta value an object with a property "key" instead of just a string containing the key name. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: tproxy: add json supportFlorian Westphal2018-08-291-0/+90
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* src: osf: add json supportFlorian Westphal2018-08-291-0/+66
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>