summaryrefslogtreecommitdiffstats
path: root/tests/shell/testcases/packetpath
Commit message (Collapse)AuthorAgeFilesLines
* tests: use common shebang in "packetpath/flowtables" testThomas Haller14 hours1-1/+3
| | | | | | | | | | | | | | | | | | | | | | "./tools/check-tree.sh" checks for a certain shebang. Either `/bin/bash` or `/bin/bash -e`. No other are currently allowed, because it makes sense to be strict/consistent and there is no need such flexibility. Move the "-x" to a later command. Note that "set -x" may not be a good choice anyway. If you want to debug a test and see the shell commands, you could just run $ ./tests/shell/run-tests.sh tests/shell/testcases/packetpath/flowtables -x That will automatically use `/bin/bash -x` as interpreter. And that works for all tests the same. This is also the reason why "check-tree.sh" checks for a well-known shebang. Because the "-x" option of the test runner mangles the shebang, but for that it needs to understand it. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add vlan mangling test casePablo Neira Ayuso13 days1-0/+75
| | | | | | | | As a follow up for: 74cf3d16d8e9 ("tests: shell: add vlan match test case") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add vlan double tagging match simple test casePablo Neira Ayuso13 days1-0/+73
| | | | | | | | | | As a follow up for: 74cf3d16d8e9 ("tests: shell: add vlan match test case") Add basic test for q-in-q matching support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: packetpath: add check for drop policyFlorian Westphal2024-04-253-0/+174
| | | | | | | check that policy can be changed from accept to drop and that the kernel acts on this. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: check for reset tcp options supportPablo Neira Ayuso2024-04-081-0/+2
| | | | | Fixes: 59a33d08ab3a ("parser: tcpopt: fix tcp option parsing with NUM + length field") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: maps/{vmap_unary,named_limits} require pipapo set backendPablo Neira Ayuso2024-04-081-0/+2
| | | | | | ... sets/typeof_sets_concat needs it too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: payload matching requires egress supportPablo Neira Ayuso2024-04-081-0/+2
| | | | | | | Older kernels do not support for egress hook. Fixes: 84da729e067a ("tests: shell: add test to cover payload transport match and mangle") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: packetpath/flowtables: open all temporary files in /tmpJeremy Sowden2024-04-021-1/+1
| | | | | | | | | | The test used to do I/O over a named pipe in $PWD, until Phil changed it to create the pipe in /tmp. However, he missed one `socat` command. Update that too. Fixes: 3a9f29e21726 ("tests: shell: packetpath/flowtables: Avoid spurious EPERM") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: restore binop syntax when listing ruleset for flagsPablo Neira Ayuso2024-03-201-8/+8
| | | | | | | | | | | c3d57114f119 ("parser_bison: add shortcut syntax for matching flags without binary operations") provides a similar syntax to iptables using a prefix representation for flag matching. Restore original representation using binop when listing the ruleset. The parser still accepts the prefix notation for backward compatibility. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Regenerate all json-nft dumpsPhil Sutter2024-03-191-12/+12
| | | | | | | | Ordering of 'nft -j list ruleset' output has changed, Regenerate existing json-nft dumps. No functional change intended, merely the position of chain objects should have moved up in the "nftables" array. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: packetpath/flowtables: Avoid spurious EPERMPhil Sutter2024-03-191-3/+3
| | | | | | | | | On my system for testing, called socat is not allowed to create the pipe file in local directory (probably due to sshfs). Specify a likely unique path in /tmp to avoid such problems. Fixes: 419c0199774c6 ("tests: shell: add test to cover ct offload by using nft flowtables") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: add more json dumpsFlorian Westphal2024-02-261-0/+674
| | | | | | | | | | | | Those are expected to be stable, so add them. Some are not 100% correct, as "typeof" is misprinted as "type" (json output and input parser lack support for this), but for these files the "type" is valid too. This will allow better validation once proper "typeof" support is added to json.c and json-parser.c. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: permit use of host-endian constant values in set lookup keysFlorian Westphal2024-02-142-0/+115
| | | | | | | | | | | extend an existing test case with the afl input to cover in/output. A new test case is added to test linearization, delinearization and matching Fixes: c0080feb0d03 ("evaluate: permit use of host-endian constant values in set lookup keys") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add test to cover ct offload by using nft flowtablesYi Chen2024-01-231-0/+96
| | | | | | | To cover kernel patch ("netfilter: nf_tables: set transport offset from mac header for netdev/egress"). Signed-off-by: Yi Chen <yiche@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: prefer project nft to system-wide nftFlorian Westphal2024-01-071-19/+19
| | | | | | | | Use $NFT (src/nft, in-tree binary), not the one installed by the distro. Else we may not find newly added bugs unless user did "make install" or bug has propagated to release. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add test to cover payload transport match and manglePablo Neira Ayuso2023-12-192-0/+180
| | | | | | | | | | Exercise payload transport match and mangle for inet, bridge and netdev families with IPv4 and IPv6 packets. To cover kernel patch ("netfilter: nf_tables: set transport offset from mac header for netdev/egress"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: tcpopt: fix tcp option parsing with NUM + length fieldFlorian Westphal2023-12-062-0/+55
| | | | | | | | | | | | | | | | | | | | | | tcp option 254 length ge 4 ... will segfault. The crash bug is that tcpopt_expr_alloc() can return NULL if we cannot find a suitable template for the requested kind + field combination, so add the needed error handling in the bison parser. However, we can handle this. NOP and EOL have templates, all other options (known or unknown) must also have a length field. So also add a fallback template to handle both kind and length, even if only a numeric option is given that nft doesn't recognize. Don't bother with output, above will be printed via raw syntax, i.e. tcp option @254,8,8 >= 4. Fixes: 24d8da308342 ("tcpopt: allow to check for presence of any tcp option") Reported-by: Maciej Żenczykowski <zenczykowski@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add missing "vlan_8021ad_tag.nodump" fileThomas Haller2023-10-161-0/+0
| | | | | | | | | | This is an inconsistency. The test should have either a .nft or a .nodump file. "./tools/check-tree.sh" enforces that and will in the future run by `make check`. Fixes: 74cf3d16d8e9 ('tests: shell: add vlan match test case') Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add vlan match test caseFlorian Westphal2023-10-071-0/+50
Check that we can match on the 8021ad header and vlan tag, see af84f9e447a6 ("netfilter: nft_payload: rebuild vlan header on h_proto access"). Signed-off-by: Florian Westphal <fw@strlen.de>