summaryrefslogtreecommitdiffstats
path: root/tests/shell/testcases
Commit message (Collapse)AuthorAgeFilesLines
* src: allow to map key to nfqueue numberFlorian Westphal13 days2-0/+17
| | | | | | | | | | | | | | | | | | | | | | | Allow to specify a numeric queue id as part of a map. The parser side is easy, but the reverse direction (listing) is not. 'queue' is a statement, it doesn't have an expression. Add a generic 'queue_type' datatype as a shim to the real basetype with constant expressions, this is used only for udata build/parse, it stores the "key" (the parser token, here "queue") as udata in kernel and can then restore the original key. Add a dumpfile to validate parser & output. JSON support is missing because JSON allow typeof only since quite recently. Joint work with Pablo. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1455 Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Support typeof in set and map typesPhil Sutter2024-11-0610-35/+193
| | | | | | | | | | | | | | | | Implement this as a special "type" property value which is an object with sole property "typeof". The latter's value is the JSON representation of the expression in set->key, so for concatenated typeofs it is a concat expression. All this is a bit clumsy right now but it works and it should be possible to tear it down a bit for more user-friendliness in a compatible way by either replacing the concat expression by the array it contains or even the whole "typeof" object - the parser would just assume any object (or objects in an array) in the "type" property value are expressions to extract a type from. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: move device to different namespacePablo Neira Ayuso2024-11-051-0/+39
| | | | | | | This actually triggers a UNREGISTER event, it is similar to existing tests, but add this test to improve coverage for this scenario. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: don't rely on writable test directoryFlorian Westphal2024-10-293-31/+23
| | | | | | | | | | | | | | | | | | | | | | Running shell tests from a virtme-ng instance with ro mapped test dir hangs due to runaway 'awk' reading from stdin instead of the intended $tmpfile (variable is empty), so add quotes where needed. 0002relative_0 wants to check relative includes. It tries to create a temporary file in the current directory, which fails as thats readonly inside the virtme vm instance. [ -w ! $foo ... did not catch this due to missing "". Add quotes and return the skip retval so the test gets flagged as skipped. 0013input_descriptors_included_files_0 and 0020include_chain_0 are switched to normal tmpfiles, there is nothing in the test that needs relative includes. Also, get rid of some error tests for subsequent mktemp calls for scripts that already called 'set -e'. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Join arithmetic statements in maps/vmap_timeoutPhil Sutter2024-10-111-6/+3
| | | | | | | In light of the recent typo fix, go an extra step and merge the modulo and offset adjustment in a single term. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: fix spurious dump failure in vmap timeout testFlorian Westphal2024-10-111-1/+1
| | | | | | | | | | | | | | | Blamed commit can update the timeout to 6s, but last line waits for 5 seconds and expects that to be enough to have all elements vanish. Fix the typo to limit update timeout also to 5 seconds and not 6. This fixes spurious dump failures like this one: - elements = { 1.2.3.4 . 22 : jump ssh_input } + elements = { 1.2.3.4 . 22 : jump ssh_input, + 10.0.95.144 . 38023 timeout 6s expires 545ms : jump other_input } Fixes: db80037c0279 ("tests: shell: extend vmap test with updates") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: more randomization for timeout parameterFlorian Westphal2024-09-151-8/+34
| | | | | | | | | | | | Either pass no timeout argument, pass timeout+expires or omit timeout (uses default timeout, if any). This should not expose further kernel code to run at this time, but unlike the existing (deterministic) element-update test case this script does have live traffic and different set types, including rhashtable which has async gc. Signed-off-by: Florian Westphal <fw@strlen.de>
* proto: use NFT_PAYLOAD_L4CSUM_PSEUDOHDR flag to mangle UDP checksumPablo Neira Ayuso2024-09-101-32/+97
| | | | | | | | | | | | | | | | | | | | | There are two mechanisms to update the UDP checksum field: 1) _CSUM_TYPE and _CSUM_OFFSET which specify the type of checksum (e.g. inet) and offset where it is located. 2) use NFT_PAYLOAD_L4CSUM_PSEUDOHDR flag to use layer 4 kernel protocol parser. The problem with 1) is that it is inconditional, that is, csum_type and csum_offset cannot deal with zero UDP checksum. Use NFT_PAYLOAD_L4CSUM_PSEUDOHDR flag instead since it relies on the layer 4 kernel parser which skips updating zero UDP checksum. Extend test coverage for the UDP mangling with and without zero checksum. Fixes: e6c9174e13b2 ("proto: add checksum key information to struct proto_desc") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: stabilize packetpath/payloadPablo Neira Ayuso2024-09-101-30/+34
| | | | | | | | | | | - Add sleep calls after setting up container topology. - Extend TCP connect timeout to 4 seconds. Test has no listener, this is just sending SYN packets that are rejected but it works to test the payload mangling ruleset. - fix incorrect logic to check for 0 matching packets through grep. Fixes: 84da729e067a ("tests: shell: add test to cover payload transport match and mangle") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add test case for timeout updatesFlorian Westphal2024-09-103-0/+173
| | | | | | | | | | | | Needs a feature check file, so add one: Add element with 1m timeout, then update expiry to 1ms. If element still exists after 1ms, update request was ignored. Test case checks timeouts can both be incremented and decremented, checks error recovery (update request but transaction fails) and that expiry is restored in addion to timeout. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: extend vmap test with updatesFlorian Westphal2024-09-101-3/+45
| | | | | | | | | | | | It won't validate that the update is actually effective, but it will trigger relevant update logic in kernel. This means the updated test works even if the kernel doesn't support updates. A dedicated test will be added to check timeout updates work. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add test for kernel stack recursion bugFlorian Westphal2024-09-102-0/+39
| | | | | | Validate that such ruleset updates get rejected. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: extend coverage for meta l4proto netdev/egress matchingPablo Neira Ayuso2024-09-021-0/+149
| | | | | | | | Extend coverage to match on small UDP packets from netdev/egress. While at it, cover bridge/input and bridge/output hooks too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: relax requirement for replace rule commandPablo Neira Ayuso2024-08-303-4/+64
| | | | | | | | | | | | | | No need for full cache, this command relies on the rule handle which is not validated from userspace. Cache requirements are similar to those of add/create/delete rule commands. This speeds up incremental updates with large rulesets. Extend tests/coverage for rule replacement. Fixes: 01e5c6f0ed03 ("src: add cache level flags") Tested-by: Eric Garver <eric@garver.life> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: cover reset command with counter and quotaPablo Neira Ayuso2024-08-261-0/+104
| | | | | Tested-by: Eric Garver <eric@garver.life> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: cover anonymous set with reset commandPablo Neira Ayuso2024-08-261-0/+21
| | | | | | | | Extend existing test to reset counters for rules with anonymous set. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1763 Tested-by: Eric Garver <eric@garver.life> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: consolidate reset commandPablo Neira Ayuso2024-08-261-7/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reset command does not utilize the cache infrastructure. This implicitly fixes a crash with anonymous sets because elements are not fetched. I initially tried to fix it by toggling the missing cache flags, but then ASAN reports memleaks. To address these issues relies on Phil's list filtering infrastructure which updates is expanded to accomodate filtering requirements of the reset commands, such as 'reset table ip' where only the family is sent to the kernel. After this update, tests/shell reports a few inconsistencies between reset and list commands: - reset rules chain t c2 display sets, but it should only list the given chain. - reset rules table t reset rules ip do not list elements in the set. In both cases, these are fully listing a given table and family, elements should be included. The consolidation also ensures list and reset will not differ. A few more notes: - CMD_OBJ_TABLE is used for: rules family table from the parser, due to the lack of a better enum, same applies to CMD_OBJ_CHAIN. - CMD_OBJ_ELEMENTS still does not use the cache, but same occurs in the CMD_GET command case which needs to be consolidated. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1763 Fixes: 83e0f4402fb7 ("Implement 'reset {set,map,element}' commands") Fixes: 1694df2de79f ("Implement 'reset rule' and 'reset rules' commands") Tested-by: Eric Garver <eric@garver.life> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: allow 0 burst in limit rate byte modePablo Neira Ayuso2024-08-192-0/+24
| | | | | | | | | | | | | | | Unbreak restoring elements in set with rate limit that fail with: > /dev/stdin:3618:61-61: Error: limit burst must be > 0 >                  elements = { 1.2.3.4 limit rate over 1000 kbytes/second timeout 1s, no need for burst != 0 for limit rate byte mode. Add tests/shell too. Fixes: 702eff5b5b74 ("src: allow burst 0 for byte ratelimit and use it as default") Fixes: 285baccfea46 ("src: disallow burst 0 in ratelimits") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add a few tests for nft -iPablo Neira Ayuso2024-08-194-0/+35
| | | | | | | | | | | Eric Garver recently provided a few tests for nft -i that helped identify issues that resulted in reverting: e791dbe109b6 ("cache: recycle existing cache with incremental updates") add these tests to tests/shell. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip vlan mangling testcase if egress is not supportPablo Neira Ayuso2024-08-191-0/+2
| | | | | | Add dependency on egress hook to skip this test in older kernels. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Extend table persist flag test a bitPhil Sutter2024-08-143-11/+42
| | | | | | Using a co-process, assert owner flag is effective. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: resolve check-tree.sh errorsFlorian Westphal2024-08-0811-0/+59
| | | | | | | | | | | | | | | | | | | | | It prints a few errors like this: ERR: "tests/shell/testcases/chains/jump_to_base_chain" has no "tests/shell/testcases/chains/dumps/jump_to_base_chain.{nft,nodump}" file For all of those, add the relevant .nft dump file. Add a 'nodump' file in case the test doesn't print anything (e.g. because the test checks that invalid ruleset fails validation). Some tests have a .nft but not .json-nft, this is because json lacks some features, in particular "typeof" and anonymous/implicit chains. ERR: "tests/shell/testcases/maps/delete_element_catchall" has no "tests/shell/testcases/maps/dumps/delete_element_catchall.{nft,nodump}" file ERR: "tests/shell/testcases/maps/dumps/delete_elem_catchall.nft" has no test "tests/shell/testcases/maps/delete_elem_catchall" these two are related, rename the dump file to match the script name. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: move flowtable with bogus priority to correct locationFlorian Westphal2024-08-081-1/+0
| | | | | | | This is an input file to be processed by "assert_failures" script. Fixes: b40bebbcee36 ("rule: do not crash if to-be-printed flowtable lacks priority") Signed-off-by: Florian Westphal <fw@strlen.de>
* optimize: skip variables in nat statementsPablo Neira Ayuso2024-07-181-7/+45
| | | | | | | | | | | Do not hit assert(): nft: optimize.c:486: rule_build_stmt_matrix_stmts: Assertion `k >= 0' failed. variables are not supported by -o/--optimize at this stage. Fixes: 9be404a153bc ("optimize: ignore existing nat mapping") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: connect chains to hook pointFlorian Westphal2024-07-1114-10/+31
| | | | | | | | | | | | | | These tests should fail because they contain a loop or exceed the jump stack. But this depends on the kernel validating chains that are not bound to any basechain/hook point. Wire up the initial chain to filter type. Without this tests will start to fail when kernel stops validating chains that are not reachable by any base chain. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: test jump to basechain is rejected, even if there is no loopFlorian Westphal2024-07-111-0/+25
| | | | | | Check that we can't jump to input hook from output. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add more ruleset validation test casesFlorian Westphal2024-07-113-0/+493
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Passes fine on all tested kernel releases. Same as existing tests, but try harder to fool the validation: 1. Add a ruleset where the jump that that exceeds 16 is "broken", i.e. c0 -> c1 ... -> c8 c9-> c1 ... -> c16 Where c0 is a base chain, with a graph thats really a linear list from c0 to c8 and c9 to c16 is a linear list not connected to the former or a hook point. Then try to link them either directly via jump/goto rule or indirectly with a verdict map. Try both unbound map with element doing 'goto c9' and then trying to add vmap rule to c8 (must fail, creates link). Then try reverse: with empty map, add vmap rule to c8 (should work, no elements...). Then, add map element with jump or goto to c9. This should be rejected. Try the same thing with a tproxy expression in a user-defined chain: attempt to make it reachable from c0 (filter input), which is illegal. Signed-off-by: Florian Westphal <fw@strlen.de>
* optimize: clone counter before insertion into set elementPablo Neira Ayuso2024-07-052-0/+28
| | | | | | | | The counter statement that is zapped from the rule needs to be cloned before inserting it into each set element. Fixes: 686ab8b6996e ("optimize: do not remove counter in verdict maps") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: cover set element deletion in mapsPablo Neira Ayuso2024-07-054-0/+87
| | | | | | | Extend existing coverage to deal with set element deletion, including catchall elements too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: check for removing table via handle with incorrect familyPablo Neira Ayuso2024-06-271-0/+9
| | | | | | | | This test checks for upstream commit: f6e1532a2697 ("netfilter: nf_tables: validate family when identifying table via handle") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add test case for reset tcp warningFlorian Westphal2024-06-253-0/+212
| | | | | | | | | | | | | | | | | | | | tcp reset rule + nftrace 1 triggers (harmless) splat from flow dissector: WARNING: CPU: 2 PID: 145809 at net/core/flow_dissector.c:1104 __skb_flow_dissect+0x19d4/0x5cc0 __skb_get_hash+0xa8/0x220 nft_trace_init+0x2ff/0x3b0 nft_do_chain+0xb04/0x1370 nft_do_chain_inet+0xc5/0x2e0 nf_hook_slow+0xa0/0x1d0 ip_local_out+0x14/0x90 nf_send_reset+0x94e/0xbd0 nft_reject_inet_eval+0x45e/0x690 nft_do_chain+0x220/0x1370 nf_hook_slow+0xa0/0x1d0 ip_local_deliver+0x23f/0x2d0 Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: do not crash if to-be-printed flowtable lacks priorityFlorian Westphal2024-06-161-0/+6
| | | | | | | Print an empty flowtable rather than crashing when dereferencing flowtable->priority.expr (its NULL). Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: use common shebang in "packetpath/flowtables" testThomas Haller2024-06-161-1/+3
| | | | | | | | | | | | | | | | | | | | | | "./tools/check-tree.sh" checks for a certain shebang. Either `/bin/bash` or `/bin/bash -e`. No other are currently allowed, because it makes sense to be strict/consistent and there is no need such flexibility. Move the "-x" to a later command. Note that "set -x" may not be a good choice anyway. If you want to debug a test and see the shell commands, you could just run $ ./tests/shell/run-tests.sh tests/shell/testcases/packetpath/flowtables -x That will automatically use `/bin/bash -x` as interpreter. And that works for all tests the same. This is also the reason why "check-tree.sh" checks for a well-known shebang. Because the "-x" option of the test runner mangles the shebang, but for that it needs to understand it. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: skip NFTA_RULE_POSITION_ID tests if kernel does not support itPablo Neira Ayuso2024-06-132-0/+4
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip ipsec tests if kernel does not support itPablo Neira Ayuso2024-06-131-0/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip ip option tests if kernel does not support itPablo Neira Ayuso2024-06-131-0/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add dependencies to skip unsupported tests in older kernelsPablo Neira Ayuso2024-06-135-0/+14
| | | | | | Update tests which contain unsupported features in older kernels. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: skip variable set elements when collapsing commandsPablo Neira Ayuso2024-06-113-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | ASAN reports an issue when collapsing commands that represent an element through a variable: include/list.h:60:13: runtime error: member access within null pointer of type 'struct list_head' AddressSanitizer:DEADLYSIGNAL ================================================================= ==11398==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7ffb77cf09c2 bp 0x7ffc818267c0 sp 0x7ffc818267a0 T0) ==11398==The signal is caused by a WRITE memory access. ==11398==Hint: address points to the zero page. #0 0x7ffb77cf09c2 in __list_add include/list.h:60 #1 0x7ffb77cf0ad9 in list_add_tail include/list.h:87 #2 0x7ffb77cf0e72 in list_move_tail include/list.h:169 #3 0x7ffb77cf86ad in nft_cmd_collapse src/cmd.c:478 #4 0x7ffb77da9f16 in nft_evaluate src/libnftables.c:531 #5 0x7ffb77dac471 in __nft_run_cmd_from_filename src/libnftables.c:720 #6 0x7ffb77dad703 in nft_run_cmd_from_filename src/libnftables.c:807 Skip such commands to address this issue. This patch also extends tests/shell to cover for this bug. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1754 Fixes: 498a5f0c219d ("rule: collapse set element commands") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add vlan mangling test casePablo Neira Ayuso2024-06-031-0/+75
| | | | | | | | As a follow up for: 74cf3d16d8e9 ("tests: shell: add vlan match test case") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add vlan double tagging match simple test casePablo Neira Ayuso2024-06-031-0/+73
| | | | | | | | | | As a follow up for: 74cf3d16d8e9 ("tests: shell: add vlan match test case") Add basic test for q-in-q matching support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add support for variables in map expressionsJeremy Sowden2024-05-208-0/+326
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is possible to use a variable to initialize a map, which is then used in a map statement: define dst_map = { ::1234 : 5678 } table ip6 nat { map dst_map { typeof ip6 daddr : tcp dport; elements = $dst_map } chain prerouting { ip6 nexthdr tcp redirect to ip6 daddr map @dst_map } } However, if one tries to use the variable directly in the statement: define dst_map = { ::1234 : 5678 } table ip6 nat { chain prerouting { ip6 nexthdr tcp redirect to ip6 daddr map $dst_map } } nft rejects it: /space/azazel/tmp/ruleset.1067161.nft:5:47-54: Error: invalid mapping expression variable ip6 nexthdr tcp redirect to ip6 daddr map $dst_map ~~~~~~~~~ ^^^^^^^^ It also rejects variables in stateful object statements: define quota_map = { 192.168.10.123 : "user123", 192.168.10.124 : "user124" } table ip nat { quota user123 { over 20 mbytes } quota user124 { over 20 mbytes } chain prerouting { quota name ip saddr map $quota_map } } thus: /space/azazel/tmp/ruleset.1067161.nft:15:29-38: Error: invalid mapping expression variable quota name ip saddr map $quota_map ~~~~~~~~ ^^^^^^^^^^ Add support for these uses together with some test-cases. Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067161 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: combine dormant flag with netdevice removalPablo Neira Ayuso2024-04-251-0/+9
| | | | | | Exercise table is dormant and netdevice is gone combination. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: packetpath: add check for drop policyFlorian Westphal2024-04-253-0/+174
| | | | | | | check that policy can be changed from accept to drop and that the kernel acts on this. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Fix for maps/typeof_maps_add_delete with ASANPhil Sutter2024-04-243-4/+4
| | | | | | | | With both KASAN and ASAN enabled, my VM is too slow so the ping-induced set entry times out before the test checks its existence. Increase its timeout to 2s, seems to do the trick. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Add support for table's persist flagPhil Sutter2024-04-191-0/+36
| | | | | | | | | Bison parser lacked support for passing multiple flags, JSON parser did not support table flags at all. Document also 'owner' flag (and describe their relationship in nft.8. Signed-off-by: Phil Sutter <phil@nwl.cc>
* mergesort: Avoid accidental set element reorderingPhil Sutter2024-04-122-20/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In corner cases, expr_msort_cmp() may return 0 for two non-identical elements. An example are ORed tcp flags: 'syn' and 'syn | ack' are considered the same value since expr_msort_value() reduces the latter to its LHS. Keeping the above in mind and looking at how list_expr_sort() works: The list in 'head' is cut in half, the first half put into the temporary list 'list' and finally 'list' is merged back into 'head' considering each element's position. Shall expr_msort_cmp() return 0 for two elements, the one from 'list' ends up after the one in 'head', thus reverting their previous ordering. The practical implication is that output never matches input for the sample set '{ syn, syn | ack }' as the sorting after delinearization in netlink_list_setelems() keeps swapping the elements. Out of coincidence, the commit this fixes itself illustrates the use-case this breaks, namely tracking a ruleset in git: Each ruleset reload will trigger an update to the stored dump. This change breaks interval set element deletion because __set_delete() implicitly relies upon this reordering of duplicate entries by inserting a clone of the one to delete into the start (via list_move()) and after sorting assumes the clone will end up right behind the original. Fix this by calling list_move_tail() instead. Fixes: 14ee0a979b622 ("src: sort set elements in netlink_get_setelems()") Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Accept more than two operands in binary expressionsPhil Sutter2024-04-122-81/+25
| | | | | | | | | | | | | | The most common use case is ORing flags like | syn | ack | rst but nft seems to be fine with less intuitive stuff like | meta mark set ip dscp << 2 << 3 so support all of them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: check for reset tcp options supportPablo Neira Ayuso2024-04-081-0/+2
| | | | | Fixes: 59a33d08ab3a ("parser: tcpopt: fix tcp option parsing with NUM + length field") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: maps/{vmap_unary,named_limits} require pipapo set backendPablo Neira Ayuso2024-04-084-0/+8
| | | | | | ... sets/typeof_sets_concat needs it too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: chains/{netdev_netns_gone,netdev_chain_dev_gone} require ↵Pablo Neira Ayuso2024-04-082-0/+4
| | | | | | | inet/ingress support Fixes: 6847a7ce0fc9 ("tests: shell: cover netns removal for netdev and inet/ingress basechains") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-24 16:48:44 +0000