summaryrefslogtreecommitdiffstats
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
* tests: shell: chain dependency validation with mapsPablo Neira Ayuso2018-05-231-0/+10
| | | | | | | Just like 4b6fb07de07a ("tests: shell: more chain dependency validation") but test chain dependency in jumps from maps. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: non-base chain loopsPablo Neira Ayuso2018-05-231-0/+10
| | | | | | Detect more non-base chain loops. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: more chain dependency validationPablo Neira Ayuso2018-05-231-0/+10
| | | | | | | More exercising for the chain dependency validation. Reported-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Make diff functions use print_* functionsMáté Eckl2018-05-171-6/+4
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: Added paylad file description to READMEMáté Eckl2018-05-171-3/+26
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: print path of the logfileMáté Eckl2018-05-172-1/+6
| | | | | | | | | | It is good to know that a log is generated even without browsing the nft-test.py source code. Also print_info function is introduced. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: print_msg refactorMáté Eckl2018-05-171-6/+8
| | | | | | | | | | | | | | | The errstr attribute was hard-coded to "ERROR:" errstr has been moved in the parameter list. As print_msg is only used from the other print_* this is not an issue, and as there is a print_error function, I don't think that strerr should default to "ERROR:". Also this kind of messages now get written to stderr. This can be beneficial if someone wants to redirect output to a file. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: updated test file structure descripion in READMEMáté Eckl2018-05-171-9/+9
| | | | | | | | | The order of the table and chain definitions have changed in test files. Now the name of the chain has to be specified in the definition of the table, so their order is reverted. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: small typo fixes in the python tests READMEMáté Eckl2018-05-171-2/+2
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: specify python version in nft-test.pyMáté Eckl2018-05-171-1/+1
| | | | | | | | /usr/bin/python is linked to different main version of python in different distributions (eg. 2 on debian, 3 on arch linux). Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: Support testing JSON input and output as wellPhil Sutter2018-05-11136-5/+34651
| | | | | | | | | | | | | | | | | | This extends nft-test.py by optional JSON testing capabilities, activated via '-j'/'--enable-json' parameter). JSON testing happens for all rules which are supposed to work: After a rule has been added and the existing tests (payload, ruleset listing output) have been performed, basically the same test is done again using a recorded JSON equivalent and (if necessary) a recorded listing output. The code tries to ease new test case creation overhead by auto-generating JSON equivalent input via listing the (non-JSON) rule in JSON format. Also, differing netlink debug and listing output are stored in *.got files to assist in analyzing/fixing failing test cases. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Highlight offending parts in differences warningsPhil Sutter2018-05-111-1/+34
| | | | | | | | Print the non-equal parts of the two rules in yellow when printing the differences warning. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Don't read expected payload for each tablePhil Sutter2018-05-111-10/+12
| | | | | | | | | When testing rule adding to different table families, expected payload was read for each tested family again. Instead, read it just once and just try to read a family-specific payload for each tested family. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Reduce indenting level in nft-test.pyPhil Sutter2018-05-111-61/+65
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Extend rule_management/0001addposition_0Phil Sutter2018-05-096-36/+112
| | | | | | | | | | | | Combine it with 0002insertposition_0 due to the many similarities, extend it to test 'handle' and 'index' parameters as well and rename the testcase accordingly. Also add a new 0002addinsertlocation_1 which tests that wrong argument to all of the location parameters fails. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: allow to specify sets with a timeoutFlorian Westphal2018-05-097-19/+94
| | | | | | | | | | | Not usable yet, as the set timeout netlink output isn't captured so far, but it adds groundwork to add this as a follow-up. Set definition syntax changes a little, if you want to add multiple elements they now have to be separated by "," just like in nftables. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: add expires tests with different time basesFlorian Westphal2018-05-092-5/+21
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* src: support timeouts in millisecondsFlorian Westphal2018-05-091-1/+6
| | | | | | | | | | currently the frontend uses seconds everywhere and multiplies/divides by 1000. Pass milliseconds around instead and extend the scanner to accept 'ms' in timestrings. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add size to metersPablo Neira Ayuso2018-05-082-2/+2
| | | | | | Otherwise, 65535 is used and testsuite reports dump mismatch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: delete chain and rule with jump to chain in same transactionPablo Neira Ayuso2018-05-081-0/+25
| | | | | | We should not hit EBUSY in this case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Fix expected output in {bridge,inet}/icmpX.tPhil Sutter2018-05-062-2/+2
| | | | | | | | The first expression in that rule is not eliminated in evaluation phase, so there is no reason why it should be while delinearizing. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meter: enforce presence of a max sizeFlorian Westphal2018-05-022-3/+3
| | | | | | | | | | meters are updated dynamically, so we don't know in advance how large this structure can be. Add a 'size' keyword to specifiy an upper limit and update the old syntax to assume a default max value of 65535. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: clear expression context before cmd evaluationFlorian Westphal2018-04-191-0/+9
| | | | | | | | | | | | We also need to clear expr ctx before we eval a command. This is a followup fix to 'evaluate: reset eval context when evaluating set definitions'. The first patch only fixed set evaluation when dealing with a complete table representation rather than individual commands. Reported-by: David Fabian <david.fabian@bosson.cz> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: use ibrname and obrnamePablo Neira Ayuso2018-04-194-8/+8
| | | | | | | | | Legacy tool name is 'brctl' and so the 'br' prefix is already known. If we use ibrname and obrname it looks consistent with iifname and oifname. So let's this instead of ibridgename and obridgename since Florian likes this too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reset eval context when evaluating set definitionsFlorian Westphal2018-04-182-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | David reported nft chokes on this: nft -f /tmp/A /tmp/A:9:22-45: Error: datatype mismatch, expected concatenation of (IPv4 address, internet network service, IPv4 address), expression has type concatenation of (IPv4 address, internet network service) cat /tmp/A flush ruleset; table ip filter { set setA { type ipv4_addr . inet_service . ipv4_addr flags timeout } set setB { type ipv4_addr . inet_service flags timeout } } Problem is we leak set definition details of setA to setB via eval context, so reset this. Also add test case for this. Reported-by: David Fabian <david.fabian@bosson.cz> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: rename ibrportname, obrportnameFlorian Westphal2018-04-174-0/+21
| | | | | | | | | | | | | | | For bridge, iifname is the port name, whereas 'ibrport' is the logical name of the bridge ("br0") the port ("iifname") is enslaved to. So, 'ibrport' is a misnomer. libnftl calls these 'bri_iifname' and 'bri_oifname', which is good but using 'briiifname' in nft is rather ugly, so use 'ibridgename' and 'obridgename' instead. Old names are still recognized, listing shows the new names. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: Fix differences printing for rules with setsPhil Sutter2018-04-141-2/+2
| | | | | | | | If a rule contained a set, it would always print the tested rule as differing from the output instead of any given output (if defined). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: rt.t: Drop needless rule outputPhil Sutter2018-04-141-1/+1
| | | | | | | It is identical to the tested rule, so no point in keeping it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: Fix for last elem at interval endPhil Sutter2018-04-141-3/+3
| | | | | | | | | | | | | | Unclosed interval check at end of interval_map_decompose() missed to check whether interval start is the last possible element in given set before creating a range expression. This led to the last element incorrectly printed as range from itself to itself. Fix this by comparing the upper boundary against the lower one. In order to keep indenting level low, invert the entry check and jump to the end if it matches. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: remove object ID from payload filePablo Neira Ayuso2018-04-111-4/+4
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Allow passing multiple files to nft-test.pyPhil Sutter2018-04-111-5/+6
| | | | | | | | | | This allows to run the testsuite over a subset of test cases, e.g. like so: | ./nft-test.py bridge/*.t Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Review print statements in nft-test.pyPhil Sutter2018-04-111-41/+39
| | | | | | | | | | | | | | | | Make use of format strings as they are easier to read than manual string concatenation. Also use class Table's __str__ method instead of printing the 'name' attribute. This changes the output in that table names are prepended by their family, but the extra information may come in handy when analyzing issues. Since class Chain's __str__ method returns just the 'name' attribute content, it may be used as synonym. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Use libnftables instead of calling nft binaryPhil Sutter2018-04-1117-120/+114
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds a simple nftables Python class in py/nftables.py which gives access to libnftables API via ctypes module. nft-test.py is extended to make use of the above class instead of calling nft binary. Since command line formatting had to be touched anyway, this patch also streamlines things a bit by introducing __str__ methods to classes Table and Chain and making extensive use of format strings instead of onerously adding all string parts together. Since the called commands don't see a shell anymore, all shell meta character escaping done in testcases is removed. The visible effects of this change are: * Four new warnings in ip/flowtable.t due to changing objref IDs (will be addressed later in a patch to libnftnl). * Reported command line in warning and error messages changed slightly for obvious reasons. * Reduction of a full test run's runtime by a factor of four. Status diff after running with 'time': < 83 test files, 77 files passed, 1724 unit tests, 0 error, 33 warning < 87.23user 696.13system 15:11.82elapsed 85%CPU (0avgtext+0avgdata 9604maxresident)k < 8inputs+36800outputs (0major+35171235minor)pagefaults 0swaps > 83 test files, 77 files passed, 1724 unit tests, 4 error, 33 warning > 6.80user 30.18system 3:45.86elapsed 16%CPU (0avgtext+0avgdata 14064maxresident)k > 0inputs+35808outputs (0major+2874minor)pagefaults 0swaps Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: ip6: fix 'missing payload' errorFlorian Westphal2018-04-011-1/+1
| | | | | | ERROR: line 2: did not find payload information for rule 'iifname "eth0" ct state established,new tcp dport vmap {22 : drop, 222 : drop } masquerade' Signed-off-by: Florian Westphal <fw@strlen.de>
* nft-test: check start of rule with sets tooFlorian Westphal2018-04-011-0/+4
| | | | | | | | | | | | | | | We special case rules with sets ({}) so set members are sorted properly. But we failed to check start of rule: input: meta mark { 1, 2 } bar expect: meta mark { 1, 2 } bar We made sure 'bar' is equal in both input and expected output, but we did not check start (before {). This causes a gazillion of warnings, will fix in followup commit. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: ct, meta: fixes for upcoming nft-test.py fixFlorian Westphal2018-04-013-28/+28
| | | | | | | nft-test.py currently fails to properly compare tests involving a set, after that bug is fixed these lines would fail, so fix this up before. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: mh: fix expected test outputFlorian Westphal2018-04-011-1/+1
| | | | | | | Forgot to include '!=', this doesn't trigger at the moment due to a bug in nft-test.py, so fix this before fixing our test script. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: redirect: fix tests for upcoming nft-test.py fixFlorian Westphal2018-04-017-11/+11
| | | | | | | nft-test.py currently fails to properly compare tests involving a set, after that bug is fixed these lines would fail, so fix this up before. Signed-off-by: Florian Westphal <fw@strlen.de>
* proto: permit icmp-in-ipv6 and icmpv6-in-ipv4Florian Westphal2018-03-284-7/+47
| | | | | | | | | | | | | | | | | Jozsef points out that meta l4proto icmp icmp type destination-unreachable is hard to read. So, lets just add icmp/icmpv6 to ip/ip6 protocol base so users can just go with icmp type destination-unreachable and let nft fill in needed dependency. After this patch, the recent patch to not remove the dependency can be reverted again. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: meta: icmp, icmpv6: don't kill required dependenciesFlorian Westphal2018-03-275-8/+48
| | | | | | | | when explicitly filtering icmp-in-ipv6 and icmp6-in-ip don't remove the required l3 protocol dependency, else "nft list ruleset" can't be read via nft -f anymore. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: Test flush and nat chain recreate in one goPhil Sutter2018-03-211-0/+17
| | | | | | | | This tests what kernel commit ae6153b50f9bf ("netfilter: nf_tables: permit second nat hook if colliding hook is going away") fixed for. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: Allow to specify multiple testcasesPhil Sutter2018-03-201-4/+6
| | | | | | | | | | | Extend run-tests.sh a bit so that all remaining arguments after option parsing are treated as filenames to test and complain if one doesn't seem like such. This allows for doing stuff like: | ./run-tests.sh testcases/include/000* Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Fix sporadic fail of include/0007glob_double_0Phil Sutter2018-03-202-21/+9
| | | | | | | | | | | | Since ruleset listing shows tables sorted by handle (which in turn depends on table creation ordering), using random filenames here guarantees to make the test fail randomly. Since the include files reside in a temporary directory anyway, there is no need to randomize their names so simplify the whole test a bit. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* flowtable: Make parsing a little more robustPhil Sutter2018-03-201-0/+14
| | | | | | | | | | It was surprisingly easy to crash nft with invalid syntax in 'add flowtable' command. Catch at least three possible ways (illustrated in provided test case) by making evaluation phase survive so that bison gets a chance to complain. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Fix flowtable test casesPhil Sutter2018-03-207-14/+14
| | | | | | | | | | | | | The major problem here was that existence of network interfaces 'eth0' and 'wlan0' was assumed. Overcome this by just using 'lo' instead, which exists even in newly created netns by default. Another minor issue was false naming of 0004delete_after_add0 - the expected return code is supposed to be separated by '_' from the remaining filename. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Fix dump of chains/0016delete_handle_0Phil Sutter2018-03-201-6/+0
| | | | | | | | | The purpose of this test is to delete some chains by their handle and that is supposed to succeed. So the respective dump should not contain them anymore. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Support 'nft -f -' to read from stdinPhil Sutter2018-03-2057-619/+112
| | | | | | | | | | | | | | | | | | In libnftables, detect if given filename is '-' and treat it as the common way of requesting to read from stdin, then open /dev/stdin instead. (Calling 'nft -f /dev/stdin' worked before as well, but this makes it official.) With this in place and bash's support for here strings, review all tests in tests/shell for needless use of temp files. Note that two categories of test cases were intentionally left unchanged: - Tests creating potentially large rulesets to avoid running into shell parameter length limits. - Tests for 'include' directive for obvious reasons. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add test cases for vmap binop transferFlorian Westphal2018-03-178-0/+138
| | | | | | they fail with 'BUG: invalid binary operation 5'. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add srh test casesFlorian Westphal2018-03-172-0/+86
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: update to new syntax to add/update set from packet pathPablo Neira Ayuso2018-03-169-11/+11
| | | | | Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>