summaryrefslogtreecommitdiffstats
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
...
* tproxy: Drop artificial port printing restrictionPhil Sutter2023-11-023-0/+49
| | | | | | | | | | | | | It does not make much sense to omit printing the port expression if it's not a value expression: On one hand, input allows for more advanced uses. On the other, if it is in-kernel, best nft can do is to try and print it no matter what. Just ignoring ruleset elements can't be correct. Fixes: 2be1d52644cf7 ("src: Add tproxy support") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1721 Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: fix mount command in "test-wrapper.sh"Thomas Haller2023-11-021-1/+1
| | | | | | | | | | | | | | | With Fedora 39 (util-linux-core-2.39.2-1.fc39), the mount command starts to fail. It was still working with Fedora 38 (util-linux-core-2.38.1-4.fc38). $ unshare -f -p -m --mount-proc -U --map-root-user -n bash -c 'mount -t tmpfs --make-private /var/run && mount' mount: /run: mount failed: Invalid argument. Not sure why this starts to fail. But arguably the command line arguments were wrong. Fix it, we need a pseudo name for the device. Fixes: df6f1a3e0803 ("tests/shell: bind mount private /var/run/netns in test container") Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: use /bin/bash in sets/elem_opts_compat_0Pablo Neira Ayuso2023-10-241-1/+1
| | | | | | So running this test with /bin/sh != /bin/bash works. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: fix length check for ifname in ifname_expr_alloc()Thomas Haller2023-10-241-6/+1
| | | | | | | | | | | | | | IFNAMSIZ is 16, and the allowed byte length of the name is one less than that. Fix the length check and adjust a test for covering the longest allowed interface name. This is obviously a change in behavior, because previously interface names with length 16 were accepted and were silently truncated along the way. Now they are rejected as invalid. Fixes: fa52bc225806 ("parser: reject zero-length interface names") Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: cover long interface name in "0042chain_variable_0" testThomas Haller2023-10-242-6/+34
| | | | | | | | | | | | | | | | IFNAMSIZ is 16. Adjust "0042chain_variable_0" to use an interface name with the maximum allowed bytes length. Instead of adding an entirely different test, adjust an existing one to use another interface name. The aspect for testing for a long interface name is not special enough, to warrant a separate test. We can cover it by extending an existing test. Note that the length check in "parser_bison.y" is wrong. The test checks still for the wrong behavior and that "d23456789012345x" is accepted. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add "bogons/nft-f/zero_length_devicename2_assert"Thomas Haller2023-10-241-0/+5
| | | | | | | | | | | | | | | | | This is copied from "bogons/nft-f/zero_length_devicename_assert" and adjusted. - `device""lo"` looks odd. In this file use `device ""` to only check against empty strings, without oddity. - "ip" type has no hook ingress in filter. If the device name would be valid, the file would still be rejected. Use "netdev". The purpose is to add a test for a file that would otherwise pass, except having an empty device name. Without oddities. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: inline input data in "single_anon_set" testThomas Haller2023-10-242-40/+45
| | | | | | | | | | | | | | | | | The file "optimizations/dumps/single_anon_set.nft.input" was laying around, and it was unclear how it was used. Let's extend "check-patch.sh" to flag all unused files. But the script cannot understand how "single_anon_set.nft.input" is used (aside allow listing it). Instead, inline the script to keep it inside the test (script). We still write the data to a separate file and don't use `nft -f -` (because reading stdin uses a different code path we want to cover). Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: test for maximum length of "comment" in "comments_objects_0"Thomas Haller2023-10-242-6/+23
| | | | | | | | | | | | | | | The comment length is limited to NFTNL_UDATA_COMMENT_MAXLEN. Test for that. Adjust an existing test for that. Also rename $EXPECTED to $RULESET. We don't compare the value of $EXPECTED against the actually configured rules. It also wouldn't work, because the input is not normalized and wouldn't match. It also isn't necessary, because there is a .nft dump file. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add missing "elem_opts_compat_0.nodump" fileThomas Haller2023-10-241-0/+0
| | | | | | | | | | This is an inconsistency. The test should have either a .nft or a .nodump file. "./tools/check-tree.sh" enforces that and will in the future run by `make check`. Fixes: 22fab8681a50 ("parser_bison: Fix for broken compatibility with older dumps") Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: honor NFT_TEST_VERBOSE_TEST variable to debug tests via `bash -x`Thomas Haller2023-10-212-2/+28
| | | | | | | | | | | | | | | | | | | | | | | | | It can be cumbersome to debug why a test fails. Our tests are just shell scripts, which for the most part don't print much. That is good, but for debugging, it can be useful to run the test via `bash -x`. Previously, we would just patch the source file while debugging. Add an option "-x" and NFT_TEST_VERBOSE_TEST=y environment variable. If set, "test-wrapper.sh" will check whether the shebang is "#!/bin/bash" and add "-x" to the command line. While at it, let test-wrapper.sh also log a line like Command: $CMD With this, we see in the log the command that was run, and how NFT_TEST_VERBOSE_TEST may have affected it. This is anyway useful, because many tests don't print anything at all, and we end up with an empty "testout.log". Empty files are cumbersome, e.g. I like to use `grep -R ^` to show the content of all files, which does not show empty files. Ensuring that something is always written is desirable. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: Fix for broken compatibility with older dumpsPhil Sutter2023-10-201-0/+29
| | | | | | | | | | | | Commit e6d1d0d611958 ("src: add set element multi-statement support") changed the order of expressions and other state attached to set elements are expected in input. This broke parsing of ruleset dumps created by nft commands prior to that commit. Restore compatibility by also accepting the old ordering. Fixes: e6d1d0d611958 ("src: add set element multi-statement support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/shell: use bash instead of /bin/sh for testsThomas Haller2023-10-1612-12/+12
| | | | | | | | | | | | | | | | | All tests under "tests/shell" are shell scripts with shebang /bin/bash or /bin/sh. This may seem expected, since these tests are under "tests/shell" directory, but any executable file would work. Anyway. The vast majority of the tests has "#!/bin/bash" as shebang. A few tests had "#!/bin/sh" or "#!/bin/sh -e". Unify this and always use bash. Since we anyway require bash, this is not a limitation. Also, if we know that this is a bash script (by parsing the shebang), we can let the test wrapper pass "-x" to the script. The next commit will do that, and it is nicer if the shebangs are all uniform. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add missing "vlan_8021ad_tag.nodump" fileThomas Haller2023-10-161-0/+0
| | | | | | | | | | This is an inconsistency. The test should have either a .nft or a .nodump file. "./tools/check-tree.sh" enforces that and will in the future run by `make check`. Fixes: 74cf3d16d8e9 ('tests: shell: add vlan match test case') Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add "-S|--setup-host" option to set sysctl for rootless testsThomas Haller2023-10-101-0/+46
| | | | | | | | | | | | | | | | | | | | | | Most tests can run just fine without root. A few of them will fail if /proc/sys/net/core/{wmem_max,rmem_max} is too small (as it is by default on the host). The easy workaround is to bump those limits once. This has to be repeated after each reboot. Doing that manually (every time) is cumbersome. Add a "--setup-host" option for that. Usage: $ sudo ./tests/shell/run-tests.sh -S Setting up host for running as rootless (requires root). echo 4096000 > /proc/sys/net/core/rmem_max (previous value 100000) echo 4096000 > /proc/sys/net/core/wmem_max (previous value 100000) Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: preserve result directory with NFT_TEST_FAIL_ON_SKIPThomas Haller2023-10-101-2/+7
| | | | | | | | | | | On a successful run, the result directory will be deleted (unless run with "-k|--keep-logs" option or NFT_TEST_KEEP_LOGS=y). With NFT_TEST_FAIL_ON_SKIP=y, when there are no failures but skipped tests, also preserve the result. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: mount all of "/var/run" in "test-wrapper.sh"Thomas Haller2023-10-101-11/+15
| | | | | | | | | | | | | | | | | | | | | After reboot, "/var/run/netns" does not exist before we run the first `ip netns add` command. Previously, "test-wrapper.sh" would mount a tmpfs on that directory, but that fails, if the directory doesn't exist. You will notice this, by deleting /var/run/netns (which only root can delete or create, and which is wiped on reboot). Instead, mount all of "/var/run". Then we can also create /var/run/netns directory. This means, any other content from /var/run is hidden too. That's probably desirable, because it means we don't depend on stuff that happens to be there. If we would require other content in /var/run, then the test runner needs to be aware of the requirement and ensure it's present. But best is just to not require anything. It's only iproute2 which insists on /var/run/netns. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add vlan match test caseFlorian Westphal2023-10-071-0/+50
| | | | | | | Check that we can match on the 8021ad header and vlan tag, see af84f9e447a6 ("netfilter: nft_payload: rebuild vlan header on h_proto access"). Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add test for dormant on/off/on bugFlorian Westphal2023-10-072-0/+52
| | | | | | | | | | | Disallow enabling/disabling a table in a single transaction. Make sure we still allow one update, either to dormant, or from active to dormant. Reported-by: "Lee, Cherie-Anne" <cherie.lee@starlabs.sg> Cc: Bing-Jhong Billy Jheng <billy@starlabs.sg> Cc: info@starlabs.sg Signed-off-by: Florian Westphal <fw@strlen.de>
* icmpv6: Allow matching target address in NS/NA, redirect and MLDNicolas Cavallari2023-10-063-0/+352
| | | | | | | | | | | | | | | It was currently not possible to match the target address of a neighbor solicitation or neighbor advertisement against a dynamic set, unlike in IPv4. Since they are many ICMPv6 messages with an address at the same offset, allow filtering on the target address for all icmp types that have one. While at it, also allow matching the destination address of an ICMPv6 redirect. Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: never merge across non-expression statements redux 2Florian Westphal2023-10-062-0/+95
| | | | | | | Turns out I also love to forget about nft-test.py -j. Fixes: 99ab1b8feb16 ("rule: never merge across non-expression statements") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: sets/reset_command_0: Fix drop_seconds()Phil Sutter2023-09-291-1/+1
| | | | | | | | | | The function print_times() skips any time elements which are zero, so output may lack the ms part. Adjust the sed call dropping anything but the minutes value to not fail in that case. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Fixes: 255ec36a11525 ("tests: shell: Stabilize sets/reset_command_0 test") Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: restrict include directive to regular filesFlorian Westphal2023-09-291-0/+1
| | | | | | | | | | | | | | Similar to previous change, also check all include "foo" and reject those if they refer to named fifos, block devices etc. Directories are still skipped, I don't think we can change this anymore. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1664 Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: never merge across non-expression statements reduxFlorian Westphal2023-09-293-0/+54
| | | | | | | Forgot to 'git add' inet/bridge/netdev payload records. Fixes: 99ab1b8feb16 ("rule: never merge across non-expression statements") Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: never merge across non-expression statementsFlorian Westphal2023-09-295-0/+38
| | | | | | | | | | | | | | | | | | The existing logic can merge across non-expression statements, if there is only one payload expression. Example: ether saddr 00:11:22:33:44:55 counter ether type 8021q is turned into counter ether saddr 00:11:22:33:44:55 ether type 8021q which isn't the same thing. Fix this up and add test cases for adjacent vlan and ip header fields. 'Counter' serves as a non-merge fence. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Fix for failing nft-f/sample-rulesetPhil Sutter2023-09-281-2/+2
| | | | | | | | | | For whatever reason, my system lacks an entry for 'sip' in /etc/services. Assuming the service name is not relevant to the test, just replace it by the respective port number. Fixes: 68728014435d9 ("tests: shell: add sample ruleset reproducer") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: fix spurious errors in sets/0036add_set_element_expiration_0Pablo Neira Ayuso2023-09-271-3/+7
| | | | | | | | | | | | | | | A number of changes to fix spurious errors: - Add seconds as expiration, otherwise 14m59 reports 14m in minute granularity, this ensures suficient time in a very slow environment with debugging instrumentation. - Provide expected output. - Update sed regular expression to make 'ms' optional and use -E mode. Fixes: adf38fd84257 ("tests: shell: use minutes granularity in sets/0036add_set_element_expiration_0") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: skip set element expression in map statement keyPablo Neira Ayuso2023-09-2710-0/+122
| | | | | | | | | | | | | | | | | This fix is similar to 22d201010919 ("netlink_linearize: skip set element expression in set statement key") to fix map statement. netlink_gen_map_stmt() relies on the map key, that is expressed as a set element. Use the set element key instead to skip the set element wrap, otherwise get_register() abort execution: nft: netlink_linearize.c:650: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. This includes JSON support to make this feature complete and it updates tests/shell to cover for this support. Reported-by: Luci Stanescu <luci@cnix.ro> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add map supportPablo Neira Ayuso2023-09-271-4/+66
| | | | | | | | | | Add basic map support to this infrastructure, eg. !map1 ipv4_addr : mark;ok Adding elements to map is still not supported. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: features: Fix table owner flag checkPhil Sutter2023-09-261-1/+1
| | | | | | | | | | | The keyword is "flags", not "flag". Resulted in a false-negative: features/table_flag_owner.nft:4:2-5: Error: syntax error, unexpected string flag owner; ^^^^ Fixes: 10373f0936cd3 ("tests: shell: skip flowtable-uaf if we lack table owner support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: skip flowtable-uaf if we lack table owner supportFlorian Westphal2023-09-222-0/+7
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add feature probe for sctp chunk matchingFlorian Westphal2023-09-212-10/+23
| | | | | | Skip the relavant parts of the test if nft_exthdr lacks sctp support. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add feature probe for sets with more than one elementFlorian Westphal2023-09-215-0/+23
| | | | | | | | | | Kernels < 5.11 can handle only one expression per element, e.g. its possible to attach a counter per key, or a rate limiter, or a quota, but not two at the same time. Add a probe file and skip the relevant tests if the feature is absent. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: skip adding catchall elements if unuspportedFlorian Westphal2023-09-211-2/+6
| | | | | | | | | | The test fails on kernels without catchall support, so elide this small part. No need to skip the test in this case, the dump file validates that the added elements are no longer there after the timeout. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: honor NFT_TEST_FAIL_ON_SKIP variable to fail on any skipped testsThomas Haller2023-09-211-1/+7
| | | | | | | | | | | | | | | | | | The test suite should pass with various kernels and build configurations. Of course, that means, that some tests will be gracefully skipped, and we don't treat that as an overall failure. However, it should be possible to run a specific kernel (net-next?) and build configuration, where we expect that all tests pass. Add an option to fail the run, if any tests were skipped. This is to ensure that we don't have broken tests that never pass. This will make more sense with automated CI is running, to enable on a test system and ensure that at least on that system, all tests pass. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* limit: display default burst when listing rulesetPablo Neira Ayuso2023-09-207-18/+18
| | | | | | | | | | | | Default burst for limit is 5 for historical reasons but it is not displayed when listing the ruleset. Update listing to display the default burst to disambiguate. man nft(8) has been recently updated to document this, no action in this front is therefore required. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: run `nft --check` on persisted dump filesThomas Haller2023-09-192-1/+34
| | | | | | | | | | | | | | | | "nft --check" will trigger a rollback in kernel. The existing dump files might hit new code paths. Take the opportunity to call the command on the existing files. And alternative would be to write a separate tests, that iterates over all files. However, then we can only run all the commands sequentially (unless we do something smart). That might be slower than the opportunity to run the checks in parallel. More importantly, it would be nice if the check for the dump file is clearly tied to the file's test. So run it right after the test, from the test wrapper. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: perform mark datatype compatibility check from mapsPablo Neira Ayuso2023-09-192-0/+64
| | | | | | | | | | | | | Wrap datatype compatibility check into a helper function and use it for map evaluation, otherwise the following bogus error message is displayed: Error: datatype mismatch, map expects packet mark, mapping expression has type integer Add unit tests to improve coverage for this usecase. Fixes: 5d8e33ddb112 ("evaluate: relax type-checking for integer arguments in mark statements") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: expand sets and maps before evaluationPablo Neira Ayuso2023-09-194-0/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 3975430b12d9 ("src: expand table command before evaluation") moved ruleset expansion before evaluation, except for sets and maps. For sets and maps there is still a post_expand() phase. This patch moves sets and map expansion to allocate an independent CMD_OBJ_SETELEMS command to add elements to named set and maps which is evaluated, this consolidates the ruleset expansion to happen always before the evaluation step for all objects, except for anonymous sets and maps. This approach avoids an interference with the set interval code which detects overlaps and merges of adjacents ranges. This set interval routine uses set->init to maintain a cache of existing elements. Then, the post_expand() phase incorrectly expands set->init cache and it triggers a bogus ENOENT errors due to incorrect bytecode (placing element addition before set creation) in combination with user declared sets using the flat syntax notation. Since the evaluation step (coming after the expansion) creates implicit/anonymous sets and maps, those are not expanded anymore. These anonymous sets still need to be evaluated from set_evaluate() path and the netlink bytecode generation path, ie. do_add_set(), needs to deal with anonymous sets. Note that, for named sets, do_add_set() does not use set->init. Such content is part of the existing cache, and the CMD_OBJ_SETELEMS command is responsible for adding elements to named sets. Fixes: 3975430b12d9 ("src: expand table command before evaluation") Reported-by: Jann Haber <jannh@selfnet.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: simplify collecting error result in "test-wrapper.sh"Thomas Haller2023-09-181-8/+8
| | | | | | | | | | | | | | | | | | | The previous pattern was unnecessarily confusing. The "$rc_{dump,valgrind,tainted}" variable should only remember whether that particular check failed, not the overall exit code of the test wrapper. Otherwise, if you want to know in which case the wrapper exits with code 122, you have to oddly follow the rc_valgrind variable. This change will make more sense, when we add another such variable, but which will be assigned the non-zero value at multiple places. Assigning there the exit code of the wrapper, duplicates the places where the condition maps to the exit code. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: colorize NFT_TEST_HAS_SOCKET_LIMITSThomas Haller2023-09-181-11/+18
| | | | | | | | | | | | | | NFT_TEST_HAS_SOCKET_LIMITS= is similar to NFT_TEST_HAVE_* variables and indicates a feature (or lack thereof), except that it's inverted. Maybe this should be consolidated, however, NFT_TEST_HAS_SOCKET_LIMITS= is detected in the root namespace, unlike the shell scripts from features. So it's unclear how to consolidate them best. Anyway. Still highlight a lack of the capability, as it can cause tests to be skipped and we should see that easily. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: don't show the exit status for failed testsThomas Haller2023-09-181-6/+3
| | | | | | | | | | | | | | | | | | | | Previously, for failed tests we would print the exit code W: [FAILED] 2/2 tests/shell/testcases/listing/0013objects_0: got 1 This doesn't seem very useful. For one, we have special exit codes like 0 (OK), 77 (SKIPPED), 124 (DUMP FAIL), 123 (TAINTED), 122 (VALGRIND). Any other exit code is just an arbitrary failure. We don't define any special codes, and printing them is not useful. Note that further exit codes (118 - 121) are reserved, and could be special purposed, when there is a use. You can find the real exit code from the test in the result data in the "rc-failed" file. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: set C locale in "run-tests.sh"Thomas Haller2023-09-181-2/+6
| | | | | | | | | | The tests should run always the same, regardless of the user's language settings. Set LANG=C and LC_ALL=C and unset LANGUAGE. If some part wants to test a different language, it would set it explicitly. They anyway wouldn't want to depend on something from the user's environment. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: fix preserving ruleset diff after testThomas Haller2023-09-181-0/+1
| | | | | | | | | We want to delete the file in the case when there was no diff (and we expect the file to be empty). The condition was wrong. Fixes: 55fe071cd193 ('tests/shell: cleanup result handling in "test-wrapper.sh"') Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: check diff in "maps/typeof_maps_0" and "sets/typeof_sets_0" testThomas Haller2023-09-182-31/+177
| | | | | | | | | | | These tests run different variants based on NFT_TEST_HAVE_osf support. Consequently, we cannot check the pre-generated diff. Instead, construct what we expect dynamically in the script, and compare the ruleset against that. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: implement NFT_TEST_HAVE_json feature detection as scriptThomas Haller2023-09-182-14/+10
| | | | | | | | No more need to special case the "run a script" approach for detecting the json feature. Use the new mechanism instead. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: skip reset tests if kernel lacks supportFlorian Westphal2023-09-185-4/+43
| | | | | | | | | | | | reset is implemented via flush + extra attribute, so older kernels perform a flush. This means .nft doesn't work, we need to check if the individual set contents/sets are still in place post-reset. Make this generic and permit use of feat.sh in addition to the simpler foo.nft feature files. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip test cases if ct expectation and/or timeout lacks supportFlorian Westphal2023-09-185-39/+33
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip test cases involving osf match if kernel lacks supportFlorian Westphal2023-09-183-10/+39
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip catchall tests if kernel lacks supportFlorian Westphal2023-09-186-2/+35
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip destroy tests if kernel lacks supportFlorian Westphal2023-09-186-0/+13
| | | | | | | | Destroy support was added for table/flowtable/chain etc. in a single commit, so no need to add capability tests for each destroy subtype. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>