blob: 9ea5cd4cff9533ffdc0a0c39fe0b1b70d6c8d78e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
#!/bin/bash
rnd=$(mktemp -u XXXXXXXX)
ns1="nft1trans-$rnd"
#
# dependency tracking for implicit set
#
RULESET="table ip x {
chain w {}
chain m {}
chain y {
ip saddr vmap { 1.1.1.1 : jump w, 2.2.2.2 : accept, 3.3.3.3 : goto m }
}
}"
$NFT -c -f - <<< "$RULESET" >/dev/null || exit 0
$NFT -f - <<< "$RULESET" >/dev/null || exit 0
ip netns add $ns1
ip netns exec $ns1 $NFT -f - <<< "$RULESET" >/dev/null || exit 0
ip netns del $ns1
RULESET="flush chain ip x y
delete chain ip x w"
$NFT -c -f - <<< "$RULESET" >/dev/null || exit 0
$NFT -f - <<< "$RULESET" >/dev/null || exit 0
#
# dependency tracking for map in implicit chain
#
RULESET="table ip x {
chain w {}
chain m {}
chain y {
meta iifname \"eno1\" jump {
ip saddr vmap { 1.1.1.1 : jump w, 3.3.3.3 : goto m }
}
}
}"
$NFT -c -f - <<< "$RULESET" >/dev/null || exit 0
$NFT -f - <<< "$RULESET" >/dev/null || exit 0
ip netns add $ns1
ip netns exec $ns1 $NFT -f - <<< "$RULESET" >/dev/null || exit 0
ip netns del $ns1
RULESET="flush chain ip x y
delete chain ip x w"
$NFT -c -f - <<< "$RULESET" >/dev/null || exit 0
$NFT -f - <<< "$RULESET" >/dev/null || exit 0
#
# dependency tracking for explicit map
#
RULESET="table ip x {
chain w {}
chain m {}
map y {
type ipv4_addr : verdict
elements = { 1.1.1.1 : jump w, 2.2.2.2 : accept, 3.3.3.3 : goto m }
}
}"
$NFT -c -f - <<< "$RULESET" >/dev/null || exit 0
$NFT -f - <<< "$RULESET" >/dev/null || exit 0
ip netns add $ns1
ip netns exec $ns1 $NFT -f - <<< "$RULESET" >/dev/null || exit 0
ip netns del $ns1
RULESET="delete set ip x y
delete chain ip x w"
$NFT -c -f - <<< "$RULESET" >/dev/null || exit 0
$NFT -f - <<< "$RULESET" >/dev/null || exit 0
#
# error path for implicit set
#
RULESET="table inet filter {
chain w {
jump z
}
chain z {
jump w
}
chain test {
ip protocol { tcp, udp } ip saddr vmap { 1.1.1.1 : jump z } counter flow add @nonexisting
ip6 nexthdr { tcp, udp } ct mark and 2 == 2 counter
}
}"
$NFT -c -f - <<< "$RULESET" >/dev/null || exit 0
$NFT -f - <<< "$RULESET" >/dev/null || exit 0
#
# error path for implicit set
#
RULESET="table inet filter {
chain w {
jump z
}
chain z {
jump w
}
chain test {
ip protocol { tcp, udp } jump {
ip saddr vmap { 1.1.1.1 : jump z }
}
ip6 nexthdr { tcp, udp } ct mark and 2 == 2 counter
}
}"
$NFT -c -f - <<< "$RULESET" >/dev/null || exit 0
$NFT -f - <<< "$RULESET" >/dev/null || exit 0
$NFT flush table inet filter || exit 0
|
