summaryrefslogtreecommitdiffstats
path: root/iptables/tests
Commit message (Collapse)AuthorAgeFilesLines
* ebtables: Refuse unselected targets' optionsPhil Sutter2023-01-311-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Unlike legacy, ebtables-nft would allow e.g.: | -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be While the result is correct, it may mislead users into believing multiple targets are possible per rule. Better follow legacy's behaviour and reject target options unless they have been "enabled" by a previous '-j' option. To achieve this, one needs to distinguish targets from watchers also attached to 'xtables_targets' and otherwise behaving like regular matches. Introduce XTABLES_EXT_WATCHER to mark the two. The above works already, but error messages are misleading when using the now unsupported syntax since target options have been merged already. Solve this by not pre-loading the targets at all, code will just fall back to loading ad '-j' parsing time as iptables does. Note how this also fixes for 'counter' statement being in wrong position of ebtables-translate output. Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* Proper fix for "unknown argument" error messagePhil Sutter2023-01-311-0/+31
| | | | | | | | | | | | | | | | While commit 1b8210f848631 kind of fixed the corner-case of invalid short-options packed with others, it broke error reporting for long-options. Revert it and deploy a proper solution: When passing an invalid short-option, e.g. 'iptables -vaL', getopt_long sets the variable 'optopt' to the invalid character's value. Use it for reporting instead of optind if set. To distinguish between invalid options and missing option arguments, ebtables-translate optstring needs adjustment. Fixes: 1b8210f848631 ("ebtables: Fix error message for invalid parameters") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Parse icmp header matchesPhil Sutter2022-12-201-3/+3
| | | | | | These were previously ignored. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: Adjust testsuite return codes to automake guidelinesPhil Sutter2022-12-141-1/+3
| | | | | | | | | | | | | As per the manual[1]: "When no test protocol is in use, an exit status of 0 from a test script will denote a success, an exit status of 77 a skipped test, an exit status of 99 a hard error, and any other exit status will denote a failure." [1] https://www.gnu.org/software/automake/manual/html_node/Scripts_002dbased-Testsuites.html Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix valgrind mode for 0008-unprivileged_0Phil Sutter2022-12-021-1/+2
| | | | | | | Valgrind is run as user nobody, let everyone write into the temporary directory. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Test selective ebtables flushingPhil Sutter2022-11-291-0/+47
| | | | | | | Found this on disk, maybe there was a problem with this and among match at some point? Anyway, it is relevant again since it fails recently. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libiptc: Fix for segfault when renaming a chainPhil Sutter2022-10-071-0/+19
| | | | | | | | | | This is an odd bug: If the number of chains is right and one renames the last one in the list, libiptc dereferences a NULL pointer. Add fix and test case for it. Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc") Reported-by: Julien Castets <castets.j@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix expected ebtables log target outputPhil Sutter2022-10-062-3/+3
| | | | | | | | Forgot to update shell testsuite when removing empty --log-prefix options. Fixes: 9cdb52d655608 ("extensions: libebt_log: Avoid empty log-prefix in output") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix expected output for ip6tables dst matchPhil Sutter2022-10-061-2/+2
| | | | | | | | Forgot to update the shell testsuites when fixing for duplicate whitespace in output. Fixes: 11e06cbb3a877 ("extensions: libip6t_dst: Fix output for empty options") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Support '-p Length'Phil Sutter2022-09-281-6/+6
| | | | | | | | | | | | | | | | | | To match on Ethernet frames using the etherproto field as length value, ebtables accepts the special protocol name "LENGTH". Implement this in ebtables-nft using a native match for 'ether type < 0x0600'. Since extension 802_3 matches are valid only with such Ethernet frames, add a local add_match() wrapper which complains if the extension is used without '-p Length' parameter. Legacy ebtables does this within the extension's final_check callback, but it's not possible here due for lack of fw->bitmask field access. While being at it, add xlate support, adjust tests and make ebtables-nft print the case-insensitive argument with capital 'L' like legacy ebtables does. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: extend native delinearize scriptFlorian Westphal2022-09-283-19/+69
| | | | | | | | | | | | | | | | | | | Feed nft-generated ruleset to iptables-nft. At this time, this will NOT pass. because dissector can handle meta l4proto tcp ip saddr 1.2.3.4 but not ip saddr 1.2.3.4 meta l4proto tcp In the latter case, iptables-nft picks up the immediate value (6) as the ip address, because the first one (1.2.3.4) gets moved as PAYLOAD_PREV due to missing 'removal' of the CTX_PAYLOAD flag. This is error prone, so lets rewrite the dissector to track each register separately and auto-clear state on writes. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Test delinearization of native nftables expressionsPhil Sutter2022-09-221-0/+26
| | | | | | | | Even if iptables-nft doesn't generate them anymore, it should continue to correctly parse them. Make sure this is tested for. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add ebtables among testcaseYi Chen2022-08-031-0/+98
| | | | | | Validate that matching works as expected. Signed-off-by: Florian Westphal <fw@strlen.de>
* xshared: Print protocol numbers if --numeric was givenPhil Sutter2022-07-293-8/+8
| | | | | | | | | | This is much trickier than expected: On one hand, proto_to_name() is used to lookup protocol extensions so must resolve despite FMT_NUMERIC being set. On the other, --verbose implies --numeric but changing the output there is probably a bad idea. Luckily the latter situation is identified by FMT_NOTABLE bit. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix for missing space after 'prot' columnPhil Sutter2022-07-291-1/+1
| | | | | | | Format string ensured a minimum field width of five characters, but allowed for longer strings to eat the column delimiting white space. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix testcases for changed ip6tables opts outputPhil Sutter2022-07-292-11/+11
| | | | | | | | Adjust captured output, ip6tables prints '--' instead of spaces since the commit in Fixes: tag. Fixes: 6e41c2d8747b2 ("iptables: xshared: Ouptut '--' in the opt field in ipv6's fake mode") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Extend zero counters test a bit furtherPhil Sutter2022-06-111-0/+15
| | | | | | Test zeroing a single rule's counters as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Extend iptables-xml test a bitPhil Sutter2022-06-111-9/+1
| | | | | | | | Call with --combine as well, even though output doesn't differ. Also there's no need to skip for xtables-nft-multi, it provides the same functionality. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Add some more rules to 0002-verbose-output_0Phil Sutter2022-06-111-0/+15
| | | | | | This increases coverage of function print_match() from 0 to 86.6%. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Check overhead in iptables-save and -restorePhil Sutter2022-06-021-0/+37
| | | | | | | Some repeated calls have been reduced recently, assert this in a test evaluating strace output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix EPERM handling for extensions without rev 0Phil Sutter2022-05-111-0/+6
| | | | | | | | | | Treating revision 0 as compatible in EPERM case works fine as long as there is a revision 0 of that extension defined in DSO. Fix the code for others: Extend the EPERM handling to all revisions and keep the existing warning for revision 0. Fixes: 17534cb18ed0a ("Improve error messages for unsupported extensions") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix 0004-return-codes_0 for static buildsPhil Sutter2022-03-151-1/+1
| | | | | | | In static builds, xtables_find_match() returns a slightly different error message if not found - make grep accept both. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Implement xtables lock timeout using signalsJethro Beekman2022-02-151-2/+1
| | | | | | | | | | | | | | | | | | | | | | | Previously, if a lock timeout is specified using `-wN `, flock() is called using LOCK_NB in a loop with a sleep. This results in two issues. The first issue is that the process may wait longer than necessary when the lock becomes available. For this the `-W` option was added, but this requires fine-tuning. The second issue is that if lock contention is high, invocations using `-w` (without a timeout) will always win lock acquisition from invocations that use `-w N`. This is because invocations using `-w` are actively waiting on the lock whereas those using `-w N` only check from time to time whether the lock is free, which will never be the case. This patch removes the sleep loop and deprecates the `-W` option (making it non-functional). Instead, flock() is always called in a blocking fashion, but the alarm() function is used with a non-SA_RESTART signal handler to cancel the system call. Signed-off-by: Jethro Beekman <jethro@fortanix.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* iptables-restore: Support for extra debug outputPhil Sutter2022-02-041-3/+6
| | | | | | | | | | | | | | Treat --verbose just like iptables itself, increasing debug level with number of invocations. To propagate the level into do_command() callback, insert virtual '-v' flags into rule lines. The only downside of this is that simple verbose output is changed and now also prints the rules as they are added - which would be useful if the lines contained the chain they apply to. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xshared: Fix response to unprivileged usersPhil Sutter2022-01-201-0/+60
| | | | | | | | | | | | | | | | | | | | | Expected behaviour in both variants is: * Print help without error, append extension help if -m and/or -j options are present * Indicate lack of permissions in an error message for anything else With iptables-nft, this was broken basically from day 1. Shared use of do_parse() then somewhat broke legacy: it started complaining about inability to create a lock file. Fix this by making iptables-nft assume extension revision 0 is present if permissions don't allow to verify. This is consistent with legacy. Second part is to exit directly after printing help - this avoids having to make the following code "nop-aware" to prevent privileged actions. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Florian Westphal <fw@strlen.de>
* tests: shell: fix bashismJeremy Sowden2021-10-011-1/+1
| | | | | | | | | The `<(cmd)` redirection is specific to Bash. Update the shebang accordingly. Fixes: 63ab4fe3a191 ("ebtables: Avoid dropping policy when flushing") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: Delete builtin chains compatiblyPhil Sutter2021-09-271-0/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | Attempting to delete all chains if --delete-chain is called without argument has unwanted side-effects especially legacy iptables users are not aware of and won't expect: * Non-default policies are ignored, a previously dropping firewall may start accepting traffic. * The kernel refuses to remove non-empty chains, causing program abort even if no user-defined chain exists. Fix this by requiring a rule cache in that situation and make builtin chain deletion depend on its policy and number of rules. Since this may change concurrently, check again when having to refresh the transaction. Also, hide builtin chains from verbose output - their creation is implicit, so treat their removal as implicit, too. When deleting a specific chain, do not allow to skip the job though. Otherwise deleting a builtin chain which is still in use will succeed although not executed. Fixes: 61e85e3192dea ("iptables-nft: allow removal of empty builtin chains") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Check base-chain compatibility when adding to cachePhil Sutter2021-09-271-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | With introduction of dedicated base-chain slots, a selection process was established as no longer all base-chains ended in the same chain list for later searching/checking but only the first one found for each hook matching criteria is kept and the rest discarded. A side-effect of the above is that table compatibility checking started to omit consecutive base-chains, making iptables-nft less restrictive as long as the expected base-chains were returned first from kernel when populating the cache. Make behaviour consistent and warn users about the possibly disturbing chains found by: * Run all base-chain checks from nft_is_chain_compatible() before allowing a base-chain to occupy its slot. * If an unfit base-chain was found (and discarded), flag the table's cache as tainted and warn about it if the remaining ruleset is otherwise compatible. Since base-chains that remain in cache would pass nft_is_chain_compatible() checking, remove that and reduce it to rule inspection. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: cache: Avoid double free of unrecognized base-chainsPhil Sutter2021-09-271-0/+27
| | | | | | | | | On error, nft_cache_add_chain() frees the allocated nft_chain object along with the nftnl_chain it points at. Fix nftnl_chain_list_cb() to not free the nftnl_chain again in that case. Fixes: 176c92c26bfc9 ("nft: Introduce a dedicated base chain array") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Avoid dropping policy when flushingPhil Sutter2021-09-151-0/+41
| | | | | | | | Unlike nftables, ebtables' user-defined chains have policies - ebtables-nft implements those internally as invisible last rule. In order to recreate them after a flush command, a rule cache is needed. https://bugzilla.netfilter.org/show_bug.cgi?id=1558
* tests: shell: Return non-zero on errorPhil Sutter2021-09-131-1/+1
| | | | | | If any test fails, return a non-zero exit code. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/shell: Assert non-verbose mode is silentPhil Sutter2021-08-031-0/+11
| | | | | | | | | | Unexpected output from iptables commands might mess up error-checking in scripts for instance, so do a quick test of the most common commands. Note: Test adds two rules to make sure flush command operates on a non-empty chain. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix bitwise expression avoidance detectionPhil Sutter2021-03-091-0/+24
| | | | | | | | | Byte-boundary prefix detection was too sloppy: Any data following the first zero-byte was ignored. Add a follow-up loop making sure there are no stray bits in the designated host part. Fixes: 323259001d617 ("nft: Optimize class-based IP prefix matches") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-nft: fix -Z optionFlorian Westphal2021-02-241-0/+64
| | | | | | | | | it zeroes the rule counters, so it needs fully populated cache. Add a test case to cover this. Fixes: 9d07514ac5c7a ("nft: calculate cache requirements from list of commands") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* tests/shell: Fix nft-only/0009-needless-bitwise_0Phil Sutter2021-01-151-1/+8
| | | | | | | | | For whatever reason, stored expected output contains false handles. To overcome this, filter the rule data lines from both expected and stored output before comparing. Fixes: 81a2e12851283 ("tests/shell: Add test for bitwise avoidance fixes") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Drop any dump sorting in placePhil Sutter2020-12-213-18/+5
| | | | | | | With iptables-nft-save output now sorted just like legacy one, no sorting to unify them is needed anymore. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: cache: Sort custom chains by namePhil Sutter2020-12-211-1/+1
| | | | | | | | | | | | | | With base chains no longer residing in the tables' chain lists, they can easily be sorted upon insertion. This on one hand aligns custom chain ordering with legacy iptables and on the other makes it predictable, which is very helpful when manually comparing ruleset dumps for instance. Adjust the one ebtables-nft test case this change breaks (as wrong ordering is expected in there). The manual output sorting done for tests which apply to legacy as well as nft is removed in a separate patch. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/shell: Test for fixed extension registrationPhil Sutter2020-12-071-0/+25
| | | | | | | | | | Use strace to look at iptables-restore behaviour with typically problematic input (conntrack revision 0 is no longer supported by current kernels) to make sure the fix in commit a1eaaceb0460b ("libxtables: Simplify pending extension registration") is still effective. Signed-off-by: Phil Sutter <phil@nwl.cc>
* libxtables: Extend MAC address printing/parsing supportPhil Sutter2020-12-031-2/+2
| | | | | | | | | | | | | | | Adding a parser which supports common names for special MAC/mask combinations and a print routine detecting those special addresses and printing the respective name allows to consolidate all the various duplicated implementations. The side-effects of this change are manageable: * arptables now accepts "BGA" as alias for the bridge group address * "mac" match now prints MAC addresses in lower-case which is consistent with the remaining code at least Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Fix for broken chain renamingPhil Sutter2020-11-171-0/+4
| | | | | | | | | | Loading extensions pollutes 'errno' value, hence before using it to indicate failure it should be sanitized. This was done by the called function before the parsing/netlink split and not migrated by accident. Move it into calling code to clarify the connection. Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: update format of registers in bitwise payloads.Pablo Neira Ayuso2020-11-161-5/+5
| | | | | | | | libnftnl has been changed to bring the format of registers in bitwise dumps in line with those in other types of expression. Update the expected output of Python test-cases. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Add test for bitwise avoidance fixesPhil Sutter2020-11-101-0/+339
| | | | | | | | | Masked address matching was recently improved to avoid bitwise expression if the given mask covers full bytes. Make use of nft netlink debug output to assert iptables-nft generates the right bytecode for each situation. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Improve concurrent noflush restore test a bitPhil Sutter2020-10-271-0/+14
| | | | | | | | | | | | The described issue happens only if chain FOO does not exist at program start so flush the ruleset after each iteration to make sure this is the case. Sadly the bug is still not 100% reproducible on my testing VM. While being at it, add a paragraph describing what exact situation the test is trying to provoke. Fixes: dac904bdcd9a1 ("nft: Fix for concurrent noflush restore calls") Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: Fix for concurrent noflush restore callsPhil Sutter2020-10-131-0/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Transaction refresh was broken with regards to nft_chain_restore(): It created a rule flush batch object only if the chain was found in cache and a chain add object only if the chain was not found. Yet with concurrent ruleset updates, one has to expect both situations: * If a chain vanishes, the rule flush job must be skipped and instead the chain add job become active. * If a chain appears, the chain add job must be skipped and instead rules flushed. Change the code accordingly: Create both batch objects and set their 'skip' field depending on the situation in cache and adjust both in nft_refresh_transaction(). As a side-effect, the implicit rule flush becomes explicit and all handling of implicit batch jobs is dropped along with the related field indicating such. Reuse the 'implicit' parameter of __nft_rule_flush() to control the initial 'skip' field value instead. A subtle caveat is vanishing of existing chains: Creating the chain add job based on the chain in cache causes a netlink message containing that chain's handle which the kernel dislikes. Therefore unset the chain's handle in that case. Fixes: 58d7de0181f61 ("xtables: handle concurrent ruleset modifications") Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptables-nft: fix basechain policy configurationPablo Neira Ayuso2020-10-081-0/+29
| | | | | | | | | | Previous to this patch, the basechain policy could not be properly configured if it wasn't explictly set when loading the ruleset, leading to iptables-nft-restore (and ip6tables-nft-restore) trying to send an invalid ruleset to the kernel. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Fix for ruleset flush while restoringPhil Sutter2020-08-141-0/+23
| | | | | | | | | | | | | | | | | | If ruleset is flushed while an instance of iptables-nft-restore is running and has seen a COMMIT line once, it doesn't notice the disappeared table while handling the next COMMIT. This is due to table existence being tracked via 'initialized' boolean which is only reset by nft_table_flush(). To fix this, drop the dedicated 'initialized' boolean and switch users to the recently introduced 'exists' one. As a side-effect, this causes base chain existence being checked for each command calling nft_xt_builtin_init() as the old 'initialized' bit was used to track if that function has been called before or not. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Merge and extend return codes testPhil Sutter2020-08-142-91/+61
| | | | | | | | | | Merge scripts for iptables and ip6tables, they were widely identical. Also extend the test by one check (removing a non-existent rule with valid chain and target) and quote the error messages where differences are deliberately ignored. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Add help output to run-tests.shPhil Sutter2020-07-061-0/+19
| | | | | | | The script has quite a few options nowadays, so add a bit of help text also. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-restore: Fix verbose mode table flushingPhil Sutter2020-06-091-0/+76
| | | | | | | | | | When called with --verbose mode, iptables-nft-restore did not print anything when flushing the table. Fix this by adding a "manual" mode to nft_cmd_table_flush(), turning it into a wrapper around '-F' and '-X' commands, which is exactly what iptables-legacy-restore does to flush a table. This though requires a real cache, so don't set NFT_CL_FAKE then. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix syntax in ipt-restore/0010-noflush-new-chain_0Phil Sutter2020-05-291-0/+1
| | | | | | | | The here-doc statement missed the final delimiter. Worked anyways because end-of-file would do the trick. Fixes: a103fbfadf4c1 ("xtables-restore: Fix parser feed from line buffer") Signed-off-by: Phil Sutter <phil@nwl.cc>