diff options
author | Phil Sutter <phil@nwl.cc> | 2018-03-19 18:02:02 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-03-20 13:05:43 +0100 |
commit | 935f82e7dd4911fde6be9dae960fd1d438542a5d (patch) | |
tree | 453d7db9f6663137d704e60c52f3b31b0140bf40 /tests/shell/testcases/nft-f | |
parent | 4aba100e593f28105be300dc888935fad5dc822f (diff) |
Support 'nft -f -' to read from stdin
In libnftables, detect if given filename is '-' and treat it as the
common way of requesting to read from stdin, then open /dev/stdin
instead. (Calling 'nft -f /dev/stdin' worked before as well, but this
makes it official.)
With this in place and bash's support for here strings, review all tests
in tests/shell for needless use of temp files. Note that two categories
of test cases were intentionally left unchanged:
- Tests creating potentially large rulesets to avoid running into shell
parameter length limits.
- Tests for 'include' directive for obvious reasons.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests/shell/testcases/nft-f')
-rwxr-xr-x | tests/shell/testcases/nft-f/0001define_slash_0 | 14 | ||||
-rwxr-xr-x | tests/shell/testcases/nft-f/0002rollback_rule_0 | 14 | ||||
-rwxr-xr-x | tests/shell/testcases/nft-f/0003rollback_jump_0 | 14 | ||||
-rwxr-xr-x | tests/shell/testcases/nft-f/0004rollback_set_0 | 14 | ||||
-rwxr-xr-x | tests/shell/testcases/nft-f/0005rollback_map_0 | 14 | ||||
-rwxr-xr-x | tests/shell/testcases/nft-f/0006action_object_0 | 25 | ||||
-rwxr-xr-x | tests/shell/testcases/nft-f/0007action_object_set_segfault_1 | 14 | ||||
-rwxr-xr-x | tests/shell/testcases/nft-f/0008split_tables_0 | 11 | ||||
-rwxr-xr-x | tests/shell/testcases/nft-f/0009variable_0 | 11 | ||||
-rwxr-xr-x | tests/shell/testcases/nft-f/0010variable_0 | 11 | ||||
-rwxr-xr-x | tests/shell/testcases/nft-f/0012different_defines_0 | 14 | ||||
-rwxr-xr-x | tests/shell/testcases/nft-f/0013defines_1 | 14 | ||||
-rwxr-xr-x | tests/shell/testcases/nft-f/0014defines_1 | 14 | ||||
-rwxr-xr-x | tests/shell/testcases/nft-f/0015defines_1 | 14 | ||||
-rwxr-xr-x | tests/shell/testcases/nft-f/0016redefines_1 | 14 |
15 files changed, 40 insertions, 172 deletions
diff --git a/tests/shell/testcases/nft-f/0001define_slash_0 b/tests/shell/testcases/nft-f/0001define_slash_0 index bf0763d4..8712fbf8 100755 --- a/tests/shell/testcases/nft-f/0001define_slash_0 +++ b/tests/shell/testcases/nft-f/0001define_slash_0 @@ -2,18 +2,10 @@ # tests for commit 85d6803 (parser_bison: initializer_expr must use rhs_expr) -tmpfile=$(mktemp) -if [ ! -w $tmpfile ] ; then - echo "Failed to create tmp file" >&2 - exit 0 -fi - -trap "rm -rf $tmpfile" EXIT # cleanup if aborted - -echo " +RULESET=" define net = 1.1.1.1/24 -" > $tmpfile +" set -e -$NFT -f $tmpfile +$NFT -f - <<< $RULESET diff --git a/tests/shell/testcases/nft-f/0002rollback_rule_0 b/tests/shell/testcases/nft-f/0002rollback_rule_0 index 19690544..da3cdc0b 100755 --- a/tests/shell/testcases/nft-f/0002rollback_rule_0 +++ b/tests/shell/testcases/nft-f/0002rollback_rule_0 @@ -3,14 +3,6 @@ # test a kernel rollback operation # fail reason: rule -tmpfile=$(mktemp) -if [ ! -w $tmpfile ] ; then - echo "Failed to create tmp file" >&2 - exit 0 -fi - -trap "rm -rf $tmpfile" EXIT # cleanup if aborted - GOOD_RULESET="table ip t { set t { type ipv4_addr @@ -35,15 +27,13 @@ table ip t2 { } }" -echo "$GOOD_RULESET" > $tmpfile -$NFT -f $tmpfile +$NFT -f - <<< $GOOD_RULESET if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi -echo "$BAD_RULESET" > $tmpfile -$NFT -f $tmpfile 2>/dev/null +$NFT -f - <<< $BAD_RULESET 2>/dev/null if [ $? -eq 0 ] ; then echo "E: bogus ruleset loaded?" >&2 exit 1 diff --git a/tests/shell/testcases/nft-f/0003rollback_jump_0 b/tests/shell/testcases/nft-f/0003rollback_jump_0 index f53fd238..1238f150 100755 --- a/tests/shell/testcases/nft-f/0003rollback_jump_0 +++ b/tests/shell/testcases/nft-f/0003rollback_jump_0 @@ -3,14 +3,6 @@ # test a kernel rollback operation # fail reason: invalid jump -tmpfile=$(mktemp) -if [ ! -w $tmpfile ] ; then - echo "Failed to create tmp file" >&2 - exit 0 -fi - -trap "rm -rf $tmpfile" EXIT # cleanup if aborted - GOOD_RULESET="table ip t { set t { type ipv4_addr @@ -35,15 +27,13 @@ table ip t2 { } }" -echo "$GOOD_RULESET" > $tmpfile -$NFT -f $tmpfile +$NFT -f - <<< $GOOD_RULESET if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi -echo "$BAD_RULESET" > $tmpfile -$NFT -f $tmpfile 2>/dev/null +$NFT -f - <<< $BAD_RULESET 2>/dev/null if [ $? -eq 0 ] ; then echo "E: bogus ruleset loaded?" >&2 exit 1 diff --git a/tests/shell/testcases/nft-f/0004rollback_set_0 b/tests/shell/testcases/nft-f/0004rollback_set_0 index 7674106f..25fc870c 100755 --- a/tests/shell/testcases/nft-f/0004rollback_set_0 +++ b/tests/shell/testcases/nft-f/0004rollback_set_0 @@ -3,14 +3,6 @@ # test a kernel rollback operation # fail reason: invalid set -tmpfile=$(mktemp) -if [ ! -w $tmpfile ] ; then - echo "Failed to create tmp file" >&2 - exit 0 -fi - -trap "rm -rf $tmpfile" EXIT # cleanup if aborted - GOOD_RULESET="table ip t { set t { type ipv4_addr @@ -35,15 +27,13 @@ table ip t2 { } }" -echo "$GOOD_RULESET" > $tmpfile -$NFT -f $tmpfile +$NFT -f - <<< $GOOD_RULESET if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi -echo "$BAD_RULESET" > $tmpfile -$NFT -f $tmpfile 2>/dev/null +$NFT -f - <<< $BAD_RULESET 2>/dev/null if [ $? -eq 0 ] ; then echo "E: bogus ruleset loaded?" >&2 exit 1 diff --git a/tests/shell/testcases/nft-f/0005rollback_map_0 b/tests/shell/testcases/nft-f/0005rollback_map_0 index ba1fcc59..90108e72 100755 --- a/tests/shell/testcases/nft-f/0005rollback_map_0 +++ b/tests/shell/testcases/nft-f/0005rollback_map_0 @@ -3,14 +3,6 @@ # test a kernel rollback operation # fail reason: invalid map -tmpfile=$(mktemp) -if [ ! -w $tmpfile ] ; then - echo "Failed to create tmp file" >&2 - exit 0 -fi - -trap "rm -rf $tmpfile" EXIT # cleanup if aborted - GOOD_RULESET="table ip t { set t { type ipv4_addr @@ -38,15 +30,13 @@ table ip t2 { } }" -echo "$GOOD_RULESET" > $tmpfile -$NFT -f $tmpfile +$NFT -f - <<< $GOOD_RULESET if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi -echo "$BAD_RULESET" > $tmpfile -$NFT -f $tmpfile 2>/dev/null +$NFT -f - <<< $BAD_RULESET 2>/dev/null if [ $? -eq 0 ] ; then echo "E: bogus ruleset loaded?" >&2 exit 1 diff --git a/tests/shell/testcases/nft-f/0006action_object_0 b/tests/shell/testcases/nft-f/0006action_object_0 index f4ec41d5..6e3b0b2e 100755 --- a/tests/shell/testcases/nft-f/0006action_object_0 +++ b/tests/shell/testcases/nft-f/0006action_object_0 @@ -2,14 +2,6 @@ # test loading a ruleset with the 'action object' pattern -tmpfile=$(mktemp) -if [ ! -w $tmpfile ] ; then - echo "Failed to create tmp file" >&2 - exit 0 -fi - -trap "rm -f $tmpfile" EXIT # cleanup if aborted - set -e FAMILIES="ip ip6 inet arp bridge" @@ -29,7 +21,7 @@ generate1() add element $family t m {10080:drop} insert rule $family t c meta l4proto tcp tcp dport vmap @m add rule $family t c meta l4proto udp udp sport vmap {1111:accept} - " >> $tmpfile + " } generate2() @@ -41,25 +33,24 @@ generate2() delete element $family t s {8080} delete chain $family t c delete table $family t - " >> $tmpfile + " } -for family in $FAMILIES ; do +RULESET=$(for family in $FAMILIES ; do generate1 $family -done +done) -$NFT -f $tmpfile +$NFT -f - <<< $RULESET if [ $? -ne 0 ] ; then echo "E: unable to load ruleset 1" >&2 exit 1 fi -echo "" > $tmpfile -for family in $FAMILIES ; do +RULESET=$(for family in $FAMILIES ; do generate2 $family -done +done) -$NFT -f $tmpfile +$NFT -f - <<< $RULESET if [ $? -ne 0 ] ; then echo "E: unable to load ruleset 2" >&2 exit 1 diff --git a/tests/shell/testcases/nft-f/0007action_object_set_segfault_1 b/tests/shell/testcases/nft-f/0007action_object_set_segfault_1 index 3a4183bb..7649a496 100755 --- a/tests/shell/testcases/nft-f/0007action_object_set_segfault_1 +++ b/tests/shell/testcases/nft-f/0007action_object_set_segfault_1 @@ -3,19 +3,11 @@ # test for a segfault if bad syntax was used in set declaration # and the set is referenced in the same batch -tmpfile=$(mktemp) -if [ ! -w $tmpfile ] ; then - echo "Failed to create tmp file" >&2 - exit 0 -fi - -trap "rm -f $tmpfile" EXIT # cleanup if aborted - -echo " +RULESET=" add table t add chain t c add set t s {type ipv4_addr\;} add rule t c ip saddr @s -" > $tmpfile +" -$NFT -f $tmpfile 2>/dev/null +$NFT -f - <<< $RULESET 2>/dev/null diff --git a/tests/shell/testcases/nft-f/0008split_tables_0 b/tests/shell/testcases/nft-f/0008split_tables_0 index b244d14e..14cdd499 100755 --- a/tests/shell/testcases/nft-f/0008split_tables_0 +++ b/tests/shell/testcases/nft-f/0008split_tables_0 @@ -2,14 +2,6 @@ set -e -tmpfile=$(mktemp) -if [ ! -w $tmpfile ] ; then - echo "Failed to create tmp file" >&2 - exit 0 -fi - -trap "rm -rf $tmpfile" EXIT # cleanup if aborted - RULESET="table inet filter { chain ssh { type filter hook input priority 0; policy accept; @@ -23,8 +15,7 @@ table inet filter { } }" -echo "$RULESET" > $tmpfile -$NFT -f $tmpfile +$NFT -f - <<< $RULESET if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 diff --git a/tests/shell/testcases/nft-f/0009variable_0 b/tests/shell/testcases/nft-f/0009variable_0 index 4d387074..8ff6b7cf 100755 --- a/tests/shell/testcases/nft-f/0009variable_0 +++ b/tests/shell/testcases/nft-f/0009variable_0 @@ -2,14 +2,6 @@ set -e -tmpfile=$(mktemp) -if [ ! -w $tmpfile ] ; then - echo "Failed to create tmp file" >&2 - exit 0 -fi - -trap "rm -rf $tmpfile" EXIT # cleanup if aborted - RULESET="define concat-set-variable = { 10.10.10.10 . 25, 10.10.10.10 . 143 } table inet forward { @@ -19,5 +11,4 @@ table inet forward { } }" -echo "$RULESET" > $tmpfile -$NFT -f $tmpfile +$NFT -f - <<< $RULESET diff --git a/tests/shell/testcases/nft-f/0010variable_0 b/tests/shell/testcases/nft-f/0010variable_0 index 2df71b13..be02c6bf 100755 --- a/tests/shell/testcases/nft-f/0010variable_0 +++ b/tests/shell/testcases/nft-f/0010variable_0 @@ -2,14 +2,6 @@ set -e -tmpfile=$(mktemp) -if [ ! -w $tmpfile ] ; then - echo "Failed to create tmp file" >&2 - exit 0 -fi - -trap "rm -rf $tmpfile" EXIT # cleanup if aborted - RULESET="define whitelist_v4 = { 1.1.1.1 } table inet filter { @@ -18,5 +10,4 @@ table inet filter { add element inet filter whitelist_v4 \$whitelist_v4 " -echo "$RULESET" > $tmpfile -$NFT -f $tmpfile +$NFT -f - <<< $RULESET diff --git a/tests/shell/testcases/nft-f/0012different_defines_0 b/tests/shell/testcases/nft-f/0012different_defines_0 index 9c496d59..c17b06b1 100755 --- a/tests/shell/testcases/nft-f/0012different_defines_0 +++ b/tests/shell/testcases/nft-f/0012different_defines_0 @@ -2,15 +2,7 @@ # tests different spots, datatypes and usages for nft defines -tmpfile=$(mktemp) -if [ ! -w $tmpfile ] ; then - echo "Failed to create tmp file" >&2 - exit 0 -fi - -trap "rm -rf $tmpfile" EXIT # cleanup if aborted - -echo " +RULESET=" define d_iifname = whatever define d_oifname = \$d_iifname define d_iif = lo @@ -38,7 +30,7 @@ table inet t { tcp dport \$d_ports udp dport vmap { \$d_ports : accept } } -}" >> $tmpfile +}" set -e -$NFT -f $tmpfile +$NFT -f - <<< $RULESET diff --git a/tests/shell/testcases/nft-f/0013defines_1 b/tests/shell/testcases/nft-f/0013defines_1 index 05370034..b6d575c9 100755 --- a/tests/shell/testcases/nft-f/0013defines_1 +++ b/tests/shell/testcases/nft-f/0013defines_1 @@ -4,15 +4,7 @@ set -e -tmpfile=$(mktemp) -if [ ! -w $tmpfile ] ; then - echo "Failed to create tmp file" >&2 - exit 0 -fi - -trap "rm -rf $tmpfile" EXIT # cleanup if aborted - -echo " +RULESET=" define var2 = \$var1 define var1 = lo @@ -20,6 +12,6 @@ table ip t { chain c { iif \$var2 } -}" >> $tmpfile +}" -$NFT -f $tmpfile +$NFT -f - <<< $RULESET diff --git a/tests/shell/testcases/nft-f/0014defines_1 b/tests/shell/testcases/nft-f/0014defines_1 index de5615e9..77d766ec 100755 --- a/tests/shell/testcases/nft-f/0014defines_1 +++ b/tests/shell/testcases/nft-f/0014defines_1 @@ -4,15 +4,7 @@ set -e -tmpfile=$(mktemp) -if [ ! -w $tmpfile ] ; then - echo "Failed to create tmp file" >&2 - exit 0 -fi - -trap "rm -rf $tmpfile" EXIT # cleanup if aborted - -echo " +RULESET=" define var1 = lo define var1 = lo @@ -20,6 +12,6 @@ table ip t { chain c { iif \$var1 } -}" >> $tmpfile +}" -$NFT -f $tmpfile +$NFT -f - <<< $RULESET diff --git a/tests/shell/testcases/nft-f/0015defines_1 b/tests/shell/testcases/nft-f/0015defines_1 index 9c1a7013..8aaa7bb1 100755 --- a/tests/shell/testcases/nft-f/0015defines_1 +++ b/tests/shell/testcases/nft-f/0015defines_1 @@ -4,21 +4,13 @@ set -e -tmpfile=$(mktemp) -if [ ! -w $tmpfile ] ; then - echo "Failed to create tmp file" >&2 - exit 0 -fi - -trap "rm -rf $tmpfile" EXIT # cleanup if aborted - -echo " +RULESET=" define var1 = \$var1 table ip t { chain c { iif \$var1 } -}" >> $tmpfile +}" -$NFT -f $tmpfile +$NFT -f - <<< $RULESET diff --git a/tests/shell/testcases/nft-f/0016redefines_1 b/tests/shell/testcases/nft-f/0016redefines_1 index da303607..9a6a764a 100755 --- a/tests/shell/testcases/nft-f/0016redefines_1 +++ b/tests/shell/testcases/nft-f/0016redefines_1 @@ -2,15 +2,7 @@ set -e -tmpfile=$(mktemp) -if [ ! -w $tmpfile ] ; then - echo "Failed to create tmp file" >&2 - exit 0 -fi - -trap "rm -rf $tmpfile" EXIT # cleanup if aborted - -echo " +RULESET=" table ip x { chain y { define unused = 4.4.4.4 @@ -20,7 +12,7 @@ table ip x { ip saddr $address undefine unused } -}" >> $tmpfile +}" EXPECTED="table ip x { chain y { @@ -29,7 +21,7 @@ EXPECTED="table ip x { } }" -$NFT -f $tmpfile +$NFT -f - <<< $RULESET GET="$($NFT list ruleset)" |