12 files changed, 1716 insertions, 0 deletions
diff --git a/tests/py/any/ct.t b/tests/py/any/ct.t
new file mode 100644
index 00000000..059402e2
--- /dev/null
+++ b/tests/py/any/ct.t
@@ -0,0 +1,109 @@
+*ip;test-ip4
+*ip6;test-ip6
+*inet;test-inet
+
+:output;type filter hook output priority 0
+
+ct state new,established, related, untracked;ok;ct state established,related,new,untracked
+ct state != related;ok
+ct state {new,established, related, untracked};ok
+- ct state != {new,established, related, untracked};ok
+ct state invalid drop;ok
+ct state established accept;ok
+ct state 8;ok;ct state new
+ct state xxx;fail
+
+ct direction original;ok
+ct direction != original;ok
+ct direction reply;ok
+ct direction != reply;ok
+ct direction {reply, original};ok
+- ct direction != {reply, original};ok
+ct direction xxx;fail
+
+ct status expected;ok
+ct status != expected;ok
+ct status seen-reply;ok
+ct status != seen-reply;ok
+ct status {expected, seen-reply, assured, confirmed, dying};ok
+ct status xxx;fail
+
+# SYMBOL("snat", IPS_SRC_NAT)
+# SYMBOL("dnat", IPS_DST_NAT)
+- ct status snat;ok
+- ct status dnat;ok
+
+ct mark 0;ok;ct mark 0x00000000
+ct mark or 0x23 == 0x11;ok;ct mark | 0x00000023 == 0x00000011
+ct mark or 0x3 != 0x1;ok;ct mark | 0x00000003 != 0x00000001
+ct mark and 0x23 == 0x11;ok;ct mark & 0x00000023 == 0x00000011
+ct mark and 0x3 != 0x1;ok;ct mark & 0x00000003 != 0x00000001
+ct mark xor 0x23 == 0x11;ok;ct mark 0x00000032
+ct mark xor 0x3 != 0x1;ok;ct mark != 0x00000002
+
+ct mark 0x00000032;ok
+ct mark != 0x00000032;ok
+ct mark 0x00000032-0x00000045;ok
+ct mark != 0x00000032-0x00000045;ok
+ct mark {0x32, 0x2222, 0x42de3};ok;ct mark { 0x00042de3, 0x00002222, 0x00000032}
+- ct mark != {0x32, 0x2222, 0x42de3};ok
+
+# ct mark != {0x32, 0x2222, 0x42de3};ok
+# BUG: invalid expression type set
+# nft: src/evaluate.c:975: expr_evaluate_relational: Assertion '0' failed.
+
+ct mark set 0x11 xor 0x1331;ok;ct mark set 0x00001320
+ct mark set 0x11333 and 0x11;ok;ct mark set 0x00000011
+ct mark set 0x12 or 0x11;ok;ct mark set 0x00000013
+ct mark set 0x11;ok;ct mark set 0x00000011
+
+ct expiration 30;ok;ct expiration 30s
+ct expiration 22;ok;ct expiration 22s
+ct expiration != 233;ok;ct expiration != 3m53s
+ct expiration 33-45;ok;ct expiration 33s-45s
+ct expiration != 33-45;ok;ct expiration != 33s-45s
+ct expiration {33, 55, 67, 88};ok;ct expiration { 1m7s, 33s, 55s, 1m28s}
+- ct expiration != {33, 55, 67, 88};ok;ct expiration { 1m7s, 33s, 55s, 1m28s}
+ct expiration {33-55};ok;ct expiration { 33s-55s}
+# BUG: ct expiration {33-55}
+# Broken output: ct expiration { "4271d23h25m52s"-"8738d3h11m59s" }
+- ct expiration != {33-55};ok
+
+ct helper "ftp";ok
+ct helper "12345678901234567";fail
+
+# BUG: ct l3proto "Layer  3 protocol of the connection"
+# nft add rule ip test input ct l3proto arp
+# <cmdline>:1:35-37: Error: Can t parse symbolic invalid expressions
+
+
+# If table is ip6 or inet or bridge family,, It is failed. I can not test it
+# ct saddr 1.2.3.4;ok
+
+# BUG: ct saddr 192.168.3.4
+# <cmdline>:1:1-43: Error: Could not process rule: Invalid argument
+# add rule ip test input ct saddr 192.168.3.4
+# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+- ct saddr 192.168.3.4;ok
+- ct daddr 192.168.3.4;ok
+
+# BUG: ct protocol tcp
+# <cmdline>:1:1-37: Error: Could not process rule: Invalid argument
+# input ct protocol bgp <cmdline>:1:36-38: Error: Could not resolve protocol name
+# ct protocol tcp;ok
+- ct protocol tcp;ok
+
+- ct proto-src udp;ok
+- ct proto-dst udp;ok
+# BUG: ct proto-src udp and ct proto-dst udp
+# <cmdline>:1:37-39: Error: datatype mismatch, expected invalid, expression has type Internet protocol
+# add rule ip test input ct proto-src udp
+#                       ~~~~~~~~~~~~ ^^^
+# <cmdline>:1:37-39: Error: datatype mismatch, expected invalid, expression has type Internet protocol
+# add rule ip test input ct proto-dst udp
+#                        ~~~~~~~~~~~~ ^^^
+
+ct state . ct mark { new . 0x12345678};ok
+ct state . ct mark { new . 0x12345678, new . 0x34127856, established . 0x12785634};ok
+ct direction . ct mark { original . 0x12345678};ok
+ct state . ct mark vmap { new . 0x12345678 : drop};ok
diff --git a/tests/py/any/ct.t.payload b/tests/py/any/ct.t.payload
new file mode 100644
index 00000000..2bebaccd
--- /dev/null
+++ b/tests/py/any/ct.t.payload
@@ -0,0 +1,275 @@
+# ct state new,established, related, untracked
+ip test-ip4 output
+  [ ct load state => reg 1 ]
+  [ bitwise reg 1 = (reg=1 & 0x0000004e ) ^ 0x00000000 ]
+  [ cmp neq reg 1 0x00000000 ]
+
+# ct state != related
+ip test-ip4 output
+  [ ct load state => reg 1 ]
+  [ cmp neq reg 1 0x00000004 ]
+
+# ct state {new,established, related, untracked}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000008  : 0 [end]	element 00000002  : 0 [end]	element 00000004  : 0 [end]	element 00000040  : 0 [end]
+ip test-ip4 output
+  [ ct load state => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# ct state invalid drop
+ip test-ip4 output
+  [ ct load state => reg 1 ]
+  [ bitwise reg 1 = (reg=1 & 0x00000001 ) ^ 0x00000000 ]
+  [ cmp neq reg 1 0x00000000 ]
+  [ immediate reg 0 drop ]
+
+# ct state established accept
+ip test-ip4 output
+  [ ct load state => reg 1 ]
+  [ bitwise reg 1 = (reg=1 & 0x00000002 ) ^ 0x00000000 ]
+  [ cmp neq reg 1 0x00000000 ]
+  [ immediate reg 0 accept ]
+
+# ct state 8
+ip test-ip4 output
+  [ ct load state => reg 1 ]
+  [ bitwise reg 1 = (reg=1 & 0x00000008 ) ^ 0x00000000 ]
+  [ cmp neq reg 1 0x00000000 ]
+
+# ct direction original
+ip test-ip4 output
+  [ ct load direction => reg 1 ]
+  [ cmp eq reg 1 0x00000000 ]
+
+# ct direction != original
+ip test-ip4 output
+  [ ct load direction => reg 1 ]
+  [ cmp neq reg 1 0x00000000 ]
+
+# ct direction reply
+ip test-ip4 output
+  [ ct load direction => reg 1 ]
+  [ cmp eq reg 1 0x00000001 ]
+
+# ct direction != reply
+ip test-ip4 output
+  [ ct load direction => reg 1 ]
+  [ cmp neq reg 1 0x00000001 ]
+
+# ct direction {reply, original}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000001  : 0 [end]	element 00000000  : 0 [end]
+ip test-ip4 output
+  [ ct load direction => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# ct status expected
+ip test-ip4 output
+  [ ct load status => reg 1 ]
+  [ bitwise reg 1 = (reg=1 & 0x00000001 ) ^ 0x00000000 ]
+  [ cmp neq reg 1 0x00000000 ]
+
+# ct status != expected
+ip test-ip4 output
+  [ ct load status => reg 1 ]
+  [ cmp neq reg 1 0x00000001 ]
+
+# ct status seen-reply
+ip test-ip4 output
+  [ ct load status => reg 1 ]
+  [ bitwise reg 1 = (reg=1 & 0x00000002 ) ^ 0x00000000 ]
+  [ cmp neq reg 1 0x00000000 ]
+
+# ct status != seen-reply
+ip test-ip4 output
+  [ ct load status => reg 1 ]
+  [ cmp neq reg 1 0x00000002 ]
+
+# ct status {expected, seen-reply, assured, confirmed, dying}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000001  : 0 [end]	element 00000002  : 0 [end]	element 00000004  : 0 [end]	element 00000008  : 0 [end]	element 00000200  : 0 [end]
+ip test-ip4 output
+  [ ct load status => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# ct mark 0
+ip test-ip4 output
+  [ ct load mark => reg 1 ]
+  [ cmp eq reg 1 0x00000000 ]
+
+# ct mark or 0x23 == 0x11
+ip test-ip4 output
+  [ ct load mark => reg 1 ]
+  [ bitwise reg 1 = (reg=1 & 0xffffffdc ) ^ 0x00000023 ]
+  [ cmp eq reg 1 0x00000011 ]
+
+# ct mark or 0x3 != 0x1
+ip test-ip4 output
+  [ ct load mark => reg 1 ]
+  [ bitwise reg 1 = (reg=1 & 0xfffffffc ) ^ 0x00000003 ]
+  [ cmp neq reg 1 0x00000001 ]
+
+# ct mark and 0x23 == 0x11
+ip test-ip4 output
+  [ ct load mark => reg 1 ]
+  [ bitwise reg 1 = (reg=1 & 0x00000023 ) ^ 0x00000000 ]
+  [ cmp eq reg 1 0x00000011 ]
+
+# ct mark and 0x3 != 0x1
+ip test-ip4 output
+  [ ct load mark => reg 1 ]
+  [ bitwise reg 1 = (reg=1 & 0x00000003 ) ^ 0x00000000 ]
+  [ cmp neq reg 1 0x00000001 ]
+
+# ct mark xor 0x23 == 0x11
+ip test-ip4 output
+  [ ct load mark => reg 1 ]
+  [ cmp eq reg 1 0x00000032 ]
+
+# ct mark xor 0x3 != 0x1
+ip test-ip4 output
+  [ ct load mark => reg 1 ]
+  [ cmp neq reg 1 0x00000002 ]
+
+# ct mark 0x00000032
+ip test-ip4 output
+  [ ct load mark => reg 1 ]
+  [ cmp eq reg 1 0x00000032 ]
+
+# ct mark != 0x00000032
+ip test-ip4 output
+  [ ct load mark => reg 1 ]
+  [ cmp neq reg 1 0x00000032 ]
+
+# ct mark 0x00000032-0x00000045
+ip test-ip4 output
+  [ ct load mark => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp gte reg 1 0x32000000 ]
+  [ cmp lte reg 1 0x45000000 ]
+
+# ct mark != 0x00000032-0x00000045
+ip test-ip4 output
+  [ ct load mark => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp lt reg 1 0x32000000 ]
+  [ cmp gt reg 1 0x45000000 ]
+
+# ct mark {0x32, 0x2222, 0x42de3}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000032  : 0 [end]	element 00002222  : 0 [end]	element 00042de3  : 0 [end]
+ip test-ip4 output
+  [ ct load mark => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# ct mark set 0x11 xor 0x1331
+ip test-ip4 output
+  [ immediate reg 1 0x00001320 ]
+  [ ct set mark with reg 1 ]
+
+# ct mark set 0x11333 and 0x11
+ip test-ip4 output
+  [ immediate reg 1 0x00000011 ]
+  [ ct set mark with reg 1 ]
+
+# ct mark set 0x12 or 0x11
+ip test-ip4 output
+  [ immediate reg 1 0x00000013 ]
+  [ ct set mark with reg 1 ]
+
+# ct mark set 0x11
+ip test-ip4 output
+  [ immediate reg 1 0x00000011 ]
+  [ ct set mark with reg 1 ]
+
+# ct expiration 30
+ip test-ip4 output
+  [ ct load expiration => reg 1 ]
+  [ cmp eq reg 1 0x0000001e ]
+
+# ct expiration 22
+ip test-ip4 output
+  [ ct load expiration => reg 1 ]
+  [ cmp eq reg 1 0x00000016 ]
+
+# ct expiration != 233
+ip test-ip4 output
+  [ ct load expiration => reg 1 ]
+  [ cmp neq reg 1 0x000000e9 ]
+
+# ct expiration 33-45
+ip test-ip4 output
+  [ ct load expiration => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp gte reg 1 0x21000000 ]
+  [ cmp lte reg 1 0x2d000000 ]
+
+# ct expiration != 33-45
+ip test-ip4 output
+  [ ct load expiration => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp lt reg 1 0x21000000 ]
+  [ cmp gt reg 1 0x2d000000 ]
+
+# ct expiration {33, 55, 67, 88}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000021  : 0 [end]	element 00000037  : 0 [end]	element 00000043  : 0 [end]	element 00000058  : 0 [end]
+ip test-ip4 output
+  [ ct load expiration => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# ct expiration {33-55}
+set%d test-ip4 7
+set%d test-ip4 0
+	element 00000000  : 1 [end]	element 21000000  : 0 [end]	element 38000000  : 1 [end]
+ip test-ip4 output
+  [ ct load expiration => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ lookup reg 1 set set%d ]
+
+# ct helper "ftp"
+ip test-ip4 output
+  [ ct load helper => reg 1 ]
+  [ cmp eq reg 1 0x00707466 0x00000000 0x00000000 0x00000000 ]
+
+# ct state . ct mark { new . 0x12345678}
+set%d test 3
+set%d test 0
+	element 00000008 12345678  : 0 [end]
+ip test-ip4 output
+  [ ct load state => reg 1 ]
+  [ ct load mark => reg 9 ]
+  [ lookup reg 1 set set%d ]
+
+# ct state . ct mark { new . 0x12345678, new . 0x34127856, established . 0x12785634}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000008 12345678  : 0 [end]	element 00000008 34127856  : 0 [end]	element 00000002 12785634  : 0 [end]
+ip test-ip4 output
+  [ ct load state => reg 1 ]
+  [ ct load mark => reg 9 ]
+  [ lookup reg 1 set set%d ]
+
+# ct direction . ct mark { original . 0x12345678}
+set%d test 3
+set%d test 0
+	element 00000000 12345678  : 0 [end]
+ip test-ip4 output
+  [ ct load direction => reg 1 ]
+  [ ct load mark => reg 9 ]
+  [ lookup reg 1 set set%d ]
+
+# ct state . ct mark vmap { new . 0x12345678 : drop}
+map%d test-ip4 b
+map%d test-ip4 0
+	element 00000008 12345678  : 0 [end]
+ip test-ip4 output
+  [ ct load state => reg 1 ]
+  [ ct load mark => reg 9 ]
+  [ lookup reg 1 set map%d dreg 0 ]
+
diff --git a/tests/py/any/frag.t b/tests/py/any/frag.t
new file mode 100644
index 00000000..d61a3d4f
--- /dev/null
+++ b/tests/py/any/frag.t
@@ -0,0 +1,64 @@
+*ip;test-ip4
+*ip6;test-ip6
+*inet;test-inet
+*arp;test-arp
+*bridge;test-bridge
+:output;type filter hook output priority 0
+
+frag nexthdr tcp;ok;frag nexthdr 6
+frag nexthdr != icmp;ok;frag nexthdr != 1
+frag nexthdr {esp, ah, comp, udp, udplite, tcp, dccp, sctp};ok;frag nexthdr { 51, 136, 132, 6, 108, 50, 17, 33}
+- frag nexthdr != {esp, ah, comp, udp, udplite, tcp, dccp, sctp};ok
+frag nexthdr esp;ok;frag nexthdr 50
+frag nexthdr ah;ok;frag nexthdr 51
+
+frag reserved 22;ok
+frag reserved != 233;ok
+frag reserved 33-45;ok
+frag reserved != 33-45;ok
+frag reserved { 33, 55, 67, 88};ok
+- frag reserved != { 33, 55, 67, 88};ok
+frag reserved { 33-55};ok
+- frag reserved != { 33-55};ok
+
+# BUG: frag frag-off 22 and frag frag-off { 33-55}
+# This breaks table listing: "netlink: Error: Relational expression size mismatch"
+
+- frag frag-off 22;ok
+- frag frag-off != 233;ok
+- frag frag-off 33-45;ok
+- frag frag-off != 33-45;ok
+- frag frag-off { 33, 55, 67, 88};ok
+- frag frag-off != { 33, 55, 67, 88};ok
+- frag frag-off { 33-55};ok
+- frag frag-off != { 33-55};ok
+
+# BUG  frag reserved2 33 and frag reserved2 1
+# $ sudo nft add rule ip test input frag reserved2 33
+# <cmdline>:1:39-40: Error: Value 33 exceeds valid range 0-3
+# add rule ip test input frag reserved2 33
+#                                      ^^
+# sudo nft add rule ip test input frag reserved2 1
+# <cmdline>:1:1-39: Error: Could not process rule: Invalid argument
+# add rule ip test input frag reserved2 1
+# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+# BUG more-fragments 1 and frag more-fragments 4
+# frag more-fragments 1
+# <cmdline>:1:1-44: Error: Could not process rule: Invalid argument
+# add rule ip test input frag more-fragments 1
+# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+# $ sudo nft add rule ip test input frag more-fragments 4
+# <cmdline>:1:44-44: Error: Value 4 exceeds valid range 0-1
+# add rule ip test input frag more-fragments 4
+#                                           ^
+
+frag id 1;ok
+frag id 22;ok
+frag id != 33;ok
+frag id 33-45;ok
+frag id != 33-45;ok
+frag id { 33, 55, 67, 88};ok
+- frag id != { 33, 55, 67, 88};ok
+frag id { 33-55};ok
+- frag id != { 33-55};ok
diff --git a/tests/py/any/frag.t.payload b/tests/py/any/frag.t.payload
new file mode 100644
index 00000000..a91ab3fa
--- /dev/null
+++ b/tests/py/any/frag.t.payload
@@ -0,0 +1,109 @@
+# frag nexthdr tcp
+ip test-ip4 output
+  [ exthdr load 1b @ 44 + 0 => reg 1 ]
+  [ cmp eq reg 1 0x00000006 ]
+
+# frag nexthdr != icmp
+ip test-ip4 output
+  [ exthdr load 1b @ 44 + 0 => reg 1 ]
+  [ cmp neq reg 1 0x00000001 ]
+
+# frag nexthdr {esp, ah, comp, udp, udplite, tcp, dccp, sctp}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000032  : 0 [end]	element 00000033  : 0 [end]	element 0000006c  : 0 [end]	element 00000011  : 0 [end]	element 00000088  : 0 [end]	element 00000006  : 0 [end]	element 00000021  : 0 [end]	element 00000084  : 0 [end]
+ip test-ip4 output
+  [ exthdr load 1b @ 44 + 0 => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# frag nexthdr esp
+ip test-ip4 output
+  [ exthdr load 1b @ 44 + 0 => reg 1 ]
+  [ cmp eq reg 1 0x00000032 ]
+
+# frag nexthdr ah
+ip test-ip4 output
+  [ exthdr load 1b @ 44 + 0 => reg 1 ]
+  [ cmp eq reg 1 0x00000033 ]
+
+# frag reserved 22
+ip test-ip4 output
+  [ exthdr load 1b @ 44 + 1 => reg 1 ]
+  [ cmp eq reg 1 0x00000016 ]
+
+# frag reserved != 233
+ip test-ip4 output
+  [ exthdr load 1b @ 44 + 1 => reg 1 ]
+  [ cmp neq reg 1 0x000000e9 ]
+
+# frag reserved 33-45
+ip test-ip4 output
+  [ exthdr load 1b @ 44 + 1 => reg 1 ]
+  [ cmp gte reg 1 0x00000021 ]
+  [ cmp lte reg 1 0x0000002d ]
+
+# frag reserved != 33-45
+ip test-ip4 output
+  [ exthdr load 1b @ 44 + 1 => reg 1 ]
+  [ cmp lt reg 1 0x00000021 ]
+  [ cmp gt reg 1 0x0000002d ]
+
+# frag reserved { 33, 55, 67, 88}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000021  : 0 [end]	element 00000037  : 0 [end]	element 00000043  : 0 [end]	element 00000058  : 0 [end]
+ip test-ip4 output
+  [ exthdr load 1b @ 44 + 1 => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# frag reserved { 33-55}
+set%d test-ip4 7
+set%d test-ip4 0
+	element 00000000  : 1 [end]	element 00000021  : 0 [end]	element 00000038  : 1 [end]
+ip test-ip4 output
+  [ exthdr load 1b @ 44 + 1 => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# frag id 1
+ip test-ip4 output
+  [ exthdr load 4b @ 44 + 4 => reg 1 ]
+  [ cmp eq reg 1 0x01000000 ]
+
+# frag id 22
+ip test-ip4 output
+  [ exthdr load 4b @ 44 + 4 => reg 1 ]
+  [ cmp eq reg 1 0x16000000 ]
+
+# frag id != 33
+ip test-ip4 output
+  [ exthdr load 4b @ 44 + 4 => reg 1 ]
+  [ cmp neq reg 1 0x21000000 ]
+
+# frag id 33-45
+ip test-ip4 output
+  [ exthdr load 4b @ 44 + 4 => reg 1 ]
+  [ cmp gte reg 1 0x21000000 ]
+  [ cmp lte reg 1 0x2d000000 ]
+
+# frag id != 33-45
+ip test-ip4 output
+  [ exthdr load 4b @ 44 + 4 => reg 1 ]
+  [ cmp lt reg 1 0x21000000 ]
+  [ cmp gt reg 1 0x2d000000 ]
+
+# frag id { 33, 55, 67, 88}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 21000000  : 0 [end]	element 37000000  : 0 [end]	element 43000000  : 0 [end]	element 58000000  : 0 [end]
+ip test-ip4 output
+  [ exthdr load 4b @ 44 + 4 => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# frag id { 33-55}
+set%d test-ip4 7
+set%d test-ip4 0
+	element 00000000  : 1 [end]	element 21000000  : 0 [end]	element 38000000  : 1 [end]
+ip test-ip4 output
+  [ exthdr load 4b @ 44 + 4 => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
diff --git a/tests/py/any/limit.t b/tests/py/any/limit.t
new file mode 100644
index 00000000..96ffe609
--- /dev/null
+++ b/tests/py/any/limit.t
@@ -0,0 +1,25 @@
+*ip;test-ip4
+*ip6;test-ip6
+*inet;test-inet
+*arp;test-arp
+*bridge;test-bridge
+:output;type filter hook output priority 0
+
+limit rate 400/minute;ok
+limit rate 20/second;ok
+limit rate 400/hour;ok
+limit rate 40/day;ok
+limit rate 400/week;ok
+limit rate 1023/second burst 10 packets;ok
+
+limit rate 1 kbytes/second;ok
+limit rate 2 kbytes/second;ok
+limit rate 1025 kbytes/second;ok
+limit rate 1023 mbytes/second;ok
+limit rate 10230 mbytes/second;ok
+limit rate 1023000 mbytes/second;ok
+
+limit rate 1025 bytes/second burst 512 bytes;ok
+limit rate 1025 kbytes/second burst 1023 kbytes;ok
+limit rate 1025 mbytes/second burst 1025 kbytes;ok
+limit rate 1025000 mbytes/second burst 1023 mbytes;ok
diff --git a/tests/py/any/limit.t.payload b/tests/py/any/limit.t.payload
new file mode 100644
index 00000000..a3c87d84
--- /dev/null
+++ b/tests/py/any/limit.t.payload
@@ -0,0 +1,64 @@
+# limit rate 400/minute
+ip test-ip4 output
+  [ limit rate 400/minute burst 0 type packets ]
+
+# limit rate 20/second
+ip test-ip4 output
+  [ limit rate 20/second burst 0 type packets ]
+
+# limit rate 400/hour
+ip test-ip4 output
+  [ limit rate 400/hour burst 0 type packets ]
+
+# limit rate 400/week
+ip test-ip4 output
+  [ limit rate 400/week burst 0 type packets ]
+
+# limit rate 40/day
+ip test-ip4 output
+  [ limit rate 40/day burst 0 type packets ]
+
+# limit rate 1023/second burst 10 packets
+ip test-ip4 output
+  [ limit rate 1023/second burst 10 type packets ]
+
+# limit rate 1 kbytes/second
+ip test-ip4 output
+  [ limit rate 1024/second burst 0 type bytes ]
+
+# limit rate 2 kbytes/second
+ip test-ip4 output
+  [ limit rate 2048/second burst 0 type bytes ]
+
+# limit rate 1025 kbytes/second
+ip test-ip4 output
+  [ limit rate 1049600/second burst 0 type bytes ]
+
+# limit rate 1023 mbytes/second
+ip test-ip4 output
+  [ limit rate 1072693248/second burst 0 type bytes ]
+
+# limit rate 10230 mbytes/second
+ip test-ip4 output
+  [ limit rate 10726932480/second burst 0 type bytes ]
+
+# limit rate 1023000 mbytes/second
+ip test-ip4 output
+  [ limit rate 1072693248000/second burst 0 type bytes ]
+
+# limit rate 1025 bytes/second burst 512 bytes
+ip test-ip4 output
+  [ limit rate 1025/second burst 512 type bytes ]
+
+# limit rate 1025 kbytes/second burst 1023 kbytes
+ip test-ip4 output
+  [ limit rate 1049600/second burst 1047552 type bytes ]
+
+# limit rate 1025 mbytes/second burst 1025 kbytes
+ip test-ip4 output
+  [ limit rate 1074790400/second burst 1049600 type bytes ]
+
+# limit rate 1025000 mbytes/second burst 1023 mbytes
+ip test-ip4 output
+  [ limit rate 1074790400000/second burst 1072693248 type bytes ]
+
diff --git a/tests/py/any/log.t b/tests/py/any/log.t
new file mode 100644
index 00000000..0eed5807
--- /dev/null
+++ b/tests/py/any/log.t
@@ -0,0 +1,26 @@
+*ip;test-ip4
+*ip6;test-ip6
+*inet;test-inet
+*arp;test-arp
+*bridge;test-bridge
+:output;type filter hook output priority 0
+
+log;ok
+log level emerg;ok
+log level alert;ok
+log level crit;ok
+log level err;ok
+log level warn;ok;log
+log level notice;ok
+log level info;ok
+log level debug;ok
+
+log level emerg group 2;fail
+log level alert group 2 prefix "log test2";fail
+
+log prefix aaaaa-aaaaaa group 2 snaplen 33;ok;log prefix "aaaaa-aaaaaa" group 2 snaplen 33
+# TODO: Add an exception: 'queue-threshold' attribute needs 'group' attribute
+# The correct rule is log group 2 queue-threshold 2
+log group 2 queue-threshold 2;ok
+log group 2 snaplen 33;ok
+log group 2 prefix \"nft-test: \";ok;log prefix "nft-test: " group 2
diff --git a/tests/py/any/log.t.payload b/tests/py/any/log.t.payload
new file mode 100644
index 00000000..689668b6
--- /dev/null
+++ b/tests/py/any/log.t.payload
@@ -0,0 +1,52 @@
+# log
+ip test-ip4 output
+  [ log prefix (null) ]
+
+# log level emerg
+ip test-ip4 output
+  [ log prefix (null) level 0 flags 0]
+
+# log level alert
+ip test-ip4 output
+  [ log prefix (null) level 1 flags 0]
+
+# log level crit
+ip test-ip4 output
+  [ log prefix (null) level 2 flags 0]
+
+# log level err
+ip test-ip4 output
+  [ log prefix (null) level 3 flags 0]
+
+# log level warn
+ip test-ip4 output
+  [ log prefix (null) level 4 flags 0]
+
+# log level notice
+ip test-ip4 output
+  [ log prefix (null) level 5 flags 0]
+
+# log level info
+ip test-ip4 output
+  [ log prefix (null) level 6 flags 0]
+
+# log level debug
+ip test-ip4 output
+  [ log prefix (null) level 7 flags 0]
+
+# log prefix aaaaa-aaaaaa group 2 snaplen 33
+ip test-ip4 output
+  [ log prefix aaaaa-aaaaaa group 2 snaplen 33 qthreshold 0]
+
+# log group 2 queue-threshold 2
+ip test-ip4 output
+  [ log prefix (null) group 2 snaplen 0 qthreshold 2]
+
+# log group 2 snaplen 33
+ip test-ip4 output
+  [ log prefix (null) group 2 snaplen 33 qthreshold 0]
+
+# log group 2 prefix \"nft-test: \"
+ip test-ip4 output
+  [ log prefix nft-test:  group 2 snaplen 0 qthreshold 0]
+
diff --git a/tests/py/any/meta.t b/tests/py/any/meta.t
new file mode 100644
index 00000000..c03e7f4e
--- /dev/null
+++ b/tests/py/any/meta.t
@@ -0,0 +1,197 @@
+*ip;test-ip4
+*ip6;test-ip6
+*inet;test-inet
+*arp;test-arp
+*bridge;test-bridge
+
+:input;type filter hook input priority 0
+
+meta length 1000;ok
+meta length 22;ok
+meta length != 233;ok
+meta length 33-45;ok
+meta length != 33-45;ok
+meta length { 33, 55, 67, 88};ok
+- meta length != { 33, 55, 67, 88};ok
+meta length { 33-55};ok
+- meta length != { 33-55};ok
+
+meta protocol { ip, arp, ip6, vlan };ok;meta protocol { ip6, ip, vlan, arp}
+- meta protocol != {ip, arp, ip6, vlan};ok
+meta protocol ip;ok
+meta protocol != ip;ok
+
+meta nfproto ipv4;ok
+meta nfproto ipv6;ok
+meta nfproto {ipv4, ipv6};ok
+
+meta l4proto 22;ok
+meta l4proto != 233;ok
+meta l4proto 33-45;ok
+meta l4proto != 33-45;ok
+meta l4proto { 33, 55, 67, 88};ok;meta l4proto { 33, 55, 67, 88}
+- meta l4proto != { 33, 55, 67, 88};ok
+meta l4proto { 33-55};ok
+- meta l4proto != { 33-55};ok
+
+- meta priority :aabb;ok
+- meta priority bcad:dadc;ok
+- meta priority aabb:;ok
+- meta priority != :aabb;ok
+- meta priority != bcad:dadc;ok
+- meta priority != aabb:;ok
+- meta priority bcad:dada-bcad:dadc;ok
+- meta priority != bcad:dada-bcad:dadc;ok
+- meta priority {bcad:dada, bcad:dadc, aaaa:bbbb};ok
+- meta priority != {bcad:dada, bcad:dadc, aaaa:bbbb};ok
+
+meta mark 0x4;ok;mark 0x00000004
+meta mark 0x32;ok;mark 0x00000032
+meta mark and 0x03 == 0x01;ok;mark & 0x00000003 == 0x00000001
+meta mark and 0x03 != 0x01;ok;mark & 0x00000003 != 0x00000001
+meta mark 0x10;ok;mark 0x00000010
+meta mark != 0x10;ok;mark != 0x00000010
+
+meta mark or 0x03 == 0x01;ok;mark | 0x00000003 == 0x00000001
+meta mark or 0x03 != 0x01;ok;mark | 0x00000003 != 0x00000001
+meta mark xor 0x03 == 0x01;ok;mark 0x00000002
+meta mark xor 0x03 != 0x01;ok;mark != 0x00000002
+
+meta iif eth0 accept;ok;iif eth0 accept
+meta iif eth0 accept;ok;iif eth0 accept
+meta iif != eth0 accept;ok;iif != eth0 accept
+meta iif != eth0 accept;ok;iif != eth0 accept
+
+meta iifname "eth0";ok;iifname "eth0"
+meta iifname != "eth0";ok;iifname != "eth0"
+meta iifname {"eth0", "lo"};ok
+- meta iifname != {"eth0", "lo"};ok
+meta iifname "eth*";ok;iifname "eth*"
+meta iifname "eth\*";ok;iifname "eth\*"
+
+meta iiftype {ether, ppp, ipip, ipip6, loopback, sit, ipgre};ok
+- meta iiftype != {ether, ppp, ipip, ipip6, loopback, sit, ipgre};ok
+meta iiftype != ether;ok;iiftype != ether
+meta iiftype ether;ok;iiftype ether
+meta iiftype != ppp;ok;iiftype != ppp
+meta iiftype ppp;ok;iiftype ppp
+
+meta oif lo accept;ok;oif lo accept
+meta oif != lo accept;ok;oif != lo accept
+meta oif {eth0, lo} accept;ok
+- meta oif != {eth0, lo} accept;ok
+
+meta oifname "eth0";ok;oifname "eth0"
+meta oifname != "eth0";ok;oifname != "eth0"
+meta oifname { "eth0", "lo"};ok
+- meta iifname != {"eth0", "lo"};ok
+meta oifname "eth*";ok;oifname "eth*"
+meta oifname "eth\*";ok;oifname "eth\*"
+
+meta oiftype {ether, ppp, ipip, ipip6, loopback, sit, ipgre};ok
+- meta oiftype != {ether, ppp, ipip, ipip6, loopback, sit, ipgre};ok
+meta oiftype != ether;ok;oiftype != ether
+meta oiftype ether;ok;oiftype ether
+
+meta skuid {bin, root, daemon} accept;ok;skuid { 0, 1, 2} accept
+- meta skuid != {bin, root, daemon} accept;ok
+meta skuid root;ok;skuid 0
+meta skuid != root;ok;skuid != 0
+meta skuid lt 3000 accept;ok;skuid < 3000 accept
+meta skuid gt 3000 accept;ok;skuid > 3000 accept
+meta skuid eq 3000 accept;ok;skuid 3000 accept
+meta skuid 3001-3005 accept;ok;skuid 3001-3005 accept
+meta skuid != 2001-2005 accept;ok;skuid != 2001-2005 accept
+meta skuid { 2001-2005} accept;ok;skuid { 2001-2005} accept
+- meta skuid != { 2001-2005} accept;ok
+
+meta skgid {bin, root, daemon} accept;ok;skgid { 0, 1, 2} accept
+- meta skgid != {bin, root, daemon} accept;ok
+meta skgid root;ok;skgid 0
+meta skgid != root;ok;skgid != 0
+meta skgid lt 3000 accept;ok;skgid < 3000 accept
+meta skgid gt 3000 accept;ok;skgid > 3000 accept
+meta skgid eq 3000 accept;ok;skgid 3000 accept
+meta skgid 2001-2005 accept;ok;skgid 2001-2005 accept
+meta skgid != 2001-2005 accept;ok;skgid != 2001-2005 accept
+meta skgid { 2001-2005} accept;ok;skgid { 2001-2005} accept
+- meta skgid != { 2001-2005} accept;ok;skgid != { 2001-2005} accept
+
+# BUG: meta nftrace 2 and meta nftrace 1
+# $ sudo nft add rule ip test input meta nftrace 2
+# <cmdline>:1:37-37: Error: Value 2 exceeds valid range 0-1
+# add rule ip test input meta nftrace 2
+#                                    ^
+# $ sudo nft add rule ip test input meta nftrace 1
+# <cmdline>:1:1-37: Error: Could not process rule: Operation not supported
+# add rule ip test input meta nftrace 1
+# -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+meta mark set 0xffffffc8 xor 0x16;ok;mark set 0xffffffde
+meta mark set 0x16 and 0x16;ok;mark set 0x00000016
+meta mark set 0xffffffe9 or 0x16;ok;mark set 0xffffffff
+meta mark set 0xffffffde and 0x16;ok;mark set 0x00000016
+meta mark set 0xf045ffde or 0x10;ok;mark set 0xf045ffde
+meta mark set 0xffffffde or 0x16;ok;mark set 0xffffffde
+meta mark set 0x32 or 0xfffff;ok;mark set 0x000fffff
+meta mark set 0xfffe xor 0x16;ok;mark set 0x0000ffe8
+
+meta iif lo;ok;iif lo
+meta oif lo;ok;oif lo
+meta oifname "eth2" accept;ok;oifname "eth2" accept
+meta skuid 3000;ok;skuid 3000
+meta skgid 3000;ok;skgid 3000
+# BUG:  meta nftrace 1;ok
+# <cmdline>:1:1-37: Error: Could not process rule: Operation not supported
+- meta nftrace 1;ok
+meta rtclassid cosmos;ok;rtclassid cosmos
+
+meta pkttype broadcast;ok;pkttype broadcast
+meta pkttype unicast;ok;pkttype unicast
+meta pkttype multicast;ok;pkttype multicast
+meta pkttype != broadcast;ok;pkttype != broadcast
+meta pkttype != unicast;ok;pkttype != unicast
+meta pkttype != multicast;ok;pkttype != multicast
+meta pkttype broadcastttt;fail
+meta pkttype { broadcast, multicast} accept;ok
+
+meta cpu 1;ok;cpu 1
+meta cpu != 1;ok;cpu != 1
+meta cpu 1-3;ok;cpu 1-3
+meta cpu != 1-2;ok;cpu != 1-2
+meta cpu { 2,3};ok;cpu { 2,3}
+-meta cpu != { 2,3};ok; cpu != { 2,3}
+
+meta iifgroup 0;ok;iifgroup default
+meta iifgroup != 0;ok;iifgroup != default
+meta iifgroup default;ok;iifgroup default
+meta iifgroup != default;ok;iifgroup != default
+meta iifgroup {default};ok;iifgroup {default}
+- meta iifgroup != {default};ok
+meta iifgroup { 11,33};ok
+meta iifgroup {11-33};ok
+- meta iifgroup != {11,33};ok
+- meta iifgroup != {11-33};ok
+meta oifgroup 0;ok;oifgroup default
+meta oifgroup != 0;ok;oifgroup != default
+meta oifgroup default;ok;oifgroup default
+meta oifgroup != default;ok;oifgroup != default
+meta oifgroup {default};ok;oifgroup {default}
+- meta oifgroup != {default};ok
+meta oifgroup { 11,33};ok
+meta oifgroup {11-33};ok
+- meta oifgroup != {11,33};ok
+- meta oifgroup != {11-33};ok
+
+meta cgroup 1048577;ok;cgroup 1048577
+meta cgroup != 1048577;ok;cgroup != 1048577
+meta cgroup { 1048577, 1048578 };ok;cgroup { 1048577, 1048578}
+# meta cgroup != { 1048577, 1048578};ok;cgroup != { 1048577, 1048578}
+meta cgroup 1048577-1048578;ok;cgroup 1048577-1048578
+meta cgroup != 1048577-1048578;ok;cgroup != 1048577-1048578
+meta cgroup {1048577-1048578};ok;cgroup { 1048577-1048578}
+# meta cgroup != { 1048577-1048578};ok;cgroup != { 1048577-1048578}
+
+meta iif . meta oif { lo . eth0 };ok
+meta iif . meta oif . meta mark { lo . eth0 . 0x0000000a };ok
+meta iif . meta oif vmap { lo . eth0 : drop };ok
diff --git a/tests/py/any/meta.t.payload b/tests/py/any/meta.t.payload
new file mode 100644
index 00000000..9f7a6d99
--- /dev/null
+++ b/tests/py/any/meta.t.payload
@@ -0,0 +1,756 @@
+# meta length 1000
+ip test-ip4 input
+  [ meta load len => reg 1 ]
+  [ cmp eq reg 1 0x000003e8 ]
+
+# meta length 22
+ip test-ip4 input
+  [ meta load len => reg 1 ]
+  [ cmp eq reg 1 0x00000016 ]
+
+# meta length != 233
+ip test-ip4 input
+  [ meta load len => reg 1 ]
+  [ cmp neq reg 1 0x000000e9 ]
+
+# meta length 33-45
+ip test-ip4 input
+  [ meta load len => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp gte reg 1 0x21000000 ]
+  [ cmp lte reg 1 0x2d000000 ]
+
+# meta length != 33-45
+ip test-ip4 input
+  [ meta load len => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp lt reg 1 0x21000000 ]
+  [ cmp gt reg 1 0x2d000000 ]
+
+# meta length { 33, 55, 67, 88}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000021  : 0 [end]	element 00000037  : 0 [end]	element 00000043  : 0 [end]	element 00000058  : 0 [end]
+ip test-ip4 input
+  [ meta load len => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# meta length { 33-55}
+set%d test-ip4 7
+set%d test-ip4 0
+	element 00000000  : 1 [end]	element 21000000  : 0 [end]	element 38000000  : 1 [end]
+ip test-ip4 input
+  [ meta load len => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ lookup reg 1 set set%d ]
+
+# meta protocol { ip, arp, ip6, vlan }
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000008  : 0 [end]	element 00000608  : 0 [end]	element 0000dd86  : 0 [end]	element 00000081  : 0 [end]
+ip test-ip4 input
+  [ meta load protocol => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# meta protocol ip
+ip test-ip4 input
+  [ meta load protocol => reg 1 ]
+  [ cmp eq reg 1 0x00000008 ]
+
+# meta protocol != ip
+ip test-ip4 input
+  [ meta load protocol => reg 1 ]
+  [ cmp neq reg 1 0x00000008 ]
+
+# meta nfproto ipv4
+ip test-ip4 input
+  [ meta load nfproto => reg 1 ]
+  [ cmp eq reg 1 0x00000002 ]
+
+# meta nfproto ipv6
+ip test-ip4 input
+  [ meta load nfproto => reg 1 ]
+  [ cmp eq reg 1 0x0000000a ]
+
+# meta nfproto {ipv4, ipv6}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000002  : 0 [end]	element 0000000a  : 0 [end]
+ip test-ip4 input
+  [ meta load nfproto => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# meta l4proto 22
+ip test-ip4 input
+  [ meta load l4proto => reg 1 ]
+  [ cmp eq reg 1 0x00000016 ]
+
+# meta l4proto != 233
+ip test-ip4 input
+  [ meta load l4proto => reg 1 ]
+  [ cmp neq reg 1 0x000000e9 ]
+
+# meta l4proto 33-45
+ip test-ip4 input
+  [ meta load l4proto => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 2, 1) ]
+  [ cmp gte reg 1 0x00000021 ]
+  [ cmp lte reg 1 0x0000002d ]
+
+# meta l4proto != 33-45
+ip test-ip4 input
+  [ meta load l4proto => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 2, 1) ]
+  [ cmp lt reg 1 0x00000021 ]
+  [ cmp gt reg 1 0x0000002d ]
+
+# meta l4proto { 33, 55, 67, 88}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000021  : 0 [end]	element 00000037  : 0 [end]	element 00000043  : 0 [end]	element 00000058  : 0 [end]
+ip test-ip4 input
+  [ meta load l4proto => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# meta l4proto { 33-55}
+set%d test-ip4 7
+set%d test-ip4 0
+	element 00000000  : 1 [end]	element 00000021  : 0 [end]	element 00000038  : 1 [end]
+ip test-ip4 input
+  [ meta load l4proto => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 2, 1) ]
+  [ lookup reg 1 set set%d ]
+
+# meta mark 0x4
+ip test-ip4 input
+  [ meta load mark => reg 1 ]
+  [ cmp eq reg 1 0x00000004 ]
+
+# meta mark 0x32
+ip test-ip4 input
+  [ meta load mark => reg 1 ]
+  [ cmp eq reg 1 0x00000032 ]
+
+# meta mark and 0x03 == 0x01
+ip test-ip4 input
+  [ meta load mark => reg 1 ]
+  [ bitwise reg 1 = (reg=1 & 0x00000003 ) ^ 0x00000000 ]
+  [ cmp eq reg 1 0x00000001 ]
+
+# meta mark and 0x03 != 0x01
+ip test-ip4 input
+  [ meta load mark => reg 1 ]
+  [ bitwise reg 1 = (reg=1 & 0x00000003 ) ^ 0x00000000 ]
+  [ cmp neq reg 1 0x00000001 ]
+
+# meta mark 0x10
+ip test-ip4 input
+  [ meta load mark => reg 1 ]
+  [ cmp eq reg 1 0x00000010 ]
+
+# meta mark != 0x10
+ip test-ip4 input
+  [ meta load mark => reg 1 ]
+  [ cmp neq reg 1 0x00000010 ]
+
+# meta mark or 0x03 == 0x01
+ip test-ip4 input
+  [ meta load mark => reg 1 ]
+  [ bitwise reg 1 = (reg=1 & 0xfffffffc ) ^ 0x00000003 ]
+  [ cmp eq reg 1 0x00000001 ]
+
+# meta mark or 0x03 != 0x01
+ip test-ip4 input
+  [ meta load mark => reg 1 ]
+  [ bitwise reg 1 = (reg=1 & 0xfffffffc ) ^ 0x00000003 ]
+  [ cmp neq reg 1 0x00000001 ]
+
+# meta mark xor 0x03 == 0x01
+ip test-ip4 input
+  [ meta load mark => reg 1 ]
+  [ cmp eq reg 1 0x00000002 ]
+
+# meta mark xor 0x03 != 0x01
+ip test-ip4 input
+  [ meta load mark => reg 1 ]
+  [ cmp neq reg 1 0x00000002 ]
+
+# meta iif eth0 accept
+ip test-ip4 input
+  [ meta load iif => reg 1 ]
+  [ cmp eq reg 1 0x00000002 ]
+  [ immediate reg 0 accept ]
+
+# meta iif eth0 accept
+ip test-ip4 input
+  [ meta load iif => reg 1 ]
+  [ cmp eq reg 1 0x00000002 ]
+  [ immediate reg 0 accept ]
+
+# meta iif != eth0 accept
+ip test-ip4 input
+  [ meta load iif => reg 1 ]
+  [ cmp neq reg 1 0x00000002 ]
+  [ immediate reg 0 accept ]
+
+# meta iif != eth0 accept
+ip test-ip4 input
+  [ meta load iif => reg 1 ]
+  [ cmp neq reg 1 0x00000002 ]
+  [ immediate reg 0 accept ]
+
+# meta iifname "eth0"
+ip test-ip4 input
+  [ meta load iifname => reg 1 ]
+  [ cmp eq reg 1 0x30687465 0x00000000 0x00000000 0x00000000 ]
+
+# meta iifname != "eth0"
+ip test-ip4 input
+  [ meta load iifname => reg 1 ]
+  [ cmp neq reg 1 0x30687465 0x00000000 0x00000000 0x00000000 ]
+
+# meta iifname {"eth0", "lo"}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 30687465 00000000 00000000 00000000  : 0 [end]	element 00006f6c 00000000 00000000 00000000  : 0 [end]
+ip test-ip4 input
+  [ meta load iifname => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# meta iifname "eth*"
+ip test-ip4 input
+  [ meta load iifname => reg 1 ]
+  [ cmp eq reg 1 0x00687465 ]
+
+# meta iifname "eth\*"
+ip test-ip4 input
+  [ meta load iifname => reg 1 ]
+  [ cmp eq reg 1 0x2a687465 0x00000000 0x00000000 0x00000000 ]
+
+# meta iiftype {ether, ppp, ipip, ipip6, loopback, sit, ipgre}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000001  : 0 [end]	element 00000200  : 0 [end]	element 00000300  : 0 [end]	element 00000301  : 0 [end]	element 00000304  : 0 [end]	element 00000308  : 0 [end]	element 0000030a  : 0 [end]
+ip test-ip4 input
+  [ meta load iiftype => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# meta iiftype != ether
+ip test-ip4 input
+  [ meta load iiftype => reg 1 ]
+  [ cmp neq reg 1 0x00000001 ]
+
+# meta iiftype ether
+ip test-ip4 input
+  [ meta load iiftype => reg 1 ]
+  [ cmp eq reg 1 0x00000001 ]
+
+# meta iiftype != ppp
+ip test-ip4 input
+  [ meta load iiftype => reg 1 ]
+  [ cmp neq reg 1 0x00000200 ]
+
+# meta iiftype ppp
+ip test-ip4 input
+  [ meta load iiftype => reg 1 ]
+  [ cmp eq reg 1 0x00000200 ]
+
+# meta oif lo accept
+ip test-ip4 input
+  [ meta load oif => reg 1 ]
+  [ cmp eq reg 1 0x00000001 ]
+  [ immediate reg 0 accept ]
+
+# meta oif != lo accept
+ip test-ip4 input
+  [ meta load oif => reg 1 ]
+  [ cmp neq reg 1 0x00000001 ]
+  [ immediate reg 0 accept ]
+
+# meta oif {eth0, lo} accept
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000002  : 0 [end]	element 00000001  : 0 [end]
+ip test-ip4 input
+  [ meta load oif => reg 1 ]
+  [ lookup reg 1 set set%d ]
+  [ immediate reg 0 accept ]
+
+# meta oifname "eth0"
+ip test-ip4 input
+  [ meta load oifname => reg 1 ]
+  [ cmp eq reg 1 0x30687465 0x00000000 0x00000000 0x00000000 ]
+
+# meta oifname != "eth0"
+ip test-ip4 input
+  [ meta load oifname => reg 1 ]
+  [ cmp neq reg 1 0x30687465 0x00000000 0x00000000 0x00000000 ]
+
+# meta oifname { "eth0", "lo"}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 30687465 00000000 00000000 00000000  : 0 [end]	element 00006f6c 00000000 00000000 00000000  : 0 [end]
+ip test-ip4 input
+  [ meta load oifname => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# meta oifname "eth*"
+ip test-ip4 input
+  [ meta load oifname => reg 1 ]
+  [ cmp eq reg 1 0x00687465 ]
+
+# meta oifname "eth\*"
+ip test-ip4 input
+  [ meta load oifname => reg 1 ]
+  [ cmp eq reg 1 0x2a687465 0x00000000 0x00000000 0x00000000 ]
+
+# meta oiftype {ether, ppp, ipip, ipip6, loopback, sit, ipgre}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000001  : 0 [end]	element 00000200  : 0 [end]	element 00000300  : 0 [end]	element 00000301  : 0 [end]	element 00000304  : 0 [end]	element 00000308  : 0 [end]	element 0000030a  : 0 [end]
+ip test-ip4 input
+  [ meta load oiftype => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# meta oiftype != ether
+ip test-ip4 input
+  [ meta load oiftype => reg 1 ]
+  [ cmp neq reg 1 0x00000001 ]
+
+# meta oiftype ether
+ip test-ip4 input
+  [ meta load oiftype => reg 1 ]
+  [ cmp eq reg 1 0x00000001 ]
+
+# meta skuid {bin, root, daemon} accept
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000001  : 0 [end]	element 00000000  : 0 [end]	element 00000002  : 0 [end]
+ip test-ip4 input
+  [ meta load skuid => reg 1 ]
+  [ lookup reg 1 set set%d ]
+  [ immediate reg 0 accept ]
+
+# meta skuid root
+ip test-ip4 input
+  [ meta load skuid => reg 1 ]
+  [ cmp eq reg 1 0x00000000 ]
+
+# meta skuid != root
+ip test-ip4 input
+  [ meta load skuid => reg 1 ]
+  [ cmp neq reg 1 0x00000000 ]
+
+# meta skuid lt 3000 accept
+ip test-ip4 input
+  [ meta load skuid => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp lt reg 1 0xb80b0000 ]
+  [ immediate reg 0 accept ]
+
+# meta skuid gt 3000 accept
+ip test-ip4 input
+  [ meta load skuid => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp gt reg 1 0xb80b0000 ]
+  [ immediate reg 0 accept ]
+
+# meta skuid eq 3000 accept
+ip test-ip4 input
+  [ meta load skuid => reg 1 ]
+  [ cmp eq reg 1 0x00000bb8 ]
+  [ immediate reg 0 accept ]
+
+# meta skuid 3001-3005 accept
+ip test-ip4 input
+  [ meta load skuid => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp gte reg 1 0xb90b0000 ]
+  [ cmp lte reg 1 0xbd0b0000 ]
+  [ immediate reg 0 accept ]
+
+# meta skuid != 2001-2005 accept
+ip test-ip4 input
+  [ meta load skuid => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp lt reg 1 0xd1070000 ]
+  [ cmp gt reg 1 0xd5070000 ]
+  [ immediate reg 0 accept ]
+
+# meta skuid { 2001-2005} accept
+set%d test-ip4 7
+set%d test-ip4 0
+	element 00000000  : 1 [end]	element d1070000  : 0 [end]	element d6070000  : 1 [end]
+ip test-ip4 input
+  [ meta load skuid => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ lookup reg 1 set set%d ]
+  [ immediate reg 0 accept ]
+
+# meta skgid {bin, root, daemon} accept
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000001  : 0 [end]	element 00000000  : 0 [end]	element 00000002  : 0 [end]
+ip test-ip4 input
+  [ meta load skgid => reg 1 ]
+  [ lookup reg 1 set set%d ]
+  [ immediate reg 0 accept ]
+
+# meta skgid root
+ip test-ip4 input
+  [ meta load skgid => reg 1 ]
+  [ cmp eq reg 1 0x00000000 ]
+
+# meta skgid != root
+ip test-ip4 input
+  [ meta load skgid => reg 1 ]
+  [ cmp neq reg 1 0x00000000 ]
+
+# meta skgid lt 3000 accept
+ip test-ip4 input
+  [ meta load skgid => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp lt reg 1 0xb80b0000 ]
+  [ immediate reg 0 accept ]
+
+# meta skgid gt 3000 accept
+ip test-ip4 input
+  [ meta load skgid => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp gt reg 1 0xb80b0000 ]
+  [ immediate reg 0 accept ]
+
+# meta skgid eq 3000 accept
+ip test-ip4 input
+  [ meta load skgid => reg 1 ]
+  [ cmp eq reg 1 0x00000bb8 ]
+  [ immediate reg 0 accept ]
+
+# meta skgid 2001-2005 accept
+ip test-ip4 input
+  [ meta load skgid => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp gte reg 1 0xd1070000 ]
+  [ cmp lte reg 1 0xd5070000 ]
+  [ immediate reg 0 accept ]
+
+# meta skgid != 2001-2005 accept
+ip test-ip4 input
+  [ meta load skgid => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp lt reg 1 0xd1070000 ]
+  [ cmp gt reg 1 0xd5070000 ]
+  [ immediate reg 0 accept ]
+
+# meta skgid { 2001-2005} accept
+set%d test-ip4 7
+set%d test-ip4 0
+	element 00000000  : 1 [end]	element d1070000  : 0 [end]	element d6070000  : 1 [end]
+ip test-ip4 input
+  [ meta load skgid => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ lookup reg 1 set set%d ]
+  [ immediate reg 0 accept ]
+
+# meta mark set 0xffffffc8 xor 0x16
+ip test-ip4 input
+  [ immediate reg 1 0xffffffde ]
+  [ meta set mark with reg 1 ]
+
+# meta mark set 0x16 and 0x16
+ip test-ip4 input
+  [ immediate reg 1 0x00000016 ]
+  [ meta set mark with reg 1 ]
+
+# meta mark set 0xffffffe9 or 0x16
+ip test-ip4 input
+  [ immediate reg 1 0xffffffff ]
+  [ meta set mark with reg 1 ]
+
+# meta mark set 0xffffffde and 0x16
+ip test-ip4 input
+  [ immediate reg 1 0x00000016 ]
+  [ meta set mark with reg 1 ]
+
+# meta mark set 0xf045ffde or 0x10
+ip test-ip4 input
+  [ immediate reg 1 0xf045ffde ]
+  [ meta set mark with reg 1 ]
+
+# meta mark set 0xffffffde or 0x16
+ip test-ip4 input
+  [ immediate reg 1 0xffffffde ]
+  [ meta set mark with reg 1 ]
+
+# meta mark set 0x32 or 0xfffff
+ip test-ip4 input
+  [ immediate reg 1 0x000fffff ]
+  [ meta set mark with reg 1 ]
+
+# meta mark set 0xfffe xor 0x16
+ip test-ip4 input
+  [ immediate reg 1 0x0000ffe8 ]
+  [ meta set mark with reg 1 ]
+
+# meta iif lo
+ip test-ip4 input
+  [ meta load iif => reg 1 ]
+  [ cmp eq reg 1 0x00000001 ]
+
+# meta oif lo
+ip test-ip4 input
+  [ meta load oif => reg 1 ]
+  [ cmp eq reg 1 0x00000001 ]
+
+# meta oifname "eth2" accept
+ip test-ip4 input
+  [ meta load oifname => reg 1 ]
+  [ cmp eq reg 1 0x32687465 0x00000000 0x00000000 0x00000000 ]
+  [ immediate reg 0 accept ]
+
+# meta skuid 3000
+ip test-ip4 input
+  [ meta load skuid => reg 1 ]
+  [ cmp eq reg 1 0x00000bb8 ]
+
+# meta skgid 3000
+ip test-ip4 input
+  [ meta load skgid => reg 1 ]
+  [ cmp eq reg 1 0x00000bb8 ]
+
+# meta rtclassid cosmos
+ip test-ip4 input
+  [ meta load rtclassid => reg 1 ]
+  [ cmp eq reg 1 0x00000000 ]
+
+# meta pkttype broadcast
+ip test-ip4 input
+  [ meta load pkttype => reg 1 ]
+  [ cmp eq reg 1 0x00000001 ]
+
+# meta pkttype unicast
+ip test-ip4 input
+  [ meta load pkttype => reg 1 ]
+  [ cmp eq reg 1 0x00000000 ]
+
+# meta pkttype multicast
+ip test-ip4 input
+  [ meta load pkttype => reg 1 ]
+  [ cmp eq reg 1 0x00000002 ]
+
+# meta pkttype != broadcast
+ip test-ip4 input
+  [ meta load pkttype => reg 1 ]
+  [ cmp neq reg 1 0x00000001 ]
+
+# meta pkttype != unicast
+ip test-ip4 input
+  [ meta load pkttype => reg 1 ]
+  [ cmp neq reg 1 0x00000000 ]
+
+# meta pkttype != multicast
+ip test-ip4 input
+  [ meta load pkttype => reg 1 ]
+  [ cmp neq reg 1 0x00000002 ]
+
+# meta pkttype { broadcast, multicast} accept
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000001  : 0 [end]	element 00000002  : 0 [end]
+ip test-ip4 input
+  [ meta load pkttype => reg 1 ]
+  [ lookup reg 1 set set%d ]
+  [ immediate reg 0 accept ]
+
+# meta cpu 1
+ip test-ip4 input
+  [ meta load cpu => reg 1 ]
+  [ cmp eq reg 1 0x00000001 ]
+
+# meta cpu != 1
+ip test-ip4 input
+  [ meta load cpu => reg 1 ]
+  [ cmp neq reg 1 0x00000001 ]
+
+# meta cpu 1-3
+ip test-ip4 input
+  [ meta load cpu => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp gte reg 1 0x01000000 ]
+  [ cmp lte reg 1 0x03000000 ]
+
+# meta cpu != 1-2
+ip test-ip4 input
+  [ meta load cpu => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp lt reg 1 0x01000000 ]
+  [ cmp gt reg 1 0x02000000 ]
+
+# meta cpu { 2,3}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000002  : 0 [end]	element 00000003  : 0 [end]
+ip test-ip4 input
+  [ meta load cpu => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# meta iifgroup 0
+ip test-ip4 input
+  [ meta load iifgroup => reg 1 ]
+  [ cmp eq reg 1 0x00000000 ]
+
+# meta iifgroup != 0
+ip test-ip4 input
+  [ meta load iifgroup => reg 1 ]
+  [ cmp neq reg 1 0x00000000 ]
+
+# meta iifgroup default
+ip test-ip4 input
+  [ meta load iifgroup => reg 1 ]
+  [ cmp eq reg 1 0x00000000 ]
+
+# meta iifgroup != default
+ip test-ip4 input
+  [ meta load iifgroup => reg 1 ]
+  [ cmp neq reg 1 0x00000000 ]
+
+# meta iifgroup {default}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000000  : 0 [end]
+ip test-ip4 input
+  [ meta load iifgroup => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# meta iifgroup { 11,33}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 0000000b  : 0 [end]	element 00000021  : 0 [end]
+ip test-ip4 input
+  [ meta load iifgroup => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# meta iifgroup {11-33}
+set%d test-ip4 7
+set%d test-ip4 0
+	element 00000000  : 1 [end]	element 0b000000  : 0 [end]	element 22000000  : 1 [end]
+ip test-ip4 input
+  [ meta load iifgroup => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ lookup reg 1 set set%d ]
+
+# meta oifgroup 0
+ip test-ip4 input
+  [ meta load oifgroup => reg 1 ]
+  [ cmp eq reg 1 0x00000000 ]
+
+# meta oifgroup != 0
+ip test-ip4 input
+  [ meta load oifgroup => reg 1 ]
+  [ cmp neq reg 1 0x00000000 ]
+
+# meta oifgroup default
+ip test-ip4 input
+  [ meta load oifgroup => reg 1 ]
+  [ cmp eq reg 1 0x00000000 ]
+
+# meta oifgroup != default
+ip test-ip4 input
+  [ meta load oifgroup => reg 1 ]
+  [ cmp neq reg 1 0x00000000 ]
+
+# meta oifgroup {default}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000000  : 0 [end]
+ip test-ip4 input
+  [ meta load oifgroup => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# meta oifgroup { 11,33}
+set%d test-ip4 3
+set%d test-ip4 0
+	element 0000000b  : 0 [end]	element 00000021  : 0 [end]
+ip test-ip4 input
+  [ meta load oifgroup => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# meta oifgroup {11-33}
+set%d test-ip4 7
+set%d test-ip4 0
+	element 00000000  : 1 [end]	element 0b000000  : 0 [end]	element 22000000  : 1 [end]
+ip test-ip4 input
+  [ meta load oifgroup => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ lookup reg 1 set set%d ]
+
+# meta cgroup 1048577
+ip test-ip4 input
+  [ meta load cgroup => reg 1 ]
+  [ cmp eq reg 1 0x00100001 ]
+
+# meta cgroup != 1048577
+ip test-ip4 input
+  [ meta load cgroup => reg 1 ]
+  [ cmp neq reg 1 0x00100001 ]
+
+# meta cgroup { 1048577, 1048578 }
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00100001  : 0 [end]	element 00100002  : 0 [end]
+ip test-ip4 input
+  [ meta load cgroup => reg 1 ]
+  [ lookup reg 1 set set%d ]
+
+# meta cgroup 1048577-1048578
+ip test-ip4 input
+  [ meta load cgroup => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp gte reg 1 0x01001000 ]
+  [ cmp lte reg 1 0x02001000 ]
+
+# meta cgroup != 1048577-1048578
+ip test-ip4 input
+  [ meta load cgroup => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ cmp lt reg 1 0x01001000 ]
+  [ cmp gt reg 1 0x02001000 ]
+
+# meta cgroup {1048577-1048578}
+set%d test-ip4 7
+set%d test-ip4 0
+	element 00000000  : 1 [end]	element 01001000  : 0 [end]	element 03001000  : 1 [end]
+ip test-ip4 input
+  [ meta load cgroup => reg 1 ]
+  [ byteorder reg 1 = hton(reg 1, 4, 4) ]
+  [ lookup reg 1 set set%d ]
+
+
+# meta iif . meta oif { lo . eth0 }
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000001 00000002  : 0 [end]
+ip test-ip4 output
+  [ meta load iif => reg 1 ]
+  [ meta load oif => reg 9 ]
+  [ lookup reg 1 set set%d ]
+
+# meta iif . meta oif . meta mark { lo . eth0 . 0x0000000a }
+set%d test-ip4 3
+set%d test-ip4 0
+	element 00000001 00000002 0000000a  : 0 [end]
+ip test-ip4 output
+  [ meta load iif => reg 1 ]
+  [ meta load oif => reg 9 ]
+  [ meta load mark => reg 10 ]
+  [ lookup reg 1 set set%d ]
+
+# meta iif . meta oif vmap { lo . eth0 : drop }
+map%d test-ip4 b
+map%d test-ip4 0
+	element 00000001 00000002  : 0 [end]
+ip test-ip4 output
+  [ meta load iif => reg 1 ]
+  [ meta load oif => reg 9 ]
+  [ lookup reg 1 set map%d dreg 0 ]
+
diff --git a/tests/py/any/queue.t b/tests/py/any/queue.t
new file mode 100644
index 00000000..600c1121
--- /dev/null
+++ b/tests/py/any/queue.t
@@ -0,0 +1,15 @@
+*ip;test-ip4
+*ip6;test-ip6
+*inet;test-inet
+*arp;test-arp
+*bridge;test-bridge
+
+:output;type filter hook output priority 0
+
+queue;ok;queue num 0
+queue num 2;ok
+queue num 2-3;ok
+- queue num {3, 4, 6};ok
+queue num 4-5 fanout bypass;ok;queue num 4-5 bypass,fanout
+queue num 4-5 fanout;ok
+queue num 4-5 bypass;ok
diff --git a/tests/py/any/queue.t.payload b/tests/py/any/queue.t.payload
new file mode 100644
index 00000000..43a6650c
--- /dev/null
+++ b/tests/py/any/queue.t.payload
@@ -0,0 +1,24 @@
+# queue
+ip test-ip4 output
+  [ queue num 0]
+
+# queue num 2
+ip test-ip4 output
+  [ queue num 2]
+
+# queue num 2-3
+ip test-ip4 output
+  [ queue num 2-3]
+
+# queue num 4-5 fanout bypass
+ip test-ip4 output
+  [ queue num 4-5 bypass fanout]
+
+# queue num 4-5 fanout
+ip test-ip4 output
+  [ queue num 4-5 fanout]
+
+# queue num 4-5 bypass
+ip test-ip4 output
+  [ queue num 4-5 bypass]
+