summaryrefslogtreecommitdiffstats
path: root/tests
diff options
context:
space:
mode:
Diffstat (limited to 'tests')
-rw-r--r--tests/py/inet/sets.t2
-rw-r--r--tests/py/inet/sets.t.payload.bridge14
-rw-r--r--tests/py/inet/sets.t.payload.inet13
-rw-r--r--tests/py/inet/sets.t.payload.netdev13
-rwxr-xr-xtests/py/nft-test.py6
-rwxr-xr-xtests/shell/run-tests.sh19
-rwxr-xr-xtests/shell/testcases/chains/0012reject_in_prerouting_111
-rwxr-xr-x[-rw-r--r--]tests/shell/testcases/chains/0030create_00
-rwxr-xr-xtests/shell/testcases/chains/0032priority_variable_010
-rwxr-xr-xtests/shell/testcases/chains/0041chain_binding_018
-rwxr-xr-xtests/shell/testcases/chains/0042chain_variable_037
-rw-r--r--tests/shell/testcases/chains/dumps/0032priority_variable_0.nft13
-rw-r--r--tests/shell/testcases/chains/dumps/0041chain_binding_0.nft12
-rw-r--r--tests/shell/testcases/chains/dumps/0042chain_variable_0.nft15
-rwxr-xr-xtests/shell/testcases/flowtable/0006segfault_03
-rwxr-xr-xtests/shell/testcases/flowtable/0012flowtable_variable_029
-rw-r--r--tests/shell/testcases/flowtable/dumps/0012flowtable_variable_0.nft14
-rwxr-xr-xtests/shell/testcases/maps/0009vmap_019
-rw-r--r--tests/shell/testcases/maps/dumps/0009vmap_0.nft13
-rw-r--r--tests/shell/testcases/optionals/dumps/log_prefix_0.nft5
-rwxr-xr-xtests/shell/testcases/optionals/log_prefix_016
-rwxr-xr-xtests/shell/testcases/sets/0043concatenated_ranges_093
-rwxr-xr-xtests/shell/testcases/sets/0044interval_overlap_0136
-rwxr-xr-xtests/shell/testcases/sets/0048set_counters_018
-rwxr-xr-xtests/shell/testcases/sets/0049set_define_016
-rwxr-xr-xtests/shell/testcases/sets/0050set_define_117
-rwxr-xr-xtests/shell/testcases/sets/0051set_interval_counter_019
-rwxr-xr-xtests/shell/testcases/sets/0052overlap_016
-rwxr-xr-xtests/shell/testcases/sets/0053echo_016
-rw-r--r--tests/shell/testcases/sets/dumps/0048set_counters_0.nft13
-rw-r--r--tests/shell/testcases/sets/dumps/0049set_define_0.nft6
-rw-r--r--tests/shell/testcases/sets/dumps/0051set_interval_counter_0.nft13
-rw-r--r--tests/shell/testcases/sets/dumps/0052overlap_0.nft8
-rw-r--r--tests/shell/testcases/sets/dumps/0053echo_0.nft6
-rwxr-xr-xtests/shell/testcases/transactions/0002table_01
-rw-r--r--tests/shell/testcases/transactions/dumps/0002table_0.nft4
36 files changed, 586 insertions, 78 deletions
diff --git a/tests/py/inet/sets.t b/tests/py/inet/sets.t
index e0b0ee86..1c6f3235 100644
--- a/tests/py/inet/sets.t
+++ b/tests/py/inet/sets.t
@@ -21,4 +21,4 @@ ip6 daddr @set1 drop;fail
?set3 10.0.0.0/8 . 192.168.1.3-192.168.1.9 . 1024-65535;ok
ip saddr . ip daddr . tcp dport @set3 accept;ok
--ip daddr . tcp dport { 10.0.0.0/8 . 10-23, 192.168.1.1-192.168.3.8 . 80-443 } accept;ok
+ip daddr . tcp dport { 10.0.0.0/8 . 10-23, 192.168.1.1-192.168.3.8 . 80-443 } accept;ok
diff --git a/tests/py/inet/sets.t.payload.bridge b/tests/py/inet/sets.t.payload.bridge
index 089d9dd7..92f5417c 100644
--- a/tests/py/inet/sets.t.payload.bridge
+++ b/tests/py/inet/sets.t.payload.bridge
@@ -26,3 +26,17 @@ bridge
[ lookup reg 1 set set3 ]
[ immediate reg 0 accept ]
+# ip daddr . tcp dport { 10.0.0.0/8 . 10-23, 192.168.1.1-192.168.3.8 . 80-443 } accept
+__set%d test-inet 87
+__set%d test-inet 0
+ element 0000000a 00000a00 : 0 [end] element 0101a8c0 00005000 : 0 [end]
+bridge
+ [ meta load protocol => reg 1 ]
+ [ cmp eq reg 1 0x00000008 ]
+ [ meta load l4proto => reg 1 ]
+ [ cmp eq reg 1 0x00000006 ]
+ [ payload load 4b @ network header + 16 => reg 1 ]
+ [ payload load 2b @ transport header + 2 => reg 9 ]
+ [ lookup reg 1 set __set%d ]
+ [ immediate reg 0 accept ]
+
diff --git a/tests/py/inet/sets.t.payload.inet b/tests/py/inet/sets.t.payload.inet
index c5acd610..bd6e1b0f 100644
--- a/tests/py/inet/sets.t.payload.inet
+++ b/tests/py/inet/sets.t.payload.inet
@@ -26,3 +26,16 @@ inet
[ lookup reg 1 set set3 ]
[ immediate reg 0 accept ]
+# ip daddr . tcp dport { 10.0.0.0/8 . 10-23, 192.168.1.1-192.168.3.8 . 80-443 } accept
+__set%d test-inet 87
+__set%d test-inet 0
+ element 0000000a 00000a00 : 0 [end] element 0101a8c0 00005000 : 0 [end]
+inet
+ [ meta load nfproto => reg 1 ]
+ [ cmp eq reg 1 0x00000002 ]
+ [ meta load l4proto => reg 1 ]
+ [ cmp eq reg 1 0x00000006 ]
+ [ payload load 4b @ network header + 16 => reg 1 ]
+ [ payload load 2b @ transport header + 2 => reg 9 ]
+ [ lookup reg 1 set __set%d ]
+ [ immediate reg 0 accept ]
diff --git a/tests/py/inet/sets.t.payload.netdev b/tests/py/inet/sets.t.payload.netdev
index 82994eab..f3032d8e 100644
--- a/tests/py/inet/sets.t.payload.netdev
+++ b/tests/py/inet/sets.t.payload.netdev
@@ -26,3 +26,16 @@ inet
[ lookup reg 1 set set3 ]
[ immediate reg 0 accept ]
+# ip daddr . tcp dport { 10.0.0.0/8 . 10-23, 192.168.1.1-192.168.3.8 . 80-443 } accept
+__set%d test-netdev 87
+__set%d test-netdev 0
+ element 0000000a 00000a00 : 0 [end] element 0101a8c0 00005000 : 0 [end]
+netdev
+ [ meta load protocol => reg 1 ]
+ [ cmp eq reg 1 0x00000008 ]
+ [ meta load l4proto => reg 1 ]
+ [ cmp eq reg 1 0x00000006 ]
+ [ payload load 4b @ network header + 16 => reg 1 ]
+ [ payload load 2b @ transport header + 2 => reg 9 ]
+ [ lookup reg 1 set __set%d ]
+ [ immediate reg 0 accept ]
diff --git a/tests/py/nft-test.py b/tests/py/nft-test.py
index 01ee6c98..df97ed8e 100755
--- a/tests/py/nft-test.py
+++ b/tests/py/nft-test.py
@@ -1394,6 +1394,12 @@ def main():
# Change working directory to repository root
os.chdir(TESTS_PATH + "/../..")
+ try:
+ import unshare
+ unshare.unshare(unshare.CLONE_NEWNET)
+ except:
+ print_warning("cannot run in own namespace, connectivity might break")
+
check_lib_path = True
if args.library is None:
if args.host:
diff --git a/tests/shell/run-tests.sh b/tests/shell/run-tests.sh
index 26f8f46d..943f8877 100755
--- a/tests/shell/run-tests.sh
+++ b/tests/shell/run-tests.sh
@@ -22,11 +22,22 @@ if [ "$(id -u)" != "0" ] ; then
msg_error "this requires root!"
fi
+if [ "${1}" != "run" ]; then
+ if unshare -f -n true; then
+ unshare -n "${0}" run $@
+ exit $?
+ fi
+ msg_warn "cannot run in own namespace, connectivity might break"
+fi
+shift
+
[ -z "$NFT" ] && NFT=$SRC_NFT
-if [ ! -x "$NFT" ] ; then
- msg_error "no nft binary!"
+${NFT} > /dev/null 2>&1
+ret=$?
+if [ ${ret} -eq 126 ] || [ ${ret} -eq 127 ]; then
+ msg_error "cannot execute nft command: ${NFT}"
else
- msg_info "using nft binary $NFT"
+ msg_info "using nft command: ${NFT}"
fi
if [ ! -d "$TESTDIR" ] ; then
@@ -101,7 +112,7 @@ do
kernel_cleanup
msg_info "[EXECUTING] $testfile"
- test_output=$(NFT=$NFT DIFF=$DIFF ${testfile} 2>&1)
+ test_output=$(NFT="$NFT" DIFF=$DIFF ${testfile} 2>&1)
rc_got=$?
echo -en "\033[1A\033[K" # clean the [EXECUTING] foobar line
diff --git a/tests/shell/testcases/chains/0012reject_in_prerouting_1 b/tests/shell/testcases/chains/0012reject_in_prerouting_1
deleted file mode 100755
index 0ee86c11..00000000
--- a/tests/shell/testcases/chains/0012reject_in_prerouting_1
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/bash
-
-set -e
-
-$NFT add table t
-$NFT add chain t prerouting {type filter hook prerouting priority 0 \; }
-
-# wrong hook prerouting, only input/forward/output is valid
-$NFT add rule t prerouting reject 2>/dev/null || exit 0
-echo "E: accepted reject in prerouting hook" >&2
-exit 1
diff --git a/tests/shell/testcases/chains/0030create_0 b/tests/shell/testcases/chains/0030create_0
index 0b457f91..0b457f91 100644..100755
--- a/tests/shell/testcases/chains/0030create_0
+++ b/tests/shell/testcases/chains/0030create_0
diff --git a/tests/shell/testcases/chains/0032priority_variable_0 b/tests/shell/testcases/chains/0032priority_variable_0
index 51bc5eb1..8f2e57b9 100755
--- a/tests/shell/testcases/chains/0032priority_variable_0
+++ b/tests/shell/testcases/chains/0032priority_variable_0
@@ -6,12 +6,22 @@ set -e
RULESET="
define pri = 10
+define post = -10
+define for = \"filter - 100\"
table inet global {
chain prerouting {
type filter hook prerouting priority \$pri
policy accept
}
+ chain forward {
+ type filter hook prerouting priority \$for
+ policy accept
+ }
+ chain postrouting {
+ type filter hook postrouting priority \$post
+ policy accept
+ }
}"
$NFT -f - <<< "$RULESET"
diff --git a/tests/shell/testcases/chains/0041chain_binding_0 b/tests/shell/testcases/chains/0041chain_binding_0
new file mode 100755
index 00000000..59bdbe9f
--- /dev/null
+++ b/tests/shell/testcases/chains/0041chain_binding_0
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+set -e
+
+EXPECTED="table inet x {
+ chain y {
+ type filter hook input priority 0;
+ meta l4proto { tcp, udp } th dport 53 jump {
+ ip saddr { 127.0.0.0/8, 172.23.0.0/16, 192.168.13.0/24 } counter accept
+ ip6 saddr ::1/128 counter accept
+ }
+ }
+}"
+
+$NFT -f - <<< $EXPECTED
+$NFT add rule inet x y meta l4proto icmpv6 jump { counter accept\; }
+$NFT add rule inet x y meta l4proto sctp jump { drop\; }
+$NFT delete rule inet x y handle 13
diff --git a/tests/shell/testcases/chains/0042chain_variable_0 b/tests/shell/testcases/chains/0042chain_variable_0
new file mode 100755
index 00000000..58535f76
--- /dev/null
+++ b/tests/shell/testcases/chains/0042chain_variable_0
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+set -e
+
+ip link add name dummy0 type dummy
+
+EXPECTED="define if_main = \"lo\"
+
+table netdev filter1 {
+ chain Main_Ingress1 {
+ type filter hook ingress device \$if_main priority -500; policy accept;
+ }
+}"
+
+$NFT -f - <<< $EXPECTED
+
+EXPECTED="define if_main = \"lo\"
+
+table netdev filter2 {
+ chain Main_Ingress2 {
+ type filter hook ingress devices = { \$if_main, dummy0 } priority -500; policy accept;
+ }
+}"
+
+$NFT -f - <<< $EXPECTED
+
+EXPECTED="define if_main = { lo, dummy0 }
+
+table netdev filter3 {
+ chain Main_Ingress3 {
+ type filter hook ingress devices = \$if_main priority -500; policy accept;
+ }
+}"
+
+$NFT -f - <<< $EXPECTED
+
+
diff --git a/tests/shell/testcases/chains/dumps/0032priority_variable_0.nft b/tests/shell/testcases/chains/dumps/0032priority_variable_0.nft
new file mode 100644
index 00000000..1a1b0794
--- /dev/null
+++ b/tests/shell/testcases/chains/dumps/0032priority_variable_0.nft
@@ -0,0 +1,13 @@
+table inet global {
+ chain prerouting {
+ type filter hook prerouting priority filter + 10; policy accept;
+ }
+
+ chain forward {
+ type filter hook prerouting priority dstnat; policy accept;
+ }
+
+ chain postrouting {
+ type filter hook postrouting priority filter - 10; policy accept;
+ }
+}
diff --git a/tests/shell/testcases/chains/dumps/0041chain_binding_0.nft b/tests/shell/testcases/chains/dumps/0041chain_binding_0.nft
new file mode 100644
index 00000000..520203d8
--- /dev/null
+++ b/tests/shell/testcases/chains/dumps/0041chain_binding_0.nft
@@ -0,0 +1,12 @@
+table inet x {
+ chain y {
+ type filter hook input priority filter; policy accept;
+ meta l4proto { tcp, udp } th dport 53 jump {
+ ip saddr { 127.0.0.0/8, 172.23.0.0/16, 192.168.13.0/24 } counter packets 0 bytes 0 accept
+ ip6 saddr ::1 counter packets 0 bytes 0 accept
+ }
+ meta l4proto ipv6-icmp jump {
+ counter packets 0 bytes 0 accept
+ }
+ }
+}
diff --git a/tests/shell/testcases/chains/dumps/0042chain_variable_0.nft b/tests/shell/testcases/chains/dumps/0042chain_variable_0.nft
new file mode 100644
index 00000000..12931aad
--- /dev/null
+++ b/tests/shell/testcases/chains/dumps/0042chain_variable_0.nft
@@ -0,0 +1,15 @@
+table netdev filter1 {
+ chain Main_Ingress1 {
+ type filter hook ingress device "lo" priority -500; policy accept;
+ }
+}
+table netdev filter2 {
+ chain Main_Ingress2 {
+ type filter hook ingress devices = { dummy0, lo } priority -500; policy accept;
+ }
+}
+table netdev filter3 {
+ chain Main_Ingress3 {
+ type filter hook ingress devices = { dummy0, lo } priority -500; policy accept;
+ }
+}
diff --git a/tests/shell/testcases/flowtable/0006segfault_0 b/tests/shell/testcases/flowtable/0006segfault_0
index de590b77..fb7c52fe 100755
--- a/tests/shell/testcases/flowtable/0006segfault_0
+++ b/tests/shell/testcases/flowtable/0006segfault_0
@@ -9,6 +9,3 @@ $NFT add flowtable ip t f { hook ingress priority 10\; devices = { lo } }
$NFT add flowtable ip t f { hook ingress\; priority 10\; }
[[ $? -eq 1 ]] || exit 1
-
-$NFT add flowtable ip t f { hook ingress priority 10\; }
-[[ $? -eq 1 ]] || exit 1
diff --git a/tests/shell/testcases/flowtable/0012flowtable_variable_0 b/tests/shell/testcases/flowtable/0012flowtable_variable_0
new file mode 100755
index 00000000..8e334224
--- /dev/null
+++ b/tests/shell/testcases/flowtable/0012flowtable_variable_0
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+set -e
+
+ip link add name dummy1 type dummy
+
+EXPECTED="define if_main = { lo, dummy1 }
+
+table filter1 {
+ flowtable Main_ft1 {
+ hook ingress priority filter
+ counter
+ devices = \$if_main
+ }
+}"
+
+$NFT -f - <<< $EXPECTED
+
+EXPECTED="define if_main = \"lo\"
+
+table filter2 {
+ flowtable Main_ft2 {
+ hook ingress priority filter
+ counter
+ devices = { \$if_main, dummy1 }
+ }
+}"
+
+$NFT -f - <<< $EXPECTED
diff --git a/tests/shell/testcases/flowtable/dumps/0012flowtable_variable_0.nft b/tests/shell/testcases/flowtable/dumps/0012flowtable_variable_0.nft
new file mode 100644
index 00000000..1cbb2f11
--- /dev/null
+++ b/tests/shell/testcases/flowtable/dumps/0012flowtable_variable_0.nft
@@ -0,0 +1,14 @@
+table ip filter1 {
+ flowtable Main_ft1 {
+ hook ingress priority filter
+ devices = { dummy1, lo }
+ counter
+ }
+}
+table ip filter2 {
+ flowtable Main_ft2 {
+ hook ingress priority filter
+ devices = { dummy1, lo }
+ counter
+ }
+}
diff --git a/tests/shell/testcases/maps/0009vmap_0 b/tests/shell/testcases/maps/0009vmap_0
new file mode 100755
index 00000000..7627c81d
--- /dev/null
+++ b/tests/shell/testcases/maps/0009vmap_0
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -e
+
+EXPECTED="table inet filter {
+ chain ssh_input {
+ }
+
+ chain wan_input {
+ tcp dport vmap { 22 : jump ssh_input }
+ }
+
+ chain prerouting {
+ type filter hook prerouting priority -300; policy accept;
+ iif vmap { "lo" : jump wan_input }
+ }
+}"
+
+$NFT -f - <<< "$EXPECTED"
diff --git a/tests/shell/testcases/maps/dumps/0009vmap_0.nft b/tests/shell/testcases/maps/dumps/0009vmap_0.nft
new file mode 100644
index 00000000..c556fece
--- /dev/null
+++ b/tests/shell/testcases/maps/dumps/0009vmap_0.nft
@@ -0,0 +1,13 @@
+table inet filter {
+ chain ssh_input {
+ }
+
+ chain wan_input {
+ tcp dport vmap { 22 : jump ssh_input }
+ }
+
+ chain prerouting {
+ type filter hook prerouting priority raw; policy accept;
+ iif vmap { "lo" : jump wan_input }
+ }
+}
diff --git a/tests/shell/testcases/optionals/dumps/log_prefix_0.nft b/tests/shell/testcases/optionals/dumps/log_prefix_0.nft
new file mode 100644
index 00000000..8c11d697
--- /dev/null
+++ b/tests/shell/testcases/optionals/dumps/log_prefix_0.nft
@@ -0,0 +1,5 @@
+table ip x {
+ chain y {
+ ct state invalid log prefix "invalid state match, logging:"
+ }
+}
diff --git a/tests/shell/testcases/optionals/log_prefix_0 b/tests/shell/testcases/optionals/log_prefix_0
new file mode 100755
index 00000000..513a9e74
--- /dev/null
+++ b/tests/shell/testcases/optionals/log_prefix_0
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+TMP=$(mktemp)
+
+RULESET='define test = "state"
+define foo = "match, logging"
+
+table x {
+ chain y {
+ ct state invalid log prefix "invalid $test $foo:"
+ }
+}'
+
+$NFT -f - <<< "$RULESET"
diff --git a/tests/shell/testcases/sets/0043concatenated_ranges_0 b/tests/shell/testcases/sets/0043concatenated_ranges_0
index a783dacc..11767373 100755
--- a/tests/shell/testcases/sets/0043concatenated_ranges_0
+++ b/tests/shell/testcases/sets/0043concatenated_ranges_0
@@ -6,11 +6,10 @@
# all possible permutations, and:
# - add entries to set
# - list them
-# - check that they can't be added again
# - get entries by specifying a value matching ranges for all fields
# - delete them
+# - check that they can't be deleted again
# - add them with 1s timeout
-# - check that they can't be added again right away
# - check that they are not listed after 1s, just once, for the first entry
# - delete them
# - make sure they can't be deleted again
@@ -63,27 +62,31 @@ cat <<'EOF' > "${tmp}"
flush ruleset
table inet filter {
- set test {
- type ${ta} . ${tb} . ${tc}
+ ${setmap} test {
+ type ${ta} . ${tb} . ${tc} ${mapt}
flags interval,timeout
- elements = { ${a1} . ${b1} . ${c1} ,
- ${a2} . ${b2} . ${c2} ,
- ${a3} . ${b3} . ${c3} }
+ elements = { ${a1} . ${b1} . ${c1} ${mapv},
+ ${a2} . ${b2} . ${c2} ${mapv},
+ ${a3} . ${b3} . ${c3} ${mapv}, }
}
chain output {
type filter hook output priority 0; policy accept;
- ${sa} . ${sb} . ${sc} @test counter
+ ${rule} @test counter
}
}
EOF
timeout_tested=0
+run_test()
+{
+setmap="$1"
for ta in ${TYPES}; do
eval a=\$ELEMS_${ta}
a1=${a%% *}; a2=$(expr "$a" : ".* \(.*\) .*"); a3=${a##* }
eval sa=\$RULESPEC_${ta}
+ mark=0
for tb in ${TYPES}; do
[ "${tb}" = "${ta}" ] && continue
if [ "${tb}" = "ipv6_addr" ]; then
@@ -107,41 +110,46 @@ for ta in ${TYPES}; do
[ "${tb}" = "ipv6_addr" ] && continue
fi
- echo "TYPE: ${ta} ${tb} ${tc}"
+ echo "$setmap TYPE: ${ta} ${tb} ${tc}"
eval c=\$ELEMS_${tc}
c1=${c%% *}; c2=$(expr "$c" : ".* \(.*\) .*"); c3=${c##* }
eval sc=\$RULESPEC_${tc}
- render ${tmp} | ${NFT} -f -
+ case "${setmap}" in
+ "set")
+ mapt=""
+ mapv=""
+ rule="${sa} . ${sb} . ${sc}"
+ ;;
+ "map")
+ mapt=": mark"
+ mark=42
+ mapv=$(printf " : 0x%08x" ${mark})
+ rule="meta mark set ${sa} . ${sb} . ${sc} map"
+ ;;
+ esac
- [ $(${NFT} list set inet filter test | \
- grep -c -e "${a1} . ${b1} . ${c1}" \
- -e "${a2} . ${b2} . ${c2}" \
- -e "${a3} . ${b3} . ${c3}") -eq 3 ]
+ render ${tmp} | ${NFT} -f -
- ! ${NFT} "add element inet filter test \
- { ${a1} . ${b1} . ${c1} };
- add element inet filter test \
- { ${a2} . ${b2} . ${c2} };
- add element inet filter test \
- { ${a3} . ${b3} . ${c3} }" 2>/dev/null
+ [ $(${NFT} list ${setmap} inet filter test | \
+ grep -c -e "${a1} . ${b1} . ${c1}${mapv}" \
+ -e "${a2} . ${b2} . ${c2}${mapv}" \
+ -e "${a3} . ${b3} . ${c3}${mapv}") -eq 3 ]
${NFT} delete element inet filter test \
- "{ ${a1} . ${b1} . ${c1} }"
- ! ${NFT} delete element inet filter test \
- "{ ${a1} . ${b1} . ${c1} }" 2>/dev/null
+ "{ ${a1} . ${b1} . ${c1}${mapv} }"
+ ${NFT} delete element inet filter test \
+ "{ ${a1} . ${b1} . ${c1}${mapv} }" \
+ 2>/dev/null && exit 1
eval add_a=\$ADD_${ta}
eval add_b=\$ADD_${tb}
eval add_c=\$ADD_${tc}
${NFT} add element inet filter test \
- "{ ${add_a} . ${add_b} . ${add_c} timeout 1s}"
- [ $(${NFT} list set inet filter test | \
+ "{ ${add_a} . ${add_b} . ${add_c} timeout 1s${mapv}}"
+ [ $(${NFT} list ${setmap} inet filter test | \
grep -c "${add_a} . ${add_b} . ${add_c}") -eq 1 ]
- ! ${NFT} add element inet filter test \
- "{ ${add_a} . ${add_b} . ${add_c} timeout 1s}" \
- 2>/dev/null
eval get_a=\$GET_${ta}
eval get_b=\$GET_${tb}
@@ -150,31 +158,36 @@ for ta in ${TYPES}; do
exp_b=${get_b##* }; get_b=${get_b%% *}
exp_c=${get_c##* }; get_c=${get_c%% *}
[ $(${NFT} get element inet filter test \
- "{ ${get_a} . ${get_b} . ${get_c} }" | \
+ "{ ${get_a} . ${get_b} . ${get_c}${mapv} }" | \
grep -c "${exp_a} . ${exp_b} . ${exp_c}") -eq 1 ]
${NFT} "delete element inet filter test \
- { ${a2} . ${b2} . ${c2} };
+ { ${a2} . ${b2} . ${c2}${mapv} };
delete element inet filter test \
- { ${a3} . ${b3} . ${c3} }"
- ! ${NFT} "delete element inet filter test \
- { ${a2} . ${b2} . ${c2} };
+ { ${a3} . ${b3} . ${c3}${mapv} }"
+ ${NFT} "delete element inet filter test \
+ { ${a2} . ${b2} . ${c2}${mapv} };
delete element inet filter test \
- { ${a3} . ${b3} . ${c3} }" 2>/dev/null
+ { ${a3} . ${b3} . ${c3} ${mapv} }" \
+ 2>/dev/null && exit 1
if [ ${timeout_tested} -eq 1 ]; then
${NFT} delete element inet filter test \
- "{ ${add_a} . ${add_b} . ${add_c} }"
- ! ${NFT} delete element inet filter test \
- "{ ${add_a} . ${add_b} . ${add_c} }" \
- 2>/dev/null
+ "{ ${add_a} . ${add_b} . ${add_c} ${mapv} }"
+ ${NFT} delete element inet filter test \
+ "{ ${add_a} . ${add_b} . ${add_c} ${mapv} }" \
+ 2>/dev/null && exit 1
continue
fi
sleep 1
- [ $(${NFT} list set inet filter test | \
- grep -c "${add_a} . ${add_b} . ${add_c}") -eq 0 ]
+ [ $(${NFT} list ${setmap} inet filter test | \
+ grep -c "${add_a} . ${add_b} . ${add_c} ${mapv}") -eq 0 ]
timeout_tested=1
done
done
done
+}
+
+run_test "set"
+run_test "map"
diff --git a/tests/shell/testcases/sets/0044interval_overlap_0 b/tests/shell/testcases/sets/0044interval_overlap_0
index fad92ddc..face90f2 100755
--- a/tests/shell/testcases/sets/0044interval_overlap_0
+++ b/tests/shell/testcases/sets/0044interval_overlap_0
@@ -7,6 +7,20 @@
# existing one
# - for concatenated ranges, the new element is less specific than any existing
# overlapping element, as elements are evaluated in order of insertion
+#
+# Then, repeat the test with a set configured with a timeout, checking that:
+# - we can insert all the elements as described above
+# - once the timeout has expired, we can insert all the elements again, and old
+# elements are not present
+# - before the timeout expires again, we can re-add elements that are not
+# expected to fail, but old elements might be present
+#
+# If $NFT points to a libtool wrapper, and we're running on a slow machine or
+# kernel (e.g. KASan enabled), it might not be possible to execute hundreds of
+# commands within an otherwise reasonable 1 second timeout. Estimate a usable
+# timeout first, by counting commands and measuring against one nft rule timeout
+# itself, so that we can keep this fast for a binary $NFT on a reasonably fast
+# kernel.
# Accept Interval List
intervals_simple="
@@ -32,35 +46,119 @@ intervals_concat="
y 0-2 . 0-3 0-2 . 0-3
n 0-1 . 0-2 0-2 . 0-3
y 10-20 . 30-40 0-2 . 0-3, 10-20 . 30-40
- n 15-20 . 50-60 0-2 . 0-3, 10-20 . 30-40, 15-20 . 50-60
+ y 15-20 . 50-60 0-2 . 0-3, 10-20 . 30-40, 15-20 . 50-60
y 3-9 . 4-29 0-2 . 0-3, 10-20 . 30-40, 15-20 . 50-60, 3-9 . 4-29
y 3-9 . 4-29 0-2 . 0-3, 10-20 . 30-40, 15-20 . 50-60, 3-9 . 4-29
n 11-19 . 30-40 0-2 . 0-3, 10-20 . 30-40, 15-20 . 50-60, 3-9 . 4-29
y 15-20 . 49-61 0-2 . 0-3, 10-20 . 30-40, 15-20 . 50-60, 3-9 . 4-29, 15-20 . 49-61
"
-$NFT add table t
-$NFT add set t s '{ type inet_service ; flags interval ; }'
-$NFT add set t c '{ type inet_service . inet_service ; flags interval ; }'
+count_elements() {
+ pass=
+ interval=
+ elements=0
+ for t in ${intervals_simple} ${intervals_concat}; do
+ [ -z "${pass}" ] && pass="${t}" && continue
+ [ -z "${interval}" ] && interval="${t}" && continue
+ unset IFS
+
+ elements=$((elements + 1))
-IFS='
+ IFS='
'
-set="s"
-for t in ${intervals_simple} switch ${intervals_concat}; do
- [ "${t}" = "switch" ] && set="c" && continue
- [ -z "${pass}" ] && pass="${t}" && continue
- [ -z "${interval}" ] && interval="${t}" && continue
-
- if [ "${pass}" = "y" ]; then
- $NFT add element t ${set} "{ ${interval} }"
- else
- ! $NFT add element t ${set} "{ ${interval} }" 2>/dev/null
+ done
+ unset IFS
+}
+
+match_elements() {
+ skip=0
+ n=0
+ out=
+ for a in $($NFT list set t ${1})}; do
+ [ ${n} -eq 0 ] && { [ "${a}" = "elements" ] && n=1; continue; }
+ [ ${n} -eq 1 ] && { [ "${a}" = "=" ] && n=2; continue; }
+ [ ${n} -eq 2 ] && { [ "${a}" = "{" ] && n=3; continue; }
+
+ [ "${a}" = "}" ] && break
+
+ [ ${skip} -eq 1 ] && skip=0 && out="${out}," && continue
+ [ "${a}" = "expires" ] && skip=1 && continue
+
+ [ -n "${out}" ] && out="${out} ${a}" || out="${a}"
+
+ done
+
+ if [ "${out%,}" != "${2}" ]; then
+ echo "Expected: ${2}, got: ${out%,}"
+ return 1
fi
- $NFT list set t ${set} | tr -d '\n\t' | tr -s ' ' | \
- grep -q "elements = { ${t} }"
+}
+
+estimate_timeout() {
+ count_elements
+ $NFT add table t
+ $NFT add set t s '{ type inet_service ; flags timeout; timeout 1s; gc-interval 1s; }'
+ execs_1s=1
+ $NFT add element t s "{ 0 }"
+ while match_elements s "0" >/dev/null; do
+ execs_1s=$((execs_1s + 1))
+ done
+
+ timeout="$((elements / execs_1s * 3 / 2 + 1))"
+}
+
+add_elements() {
+ set="s"
pass=
interval=
-done
+ IFS='
+'
+ for t in ${intervals_simple} switch ${intervals_concat}; do
+ [ "${t}" = "switch" ] && set="c" && continue
+ [ -z "${pass}" ] && pass="${t}" && continue
+ [ -z "${interval}" ] && interval="${t}" && continue
+ unset IFS
+
+ if [ "${pass}" = "y" ]; then
+ if ! $NFT add element t ${set} "{ ${interval} }"; then
+ echo "Failed to insert ${interval} given:"
+ $NFT list ruleset
+ exit 1
+ fi
+ else
+ if $NFT add element t ${set} "{ ${interval} }" 2>/dev/null; then
+ echo "Could insert ${interval} given:"
+ $NFT list ruleset
+ exit 1
+ fi
+ fi
+
+ [ "${1}" != "nomatch" ] && match_elements "${set}" "${t}"
+
+ pass=
+ interval=
+ IFS='
+'
+ done
+ unset IFS
+}
+
+$NFT add table t
+$NFT add set t s '{ type inet_service ; flags interval ; }'
+$NFT add set t c '{ type inet_service . inet_service ; flags interval ; }'
+add_elements
+
+$NFT flush ruleset
+estimate_timeout
+
+$NFT flush ruleset
+$NFT add table t
+$NFT add set t s "{ type inet_service ; flags interval,timeout; timeout ${timeout}s; gc-interval ${timeout}s; }"
+$NFT add set t c "{ type inet_service . inet_service ; flags interval,timeout ; timeout ${timeout}s; gc-interval ${timeout}s; }"
+add_elements
+
+sleep $((timeout * 3 / 2))
+add_elements
-unset IFS
+add_elements nomatch
diff --git a/tests/shell/testcases/sets/0048set_counters_0 b/tests/shell/testcases/sets/0048set_counters_0
new file mode 100755
index 00000000..e62d25df
--- /dev/null
+++ b/tests/shell/testcases/sets/0048set_counters_0
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+set -e
+
+EXPECTED="table ip x {
+ set y {
+ typeof ip saddr
+ counter
+ elements = { 192.168.10.35, 192.168.10.101, 192.168.10.135 }
+ }
+
+ chain z {
+ type filter hook output priority filter; policy accept;
+ ip daddr @y
+ }
+}"
+
+$NFT -f - <<< "$EXPECTED"
diff --git a/tests/shell/testcases/sets/0049set_define_0 b/tests/shell/testcases/sets/0049set_define_0
new file mode 100755
index 00000000..1d512f7b
--- /dev/null
+++ b/tests/shell/testcases/sets/0049set_define_0
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+EXPECTED="define BASE_ALLOWED_INCOMING_TCP_PORTS = {22, 80, 443}
+define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {}
+
+table inet filter {
+ chain input {
+ type filter hook input priority 0; policy drop;
+ tcp dport {\$BASE_ALLOWED_INCOMING_TCP_PORTS, \$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
+ }
+}
+"
+
+$NFT -f - <<< "$EXPECTED"
diff --git a/tests/shell/testcases/sets/0050set_define_1 b/tests/shell/testcases/sets/0050set_define_1
new file mode 100755
index 00000000..c12de177
--- /dev/null
+++ b/tests/shell/testcases/sets/0050set_define_1
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -e
+
+EXPECTED="define BASE_ALLOWED_INCOMING_TCP_PORTS = {}
+
+table inet filter {
+ chain input {
+ type filter hook input priority 0; policy drop;
+ tcp dport {\$BASE_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept
+ }
+}
+"
+
+$NFT -f - <<< "$EXPECTED" &> /dev/null || exit 0
+echo "E: Accepted empty set" 1>&2
+exit 1
diff --git a/tests/shell/testcases/sets/0051set_interval_counter_0 b/tests/shell/testcases/sets/0051set_interval_counter_0
new file mode 100755
index 00000000..ea90e264
--- /dev/null
+++ b/tests/shell/testcases/sets/0051set_interval_counter_0
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -e
+
+EXPECTED="table ip x {
+ set s {
+ type ipv4_addr
+ flags interval
+ counter
+ elements = { 192.168.2.0/24 }
+ }
+
+ chain y {
+ type filter hook output priority filter; policy accept;
+ ip daddr @s
+ }
+}"
+
+$NFT -f - <<< "$EXPECTED"
diff --git a/tests/shell/testcases/sets/0052overlap_0 b/tests/shell/testcases/sets/0052overlap_0
new file mode 100755
index 00000000..c2960945
--- /dev/null
+++ b/tests/shell/testcases/sets/0052overlap_0
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+EXPECTED="add table ip filter
+add set ip filter w_all {type ipv4_addr; flags interval; auto-merge}
+add element ip filter w_all {10.10.10.10, 10.10.10.11}
+"
+
+$NFT -f - <<< "$EXPECTED"
+
+EXPECTED="flush set ip filter w_all
+add element ip filter w_all {10.10.10.10, 10.10.10.253}
+"
+
+$NFT -f - <<< "$EXPECTED"
diff --git a/tests/shell/testcases/sets/0053echo_0 b/tests/shell/testcases/sets/0053echo_0
new file mode 100755
index 00000000..6bb03c28
--- /dev/null
+++ b/tests/shell/testcases/sets/0053echo_0
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+EXPECTED="add table inet filter
+delete table inet filter
+
+table inet filter {
+ chain input {
+ type filter hook input priority filter; policy drop;
+ iifname { lo } ip saddr { 10.0.0.0/8 } ip daddr { 192.168.100.62 } tcp dport { 2001 } counter accept
+ }
+}
+"
+
+$NFT -ef - <<< "$EXPECTED"
diff --git a/tests/shell/testcases/sets/dumps/0048set_counters_0.nft b/tests/shell/testcases/sets/dumps/0048set_counters_0.nft
new file mode 100644
index 00000000..2145f6b1
--- /dev/null
+++ b/tests/shell/testcases/sets/dumps/0048set_counters_0.nft
@@ -0,0 +1,13 @@
+table ip x {
+ set y {
+ typeof ip saddr
+ counter
+ elements = { 192.168.10.35 counter packets 0 bytes 0, 192.168.10.101 counter packets 0 bytes 0,
+ 192.168.10.135 counter packets 0 bytes 0 }
+ }
+
+ chain z {
+ type filter hook output priority filter; policy accept;
+ ip daddr @y
+ }
+}
diff --git a/tests/shell/testcases/sets/dumps/0049set_define_0.nft b/tests/shell/testcases/sets/dumps/0049set_define_0.nft
new file mode 100644
index 00000000..998b387a
--- /dev/null
+++ b/tests/shell/testcases/sets/dumps/0049set_define_0.nft
@@ -0,0 +1,6 @@
+table inet filter {
+ chain input {
+ type filter hook input priority filter; policy drop;
+ tcp dport { 22, 80, 443 } ct state new counter packets 0 bytes 0 accept
+ }
+}
diff --git a/tests/shell/testcases/sets/dumps/0051set_interval_counter_0.nft b/tests/shell/testcases/sets/dumps/0051set_interval_counter_0.nft
new file mode 100644
index 00000000..fd488a76
--- /dev/null
+++ b/tests/shell/testcases/sets/dumps/0051set_interval_counter_0.nft
@@ -0,0 +1,13 @@
+table ip x {
+ set s {
+ type ipv4_addr
+ flags interval
+ counter
+ elements = { 192.168.2.0/24 counter packets 0 bytes 0 }
+ }
+
+ chain y {
+ type filter hook output priority filter; policy accept;
+ ip daddr @s
+ }
+}
diff --git a/tests/shell/testcases/sets/dumps/0052overlap_0.nft b/tests/shell/testcases/sets/dumps/0052overlap_0.nft
new file mode 100644
index 00000000..1cc02ada
--- /dev/null
+++ b/tests/shell/testcases/sets/dumps/0052overlap_0.nft
@@ -0,0 +1,8 @@
+table ip filter {
+ set w_all {
+ type ipv4_addr
+ flags interval
+ auto-merge
+ elements = { 10.10.10.10, 10.10.10.253 }
+ }
+}
diff --git a/tests/shell/testcases/sets/dumps/0053echo_0.nft b/tests/shell/testcases/sets/dumps/0053echo_0.nft
new file mode 100644
index 00000000..6a816636
--- /dev/null
+++ b/tests/shell/testcases/sets/dumps/0053echo_0.nft
@@ -0,0 +1,6 @@
+table inet filter {
+ chain input {
+ type filter hook input priority filter; policy drop;
+ iifname { "lo" } ip saddr { 10.0.0.0/8 } ip daddr { 192.168.100.62 } tcp dport { 2001 } counter packets 0 bytes 0 accept
+ }
+}
diff --git a/tests/shell/testcases/transactions/0002table_0 b/tests/shell/testcases/transactions/0002table_0
index 246b1092..c5f31a6f 100755
--- a/tests/shell/testcases/transactions/0002table_0
+++ b/tests/shell/testcases/transactions/0002table_0
@@ -5,6 +5,7 @@ set -e
RULESET="add table x
delete table x
add table x
+add chain x y { type nat hook prerouting priority 0; policy accept; }
add table x { flags dormant; }"
$NFT -f - <<< "$RULESET"
diff --git a/tests/shell/testcases/transactions/dumps/0002table_0.nft b/tests/shell/testcases/transactions/dumps/0002table_0.nft
index 6eb70726..429cbc34 100644
--- a/tests/shell/testcases/transactions/dumps/0002table_0.nft
+++ b/tests/shell/testcases/transactions/dumps/0002table_0.nft
@@ -1,3 +1,7 @@
table ip x {
flags dormant
+
+ chain y {
+ type nat hook prerouting priority filter; policy accept;
+ }
}