summaryrefslogtreecommitdiffstats
path: root/tests/py/any
Commit message (Collapse)AuthorAgeFilesLines
* tests: py: Drop needless recorded JSON outputsPhil Sutter2024-04-122-187/+0
| | | | | | These match the input already, no need to track them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: Fix some JSON equivalentsPhil Sutter2024-04-122-3/+3
| | | | | | | | | | | | Make sure they match the standard syntax input as much as possible. For some reason inet/tcp.t.json was using plain arrays in place of binary OR expressions in many cases. These arrays are interpreted as list expressions, which seems to be semantically identical but the goal here is to present an accurate equivalent to the rule in standard syntax. Signed-off-by: Phil Sutter <phil@nwl.cc>
* datatype: use DTYPE_F_PREFIX only for IP address datatypePablo Neira Ayuso2024-03-212-10/+10
| | | | | | | | | | | | | | | | | DTYPE_F_PREFIX flag provides a hint to the netlink delinearize path to use prefix notation. It seems use of prefix notation in meta mark causes confusion, users expect to see prefix in the listing only in IP address datatypes. Untoggle this flag so (more lengthy) binop output such as: meta mark & 0xffffff00 == 0xffffff00 is used instead. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1739 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: remove huge-limit test casesFlorian Westphal2024-01-194-100/+0
| | | | | | | These tests will fail once the kernel checks for overflow in the internal token bucken counter, so drop them. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: missing json output in meta.t with vlan mappingPablo Neira Ayuso2023-12-111-0/+60
| | | | | | | | | | Fix this warning due to missing coverage: tests/py/any/meta.t.json.got: WARNING: line 2: Wrote JSON equivalent for rule meta mark set vlan id map { 1 : 0x00000001, 4095 : 0x00004095 } ERROR: did not find JSON equivalent for rule 'meta mark set vlan id map @map1 Fixes: 8d3de823b622 ("evaluate: reset statement length context before evaluating statement") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reset statement length context before evaluating statementPablo Neira Ayuso2023-12-083-0/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch consolidates ctx->stmt_len reset in stmt_evaluate() to avoid this problem. Note that stmt_evaluate_meta() and stmt_evaluate_ct() already reset it after the statement evaluation. Moreover, statement dependency can be generated while evaluating a meta and ct statement. Payload statement dependency already manually stashes this before calling stmt_evaluate(). Add a new stmt_dependency_evaluate() function to stash statement length context when evaluating a new statement dependency and use it for all of the existing statement dependencies. Florian also says: 'meta mark set vlan id map { 1 : 0x00000001, 4095 : 0x00004095 }' will crash. Reason is that the l2 dependency generated here is errounously expanded to a 32bit-one, so the evaluation path won't recognize this as a L2 dependency. Therefore, pctx->stacked_ll_count is 0 and __expr_evaluate_payload() crashes with a null deref when dereferencing pctx->stacked_ll[0]. nft-test.py gains a fugly hack to tolerate '!map typeof vlan id : meta mark'. For more generic support we should find something more acceptable, e.g. !map typeof( everything here is a key or data ) timeout ... tests/py update and assert(pctx->stacked_ll_count) by Florian Westphal. Fixes: edecd58755a8 ("evaluate: support shifts larger than the width of the left operand") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* limit: display default burst when listing rulesetPablo Neira Ayuso2023-09-201-10/+10
| | | | | | | | | | | | Default burst for limit is 5 for historical reasons but it is not displayed when listing the ruleset. Update listing to display the default burst to disambiguate. man nft(8) has been recently updated to document this, no action in this front is therefore required. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: json: add missing/expected json outputFlorian Westphal2023-06-241-0/+14
| | | | | | | | | | | | | | nft-test.py generates following warning: any/last.t: WARNING: line 12: '{"nftables": [{"add": {"rule": {"family": "ip", "table": "test-ip4", "chain": "input", "expr": [{"last": {"used": 300000}}]}}}]}': '[{"last": {"used": 300000}}]' mismatches '[{"last": null}]' This is because "last" expression is stateful; but nft-test.py explicitly asks for stateless output. Thus we need to provide a json.output file, without it, nft-test.py uses last.json as the expected output file. Fixes: ae8786756b0c ("src: add json support for last statement") Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add json support for last statementPablo Neira Ayuso2023-06-201-0/+16
| | | | | | | | | | This patch adds json support for the last statement, it works for me here. However, tests/py still displays a warning: any/last.t: WARNING: line 12: '{"nftables": [{"add": {"rule": {"family": "ip", "table": "test-ip4", "chain": "input", "expr": [{"last": {"used": 300000}}]}}}]}': '[{"last": {"used": 300000}}]' mismatches '[{"last": null}]' Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add last statementPablo Neira Ayuso2023-02-282-0/+21
| | | | | | | | | | | | | | | | | | | | | This new statement allows you to know how long ago there was a matching packet. # nft list ruleset table ip x { chain y { [...] ip protocol icmp last used 49m54s884ms counter packets 1 bytes 64 } } if this statement never sees a packet, then the listing says: ip protocol icmp last used never counter packets 0 bytes 0 Add tests/py in this patch too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: do not kill dependency for proto_unknownPablo Neira Ayuso2022-10-313-0/+41
| | | | | | | | | | | | | Unsupported meta match on layer 4 protocol sets on protocol context to proto_unknown, handle anything coming after it as a raw expression in payload_expr_expand(). Moreover, payload_dependency_kill() skips dependency removal if protocol is unknown, so raw payload expression leaves meta layer 4 protocol remains in place. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1641 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow burst 0 for byte ratelimit and use it as defaultPablo Neira Ayuso2022-08-313-30/+30
| | | | | | | | | | | | | | | | | Packet-based limit burst is set to 5, as in iptables. However, byte-based limit burst adds to the rate to calculate the bucket size, and this is also sets this to 5 (... bytes in this case). Update it to use zero byte burst by default instead. This patch also updates manpage to describe how the burst value influences the kernel module's token bucket in each of the two modes. This documentation update is based on original text by Phil Sutter. Adjust tests/py to silence warnings due to mismatching byte burst. Fixes: 285baccfea46 ("src: disallow burst 0 in ratelimits") Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: disable arp family for queue statementPablo Neira Ayuso2022-08-091-1/+0
| | | | | | | | | | | | | | Kernel commit: commit 47f4f510ad586032b85c89a0773fbb011d412425 Author: Florian Westphal <fw@strlen.de> Date: Tue Jul 26 19:49:00 2022 +0200 netfilter: nft_queue: only allow supported familes and hooks restricts supported families, excluding arp. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Add meta time tests without 'meta' keywordMartin Gignac2022-04-103-0/+52
| | | | | | | | | v1.0.2 of 'nft' fails on 'time < "2022-07-01 11:00:00"' but succeeds when 'meta' is specified ('meta time < "2022-07-01 11:00:00"'). This extends coverage by testing 'time' without 'meta'. Signed-off-by: Martin Gignac <martin.gignac@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: extend meta time coveragePablo Neira Ayuso2022-04-083-0/+52
| | | | | | Add meta time tests using < and > operands. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add tcp option reset supportFlorian Westphal2022-02-283-0/+53
| | | | | | | This allows to replace a tcp option with nops, similar to the TCPOPTSTRIP feature of iptables. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: Test connlimit statementPhil Sutter2022-02-203-0/+30
| | | | | | This wasn't covered at all. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: add tcp subtype match test casesFlorian Westphal2021-12-013-0/+78
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: add test cases for md5sig, fastopen and mptcp mnemonicsFlorian Westphal2021-12-013-0/+63
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tcpopt: remove KIND keywordFlorian Westphal2021-12-013-67/+38
| | | | | | | | | | | | | | | | tcp option <foo> kind ... never makes any sense, as "tcp option <foo>" already tells the kernel to look for the foo <kind>. "tcp option sack kind 5" matches if the sack option is present; its a more complicated form of the simpler "tcp option sack exists". "tcp option sack kind 1" (or any other value than 5) will never match. So remove this. Test cases are converted to "exists". Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_json: add raw payload inner header match supportPablo Neira Ayuso2021-11-173-0/+25
| | | | | | | Add missing "ih" base raw payload and extend tests/py to cover this new usecase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: update rawpayload.t.jsonPablo Neira Ayuso2021-11-082-5/+21
| | | | | | | Missing update of json test. Fixes: 6ad2058da66a ("datatype: add xinteger_type alias to print in hexadecimal") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: add xinteger_type alias to print in hexadecimalPablo Neira Ayuso2021-11-032-8/+8
| | | | | | | | | Add an alias of the integer type to print raw payload expressions in hexadecimal. Update tests/py. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: extend limit syntaxJeremy Sowden2021-11-033-0/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The documentation describes the syntax of limit statements thus: limit rate [over] packet_number / TIME_UNIT [burst packet_number packets] limit rate [over] byte_number BYTE_UNIT / TIME_UNIT [burst byte_number BYTE_UNIT] TIME_UNIT := second | minute | hour | day BYTE_UNIT := bytes | kbytes | mbytes From this one might infer that a limit may be specified by any of the following: limit rate 1048576/second limit rate 1048576 mbytes/second limit rate 1048576 / second limit rate 1048576 mbytes / second However, the last does not currently parse: $ sudo /usr/sbin/nft add filter input limit rate 1048576 mbytes / second Error: wrong rate format add filter input limit rate 1048576 mbytes / second ^^^^^^^^^^^^^^^^^^^^^^^^^ Extend the `limit_rate_bytes` parser rule to support it, and add some new Python test-cases. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Support netdev egress hookLukas Wunner2021-10-286-6/+12
| | | | | | | | | Add userspace support for the netdev egress hook which is queued up for v5.16-rc1, complete with documentation and tests. Usage is identical to the ingress hook. Signed-off-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Move netdev-specific tests to appropriate subdirectoryLukas Wunner2021-10-287-153/+0
| | | | | | | | The fwd and dup statements are specific to netdev hooks, so move their tests to the appropriate subdirectory. Signed-off-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: update ct expirationPablo Neira Ayuso2021-09-151-3/+3
| | | | | | | | Since 309785674b25 ("datatype: time_print() ignores -T"), time_type honors -T option. Given tests/py run in numeric format, this patch fixes a warning since the ct expiration is now expressed in seconds. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Optimize prefix match only if is big-endianXiao Liang2021-08-233-0/+27
| | | | | | | | | | | A prefix of integer type is big-endian in nature. Prefix match can be optimized to truncated 'cmp' only if it is big-endian. [ Add one tests/py for this use-case --pablo ] Fixes: 25338cdb6c77 ("src: Optimize prefix matches on byte-boundaries") Signed-off-by: Xiao Liang <shaw.leon@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: queue: consolidate queue statement syntaxPablo Neira Ayuso2021-08-203-8/+113
| | | | | | | | | | | | Print queue statement using the 'queue ... to' syntax to consolidate the syntax around Florian's proposal introduced in 6cf0f2c17bfb ("src: queue: allow use of arbitrary queue expressions"). Retain backward compatibility, 'queue num' syntax is still allowed. Update and add new tests. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tcpopt: bogus assertion on undefined optionsPablo Neira Ayuso2021-08-113-0/+23
| | | | | | | | | | # nft add rule x y tcp option 6 exists # nft list ruleset nft: tcpopt.c:208: tcpopt_init_raw: Assertion `expr->exthdr.desc != NULL' failed. Aborted Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1557 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: queue: allow use of MAP statement for queue number retrievalFlorian Westphal2021-06-213-0/+44
| | | | | | | | | This allows to chose a queue number at run time using map statements, e.g.: queue flags bypass to ip saddr map { 192.168.7/24 : 0, 192.168.0/24 : 1 } Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: extend queue testcases for new sreg supportFlorian Westphal2021-06-213-0/+82
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: new queue flag input formatFlorian Westphal2021-06-211-4/+3
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: remove redundant test casesFlorian Westphal2021-06-073-82/+0
| | | | | | | | | | | | | Check for ... 23-42 ... ... { 23-42 } ... and remove the latter. Followup patch will translate the former to the latter during evaluation step to avoid the unneded anon set. A separate test case will be added that checks for such rewrites. Signed-off-by: Florian Westphal <fw@strlen.de>
* proto: replace vlan ether type with 8021qFlorian Westphal2021-04-034-8/+8
| | | | | | | | | | | | | Previous patches added "8021ad" mnemonic for IEEE 802.1AD frame type. This adds the 8021q shorthand for the existing 'vlan' frame type. nft will continue to recognize 'ether type vlan', but listing will now print 8021q. Adjust all test cases accordingly. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: fix scope closure of COUNTER tokenFlorian Westphal2021-03-254-0/+96
| | | | | | | | | It is closed after allocation, which is too early: this stopped 'packets' and 'bytes' from getting parsed correctly. Also add a test case for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: Fix for missing JSON equivalent in any/ct.t.jsonPhil Sutter2021-03-091-0/+15
| | | | | | | JSON equivalent for recently added test of the '!' shortcut was missing. Fixes: e6c32b2fa0b82 ("src: add negation match on singleton bitmask value") Signed-off-by: Phil Sutter <phil@nwl.cc>
* mnl: Set NFTNL_SET_DATA_TYPE before dumping set elementsPhil Sutter2021-03-092-2/+2
| | | | | | | | In combination with libnftnl's commit "set_elem: Fix printing of verdict map elements", This adds the vmap target to netlink dumps. Adjust dumps in tests/py accordingly. Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: add negation match on singleton bitmask valuePablo Neira Ayuso2021-02-052-0/+7
| | | | | | | | | | | | | | | | | This patch provides a shortcut for: ct status and dnat == 0 which allows to check for the packet whose dnat bit is unset: # nft add rule x y ct status ! dnat counter This operation is only available for expression with a bitmask basetype, eg. # nft describe ct status ct expression, datatype ct_status (conntrack status) (basetype bitmask, integer), 32 bits Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Add a test sanitizer and fix its findingsPhil Sutter2021-02-046-104/+41
| | | | | | | | | | | | | | | | This is just basic housekeeping: - Remove duplicate tests in any of the *.t files - Remove explicit output if equal to command itself in *.t files - Remove duplicate payload records in any of the *.t.payload* files - Remove stale payload records (for which no commands exist in the respective *.t file - Remove duplicate/stale entries in any of the *.t.json files In some cases, tests were added instead of removing a stale payload record if it fit nicely into the sequence of tests. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: limit: Always include burst valuePhil Sutter2021-01-271-0/+277
| | | | | | The default burst value is non-zero, so JSON output should include it. Signed-off-by: Phil Sutter <phil@nwl.cc>
* exthdr: remove tcp dependency for tcp option matchingFlorian Westphal2021-01-261-60/+0
| | | | | | Kernel won't search for tcp options in non-tcp packets. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: disallow burst 0 in ratelimitsPablo Neira Ayuso2020-12-181-22/+22
| | | | | | | | | | | | The ratelimiter in nftables is similar to the one in iptables, and iptables disallows a zero burst. Update the byte rate limiter not to print burst 5 (default value). Update tests/py payloads to print burst 5 instead of zero when the burst is unspecified. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: update format of registers in bitwise payloads.Jeremy Sowden2020-11-163-22/+22
| | | | | | | | | libnftnl has been changed to bring the format of registers in bitwise dumps in line with those in other types of expression. Update the expected output of Python test-cases. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: remove duplicate payloads.Jeremy Sowden2020-11-092-350/+0
| | | | | | | | | nft-test.py only needs one payload per rule, but a number of rules have duplicates, typically one per address family, so just keep the last payload for rules listed more than once. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* json: tcp: add raw tcp option match supportFlorian Westphal2020-11-091-0/+34
| | | | | | | | | To similar change as in previous one, this time for the jason (de)serialization. Re-uses the raw payload match syntax, i.e. base,offset,length. Signed-off-by: Florian Westphal <fw@strlen.de>
* tcp: add raw tcp option match supportFlorian Westphal2020-11-092-0/+9
| | | | | | tcp option @42,16,4 (@kind,offset,length). Signed-off-by: Florian Westphal <fw@strlen.de>
* tcpopt: allow to check for presence of any tcp optionFlorian Westphal2020-11-092-49/+6
| | | | | | | | | | | | | nft currently doesn't allow to check for presence of arbitrary tcp options. Only known options where nft provides a template can be tested for. This allows to test for presence of raw protocol values as well. Example: tcp option 42 exists Signed-off-by: Florian Westphal <fw@strlen.de>
* tcpopt: rename noop to nopFlorian Westphal2020-11-093-18/+4
| | | | | | | 'nop' is the tcp padding "option". "noop" is retained for compatibility on parser side. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: merge sack-perm/sack-permitted and maxseg/mssFlorian Westphal2020-11-093-12/+12
| | | | | | | | | | | | | | | | | | | | | | One was added by the tcp option parsing ocde, the other by synproxy. So we have: synproxy ... sack-perm synproxy ... mss and tcp option maxseg tcp option sack-permitted This kills the extra tokens on the scanner/parser side, so sack-perm and sack-permitted can both be used. Likewise, 'synproxy maxseg' and 'tcp option mss size 42' will work too. On the output side, the shorter form is now preferred, i.e. sack-perm and mss. Signed-off-by: Florian Westphal <fw@strlen.de>
generated by cgit v1.2.3 (git 2.25.0) at 2025-08-07 08:09:23 +0000