summaryrefslogtreecommitdiffstats
path: root/tests/py/ip
Commit message (Collapse)AuthorAgeFilesLines
* tests: enable ip/ip.t for bridge protocol, tooFlorian Westphal2017-10-262-0/+761
| | | | | | | This does not add any additional warnings, it just increases coverage to bridge. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: fix harmess typo in table nameFlorian Westphal2017-10-262-3/+3
| | | | | | table name should be 'test-ip', not inet. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_linearize: skip set element expression in set statement keyAnders K. Pedersen2017-10-064-0/+51
| | | | | | | | | | | | | | | | | | | | Before this patch the following fails: # nft add rule ip6 filter x \ set add ip6 saddr . ip6 daddr @test nft: netlink_linearize.c:648: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. Aborted This is was previously fixed for flow statements in fbea4a6f4449 ("netlink_linearize: skip set element expression in flow table key"), and this patch implements the same change for set statements by using the set element key in netlink_gen_set_stmt(). nft-test.py is updated to support set types with concatenated data types in order to support testing of this. Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: rt: fix test casesFlorian Westphal2017-09-291-1/+2
| | | | | | | | | | nfproto meta dependency is no longer needed, keep one test since we still support this syntax. When meta is not provided, no need to add a dependency because nft_rt already checks pf number before checking skb->dst. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: ct: adjust test case commandsFlorian Westphal2017-09-292-17/+17
| | | | | | use 'ip saddr', 'ip6 saddr', etc. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: add tests for limit stateful objectPablo M. Bermudo Garay2017-09-042-3/+33
| | | | | | | The patch also reorganizes ip/objects.t file. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add test case for ttl/protocol setFlorian Westphal2017-08-174-0/+58
| | | | | | | | | nft .. ip ttl set 42 did set the protocol field and left ttl alone, add test cases for this. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Add test for ambiguity while setting the valueShyam Saini2017-06-181-0/+2
| | | | | | | | | | | | | | | | | | | | | This test checks bug identified and fixed in the commit mentioned below In a statement if there are multiple src data then it would be totally ambiguous to decide which value to set. Before the commit was made it returned 134(BUG), but now it returns 1 i.e, an error message. Following rules tests ambiguity while setting the value: $ sudo nft add rule ip test-ip4 output ct mark set {0x11333, 0x11} <cmdline>:1:41-55: Error: you cannot use a set here, unknown value to use add rule ip test-ip4 output ct mark set {0x11333, 0x11} ~~~~~~~~~~~~^^^^^^^^^^^^^^^ Test: 986dea8 ("evaluate: avoid reference to multiple src data in statements which set values") Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: fix up meta l4proto change for ip familyFlorian Westphal2017-05-1910-154/+154
| | | | | | | We can delete some of the payload files now as ip/ip6/inet produce same implicit meta l4proto dep. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add ip reject with tcp and check for mark tooFlorian Westphal2017-05-182-0/+9
| | | | | | | ... to avoid resetting e.g. the ssh session to the vm that runs nft-test.py. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: don't kill dependencies accross statementsFlorian Westphal2017-05-082-0/+26
| | | | | | add a test case for previous commit. Signed-off-by: Florian Westphal <fw@strlen.de>
* hash: generate a random seed if seed option is emptyLiping Zhang2017-04-152-0/+8
| | | | | | | | | | | Typing the "nft add rule x y ct mark set jhash ip saddr mod 2" will not generate a random seed, instead, the seed will always be zero. So if seed option is empty, we shoulde not set the NFTA_HASH_SEED attribute, then a random seed will be generated in the kernel. Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Add test cases for nested anonymous setsPhil Sutter2017-03-224-0/+57
| | | | | | | | | This makes sure nesting of anonymous sets works regardless of whether defines are used or not. As a side-effect, it also checks that overlap checking when IP address prefixes are used, works. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add insert-failure testFlorian Westphal2017-03-161-0/+1
| | | | | | | It should not be possible to add a ip6 restricted helper to ip family. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add ct helper testsFlorian Westphal2017-03-162-0/+18
| | | | | | | needs minor tweak to nft-test.py so we don't zap the ';' withhin the {}. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: hash: support of symmetric hashLaura Garcia Liebana2017-03-062-0/+5
| | | | | | | | | | | | | | | | | | | | | This patch provides symmetric hash support according to source ip address and port, and destination ip address and port. The new attribute NFTA_HASH_TYPE has been included to support different types of hashing functions. Currently supported NFT_HASH_JENKINS through jhash and NFT_HASH_SYM through symhash. The main difference between both types are: - jhash requires an expression with sreg, symhash doesn't. - symhash supports modulus and offset, but not seed. Examples: nft add rule ip nat prerouting ct mark set jhash ip saddr mod 2 nft add rule ip nat prerouting ct mark set symhash mod 2 Signed-off-by: Laura Garcia Liebana <laura.garcia@zevenet.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: revisit tcp options supportPablo Neira Ayuso2017-02-282-20/+20
| | | | | | | | | | | | | | | | | | | Rework syntax, add tokens so we can extend the grammar more easily. This has triggered several syntax changes with regards to the original patch, specifically: tcp option sack0 left 1 There is no space between sack and the block number anymore, no more offset field, now they are a single field. Just like we do with rt, rt0 and rt2. This simplifies our grammar and that is good since it makes our life easier when extending it later on to accomodate new features. I have also renamed sack_permitted to sack-permitted. I couldn't find any option using underscore so far, so let's keep it consistent with what we have. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: fix incorrect bytecode in numgen and hash mappingsPablo Neira Ayuso2017-02-252-2/+2
| | | | | | | Byteorder is not correct as it is expressed in network byteorder. This uncovered when storing set byteorder in NFTA_USER_DATA. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Add basic tests for ip, ip6 and inetManuel Messner2017-02-122-0/+219
| | | | | Signed-off-by: Manuel Messner <mm@skelett.io> Signed-off-by: Florian Westphal <fw@strlen.de>
* statement: fix print of ip dnat addressFlorian Westphal2017-02-052-0/+13
| | | | | | | | | | | | the change causes non-ipv6 addresses to not be printed at all in case a nfproto was given. Also add a test case to catch this. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1117 Fixes: 5ab0e10fc6e2c22363a ("src: support for RFC2732 IPv6 address format with brackets") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Add tests for stateful objectsElise Lennion2017-01-272-0/+46
| | | | | | | | These test for adding counters and quotas, to tables of different families, and for referencing the objects in rules. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Use stateless option on testsElise Lennion2017-01-186-6/+6
| | | | | | | | | | | To don't trigger false errors because of unrelated traffic on the tested machine. Tests, which have rules with counter and 'ok' result, are updated to avoid new Warnings. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: update quota and payloadPablo Neira Ayuso2016-12-143-21/+21
| | | | | | Include new consumed field for quota, and check for csum_flags in payload. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: don't send empty set elements netlink message to kernelPablo Neira Ayuso2016-12-142-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following command: # nft --debug=mnl add rule x y flow table xyz { ip saddr timeout 30s counter } breaks with EINVAL. The following netlink message is causing the problem: ... ---------------- ------------------ | 0000000044 | | message length | | 02572 | R--- | | type | flags | | 0000000004 | | sequence number| | 0000000000 | | port ID | ---------------- ------------------ | 02 00 00 00 | | extra header | |00008|--|00002| |len |flags| type| | 78 79 7a 00 | | data | x y z |00008|--|00004| |len |flags| type| | 00 00 00 01 | | data | |00006|--|00001| |len |flags| type| | 78 00 00 00 | | data | x ---------------- ------------------ ... This is incorrect since this describes no elements at all, so it is useless. Add upfront check before iterating over the list of set elements so the netlink message is not placed in the batch. This patch also adds a set so flow tables are minimally covered. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Unmask negative set lookupAnatole Denis2016-11-2914-53/+659
| | | | | | | | Many testcases were masked because of bug #888. This series of patches unmasks them Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add some testcases for log flagsPablo Neira Ayuso2016-11-141-1/+1
| | | | | | | Remove null and zero flags from tests, to reduce the noise when running tests. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add offset attribute for hash expressionLaura Garcia Liebana2016-11-092-0/+16
| | | | | | | | | | | Add support to add an offset to the hash generator, eg. ct mark set hash ip saddr mod 10 offset 100 This will generate marks with series between 100-109. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: make hash seed attribute optionalLaura Garcia Liebana2016-11-092-0/+8
| | | | | | | | | | | | | | | | | | The hash expression requires a seed attribute to call the jhash operation, eg. # nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 \ seed 0xdeadbeef With this patch the seed attribute is optional and it's generated by a random function from userspace, eg. # nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 The kernel will take care of generate a random seed. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: add missing payload test for numgen offsetPablo Neira Ayuso2016-10-311-0/+5
| | | | | | | | | | The new cover test for: ct mark set numgen inc mod 2 offset 100 was lacking the payload file chunk. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Replace tests/files/expr-rt with Python based tests, and replace ether typeAnders K. Pedersen2016-10-292-0/+11
| | | | | | | with meta nfproto, which generates a bit fewer instructions. Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add offset attribute for numgen expressionLaura Garcia Liebana2016-10-271-0/+1
| | | | | | | | | | | | | Add support to add an offset to the numgen generated value. Example: ct mark set numgen inc mod 2 offset 100 This will generate marks with serie like 100, 101, 100, ... Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support ct l3proto/protocol without direction syntaxLiping Zhang2016-10-172-8/+8
| | | | | | | | | | | | | | | Acctually, ct l3proto and ct protocol are unrelated to direction, so it's unnecessary that we must specify dir if we want to use them. Now add support that we can match ct l3proto/protocol without direction: # nft add rule filter input ct l3proto ipv4 # nft add rule filter output ct protocol 17 Note: existing syntax is still preserved, so "ct reply l3proto ipv6" is still fine. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use new range expression for != [a,b] intervalsPablo Neira Ayuso2016-10-176-68/+34
| | | | | | | Use new range expression in the kernel to fix wrong bytecode generation. This patch also adjust tests so we don't hit problems there. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: fix numgen case failed due to changes in libnftnlLiping Zhang2016-09-231-3/+3
| | | | | | | | | | | | In nftnl_expr_ng_snprintf_default, format "(%u)" was changed to "mod %u", so numgen test case failed: ... '[ numgen reg 1 = inc(2) ]' mismatches '[ numgen reg 1 = inc mod 2 ]' ... ip/numgen.t: 3 unit tests, 3 error, 0 warning Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: replace "eth0" with "lo" in dup expr testsLiping Zhang2016-09-122-6/+6
| | | | | | | | | | | | | | This patch follow up on Manuel's commit a8871ba6daa0 ("tests: py: any: Make tests more generic by using other interfaces"). The ifindex of "eth0" is not always 1, furthermore, "eth0" maybe not exist on some systems. So replace it with "lo" will make tests more rubost. In other test cases, "eth0" is used by iifname or oifname, so there's no need to convert it to "lo". Even if "eth0" is not exist, test will never fail. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: adapt netlink bytecode output of numgen and hashPablo Neira Ayuso2016-08-302-5/+5
| | | | | | Adapt them to the revisited output string now in libnftnl. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add hash expressionPablo Neira Ayuso2016-08-292-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This is special expression that transforms an input expression into a 32-bit unsigned integer. This expression takes a modulus parameter to scale the result and the random seed so the hash result becomes harder to predict. You can use it to set the packet mark, eg. # nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 seed 0xdeadbeef You can combine this with maps too, eg. # nft add rule x y dnat to jhash ip saddr mod 2 seed 0xdeadbeef map { \ 0 : 192.168.20.100, \ 1 : 192.168.30.100 \ } Currently, this expression implements the jenkins hash implementation available in the Linux kernel: http://lxr.free-electrons.com/source/include/linux/jhash.h But it should be possible to extend it to support any other hash function type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add numgen expressionPablo Neira Ayuso2016-08-292-0/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new expression allows us to generate incremental and random numbers bound to a specified modulus value. The following rule sets the conntrack mark of 0 to the first packet seen, then 1 to second packet, then 0 again to the third packet and so on: # nft add rule x y ct mark set numgen inc mod 2 A more useful example is a simple load balancing scenario, where you can also use maps to set the destination NAT address based on this new numgen expression: # nft add rule nat prerouting \ dnat to numgen inc mod 2 map { 0 : 192.168.10.100, 1 : 192.168.20.200 } So this is distributing new connections in a round-robin fashion between 192.168.10.100 and 192.168.20.200. Don't forget the special NAT chain semantics: Only the first packet evaluates the rule, follow up packets rely on conntrack to apply the NAT information. You can also emulate flow distribution with different backend weights using intervals: # nft add rule nat prerouting \ dnat to numgen inc mod 10 map { 0-5 : 192.168.10.100, 6-9 : 192.168.20.200 } So 192.168.10.100 gets 60% of the workload, while 192.168.20.200 gets 40%. We can also be mixed with dynamic sets, thus weight can be updated in runtime. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: adapt it to new add element command semanticsPablo Neira Ayuso2016-08-291-3/+3
| | | | | | | | Since fd33d96 ("src: create element command"), add element doesn't fail anymore if the element exists, you have to use create instead in case you want to check if the element already exists. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: redirect to :port for consistency with nat/masq statementPablo Neira Ayuso2016-08-182-22/+22
| | | | | | | Use the colon port syntax for consistency with other statements. Existing syntax is still preserved but the output displays the colon. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add 'to' for snat and dnatPablo Neira Ayuso2016-08-184-24/+24
| | | | | | | | | | | This is extra syntaxtic sugar to get this consistent with other statements such as redirect, masquerade, dup and fwd that indicates where to go. Existing syntax is still preserved, but the listing shows the one including 'to'. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: quote user-defined strings when used from rule selectorsPablo Neira Ayuso2016-08-186-33/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The following selectors display strings using quotes: * meta iifname * meta oifname * meta ibriport * meta obriport However, the following do not: * meta oif * meta iif * meta skuid * meta skgid * meta iifgroup * meta oifgroup * meta rtclassid * ct label Given they refer to user-defined values, neither keywords nor internal built-in known values, let's quote the output of this. This patch modifies symbolic_constant_print() so we can signal this to indicate if the string needs to be quoted. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: ip payload set support for ecn and dscpFlorian Westphal2016-08-014-0/+123
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add basic payload testsFlorian Westphal2016-07-214-0/+74
| | | | | | | | | | payload set operations should work at least for byte-sized quantities >= 2 byte. Before adding support for odd-sized writes (ecn, dscp, ip6 flowlabel ...) add a bunch of tests to cover current state. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: don't update protocol context if we can't find a descriptionFlorian Westphal2016-06-074-0/+22
| | | | | | | | | | | | | | Since commit 20b1131c07acd2fc ("payload: fix stacked headers protocol context tracking") we deref null pointer if we can't find a description for the desired protocol, so "ip protocol 254" crashes while testing protocols 6 or 17 (tcp, udp) works. Also add a test case for this. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1072 Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: update for changed set name in payloadPablo Neira Ayuso2016-05-139-207/+207
| | | | | | | Original patch posted in the mailing list from Patrick, I have refreshed this so it applies on top of current HEAD. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: add missing netdev ip dscp payload testsPablo Neira Ayuso2016-05-111-0/+43
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add dscp supportPablo Neira Ayuso2016-05-113-5/+81
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This supports both IPv4: # nft --debug=netlink add rule filter forward ip dscp cs1 counter ip filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x000000fc ) ^ 0x00000000 ] [ cmp neq reg 1 0x00000080 ] [ counter pkts 0 bytes 0 ] And also IPv6, note that in this case we take two bytes from the payload: # nft --debug=netlink add rule ip6 filter input ip6 dscp cs4 counter ip6 filter input [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x0000c00f ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000008 ] [ counter pkts 0 bytes 0 ] Given the DSCP is split in two bytes, the less significant nibble of the first byte and the two most significant 2 bits of the second byte. The 8 bit traffic class in RFC2460 after the version field are used for DSCP (6 bit) and ECN (2 bit). Support for ECN comes in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: add interval testsPablo Neira Ayuso2016-04-271-0/+12
| | | | | | Add some initial tests to cover dynamic interval sets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: explicitly indication of set type and flags from test definitionsPablo Neira Ayuso2016-04-271-6/+6
| | | | | | | | | This patch adds explicit set type in test definitions, as well as flags. This has triggered a rework that starts by introducing a Set class to make this whole code more extensible and maintainable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-12 18:14:32 +0000