summaryrefslogtreecommitdiffstats
path: root/tests/py
Commit message (Collapse)AuthorAgeFilesLines
* evaluate: place byteorder conversion after numgen for IP address datatypesJorge Ortiz2023-09-014-0/+73
| | | | | | | | | | | | | | | | | | | | | | | | The numgen extension generates numbers in little-endian. This can be very tricky when trying to combine it with IP addresses, which use big endian. This change adds a new byteorder operation to convert data type endianness. Before this patch: $ sudo nft -d netlink add rule nat snat_chain snat to numgen inc mod 7 offset 0x0a000001 ip nat snat_chain [ numgen reg 1 = inc mod 7 offset 167772161 ] [ nat snat ip addr_min reg 1 ] After this patch: $ sudo nft -d netlink add rule nat snat_chain snat to numgen inc mod 7 offset 0x0a000001 ip nat snat_chain [ numgen reg 1 = inc mod 7 offset 167772161 ] [ byteorder reg 1 = hton(reg 1, 4, 4) ] [ nat snat ip addr_min reg 1 ] Regression tests have been modified to include these new cases. Signed-off-by: Jorge Ortiz Escribano <jorge.ortiz.escribano@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: debloat frag.t.payload.netdevPablo Neira Ayuso2023-08-301-1990/+36
| | | | | | This bytecode output file contains many duplicated entries, remove them. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: extend ip frag-off coveragePablo Neira Ayuso2023-08-306-0/+156
| | | | | | Cover matching on DF and MF bits and fragments. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: use hexadecimal to display ip frag-off fieldPablo Neira Ayuso2023-08-306-36/+36
| | | | | | | | | | | | | The ip frag-off field in the protocol definition is 16-bits long and it contains the DF (0x2000) and MF (0x4000) bits too. iptables-translate also suggests: ip frag-off & 0x1ffff != 0 to match on fragments. Use hexadecimal for listing this header field. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: stash context statement length when generating payload/meta dependencyPablo Neira Ayuso2023-07-193-0/+131
| | | | | | | | | | | | | | | | | | | | | | | | ... meta mark set ip dscp generates an implicit dependency from the inet family to match on meta nfproto ip. The length of this implicit expression is incorrectly adjusted to the statement length, ie. relational to compare meta nfproto takes 4 bytes instead of 1 byte. The evaluation of 'ip dscp' under the meta mark statement triggers this implicit dependency which should not consider the context statement length since it is added before the statement itself. This problem shows when listing the ruleset, since netlink_parse_cmp() where left->len < right->len, hence handling the implicit dependency as a concatenation, but it is actually a bug in the evaluation step that leads to incorrect bytecode. Fixes: 3c64ea7995cb ("evaluate: honor statement length in integer evaluation") Fixes: edecd58755a8 ("evaluate: support shifts larger than the width of the left operand") Tested-by: Brian Davidson <davidson.brian@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: place byteorder conversion before rshift in payload statementPablo Neira Ayuso2023-07-082-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For bitfield that spans more than one byte, such as ip6 dscp, byteorder conversion needs to be done before rshift. Add unary expression for this conversion only in the case of meta and ct statements. Before this patch: # nft --debug=netlink add rule ip6 x y 'meta mark set ip6 dscp' ip6 x y [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] [ byteorder reg 1 = ntoh(reg 1, 2, 2) ] <--------- incorrect [ meta set mark with reg 1 ] After this patch: # nft --debug=netlink add rule ip6 x y 'meta mark set ip6 dscp' ip6 x y [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] [ byteorder reg 1 = ntoh(reg 1, 2, 2) ] <-------- correct [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] [ meta set mark with reg 1 ] For the matching case, binary transfer already deals with the rshift to adjust left and right hand side of the expression, the unary conversion is not needed in such case. Fixes: 8221d86e616b ("tests: py: add test-cases for ct and packet mark payload expressions") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: use div_round_up in byteorder lengthPablo Neira Ayuso2023-07-062-7/+7
| | | | | | | | | Use div_round_up() to calculate the byteorder length, otherwise fields that take % BITS_PER_BYTE != 0 are not considered by the byteorder expression. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Document JSON mode in READMEPhil Sutter2023-06-271-0/+31
| | | | | | | Mostly identify the various files that (may) appear or exist already and how to deal with them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: json: add missing/expected json outputFlorian Westphal2023-06-241-0/+14
| | | | | | | | | | | | | | nft-test.py generates following warning: any/last.t: WARNING: line 12: '{"nftables": [{"add": {"rule": {"family": "ip", "table": "test-ip4", "chain": "input", "expr": [{"last": {"used": 300000}}]}}}]}': '[{"last": {"used": 300000}}]' mismatches '[{"last": null}]' This is because "last" expression is stateful; but nft-test.py explicitly asks for stateless output. Thus we need to provide a json.output file, without it, nft-test.py uses last.json as the expected output file. Fixes: ae8786756b0c ("src: add json support for last statement") Signed-off-by: Florian Westphal <fw@strlen.de>
* json: add inner payload supportPablo Neira Ayuso2023-06-204-0/+1060
| | | | | | Add support for vxlan, geneve, gre and gretap. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add json support for last statementPablo Neira Ayuso2023-06-201-0/+16
| | | | | | | | | | This patch adds json support for the last statement, it works for me here. However, tests/py still displays a warning: any/last.t: WARNING: line 12: '{"nftables": [{"add": {"rule": {"family": "ip", "table": "test-ip4", "chain": "input", "expr": [{"last": {"used": 300000}}]}}}]}': '[{"last": {"used": 300000}}]' mismatches '[{"last": null}]' Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: add boolean DCCP option matchingJeremy Sowden2023-06-013-0/+63
| | | | | | | | | | Iptables supports the matching of DCCP packets based on the presence or absence of DCCP options. Extend exthdr expressions to add this functionality to nftables. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=930 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: introduce meta broute supportSriram Yagnaraman2023-04-294-0/+23
| | | | | | | | | | | Can be used in bridge prerouting hook to divert a packet to the ip stack for routing. This is a replacement for "ebtables -t broute" functionality. Link: https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230224095251.11249-1-sriram.yagnaraman@est.tech/ Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: missing json updates on ct and meta mark payload expressionPablo Neira Ayuso2023-04-251-0/+59
| | | | | | | Add json output, it is missing in the original tests/py update. Fixes: 8221d86e616b ("tests: py: add test-cases for ct and packet mark payload expressions") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: do not reset protocol context for nat protocol expressionPablo Neira Ayuso2023-04-056-32/+8
| | | | | | | | This patch reverts 403b46ada490 ("netlink_delinearize: kill dependency before eval of 'redirect' stmt"). Since ("evaluate: bogus missing transport protocol"), this workaround is not required anymore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: extend test-cases for mark statements with bitwise expressionsPablo Neira Ayuso2023-03-286-0/+234
| | | | | | | | | | Add more tests to cover bitwise operation. Shift operations are used on constant value which are reduced at evaluation time. Shift takes precendence over AND and OR operations, otherwise use parens to override this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add test-cases for ct and packet mark payload expressionsJeremy Sowden2023-03-2812-0/+483
| | | | | | | | Add new test-cases to verify that defining a rule that sets the ct or packet mark to a value derived from a payload works correctly. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: relax type-checking for integer arguments in mark statementsPablo Neira Ayuso2023-03-283-0/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to be able to set ct and meta marks to values derived from payload expressions, we need to relax the requirement that the type of the statement argument must match that of the statement key. Instead, we require that the base-type of the argument is integer and that the argument is small enough to fit. Moreover, swap expression byteorder before to make it compatible with the statement byteorder, to ensure rulesets are portable. # nft --debug=netlink add rule ip t c 'meta mark set ip saddr' ip t c [ payload load 4b @ network header + 12 => reg 1 ] [ byteorder reg 1 = ntoh(reg 1, 4, 4) ] <----------- byteorder swap [ meta set mark with reg 1 ] Based on original work from Jeremy Sowden. The following patches are required for this to work: evaluate: get length from statement instead of lhs expression evaluate: don't eval unary arguments evaluate: support shifts larger than the width of the left operand netlink_delinearize: correct type and byte-order of shifts evaluate: insert byte-order conversions for expressions between 9 and 15 bits Add one testcase for tests/py. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "evaluate: relax type-checking for integer arguments in mark statements"Pablo Neira Ayuso2023-03-143-30/+0
| | | | | | | | | | | This patch reverts eab3eb7f146c ("evaluate: relax type-checking for integer arguments in mark statements") since it might cause ruleset portability issues when moving a ruleset from little to big endian host (and vice-versa). Let's revert this until we agree on what to do in this case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add last statementPablo Neira Ayuso2023-02-282-0/+21
| | | | | | | | | | | | | | | | | | | | | This new statement allows you to know how long ago there was a matching packet. # nft list ruleset table ip x { chain y { [...] ip protocol icmp last used 49m54s884ms counter packets 1 bytes 64 } } if this statement never sees a packet, then the listing says: ip protocol icmp last used never counter packets 0 bytes 0 Add tests/py in this patch too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: expand value to range when nat mapping contains intervalsPablo Neira Ayuso2023-02-283-0/+170
| | | | | | | | | | | | | | | | | | | | | | | | | If the data in the mapping contains a range, then upgrade value to range. Otherwise, the following error is displayed: /dev/stdin:11:57-75: Error: Could not process rule: Invalid argument dnat ip to iifname . ip saddr map { enp2s0 . 10.1.1.136 : 1.1.2.69, enp2s0 . 10.1.1.1-10.1.1.135 : 1.1.2.66-1.84.236.78 } ^^^^^^^^^^^^^^^^^^^ The kernel rejects this command because userspace sends a single value while the kernel expects the range that represents the min and the max IP address to be used for NAT. The upgrade is also done when concatenation with intervals is used in the rhs of the mapping. For anonymous sets, expansion cannot be done from expr_evaluate_mapping() because the EXPR_F_INTERVAL flag is inferred from the elements. For explicit sets, this can be done from expr_evaluate_mapping() because the user already specifies the interval flag in the rhs of the map definition. Update tests/shell and tests/py to improve testing coverage in this case. Fixes: 9599d9d25a6b ("src: NAT support for intervals in maps") Fixes: 66746e7dedeb ("src: support for nat with interval concatenation") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: relax type-checking for integer arguments in mark statementsJeremy Sowden2023-02-073-0/+30
| | | | | | | | | | | | In order to be able to set ct and meta marks to values derived from payload expressions, we need to relax the requirement that the type of the statement argument must match that of the statement key. Instead, we require that the base-type of the argument is integer and that the argument is small enough to fit. Add one testcase for tests/py. Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
* tests: py: add gretap testsPablo Neira Ayuso2023-01-022-0/+108
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add geneve testsPablo Neira Ayuso2023-01-022-0/+137
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add gre testsPablo Neira Ayuso2023-01-022-0/+100
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add vxlan testsPablo Neira Ayuso2023-01-022-0/+137
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: swap byteorder of value component in concatenation of intervalsPablo Neira Ayuso2022-12-083-0/+116
| | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 1017d323cafa ("src: support for selectors with different byteorder with interval concatenations") was incomplete. Switch byteorder of singleton values in a set that contains concatenation of intervals. This singleton value is actually represented as a range in the kernel. After this patch, if the set represents a concatenation of intervals: - EXPR_F_INTERVAL denotes the lhs of the interval. - EXPR_F_INTERVAL_END denotes the rhs of the interval (this flag was already used in this way before this patch). If none of these flags are set on, then the set contains concatenations of singleton values (no interval flag is set on), in such case, no byteorder swap is required. Update tests/shell and tests/py to cover the use-case breakage reported by Eric. Fixes: 1017d323cafa ("src: support for selectors with different byteorder with interval concatenations") Reported-by: Eric Garver <eric@garver.life> Tested-by: Eric Garver <eric@garver.life> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: missing json for different byteorder selector with interval ↵Pablo Neira Ayuso2022-12-081-0/+61
| | | | | | | | | concatenation Add missing json output, otherwise -j reports an error. Fixes: 1017d323cafa ("src: support for selectors with different byteorder with interval concatenations") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for selectors with different byteorder with interval concatenationsPablo Neira Ayuso2022-11-302-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Assuming the following interval set with concatenation: set test { typeof ip saddr . meta mark flags interval } then, the following rule: ip saddr . meta mark @test requires bytecode that swaps the byteorder for the meta mark selector in case the set contains intervals and concatenations. inet x y [ meta load nfproto => reg 1 ] [ cmp eq reg 1 0x00000002 ] [ payload load 4b @ network header + 12 => reg 1 ] [ meta load mark => reg 9 ] [ byteorder reg 9 = hton(reg 9, 4, 4) ] <----- this is required ! [ lookup reg 1 set test dreg 0 ] This patch updates byteorder_conversion() to add the unary expression that introduces the byteorder expression. Moreover, store the meta mark range component of the element tuple in the set in big endian as it is required for the range comparisons. Undo the byteorder swap in the netlink delinearize path to listing the meta mark values accordingly. Update tests/py to validate that byteorder expression is emitted in the bytecode. Update tests/shell to validate insertion and listing of a named map declaration. A similar commit 806ab081dc9a ("netlink: swap byteorder for host-endian concat data") already exists in the tree to handle this for strings with prefix (e.g. eth*). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: do not kill dependency for proto_unknownPablo Neira Ayuso2022-10-313-0/+41
| | | | | | | | | | | | | Unsupported meta match on layer 4 protocol sets on protocol context to proto_unknown, handle anything coming after it as a raw expression in payload_expr_expand(). Moreover, payload_dependency_kill() skips dependency removal if protocol is unknown, so raw payload expression leaves meta layer 4 protocol remains in place. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1641 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add vlan test case for ip/inet familyFlorian Westphal2022-09-295-0/+94
| | | | | | | | | | | | | | | | | | | before fixup, this failed with: line 4: 'add rule ip test-ip4 input vlan id 1': '[ payload load 2b @ link header + 12 => reg 1 ]' mismatches '[ payload load 2b @ link header + 0 => reg 1 ]' ... because the auto-dependency did not add the preceeding ethernet header, so vlan was using the wrong offset. Note than vlan id match in inet input families will only work if header removal was disabled, i.e. ... add link vethin1 name vethin1.3 type vlan id 3 reorder_hdr off otherwise, kernel will strip the vlan tag and interface appears as a normal ethernet interface. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: missing userdata in netlink payloadPablo Neira Ayuso2022-08-311-3/+3
| | | | | | | | Since libnftnl's 212479ad2c92 ("rule, set_elem: fix printing of user data"), userdata is missing in netlink payload printing via --debug. Update tests/py/ip6/srh.t.payload to silence warning. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow burst 0 for byte ratelimit and use it as defaultPablo Neira Ayuso2022-08-313-30/+30
| | | | | | | | | | | | | | | | | Packet-based limit burst is set to 5, as in iptables. However, byte-based limit burst adds to the rate to calculate the bucket size, and this is also sets this to 5 (... bytes in this case). Update it to use zero byte burst by default instead. This patch also updates manpage to describe how the burst value influences the kernel module's token bucket in each of the two modes. This documentation update is based on original text by Phil Sutter. Adjust tests/py to silence warnings due to mismatching byte burst. Fixes: 285baccfea46 ("src: disallow burst 0 in ratelimits") Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: disable arp family for queue statementPablo Neira Ayuso2022-08-091-1/+0
| | | | | | | | | | | | | | Kernel commit: commit 47f4f510ad586032b85c89a0773fbb011d412425 Author: Florian Westphal <fw@strlen.de> Date: Tue Jul 26 19:49:00 2022 +0200 netfilter: nft_queue: only allow supported familes and hooks restricts supported families, excluding arp. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow anon set concatenation with ether and vlanFlorian Westphal2022-08-054-0/+69
| | | | | | | | | | | | | | | | | | | | | | | vlan id uses integer type (which has a length of 0). Using it was possible, but listing would assert: python: mergesort.c:24: concat_expr_msort_value: Assertion `ilen > 0' failed. There are two reasons for this. First reason is that the udata/typeof information lacks the 'vlan id' part, because internally this is 'payload . binop(payload AND mask)'. binop lacks an udata store. It makes little sense to store it, 'typeof' keyword expects normal match syntax. So, when storing udata, store the left hand side of the binary operation, i.e. the load of the 2-byte key. With that resolved, delinerization could work, but concat_elem_expr() would splice 12 bits off the elements value, but it should be 16 (on a byte boundary). Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: search stacked header list for matching payload depFlorian Westphal2022-08-054-0/+95
| | | | | | | | | | | | | | "ether saddr 0:1:2:3:4:6 vlan id 2" works, but reverse fails: "vlan id 2 ether saddr 0:1:2:3:4:6" will give Error: conflicting protocols specified: vlan vs. ether After "proto: track full stack of seen l2 protocols, not just cumulative offset", we have a list of all l2 headers, so search those to see if we had this proto base in the past before rejecting this. Reported-by: Eric Garver <eric@garver.life> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: Add a test for failing ipsec after counterPhil Sutter2022-06-273-0/+29
| | | | | | | | | | | This is a bug in parser/scanner due to scoping: | Error: syntax error, unexpected string, expecting saddr or daddr | add rule ip ipsec-ip4 ipsec-forw counter ipsec out ip daddr 192.168.1.2 | ^^^^^ Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: Add meta time tests without 'meta' keywordMartin Gignac2022-04-103-0/+52
| | | | | | | | | v1.0.2 of 'nft' fails on 'time < "2022-07-01 11:00:00"' but succeeds when 'meta' is specified ('meta time < "2022-07-01 11:00:00"'). This extends coverage by testing 'time' without 'meta'. Signed-off-by: Martin Gignac <martin.gignac@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Don't colorize output if stderr is redirectedPhil Sutter2022-04-081-1/+1
| | | | | | | | Cover for calls with '2>/tmp/log' and avoid printing escape sequences to that file. One could still keep colored output on stdout, but that required a printing routine for non-errors. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: extend meta time coveragePablo Neira Ayuso2022-04-083-0/+52
| | | | | | Add meta time tests using < and > operands. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add inet/vmap testsPablo Neira Ayuso2022-03-294-0/+222
| | | | | | | Add a few tests with concatenations including raw and integer type expressions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add tcp option reset supportFlorian Westphal2022-02-283-0/+53
| | | | | | | This allows to replace a tcp option with nops, similar to the TCPOPTSTRIP feature of iptables. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: Test connlimit statementPhil Sutter2022-02-203-0/+30
| | | | | | This wasn't covered at all. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: remove redundant payload expressionsJeremy Sowden2022-01-153-21/+1
| | | | | | | | Now that we keep track of more payload dependencies, more redundant payloads are eliminated. Remove these from the Python test-cases. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: fix inet/ip.t bridge payloadJeremy Sowden2022-01-151-1/+1
| | | | | | | | | | | | Correct the statement used to load the protocol in the bridge payload of one of the ip tests. A previous commit was supposed, in part, to do this, but the update got lost. Fixes: 4b8e51ea5fc8 ("tests: py: fix inet/ip.t payloads") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: fix inet/ip_tcp.t testJeremy Sowden2022-01-152-2/+14
| | | | | | | | | | | | | | | | | | Contrary to the comment and expected output, nft does _not_ eliminate the redundant `ip protocol` expression from the second test. Dependency elimination requires a higher level expression. `ip saddr` cannot lead to the elimination of `ip protocol` since they are both L3 expressions. `tcp dport` cannot because although `ip saddr` and `ip protocol` both imply that the L3 protocol is `ip`, only protocol matches are stored as dependencies, so the redundancy is not apparent, and in fact, `payload_may_dependency_kill` explicitly checks for the combination of inet, bridge or netdev family, L4 expression and L3 ipv4 or ipv6 dependency and returns false. Correct the expected output and comment. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: fix inet/ip.t payloadsJeremy Sowden2022-01-151-14/+0
| | | | | | | | | | In one of the bridge payloads, the wrong command is given to load the protocol. [ fw@strlen.de: remove the duplicated netdev payload ] Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: fix inet/sets.t netdev payloadJeremy Sowden2022-01-151-3/+3
| | | | | | | | The netdev payload for one of the inet/sets.t tests was cut-and-pasted from the inet payload without being properly updated. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: reject: support ethernet as L2 protocol for inet tableJeremy Sowden2021-12-153-0/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we are evaluating a `reject` statement in the `inet` family, we may have `ether` and `ip` or `ip6` as the L2 and L3 protocols in the evaluation context: table inet filter { chain input { type filter hook input priority filter; ether saddr aa:bb:cc:dd:ee:ff ip daddr 192.168.0.1 reject } } Since no `reject` option is given, nft attempts to infer one and fails: BUG: unsupported familynft: evaluate.c:2766:stmt_evaluate_reject_inet_family: Assertion `0' failed. Aborted The reason it fails is that the ethernet protocol numbers for IPv4 and IPv6 (`ETH_P_IP` and `ETH_P_IPV6`) do not match `NFPROTO_IPV4` and `NFPROTO_IPV6`. Add support for the ethernet protocol numbers. Replace the current `BUG("unsupported family")` error message with something more informative that tells the user to provide an explicit reject option. Add a Python test case. Fixes: 5fdd0b6a0600 ("nft: complete reject support") Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001360 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add tcp subtype match test casesFlorian Westphal2021-12-013-0/+78
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>