summaryrefslogtreecommitdiffstats
path: root/tests/py
Commit message (Collapse)AuthorAgeFilesLines
...
* netlink_delinearize: skip flags / mask notation for singleton bitmask againPablo Neira Ayuso2021-08-153-0/+30
| | | | | | | != operation should also be covered too. Fixes: 347a4aa16e64 ("netlink_delinearize: skip flags / mask notation for singleton bitmask") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Make netns spawning more robustPhil Sutter2021-08-111-6/+34
| | | | | | | On systems without unshare Python module, try to call unshare binary with oneself as parameters. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tcpopt: bogus assertion on undefined optionsPablo Neira Ayuso2021-08-113-0/+23
| | | | | | | | | | # nft add rule x y tcp option 6 exists # nft list ruleset nft: tcpopt.c:208: tcpopt_init_raw: Assertion `expr->exthdr.desc != NULL' failed. Aborted Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1557 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: check more flag match transformations to compact syntaxPablo Neira Ayuso2021-07-283-0/+193
| | | | | | Add a few more tests to extend coverage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: tcp flags & (fin | syn | rst | ack) == synPablo Neira Ayuso2021-07-283-0/+36
| | | | | | Add a test case to cover translation to tcp flags syn / fin,syn,rst,ack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: skip flags / mask notation for singleton bitmaskPablo Neira Ayuso2021-07-283-0/+31
| | | | | | | | Do not transform 'tcp flags & flag == flag' to 'flag / flag'. The parser does not accept this notation yet. Fixes: c3d57114f119 ("parser_bison: add shortcut syntax for matching flags without binary operations") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: idempotent tcp flags & syn != 0 to tcp flag synPablo Neira Ayuso2021-07-273-0/+25
| | | | | | Add a test to cover this case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: disallow negation with binary operationPablo Neira Ayuso2021-07-271-0/+1
| | | | | | | | | | | | | The negation was introduced to provide a simple shortcut. Extend e6c32b2fa0b8 ("src: add negation match on singleton bitmask value") to disallow negation with binary operations too. # nft add rule meh tcp_flags 'tcp flags & (fin | syn | rst | ack) ! syn' Error: cannot combine negation with binary expression add rule meh tcp_flags tcp flags & (fin | syn | rst | ack) ! syn ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ~~~ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: incorrect netlink bytecode with binary operation and flagsPablo Neira Ayuso2021-07-273-0/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | nft generates incorrect bytecode when combining flag datatype and binary operations: # nft --debug=netlink add rule meh tcp_flags 'tcp flags & (fin | syn | rst | ack) syn' ip [ meta load l4proto => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ payload load 1b @ transport header + 13 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x00000017 ) ^ 0x00000000 ] [ bitwise reg 1 = ( reg 1 & 0x00000002 ) ^ 0x00000000 ] [ cmp neq reg 1 0x00000000 ] Note the double bitwise expression. The last two expressions are not correct either since it should match on the syn flag, ie. 0x2. After this patch, netlink bytecode generation looks correct: # nft --debug=netlink add rule meh tcp_flags 'tcp flags & (fin | syn | rst | ack) syn' ip [ meta load l4proto => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ payload load 1b @ transport header + 13 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x00000017 ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000002 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: missing != in flagcmp expression print functionPablo Neira Ayuso2021-07-273-0/+34
| | | | | | | Missing != when printing the expression. Fixes: c3d57114f119 ("parser_bison: add shortcut syntax for matching flags without binary operations") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: missing json update for numeric reject with icmp numericPablo Neira Ayuso2021-07-273-0/+30
| | | | | | | Add missing tests to cover json support for reject with icmp numeric. Fixes: 1ab1fcbc19a8 ("parser_bison: parse number as reject icmp code") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: update new reject with icmp code syntax leftoverPablo Neira Ayuso2021-07-273-15/+15
| | | | | | | I forgot to update a few more spots in the json files. Fixes: 08d2f0493671 ("src: promote 'reject with icmp CODE' syntax") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: promote 'reject with icmp CODE' syntaxPablo Neira Ayuso2021-07-2613-229/+229
| | | | | | | | | | | | | | | | | | | | | | | The kernel already assumes that that ICMP type to reject a packet is destination-unreachable, hence the user specifies the *ICMP code*. Simplify the syntax to: ... reject with icmp port-unreachable this removes the 'type' keyword before the ICMP code to reject the packet with. IIRC, the original intention is to leave room for future extensions that allow to specify both the ICMP type and the ICMP code, this is however not possible with the current inconsistent syntax. Update manpages which also refer to ICMP type. Adjust tests/py to the new syntax. Fixes: 5fdd0b6a0600 ("nft: complete reject support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: parse number as reject icmp codePablo Neira Ayuso2021-07-266-0/+15
| | | | | | | | | | | | Extend parser to accept a numeric icmp code, instead of bailing out: # nft add rule inet filter input reject with icmpx type 3 Error: syntax error, unexpected number, expecting string add rule inet filter input reject with icmpx type 3 ^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1555 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add dnat to port without defining destination addressPablo Neira Ayuso2021-07-223-0/+28
| | | | | | | Add a test to cover dnat to port without destination address. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1428 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: extend coverage for dnat with classic range representationPablo Neira Ayuso2021-07-142-0/+43
| | | | | | Add a few more tests for the classic dnat range representation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for nat with interval concatenationPablo Neira Ayuso2021-07-135-1/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows you to combine concatenation and interval in NAT mappings, e.g. add rule x y dnat to ip saddr . tcp dport map { 192.168.1.2 . 80 : 10.141.10.2-10.141.10.5 . 8888-8999 } This generates the following NAT expression: [ nat dnat ip addr_min reg 1 addr_max reg 10 proto_min reg 9 proto_max reg 11 ] which expects to obtain the following tuple: IP address (min), source port (min), IP address (max), source port (max) to be obtained from the map. This representation simplifies the delinearize path, since the datatype is specified as: ipv4_addr . inet_service. A few more notes on this update: - alloc_nftnl_setelem() needs a variant netlink_gen_data() to deal with the representation of the range on the rhs of the mapping. In contrast to interval concatenation in the key side, where the range is expressed as two netlink attributes, the data side of the set element mapping stores the interval concatenation in a contiguos memory area, see __netlink_gen_concat_expand() for reference. - add range_expr_postprocess() to postprocess the data mapping range. If either one single IP address or port is used, then the minimum and maximum value in the range is the same value, e.g. to avoid listing 80-80, this round simplify the range. This also invokes the range to prefix conversion routine. - add concat_elem_expr() helper function to consolidate code to build the concatenation expression on the rhs element data side. This patch also adds tests/py and tests/shell. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: infer NAT mapping with concatenation from setPablo Neira Ayuso2021-07-132-2/+2
| | | | | | | | | | | | If the map is anonymous, infer it from the set elements. Otherwise, the set definition already have an explicit concatenation definition in the data side of the mapping. This update simplifies the NAT mapping syntax with concatenations, e.g. snat ip to ip saddr map { 10.141.11.4 : 192.168.2.3 . 80 } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove STMT_NAT_F_INTERVAL flags and interval keywordPablo Neira Ayuso2021-07-132-2/+2
| | | | | | | | | | | | | | | STMT_NAT_F_INTERVAL is not useful, the keyword interval can be removed to simplify the syntax, e.g. snat to ip saddr map { 10.141.11.4 : 192.168.2.2-192.168.2.4 } This patch reworks 9599d9d25a6b ("src: NAT support for intervals in maps"). Do not remove STMT_NAT_F_INTERVAL yet since this flag is needed for interval concatenations coming in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: queue: allow use of MAP statement for queue number retrievalFlorian Westphal2021-06-213-0/+44
| | | | | | | | | This allows to chose a queue number at run time using map statements, e.g.: queue flags bypass to ip saddr map { 192.168.7/24 : 0, 192.168.0/24 : 1 } Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: extend queue testcases for new sreg supportFlorian Westphal2021-06-213-0/+82
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: new queue flag input formatFlorian Westphal2021-06-211-4/+3
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* segtree: memleak in error path of the set to segtree conversionPablo Neira Ayuso2021-06-181-1/+1
| | | | | | | | | | | Release the array of intervals and the segtree in case of error, otherwise these structures and objects are never released: SUMMARY: AddressSanitizer: 2864 byte(s) leaked in 37 allocation(s). Moreover, improve existing a test coverage of this error path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: unbreak verdict maps with implicit map with interval concatenationsPablo Neira Ayuso2021-06-186-0/+92
| | | | | | | | | | | Verdict maps in combination with interval concatenations are broken, e.g. # nft add rule x y tcp dport . ip saddr vmap { 1025-65535 . 192.168.10.2 : accept } Retrieve the concatenation field length and count from the map->map expressions that represents the key of the implicit map. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add a icmp-reply only and icmpv6 id test casesFlorian Westphal2021-06-176-0/+123
| | | | | | | | | | | | | | | | | | Check that nft doesn't remove the dependency in these cases: icmp type echo-reply icmp id 1 ("icmp id" matches both echo request and reply). Add icmpv6 test cases. These fail without the previous patches: add rule ip6 test-ip6 input icmpv6 id 1: 'icmpv6 id 1' mismatches 'icmpv6 type { echo-request, echo-reply} icmpv6 parameter-problem 65536/16' add rule ip6 test-ip6 input icmpv6 type echo-reply icmpv6 id 65534': 'icmpv6 type echo-reply icmpv6 id 65534' mismatches 'icmpv6 type echo-reply @th,32,16 65534' Signed-off-by: Florian Westphal <fw@strlen.de>
* json: tests: add missing concat test caseFlorian Westphal2021-06-141-0/+39
| | | | | | | | | | Fix ERROR: did not find JSON equivalent for rule 'ip saddr . ip daddr { 192.0.2.1 . 10.0.0.1-10.0.0.2 }' when running nft-test.py -j Fixes: bbcc5eda7e58 ("evaluate: restore interval + concatenation in anonymous set") Signed-off-by: Florian Westphal <fw@strlen.de>
* json: tests: fix vlan.t cfi test caseFlorian Westphal2021-06-141-1/+29
| | | | | | | | | | | The test case exists twice, once with new dei, once with old 'cfi', so we need to retain the cfi one in the json file too. Else we get: WARNING: line 2: Wrote JSON equivalent for rule vlan id 4094 vlan dei 1 Fixes: d2fba515ff94 ("src: add vlan dei") Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: restore interval + concatenation in anonymous setPablo Neira Ayuso2021-06-115-0/+44
| | | | | | | | | | | | | | | | | | | Perform the table and set lookup only for non-anonymous sets, where the incremental cache update is required. The problem fixed by 7aa08d45031e ("evaluate: Perform set evaluation on implicitly declared (anonymous) sets") resurrected after the cache rework. # nft add rule x y tcp sport . tcp dport vmap { ssh . 0-65535 : accept, 0-65535 . ssh : accept } BUG: invalid range expression type concat nft: expression.c:1422: range_expr_value_low: Assertion `0' failed. Abort Add a test case to make sure this does not happen again. Fixes: 5ec5c706d993 ("cache: add hashtable cache for table") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add vlan deiPablo Neira Ayuso2021-06-114-38/+63
| | | | | | | | | | the CFI bit has been repurposed as DEI "Drop Eligible Indicator" since 802.1Q-2011. The vlan cfi field is still retained for compatibility. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1516 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: remove redundant test casesFlorian Westphal2021-06-0769-5220/+0
| | | | | | | | | | | | | Check for ... 23-42 ... ... { 23-42 } ... and remove the latter. Followup patch will translate the former to the latter during evaluation step to avoid the unneded anon set. A separate test case will be added that checks for such rewrites. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: ct: prefer normal cmpFlorian Westphal2021-06-073-12/+5
| | | | | | | | Followup patch will replace the { 1.2.3.4 } with single cmp, so this will cause an error when the netlink dump gets compared. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: update netdev reject test fileFlorian Westphal2021-06-041-45/+21
| | | | | | | | netdev/reject.t throws a couple of WARNINGs. For some reason this file wasn't updated after the reject statement json output was changed to keep the icmp type/protocol. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: catchall element supportFlorian Westphal2021-06-021-0/+84
| | | | | | | Treat '*' as catchall element, not as a symbol. Also add missing json test cases for wildcard set support. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: fix error messageFlorian Westphal2021-06-021-1/+5
| | | | | | | This should say "should have failed" only if the set add operation was supposed to fail, not when its supposed to work. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: fix parse of flagcmp expressionFlorian Westphal2021-06-021-0/+27
| | | | | | | | | | | | The json test case for the flagcmp notation ('tcp flags syn,fin / syn,fin') fails with: command: {"nftables": [{"add": {"rule": {"family": "ip", "table": "test-ip4", "chain": "input", "expr": [{"match": {"left": {"&": [{"payload": {"field": "flags", "protocol": "tcp"}}, ["fin", "syn"]]}, "op": "==", "right": ["fin", "syn"]}}]}}}]} internal:0:0-0: Error: List expression only allowed on RHS or in statement expression. internal:0:0-0: Error: Failed to parse RHS of binop expression. internal:0:0-0: Error: Invalid LHS of relational. internal:0:0-0: Error: Parsing expr array at index 0 failed. internal:0:0-0: Error: Parsing command array at index 0 failed. Signed-off-by: Florian Westphal <fw@strlen.de>
* exthdr: Implement SCTP Chunk matchingPhil Sutter2021-05-193-0/+670
| | | | | | | | Extend exthdr expression to support scanning through SCTP packet chunks and matching on fixed fields' values. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* parser_bison: add shortcut syntax for matching flags without binary operationsPablo Neira Ayuso2021-05-162-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the following shortcut syntax: expression flags / flags instead of: expression and flags == flags For example: tcp flags syn,ack / syn,ack,fin,rst ^^^^^^^ ^^^^^^^^^^^^^^^ value mask instead of: tcp flags and (syn|ack|fin|rst) == syn|ack The second list of comma-separated flags represents the mask which are examined and the first list of comma-separated flags must be set. You can also use the != operator with this syntax: tcp flags != fin,rst / syn,ack,fin,rst This shortcut is based on the prefix notation, but it is also similar to the iptables tcp matching syntax. This patch introduces the flagcmp expression to print the tcp flags in this new notation. The delinearize path transforms the binary expression to this new flagcmp expression whenever possible. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set element catch-all supportPablo Neira Ayuso2021-05-114-0/+89
| | | | | | | | | | | | | | | | | | | | | | | | | Add a catchall expression (EXPR_SET_ELEM_CATCHALL). Use the asterisk (*) to represent the catch-all set element, e.g. table x { set y { type ipv4_addr counter elements = { 1.2.3.4 counter packets 0 bytes 0, * counter packets 0 bytes 0 } } } Special handling for segtree: zap the catch-all element from the set element list and re-add it after processing. Remove wildcard_expr deadcode in src/parser_bison.y This patch also adds several tests for the tests/py and tests/shell infrastructures. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: missing relational operation on flag listPablo Neira Ayuso2021-05-023-0/+27
| | | | | | | | | | | | | | | Complete e6c32b2fa0b8 ("src: add negation match on singleton bitmask value") which was missing comma-separated list of flags. This patch provides a shortcut for: tcp flags and fin,rst == 0 which allows to check for the packet whose fin and rst bits are unset: # nft add rule x y tcp flags not fin,rst counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: replace vlan ether type with 8021qFlorian Westphal2021-04-0315-35/+34
| | | | | | | | | | | | | Previous patches added "8021ad" mnemonic for IEEE 802.1AD frame type. This adds the 8021q shorthand for the existing 'vlan' frame type. nft will continue to recognize 'ether type vlan', but listing will now print 8021q. Adjust all test cases accordingly. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add 8021.AD vlan test casesFlorian Westphal2021-04-035-0/+450
| | | | | | | Check nft doesn't remove the explicit '8021ad' type check and that the expected dependency chains are generated. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: fix scope closure of COUNTER tokenFlorian Westphal2021-03-254-0/+96
| | | | | | | | | It is closed after allocation, which is too early: this stopped 'packets' and 'bytes' from getting parsed correctly. Also add a test case for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: Fix for missing JSON equivalent in any/ct.t.jsonPhil Sutter2021-03-091-0/+15
| | | | | | | JSON equivalent for recently added test of the '!' shortcut was missing. Fixes: e6c32b2fa0b82 ("src: add negation match on singleton bitmask value") Signed-off-by: Phil Sutter <phil@nwl.cc>
* mnl: Set NFTNL_SET_DATA_TYPE before dumping set elementsPhil Sutter2021-03-0917-148/+148
| | | | | | | | In combination with libnftnl's commit "set_elem: Fix printing of verdict map elements", This adds the vmap target to netlink dumps. Adjust dumps in tests/py accordingly. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/py: Adjust payloads for fixed nat statement dumpsPhil Sutter2021-03-0910-31/+31
| | | | | | Libnftnl no longer dumps unused regs, so drop those. Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: add negation match on singleton bitmask valuePablo Neira Ayuso2021-02-052-0/+7
| | | | | | | | | | | | | | | | | This patch provides a shortcut for: ct status and dnat == 0 which allows to check for the packet whose dnat bit is unset: # nft add rule x y ct status ! dnat counter This operation is only available for expression with a bitmask basetype, eg. # nft describe ct status ct expression, datatype ct_status (conntrack status) (basetype bitmask, integer), 32 bits Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Add a test sanitizer and fix its findingsPhil Sutter2021-02-0439-780/+160
| | | | | | | | | | | | | | | | This is just basic housekeeping: - Remove duplicate tests in any of the *.t files - Remove explicit output if equal to command itself in *.t files - Remove duplicate payload records in any of the *.t.payload* files - Remove stale payload records (for which no commands exist in the respective *.t file - Remove duplicate/stale entries in any of the *.t.json files In some cases, tests were added instead of removing a stale payload record if it fit nicely into the sequence of tests. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/py: Write dissenting payload into the right filePhil Sutter2021-02-041-1/+4
| | | | | | | | | | | | The testsuite supports diverging payloads depending on table family. This is necessary since for some families, dependency matches are created. If a payload mismatch happens, record it into a "got"-file which matches the family-specific payload file, not the common one. This eases use of diff-tools a lot as the extra other families' payloads confuse the tools. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Do not abbreviate reject statement objectPhil Sutter2021-02-034-112/+47
| | | | | | | | | No need to reduce output size, also this way output is more predictable. While being at it, drop some pointless chunks from tests/py/bridge/reject.t.json.output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: add icmp/6 test where dependency should be left aloneFlorian Westphal2021-02-016-0/+73
| | | | | | These tests fail: nft should leave the type as-is. Signed-off-by: Florian Westphal <fw@strlen.de>