summaryrefslogtreecommitdiffstats
path: root/tests/py
Commit message (Collapse)AuthorAgeFilesLines
* tests: Prepare exit codes for automakePhil Sutter2025-09-111-5/+7
| | | | | | | | Make the test suite runners exit 77 when requiring root and running as regular user, exit 99 for internal errors (unrelated to test cases) and exit 1 (or any free non-zero value) to indicate test failures. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: Enable JSON and JSON schema by defaultPhil Sutter2025-09-111-4/+12
| | | | | | | Introduce -J/--disable-json and -S/--no-schema to explicitly disable them if desired. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: add tunnel shell and python testsFernando Fernandez Mancera2025-08-273-0/+67
| | | | | | | | Add tests for tunnel statement and object support. Shell and python tests both cover standard nft output and json. Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fib: restore JSON output for relational expressionsPablo Neira Ayuso2025-08-202-4/+4
| | | | | | | | | | | | | | | | | | | JSON output for the fib expression changed: - "result": "check" + "result": "oif" This breaks third party JSON parsers, revert this change for relational expressions only via workaround until there are clear rules on how to proceed with JSON schema updates. As for set and map statements, keep this new "check" result type since it is not possible to peek on rhs in such case to guess if the NFT_FIB_F_PRESENT flag needs to be set on. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1806 Fixes: f4b646032acf ("fib: allow to check if route exists in maps") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Do not reduce single-item arrays on outputPhil Sutter2025-08-1812-19/+534
| | | | | | | | | | | | | | This is a partial revert of commit a740f2036ad0d ("json: Introduce json_add_array_new()"), keeping the function but eliminating its primary task which is to replace arrays of size 1 by their only item. While support for this on input is convenient for users, it means extra casing in JSON output parsers to cover for it. The minor reduction in output size does not justify that. Fixes: a740f2036ad0d ("json: Introduce json_add_array_new()") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1806 Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Fix tests added for 'icmpv6 taddr' supportPhil Sutter2025-08-183-60/+36
| | | | | | | | | | There was a duplicate test, also stored JSON equivalents should match input as much as possible. The expected deviation in output (just like with standard syntax) is stored in the .json.output file instead. Fixes: 2e86f45d0260a ("icmpv6: Allow matching target address in NS/NA, redirect and MLD") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Drop stale entry from ip/snat.t.payloadPhil Sutter2025-08-181-14/+0
| | | | | | | | | This payload actually belongs to ip/dnat.t.payload, fixed commit added it to the wrong file. Fixes: 8f3048954d40d ("evaluate: postpone transport protocol match check after nat expression evaluation") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Drop stale entries from ip6/{ct,meta}.t.jsonPhil Sutter2025-08-182-222/+0
| | | | | | | | | Looks like these were added by accident, fixed commit did not add these test cases. Fixes: 8221d86e616bd ("tests: py: add test-cases for ct and packet mark payload expressions") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Drop stale entry from ip/snat.t.jsonPhil Sutter2025-08-181-33/+0
| | | | | | | | | The test syntax was changed, but the respective JSON equivalent remained in place. Fixes: 9b169bfc650eb ("src: remove STMT_NAT_F_INTERVAL flags and interval keyword") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Drop redundant payloads for ip/ip.tPhil Sutter2025-08-182-437/+0
| | | | | | | | | Each was present multiple times, introduced probably by copying from a respective .got file. Fixes: 77def2d43466e ("netlink_delinearize: support for bitfield payload statement with binary operation") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Drop duplicate test from inet/vxlan.tPhil Sutter2025-08-182-30/+0
| | | | | | | | | The test was duplicate since day 1. The duplicate JSON equivalent was added later (semi-automated), remove it as well. Fixes: df81baa4c2bef ("tests: py: add vxlan tests") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Drop stale entry from inet/tcp.t.jsonPhil Sutter2025-08-181-31/+0
| | | | | | | | | | The test was changed but JSON equivalents not updated. Commit c0b685951fabb ("json: fix parse of flagcmp expression") then added an equivalent matching the changed test, so just drop the old one. Fixes: c3d57114f119b ("parser_bison: add shortcut syntax for matching flags without binary operations") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Drop duplicate test from inet/gretap.tPhil Sutter2025-08-182-18/+0
| | | | | | | | | The test was duplicate since day 1. The duplicate JSON equivalent was added later (semi-automated), remove it as well. Fixes: 39a68d9ffd25c ("tests: py: add gretap tests") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Drop duplicate test from inet/gre.tPhil Sutter2025-08-182-18/+0
| | | | | | | | | The test was duplicate since day 1. The duplicate JSON equivalent was added later (semi-automated), remove it as well. Fixes: c04ef8d104ec6 ("tests: py: add gre tests") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Drop duplicate test from inet/geneve.tPhil Sutter2025-08-182-30/+0
| | | | | | | | | The test was duplicate since day 1. The duplicate JSON equivalent was added later (semi-automated), remove it as well. Fixes: 2b9143bc7ab81 ("tests: py: add geneve tests") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Drop stale payload from any/rawpayload.t.payloadPhil Sutter2025-08-181-6/+0
| | | | | | | | There never was a test corresponding to this payload. Fixes: 857904bdfaf7a ("tests: py: extend raw payload match tests") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Drop stale entries since redundant test case removalPhil Sutter2025-08-186-240/+0
| | | | | | | | | Fixed commit left stale JSON equivalents and payload records in place, drop them. Fixes: ec1ea13314fa5 ("tests: remove redundant test cases") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Drop duplicate test in any/meta.tPhil Sutter2025-08-181-1/+0
| | | | | | | | The expected invalid meta hour argument of 24:00 is tested already. Fixes: a6717ae094db2 ("evaluate: Fix for 'meta hour' ranges spanning date boundaries") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: revert dccp python testsFlorian Westphal2025-08-113-63/+0
| | | | | | | | | These fail for kernels with 'CONFIG_NFT_EXTHDR_DCCP is not set', remove the tests in anticipation of a future removal from both kernel and nftables. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Fix for 'meta hour' ranges spanning date boundariesPhil Sutter2025-07-314-0/+260
| | | | | | | | | | | | | | | | | | | | Introduction of EXPR_RANGE_SYMBOL type inadvertently disabled sanitizing of meta hour ranges where the lower boundary has a higher value than the upper boundary. This may happen outside of user control due to the fact that given ranges are converted to UTC which is the kernel's native timezone. Perform the conditional match and op inversion with the new RHS expression type as well after expanding it so values are comparable. Since this replaces the whole range expression, make it replace the relational's RHS entirely. While at it extend testsuites to cover these corner-cases. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1805 Fixes: 347039f64509e ("src: add symbol range expression to further compact intervals") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: re-enables nft-test.py to load the local nftables.pyZhongqiu Duan2025-07-041-1/+1
| | | | | | | | | | | | | | This is a needed follow-up of commit ce443afc21455 ("py: move package source into src directory") from 2023. Since that change, nft-test.py started using the host's nftables.py instead of the local one. But since nft-test.py passes the local src/.libs/libnftables.so.1 as parameter when instantiating the Nftables class, we did nevertheless use the local libnftables. Fixes: ce443afc21455 ("py: move package source into src directory") Reviewed-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Zhongqiu Duan <dzq.aishenghu0@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fib: allow to use it in set statementsPablo Neira Ayuso2025-06-273-0/+55
| | | | | | | | | Allow to use fib expression in set statements, eg. meta mark set ip saddr . fib daddr check map { 1.2.3.4 . exists : 0x00000001 } Fixes: 4a75ed32132d ("src: add fib expression") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fib: allow to check if route exists in mapsPablo Neira Ayuso2025-06-274-9/+46
| | | | | | | | | | | | | | | | | | | | f686a17eafa0 ("fib: Support existence check") adds EXPR_F_BOOLEAN as a workaround to infer from the rhs of the relational expression if the fib lookup wants to check for a specific output interface or, instead, simply check for existence. This, however, does not work with maps. The NFT_FIB_F_PRESENT flag can be used both with NFT_FIB_RESULT_OIF and NFT_FIB_RESULT_OFINAME, my understanding is that they serve the same purpose which is to check if a route exists, so they are redundant. Add a 'check' fib result to check for routes while still keeping the inference workaround for backward compatibility, but prefer the new syntax in the listing. Update man nft(8) and tests/py. Fixes: f686a17eafa0 ("fib: Support existence check") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: clean up set backend support falloutFlorian Westphal2025-06-241-1/+1
| | | | | | | | | | | | | | | | | | Pablo reports failing py tests woth recent kernel and userland: any/objects.t: OK WARNING: line 3: 'add rule ip6 test-ip6 input .. mismatches 'family 2 __set0 test-ip4 3 backend nft_set_bitmap_type [nf_tables] count 7' When nf_tables is built as a module, the set backend name coming from kernel contains the module name ([nf_tables]), this makes the test script treat it as part of the pseudo instructions. Skip this line explicitly to avoid these warnings. Fixes: 7cec20e45a75 ("tests/py: prepare for set debug change") Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: prepare for set debug changeFlorian Westphal2025-06-221-5/+10
| | | | | | | | | | | | | | | | | Next patch will make initial set dump from kernel emit set debug information, so the obtained netlink debug file won't match what is recorded in tests/py. Furthermore, as the python add rules for each of the family the test is for, subsequent dump will include debug information of the other/previous families. Change the script to skip all unrelated information to only compare the relevant set element information and the generated expressions. This change still finds changes in [ expr ... ] and set elem debug output. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: Properly fix JSON equivalents for netdev/reject.tPhil Sutter2025-06-122-21/+126
| | | | | | | | | | | | | | Revert commit d1a7b9e19fe65 ("tests: py: update netdev reject test file"), the stored JSON equivalents were correct in that they matched the standard syntax input. In fact, we missed a .json.output file recording the expected deviation in JSON output. Fixes: d1a7b9e19fe65 ("tests: py: update netdev reject test file") Fixes: 7ca3368cd7575 ("reject: Unify inet, netdev and bridge delinearization") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: fix json single-flag output for fib & synproxyFlorian Westphal2025-06-042-0/+49
| | | | | | | | | | Blamed commits change output format but did not adjust existing tests: inet/fib.t: WARNING: line 16: '{"nftables": .. Fixes: 38f99ee84fe6 ("json: Print single synproxy flags as non-array") Fixes: dbe5c44f2b89 ("json: Print single fib flag as non-array") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* netlink_delinerize: add more restrictions on meta nfproto removalFlorian Westphal2025-03-203-0/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We can't remove 'meta nfproto' dependencies for all cases. Its removed for ip/ip6 families, this works fine. But for others, e.g. inet, removal is not as simple. For example meta nfproto ipv4 ct protocol tcp is listed as 'ct protocol tcp', even when this is uses in the inet table. Meta L4PROTO removal checks were correct, but refactor this into a helper function to split meta/ct checks from the common calling function. Ct check was lacking, we need to examine ct keys more closely to figure out if they need to retain the network protocol depenency or not. Elide for NFT_CT_SRC/DST and its variants, as those imply the network protocol to use, all others must keep it as-is. Also extend test coverage for this. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1783 Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: remove unknown fieldsPablo Neira Ayuso2025-03-193-3/+3
| | | | | | | | | Amend tests/py after libnftnl fixes: a7dfa49d34c7 ("expr: ct: print key name of id field") dba1b687a9a7 ("expr: payload: print tunnel header") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: reduce register waste with non-constant binop expressionsPablo Neira Ayuso2025-03-103-0/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Register use is not good with bitwise operations that involve three or more selectors, eg. mark set ip dscp and 0x3 or ct mark or meta mark [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ] [ bitwise reg 1 = ( reg 1 >> 0x00000002 ) ] [ bitwise reg 1 = ( reg 1 & 0x00000003 ) ^ 0x00000000 ] [ ct load mark => reg 2 ] [ bitwise reg 1 = ( reg 1 | reg 2 ) ] [ meta load mark => reg 3 ] <--- this could use register 2 instead! [ bitwise reg 1 = ( reg 1 | reg 3 ) ] [ meta set mark with reg 1 ] register 3 is used to store meta mark, however, register 2 can be already use since register 1 already stores the partial result of the bitwise operation for this expression. After this fix: [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ] [ bitwise reg 1 = ( reg 1 >> 0x00000002 ) ] [ bitwise reg 1 = ( reg 1 & 0x00000003 ) ^ 0x00000000 ] [ ct load mark => reg 2 ] [ bitwise reg 1 = ( reg 1 | reg 2 ) ] [ meta load mark => reg 2 ] <--- recycle register 2 [ bitwise reg 1 = ( reg 1 | reg 2 ) ] [ meta set mark with reg 1 ] Release source register in bitwise operation given destination register already stores the partial result of the expression. Extend tests/py to cover this. Fixes: 54bfc38c522b ("src: allow binop expressions with variable right-hand operands") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: support for bitfield payload statement with binary ↵Pablo Neira Ayuso2025-03-076-0/+1168
| | | | | | | | | | | | | | | | | | | | | | | | | operation Add a new function to deal with payload statement delinearization with binop expression. Infer the payload offset from the mask, then walk the template list to determine if estimated offset falls within a matching header field. If so, then validate that this is not a raw expression but an actual bitfield matching. Finally, trim the payload expression length accordingly and adjust the payload offset. instead of: @nh,8,5 set 0x0 it displays: ip dscp and 0x1 Update tests/py to cover for this enhancement. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: expr_build_udata_recurse should recurseFlorian Westphal2025-03-063-0/+91
| | | | | | | | | | | | | | | | | | | | | | | | | | If we see EXPR_BINOP, recurse: ->left can be another EXPR_BINOP. This is irrelevant for 'typeof' named sets, but for anonymous sets, the key is derived from the concat expression that builds the lookup key for the anonymous set. tcp option mptcp subtype . ip daddr { mp-join. 10.0.0.1, .. needs two binops back-to-back: [ exthdr load tcpopt 1b @ 30 + 2 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x000000f0 ) ^ 0x00000000 ] [ bitwise reg 1 = ( reg 1 >> 0x00000004 ) ] This bug prevents concat_expr_build_udata() from creating the userdata key at load time. When listing the rules, we get an assertion: nft: src/mergesort.c:23: concat_expr_msort_value: Assertion `ilen > 0' failed. because the set has a key with 0-length integers. Signed-off-by: Florian Westphal <fw@strlen.de>
* expression: propagate key datatype for anonymous setsFlorian Westphal2025-03-063-9/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | set s { typeof tcp option mptcp subtype elements = { mp-join, dss } } is listed correctly. The set key provides the 'mptcpopt_subtype' information and listing can print all elements with symbolic names. In anon set case this doesn't work: tcp option mptcp subtype { mp-join, dss } is printed as "... subtype { 1, 2}" because the anon set only provides plain integer type. This change propagates the datatype to the individual members of the anon set. After this change, multiple existing data types such as TYPE_ICMP_TYPE could theoretically be replaced by integer-type aliases. However, those datatypes are already exposed to userspace via the 'set type' keyword. Thus removing them will break set definitions that use them. Signed-off-by: Florian Westphal <fw@strlen.de>
* tcpopt: add symbol table for mptcp suboptionsFlorian Westphal2025-03-063-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | nft can be used t match on specific multipath tcp subtypes: tcp option mptcp subtype 0 However, depending on which subtype to match, users need to look up the type/value to use in rfc8684. Add support for mnemonics and "nft describe tcp option mptcp subtype" to get the subtype list. Because the number of unique 'enum datatypes' is limited by ABI contraints this adds a new mptcp suboption type as integer alias. After this patch, nft supports all of the following: add element t s { mp-capable } add rule t c tcp option mptcp subtype mp-capable add rule t c tcp option mptcp subtype { mp-capable, mp-fail } For the 3rd case, listing will break because unlike for named sets, nft lacks the type information needed to pretty-print the integer values, i.e. nft will print the 3rd rule as 'subtype { 0, 6 }'. This is resolved in a followup patch. Other problematic constructs are: set s1 { typeof tcp option mptcp subtype . ip saddr elements = { mp-fail . 1.2.3.4 } } Followed by: tcp option mptcp subtype . ip saddr @s1 nft will print this as: tcp option mptcp unknown & 240) >> 4 . ip saddr @s1 All of these issues are not related to this patch, however, they also occur with other bit-sized extheader fields. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: don't kill dependency for proto_thFlorian Westphal2025-03-063-0/+40
| | | | | | | | | | | | | | proto_th carries no information about the proto number, we need to preserve the L4 protocol expression unless we can be sure that For example, if "meta l4proto 91 @th,0,16 0" is simplified to "th sport 0", the information of protocol number is lost. Based on initial patch from Xiao Liang. Signed-off-by: Xiao Liang <shaw.leon@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: use range expression for OP_EQ and OP_IMPLICITPablo Neira Ayuso2025-02-2143-318/+159
| | | | | | | | | | | | | | | | | | range expression is available since v4.9-rc1~127^2~67^2~3, replace the two cmp expression when generating netlink bytecode. Code to delinearize the two cmp expressions to represent the range remains in place for backwards compatibility. The delinearize path to parse range expressions with NFT_OP_EQ is already present since: 3ed932917cc7 ("src: use new range expression for != [a,b] intervals") Update tests/py payload accordingly, json tests need no update since they already use the range to represent them. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: extend raw payload match testsFlorian Westphal2025-02-073-0/+217
| | | | | | | | Add more test cases to exercise binop elimination for raw payload matches. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow binop expressions with variable right-hand operandsJeremy Sowden2024-12-0412-0/+216
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hitherto, the kernel has required constant values for the `xor` and `mask` attributes of boolean bitwise expressions. This has meant that the right-hand operand of a boolean binop must be constant. Now the kernel has support for AND, OR and XOR operations with right-hand operands passed via registers, we can relax this restriction. Allow non-constant right-hand operands if the left-hand operand is not constant, e.g.: ct mark & 0xffff0000 | meta mark & 0xffff The kernel now supports performing AND, OR and XOR operations directly, on one register and an immediate value or on two registers, so we need to be able to generate and parse bitwise boolean expressions of this form. If a boolean operation has a constant RHS, we continue to send a mask-and-xor expression to the kernel. Add tests for {ct,meta} mark with variable RHS operands. JSON support is also included. This requires Linux kernel >= 6.13-rc. [ Originally posted as patch 1/8 and 6/8 which has been collapsed and simplified to focus on initial {ct,meta} mark support. Tests have been extracted from 8/8 including a tests/py fix to payload output due to incorrect output in original patchset. JSON support has been extracted from patch 7/8 --pablo] Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Fix for storing payload into missing filePhil Sutter2024-11-061-3/+2
| | | | | | | | | When running a test for which no corresponding *.payload file exists, the *.payload.got file name was incorrectly constructed due to 'payload_path' variable not being set. Fixes: 2cfab7a3e10fc ("tests/py: Write dissenting payload into the right file") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: fix up udp csum fixup outputFlorian Westphal2024-09-111-2/+2
| | | | | | | | | | | | Preceeding commit switched udp to use the inkernel csum parser, so tests warn: WARNING: line 7: 'add rule ip test-ip4 input iif "lo" udp checksum set 0': '[ payload write reg 1 => 2b @ transport header + 6 csum_type 1 csum_off 6 csum_flags 0x0 ]' mismatches '[ payload write reg 1 => 2b @ transport header + 6 csum_type 0 csum_off 0 csum_flags 0x1 ]' Fixes: f89abfb4068d ("proto: use NFT_PAYLOAD_L4CSUM_PSEUDOHDR flag to mangle UDP checksum") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: drop redundant JSON outputsPablo Neira Ayuso2024-06-252-86/+0
| | | | | | | | | | | 8abe71f862e6 ("tests: py: Warn if recorded JSON output matches the input") adds a warning on duplicated JSON outputs. Remove them when running tests with -j: WARNING: Recorded JSON output matches input for: icmp code { 2, 4, 54, 33, 56} Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* dynset: avoid errouneous assert with ipv6 concat dataSon Dinh2024-06-1611-0/+141
| | | | | | | | | | | | | | | | | | nft add rule ip6 table-test chain-1 update @map-X { ip6 saddr : 1000::1 . 5001 } nft: src/netlink_linearize.c:873: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. Aborted (core dumped) This is because we pass the EXPR_SET_ELEM expr to the register allocation, which will make it reserve 1 128 bit register / 16 bytes. This happens to be enough for most cases, but its not for ipv6 concat data. Pass the actual key and data instead: This will reserve enough space to hold a possible concat expression. Also add test cases. Signed-off-by: Son Dinh <dinhtrason@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: Drop needless recorded JSON outputsPhil Sutter2024-04-125-512/+0
| | | | | | These match the input already, no need to track them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: Warn if recorded JSON output matches the inputPhil Sutter2024-04-121-0/+2
| | | | | | Actively support spring-cleaning by nagging callers. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: Fix some JSON equivalentsPhil Sutter2024-04-123-55/+75
| | | | | | | | | | | | Make sure they match the standard syntax input as much as possible. For some reason inet/tcp.t.json was using plain arrays in place of binary OR expressions in many cases. These arrays are interpreted as list expressions, which seems to be semantically identical but the goal here is to present an accurate equivalent to the rule in standard syntax. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Accept more than two operands in binary expressionsPhil Sutter2024-04-122-143/+28
| | | | | | | | | | | | | | The most common use case is ORing flags like | syn | ack | rst but nft seems to be fine with less intuitive stuff like | meta mark set ip dscp << 2 << 3 so support all of them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: complete icmp and icmpv6 updatePablo Neira Ayuso2024-04-045-14/+14
| | | | | | | Update json update and leftover payload update to complete 5fecd2a6ef61 ("src: disentangle ICMP code types"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: disentangle ICMP code typesPablo Neira Ayuso2024-04-042-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, ICMP{v4,v6,inet} code datatypes only describe those that are supported by the reject statement, but they can also be used for icmp code matching. Moreover, ICMP code types go hand-to-hand with ICMP types, that is, ICMP code symbols depend on the ICMP type. Thus, the output of: nft describe icmp_code look confusing because that only displays the values that are supported by the reject statement. Disentangle this by adding internal datatypes for the reject statement to handle the ICMP code symbol conversion to value as well as ruleset listing. The existing icmp_code, icmpv6_code and icmpx_code remain in place. For backward compatibility, a parser function is defined in case an existing ruleset relies on these symbols. As for the manpage, move existing ICMP code tables from the DATA TYPES section to the REJECT STATEMENT section, where this really belongs to. But the icmp_code and icmpv6_code table stubs remain in the DATA TYPES section because that describe that this is an 8-bit integer field. After this patch: # nft describe icmp_code datatype icmp_code (icmp code) (basetype integer), 8 bits # nft describe icmpv6_code datatype icmpv6_code (icmpv6 code) (basetype integer), 8 bits # nft describe icmpx_code datatype icmpx_code (icmpx code) (basetype integer), 8 bits do not display the symbol table of the reject statement anymore. icmpx_code_type is not used anymore, but keep it in place for backward compatibility reasons. And update tests/shell accordingly. Fixes: 5fdd0b6a0600 ("nft: complete reject support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: use DTYPE_F_PREFIX only for IP address datatypePablo Neira Ayuso2024-03-212-10/+10
| | | | | | | | | | | | | | | | | DTYPE_F_PREFIX flag provides a hint to the netlink delinearize path to use prefix notation. It seems use of prefix notation in meta mark causes confusion, users expect to see prefix in the listing only in IP address datatypes. Untoggle this flag so (more lengthy) binop output such as: meta mark & 0xffffff00 == 0xffffff00 is used instead. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1739 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: restore binop syntax when listing ruleset for flagsPablo Neira Ayuso2024-03-204-26/+317
| | | | | | | | | | | c3d57114f119 ("parser_bison: add shortcut syntax for matching flags without binary operations") provides a similar syntax to iptables using a prefix representation for flag matching. Restore original representation using binop when listing the ruleset. The parser still accepts the prefix notation for backward compatibility. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2025-09-27 09:21:12 +0000