summaryrefslogtreecommitdiffstats
path: root/tests/shell/testcases/maps
Commit message (Collapse)AuthorAgeFilesLines
* json: Print single set flag as non-arrayPhil Sutter29 hours11-42/+14
| | | | | | | | The code obviously intended to do this already but got the array length check wrong. Fixes: e70354f53e9f6 ("libnftables: Implement JSON output support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: print set element with multi-word description in single one linePablo Neira Ayuso2025-03-1813-508/+986
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the set element: - represents a mapping - has a timeout - has a comment - has counter/quota/limit - concatenation (already printed in a single line before this patch) ie. if the set element requires several words, then print it in one single line. Before this patch: table ip x { set y { typeof ip saddr counter elements = { 192.168.10.35 counter packets 0 bytes 0, 192.168.10.101 counter packets 0 bytes 0, 192.168.10.135 counter packets 0 bytes 0 } } } After this patch: table ip x { set y { typeof ip saddr counter elements = { 192.168.10.35 counter packets 0 bytes 0, 192.168.10.101 counter packets 0 bytes 0, 192.168.10.135 counter packets 0 bytes 0 } } } Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Support typeof in set and map typesPhil Sutter2024-11-066-20/+114
| | | | | | | | | | | | | | | | Implement this as a special "type" property value which is an object with sole property "typeof". The latter's value is the JSON representation of the expression in set->key, so for concatenated typeofs it is a concat expression. All this is a bit clumsy right now but it works and it should be possible to tear it down a bit for more user-friendliness in a compatible way by either replacing the concat expression by the array it contains or even the whole "typeof" object - the parser would just assume any object (or objects in an array) in the "type" property value are expressions to extract a type from. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Join arithmetic statements in maps/vmap_timeoutPhil Sutter2024-10-111-6/+3
| | | | | | | In light of the recent typo fix, go an extra step and merge the modulo and offset adjustment in a single term. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: fix spurious dump failure in vmap timeout testFlorian Westphal2024-10-111-1/+1
| | | | | | | | | | | | | | | Blamed commit can update the timeout to 6s, but last line waits for 5 seconds and expects that to be enough to have all elements vanish. Fix the typo to limit update timeout also to 5 seconds and not 6. This fixes spurious dump failures like this one: - elements = { 1.2.3.4 . 22 : jump ssh_input } + elements = { 1.2.3.4 . 22 : jump ssh_input, + 10.0.95.144 . 38023 timeout 6s expires 545ms : jump other_input } Fixes: db80037c0279 ("tests: shell: extend vmap test with updates") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: extend vmap test with updatesFlorian Westphal2024-09-101-3/+45
| | | | | | | | | | | | It won't validate that the update is actually effective, but it will trigger relevant update logic in kernel. This means the updated test works even if the kernel doesn't support updates. A dedicated test will be added to check timeout updates work. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: resolve check-tree.sh errorsFlorian Westphal2024-08-083-0/+0
| | | | | | | | | | | | | | | | | | | | | It prints a few errors like this: ERR: "tests/shell/testcases/chains/jump_to_base_chain" has no "tests/shell/testcases/chains/dumps/jump_to_base_chain.{nft,nodump}" file For all of those, add the relevant .nft dump file. Add a 'nodump' file in case the test doesn't print anything (e.g. because the test checks that invalid ruleset fails validation). Some tests have a .nft but not .json-nft, this is because json lacks some features, in particular "typeof" and anonymous/implicit chains. ERR: "tests/shell/testcases/maps/delete_element_catchall" has no "tests/shell/testcases/maps/dumps/delete_element_catchall.{nft,nodump}" file ERR: "tests/shell/testcases/maps/dumps/delete_elem_catchall.nft" has no test "tests/shell/testcases/maps/delete_elem_catchall" these two are related, rename the dump file to match the script name. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: cover set element deletion in mapsPablo Neira Ayuso2024-07-054-0/+87
| | | | | | | Extend existing coverage to deal with set element deletion, including catchall elements too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip ipsec tests if kernel does not support itPablo Neira Ayuso2024-06-131-0/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add dependencies to skip unsupported tests in older kernelsPablo Neira Ayuso2024-06-132-0/+6
| | | | | | Update tests which contain unsupported features in older kernels. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add support for variables in map expressionsJeremy Sowden2024-05-208-0/+326
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is possible to use a variable to initialize a map, which is then used in a map statement: define dst_map = { ::1234 : 5678 } table ip6 nat { map dst_map { typeof ip6 daddr : tcp dport; elements = $dst_map } chain prerouting { ip6 nexthdr tcp redirect to ip6 daddr map @dst_map } } However, if one tries to use the variable directly in the statement: define dst_map = { ::1234 : 5678 } table ip6 nat { chain prerouting { ip6 nexthdr tcp redirect to ip6 daddr map $dst_map } } nft rejects it: /space/azazel/tmp/ruleset.1067161.nft:5:47-54: Error: invalid mapping expression variable ip6 nexthdr tcp redirect to ip6 daddr map $dst_map ~~~~~~~~~ ^^^^^^^^ It also rejects variables in stateful object statements: define quota_map = { 192.168.10.123 : "user123", 192.168.10.124 : "user124" } table ip nat { quota user123 { over 20 mbytes } quota user124 { over 20 mbytes } chain prerouting { quota name ip saddr map $quota_map } } thus: /space/azazel/tmp/ruleset.1067161.nft:15:29-38: Error: invalid mapping expression variable quota name ip saddr map $quota_map ~~~~~~~~ ^^^^^^^^^^ Add support for these uses together with some test-cases. Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067161 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Fix for maps/typeof_maps_add_delete with ASANPhil Sutter2024-04-243-4/+4
| | | | | | | | With both KASAN and ASAN enabled, my VM is too slow so the ping-induced set entry times out before the test checks its existence. Increase its timeout to 2s, seems to do the trick. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: maps/{vmap_unary,named_limits} require pipapo set backendPablo Neira Ayuso2024-04-082-0/+4
| | | | | | ... sets/typeof_sets_concat needs it too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Add missing json-nft dumpsPhil Sutter2024-03-196-0/+849
| | | | | | | | | Given that a bunch of issues got fixed, add some more dumps. Also add tests/shell/testcases/owner/dumps/0002-persist.nft while at it, even though it's really small. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Regenerate all json-nft dumpsPhil Sutter2024-03-1911-128/+128
| | | | | | | | Ordering of 'nft -j list ruleset' output has changed, Regenerate existing json-nft dumps. No functional change intended, merely the position of chain objects should have moved up in the "nftables" array. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: add test case for named ct objectsFlorian Westphal2024-03-052-0/+165
| | | | | | | | | | Add a dedicated test for named conntrack objects: timeouts, helpers and expectations. A json dump file is not added because the json input code does not support "typeof" declarations for sets/maps. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: move test case to "maps" directoryFlorian Westphal2024-03-012-0/+80
| | | | | | | This tests named object maps, so this should reside in maps/ not sets/ directory. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: maps: add a test case for "limit" objref mapFlorian Westphal2024-03-013-0/+442
| | | | | | | | | check add, delete and removal operations for objref maps. Also check type vs. typeof declarations and use both interval and interval+concatenation (rbtree, pipapo). Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add more json dumpsFlorian Westphal2024-02-262-0/+139
| | | | | | | | | | | | Those are expected to be stable, so add them. Some are not 100% correct, as "typeof" is misprinted as "type" (json output and input parser lack support for this), but for these files the "type" is valid too. This will allow better validation once proper "typeof" support is added to json.c and json-parser.c. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add regression test for catchall double-deleteFlorian Westphal2024-02-182-0/+36
| | | | | | | | Test case for: b1db244ffd04 ("netfilter: nf_tables: check if catch-all set element is active in next generation") Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Pretty-print all *.json-nft dumpsPhil Sutter2024-02-0820-20/+5451
| | | | | | | | | | | | | The problem with single line output as produced by 'nft -j list ruleset' is its incompatibility to unified diff format as any change in this single line will produce a diff which contains the old and new lines in total. This is not just unreadable but will blow up patches which may exceed mailinglists' mail size limits. Convert them all at once by feeding their contents to tests/shell/helpers/json-pretty.sh. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: add a test case for double-flush bug in pipapoFlorian Westphal2024-01-082-0/+34
| | | | | | | | Test for 'netfilter: nft_set_pipapo: skip inactive elements during set walk'. Reported-by: Xingyuan Mo <hdthky0@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add missing .nodump fileFlorian Westphal2023-12-011-0/+0
| | | | | | | | We don't want a dump file here, the test has elements with timeouts, listing will differ depending on timing ("expires $random seconds"). Fixes: 4890211e188a ("tests: shell: add test case for catchall gc bug") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add test case for catchall gc bugFlorian Westphal2023-11-281-0/+13
| | | | | | | | Check for bug fixed with kernel commit 93995bf4af2c ("netfilter: nf_tables: remove catchall element in GC sync path"). Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: clone unary expression datatype to deal with dynamic datatypePablo Neira Ayuso2023-11-222-0/+28
| | | | | | | | When allocating a unary expression, clone the datatype to deal with dynamic datatypes. Fixes: 6b01bb9ff798 ("datatype: concat expression only releases dynamically allocated datatype") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: sanitize "handle" in JSON outputThomas Haller2023-11-2218-18/+18
| | | | | | | | | The "handle" in JSON output is not stable. Sanitize/normalize to zero. Adjust the sanitize code, and regenerate the .json-nft files. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip nat inet if kernel does not support itPablo Neira Ayuso2023-11-221-0/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip maps delete test if dynset lacks delete opFlorian Westphal2023-11-211-0/+2
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add JSON dump filesThomas Haller2023-11-1520-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Generate and add ".json-nft" files. These files contain the output of `nft -j list ruleset` after the test. Also, "test-wrapper.sh" will compare the current ruleset against the ".json-nft" files and test them with "nft -j --check -f $FILE`. These are useful extra tests, that we almost get for free. Note that for some JSON dumps, `nft -f --check` fails (or prints something). For those tests no *.json-nft file is added. The bugs needs to be fixed first. An example of such an issue is: $ DUMPGEN=all ./tests/shell/run-tests.sh tests/shell/testcases/maps/nat_addr_port which gives a file "rc-failed-chkdump" with Command `./tests/shell/../../src/nft -j --check -f "tests/shell/testcases/maps/dumps/nat_addr_port.json-nft"` failed >>>> internal:0:0-0: Error: Invalid map type 'ipv4_addr . inet_service'. internal:0:0-0: Error: Parsing command array at index 3 failed. internal:0:0-0: Error: unqualified type integer specified in map definition. Try "typeof expression" instead of "type datatype". <<<< Tests like "tests/shell/testcases/nft-f/0012different_defines_0" and "tests/shell/testcases/nft-f/0024priority_0" also don't get a .json-nft dump yet, because their output is not stable. That needs fixing too. Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: split map testPablo Neira Ayuso2023-11-114-32/+38
| | | | | | | Split interval + concatenation into a separated file, so older kernels with no pipapo can still run what it is supported. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip if kernel does not support bitshiftPablo Neira Ayuso2023-11-111-0/+2
| | | | | | | | A few tests are missing bitshift checks that has been added to 885845468408 ("tests/shell: skip bitshift tests if kernel lacks support"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip stateful expression in sets tests if kernel lacks supportPablo Neira Ayuso2023-11-111-0/+2
| | | | | | Skip tests that require stateful expressions in sets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip pipapo tests if kernel lacks supportPablo Neira Ayuso2023-11-113-0/+6
| | | | | | Skip tests that require net/netfilter/nft_set_pipapo support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: use bash instead of /bin/sh for testsThomas Haller2023-10-161-1/+1
| | | | | | | | | | | | | | | | | All tests under "tests/shell" are shell scripts with shebang /bin/bash or /bin/sh. This may seem expected, since these tests are under "tests/shell" directory, but any executable file would work. Anyway. The vast majority of the tests has "#!/bin/bash" as shebang. A few tests had "#!/bin/sh" or "#!/bin/sh -e". Unify this and always use bash. Since we anyway require bash, this is not a limitation. Also, if we know that this is a bash script (by parsing the shebang), we can let the test wrapper pass "-x" to the script. The next commit will do that, and it is nicer if the shebangs are all uniform. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: skip adding catchall elements if unuspportedFlorian Westphal2023-09-211-2/+6
| | | | | | | | | | The test fails on kernels without catchall support, so elide this small part. No need to skip the test in this case, the dump file validates that the added elements are no longer there after the timeout. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: perform mark datatype compatibility check from mapsPablo Neira Ayuso2023-09-192-0/+64
| | | | | | | | | | | | | Wrap datatype compatibility check into a helper function and use it for map evaluation, otherwise the following bogus error message is displayed: Error: datatype mismatch, map expects packet mark, mapping expression has type integer Add unit tests to improve coverage for this usecase. Fixes: 5d8e33ddb112 ("evaluate: relax type-checking for integer arguments in mark statements") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: check diff in "maps/typeof_maps_0" and "sets/typeof_sets_0" testThomas Haller2023-09-181-16/+59
| | | | | | | | | | | These tests run different variants based on NFT_TEST_HAVE_osf support. Consequently, we cannot check the pre-generated diff. Instead, construct what we expect dynamically in the script, and compare the ruleset against that. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: skip test cases involving osf match if kernel lacks supportFlorian Westphal2023-09-181-4/+15
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip catchall tests if kernel lacks supportFlorian Westphal2023-09-183-2/+23
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip destroy tests if kernel lacks supportFlorian Westphal2023-09-181-0/+2
| | | | | | | | Destroy support was added for table/flowtable/chain etc. in a single commit, so no need to add capability tests for each destroy subtype. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip map query if kernel lacks supportFlorian Westphal2023-09-181-8/+27
| | | | | | | | | | | | | | On recent kernels one can perform a lookup in a map without a destination register (i.e., treat the map like a set -- pure existence check). Add a feature probe and work around the missing feature in typeof_maps_add_delete: do the test with a simplified ruleset, Indicate skipped even though a reduced test was run (earlier errors cause a failure) to not trigger dump validation error. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: typeof_integer/raw: prefer @nh for payload matchingFlorian Westphal2023-09-104-8/+8
| | | | | | | | | | @ih fails on kernels where payload expression doesn't support the 'inner' base offset. This test isn't about inner headers, so just use @nh which is universally available. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add "--quick" option to skip slow tests (via NFT_TEST_SKIP_slow=y)Thomas Haller2023-09-093-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's important to run (a part) of the tests in a timely manner. Add an option to skip long running tests. Thereby, add a more general NFT_TEST_SKIP_* mechanism. This is related and inverse from "NFT_TEST_HAVE_json", where a test can require [ "$NFT_TEST_HAVE_json" != n ] to run, but is skipped when [ "$NFT_TEST_SKIP_slow" = y ]. Currently only NFT_TEST_SKIP_slow is supported. The user can set such environment variables (or use the -Q|--quick command line option). The configuration is printed in the test info. Tests should check for [ "$NFT_TEST_SKIP_slow" = y ] so that the variable has to be explicitly set to opt-out. For convenience, tests can also add a # NFT_TEST_SKIP(NFT_TEST_SKIP_slow) tag, which is evaluated by test-wrapper.sh. Or they can run a quick, reduced part of the test, but then should still indicate to be skipped. Mark 8 tests are as slow, that take longer than 5 seconds on my machine. With this, a parallel wall time for the non-slow tests is only 7 seconds (on my machine). The ultimate point is to integrate a call to "tests/shell/run-tests.sh" in a `make check` target. For development, you can then export NFT_TEST_SKIP_slow=y and have a fast `make check`. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add missing ".nodump" file for tests without dumpsThomas Haller2023-09-091-0/+0
| | | | | | | | | | | | These files are generated by running `./tests/shell/run-tests.sh -g`. Commit the .nodump files to git. The point is to explicitly make it known that no dump file should be there. This prevents `./tests/shell/run-tests.sh -g` from generating the files and proposing (over and over) to add them to git. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: generate and add ".nft" dump files for existing testsThomas Haller2023-09-096-0/+517
| | | | | | | | | | | | | | | | | | | | | | | | | | | Several tests didn't have a ".nft" dump file committed. Generate one and commit it to git. While not all tests have a stable ruleset to compare, many have. Commit the .nft files for the tests where the output appears to be stable. This was generated by running `./tests/shell/run-tests.sh -g` twice, and commit the files that were identical both times. Note that 7 tests on my machine fail, so those are skipped. Also skip the files tests/shell/testcases/maps/dumps/0004interval_map_create_once_0.nft tests/shell/testcases/nft-f/dumps/0011manydefines_0.nft tests/shell/testcases/sets/dumps/0011add_many_elements_0.nft tests/shell/testcases/sets/dumps/0030add_many_elements_interval_0.nft tests/shell/testcases/sets/dumps/0068interval_stack_overflow_0.nft Those files are larger than 100KB, and I don't think we want to blow up the git repository this way. Even if they are only text files and compress well. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: expand vmap test case to also cause batch abortFlorian Westphal2023-08-292-6/+22
| | | | | | | | | | Let the last few batches also push an update that contains elements twice. This is expected to cause the batch to be aborted, which increases code coverage on kernel side. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add one more chain jump in vmap testFlorian Westphal2023-08-151-0/+5
| | | | | | | | | | | This triggers a splat on kernels that lack 314c82841602 ("netfilter: nf_tables: can't schedule in nft_chain_validate"). There is another test case that triggers this splat (optimize/ruleset), but that test uses some more advanced features that don't exist on older kernels, so the splat is never seen. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add test with concatenation, vmap and timeoutFlorian Westphal2023-08-132-0/+62
| | | | | | | | | Add 4k elements to map, with timeouts in range 1..3s, also add a catchall element with timeout. Check that all elements are no longer included in set list after 4s. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add test case for double-deactivationFlorian Westphal2023-08-122-0/+15
| | | | | Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Review test-cases for destroy commandPhil Sutter2023-08-033-13/+6
| | | | | | | | | | | | | | Having separate files for successful destroy of existing and non-existing objects is a bit too much, just combine them into one. While being at it: * No bashisms, using /bin/sh is fine * Append '-e' to shebang itself instead of calling 'set' * Use 'nft -a -e' instead of assuming the created rule's handle value * Shellcheck warned about curly braces, quote them Signed-off-by: Phil Sutter <phil@nwl.cc>
generated by cgit v1.2.3 (git 2.25.0) at 2025-05-14 13:20:08 +0000