summaryrefslogtreecommitdiffstats
path: root/tests/shell/testcases/nft-f
Commit message (Collapse)AuthorAgeFilesLines
* tests: shell: add quotes when using <<<-style here documentFlorian Westphal2018-06-0811-11/+11
| | | | | | | | | bash 4.3.30 removes newlines in RULESET when "" are omitted, which then causes nft -f to complain about invalid syntax. As a result, all test cases that use this here-doc style fail. Signed-off-by: Florian Westphal <fw@strlen.de>
* Support 'nft -f -' to read from stdinPhil Sutter2018-03-2015-172/+40
| | | | | | | | | | | | | | | | | | In libnftables, detect if given filename is '-' and treat it as the common way of requesting to read from stdin, then open /dev/stdin instead. (Calling 'nft -f /dev/stdin' worked before as well, but this makes it official.) With this in place and bash's support for here strings, review all tests in tests/shell for needless use of temp files. Note that two categories of test cases were intentionally left unchanged: - Tests creating potentially large rulesets to avoid running into shell parameter length limits. - Tests for 'include' directive for obvious reasons. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: autogenerate dump verificationLaura Garcia Liebana2018-03-0913-59/+103
| | | | | | | | | | | | | | | | | | | | Complete the automated shell tests with the verification of the test file dump, only for positive tests and if the test execution was successful. It's able to generate the dump file with the -g option. Example: # ./run-tests.sh -g testcases/chains/0001jumps_0 The dump files are generated in the same path in the folder named dumps/ with .nft extension. It has been avoided the dump verification code in every test file. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: redefine and undefinePablo Neira Ayuso2018-03-041-0/+40
| | | | | | This tests cover the new redefine and undefine scripting feature. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Prevent lockout in nft-f/0008split_tables_0Phil Sutter2017-11-221-2/+2
| | | | | | | | | | | Since packets traverse both tables, the accept rule in the first one is ineffective due to the second table's drop policy. To prevent lockouts when running the testsuite via SSH connection, set the second chain's policy to accept as well. Fixes: 337c7e0de3d9d ("tests: shell: make sure split table definition works via nft -f") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Add tests for variable definition.Varsha Rao2017-10-173-0/+74
| | | | | | | This patch adds test cases for a variable definition and redefinition. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sets: Fix for missing space after last elementPhil Sutter2017-03-224-9/+9
| | | | | | | | | | | Not having a space between the last element in a set and the closing curly brace looks ugly, so add it here. This also adjusts all shell testcases as they match whitespace in nft output and therefore fail otherwise. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add testcase for different defines usageArturo Borrero Gonzalez2016-11-291-0/+44
| | | | | | | | | | | | | | | | | | This testcase add some defines in a nft -f run and then uses them in different spots (which are not covered in previous testcases). * defines used to define another one * different datatypes (numbers, strings, bits, ranges) * usage in sets, maps, contatenatios * single rules with single statements, multiple statements * reuse define in same rule Perhaps this isn't testing many different code path, but I find this interesting to have given it will probably be one of the most common use cases of nftables. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add a testcase for many definesArturo Borrero Gonzalez2016-11-291-0/+37
| | | | | | | Use many defines in a single nft -f run. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: allow to use variable to add/create/delete elementsPablo Neira Ayuso2016-10-211-0/+22
| | | | | | | | | | | | | | | | | | | | | | | Using variable definitions from element command doesn't work, eg. -test.nft- define whitelist_v4 = { 1.1.1.1 } table inet filter { set whitelist_v4 { type ipv4_addr; } } add element inet filter whitelist_v4 $whitelist_v4 -EOF- # nft -f test.nft test.nft:7:38-38: Error: syntax error, unexpected '$', expecting '{' add element inet filter whitelist_v4 $whitelist_v4 ^ Fix this by using set_block_expr rule for every element command. This patch also comes with a new regression test. Reported-by: Leon Merten Lohse <leon@green-side.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: allow variable references in set elements definitionPablo Neira Ayuso2016-08-291-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Andreas reports that he cannot use variables in set definitions: define s-ext-2-int = 10.10.10.10 . 25, 10.10.10.10 . 143 set s-ext-2-int { type ipv4_addr . inet_service elements = { $s-ext-2-int } } This syntax is not correct though, since the curly braces should be placed in the variable definition itself, so we have context to handle this variable as a list of set elements. The correct syntax that works after this patch is: define s-ext-2-int = { 10.10.10.10 . 25, 10.10.10.10 . 143 } table inet forward { set s-ext-2-int { type ipv4_addr . inet_service elements = $s-ext-2-int } } Reported-by: Andreas Hainke <andreas.hainke@foteviken.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: make sure split table definition works via nft -fPablo Neira Ayuso2016-07-131-0/+50
| | | | | | Add test to cover split table definition in one single file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: make testcases which using tcp/udp port more rubostLiping Zhang2016-06-154-4/+4
| | | | | | | | | | | | | | | | In my mechain, port 12345 is mapped to italk in /etc/services: italk 12345/tcp # Italk Chat System So when we add nft rule with udp port "12345", nft list ruleset will displayed it as "italk", that cause the result is not same with expected, then testcase fail. Add "-nn" option when dump the rulesets from the kernel, make testcases which using tcp/udp port more rubost. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add testcase to catch segfault if invalid syntax was usedArturo Borrero2016-05-131-0/+21
| | | | | | | | This helps to catch 5afa5a1 ("evaluate: check for NULL datatype in rhs in lookup expr"). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add testcase for 'nft -f' load with actionsArturo Borrero2016-05-131-0/+68
| | | | | | | Let's tests loading a ruleset with actions. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: delete tempfile failover in testcasesArturo Borrero2016-04-155-35/+5
| | | | | | | | It seems both Debian/Fedora (and derivates) contains mktemp (from the coreutils package) so it makes no sense to have this failover, which looks buggy also. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add new testcases for commit/rollbackArturo Borrero2016-04-074-0/+267
| | | | | | | | | | | New simple testcases for kernel commit/rollback operations. * ruleset A is loaded (good ruleset) * ruleset B is loaded (bad ruleset): fail is expected * ruleset A should remain in the kernel Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add first `nft -f' testsArturo Borrero2016-03-031-0/+25
This patch add some basic initial tests. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>