summaryrefslogtreecommitdiffstats
path: root/tests/shell/testcases/sets
Commit message (Collapse)AuthorAgeFilesLines
* tests: update to new syntax to add/update set from packet pathPablo Neira Ayuso2018-03-161-3/+3
| | | | | Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: fix tests for deletion via handle attributeHarsha Sharma2018-03-091-5/+7
| | | | | | | | Fetch object, chain and set handles and with '-a' option and then delete them. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: autogenerate dump verificationLaura Garcia Liebana2018-03-0930-49/+235
| | | | | | | | | | | | | | | | | | | | Complete the automated shell tests with the verification of the test file dump, only for positive tests and if the test execution was successful. It's able to generate the dump file with the -g option. Example: # ./run-tests.sh -g testcases/chains/0001jumps_0 The dump files are generated in the same path in the folder named dumps/ with .nft extension. It has been avoided the dump verification code in every test file. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: missing redirection to filePablo Neira Ayuso2018-03-051-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add tests for deletion of sets via set handleHarsha Sharma2018-03-051-0/+33
| | | | | | | Delete set with given unique set handle. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: set timeout and size combination coveragePablo Neira Ayuso2018-03-051-0/+15
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: regression test for bugzilla 1228Pablo Neira Ayuso2018-02-281-0/+30
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: introduce datatype ifname_typeArturo Borrero Gonzalez2018-02-251-0/+35
| | | | | | | | | | | | | | | | | | | | | | | | This new datatype is a string subtype. It will allow us to build named maps/sets using meta keys like 'iifname', 'oifname', 'ibriport' or 'obriport'. Example: table inet t { set s { type ifname elements = { "eth0", "eth1" } } chain c { iifname @s accept oifname @s accept } } Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add test case for sets updated from packet pathFlorian Westphal2018-02-141-0/+17
| | | | | | | | currently kernel may pick a set implementation that doesn't provide a ->update() function. This causes an error when user attempts to add the nftables rule that is supposed to add entries to the set. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: enable sets test case 27Florian Westphal2018-02-141-0/+0
| | | | | | needs +x, else run-tests.sh won't run it. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: Add back named_interval_automerging_0Phil Sutter2018-01-251-0/+12
| | | | | | | Change the test to expect no automerging since it was disabled recently. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Don't merge adjacent/overlapping rangesPhil Sutter2018-01-111-12/+0
| | | | | | | | | | | | | | | | | | | | | Previously, when adding multiple ranges to a set they were merged if overlapping or adjacent. This might cause inconvenience though since it is afterwards not easily possible anymore to remove one of the merged ranges again while keeping the others in place. Since it is not possible to have overlapping ranges, this patch adds a check for newly added ranges to make sure they don't overlap if merging is turned off. Note that it is not possible (yet?) to enable range merging using nft tool. Testsuite had to be adjusted as well: One test in tests/py changed avoid adding overlapping ranges and the test in tests/shell which explicitly tests for this feature dropped. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: no need for 'name' token for metersPablo Neira Ayuso2017-11-241-2/+2
| | | | | | | Rework grammar to skip the 'name' token after 'meter' for named meters. For consistency with sets and maps in terms of syntax. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: deprecate "flow table" syntax, replace it by "meter"Pablo Neira Ayuso2017-11-241-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | According to bugzilla 1137: "flow tables" should not be syntactically unique. "Flow tables are always named, but they don't conform to the way sets, maps, and dictionaries work in terms of "add" and "delete" and all that. They are also "flow tables" instead of one word like "flows" or "throttle" or something. It seems weird to just have these break the syntactic expectations." Personally, I never liked the reference to "table" since we have very specific semantics in terms of what a "table" is netfilter for long time. This patch promotes "meter" as the new keyword. The former syntax is still accepted for a while, just to reduce chances of breaking things. At some point the former syntax will just be removed. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1137 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
* tests: shell: Add test for IPv4 Mapped IPv6 address.Varsha Rao2017-11-201-0/+25
| | | | | | | This patch adds test case for IPv4 Mapped IPv6 address. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Rename 0025named_limit_0 to 0026named_limit_0Varsha Rao2017-11-201-0/+0
| | | | | | | | This renames file 0025named_limit_0 to 0026named_limit_0, there is already a test whose prefix is 0025. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Add test case for sets.Varsha Rao2017-10-171-0/+17
| | | | | | | This patch adds test case for anonymous sets. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add testcases for named limitsHarsha Sharma2017-10-171-0/+27
| | | | | | | | Add testcases for creating named limits and referencing them from rule Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add testcases for named objectsHarsha Sharma2017-10-061-0/+41
| | | | | | | | Add testcases for creating named objects with unique name, defined by user and referencing them from rule. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Add test for incomplete set add set commandShyam Saini2017-06-261-0/+16
| | | | | | | | | | | | | | | | | | | | | | | Before c6cd7c22548a ("src: fix crash when inputting an incomplete set add command") commit, if we run nft with incomplete "add set" command it caused segmentation fault and exit with error code 139 and further it didn't throw any error message. For example: $ sudo nft add set t s But after the aforementioned commit it throws syntax error message and exits with return value 1. For example: $ sudo nft add set t s <cmdline>:1:12-12: Error: syntax error, unexpected newline, expecting '{' add set t s ^ This commit tests changes made in such commit. Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Add test for flush command selectiveness on setsElise Lennion2017-03-241-0/+41
| | | | | | | | This tests the selectiveness of flush command on structures that use the generic set infrastructure (sets, maps and flow tables). Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sets: Fix for missing space after last elementPhil Sutter2017-03-221-1/+1
| | | | | | | | | | | Not having a space between the last element in a set and the closing curly brace looks ugly, so add it here. This also adjusts all shell testcases as they match whitespace in nft output and therefore fail otherwise. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Add test cases for nested anonymous setsPhil Sutter2017-03-221-0/+46
| | | | | | | | | This makes sure nesting of anonymous sets works regardless of whether defines are used or not. As a side-effect, it also checks that overlap checking when IP address prefixes are used, works. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: test comments with small setsPablo Neira Ayuso2017-03-131-0/+12
| | | | | | Just a test to cover the bitmap backend implementation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: validate set sizePablo Neira Ayuso2017-01-242-0/+28
| | | | | | | | | | Add two tests to make sure that set size checks work fine: 1) Check if set size is indeed working, this is a simple one. 2) Check if set size is correct after ENFILE error, there is bug that adds a new spare slot everytime we hit this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Add test for flush bug on sets with sizeElise Lennion2017-01-241-0/+12
| | | | | | | | This tests for a bug where elements can't be added after flushing a full set with the flag NFTNL_SET_DESC_SIZE set. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Add test for set element leak bugElise Lennion2017-01-231-0/+11
| | | | | | | This tests for a bug where a repeated element is added and the set elements counter is incorrectly increased. Signed-off-by: Elise Lennion <elise.lennion@gmail.com>
* tests: shell: cover cache flush on flush rulesetPablo Neira Ayuso2017-01-101-0/+26
| | | | | | | | This tests covers 530a82a72d15 ("evaluate: Update cache on flush ruleset"). Make sure loading twice including an upfront ruleset flush leaves us with an empty cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add test case for inserting element into verdict mapLiping Zhang2016-12-041-0/+25
| | | | | | | | | | "dalegaard@gmail.com" reports that when inserting an element into a verdict map, kernel crash will happen. Now add this test case so we can avoid future regressions fail. Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Acked-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Add regression test for malformed setsAnatole Denis2016-11-291-0/+33
| | | | | | | | | | see: 5afa5a164ff1c066af1ec56d875b91562882bd50 When a malformed set is added, it was added before erroring out, causing a segfault further down when used. This tests for this case, ensuring that nftables doesn't segfault but errors correctly Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: another testcase for deleting many set elementsArturo Borrero Gonzalez2016-11-241-0/+48
| | | | | | | | | This testcase adds and deletes many elements in a set. We add and delete 65.536 elements in two different nft -f runs. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: testcase for deleting many set elementsArturo Borrero Gonzalez2016-11-241-0/+46
| | | | | | | | | | This testcase adds and deletes many elements in a set. We add and delete 65.536 elements in a same batch of netlink messages, (single nft -f run). Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: testcase for adding many set elementsArturo Borrero Gonzalez2016-11-241-0/+32
| | | | | | | | This testcase adds many elements in a set. We add 65.356 elements. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add testcases for comments in set elementsArturo Borrero Gonzalez2016-11-093-0/+35
| | | | | | | | This patch adds a several testcases for comments in set elements. This includes the netfilter bug #1090 about comments in set interval elements. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: introduce the cache testcases directoryArturo Borrero Gonzalez2016-11-091-29/+0
| | | | | | | This directory is for testcases related to the nft cache. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: cover add and create set commandPablo Neira Ayuso2016-08-251-0/+15
| | | | | | | This patch validates that creation of an already existing element bails out with EEXIST. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: cover add and create set commandPablo Neira Ayuso2016-08-241-0/+14
| | | | | | | This patch validates that creation of an already existing set bails out with EEXIST. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: cleanup tempfile handling in testcases/sets/cache_handling_0Arturo Borrero2016-06-151-7/+1
| | | | | | | | It uses a bogus pattern which was cleaned up already in others testscases, and this is a leftover. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add testcases for named sets with intervalsArturo Borrero2016-04-275-0/+97
| | | | | | | Let's add some testcases for named sets with intervals and ranges. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add test case for cache bugArturo Borrero2015-12-181-0/+35
This testcase for sets catch a cache bug. By the time of this commit this test is failing, so the test suite shows: % sudo ./run-tests.sh I: using nft binary /usr/local/sbin/nft I: [OK] ./testcases/maps/anonymous_snat_map_0 I: [OK] ./testcases/maps/named_snat_map_0 W: [FAILED] ./testcases/sets/cache_handling_0 I: [OK] ./testcases/optionals/comments_0 I: [OK] ./testcases/optionals/comments_handles_monitor_0 I: [OK] ./testcases/optionals/handles_1 I: [OK] ./testcases/optionals/handles_0 I: [OK] ./testcases/optionals/comments_handles_0 I: results: [OK] 7 [FAILED] 1 [TOTAL] 8 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>