summaryrefslogtreecommitdiffstats
path: root/tests/shell/testcases/sets
Commit message (Collapse)AuthorAgeFilesLines
* netlink: bogus concatenated set ranges with netlink message overrunPablo Neira Ayuso2025-04-212-0/+741
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When building each component of the set element key, a late byteorder switch is performed to ensure that all components in the interval are represented in big endian, as required by the pipapo backend. In case that the set element does not fit into the netlink message, the byteorder switch happens twice, leading to inserting an element with a bogus component with large sets, so instead: "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890" listing reports: 16777216 . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890" Note that 16777216 is 0x1000000, which should instead be 0x00000001 to represent "lo" as u32. Fix this by switching the value in a temporary variable and use it to set the set element key attribute in the netlink message. Later, revisit this to perform this byteorder switch from evaluation step. Add tests/shell unit to cover for this bug. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1792 Fixes: 8ac2f3b2fca3 ("src: Add support for concatenated set ranges") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: missing ct count elements in new set_stmt testPablo Neira Ayuso2025-03-251-0/+4
| | | | | | | | | Add missing entries to dump file. Reported-by: Florian Westphal <fw@strlen.de> Fixes: 1f3d0b9cf9cc ("tests: shell: extend coverage for set element statements") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: extend coverage for set element statementsPablo Neira Ayuso2025-03-212-0/+110
| | | | | | Add a test to cover the existing set element statements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: print set element with multi-word description in single one linePablo Neira Ayuso2025-03-188-10/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the set element: - represents a mapping - has a timeout - has a comment - has counter/quota/limit - concatenation (already printed in a single line before this patch) ie. if the set element requires several words, then print it in one single line. Before this patch: table ip x { set y { typeof ip saddr counter elements = { 192.168.10.35 counter packets 0 bytes 0, 192.168.10.101 counter packets 0 bytes 0, 192.168.10.135 counter packets 0 bytes 0 } } } After this patch: table ip x { set y { typeof ip saddr counter elements = { 192.168.10.35 counter packets 0 bytes 0, 192.168.10.101 counter packets 0 bytes 0, 192.168.10.135 counter packets 0 bytes 0 } } } Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip interval size tests on kernel that lack rbtree size fixFlorian Westphal2025-03-122-0/+4
| | | | | | | Skip these tests for older kernels. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: don't crash if range has same start and end intervalFlorian Westphal2025-03-103-0/+55
| | | | | | | | | | | | | | In this case, evaluation step replaces the range expression with a single value and we'd crash as range->left/right contain garbage values. Simply replace the input expression with the evaluation result. Also add a test case modeled on the afl reproducer. Fixes: fe6cc0ad29cd ("evaluate: consolidate evaluation of symbol range expression") Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: extend reset test case to cover interval set and map typeFlorian Westphal2025-03-071-10/+60
| | | | | | | Make sure segtree processing doesn't drop associated stateful elements. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: fix string data initialisationFlorian Westphal2025-03-071-0/+62
| | | | | | | | | | | | | | | | | | | | | | | | This uses the wrong length. This must re-use the length of the datatype, not the string length. The added test cases will fail without the fix due to erroneous overlap detection, which in itself is due to incorrect sorting of the elements. Example error: netlink: Error: interval overlaps with an existing one add element inet testifsets simple_wild { "2-1" } failed. table inet testifsets { ... elements = { "1-1", "abcdef*", "othername", "ppp0" } ... but clearly "2-1" doesn't overlap with any existing members. The false detection is because of the "acvdef*" wildcard getting sorted at the beginning of the list which is because its erronously initialised as a 64bit number instead of 128 bits (16 bytes / IFNAMSIZ). Fixes: 5e393ea1fc0a ("segtree: add string "range" reversal support") Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: also consider exthdr type when trimming binopsFlorian Westphal2025-03-062-0/+29
| | | | | | | | | | | | | | | | | | | | | | | | | This allows trimming the binop for exthdrs, this will make nft render (tcp option mptcp unknown & 240) >> 4 . ip saddr @s1 as tcp option mptcp subtype . ip saddr @s1 Also extend the typeof set tests with a set concatenating a sub-byte-sized exthdr expression with a payload one. The additional call to expr_postprocess() is needed, without this, typeof_sets_0.nft fails because frag frag-off @s4 accept is shown as meta nfproto ipv6 frag frag-off @s4 accept Previouly, EXPR_EXTHDR would cause payload_binop_postprocess() to return false which will then make the caller invoke expr_postprocess(), but after handling EXPR_EXTHDR this doesn't happen anymore. Signed-off-by: Florian Westphal <fw@strlen.de>
* tcpopt: add symbol table for mptcp suboptionsFlorian Westphal2025-03-062-0/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | nft can be used t match on specific multipath tcp subtypes: tcp option mptcp subtype 0 However, depending on which subtype to match, users need to look up the type/value to use in rfc8684. Add support for mnemonics and "nft describe tcp option mptcp subtype" to get the subtype list. Because the number of unique 'enum datatypes' is limited by ABI contraints this adds a new mptcp suboption type as integer alias. After this patch, nft supports all of the following: add element t s { mp-capable } add rule t c tcp option mptcp subtype mp-capable add rule t c tcp option mptcp subtype { mp-capable, mp-fail } For the 3rd case, listing will break because unlike for named sets, nft lacks the type information needed to pretty-print the integer values, i.e. nft will print the 3rd rule as 'subtype { 0, 6 }'. This is resolved in a followup patch. Other problematic constructs are: set s1 { typeof tcp option mptcp subtype . ip saddr elements = { mp-fail . 1.2.3.4 } } Followed by: tcp option mptcp subtype . ip saddr @s1 nft will print this as: tcp option mptcp unknown & 240) >> 4 . ip saddr @s1 All of these issues are not related to this patch, however, they also occur with other bit-sized extheader fields. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: random interval set with sizePablo Neira Ayuso2025-02-261-0/+113
| | | | | | | Generate a random set with intervals to validate set size, try one that should fit and then subtract one to set size and retry. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: interval sets with sizePablo Neira Ayuso2025-02-261-0/+42
| | | | | | | Exercise size in set with intervals (rbtree), including corner cases such as 0.0.0.0 and 255.255.255.255 (half-open interval). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fib: Change data type of fib oifname to "ifname"Xiao Liang2025-02-252-0/+2
| | | | | | | | | | | | | | | Change data type of fib oifname from "string" to "ifname", so that it can be matched against a set of ifnames: set x { type ifname } chain y { fib saddr oifname @x drop } Signed-off-by: Xiao Liang <shaw.leon@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: allow to re-use existing metered setFlorian Westphal2025-01-293-0/+136
| | | | | | | | | | | | | | | | | | | Blamed commit translates old meter syntax (which used to allocate an anonymous set) to dynamic sets. A side effect of this is that re-adding a meter rule after chain was flushed results in an error, unlike anonymous sets named sets are not impacted by the flush. Refine this: if a set of the same name exists and is compatible, then re-use it instead of returning an error. Also pick up the reproducer kindly provided by the reporter and place it in the shell test directory. Fixes: b8f8ddfff733 ("evaluate: translate meter into dynamic set") Reported-by: Yi Chen <yiche@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* json: Support typeof in set and map typesPhil Sutter2024-11-063-7/+45
| | | | | | | | | | | | | | | | Implement this as a special "type" property value which is an object with sole property "typeof". The latter's value is the JSON representation of the expression in set->key, so for concatenated typeofs it is a concat expression. All this is a bit clumsy right now but it works and it should be possible to tear it down a bit for more user-friendliness in a compatible way by either replacing the concat expression by the array it contains or even the whole "typeof" object - the parser would just assume any object (or objects in an array) in the "type" property value are expressions to extract a type from. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: add test case for timeout updatesFlorian Westphal2024-09-103-0/+173
| | | | | | | | | | | | Needs a feature check file, so add one: Add element with 1m timeout, then update expiry to 1ms. If element still exists after 1ms, update request was ignored. Test case checks timeouts can both be incremented and decremented, checks error recovery (update request but transaction fails) and that expiry is restored in addion to timeout. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: allow 0 burst in limit rate byte modePablo Neira Ayuso2024-08-192-0/+24
| | | | | | | | | | | | | | | Unbreak restoring elements in set with rate limit that fail with: > /dev/stdin:3618:61-61: Error: limit burst must be > 0 >                  elements = { 1.2.3.4 limit rate over 1000 kbytes/second timeout 1s, no need for burst != 0 for limit rate byte mode. Add tests/shell too. Fixes: 702eff5b5b74 ("src: allow burst 0 for byte ratelimit and use it as default") Fixes: 285baccfea46 ("src: disallow burst 0 in ratelimits") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip ip option tests if kernel does not support itPablo Neira Ayuso2024-06-131-0/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: skip variable set elements when collapsing commandsPablo Neira Ayuso2024-06-113-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | ASAN reports an issue when collapsing commands that represent an element through a variable: include/list.h:60:13: runtime error: member access within null pointer of type 'struct list_head' AddressSanitizer:DEADLYSIGNAL ================================================================= ==11398==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7ffb77cf09c2 bp 0x7ffc818267c0 sp 0x7ffc818267a0 T0) ==11398==The signal is caused by a WRITE memory access. ==11398==Hint: address points to the zero page. #0 0x7ffb77cf09c2 in __list_add include/list.h:60 #1 0x7ffb77cf0ad9 in list_add_tail include/list.h:87 #2 0x7ffb77cf0e72 in list_move_tail include/list.h:169 #3 0x7ffb77cf86ad in nft_cmd_collapse src/cmd.c:478 #4 0x7ffb77da9f16 in nft_evaluate src/libnftables.c:531 #5 0x7ffb77dac471 in __nft_run_cmd_from_filename src/libnftables.c:720 #6 0x7ffb77dad703 in nft_run_cmd_from_filename src/libnftables.c:807 Skip such commands to address this issue. This patch also extends tests/shell to cover for this bug. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1754 Fixes: 498a5f0c219d ("rule: collapse set element commands") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mergesort: Avoid accidental set element reorderingPhil Sutter2024-04-122-20/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In corner cases, expr_msort_cmp() may return 0 for two non-identical elements. An example are ORed tcp flags: 'syn' and 'syn | ack' are considered the same value since expr_msort_value() reduces the latter to its LHS. Keeping the above in mind and looking at how list_expr_sort() works: The list in 'head' is cut in half, the first half put into the temporary list 'list' and finally 'list' is merged back into 'head' considering each element's position. Shall expr_msort_cmp() return 0 for two elements, the one from 'list' ends up after the one in 'head', thus reverting their previous ordering. The practical implication is that output never matches input for the sample set '{ syn, syn | ack }' as the sorting after delinearization in netlink_list_setelems() keeps swapping the elements. Out of coincidence, the commit this fixes itself illustrates the use-case this breaks, namely tracking a ruleset in git: Each ruleset reload will trigger an update to the stored dump. This change breaks interval set element deletion because __set_delete() implicitly relies upon this reordering of duplicate entries by inserting a clone of the one to delete into the start (via list_move()) and after sorting assumes the clone will end up right behind the original. Fix this by calling list_move_tail() instead. Fixes: 14ee0a979b622 ("src: sort set elements in netlink_get_setelems()") Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Accept more than two operands in binary expressionsPhil Sutter2024-04-121-75/+23
| | | | | | | | | | | | | | The most common use case is ORing flags like | syn | ack | rst but nft seems to be fine with less intuitive stuff like | meta mark set ip dscp << 2 << 3 so support all of them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: maps/{vmap_unary,named_limits} require pipapo set backendPablo Neira Ayuso2024-04-081-0/+2
| | | | | | ... sets/typeof_sets_concat needs it too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Fix one json-nft dump for reordered outputPhil Sutter2024-03-201-16/+16
| | | | | | | Missed this one when regenerating all dumps. Fixes: 2a0fe52eca32a ("tests: shell: Regenerate all json-nft dumps") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Add missing json-nft dumpsPhil Sutter2024-03-193-0/+760
| | | | | | | | | Given that a bunch of issues got fixed, add some more dumps. Also add tests/shell/testcases/owner/dumps/0002-persist.nft while at it, even though it's really small. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Regenerate all json-nft dumpsPhil Sutter2024-03-1922-231/+231
| | | | | | | | Ordering of 'nft -j list ruleset' output has changed, Regenerate existing json-nft dumps. No functional change intended, merely the position of chain objects should have moved up in the "nftables" array. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: move meter tests to tests/shellPablo Neira Ayuso2024-03-133-0/+250
| | | | | | | | | Userspace performs an translation to dynamic set which does not fit well into tests/py, move them to tests/shell. Fixes: b8f8ddfff733 ("evaluate: translate meter into dynamic set") Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: translate meter into dynamic setPablo Neira Ayuso2024-03-126-24/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 129f9d153279 ("nft: migrate man page examples with `meter` directive to sets") already replaced meters by dynamic sets. This patch removes NFT_SET_ANONYMOUS flag from the implicit set that is instantiated via meter, so the listing shows a dynamic set instead which is the recommended approach these days. Therefore, a batch like this: add table t add chain t c add rule t c tcp dport 80 meter m size 128 { ip saddr timeout 1s limit rate 10/second } gets translated to a dynamic set: table ip t { set m { type ipv4_addr size 128 flags dynamic,timeout } chain c { tcp dport 80 update @m { ip saddr timeout 1s limit rate 10/second burst 5 packets } } } Check for NFT_SET_ANONYMOUS flag is also relaxed for list and flush meter commands: # nft list meter ip t m table ip t { set m { type ipv4_addr size 128 flags dynamic,timeout } } # nft flush meter ip t m As a side effect the legacy 'list meter' and 'flush meter' commands allow to flush a dynamic set to retain backward compatibility. This patch updates testcases/sets/0022type_selective_flush_0 and testcases/sets/0038meter_list_0 as well as the json output which now uses the dynamic set representation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: move test case to "maps" directoryFlorian Westphal2024-03-012-80/+0
| | | | | | | This tests named object maps, so this should reside in maps/ not sets/ directory. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add more json dumpsFlorian Westphal2024-02-261-0/+165
| | | | | | | | | | | | Those are expected to be stable, so add them. Some are not 100% correct, as "typeof" is misprinted as "type" (json output and input parser lack support for this), but for these files the "type" is valid too. This will allow better validation once proper "typeof" support is added to json.c and json-parser.c. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: permit use of host-endian constant values in set lookup keysFlorian Westphal2024-02-141-0/+11
| | | | | | | | | | | extend an existing test case with the afl input to cover in/output. A new test case is added to test linearization, delinearization and matching Fixes: c0080feb0d03 ("evaluate: permit use of host-endian constant values in set lookup keys") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Pretty-print all *.json-nft dumpsPhil Sutter2024-02-0874-74/+7367
| | | | | | | | | | | | | The problem with single line output as produced by 'nft -j list ruleset' is its incompatibility to unified diff format as any change in this single line will produce a diff which contains the old and new lines in total. This is not just unreadable but will blow up patches which may exceed mailinglists' mail size limits. Convert them all at once by feeding their contents to tests/shell/helpers/json-pretty.sh. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: missing auto-merge in json outputPablo Neira Ayuso2024-02-073-3/+3
| | | | | | | | | Several tests reports DUMP_FAILED because it was missing the auto-merge flag. That is, the original json dump was not correct. Update tests accordingly now that json support provides an automerge flag. Fixes: a4034c66b03e ("json: Support sets' auto-merge option") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix bogus assertion failure with boolean datatypeFlorian Westphal2023-12-122-0/+26
| | | | | | | | | | | | The assertion is too strict, as found by afl++: typeof iifname . ip saddr . meta ipsec elements = { "eth0" . 10.1.1.2 . 1 } meta ipsec is boolean (1 bit), but datasize of 1 is set at 8 bit. Fixes: 22b750aa6dc9 ("src: allow use of base integer types as set keys in concatenations") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Fix sets/reset_command_0 for current kernelsPhil Sutter2023-11-221-8/+2
| | | | | | | | | Since kernel commit 4c90bba60c26 ("netfilter: nf_tables: do not refresh timeout when resetting element"), element reset won't touch expiry anymore. Invert the one check to make sure it remains unaltered, drop the other testing behaviour for per-element timeouts. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/shell: sanitize "handle" in JSON outputThomas Haller2023-11-2270-70/+70
| | | | | | | | | The "handle" in JSON output is not stable. Sanitize/normalize to zero. Adjust the sanitize code, and regenerate the .json-nft files. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip if kernel does not allow to restore set element expirationPablo Neira Ayuso2023-11-221-0/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip synproxy test if kernel does not support itPablo Neira Ayuso2023-11-221-0/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: detach synproxy testPablo Neira Ayuso2023-11-224-33/+52
| | | | | | Old kernels do not support synproxy, split existing tests with stateful objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: connlimit tests requires set expression supportPablo Neira Ayuso2023-11-221-0/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: flush connlimit setsPablo Neira Ayuso2023-11-212-2/+3
| | | | | | | | | | | Restored elements via set declaration are removed almost inmediately by GC, this is causing spurious failures in test runs. Flush sets to ensure dump is always consistent. Still, cover that restoring a set with connlimit elements do not. Fixes: 95d348d55a9e ("tests: shell: extend connlimit test") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip sets/sets_with_ifnames if no pipapo backend is availablePablo Neira Ayuso2023-11-151-0/+2
| | | | | | | | Skip this by now for older kernels until someone detaches the tests that require the pipapo set backend. Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add JSON dump filesThomas Haller2023-11-1574-0/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Generate and add ".json-nft" files. These files contain the output of `nft -j list ruleset` after the test. Also, "test-wrapper.sh" will compare the current ruleset against the ".json-nft" files and test them with "nft -j --check -f $FILE`. These are useful extra tests, that we almost get for free. Note that for some JSON dumps, `nft -f --check` fails (or prints something). For those tests no *.json-nft file is added. The bugs needs to be fixed first. An example of such an issue is: $ DUMPGEN=all ./tests/shell/run-tests.sh tests/shell/testcases/maps/nat_addr_port which gives a file "rc-failed-chkdump" with Command `./tests/shell/../../src/nft -j --check -f "tests/shell/testcases/maps/dumps/nat_addr_port.json-nft"` failed >>>> internal:0:0-0: Error: Invalid map type 'ipv4_addr . inet_service'. internal:0:0-0: Error: Parsing command array at index 3 failed. internal:0:0-0: Error: unqualified type integer specified in map definition. Try "typeof expression" instead of "type datatype". <<<< Tests like "tests/shell/testcases/nft-f/0012different_defines_0" and "tests/shell/testcases/nft-f/0024priority_0" also don't get a .json-nft dump yet, because their output is not stable. That needs fixing too. Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: expand create commandsPablo Neira Ayuso2023-11-152-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | create commands also need to be expanded, otherwise elements are never evaluated: # cat ruleset.nft define ip-block-4 = { 1.1.1.1 } create set netdev filter ip-block-4-test { type ipv4_addr flags interval auto-merge elements = $ip-block-4 } # nft -f ruleset.nft BUG: unhandled expression type 0 nft: src/intervals.c:211: interval_expr_key: Assertion `0' failed. Aborted Same applies to chains in the form of: create chain x y { counter } which is also accepted by the parser. Update tests/shell to improve coverage for these use cases. Fixes: 56c90a2dd2eb ("evaluate: expand sets and maps before evaluation") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: split set NAT interval testPablo Neira Ayuso2023-11-114-22/+32
| | | | | | | | Split test in two, one for interval sets and another with concatenation + intervals, so at least intervals are tested in older kernels with no pipapo support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip if kernel does not support bitshiftPablo Neira Ayuso2023-11-111-43/+43
| | | | | | | | A few tests are missing bitshift checks that has been added to 885845468408 ("tests/shell: skip bitshift tests if kernel lacks support"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip comment tests if kernel lacks supportPablo Neira Ayuso2023-11-111-0/+2
| | | | | | Skip tests that require comment support Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip NAT netmap tests if kernel lacks supportPablo Neira Ayuso2023-11-111-0/+2
| | | | | | Skip tests that require NAT netmap support Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip stateful expression in sets tests if kernel lacks supportPablo Neira Ayuso2023-11-113-0/+6
| | | | | | Skip tests that require stateful expressions in sets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip pipapo tests if kernel lacks supportPablo Neira Ayuso2023-11-116-2/+19
| | | | | | Skip tests that require net/netfilter/nft_set_pipapo support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: use /bin/bash in sets/elem_opts_compat_0Pablo Neira Ayuso2023-10-241-1/+1
| | | | | | So running this test with /bin/sh != /bin/bash works. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2025-05-14 11:19:06 +0000