summaryrefslogtreecommitdiffstats
path: root/tests/shell/testcases/transactions
Commit message (Collapse)AuthorAgeFilesLines
* tests: shell: add regression test for double-free crash bugFlorian Westphal2024-04-023-0/+83
| | | | | | | | | | | | | | | | BUG: KASAN: slab-use-after-free in nf_tables_set_elem_destroy+0x55/0x160 Call Trace: nf_tables_set_elem_destroy+0x55/0x160 nf_tables_set_elem_destroy+0x55/0x160 nft_pipapo_destroy+0x3b4/0x5a0 nft_set_destroy+0x118/0x3a0 nf_tables_trans_destroy_work+0x4f2/0xa80 This is a test case for the bug fiex with kernel commit b0e256f3dd2b ("netfilter: nft_set_pipapo: release elements in clone only from destroy path"). Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Regenerate all json-nft dumpsPhil Sutter2024-03-191-10/+10
| | | | | | | | Ordering of 'nft -j list ruleset' output has changed, Regenerate existing json-nft dumps. No functional change intended, merely the position of chain objects should have moved up in the "nftables" array. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Pretty-print all *.json-nft dumpsPhil Sutter2024-02-0841-41/+6253
| | | | | | | | | | | | | The problem with single line output as produced by 'nft -j list ruleset' is its incompatibility to unified diff format as any change in this single line will produce a diff which contains the old and new lines in total. This is not just unreadable but will blow up patches which may exceed mailinglists' mail size limits. Convert them all at once by feeding their contents to tests/shell/helpers/json-pretty.sh. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Revert "evaluate: error out when existing set has incompatible key"Florian Westphal2023-12-143-0/+30
| | | | | | | | | | This breaks existing behaviour, add a test case so this is caught in the future. The reverted test case will be brought back once a better fix is available. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: sanitize "handle" in JSON outputThomas Haller2023-11-2227-27/+27
| | | | | | | | | The "handle" in JSON output is not stable. Sanitize/normalize to zero. Adjust the sanitize code, and regenerate the .json-nft files. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: quote reference to array to iterate over empty stringPablo Neira Ayuso2023-11-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | This patch restores coverage for non-interval set backend. Use "${FLAGS[@]}" in loop, otherwise empty string is skipped in the iteration. This snippet: FLAGS=("") available_flags FLAGS "single" for flags in "${FLAGS[@]}" ; do echo $flags done ... now shows the empty string: # bash test.sh interval Fixes: ed927baa4fd8 ("tests: shell: skip pipapo set backend in transactions/30s-stress") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: restore pipapo and chain binding coverage in standalone 30s-stressPablo Neira Ayuso2023-11-151-0/+9
| | | | | | | | | | | | | | | | | | Do not disable pipapo and chain binding coverage for standalone runs by default. Instead, turn them on by default and allow users to disable them through: # export NFT_TEST_HAVE_chain_binding=n; bash tests/shell/testcases/transactions/30s-stress 3600 ... running standalone with: NFT_TEST_HAVE_chain_binding=n NFT_TEST_HAVE_pipapo=y given feature detection is not available in this case, thus, user has to provide an explicit hint on what this kernel supports. Fixes: c5b5b1044fdd ("tests/shell: add feature probing via "features/*.nft" files") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip pipapo set backend in transactions/30s-stressPablo Neira Ayuso2023-11-151-7/+44
| | | | | | Skip tests with concatenations and intervals if kernel does not support it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add JSON dump filesThomas Haller2023-11-1540-0/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Generate and add ".json-nft" files. These files contain the output of `nft -j list ruleset` after the test. Also, "test-wrapper.sh" will compare the current ruleset against the ".json-nft" files and test them with "nft -j --check -f $FILE`. These are useful extra tests, that we almost get for free. Note that for some JSON dumps, `nft -f --check` fails (or prints something). For those tests no *.json-nft file is added. The bugs needs to be fixed first. An example of such an issue is: $ DUMPGEN=all ./tests/shell/run-tests.sh tests/shell/testcases/maps/nat_addr_port which gives a file "rc-failed-chkdump" with Command `./tests/shell/../../src/nft -j --check -f "tests/shell/testcases/maps/dumps/nat_addr_port.json-nft"` failed >>>> internal:0:0-0: Error: Invalid map type 'ipv4_addr . inet_service'. internal:0:0-0: Error: Parsing command array at index 3 failed. internal:0:0-0: Error: unqualified type integer specified in map definition. Try "typeof expression" instead of "type datatype". <<<< Tests like "tests/shell/testcases/nft-f/0012different_defines_0" and "tests/shell/testcases/nft-f/0024priority_0" also don't get a .json-nft dump yet, because their output is not stable. That needs fixing too. Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: use bash instead of /bin/sh for testsThomas Haller2023-10-161-1/+1
| | | | | | | | | | | | | | | | | All tests under "tests/shell" are shell scripts with shebang /bin/bash or /bin/sh. This may seem expected, since these tests are under "tests/shell" directory, but any executable file would work. Anyway. The vast majority of the tests has "#!/bin/bash" as shebang. A few tests had "#!/bin/sh" or "#!/bin/sh -e". Unify this and always use bash. Since we anyway require bash, this is not a limitation. Also, if we know that this is a bash script (by parsing the shebang), we can let the test wrapper pass "-x" to the script. The next commit will do that, and it is nicer if the shebangs are all uniform. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add test for dormant on/off/on bugFlorian Westphal2023-10-072-0/+52
| | | | | | | | | | | Disallow enabling/disabling a table in a single transaction. Make sure we still allow one update, either to dormant, or from active to dormant. Reported-by: "Lee, Cherie-Anne" <cherie.lee@starlabs.sg> Cc: Bing-Jhong Billy Jheng <billy@starlabs.sg> Cc: info@starlabs.sg Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add and use chain binding feature probeFlorian Westphal2023-09-181-7/+48
| | | | | | | | | | Alter 30s-stress to suppress anon chains when its unuspported. Note that 30s-stress is optionally be run standalone, so also update the test script. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: add missing nft/nodump files for testsThomas Haller2023-09-151-0/+0
| | | | | | | | | | Three tests didn't have a nft/nodump file, because previously I only generated files on Fedora kernel, where those tests are failing. Generate them on CentOS-Stream-9 with kernel 5.14.0-354.el9.x86_64. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: drop unstable dump for "transactions/0051map_0" testThomas Haller2023-09-152-7/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The file "tests/shell/testcases/transactions/dumps/0051map_0.nft" gets generated differently on Fedora 38 (6.4.14-200.fc38.x86_64) and CentOS-Stream-9 (5.14.0-354.el9.x86_64). It's not stable. diff --git c/tests/shell/testcases/transactions/dumps/0051map_0.nft w/tests/shell/testcases/transactions/dumps/0051map_0.nft index 59d69df70e61..fa7df9f93757 100644 --- c/tests/shell/testcases/transactions/dumps/0051map_0.nft +++ w/tests/shell/testcases/transactions/dumps/0051map_0.nft @@ -1,7 +1,11 @@ table ip x { + chain w { + } + chain m { } chain y { + ip saddr vmap { 1.1.1.1 : jump w, 2.2.2.2 : accept, 3.3.3.3 : goto m } } } Drop it. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add "--quick" option to skip slow tests (via NFT_TEST_SKIP_slow=y)Thomas Haller2023-09-091-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's important to run (a part) of the tests in a timely manner. Add an option to skip long running tests. Thereby, add a more general NFT_TEST_SKIP_* mechanism. This is related and inverse from "NFT_TEST_HAVE_json", where a test can require [ "$NFT_TEST_HAVE_json" != n ] to run, but is skipped when [ "$NFT_TEST_SKIP_slow" = y ]. Currently only NFT_TEST_SKIP_slow is supported. The user can set such environment variables (or use the -Q|--quick command line option). The configuration is printed in the test info. Tests should check for [ "$NFT_TEST_SKIP_slow" = y ] so that the variable has to be explicitly set to opt-out. For convenience, tests can also add a # NFT_TEST_SKIP(NFT_TEST_SKIP_slow) tag, which is evaluated by test-wrapper.sh. Or they can run a quick, reduced part of the test, but then should still indicate to be skipped. Mark 8 tests are as slow, that take longer than 5 seconds on my machine. With this, a parallel wall time for the non-slow tests is only 7 seconds (on my machine). The ultimate point is to integrate a call to "tests/shell/run-tests.sh" in a `make check` target. For development, you can then export NFT_TEST_SKIP_slow=y and have a fast `make check`. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: skip tests if nft does not support JSON modeThomas Haller2023-09-091-2/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We can build nft without JSON support, and some tests will fail without it. Instead, they should be skipped. Also note, that the test accepts any nft binary via the "NFT" environment variable. So it's not enough to make the skipping dependent on build configuration, but on the currently used $NFT variable. Let "run-test.sh" detect and export a "NFT_TEST_HAVE_json=y|n" variable. This is heavily inspired by Florian's feature probing patches. Tests that require JSON can check that variable, and skip. Note that they check in the form of [ "$NFT_TEST_HAVE_json" != n ], so the test is only skipped, if we explicitly detect lack of support. That is, don't check via [ "$NFT_TEST_HAVE_json" = y ]. Some of the tests still run parts of the tests that don't require JSON. Only towards the end of such partial run, mark the test as skipped. Some tests require JSON support throughout. For those, add a mechanism where tests can add a tag (in their first 10 lines): # NFT_TEST_REQUIRES(NFT_TEST_HAVE_json) This will be checked by "test-wrapper.sh", which will skip the test. The purpose of this is to make it low-effort to skip a test and to print the reason in the text output as Test skipped due to NFT_TEST_HAVE_json=n (test has "NFT_TEST_REQUIRES(NFT_TEST_HAVE_json)" tag) This is intentionally not shortened to NFT_TEST_REQUIRES(json), so that we can grep for NFT_TEST_HAVE_json to find all relevant places. Note that while NFT_TEST_HAVE_json is autodetected, the caller can also force it by setting the environment variable. This allows to see what would happen to such a test. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: generate and add ".nft" dump files for existing testsThomas Haller2023-09-0920-0/+785
| | | | | | | | | | | | | | | | | | | | | | | | | | | Several tests didn't have a ".nft" dump file committed. Generate one and commit it to git. While not all tests have a stable ruleset to compare, many have. Commit the .nft files for the tests where the output appears to be stable. This was generated by running `./tests/shell/run-tests.sh -g` twice, and commit the files that were identical both times. Note that 7 tests on my machine fail, so those are skipped. Also skip the files tests/shell/testcases/maps/dumps/0004interval_map_create_once_0.nft tests/shell/testcases/nft-f/dumps/0011manydefines_0.nft tests/shell/testcases/sets/dumps/0011add_many_elements_0.nft tests/shell/testcases/sets/dumps/0030add_many_elements_interval_0.nft tests/shell/testcases/sets/dumps/0068interval_stack_overflow_0.nft Those files are larger than 100KB, and I don't think we want to blow up the git repository this way. Even if they are only text files and compress well. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: skip test in rootless that hit socket buffer size limitThomas Haller2023-09-072-0/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The socket buffer limits like /proc/sys/net/core/{rmem_max,wmem_max} can cause tests to fail, when running rootless. That's because real-root can override those limits, rootless cannot. Add an environment variable NFT_TEST_HAS_SOCKET_LIMITS=*|n which is automatically set by "run-tests.sh". Certain tests will check for [ "$NFT_TEST_HAS_SOCKET_LIMITS" = y ] and skip the test. The user may manually bump those limits (requires root), and set NFT_TEST_HAS_SOCKET_LIMITS=n to get the tests to pass even as rootless. For example, the test passes with root: sudo ./tests/shell/run-tests.sh -- tests/shell/testcases/sets/automerge_0 Without root, it would fail. Skip it instead: ./tests/shell/run-tests.sh -- tests/shell/testcases/sets/automerge_0 ... I: [SKIPPED] tests/shell/testcases/sets/automerge_0 Or bump the limit: $ echo 3000000 | sudo tee /proc/sys/net/core/wmem_max $ NFT_TEST_HAS_SOCKET_LIMITS=n ./tests/shell/run-tests.sh -- tests/shell/testcases/sets/automerge_0 ... I: [OK] tests/shell/testcases/sets/automerge_0 Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: 30s-stress: add failslab and abort phase testsFlorian Westphal2023-08-241-15/+375
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pablo suggested to also cover abort phase by intentionally deleting non-existent or adding clashing keys. While at it: add rules with anon sets and jumps to anonymous chains and a few constant sets. Pick different key sizes so there is a higher chance kernel picks different backend storages such as bitmap or hash_fast. add failslab support, this also covers unlikely or "impossible" cases like failing GFP_KERNEL allocations. randomly spawn 'nft monitor' in the background for a random duration to cover notification path. Try to randomly delete a set or chain from control plane. Randomly set a table as dormant (and back to normal). Allow to pass the test runtime as argument, so one can now do ./30s-stress 3600 to have the test run for one hour. For such long test durations, make sure the ruleset gets regenerated periodically. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: update bad_expression test caseFlorian Westphal2023-08-171-0/+9
| | | | | | | | Check that the ruleset also fails to validate if there is another table that passes validation checks. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add table validation checkFlorian Westphal2023-08-171-0/+29
| | | | | | | | | | Pablo noticed problems with commit validation, investigation shows nfnetlink can retry forever in infinite -EAGAIN cycle, test for this. The process is killable, this only hogs cpu. Add a test for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add transaction stress test with parallel delete/add/flush and netns ↵Florian Westphal2023-08-151-0/+225
| | | | | | | | | | deletion Based on nft_trans_stress.sh from kernel selftests, changed to run from run-tests.sh, plus additional ideas from Pablo Neira, such as del+readd of the netns. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: extend implicit chain map with flush commandPablo Neira Ayuso2023-07-211-0/+1
| | | | | | Add a rule flush command. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: bogus EBUSY errors in transactionsPablo Neira Ayuso2023-06-191-0/+121
| | | | | | | | | | | | | | | Make sure reference tracking during transaction update is correct by checking for bogus EBUSY error. For example, when deleting map with chain reference X, followed by a delete chain X command. This test is covering the following paths: - prepare + abort (via -c/--check option) - prepare + commit - release (when netns is destroyed) Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add test case for chain-in-use-splatFlorian Westphal2023-06-161-0/+19
| | | | | | | | | | | | | | | | | | | WARNING [.]: at net/netfilter/nf_tables_api.c:1885 6.3.4-201.fc38.x86_64 #1 nft_immediate_destroy+0xc1/0xd0 [nf_tables] __nf_tables_abort+0x4b9/0xb20 [nf_tables] nf_tables_abort+0x39/0x50 [nf_tables] nfnetlink_rcv_batch+0x47c/0x8e0 [nfnetlink] nfnetlink_rcv+0x179/0x1a0 [nfnetlink] netlink_unicast+0x19e/0x290 This is because of chain->use underflow, at time destroy function is called, ->use has wrapped back to -1. Fixed via "netfilter: nf_tables: fix chain binding transaction logic". Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: extend existing dormat test case to catch a kernel bugFlorian Westphal2020-07-182-0/+5
| | | | | | | This is a test case for the kernel bug fixed by: netfilter: nf_tables: fix nat hook table deletion Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Search diff tool once and for allPhil Sutter2020-01-162-5/+2
| | | | | | | | | | | | | | | Instead of calling 'which diff' over and over again, just detect the tool's presence in run-tests.sh and pass $DIFF to each testcase just like with nft binary. Fall back to using 'true' command to avoid the need for any conditional calling in test cases. While being at it, unify potential diff calls so that a string comparison in shell happens irrespective of diff presence. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add huge transaction from firewalldEric Garver2019-09-101-0/+10
| | | | | | | This is borrowed from one of firewalld's test cases. Signed-off-by: Eric Garver <eric@garver.life> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: add huge JSON transactionEric Garver2019-09-101-0/+16
| | | | | | | | Expand the test case to also check for returned rule handles in the JSON output. Signed-off-by: Eric Garver <eric@garver.life> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: verify huge transaction returns expected number of rulesEric Garver2019-09-101-2/+3
| | | | | | | | Verify that we get the expected number of rules with --echo (i.e. the reply wasn't truncated). Signed-off-by: Eric Garver <eric@garver.life> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: use-after-free from abort pathPablo Neira Ayuso2019-09-081-0/+19
| | | | | | | Rule that fails to be added while holding a bound set triggers user-after-free from the abort path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Support intra-transaction rule referencesPhil Sutter2019-06-074-0/+52
| | | | | | | | | | | | | | | | | | | | | | | A rule may be added before or after another one using index keyword. To support for the other rule being added within the same batch, one has to make use of NFTNL_RULE_ID and NFTNL_RULE_POSITION_ID attributes. This patch does just that among a few more crucial things: * If cache is complete enough to contain rules, update cache when evaluating rule commands so later index references resolve correctly. * Reduce rule_translate_index() to its core code which is the actual linking of rules and consequently rename the function. The removed bits are pulled into the calling rule_evaluate() to reduce code duplication in between cache updates with and without rule reference. * Pass the current command op to rule_evaluate() as indicator whether to insert before or after a referenced rule or at beginning or end of chain in cache. Exploit this from chain_evaluate() to avoid adding the chain's rules a second time. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Test large transaction with echo outputPhil Sutter2019-05-311-0/+14
| | | | | | | | | This reliably triggered ENOBUFS condition in mnl_batch_talk(). With the past changes, it passes even after increasing the number of rules to 300k. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: bogus EBUSY on helper deletion from transactionPablo Neira Ayuso2019-03-141-0/+15
| | | | | Reported-by: Laura Garcia <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: bogus ENOENT on element deletion in interval setPablo Neira Ayuso2019-03-121-0/+26
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: bogus EBUSY in set deletion after flushPablo Neira Ayuso2019-03-081-0/+18
| | | | | | | | | | | | | | | | flush chain ip filter group_7933 Removes all rules, including references to set 'group_7933', however: delete map ip filter group_7933 results in: delete.nft:6:1-32: Error: Could not process rule: Device or resource busy delete map ip filter group_7933 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add test case for anon set abort.Florian Westphal2019-03-071-0/+10
| | | | | | | This triggers kernel crash in 5.0, see https://bugzilla.netfilter.org/show_bug.cgi?id=1325 Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: flush after rule deletionPablo Neira Ayuso2019-02-151-0/+22
| | | | | | Flush after rule deletion should hit no ENOENT. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: exercise abort path with anonymous set that is bound to rulePablo Neira Ayuso2019-02-081-0/+14
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: name is ignored when deleting a tableFlorian Westphal2019-01-181-0/+35
| | | | | | | | | | | | | nlt is reallocated, leaking first allocation and also removing the table name/handle that was set on nlt object. Add a test case for this as well, the batch is supposed to fail when trying to delete a non-existant table, rather than wiping all tables in the same address family. Fixes: 12c362e2214a0 ("mnl: remove alloc_nftnl_table()") Reported-by: Mikhail Morfikov <mmorfikov@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: change all test scripts to return 0Florian Westphal2019-01-044-12/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The shell-based tests currently encode a return value in the file name, i.e. foo_1 expects that the script should return '1' for the test case to pass. This is very error prone, and one test case is even broken (i.e., it returns 1, but because of a different, earlier error). do_something || exit 1 or 'set -e' are both pretty common patterns, in both cases tests should fail. In those test-cases that deliberately test for an error, nft something_should_fail || exit 0 nft something_should_fail && exit 1 or a similar constructs should be used. This initial commit modififies all '_1' scripts to return 0 on success, usually via 'nft wrong || exit 0'. All tests pass, except the one broken test case that hasn't worked before either, but where 'set -e' use made it pass (the failing command is supposed to work, and the command that is supposed to fail is never run). Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add test case for leaking of stateful object refcountFlorian Westphal2019-01-041-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | Taehee Yoo fixed a bug in error path handling for object refcounts. Quoting patch description: | $nft add table ip filter | $nft add counter ip filter c1 | $nft add map ip filter m1 { type ipv4_addr : counter \;} | $nft add element ip filter m1 { 1 : c1 } | $nft add element ip filter m1 { 1 : c1 } | $nft delete element ip filter m1 { 1 } | $nft delete counter ip filter c1 |Result: | Error: Could not process rule: Device or resource busy | delete counter ip filter c1 | |At the second 'nft add element ip filter m1 { 1 : c1 }', the reference |count of the 'c1' is increased then it tries to insert into the 'm1'. but |the 'm1' already has same element so it returns -EEXIST. |But it doesn't decrease the reference count of the 'c1' in the error path. |Due to a leak of the reference count of the 'c1', the 'c1' can't be |removed by 'nft delete counter ip filter c1'. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Set/print standard chain prios with textual namesMáté Eckl2018-08-145-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the possibility to use textual names to set the chain priority to standard values so that numeric values do not need to be learnt any more for basic usage. Basic arithmetic can also be done with them to ease the addition of relatively higher/lower priority chains. Addition and substraction is possible. Values are also printed with their friendly name within the range of <basicprio> +- 10. Also numeric printing is supported in case of -nnn option (numeric == NFT_NUMERIC_ALL) The supported name-value pairs and where they are valid is based on how x_tables use these values when registering their base chains. (See iptables/nft.c in the iptables repository). Also see the compatibility matrices extracted from the man page: Standard priority names, family and hook compatibility matrix ┌─────────┬───────┬────────────────┬─────────────┐ │Name │ Value │ Families │ Hooks │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │raw │ -300 │ ip, ip6, inet │ all │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │mangle │ -150 │ ip, ip6, inet │ all │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │dstnat │ -100 │ ip, ip6, inet │ prerouting │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │filter │ 0 │ ip, ip6, inet, │ all │ │ │ │ arp, netdev │ │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │security │ 50 │ ip, ip6, inet │ all │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │srcnat │ 100 │ ip, ip6, inet │ postrouting │ └─────────┴───────┴────────────────┴─────────────┘ Standard priority names and hook compatibility for the bridge family ┌───────┬───────┬─────────────┐ │ │ │ │ │Name │ Value │ Hooks │ ├───────┼───────┼─────────────┤ │ │ │ │ │dstnat │ -300 │ prerouting │ ├───────┼───────┼─────────────┤ │ │ │ │ │filter │ -200 │ all │ ├───────┼───────┼─────────────┤ │ │ │ │ │out │ 100 │ output │ ├───────┼───────┼─────────────┤ │ │ │ │ │srcnat │ 300 │ postrouting │ └───────┴───────┴─────────────┘ This can be also applied for flowtables wher it works as a netdev family chain. Example: nft> add table ip x nft> add chain ip x y { type filter hook prerouting priority raw; } nft> add chain ip x z { type filter hook prerouting priority mangle + 1; } nft> add chain ip x w { type filter hook prerouting priority dstnat - 5; } nft> add chain ip x r { type filter hook prerouting priority filter + 10; } nft> add chain ip x t { type filter hook prerouting priority security; } nft> add chain ip x q { type filter hook postrouting priority srcnat + 11; } nft> add chain ip x h { type filter hook prerouting priority 15; } nft> nft> add flowtable ip x y { hook ingress priority filter + 5 ; devices = {enp0s31f6}; } nft> nft> add table arp x nft> add chain arp x y { type filter hook input priority filter + 5; } nft> nft> add table bridge x nft> add chain bridge x y { type filter hook input priority filter + 9; } nft> add chain bridge x z { type filter hook prerouting priority dstnat; } nft> add chain bridge x q { type filter hook postrouting priority srcnat; } nft> add chain bridge x k { type filter hook output priority out; } nft> nft> list ruleset table ip x { flowtable y { hook ingress priority filter + 5 devices = { enp0s31f6 } } chain y { type filter hook prerouting priority raw; policy accept; } chain z { type filter hook prerouting priority mangle + 1; policy accept; } chain w { type filter hook prerouting priority dstnat - 5; policy accept; } chain r { type filter hook prerouting priority filter + 10; policy accept; } chain t { type filter hook prerouting priority security; policy accept; } chain q { type filter hook postrouting priority 111; policy accept; } chain h { type filter hook prerouting priority 15; policy accept; } } table arp x { chain y { type filter hook input priority filter + 5; policy accept; } } table bridge x { chain y { type filter hook input priority filter + 9; policy accept; } chain z { type filter hook prerouting priority dstnat; policy accept; } chain q { type filter hook postrouting priority srcnat; policy accept; } chain k { type filter hook output priority out; policy accept; } } nft> # Everything should fail after this nft> add chain ip x h { type filter hook prerouting priority first; } Error: 'first' is invalid priority in this context. add chain ip x h { type filter hook prerouting priority first; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain ip x q { type filter hook prerouting priority srcnat + 11; } Error: 'srcnat' is invalid priority in this context. add chain ip x q { type filter hook prerouting priority srcnat + 11; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain arp x y { type filter hook input priority raw; } Error: 'raw' is invalid priority in this context. add chain arp x y { type filter hook input priority raw; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add flowtable ip x y { hook ingress priority magle; devices = {enp0s31f6}; } Error: 'magle' is invalid priority. add flowtable ip x y { hook ingress priority magle; devices = {enp0s31f6}; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain bridge x r { type filter hook postrouting priority dstnat; } Error: 'dstnat' is invalid priority in this context. add chain bridge x r { type filter hook postrouting priority dstnat; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain bridge x t { type filter hook prerouting priority srcnat; } Error: 'srcnat' is invalid priority in this context. add chain bridge x t { type filter hook prerouting priority srcnat; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add quotes when using <<<-style here documentFlorian Westphal2018-06-0825-28/+28
| | | | | | | | | bash 4.3.30 removes newlines in RULESET when "" are omitted, which then causes nft -f to complain about invalid syntax. As a result, all test cases that use this here-doc style fail. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: delete chain and rule with jump to chain in same transactionPablo Neira Ayuso2018-05-081-0/+25
| | | | | | We should not hit EBUSY in this case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Test flush and nat chain recreate in one goPhil Sutter2018-03-211-0/+17
| | | | | | | | This tests what kernel commit ae6153b50f9bf ("netfilter: nf_tables: permit second nat hook if colliding hook is going away") fixed for. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Support 'nft -f -' to read from stdinPhil Sutter2018-03-2023-232/+24
| | | | | | | | | | | | | | | | | | In libnftables, detect if given filename is '-' and treat it as the common way of requesting to read from stdin, then open /dev/stdin instead. (Calling 'nft -f /dev/stdin' worked before as well, but this makes it official.) With this in place and bash's support for here strings, review all tests in tests/shell for needless use of temp files. Note that two categories of test cases were intentionally left unchanged: - Tests creating potentially large rulesets to avoid running into shell parameter length limits. - Tests for 'include' directive for obvious reasons. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: autogenerate dump verificationLaura Garcia Liebana2018-03-0936-263/+90
| | | | | | | | | | | | | | | | | | | | Complete the automated shell tests with the verification of the test file dump, only for positive tests and if the test execution was successful. It's able to generate the dump file with the -g option. Example: # ./run-tests.sh -g testcases/chains/0001jumps_0 The dump files are generated in the same path in the folder named dumps/ with .nft extension. It has been avoided the dump verification code in every test file. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: delete element and chain in transactionPablo Neira Ayuso2017-05-041-0/+76
| | | | | | | | This patch adds a test to test refcounting from element to chain and objects. Reported-by: Andreas Schultz <aschultz@tpip.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sets: Fix for missing space after last elementPhil Sutter2017-03-223-3/+3
| | | | | | | | | | | Not having a space between the last element in a set and the closing curly brace looks ugly, so add it here. This also adjusts all shell testcases as they match whitespace in nft output and therefore fail otherwise. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>