summaryrefslogtreecommitdiffstats
path: root/tests/shell/testcases
Commit message (Collapse)AuthorAgeFilesLines
* tests: shell: fix dump validation messageFlorian Westphal2023-09-162-13/+0
| | | | | | | | | | | | This test output depends on CONFIG_HZ: - update @y { ip saddr timeout 1d2h3m4s8ms } + update @y { ip saddr timeout 1d2h3m4s10ms } The dump record is with HZ=1000, on HZ=250 we get failure. Remove the dump file for now. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add missing nft/nodump files for testsThomas Haller2023-09-153-0/+29
| | | | | | | | | | Three tests didn't have a nft/nodump file, because previously I only generated files on Fedora kernel, where those tests are failing. Generate them on CentOS-Stream-9 with kernel 5.14.0-354.el9.x86_64. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: drop unstable dump for "transactions/0051map_0" testThomas Haller2023-09-152-7/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The file "tests/shell/testcases/transactions/dumps/0051map_0.nft" gets generated differently on Fedora 38 (6.4.14-200.fc38.x86_64) and CentOS-Stream-9 (5.14.0-354.el9.x86_64). It's not stable. diff --git c/tests/shell/testcases/transactions/dumps/0051map_0.nft w/tests/shell/testcases/transactions/dumps/0051map_0.nft index 59d69df70e61..fa7df9f93757 100644 --- c/tests/shell/testcases/transactions/dumps/0051map_0.nft +++ w/tests/shell/testcases/transactions/dumps/0051map_0.nft @@ -1,7 +1,11 @@ table ip x { + chain w { + } + chain m { } chain y { + ip saddr vmap { 1.1.1.1 : jump w, 2.2.2.2 : accept, 3.3.3.3 : goto m } } } Drop it. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: remove spurious .nft dump filesThomas Haller2023-09-152-16/+0
| | | | | | | | | | | These are left-over dumps ([1]), or dumps generated with the wrong name ([2]). Remove the files. [1] commit eb14363d44ce ('tests: shell: move chain priority and policy to chain folder') [2] commit b4775dec9f80 ('src: ingress inet support') Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add "random-source.sh" helper for random-source for sort/shufThomas Haller2023-09-151-1/+1
| | | | | | | | | | | | | | | | | Commands `sort` and `shuf` have a "--random-source" argument. That's useful for generating stable, reproducible "random" output. However, we want to do this based on a fixed seed, while the "--random-source" expects a stream of randomness. Add a helper script for that. Also, use the stable randomness for shuf in the test "tests/shell/testcases/sets/automerge_0". See-also: https://www.gnu.org/software/coreutils/manual/html_node/Random-sources.html#Random-sources Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: typeof_integer/raw: prefer @nh for payload matchingFlorian Westphal2023-09-106-12/+12
| | | | | | | | | | @ih fails on kernels where payload expression doesn't support the 'inner' base offset. This test isn't about inner headers, so just use @nh which is universally available. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: make delete_by_handle test work on older releasesFlorian Westphal2023-09-101-1/+1
| | | | | | | | | | This test fails on kernels that lack 05abe4456fa3 ("netfilter: nf_tables: allow to register flowtable with no devices") v5.8-rc1~165^2~27^2~1 Just add lo as dummy device. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add "--quick" option to skip slow tests (via NFT_TEST_SKIP_slow=y)Thomas Haller2023-09-098-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's important to run (a part) of the tests in a timely manner. Add an option to skip long running tests. Thereby, add a more general NFT_TEST_SKIP_* mechanism. This is related and inverse from "NFT_TEST_HAVE_json", where a test can require [ "$NFT_TEST_HAVE_json" != n ] to run, but is skipped when [ "$NFT_TEST_SKIP_slow" = y ]. Currently only NFT_TEST_SKIP_slow is supported. The user can set such environment variables (or use the -Q|--quick command line option). The configuration is printed in the test info. Tests should check for [ "$NFT_TEST_SKIP_slow" = y ] so that the variable has to be explicitly set to opt-out. For convenience, tests can also add a # NFT_TEST_SKIP(NFT_TEST_SKIP_slow) tag, which is evaluated by test-wrapper.sh. Or they can run a quick, reduced part of the test, but then should still indicate to be skipped. Mark 8 tests are as slow, that take longer than 5 seconds on my machine. With this, a parallel wall time for the non-slow tests is only 7 seconds (on my machine). The ultimate point is to integrate a call to "tests/shell/run-tests.sh" in a `make check` target. For development, you can then export NFT_TEST_SKIP_slow=y and have a fast `make check`. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: skip tests if nft does not support JSON modeThomas Haller2023-09-099-6/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We can build nft without JSON support, and some tests will fail without it. Instead, they should be skipped. Also note, that the test accepts any nft binary via the "NFT" environment variable. So it's not enough to make the skipping dependent on build configuration, but on the currently used $NFT variable. Let "run-test.sh" detect and export a "NFT_TEST_HAVE_json=y|n" variable. This is heavily inspired by Florian's feature probing patches. Tests that require JSON can check that variable, and skip. Note that they check in the form of [ "$NFT_TEST_HAVE_json" != n ], so the test is only skipped, if we explicitly detect lack of support. That is, don't check via [ "$NFT_TEST_HAVE_json" = y ]. Some of the tests still run parts of the tests that don't require JSON. Only towards the end of such partial run, mark the test as skipped. Some tests require JSON support throughout. For those, add a mechanism where tests can add a tag (in their first 10 lines): # NFT_TEST_REQUIRES(NFT_TEST_HAVE_json) This will be checked by "test-wrapper.sh", which will skip the test. The purpose of this is to make it low-effort to skip a test and to print the reason in the text output as Test skipped due to NFT_TEST_HAVE_json=n (test has "NFT_TEST_REQUIRES(NFT_TEST_HAVE_json)" tag) This is intentionally not shortened to NFT_TEST_REQUIRES(json), so that we can grep for NFT_TEST_HAVE_json to find all relevant places. Note that while NFT_TEST_HAVE_json is autodetected, the caller can also force it by setting the environment variable. This allows to see what would happen to such a test. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add ".nft" dump files for tests without dumps/ directoryThomas Haller2023-09-096-0/+0
| | | | | | | | | | | | | | DUMPGEN=y mode skips tests that don't have a corresponding "dumps/" directory. Add the "dumps/" directory for tests that lacked it, and generate ".nft" files by running `./tests/shell/run-tests.sh -g`. Yes, they are all empty. Not very exciting, but why not check for that too? Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add missing ".nodump" file for tests without dumpsThomas Haller2023-09-098-0/+0
| | | | | | | | | | | | These files are generated by running `./tests/shell/run-tests.sh -g`. Commit the .nodump files to git. The point is to explicitly make it known that no dump file should be there. This prevents `./tests/shell/run-tests.sh -g` from generating the files and proposing (over and over) to add them to git. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: generate and add ".nft" dump files for existing testsThomas Haller2023-09-09161-0/+2546
| | | | | | | | | | | | | | | | | | | | | | | | | | | Several tests didn't have a ".nft" dump file committed. Generate one and commit it to git. While not all tests have a stable ruleset to compare, many have. Commit the .nft files for the tests where the output appears to be stable. This was generated by running `./tests/shell/run-tests.sh -g` twice, and commit the files that were identical both times. Note that 7 tests on my machine fail, so those are skipped. Also skip the files tests/shell/testcases/maps/dumps/0004interval_map_create_once_0.nft tests/shell/testcases/nft-f/dumps/0011manydefines_0.nft tests/shell/testcases/sets/dumps/0011add_many_elements_0.nft tests/shell/testcases/sets/dumps/0030add_many_elements_interval_0.nft tests/shell/testcases/sets/dumps/0068interval_stack_overflow_0.nft Those files are larger than 100KB, and I don't think we want to blow up the git repository this way. Even if they are only text files and compress well. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: return 77/skip for tests that fail to create dummy deviceThomas Haller2023-09-083-5/+5
| | | | | | | | | | | | | There are some existing tests, that skip operation when they fail to create a dummy interface. Use the new exit code 77 to indicate "SKIPPED". I wonder why creating a dummy device would ever fail and why we don't just fail the test altogether in that case. But the patch does not change that. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: fix "0003includepath_0" for different TMPDIRThomas Haller2023-09-071-2/+2
| | | | | | | | We are going to set $TMPDIR to another location. The previous code made assumptions that the generated path would always be in /tmp. Fix that. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: skip test in rootless that hit socket buffer size limitThomas Haller2023-09-079-5/+135
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The socket buffer limits like /proc/sys/net/core/{rmem_max,wmem_max} can cause tests to fail, when running rootless. That's because real-root can override those limits, rootless cannot. Add an environment variable NFT_TEST_HAS_SOCKET_LIMITS=*|n which is automatically set by "run-tests.sh". Certain tests will check for [ "$NFT_TEST_HAS_SOCKET_LIMITS" = y ] and skip the test. The user may manually bump those limits (requires root), and set NFT_TEST_HAS_SOCKET_LIMITS=n to get the tests to pass even as rootless. For example, the test passes with root: sudo ./tests/shell/run-tests.sh -- tests/shell/testcases/sets/automerge_0 Without root, it would fail. Skip it instead: ./tests/shell/run-tests.sh -- tests/shell/testcases/sets/automerge_0 ... I: [SKIPPED] tests/shell/testcases/sets/automerge_0 Or bump the limit: $ echo 3000000 | sudo tee /proc/sys/net/core/wmem_max $ NFT_TEST_HAS_SOCKET_LIMITS=n ./tests/shell/run-tests.sh -- tests/shell/testcases/sets/automerge_0 ... I: [OK] tests/shell/testcases/sets/automerge_0 Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: 0043concatenated_ranges_0: re-enable all testsFlorian Westphal2023-09-061-6/+1
| | | | | | | | This script suppressed a few tests when ran via run-tests.sh, don't do that, it would have caught the previous 'get' bug years ago. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: expand vmap test case to also cause batch abortFlorian Westphal2023-08-292-6/+22
| | | | | | | | | | Let the last few batches also push an update that contains elements twice. This is expected to cause the batch to be aborted, which increases code coverage on kernel side. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: 30s-stress: add failslab and abort phase testsFlorian Westphal2023-08-241-15/+375
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pablo suggested to also cover abort phase by intentionally deleting non-existent or adding clashing keys. While at it: add rules with anon sets and jumps to anonymous chains and a few constant sets. Pick different key sizes so there is a higher chance kernel picks different backend storages such as bitmap or hash_fast. add failslab support, this also covers unlikely or "impossible" cases like failing GFP_KERNEL allocations. randomly spawn 'nft monitor' in the background for a random duration to cover notification path. Try to randomly delete a set or chain from control plane. Randomly set a table as dormant (and back to normal). Allow to pass the test runtime as argument, so one can now do ./30s-stress 3600 to have the test run for one hour. For such long test durations, make sure the ruleset gets regenerated periodically. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: use minutes granularity in sets/0036add_set_element_expiration_0Pablo Neira Ayuso2023-08-231-2/+6
| | | | | | | Use minute granularity to fix bogus failures of this test on slow testbed. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Stabilize sets/0043concatenated_ranges_0 testPhil Sutter2023-08-231-2/+6
| | | | | | | | | | | On a slow system, one of the 'delete element' commands would occasionally fail. Assuming it can only happen if the 2s timeout passes "too quickly", work around it by adding elements with a 2m timeout instead and when wanting to test the element expiry just drop and add the element again with a short timeout. Fixes: 6231d3fa4af1e ("tests: shell: Fix for unstable sets/0043concatenated_ranges_0") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Stabilize sets/reset_command_0 testPhil Sutter2023-08-231-39/+48
| | | | | | | | | | | | | | | | | | Timeout/expiry value testing based on seconds is way too fragile, especially with slow debug kernels. Rewrite the unit to test minute-based values. This means it is no longer feasible to wait for values to sufficiently change, so instead specify an 'expires' value when creating the ruleset and drop the 'sleep' call. While being at it: - Combine 'get element' and 'reset element' calls into one, assert the relevant (sanitized) line appears twice in output instead of comparing with 'diff'. - Turn comments into 'echo' calls to help debugging if the test fails. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: update bad_expression test caseFlorian Westphal2023-08-171-0/+9
| | | | | | | | Check that the ruleset also fails to validate if there is another table that passes validation checks. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add table validation checkFlorian Westphal2023-08-171-0/+29
| | | | | | | | | | Pablo noticed problems with commit validation, investigation shows nfnetlink can retry forever in infinite -EAGAIN cycle, test for this. The process is killable, this only hogs cpu. Add a test for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add one more chain jump in vmap testFlorian Westphal2023-08-151-0/+5
| | | | | | | | | | | This triggers a splat on kernels that lack 314c82841602 ("netfilter: nf_tables: can't schedule in nft_chain_validate"). There is another test case that triggers this splat (optimize/ruleset), but that test uses some more advanced features that don't exist on older kernels, so the splat is never seen. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add transaction stress test with parallel delete/add/flush and netns ↵Florian Westphal2023-08-151-0/+225
| | | | | | | | | | deletion Based on nft_trans_stress.sh from kernel selftests, changed to run from run-tests.sh, plus additional ideas from Pablo Neira, such as del+readd of the netns. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add test with concatenation, vmap and timeoutFlorian Westphal2023-08-132-0/+62
| | | | | | | | | Add 4k elements to map, with timeouts in range 1..3s, also add a catchall element with timeout. Check that all elements are no longer included in set list after 4s. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add test case for double-deactivationFlorian Westphal2023-08-122-0/+15
| | | | | Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Review test-cases for destroy commandPhil Sutter2023-08-0315-65/+32
| | | | | | | | | | | | | | Having separate files for successful destroy of existing and non-existing objects is a bit too much, just combine them into one. While being at it: * No bashisms, using /bin/sh is fine * Append '-e' to shebang itself instead of calling 'set' * Use 'nft -a -e' instead of assuming the created rule's handle value * Shellcheck warned about curly braces, quote them Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser: allow ct timeouts to use time_spec valuesFlorian Westphal2023-08-032-2/+2
| | | | | | | | | | | | | | | For some reason the parser only allows raw numbers (seconds) for ct timeouts, e.g. ct timeout ttcp { protocol tcp; policy = { syn_sent : 3, ... Also permit time_spec, e.g. "established : 5d". Print the nicer time formats on output, but retain raw numbers support on input for compatibility. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add dynmap datapath add/delete test caseFlorian Westphal2023-08-032-0/+57
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: fix inet nat prio testsFlorian Westphal2023-08-022-2/+2
| | | | | | | | | Its legal to DNAT in output and SNAT in input chain, so don't test for that being illegal. Fixes: 8beafab74c39 ("rule: allow src/dstnat prios in input and output") Fixes: 34ce4e4a7bb6 ("test: shell: Test cases for standard chain prios") Signed-off-by: Florian Westphal <fw@strlen.de>
* libnftables: Drop cache in -c/--check modePablo Neira Ayuso2023-08-012-0/+22
| | | | | | | | | | | | | | | | | | | | | Extend e0aace943412 ("libnftables: Drop cache in error case") to also drop the cache with -c/--check, this is a dry run mode and kernel does not get any update. This fixes a bug with -o/--optimize, which first runs in an implicit -c/--check mode to validate that the ruleset is correct, then it provides the proposed optimization. In this case, if the cache is not emptied, old objects in the cache refer to scanner data that was already released, which triggers BUG like this: BUG: invalid input descriptor type 151665524 nft: erec.c:161: erec_print: Assertion `0' failed. Aborted This bug was triggered in a ruleset that contains a set for geoip filtering. This patch also extends tests/shell to cover this case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: extend implicit chain map with flush commandPablo Neira Ayuso2023-07-211-0/+1
| | | | | | Add a rule flush command. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Implement 'reset {set,map,element}' commandsPhil Sutter2023-07-131-0/+82
| | | | | | | | | | | All these are used to reset state in set/map elements, i.e. reset the timeout or zero quota and counter values. While 'reset element' expects a (list of) elements to be specified which should be reset, 'reset set/map' will reset all elements in the given set/map. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: cover old scanner bugPablo Neira Ayuso2023-07-112-0/+1132
| | | | | | | | Add a test to cover 423abaa40ec4 ("scanner: don't rely on fseek for input stream repositioning") that fixes the bug described in https://bugs.gentoo.org/675188. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: refcount memleak in map rhs with timeoutsPablo Neira Ayuso2023-07-041-0/+48
| | | | | | Extend coverage for refcount leaks on map element expiration. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: define .clone for catchall set elementPablo Neira Ayuso2023-06-301-0/+21
| | | | | | | Otherwise reuse of catchall set element expression in variable triggers a null-pointer dereference. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: cover refcount leak of mapping rhsPablo Neira Ayuso2023-06-271-0/+38
| | | | | | | | Add a test to cover reference count leak in maps by adding twice same element, then flush. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: coverage for simple port knocking rulesetPablo Neira Ayuso2023-06-262-0/+59
| | | | | | Add a test to cover port knocking simple ruleset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: reject zero-length interface names in flowtablesFlorian Westphal2023-06-201-0/+5
| | | | | | Previous patch wasn't enough, also disable this for flowtable device lists. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: reject zero-length interface namesFlorian Westphal2023-06-201-0/+5
| | | | | | | | | | | device "" results in an assertion during evaluation. Before: nft: expression.c:426: constant_expr_alloc: Assertion `(((len) + (8) - 1) / (8)) > 0' failed. After: zero_length_devicename_assert:3:42-49: Error: you cannot set an empty interface name type filter hook ingress device""lo" priority -1 ^^^^^^^^ Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: don't assert on scope underflowsFlorian Westphal2023-06-201-0/+6
| | | | | | | | | | | | | | | close_scope() gets called from the object destructors; imbalance can cause us to hit assert(). Before: nft: parser_bison.y:88: close_scope: Assertion `state->scope > 0' failed. After: assertion3:4:7-7: Error: too many levels of nesting jump { assertion3:5:8-8: Error: too many levels of nesting jump assertion3:5:9-9: Error: syntax error, unexpected newline, expecting '{' assertion3:7:1-1: Error: syntax error, unexpected end of file Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: do not abort when prefix map has non-map elementFlorian Westphal2023-06-202-0/+19
| | | | | | | | | | | Before: nft: evaluate.c:1849: __mapping_expr_expand: Assertion `i->etype == EXPR_MAPPING' failed. after: Error: expected mapping, not set element snat ip prefix to ip saddr map { 10.141.11.0/24 : 192.168.2.0/24, 10.141.12.1 } Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: bogus EBUSY errors in transactionsPablo Neira Ayuso2023-06-191-0/+121
| | | | | | | | | | | | | | | Make sure reference tracking during transaction update is correct by checking for bogus EBUSY error. For example, when deleting map with chain reference X, followed by a delete chain X command. This test is covering the following paths: - prepare + abort (via -c/--check option) - prepare + commit - release (when netns is destroyed) Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add test case for chain-in-use-splatFlorian Westphal2023-06-161-0/+19
| | | | | | | | | | | | | | | | | | | WARNING [.]: at net/netfilter/nf_tables_api.c:1885 6.3.4-201.fc38.x86_64 #1 nft_immediate_destroy+0xc1/0xd0 [nf_tables] __nf_tables_abort+0x4b9/0xb20 [nf_tables] nf_tables_abort+0x39/0x50 [nf_tables] nfnetlink_rcv_batch+0x47c/0x8e0 [nfnetlink] nfnetlink_rcv+0x179/0x1a0 [nfnetlink] netlink_unicast+0x19e/0x290 This is because of chain->use underflow, at time destroy function is called, ->use has wrapped back to -1. Fixed via "netfilter: nf_tables: fix chain binding transaction logic". Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: fix spurious errors in terse listing in jsonPablo Neira Ayuso2023-06-111-1/+1
| | | | | | | Sometimes table handle becomes 192, which makes this test fail. Check for 192.168 instead to make sure terse listing works fine instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: extend tests for destroy commandFernando Fernandez Mancera2023-06-0118-0/+74
| | | | | | | | | Extend tests to cover destroy command for chains, flowtables, sets, maps. In addition rename a destroy command test for rules with a duplicated number. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: permit use of constant values in set lookup keysFlorian Westphal2023-05-242-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Something like: Given: set s { type ipv4_addr . ipv4_addr . inet_service .. } something like add rule ip saddr . 1.2.3.4 . 80 @s goto c1 fails with: "Error: Can't parse symbolic invalid expressions". This fails because the relational expression first evaluates the left hand side, so when concat evaluation sees '1.2.3.4' no key context is available. Check if the RHS is a set reference, and, if so, evaluate the right hand side. This sets a pointer to the set key in the evaluation context structure which then makes the concat evaluation step parse 1.2.3.4 and 80 as ipv4 address and 16bit port number. On delinearization, extend relop postprocessing to copy the datatype from the rhs (set reference, has proper datatype according to set->key) to the lhs (concat expression). Signed-off-by: Florian Westphal <fw@strlen.de>
* optimize: do not remove counter in verdict mapsPablo Neira Ayuso2023-05-102-0/+8
| | | | | | | | | | | | | Add counter to set element instead of dropping it: # nft -c -o -f test.nft Merging: test.nft:6:3-50: ip saddr 1.1.1.1 ip daddr 2.2.2.2 counter accept test.nft:7:3-48: ip saddr 1.1.1.2 ip daddr 3.3.3.3 counter drop into: ip daddr . ip saddr vmap { 2.2.2.2 . 1.1.1.1 counter : accept, 3.3.3.3 . 1.1.1.2 counter : drop } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: skip optimization if anonymous set uses stateful statementPablo Neira Ayuso2023-05-102-0/+4
| | | | | | | | fee6bda06403 ("evaluate: remove anon sets with exactly one element") introduces an optimization to remove use of sets with single element. Skip this optimization if set element contains stateful statements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>