summaryrefslogtreecommitdiffstats
path: root/tests/shell/testcases
Commit message (Collapse)AuthorAgeFilesLines
* tests: shell: add vlan match test caseFlorian Westphal2023-10-071-0/+50
| | | | | | | Check that we can match on the 8021ad header and vlan tag, see af84f9e447a6 ("netfilter: nft_payload: rebuild vlan header on h_proto access"). Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add test for dormant on/off/on bugFlorian Westphal2023-10-072-0/+52
| | | | | | | | | | | Disallow enabling/disabling a table in a single transaction. Make sure we still allow one update, either to dormant, or from active to dormant. Reported-by: "Lee, Cherie-Anne" <cherie.lee@starlabs.sg> Cc: Bing-Jhong Billy Jheng <billy@starlabs.sg> Cc: info@starlabs.sg Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: sets/reset_command_0: Fix drop_seconds()Phil Sutter2023-09-291-1/+1
| | | | | | | | | | The function print_times() skips any time elements which are zero, so output may lack the ms part. Adjust the sed call dropping anything but the minutes value to not fail in that case. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Fixes: 255ec36a11525 ("tests: shell: Stabilize sets/reset_command_0 test") Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: restrict include directive to regular filesFlorian Westphal2023-09-291-0/+1
| | | | | | | | | | | | | | Similar to previous change, also check all include "foo" and reject those if they refer to named fifos, block devices etc. Directories are still skipped, I don't think we can change this anymore. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1664 Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Fix for failing nft-f/sample-rulesetPhil Sutter2023-09-281-2/+2
| | | | | | | | | | For whatever reason, my system lacks an entry for 'sip' in /etc/services. Assuming the service name is not relevant to the test, just replace it by the respective port number. Fixes: 68728014435d9 ("tests: shell: add sample ruleset reproducer") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: fix spurious errors in sets/0036add_set_element_expiration_0Pablo Neira Ayuso2023-09-271-3/+7
| | | | | | | | | | | | | | | A number of changes to fix spurious errors: - Add seconds as expiration, otherwise 14m59 reports 14m in minute granularity, this ensures suficient time in a very slow environment with debugging instrumentation. - Provide expected output. - Update sed regular expression to make 'ms' optional and use -E mode. Fixes: adf38fd84257 ("tests: shell: use minutes granularity in sets/0036add_set_element_expiration_0") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip flowtable-uaf if we lack table owner supportFlorian Westphal2023-09-221-0/+2
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add feature probe for sctp chunk matchingFlorian Westphal2023-09-211-10/+16
| | | | | | Skip the relavant parts of the test if nft_exthdr lacks sctp support. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add feature probe for sets with more than one elementFlorian Westphal2023-09-214-0/+14
| | | | | | | | | | Kernels < 5.11 can handle only one expression per element, e.g. its possible to attach a counter per key, or a rate limiter, or a quota, but not two at the same time. Add a probe file and skip the relevant tests if the feature is absent. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: skip adding catchall elements if unuspportedFlorian Westphal2023-09-211-2/+6
| | | | | | | | | | The test fails on kernels without catchall support, so elide this small part. No need to skip the test in this case, the dump file validates that the added elements are no longer there after the timeout. Signed-off-by: Florian Westphal <fw@strlen.de>
* limit: display default burst when listing rulesetPablo Neira Ayuso2023-09-206-8/+8
| | | | | | | | | | | | Default burst for limit is 5 for historical reasons but it is not displayed when listing the ruleset. Update listing to display the default burst to disambiguate. man nft(8) has been recently updated to document this, no action in this front is therefore required. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: perform mark datatype compatibility check from mapsPablo Neira Ayuso2023-09-192-0/+64
| | | | | | | | | | | | | Wrap datatype compatibility check into a helper function and use it for map evaluation, otherwise the following bogus error message is displayed: Error: datatype mismatch, map expects packet mark, mapping expression has type integer Add unit tests to improve coverage for this usecase. Fixes: 5d8e33ddb112 ("evaluate: relax type-checking for integer arguments in mark statements") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: expand sets and maps before evaluationPablo Neira Ayuso2023-09-194-0/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 3975430b12d9 ("src: expand table command before evaluation") moved ruleset expansion before evaluation, except for sets and maps. For sets and maps there is still a post_expand() phase. This patch moves sets and map expansion to allocate an independent CMD_OBJ_SETELEMS command to add elements to named set and maps which is evaluated, this consolidates the ruleset expansion to happen always before the evaluation step for all objects, except for anonymous sets and maps. This approach avoids an interference with the set interval code which detects overlaps and merges of adjacents ranges. This set interval routine uses set->init to maintain a cache of existing elements. Then, the post_expand() phase incorrectly expands set->init cache and it triggers a bogus ENOENT errors due to incorrect bytecode (placing element addition before set creation) in combination with user declared sets using the flat syntax notation. Since the evaluation step (coming after the expansion) creates implicit/anonymous sets and maps, those are not expanded anymore. These anonymous sets still need to be evaluated from set_evaluate() path and the netlink bytecode generation path, ie. do_add_set(), needs to deal with anonymous sets. Note that, for named sets, do_add_set() does not use set->init. Such content is part of the existing cache, and the CMD_OBJ_SETELEMS command is responsible for adding elements to named sets. Fixes: 3975430b12d9 ("src: expand table command before evaluation") Reported-by: Jann Haber <jannh@selfnet.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: check diff in "maps/typeof_maps_0" and "sets/typeof_sets_0" testThomas Haller2023-09-182-31/+177
| | | | | | | | | | | These tests run different variants based on NFT_TEST_HAVE_osf support. Consequently, we cannot check the pre-generated diff. Instead, construct what we expect dynamically in the script, and compare the ruleset against that. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: skip reset tests if kernel lacks supportFlorian Westphal2023-09-182-0/+4
| | | | | | | | | | | | reset is implemented via flush + extra attribute, so older kernels perform a flush. This means .nft doesn't work, we need to check if the individual set contents/sets are still in place post-reset. Make this generic and permit use of feat.sh in addition to the simpler foo.nft feature files. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip test cases if ct expectation and/or timeout lacks supportFlorian Westphal2023-09-183-39/+15
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip test cases involving osf match if kernel lacks supportFlorian Westphal2023-09-182-10/+32
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip catchall tests if kernel lacks supportFlorian Westphal2023-09-185-2/+27
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip destroy tests if kernel lacks supportFlorian Westphal2023-09-185-0/+10
| | | | | | | | Destroy support was added for table/flowtable/chain etc. in a single commit, so no need to add capability tests for each destroy subtype. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip inet ingress tests if kernel lacks supportFlorian Westphal2023-09-183-7/+11
| | | | | | | Split the bridge autoremove test to a new file. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip some tests if kernel lacks netdev egress supportFlorian Westphal2023-09-182-1/+11
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip bitshift tests if kernel lacks supportFlorian Westphal2023-09-1810-0/+20
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip inner matching tests if unsupportedFlorian Westphal2023-09-181-0/+2
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip map query if kernel lacks supportFlorian Westphal2023-09-181-8/+27
| | | | | | | | | | | | | | On recent kernels one can perform a lookup in a map without a destination register (i.e., treat the map like a set -- pure existence check). Add a feature probe and work around the missing feature in typeof_maps_add_delete: do the test with a simplified ruleset, Indicate skipped even though a reduced test was run (earlier errors cause a failure) to not trigger dump validation error. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: skip netdev_chain_0 if kernel requires netdev deviceFlorian Westphal2023-09-181-0/+2
| | | | | | | | | | | | | | This test case only works on kernel 6.4+. Add feature probe for this and tag the test accordingly using the scheme added by Thomas Haller in "tests/shell: skip tests if nft does not support JSON mode" so that run-test.sh skips it if kernel requires a device. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: add and use chain binding feature probeFlorian Westphal2023-09-183-7/+55
| | | | | | | | | | Alter 30s-stress to suppress anon chains when its unuspported. Note that 30s-stress is optionally be run standalone, so also update the test script. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com>
* tests/shell: cleanup creating dummy interfaces in testsThomas Haller2023-09-186-31/+32
| | | | | | | | | | | | | | | | | | | | | | | In "tests/shell/testcases/chains/netdev_chain_0", calling "trap ... EXIT" multiple times does not work. Fix it, by calling one cleanup function. Note that we run in separate namespaces, so the cleanup is usually not necessary. Still do it, we might want to run without unshare (via NFT_TEST_UNSHARE_CMD=""). Without unshare, it's important that the cleanup always works. In practice it might not, for example, "trap ... EXIT" does not run for SIGTERM. A leaked interface might break the follow up test and tests interfere with each other. Try to workaround that by first trying to delete the interface. Also failures to create the interfaces are not considered fatal. I don't understand under what circumstances this might fail, note that there are other tests that create dummy interface and don't "exit 77" on failure. We want to know when something odd is going on. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add sample ruleset reproducerFlorian Westphal2023-09-182-0/+501
| | | | | | | | | | | | Changes on kernel side no longer permit transactions that reference a chain after it is bound. This test case breaks when run with nftables 1.0.6 and earlier. Keep this as a test case in tree to catch any future problems in this area. Link: https://lore.kernel.org/netfilter-devel/20230911213750.5B4B663206F5@dd20004.kasserver.com/ Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: fix dump validation messageFlorian Westphal2023-09-162-13/+0
| | | | | | | | | | | | This test output depends on CONFIG_HZ: - update @y { ip saddr timeout 1d2h3m4s8ms } + update @y { ip saddr timeout 1d2h3m4s10ms } The dump record is with HZ=1000, on HZ=250 we get failure. Remove the dump file for now. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add missing nft/nodump files for testsThomas Haller2023-09-153-0/+29
| | | | | | | | | | Three tests didn't have a nft/nodump file, because previously I only generated files on Fedora kernel, where those tests are failing. Generate them on CentOS-Stream-9 with kernel 5.14.0-354.el9.x86_64. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: drop unstable dump for "transactions/0051map_0" testThomas Haller2023-09-152-7/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The file "tests/shell/testcases/transactions/dumps/0051map_0.nft" gets generated differently on Fedora 38 (6.4.14-200.fc38.x86_64) and CentOS-Stream-9 (5.14.0-354.el9.x86_64). It's not stable. diff --git c/tests/shell/testcases/transactions/dumps/0051map_0.nft w/tests/shell/testcases/transactions/dumps/0051map_0.nft index 59d69df70e61..fa7df9f93757 100644 --- c/tests/shell/testcases/transactions/dumps/0051map_0.nft +++ w/tests/shell/testcases/transactions/dumps/0051map_0.nft @@ -1,7 +1,11 @@ table ip x { + chain w { + } + chain m { } chain y { + ip saddr vmap { 1.1.1.1 : jump w, 2.2.2.2 : accept, 3.3.3.3 : goto m } } } Drop it. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: remove spurious .nft dump filesThomas Haller2023-09-152-16/+0
| | | | | | | | | | | These are left-over dumps ([1]), or dumps generated with the wrong name ([2]). Remove the files. [1] commit eb14363d44ce ('tests: shell: move chain priority and policy to chain folder') [2] commit b4775dec9f80 ('src: ingress inet support') Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add "random-source.sh" helper for random-source for sort/shufThomas Haller2023-09-151-1/+1
| | | | | | | | | | | | | | | | | Commands `sort` and `shuf` have a "--random-source" argument. That's useful for generating stable, reproducible "random" output. However, we want to do this based on a fixed seed, while the "--random-source" expects a stream of randomness. Add a helper script for that. Also, use the stable randomness for shuf in the test "tests/shell/testcases/sets/automerge_0". See-also: https://www.gnu.org/software/coreutils/manual/html_node/Random-sources.html#Random-sources Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: typeof_integer/raw: prefer @nh for payload matchingFlorian Westphal2023-09-106-12/+12
| | | | | | | | | | @ih fails on kernels where payload expression doesn't support the 'inner' base offset. This test isn't about inner headers, so just use @nh which is universally available. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: make delete_by_handle test work on older releasesFlorian Westphal2023-09-101-1/+1
| | | | | | | | | | This test fails on kernels that lack 05abe4456fa3 ("netfilter: nf_tables: allow to register flowtable with no devices") v5.8-rc1~165^2~27^2~1 Just add lo as dummy device. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add "--quick" option to skip slow tests (via NFT_TEST_SKIP_slow=y)Thomas Haller2023-09-098-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's important to run (a part) of the tests in a timely manner. Add an option to skip long running tests. Thereby, add a more general NFT_TEST_SKIP_* mechanism. This is related and inverse from "NFT_TEST_HAVE_json", where a test can require [ "$NFT_TEST_HAVE_json" != n ] to run, but is skipped when [ "$NFT_TEST_SKIP_slow" = y ]. Currently only NFT_TEST_SKIP_slow is supported. The user can set such environment variables (or use the -Q|--quick command line option). The configuration is printed in the test info. Tests should check for [ "$NFT_TEST_SKIP_slow" = y ] so that the variable has to be explicitly set to opt-out. For convenience, tests can also add a # NFT_TEST_SKIP(NFT_TEST_SKIP_slow) tag, which is evaluated by test-wrapper.sh. Or they can run a quick, reduced part of the test, but then should still indicate to be skipped. Mark 8 tests are as slow, that take longer than 5 seconds on my machine. With this, a parallel wall time for the non-slow tests is only 7 seconds (on my machine). The ultimate point is to integrate a call to "tests/shell/run-tests.sh" in a `make check` target. For development, you can then export NFT_TEST_SKIP_slow=y and have a fast `make check`. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: skip tests if nft does not support JSON modeThomas Haller2023-09-099-6/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We can build nft without JSON support, and some tests will fail without it. Instead, they should be skipped. Also note, that the test accepts any nft binary via the "NFT" environment variable. So it's not enough to make the skipping dependent on build configuration, but on the currently used $NFT variable. Let "run-test.sh" detect and export a "NFT_TEST_HAVE_json=y|n" variable. This is heavily inspired by Florian's feature probing patches. Tests that require JSON can check that variable, and skip. Note that they check in the form of [ "$NFT_TEST_HAVE_json" != n ], so the test is only skipped, if we explicitly detect lack of support. That is, don't check via [ "$NFT_TEST_HAVE_json" = y ]. Some of the tests still run parts of the tests that don't require JSON. Only towards the end of such partial run, mark the test as skipped. Some tests require JSON support throughout. For those, add a mechanism where tests can add a tag (in their first 10 lines): # NFT_TEST_REQUIRES(NFT_TEST_HAVE_json) This will be checked by "test-wrapper.sh", which will skip the test. The purpose of this is to make it low-effort to skip a test and to print the reason in the text output as Test skipped due to NFT_TEST_HAVE_json=n (test has "NFT_TEST_REQUIRES(NFT_TEST_HAVE_json)" tag) This is intentionally not shortened to NFT_TEST_REQUIRES(json), so that we can grep for NFT_TEST_HAVE_json to find all relevant places. Note that while NFT_TEST_HAVE_json is autodetected, the caller can also force it by setting the environment variable. This allows to see what would happen to such a test. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add ".nft" dump files for tests without dumps/ directoryThomas Haller2023-09-096-0/+0
| | | | | | | | | | | | | | DUMPGEN=y mode skips tests that don't have a corresponding "dumps/" directory. Add the "dumps/" directory for tests that lacked it, and generate ".nft" files by running `./tests/shell/run-tests.sh -g`. Yes, they are all empty. Not very exciting, but why not check for that too? Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add missing ".nodump" file for tests without dumpsThomas Haller2023-09-098-0/+0
| | | | | | | | | | | | These files are generated by running `./tests/shell/run-tests.sh -g`. Commit the .nodump files to git. The point is to explicitly make it known that no dump file should be there. This prevents `./tests/shell/run-tests.sh -g` from generating the files and proposing (over and over) to add them to git. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: generate and add ".nft" dump files for existing testsThomas Haller2023-09-09161-0/+2546
| | | | | | | | | | | | | | | | | | | | | | | | | | | Several tests didn't have a ".nft" dump file committed. Generate one and commit it to git. While not all tests have a stable ruleset to compare, many have. Commit the .nft files for the tests where the output appears to be stable. This was generated by running `./tests/shell/run-tests.sh -g` twice, and commit the files that were identical both times. Note that 7 tests on my machine fail, so those are skipped. Also skip the files tests/shell/testcases/maps/dumps/0004interval_map_create_once_0.nft tests/shell/testcases/nft-f/dumps/0011manydefines_0.nft tests/shell/testcases/sets/dumps/0011add_many_elements_0.nft tests/shell/testcases/sets/dumps/0030add_many_elements_interval_0.nft tests/shell/testcases/sets/dumps/0068interval_stack_overflow_0.nft Those files are larger than 100KB, and I don't think we want to blow up the git repository this way. Even if they are only text files and compress well. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: return 77/skip for tests that fail to create dummy deviceThomas Haller2023-09-083-5/+5
| | | | | | | | | | | | | There are some existing tests, that skip operation when they fail to create a dummy interface. Use the new exit code 77 to indicate "SKIPPED". I wonder why creating a dummy device would ever fail and why we don't just fail the test altogether in that case. But the patch does not change that. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: fix "0003includepath_0" for different TMPDIRThomas Haller2023-09-071-2/+2
| | | | | | | | We are going to set $TMPDIR to another location. The previous code made assumptions that the generated path would always be in /tmp. Fix that. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: skip test in rootless that hit socket buffer size limitThomas Haller2023-09-079-5/+135
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The socket buffer limits like /proc/sys/net/core/{rmem_max,wmem_max} can cause tests to fail, when running rootless. That's because real-root can override those limits, rootless cannot. Add an environment variable NFT_TEST_HAS_SOCKET_LIMITS=*|n which is automatically set by "run-tests.sh". Certain tests will check for [ "$NFT_TEST_HAS_SOCKET_LIMITS" = y ] and skip the test. The user may manually bump those limits (requires root), and set NFT_TEST_HAS_SOCKET_LIMITS=n to get the tests to pass even as rootless. For example, the test passes with root: sudo ./tests/shell/run-tests.sh -- tests/shell/testcases/sets/automerge_0 Without root, it would fail. Skip it instead: ./tests/shell/run-tests.sh -- tests/shell/testcases/sets/automerge_0 ... I: [SKIPPED] tests/shell/testcases/sets/automerge_0 Or bump the limit: $ echo 3000000 | sudo tee /proc/sys/net/core/wmem_max $ NFT_TEST_HAS_SOCKET_LIMITS=n ./tests/shell/run-tests.sh -- tests/shell/testcases/sets/automerge_0 ... I: [OK] tests/shell/testcases/sets/automerge_0 Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: 0043concatenated_ranges_0: re-enable all testsFlorian Westphal2023-09-061-6/+1
| | | | | | | | This script suppressed a few tests when ran via run-tests.sh, don't do that, it would have caught the previous 'get' bug years ago. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: expand vmap test case to also cause batch abortFlorian Westphal2023-08-292-6/+22
| | | | | | | | | | Let the last few batches also push an update that contains elements twice. This is expected to cause the batch to be aborted, which increases code coverage on kernel side. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: 30s-stress: add failslab and abort phase testsFlorian Westphal2023-08-241-15/+375
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pablo suggested to also cover abort phase by intentionally deleting non-existent or adding clashing keys. While at it: add rules with anon sets and jumps to anonymous chains and a few constant sets. Pick different key sizes so there is a higher chance kernel picks different backend storages such as bitmap or hash_fast. add failslab support, this also covers unlikely or "impossible" cases like failing GFP_KERNEL allocations. randomly spawn 'nft monitor' in the background for a random duration to cover notification path. Try to randomly delete a set or chain from control plane. Randomly set a table as dormant (and back to normal). Allow to pass the test runtime as argument, so one can now do ./30s-stress 3600 to have the test run for one hour. For such long test durations, make sure the ruleset gets regenerated periodically. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: use minutes granularity in sets/0036add_set_element_expiration_0Pablo Neira Ayuso2023-08-231-2/+6
| | | | | | | Use minute granularity to fix bogus failures of this test on slow testbed. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Stabilize sets/0043concatenated_ranges_0 testPhil Sutter2023-08-231-2/+6
| | | | | | | | | | | On a slow system, one of the 'delete element' commands would occasionally fail. Assuming it can only happen if the 2s timeout passes "too quickly", work around it by adding elements with a 2m timeout instead and when wanting to test the element expiry just drop and add the element again with a short timeout. Fixes: 6231d3fa4af1e ("tests: shell: Fix for unstable sets/0043concatenated_ranges_0") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Stabilize sets/reset_command_0 testPhil Sutter2023-08-231-39/+48
| | | | | | | | | | | | | | | | | | Timeout/expiry value testing based on seconds is way too fragile, especially with slow debug kernels. Rewrite the unit to test minute-based values. This means it is no longer feasible to wait for values to sufficiently change, so instead specify an 'expires' value when creating the ruleset and drop the 'sleep' call. While being at it: - Combine 'get element' and 'reset element' calls into one, assert the relevant (sanitized) line appears twice in output instead of comparing with 'diff'. - Turn comments into 'echo' calls to help debugging if the test fails. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: update bad_expression test caseFlorian Westphal2023-08-171-0/+9
| | | | | | | | Check that the ruleset also fails to validate if there is another table that passes validation checks. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>