summaryrefslogtreecommitdiffstats
path: root/tests/shell/testcases
Commit message (Collapse)AuthorAgeFilesLines
* tests/shell: add testcase for 'nft -f' load with actionsArturo Borrero2016-05-131-0/+68
| | | | | | | Let's tests loading a ruleset with actions. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add testcases for named sets with intervalsArturo Borrero2016-04-275-0/+97
| | | | | | | Let's add some testcases for named sets with intervals and ranges. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: delete tempfile failover in testcasesArturo Borrero2016-04-157-49/+7
| | | | | | | | It seems both Debian/Fedora (and derivates) contains mktemp (from the coreutils package) so it makes no sense to have this failover, which looks buggy also. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add testcases for Netfilter bug #965Arturo Borrero2016-04-159-0/+174
| | | | | | | | | | | | | Testscases for Netfilter bug #965: * add rule at position * insert rule at position * replace rule with given handle * delete rule with given handle * don't allow to delete rules with position keyword Netfilter Bugzilla: http://bugzilla.netfilter.org/show_bug.cgi?id=965 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add some tests for network namespacesArturo Borrero2016-04-073-0/+306
| | | | | | | | A basic tests to check we can perform operations in different network namespaces. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add new testcases for commit/rollbackArturo Borrero2016-04-074-0/+267
| | | | | | | | | | | New simple testcases for kernel commit/rollback operations. * ruleset A is loaded (good ruleset) * ruleset B is loaded (bad ruleset): fail is expected * ruleset A should remain in the kernel Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add chain validations testsArturo Borrero2016-03-239-0/+120
| | | | | | | Some basic test regarding chains: jumps and validations. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: revisit cache population logicPablo Neira Ayuso2016-03-142-14/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We get a partial cache (tables, chains and sets) when: * We see a set reference from a rule, since this set object may be already defined in kernelspace and we need to fetch the datatype for evaluation. * We add/delete a set element, we need this to evaluate if the element datatype is correct. * We rename a chain, since we need to know the chain handle. * We add a chain/set. This isn't needed for simple command line invocations. However, since the existing codepath is also exercised from `nft -f' context, we need to know if the object exists in the kernel. Thus, if this a newly declared object (not yet in the kernel) we add it to the cache, otherwise, we will not find follow up references to this object in our cache. We get a full cache when: * We list the ruleset. We can provide finer grain listing though, via partial cache, later. * We monitor updates, since this displays incremental updates based on the existing objects. * We export the ruleset, since this dumps all of the existing objects. * We push updates via `nft -f'. We need to know what objects are already in the kernel for incremental updates. Otherwise, cache_update() hits a bogus 'set doesn't exist' error message for just declared set in this batch. To avoid this problem, we need a way to differentiate between what objects in the lists that are already defined in the kernel and what are just declared in this batch (hint: the location structure information is set for just declared objects). We don't get a cache at all when: * We flush the ruleset, this is important in case of delinearize bugs, so you don't need to reboot or manually flush the ruleset via libnftnl examples/nft-table-flush. * We delete any object, except for set elements (as we describe above). * We add a rule, so you can generate via --debug=netlink the expression without requiring a table and chain in place. * We describe a expression. This patch also includes some intentional adjustments to the shell tests to we don't get bogus errors due to changes in the list printing. BTW, this patch also includes a revert for 97493717e738 ("evaluate: check if table and chain exists when adding rules") since that check is not possible anymore with this logic. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/listing: add some listing testsArturo Borrero2016-03-0312-0/+329
| | | | | | | | | | Let's test what is shown with the 'list' command, for ruleset, tables and sets. In order to ease debug in case of failure, if the diff tool is in the system, then a textual diff is printed. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add first `nft -f' testsArturo Borrero2016-03-031-0/+25
| | | | | | | This patch add some basic initial tests. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add tests for handles and commentsArturo Borrero2015-12-254-0/+34
| | | | | | | Here some tests for optional things like rule handles and comments. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add test case for cache bugArturo Borrero2015-12-181-0/+35
| | | | | | | | | | | | | | | | | | | | | | | This testcase for sets catch a cache bug. By the time of this commit this test is failing, so the test suite shows: % sudo ./run-tests.sh I: using nft binary /usr/local/sbin/nft I: [OK] ./testcases/maps/anonymous_snat_map_0 I: [OK] ./testcases/maps/named_snat_map_0 W: [FAILED] ./testcases/sets/cache_handling_0 I: [OK] ./testcases/optionals/comments_0 I: [OK] ./testcases/optionals/comments_handles_monitor_0 I: [OK] ./testcases/optionals/handles_1 I: [OK] ./testcases/optionals/handles_0 I: [OK] ./testcases/optionals/comments_handles_0 I: results: [OK] 7 [FAILED] 1 [TOTAL] 8 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add maps tests casesArturo Borrero2015-12-182-0/+18
Let's add some tests cases for maps. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>