summaryrefslogtreecommitdiffstats
path: root/tests/shell
Commit message (Collapse)AuthorAgeFilesLines
* tests: shell: add test case for catchall gc bugHEADmasterFlorian Westphal43 hours1-0/+13
| | | | | | | | Check for bug fixed with kernel commit 93995bf4af2c ("netfilter: nf_tables: remove catchall element in GC sync path"). Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: workaround lack of $SRANDOM before bash 5.1Thomas Haller3 days1-0/+1
| | | | | | | $SRANDOM is only supported since bash 5.1. Add a fallback to $RANDOM. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: workaround lack of `wait -p` before bash 5.1Thomas Haller3 days1-7/+40
| | | | | | | | | | | | Before bash 5.1, `wait -p` is not supported. So we cannot know which child process completed. As workaround, explicitly wait for the next PID. That works, but it significantly reduces parallel execution, because a long running job blocks the queue. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* json: deal appropriately with multidevice in chainPablo Neira Ayuso7 days3-3/+3
| | | | | | | | | | | | | | | | Chain device support is broken in JSON: listing does not include devices and parser only deals with one single device. Use existing json_parse_flowtable_devs() function, rename it to json_parse_devs() to parse the device array. Use the dev_array that contains the device names (as string) for the listing. Update incorrect .json-nft files in tests/shell. Fixes: 3fdc7541fba0 ("src: add multidevice support for netdev chain") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: clone unary expression datatype to deal with dynamic datatypePablo Neira Ayuso8 days2-0/+28
| | | | | | | | When allocating a unary expression, clone the datatype to deal with dynamic datatypes. Fixes: 6b01bb9ff798 ("datatype: concat expression only releases dynamically allocated datatype") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Fix sets/reset_command_0 for current kernelsPhil Sutter8 days1-8/+2
| | | | | | | | | Since kernel commit 4c90bba60c26 ("netfilter: nf_tables: do not refresh timeout when resetting element"), element reset won't touch expiry anymore. Invert the one check to make sure it remains unaltered, drop the other testing behaviour for per-element timeouts. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/shell: prettify JSON in test output and add helperThomas Haller8 days3-0/+38
| | | | | | | | | | | | | | | | | - add helper script "json-pretty.sh" for prettify/format JSON. It uses either `jq` or a `python` fallback. In my tests, they produce the same output, but the output is not guaranteed to be stable. This is mainly for informational purpose. - add a "json-diff-pretty.sh" which prettifies two JSON inputs and shows a diff of them. - in "test-wrapper.sh", after the check for a .json-nft dump fails, also call "json-diff-pretty.sh" and write the output to "ruleset-diff.json.pretty". This is beside "ruleset-diff.json", which contains the original diff. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: sanitize "handle" in JSON outputThomas Haller8 days279-280/+286
| | | | | | | | | The "handle" in JSON output is not stable. Sanitize/normalize to zero. Adjust the sanitize code, and regenerate the .json-nft files. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip if kernel does not allow to restore set element expirationPablo Neira Ayuso8 days2-0/+20
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip secmark tests if kernel does not support itPablo Neira Ayuso8 days2-0/+8
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: split nat inet testsPablo Neira Ayuso8 days4-27/+32
| | | | | | Detach nat inet from existing tests not to reduce test coverage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip nat inet if kernel does not support itPablo Neira Ayuso8 days2-0/+9
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip synproxy test if kernel does not support itPablo Neira Ayuso8 days2-0/+11
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: detach synproxy testPablo Neira Ayuso8 days4-33/+52
| | | | | | Old kernels do not support synproxy, split existing tests with stateful objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip stateful object updates if unsupportedPablo Neira Ayuso8 days2-0/+23
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: connlimit tests requires set expression supportPablo Neira Ayuso8 days1-0/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: bogus error when adding devices to flowtablePablo Neira Ayuso8 days1-0/+8
| | | | | | | | | | | | | | | | | | | | | | Bail out if flowtable declaration is missing and no devices are specified. Otherwise, this reports a bogus error when adding new devices to an existing flowtable. # nft -v nftables v1.0.9 (Old Doc Yak #3) # ip link add dummy1 type dummy # ip link set dummy1 up # nft 'create flowtable inet filter f1 { hook ingress priority 0; counter }' # nft 'add flowtable inet filter f1 { devices = { dummy1 } ; }' Error: missing hook and priority in flowtable declaration add flowtable inet filter f1 { devices = { dummy1 } ; } ^^^^^^^^^^^^^^^^^^^^^^^^ Fixes: 5ad475fce5a1 ("evaluate: bail out if new flowtable does not specify hook and priority") Reported-by: Martin Gignac <martin.gignac@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: flush connlimit setsPablo Neira Ayuso9 days2-2/+3
| | | | | | | | | | | Restored elements via set declaration are removed almost inmediately by GC, this is causing spurious failures in test runs. Flush sets to ensure dump is always consistent. Still, cover that restoring a set with connlimit elements do not. Fixes: 95d348d55a9e ("tests: shell: extend connlimit test") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip meta time test meta expression lacks supportFlorian Westphal9 days2-0/+9
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: skip maps delete test if dynset lacks delete opFlorian Westphal9 days2-0/+14
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: skip ct expectation test if feature is missingFlorian Westphal9 days1-0/+2
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: quote reference to array to iterate over empty stringPablo Neira Ayuso9 days1-1/+1
| | | | | | | | | | | | | | | | | | | | | | | This patch restores coverage for non-interval set backend. Use "${FLAGS[@]}" in loop, otherwise empty string is skipped in the iteration. This snippet: FLAGS=("") available_flags FLAGS "single" for flags in "${FLAGS[@]}" ; do echo $flags done ... now shows the empty string: # bash test.sh interval Fixes: ed927baa4fd8 ("tests: shell: skip pipapo set backend in transactions/30s-stress") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: adjust add-after-delete flowtable for older kernelsPablo Neira Ayuso9 days3-3/+2
| | | | | | | | | | | Remove counter from flowtable, older kernels (<=5.4) do not support this in testcases/flowtable/0013addafterdelete_0 so this bug is still covered. Skip testcases/flowtable/0014addafterdelete_0 if flowtable counter support is not available. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip sets/sets_with_ifnames if no pipapo backend is availablePablo Neira Ayuso2023-11-151-0/+2
| | | | | | | | Skip this by now for older kernels until someone detaches the tests that require the pipapo set backend. Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: restore pipapo and chain binding coverage in standalone 30s-stressPablo Neira Ayuso2023-11-151-0/+9
| | | | | | | | | | | | | | | | | | Do not disable pipapo and chain binding coverage for standalone runs by default. Instead, turn them on by default and allow users to disable them through: # export NFT_TEST_HAVE_chain_binding=n; bash tests/shell/testcases/transactions/30s-stress 3600 ... running standalone with: NFT_TEST_HAVE_chain_binding=n NFT_TEST_HAVE_pipapo=y given feature detection is not available in this case, thus, user has to provide an explicit hint on what this kernel supports. Fixes: c5b5b1044fdd ("tests/shell: add feature probing via "features/*.nft" files") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip pipapo set backend in transactions/30s-stressPablo Neira Ayuso2023-11-151-7/+44
| | | | | | Skip tests with concatenations and intervals if kernel does not support it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip if kernel does not support flowtable with no devicesPablo Neira Ayuso2023-11-152-0/+10
| | | | | | | | Originally, flowtables required devices in place to work, this was later relaxed to allow flowtable with no initial devices, see 05abe4456fa3 ("netfilter: nf_tables: allow to register flowtable with no devices"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip if kernel does not support flowtable counterPablo Neira Ayuso2023-11-152-0/+18
| | | | | | | Check if kernel provides flowtable counter supports which is available since 53c2b2899af7 ("netfilter: flowtable: add counter support"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add JSON dump filesThomas Haller2023-11-15339-0/+339
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Generate and add ".json-nft" files. These files contain the output of `nft -j list ruleset` after the test. Also, "test-wrapper.sh" will compare the current ruleset against the ".json-nft" files and test them with "nft -j --check -f $FILE`. These are useful extra tests, that we almost get for free. Note that for some JSON dumps, `nft -f --check` fails (or prints something). For those tests no *.json-nft file is added. The bugs needs to be fixed first. An example of such an issue is: $ DUMPGEN=all ./tests/shell/run-tests.sh tests/shell/testcases/maps/nat_addr_port which gives a file "rc-failed-chkdump" with Command `./tests/shell/../../src/nft -j --check -f "tests/shell/testcases/maps/dumps/nat_addr_port.json-nft"` failed >>>> internal:0:0-0: Error: Invalid map type 'ipv4_addr . inet_service'. internal:0:0-0: Error: Parsing command array at index 3 failed. internal:0:0-0: Error: unqualified type integer specified in map definition. Try "typeof expression" instead of "type datatype". <<<< Tests like "tests/shell/testcases/nft-f/0012different_defines_0" and "tests/shell/testcases/nft-f/0024priority_0" also don't get a .json-nft dump yet, because their output is not stable. That needs fixing too. Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: check and generate JSON dump filesThomas Haller2023-11-153-39/+138
| | | | | | | | | | | | | | | | | | | | | | The rules after a successful test are good opportunity to test `nft -j list ruleset` and `nft -j --check`. This quite possibly touches code paths that are not hit by other tests yet. The only downside is the increase of the test runtime (which seems negligible, given the benefits of increasing test coverage). Future commits will generate and commit those ".json-nft" dump files. "DUMPGEN=y" will, like before, regenerate only the existing "*.{nodump,nft,json-nft}" files (unless a test has none of the 3 files, in which case they are all generated and the user is suggested to commit the correct ones). Now also "DUMPGEN=all" is honored, that will generate all 3 files, regardless of whether they already existed. That is useful if you start out with a test that only has a .nft file, and then you want to generate a .json-nft file too. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: expand create commandsPablo Neira Ayuso2023-11-154-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | create commands also need to be expanded, otherwise elements are never evaluated: # cat ruleset.nft define ip-block-4 = { 1.1.1.1 } create set netdev filter ip-block-4-test { type ipv4_addr flags interval auto-merge elements = $ip-block-4 } # nft -f ruleset.nft BUG: unhandled expression type 0 nft: src/intervals.c:211: interval_expr_key: Assertion `0' failed. Aborted Same applies to chains in the form of: create chain x y { counter } which is also accepted by the parser. Update tests/shell to improve coverage for these use cases. Fixes: 56c90a2dd2eb ("evaluate: expand sets and maps before evaluation") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: split merge nat optimization in two testsPablo Neira Ayuso2023-11-114-21/+26
| | | | | | | One without pipapo support and another with not to harm existing coverage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: split single element in anonymous setPablo Neira Ayuso2023-11-114-4/+31
| | | | | | | Split this to move set stateful expression support into a separated test not to harm existing coverage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: split map testPablo Neira Ayuso2023-11-114-32/+38
| | | | | | | Split interval + concatenation into a separated file, so older kernels with no pipapo can still run what it is supported. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: split set NAT interval testPablo Neira Ayuso2023-11-114-22/+32
| | | | | | | | Split test in two, one for interval sets and another with concatenation + intervals, so at least intervals are tested in older kernels with no pipapo support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip if kernel does not support bitshiftPablo Neira Ayuso2023-11-112-43/+45
| | | | | | | | A few tests are missing bitshift checks that has been added to 885845468408 ("tests/shell: skip bitshift tests if kernel lacks support"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip multidevice chain tests if kernel lacks supportPablo Neira Ayuso2023-11-112-0/+19
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip comment tests if kernel lacks supportPablo Neira Ayuso2023-11-116-0/+23
| | | | | | Skip tests that require comment support Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip NAT netmap tests if kernel lacks supportPablo Neira Ayuso2023-11-112-0/+10
| | | | | | Skip tests that require NAT netmap support Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip stateful expression in sets tests if kernel lacks supportPablo Neira Ayuso2023-11-117-0/+30
| | | | | | Skip tests that require stateful expressions in sets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip prerouting reject tests if kernel lacks supportPablo Neira Ayuso2023-11-112-0/+10
| | | | | | Skip tests that require reject at prerouting hook. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip pipapo tests if kernel lacks supportPablo Neira Ayuso2023-11-1112-2/+38
| | | | | | Skip tests that require net/netfilter/nft_set_pipapo support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix hour decoding when timezone offset is negativeFlorian Westphal2023-11-022-0/+52
| | | | | | | | | | | | | | | | | | | | | Brian Davidson says: meta hour rules don't display properly after being created when the hour is on or after 00:00 UTC. The netlink debug looks correct for seconds past midnight UTC, but displaying the rules looks like an overflow or a byte order problem. I am in UTC-0400, so today, 20:00 and later exhibits the problem, while 19:00 and earlier hours are fine. meta.c only ever worked when the delta to UTC is positive. We need to add in case the second counter turns negative after offset adjustment. Also add a test case for this. Fixes: f8f32deda31d ("meta: Introduce new conditions 'time', 'day' and 'hour'") Reported-by: Brian Davidson <davidson.brian@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: fix mount command in "test-wrapper.sh"Thomas Haller2023-11-021-1/+1
| | | | | | | | | | | | | | | With Fedora 39 (util-linux-core-2.39.2-1.fc39), the mount command starts to fail. It was still working with Fedora 38 (util-linux-core-2.38.1-4.fc38). $ unshare -f -p -m --mount-proc -U --map-root-user -n bash -c 'mount -t tmpfs --make-private /var/run && mount' mount: /run: mount failed: Invalid argument. Not sure why this starts to fail. But arguably the command line arguments were wrong. Fix it, we need a pseudo name for the device. Fixes: df6f1a3e0803 ("tests/shell: bind mount private /var/run/netns in test container") Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: use /bin/bash in sets/elem_opts_compat_0Pablo Neira Ayuso2023-10-241-1/+1
| | | | | | So running this test with /bin/sh != /bin/bash works. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: fix length check for ifname in ifname_expr_alloc()Thomas Haller2023-10-241-6/+1
| | | | | | | | | | | | | | IFNAMSIZ is 16, and the allowed byte length of the name is one less than that. Fix the length check and adjust a test for covering the longest allowed interface name. This is obviously a change in behavior, because previously interface names with length 16 were accepted and were silently truncated along the way. Now they are rejected as invalid. Fixes: fa52bc225806 ("parser: reject zero-length interface names") Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: cover long interface name in "0042chain_variable_0" testThomas Haller2023-10-242-6/+34
| | | | | | | | | | | | | | | | IFNAMSIZ is 16. Adjust "0042chain_variable_0" to use an interface name with the maximum allowed bytes length. Instead of adding an entirely different test, adjust an existing one to use another interface name. The aspect for testing for a long interface name is not special enough, to warrant a separate test. We can cover it by extending an existing test. Note that the length check in "parser_bison.y" is wrong. The test checks still for the wrong behavior and that "d23456789012345x" is accepted. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add "bogons/nft-f/zero_length_devicename2_assert"Thomas Haller2023-10-241-0/+5
| | | | | | | | | | | | | | | | | This is copied from "bogons/nft-f/zero_length_devicename_assert" and adjusted. - `device""lo"` looks odd. In this file use `device ""` to only check against empty strings, without oddity. - "ip" type has no hook ingress in filter. If the device name would be valid, the file would still be rejected. Use "netdev". The purpose is to add a test for a file that would otherwise pass, except having an empty device name. Without oddities. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: inline input data in "single_anon_set" testThomas Haller2023-10-242-40/+45
| | | | | | | | | | | | | | | | | The file "optimizations/dumps/single_anon_set.nft.input" was laying around, and it was unclear how it was used. Let's extend "check-patch.sh" to flag all unused files. But the script cannot understand how "single_anon_set.nft.input" is used (aside allow listing it). Instead, inline the script to keep it inside the test (script). We still write the data to a separate file and don't use `nft -f -` (because reading stdin uses a different code path we want to cover). Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: test for maximum length of "comment" in "comments_objects_0"Thomas Haller2023-10-242-6/+23
| | | | | | | | | | | | | | | The comment length is limited to NFTNL_UDATA_COMMENT_MAXLEN. Test for that. Adjust an existing test for that. Also rename $EXPECTED to $RULESET. We don't compare the value of $EXPECTED against the actually configured rules. It also wouldn't work, because the input is not normalized and wouldn't match. It also isn't necessary, because there is a .nft dump file. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>