summaryrefslogtreecommitdiffstats
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
* tests: shell: better parameters for the interval stack overflow testŠtěpán Němec2021-12-081-2/+2
| | | | | | | | | | | | | | | | | | Wider testing has shown that 128 kB stack is too low (e.g. for systems with 64 kB page size), leading to false failures in some environments. Based on results from a matrix of RHEL 8 and RHEL 9 systems across x86_64, aarch64, ppc64le and s390x architectures as well as some anecdotal testing of other Linux distros on x86_64 machines, 400 kB seems safe: the normal nft stack (which should stay constant during this test) on all tested systems doesn't exceed 200 kB (stays around 100 kB on typical systems with 4 kB page size), while always growing beyond 500 kB in the failing case (nftables before baecd1cf2685) with the increased set size. Fixes: d8ccad2a2b73 ("tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge interval set")") Signed-off-by: Štěpán Němec <snemec@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptopt: fix crash with invalid field/type comboFlorian Westphal2021-12-071-0/+7
| | | | | | | | | | | | | | | % nft describe ip option rr value segmentation fault after this fix, this exits with 'Error: unknown ip option type/field'. Problem is that 'rr' doesn't have a value template, so the template struct is all-zeroes, so we crash when trying to use tmpl->dtype (its NULL). Furthermore, expr_describe tries to print expr->identifier but expr is exthdr, not symbol: ->identifier contains garbage. Signed-off-by: Florian Westphal <fw@strlen.de>
* exthdr: support ip/tcp options and sctp chunks in typeof expressionsFlorian Westphal2021-12-072-0/+54
| | | | | | | | | This did not store the 'op' member and listing always treated this as ipv6 extension header. Add test cases for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* cache: Support filtering for a specific flowtablePhil Sutter2021-12-031-5/+46
| | | | | | | | | | Extend nft_cache_filter to hold a flowtable name so 'list flowtable' command causes fetching the requested flowtable only. Dump flowtables just once instead of for each table, merely assign fetched data to tables inside the loop. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: add tcp subtype match test casesFlorian Westphal2021-12-013-0/+78
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: add test cases for md5sig, fastopen and mptcp mnemonicsFlorian Westphal2021-12-013-0/+63
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tcpopt: remove KIND keywordFlorian Westphal2021-12-013-67/+38
| | | | | | | | | | | | | | | | tcp option <foo> kind ... never makes any sense, as "tcp option <foo>" already tells the kernel to look for the foo <kind>. "tcp option sack kind 5" matches if the sack option is present; its a more complicated form of the simpler "tcp option sack exists". "tcp option sack kind 1" (or any other value than 5) will never match. So remove this. Test cases are converted to "exists". Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: Avoid duplicate records in *.got filesPhil Sutter2021-11-301-10/+19
| | | | | | | | | | If payloads don't contain family-specific bits, they may sit in a single *.payload file for all tested families. In such case, nft-test.py will consequently write dissenting payloads into a single *.got file. To avoid the duplicate entries, check if a matching record exists already before writing it out. Signed-off-by: Phil Sutter <phil@nwl.cc>
* exthdr: fix type number saved in udataFlorian Westphal2021-11-302-0/+10
| | | | | | | | | This should store the index of the protocol template, but &x[i] - &x[0] is always i, so remove the divide. Also add test case. Fixes: 01fbc1574b9e ("exthdr: add parse and build userdata interface") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* cache: do not skip populating anonymous set with -tPablo Neira Ayuso2021-11-181-2/+2
| | | | | | | | | | | | | | | | | | | --terse does not apply to anonymous set, add a NFT_CACHE_TERSE bit to skip named sets only. Moreover, prioritize specific listing filter over --terse to avoid a bogus: netlink: Error: Unknown set '__set0' in lookup expression when invoking: # nft -ta list set inet filter example Extend existing test to improve coverage. Fixes: 9628d52e46ac ("cache: disable NFT_CACHE_SETELEM_BIT on --terse listing only") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: do not call interval_map_decompose() for concat intervalsFlorian Westphal2021-11-171-0/+5
| | | | | | | | | | | | | | Without this, nft monitor will either print garbage or even segfault when encountering a concat set because we pass expr->value to libgmp helpers for concat (non-value) expressions. Also, for concat case, we need to call concat_range_aggregate() helper. Add a test case for this. Without this patch, it gives: tests/monitor/run-tests.sh: line 98: 1163 Segmentation fault (core dumped) $nft -nn -e -f $command_file > $echo_output Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_json: add raw payload inner header match supportPablo Neira Ayuso2021-11-173-0/+25
| | | | | | | Add missing "ih" base raw payload and extend tests/py to cover this new usecase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: remove netdev coverage in ip/ip_tcp.tPablo Neira Ayuso2021-11-122-96/+0
| | | | | | | | | | | | | The following tests shows a warning in the netdev family: ip/ip_tcp.t: WARNING: line 9: 'add rule netdev test-netdev ingress ip protocol tcp tcp dport 22': 'tcp dport 22' mismatches 'ip protocol 6 tcp dport 22' 'ip protocol tcp' can be removed in the ip family, but not in netdev. This test is specific of the ip family, remove the netdev lines. Fixes: 510c4fad7e78 ("src: Support netdev egress hook") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: missing json output update in ip6/meta.tPablo Neira Ayuso2021-11-121-0/+16
| | | | | | | Update json output for 'meta protocol ip6 udp dport 67'. Fixes: 646c5d02a5db ("rule: remove redundant meta protocol from the evaluation step") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: missing ip/snat.t json updatesPablo Neira Ayuso2021-11-122-0/+347
| | | | | | | Missing json update for new tests added recently. Fixes: 50780456a01a ("evaluate: check for missing transport protocol match in nat map with concatenations") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: missing ip/dnat.t json updatesPablo Neira Ayuso2021-11-121-0/+333
| | | | | | | Missing json update for three new tests added recently. Fixes: 640dc0c8a3da ("tests: py: extend coverage for dnat with classic range representation") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: update rawpayload.t.jsonPablo Neira Ayuso2021-11-082-5/+21
| | | | | | | Missing update of json test. Fixes: 6ad2058da66a ("datatype: add xinteger_type alias to print in hexadecimal") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: clone variable expression if there is more than one referencePablo Neira Ayuso2021-11-082-0/+30
| | | | | | | | | Clone the expression that defines the variable value if there are multiple references to it in the ruleset. This saves heap memory consumption in case the variable defines a set with a huge number of elements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: remove verdict from closing end intervalPablo Neira Ayuso2021-11-087-7/+7
| | | | | | | | | | | | | Kernel does not allow for NFT_SET_ELEM_INTERVAL_END flag and NFTA_SET_ELEM_DATA. The closing end interval represents a mismatch, therefore, no verdict can be applied. The existing payload files show the drop verdict when this is unset (because NF_DROP=0). This update is required to fix payload warnings in tests/py after libnftnl's ("set: use NFTNL_SET_ELEM_VERDICT to print verdict"). Fixes: 6671d9d137f6 ("mnl: Set NFTNL_SET_DATA_TYPE before dumping set elements") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: $NFT needs to be invoked unquotedŠtěpán Němec2021-11-052-1/+4
| | | | | | | | | | | | | The variable has to undergo word splitting, otherwise the shell tries to find the variable value as an executable, which breaks in cases that 7c8a44b25c22 ("tests: shell: Allow wrappers to be passed as nft command") intends to support. Mention this in the shell tests README. Fixes: d8ccad2a2b73 ("tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge interval set")") Signed-off-by: Štěpán Němec <snemec@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: README: clarify test file name conventionŠtěpán Němec2021-11-051-2/+5
| | | | | | | | | | | | Since commit 4d26b6dd3c4c, test file name suffix no longer reflects expected exit code in all cases. Move the sentence "Since they are located with `find', test files can be put in any subdirectory." to a separate paragraph. Fixes: 4d26b6dd3c4c ("tests: shell: change all test scripts to return 0") Signed-off-by: Štěpán Němec <snemec@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: README: $NFT does not have to be a path to a binaryŠtěpán Němec2021-11-051-1/+1
| | | | | | | | | Since commit 7c8a44b25c22, $NFT can contain an arbitrary command, e.g. 'valgrind nft'. Fixes: 7c8a44b25c22 ("tests: shell: Allow wrappers to be passed as nft command") Signed-off-by: Štěpán Němec <snemec@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: README: copy editŠtěpán Němec2021-11-051-11/+12
| | | | | | | Grammar, wording, formatting fixes (no substantial change of meaning). Signed-off-by: Štěpán Němec <snemec@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* datatype: add xinteger_type alias to print in hexadecimalPablo Neira Ayuso2021-11-032-8/+8
| | | | | | | | | Add an alias of the integer type to print raw payload expressions in hexadecimal. Update tests/py. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: postpone transport protocol match check after nat expression ↵Pablo Neira Ayuso2021-11-033-0/+27
| | | | | | | | | evaluation Fix bogus error report when using transport protocol as map key. Fixes: 50780456a01a ("evaluate: check for missing transport protocol match in nat map with concatenations") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: extend limit syntaxJeremy Sowden2021-11-033-0/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The documentation describes the syntax of limit statements thus: limit rate [over] packet_number / TIME_UNIT [burst packet_number packets] limit rate [over] byte_number BYTE_UNIT / TIME_UNIT [burst byte_number BYTE_UNIT] TIME_UNIT := second | minute | hour | day BYTE_UNIT := bytes | kbytes | mbytes From this one might infer that a limit may be specified by any of the following: limit rate 1048576/second limit rate 1048576 mbytes/second limit rate 1048576 / second limit rate 1048576 mbytes / second However, the last does not currently parse: $ sudo /usr/sbin/nft add filter input limit rate 1048576 mbytes / second Error: wrong rate format add filter input limit rate 1048576 mbytes / second ^^^^^^^^^^^^^^^^^^^^^^^^^ Extend the `limit_rate_bytes` parser rule to support it, and add some new Python test-cases. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: run-tests.sh: ensure non-zero exit when $failed != 0Štěpán Němec2021-11-022-2/+2
| | | | | | | | | | | | | | POSIX [1] does not specify the behavior of `exit' with arguments outside the 0-255 range, but what generally (bash, dash, zsh, OpenBSD ksh, busybox) seems to happen is the shell exiting with status & 255 [2], which results in zero exit for certain non-zero arguments. [1] https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#exit [2] https://git.savannah.gnu.org/cgit/bash.git/tree/builtins/common.c#n579 Fixes: 0c6592420586 ("tests: fix return codes") Signed-off-by: Štěpán Němec <snemec@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix bogus testsuite failure with 250HzPhil Sutter2021-11-021-1/+1
| | | | | | | | | | | Previous fix for HZ=100 was not sufficient, a kernel with HZ=250 rounds the 10ms to 8ms it seems. Do as Lukas suggests and accept the occasional input/output asymmetry instead of continuing the hide'n'seek game. Fixes: c9c5b5f621c37 ("tests: shell: Fix bogus testsuite failure with 100Hz") Suggested-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Support netdev egress hookLukas Wunner2021-10-2836-29/+2377
| | | | | | | | | Add userspace support for the netdev egress hook which is queued up for v5.16-rc1, complete with documentation and tests. Usage is identical to the ingress hook. Signed-off-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Move netdev-specific tests to appropriate subdirectoryLukas Wunner2021-10-287-0/+0
| | | | | | | | The fwd and dup statements are specific to netdev hooks, so move their tests to the appropriate subdirectory. Signed-off-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add testcase for --tersePablo Neira Ayuso2021-10-281-0/+69
| | | | | | | | | Compare listing with and without --terse for: nft list ruleset nft list set x y Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge ↵Štěpán Němec2021-10-201-0/+29
| | | | | | | | | | | | | | | | | | interval set") Test inspired by [1] with both the set and stack size reduced by the same power of 2, to preserve the (pre-baecd1cf2685) segfault on one hand, and make the test successfully complete (post-baecd1cf2685) in a few seconds even on weaker hardware on the other. (The reason I stopped at 128kB stack size is that with 64kB I was getting segfaults even with baecd1cf2685 applied.) [1] https://bugzilla.redhat.com/show_bug.cgi?id=1908127 Signed-off-by: Štěpán Němec <snemec@redhat.com> Helped-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: auto-removal of chain hook on netns removalFlorian Westphal2021-10-191-0/+6
| | | | | | | | This is the nft equivalent of the syzbot report that lead to kernel commit 68a3765c659f8 ("netfilter: nf_tables: skip netdev events generated on netns removal"). Signed-off-by: Florian Westphal <fw@strlen.de>
* cache: set on cache flags for nested notationPablo Neira Ayuso2021-09-291-0/+25
| | | | | | | | | Set on the cache flags for the nested notation too, this is fixing nft -f with two files, one that contains the set declaration and another that adds a rule that refers to such set. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1474 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: check for missing transport protocol match in nat map with ↵Pablo Neira Ayuso2021-09-292-3/+25
| | | | | | | | | | | | | | | | concatenations Restore this error with NAT maps: # nft add rule 'ip ipfoo c dnat to ip daddr map @y' Error: transport protocol mapping is only valid after transport protocol match add rule ip ipfoo c dnat to ip daddr map @y ~~~~ ^^^^^^^^^^^^^^^ Allow for transport protocol match in the map too, which is implicitly pulling in a transport protocol dependency. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: check for concatenation in set data datatypePablo Neira Ayuso2021-09-292-0/+18
| | | | | | | | | | | | | When adding this rule with an existing map: add rule nat x y meta l4proto { tcp, udp } dnat ip to ip daddr . th dport map @fwdtoip_th reports a bogus: Error: datatype mismatch: expected IPv4 address, expression has type concatenation of (IPv4 address, internet network service) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: monitor: update insert and replace commandsPablo Neira Ayuso2021-09-291-2/+2
| | | | | | | | | Adjust test after these two kernel fixes: ("netfilter: nf_tables: reverse order in rule replacement expansion") ("netfilter: nf_tables: add position handle in event notification") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: dynset: set compound expr dtype based on set key definitionFlorian Westphal2021-09-292-0/+28
| | | | | | | | | | | | | | | | | "nft add rule ... add @t { ip saddr . 22 ..." will be listed as 'ip saddr . 0x16 [ invalid type]". This is a display bug, the compound expression created during netlink deserialization lacks correct datatypes for the value expression. Avoid this by setting the individual expressions' datatype. The set key has the needed information, so walk over the types and set them in the dynset statment. Also add a test case. Reported-by: Paulo Ricardo Bruck <paulobruck1@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: don't adjust offsets of autogenerated dependency expressionsFlorian Westphal2021-09-294-0/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pablo says: user reports that this is broken: nft --debug=netlink add rule bridge filter forward vlan id 100 vlan id set 200 [..] [ payload load 2b @ link header + 14 => reg 1 ] [..] [ payload load 2b @ link header + 28 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x000000f0 ) ^ 0x0000c800 ] [ payload write reg 1 => 2b @ link header + 14 csum_type 0 csum_off 0 csum_flags 0x0 ] offset says 28, it is assuming q-in-q, in this case it is mangling the existing header. The problem here is that 'vlan id set 200' needs a read-modify-write cycle because 'vlan id set' has to preserve bits located in the same byte area as the vlan id. The first 'payload load' at offset 14 is generated via 'vlan id 100', this part is ok. The second 'payload load' at offset 28 is the bogus one. Its added as a dependency, but then adjusted because nft evaluation considers this identical to 'vlan id 1 vlan id '2, where nft assumes q-in-q. To fix this, skip offset adjustments for raw expressions and mark the dependency-generated payload instruction as such. This is fine because raw payload operations assume that user specifies base/offset/length manually. Also add a test case for this. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: reset temporary set element stmt list after list splicePablo Neira Ayuso2021-09-162-0/+27
| | | | | | | | Reset temporary stmt list to deal with the key_end case which might result in a jump backward to handle the rhs of the interval. Reported-by: Martin Zatloukal <slezi2@pvfree.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: update ct expirationPablo Neira Ayuso2021-09-151-3/+3
| | | | | | | | Since 309785674b25 ("datatype: time_print() ignores -T"), time_type honors -T option. Given tests/py run in numeric format, this patch fixes a warning since the ct expiration is now expressed in seconds. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: rework range_expr_to_prefix()Pablo Neira Ayuso2021-09-093-0/+112
| | | | | | | | | Consolidate prefix calculation in range_expr_is_prefix(). Add tests/py for 9208fb30dc49 ("src: Check range bounds before converting to prefix"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: remove redundant meta protocol from the evaluation stepPablo Neira Ayuso2021-09-034-6/+2
| | | | | | | | | | | | | 567ea4774e13 ("netlink_delinearize: incorrect meta protocol dependency kill") does not document two cases that are handled in this patch: - 'meta protocol ip' is removed if used in the ip family. - 'meta protocol ip6' is removed if used in the ip6 family. This patch removes this redundancy earlier, from the evaluation step before netlink bytecode generation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: incorrect meta protocol dependency kill againPablo Neira Ayuso2021-09-032-0/+90
| | | | | | | | | | | | | This patch adds __meta_dependency_may_kill() to consolidate inspection of the meta protocol, nfproto and ether type expression to validate dependency removal on listings. Phil reports that 567ea4774e13 includes an update on the ip and ip6 families that is not described in the patch, moreover, it flips the default verdict from true to false. Fixes: 567ea4774e13 ("netlink_delinearize: incorrect meta protocol dependency kill") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: incorrect meta protocol dependency killPablo Neira Ayuso2021-08-2612-0/+253
| | | | | | | | meta protocol is meaningful in bridge, netdev and inet families, do not remove this. Fixes: 056aaa3e6dc6 ("netlink_delinearize: Refactor meta_may_dependency_kill()") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: monitor: Continue on errorPhil Sutter2021-08-241-10/+23
| | | | | | Just make sure return code reflects the overall result. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: monitor: Print errors to stderrPhil Sutter2021-08-241-10/+17
| | | | | | | While being at it, introduce die() to error and exit. But don't use it everywhere to prepare for continuing on errors. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: json_echo: Print errors to stderrPhil Sutter2021-08-241-7/+7
| | | | | | | | | | | | | | Apart from the obvious, this fixes exit_dump() which tried to dump the wrong variable ('out' instead of 'obj') and missed that json.dumps() doesn't print but just returns a string. Make it call exit_err() to share some code, which changes the prefix from 'FAIL' to 'Error' as a side-effect. While being at it, fix for a syntax warning with newer Python in unrelated code. Fixes: bb32d8db9a125 ("JSON: Add support for echo option") Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: Optimize prefix match only if is big-endianXiao Liang2021-08-233-0/+27
| | | | | | | | | | | A prefix of integer type is big-endian in nature. Prefix match can be optimized to truncated 'cmp' only if it is big-endian. [ Add one tests/py for this use-case --pablo ] Fixes: 25338cdb6c77 ("src: Optimize prefix matches on byte-boundaries") Signed-off-by: Xiao Liang <shaw.leon@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add nft-f/0022variables_0 dump filePablo Neira Ayuso2021-08-202-5/+14
| | | | | | Dump file was missing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-12 18:17:03 +0000