summaryrefslogtreecommitdiffstats
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
* tests: add json test for vlan rule fixM. Braun2019-08-122-0/+62
| | | | | | | | | | | | | | | This fixes ERROR: did not find JSON equivalent for rule 'ether type vlan ip protocol 1 accept' when running ./nft-test.py -j bridge/vlan.t Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Michael Braun <michael-dev@fami-braun.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: move chain priority and policy to chain folderPablo Neira Ayuso2019-08-098-0/+0
| | | | | | Move new chain tests for variable priority and policy to chain folder. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow variable in chain policyFernando Fernandez Mancera2019-08-086-0/+80
| | | | | | | | | | | | This patch allows you to use variables in chain policy definition, e.g. define default_policy = "accept" add table ip foo add chain ip foo bar {type filter hook input priority filter; policy $default_policy} Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow variables in the chain priority specificationFernando Fernandez Mancera2019-08-086-0/+80
| | | | | | | | | | | | | | | | | This patch allows you to use variables in chain priority definitions, e.g. define prio = filter define prionum = 10 define prioffset = "filter - 150" add table ip foo add chain ip foo bar { type filter hook input priority $prio; } add chain ip foo ber { type filter hook input priority $prionum; } add chain ip foo bor { type filter hook input priority $prioffset; } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: incorrect flush flag for table/chainLaura Garcia Liebana2019-07-312-0/+32
| | | | | | | | | | | | | | | | | | | After the new cache system, nft raises a table error flushing a chain in a transaction. # nft "flush chain ip nftlb filter-newfarm ; \ add rule ip nftlb filter-newfarm update \ @persist-newfarm { ip saddr : ct mark } ; \ flush chain ip nftlb nat-newfarm" Error: No such file or directory flush chain ip nftlb filter-newfarm ; add rule ip nftlb (...) ^^^^^ This patch sets the cache flag properly to save this case. Fixes: 01e5c6f0ed031 ("src: add cache level flags") Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix dumping vlan rulesM. Braun2019-07-313-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Given the following bridge rules: 1. ip protocol icmp accept 2. ether type vlan vlan type ip ip protocol icmp accept The are currently both dumped by "nft list ruleset" as 1. ip protocol icmp accept 2. ip protocol icmp accept Though, the netlink code actually is different bridge filter FORWARD 4 [ payload load 2b @ link header + 12 => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000001 ] [ immediate reg 0 accept ] bridge filter FORWARD 5 4 [ payload load 2b @ link header + 12 => reg 1 ] [ cmp eq reg 1 0x00000081 ] [ payload load 2b @ link header + 16 => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000001 ] [ immediate reg 0 accept ] What happens here is that: 1. vlan type ip kills ether type vlan 2. ip protocol icmp kills vlan type ip Fix this by avoiding the removal of all vlan statements in the given example. Signed-off-by: Michael Braun <michael-dev@fami-braun.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: check for table re-definition usecaseFlorian Westphal2019-07-231-0/+15
| | | | | | | | | | | | | | | | | | | | Make sure nft behaves like 0.9.0 -- the ruleset flush ruleset table inet filter { } table inet filter { chain test { counter } } loads again without crashing/generating an error message. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1351 Fixes: e5382c0d08e3c ("src: Support intra-transaction rule references") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: evaluate: support prefix expression in statementsFlorian Westphal2019-07-223-0/+41
| | | | | | | | | | | | | | | | | | | | | | | | Currently nft dumps core when it encounters a prefix expression as part of a statement, e.g. iifname ens3 snat to 10.0.0.0/28 yields: BUG: unknown expression type prefix nft: netlink_linearize.c:688: netlink_gen_expr: Assertion `0' failed. This assertion is correct -- we can't linearize a prefix because kernel doesn't know what that is. For LHS prefixes, they get converted to a binary 'and' such as '10.0.0.0 & 255.255.255.240'. For RHS, we can do something similar and convert them into a range. snat to 10.0.0.0/28 will be converted into: iifname "ens3" snat to 10.0.0.0-10.0.0.15 Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1187 Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add missing json outputsFernando Fernandez Mancera2019-07-171-0/+25
| | | | | | Fixes: 1188a69604c3 ("src: introduce SYNPROXY matching") Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce SYNPROXY matchingFernando Fernandez Mancera2019-07-173-0/+156
| | | | | | | | | | | | | | | | | | | | Add support for "synproxy" statement. For example (for TCP port 8888): table ip x { chain y { type filter hook prerouting priority raw; policy accept; tcp dport 8888 tcp flags syn notrack } chain z { type filter hook input priority filter; policy accept; tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm ct state invalid drop } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: fix up two broken json test casesFlorian Westphal2019-07-172-3/+25
| | | | | | | | | Forgot to add a json test case for the recently added ct ip addr in map case. Fix up rawpayload.t for json, it needs to expect new "th dport" when listing. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add ct expectations supportStéphane Veyret2019-07-166-1/+51
| | | | | | | This modification allow to directly add/list/delete expectations. Signed-off-by: Stéphane Veyret <sveyret@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: incorrect flags for create commandsPablo Neira Ayuso2019-07-162-0/+10
| | | | | | | | | | | | | | | # nft create table testD # nft create chain testD test6 Error: No such file or directory create chain testD test6 ^^^^^ Handle 'create' command just like 'add' and 'insert'. Check for object types to dump the tables for more fine grain listing, instead of dumping the whole ruleset. Fixes: 7df42800cf89 ("src: single cache_update() call to build cache before evaluation") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: missing object maps handling in list and flush commandsPablo Neira Ayuso2019-07-163-0/+57
| | | | | | | | | | | | | | | | | | | | NFT_SET_OBJECT tells there is an object map. # nft list ruleset table inet filter { map countermap { type ipv4_addr : counter } } The following command fails: # nft flush set inet filter countermap This patch checks for NFT_SET_OBJECT from new set_is_literal() and map_is_literal() functions. This patch also adds tests for this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: make sure we test nft binary from working tree, not hostFlorian Westphal2019-07-151-2/+0
| | | | | | | This tests the installed host nft binary, which fails on my test vm. Using the one from the working tree makes this test pass. Signed-off-by: Florian Westphal <fw@strlen.de>
* proto: add pseudo th protocol to match d/sport in generic wayFlorian Westphal2019-07-153-1/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: Its not possible to easily match both udp and tcp in a single rule. ... input ip protocol { tcp,udp } dport 53 will not work, as bison expects "tcp dport" or "sctp dport", or any other transport protocol name. Its possible to match the sport and dport via raw payload expressions, e.g.: ... input ip protocol { tcp,udp } @th,16,16 53 but its not very readable. Furthermore, its not possible to use this for set definitions: table inet filter { set myset { type ipv4_addr . inet_proto . inet_service } chain forward { type filter hook forward priority filter; policy accept; ip daddr . ip protocol . @th,0,16 @myset } } # nft -f test test:7:26-35: Error: can not use variable sized data types (integer) in concat expressions During the netfilter workshop Pablo suggested to add an alias to do raw sport/dport matching more readable, and make it use the inet_service type automatically. So, this change makes @th,0,16 work for the set definition case by setting the data type to inet_service. A new "th s|dport" syntax is provided as readable alternative: ip protocol { tcp, udp } th dport 53 As "th" is an alias for the raw expression, no dependency is generated -- its the users responsibility to add a suitable test to select the l4 header types that should be matched. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src/ct: provide fixed data lengh sizes for ip/ip6 keysFlorian Westphal2019-07-122-0/+10
| | | | | | | | | | | | | | | | | | nft can load but not list this: table inet filter { chain input { ct original ip daddr {1.2.3.4} accept } } Problem is that the ct template length is 0, so we believe the right hand side is a concatenation because left->len < set->key->len is true. nft then calls abort() during concatenation parsing. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1222 Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: add support for matching IPv4 optionsStephen Suryaputra2019-07-0412-331/+331
| | | | | | | | | Add capability to have rules matching IPv4 options. This is developed mainly to support dropping of IP packets with loose and/or strict source route route options. Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: update test to include reset commandPablo Neira Ayuso2019-07-032-0/+9
| | | | | | Update tests to invoke the reset command. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: fix python3Shekhar Sharma2019-07-011-33/+33
| | | | | | | This converts the nft-test.py file to run on both py2 and py3. Signed-off-by: Shekhar Sharma <shekhar250198@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: print space between policy and timeoutPablo Neira Ayuso2019-07-013-4/+4
| | | | | | | | | | | | table ip filter { ct timeout agressive-tcp { ... policy = { established : 100, close_wait : 4, close : 4 } ^ ^ ^ ^ ^ ^ for consistency with map syntax. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: do not print semicolon in ct timeoutPablo Neira Ayuso2019-07-013-3/+3
| | | | | | | | | | | | table ip filter { ct timeout agressive-tcp { protocol tcp; ^--- remove this semicolon Not needed, remove it. Fixes: c7c94802679c ("src: add ct timeout support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: restore element expirationPablo Neira Ayuso2019-07-011-0/+13
| | | | | | | | | | This patch adds a test for 24f33c710e8c ("src: enable set expiration date for set elements"). This is also implicitly testing for a cache corruption bug that is fixed by 9b032cd6477b ("monitor: fix double cache update with --echo"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: support for NFT_CT_{SRC,DST}_{IP,IP6}Pablo Neira Ayuso2019-06-216-32/+21
| | | | | | | | | | | | | | | | | These keys are available since kernel >= 4.17. You can still use NFT_CT_{SRC,DST}, however, you need to specify 'meta protocol' in first place to provide layer 3 context. Note that NFT_CT_{SRC,DST} are broken with set, maps and concatenations. This patch is implicitly fixing these cases. If your kernel is < 4.17, you can still use address matching via explicit meta nfproto: meta nfproto ipv4 ct original saddr 1.2.3.4 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: prefer meta protocol as bridge l3 dependencyFlorian Westphal2019-06-197-120/+128
| | | | | | | | | | | | | | | | | | | On families other than 'ip', the rule ip protocol icmp needs a dependency on the ip protocol so we do not treat e.g. an ipv6 header as ip. Bridge currently uses eth_hdr.type for this, but that will cause the rule above to not match in case the ip packet is within a VLAN tagged frame -- ether.type will appear as ETH_P_8021Q. Due to vlan tag stripping, skb->protocol will be ETH_P_IP -- so prefer to use this instead. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinerize: remove network header dep for reject statement also in ↵Florian Westphal2019-06-193-200/+45
| | | | | | | | | | | | | | | | | | | | | bridge family add rule bridge test-bridge input reject with icmp type ... is shown as ether type ip reject type ... i.e., the dependency is not removed. Allow dependency removal -- this adds a problem where some icmp types will be shortened to 'reject', losing the icmp ipv4 dependency. Next patch resolves this problem by disabling short-hand abbreviations for bridge reject statements. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: do not allow to list/flush anonymous sets via list commandPablo Neira Ayuso2019-06-191-0/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | Don't allow this: # nft list set x __set0 table ip x { set __set0 { type ipv4_addr flags constant elements = { 1.1.1.1 } } } Constant sets never change and they are attached to a rule (anonymous flag is set on), do not list their content through this command. Do not allow flush operation either. After this patch: # nft list set x __set0 Error: No such file or directory list set x __set0 ^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: allow get/list/flush dynamic sets and maps via list commandPablo Neira Ayuso2019-06-191-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | Before: # nft list set ip filter untracked_unknown Error: No such file or directory; did you mean set ‘untracked_unknown’ in table ip ‘filter’? list set ip filter untracked_unknown ^^^^^^^^^^^^^^^^^ After: # nft list set ip filter untracked_unknown table ip filter { set untracked_unknown { type ipv4_addr . inet_service . ipv4_addr . inet_service . inet_proto size 100000 flags dynamic,timeout } } Add a testcase for this too. Reported-by: Václav Zindulka <vaclav.zindulka@tlapnet.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add missing json arp operation outputFlorian Westphal2019-06-181-0/+21
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: cannot use handle for non-existing rule in kernelPablo Neira Ayuso2019-06-171-1/+1
| | | | | | Do not guess handle for an unexisting rule in the kernel. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: fix print of raw numerical symbol valuesFlorian Westphal2019-06-173-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The two rules: arp operation 1-2 accept arp operation 256-512 accept are both shown as 256-512: chain in_public { arp operation 256-512 accept arp operation 256-512 accept meta mark "1" tcp flags 2,4 } This is because range expression enforces numeric output, yet nft_print doesn't respect byte order. Behave as if we had no symbol in the first place and call the base type print function instead. This means we now respect format specifier as well: chain in_public { arp operation 1-2 accept arp operation 256-512 accept meta mark 0x00000001 tcp flags 0x2,0x4 } Without fix, added test case will fail: 'add rule arp test-arp input arp operation 1-2': 'arp operation 1-2' mismatches 'arp operation 256-512' v2: in case of -n, also elide quotation marks, just as if we would not have found a symbolic name. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Print unified diffs in dump errorsPhil Sutter2019-06-081-1/+1
| | | | | | | | Non-unified format is useful only if the expected output is printed as well, which is not the case. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Fix warning from awk callPhil Sutter2019-06-081-1/+1
| | | | | | | | | Syntax passed to awk in that one testcase caused a warning, fix the syntax. Fixes: e0a9aad024809 ("tests: shell: fix tests for deletion via handle attribute") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Add missing arp.t JSON equivalentsPhil Sutter2019-06-082-8/+70
| | | | | | Fixes: 4b0f2a712b579 ("src: support for arp sender and target ethernet and IPv4 addresses") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Fix JSON equivalentsPhil Sutter2019-06-083-80/+86
| | | | | | | | | Recent patch removing single element set use missed to adjust JSON equivalents accordingly. Fixes: 27f6a4c68b4fd ("tests: replace single element sets") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Support intra-transaction rule referencesPhil Sutter2019-06-075-0/+59
| | | | | | | | | | | | | | | | | | | | | | | A rule may be added before or after another one using index keyword. To support for the other rule being added within the same batch, one has to make use of NFTNL_RULE_ID and NFTNL_RULE_POSITION_ID attributes. This patch does just that among a few more crucial things: * If cache is complete enough to contain rules, update cache when evaluating rule commands so later index references resolve correctly. * Reduce rule_translate_index() to its core code which is the actual linking of rules and consequently rename the function. The removed bits are pulled into the calling rule_evaluate() to reduce code duplication in between cache updates with and without rule reference. * Pass the current command op to rule_evaluate() as indicator whether to insert before or after a referenced rule or at beginning or end of chain in cache. Exploit this from chain_evaluate() to avoid adding the chain's rules a second time. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/json_echo: Drop needless workaroundPhil Sutter2019-06-071-4/+2
| | | | | | | | With cache issues now resolved, there is no need for the multi add test workaround anymore. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Support JSON validationPhil Sutter2019-05-311-1/+24
| | | | | | | | | | Introduce a new flag -s/--schema to nft-test.py which enables validation of any JSON input and output against our schema. Make use of traceback module to get more details if validation fails. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Test large transaction with echo outputPhil Sutter2019-05-311-0/+14
| | | | | | | | | This reliably triggered ENOBUFS condition in mnl_batch_talk(). With the past changes, it passes even after increasing the number of rules to 300k. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: replace single element setsPablo Neira Ayuso2019-05-3121-256/+280
| | | | | | Add at least two elements to sets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: json_echo: convert to py3Shekhar Sharma2019-05-291-22/+23
| | | | | | | | This patch converts the run-test.py file to run on both python3 and python2. Signed-off-by: Shekhar Sharma <shekhar250198@gmail.com> Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Allow goto and jump to a variableFernando Fernandez Mancera2019-05-244-0/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces the use of nft input files variables in 'jump' and 'goto' statements, e.g. define dest = ber add table ip foo add chain ip foo bar {type filter hook input priority 0;} add chain ip foo ber add rule ip foo ber counter add rule ip foo bar jump $dest table ip foo { chain bar { type filter hook input priority filter; policy accept; jump ber } chain ber { counter packets 71 bytes 6664 } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for arp sender and target ethernet and IPv4 addressesPablo Neira Ayuso2019-05-243-1/+55
| | | | | | | | | | | | | | | | | | | | | | | | # nft add table arp x # nft add chain arp x y { type filter hook input priority 0\; } # nft add rule arp x y arp saddr ip 192.168.2.1 counter Testing this: # ip neigh flush dev eth0 # ping 8.8.8.8 # nft list ruleset table arp x { chain y { type filter hook input priority filter; policy accept; arp saddr ip 192.168.2.1 counter packets 1 bytes 46 } } You can also specify hardware sender address, eg. # nft add rule arp x y arp saddr ether aa:bb:cc:aa:bb:cc drop counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: update cache if cmd is more specificEric Garver2019-05-241-0/+14
| | | | | | | | | | | | | | | | | If we've done a partial fetch of the cache and the genid is the same the cache update will be skipped without fetching the needed items. This change flushes the cache if the new request is more specific than the current cache - forcing a cache update which includes the needed items. Introduces a simple scoring system which reflects how cache_init_objects() looks at the current command to decide if it is finished already or not. Then use that in cache_needs_more(): If current command's score is higher than old command's, cache needs an update. Fixes: 816d8c7659c1 ("Support 'add/insert rule index <IDX>'") Signed-off-by: Eric Garver <eric@garver.life> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "tests: shell: avoid single-value anon sets"Pablo Neira Ayuso2019-05-2413-20/+20
| | | | This reverts commit b7459b0c854fc7a0d6cd86151b81035a8edf8e63.
* Revert "tests: py: remove single-value-anon-set test cases"Pablo Neira Ayuso2019-05-2468-2/+5168
| | | | This reverts commit d03bcb669c0c645190df9bd166f53380bcac7862.
* tests: py: remove single-value-anon-set test casesFlorian Westphal2019-05-1968-5168/+2
| | | | | | | | future change will rewrite all single-element anon sets to a cmp op. Retain a few test cases to later check that the rewrite is correct, but remove all others. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: avoid single-value anon setsFlorian Westphal2019-05-1913-20/+20
| | | | | | | Future change is going to auto-change them to simple compare ops rather than lookup in set with only one element. Signed-off-by: Florian Westphal <fw@strlen.de>
* Revert "proto: support for draft-ietf-tsvwg-le-phb-10.txt"Pablo Neira Ayuso2019-05-0911-14/+11
| | | | | | | | This reverts commit 55715486efba424e97361c81d8d47e854f45a5a6. This breaks tests/py. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Fix JSON expected output for icmpv6 code valuesPhil Sutter2019-05-091-0/+59
| | | | | | | | | | Reverse translation is happening for values which are known, even if they are part of a range. In contrast to standard output, this is OK because in JSON lower and upper bounds are properties and there is no ambiguity if names contain a dash. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>