summaryrefslogtreecommitdiffstats
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
...
* tests: add one more chain jump in vmap testFlorian Westphal2023-08-151-0/+5
| | | | | | | | | | | This triggers a splat on kernels that lack 314c82841602 ("netfilter: nf_tables: can't schedule in nft_chain_validate"). There is another test case that triggers this splat (optimize/ruleset), but that test uses some more advanced features that don't exist on older kernels, so the splat is never seen. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add transaction stress test with parallel delete/add/flush and netns ↵Florian Westphal2023-08-151-0/+225
| | | | | | | | | | deletion Based on nft_trans_stress.sh from kernel selftests, changed to run from run-tests.sh, plus additional ideas from Pablo Neira, such as del+readd of the netns. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add test with concatenation, vmap and timeoutFlorian Westphal2023-08-132-0/+62
| | | | | | | | | Add 4k elements to map, with timeouts in range 1..3s, also add a catchall element with timeout. Check that all elements are no longer included in set list after 4s. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add test case for double-deactivationFlorian Westphal2023-08-122-0/+15
| | | | | Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Review test-cases for destroy commandPhil Sutter2023-08-0315-65/+32
| | | | | | | | | | | | | | Having separate files for successful destroy of existing and non-existing objects is a bit too much, just combine them into one. While being at it: * No bashisms, using /bin/sh is fine * Append '-e' to shebang itself instead of calling 'set' * Use 'nft -a -e' instead of assuming the created rule's handle value * Shellcheck warned about curly braces, quote them Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser: allow ct timeouts to use time_spec valuesFlorian Westphal2023-08-032-2/+2
| | | | | | | | | | | | | | | For some reason the parser only allows raw numbers (seconds) for ct timeouts, e.g. ct timeout ttcp { protocol tcp; policy = { syn_sent : 3, ... Also permit time_spec, e.g. "established : 5d". Print the nicer time formats on output, but retain raw numbers support on input for compatibility. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add dynmap datapath add/delete test caseFlorian Westphal2023-08-032-0/+57
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: fix inet nat prio testsFlorian Westphal2023-08-022-2/+2
| | | | | | | | | Its legal to DNAT in output and SNAT in input chain, so don't test for that being illegal. Fixes: 8beafab74c39 ("rule: allow src/dstnat prios in input and output") Fixes: 34ce4e4a7bb6 ("test: shell: Test cases for standard chain prios") Signed-off-by: Florian Westphal <fw@strlen.de>
* libnftables: Drop cache in -c/--check modePablo Neira Ayuso2023-08-012-0/+22
| | | | | | | | | | | | | | | | | | | | | Extend e0aace943412 ("libnftables: Drop cache in error case") to also drop the cache with -c/--check, this is a dry run mode and kernel does not get any update. This fixes a bug with -o/--optimize, which first runs in an implicit -c/--check mode to validate that the ruleset is correct, then it provides the proposed optimization. In this case, if the cache is not emptied, old objects in the cache refer to scanner data that was already released, which triggers BUG like this: BUG: invalid input descriptor type 151665524 nft: erec.c:161: erec_print: Assertion `0' failed. Aborted This bug was triggered in a ruleset that contains a set for geoip filtering. This patch also extends tests/shell to cover this case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: extend implicit chain map with flush commandPablo Neira Ayuso2023-07-211-0/+1
| | | | | | Add a rule flush command. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: auto-run kmemleak if its availableFlorian Westphal2023-07-201-1/+55
| | | | | | | | | | | | | | On my test vm a full scan takes almost 5s. As this would slowdown the test runs too much, only run them every couple of tests. This allows to detect when there is a leak reported at the end of the script, and it allows to narrow down the test case/group that triggers the issue. Add new -K flag to force kmemleak runs after each test if its available, this can then be used to find the exact test case. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: monitor: Summarize failures per test casePhil Sutter2023-07-201-1/+8
| | | | | | | Explicitly print when tests from a file fail in addition to the diff + "output differs" message. Signed-off-by: Phil Sutter <phil@nwl.cc>
* meta: stash context statement length when generating payload/meta dependencyPablo Neira Ayuso2023-07-193-0/+131
| | | | | | | | | | | | | | | | | | | | | | | | ... meta mark set ip dscp generates an implicit dependency from the inet family to match on meta nfproto ip. The length of this implicit expression is incorrectly adjusted to the statement length, ie. relational to compare meta nfproto takes 4 bytes instead of 1 byte. The evaluation of 'ip dscp' under the meta mark statement triggers this implicit dependency which should not consider the context statement length since it is added before the statement itself. This problem shows when listing the ruleset, since netlink_parse_cmp() where left->len < right->len, hence handling the implicit dependency as a concatenation, but it is actually a bug in the evaluation step that leads to incorrect bytecode. Fixes: 3c64ea7995cb ("evaluate: honor statement length in integer evaluation") Fixes: edecd58755a8 ("evaluate: support shifts larger than the width of the left operand") Tested-by: Brian Davidson <davidson.brian@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/build/run-tests.sh: fix issues reported by shellcheckArturo Borrero Gonzalez2023-07-171-15/+19
| | | | | | | | | | | Improve a bit the script as reported by shellcheck, also including information about the log file. The log file, by the way, is added to the gitignore to reduce noise in the git tree. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Implement 'reset {set,map,element}' commandsPhil Sutter2023-07-131-0/+82
| | | | | | | | | | | All these are used to reset state in set/map elements, i.e. reset the timeout or zero quota and counter values. While 'reset element' expects a (list of) elements to be specified which should be reset, 'reset set/map' will reset all elements in the given set/map. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: cover old scanner bugPablo Neira Ayuso2023-07-112-0/+1132
| | | | | | | | Add a test to cover 423abaa40ec4 ("scanner: don't rely on fseek for input stream repositioning") that fixes the bug described in https://bugs.gentoo.org/675188. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: place byteorder conversion before rshift in payload statementPablo Neira Ayuso2023-07-082-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For bitfield that spans more than one byte, such as ip6 dscp, byteorder conversion needs to be done before rshift. Add unary expression for this conversion only in the case of meta and ct statements. Before this patch: # nft --debug=netlink add rule ip6 x y 'meta mark set ip6 dscp' ip6 x y [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] [ byteorder reg 1 = ntoh(reg 1, 2, 2) ] <--------- incorrect [ meta set mark with reg 1 ] After this patch: # nft --debug=netlink add rule ip6 x y 'meta mark set ip6 dscp' ip6 x y [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] [ byteorder reg 1 = ntoh(reg 1, 2, 2) ] <-------- correct [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] [ meta set mark with reg 1 ] For the matching case, binary transfer already deals with the rshift to adjust left and right hand side of the expression, the unary conversion is not needed in such case. Fixes: 8221d86e616b ("tests: py: add test-cases for ct and packet mark payload expressions") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: use div_round_up in byteorder lengthPablo Neira Ayuso2023-07-062-7/+7
| | | | | | | | | Use div_round_up() to calculate the byteorder length, otherwise fields that take % BITS_PER_BYTE != 0 are not considered by the byteorder expression. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Introduce valgrind modePhil Sutter2023-07-041-0/+47
| | | | | | | | Pass flag '-V' to run-tests.sh to run all 'nft' invocations in valgrind leak checking environment. Code copied from iptables' shell-testsuite where it proved to be useful already. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: refcount memleak in map rhs with timeoutsPablo Neira Ayuso2023-07-041-0/+48
| | | | | | Extend coverage for refcount leaks on map element expiration. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: define .clone for catchall set elementPablo Neira Ayuso2023-06-301-0/+21
| | | | | | | Otherwise reuse of catchall set element expression in variable triggers a null-pointer dereference. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Document JSON mode in READMEPhil Sutter2023-06-271-0/+31
| | | | | | | Mostly identify the various files that (may) appear or exist already and how to deal with them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: cover refcount leak of mapping rhsPablo Neira Ayuso2023-06-271-0/+38
| | | | | | | | Add a test to cover reference count leak in maps by adding twice same element, then flush. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: coverage for simple port knocking rulesetPablo Neira Ayuso2023-06-262-0/+59
| | | | | | Add a test to cover port knocking simple ruleset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: json: add missing/expected json outputFlorian Westphal2023-06-241-0/+14
| | | | | | | | | | | | | | nft-test.py generates following warning: any/last.t: WARNING: line 12: '{"nftables": [{"add": {"rule": {"family": "ip", "table": "test-ip4", "chain": "input", "expr": [{"last": {"used": 300000}}]}}}]}': '[{"last": {"used": 300000}}]' mismatches '[{"last": null}]' This is because "last" expression is stateful; but nft-test.py explicitly asks for stateless output. Thus we need to provide a json.output file, without it, nft-test.py uses last.json as the expected output file. Fixes: ae8786756b0c ("src: add json support for last statement") Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: reject zero-length interface names in flowtablesFlorian Westphal2023-06-201-0/+5
| | | | | | Previous patch wasn't enough, also disable this for flowtable device lists. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: reject zero-length interface namesFlorian Westphal2023-06-201-0/+5
| | | | | | | | | | | device "" results in an assertion during evaluation. Before: nft: expression.c:426: constant_expr_alloc: Assertion `(((len) + (8) - 1) / (8)) > 0' failed. After: zero_length_devicename_assert:3:42-49: Error: you cannot set an empty interface name type filter hook ingress device""lo" priority -1 ^^^^^^^^ Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: don't assert on scope underflowsFlorian Westphal2023-06-201-0/+6
| | | | | | | | | | | | | | | close_scope() gets called from the object destructors; imbalance can cause us to hit assert(). Before: nft: parser_bison.y:88: close_scope: Assertion `state->scope > 0' failed. After: assertion3:4:7-7: Error: too many levels of nesting jump { assertion3:5:8-8: Error: too many levels of nesting jump assertion3:5:9-9: Error: syntax error, unexpected newline, expecting '{' assertion3:7:1-1: Error: syntax error, unexpected end of file Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: do not abort when prefix map has non-map elementFlorian Westphal2023-06-202-0/+19
| | | | | | | | | | | Before: nft: evaluate.c:1849: __mapping_expr_expand: Assertion `i->etype == EXPR_MAPPING' failed. after: Error: expected mapping, not set element snat ip prefix to ip saddr map { 10.141.11.0/24 : 192.168.2.0/24, 10.141.12.1 } Signed-off-by: Florian Westphal <fw@strlen.de>
* json: add inner payload supportPablo Neira Ayuso2023-06-204-0/+1060
| | | | | | Add support for vxlan, geneve, gre and gretap. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add json support for last statementPablo Neira Ayuso2023-06-201-0/+16
| | | | | | | | | | This patch adds json support for the last statement, it works for me here. However, tests/py still displays a warning: any/last.t: WARNING: line 12: '{"nftables": [{"add": {"rule": {"family": "ip", "table": "test-ip4", "chain": "input", "expr": [{"last": {"used": 300000}}]}}}]}': '[{"last": {"used": 300000}}]' mismatches '[{"last": null}]' Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: bogus EBUSY errors in transactionsPablo Neira Ayuso2023-06-191-0/+121
| | | | | | | | | | | | | | | Make sure reference tracking during transaction update is correct by checking for bogus EBUSY error. For example, when deleting map with chain reference X, followed by a delete chain X command. This test is covering the following paths: - prepare + abort (via -c/--check option) - prepare + commit - release (when netns is destroyed) Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add test case for chain-in-use-splatFlorian Westphal2023-06-161-0/+19
| | | | | | | | | | | | | | | | | | | WARNING [.]: at net/netfilter/nf_tables_api.c:1885 6.3.4-201.fc38.x86_64 #1 nft_immediate_destroy+0xc1/0xd0 [nf_tables] __nf_tables_abort+0x4b9/0xb20 [nf_tables] nf_tables_abort+0x39/0x50 [nf_tables] nfnetlink_rcv_batch+0x47c/0x8e0 [nfnetlink] nfnetlink_rcv+0x179/0x1a0 [nfnetlink] netlink_unicast+0x19e/0x290 This is because of chain->use underflow, at time destroy function is called, ->use has wrapped back to -1. Fixed via "netfilter: nf_tables: fix chain binding transaction logic". Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: fix spurious errors in terse listing in jsonPablo Neira Ayuso2023-06-111-1/+1
| | | | | | | Sometimes table handle becomes 192, which makes this test fail. Check for 192.168 instead to make sure terse listing works fine instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: add boolean DCCP option matchingJeremy Sowden2023-06-013-0/+63
| | | | | | | | | | Iptables supports the matching of DCCP packets based on the presence or absence of DCCP options. Extend exthdr expressions to add this functionality to nftables. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=930 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: extend tests for destroy commandFernando Fernandez Mancera2023-06-0118-0/+74
| | | | | | | | | Extend tests to cover destroy command for chains, flowtables, sets, maps. In addition rename a destroy command test for rules with a duplicated number. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: permit use of constant values in set lookup keysFlorian Westphal2023-05-242-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Something like: Given: set s { type ipv4_addr . ipv4_addr . inet_service .. } something like add rule ip saddr . 1.2.3.4 . 80 @s goto c1 fails with: "Error: Can't parse symbolic invalid expressions". This fails because the relational expression first evaluates the left hand side, so when concat evaluation sees '1.2.3.4' no key context is available. Check if the RHS is a set reference, and, if so, evaluate the right hand side. This sets a pointer to the set key in the evaluation context structure which then makes the concat evaluation step parse 1.2.3.4 and 80 as ipv4 address and 16bit port number. On delinearization, extend relop postprocessing to copy the datatype from the rhs (set reference, has proper datatype according to set->key) to the lhs (concat expression). Signed-off-by: Florian Westphal <fw@strlen.de>
* optimize: do not remove counter in verdict mapsPablo Neira Ayuso2023-05-102-0/+8
| | | | | | | | | | | | | Add counter to set element instead of dropping it: # nft -c -o -f test.nft Merging: test.nft:6:3-50: ip saddr 1.1.1.1 ip daddr 2.2.2.2 counter accept test.nft:7:3-48: ip saddr 1.1.1.2 ip daddr 3.3.3.3 counter drop into: ip daddr . ip saddr vmap { 2.2.2.2 . 1.1.1.1 counter : accept, 3.3.3.3 . 1.1.1.2 counter : drop } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: skip optimization if anonymous set uses stateful statementPablo Neira Ayuso2023-05-102-0/+4
| | | | | | | | fee6bda06403 ("evaluate: remove anon sets with exactly one element") introduces an optimization to remove use of sets with single element. Skip this optimization if set element contains stateful statements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: allow stateful statements with anonymous verdict mapsPablo Neira Ayuso2023-05-102-2/+2
| | | | | | | | | | | | | | Evaluation fails to accept stateful statements in verdict maps, relax the following check for anonymous sets: test.nft:4:29-35: Error: missing statement in map declaration ip saddr vmap { 127.0.0.1 counter : drop, * counter : accept } ^^^^^^^ The existing code generates correctly the counter in the anonymous verdict map. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: restore typeof interval map data typeFlorian Westphal2023-05-021-2/+2
| | | | | | | | | | | | | When "typeof ... : interval ..." gets used, existing logic failed to validate the expressions. "interval" means that kernel reserves twice the size, so consider this when validating and restoring. Also fix up the dump file of the existing test case to be symmetrical. Signed-off-by: Florian Westphal <fw@strlen.de>
* meta: introduce meta broute supportSriram Yagnaraman2023-04-294-0/+23
| | | | | | | | | | | Can be used in bridge prerouting hook to divert a packet to the ip stack for routing. This is a replacement for "ebtables -t broute" functionality. Link: https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230224095251.11249-1-sriram.yagnaraman@est.tech/ Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: missing json updates on ct and meta mark payload expressionPablo Neira Ayuso2023-04-251-0/+59
| | | | | | | Add json output, it is missing in the original tests/py update. Fixes: 8221d86e616b ("tests: py: add test-cases for ct and packet mark payload expressions") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: handle singleton element in netdevice setPablo Neira Ayuso2023-04-252-0/+8
| | | | | | | | expr_evaluate_set() turns sets with singleton element into value, nft_dev_add() expects a list of expression, so it crashes. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1676 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: bail out if new flowtable does not specify hook and priorityPablo Neira Ayuso2023-04-241-0/+2
| | | | | | | | | | | | | | | | | | | | If user forgets to specify the hook and priority and the flowtable does not exist, then bail out: # cat flowtable-incomplete.nft table t { flowtable f { devices = { lo } } } # nft -f /tmp/k flowtable-incomplete.nft:2:12-12: Error: missing hook and priority in flowtable declaration flowtable f { ^ Update one existing tests/shell to specify a hook and priority. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow for updating devices on existing netdev chainPablo Neira Ayuso2023-04-242-0/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows you to add/remove devices to an existing chain: # cat ruleset.nft table netdev x { chain y { type filter hook ingress devices = { eth0 } priority 0; policy accept; } } # nft -f ruleset.nft # nft add chain netdev x y '{ devices = { eth1 }; }' # nft list ruleset table netdev x { chain y { type filter hook ingress devices = { eth0, eth1 } priority 0; policy accept; } } # nft delete chain netdev x y '{ devices = { eth0 }; }' # nft list ruleset table netdev x { chain y { type filter hook ingress devices = { eth1 } priority 0; policy accept; } } This feature allows for creating an empty netdev chain, with no devices. In such case, no packets are seen until a device is registered. This patch includes extended netlink error reporting: # nft add chain netdev x y '{ devices = { x } ; }' Error: Could not process rule: No such file or directory add chain netdev x y { devices = { x } ; } ^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Fix for unstable sets/0043concatenated_ranges_0Phil Sutter2023-04-201-2/+2
| | | | | | | | | | | | | | On my (slow?) testing VM, The test tends to fail when doing a full run (i.e., calling run-test.sh without arguments) and tends to pass when run individually. The problem seems to be the 1s element timeout which in some cases may pass before element deletion occurs. Simply fix this by doubling the timeout. It has to pass just once, so shouldn't hurt too much. Fixes: 618393c6b3f25 ("tests: Introduce test for set with concatenated ranges") Reviewed-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* optimize: support for redirect and masqueradePablo Neira Ayuso2023-04-052-0/+11
| | | | | | | | | | | | | | The redirect and masquerade statements can be handled as verdicts: - if redirect statement specifies no ports. - masquerade statement, in any case. Exceptions to the rule: If redirect statement specifies ports, then nat map transformation can be used iif both statements specify ports. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1668 Fixes: 0a6dbfce6dc3 ("optimize: merge nat rules with same selectors into map") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: do not reset protocol context for nat protocol expressionPablo Neira Ayuso2023-04-056-32/+8
| | | | | | | | This patch reverts 403b46ada490 ("netlink_delinearize: kill dependency before eval of 'redirect' stmt"). Since ("evaluate: bogus missing transport protocol"), this workaround is not required anymore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: extend test-cases for mark statements with bitwise expressionsPablo Neira Ayuso2023-03-286-0/+234
| | | | | | | | | | Add more tests to cover bitwise operation. Shift operations are used on constant value which are reduced at evaluation time. Shift takes precendence over AND and OR operations, otherwise use parens to override this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>