summaryrefslogtreecommitdiffstats
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
* optimize: clone counter before insertion into set elementPablo Neira Ayuso2024-07-052-0/+28
| | | | | | | | The counter statement that is zapped from the rule needs to be cloned before inserting it into each set element. Fixes: 686ab8b6996e ("optimize: do not remove counter in verdict maps") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: cover set element deletion in mapsPablo Neira Ayuso2024-07-054-0/+87
| | | | | | | Extend existing coverage to deal with set element deletion, including catchall elements too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: check for removing table via handle with incorrect familyPablo Neira Ayuso2024-06-271-0/+9
| | | | | | | | This test checks for upstream commit: f6e1532a2697 ("netfilter: nf_tables: validate family when identifying table via handle") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: drop redundant JSON outputsPablo Neira Ayuso2024-06-252-86/+0
| | | | | | | | | | | 8abe71f862e6 ("tests: py: Warn if recorded JSON output matches the input") adds a warning on duplicated JSON outputs. Remove them when running tests with -j: WARNING: Recorded JSON output matches input for: icmp code { 2, 4, 54, 33, 56} Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add test case for reset tcp warningFlorian Westphal2024-06-253-0/+212
| | | | | | | | | | | | | | | | | | | | tcp reset rule + nftrace 1 triggers (harmless) splat from flow dissector: WARNING: CPU: 2 PID: 145809 at net/core/flow_dissector.c:1104 __skb_flow_dissect+0x19d4/0x5cc0 __skb_get_hash+0xa8/0x220 nft_trace_init+0x2ff/0x3b0 nft_do_chain+0xb04/0x1370 nft_do_chain_inet+0xc5/0x2e0 nf_hook_slow+0xa0/0x1d0 ip_local_out+0x14/0x90 nf_send_reset+0x94e/0xbd0 nft_reject_inet_eval+0x45e/0x690 nft_do_chain+0x220/0x1370 nf_hook_slow+0xa0/0x1d0 ip_local_deliver+0x23f/0x2d0 Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* dynset: avoid errouneous assert with ipv6 concat dataSon Dinh2024-06-1611-0/+141
| | | | | | | | | | | | | | | | | | nft add rule ip6 table-test chain-1 update @map-X { ip6 saddr : 1000::1 . 5001 } nft: src/netlink_linearize.c:873: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. Aborted (core dumped) This is because we pass the EXPR_SET_ELEM expr to the register allocation, which will make it reserve 1 128 bit register / 16 bytes. This happens to be enough for most cases, but its not for ipv6 concat data. Pass the actual key and data instead: This will reserve enough space to hold a possible concat expression. Also add test cases. Signed-off-by: Son Dinh <dinhtrason@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: do not crash if to-be-printed flowtable lacks priorityFlorian Westphal2024-06-161-0/+6
| | | | | | | Print an empty flowtable rather than crashing when dereferencing flowtable->priority.expr (its NULL). Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: use common shebang in "packetpath/flowtables" testThomas Haller2024-06-161-1/+3
| | | | | | | | | | | | | | | | | | | | | | "./tools/check-tree.sh" checks for a certain shebang. Either `/bin/bash` or `/bin/bash -e`. No other are currently allowed, because it makes sense to be strict/consistent and there is no need such flexibility. Move the "-x" to a later command. Note that "set -x" may not be a good choice anyway. If you want to debug a test and see the shell commands, you could just run $ ./tests/shell/run-tests.sh tests/shell/testcases/packetpath/flowtables -x That will automatically use `/bin/bash -x` as interpreter. And that works for all tests the same. This is also the reason why "check-tree.sh" checks for a well-known shebang. Because the "-x" option of the test runner mangles the shebang, but for that it needs to understand it. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: skip NFTA_RULE_POSITION_ID tests if kernel does not support itPablo Neira Ayuso2024-06-133-0/+27
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip ipsec tests if kernel does not support itPablo Neira Ayuso2024-06-132-0/+9
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip ip option tests if kernel does not support itPablo Neira Ayuso2024-06-132-0/+10
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add dependencies to skip unsupported tests in older kernelsPablo Neira Ayuso2024-06-135-0/+14
| | | | | | Update tests which contain unsupported features in older kernels. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: skip variable set elements when collapsing commandsPablo Neira Ayuso2024-06-113-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | ASAN reports an issue when collapsing commands that represent an element through a variable: include/list.h:60:13: runtime error: member access within null pointer of type 'struct list_head' AddressSanitizer:DEADLYSIGNAL ================================================================= ==11398==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7ffb77cf09c2 bp 0x7ffc818267c0 sp 0x7ffc818267a0 T0) ==11398==The signal is caused by a WRITE memory access. ==11398==Hint: address points to the zero page. #0 0x7ffb77cf09c2 in __list_add include/list.h:60 #1 0x7ffb77cf0ad9 in list_add_tail include/list.h:87 #2 0x7ffb77cf0e72 in list_move_tail include/list.h:169 #3 0x7ffb77cf86ad in nft_cmd_collapse src/cmd.c:478 #4 0x7ffb77da9f16 in nft_evaluate src/libnftables.c:531 #5 0x7ffb77dac471 in __nft_run_cmd_from_filename src/libnftables.c:720 #6 0x7ffb77dad703 in nft_run_cmd_from_filename src/libnftables.c:807 Skip such commands to address this issue. This patch also extends tests/shell to cover for this bug. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1754 Fixes: 498a5f0c219d ("rule: collapse set element commands") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add vlan mangling test casePablo Neira Ayuso2024-06-031-0/+75
| | | | | | | | As a follow up for: 74cf3d16d8e9 ("tests: shell: add vlan match test case") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add vlan double tagging match simple test casePablo Neira Ayuso2024-06-031-0/+73
| | | | | | | | | | As a follow up for: 74cf3d16d8e9 ("tests: shell: add vlan match test case") Add basic test for q-in-q matching support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add support for variables in map expressionsJeremy Sowden2024-05-208-0/+326
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is possible to use a variable to initialize a map, which is then used in a map statement: define dst_map = { ::1234 : 5678 } table ip6 nat { map dst_map { typeof ip6 daddr : tcp dport; elements = $dst_map } chain prerouting { ip6 nexthdr tcp redirect to ip6 daddr map @dst_map } } However, if one tries to use the variable directly in the statement: define dst_map = { ::1234 : 5678 } table ip6 nat { chain prerouting { ip6 nexthdr tcp redirect to ip6 daddr map $dst_map } } nft rejects it: /space/azazel/tmp/ruleset.1067161.nft:5:47-54: Error: invalid mapping expression variable ip6 nexthdr tcp redirect to ip6 daddr map $dst_map ~~~~~~~~~ ^^^^^^^^ It also rejects variables in stateful object statements: define quota_map = { 192.168.10.123 : "user123", 192.168.10.124 : "user124" } table ip nat { quota user123 { over 20 mbytes } quota user124 { over 20 mbytes } chain prerouting { quota name ip saddr map $quota_map } } thus: /space/azazel/tmp/ruleset.1067161.nft:15:29-38: Error: invalid mapping expression variable quota name ip saddr map $quota_map ~~~~~~~~ ^^^^^^^^^^ Add support for these uses together with some test-cases. Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067161 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: combine dormant flag with netdevice removalPablo Neira Ayuso2024-04-251-0/+9
| | | | | | Exercise table is dormant and netdevice is gone combination. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: packetpath: add check for drop policyFlorian Westphal2024-04-253-0/+174
| | | | | | | check that policy can be changed from accept to drop and that the kernel acts on this. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Fix for maps/typeof_maps_add_delete with ASANPhil Sutter2024-04-243-4/+4
| | | | | | | | With both KASAN and ASAN enabled, my VM is too slow so the ping-induced set entry times out before the test checks its existence. Increase its timeout to 2s, seems to do the trick. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Add support for table's persist flagPhil Sutter2024-04-192-0/+39
| | | | | | | | | Bison parser lacked support for passing multiple flags, JSON parser did not support table flags at all. Document also 'owner' flag (and describe their relationship in nft.8. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Avoid escape chars when printing to non-terminalsPhil Sutter2024-04-121-2/+2
| | | | | | | | Print the 'EXECUTING' status line only if stdout is a terminal, the mandatory following escape sequence to delete it messes up log file contents. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: Drop needless recorded JSON outputsPhil Sutter2024-04-125-512/+0
| | | | | | These match the input already, no need to track them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: Warn if recorded JSON output matches the inputPhil Sutter2024-04-121-0/+2
| | | | | | Actively support spring-cleaning by nagging callers. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: Fix some JSON equivalentsPhil Sutter2024-04-123-55/+75
| | | | | | | | | | | | Make sure they match the standard syntax input as much as possible. For some reason inet/tcp.t.json was using plain arrays in place of binary OR expressions in many cases. These arrays are interpreted as list expressions, which seems to be semantically identical but the goal here is to present an accurate equivalent to the rule in standard syntax. Signed-off-by: Phil Sutter <phil@nwl.cc>
* mergesort: Avoid accidental set element reorderingPhil Sutter2024-04-122-20/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In corner cases, expr_msort_cmp() may return 0 for two non-identical elements. An example are ORed tcp flags: 'syn' and 'syn | ack' are considered the same value since expr_msort_value() reduces the latter to its LHS. Keeping the above in mind and looking at how list_expr_sort() works: The list in 'head' is cut in half, the first half put into the temporary list 'list' and finally 'list' is merged back into 'head' considering each element's position. Shall expr_msort_cmp() return 0 for two elements, the one from 'list' ends up after the one in 'head', thus reverting their previous ordering. The practical implication is that output never matches input for the sample set '{ syn, syn | ack }' as the sorting after delinearization in netlink_list_setelems() keeps swapping the elements. Out of coincidence, the commit this fixes itself illustrates the use-case this breaks, namely tracking a ruleset in git: Each ruleset reload will trigger an update to the stored dump. This change breaks interval set element deletion because __set_delete() implicitly relies upon this reordering of duplicate entries by inserting a clone of the one to delete into the start (via list_move()) and after sorting assumes the clone will end up right behind the original. Fix this by calling list_move_tail() instead. Fixes: 14ee0a979b622 ("src: sort set elements in netlink_get_setelems()") Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Accept more than two operands in binary expressionsPhil Sutter2024-04-124-224/+53
| | | | | | | | | | | | | | The most common use case is ORing flags like | syn | ack | rst but nft seems to be fine with less intuitive stuff like | meta mark set ip dscp << 2 << 3 so support all of them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: check for reset tcp options supportPablo Neira Ayuso2024-04-082-0/+7
| | | | | Fixes: 59a33d08ab3a ("parser: tcpopt: fix tcp option parsing with NUM + length field") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: maps/{vmap_unary,named_limits} require pipapo set backendPablo Neira Ayuso2024-04-084-0/+8
| | | | | | ... sets/typeof_sets_concat needs it too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: chains/{netdev_netns_gone,netdev_chain_dev_gone} require ↵Pablo Neira Ayuso2024-04-082-0/+4
| | | | | | | inet/ingress support Fixes: 6847a7ce0fc9 ("tests: shell: cover netns removal for netdev and inet/ingress basechains") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: payload matching requires egress supportPablo Neira Ayuso2024-04-081-0/+2
| | | | | | | Older kernels do not support for egress hook. Fixes: 84da729e067a ("tests: shell: add test to cover payload transport match and mangle") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: complete icmp and icmpv6 updatePablo Neira Ayuso2024-04-045-14/+14
| | | | | | | Update json update and leftover payload update to complete 5fecd2a6ef61 ("src: disentangle ICMP code types"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: disentangle ICMP code typesPablo Neira Ayuso2024-04-042-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, ICMP{v4,v6,inet} code datatypes only describe those that are supported by the reject statement, but they can also be used for icmp code matching. Moreover, ICMP code types go hand-to-hand with ICMP types, that is, ICMP code symbols depend on the ICMP type. Thus, the output of: nft describe icmp_code look confusing because that only displays the values that are supported by the reject statement. Disentangle this by adding internal datatypes for the reject statement to handle the ICMP code symbol conversion to value as well as ruleset listing. The existing icmp_code, icmpv6_code and icmpx_code remain in place. For backward compatibility, a parser function is defined in case an existing ruleset relies on these symbols. As for the manpage, move existing ICMP code tables from the DATA TYPES section to the REJECT STATEMENT section, where this really belongs to. But the icmp_code and icmpv6_code table stubs remain in the DATA TYPES section because that describe that this is an 8-bit integer field. After this patch: # nft describe icmp_code datatype icmp_code (icmp code) (basetype integer), 8 bits # nft describe icmpv6_code datatype icmpv6_code (icmpv6 code) (basetype integer), 8 bits # nft describe icmpx_code datatype icmpx_code (icmpx code) (basetype integer), 8 bits do not display the symbol table of the reject statement anymore. icmpx_code_type is not used anymore, but keep it in place for backward compatibility reasons. And update tests/shell accordingly. Fixes: 5fdd0b6a0600 ("nft: complete reject support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: unused code in reverse cross-day meta hour rangePablo Neira Ayuso2024-04-021-0/+8
| | | | | | | | | | | | | | | | | | | | | f8f32deda31d ("meta: Introduce new conditions 'time', 'day' and 'hour'") reverses a cross-day range expressed as "22:00"-"02:00" UTC time into != "02:00"-"22:00" so meta hour ranges works. Listing is however confusing, hence, 44d144cd593e ("netlink_delinearize: reverse cross-day meta hour range") introduces code to reverse a cross-day. However, it also adds code to reverse a range in == to-from form (assuming OP_IMPLICIT) which is never exercised from the listing path because the range expression is not currently used, instead two instructions (cmp gte and cmp lte) are used to represent the range. Remove this branch otherwise a reversed notation will be used to display meta hour ranges once the range instruction is to represent this. Add test for cross-day scenario in EADT timezone. Fixes: 44d144cd593e ("netlink_delinearize: reverse cross-day meta hour range") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: packetpath/flowtables: open all temporary files in /tmpJeremy Sowden2024-04-021-1/+1
| | | | | | | | | | The test used to do I/O over a named pipe in $PWD, until Phil changed it to create the pipe in /tmp. However, he missed one `socat` command. Update that too. Fixes: 3a9f29e21726 ("tests: shell: packetpath/flowtables: Avoid spurious EPERM") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: meta_time: fix dump validation failureFlorian Westphal2024-04-022-32/+0
| | | | | | | | | | | | [DUMP FAIL] 1/1 tests/shell/testcases/listing/meta_time This dump file validates only correctly for TZ=UTC-1 (i.e., CET). Time dumps cannot be validated in a portable way, the dump depends on TZ. As the test already does dump valiation with different TZ values, remove the dump file again. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add regression test for double-free crash bugFlorian Westphal2024-04-023-0/+83
| | | | | | | | | | | | | | | | BUG: KASAN: slab-use-after-free in nf_tables_set_elem_destroy+0x55/0x160 Call Trace: nf_tables_set_elem_destroy+0x55/0x160 nf_tables_set_elem_destroy+0x55/0x160 nft_pipapo_destroy+0x3b4/0x5a0 nft_set_destroy+0x118/0x3a0 nf_tables_trans_destroy_work+0x4f2/0xa80 This is a test case for the bug fiex with kernel commit b0e256f3dd2b ("netfilter: nft_set_pipapo: release elements in clone only from destroy path"). Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* datatype: use DTYPE_F_PREFIX only for IP address datatypePablo Neira Ayuso2024-03-212-10/+10
| | | | | | | | | | | | | | | | | DTYPE_F_PREFIX flag provides a hint to the netlink delinearize path to use prefix notation. It seems use of prefix notation in meta mark causes confusion, users expect to see prefix in the listing only in IP address datatypes. Untoggle this flag so (more lengthy) binop output such as: meta mark & 0xffffff00 == 0xffffff00 is used instead. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1739 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: reverse cross-day meta hour rangePablo Neira Ayuso2024-03-203-0/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | f8f32deda31d ("meta: Introduce new conditions 'time', 'day' and 'hour'") reverses the hour range in case that a cross-day range is used, eg. meta hour "03:00"-"14:00" counter accept which results in (Sidney, Australia AEDT time): meta hour != "14:00"-"03:00" counter accept kernel handles time in UTC, therefore, cross-day range may not be obvious according to local time. The ruleset listing above is not very intuitive to the reader depending on their timezone, therefore, complete netlink delinearize path to reverse the cross-day meta range. Update manpage to recommend to use a range expression when matching meta hour range. Recommend range expression for meta time and meta day too. Extend testcases/listing/meta_time to cover for this scenario. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1737 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: restore binop syntax when listing ruleset for flagsPablo Neira Ayuso2024-03-206-36/+327
| | | | | | | | | | | c3d57114f119 ("parser_bison: add shortcut syntax for matching flags without binary operations") provides a similar syntax to iptables using a prefix representation for flag matching. Restore original representation using binop when listing the ruleset. The parser still accepts the prefix notation for backward compatibility. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: do not merge a set with a erroneous oneFlorian Westphal2024-03-201-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The included sample causes a crash because we attempt to range-merge a prefix expression with a symbolic expression. The first set is evaluated, the symbol expression evaluation fails and nft queues an error message ("Could not resolve hostname"). However, nft continues evaluation. nft then encounters the same set definition again and merges the new content with the preceeding one. But the first set structure is dodgy, it still contains the unresolved symbolic expression. That then makes nft crash (assert) in the set internals. There are various different incarnations of this issue, but the low level set processing code does not allow for any partially transformed expressions to still remain. Before: nft --check -f tests/shell/testcases/bogons/nft-f/invalid_range_expr_type_binop BUG: invalid range expression type binop nft: src/expression.c:1479: range_expr_value_low: Assertion `0' failed. After: nft --check -f tests/shell/testcases/bogons/nft-f/invalid_range_expr_type_binop invalid_range_expr_type_binop:4:18-25: Error: Could not resolve hostname: Name or service not known elements = { 1&.141.0.1 - 192.168.0.2} ^^^^^^^^ Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Fix one json-nft dump for reordered outputPhil Sutter2024-03-201-16/+16
| | | | | | | Missed this one when regenerating all dumps. Fixes: 2a0fe52eca32a ("tests: shell: Regenerate all json-nft dumps") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Add missing json-nft dumpsPhil Sutter2024-03-1913-0/+1808
| | | | | | | | | Given that a bunch of issues got fixed, add some more dumps. Also add tests/shell/testcases/owner/dumps/0002-persist.nft while at it, even though it's really small. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Regenerate all json-nft dumpsPhil Sutter2024-03-1960-647/+647
| | | | | | | | Ordering of 'nft -j list ruleset' output has changed, Regenerate existing json-nft dumps. No functional change intended, merely the position of chain objects should have moved up in the "nftables" array. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: packetpath/flowtables: Avoid spurious EPERMPhil Sutter2024-03-191-3/+3
| | | | | | | | | On my system for testing, called socat is not allowed to create the pipe file in local directory (probably due to sshfs). Specify a likely unique path in /tmp to avoid such problems. Fixes: 419c0199774c6 ("tests: shell: add test to cover ct offload by using nft flowtables") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: move meter tests to tests/shellPablo Neira Ayuso2024-03-1310-182/+250
| | | | | | | | | Userspace performs an translation to dynamic set which does not fit well into tests/py, move them to tests/shell. Fixes: b8f8ddfff733 ("evaluate: translate meter into dynamic set") Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add payload merging test casesFlorian Westphal2024-03-133-0/+291
| | | | | | Add a test case that would fail without preceeding fix. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: translate meter into dynamic setPablo Neira Ayuso2024-03-126-24/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 129f9d153279 ("nft: migrate man page examples with `meter` directive to sets") already replaced meters by dynamic sets. This patch removes NFT_SET_ANONYMOUS flag from the implicit set that is instantiated via meter, so the listing shows a dynamic set instead which is the recommended approach these days. Therefore, a batch like this: add table t add chain t c add rule t c tcp dport 80 meter m size 128 { ip saddr timeout 1s limit rate 10/second } gets translated to a dynamic set: table ip t { set m { type ipv4_addr size 128 flags dynamic,timeout } chain c { tcp dport 80 update @m { ip saddr timeout 1s limit rate 10/second burst 5 packets } } } Check for NFT_SET_ANONYMOUS flag is also relaxed for list and flush meter commands: # nft list meter ip t m table ip t { set m { type ipv4_addr size 128 flags dynamic,timeout } } # nft flush meter ip t m As a side effect the legacy 'list meter' and 'flush meter' commands allow to flush a dynamic set to retain backward compatibility. This patch updates testcases/sets/0022type_selective_flush_0 and testcases/sets/0038meter_list_0 as well as the json output which now uses the dynamic set representation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add test case for named ct objectsFlorian Westphal2024-03-052-0/+165
| | | | | | | | | | Add a dedicated test for named conntrack objects: timeouts, helpers and expectations. A json dump file is not added because the json input code does not support "typeof" declarations for sets/maps. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: move test case to "maps" directoryFlorian Westphal2024-03-012-0/+0
| | | | | | | This tests named object maps, so this should reside in maps/ not sets/ directory. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: maps: add a test case for "limit" objref mapFlorian Westphal2024-03-013-0/+442
| | | | | | | | | check add, delete and removal operations for objref maps. Also check type vs. typeof declarations and use both interval and interval+concatenation (rbtree, pipapo). Signed-off-by: Florian Westphal <fw@strlen.de>
generated by cgit v1.2.3 (git 2.25.0) at 2025-08-03 08:48:40 +0000