This test-suite is intended to perform tests of higher level than
-the other reggresion test-suite.
+the other regression test-suite.
It can run arbitrary executables which can perform any test apart of testing
the nft syntax or netlink code (which is what the regression tests does).
You can turn on a verbose execution by calling:
% ./run-tests.sh -v
+And generate missing dump files with:
+ % ./run-tests.sh -g <TESTFILE>
+
Before each call to the test-files, `nft flush ruleset' will be called.
Also, test-files will receive the environment variable $NFT which contains the
path to the nftables binary being tested.
TESTDIR="./$(dirname $0)/"
RETURNCODE_SEPARATOR="_"
SRC_NFT="$(dirname $0)/../../src/nft"
+POSITIVE_RET=0
+DIFF=$(which diff)
msg_error() {
echo "E: $1 ..." >&2
msg_error "no modprobe binary found"
fi
+if [ "$1" == "-v" ] ; then
+ VERBOSE=y
+ shift
+fi
+
+if [ "$1" == "-g" ] ; then
+ DUMPGEN=y
+ shift
+fi
+
if [ -x "$1" ] ; then
if grep ^.*${RETURNCODE_SEPARATOR}[0-9]\\+$ <<< $1 >/dev/null ; then
SINGLE=$1
fi
fi
-if [ "$1" == "-v" ] ; then
- VERBOSE=y
-fi
-
kernel_cleanup() {
$NFT flush ruleset
$MODPROBE -raq \
echo -en "\033[1A\033[K" # clean the [EXECUTING] foobar line
if [ "$rc_got" == "$rc_spec" ] ; then
- msg_info "[OK] $testfile"
- [ "$VERBOSE" == "y" ] && [ ! -z "$test_output" ] && echo "$test_output"
- ((ok++))
+ # check nft dump only for positive tests
+ rc_spec="${POSITIVE_RET}"
+ dumppath="$(dirname ${testfile})/dumps"
+ dumpfile="${dumppath}/$(basename ${testfile}).nft"
+ if [ "$rc_got" == "${POSITIVE_RET}" ] && [ -f ${dumpfile} ]; then
+ test_output=$(${DIFF} ${dumpfile} <(nft list ruleset) 2>&1)
+ rc_spec=$?
+ fi
+
+ if [ "$rc_spec" == "${POSITIVE_RET}" ]; then
+ msg_info "[OK] $testfile"
+ [ "$VERBOSE" == "y" ] && [ ! -z "$test_output" ] && echo "$test_output"
+ ((ok++))
+
+ if [ "$DUMPGEN" == "y" ] && [ "$rc_got" == "${POSITIVE_RET}" ] && [ ! -f "${dumpfile}" ]; then
+ mkdir -p "${dumppath}"
+ nft list ruleset > "${dumpfile}"
+ fi
+ else
+ ((failed++))
+ if [ "$VERBOSE" == "y" ] ; then
+ msg_warn "[DUMP FAIL] $testfile: dump diff detected"
+ [ ! -z "$test_output" ] && echo "$test_output"
+ else
+ msg_warn "[DUMP FAIL] $testfile"
+ fi
+ fi
else
((failed++))
if [ "$VERBOSE" == "y" ] ; then
--- /dev/null
+table inet test {
+ set test {
+ type ipv4_addr
+ elements = { 1.1.1.1 }
+ }
+
+ chain test {
+ ip daddr { 2.2.2.2 } counter packets 0 bytes 0 accept
+ ip saddr @test counter packets 0 bytes 0 accept
+ ip daddr { 2.2.2.2 } counter packets 0 bytes 0 accept
+ }
+}
--- /dev/null
+table inet t {
+ set s {
+ type ipv4_addr
+ flags interval
+ elements = { 192.168.0.0/24 }
+ }
+}
$NFT add chain ip6 test-ip6 z # should have handle 3
$NFT delete chain test-ip handle 2
$NFT delete chain ip6 test-ip6 handle 3
-
-EXPECTED="table ip test-ip {
- chain x {
- }
-
- chain z {
- }
-}
-table ip6 test-ip6 {
- chain x {
- }
-
- chain y {
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
--- /dev/null
+table ip t {
+ chain c1 {
+ jump c2
+ }
+
+ chain c2 {
+ jump c3
+ }
+
+ chain c3 {
+ jump c4
+ }
+
+ chain c4 {
+ jump c5
+ }
+
+ chain c5 {
+ jump c6
+ }
+
+ chain c6 {
+ jump c7
+ }
+
+ chain c7 {
+ jump c8
+ }
+
+ chain c8 {
+ jump c9
+ }
+
+ chain c9 {
+ jump c10
+ }
+
+ chain c10 {
+ jump c11
+ }
+
+ chain c11 {
+ jump c12
+ }
+
+ chain c12 {
+ jump c13
+ }
+
+ chain c13 {
+ jump c14
+ }
+
+ chain c14 {
+ jump c15
+ }
+
+ chain c15 {
+ jump c16
+ }
+
+ chain c16 {
+ }
+}
--- /dev/null
+table ip t {
+ chain c1 {
+ type nat hook postrouting priority 0; policy accept;
+ masquerade
+ }
+}
--- /dev/null
+table ip t {
+ chain c2 {
+ }
+}
--- /dev/null
+table ip test-ip {
+ chain x {
+ }
+
+ chain y {
+ }
+
+ chain z {
+ }
+}
+table ip6 test-ip6 {
+ chain x {
+ }
+
+ chain y {
+ }
+
+ chain z {
+ }
+}
echo "$EXPECTED" > $tmpfile
set -e
$NFT -f $tmpfile
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
--- /dev/null
+table inet t {
+ flowtable f {
+ hook ingress priority 10
+ devices = { eth0, wlan0 }
+ }
+
+ chain c {
+ flow offload @f
+ }
+}
$NFT export vm json > $tmpfile
$NFT flush ruleset
cat $tmpfile | $NFT import vm json
-
-RESULT="$($NFT list ruleset)"
-
-
-if [ "$RULESET" != "$RESULT" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$RULESET") <(echo "$RESULT")
-fi
--- /dev/null
+table ip x {
+}
--- /dev/null
+table ip x {
+}
--- /dev/null
+table ip x {
+}
--- /dev/null
+table ip x {
+}
--- /dev/null
+table ip y {
+}
+table ip x {
+}
--- /dev/null
+table ip x {
+ chain y {
+ }
+}
--- /dev/null
+table ip x {
+}
--- /dev/null
+table ip x {
+ chain y {
+ }
+}
# list ruleset shows a table
-EXPECTED="table ip test {
-}"
-
set -e
$NFT add table test
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
-
EXPECTED=""
set -e
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
-
--- /dev/null
+table ip test {
+}
echo "add element x y { 10.${n}.${n}.0/24 : 10.0.${n}.${n} }" > $tmpfile
$NFT -f $tmpfile
-
-EXPECTED="table ip x {
- map y {
- type ipv4_addr : ipv4_addr
- flags interval
- elements = { "$(generate_test)" }
- }
-}"
-GET=$($NFT list ruleset)
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
-
$NFT -f $tmpfile
-EXPECTED="table ip x {
- map y {
- type ipv4_addr : ipv4_addr
- flags interval
- elements = { 10.0.1.0/24 : 10.0.0.1, 10.0.2.0/24 : 10.0.0.2 }
- }
-}"
-GET=$($NFT list ruleset)
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
-
echo "$EXPECTED" > $tmpfile
$NFT -f $tmpfile
-GET="$($NFT list ruleset)"
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
-
--- /dev/null
+table ip x {
+ map y {
+ type ipv4_addr : ipv4_addr
+ flags interval
+ elements = { 10.1.1.0/24 : 10.0.1.1, 10.1.2.0/24 : 10.0.1.2,
+ 10.2.1.0/24 : 10.0.2.1, 10.2.2.0/24 : 10.0.2.2 }
+ }
+}
--- /dev/null
+table ip x {
+ map y {
+ type ipv4_addr : ipv4_addr
+ flags interval
+ elements = { 10.0.1.0/24 : 10.0.0.1, 10.0.2.0/24 : 10.0.0.2 }
+ }
+}
--- /dev/null
+table inet t {
+ map m1 {
+ type ifname : ipv4_addr
+ elements = { "eth0" : 1.1.1.1 }
+ }
+
+ chain c {
+ ip daddr set iifname map @m1
+ ip daddr set oifname map @m1
+ }
+}
--- /dev/null
+table ip nat {
+ chain postrouting {
+ snat to ip saddr map { 1.1.1.1 : 2.2.2.2 }
+ }
+}
--- /dev/null
+table ip x {
+ map y {
+ type ipv4_addr : ipv4_addr
+ flags timeout
+ }
+}
--- /dev/null
+table ip nat {
+ map m {
+ type ipv4_addr : ipv4_addr
+ elements = { 1.1.1.1 : 2.2.2.2 }
+ }
+
+ chain postrouting {
+ snat to ip saddr map @m
+ }
+}
$NFT add table x
$NFT add map x y { type ipv4_addr : ipv4_addr\; flags timeout\; }
-
-EXPECTED="table ip x {
- map y {
- type ipv4_addr : ipv4_addr
- flags timeout
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: bogus ruleset loaded?" >&2
exit 1
fi
-
-KERNEL_RULESET="$($NFT list ruleset -nn)"
-
-if [ "$GOOD_RULESET" != "$KERNEL_RULESET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$GOOD_RULESET") <(echo "$KERNEL_RULESET")
- exit 1
-fi
-
-exit 0
echo "E: bogus ruleset loaded?" >&2
exit 1
fi
-
-KERNEL_RULESET="$($NFT list ruleset -nn)"
-
-if [ "$GOOD_RULESET" != "$KERNEL_RULESET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$GOOD_RULESET") <(echo "$KERNEL_RULESET")
- exit 1
-fi
-
-exit 0
echo "E: bogus ruleset loaded?" >&2
exit 1
fi
-
-KERNEL_RULESET="$($NFT list ruleset -nn)"
-
-if [ "$GOOD_RULESET" != "$KERNEL_RULESET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$GOOD_RULESET") <(echo "$KERNEL_RULESET")
- exit 1
-fi
-
-exit 0
echo "E: bogus ruleset loaded?" >&2
exit 1
fi
-
-KERNEL_RULESET="$($NFT list ruleset -nn)"
-
-if [ "$GOOD_RULESET" != "$KERNEL_RULESET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$GOOD_RULESET") <(echo "$KERNEL_RULESET")
- exit 1
-fi
-
-exit 0
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table inet filter {
- chain ssh {
- type filter hook input priority 0; policy accept;
- tcp dport ssh accept
- }
-
- chain input {
- type filter hook input priority 1; policy accept;
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
--- /dev/null
+table ip t {
+ set t {
+ type ipv4_addr
+ elements = { 1.1.1.1 }
+ }
+
+ chain c {
+ ct state new
+ tcp dport { 22222 }
+ ip saddr @t drop
+ jump other
+ }
+
+ chain other {
+ }
+}
--- /dev/null
+table ip t {
+ set t {
+ type ipv4_addr
+ elements = { 1.1.1.1 }
+ }
+
+ chain c {
+ ct state new
+ tcp dport { 22222 }
+ ip saddr @t drop
+ jump other
+ }
+
+ chain other {
+ }
+}
--- /dev/null
+table ip t {
+ set t {
+ type ipv4_addr
+ elements = { 1.1.1.1 }
+ }
+
+ chain c {
+ ct state new
+ tcp dport { 22222 }
+ ip saddr @t drop
+ jump other
+ }
+
+ chain other {
+ }
+}
--- /dev/null
+table ip t {
+ set t {
+ type ipv4_addr
+ elements = { 1.1.1.1 }
+ }
+
+ chain c {
+ ct state new
+ tcp dport { 22222 }
+ ip saddr @t drop
+ jump other
+ }
+
+ chain other {
+ }
+}
--- /dev/null
+table inet filter {
+ chain ssh {
+ type filter hook input priority 0; policy accept;
+ tcp dport ssh accept
+ }
+
+ chain input {
+ type filter hook input priority 1; policy accept;
+ }
+}
--- /dev/null
+table inet forward {
+ set concat-set-variable {
+ type ipv4_addr . inet_service
+ elements = { 10.10.10.10 . smtp,
+ 10.10.10.10 . imap2 }
+ }
+}
--- /dev/null
+table inet filter {
+ set whitelist_v4 {
+ type ipv4_addr
+ elements = { 1.1.1.1 }
+ }
+}
--- /dev/null
+table inet t {
+ chain c {
+ iifname "whatever" oifname "whatever" iif "lo" oif "lo"
+ iifname { "whatever" } iif { "lo" } mark 0x0000007b
+ ct state established,related,new
+ ct state != established | related | new
+ ip saddr 10.0.0.0 ip saddr 10.0.0.0 ip daddr 10.0.0.2
+ ip6 daddr fe0::1 ip6 saddr fe0::2
+ ip saddr vmap { 10.0.0.0 : drop, 10.0.0.2 : accept }
+ ip6 daddr vmap { fe0::1 : drop, fe0::2 : accept }
+ ip6 saddr . ip6 nexthdr { fe0::1 . udp, fe0::2 . tcp }
+ ip daddr . iif vmap { 10.0.0.0 . "lo" : accept }
+ tcp dport 100-222
+ udp dport vmap { 100-222 : accept }
+ }
+}
--- /dev/null
+table ip test {
+ chain test {
+ tcp dport ssh counter packets 0 bytes 0 accept comment "test_comment"
+ }
+}
--- /dev/null
+table ip test {
+ chain test {
+ tcp dport ssh counter packets 0 bytes 0 accept comment "test_comment"
+ }
+}
--- /dev/null
+table ip test {
+ chain test {
+ tcp dport ssh counter packets 0 bytes 0 accept
+ }
+}
$NFT add rule t c accept # should have handle 2
$NFT add rule t c accept # should have handle 3
$NFT add rule t c position 2 drop
-
-EXPECTED="table ip t {
- chain c {
- accept
- drop
- accept
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
$NFT add rule t c accept # should have handle 2
$NFT add rule t c accept # should have handle 3
$NFT insert rule t c position 2 drop
-
-EXPECTED="table ip t {
- chain c {
- drop
- accept
- accept
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
$NFT insert rule t c accept
$NFT insert rule t c drop
$NFT insert rule t c masquerade
-
-EXPECTED="table ip t {
- chain c {
- masquerade
- drop
- accept
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
$NFT add chain t c
$NFT add rule t c accept # should have handle 2
$NFT replace rule t c handle 2 drop
-
-EXPECTED="table ip t {
- chain c {
- drop
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
$NFT add rule t c accept # should have handle 2
$NFT add rule t c drop # should have handle 3
$NFT delete rule t c handle 2
-
-EXPECTED="table ip t {
- chain c {
- drop
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
--- /dev/null
+table ip t {
+ chain c {
+ accept
+ drop
+ accept
+ }
+}
--- /dev/null
+table ip t {
+ chain c {
+ drop
+ accept
+ accept
+ }
+}
--- /dev/null
+table ip t {
+ chain c {
+ masquerade
+ drop
+ accept
+ }
+}
--- /dev/null
+table ip t {
+ chain c {
+ drop
+ }
+}
--- /dev/null
+table ip t {
+ chain c {
+ drop
+ }
+}
set -e
$NFT -f $tmpfile
-
-EXPECTED="table ip x {
- set y {
- type ipv4_addr
- }
-}"
-GET=$($NFT list ruleset)
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
-
$NFT -f $tmpfile
echo "delete element x y $(generate)" > $tmpfile
$NFT -f $tmpfile
-
-
-EXPECTED="table ip x {
- set y {
- type ipv4_addr
- }
-}"
-GET=$($NFT list ruleset)
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
-
echo "E: unable to load ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip x {
- chain y {
- ip saddr { 1.1.1.0/24, 2.2.2.0/24, 3.3.3.0/24 }
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
set -e
echo "$EXPECTED" > $tmpfile
$NFT -f $tmpfile
-
-GET="$($NFT list ruleset)"
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
-
--- /dev/null
+table inet t {
+ set s1 {
+ type ipv4_addr
+ flags interval
+ elements = { 10.0.0.0-11.0.0.0, 172.16.0.0/16 }
+ }
+
+ set s2 {
+ type ipv6_addr
+ flags interval
+ elements = { fe00::/64,
+ fe11::-fe22:: }
+ }
+
+ set s3 {
+ type inet_proto
+ flags interval
+ elements = { 10-20, 50-60 }
+ }
+
+ set s4 {
+ type inet_service
+ flags interval
+ elements = { 0-1024, 8080-8082, 10000-40000 }
+ }
+
+ chain c {
+ ip saddr @s1 accept
+ ip6 daddr @s2 accept
+ ip protocol @s3 accept
+ ip6 nexthdr @s3 accept
+ tcp dport @s4 accept
+ }
+}
--- /dev/null
+table ip t {
+ set s {
+ type ipv4_addr
+ flags interval
+ elements = { 192.168.0.0/24, 192.168.1.0/24 }
+ }
+}
--- /dev/null
+table ip t {
+ set s {
+ type ipv4_addr
+ }
+}
--- /dev/null
+table inet t {
+ set s {
+ type ipv6_addr
+ flags interval
+ elements = { fe00::/64 }
+ }
+}
--- /dev/null
+table inet t {
+ set s {
+ type ipv6_addr
+ flags interval
+ elements = { fe00::/48 }
+ }
+}
--- /dev/null
+table ip t {
+ set s {
+ type ipv4_addr
+ }
+}
--- /dev/null
+table ip t {
+ set s {
+ type ipv4_addr
+ elements = { 1.1.1.1 }
+ }
+}
--- /dev/null
+table ip t {
+ set s {
+ type ipv4_addr
+ flags interval
+ elements = { 1.1.1.1 comment "test" }
+ }
+}
--- /dev/null
+table ip t {
+ map sourcemap {
+ type ipv4_addr : verdict
+ elements = { 100.123.10.2 : jump c }
+ }
+
+ chain postrouting {
+ ip saddr vmap @sourcemap accept
+ }
+
+ chain c {
+ }
+}
--- /dev/null
+table ip t {
+ set s {
+ type ipv4_addr
+ flags timeout
+ elements = { 1.1.1.1 comment "test" }
+ }
+}
--- /dev/null
+table inet t {
+ set s {
+ type ipv6_addr
+ elements = { ::1 comment "test" }
+ }
+}
--- /dev/null
+table ip x {
+ set y {
+ type ipv4_addr
+ }
+}
--- /dev/null
+table ip x {
+ set y {
+ type ipv4_addr
+ }
+}
--- /dev/null
+table ip t {
+ chain c {
+ }
+}
+table inet filter {
+ set blacklist_v4 {
+ type ipv4_addr
+ flags interval
+ elements = { 192.168.0.0/24 }
+ }
+}
--- /dev/null
+table ip x {
+ set s {
+ type ipv4_addr
+ size 2
+ elements = { 1.1.1.1 }
+ }
+}
--- /dev/null
+table ip x {
+ set s {
+ type ipv4_addr
+ size 2
+ elements = { 1.1.1.1 }
+ }
+}
--- /dev/null
+table ip x {
+ set s {
+ type ipv4_addr
+ size 2
+ elements = { 1.1.1.1, 1.1.1.2 }
+ }
+}
--- /dev/null
+table inet t {
+ set s {
+ type inet_service
+ elements = { ssh comment "test" }
+ }
+}
--- /dev/null
+table ip x {
+ chain y {
+ ip saddr { 1.1.1.0/24, 2.2.2.0/24, 3.3.3.0/24 }
+ }
+}
--- /dev/null
+table ip t {
+ set s {
+ type ipv4_addr
+ }
+
+ map m {
+ type ipv4_addr : inet_service
+ }
+
+ chain c {
+ tcp dport http meter f { ip saddr limit rate 10/second}
+ }
+}
--- /dev/null
+table ip t {
+}
--- /dev/null
+table inet x {
+ counter user123 {
+ packets 12 bytes 1433
+ }
+
+ quota user123 {
+ over 2000 bytes
+ }
+
+ quota user124 {
+ over 2000 bytes
+ }
+
+ set y {
+ type ipv4_addr
+ }
+
+ map test {
+ type ipv4_addr : quota
+ elements = { 192.168.2.2 : "user124", 192.168.2.3 : "user124" }
+ }
+
+ chain y {
+ type filter hook input priority 0; policy accept;
+ counter name ip saddr map { 1.1.1.1 : "user123", 2.2.2.2 : "user123", 192.168.2.2 : "user123" }
+ quota name ip saddr map @test drop
+ }
+}
--- /dev/null
+table ip t {
+ chain c {
+ type filter hook output priority 0; policy accept;
+ ip daddr { 192.168.0.1, 192.168.0.2, 192.168.0.3 }
+ tcp dport { ssh, telnet } counter packets 0 bytes 0
+ }
+}
--- /dev/null
+table ip filter {
+ limit http-traffic {
+ rate 1/second
+ }
+
+ chain input {
+ type filter hook input priority 0; policy accept;
+ limit name tcp dport map { http : "http-traffic", https : "http-traffic" }
+ }
+}
--- /dev/null
+table inet t {
+ set s {
+ type ipv6_addr
+ flags interval
+ elements = { ::ffff:0.0.0.0/96 }
+ }
+}
--- /dev/null
+table inet t {
+ set s {
+ type ifname
+ elements = { "eth0" }
+ }
+
+ chain c {
+ iifname @s accept
+ oifname @s accept
+ }
+}
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip x {
-}
-table ip y {
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip x {
- flags dormant
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED=""
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip w {
- chain y {
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip x {
- chain y {
- type filter hook input priority 0; policy drop;
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip w {
- chain y {
- type filter hook output priority 0; policy accept;
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip w {
- chain y {
- type filter hook output priority 0; policy accept;
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED=""
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip x {
- chain y {
- ip saddr 2.2.2.2 counter packets 0 bytes 0
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip x {
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip x {
- set y {
- type ipv4_addr
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip w {
- set y {
- type ipv4_addr
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip x {
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip x {
- set y {
- type ipv4_addr
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip x {
- set y {
- type ipv4_addr
- elements = { 3.3.3.3 }
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip x {
- set y {
- type ipv4_addr
- flags interval
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip x {
- set y {
- type ipv4_addr
- flags interval
- elements = { 192.168.4.0/24 }
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-EXPECTED="table ip x {
- set y {
- type ipv4_addr
- flags interval
- elements = { 192.168.4.0/24 }
- }
-}"
-
-GET="$($NFT list ruleset)"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
echo "E: unable to load good ruleset" >&2
exit 1
fi
-
-GET="$($NFT list ruleset)"
-
-EXPECTED="table ip filter {
- map client_to_any {
- type ipv4_addr : verdict
- }
-
- chain FORWARD {
- type filter hook forward priority 0; policy accept;
- goto client_to_any
- }
-
- chain client_to_any {
- ip saddr vmap @client_to_any
- }
-}"
-
-if [ "$EXPECTED" != "$GET" ] ; then
- DIFF="$(which diff)"
- [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
- exit 1
-fi
--- /dev/null
+table ip x {
+}
+table ip y {
+}
--- /dev/null
+table ip x {
+ flags dormant
+}
--- /dev/null
+table ip w {
+ chain y {
+ }
+}
--- /dev/null
+table ip x {
+ chain y {
+ type filter hook input priority 0; policy drop;
+ }
+}
--- /dev/null
+table ip w {
+ chain y {
+ type filter hook output priority 0; policy accept;
+ }
+}
--- /dev/null
+table ip w {
+ chain y {
+ type filter hook output priority 0; policy accept;
+ }
+}
--- /dev/null
+table ip x {
+ chain y {
+ ip saddr 2.2.2.2 counter packets 0 bytes 0
+ }
+}
--- /dev/null
+table ip x {
+}
--- /dev/null
+table ip x {
+ set y {
+ type ipv4_addr
+ }
+}
--- /dev/null
+table ip w {
+ set y {
+ type ipv4_addr
+ }
+}
--- /dev/null
+table ip x {
+}
--- /dev/null
+table ip x {
+ set y {
+ type ipv4_addr
+ }
+}
--- /dev/null
+table ip x {
+ set y {
+ type ipv4_addr
+ elements = { 3.3.3.3 }
+ }
+}
--- /dev/null
+table ip x {
+ set y {
+ type ipv4_addr
+ flags interval
+ }
+}
--- /dev/null
+table ip x {
+ set y {
+ type ipv4_addr
+ flags interval
+ elements = { 192.168.4.0/24 }
+ }
+}
--- /dev/null
+table ip x {
+ set y {
+ type ipv4_addr
+ flags interval
+ elements = { 192.168.4.0/24 }
+ }
+}
--- /dev/null
+table ip filter {
+ map client_to_any {
+ type ipv4_addr : verdict
+ }
+
+ chain FORWARD {
+ type filter hook forward priority 0; policy accept;
+ goto client_to_any
+ }
+
+ chain client_to_any {
+ ip saddr vmap @client_to_any
+ }
+}
projects / thirdparty / nftables.git / commitdiff
