ACLOCAL_AMFLAGS = -I m4
-SUBDIRS = src include examples
+SUBDIRS = src include examples tests
DIST_SUBDIRS = src include examples
pkgconfigdir = $(libdir)/pkgconfig
-Wformat=2 -pipe"
AC_SUBST([regular_CPPFLAGS])
AC_SUBST([regular_CFLAGS])
-AC_CONFIG_FILES([Makefile src/Makefile include/Makefile include/libnftables/Makefile include/linux/Makefile include/linux/netfilter/Makefile examples/Makefile libnftables.pc doxygen.cfg])
+AC_CONFIG_FILES([Makefile src/Makefile include/Makefile include/libnftables/Makefile include/linux/Makefile include/linux/netfilter/Makefile examples/Makefile tests/Makefile libnftables.pc doxygen.cfg])
AC_OUTPUT
+++ /dev/null
-<?xml version="1.0"?>
-<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
- <rule_flags>0</rule_flags>
- <flags>127</flags>
- <compat_flags>0</compat_flags>
- <compat_proto>0</compat_proto>
- <expr type="meta">
- <dreg>1</dreg>
- <key>4</key>
- </expr>
- <expr type="cmp">
- <sreg>1</sreg>
- <op>eq</op>
- <cmpdata>
- <data_reg type="value">
- <len>1</len>
- <data0>0x04000000</data0>
- </data_reg>
- </cmpdata>
- </expr>
- <expr type="payload">
- <dreg>1</dreg>
- <base>1</base>
- <offset>12</offset>
- <len>4</len>
- </expr>
- <expr type="cmp">
- <sreg>1</sreg>
- <op>eq</op>
- <cmpdata>
- <data_reg type="value">
- <len>1</len>
- <data0>0x96d60496</data0>
- </data_reg>
- </cmpdata>
- </expr>
- <expr type="payload">
- <dreg>1</dreg>
- <base>1</base>
- <offset>16</offset>
- <len>4</len>
- </expr>
- <expr type="cmp">
- <sreg>1</sreg>
- <op>eq</op>
- <cmpdata>
- <data_reg type="value">
- <len>1</len>
- <data0>0x96d60329</data0>
- </data_reg>
- </cmpdata>
- </expr>
- <expr type="payload">
- <dreg>1</dreg>
- <base>1</base>
- <offset>9</offset>
- <len>1</len>
- </expr>
- <expr type="cmp">
- <sreg>1</sreg>
- <op>eq</op>
- <cmpdata>
- <data_reg type="value">
- <len>1</len>
- <data0>0x06000000</data0>
- </data_reg>
- </cmpdata>
- </expr>
- <expr type="match">
- <name>state</name>
- <rev>0</rev>
- <info>
- </info>
- </expr>
- <expr type="counter">
- <pkts>123123</pkts>
- <bytes>321321</bytes>
- </expr>
- <expr type="target">
- <name>LOG</name>
- <rev>0</rev>
- <info>
- </info>
- </expr>
-</rule>
+++ /dev/null
-#!/bin/bash
-
-#
-# (C) 2013 by Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-
-# This is a small testbench for adding nftables chains to kernel
-# in XML format.
-
-BINARY="../examples/nft-chain-xml-add"
-NFT=$( which nft )
-MKTEMP=$( which mktemp)
-TMPFILE=$( $MKTEMP )
-
-if [ ! -x "$BINARY" ] ; then
- echo "E: Binary not found $BINARY"
- exit 1
-fi
-
-if [ ! -x "$MKTEMP" ] ; then
- echo "E: mktemp not found and is neccesary"
- exit 1
-fi
-
-if [ ! -w "$TMPFILE" ] ; then
- echo "E: Unable to create temp file via mktemp"
- exit 1
-fi
-
-[ ! -x "$NFT" ] && echo "W: nftables main binary not found but continuing anyway $NFT"
-
-XML="<chain name=\"test1\" handle=\"100\" bytes=\"123\" packets=\"321\" version=\"0\">
- <properties>
- <type>filter</type>
- <table>filter</table>
- <prio>0</prio>
- <use>0</use>
- <hooknum>NF_INET_LOCAL_IN</hooknum>
- <policy>accept</policy>
- <family>ip</family>
- </properties>
-</chain>"
-
-$NFT delete chain ip filter test1 2>/dev/null >&2
-echo $XML > $TMPFILE
-if ! $BINARY "$TMPFILE" ; then
- echo "E: Unable to add XML:"
- echo "$XML"
- exit 1
-fi
-
-# This is valid (as long as the table exist)
-XML="<chain name=\"test2\" handle=\"101\" bytes=\"59\" packets=\"1\" version=\"0\">
- <properties>
- <type>filter</type>
- <table>filter</table>
- <prio>1</prio>
- <use>0</use>
- <hooknum>NF_INET_POST_ROUTING</hooknum>
- <policy>accept</policy>
- <family>ip6</family>
- </properties>
-</chain>"
-
-$NFT delete chain ip6 filter test2 2>/dev/null >&2
-echo $XML > $TMPFILE
-if ! $BINARY "$TMPFILE" ; then
- echo "E: Unable to add XML:"
- echo "$XML"
- rm -rf $TMPFILE 2>/dev/null
- exit 1
-fi
-
-# This is valid (as long as the table exist)
-XML="<chain name=\"test3\" handle=\"102\" bytes=\"51231239\" packets=\"1123123123\" version=\"0\">
- <properties>
- <type>filter</type>
- <table>filter</table>
- <prio>0</prio>
- <use>0</use>
- <hooknum>NF_INET_FORWARD</hooknum>
- <policy>drop</policy>
- <family>ip</family>
- </properties>
-</chain>"
-
-$NFT delete chain ip6 filter test3 2>/dev/null >&2
-echo $XML > $TMPFILE
-if ! $BINARY "$TMPFILE" ; then
- echo "E: Unable to add XML:"
- echo "$XML"
- rm -rf $TMPFILE 2>/dev/null
- exit 1
-fi
-
-# This is invalid
-XML="<chain name=\"XXXX\" handle=\"XXXX\" bytes=\"XXXXXXX\" packets=\"XXXXXXX\" >
- <properties>
- <flags>asdasd</flags>
- <type>filter</type>
- <table>filter</table>
- <prio>asdasd</prio>
- <use>asdasd</use>
- <hooknum>asdasd</hooknum>
- <policy>asdasd</policy>
- <family>asdasd</family>
- </properties>
- </chain>"
-
-if $BINARY "$XML" 2>/dev/null; then
- echo "E: Accepted invalid XML:"
- echo "$XML"
- rm -rf $TMPFILE 2>/dev/null
- exit 1
-fi
-
-rm -rf $TMPFILE 2>/dev/null
-echo "I: Test OK"
+++ /dev/null
-#!/bin/bash
-
-#
-# (C) 2013 by Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-
-# This is a small testbench for adding nftables rules to kernel
-# in XML format.
-
-BINARY="../examples/nft-rule-xml-add"
-NFT="$( which nft )"
-MKTEMP="$( which mktemp )"
-TMPFILE="$( $MKTEMP )"
-
-if [ ! -x "$BINARY" ] ; then
- echo "E: Binary not found $BINARY"
- exit 1
-fi
-
-if [ ! -x "$MKTEMP" ] ; then
- echo "E: mktemp not found. Is mandatory."
- exit 1
-fi
-
-if [ ! -w "$TMPFILE" ] ; then
- echo "E: Unable to create tempfile with mktemp"
- exit 1
-fi
-
-[ ! -x "$NFT" ] && echo "W: nftables main binary not found but continuing anyway $NFT"
-
-XML="<rule family=\"ip\" table=\"filter\" chain=\"INPUT\" handle=\"100\" version=\"0\">
- <rule_flags>0</rule_flags>
- <compat_flags>0</compat_flags>
- <compat_proto>0</compat_proto>
- <expr type=\"meta\">
- <dreg>1</dreg>
- <key>iif</key>
- </expr>
- <expr type=\"cmp\">
- <sreg>1</sreg>
- <op>eq</op>
- <cmpdata>
- <data_reg type=\"value\">
- <len>4</len>
- <data0>0x04000000</data0>
- </data_reg>
- </cmpdata>
- </expr>
- <expr type=\"payload\">
- <dreg>1</dreg>
- <base>transport</base>
- <offset>12</offset>
- <len>4</len>
- </expr>
- <expr type=\"cmp\">
- <sreg>1</sreg>
- <op>eq</op>
- <cmpdata>
- <data_reg type=\"value\">
- <len>4</len>
- <data0>0x96d60496</data0>
- </data_reg>
- </cmpdata>
- </expr>
- <expr type=\"payload\">
- <dreg>1</dreg>
- <base>link</base>
- <offset>16</offset>
- <len>4</len>
- </expr>
- <expr type=\"cmp\">
- <sreg>1</sreg>
- <op>eq</op>
- <cmpdata>
- <data_reg type=\"value\">
- <len>4</len>
- <data0>0x96d60329</data0>
- </data_reg>
- </cmpdata>
- </expr>
- <expr type=\"payload\">
- <dreg>1</dreg>
- <base>network</base>
- <offset>9</offset>
- <len>1</len>
- </expr>
- <expr type=\"cmp\">
- <sreg>1</sreg>
- <op>eq</op>
- <cmpdata>
- <data_reg type=\"value\">
- <len>4</len>
- <data0>0x06000000</data0>
- </data_reg>
- </cmpdata>
- </expr>
- <expr type=\"match\">
- <name>state</name>
- </expr>
- <expr type=\"counter\">
- <pkts>123123</pkts>
- <bytes>321321</bytes>
- </expr>
- <expr type=\"target\">
- <name>LOG</name>
- </expr>
-</rule>"
-
-$NFT add table filter 2>/dev/null >&2
-$NFT add chain filter INPUT 2>/dev/null >&2
-
-echo $XML > $TMPFILE
-if ! $BINARY "$TMPFILE" ; then
- echo "E: Unable to add XML."
- rm -rf $TMPFILE 2>/dev/null
- exit 1
-fi
-
-rm -rf $TMPFILE 2>/dev/null
-echo "I: Test OK"
+++ /dev/null
-#!/bin/bash
-
-#
-# (C) 2013 by Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-
-# This is a small testbench for adding nftables tables to kernel
-# in XML format.
-
-BINARY="../examples/nft-table-xml-add"
-NFT="$( which nft )"
-MKTEMP="$( which mktemp)"
-TMPFILE="$( $MKTEMP )"
-
-if [ ! -x "$BINARY" ] ; then
- echo "E: Binary not found $BINARY"
- exit 1
-fi
-
-if [ ! -x "$MKTEMP" ] ; then
- echo "E: mktemp not found and is neccesary"
- exit 1
-fi
-
-if [ ! -w "$TMPFILE" ] ; then
- echo "E: Unable to create temp file via mktemp"
- exit 1
-fi
-
-
-if [ ! -x "$NFT" ] ; then
- echo "W: nftables main binary not found but continuing anyway $NFT"
-fi
-
-# This is valid
-XML="<table name=\"filter_test\" version=\"0\">
- <properties>
- <family>ip</family>
- <table_flags>0</table_flags>
- </properties>
-</table>"
-
-$NFT delete table filter_test 2>/dev/null >&2
-echo $XML > $TMPFILE
-if ! $BINARY "$TMPFILE" ; then
- echo "E: Unable to add XML:"
- echo "$XML"
- rm -rf $TMPFILE 2>/dev/null
- exit 1
-fi
-
-# This is valid
-XML="<table name=\"filter6_test\" version=\"0\">
- <properties>
- <family>ip6</family>
- <table_flags>0</table_flags>
- </properties>
-</table>"
-
-$NFT delete table filter6_test 2>/dev/null >&2
-echo $XML > $TMPFILE
-if ! $BINARY "$TMPFILE" ; then
- echo "E: Unable to add XML:"
- echo "$XML"
- rm -rf $TMPFILE 2>/dev/null
- exit 1
-fi
-
-rm -rf $TMPFILE 2>/dev/null
-echo "I: Test OK"
--- /dev/null
+include $(top_srcdir)/Make_global.am
+
+check_PROGRAMS = nft-parsing-test
+
+nft_parsing_test_SOURCES = nft-parsing-test.c
+nft_parsing_test_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} ${LIBXML_LIBS}
--- /dev/null
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <dirent.h>
+#include <limits.h>
+#include <errno.h>
+
+#include <libmnl/libmnl.h> /*nlmsghdr*/
+#include <libnftables/table.h>
+#include <libnftables/chain.h>
+#include <libnftables/rule.h>
+
+#ifdef XML_PARSING
+#include <mxml.h>
+#endif
+
+static int test_xml(const char *filename)
+{
+#ifdef XML_PARSING
+ int ret = -1;
+ struct nft_table *t = NULL;
+ struct nft_chain *c = NULL;
+ struct nft_rule *r = NULL;
+ FILE *fp;
+ mxml_node_t *tree = NULL;;
+ char *xml = NULL;
+
+ fp = fopen(filename, "r");
+ tree = mxmlLoadFile(NULL, fp, MXML_NO_CALLBACK);
+ fclose(fp);
+
+ if (tree == NULL)
+ return -1;
+
+ xml = mxmlSaveAllocString(tree, MXML_NO_CALLBACK);
+ if (xml == NULL)
+ return -1;
+
+ /* Check what parsing should be done */
+ if (strcmp(tree->value.opaque, "table") == 0) {
+ t = nft_table_alloc();
+ if (t != NULL) {
+ if (nft_table_parse(t, NFT_TABLE_PARSE_XML, xml) == 0)
+ ret = 0;
+
+ nft_table_free(t);
+ }
+ } else if (strcmp(tree->value.opaque, "chain") == 0) {
+ c = nft_chain_alloc();
+ if (c != NULL) {
+ if (nft_chain_parse(c, NFT_CHAIN_PARSE_XML, xml) == 0)
+ ret = 0;
+
+ nft_chain_free(c);
+ }
+ } else if (strcmp(tree->value.opaque, "rule") == 0) {
+ r = nft_rule_alloc();
+ if (r != NULL) {
+ if (nft_rule_parse(r, NFT_RULE_PARSE_XML, xml) == 0)
+ ret = 0;
+
+ nft_rule_free(r);
+ }
+ }
+
+ return ret;
+#else
+ errno = EOPNOTSUPP;
+ return -1;
+#endif
+}
+
+int main(int argc, char *argv[])
+{
+ DIR *d;
+ struct dirent *dent;
+ char path[PATH_MAX];
+
+ if (argc != 2) {
+ fprintf(stderr, "Usage: %s <directory>\n", argv[0]);
+ exit(EXIT_FAILURE);
+ }
+
+ d = opendir(argv[1]);
+ if (d == NULL) {
+ perror("opendir");
+ exit(EXIT_FAILURE);
+ }
+
+ while ((dent = readdir(d)) != NULL) {
+ int len = strlen(dent->d_name);
+
+ if (strcmp(dent->d_name, ".") == 0 ||
+ strcmp(dent->d_name, "..") == 0)
+ continue;
+
+ snprintf(path, sizeof(path), "%s/%s", argv[1], dent->d_name);
+
+ if (strcmp(&dent->d_name[len-4], ".xml") == 0) {
+ printf("parsing %s: ", path);
+ if (test_xml(path) < 0)
+ printf("\033[31mFAILED\033[37m (%s)\n",
+ strerror(errno));
+ else
+ printf("\033[32mOK\033[37m \n");
+ }
+ }
+
+ closedir(d);
+ return 0;
+}
<table name="filter" version="0">
<properties>
- <family>2</family>
+ <family>ip</family>
<table_flags>0</table_flags>
</properties>
</table>
--- /dev/null
+<table name="nat" version="0">
+ <properties>
+ <family>ip6</family>
+ <table_flags>0</table_flags>
+ </properties>
+</table>
--- /dev/null
+<chain name="test" handle="0" bytes="0" packets="0" version="0">
+ <properties>
+ <type>filter</type>
+ <table>filter</table>
+ <prio>0</prio>
+ <use>1</use>
+ <hooknum>NF_INET_LOCAL_IN</hooknum>
+ <policy>accept</policy>
+ <family>ip</family>
+ </properties>
+</chain>
<properties>
<type>filter</type>
<table>filter</table>
- <prio>1</prio>
- <use>0</use>
- <hooknum>4</hooknum>
- <policy>1</policy>
- <family>10</family>
+ <prio>0</prio>
+ <use>1</use>
+ <hooknum>NF_INET_FORWARD</hooknum>
+ <policy>drop</policy>
+ <family>ip6</family>
</properties>
</chain>
--- /dev/null
+<chain name="foo" handle="100" bytes="59264154979" packets="2548796325" version="0">
+ <properties>
+ <type>nat</type>
+ <table>nat</table>
+ <prio>0</prio>
+ <use>1</use>
+ <hooknum>NF_INET_POST_ROUTING</hooknum>
+ <policy>accept</policy>
+ <family>ip</family>
+ </properties>
+</chain>
--- /dev/null
+<rule family="ip" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <expr type="bitwise">
+ <sreg>2</sreg>
+ <dreg>2</dreg>
+ <mask>
+ <data_reg type="value">
+ <len>16</len>
+ <data0>0xffffffff</data0>
+ <data1>0xffffffff</data1>
+ <data2>0xffffffff</data2>
+ <data3>0x000000ff</data3>
+ </data_reg>
+ </mask>
+ <xor>
+ <data_reg type="value">
+ <len>16</len>
+ <data0>0xfaceb00c</data0>
+ <data1>0xc1cac1ca</data1>
+ <data2>0xcafecafe</data2>
+ <data3>0xdeadbeef</data3>
+ </data_reg>
+ </xor>
+ </expr>
+</rule>
--- /dev/null
+<rule family="ip" table="test" chain="test" handle="1000" version="0">
+ <rule_flags>123</rule_flags>
+ <compat_flags>123</compat_flags>
+ <compat_proto>123</compat_proto>
+ <expr type="byteorder">
+ <sreg>3</sreg>
+ <dreg>4</dreg>
+ <op>hton</op>
+ <len>4</len>
+ <size>4</size>
+ </expr>
+</rule>
--- /dev/null
+<rule family="ip" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <expr type="cmp">
+ <sreg>1</sreg>
+ <op>eq</op>
+ <cmpdata>
+ <data_reg type="value">
+ <len>4</len>
+ <data0>0x01010101</data0>
+ </data_reg>
+ </cmpdata>
+ </expr>
+</rule>
--- /dev/null
+<rule family="ip6" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <flags>127</flags>
+ <expr type="counter">
+ <pkts>123123</pkts>
+ <bytes>321321</bytes>
+ </expr>
+</rule>
--- /dev/null
+<rule family="ip" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <compat_flags>0</compat_flags>
+ <compat_proto>0</compat_proto>
+ <expr type="ct">
+ <dreg>4</dreg>
+ <dir>1</dir>
+ <key>state</key>
+ </expr>
+</rule>
--- /dev/null
+<rule family="ip6" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <expr type="exthdr">
+ <dreg>1</dreg>
+ <exthdr_type>mh</exthdr_type>
+ <offset>2</offset>
+ <len>16</len>
+ </expr>
+</rule>
--- /dev/null
+<rule family="ip" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <expr type="immediate">
+ <dreg>1</dreg>
+ <immdata>
+ <data_reg type="value">
+ <len>4</len>
+ <data0>0xaabbccdd</data0>
+ </data_reg>
+ </immdata>
+ </expr>
+</rule>
--- /dev/null
+<rule family="ip" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <expr type="limit">
+ <rate>123123</rate>
+ <depth>321321</depth>
+ </expr>
+</rule>
--- /dev/null
+<rule family="ip6" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <expr type="log">
+ <group>10</group>
+ <snaplen>4000000</snaplen>
+ <qthreshold>1222222</qthreshold>
+ <prefix>prefixtest</prefix>
+ </expr>
+</rule>
--- /dev/null
+<rule family="ip" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <expr type="lookup">
+ <sreg>2</sreg>
+ <dreg>1</dreg>
+ <set>set_name_test</set>
+ </expr>
+</rule>
--- /dev/null
+<rule family="ip" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <expr type="match">
+ <name>state</name>
+ </expr>
+</rule>
--- /dev/null
+<rule family="ip" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <expr type="meta">
+ <dreg>1</dreg>
+ <key>oifname</key>
+ </expr>
+</rule>
--- /dev/null
+<rule family="ip6" table="nat" chain="OUTPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <expr type="nat">
+ <family>ip6</family>
+ <nat_type>snat</nat_type>
+ <sreg_addr_min>1</sreg_addr_min>
+ <sreg_addr_max>2</sreg_addr_max>
+ <sreg_proto_min>3</sreg_proto_min>
+ <sreg_proto_max>4</sreg_proto_max>
+ </expr>
+</rule>
--- /dev/null
+<rule family="ip" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <expr type="nat">
+ <sreg_addr_min>1</sreg_addr_min>
+ <sreg_addr_max>2</sreg_addr_max>
+ <sreg_proto_min>3</sreg_proto_min>
+ <sreg_proto_max>4</sreg_proto_max>
+ <family>ip</family>
+ <nat_type>dnat</nat_type>
+ </expr>
+</rule>
--- /dev/null
+<rule family="ip6" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <expr type="payload">
+ <dreg>1</dreg>
+ <base>transport</base>
+ <offset>12</offset>
+ <len>4</len>
+ </expr>
+</rule>
--- /dev/null
+<rule family="ip" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <expr type="target">
+ <name>LOG</name>
+ </expr>
+</rule>
projects / thirdparty / libnftnl.git / commitdiff
