From 249c6979819a5f061b24e53c2f2bd5dab679da0d Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Sun, 27 Jul 2025 23:27:14 +0200 Subject: [PATCH] Backport nftables tests/shell from 2a38f458f12b Originally, the plan was to use tests/shell from git HEAD, but this does not work well in practise because slight changes in the test output break checks resulting in lots of [DUMP FAIL] errors. It is easier to test infrastructure self-contained in this 1.0.6.y branch. However, backporting the tests/shell into 1.0.6.y turns out to be more complicated than expected, so I decided to follow the opposite, which is to (brute) force a copy of tests/shell from 2a38f458f12bc032dac1b3ba63f95ca5a3c03fbd into this branch. This also requires a number follow up partial reverts on tests/shell updates to work with 1.0.6.y. Signed-off-by: Pablo Neira Ayuso --- tests/shell/features/bitshift.nft | 7 + tests/shell/features/bitwise_multireg.nft | 5 + tests/shell/features/catchall_element.nft | 8 + tests/shell/features/cgroupsv2.nft | 7 + tests/shell/features/chain_binding.nft | 7 + tests/shell/features/comment.sh | 14 + tests/shell/features/ctexpect.nft | 10 + tests/shell/features/cttimeout.nft | 8 + tests/shell/features/curl.sh | 4 + tests/shell/features/destroy.nft | 3 + tests/shell/features/dynset_op_delete.nft | 12 + tests/shell/features/elem_timeout_update.sh | 22 + tests/shell/features/flowtable_counter.sh | 16 + tests/shell/features/flowtable_no_devices.nft | 8 + tests/shell/features/ifname_based_hooks.sh | 12 + tests/shell/features/inet_ingress.nft | 7 + tests/shell/features/inet_nat.nft | 7 + tests/shell/features/inner_matching.nft | 7 + tests/shell/features/ip_options.nft | 8 + tests/shell/features/ipsec.nft | 7 + tests/shell/features/json.sh | 6 + tests/shell/features/map_lookup.nft | 11 + tests/shell/features/meta_time.nft | 7 + .../features/netdev_chain_multidevice.sh | 17 + .../features/netdev_chain_without_device.nft | 7 + tests/shell/features/netdev_egress.nft | 7 + tests/shell/features/netmap.nft | 8 + tests/shell/features/osf.nft | 7 + tests/shell/features/pipapo.nft | 9 + tests/shell/features/position_id.sh | 23 + tests/shell/features/prerouting_reject.nft | 8 + tests/shell/features/rbtree_size_limit.nft | 10 + tests/shell/features/reset_rule.sh | 8 + tests/shell/features/reset_set.sh | 10 + tests/shell/features/reset_tcp_options.nft | 5 + tests/shell/features/sctp_chunks.nft | 7 + tests/shell/features/secmark.nft | 7 + tests/shell/features/set_expr.sh | 19 + .../features/set_with_two_expressions.nft | 9 + tests/shell/features/setelem_expiration.sh | 18 + tests/shell/features/socat.sh | 4 + .../shell/features/stateful_object_update.sh | 21 + tests/shell/features/synproxy.nft | 9 + tests/shell/features/table_flag_owner.nft | 5 + tests/shell/features/table_flag_persist.nft | 3 + tests/shell/features/tcpdump.sh | 4 + tests/shell/features/vsftpd.sh | 4 + tests/shell/helpers/json-diff-pretty.sh | 17 + tests/shell/helpers/json-pretty.sh | 30 + tests/shell/helpers/json-sanitize-ruleset.sh | 30 + tests/shell/helpers/nft-valgrind-wrapper.sh | 31 + tests/shell/helpers/random-source.sh | 40 + tests/shell/helpers/test-wrapper.sh | 328 ++ tests/shell/run-tests.sh | 1012 +++- .../0040mark_binop_0} | 4 +- .../0040mark_binop_1} | 4 +- .../shell/testcases/bitwise/0040mark_binop_10 | 13 + .../shell/testcases/bitwise/0040mark_binop_11 | 13 + .../shell/testcases/bitwise/0040mark_binop_12 | 13 + .../shell/testcases/bitwise/0040mark_binop_13 | 13 + .../shell/testcases/bitwise/0040mark_binop_2 | 13 + .../shell/testcases/bitwise/0040mark_binop_3 | 13 + .../shell/testcases/bitwise/0040mark_binop_4 | 13 + .../shell/testcases/bitwise/0040mark_binop_5 | 13 + .../shell/testcases/bitwise/0040mark_binop_6 | 13 + .../shell/testcases/bitwise/0040mark_binop_7 | 13 + .../shell/testcases/bitwise/0040mark_binop_8 | 13 + .../shell/testcases/bitwise/0040mark_binop_9 | 13 + .../testcases/bitwise/0044payload_binop_2 | 13 + .../testcases/bitwise/0044payload_binop_5 | 13 + .../bitwise/dumps/0040mark_binop_0.json-nft | 75 + .../dumps/0040mark_binop_0.nft} | 2 +- .../bitwise/dumps/0040mark_binop_1.json-nft | 86 + .../dumps/0040mark_binop_1.nft} | 2 +- .../bitwise/dumps/0040mark_binop_10.nft | 6 + .../bitwise/dumps/0040mark_binop_11.nft | 6 + .../bitwise/dumps/0040mark_binop_12.nft | 6 + .../bitwise/dumps/0040mark_binop_13.nft | 6 + .../bitwise/dumps/0040mark_binop_2.json-nft | 65 + .../bitwise/dumps/0040mark_binop_2.nft | 6 + .../bitwise/dumps/0040mark_binop_3.json-nft | 65 + .../bitwise/dumps/0040mark_binop_3.nft | 6 + .../bitwise/dumps/0040mark_binop_4.json-nft | 65 + .../bitwise/dumps/0040mark_binop_4.nft | 6 + .../bitwise/dumps/0040mark_binop_5.json-nft | 65 + .../bitwise/dumps/0040mark_binop_5.nft | 6 + .../bitwise/dumps/0040mark_binop_6.json-nft | 65 + .../bitwise/dumps/0040mark_binop_6.nft | 6 + .../bitwise/dumps/0040mark_binop_7.json-nft | 65 + .../bitwise/dumps/0040mark_binop_7.nft | 6 + .../bitwise/dumps/0040mark_binop_8.json-nft | 65 + .../bitwise/dumps/0040mark_binop_8.nft | 6 + .../bitwise/dumps/0040mark_binop_9.json-nft | 65 + .../bitwise/dumps/0040mark_binop_9.nft | 6 + .../bitwise/dumps/0044payload_binop_2.nft | 6 + .../bitwise/dumps/0044payload_binop_5.nft | 6 + .../bogons/dumps/assert_failures.json-nft | 11 + .../bogons/dumps/assert_failures.nft | 0 .../nft-f/delete_nonexistant_object_crash | 1 + ...sh => mapping_with_invalid_datatype_crash} | 0 .../bogons/nft-f/range_expression_corruption | 2 + .../nft-f/set_definition_with_no_key_assert | 12 + .../nft-f/use_after_free_on_chain_removal | 5 + .../nft-f/zero_length_devicename2_assert | 5 + .../nft-j-f/Assertion__out_failed_assert | 6 + .../nft-j-f/binop_rhs_decode_error_crash | 76 + .../bogons/nft-j-f/constant_expr_alloc_assert | 38 + ...pr_evaluate_concat_empty_concat_key_assert | 27 + .../nft-j-f/list_a_destroyed_table_crash | 3 + .../reject_stmt_with_no_expression_crash | 32 + .../set_with_single_value_concat_assert | 26 + .../unkown_stateful_statement_type_19_assert | 34 + .../testcases/cache/0008_delete_by_handle_0 | 2 +- .../testcases/cache/0010_implicit_chain_0 | 2 + tests/shell/testcases/cache/0011_index_0 | 2 + .../dumps/0001_cache_handling_0.json-nft | 142 + .../cache/dumps/0002_interval_0.json-nft | 36 + .../cache/dumps/0003_cache_update_0.json-nft | 137 + .../cache/dumps/0003_cache_update_0.nft | 18 + .../cache/dumps/0004_cache_update_0.json-nft | 42 + .../cache/dumps/0004_cache_update_0.nft | 5 + .../dumps/0005_cache_chain_flush.json-nft | 77 + .../cache/dumps/0005_cache_chain_flush.nft | 14 + .../dumps/0006_cache_table_flush.json-nft | 77 + .../cache/dumps/0006_cache_table_flush.nft | 14 + .../dumps/0007_echo_cache_init_0.json-nft | 68 + .../dumps/0008_delete_by_handle_0.json-nft | 18 + .../cache/dumps/0008_delete_by_handle_0.nft | 2 + ...0009_delete_by_handle_incorrect_0.json-nft | 11 + .../0009_delete_by_handle_incorrect_0.nft | 0 .../cache/dumps/0010_implicit_chain_0.nft | 7 + .../cache/dumps/0011_index_0.json-nft | 93 + tests/shell/testcases/chains/0003jump_loop_1 | 3 +- .../testcases/chains/0010endless_jump_loop_1 | 2 +- .../testcases/chains/0011endless_jump_loop_1 | 2 +- tests/shell/testcases/chains/0014rename_0 | 2 +- .../testcases/chains/0018check_jump_loop_1 | 2 +- tests/shell/testcases/chains/0021prio_0 | 7 +- .../testcases/chains/0041chain_binding_0 | 5 + .../testcases/chains/0042chain_variable_0 | 23 +- .../testcases/chains/0043chain_ingress_0 | 9 +- .../testcases/chains/0044chain_destroy_0 | 12 + .../chains/dumps/0001jumps_0.json-nft | 371 ++ .../chains/dumps/0002jumps_1.json-nft | 383 ++ .../testcases/chains/dumps/0002jumps_1.nft | 68 + .../chains/dumps/0003jump_loop_1.json-nft | 375 ++ .../chains/dumps/0003jump_loop_1.nft | 65 + .../chains/dumps/0004busy_1.json-nft | 49 + .../testcases/chains/dumps/0004busy_1.nft | 8 + .../chains/dumps/0005busy_map_1.json-nft | 66 + .../testcases/chains/dumps/0005busy_map_1.nft | 8 + .../chains/dumps/0006masquerade_0.json-nft | 43 + .../chains/dumps/0007masquerade_1.json-nft | 30 + .../chains/dumps/0007masquerade_1.nft | 5 + .../dumps/0008masquerade_jump_1.json-nft | 51 + .../chains/dumps/0008masquerade_jump_1.nft | 9 + .../dumps/0009masquerade_jump_1.json-nft | 51 + .../chains/dumps/0009masquerade_jump_1.nft | 9 + .../dumps/0010endless_jump_loop_1.json-nft | 30 + .../chains/dumps/0010endless_jump_loop_1.nft | 5 + .../dumps/0011endless_jump_loop_1.json-nft | 79 + .../chains/dumps/0011endless_jump_loop_1.nft | 14 + .../chains/dumps/0013rename_0.json-nft | 26 + .../chains/dumps/0014rename_0.json-nft | 34 + .../testcases/chains/dumps/0014rename_0.nft | 7 + .../dumps/0015check_jump_loop_1.json-nft | 49 + .../chains/dumps/0015check_jump_loop_1.nft | 8 + .../chains/dumps/0016delete_handle_0.json-nft | 57 + .../dumps/0017masquerade_jump_1.json-nft | 53 + .../chains/dumps/0017masquerade_jump_1.nft | 9 + .../dumps/0018check_jump_loop_1.json-nft | 53 + .../chains/dumps/0018check_jump_loop_1.nft | 9 + .../dumps/0019masquerade_jump_1.json-nft | 70 + .../chains/dumps/0019masquerade_jump_1.nft | 9 + .../chains/dumps/0020depth_1.json-nft | 475 ++ .../testcases/chains/dumps/0020depth_1.nft | 84 + .../chains/dumps/0021prio_0.json-nft | 4743 +++++++++++++++ .../chains/dumps/0022prio_dummy_1.json-nft | 18 + .../chains/dumps/0022prio_dummy_1.nft | 2 + .../dumps/0023prio_inet_srcnat_1.json-nft | 32 + .../chains/dumps/0023prio_inet_srcnat_1.nft | 6 + .../dumps/0024prio_inet_dstnat_1.json-nft | 32 + .../chains/dumps/0024prio_inet_dstnat_1.nft | 6 + .../chains/dumps/0025prio_arp_1.json-nft | 18 + .../testcases/chains/dumps/0025prio_arp_1.nft | 2 + .../chains/dumps/0026prio_netdev_1.json-nft | 18 + .../chains/dumps/0026prio_netdev_1.nft | 2 + .../dumps/0027prio_bridge_dstnat_1.json-nft | 18 + .../chains/dumps/0027prio_bridge_dstnat_1.nft | 2 + .../dumps/0028prio_bridge_out_1.json-nft | 18 + .../chains/dumps/0028prio_bridge_out_1.nft | 2 + .../dumps/0029prio_bridge_srcnat_1.json-nft | 18 + .../chains/dumps/0029prio_bridge_srcnat_1.nft | 2 + .../chains/dumps/0030create_0.json-nft | 26 + .../dumps/0031priority_variable_0.json-nft | 30 + .../dumps/0032priority_variable_0.json-nft | 54 + .../dumps/0033priority_variable_1.json-nft | 11 + .../chains/dumps/0033priority_variable_1.nft | 0 .../dumps/0034priority_variable_1.json-nft | 11 + .../chains/dumps/0034priority_variable_1.nft | 0 .../dumps/0035policy_variable_0.json-nft | 30 + .../dumps/0036policy_variable_0.json-nft | 30 + .../dumps/0036policy_variable_0.nft} | 0 .../dumps/0037policy_variable_1.json-nft | 11 + .../chains/dumps/0037policy_variable_1.nft | 0 .../dumps/0038policy_variable_1.json-nft | 11 + .../chains/dumps/0038policy_variable_1.nft | 0 .../dumps/0039negative_priority_0.json-nft | 30 + .../chains/dumps/0039negative_priority_0.nft | 5 + .../dumps/0042chain_variable_0.json-nft | 90 + .../chains/dumps/0042chain_variable_0.nft | 8 +- .../chains/dumps/0043chain_ingress_0.json-nft | 55 + ...in_ingress.nft => 0043chain_ingress_0.nft} | 4 +- .../chains/dumps/0044chain_destroy_0.json-nft | 18 + .../chains/dumps/0044chain_destroy_0.nft | 2 + .../chains/dumps/jump_to_base_chain.nodump | 0 .../chains/dumps/netdev_chain_0.json-nft | 18 + .../testcases/chains/dumps/netdev_chain_0.nft | 2 + .../dumps/netdev_chain_autoremove.json-nft | 11 + .../chains/dumps/netdev_chain_autoremove.nft | 0 .../dumps/netdev_chain_dev_addremove.nodump | 0 .../chains/dumps/netdev_chain_dev_gone.nodump | 0 .../netdev_chain_dormant_autoremove.json-nft | 32 + .../dumps/netdev_chain_dormant_autoremove.nft | 7 + .../dumps/netdev_chain_multidev_gone.nodump | 0 .../dumps/netdev_multidev_netns_gone.nodump | 0 .../chains/dumps/netdev_netns_gone.nodump | 0 .../shell/testcases/chains/jump_to_base_chain | 25 + tests/shell/testcases/chains/netdev_chain_0 | 30 + .../testcases/chains/netdev_chain_autoremove | 9 + .../chains/netdev_chain_dev_addremove | 53 + .../testcases/chains/netdev_chain_dev_gone | 34 + .../chains/netdev_chain_dormant_autoremove | 14 + .../chains/netdev_chain_multidev_gone | 41 + .../shell/testcases/chains/netdev_move_device | 39 + .../chains/netdev_multidev_netns_gone | 43 + .../shell/testcases/chains/netdev_netns_gone | 37 + .../comments/dumps/comments_0.json-nft | 135 + .../flowtable/0012flowtable_variable_0 | 15 + .../testcases/flowtable/0013addafterdelete_0 | 2 - .../testcases/flowtable/0014addafterdelete_0 | 2 + .../flowtable/dumps/0001flowtable_0.json-nft | 53 + .../dumps/0002create_flowtable_0.json-nft | 29 + .../dumps/0002create_flowtable_0.nft | 6 + .../dumps/0003add_after_flush_0.json-nft | 29 + .../flowtable/dumps/0003add_after_flush_0.nft | 6 + .../dumps/0004delete_after_add_0.json-nft | 18 + .../dumps/0004delete_after_add_0.nft | 2 + .../dumps/0005delete_in_use_1.json-nft | 53 + .../flowtable/dumps/0005delete_in_use_1.nft | 10 + .../flowtable/dumps/0006segfault_0.json-nft | 18 + .../flowtable/dumps/0006segfault_0.nft | 2 + .../flowtable/dumps/0007prio_0.json-nft | 18 + .../testcases/flowtable/dumps/0007prio_0.nft | 2 + .../flowtable/dumps/0008prio_1.json-nft | 18 + .../testcases/flowtable/dumps/0008prio_1.nft | 2 + .../dumps/0009deleteafterflush_0.json-nft | 26 + .../dumps/0009deleteafterflush_0.nft | 4 + .../dumps/0010delete_handle_0.json-nft | 18 + .../flowtable/dumps/0010delete_handle_0.nft | 2 + .../dumps/0011deleteafterflush_0.json-nft | 26 + .../dumps/0011deleteafterflush_0.nft | 4 + .../dumps/0012flowtable_variable_0.json-nft | 47 + .../dumps/0012flowtable_variable_0.nft | 4 +- .../dumps/0013addafterdelete_0.json-nft | 29 + .../flowtable/dumps/0013addafterdelete_0.nft | 6 + .../dumps/0014addafterdelete_0.json-nft | 63 + .../flowtable/dumps/0014addafterdelete_0.nft | 12 + .../flowtable/dumps/0015destroy_0.json-nft | 18 + .../flowtable/dumps/0015destroy_0.nft | 2 + tests/shell/testcases/include/0002relative_0 | 23 +- .../shell/testcases/include/0003includepath_0 | 4 +- .../0013input_descriptors_included_files_0 | 30 +- .../testcases/include/0020include_chain_0 | 6 +- .../include/dumps/0001absolute_0.json-nft | 18 + .../include/dumps/0002relative_0.json-nft | 18 + .../include/dumps/0003includepath_0.json-nft | 18 + .../include/dumps/0004endlessloop_1.json-nft | 11 + .../include/dumps/0004endlessloop_1.nft | 0 .../include/dumps/0005glob_empty_0.json-nft | 11 + .../include/dumps/0005glob_empty_0.nft | 0 .../include/dumps/0006glob_single_0.json-nft | 18 + .../include/dumps/0007glob_double_0.json-nft | 25 + .../dumps/0008glob_nofile_wildcard_0.json-nft | 11 + .../dumps/0008glob_nofile_wildcard_0.nft | 0 .../include/dumps/0009glob_nofile_1.json-nft | 11 + .../include/dumps/0009glob_nofile_1.nft | 0 .../dumps/0010glob_broken_file_1.json-nft | 11 + .../include/dumps/0010glob_broken_file_1.nft | 0 .../dumps/0011glob_dependency_0.json-nft | 26 + .../dumps/0012glob_dependency_1.json-nft | 11 + .../include/dumps/0012glob_dependency_1.nft | 0 .../include/dumps/0013glob_dotfile_0.json-nft | 18 + ...nput_descriptors_included_files_0.json-nft | 11 + ...0013input_descriptors_included_files_0.nft | 0 .../dumps/0014glob_directory_0.json-nft | 11 + .../include/dumps/0014glob_directory_0.nft | 0 .../dumps/0015doubleincludepath_0.json-nft | 26 + .../include/dumps/0016maxdepth_0.json-nft | 11 + .../include/dumps/0016maxdepth_0.nft | 0 .../0017glob_more_than_maxdepth_1.json-nft | 11 + .../dumps/0017glob_more_than_maxdepth_1.nft | 0 .../dumps/0018include_error_0.json-nft | 11 + .../include/dumps/0018include_error_0.nft | 0 .../dumps/0019include_error_0.json-nft | 11 + .../include/dumps/0019include_error_0.nft | 0 .../dumps/0020include_chain_0.json-nft | 128 + .../include/dumps/glob_duplicated_include.nft | 6 + .../testcases/include/glob_duplicated_include | 19 + .../shell/testcases/json/0001set_statements_0 | 2 + tests/shell/testcases/json/0002table_map_0 | 3 + .../testcases/json/0003json_schema_version_0 | 2 + .../testcases/json/0004json_schema_version_1 | 2 + .../shell/testcases/json/0005secmark_objref_0 | 3 + tests/shell/testcases/json/0006obj_comment_0 | 3 + .../json/dumps/0001set_statements_0.json-nft | 98 + .../json/dumps/0002table_map_0.json-nft | 33 + .../dumps/0003json_schema_version_0.json-nft | 11 + .../dumps/0004json_schema_version_1.json-nft | 11 + .../json/dumps/0005secmark_objref_0.json-nft | 233 + .../json/dumps/0006obj_comment_0.json-nft | 29 + .../testcases/json/dumps/netdev.json-nft | 18 + tests/shell/testcases/json/dumps/netdev.nft | 2 + tests/shell/testcases/json/netdev | 23 +- tests/shell/testcases/json/single_flag | 190 + tests/shell/testcases/listing/0013objects_0 | 50 +- tests/shell/testcases/listing/0020flowtable_0 | 20 +- .../listing/0021ruleset_json_terse_0 | 13 +- .../listing/dumps/0001ruleset_0.json-nft | 18 + .../listing/dumps/0002ruleset_0.json-nft | 11 + .../testcases/listing/dumps/0002ruleset_0.nft | 0 .../listing/dumps/0003table_0.json-nft | 18 + .../testcases/listing/dumps/0003table_0.nft | 2 + .../listing/dumps/0004table_0.json-nft | 25 + .../testcases/listing/dumps/0004table_0.nft | 4 + .../listing/dumps/0005ruleset_ip_0.json-nft | 46 + .../listing/dumps/0005ruleset_ip_0.nft | 10 + .../listing/dumps/0006ruleset_ip6_0.json-nft | 46 + .../listing/dumps/0006ruleset_ip6_0.nft | 10 + .../listing/dumps/0007ruleset_inet_0.json-nft | 46 + .../listing/dumps/0007ruleset_inet_0.nft | 10 + .../listing/dumps/0008ruleset_arp_0.json-nft | 46 + .../listing/dumps/0008ruleset_arp_0.nft | 10 + .../dumps/0009ruleset_bridge_0.json-nft | 46 + .../listing/dumps/0009ruleset_bridge_0.nft | 10 + .../listing/dumps/0010sets_0.json-nft | 120 + .../testcases/listing/dumps/0010sets_0.nft | 39 + .../listing/dumps/0011sets_0.json-nft | 220 + .../testcases/listing/dumps/0011sets_0.nft | 25 + .../listing/dumps/0012sets_0.json-nft | 120 + .../testcases/listing/dumps/0012sets_0.nft | 39 + .../listing/dumps/0013objects_0.json-nft | 75 + .../testcases/listing/dumps/0013objects_0.nft | 27 + .../listing/dumps/0014objects_0.json-nft | 47 + .../testcases/listing/dumps/0014objects_0.nft | 12 + .../listing/dumps/0015dynamic_0.json-nft | 38 + .../testcases/listing/dumps/0015dynamic_0.nft | 7 + .../listing/dumps/0016anonymous_0.json-nft | 85 + .../listing/dumps/0016anonymous_0.nft | 6 + .../listing/dumps/0017objects_0.json-nft | 28 + .../testcases/listing/dumps/0017objects_0.nft | 5 + .../listing/dumps/0018data_0.json-nft | 28 + .../testcases/listing/dumps/0018data_0.nft | 5 + .../listing/dumps/0019set_0.json-nft | 27 + .../testcases/listing/dumps/0019set_0.nft | 5 + .../listing/dumps/0020flowtable_0.json-nft | 67 + .../listing/dumps/0020flowtable_0.nft | 20 + .../dumps/0021ruleset_json_terse_0.json-nft | 39 + .../dumps/0021ruleset_json_terse_0.nft | 9 + .../listing/dumps/0022terse_0.json-nft | 86 + .../testcases/listing/dumps/0022terse_0.nft | 12 + .../testcases/listing/dumps/meta_time.nft | 32 - .../testcases/listing/dumps/meta_time.nodump | 0 tests/shell/testcases/listing/meta_time | 2 + tests/shell/testcases/listing/reset_objects | 104 + .../maps/0003map_add_many_elements_0 | 9 +- .../maps/0004interval_map_create_once_0 | 17 +- .../testcases/maps/0008interval_map_delete_0 | 3 +- tests/shell/testcases/maps/0009vmap_0 | 2 + tests/shell/testcases/maps/0010concat_map_0 | 2 + tests/shell/testcases/maps/0011vmap_0 | 10 +- tests/shell/testcases/maps/0012map_0 | 19 - tests/shell/testcases/maps/0012map_concat_0 | 24 + tests/shell/testcases/maps/0013map_0 | 2 + tests/shell/testcases/maps/0014destroy_0 | 12 + tests/shell/testcases/maps/0016map_leak_0 | 38 + .../shell/testcases/maps/0017_map_variable_0 | 13 +- .../testcases/maps/0018map_leak_timeout_0 | 50 + .../{sets => maps}/0024named_objects_0 | 15 - tests/shell/testcases/maps/anon_objmap_concat | 2 + tests/shell/testcases/maps/delete_element | 28 + .../testcases/maps/delete_element_catchall | 35 + .../0003map_add_many_elements_0.json-nft | 3874 +++++++++++++ .../dumps/0003map_add_many_elements_0.nft | 966 ++++ .../0004interval_map_create_once_0.nodump | 0 ...5interval_map_add_many_elements_0.json-nft | 67 + .../0005interval_map_add_many_elements_0.nft | 6 +- .../dumps/0006interval_map_overlap_0.json-nft | 49 + .../maps/dumps/0006interval_map_overlap_0.nft | 3 +- .../dumps/0007named_ifname_dtype_0.json-nft | 102 + .../dumps/0008interval_map_delete_0.json-nft | 157 + .../maps/dumps/0008interval_map_delete_0.nft | 16 + .../testcases/maps/dumps/0009vmap_0.json-nft | 117 + .../maps/dumps/0010concat_map_0.json-nft | 106 + .../testcases/maps/dumps/0011vmap_0.json-nft | 145 + .../shell/testcases/maps/dumps/0011vmap_0.nft | 3 +- .../testcases/maps/dumps/0012map_0.json-nft | 97 + .../shell/testcases/maps/dumps/0012map_0.nft | 13 - .../maps/dumps/0012map_concat_0.json-nft | 143 + .../testcases/maps/dumps/0012map_concat_0.nft | 14 + .../testcases/maps/dumps/0013map_0.json-nft | 126 + .../maps/dumps/0014destroy_0.json-nft | 18 + .../testcases/maps/dumps/0014destroy_0.nft | 2 + .../maps/dumps/0016map_leak_0.json-nft | 11 + .../testcases/maps/dumps/0016map_leak_0.nft | 0 .../maps/dumps/0017_map_variable_0.json-nft | 72 + .../maps/dumps/0017_map_variable_0.nft | 13 + .../dumps/0018map_leak_timeout_0.json-nft | 11 + .../maps/dumps/0018map_leak_timeout_0.nft | 0 .../maps/dumps/0024named_objects_0.json-nft | 165 + .../dumps/0024named_objects_0.nft | 21 +- .../maps/dumps/0024named_objects_2.nodump | 0 .../maps/dumps/anon_objmap_concat.json-nft | 116 + .../maps/dumps/anonymous_snat_map_0.json-nft | 58 + .../maps/dumps/anonymous_snat_map_2.nodump | 0 .../testcases/maps/dumps/delete_element.nft | 12 + .../maps/dumps/delete_element_catchall.nft | 12 + .../maps/dumps/different_map_types_1.json-nft | 30 + .../maps/dumps/different_map_types_1.nft | 5 + .../map_catchall_double_deactivate.json-nft | 26 + .../dumps/map_catchall_double_deactivate.nft | 4 + .../dumps/map_catchall_double_free.nodump | 0 .../dumps/map_catchall_double_free_2.json-nft | 46 + .../maps/dumps/map_catchall_double_free_2.nft | 9 + .../maps/dumps/map_with_flags_0.json-nft | 29 + .../testcases/maps/dumps/named_ct_objects.nft | 71 + .../maps/dumps/named_limits.json-nft | 363 ++ .../testcases/maps/dumps/named_limits.nft | 55 + .../maps/dumps/named_snat_map_0.json-nft | 67 + .../maps/dumps/pipapo_double_flush.json-nft | 40 + .../maps/dumps/pipapo_double_flush.nft | 9 + .../testcases/maps/dumps/typeof_integer_0.nft | 4 +- .../testcases/maps/dumps/typeof_maps_0.nft | 3 +- .../dumps/typeof_maps_add_delete.json-nft | 288 + .../maps/dumps/typeof_maps_add_delete.nft | 22 + .../maps/dumps/typeof_maps_update_0.json-nft | 113 + .../testcases/maps/dumps/typeof_raw_0.nft | 4 +- .../maps/dumps/vmap_mark_bitwise_0.json-nft | 158 + .../maps/dumps/vmap_mark_bitwise_0.nft | 3 +- .../maps/dumps/vmap_timeout.json-nft | 239 + .../testcases/maps/dumps/vmap_timeout.nft | 36 + .../maps/map_catchall_double_deactivate | 13 + .../testcases/maps/map_catchall_double_free | 13 + .../testcases/maps/map_catchall_double_free_2 | 27 + tests/shell/testcases/maps/named_ct_objects | 95 + tests/shell/testcases/maps/named_limits | 61 + tests/shell/testcases/maps/nat_addr_port | 5 + .../shell/testcases/maps/pipapo_double_flush | 25 + tests/shell/testcases/maps/typeof_integer_0 | 6 +- tests/shell/testcases/maps/typeof_maps_0 | 69 +- .../testcases/maps/typeof_maps_add_delete | 56 + tests/shell/testcases/maps/typeof_raw_0 | 4 +- .../shell/testcases/maps/vmap_mark_bitwise_0 | 2 + tests/shell/testcases/maps/vmap_timeout | 92 + tests/shell/testcases/maps/vmap_unary | 2 + .../netns/dumps/0001nft-f_0.json-nft | 11 + .../testcases/netns/dumps/0001nft-f_0.nft | 0 .../netns/dumps/0002loosecommands_0.json-nft | 11 + .../netns/dumps/0002loosecommands_0.nft | 0 .../testcases/netns/dumps/0003many_0.json-nft | 11 + .../testcases/netns/dumps/0003many_0.nft | 0 tests/shell/testcases/nft-f/0011manydefines_0 | 16 + .../testcases/nft-f/0017ct_timeout_obj_0 | 2 + .../testcases/nft-f/0018ct_expectation_obj_0 | 2 + .../shell/testcases/nft-f/0025empty_dynset_0 | 8 + tests/shell/testcases/nft-f/0032pknock_0 | 34 + .../nft-f/dumps/0001define_slash_0.json-nft | 11 + .../nft-f/dumps/0001define_slash_0.nft | 0 .../nft-f/dumps/0002rollback_rule_0.json-nft | 134 + .../nft-f/dumps/0003rollback_jump_0.json-nft | 134 + .../nft-f/dumps/0004rollback_set_0.json-nft | 134 + .../nft-f/dumps/0005rollback_map_0.json-nft | 134 + .../nft-f/dumps/0006action_object_0.json-nft | 11 + .../nft-f/dumps/0006action_object_0.nft | 0 .../0007action_object_set_segfault_1.json-nft | 11 + .../0007action_object_set_segfault_1.nft | 0 .../nft-f/dumps/0008split_tables_0.json-nft | 67 + .../nft-f/dumps/0009variable_0.json-nft | 44 + .../nft-f/dumps/0010variable_0.json-nft | 30 + .../nft-f/dumps/0011manydefines_0.nodump | 0 .../nft-f/dumps/0013defines_1.json-nft | 11 + .../testcases/nft-f/dumps/0013defines_1.nft | 0 .../nft-f/dumps/0014defines_1.json-nft | 11 + .../testcases/nft-f/dumps/0014defines_1.nft | 0 .../nft-f/dumps/0015defines_1.json-nft | 11 + .../testcases/nft-f/dumps/0015defines_1.nft | 0 .../nft-f/dumps/0016redefines_1.json-nft | 80 + .../testcases/nft-f/dumps/0016redefines_1.nft | 6 + .../nft-f/dumps/0017ct_timeout_obj_0.json-nft | 53 + .../dumps/0018ct_expectation_obj_0.json-nft | 52 + .../nft-f/dumps/0018ct_expectation_obj_0.nft | 13 + .../nft-f/dumps/0018jump_variable_0.json-nft | 49 + .../nft-f/dumps/0019jump_variable_1.json-nft | 11 + .../nft-f/dumps/0019jump_variable_1.nft | 0 .../nft-f/dumps/0020jump_variable_1.json-nft | 11 + .../nft-f/dumps/0020jump_variable_1.nft | 0 .../nft-f/dumps/0021list_ruleset_0.json-nft | 30 + .../nft-f/dumps/0022variables_0.json-nft | 115 + .../nft-f/dumps/0023check_1.json-nft | 30 + .../testcases/nft-f/dumps/0023check_1.nft | 5 + .../nft-f/dumps/0024priority_0.json-nft | 95 + .../nft-f/dumps/0025empty_dynset_0.json-nft | 105 + .../nft-f/dumps/0026listing_0.json-nft | 56 + .../testcases/nft-f/dumps/0026listing_0.nft | 5 + .../nft-f/dumps/0027split_chains_0.json-nft | 53 + .../dumps/0028variable_cmdline_0.json-nft | 34 + .../nft-f/dumps/0029split_file_0.json-nft | 61 + .../nft-f/dumps/0029split_file_0.nft | 10 + .../nft-f/dumps/0030variable_reuse_0.json-nft | 44 + .../nft-f/dumps/0031vmap_string_0.json-nft | 11 + .../nft-f/dumps/0031vmap_string_0.nft | 0 .../nft-f/dumps/0032pknock_0.json-nft | 484 ++ .../testcases/nft-f/dumps/0032pknock_0.nft | 25 + tests/shell/testcases/nft-f/sample-ruleset | 262 + .../nft-i/dumps/0001define_0.json-nft | 11 + .../testcases/nft-i/dumps/0001define_0.nft | 0 tests/shell/testcases/nft-i/dumps/index_0.nft | 8 + tests/shell/testcases/nft-i/dumps/set_0.nft | 7 + tests/shell/testcases/nft-i/index_0 | 11 + tests/shell/testcases/nft-i/set_0 | 9 + .../dumps/dependency_kill.json-nft | 776 +++ .../optimizations/dumps/merge_nat.json-nft | 379 ++ .../optimizations/dumps/merge_nat.nft | 19 - .../dumps/merge_nat_concat.json-nft | 200 + .../optimizations/dumps/merge_nat_concat.nft | 8 + .../dumps/merge_nat_inet.json-nft | 208 + .../optimizations/dumps/merge_nat_inet.nft | 11 + .../optimizations/dumps/merge_reject.json-nft | 320 + .../optimizations/dumps/merge_stmts.json-nft | 63 + .../dumps/merge_stmts_concat_vmap.json-nft | 167 + .../dumps/merge_stmts_vmap.json-nft | 182 + .../dumps/merge_vmap_raw.json-nft | 438 ++ .../optimizations/dumps/merge_vmaps.json-nft | 203 + .../dumps/not_mergeable.json-nft | 140 + .../optimizations/dumps/ruleset.json-nft | 11 + .../testcases/optimizations/dumps/ruleset.nft | 0 .../dumps/single_anon_set.json-nft | 360 ++ .../optimizations/dumps/single_anon_set.nft | 1 - .../dumps/single_anon_set.nft.input | 38 - .../dumps/single_anon_set_expr.json-nft | 59 + .../dumps/single_anon_set_expr.nft | 5 + .../optimizations/dumps/skip_merge.json-nft | 235 + .../optimizations/dumps/skip_non_eq.json-nft | 108 + .../dumps/skip_unsupported.json-nft | 254 + .../optimizations/dumps/variables.json-nft | 11 + .../optimizations/dumps/variables.nft | 0 tests/shell/testcases/optimizations/merge_nat | 29 - .../testcases/optimizations/merge_nat_concat | 18 + .../testcases/optimizations/merge_nat_inet | 21 + .../optimizations/merge_stmts_concat | 2 + .../testcases/optimizations/merge_stmts_vmap | 2 + .../testcases/optimizations/merge_vmap_raw | 2 + tests/shell/testcases/optimizations/ruleset | 3 + .../testcases/optimizations/single_anon_set | 44 +- .../optimizations/single_anon_set_expr | 26 + .../testcases/optionals/comments_chain_0 | 2 + .../testcases/optionals/comments_objects_0 | 24 +- .../testcases/optionals/comments_table_0 | 2 + .../optionals/dumps/comments_0.json-nft | 58 + .../optionals/dumps/comments_chain_0.json-nft | 27 + .../dumps/comments_handles_0.json-nft | 58 + .../dumps/comments_objects_0.json-nft | 102 + .../optionals/dumps/comments_objects_0.nft | 7 +- .../dumps/comments_objects_dup_0.json-nft | 11 + .../dumps/comments_objects_dup_0.nft | 0 .../optionals/dumps/comments_table_0.json-nft | 19 + .../dumps/delete_object_handles_0.json-nft | 67 + .../dumps/delete_object_handles_0.nft | 18 + .../optionals/dumps/handles_0.json-nft | 57 + .../optionals/dumps/handles_1.json-nft | 57 + .../testcases/optionals/dumps/handles_1.nft | 5 + .../optionals/dumps/log_prefix_0.json-nft | 52 + .../dumps/update_object_handles_0.json-nft | 39 + .../dumps/update_object_handles_0.nft | 9 + .../optionals/update_object_handles_0 | 2 + .../shell/testcases/owner/0001-flowtable-uaf | 2 + tests/shell/testcases/owner/0002-persist | 79 + .../owner/dumps/0001-flowtable-uaf.json-nft | 11 + .../owner/dumps/0001-flowtable-uaf.nft | 0 .../owner/dumps/0002-persist.json-nft | 11 + .../testcases/owner/dumps/0002-persist.nft | 0 tests/shell/testcases/packetpath/cgroupv2 | 143 + .../packetpath/dumps/cgroupv2.nodump | 0 .../packetpath/dumps/flowtables.nodump | 0 .../testcases/packetpath/dumps/payload.nodump | 0 .../packetpath/dumps/policy.json-nft | 121 + .../testcases/packetpath/dumps/policy.nft | 11 + .../packetpath/dumps/set_lookups.json-nft | 696 +++ .../packetpath/dumps/set_lookups.nft | 51 + .../packetpath/dumps/tcp_reset.json-nft | 168 + .../testcases/packetpath/dumps/tcp_reset.nft | 13 + .../packetpath/dumps/vlan_8021ad_tag.nodump | 0 .../packetpath/dumps/vlan_mangling.nodump | 0 .../packetpath/dumps/vlan_qinq.nodump | 0 tests/shell/testcases/packetpath/flowtables | 122 + .../shell/testcases/packetpath/match_l4proto | 150 + tests/shell/testcases/packetpath/nat_ftp | 178 + tests/shell/testcases/packetpath/payload | 252 + tests/shell/testcases/packetpath/policy | 42 + tests/shell/testcases/packetpath/set_lookups | 66 + tests/shell/testcases/packetpath/tcp_options | 9 +- tests/shell/testcases/packetpath/tcp_reset | 31 + .../testcases/packetpath/vlan_8021ad_tag | 50 + .../shell/testcases/packetpath/vlan_mangling | 79 + tests/shell/testcases/packetpath/vlan_qinq | 73 + .../testcases/parsing/dumps/describe.json-nft | 11 + .../testcases/parsing/dumps/describe.nft | 0 .../parsing/dumps/large_rule_pipe.json-nft | 4079 +++++++++++++ .../parsing/dumps/large_rule_pipe.nft | 561 ++ .../testcases/parsing/dumps/log.json-nft | 11 + tests/shell/testcases/parsing/dumps/log.nft | 0 .../testcases/parsing/dumps/octal.json-nft | 11 + tests/shell/testcases/parsing/dumps/octal.nft | 0 tests/shell/testcases/parsing/large_rule_pipe | 571 ++ .../testcases/rule_management/0004replace_0 | 8 +- .../testcases/rule_management/0010replace_0 | 2 +- .../testcases/rule_management/0011reset_0 | 187 + .../testcases/rule_management/0012destroy_0 | 14 + .../dumps/0001addinsertposition_0.json-nft | 65 + .../dumps/0001addinsertposition_0.nft | 7 + .../dumps/0002addinsertlocation_1.json-nft | 52 + .../dumps/0002addinsertlocation_1.nft | 6 + .../dumps/0003insert_0.json-nft | 102 + .../dumps/0004replace_0.json-nft | 84 + .../rule_management/dumps/0004replace_0.nft | 11 +- .../dumps/0005replace_1.json-nft | 26 + .../rule_management/dumps/0005replace_1.nft | 4 + .../dumps/0006replace_1.json-nft | 26 + .../rule_management/dumps/0006replace_1.nft | 4 + .../dumps/0007delete_0.json-nft | 39 + .../dumps/0008delete_1.json-nft | 26 + .../rule_management/dumps/0008delete_1.nft | 4 + .../dumps/0009delete_1.json-nft | 26 + .../rule_management/dumps/0009delete_1.nft | 4 + .../dumps/0010replace_0.json-nft | 11 + .../rule_management/dumps/0010replace_0.nft | 0 .../dumps/0011reset_0.json-nft | 255 + .../rule_management/dumps/0011reset_0.nft | 31 + .../dumps/0012destroy_0.json-nft | 26 + .../rule_management/dumps/0012destroy_0.nft | 4 + .../testcases/sets/0011add_many_elements_0 | 15 + .../sets/0012add_delete_many_elements_0 | 14 + .../sets/0013add_delete_many_elements_0 | 14 + tests/shell/testcases/sets/0020comments_0 | 2 + .../testcases/sets/0022type_selective_flush_0 | 2 +- tests/shell/testcases/sets/0024synproxy_0 | 31 + .../sets/0030add_many_elements_interval_0 | 14 + tests/shell/testcases/sets/0034get_element_0 | 2 + .../sets/0036add_set_element_expiration_0 | 18 +- tests/shell/testcases/sets/0038meter_list_0 | 7 +- .../testcases/sets/0043concatenated_ranges_0 | 12 +- .../testcases/sets/0043concatenated_ranges_1 | 4 +- .../testcases/sets/0044interval_overlap_0 | 16 +- .../testcases/sets/0044interval_overlap_1 | 4 +- tests/shell/testcases/sets/0046netmap_0 | 2 + tests/shell/testcases/sets/0047nat_0 | 2 + tests/shell/testcases/sets/0048set_counters_0 | 2 + .../testcases/sets/0051set_interval_counter_0 | 2 + .../testcases/sets/0059set_update_multistmt_0 | 2 + .../shell/testcases/sets/0060set_multistmt_0 | 2 + .../shell/testcases/sets/0060set_multistmt_1 | 2 + .../shell/testcases/sets/0062set_connlimit_0 | 5 + tests/shell/testcases/sets/0063set_catchall_0 | 2 + tests/shell/testcases/sets/0064map_catchall_0 | 2 + .../testcases/sets/0067nat_concat_interval_0 | 17 +- tests/shell/testcases/sets/0067nat_interval_0 | 18 + .../sets/0068interval_stack_overflow_0 | 18 +- tests/shell/testcases/sets/0072destroy_0 | 12 + .../testcases/sets/0073flat_interval_set | 11 + .../testcases/sets/0074nested_interval_set | 6 + tests/shell/testcases/sets/automerge_0 | 79 +- tests/shell/testcases/sets/collapse_elem_0 | 6 + tests/shell/testcases/sets/concat_interval_0 | 2 + .../sets/dumps/0001named_interval_0.json-nft | 253 + .../0002named_interval_automerging_0.json-nft | 42 + ...0003named_interval_missing_flag_0.json-nft | 27 + .../0004named_interval_shadow_0.json-nft | 36 + .../0005named_interval_shadow_0.json-nft | 36 + .../sets/dumps/0006create_set_0.json-nft | 27 + .../sets/dumps/0007create_element_0.json-nft | 30 + .../dumps/0008comments_interval_0.json-nft | 36 + .../dumps/0008create_verdict_map_0.json-nft | 78 + .../dumps/0009comments_timeout_0.json-nft | 36 + .../sets/dumps/0010comments_0.json-nft | 35 + .../sets/dumps/0011add_many_elements_0.nodump | 0 .../0012add_delete_many_elements_0.json-nft | 27 + .../0013add_delete_many_elements_0.json-nft | 27 + ...014malformed_set_is_not_defined_0.json-nft | 11 + .../0014malformed_set_is_not_defined_0.nft | 0 .../sets/dumps/0015rulesetflush_0.json-nft | 51 + .../sets/dumps/0016element_leak_0.json-nft | 31 + .../sets/dumps/0017add_after_flush_0.json-nft | 31 + .../sets/dumps/0018set_check_size_1.json-nft | 32 + .../sets/dumps/0018set_check_size_1.nft | 7 + .../sets/dumps/0019set_check_size_0.json-nft | 32 + .../sets/dumps/0020comments_0.json-nft | 35 + .../sets/dumps/0021nesting_0.json-nft | 69 + .../dumps/0022type_selective_flush_0.json-nft | 99 + .../sets/dumps/0022type_selective_flush_0.nft | 8 +- .../0023incomplete_add_set_command_0.json-nft | 18 + .../sets/dumps/0024named_objects_0.json-nft | 165 + .../sets/dumps/0024synproxy_0.json-nft | 129 + .../testcases/sets/dumps/0024synproxy_0.nft | 24 + .../sets/dumps/0025anonymous_set_0.json-nft | 102 + .../sets/dumps/0026named_limit_0.json-nft | 75 + .../sets/dumps/0027ipv6_maps_ipv4_0.json-nft | 36 + .../sets/dumps/0028autoselect_0.json-nft | 162 + .../testcases/sets/dumps/0028autoselect_0.nft | 26 + .../sets/dumps/0028delete_handle_0.json-nft | 51 + .../sets/dumps/0028delete_handle_0.nft | 15 + .../0030add_many_elements_interval_0.nodump | 0 .../sets/dumps/0031set_timeout_size_0.nodump | 0 .../dumps/0032restore_set_simple_0.json-nft | 45 + .../dumps/0033add_set_simple_flat_0.json-nft | 45 + .../sets/dumps/0033add_set_simple_flat_0.nft | 11 + .../sets/dumps/0034get_element_0.json-nft | 134 + .../sets/dumps/0034get_element_0.nft | 23 + .../0035add_set_elements_flat_0.json-nft | 28 + .../dumps/0035add_set_elements_flat_0.nft | 6 + .../0036add_set_element_expiration_0.nodump | 0 .../0037_set_with_inet_service_0.json-nft | 159 + .../sets/dumps/0038meter_list_0.json-nft | 94 + .../testcases/sets/dumps/0038meter_list_0.nft | 8 +- .../sets/dumps/0039delete_interval_0.json-nft | 37 + .../sets/dumps/0039delete_interval_0.nft | 7 + .../0040get_host_endian_elements_0.json-nft | 37 + .../dumps/0040get_host_endian_elements_0.nft | 7 + .../sets/dumps/0041interval_0.json-nft | 31 + .../testcases/sets/dumps/0041interval_0.nft | 7 + .../sets/dumps/0042update_set_0.json-nft | 85 + .../testcases/sets/dumps/0042update_set_0.nft | 15 + .../dumps/0043concatenated_ranges_0.json-nft | 98 + .../sets/dumps/0043concatenated_ranges_0.nft | 11 + .../dumps/0043concatenated_ranges_1.json-nft | 1719 ++++++ .../sets/dumps/0043concatenated_ranges_1.nft | 116 + .../sets/dumps/0044interval_overlap_0.nodump | 0 .../dumps/0044interval_overlap_1.json-nft | 527 ++ .../sets/dumps/0044interval_overlap_1.nft | 106 + .../dumps/0045concat_ipv4_service.json-nft | 95 + .../sets/dumps/0046netmap_0.json-nft | 167 + .../shell/testcases/sets/dumps/0047nat_0.nft | 3 +- .../sets/dumps/0048set_counters_0.json-nft | 102 + .../sets/dumps/0048set_counters_0.nft | 3 +- .../sets/dumps/0049set_define_0.json-nft | 92 + .../sets/dumps/0050set_define_1.json-nft | 11 + .../testcases/sets/dumps/0050set_define_1.nft | 0 .../dumps/0051set_interval_counter_0.json-nft | 83 + .../sets/dumps/0052overlap_0.json-nft | 33 + .../testcases/sets/dumps/0053echo_0.json-nft | 101 + .../sets/dumps/0054comments_set_0.json-nft | 41 + .../sets/dumps/0055tcpflags_0.json-nft | 4 +- .../sets/dumps/0056dynamic_limit_0.json-nft | 11 + .../sets/dumps/0056dynamic_limit_0.nft | 0 .../dumps/0057set_create_fails_0.json-nft | 31 + .../sets/dumps/0057set_create_fails_0.nft | 7 + .../dumps/0058_setupdate_timeout_0.json-nft | 68 + .../dumps/0059set_update_multistmt_0.json-nft | 79 + .../sets/dumps/0060set_multistmt_0.json-nft | 105 + .../sets/dumps/0060set_multistmt_0.nft | 3 +- .../sets/dumps/0060set_multistmt_1.json-nft | 103 + .../sets/dumps/0060set_multistmt_1.nft | 3 +- .../dumps/0061anonymous_automerge_0.json-nft | 57 + .../sets/dumps/0062set_connlimit_0.json-nft | 48 + .../sets/dumps/0062set_connlimit_0.nft | 14 + .../sets/dumps/0063set_catchall_0.json-nft | 92 + .../sets/dumps/0063set_catchall_0.nft | 6 +- .../sets/dumps/0064map_catchall_0.json-nft | 218 + .../sets/dumps/0064map_catchall_0.nft | 6 +- .../dumps/0065_icmp_postprocessing.json-nft | 78 + .../sets/dumps/0065_icmp_postprocessing.nft | 6 + .../sets/dumps/0067nat_concat_interval_0.nft | 7 - .../sets/dumps/0067nat_interval_0.nft | 13 + .../0068interval_stack_overflow_0.nodump | 0 .../sets/dumps/0069interval_merge_0.json-nft | 49 + .../0071unclosed_prefix_interval_0.json-nft | 124 + .../sets/dumps/0072destroy_0.json-nft | 18 + .../testcases/sets/dumps/0072destroy_0.nft | 2 + .../sets/dumps/0073flat_interval_set.json-nft | 50 + .../sets/dumps/0073flat_interval_set.nft | 11 + .../dumps/0074nested_interval_set.json-nft | 50 + .../sets/dumps/0074nested_interval_set.nft | 11 + .../testcases/sets/dumps/automerge_0.nodump | 0 .../sets/dumps/collapse_elem_0.json-nft | 53 + .../testcases/sets/dumps/collapse_elem_0.nft | 2 +- .../sets/dumps/concat_interval_0.json-nft | 64 + .../sets/dumps/dynset_missing.json-nft | 81 + .../sets/dumps/elem_opts_compat_0.nodump | 0 .../testcases/sets/dumps/errors_0.json-nft | 11 + tests/shell/testcases/sets/dumps/errors_0.nft | 0 .../sets/dumps/exact_overlap_0.json-nft | 108 + .../testcases/sets/dumps/exact_overlap_0.nft | 13 + .../testcases/sets/dumps/inner_0.json-nft | 229 + tests/shell/testcases/sets/dumps/inner_0.nft | 18 + .../testcases/sets/dumps/meter_0.json-nft | 203 + tests/shell/testcases/sets/dumps/meter_0.nft | 29 + .../sets/dumps/meter_set_reuse.json-nft | 103 + .../testcases/sets/dumps/meter_set_reuse.nft | 11 + .../dumps/range_with_same_start_end.json-nft | 33 + .../sets/dumps/range_with_same_start_end.nft | 7 + .../sets/dumps/reset_command_0.nodump | 0 .../set_element_timeout_updates.json-nft | 48 + .../dumps/set_element_timeout_updates.nft | 10 + .../testcases/sets/dumps/set_eval_0.json-nft | 83 + tests/shell/testcases/sets/dumps/set_stmt.nft | 66 + .../sets/dumps/sets_with_ifnames.json-nft | 545 ++ .../sets/dumps/type_set_symbol.json-nft | 114 + .../testcases/sets/dumps/typeof_raw_0.nft | 4 +- .../testcases/sets/dumps/typeof_sets_0.nft | 28 + .../sets/dumps/typeof_sets_concat.nft | 11 + tests/shell/testcases/sets/elem_limit_0 | 2 +- tests/shell/testcases/sets/elem_opts_compat_0 | 2 + tests/shell/testcases/sets/inner_0 | 27 + tests/shell/testcases/sets/interval_size | 44 + .../shell/testcases/sets/interval_size_random | 115 + tests/shell/testcases/sets/meter_0 | 18 + tests/shell/testcases/sets/meter_set_reuse | 20 + .../testcases/sets/range_with_same_start_end | 13 + tests/shell/testcases/sets/reset_command_0 | 137 + .../sets/set_element_timeout_updates | 120 + tests/shell/testcases/sets/set_stmt | 50 + tests/shell/testcases/sets/sets_with_ifnames | 2 + tests/shell/testcases/sets/typeof_raw_0 | 4 +- tests/shell/testcases/sets/typeof_sets_0 | 233 +- tests/shell/testcases/sets/typeof_sets_concat | 2 + tests/shell/testcases/transactions/0023rule_1 | 2 +- tests/shell/testcases/transactions/0024rule_0 | 2 + tests/shell/testcases/transactions/0049huge_0 | 35 +- tests/shell/testcases/transactions/0050rule_1 | 4 + tests/shell/testcases/transactions/0051map_0 | 122 + tests/shell/testcases/transactions/30s-stress | 709 +++ .../testcases/transactions/anon_chain_loop | 19 + .../testcases/transactions/atomic_replace.sh | 73 + .../testcases/transactions/bad_expression | 38 + .../testcases/transactions/bad_rule_graphs | 262 + .../testcases/transactions/concat_range_abort | 28 + .../shell/testcases/transactions/doubled-set | 22 + .../transactions/dumps/0001table_0.json-nft | 25 + .../transactions/dumps/0002table_0.json-nft | 31 + .../transactions/dumps/0003table_0.json-nft | 25 + .../transactions/dumps/0003table_0.nft | 4 + .../transactions/dumps/0010chain_0.json-nft | 26 + .../transactions/dumps/0011chain_0.json-nft | 30 + .../transactions/dumps/0012chain_0.json-nft | 30 + .../transactions/dumps/0013chain_0.json-nft | 30 + .../transactions/dumps/0014chain_1.json-nft | 11 + .../transactions/dumps/0014chain_1.nft | 0 .../transactions/dumps/0015chain_0.json-nft | 11 + .../transactions/dumps/0015chain_0.nft | 0 .../transactions/dumps/0020rule_0.json-nft | 11 + .../transactions/dumps/0020rule_0.nft | 0 .../transactions/dumps/0021rule_0.json-nft | 54 + .../transactions/dumps/0022rule_1.json-nft | 11 + .../transactions/dumps/0022rule_1.nft | 0 .../transactions/dumps/0023rule_1.json-nft | 11 + .../transactions/dumps/0023rule_1.nft | 0 .../transactions/dumps/0024rule_0.json-nft | 82 + .../transactions/dumps/0025rule_0.json-nft | 52 + .../transactions/dumps/0030set_0.json-nft | 18 + .../transactions/dumps/0031set_0.json-nft | 27 + .../transactions/dumps/0032set_0.json-nft | 27 + .../transactions/dumps/0033set_0.json-nft | 18 + .../transactions/dumps/0034set_0.json-nft | 27 + .../transactions/dumps/0035set_0.json-nft | 30 + .../transactions/dumps/0036set_1.json-nft | 11 + .../transactions/dumps/0036set_1.nft | 0 .../transactions/dumps/0037set_0.json-nft | 28 + .../transactions/dumps/0038set_0.json-nft | 36 + .../transactions/dumps/0039set_0.json-nft | 36 + .../transactions/dumps/0040set_0.json-nft | 84 + .../dumps/0041nat_restore_0.json-nft | 30 + .../transactions/dumps/0041nat_restore_0.nft | 5 + .../dumps/0042_stateful_expr_0.json-nft | 28 + .../dumps/0042_stateful_expr_0.nft | 5 + .../transactions/dumps/0043set_1.json-nft | 11 + .../transactions/dumps/0043set_1.nft | 0 .../transactions/dumps/0044rule_0.json-nft | 11 + .../transactions/dumps/0044rule_0.nft | 0 .../dumps/0045anon-unbind_0.json-nft | 11 + .../transactions/dumps/0045anon-unbind_0.nft | 0 .../transactions/dumps/0046set_0.json-nft | 18 + .../transactions/dumps/0046set_0.nft | 2 + .../transactions/dumps/0047set_0.json-nft | 71 + .../transactions/dumps/0047set_0.nft | 16 + .../transactions/dumps/0048helpers_0.json-nft | 18 + .../transactions/dumps/0048helpers_0.nft | 2 + .../transactions/dumps/0049huge_0.json-nft | 5121 +++++++++++++++++ .../transactions/dumps/0049huge_0.nft | 749 +++ .../transactions/dumps/0050rule_1.json-nft | 11 + .../transactions/dumps/0050rule_1.nft | 0 .../transactions/dumps/0051map_0.nodump | 0 .../transactions/dumps/30s-stress.json-nft | 11 + .../transactions/dumps/30s-stress.nft | 0 .../dumps/anon_chain_loop.json-nft | 11 + .../transactions/dumps/anon_chain_loop.nft | 0 .../dumps/atomic_replace.sh.nodump | 0 .../dumps/bad_expression.json-nft | 11 + .../transactions/dumps/bad_expression.nft | 0 .../dumps/bad_rule_graphs.json-nft | 201 + .../transactions/dumps/bad_rule_graphs.nft | 30 + .../dumps/concat_range_abort.json-nft | 47 + .../transactions/dumps/concat_range_abort.nft | 8 + .../transactions/dumps/doubled-set.json-nft | 39 + .../transactions/dumps/doubled-set.nft | 7 + .../dumps/handle_bad_family.json-nft | 18 + .../transactions/dumps/handle_bad_family.nft | 2 + .../transactions/dumps/table_onoff.json-nft | 59 + .../transactions/dumps/table_onoff.nft | 8 + .../dumps/validation_recursion.sh.nodump | 0 .../testcases/transactions/handle_bad_family | 9 + .../shell/testcases/transactions/table_onoff | 44 + .../transactions/validation_recursion.sh | 39 + 921 files changed, 59576 insertions(+), 550 deletions(-) create mode 100644 tests/shell/features/bitshift.nft create mode 100644 tests/shell/features/bitwise_multireg.nft create mode 100644 tests/shell/features/catchall_element.nft create mode 100644 tests/shell/features/cgroupsv2.nft create mode 100644 tests/shell/features/chain_binding.nft create mode 100755 tests/shell/features/comment.sh create mode 100644 tests/shell/features/ctexpect.nft create mode 100644 tests/shell/features/cttimeout.nft create mode 100755 tests/shell/features/curl.sh create mode 100644 tests/shell/features/destroy.nft create mode 100644 tests/shell/features/dynset_op_delete.nft create mode 100755 tests/shell/features/elem_timeout_update.sh create mode 100755 tests/shell/features/flowtable_counter.sh create mode 100755 tests/shell/features/flowtable_no_devices.nft create mode 100755 tests/shell/features/ifname_based_hooks.sh create mode 100644 tests/shell/features/inet_ingress.nft create mode 100644 tests/shell/features/inet_nat.nft create mode 100644 tests/shell/features/inner_matching.nft create mode 100644 tests/shell/features/ip_options.nft create mode 100644 tests/shell/features/ipsec.nft create mode 100755 tests/shell/features/json.sh create mode 100644 tests/shell/features/map_lookup.nft create mode 100644 tests/shell/features/meta_time.nft create mode 100755 tests/shell/features/netdev_chain_multidevice.sh create mode 100644 tests/shell/features/netdev_chain_without_device.nft create mode 100644 tests/shell/features/netdev_egress.nft create mode 100644 tests/shell/features/netmap.nft create mode 100644 tests/shell/features/osf.nft create mode 100644 tests/shell/features/pipapo.nft create mode 100755 tests/shell/features/position_id.sh create mode 100644 tests/shell/features/prerouting_reject.nft create mode 100644 tests/shell/features/rbtree_size_limit.nft create mode 100755 tests/shell/features/reset_rule.sh create mode 100755 tests/shell/features/reset_set.sh create mode 100644 tests/shell/features/reset_tcp_options.nft create mode 100644 tests/shell/features/sctp_chunks.nft create mode 100644 tests/shell/features/secmark.nft create mode 100755 tests/shell/features/set_expr.sh create mode 100644 tests/shell/features/set_with_two_expressions.nft create mode 100755 tests/shell/features/setelem_expiration.sh create mode 100755 tests/shell/features/socat.sh create mode 100755 tests/shell/features/stateful_object_update.sh create mode 100644 tests/shell/features/synproxy.nft create mode 100644 tests/shell/features/table_flag_owner.nft create mode 100644 tests/shell/features/table_flag_persist.nft create mode 100755 tests/shell/features/tcpdump.sh create mode 100755 tests/shell/features/vsftpd.sh create mode 100755 tests/shell/helpers/json-diff-pretty.sh create mode 100755 tests/shell/helpers/json-pretty.sh create mode 100755 tests/shell/helpers/json-sanitize-ruleset.sh create mode 100755 tests/shell/helpers/nft-valgrind-wrapper.sh create mode 100755 tests/shell/helpers/random-source.sh create mode 100755 tests/shell/helpers/test-wrapper.sh rename tests/shell/testcases/{chains/0040mark_shift_0 => bitwise/0040mark_binop_0} (55%) rename tests/shell/testcases/{chains/0040mark_shift_1 => bitwise/0040mark_binop_1} (57%) create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_10 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_11 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_12 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_13 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_2 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_3 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_4 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_5 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_6 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_7 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_8 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_9 create mode 100755 tests/shell/testcases/bitwise/0044payload_binop_2 create mode 100755 tests/shell/testcases/bitwise/0044payload_binop_5 create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_0.json-nft rename tests/shell/testcases/{chains/dumps/0040mark_shift_0.nft => bitwise/dumps/0040mark_binop_0.nft} (58%) create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_1.json-nft rename tests/shell/testcases/{chains/dumps/0040mark_shift_1.nft => bitwise/dumps/0040mark_binop_1.nft} (64%) create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_10.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_11.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_12.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_13.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_2.json-nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_2.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_3.json-nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_3.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_4.json-nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_4.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_5.json-nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_5.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_6.json-nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_6.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_7.json-nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_7.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_8.json-nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_8.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_9.json-nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_9.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0044payload_binop_2.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0044payload_binop_5.nft create mode 100644 tests/shell/testcases/bogons/dumps/assert_failures.json-nft create mode 100644 tests/shell/testcases/bogons/dumps/assert_failures.nft create mode 100644 tests/shell/testcases/bogons/nft-f/delete_nonexistant_object_crash rename tests/shell/testcases/bogons/nft-f/{mapping_With_invalid_datatype_crash => mapping_with_invalid_datatype_crash} (100%) create mode 100644 tests/shell/testcases/bogons/nft-f/range_expression_corruption create mode 100644 tests/shell/testcases/bogons/nft-f/set_definition_with_no_key_assert create mode 100644 tests/shell/testcases/bogons/nft-f/use_after_free_on_chain_removal create mode 100644 tests/shell/testcases/bogons/nft-f/zero_length_devicename2_assert create mode 100644 tests/shell/testcases/bogons/nft-j-f/Assertion__out_failed_assert create mode 100644 tests/shell/testcases/bogons/nft-j-f/binop_rhs_decode_error_crash create mode 100644 tests/shell/testcases/bogons/nft-j-f/constant_expr_alloc_assert create mode 100644 tests/shell/testcases/bogons/nft-j-f/expr_evaluate_concat_empty_concat_key_assert create mode 100644 tests/shell/testcases/bogons/nft-j-f/list_a_destroyed_table_crash create mode 100644 tests/shell/testcases/bogons/nft-j-f/reject_stmt_with_no_expression_crash create mode 100644 tests/shell/testcases/bogons/nft-j-f/set_with_single_value_concat_assert create mode 100644 tests/shell/testcases/bogons/nft-j-f/unkown_stateful_statement_type_19_assert create mode 100644 tests/shell/testcases/cache/dumps/0001_cache_handling_0.json-nft create mode 100644 tests/shell/testcases/cache/dumps/0002_interval_0.json-nft create mode 100644 tests/shell/testcases/cache/dumps/0003_cache_update_0.json-nft create mode 100644 tests/shell/testcases/cache/dumps/0003_cache_update_0.nft create mode 100644 tests/shell/testcases/cache/dumps/0004_cache_update_0.json-nft create mode 100644 tests/shell/testcases/cache/dumps/0004_cache_update_0.nft create mode 100644 tests/shell/testcases/cache/dumps/0005_cache_chain_flush.json-nft create mode 100644 tests/shell/testcases/cache/dumps/0005_cache_chain_flush.nft create mode 100644 tests/shell/testcases/cache/dumps/0006_cache_table_flush.json-nft create mode 100644 tests/shell/testcases/cache/dumps/0006_cache_table_flush.nft create mode 100644 tests/shell/testcases/cache/dumps/0007_echo_cache_init_0.json-nft create mode 100644 tests/shell/testcases/cache/dumps/0008_delete_by_handle_0.json-nft create mode 100644 tests/shell/testcases/cache/dumps/0008_delete_by_handle_0.nft create mode 100644 tests/shell/testcases/cache/dumps/0009_delete_by_handle_incorrect_0.json-nft create mode 100644 tests/shell/testcases/cache/dumps/0009_delete_by_handle_incorrect_0.nft create mode 100644 tests/shell/testcases/cache/dumps/0010_implicit_chain_0.nft create mode 100644 tests/shell/testcases/cache/dumps/0011_index_0.json-nft create mode 100755 tests/shell/testcases/chains/0044chain_destroy_0 create mode 100644 tests/shell/testcases/chains/dumps/0001jumps_0.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0002jumps_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0002jumps_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0003jump_loop_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0003jump_loop_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0004busy_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0004busy_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0005busy_map_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0005busy_map_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0006masquerade_0.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0007masquerade_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0007masquerade_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0008masquerade_jump_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0008masquerade_jump_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0009masquerade_jump_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0009masquerade_jump_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0010endless_jump_loop_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0010endless_jump_loop_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0011endless_jump_loop_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0011endless_jump_loop_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0013rename_0.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0014rename_0.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0014rename_0.nft create mode 100644 tests/shell/testcases/chains/dumps/0015check_jump_loop_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0015check_jump_loop_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0016delete_handle_0.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0017masquerade_jump_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0017masquerade_jump_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0018check_jump_loop_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0018check_jump_loop_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0019masquerade_jump_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0019masquerade_jump_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0020depth_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0020depth_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0021prio_0.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0022prio_dummy_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0022prio_dummy_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0023prio_inet_srcnat_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0023prio_inet_srcnat_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0024prio_inet_dstnat_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0024prio_inet_dstnat_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0025prio_arp_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0025prio_arp_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0026prio_netdev_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0026prio_netdev_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0027prio_bridge_dstnat_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0027prio_bridge_dstnat_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0028prio_bridge_out_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0028prio_bridge_out_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0029prio_bridge_srcnat_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0029prio_bridge_srcnat_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0030create_0.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0031priority_variable_0.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0032priority_variable_0.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0033priority_variable_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0033priority_variable_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0034priority_variable_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0034priority_variable_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0035policy_variable_0.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0036policy_variable_0.json-nft rename tests/shell/testcases/{nft-f/dumps/0026policy_variable_0.nft => chains/dumps/0036policy_variable_0.nft} (100%) create mode 100644 tests/shell/testcases/chains/dumps/0037policy_variable_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0037policy_variable_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0038policy_variable_1.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0038policy_variable_1.nft create mode 100644 tests/shell/testcases/chains/dumps/0039negative_priority_0.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0039negative_priority_0.nft create mode 100644 tests/shell/testcases/chains/dumps/0042chain_variable_0.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0043chain_ingress_0.json-nft rename tests/shell/testcases/chains/dumps/{0043chain_ingress.nft => 0043chain_ingress_0.nft} (72%) create mode 100644 tests/shell/testcases/chains/dumps/0044chain_destroy_0.json-nft create mode 100644 tests/shell/testcases/chains/dumps/0044chain_destroy_0.nft create mode 100644 tests/shell/testcases/chains/dumps/jump_to_base_chain.nodump create mode 100644 tests/shell/testcases/chains/dumps/netdev_chain_0.json-nft create mode 100644 tests/shell/testcases/chains/dumps/netdev_chain_0.nft create mode 100644 tests/shell/testcases/chains/dumps/netdev_chain_autoremove.json-nft create mode 100644 tests/shell/testcases/chains/dumps/netdev_chain_autoremove.nft create mode 100644 tests/shell/testcases/chains/dumps/netdev_chain_dev_addremove.nodump create mode 100644 tests/shell/testcases/chains/dumps/netdev_chain_dev_gone.nodump create mode 100644 tests/shell/testcases/chains/dumps/netdev_chain_dormant_autoremove.json-nft create mode 100644 tests/shell/testcases/chains/dumps/netdev_chain_dormant_autoremove.nft create mode 100644 tests/shell/testcases/chains/dumps/netdev_chain_multidev_gone.nodump create mode 100644 tests/shell/testcases/chains/dumps/netdev_multidev_netns_gone.nodump create mode 100644 tests/shell/testcases/chains/dumps/netdev_netns_gone.nodump create mode 100755 tests/shell/testcases/chains/jump_to_base_chain create mode 100755 tests/shell/testcases/chains/netdev_chain_0 create mode 100755 tests/shell/testcases/chains/netdev_chain_autoremove create mode 100755 tests/shell/testcases/chains/netdev_chain_dev_addremove create mode 100755 tests/shell/testcases/chains/netdev_chain_dev_gone create mode 100755 tests/shell/testcases/chains/netdev_chain_dormant_autoremove create mode 100755 tests/shell/testcases/chains/netdev_chain_multidev_gone create mode 100755 tests/shell/testcases/chains/netdev_move_device create mode 100755 tests/shell/testcases/chains/netdev_multidev_netns_gone create mode 100755 tests/shell/testcases/chains/netdev_netns_gone create mode 100644 tests/shell/testcases/comments/dumps/comments_0.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0001flowtable_0.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0002create_flowtable_0.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0002create_flowtable_0.nft create mode 100644 tests/shell/testcases/flowtable/dumps/0003add_after_flush_0.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0003add_after_flush_0.nft create mode 100644 tests/shell/testcases/flowtable/dumps/0004delete_after_add_0.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0004delete_after_add_0.nft create mode 100644 tests/shell/testcases/flowtable/dumps/0005delete_in_use_1.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0005delete_in_use_1.nft create mode 100644 tests/shell/testcases/flowtable/dumps/0006segfault_0.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0006segfault_0.nft create mode 100644 tests/shell/testcases/flowtable/dumps/0007prio_0.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0007prio_0.nft create mode 100644 tests/shell/testcases/flowtable/dumps/0008prio_1.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0008prio_1.nft create mode 100644 tests/shell/testcases/flowtable/dumps/0009deleteafterflush_0.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0009deleteafterflush_0.nft create mode 100644 tests/shell/testcases/flowtable/dumps/0010delete_handle_0.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0010delete_handle_0.nft create mode 100644 tests/shell/testcases/flowtable/dumps/0011deleteafterflush_0.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0011deleteafterflush_0.nft create mode 100644 tests/shell/testcases/flowtable/dumps/0012flowtable_variable_0.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0013addafterdelete_0.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0013addafterdelete_0.nft create mode 100644 tests/shell/testcases/flowtable/dumps/0014addafterdelete_0.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0014addafterdelete_0.nft create mode 100644 tests/shell/testcases/flowtable/dumps/0015destroy_0.json-nft create mode 100644 tests/shell/testcases/flowtable/dumps/0015destroy_0.nft create mode 100644 tests/shell/testcases/include/dumps/0001absolute_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/0002relative_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/0003includepath_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/0004endlessloop_1.json-nft create mode 100644 tests/shell/testcases/include/dumps/0004endlessloop_1.nft create mode 100644 tests/shell/testcases/include/dumps/0005glob_empty_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/0005glob_empty_0.nft create mode 100644 tests/shell/testcases/include/dumps/0006glob_single_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/0007glob_double_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/0008glob_nofile_wildcard_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/0008glob_nofile_wildcard_0.nft create mode 100644 tests/shell/testcases/include/dumps/0009glob_nofile_1.json-nft create mode 100644 tests/shell/testcases/include/dumps/0009glob_nofile_1.nft create mode 100644 tests/shell/testcases/include/dumps/0010glob_broken_file_1.json-nft create mode 100644 tests/shell/testcases/include/dumps/0010glob_broken_file_1.nft create mode 100644 tests/shell/testcases/include/dumps/0011glob_dependency_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/0012glob_dependency_1.json-nft create mode 100644 tests/shell/testcases/include/dumps/0012glob_dependency_1.nft create mode 100644 tests/shell/testcases/include/dumps/0013glob_dotfile_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/0013input_descriptors_included_files_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/0013input_descriptors_included_files_0.nft create mode 100644 tests/shell/testcases/include/dumps/0014glob_directory_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/0014glob_directory_0.nft create mode 100644 tests/shell/testcases/include/dumps/0015doubleincludepath_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/0016maxdepth_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/0016maxdepth_0.nft create mode 100644 tests/shell/testcases/include/dumps/0017glob_more_than_maxdepth_1.json-nft create mode 100644 tests/shell/testcases/include/dumps/0017glob_more_than_maxdepth_1.nft create mode 100644 tests/shell/testcases/include/dumps/0018include_error_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/0018include_error_0.nft create mode 100644 tests/shell/testcases/include/dumps/0019include_error_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/0019include_error_0.nft create mode 100644 tests/shell/testcases/include/dumps/0020include_chain_0.json-nft create mode 100644 tests/shell/testcases/include/dumps/glob_duplicated_include.nft create mode 100755 tests/shell/testcases/include/glob_duplicated_include create mode 100644 tests/shell/testcases/json/dumps/0001set_statements_0.json-nft create mode 100644 tests/shell/testcases/json/dumps/0002table_map_0.json-nft create mode 100644 tests/shell/testcases/json/dumps/0003json_schema_version_0.json-nft create mode 100644 tests/shell/testcases/json/dumps/0004json_schema_version_1.json-nft create mode 100644 tests/shell/testcases/json/dumps/0005secmark_objref_0.json-nft create mode 100644 tests/shell/testcases/json/dumps/0006obj_comment_0.json-nft create mode 100644 tests/shell/testcases/json/dumps/netdev.json-nft create mode 100644 tests/shell/testcases/json/dumps/netdev.nft create mode 100755 tests/shell/testcases/json/single_flag create mode 100644 tests/shell/testcases/listing/dumps/0001ruleset_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0002ruleset_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0002ruleset_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0003table_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0003table_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0004table_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0004table_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0005ruleset_ip_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0005ruleset_ip_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0006ruleset_ip6_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0006ruleset_ip6_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0007ruleset_inet_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0007ruleset_inet_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0008ruleset_arp_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0008ruleset_arp_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0009ruleset_bridge_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0009ruleset_bridge_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0010sets_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0010sets_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0011sets_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0011sets_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0012sets_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0012sets_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0013objects_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0013objects_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0014objects_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0014objects_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0015dynamic_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0015dynamic_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0016anonymous_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0016anonymous_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0017objects_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0017objects_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0018data_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0018data_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0019set_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0019set_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0020flowtable_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0020flowtable_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0021ruleset_json_terse_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0021ruleset_json_terse_0.nft create mode 100644 tests/shell/testcases/listing/dumps/0022terse_0.json-nft create mode 100644 tests/shell/testcases/listing/dumps/0022terse_0.nft delete mode 100644 tests/shell/testcases/listing/dumps/meta_time.nft create mode 100644 tests/shell/testcases/listing/dumps/meta_time.nodump create mode 100755 tests/shell/testcases/listing/reset_objects create mode 100755 tests/shell/testcases/maps/0012map_concat_0 create mode 100755 tests/shell/testcases/maps/0014destroy_0 create mode 100755 tests/shell/testcases/maps/0016map_leak_0 create mode 100755 tests/shell/testcases/maps/0018map_leak_timeout_0 rename tests/shell/testcases/{sets => maps}/0024named_objects_0 (70%) create mode 100755 tests/shell/testcases/maps/delete_element create mode 100755 tests/shell/testcases/maps/delete_element_catchall create mode 100644 tests/shell/testcases/maps/dumps/0003map_add_many_elements_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/0003map_add_many_elements_0.nft create mode 100644 tests/shell/testcases/maps/dumps/0004interval_map_create_once_0.nodump create mode 100644 tests/shell/testcases/maps/dumps/0005interval_map_add_many_elements_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/0006interval_map_overlap_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/0007named_ifname_dtype_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/0008interval_map_delete_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/0008interval_map_delete_0.nft create mode 100644 tests/shell/testcases/maps/dumps/0009vmap_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/0010concat_map_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/0011vmap_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/0012map_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/0012map_concat_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/0012map_concat_0.nft create mode 100644 tests/shell/testcases/maps/dumps/0013map_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/0014destroy_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/0014destroy_0.nft create mode 100644 tests/shell/testcases/maps/dumps/0016map_leak_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/0016map_leak_0.nft create mode 100644 tests/shell/testcases/maps/dumps/0017_map_variable_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/0017_map_variable_0.nft create mode 100644 tests/shell/testcases/maps/dumps/0018map_leak_timeout_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/0018map_leak_timeout_0.nft create mode 100644 tests/shell/testcases/maps/dumps/0024named_objects_0.json-nft rename tests/shell/testcases/{sets => maps}/dumps/0024named_objects_0.nft (50%) create mode 100644 tests/shell/testcases/maps/dumps/0024named_objects_2.nodump create mode 100644 tests/shell/testcases/maps/dumps/anon_objmap_concat.json-nft create mode 100644 tests/shell/testcases/maps/dumps/anonymous_snat_map_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/anonymous_snat_map_2.nodump create mode 100644 tests/shell/testcases/maps/dumps/delete_element.nft create mode 100644 tests/shell/testcases/maps/dumps/delete_element_catchall.nft create mode 100644 tests/shell/testcases/maps/dumps/different_map_types_1.json-nft create mode 100644 tests/shell/testcases/maps/dumps/different_map_types_1.nft create mode 100644 tests/shell/testcases/maps/dumps/map_catchall_double_deactivate.json-nft create mode 100644 tests/shell/testcases/maps/dumps/map_catchall_double_deactivate.nft create mode 100644 tests/shell/testcases/maps/dumps/map_catchall_double_free.nodump create mode 100644 tests/shell/testcases/maps/dumps/map_catchall_double_free_2.json-nft create mode 100644 tests/shell/testcases/maps/dumps/map_catchall_double_free_2.nft create mode 100644 tests/shell/testcases/maps/dumps/map_with_flags_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/named_ct_objects.nft create mode 100644 tests/shell/testcases/maps/dumps/named_limits.json-nft create mode 100644 tests/shell/testcases/maps/dumps/named_limits.nft create mode 100644 tests/shell/testcases/maps/dumps/named_snat_map_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/pipapo_double_flush.json-nft create mode 100644 tests/shell/testcases/maps/dumps/pipapo_double_flush.nft create mode 100644 tests/shell/testcases/maps/dumps/typeof_maps_add_delete.json-nft create mode 100644 tests/shell/testcases/maps/dumps/typeof_maps_add_delete.nft create mode 100644 tests/shell/testcases/maps/dumps/typeof_maps_update_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/vmap_mark_bitwise_0.json-nft create mode 100644 tests/shell/testcases/maps/dumps/vmap_timeout.json-nft create mode 100644 tests/shell/testcases/maps/dumps/vmap_timeout.nft create mode 100755 tests/shell/testcases/maps/map_catchall_double_deactivate create mode 100755 tests/shell/testcases/maps/map_catchall_double_free create mode 100755 tests/shell/testcases/maps/map_catchall_double_free_2 create mode 100755 tests/shell/testcases/maps/named_ct_objects create mode 100755 tests/shell/testcases/maps/named_limits create mode 100755 tests/shell/testcases/maps/pipapo_double_flush create mode 100755 tests/shell/testcases/maps/typeof_maps_add_delete create mode 100755 tests/shell/testcases/maps/vmap_timeout create mode 100644 tests/shell/testcases/netns/dumps/0001nft-f_0.json-nft create mode 100644 tests/shell/testcases/netns/dumps/0001nft-f_0.nft create mode 100644 tests/shell/testcases/netns/dumps/0002loosecommands_0.json-nft create mode 100644 tests/shell/testcases/netns/dumps/0002loosecommands_0.nft create mode 100644 tests/shell/testcases/netns/dumps/0003many_0.json-nft create mode 100644 tests/shell/testcases/netns/dumps/0003many_0.nft create mode 100755 tests/shell/testcases/nft-f/0032pknock_0 create mode 100644 tests/shell/testcases/nft-f/dumps/0001define_slash_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0001define_slash_0.nft create mode 100644 tests/shell/testcases/nft-f/dumps/0002rollback_rule_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0003rollback_jump_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0004rollback_set_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0005rollback_map_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0006action_object_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0006action_object_0.nft create mode 100644 tests/shell/testcases/nft-f/dumps/0007action_object_set_segfault_1.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0007action_object_set_segfault_1.nft create mode 100644 tests/shell/testcases/nft-f/dumps/0008split_tables_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0009variable_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0010variable_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0011manydefines_0.nodump create mode 100644 tests/shell/testcases/nft-f/dumps/0013defines_1.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0013defines_1.nft create mode 100644 tests/shell/testcases/nft-f/dumps/0014defines_1.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0014defines_1.nft create mode 100644 tests/shell/testcases/nft-f/dumps/0015defines_1.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0015defines_1.nft create mode 100644 tests/shell/testcases/nft-f/dumps/0016redefines_1.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0016redefines_1.nft create mode 100644 tests/shell/testcases/nft-f/dumps/0017ct_timeout_obj_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0018ct_expectation_obj_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0018ct_expectation_obj_0.nft create mode 100644 tests/shell/testcases/nft-f/dumps/0018jump_variable_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0019jump_variable_1.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0019jump_variable_1.nft create mode 100644 tests/shell/testcases/nft-f/dumps/0020jump_variable_1.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0020jump_variable_1.nft create mode 100644 tests/shell/testcases/nft-f/dumps/0021list_ruleset_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0022variables_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0023check_1.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0023check_1.nft create mode 100644 tests/shell/testcases/nft-f/dumps/0024priority_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0025empty_dynset_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0026listing_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0026listing_0.nft create mode 100644 tests/shell/testcases/nft-f/dumps/0027split_chains_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0028variable_cmdline_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0029split_file_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0029split_file_0.nft create mode 100644 tests/shell/testcases/nft-f/dumps/0030variable_reuse_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0031vmap_string_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0031vmap_string_0.nft create mode 100644 tests/shell/testcases/nft-f/dumps/0032pknock_0.json-nft create mode 100644 tests/shell/testcases/nft-f/dumps/0032pknock_0.nft create mode 100755 tests/shell/testcases/nft-f/sample-ruleset create mode 100644 tests/shell/testcases/nft-i/dumps/0001define_0.json-nft create mode 100644 tests/shell/testcases/nft-i/dumps/0001define_0.nft create mode 100644 tests/shell/testcases/nft-i/dumps/index_0.nft create mode 100644 tests/shell/testcases/nft-i/dumps/set_0.nft create mode 100755 tests/shell/testcases/nft-i/index_0 create mode 100755 tests/shell/testcases/nft-i/set_0 create mode 100644 tests/shell/testcases/optimizations/dumps/dependency_kill.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/merge_nat.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/merge_nat_concat.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/merge_nat_concat.nft create mode 100644 tests/shell/testcases/optimizations/dumps/merge_nat_inet.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/merge_nat_inet.nft create mode 100644 tests/shell/testcases/optimizations/dumps/merge_reject.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/merge_stmts.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/merge_stmts_concat_vmap.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/merge_stmts_vmap.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/merge_vmap_raw.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/merge_vmaps.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/not_mergeable.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/ruleset.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/ruleset.nft create mode 100644 tests/shell/testcases/optimizations/dumps/single_anon_set.json-nft delete mode 100644 tests/shell/testcases/optimizations/dumps/single_anon_set.nft.input create mode 100644 tests/shell/testcases/optimizations/dumps/single_anon_set_expr.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/single_anon_set_expr.nft create mode 100644 tests/shell/testcases/optimizations/dumps/skip_merge.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/skip_non_eq.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/skip_unsupported.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/variables.json-nft create mode 100644 tests/shell/testcases/optimizations/dumps/variables.nft create mode 100755 tests/shell/testcases/optimizations/merge_nat_concat create mode 100755 tests/shell/testcases/optimizations/merge_nat_inet create mode 100755 tests/shell/testcases/optimizations/single_anon_set_expr create mode 100644 tests/shell/testcases/optionals/dumps/comments_0.json-nft create mode 100644 tests/shell/testcases/optionals/dumps/comments_chain_0.json-nft create mode 100644 tests/shell/testcases/optionals/dumps/comments_handles_0.json-nft create mode 100644 tests/shell/testcases/optionals/dumps/comments_objects_0.json-nft create mode 100644 tests/shell/testcases/optionals/dumps/comments_objects_dup_0.json-nft create mode 100644 tests/shell/testcases/optionals/dumps/comments_objects_dup_0.nft create mode 100644 tests/shell/testcases/optionals/dumps/comments_table_0.json-nft create mode 100644 tests/shell/testcases/optionals/dumps/delete_object_handles_0.json-nft create mode 100644 tests/shell/testcases/optionals/dumps/delete_object_handles_0.nft create mode 100644 tests/shell/testcases/optionals/dumps/handles_0.json-nft create mode 100644 tests/shell/testcases/optionals/dumps/handles_1.json-nft create mode 100644 tests/shell/testcases/optionals/dumps/handles_1.nft create mode 100644 tests/shell/testcases/optionals/dumps/log_prefix_0.json-nft create mode 100644 tests/shell/testcases/optionals/dumps/update_object_handles_0.json-nft create mode 100644 tests/shell/testcases/optionals/dumps/update_object_handles_0.nft create mode 100755 tests/shell/testcases/owner/0002-persist create mode 100644 tests/shell/testcases/owner/dumps/0001-flowtable-uaf.json-nft create mode 100644 tests/shell/testcases/owner/dumps/0001-flowtable-uaf.nft create mode 100644 tests/shell/testcases/owner/dumps/0002-persist.json-nft create mode 100644 tests/shell/testcases/owner/dumps/0002-persist.nft create mode 100755 tests/shell/testcases/packetpath/cgroupv2 create mode 100644 tests/shell/testcases/packetpath/dumps/cgroupv2.nodump create mode 100644 tests/shell/testcases/packetpath/dumps/flowtables.nodump create mode 100644 tests/shell/testcases/packetpath/dumps/payload.nodump create mode 100644 tests/shell/testcases/packetpath/dumps/policy.json-nft create mode 100644 tests/shell/testcases/packetpath/dumps/policy.nft create mode 100644 tests/shell/testcases/packetpath/dumps/set_lookups.json-nft create mode 100644 tests/shell/testcases/packetpath/dumps/set_lookups.nft create mode 100644 tests/shell/testcases/packetpath/dumps/tcp_reset.json-nft create mode 100644 tests/shell/testcases/packetpath/dumps/tcp_reset.nft create mode 100644 tests/shell/testcases/packetpath/dumps/vlan_8021ad_tag.nodump create mode 100644 tests/shell/testcases/packetpath/dumps/vlan_mangling.nodump create mode 100644 tests/shell/testcases/packetpath/dumps/vlan_qinq.nodump create mode 100755 tests/shell/testcases/packetpath/flowtables create mode 100755 tests/shell/testcases/packetpath/match_l4proto create mode 100755 tests/shell/testcases/packetpath/nat_ftp create mode 100755 tests/shell/testcases/packetpath/payload create mode 100755 tests/shell/testcases/packetpath/policy create mode 100755 tests/shell/testcases/packetpath/set_lookups create mode 100755 tests/shell/testcases/packetpath/tcp_reset create mode 100755 tests/shell/testcases/packetpath/vlan_8021ad_tag create mode 100755 tests/shell/testcases/packetpath/vlan_mangling create mode 100755 tests/shell/testcases/packetpath/vlan_qinq create mode 100644 tests/shell/testcases/parsing/dumps/describe.json-nft create mode 100644 tests/shell/testcases/parsing/dumps/describe.nft create mode 100644 tests/shell/testcases/parsing/dumps/large_rule_pipe.json-nft create mode 100644 tests/shell/testcases/parsing/dumps/large_rule_pipe.nft create mode 100644 tests/shell/testcases/parsing/dumps/log.json-nft create mode 100644 tests/shell/testcases/parsing/dumps/log.nft create mode 100644 tests/shell/testcases/parsing/dumps/octal.json-nft create mode 100644 tests/shell/testcases/parsing/dumps/octal.nft create mode 100755 tests/shell/testcases/parsing/large_rule_pipe create mode 100755 tests/shell/testcases/rule_management/0011reset_0 create mode 100755 tests/shell/testcases/rule_management/0012destroy_0 create mode 100644 tests/shell/testcases/rule_management/dumps/0001addinsertposition_0.json-nft create mode 100644 tests/shell/testcases/rule_management/dumps/0001addinsertposition_0.nft create mode 100644 tests/shell/testcases/rule_management/dumps/0002addinsertlocation_1.json-nft create mode 100644 tests/shell/testcases/rule_management/dumps/0002addinsertlocation_1.nft create mode 100644 tests/shell/testcases/rule_management/dumps/0003insert_0.json-nft create mode 100644 tests/shell/testcases/rule_management/dumps/0004replace_0.json-nft create mode 100644 tests/shell/testcases/rule_management/dumps/0005replace_1.json-nft create mode 100644 tests/shell/testcases/rule_management/dumps/0005replace_1.nft create mode 100644 tests/shell/testcases/rule_management/dumps/0006replace_1.json-nft create mode 100644 tests/shell/testcases/rule_management/dumps/0006replace_1.nft create mode 100644 tests/shell/testcases/rule_management/dumps/0007delete_0.json-nft create mode 100644 tests/shell/testcases/rule_management/dumps/0008delete_1.json-nft create mode 100644 tests/shell/testcases/rule_management/dumps/0008delete_1.nft create mode 100644 tests/shell/testcases/rule_management/dumps/0009delete_1.json-nft create mode 100644 tests/shell/testcases/rule_management/dumps/0009delete_1.nft create mode 100644 tests/shell/testcases/rule_management/dumps/0010replace_0.json-nft create mode 100644 tests/shell/testcases/rule_management/dumps/0010replace_0.nft create mode 100644 tests/shell/testcases/rule_management/dumps/0011reset_0.json-nft create mode 100644 tests/shell/testcases/rule_management/dumps/0011reset_0.nft create mode 100644 tests/shell/testcases/rule_management/dumps/0012destroy_0.json-nft create mode 100644 tests/shell/testcases/rule_management/dumps/0012destroy_0.nft create mode 100755 tests/shell/testcases/sets/0024synproxy_0 create mode 100755 tests/shell/testcases/sets/0067nat_interval_0 create mode 100755 tests/shell/testcases/sets/0072destroy_0 create mode 100755 tests/shell/testcases/sets/0073flat_interval_set create mode 100755 tests/shell/testcases/sets/0074nested_interval_set create mode 100644 tests/shell/testcases/sets/dumps/0001named_interval_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0002named_interval_automerging_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0003named_interval_missing_flag_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0004named_interval_shadow_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0005named_interval_shadow_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0006create_set_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0007create_element_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0008comments_interval_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0008create_verdict_map_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0009comments_timeout_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0010comments_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0011add_many_elements_0.nodump create mode 100644 tests/shell/testcases/sets/dumps/0012add_delete_many_elements_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0013add_delete_many_elements_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0014malformed_set_is_not_defined_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0014malformed_set_is_not_defined_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0015rulesetflush_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0016element_leak_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0017add_after_flush_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0018set_check_size_1.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0018set_check_size_1.nft create mode 100644 tests/shell/testcases/sets/dumps/0019set_check_size_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0020comments_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0021nesting_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0022type_selective_flush_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0023incomplete_add_set_command_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0024named_objects_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0024synproxy_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0024synproxy_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0025anonymous_set_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0026named_limit_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0027ipv6_maps_ipv4_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0028autoselect_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0028autoselect_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0028delete_handle_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0028delete_handle_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0030add_many_elements_interval_0.nodump create mode 100644 tests/shell/testcases/sets/dumps/0031set_timeout_size_0.nodump create mode 100644 tests/shell/testcases/sets/dumps/0032restore_set_simple_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0033add_set_simple_flat_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0033add_set_simple_flat_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0034get_element_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0034get_element_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0035add_set_elements_flat_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0035add_set_elements_flat_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0036add_set_element_expiration_0.nodump create mode 100644 tests/shell/testcases/sets/dumps/0037_set_with_inet_service_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0038meter_list_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0039delete_interval_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0039delete_interval_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0040get_host_endian_elements_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0040get_host_endian_elements_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0041interval_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0041interval_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0042update_set_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0042update_set_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0043concatenated_ranges_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0043concatenated_ranges_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0043concatenated_ranges_1.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0043concatenated_ranges_1.nft create mode 100644 tests/shell/testcases/sets/dumps/0044interval_overlap_0.nodump create mode 100644 tests/shell/testcases/sets/dumps/0044interval_overlap_1.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0044interval_overlap_1.nft create mode 100644 tests/shell/testcases/sets/dumps/0045concat_ipv4_service.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0046netmap_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0048set_counters_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0049set_define_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0050set_define_1.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0050set_define_1.nft create mode 100644 tests/shell/testcases/sets/dumps/0051set_interval_counter_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0052overlap_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0053echo_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0054comments_set_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0056dynamic_limit_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0056dynamic_limit_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0057set_create_fails_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0057set_create_fails_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0058_setupdate_timeout_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0059set_update_multistmt_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0060set_multistmt_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0060set_multistmt_1.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0061anonymous_automerge_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0062set_connlimit_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0062set_connlimit_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0063set_catchall_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0064map_catchall_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0065_icmp_postprocessing.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0065_icmp_postprocessing.nft create mode 100644 tests/shell/testcases/sets/dumps/0067nat_interval_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0068interval_stack_overflow_0.nodump create mode 100644 tests/shell/testcases/sets/dumps/0069interval_merge_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0071unclosed_prefix_interval_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0072destroy_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0072destroy_0.nft create mode 100644 tests/shell/testcases/sets/dumps/0073flat_interval_set.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0073flat_interval_set.nft create mode 100644 tests/shell/testcases/sets/dumps/0074nested_interval_set.json-nft create mode 100644 tests/shell/testcases/sets/dumps/0074nested_interval_set.nft create mode 100644 tests/shell/testcases/sets/dumps/automerge_0.nodump create mode 100644 tests/shell/testcases/sets/dumps/collapse_elem_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/concat_interval_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/dynset_missing.json-nft create mode 100644 tests/shell/testcases/sets/dumps/elem_opts_compat_0.nodump create mode 100644 tests/shell/testcases/sets/dumps/errors_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/errors_0.nft create mode 100644 tests/shell/testcases/sets/dumps/exact_overlap_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/exact_overlap_0.nft create mode 100644 tests/shell/testcases/sets/dumps/inner_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/inner_0.nft create mode 100644 tests/shell/testcases/sets/dumps/meter_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/meter_0.nft create mode 100644 tests/shell/testcases/sets/dumps/meter_set_reuse.json-nft create mode 100644 tests/shell/testcases/sets/dumps/meter_set_reuse.nft create mode 100644 tests/shell/testcases/sets/dumps/range_with_same_start_end.json-nft create mode 100644 tests/shell/testcases/sets/dumps/range_with_same_start_end.nft create mode 100644 tests/shell/testcases/sets/dumps/reset_command_0.nodump create mode 100644 tests/shell/testcases/sets/dumps/set_element_timeout_updates.json-nft create mode 100644 tests/shell/testcases/sets/dumps/set_element_timeout_updates.nft create mode 100644 tests/shell/testcases/sets/dumps/set_eval_0.json-nft create mode 100644 tests/shell/testcases/sets/dumps/set_stmt.nft create mode 100644 tests/shell/testcases/sets/dumps/sets_with_ifnames.json-nft create mode 100644 tests/shell/testcases/sets/dumps/type_set_symbol.json-nft create mode 100755 tests/shell/testcases/sets/inner_0 create mode 100755 tests/shell/testcases/sets/interval_size create mode 100755 tests/shell/testcases/sets/interval_size_random create mode 100755 tests/shell/testcases/sets/meter_0 create mode 100755 tests/shell/testcases/sets/meter_set_reuse create mode 100755 tests/shell/testcases/sets/range_with_same_start_end create mode 100755 tests/shell/testcases/sets/reset_command_0 create mode 100755 tests/shell/testcases/sets/set_element_timeout_updates create mode 100755 tests/shell/testcases/sets/set_stmt create mode 100755 tests/shell/testcases/transactions/0051map_0 create mode 100755 tests/shell/testcases/transactions/30s-stress create mode 100755 tests/shell/testcases/transactions/anon_chain_loop create mode 100755 tests/shell/testcases/transactions/atomic_replace.sh create mode 100755 tests/shell/testcases/transactions/bad_expression create mode 100755 tests/shell/testcases/transactions/bad_rule_graphs create mode 100755 tests/shell/testcases/transactions/concat_range_abort create mode 100755 tests/shell/testcases/transactions/doubled-set create mode 100644 tests/shell/testcases/transactions/dumps/0001table_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0002table_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0003table_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0003table_0.nft create mode 100644 tests/shell/testcases/transactions/dumps/0010chain_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0011chain_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0012chain_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0013chain_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0014chain_1.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0014chain_1.nft create mode 100644 tests/shell/testcases/transactions/dumps/0015chain_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0015chain_0.nft create mode 100644 tests/shell/testcases/transactions/dumps/0020rule_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0020rule_0.nft create mode 100644 tests/shell/testcases/transactions/dumps/0021rule_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0022rule_1.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0022rule_1.nft create mode 100644 tests/shell/testcases/transactions/dumps/0023rule_1.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0023rule_1.nft create mode 100644 tests/shell/testcases/transactions/dumps/0024rule_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0025rule_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0030set_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0031set_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0032set_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0033set_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0034set_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0035set_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0036set_1.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0036set_1.nft create mode 100644 tests/shell/testcases/transactions/dumps/0037set_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0038set_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0039set_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0040set_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0041nat_restore_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0041nat_restore_0.nft create mode 100644 tests/shell/testcases/transactions/dumps/0042_stateful_expr_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0042_stateful_expr_0.nft create mode 100644 tests/shell/testcases/transactions/dumps/0043set_1.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0043set_1.nft create mode 100644 tests/shell/testcases/transactions/dumps/0044rule_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0044rule_0.nft create mode 100644 tests/shell/testcases/transactions/dumps/0045anon-unbind_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0045anon-unbind_0.nft create mode 100644 tests/shell/testcases/transactions/dumps/0046set_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0046set_0.nft create mode 100644 tests/shell/testcases/transactions/dumps/0047set_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0047set_0.nft create mode 100644 tests/shell/testcases/transactions/dumps/0048helpers_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0048helpers_0.nft create mode 100644 tests/shell/testcases/transactions/dumps/0049huge_0.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0049huge_0.nft create mode 100644 tests/shell/testcases/transactions/dumps/0050rule_1.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/0050rule_1.nft create mode 100644 tests/shell/testcases/transactions/dumps/0051map_0.nodump create mode 100644 tests/shell/testcases/transactions/dumps/30s-stress.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/30s-stress.nft create mode 100644 tests/shell/testcases/transactions/dumps/anon_chain_loop.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/anon_chain_loop.nft create mode 100644 tests/shell/testcases/transactions/dumps/atomic_replace.sh.nodump create mode 100644 tests/shell/testcases/transactions/dumps/bad_expression.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/bad_expression.nft create mode 100644 tests/shell/testcases/transactions/dumps/bad_rule_graphs.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/bad_rule_graphs.nft create mode 100644 tests/shell/testcases/transactions/dumps/concat_range_abort.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/concat_range_abort.nft create mode 100644 tests/shell/testcases/transactions/dumps/doubled-set.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/doubled-set.nft create mode 100644 tests/shell/testcases/transactions/dumps/handle_bad_family.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/handle_bad_family.nft create mode 100644 tests/shell/testcases/transactions/dumps/table_onoff.json-nft create mode 100644 tests/shell/testcases/transactions/dumps/table_onoff.nft create mode 100644 tests/shell/testcases/transactions/dumps/validation_recursion.sh.nodump create mode 100755 tests/shell/testcases/transactions/handle_bad_family create mode 100755 tests/shell/testcases/transactions/table_onoff create mode 100755 tests/shell/testcases/transactions/validation_recursion.sh diff --git a/tests/shell/features/bitshift.nft b/tests/shell/features/bitshift.nft new file mode 100644 index 000000000..7f9ccb64f --- /dev/null +++ b/tests/shell/features/bitshift.nft @@ -0,0 +1,7 @@ +# 567d746b55bc ("netfilter: bitwise: add support for shifts.") +# v5.6-rc1~151^2~73^2 +table ip t { + chain c { + meta mark set meta mark << 2 + } +} diff --git a/tests/shell/features/bitwise_multireg.nft b/tests/shell/features/bitwise_multireg.nft new file mode 100644 index 000000000..cfce5a39b --- /dev/null +++ b/tests/shell/features/bitwise_multireg.nft @@ -0,0 +1,5 @@ +table inet test { + chain y { + ct mark set ct mark | meta mark + } +} diff --git a/tests/shell/features/catchall_element.nft b/tests/shell/features/catchall_element.nft new file mode 100644 index 000000000..1a02fd614 --- /dev/null +++ b/tests/shell/features/catchall_element.nft @@ -0,0 +1,8 @@ +# aaa31047a6d2 ("netfilter: nftables: add catch-all set element support") +# v5.13-rc1~94^2~10^2~2 +table t { + map m { + type inet_service : inet_service + elements = { * : 42 } + } +} diff --git a/tests/shell/features/cgroupsv2.nft b/tests/shell/features/cgroupsv2.nft new file mode 100644 index 000000000..b6a3869db --- /dev/null +++ b/tests/shell/features/cgroupsv2.nft @@ -0,0 +1,7 @@ +# e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2") +# v5.13-rc1~94^2~35^2~20 +table ip t { + chain c { + socket cgroupv2 level 1 "user.slice" counter + } +} diff --git a/tests/shell/features/chain_binding.nft b/tests/shell/features/chain_binding.nft new file mode 100644 index 000000000..b381ec540 --- /dev/null +++ b/tests/shell/features/chain_binding.nft @@ -0,0 +1,7 @@ +# d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") +# v5.9-rc1~133^2~302^2~1 +table ip t { + chain c { + jump { counter; } + } +} diff --git a/tests/shell/features/comment.sh b/tests/shell/features/comment.sh new file mode 100755 index 000000000..0ad24d04c --- /dev/null +++ b/tests/shell/features/comment.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# 002f21765320 ("netfilter: nf_tables: add userdata attributes to nft_chain") +# v5.10-rc1~107^2~60^2~5 + +EXPECTED="table ip x { + chain y { + comment \"test\" + } +}" + +$NFT -f - <<< $EXPECTED + +diff -u <($NFT list ruleset) - <<<"$EXPECTED" diff --git a/tests/shell/features/ctexpect.nft b/tests/shell/features/ctexpect.nft new file mode 100644 index 000000000..02c3dfd74 --- /dev/null +++ b/tests/shell/features/ctexpect.nft @@ -0,0 +1,10 @@ +# 857b46027d6f ("netfilter: nft_ct: add ct expectations support") +# v5.3-rc1~140^2~153^2~19 +table t { + ct expectation ctexpect { + protocol tcp + dport 5432 + timeout 1h + size 12; + } +} diff --git a/tests/shell/features/cttimeout.nft b/tests/shell/features/cttimeout.nft new file mode 100644 index 000000000..4be58cd3c --- /dev/null +++ b/tests/shell/features/cttimeout.nft @@ -0,0 +1,8 @@ +# 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support") +# v4.19-rc1~140^2~64^2~3 +table t { + ct timeout cttime { + protocol tcp; + policy = {established: 120 } + } +} diff --git a/tests/shell/features/curl.sh b/tests/shell/features/curl.sh new file mode 100755 index 000000000..6aa51623a --- /dev/null +++ b/tests/shell/features/curl.sh @@ -0,0 +1,4 @@ +#!/bin/sh + +# check whether curl is installed and supports ftp +curl --version | grep "^Protocols: "| grep -q " ftp" diff --git a/tests/shell/features/destroy.nft b/tests/shell/features/destroy.nft new file mode 100644 index 000000000..b97242e41 --- /dev/null +++ b/tests/shell/features/destroy.nft @@ -0,0 +1,3 @@ +# f80a612dd77c ("netfilter: nf_tables: add support to destroy operation") +# v6.3-rc1~162^2~264^2 +destroy table t diff --git a/tests/shell/features/dynset_op_delete.nft b/tests/shell/features/dynset_op_delete.nft new file mode 100644 index 000000000..125b4526b --- /dev/null +++ b/tests/shell/features/dynset_op_delete.nft @@ -0,0 +1,12 @@ +# d0a8d877da97 ("netfilter: nft_dynset: support for element deletion") +# v5.4-rc1~131^2~59^2~4 +table ip x { + set s { + flags dynamic; + type inet_service; + } + + chain y { + delete @s { tcp dport } + } +} diff --git a/tests/shell/features/elem_timeout_update.sh b/tests/shell/features/elem_timeout_update.sh new file mode 100755 index 000000000..6243170a6 --- /dev/null +++ b/tests/shell/features/elem_timeout_update.sh @@ -0,0 +1,22 @@ +#!/bin/bash + +# 4201f3938914 ("netfilter: nf_tables: set element timeout update support") + +$NFT -f - </dev/null 2>&1 diff --git a/tests/shell/features/stateful_object_update.sh b/tests/shell/features/stateful_object_update.sh new file mode 100755 index 000000000..62fbf7e38 --- /dev/null +++ b/tests/shell/features/stateful_object_update.sh @@ -0,0 +1,21 @@ +#!/bin/bash + +# d62d0ba97b58 ("netfilter: nf_tables: Introduce stateful object update operation") +# v5.4-rc1~131^2~59^2~2 + +set -e +$NFT add table test-ip +$NFT add quota test-ip traffic-quota 25 mbytes +$NFT add quota test-ip traffic-quota 50 mbytes + +EXPECTED="table ip test-ip { + quota traffic-quota { + 50 mbytes + } +}" + +GET="$($NFT list ruleset)" +if [ "$EXPECTED" != "$GET" ] ; then + diff -u <(echo "$EXPECTED") <(echo "$GET") + exit 1 +fi diff --git a/tests/shell/features/synproxy.nft b/tests/shell/features/synproxy.nft new file mode 100644 index 000000000..bea4f9205 --- /dev/null +++ b/tests/shell/features/synproxy.nft @@ -0,0 +1,9 @@ +# v5.3-rc1~140^2~44^2~10 +# ad49d86e07a4 ("netfilter: nf_tables: Add synproxy support") +table inet x { + synproxy https-synproxy { + mss 1460 + wscale 7 + timestamp sack-perm + } +} diff --git a/tests/shell/features/table_flag_owner.nft b/tests/shell/features/table_flag_owner.nft new file mode 100644 index 000000000..aef122a07 --- /dev/null +++ b/tests/shell/features/table_flag_owner.nft @@ -0,0 +1,5 @@ +# 6001a930ce03 ("netfilter: nftables: introduce table ownership") +# v5.12-rc1~200^2~6^2 +table t { + flags owner; +} diff --git a/tests/shell/features/table_flag_persist.nft b/tests/shell/features/table_flag_persist.nft new file mode 100644 index 000000000..0da3e6d4f --- /dev/null +++ b/tests/shell/features/table_flag_persist.nft @@ -0,0 +1,3 @@ +table t { + flags persist; +} diff --git a/tests/shell/features/tcpdump.sh b/tests/shell/features/tcpdump.sh new file mode 100755 index 000000000..70df9f681 --- /dev/null +++ b/tests/shell/features/tcpdump.sh @@ -0,0 +1,4 @@ +#!/bin/sh + +# check whether tcpdump is installed +tcpdump -h >/dev/null 2>&1 diff --git a/tests/shell/features/vsftpd.sh b/tests/shell/features/vsftpd.sh new file mode 100755 index 000000000..d35006405 --- /dev/null +++ b/tests/shell/features/vsftpd.sh @@ -0,0 +1,4 @@ +#!/bin/sh + +# check whether vsftpd is installed +which vsftpd >/dev/null 2>&1 diff --git a/tests/shell/helpers/json-diff-pretty.sh b/tests/shell/helpers/json-diff-pretty.sh new file mode 100755 index 000000000..bebb7e8ed --- /dev/null +++ b/tests/shell/helpers/json-diff-pretty.sh @@ -0,0 +1,17 @@ +#!/bin/bash -e + +BASEDIR="$(dirname "$0")" + +[ $# -eq 2 ] || (echo "$0: expects two JSON files as arguments" ; exit 1) + +FILE1="$1" +FILE2="$2" + +pretty() +{ + "$BASEDIR/json-pretty.sh" < "$1" 2>&1 || : +} + +echo "Cmd: \"$0\" \"$FILE1\" \"$FILE2\"" +diff -u "$FILE1" "$FILE2" 2>&1 || : +diff -u <(pretty "$FILE1") <(pretty "$FILE2") 2>&1 || : diff --git a/tests/shell/helpers/json-pretty.sh b/tests/shell/helpers/json-pretty.sh new file mode 100755 index 000000000..5407a8420 --- /dev/null +++ b/tests/shell/helpers/json-pretty.sh @@ -0,0 +1,30 @@ +#!/bin/bash -e + +exec_pretty() { + # The output of this command must be stable (and `jq` and python + # fallback must generate the same output. + + if command -v jq &>/dev/null ; then + # If we have, use `jq` + exec jq + fi + + # Fallback to python. + exec python -c ' +import json +import sys + +parsed = json.load(sys.stdin) +print(json.dumps(parsed, indent=2)) +' +} + +[ "$#" -le 1 ] || { echo "At most one argument supported" ; exit 1 ; } + +if [ "$#" -eq 1 ] ; then + # One argument passed. This must be a JSON file. + [ -f "$1" ] || { echo "File \"$1\" does not exist" ; exit 1 ; } + exec_pretty < "$1" +fi + +exec_pretty diff --git a/tests/shell/helpers/json-sanitize-ruleset.sh b/tests/shell/helpers/json-sanitize-ruleset.sh new file mode 100755 index 000000000..31b85cbd8 --- /dev/null +++ b/tests/shell/helpers/json-sanitize-ruleset.sh @@ -0,0 +1,30 @@ +#!/bin/bash -e + +die() { + printf "%s\n" "$*" + exit 1 +} + +do_sed() { + # Normalize the "version"/"release_name", otherwise we have to + # regenerate the JSON output upon new release. + # + # Also, "handle" are not stable. Normalize them 0. + sed \ + -e '1s/^\({"nftables": \[{"metainfo": {"version": "\)[0-9.]\+\(", "release_name": "\)[^"]\+\(", "\)/\1VERSION\2RELEASE_NAME\3/' \ + -e '1s/"handle": [0-9]\+\>/"handle": 0/g' \ + "$@" +} + +if [ "$#" = 0 ] ; then + do_sed + exit $? +fi + +for f ; do + test -f "$f" || die "$0: file \"$f\" does not exist" +done + +for f ; do + do_sed -i "$f" || die "$0: \`sed -i\` failed for \"$f\"" +done diff --git a/tests/shell/helpers/nft-valgrind-wrapper.sh b/tests/shell/helpers/nft-valgrind-wrapper.sh new file mode 100755 index 000000000..98bbdf435 --- /dev/null +++ b/tests/shell/helpers/nft-valgrind-wrapper.sh @@ -0,0 +1,31 @@ +#!/bin/bash -e + +SUFFIX="$(date "+%H%M%S.%6N").$$" + +rc=0 +libtool \ + --mode=execute \ + valgrind \ + --log-file="$NFT_TEST_TESTTMPDIR/valgrind.$SUFFIX.%p.log" \ + --trace-children=yes \ + --leak-check=full \ + --show-leak-kinds=all \ + --num-callers=100 \ + --error-exitcode=122 \ + --vgdb-prefix="$_NFT_TEST_VALGRIND_VGDB_PREFIX-$SUFFIX" \ + $NFT_TEST_VALGRIND_OPTS \ + "$NFT_REAL" \ + "$@" \ + || rc=$? + +if [ "$rc" -eq 122 ] ; then + shopt -s nullglob + FILES=( "$NFT_TEST_TESTTMPDIR/valgrind.$SUFFIX."*".log" ) + shopt -u nullglob + ( + printf '%s\n' "args: $*" + printf '%s\n' "${FILES[*]}" + ) >> "$NFT_TEST_TESTTMPDIR/rc-failed-valgrind" +fi + +exit $rc diff --git a/tests/shell/helpers/random-source.sh b/tests/shell/helpers/random-source.sh new file mode 100755 index 000000000..91a8248be --- /dev/null +++ b/tests/shell/helpers/random-source.sh @@ -0,0 +1,40 @@ +#!/bin/bash + +# Commands like `sort` and `shuf` have a "--random-source" argument, for +# generating a stable, reproducible output. However, they require an input +# that provides sufficiently many bytes (depending on the input). +# +# This script generates a stream that can be used like +# +# shuf --random-source=<($0 "$seed") + +seed="" +for a; do + seed="$seed${#a}:$a\n" +done + +if command -v openssl &>/dev/null ; then + # We have openssl. Use it. + # https://www.gnu.org/software/coreutils/manual/html_node/Random-sources.html#Random-sources + # + # Note that we don't care that different installations/architectures generate the + # same output. + openssl enc -aes-256-ctr -pass "pass:$seed" -nosalt /dev/null +else + # Hack something. It's much slower. + idx=0 + while : ; do + idx="$((idx++))" + seed="$(sha256sum <<<"$idx.$seed")" + echo ">>>$seed" >> a + seed="${seed%% *}" + LANG=C awk -v s="$seed" 'BEGIN{ + for (i=1; i <= length(s); i+=2) { + xchar = substr(s, i, 2); + decnum = strtonum("0x"xchar); + printf("%c", decnum); + } + }' || break + done +fi +exit 0 diff --git a/tests/shell/helpers/test-wrapper.sh b/tests/shell/helpers/test-wrapper.sh new file mode 100755 index 000000000..4a7e8b7b9 --- /dev/null +++ b/tests/shell/helpers/test-wrapper.sh @@ -0,0 +1,328 @@ +#!/bin/bash -e + +# This wrapper wraps the invocation of the test. It is called by run-tests.sh, +# and already in the unshared namespace. +# +# For some printf debugging, you can also patch this file. + +array_contains() { + local needle="$1" + local a + shift + for a; do + [ "$a" = "$needle" ] && return 0 + done + return 1 +} + +show_file() { + local filename="$1" + shift + local msg="$*" + + printf '%s\n>>>>\n' "$msg" + cat "$filename" + printf "<<<<\n" +} + +json_pretty() { + "$NFT_TEST_BASEDIR/helpers/json-pretty.sh" "$@" 2>&1 || : +} + +TEST="$1" +TESTBASE="$(basename "$TEST")" +TESTDIR="$(dirname "$TEST")" + +START_TIME="$(cut -d ' ' -f1 /proc/uptime)" + +export TMPDIR="$NFT_TEST_TESTTMPDIR" + +CLEANUP_UMOUNT_VAR_RUN=n + +cleanup() { + if [ "$CLEANUP_UMOUNT_VAR_RUN" = y ] ; then + umount "/var/run" &>/dev/null || : + fi +} + +trap cleanup EXIT + +printf '%s\n' "$TEST" > "$NFT_TEST_TESTTMPDIR/name" + +read tainted_before < /proc/sys/kernel/tainted + +if [ "$NFT_TEST_HAS_UNSHARED_MOUNT" = y ] ; then + # We have a private mount namespace. We will mount /var/run/ as a tmpfs. + # + # The main purpose is so that we can create /var/run/netns, which is + # required for `ip netns add` to work. When running as rootless, this + # is necessary to get such tests to pass. When running rootful, it's + # still useful to not touch the "real" /var/run/netns of the system. + # + # Note that this also hides everything that might reside in /var/run. + # That is desirable, as tests should not depend on content there (or if + # they do, we need to explicitly handle it as appropriate). + if mount -t tmpfs --make-private tmpfs "/var/run" 2>/dev/null ; then + CLEANUP_UMOUNT_VAR_RUN=y + fi + mkdir -p /var/run/netns +fi + +TEST_TAGS_PARSED=0 +ensure_TEST_TAGS() { + if [ "$TEST_TAGS_PARSED" = 0 ] ; then + TEST_TAGS_PARSED=1 + TEST_TAGS=( $(sed -n '1,10 { s/^.*\<\(NFT_TEST_REQUIRES\|NFT_TEST_SKIP\)\>\s*(\s*\(NFT_TEST_SKIP_[a-zA-Z0-9_]\+\|NFT_TEST_HAVE_[a-zA-Z0-9_]\+\)\s*).*$/\1(\2)/p }' "$1" 2>/dev/null || : ) ) + fi +} + +rc_test=0 + +if [ "$rc_test" -eq 0 ] ; then + for KEY in $(compgen -v | grep '^NFT_TEST_HAVE_') ; do + if [ "${!KEY}" != n ]; then + continue + fi + ensure_TEST_TAGS "$TEST" + if array_contains "NFT_TEST_REQUIRES($KEY)" "${TEST_TAGS[@]}" ; then + echo "Test skipped due to $KEY=n (test has \"NFT_TEST_REQUIRES($KEY)\" tag)" >> "$NFT_TEST_TESTTMPDIR/testout.log" + rc_test=77 + break + fi + done +fi + +if [ "$rc_test" -eq 0 ] ; then + for KEY in $(compgen -v | grep '^NFT_TEST_SKIP_') ; do + if [ "${!KEY}" != y ]; then + continue + fi + ensure_TEST_TAGS "$TEST" + if array_contains "NFT_TEST_SKIP($KEY)" "${TEST_TAGS[@]}" ; then + echo "Test skipped due to $KEY=y (test has \"NFT_TEST_SKIP($KEY)\" tag)" >> "$NFT_TEST_TESTTMPDIR/testout.log" + rc_test=77 + break + fi + done +fi + +if [ "$rc_test" -eq 0 ] ; then + CMD=( "$TEST" ) + if [ "$NFT_TEST_VERBOSE_TEST" = y ] ; then + X="$(sed -n '1 s/^#!\(\/bin\/bash\>.*$\)/\1/p' "$TEST" 2>/dev/null)" + if [ -n "$X" ] ; then + # Note that kernel parses the shebang differently and does not + # word splitting for the arguments. We do split the arguments here + # which would matter if there are spaces. For our tests, there + # are either no arguments or only one argument without space. So + # this is good enough. + CMD=( $X -x "$TEST" ) + fi + fi + printf "Command: $(printf '%q ' "${CMD[@]}")\n" &>> "$NFT_TEST_TESTTMPDIR/testout.log" + "${CMD[@]}" &>> "$NFT_TEST_TESTTMPDIR/testout.log" || rc_test=$? +fi + +rc_chkdump=0 +rc=0 +$NFT list ruleset > "$NFT_TEST_TESTTMPDIR/ruleset-after" 2> "$NFT_TEST_TESTTMPDIR/chkdump" || rc=$? +if [ "$rc" -ne 0 -o -s "$NFT_TEST_TESTTMPDIR/chkdump" ] ; then + show_file "$NFT_TEST_TESTTMPDIR/chkdump" "Command \`$NFT list ruleset\` failed" >> "$NFT_TEST_TESTTMPDIR/rc-failed-chkdump" + rc_chkdump=1 +fi +if [ "$NFT_TEST_HAVE_json" != n ] ; then + rc=0 + $NFT -j list ruleset > "$NFT_TEST_TESTTMPDIR/ruleset-after.json" 2> "$NFT_TEST_TESTTMPDIR/chkdump" || rc=$? + + # Workaround known bug in stmt_print_json(), due to + # "chain_stmt_ops.json" being NULL. This spams stderr. + sed -i '/^warning: stmt ops chain have no json callback$/d' "$NFT_TEST_TESTTMPDIR/chkdump" + + if [ "$rc" -ne 0 -o -s "$NFT_TEST_TESTTMPDIR/chkdump" ] ; then + show_file "$NFT_TEST_TESTTMPDIR/chkdump" "Command \`$NFT -j list ruleset\` failed" >> "$NFT_TEST_TESTTMPDIR/rc-failed-chkdump" + rc_chkdump=1 + fi + # JSON output needs normalization/sanitization, otherwise it's not stable. + "$NFT_TEST_BASEDIR/helpers/json-sanitize-ruleset.sh" "$NFT_TEST_TESTTMPDIR/ruleset-after.json" + json_pretty "$NFT_TEST_TESTTMPDIR/ruleset-after.json" > "$NFT_TEST_TESTTMPDIR/ruleset-after.json-pretty" +fi + +read tainted_after < /proc/sys/kernel/tainted + +DUMPPATH="$TESTDIR/dumps" +DUMPFILE="$DUMPPATH/$TESTBASE.nft" +JDUMPFILE="$DUMPPATH/$TESTBASE.json-nft" +NODUMPFILE="$DUMPPATH/$TESTBASE.nodump" + +# The caller can request a re-geneating of the .nft, .nodump, .json-nft dump files +# by setting DUMPGEN=y. In that case, only the existing files will be regenerated +# (unless all three files are missing, in which case all of them are generated). +# +# By setting DUMPGEN=all, all 3 files are always regenerated. +dump_written=n +if [ "$rc_test" -eq 0 -a '(' "$DUMPGEN" = all -o "$DUMPGEN" = y ')' ] ; then + dump_written=y + if [ ! -d "$DUMPPATH" ] ; then + mkdir "$DUMPPATH" + fi + if [ "$DUMPGEN" = all ] ; then + gen_nodumpfile=y + gen_dumpfile=y + gen_jdumpfile=y + else + # by default, only regenerate the files that we already have on disk. + gen_nodumpfile=n + gen_dumpfile=n + gen_jdumpfile=n + test -f "$DUMPFILE" && gen_dumpfile=y + test -f "$JDUMPFILE" && gen_jdumpfile=y + test -f "$NODUMPFILE" && gen_nodumpfile=y + if [ "$gen_dumpfile" != y -a "$gen_jdumpfile" != y -a "$gen_nodumpfile" != y ] ; then + # Except, if no files exist. Them generate all files. + gen_dumpfile=y + gen_jdumpfile=y + gen_nodumpfile=y + fi + fi + if [ "$gen_nodumpfile" = y ] ; then + : > "$NODUMPFILE" + fi + if [ "$gen_dumpfile" = y ] ; then + cat "$NFT_TEST_TESTTMPDIR/ruleset-after" > "$DUMPFILE" + fi + if [ "$NFT_TEST_HAVE_json" != n -a "$gen_jdumpfile" = y ] ; then + cat "$NFT_TEST_TESTTMPDIR/ruleset-after.json-pretty" > "$JDUMPFILE" + fi +fi + +rc_dump=0 +if [ "$rc_test" -ne 77 -a "$dump_written" != y ] ; then + if [ -f "$DUMPFILE" ] ; then + if ! $DIFF -u "$DUMPFILE" "$NFT_TEST_TESTTMPDIR/ruleset-after" &> "$NFT_TEST_TESTTMPDIR/ruleset-diff" ; then + show_file "$NFT_TEST_TESTTMPDIR/ruleset-diff" "Failed \`$DIFF -u \"$DUMPFILE\" \"$NFT_TEST_TESTTMPDIR/ruleset-after\"\`" >> "$NFT_TEST_TESTTMPDIR/rc-failed-dump" + rc_dump=1 + else + rm -f "$NFT_TEST_TESTTMPDIR/ruleset-diff" + fi + fi + if [ "$NFT_TEST_HAVE_json" != n -a -f "$JDUMPFILE" ] ; then + if ! $DIFF -u "$JDUMPFILE" "$NFT_TEST_TESTTMPDIR/ruleset-after.json-pretty" &> "$NFT_TEST_TESTTMPDIR/ruleset-diff.json" ; then + show_file "$NFT_TEST_TESTTMPDIR/ruleset-diff.json" "Failed \`$DIFF -u \"$JDUMPFILE\" \"$NFT_TEST_TESTTMPDIR/ruleset-after.json-pretty\"\`" >> "$NFT_TEST_TESTTMPDIR/rc-failed-dump" + rc_dump=1 + else + rm -f "$NFT_TEST_TESTTMPDIR/ruleset-diff.json" + fi + fi +fi + +# check that a flush after the test succeeds. We anyway need a clean ruleset +# for the `nft --check` next. +rc=0 +$NFT flush ruleset &> "$NFT_TEST_TESTTMPDIR/chkdump" || rc=1 +if [ "$rc" = 1 -o -s "$NFT_TEST_TESTTMPDIR/chkdump" ] ; then + show_file "$NFT_TEST_TESTTMPDIR/chkdump" "Command \`$NFT flush ruleset\` failed" >> "$NFT_TEST_TESTTMPDIR/rc-failed-chkdump" + rc_chkdump=1 +fi +# Check that `nft [-j] list ruleset | nft [-j] --check -f -` works. +fail=n +$NFT --check -f "$NFT_TEST_TESTTMPDIR/ruleset-after" &> "$NFT_TEST_TESTTMPDIR/chkdump" || fail=y +test -s "$NFT_TEST_TESTTMPDIR/chkdump" && fail=y +if [ "$fail" = y ] ; then + show_file "$NFT_TEST_TESTTMPDIR/chkdump" "Command \`$NFT --check -f \"$NFT_TEST_TESTTMPDIR/ruleset-after\"\` failed" >> "$NFT_TEST_TESTTMPDIR/rc-failed-chkdump" + rc_chkdump=1 +fi +if [ -f "$DUMPFILE" ] && ! cmp "$DUMPFILE" "$NFT_TEST_TESTTMPDIR/ruleset-after" &>/dev/null ; then + # Also check the $DUMPFILE to hit possibly new code paths. This + # is useful to see crashes and with ASAN/valgrind. + $NFT --check -f "$DUMPFILE" &>/dev/null || : +fi +if [ "$NFT_TEST_HAVE_json" != n ] ; then + if [ ! -f "$JDUMPFILE" ] ; then + # Optimally, `nft -j list ruleset | nft -j --check -f -` never + # fails. However, there are known issues where this doesn't + # work, and we cannot assert hard against that. It's those + # tests that don't have a .json-nft file. + # + # This should be fixed, every test should have a .json-nft + # file, and this workaround removed. + $NFT -j --check -f "$NFT_TEST_TESTTMPDIR/ruleset-after.json" &>/dev/null || : + $NFT -j --check -f "$NFT_TEST_TESTTMPDIR/ruleset-after.json-pretty" &>/dev/null || : + else + fail=n + $NFT -j --check -f "$NFT_TEST_TESTTMPDIR/ruleset-after.json" &> "$NFT_TEST_TESTTMPDIR/chkdump" || fail=y + test -s "$NFT_TEST_TESTTMPDIR/chkdump" && fail=y + if [ "$fail" = y ] ; then + show_file "$NFT_TEST_TESTTMPDIR/chkdump" "Command \`$NFT -j --check -f \"$NFT_TEST_TESTTMPDIR/ruleset-after.json\"\` failed" >> "$NFT_TEST_TESTTMPDIR/rc-failed-chkdump" + rc_chkdump=1 + fi + fail=n + $NFT -j --check -f "$NFT_TEST_TESTTMPDIR/ruleset-after.json-pretty" &> "$NFT_TEST_TESTTMPDIR/chkdump" || fail=y + test -s "$NFT_TEST_TESTTMPDIR/chkdump" && fail=y + if [ "$fail" = y ] ; then + show_file "$NFT_TEST_TESTTMPDIR/chkdump" "Command \`$NFT -j --check -f \"$NFT_TEST_TESTTMPDIR/ruleset-after.json-pretty\"\` failed" >> "$NFT_TEST_TESTTMPDIR/rc-failed-chkdump" + rc_chkdump=1 + fi + fi + if [ -f "$JDUMPFILE" ] \ + && ! cmp "$JDUMPFILE" "$NFT_TEST_TESTTMPDIR/ruleset-after.json" &>/dev/null \ + && ! cmp "$JDUMPFILE" "$NFT_TEST_TESTTMPDIR/ruleset-after.json-pretty" &>/dev/null ; \ + then + $NFT -j --check -f "$JDUMPFILE" &>/dev/null || : + fi +fi +rm -f "$NFT_TEST_TESTTMPDIR/chkdump" + +rc_valgrind=0 +[ -f "$NFT_TEST_TESTTMPDIR/rc-failed-valgrind" ] && rc_valgrind=1 + +rc_tainted=0 +if [ "$tainted_before" != "$tainted_after" ] ; then + echo "$tainted_after" > "$NFT_TEST_TESTTMPDIR/rc-failed-tainted" + rc_tainted=1 +fi + +if [ "$rc_valgrind" -ne 0 ] ; then + rc_exit=122 +elif [ "$rc_tainted" -ne 0 ] ; then + rc_exit=123 +elif [ "$rc_test" -ge 118 -a "$rc_test" -le 124 ] ; then + # Special exit codes are reserved. Coerce them. + rc_exit=125 +elif [ "$rc_test" -ne 0 ] ; then + rc_exit="$rc_test" +elif [ "$rc_dump" -ne 0 ] ; then + rc_exit=124 +elif [ "$rc_chkdump" -ne 0 ] ; then + rc_exit=121 +else + rc_exit=0 +fi + + +# We always write the real exit code of the test ($rc_test) to one of the files +# rc-{ok,skipped,failed}, depending on which it is. +# +# Note that there might be other rc-failed-{dump,tainted,valgrind} files with +# additional errors. Note that if such files exist, the overall state will +# always be failed too (and an "rc-failed" file exists). +# +# On failure, we also write the combined "$rc_exit" code from "test-wrapper.sh" +# to "rc-failed-exit" file. +# +# This means, failed tests will have a "rc-failed" file, and additional +# "rc-failed-*" files exist for further information. +if [ "$rc_exit" -eq 0 ] ; then + RC_FILENAME="rc-ok" +elif [ "$rc_exit" -eq 77 ] ; then + RC_FILENAME="rc-skipped" +else + RC_FILENAME="rc-failed" + echo "$rc_exit" > "$NFT_TEST_TESTTMPDIR/rc-failed-exit" +fi +echo "$rc_test" > "$NFT_TEST_TESTTMPDIR/$RC_FILENAME" + +END_TIME="$(cut -d ' ' -f1 /proc/uptime)" +WALL_TIME="$(awk -v start="$START_TIME" -v end="$END_TIME" "BEGIN { print(end - start) }")" +printf "%s\n" "$WALL_TIME" "$START_TIME" "$END_TIME" > "$NFT_TEST_TESTTMPDIR/times" + +exit "$rc_exit" diff --git a/tests/shell/run-tests.sh b/tests/shell/run-tests.sh index 931bba967..2d2e0ad14 100755 --- a/tests/shell/run-tests.sh +++ b/tests/shell/run-tests.sh @@ -1,57 +1,617 @@ #!/bin/bash -# Configuration -TESTDIR="./$(dirname $0)/testcases" -SRC_NFT="$(dirname $0)/../../src/nft" -DIFF=$(which diff) +unset LANGUAGE +export LANG=C +export LC_ALL=C + +GREEN="" +YELLOW="" +RED="" +RESET="" +if [ -z "$NO_COLOR" ] ; then + if [ -n "$CLICOLOR_FORCE" ] || [[ -t 1 ]] ; then + # See https://bixense.com/clicolors/ . We only check isatty() on + # file descriptor 1, to decide whether colorizing happens (although, + # we might also colorize on other places/FDs). + GREEN=$'\e[32m' + YELLOW=$'\e[33m' + RED=$'\e[31m' + RESET=$'\e[0m' + fi +fi + +array_contains() { + local needle="$1" + local a + shift + for a; do + [ "$a" = "$needle" ] && return 0 + done + return 1 +} + +array_remove_first() { + local _varname="$1" + local _needle="$2" + local _result=() + local _a + + eval "local _input=( \"\${$_varname[@]}\" )" + for _a in "${_input[@]}" ; do + if [ -n "${_needle+x}" -a "$_needle" = "$_a" ] ; then + unset _needle + else + _result+=("$_a") + fi + done + eval "$_varname="'( "${_result[@]}" )' +} + +colorize_keywords() { + local out_variable="$1" + local color="$2" + local val="$3" + local val2 + shift 3 + + printf -v val2 '%q' "$val" + array_contains "$val" "$@" && val2="$color$val2$RESET" + printf -v "$out_variable" '%s' "$val2" +} + +strtonum() { + local s="$1" + local n + local n2 + + re='^[[:space:]]*([0-9]+)[[:space:]]*$' + if [[ "$s" =~ $re ]] ; then + n="${BASH_REMATCH[1]}" + if [ "$(( n + 0 ))" = "$n" ] ; then + echo "$n" + return 0 + fi + fi + re='^[[:space:]]*0x([0-9a-fA-F]+)[[:space:]]*$' + if [[ "$s" =~ $re ]] ; then + n="${BASH_REMATCH[1]}" + n2="$(( 16#$n + 0 ))" + if [ "$n2" = "$(printf '%d' "0x$n" 2>/dev/null)" ] ; then + echo "$n2" + return 0 + fi + fi + return 1 +} + +_msg() { + local level="$1" + shift + + if [ "$level" = E ] ; then + printf '%s\n' "$RED$level$RESET: $*" + elif [ "$level" = W ] ; then + printf '%s\n' "$YELLOW$level$RESET: $*" + else + printf '%s\n' "$level: $*" + fi + if [ "$level" = E ] ; then + exit 1 + fi +} msg_error() { - echo "E: $1 ..." >&2 - exit 1 + _msg E "$@" } msg_warn() { - echo "W: $1" >&2 + _msg W "$@" } msg_info() { - echo "I: $1" + _msg I "$@" } -if [ "$(id -u)" != "0" ] ; then - msg_error "this requires root!" +align_text() { + local _OUT_VARNAME="$1" + local _LEFT_OR_RIGHT="$2" + local _INDENT="$3" + shift 3 + local _text="$*" + local _text_plain + local _text_align + local _text_result + local _i + + # This function is needed, because "$text" might contain color escape + # sequences. A plain `printf '%12s' "$text"` will not align properly. + + # strip escape sequences + _text_plain="${_text//$'\e['[0-9]m/}" + _text_plain="${_text_plain//$'\e['[0-9][0-9]m/}" + + _text_align="" + for (( _i = "${#_text_plain}" ; "$_i" < "$_INDENT" ; _i++ )) ; do + _text_align="$_text_align " + done + + if [ "$_LEFT_OR_RIGHT" = left ] ; then + _text_result="$(printf "%s$_text_align-" "$_text")" + else + _text_result="$(printf "$_text_align%s-" "$_text")" + fi + _text_result="${_text_result%-}" + + eval "$_OUT_VARNAME=\"\$_text_result\"" +} + +bool_n() { + case "$1" in + n|N|no|No|NO|0|false|False|FALSE) + printf n + ;; + *) + printf y + ;; + esac +} + +bool_y() { + case "$1" in + y|Y|yes|Yes|YES|1|true|True|TRUE) + printf y + ;; + *) + printf n + ;; + esac +} + +usage() { + echo " $0 [OPTIONS] [TESTS...]" + echo + echo "OPTIONS:" + echo " -h|--help : Print usage." + echo " -L|--list-tests : List test names and quit." + echo " -v : Sets VERBOSE=y." + echo " -g : Sets DUMPGEN=y." + echo " -V : Sets VALGRIND=y." + echo " -K : Sets KMEMLEAK=y." + echo " -R|--without-realroot : Sets NFT_TEST_HAS_REALROOT=n." + echo " -U|--no-unshare : Sets NFT_TEST_UNSHARE_CMD=\"\"." + echo " -k|--keep-logs : Sets NFT_TEST_KEEP_LOGS=y." + echo " -x : Sets NFT_TEST_VERBOSE_TEST=y." + echo " -s|--sequential : Sets NFT_TEST_JOBS=0, which also enables global cleanups." + echo " Also sets NFT_TEST_SHUFFLE_TESTS=n if left unspecified." + echo " -Q|--quick : Sets NFT_TEST_SKIP_slow=y." + echo " -S|--setup-host : Modify the host to run as rootless. Otherwise, some tests will be" + echo " skipped. Basically, this bumps /proc/sys/net/core/{wmem_max,rmem_max}." + echo " Must run as root and this option must be specified alone." + echo " -- : Separate options from tests." + echo " [TESTS...] : Other options are treated as test names," + echo " that is, executables that are run by the runner." + echo + echo "ENVIRONMENT VARIABLES:" + echo " NFT= : Path to nft executable. Will be called as \`\$NFT [...]\` so" + echo " it can be a command with parameters. Note that in this mode quoting" + echo " does not work, so the usage is limited and the command cannot contain" + echo " spaces." + echo " NFT_REAL= : Real nft comand. Usually this is just the same as \$NFT," + echo " however, you may set NFT='valgrind nft' and NFT_REAL to the real command." + echo " VERBOSE=*|y : Enable verbose output." + echo " NFT_TEST_VERBOSE_TEST=*|y: if true, enable verbose output for tests. For bash scripts, this means" + echo " to pass \"-x\" to the interpreter." + echo " DUMPGEN=*|y|all : Regenerate dump files \".{nft,json-nft,nodump}\". \"DUMPGEN=y\" only regenerates existing" + echo " files, unless the test has no files (then all three files are generated, and you need to" + echo " choose which to keep). With \"DUMPGEN=all\" all 3 files are regenerated, regardless" + echo " whether they already exist." + echo " VALGRIND=*|y : Run \$NFT in valgrind." + echo " KMEMLEAK=*|y : Check for kernel memleaks." + echo " NFT_TEST_HAS_REALROOT=*|y : To indicate whether the test has real root permissions." + echo " Usually, you don't need this and it gets autodetected." + echo " You might want to set it, if you know better than the" + echo " \`id -u\` check, whether the user is root in the main namespace." + echo " Note that without real root, certain tests may not work," + echo " e.g. due to limited /proc/sys/net/core/{wmem_max,rmem_max}." + echo " Checks that cannot pass in such environment should check for" + echo " [ \"\$NFT_TEST_HAS_REALROOT\" != y ] and skip gracefully." + echo " NFT_TEST_HAS_SOCKET_LIMITS=*|n : some tests will fail if /proc/sys/net/core/{wmem_max,rmem_max} is" + echo " too small. When running as real root, then test can override those limits. However," + echo " with rootless the test would fail. Tests will check for [ "\$NFT_TEST_HAS_SOCKET_LIMITS" = y ]" + echo " and skip. You may set NFT_TEST_HAS_SOCKET_LIMITS=n if you ensure those limits are" + echo " suitable to run the test rootless. Otherwise will be autodetected." + echo " Set /proc/sys/net/core/{wmem_max,rmem_max} to at least 4MB to get them to pass automatically." + echo " NFT_TEST_UNSHARE_CMD=cmd : when set, this is the command line for an unshare" + echo " command, which is used to sandbox each test invocation. By" + echo " setting it to empty, no unsharing is done." + echo " By default it is unset, in which case it's autodetected as" + echo " \`unshare -f -p\` (for root) or as \`unshare -f -p --mount-proc -U --map-root-user -n\`" + echo " for non-root." + echo " When setting this, you may also want to set NFT_TEST_HAS_UNSHARED=," + echo " NFT_TEST_HAS_REALROOT= and NFT_TEST_HAS_UNSHARED_MOUNT= accordingly." + echo " NFT_TEST_HAS_UNSHARED=*|y : To indicate to the test whether the test run will be unshared." + echo " Test may consider this." + echo " This is only honored when \$NFT_TEST_UNSHARE_CMD= is set. Otherwise it's detected." + echo " NFT_TEST_HAS_UNSHARED_MOUNT=*|y : To indicate to the test whether the test run will have a private" + echo " mount namespace." + echo " This is only honored when \$NFT_TEST_UNSHARE_CMD= is set. Otherwise it's detected." + echo " NFT_TEST_KEEP_LOGS=*|y: Keep the temp directory. On success, it will be deleted by default." + echo " NFT_TEST_JOBS=: number of jobs for parallel execution. Defaults to \"\$(nproc)*1.5\" for parallel run." + echo " Setting this to \"0\" or \"1\", means to run jobs sequentially." + echo " Setting this to \"0\" means also to perform global cleanups between tests (remove" + echo " kernel modules)." + echo " Parallel jobs requires unshare and are disabled with NFT_TEST_UNSHARE_CMD=\"\"." + echo " NFT_TEST_FAIL_ON_SKIP=*|y: if any jobs are skipped, exit with error." + echo " NFT_TEST_RANDOM_SEED=: The test runner will export the environment variable NFT_TEST_RANDOM_SEED" + echo " set to a random number. This can be used as a stable seed for tests to randomize behavior." + echo " Set this to a fixed value to get reproducible behavior." + echo " NFT_TEST_SHUFFLE_TESTS=*|n|y: control whether to randomly shuffle the order of tests. By default, if" + echo " tests are specified explicitly, they are not shuffled while they are shuffled when" + echo " all tests are run. The shuffling is based on NFT_TEST_RANDOM_SEED." + echo " TMPDIR= : select a different base directory for the result data." + echo + echo " NFT_TEST_HAVE_=*|y: Some tests requires certain features or will be skipped." + echo " The features are autodetected, but you can force it by setting the variable." + echo " Supported s are: ${_HAVE_OPTS[@]}." + echo " NFT_TEST_SKIP_