| Message ID | 20180305225741.szfm3exxsahk7fag@nevthink |
|---|---|
| State | RFC |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | [RFC,nft] tests: shell: autogenerate dump verification | expand |
On 5 March 2018 at 23:57, Laura Garcia Liebana <nevola@gmail.com> wrote:
> 141 files changed, 837 insertions(+), 526 deletions(-)
Better place a new script as a testcase, and all the required dump
files somewhere for it to read them.
Also, we have several testscases which are very long (we generate lots
of sets elements, for example) and I don't think it makes sense to
have them in plain text in the git tree.
Mind that this testsuite is mean to be generic, we have now shell
scripts, but we may have python code or even C in the future, and the
main runner script is intended to only launch them.
Anyway, we don't seem to be saving LOCs.
BTW make sure you use the NFT environment variable, so we can tests
arbitrary nft binaries.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Arturo Borrero Gonzalez <arturo@netfilter.org> wrote: > On 5 March 2018 at 23:57, Laura Garcia Liebana <nevola@gmail.com> wrote: > > > 141 files changed, 837 insertions(+), 526 deletions(-) > > Better place a new script as a testcase, and all the required dump > files somewhere for it to read them. > Also, we have several testscases which are very long (we generate lots > of sets elements, for example) and I don't think it makes sense to > have them in plain text in the git tree. How would you verify that output didn't change without storing 'known state' somewhere? Or did you mean 'skip listing verification for some tests'? I don't think its a big deal and would not worry about the size. > Anyway, we don't seem to be saving LOCs. Yes but it decouples script from expected output, i think thats an improvement. Next step f.e. could be to make sure we don't choke when we try to feed rule listing back to nftables via -f. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 6 March 2018 at 11:47, Florian Westphal <fw@strlen.de> wrote: > Arturo Borrero Gonzalez <arturo@netfilter.org> wrote: >> On 5 March 2018 at 23:57, Laura Garcia Liebana <nevola@gmail.com> wrote: >> >> > 141 files changed, 837 insertions(+), 526 deletions(-) >> >> Better place a new script as a testcase, and all the required dump >> files somewhere for it to read them. >> Also, we have several testscases which are very long (we generate lots >> of sets elements, for example) and I don't think it makes sense to >> have them in plain text in the git tree. > > How would you verify that output didn't change without storing > 'known state' somewhere? > Or did you mean 'skip listing verification for some tests'? > > I don't think its a big deal and would not worry about the size. > >> Anyway, we don't seem to be saving LOCs. > > Yes but it decouples script from expected output, i think thats an > improvement. > > Next step f.e. could be to make sure we don't choke when we try > to feed rule listing back to nftables via -f. Ok, makes sense. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/tests/shell/README b/tests/shell/README index 3ffe642..e6d83bc 100644 --- a/tests/shell/README +++ b/tests/shell/README @@ -1,5 +1,5 @@ This test-suite is intended to perform tests of higher level than -the other reggresion test-suite. +the other regression test-suite. It can run arbitrary executables which can perform any test apart of testing the nft syntax or netlink code (which is what the regression tests does). @@ -15,6 +15,9 @@ test-files can be spread in any sub-directories. You can turn on a verbose execution by calling: % ./run-tests.sh -v +And generate missing dump files with: + % ./run-tests.sh -g <TESTFILE> + Before each call to the test-files, `nft flush ruleset' will be called. Also, test-files will receive the environment variable $NFT which contains the path to the nftables binary being tested. diff --git a/tests/shell/run-tests.sh b/tests/shell/run-tests.sh index 3eee99d..a2e1267 100755 --- a/tests/shell/run-tests.sh +++ b/tests/shell/run-tests.sh @@ -4,6 +4,8 @@ TESTDIR="./$(dirname $0)/" RETURNCODE_SEPARATOR="_" SRC_NFT="$(dirname $0)/../../src/nft" +POSITIVE_RET=0 +DIFF=$(which diff) msg_error() { echo "E: $1 ..." >&2 @@ -43,6 +45,16 @@ if [ ! -x "$MODPROBE" ] ; then msg_error "no modprobe binary found" fi +if [ "$1" == "-v" ] ; then + VERBOSE=y + shift +fi + +if [ "$1" == "-g" ] ; then + DUMPGEN=y + shift +fi + if [ -x "$1" ] ; then if grep ^.*${RETURNCODE_SEPARATOR}[0-9]\\+$ <<< $1 >/dev/null ; then SINGLE=$1 @@ -50,10 +62,6 @@ if [ -x "$1" ] ; then fi fi -if [ "$1" == "-v" ] ; then - VERBOSE=y -fi - kernel_cleanup() { $NFT flush ruleset $MODPROBE -raq \ @@ -97,9 +105,30 @@ do echo -en "\033[1A\033[K" # clean the [EXECUTING] foobar line if [ "$rc_got" == "$rc_spec" ] ; then - msg_info "[OK] $testfile" - [ "$VERBOSE" == "y" ] && [ ! -z "$test_output" ] && echo "$test_output" - ((ok++)) + # check nft dump only for positive tests + rc_spec="${POSITIVE_RET}" + dumpfile="${testfile}.dump" + if [ "$rc_got" == "${POSITIVE_RET}" ] && [ -f ${dumpfile} ]; then + test_output=$(${DIFF} ${dumpfile} <(nft list ruleset) 2>&1) + rc_spec=$? + fi + + if [ "$rc_spec" == "${POSITIVE_RET}" ]; then + msg_info "[OK] $testfile" + [ "$VERBOSE" == "y" ] && [ ! -z "$test_output" ] && echo "$test_output" + ((ok++)) + + [ "$DUMPGEN" == "y" ] && [ "$rc_got" == "${POSITIVE_RET}" ] && [ ! -f "${dumpfile}" ] && nft list ruleset > "${dumpfile}" + + else + ((failed++)) + if [ "$VERBOSE" == "y" ] ; then + msg_warn "[DUMP FAIL] $testfile: dump diff detected" + [ ! -z "$test_output" ] && echo "$test_output" + else + msg_warn "[DUMP FAIL] $testfile" + fi + fi else ((failed++)) if [ "$VERBOSE" == "y" ] ; then diff --git a/tests/shell/testcases/cache/0001_cache_handling_0.dump b/tests/shell/testcases/cache/0001_cache_handling_0.dump new file mode 100644 index 0000000..f6dd654 --- /dev/null +++ b/tests/shell/testcases/cache/0001_cache_handling_0.dump @@ -0,0 +1,12 @@ +table inet test { + set test { + type ipv4_addr + elements = { 1.1.1.1 } + } + + chain test { + ip daddr { 2.2.2.2 } counter packets 0 bytes 0 accept + ip saddr @test counter packets 0 bytes 0 accept + ip daddr { 2.2.2.2 } counter packets 0 bytes 0 accept + } +} diff --git a/tests/shell/testcases/cache/0002_interval_0.dump b/tests/shell/testcases/cache/0002_interval_0.dump new file mode 100644 index 0000000..6a08132 --- /dev/null +++ b/tests/shell/testcases/cache/0002_interval_0.dump @@ -0,0 +1,7 @@ +table inet t { + set s { + type ipv4_addr + flags interval + elements = { 192.168.0.0/24 } + } +} diff --git a/tests/shell/testcases/chains/0001jumps_0.dump b/tests/shell/testcases/chains/0001jumps_0.dump new file mode 100644 index 0000000..7054cde --- /dev/null +++ b/tests/shell/testcases/chains/0001jumps_0.dump @@ -0,0 +1,64 @@ +table ip t { + chain c1 { + jump c2 + } + + chain c2 { + jump c3 + } + + chain c3 { + jump c4 + } + + chain c4 { + jump c5 + } + + chain c5 { + jump c6 + } + + chain c6 { + jump c7 + } + + chain c7 { + jump c8 + } + + chain c8 { + jump c9 + } + + chain c9 { + jump c10 + } + + chain c10 { + jump c11 + } + + chain c11 { + jump c12 + } + + chain c12 { + jump c13 + } + + chain c13 { + jump c14 + } + + chain c14 { + jump c15 + } + + chain c15 { + jump c16 + } + + chain c16 { + } +} diff --git a/tests/shell/testcases/chains/0006masquerade_0.dump b/tests/shell/testcases/chains/0006masquerade_0.dump new file mode 100644 index 0000000..e4b9872 --- /dev/null +++ b/tests/shell/testcases/chains/0006masquerade_0.dump @@ -0,0 +1,6 @@ +table ip t { + chain c1 { + type nat hook postrouting priority 0; policy accept; + masquerade + } +} diff --git a/tests/shell/testcases/chains/0013rename_0.dump b/tests/shell/testcases/chains/0013rename_0.dump new file mode 100644 index 0000000..e4e0171 --- /dev/null +++ b/tests/shell/testcases/chains/0013rename_0.dump @@ -0,0 +1,4 @@ +table ip t { + chain c2 { + } +} diff --git a/tests/shell/testcases/include/0001absolute_0.dump b/tests/shell/testcases/include/0001absolute_0.dump new file mode 100644 index 0000000..5d4d2ca --- /dev/null +++ b/tests/shell/testcases/include/0001absolute_0.dump @@ -0,0 +1,2 @@ +table ip x { +} diff --git a/tests/shell/testcases/include/0002relative_0.dump b/tests/shell/testcases/include/0002relative_0.dump new file mode 100644 index 0000000..5d4d2ca --- /dev/null +++ b/tests/shell/testcases/include/0002relative_0.dump @@ -0,0 +1,2 @@ +table ip x { +} diff --git a/tests/shell/testcases/include/0003includepath_0.dump b/tests/shell/testcases/include/0003includepath_0.dump new file mode 100644 index 0000000..5d4d2ca --- /dev/null +++ b/tests/shell/testcases/include/0003includepath_0.dump @@ -0,0 +1,2 @@ +table ip x { +} diff --git a/tests/shell/testcases/include/0005glob_empty_0.dump b/tests/shell/testcases/include/0005glob_empty_0.dump new file mode 100644 index 0000000..e69de29 diff --git a/tests/shell/testcases/include/0006glob_single_0.dump b/tests/shell/testcases/include/0006glob_single_0.dump new file mode 100644 index 0000000..5d4d2ca --- /dev/null +++ b/tests/shell/testcases/include/0006glob_single_0.dump @@ -0,0 +1,2 @@ +table ip x { +} diff --git a/tests/shell/testcases/include/0007glob_double_0.dump b/tests/shell/testcases/include/0007glob_double_0.dump new file mode 100644 index 0000000..e4e5f9b --- /dev/null +++ b/tests/shell/testcases/include/0007glob_double_0.dump @@ -0,0 +1,4 @@ +table ip x { +} +table ip y { +} diff --git a/tests/shell/testcases/include/0008glob_nofile_wildcard_0.dump b/tests/shell/testcases/include/0008glob_nofile_wildcard_0.dump new file mode 100644 index 0000000..e69de29 diff --git a/tests/shell/testcases/include/0011glob_dependency_0.dump b/tests/shell/testcases/include/0011glob_dependency_0.dump new file mode 100644 index 0000000..8e818d2 --- /dev/null +++ b/tests/shell/testcases/include/0011glob_dependency_0.dump @@ -0,0 +1,4 @@ +table ip x { + chain y { + } +} diff --git a/tests/shell/testcases/include/0013glob_dotfile_0.dump b/tests/shell/testcases/include/0013glob_dotfile_0.dump new file mode 100644 index 0000000..5d4d2ca --- /dev/null +++ b/tests/shell/testcases/include/0013glob_dotfile_0.dump @@ -0,0 +1,2 @@ +table ip x { +} diff --git a/tests/shell/testcases/include/0013input_descriptors_included_files_0.dump b/tests/shell/testcases/include/0013input_descriptors_included_files_0.dump new file mode 100644 index 0000000..e69de29 diff --git a/tests/shell/testcases/include/0014glob_directory_0.dump b/tests/shell/testcases/include/0014glob_directory_0.dump new file mode 100644 index 0000000..e69de29 diff --git a/tests/shell/testcases/include/0015doubleincludepath_0.dump b/tests/shell/testcases/include/0015doubleincludepath_0.dump new file mode 100644 index 0000000..8e818d2 --- /dev/null +++ b/tests/shell/testcases/include/0015doubleincludepath_0.dump @@ -0,0 +1,4 @@ +table ip x { + chain y { + } +} diff --git a/tests/shell/testcases/listing/0001ruleset_0 b/tests/shell/testcases/listing/0001ruleset_0 index 1a3a73b..19cb3b0 100755 --- a/tests/shell/testcases/listing/0001ruleset_0 +++ b/tests/shell/testcases/listing/0001ruleset_0 @@ -2,17 +2,6 @@ # list ruleset shows a table -EXPECTED="table ip test { -}" - set -e $NFT add table test -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi - diff --git a/tests/shell/testcases/listing/0001ruleset_0.dump b/tests/shell/testcases/listing/0001ruleset_0.dump new file mode 100644 index 0000000..1c9f40c --- /dev/null +++ b/tests/shell/testcases/listing/0001ruleset_0.dump @@ -0,0 +1,2 @@ +table ip test { +} diff --git a/tests/shell/testcases/listing/0002ruleset_0 b/tests/shell/testcases/listing/0002ruleset_0 index 45121fb..b4a535c 100755 --- a/tests/shell/testcases/listing/0002ruleset_0 +++ b/tests/shell/testcases/listing/0002ruleset_0 @@ -5,12 +5,3 @@ EXPECTED="" set -e - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi - diff --git a/tests/shell/testcases/listing/0002ruleset_0.dump b/tests/shell/testcases/listing/0002ruleset_0.dump new file mode 100644 index 0000000..e69de29 diff --git a/tests/shell/testcases/listing/0003table_0.dump b/tests/shell/testcases/listing/0003table_0.dump new file mode 100644 index 0000000..1c9f40c --- /dev/null +++ b/tests/shell/testcases/listing/0003table_0.dump @@ -0,0 +1,2 @@ +table ip test { +} diff --git a/tests/shell/testcases/listing/0004table_0.dump b/tests/shell/testcases/listing/0004table_0.dump new file mode 100644 index 0000000..56d035d --- /dev/null +++ b/tests/shell/testcases/listing/0004table_0.dump @@ -0,0 +1,4 @@ +table ip test { +} +table ip test2 { +} diff --git a/tests/shell/testcases/listing/0005ruleset_ip_0.dump b/tests/shell/testcases/listing/0005ruleset_ip_0.dump new file mode 100644 index 0000000..c37261b --- /dev/null +++ b/tests/shell/testcases/listing/0005ruleset_ip_0.dump @@ -0,0 +1,10 @@ +table ip test { +} +table ip6 test { +} +table inet test { +} +table arp test { +} +table bridge test { +} diff --git a/tests/shell/testcases/listing/0006ruleset_ip6_0.dump b/tests/shell/testcases/listing/0006ruleset_ip6_0.dump new file mode 100644 index 0000000..c37261b --- /dev/null +++ b/tests/shell/testcases/listing/0006ruleset_ip6_0.dump @@ -0,0 +1,10 @@ +table ip test { +} +table ip6 test { +} +table inet test { +} +table arp test { +} +table bridge test { +} diff --git a/tests/shell/testcases/listing/0007ruleset_inet_0.dump b/tests/shell/testcases/listing/0007ruleset_inet_0.dump new file mode 100644 index 0000000..c37261b --- /dev/null +++ b/tests/shell/testcases/listing/0007ruleset_inet_0.dump @@ -0,0 +1,10 @@ +table ip test { +} +table ip6 test { +} +table inet test { +} +table arp test { +} +table bridge test { +} diff --git a/tests/shell/testcases/listing/0008ruleset_arp_0.dump b/tests/shell/testcases/listing/0008ruleset_arp_0.dump new file mode 100644 index 0000000..c37261b --- /dev/null +++ b/tests/shell/testcases/listing/0008ruleset_arp_0.dump @@ -0,0 +1,10 @@ +table ip test { +} +table ip6 test { +} +table inet test { +} +table arp test { +} +table bridge test { +} diff --git a/tests/shell/testcases/listing/0009ruleset_bridge_0.dump b/tests/shell/testcases/listing/0009ruleset_bridge_0.dump new file mode 100644 index 0000000..c37261b --- /dev/null +++ b/tests/shell/testcases/listing/0009ruleset_bridge_0.dump @@ -0,0 +1,10 @@ +table ip test { +} +table ip6 test { +} +table inet test { +} +table arp test { +} +table bridge test { +} diff --git a/tests/shell/testcases/listing/0010sets_0.dump b/tests/shell/testcases/listing/0010sets_0.dump new file mode 100644 index 0000000..7303c40 --- /dev/null +++ b/tests/shell/testcases/listing/0010sets_0.dump @@ -0,0 +1,39 @@ +table ip nat { + set ssh { + type ipv4_addr + } +} +table ip6 test { + set testset { + type ipv6_addr + } +} +table arp test_arp { + set test_set_arp00 { + type inet_service + } + + set test_set_arp01 { + type inet_service + flags constant + } +} +table bridge test_bridge { + set test_set_bridge { + type inet_service + } +} +table inet filter { + set set0 { + type inet_service + } + + set set1 { + type inet_service + flags constant + } + + set set2 { + type icmpv6_type + } +} diff --git a/tests/shell/testcases/listing/0011sets_0.dump b/tests/shell/testcases/listing/0011sets_0.dump new file mode 100644 index 0000000..f47fef0 --- /dev/null +++ b/tests/shell/testcases/listing/0011sets_0.dump @@ -0,0 +1,25 @@ +table ip nat { + chain test { + tcp dport { ntp } + } +} +table ip6 test { + chain test { + udp sport { ntp } + } +} +table arp test_arp { + chain test { + mark { 0x0000007b } + } +} +table bridge test_bridge { + chain test { + ip daddr { 1.1.1.1 } + } +} +table inet filter { + chain test { + tcp dport { http, https } + } +} diff --git a/tests/shell/testcases/listing/0012sets_0.dump b/tests/shell/testcases/listing/0012sets_0.dump new file mode 100644 index 0000000..7303c40 --- /dev/null +++ b/tests/shell/testcases/listing/0012sets_0.dump @@ -0,0 +1,39 @@ +table ip nat { + set ssh { + type ipv4_addr + } +} +table ip6 test { + set testset { + type ipv6_addr + } +} +table arp test_arp { + set test_set_arp00 { + type inet_service + } + + set test_set_arp01 { + type inet_service + flags constant + } +} +table bridge test_bridge { + set test_set_bridge { + type inet_service + } +} +table inet filter { + set set0 { + type inet_service + } + + set set1 { + type inet_service + flags constant + } + + set set2 { + type icmpv6_type + } +} diff --git a/tests/shell/testcases/maps/0005interval_map_add_many_elements_0 b/tests/shell/testcases/maps/0005interval_map_add_many_elements_0 index 55f9055..0714963 100755 --- a/tests/shell/testcases/maps/0005interval_map_add_many_elements_0 +++ b/tests/shell/testcases/maps/0005interval_map_add_many_elements_0 @@ -56,18 +56,3 @@ n=$HOWMANY echo "add element x y { 10.${n}.${n}.0/24 : 10.0.${n}.${n} }" > $tmpfile $NFT -f $tmpfile - -EXPECTED="table ip x { - map y { - type ipv4_addr : ipv4_addr - flags interval - elements = { "$(generate_test)" } - } -}" -GET=$($NFT list ruleset) -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi - diff --git a/tests/shell/testcases/maps/0005interval_map_add_many_elements_0.dump b/tests/shell/testcases/maps/0005interval_map_add_many_elements_0.dump new file mode 100644 index 0000000..ab992c4 --- /dev/null +++ b/tests/shell/testcases/maps/0005interval_map_add_many_elements_0.dump @@ -0,0 +1,8 @@ +table ip x { + map y { + type ipv4_addr : ipv4_addr + flags interval + elements = { 10.1.1.0/24 : 10.0.1.1, 10.1.2.0/24 : 10.0.1.2, + 10.2.1.0/24 : 10.0.2.1, 10.2.2.0/24 : 10.0.2.2 } + } +} diff --git a/tests/shell/testcases/maps/0006interval_map_overlap_0 b/tests/shell/testcases/maps/0006interval_map_overlap_0 index 8597639..682ac65 100755 --- a/tests/shell/testcases/maps/0006interval_map_overlap_0 +++ b/tests/shell/testcases/maps/0006interval_map_overlap_0 @@ -25,17 +25,3 @@ echo "add element x y { 10.0.${n}.0/24 : 10.0.0.${n} }" > $tmpfile $NFT -f $tmpfile -EXPECTED="table ip x { - map y { - type ipv4_addr : ipv4_addr - flags interval - elements = { 10.0.1.0/24 : 10.0.0.1, 10.0.2.0/24 : 10.0.0.2 } - } -}" -GET=$($NFT list ruleset) -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi - diff --git a/tests/shell/testcases/maps/0006interval_map_overlap_0.dump b/tests/shell/testcases/maps/0006interval_map_overlap_0.dump new file mode 100644 index 0000000..1f5343f --- /dev/null +++ b/tests/shell/testcases/maps/0006interval_map_overlap_0.dump @@ -0,0 +1,7 @@ +table ip x { + map y { + type ipv4_addr : ipv4_addr + flags interval + elements = { 10.0.1.0/24 : 10.0.0.1, 10.0.2.0/24 : 10.0.0.2 } + } +} diff --git a/tests/shell/testcases/maps/0007named_ifname_dtype_0 b/tests/shell/testcases/maps/0007named_ifname_dtype_0 index dcbcf2f..5e51a60 100755 --- a/tests/shell/testcases/maps/0007named_ifname_dtype_0 +++ b/tests/shell/testcases/maps/0007named_ifname_dtype_0 @@ -26,10 +26,3 @@ set -e echo "$EXPECTED" > $tmpfile $NFT -f $tmpfile -GET="$($NFT list ruleset)" -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi - diff --git a/tests/shell/testcases/maps/0007named_ifname_dtype_0.dump b/tests/shell/testcases/maps/0007named_ifname_dtype_0.dump new file mode 100644 index 0000000..878e7c0 --- /dev/null +++ b/tests/shell/testcases/maps/0007named_ifname_dtype_0.dump @@ -0,0 +1,11 @@ +table inet t { + map m1 { + type ifname : ipv4_addr + elements = { "eth0" : 1.1.1.1 } + } + + chain c { + ip daddr set iifname map @m1 + ip daddr set oifname map @m1 + } +} diff --git a/tests/shell/testcases/maps/anonymous_snat_map_0.dump b/tests/shell/testcases/maps/anonymous_snat_map_0.dump new file mode 100644 index 0000000..5009560 --- /dev/null +++ b/tests/shell/testcases/maps/anonymous_snat_map_0.dump @@ -0,0 +1,5 @@ +table ip nat { + chain postrouting { + snat to ip saddr map { 1.1.1.1 : 2.2.2.2 } + } +} diff --git a/tests/shell/testcases/maps/map_with_flags_0 b/tests/shell/testcases/maps/map_with_flags_0 index 8774eb5..68bd80d 100755 --- a/tests/shell/testcases/maps/map_with_flags_0 +++ b/tests/shell/testcases/maps/map_with_flags_0 @@ -4,18 +4,3 @@ set -e $NFT add table x $NFT add map x y { type ipv4_addr : ipv4_addr\; flags timeout\; } - -EXPECTED="table ip x { - map y { - type ipv4_addr : ipv4_addr - flags timeout - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/maps/map_with_flags_0.dump b/tests/shell/testcases/maps/map_with_flags_0.dump new file mode 100644 index 0000000..c96b1ed --- /dev/null +++ b/tests/shell/testcases/maps/map_with_flags_0.dump @@ -0,0 +1,6 @@ +table ip x { + map y { + type ipv4_addr : ipv4_addr + flags timeout + } +} diff --git a/tests/shell/testcases/maps/named_snat_map_0.dump b/tests/shell/testcases/maps/named_snat_map_0.dump new file mode 100644 index 0000000..a7c5751 --- /dev/null +++ b/tests/shell/testcases/maps/named_snat_map_0.dump @@ -0,0 +1,10 @@ +table ip nat { + map m { + type ipv4_addr : ipv4_addr + elements = { 1.1.1.1 : 2.2.2.2 } + } + + chain postrouting { + snat to ip saddr map @m + } +} diff --git a/tests/shell/testcases/nft-f/0001define_slash_0.dump b/tests/shell/testcases/nft-f/0001define_slash_0.dump new file mode 100644 index 0000000..e69de29 diff --git a/tests/shell/testcases/nft-f/0002rollback_rule_0 b/tests/shell/testcases/nft-f/0002rollback_rule_0 index ddeb542..1969054 100755 --- a/tests/shell/testcases/nft-f/0002rollback_rule_0 +++ b/tests/shell/testcases/nft-f/0002rollback_rule_0 @@ -48,13 +48,3 @@ if [ $? -eq 0 ] ; then echo "E: bogus ruleset loaded?" >&2 exit 1 fi - -KERNEL_RULESET="$($NFT list ruleset -nn)" - -if [ "$GOOD_RULESET" != "$KERNEL_RULESET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$GOOD_RULESET") <(echo "$KERNEL_RULESET") - exit 1 -fi - -exit 0 diff --git a/tests/shell/testcases/nft-f/0002rollback_rule_0.dump b/tests/shell/testcases/nft-f/0002rollback_rule_0.dump new file mode 100644 index 0000000..f6f2615 --- /dev/null +++ b/tests/shell/testcases/nft-f/0002rollback_rule_0.dump @@ -0,0 +1,16 @@ +table ip t { + set t { + type ipv4_addr + elements = { 1.1.1.1 } + } + + chain c { + ct state new + tcp dport { 22222 } + ip saddr @t drop + jump other + } + + chain other { + } +} diff --git a/tests/shell/testcases/nft-f/0003rollback_jump_0 b/tests/shell/testcases/nft-f/0003rollback_jump_0 index 6c43df9..f53fd23 100755 --- a/tests/shell/testcases/nft-f/0003rollback_jump_0 +++ b/tests/shell/testcases/nft-f/0003rollback_jump_0 @@ -48,13 +48,3 @@ if [ $? -eq 0 ] ; then echo "E: bogus ruleset loaded?" >&2 exit 1 fi - -KERNEL_RULESET="$($NFT list ruleset -nn)" - -if [ "$GOOD_RULESET" != "$KERNEL_RULESET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$GOOD_RULESET") <(echo "$KERNEL_RULESET") - exit 1 -fi - -exit 0 diff --git a/tests/shell/testcases/nft-f/0003rollback_jump_0.dump b/tests/shell/testcases/nft-f/0003rollback_jump_0.dump new file mode 100644 index 0000000..f6f2615 --- /dev/null +++ b/tests/shell/testcases/nft-f/0003rollback_jump_0.dump @@ -0,0 +1,16 @@ +table ip t { + set t { + type ipv4_addr + elements = { 1.1.1.1 } + } + + chain c { + ct state new + tcp dport { 22222 } + ip saddr @t drop + jump other + } + + chain other { + } +} diff --git a/tests/shell/testcases/nft-f/0004rollback_set_0 b/tests/shell/testcases/nft-f/0004rollback_set_0 index 1dea85e..7674106 100755 --- a/tests/shell/testcases/nft-f/0004rollback_set_0 +++ b/tests/shell/testcases/nft-f/0004rollback_set_0 @@ -48,13 +48,3 @@ if [ $? -eq 0 ] ; then echo "E: bogus ruleset loaded?" >&2 exit 1 fi - -KERNEL_RULESET="$($NFT list ruleset -nn)" - -if [ "$GOOD_RULESET" != "$KERNEL_RULESET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$GOOD_RULESET") <(echo "$KERNEL_RULESET") - exit 1 -fi - -exit 0 diff --git a/tests/shell/testcases/nft-f/0004rollback_set_0.dump b/tests/shell/testcases/nft-f/0004rollback_set_0.dump new file mode 100644 index 0000000..f6f2615 --- /dev/null +++ b/tests/shell/testcases/nft-f/0004rollback_set_0.dump @@ -0,0 +1,16 @@ +table ip t { + set t { + type ipv4_addr + elements = { 1.1.1.1 } + } + + chain c { + ct state new + tcp dport { 22222 } + ip saddr @t drop + jump other + } + + chain other { + } +} diff --git a/tests/shell/testcases/nft-f/0005rollback_map_0 b/tests/shell/testcases/nft-f/0005rollback_map_0 index 777cc71..ba1fcc5 100755 --- a/tests/shell/testcases/nft-f/0005rollback_map_0 +++ b/tests/shell/testcases/nft-f/0005rollback_map_0 @@ -51,13 +51,3 @@ if [ $? -eq 0 ] ; then echo "E: bogus ruleset loaded?" >&2 exit 1 fi - -KERNEL_RULESET="$($NFT list ruleset -nn)" - -if [ "$GOOD_RULESET" != "$KERNEL_RULESET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$GOOD_RULESET") <(echo "$KERNEL_RULESET") - exit 1 -fi - -exit 0 diff --git a/tests/shell/testcases/nft-f/0005rollback_map_0.dump b/tests/shell/testcases/nft-f/0005rollback_map_0.dump new file mode 100644 index 0000000..f6f2615 --- /dev/null +++ b/tests/shell/testcases/nft-f/0005rollback_map_0.dump @@ -0,0 +1,16 @@ +table ip t { + set t { + type ipv4_addr + elements = { 1.1.1.1 } + } + + chain c { + ct state new + tcp dport { 22222 } + ip saddr @t drop + jump other + } + + chain other { + } +} diff --git a/tests/shell/testcases/nft-f/0006action_object_0.dump b/tests/shell/testcases/nft-f/0006action_object_0.dump new file mode 100644 index 0000000..e69de29 diff --git a/tests/shell/testcases/nft-f/0008split_tables_0 b/tests/shell/testcases/nft-f/0008split_tables_0 index dd03545..b244d14 100755 --- a/tests/shell/testcases/nft-f/0008split_tables_0 +++ b/tests/shell/testcases/nft-f/0008split_tables_0 @@ -29,22 +29,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table inet filter { - chain ssh { - type filter hook input priority 0; policy accept; - tcp dport ssh accept - } - - chain input { - type filter hook input priority 1; policy accept; - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/nft-f/0008split_tables_0.dump b/tests/shell/testcases/nft-f/0008split_tables_0.dump new file mode 100644 index 0000000..1211411 --- /dev/null +++ b/tests/shell/testcases/nft-f/0008split_tables_0.dump @@ -0,0 +1,10 @@ +table inet filter { + chain ssh { + type filter hook input priority 0; policy accept; + tcp dport ssh accept + } + + chain input { + type filter hook input priority 1; policy accept; + } +} diff --git a/tests/shell/testcases/nft-f/0009variable_0.dump b/tests/shell/testcases/nft-f/0009variable_0.dump new file mode 100644 index 0000000..a793751 --- /dev/null +++ b/tests/shell/testcases/nft-f/0009variable_0.dump @@ -0,0 +1,7 @@ +table inet forward { + set concat-set-variable { + type ipv4_addr . inet_service + elements = { 10.10.10.10 . smtp, + 10.10.10.10 . imap2 } + } +} diff --git a/tests/shell/testcases/nft-f/0010variable_0.dump b/tests/shell/testcases/nft-f/0010variable_0.dump new file mode 100644 index 0000000..1f3d05e --- /dev/null +++ b/tests/shell/testcases/nft-f/0010variable_0.dump @@ -0,0 +1,6 @@ +table inet filter { + set whitelist_v4 { + type ipv4_addr + elements = { 1.1.1.1 } + } +} diff --git a/tests/shell/testcases/nft-f/0012different_defines_0.dump b/tests/shell/testcases/nft-f/0012different_defines_0.dump new file mode 100644 index 0000000..e9eef4b --- /dev/null +++ b/tests/shell/testcases/nft-f/0012different_defines_0.dump @@ -0,0 +1,16 @@ +table inet t { + chain c { + iifname "whatever" oifname "whatever" iif "lo" oif "lo" + iifname { "whatever" } iif { "lo" } mark 0x0000007b + ct state established,related,new + ct state != established | related | new + ip saddr 10.0.0.0 ip saddr 10.0.0.0 ip daddr 10.0.0.2 + ip6 daddr fe0::1 ip6 saddr fe0::2 + ip saddr vmap { 10.0.0.0 : drop, 10.0.0.2 : accept } + ip6 daddr vmap { fe0::1 : drop, fe0::2 : accept } + ip6 saddr . ip6 nexthdr { fe0::1 . udp, fe0::2 . tcp } + ip daddr . iif vmap { 10.0.0.0 . "lo" : accept } + tcp dport 100-222 + udp dport vmap { 100-222 : accept } + } +} diff --git a/tests/shell/testcases/optionals/comments_0.dump b/tests/shell/testcases/optionals/comments_0.dump new file mode 100644 index 0000000..416a07e --- /dev/null +++ b/tests/shell/testcases/optionals/comments_0.dump @@ -0,0 +1,5 @@ +table ip test { + chain test { + tcp dport ssh counter packets 0 bytes 0 accept comment "test_comment" + } +} diff --git a/tests/shell/testcases/optionals/comments_handles_0.dump b/tests/shell/testcases/optionals/comments_handles_0.dump new file mode 100644 index 0000000..416a07e --- /dev/null +++ b/tests/shell/testcases/optionals/comments_handles_0.dump @@ -0,0 +1,5 @@ +table ip test { + chain test { + tcp dport ssh counter packets 0 bytes 0 accept comment "test_comment" + } +} diff --git a/tests/shell/testcases/optionals/handles_0.dump b/tests/shell/testcases/optionals/handles_0.dump new file mode 100644 index 0000000..eb0af81 --- /dev/null +++ b/tests/shell/testcases/optionals/handles_0.dump @@ -0,0 +1,5 @@ +table ip test { + chain test { + tcp dport ssh counter packets 0 bytes 0 accept + } +} diff --git a/tests/shell/testcases/rule_management/0001addposition_0 b/tests/shell/testcases/rule_management/0001addposition_0 index e66bfff..ee90d92 100755 --- a/tests/shell/testcases/rule_management/0001addposition_0 +++ b/tests/shell/testcases/rule_management/0001addposition_0 @@ -9,19 +9,3 @@ $NFT add chain t c $NFT add rule t c accept # should have handle 2 $NFT add rule t c accept # should have handle 3 $NFT add rule t c position 2 drop - -EXPECTED="table ip t { - chain c { - accept - drop - accept - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/rule_management/0001addposition_0.dump b/tests/shell/testcases/rule_management/0001addposition_0.dump new file mode 100644 index 0000000..e282e13 --- /dev/null +++ b/tests/shell/testcases/rule_management/0001addposition_0.dump @@ -0,0 +1,7 @@ +table ip t { + chain c { + accept + drop + accept + } +} diff --git a/tests/shell/testcases/rule_management/0002insertposition_0 b/tests/shell/testcases/rule_management/0002insertposition_0 index cf8a568..e9f886f 100755 --- a/tests/shell/testcases/rule_management/0002insertposition_0 +++ b/tests/shell/testcases/rule_management/0002insertposition_0 @@ -9,19 +9,3 @@ $NFT add chain t c $NFT add rule t c accept # should have handle 2 $NFT add rule t c accept # should have handle 3 $NFT insert rule t c position 2 drop - -EXPECTED="table ip t { - chain c { - drop - accept - accept - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/rule_management/0002insertposition_0.dump b/tests/shell/testcases/rule_management/0002insertposition_0.dump new file mode 100644 index 0000000..527d79d --- /dev/null +++ b/tests/shell/testcases/rule_management/0002insertposition_0.dump @@ -0,0 +1,7 @@ +table ip t { + chain c { + drop + accept + accept + } +} diff --git a/tests/shell/testcases/rule_management/0003insert_0 b/tests/shell/testcases/rule_management/0003insert_0 index 6691c16..329ccc2 100755 --- a/tests/shell/testcases/rule_management/0003insert_0 +++ b/tests/shell/testcases/rule_management/0003insert_0 @@ -9,19 +9,3 @@ $NFT add chain t c $NFT insert rule t c accept $NFT insert rule t c drop $NFT insert rule t c masquerade - -EXPECTED="table ip t { - chain c { - masquerade - drop - accept - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/rule_management/0003insert_0.dump b/tests/shell/testcases/rule_management/0003insert_0.dump new file mode 100644 index 0000000..9421f4a --- /dev/null +++ b/tests/shell/testcases/rule_management/0003insert_0.dump @@ -0,0 +1,7 @@ +table ip t { + chain c { + masquerade + drop + accept + } +} diff --git a/tests/shell/testcases/rule_management/0004replace_0 b/tests/shell/testcases/rule_management/0004replace_0 index 6a4b949..c3329af 100755 --- a/tests/shell/testcases/rule_management/0004replace_0 +++ b/tests/shell/testcases/rule_management/0004replace_0 @@ -8,17 +8,3 @@ $NFT add table t $NFT add chain t c $NFT add rule t c accept # should have handle 2 $NFT replace rule t c handle 2 drop - -EXPECTED="table ip t { - chain c { - drop - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/rule_management/0004replace_0.dump b/tests/shell/testcases/rule_management/0004replace_0.dump new file mode 100644 index 0000000..e20952e --- /dev/null +++ b/tests/shell/testcases/rule_management/0004replace_0.dump @@ -0,0 +1,5 @@ +table ip t { + chain c { + drop + } +} diff --git a/tests/shell/testcases/rule_management/0007delete_0 b/tests/shell/testcases/rule_management/0007delete_0 index 126fe5d..11376cc 100755 --- a/tests/shell/testcases/rule_management/0007delete_0 +++ b/tests/shell/testcases/rule_management/0007delete_0 @@ -9,17 +9,3 @@ $NFT add chain t c $NFT add rule t c accept # should have handle 2 $NFT add rule t c drop # should have handle 3 $NFT delete rule t c handle 2 - -EXPECTED="table ip t { - chain c { - drop - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/rule_management/0007delete_0.dump b/tests/shell/testcases/rule_management/0007delete_0.dump new file mode 100644 index 0000000..e20952e --- /dev/null +++ b/tests/shell/testcases/rule_management/0007delete_0.dump @@ -0,0 +1,5 @@ +table ip t { + chain c { + drop + } +} diff --git a/tests/shell/testcases/sets/0001named_interval_0.dump b/tests/shell/testcases/sets/0001named_interval_0.dump new file mode 100644 index 0000000..3049aa8 --- /dev/null +++ b/tests/shell/testcases/sets/0001named_interval_0.dump @@ -0,0 +1,34 @@ +table inet t { + set s1 { + type ipv4_addr + flags interval + elements = { 10.0.0.0-11.0.0.0, 172.16.0.0/16 } + } + + set s2 { + type ipv6_addr + flags interval + elements = { fe00::/64, + fe11::-fe22:: } + } + + set s3 { + type inet_proto + flags interval + elements = { 10-20, 50-60 } + } + + set s4 { + type inet_service + flags interval + elements = { 0-1024, 8080-8082, 10000-40000 } + } + + chain c { + ip saddr @s1 accept + ip6 daddr @s2 accept + ip protocol @s3 accept + ip6 nexthdr @s3 accept + tcp dport @s4 accept + } +} diff --git a/tests/shell/testcases/sets/0002named_interval_automerging_0.dump b/tests/shell/testcases/sets/0002named_interval_automerging_0.dump new file mode 100644 index 0000000..452ee23 --- /dev/null +++ b/tests/shell/testcases/sets/0002named_interval_automerging_0.dump @@ -0,0 +1,7 @@ +table ip t { + set s { + type ipv4_addr + flags interval + elements = { 192.168.0.0/24, 192.168.1.0/24 } + } +} diff --git a/tests/shell/testcases/sets/0003named_interval_missing_flag_0.dump b/tests/shell/testcases/sets/0003named_interval_missing_flag_0.dump new file mode 100644 index 0000000..70c32a8 --- /dev/null +++ b/tests/shell/testcases/sets/0003named_interval_missing_flag_0.dump @@ -0,0 +1,5 @@ +table ip t { + set s { + type ipv4_addr + } +} diff --git a/tests/shell/testcases/sets/0004named_interval_shadow_0.dump b/tests/shell/testcases/sets/0004named_interval_shadow_0.dump new file mode 100644 index 0000000..940030a --- /dev/null +++ b/tests/shell/testcases/sets/0004named_interval_shadow_0.dump @@ -0,0 +1,7 @@ +table inet t { + set s { + type ipv6_addr + flags interval + elements = { fe00::/64 } + } +} diff --git a/tests/shell/testcases/sets/0005named_interval_shadow_0.dump b/tests/shell/testcases/sets/0005named_interval_shadow_0.dump new file mode 100644 index 0000000..4224d9d --- /dev/null +++ b/tests/shell/testcases/sets/0005named_interval_shadow_0.dump @@ -0,0 +1,7 @@ +table inet t { + set s { + type ipv6_addr + flags interval + elements = { fe00::/48 } + } +} diff --git a/tests/shell/testcases/sets/0006create_set_0.dump b/tests/shell/testcases/sets/0006create_set_0.dump new file mode 100644 index 0000000..70c32a8 --- /dev/null +++ b/tests/shell/testcases/sets/0006create_set_0.dump @@ -0,0 +1,5 @@ +table ip t { + set s { + type ipv4_addr + } +} diff --git a/tests/shell/testcases/sets/0007create_element_0.dump b/tests/shell/testcases/sets/0007create_element_0.dump new file mode 100644 index 0000000..169be11 --- /dev/null +++ b/tests/shell/testcases/sets/0007create_element_0.dump @@ -0,0 +1,6 @@ +table ip t { + set s { + type ipv4_addr + elements = { 1.1.1.1 } + } +} diff --git a/tests/shell/testcases/sets/0008comments_interval_0.dump b/tests/shell/testcases/sets/0008comments_interval_0.dump new file mode 100644 index 0000000..5e7a768 --- /dev/null +++ b/tests/shell/testcases/sets/0008comments_interval_0.dump @@ -0,0 +1,7 @@ +table ip t { + set s { + type ipv4_addr + flags interval + elements = { 1.1.1.1 comment "test" } + } +} diff --git a/tests/shell/testcases/sets/0008create_verdict_map_0.dump b/tests/shell/testcases/sets/0008create_verdict_map_0.dump new file mode 100644 index 0000000..ab0fe80 --- /dev/null +++ b/tests/shell/testcases/sets/0008create_verdict_map_0.dump @@ -0,0 +1,13 @@ +table ip t { + map sourcemap { + type ipv4_addr : verdict + elements = { 100.123.10.2 : jump c } + } + + chain postrouting { + ip saddr vmap @sourcemap accept + } + + chain c { + } +} diff --git a/tests/shell/testcases/sets/0009comments_timeout_0.dump b/tests/shell/testcases/sets/0009comments_timeout_0.dump new file mode 100644 index 0000000..455ebe3 --- /dev/null +++ b/tests/shell/testcases/sets/0009comments_timeout_0.dump @@ -0,0 +1,7 @@ +table ip t { + set s { + type ipv4_addr + flags timeout + elements = { 1.1.1.1 comment "test" } + } +} diff --git a/tests/shell/testcases/sets/0010comments_0.dump b/tests/shell/testcases/sets/0010comments_0.dump new file mode 100644 index 0000000..6e42ec4 --- /dev/null +++ b/tests/shell/testcases/sets/0010comments_0.dump @@ -0,0 +1,6 @@ +table inet t { + set s { + type ipv6_addr + elements = { ::1 comment "test" } + } +} diff --git a/tests/shell/testcases/sets/0012add_delete_many_elements_0 b/tests/shell/testcases/sets/0012add_delete_many_elements_0 index 7a5f8c6..7e7beeb 100755 --- a/tests/shell/testcases/sets/0012add_delete_many_elements_0 +++ b/tests/shell/testcases/sets/0012add_delete_many_elements_0 @@ -31,16 +31,3 @@ delete element x y $(generate)" > $tmpfile set -e $NFT -f $tmpfile - -EXPECTED="table ip x { - set y { - type ipv4_addr - } -}" -GET=$($NFT list ruleset) -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi - diff --git a/tests/shell/testcases/sets/0012add_delete_many_elements_0.dump b/tests/shell/testcases/sets/0012add_delete_many_elements_0.dump new file mode 100644 index 0000000..e3d4aee --- /dev/null +++ b/tests/shell/testcases/sets/0012add_delete_many_elements_0.dump @@ -0,0 +1,5 @@ +table ip x { + set y { + type ipv4_addr + } +} diff --git a/tests/shell/testcases/sets/0013add_delete_many_elements_0 b/tests/shell/testcases/sets/0013add_delete_many_elements_0 index 265a554..5774317 100755 --- a/tests/shell/testcases/sets/0013add_delete_many_elements_0 +++ b/tests/shell/testcases/sets/0013add_delete_many_elements_0 @@ -32,17 +32,3 @@ add element x y $(generate)" > $tmpfile $NFT -f $tmpfile echo "delete element x y $(generate)" > $tmpfile $NFT -f $tmpfile - - -EXPECTED="table ip x { - set y { - type ipv4_addr - } -}" -GET=$($NFT list ruleset) -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi - diff --git a/tests/shell/testcases/sets/0013add_delete_many_elements_0.dump b/tests/shell/testcases/sets/0013add_delete_many_elements_0.dump new file mode 100644 index 0000000..e3d4aee --- /dev/null +++ b/tests/shell/testcases/sets/0013add_delete_many_elements_0.dump @@ -0,0 +1,5 @@ +table ip x { + set y { + type ipv4_addr + } +} diff --git a/tests/shell/testcases/sets/0014malformed_set_is_not_defined_0.dump b/tests/shell/testcases/sets/0014malformed_set_is_not_defined_0.dump new file mode 100644 index 0000000..e69de29 diff --git a/tests/shell/testcases/sets/0015rulesetflush_0.dump b/tests/shell/testcases/sets/0015rulesetflush_0.dump new file mode 100644 index 0000000..f6eddbf --- /dev/null +++ b/tests/shell/testcases/sets/0015rulesetflush_0.dump @@ -0,0 +1,11 @@ +table ip t { + chain c { + } +} +table inet filter { + set blacklist_v4 { + type ipv4_addr + flags interval + elements = { 192.168.0.0/24 } + } +} diff --git a/tests/shell/testcases/sets/0016element_leak_0.dump b/tests/shell/testcases/sets/0016element_leak_0.dump new file mode 100644 index 0000000..9d2b0af --- /dev/null +++ b/tests/shell/testcases/sets/0016element_leak_0.dump @@ -0,0 +1,7 @@ +table ip x { + set s { + type ipv4_addr + size 2 + elements = { 1.1.1.1 } + } +} diff --git a/tests/shell/testcases/sets/0017add_after_flush_0.dump b/tests/shell/testcases/sets/0017add_after_flush_0.dump new file mode 100644 index 0000000..9d2b0af --- /dev/null +++ b/tests/shell/testcases/sets/0017add_after_flush_0.dump @@ -0,0 +1,7 @@ +table ip x { + set s { + type ipv4_addr + size 2 + elements = { 1.1.1.1 } + } +} diff --git a/tests/shell/testcases/sets/0019set_check_size_0.dump b/tests/shell/testcases/sets/0019set_check_size_0.dump new file mode 100644 index 0000000..8cd3707 --- /dev/null +++ b/tests/shell/testcases/sets/0019set_check_size_0.dump @@ -0,0 +1,7 @@ +table ip x { + set s { + type ipv4_addr + size 2 + elements = { 1.1.1.1, 1.1.1.2 } + } +} diff --git a/tests/shell/testcases/sets/0020comments_0.dump b/tests/shell/testcases/sets/0020comments_0.dump new file mode 100644 index 0000000..d533084 --- /dev/null +++ b/tests/shell/testcases/sets/0020comments_0.dump @@ -0,0 +1,6 @@ +table inet t { + set s { + type inet_service + elements = { ssh comment "test" } + } +} diff --git a/tests/shell/testcases/sets/0021nesting_0 b/tests/shell/testcases/sets/0021nesting_0 index 763d9ae..4779f26 100755 --- a/tests/shell/testcases/sets/0021nesting_0 +++ b/tests/shell/testcases/sets/0021nesting_0 @@ -30,17 +30,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load ruleset" >&2 exit 1 fi - -EXPECTED="table ip x { - chain y { - ip saddr { 1.1.1.0/24, 2.2.2.0/24, 3.3.3.0/24 } - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/sets/0021nesting_0.dump b/tests/shell/testcases/sets/0021nesting_0.dump new file mode 100644 index 0000000..6fd2a44 --- /dev/null +++ b/tests/shell/testcases/sets/0021nesting_0.dump @@ -0,0 +1,5 @@ +table ip x { + chain y { + ip saddr { 1.1.1.0/24, 2.2.2.0/24, 3.3.3.0/24 } + } +} diff --git a/tests/shell/testcases/sets/0022type_selective_flush_0.dump b/tests/shell/testcases/sets/0022type_selective_flush_0.dump new file mode 100644 index 0000000..3dd9760 --- /dev/null +++ b/tests/shell/testcases/sets/0022type_selective_flush_0.dump @@ -0,0 +1,13 @@ +table ip t { + set s { + type ipv4_addr + } + + map m { + type ipv4_addr : inet_service + } + + chain c { + tcp dport http meter f { ip saddr limit rate 10/second} + } +} diff --git a/tests/shell/testcases/sets/0023incomplete_add_set_command_0.dump b/tests/shell/testcases/sets/0023incomplete_add_set_command_0.dump new file mode 100644 index 0000000..985768b --- /dev/null +++ b/tests/shell/testcases/sets/0023incomplete_add_set_command_0.dump @@ -0,0 +1,2 @@ +table ip t { +} diff --git a/tests/shell/testcases/sets/0024named_objects_0.dump b/tests/shell/testcases/sets/0024named_objects_0.dump new file mode 100644 index 0000000..929c5d9 --- /dev/null +++ b/tests/shell/testcases/sets/0024named_objects_0.dump @@ -0,0 +1,28 @@ +table inet x { + counter user123 { + packets 12 bytes 1433 + } + + quota user123 { + over 2000 bytes + } + + quota user124 { + over 2000 bytes + } + + set y { + type ipv4_addr + } + + map test { + type ipv4_addr : quota + elements = { 192.168.2.2 : "user124", 192.168.2.3 : "user124" } + } + + chain y { + type filter hook input priority 0; policy accept; + counter name ip saddr map { 1.1.1.1 : "user123", 2.2.2.2 : "user123", 192.168.2.2 : "user123" } + quota name ip saddr map @test drop + } +} diff --git a/tests/shell/testcases/sets/0025anonymous_set_0.dump b/tests/shell/testcases/sets/0025anonymous_set_0.dump new file mode 100644 index 0000000..c823ae9 --- /dev/null +++ b/tests/shell/testcases/sets/0025anonymous_set_0.dump @@ -0,0 +1,7 @@ +table ip t { + chain c { + type filter hook output priority 0; policy accept; + ip daddr { 192.168.0.1, 192.168.0.2, 192.168.0.3 } + tcp dport { ssh, telnet } counter packets 0 bytes 0 + } +} diff --git a/tests/shell/testcases/sets/0026named_limit_0.dump b/tests/shell/testcases/sets/0026named_limit_0.dump new file mode 100644 index 0000000..0d1f125 --- /dev/null +++ b/tests/shell/testcases/sets/0026named_limit_0.dump @@ -0,0 +1,10 @@ +table ip filter { + limit http-traffic { + rate 1/second + } + + chain input { + type filter hook input priority 0; policy accept; + limit name tcp dport map { http : "http-traffic", https : "http-traffic" } + } +} diff --git a/tests/shell/testcases/sets/0027ipv6_maps_ipv4_0.dump b/tests/shell/testcases/sets/0027ipv6_maps_ipv4_0.dump new file mode 100644 index 0000000..c49eefa --- /dev/null +++ b/tests/shell/testcases/sets/0027ipv6_maps_ipv4_0.dump @@ -0,0 +1,7 @@ +table inet t { + set s { + type ipv6_addr + flags interval + elements = { ::ffff:0.0.0.0/96 } + } +} diff --git a/tests/shell/testcases/sets/0029named_ifname_dtype_0 b/tests/shell/testcases/sets/0029named_ifname_dtype_0 index 8b7ab98..92f4a4a 100755 --- a/tests/shell/testcases/sets/0029named_ifname_dtype_0 +++ b/tests/shell/testcases/sets/0029named_ifname_dtype_0 @@ -25,11 +25,3 @@ EXPECTED="table inet t { set -e echo "$EXPECTED" > $tmpfile $NFT -f $tmpfile - -GET="$($NFT list ruleset)" -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi - diff --git a/tests/shell/testcases/sets/0029named_ifname_dtype_0.dump b/tests/shell/testcases/sets/0029named_ifname_dtype_0.dump new file mode 100644 index 0000000..2c82e57 --- /dev/null +++ b/tests/shell/testcases/sets/0029named_ifname_dtype_0.dump @@ -0,0 +1,11 @@ +table inet t { + set s { + type ifname + elements = { "eth0" } + } + + chain c { + iifname @s accept + oifname @s accept + } +} diff --git a/tests/shell/testcases/sets/0031set_timeout_size_0.dump b/tests/shell/testcases/sets/0031set_timeout_size_0.dump new file mode 100644 index 0000000..e69de29 diff --git a/tests/shell/testcases/transactions/0001table_0 b/tests/shell/testcases/transactions/0001table_0 index 0bde101..83f9fd0 100755 --- a/tests/shell/testcases/transactions/0001table_0 +++ b/tests/shell/testcases/transactions/0001table_0 @@ -21,16 +21,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip x { -} -table ip y { -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0001table_0.dump b/tests/shell/testcases/transactions/0001table_0.dump new file mode 100644 index 0000000..e4e5f9b --- /dev/null +++ b/tests/shell/testcases/transactions/0001table_0.dump @@ -0,0 +1,4 @@ +table ip x { +} +table ip y { +} diff --git a/tests/shell/testcases/transactions/0002table_0 b/tests/shell/testcases/transactions/0002table_0 index c5f319e..dbd2f4a 100755 --- a/tests/shell/testcases/transactions/0002table_0 +++ b/tests/shell/testcases/transactions/0002table_0 @@ -21,15 +21,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip x { - flags dormant -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0002table_0.dump b/tests/shell/testcases/transactions/0002table_0.dump new file mode 100644 index 0000000..6eb7072 --- /dev/null +++ b/tests/shell/testcases/transactions/0002table_0.dump @@ -0,0 +1,3 @@ +table ip x { + flags dormant +} diff --git a/tests/shell/testcases/transactions/0003table_0 b/tests/shell/testcases/transactions/0003table_0 index f17285e..004ce51 100755 --- a/tests/shell/testcases/transactions/0003table_0 +++ b/tests/shell/testcases/transactions/0003table_0 @@ -20,13 +20,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0003table_0.dump b/tests/shell/testcases/transactions/0003table_0.dump new file mode 100644 index 0000000..e69de29 diff --git a/tests/shell/testcases/transactions/0010chain_0 b/tests/shell/testcases/transactions/0010chain_0 index f4c1fbd..d191868 100755 --- a/tests/shell/testcases/transactions/0010chain_0 +++ b/tests/shell/testcases/transactions/0010chain_0 @@ -22,16 +22,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip w { - chain y { - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0010chain_0.dump b/tests/shell/testcases/transactions/0010chain_0.dump new file mode 100644 index 0000000..aa4a521 --- /dev/null +++ b/tests/shell/testcases/transactions/0010chain_0.dump @@ -0,0 +1,4 @@ +table ip w { + chain y { + } +} diff --git a/tests/shell/testcases/transactions/0011chain_0 b/tests/shell/testcases/transactions/0011chain_0 index 71afa6e..aac33d5 100755 --- a/tests/shell/testcases/transactions/0011chain_0 +++ b/tests/shell/testcases/transactions/0011chain_0 @@ -22,17 +22,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip x { - chain y { - type filter hook input priority 0; policy drop; - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0011chain_0.dump b/tests/shell/testcases/transactions/0011chain_0.dump new file mode 100644 index 0000000..02cdb23 --- /dev/null +++ b/tests/shell/testcases/transactions/0011chain_0.dump @@ -0,0 +1,5 @@ +table ip x { + chain y { + type filter hook input priority 0; policy drop; + } +} diff --git a/tests/shell/testcases/transactions/0012chain_0 b/tests/shell/testcases/transactions/0012chain_0 index 757bc75..c3bfe13 100755 --- a/tests/shell/testcases/transactions/0012chain_0 +++ b/tests/shell/testcases/transactions/0012chain_0 @@ -26,17 +26,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip w { - chain y { - type filter hook output priority 0; policy accept; - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0012chain_0.dump b/tests/shell/testcases/transactions/0012chain_0.dump new file mode 100644 index 0000000..1fddecb --- /dev/null +++ b/tests/shell/testcases/transactions/0012chain_0.dump @@ -0,0 +1,5 @@ +table ip w { + chain y { + type filter hook output priority 0; policy accept; + } +} diff --git a/tests/shell/testcases/transactions/0013chain_0 b/tests/shell/testcases/transactions/0013chain_0 index 2c75bd4..67c31c8 100755 --- a/tests/shell/testcases/transactions/0013chain_0 +++ b/tests/shell/testcases/transactions/0013chain_0 @@ -27,17 +27,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip w { - chain y { - type filter hook output priority 0; policy accept; - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0013chain_0.dump b/tests/shell/testcases/transactions/0013chain_0.dump new file mode 100644 index 0000000..1fddecb --- /dev/null +++ b/tests/shell/testcases/transactions/0013chain_0.dump @@ -0,0 +1,5 @@ +table ip w { + chain y { + type filter hook output priority 0; policy accept; + } +} diff --git a/tests/shell/testcases/transactions/0020rule_0 b/tests/shell/testcases/transactions/0020rule_0 index 1ad4362..e38634d 100755 --- a/tests/shell/testcases/transactions/0020rule_0 +++ b/tests/shell/testcases/transactions/0020rule_0 @@ -21,13 +21,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0020rule_0.dump b/tests/shell/testcases/transactions/0020rule_0.dump new file mode 100644 index 0000000..e69de29 diff --git a/tests/shell/testcases/transactions/0021rule_0 b/tests/shell/testcases/transactions/0021rule_0 index 2467124..284a9e7 100755 --- a/tests/shell/testcases/transactions/0021rule_0 +++ b/tests/shell/testcases/transactions/0021rule_0 @@ -24,17 +24,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip x { - chain y { - ip saddr 2.2.2.2 counter packets 0 bytes 0 - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0021rule_0.dump b/tests/shell/testcases/transactions/0021rule_0.dump new file mode 100644 index 0000000..a6c4130 --- /dev/null +++ b/tests/shell/testcases/transactions/0021rule_0.dump @@ -0,0 +1,5 @@ +table ip x { + chain y { + ip saddr 2.2.2.2 counter packets 0 bytes 0 + } +} diff --git a/tests/shell/testcases/transactions/0030set_0 b/tests/shell/testcases/transactions/0030set_0 index 1fefb94..ad08b7e 100755 --- a/tests/shell/testcases/transactions/0030set_0 +++ b/tests/shell/testcases/transactions/0030set_0 @@ -21,14 +21,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip x { -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0030set_0.dump b/tests/shell/testcases/transactions/0030set_0.dump new file mode 100644 index 0000000..5d4d2ca --- /dev/null +++ b/tests/shell/testcases/transactions/0030set_0.dump @@ -0,0 +1,2 @@ +table ip x { +} diff --git a/tests/shell/testcases/transactions/0031set_0 b/tests/shell/testcases/transactions/0031set_0 index 87848b4..6c5757c 100755 --- a/tests/shell/testcases/transactions/0031set_0 +++ b/tests/shell/testcases/transactions/0031set_0 @@ -21,17 +21,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip x { - set y { - type ipv4_addr - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0031set_0.dump b/tests/shell/testcases/transactions/0031set_0.dump new file mode 100644 index 0000000..e3d4aee --- /dev/null +++ b/tests/shell/testcases/transactions/0031set_0.dump @@ -0,0 +1,5 @@ +table ip x { + set y { + type ipv4_addr + } +} diff --git a/tests/shell/testcases/transactions/0032set_0 b/tests/shell/testcases/transactions/0032set_0 index d4d7e7e..1b41cf0 100755 --- a/tests/shell/testcases/transactions/0032set_0 +++ b/tests/shell/testcases/transactions/0032set_0 @@ -22,17 +22,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip w { - set y { - type ipv4_addr - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0032set_0.dump b/tests/shell/testcases/transactions/0032set_0.dump new file mode 100644 index 0000000..7d11892 --- /dev/null +++ b/tests/shell/testcases/transactions/0032set_0.dump @@ -0,0 +1,5 @@ +table ip w { + set y { + type ipv4_addr + } +} diff --git a/tests/shell/testcases/transactions/0033set_0 b/tests/shell/testcases/transactions/0033set_0 index b73b6fc..19543b3 100755 --- a/tests/shell/testcases/transactions/0033set_0 +++ b/tests/shell/testcases/transactions/0033set_0 @@ -20,14 +20,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip x { -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0033set_0.dump b/tests/shell/testcases/transactions/0033set_0.dump new file mode 100644 index 0000000..5d4d2ca --- /dev/null +++ b/tests/shell/testcases/transactions/0033set_0.dump @@ -0,0 +1,2 @@ +table ip x { +} diff --git a/tests/shell/testcases/transactions/0034set_0 b/tests/shell/testcases/transactions/0034set_0 index 25e6500..4cddb94 100755 --- a/tests/shell/testcases/transactions/0034set_0 +++ b/tests/shell/testcases/transactions/0034set_0 @@ -21,17 +21,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip x { - set y { - type ipv4_addr - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0034set_0.dump b/tests/shell/testcases/transactions/0034set_0.dump new file mode 100644 index 0000000..e3d4aee --- /dev/null +++ b/tests/shell/testcases/transactions/0034set_0.dump @@ -0,0 +1,5 @@ +table ip x { + set y { + type ipv4_addr + } +} diff --git a/tests/shell/testcases/transactions/0035set_0 b/tests/shell/testcases/transactions/0035set_0 index 0788e2f..9b20746 100755 --- a/tests/shell/testcases/transactions/0035set_0 +++ b/tests/shell/testcases/transactions/0035set_0 @@ -23,18 +23,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip x { - set y { - type ipv4_addr - elements = { 3.3.3.3 } - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0035set_0.dump b/tests/shell/testcases/transactions/0035set_0.dump new file mode 100644 index 0000000..e111494 --- /dev/null +++ b/tests/shell/testcases/transactions/0035set_0.dump @@ -0,0 +1,6 @@ +table ip x { + set y { + type ipv4_addr + elements = { 3.3.3.3 } + } +} diff --git a/tests/shell/testcases/transactions/0037set_0 b/tests/shell/testcases/transactions/0037set_0 index 3e48c80..75b1d45 100755 --- a/tests/shell/testcases/transactions/0037set_0 +++ b/tests/shell/testcases/transactions/0037set_0 @@ -21,18 +21,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip x { - set y { - type ipv4_addr - flags interval - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0037set_0.dump b/tests/shell/testcases/transactions/0037set_0.dump new file mode 100644 index 0000000..ca69cee --- /dev/null +++ b/tests/shell/testcases/transactions/0037set_0.dump @@ -0,0 +1,6 @@ +table ip x { + set y { + type ipv4_addr + flags interval + } +} diff --git a/tests/shell/testcases/transactions/0038set_0 b/tests/shell/testcases/transactions/0038set_0 index 7655075..3120e91 100755 --- a/tests/shell/testcases/transactions/0038set_0 +++ b/tests/shell/testcases/transactions/0038set_0 @@ -23,19 +23,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip x { - set y { - type ipv4_addr - flags interval - elements = { 192.168.4.0/24 } - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0038set_0.dump b/tests/shell/testcases/transactions/0038set_0.dump new file mode 100644 index 0000000..651a11b --- /dev/null +++ b/tests/shell/testcases/transactions/0038set_0.dump @@ -0,0 +1,7 @@ +table ip x { + set y { + type ipv4_addr + flags interval + elements = { 192.168.4.0/24 } + } +} diff --git a/tests/shell/testcases/transactions/0039set_0 b/tests/shell/testcases/transactions/0039set_0 index 7655075..3120e91 100755 --- a/tests/shell/testcases/transactions/0039set_0 +++ b/tests/shell/testcases/transactions/0039set_0 @@ -23,19 +23,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -EXPECTED="table ip x { - set y { - type ipv4_addr - flags interval - elements = { 192.168.4.0/24 } - } -}" - -GET="$($NFT list ruleset)" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0039set_0.dump b/tests/shell/testcases/transactions/0039set_0.dump new file mode 100644 index 0000000..651a11b --- /dev/null +++ b/tests/shell/testcases/transactions/0039set_0.dump @@ -0,0 +1,7 @@ +table ip x { + set y { + type ipv4_addr + flags interval + elements = { 192.168.4.0/24 } + } +} diff --git a/tests/shell/testcases/transactions/0040set_0 b/tests/shell/testcases/transactions/0040set_0 index 241703d..0ffc441 100755 --- a/tests/shell/testcases/transactions/0040set_0 +++ b/tests/shell/testcases/transactions/0040set_0 @@ -51,26 +51,3 @@ if [ $? -ne 0 ] ; then echo "E: unable to load good ruleset" >&2 exit 1 fi - -GET="$($NFT list ruleset)" - -EXPECTED="table ip filter { - map client_to_any { - type ipv4_addr : verdict - } - - chain FORWARD { - type filter hook forward priority 0; policy accept; - goto client_to_any - } - - chain client_to_any { - ip saddr vmap @client_to_any - } -}" - -if [ "$EXPECTED" != "$GET" ] ; then - DIFF="$(which diff)" - [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") - exit 1 -fi diff --git a/tests/shell/testcases/transactions/0040set_0.dump b/tests/shell/testcases/transactions/0040set_0.dump new file mode 100644 index 0000000..fe86405 --- /dev/null +++ b/tests/shell/testcases/transactions/0040set_0.dump @@ -0,0 +1,14 @@ +table ip filter { + map client_to_any { + type ipv4_addr : verdict + } + + chain FORWARD { + type filter hook forward priority 0; policy accept; + goto client_to_any + } + + chain client_to_any { + ip saddr vmap @client_to_any + } +}
Complete the automated shell tests with the verification of the test file dump, only for positive tests and if the test execution was successful. It's able to generate the dump file with the -g option. Example: # ./run-tests.sh -g testcases/chains/0001jumps_0 The dump files are generated in the same path with .dump extension. It has been avoided the dump verification code in every test file. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> --- tests/shell/README | 5 +- tests/shell/run-tests.sh | 43 ++++++++++++--- .../testcases/cache/0001_cache_handling_0.dump | 12 ++++ tests/shell/testcases/cache/0002_interval_0.dump | 7 +++ tests/shell/testcases/chains/0001jumps_0.dump | 64 ++++++++++++++++++++++ tests/shell/testcases/chains/0006masquerade_0.dump | 6 ++ tests/shell/testcases/chains/0013rename_0.dump | 4 ++ tests/shell/testcases/include/0001absolute_0.dump | 2 + tests/shell/testcases/include/0002relative_0.dump | 2 + .../shell/testcases/include/0003includepath_0.dump | 2 + .../shell/testcases/include/0005glob_empty_0.dump | 0 .../shell/testcases/include/0006glob_single_0.dump | 2 + .../shell/testcases/include/0007glob_double_0.dump | 4 ++ .../include/0008glob_nofile_wildcard_0.dump | 0 .../testcases/include/0011glob_dependency_0.dump | 4 ++ .../testcases/include/0013glob_dotfile_0.dump | 2 + .../0013input_descriptors_included_files_0.dump | 0 .../testcases/include/0014glob_directory_0.dump | 0 .../testcases/include/0015doubleincludepath_0.dump | 4 ++ tests/shell/testcases/listing/0001ruleset_0 | 11 ---- tests/shell/testcases/listing/0001ruleset_0.dump | 2 + tests/shell/testcases/listing/0002ruleset_0 | 9 --- tests/shell/testcases/listing/0002ruleset_0.dump | 0 tests/shell/testcases/listing/0003table_0.dump | 2 + tests/shell/testcases/listing/0004table_0.dump | 4 ++ .../shell/testcases/listing/0005ruleset_ip_0.dump | 10 ++++ .../shell/testcases/listing/0006ruleset_ip6_0.dump | 10 ++++ .../testcases/listing/0007ruleset_inet_0.dump | 10 ++++ .../shell/testcases/listing/0008ruleset_arp_0.dump | 10 ++++ .../testcases/listing/0009ruleset_bridge_0.dump | 10 ++++ tests/shell/testcases/listing/0010sets_0.dump | 39 +++++++++++++ tests/shell/testcases/listing/0011sets_0.dump | 25 +++++++++ tests/shell/testcases/listing/0012sets_0.dump | 39 +++++++++++++ .../maps/0005interval_map_add_many_elements_0 | 15 ----- .../maps/0005interval_map_add_many_elements_0.dump | 8 +++ .../testcases/maps/0006interval_map_overlap_0 | 14 ----- .../testcases/maps/0006interval_map_overlap_0.dump | 7 +++ .../shell/testcases/maps/0007named_ifname_dtype_0 | 7 --- .../testcases/maps/0007named_ifname_dtype_0.dump | 11 ++++ .../shell/testcases/maps/anonymous_snat_map_0.dump | 5 ++ tests/shell/testcases/maps/map_with_flags_0 | 15 ----- tests/shell/testcases/maps/map_with_flags_0.dump | 6 ++ tests/shell/testcases/maps/named_snat_map_0.dump | 10 ++++ .../shell/testcases/nft-f/0001define_slash_0.dump | 0 tests/shell/testcases/nft-f/0002rollback_rule_0 | 10 ---- .../shell/testcases/nft-f/0002rollback_rule_0.dump | 16 ++++++ tests/shell/testcases/nft-f/0003rollback_jump_0 | 10 ---- .../shell/testcases/nft-f/0003rollback_jump_0.dump | 16 ++++++ tests/shell/testcases/nft-f/0004rollback_set_0 | 10 ---- .../shell/testcases/nft-f/0004rollback_set_0.dump | 16 ++++++ tests/shell/testcases/nft-f/0005rollback_map_0 | 10 ---- .../shell/testcases/nft-f/0005rollback_map_0.dump | 16 ++++++ .../shell/testcases/nft-f/0006action_object_0.dump | 0 tests/shell/testcases/nft-f/0008split_tables_0 | 19 ------- .../shell/testcases/nft-f/0008split_tables_0.dump | 10 ++++ tests/shell/testcases/nft-f/0009variable_0.dump | 7 +++ tests/shell/testcases/nft-f/0010variable_0.dump | 6 ++ .../testcases/nft-f/0012different_defines_0.dump | 16 ++++++ tests/shell/testcases/optionals/comments_0.dump | 5 ++ .../testcases/optionals/comments_handles_0.dump | 5 ++ tests/shell/testcases/optionals/handles_0.dump | 5 ++ .../testcases/rule_management/0001addposition_0 | 16 ------ .../rule_management/0001addposition_0.dump | 7 +++ .../testcases/rule_management/0002insertposition_0 | 16 ------ .../rule_management/0002insertposition_0.dump | 7 +++ tests/shell/testcases/rule_management/0003insert_0 | 16 ------ .../testcases/rule_management/0003insert_0.dump | 7 +++ .../shell/testcases/rule_management/0004replace_0 | 14 ----- .../testcases/rule_management/0004replace_0.dump | 5 ++ tests/shell/testcases/rule_management/0007delete_0 | 14 ----- .../testcases/rule_management/0007delete_0.dump | 5 ++ .../shell/testcases/sets/0001named_interval_0.dump | 34 ++++++++++++ .../sets/0002named_interval_automerging_0.dump | 7 +++ .../sets/0003named_interval_missing_flag_0.dump | 5 ++ .../sets/0004named_interval_shadow_0.dump | 7 +++ .../sets/0005named_interval_shadow_0.dump | 7 +++ tests/shell/testcases/sets/0006create_set_0.dump | 5 ++ .../shell/testcases/sets/0007create_element_0.dump | 6 ++ .../testcases/sets/0008comments_interval_0.dump | 7 +++ .../testcases/sets/0008create_verdict_map_0.dump | 13 +++++ .../testcases/sets/0009comments_timeout_0.dump | 7 +++ tests/shell/testcases/sets/0010comments_0.dump | 6 ++ .../testcases/sets/0012add_delete_many_elements_0 | 13 ----- .../sets/0012add_delete_many_elements_0.dump | 5 ++ .../testcases/sets/0013add_delete_many_elements_0 | 14 ----- .../sets/0013add_delete_many_elements_0.dump | 5 ++ .../sets/0014malformed_set_is_not_defined_0.dump | 0 tests/shell/testcases/sets/0015rulesetflush_0.dump | 11 ++++ tests/shell/testcases/sets/0016element_leak_0.dump | 7 +++ .../testcases/sets/0017add_after_flush_0.dump | 7 +++ .../shell/testcases/sets/0019set_check_size_0.dump | 7 +++ tests/shell/testcases/sets/0020comments_0.dump | 6 ++ tests/shell/testcases/sets/0021nesting_0 | 14 ----- tests/shell/testcases/sets/0021nesting_0.dump | 5 ++ .../testcases/sets/0022type_selective_flush_0.dump | 13 +++++ .../sets/0023incomplete_add_set_command_0.dump | 2 + .../shell/testcases/sets/0024named_objects_0.dump | 28 ++++++++++ .../shell/testcases/sets/0025anonymous_set_0.dump | 7 +++ tests/shell/testcases/sets/0026named_limit_0.dump | 10 ++++ .../shell/testcases/sets/0027ipv6_maps_ipv4_0.dump | 7 +++ .../shell/testcases/sets/0029named_ifname_dtype_0 | 8 --- .../testcases/sets/0029named_ifname_dtype_0.dump | 11 ++++ .../testcases/sets/0031set_timeout_size_0.dump | 0 tests/shell/testcases/transactions/0001table_0 | 13 ----- .../shell/testcases/transactions/0001table_0.dump | 4 ++ tests/shell/testcases/transactions/0002table_0 | 12 ---- .../shell/testcases/transactions/0002table_0.dump | 3 + tests/shell/testcases/transactions/0003table_0 | 10 ---- .../shell/testcases/transactions/0003table_0.dump | 0 tests/shell/testcases/transactions/0010chain_0 | 13 ----- .../shell/testcases/transactions/0010chain_0.dump | 4 ++ tests/shell/testcases/transactions/0011chain_0 | 14 ----- .../shell/testcases/transactions/0011chain_0.dump | 5 ++ tests/shell/testcases/transactions/0012chain_0 | 14 ----- .../shell/testcases/transactions/0012chain_0.dump | 5 ++ tests/shell/testcases/transactions/0013chain_0 | 14 ----- .../shell/testcases/transactions/0013chain_0.dump | 5 ++ tests/shell/testcases/transactions/0020rule_0 | 10 ---- tests/shell/testcases/transactions/0020rule_0.dump | 0 tests/shell/testcases/transactions/0021rule_0 | 14 ----- tests/shell/testcases/transactions/0021rule_0.dump | 5 ++ tests/shell/testcases/transactions/0030set_0 | 11 ---- tests/shell/testcases/transactions/0030set_0.dump | 2 + tests/shell/testcases/transactions/0031set_0 | 14 ----- tests/shell/testcases/transactions/0031set_0.dump | 5 ++ tests/shell/testcases/transactions/0032set_0 | 14 ----- tests/shell/testcases/transactions/0032set_0.dump | 5 ++ tests/shell/testcases/transactions/0033set_0 | 11 ---- tests/shell/testcases/transactions/0033set_0.dump | 2 + tests/shell/testcases/transactions/0034set_0 | 14 ----- tests/shell/testcases/transactions/0034set_0.dump | 5 ++ tests/shell/testcases/transactions/0035set_0 | 15 ----- tests/shell/testcases/transactions/0035set_0.dump | 6 ++ tests/shell/testcases/transactions/0037set_0 | 15 ----- tests/shell/testcases/transactions/0037set_0.dump | 6 ++ tests/shell/testcases/transactions/0038set_0 | 16 ------ tests/shell/testcases/transactions/0038set_0.dump | 7 +++ tests/shell/testcases/transactions/0039set_0 | 16 ------ tests/shell/testcases/transactions/0039set_0.dump | 7 +++ tests/shell/testcases/transactions/0040set_0 | 23 -------- tests/shell/testcases/transactions/0040set_0.dump | 14 +++++ 141 files changed, 837 insertions(+), 526 deletions(-) create mode 100644 tests/shell/testcases/cache/0001_cache_handling_0.dump create mode 100644 tests/shell/testcases/cache/0002_interval_0.dump create mode 100644 tests/shell/testcases/chains/0001jumps_0.dump create mode 100644 tests/shell/testcases/chains/0006masquerade_0.dump create mode 100644 tests/shell/testcases/chains/0013rename_0.dump create mode 100644 tests/shell/testcases/include/0001absolute_0.dump create mode 100644 tests/shell/testcases/include/0002relative_0.dump create mode 100644 tests/shell/testcases/include/0003includepath_0.dump create mode 100644 tests/shell/testcases/include/0005glob_empty_0.dump create mode 100644 tests/shell/testcases/include/0006glob_single_0.dump create mode 100644 tests/shell/testcases/include/0007glob_double_0.dump create mode 100644 tests/shell/testcases/include/0008glob_nofile_wildcard_0.dump create mode 100644 tests/shell/testcases/include/0011glob_dependency_0.dump create mode 100644 tests/shell/testcases/include/0013glob_dotfile_0.dump create mode 100644 tests/shell/testcases/include/0013input_descriptors_included_files_0.dump create mode 100644 tests/shell/testcases/include/0014glob_directory_0.dump create mode 100644 tests/shell/testcases/include/0015doubleincludepath_0.dump create mode 100644 tests/shell/testcases/listing/0001ruleset_0.dump create mode 100644 tests/shell/testcases/listing/0002ruleset_0.dump create mode 100644 tests/shell/testcases/listing/0003table_0.dump create mode 100644 tests/shell/testcases/listing/0004table_0.dump create mode 100644 tests/shell/testcases/listing/0005ruleset_ip_0.dump create mode 100644 tests/shell/testcases/listing/0006ruleset_ip6_0.dump create mode 100644 tests/shell/testcases/listing/0007ruleset_inet_0.dump create mode 100644 tests/shell/testcases/listing/0008ruleset_arp_0.dump create mode 100644 tests/shell/testcases/listing/0009ruleset_bridge_0.dump create mode 100644 tests/shell/testcases/listing/0010sets_0.dump create mode 100644 tests/shell/testcases/listing/0011sets_0.dump create mode 100644 tests/shell/testcases/listing/0012sets_0.dump create mode 100644 tests/shell/testcases/maps/0005interval_map_add_many_elements_0.dump create mode 100644 tests/shell/testcases/maps/0006interval_map_overlap_0.dump create mode 100644 tests/shell/testcases/maps/0007named_ifname_dtype_0.dump create mode 100644 tests/shell/testcases/maps/anonymous_snat_map_0.dump create mode 100644 tests/shell/testcases/maps/map_with_flags_0.dump create mode 100644 tests/shell/testcases/maps/named_snat_map_0.dump create mode 100644 tests/shell/testcases/nft-f/0001define_slash_0.dump create mode 100644 tests/shell/testcases/nft-f/0002rollback_rule_0.dump create mode 100644 tests/shell/testcases/nft-f/0003rollback_jump_0.dump create mode 100644 tests/shell/testcases/nft-f/0004rollback_set_0.dump create mode 100644 tests/shell/testcases/nft-f/0005rollback_map_0.dump create mode 100644 tests/shell/testcases/nft-f/0006action_object_0.dump create mode 100644 tests/shell/testcases/nft-f/0008split_tables_0.dump create mode 100644 tests/shell/testcases/nft-f/0009variable_0.dump create mode 100644 tests/shell/testcases/nft-f/0010variable_0.dump create mode 100644 tests/shell/testcases/nft-f/0012different_defines_0.dump create mode 100644 tests/shell/testcases/optionals/comments_0.dump create mode 100644 tests/shell/testcases/optionals/comments_handles_0.dump create mode 100644 tests/shell/testcases/optionals/handles_0.dump create mode 100644 tests/shell/testcases/rule_management/0001addposition_0.dump create mode 100644 tests/shell/testcases/rule_management/0002insertposition_0.dump create mode 100644 tests/shell/testcases/rule_management/0003insert_0.dump create mode 100644 tests/shell/testcases/rule_management/0004replace_0.dump create mode 100644 tests/shell/testcases/rule_management/0007delete_0.dump create mode 100644 tests/shell/testcases/sets/0001named_interval_0.dump create mode 100644 tests/shell/testcases/sets/0002named_interval_automerging_0.dump create mode 100644 tests/shell/testcases/sets/0003named_interval_missing_flag_0.dump create mode 100644 tests/shell/testcases/sets/0004named_interval_shadow_0.dump create mode 100644 tests/shell/testcases/sets/0005named_interval_shadow_0.dump create mode 100644 tests/shell/testcases/sets/0006create_set_0.dump create mode 100644 tests/shell/testcases/sets/0007create_element_0.dump create mode 100644 tests/shell/testcases/sets/0008comments_interval_0.dump create mode 100644 tests/shell/testcases/sets/0008create_verdict_map_0.dump create mode 100644 tests/shell/testcases/sets/0009comments_timeout_0.dump create mode 100644 tests/shell/testcases/sets/0010comments_0.dump create mode 100644 tests/shell/testcases/sets/0012add_delete_many_elements_0.dump create mode 100644 tests/shell/testcases/sets/0013add_delete_many_elements_0.dump create mode 100644 tests/shell/testcases/sets/0014malformed_set_is_not_defined_0.dump create mode 100644 tests/shell/testcases/sets/0015rulesetflush_0.dump create mode 100644 tests/shell/testcases/sets/0016element_leak_0.dump create mode 100644 tests/shell/testcases/sets/0017add_after_flush_0.dump create mode 100644 tests/shell/testcases/sets/0019set_check_size_0.dump create mode 100644 tests/shell/testcases/sets/0020comments_0.dump create mode 100644 tests/shell/testcases/sets/0021nesting_0.dump create mode 100644 tests/shell/testcases/sets/0022type_selective_flush_0.dump create mode 100644 tests/shell/testcases/sets/0023incomplete_add_set_command_0.dump create mode 100644 tests/shell/testcases/sets/0024named_objects_0.dump create mode 100644 tests/shell/testcases/sets/0025anonymous_set_0.dump create mode 100644 tests/shell/testcases/sets/0026named_limit_0.dump create mode 100644 tests/shell/testcases/sets/0027ipv6_maps_ipv4_0.dump create mode 100644 tests/shell/testcases/sets/0029named_ifname_dtype_0.dump create mode 100644 tests/shell/testcases/sets/0031set_timeout_size_0.dump create mode 100644 tests/shell/testcases/transactions/0001table_0.dump create mode 100644 tests/shell/testcases/transactions/0002table_0.dump create mode 100644 tests/shell/testcases/transactions/0003table_0.dump create mode 100644 tests/shell/testcases/transactions/0010chain_0.dump create mode 100644 tests/shell/testcases/transactions/0011chain_0.dump create mode 100644 tests/shell/testcases/transactions/0012chain_0.dump create mode 100644 tests/shell/testcases/transactions/0013chain_0.dump create mode 100644 tests/shell/testcases/transactions/0020rule_0.dump create mode 100644 tests/shell/testcases/transactions/0021rule_0.dump create mode 100644 tests/shell/testcases/transactions/0030set_0.dump create mode 100644 tests/shell/testcases/transactions/0031set_0.dump create mode 100644 tests/shell/testcases/transactions/0032set_0.dump create mode 100644 tests/shell/testcases/transactions/0033set_0.dump create mode 100644 tests/shell/testcases/transactions/0034set_0.dump create mode 100644 tests/shell/testcases/transactions/0035set_0.dump create mode 100644 tests/shell/testcases/transactions/0037set_0.dump create mode 100644 tests/shell/testcases/transactions/0038set_0.dump create mode 100644 tests/shell/testcases/transactions/0039set_0.dump create mode 100644 tests/shell/testcases/transactions/0040set_0.dump