From patchwork Wed Mar 22 21:52:56 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1760006 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4Phj010w8Fz247J for ; Thu, 23 Mar 2023 08:53:21 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230013AbjCVVxT (ORCPT ); Wed, 22 Mar 2023 17:53:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59240 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230016AbjCVVxR (ORCPT ); Wed, 22 Mar 2023 17:53:17 -0400 Received: from mail.netfilter.org (mail.netfilter.org [217.70.188.207]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 0196C33CFD for ; Wed, 22 Mar 2023 14:53:09 -0700 (PDT) From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v2 1/8] netlink_delinearize: correct type and byte-order of shifts Date: Wed, 22 Mar 2023 22:52:56 +0100 Message-Id: <20230322215303.239763-2-pablo@netfilter.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20230322215303.239763-1-pablo@netfilter.org> References: <20230322215303.239763-1-pablo@netfilter.org> MIME-Version: 1.0 X-Spam-Status: No, score=0.0 required=5.0 tests=SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org From: Jeremy Sowden Downgrade to base type integer instead of the specific type from the expression that is used in the shift operation. Without this, listing a rule like: ct mark set ip dscp lshift 2 or 0x10 will return: ct mark set ip dscp << 2 | cs2 because the type of the OR's right operand will be transitively derived from `ip dscp`. However, this is not valid syntax: # nft add rule t c ct mark set ip dscp '<<' 2 '|' cs2 Error: Could not parse integer add rule t c ct mark set ip dscp << 2 | cs2 ^^^ Use xinteger_type to print the output in hexadecimal. Signed-off-by: Jeremy Sowden Signed-off-by: Pablo Neira Ayuso --- src/netlink_delinearize.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index 60350cd6cd96..c1b4c1148d33 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -2810,8 +2810,17 @@ static void expr_postprocess(struct rule_pp_ctx *ctx, struct expr **exprp) } expr_postprocess(ctx, &expr->right); - expr_set_type(expr, expr->left->dtype, - expr->left->byteorder); + switch (expr->op) { + case OP_LSHIFT: + case OP_RSHIFT: + expr_set_type(expr, &xinteger_type, + BYTEORDER_HOST_ENDIAN); + break; + default: + expr_set_type(expr, expr->left->dtype, + expr->left->byteorder); + } + break; case EXPR_RELATIONAL: switch (expr->left->etype) { From patchwork Wed Mar 22 21:52:57 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1760005 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4Phj004sPXz247w for ; Thu, 23 Mar 2023 08:53:20 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229936AbjCVVxS (ORCPT ); Wed, 22 Mar 2023 17:53:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59008 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230013AbjCVVxR (ORCPT ); Wed, 22 Mar 2023 17:53:17 -0400 Received: from mail.netfilter.org (mail.netfilter.org [217.70.188.207]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 0D24334005 for ; Wed, 22 Mar 2023 14:53:09 -0700 (PDT) From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v2 2/8] evaluate: support shifts larger than the width of the left operand Date: Wed, 22 Mar 2023 22:52:57 +0100 Message-Id: <20230322215303.239763-3-pablo@netfilter.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20230322215303.239763-1-pablo@netfilter.org> References: <20230322215303.239763-1-pablo@netfilter.org> MIME-Version: 1.0 X-Spam-Status: No, score=0.0 required=5.0 tests=SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org If we want to left-shift a value of narrower type and assign the result to a variable of a wider type, we are constrained to only shifting up to the width of the narrower type. Thus: add rule t c meta mark set ip dscp << 2 works, but: add rule t c meta mark set ip dscp << 8 does not, even though the lvalue is large enough to accommodate the result. Upgrade the maximum length based on the statement datatype length, which provided via context, if it is larger than lvalue. Update netlink_delinearize.c to handle the case where the length of a shift expression does not match that of its left-hand operand. Based on patch from Jeremy Sowden. Signed-off-by: Pablo Neira Ayuso --- src/evaluate.c | 27 +++++++++++++++++++-------- src/netlink_delinearize.c | 4 ++-- 2 files changed, 21 insertions(+), 10 deletions(-) diff --git a/src/evaluate.c b/src/evaluate.c index 21d360493ceb..33161f1e2012 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1289,14 +1289,19 @@ static int constant_binop_simplify(struct eval_ctx *ctx, struct expr **expr) static int expr_evaluate_shift(struct eval_ctx *ctx, struct expr **expr) { struct expr *op = *expr, *left = op->left, *right = op->right; + unsigned int shift = mpz_get_uint32(right->value); + unsigned int max_shift_len; - if (mpz_get_uint32(right->value) >= left->len) + if (ctx->ectx.len > left->len) + max_shift_len = ctx->ectx.len; + else + max_shift_len = left->len; + + if (shift >= max_shift_len) return expr_binary_error(ctx->msgs, right, left, - "%s shift of %u bits is undefined " - "for type of %u bits width", + "%s shift of %u bits is undefined for type of %u bits width", op->op == OP_LSHIFT ? "Left" : "Right", - mpz_get_uint32(right->value), - left->len); + shift, max_shift_len); /* Both sides need to be in host byte order */ if (byteorder_conversion(ctx, &op->left, BYTEORDER_HOST_ENDIAN) < 0) @@ -1306,7 +1311,7 @@ static int expr_evaluate_shift(struct eval_ctx *ctx, struct expr **expr) return -1; op->byteorder = BYTEORDER_HOST_ENDIAN; - op->len = left->len; + op->len = max_shift_len; if (expr_is_constant(left)) return constant_binop_simplify(ctx, expr); @@ -1339,14 +1344,20 @@ static int expr_evaluate_binop(struct eval_ctx *ctx, struct expr **expr) { struct expr *op = *expr, *left, *right; const char *sym = expr_op_symbols[op->op]; + unsigned int max_shift_len = ctx->ectx.len; if (expr_evaluate(ctx, &op->left) < 0) return -1; left = op->left; - if (op->op == OP_LSHIFT || op->op == OP_RSHIFT) + if (op->op == OP_LSHIFT || op->op == OP_RSHIFT) { + if (left->len > max_shift_len) + max_shift_len = left->len; + __expr_set_context(&ctx->ectx, &integer_type, - left->byteorder, ctx->ectx.len, 0); + left->byteorder, max_shift_len, 0); + } + if (expr_evaluate(ctx, &op->right) < 0) return -1; right = op->right; diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index c1b4c1148d33..4dc28ed8e651 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -489,7 +489,7 @@ static struct expr *netlink_parse_bitwise_bool(struct netlink_parse_ctx *ctx, mpz_ior(m, m, o); } - if (left->len > 0 && mpz_scan0(m, 0) == left->len) { + if (left->len > 0 && mpz_scan0(m, 0) >= left->len) { /* mask encompasses the entire value */ expr_free(mask); } else { @@ -537,7 +537,7 @@ static struct expr *netlink_parse_bitwise_shift(struct netlink_parse_ctx *ctx, right->byteorder = BYTEORDER_HOST_ENDIAN; expr = binop_expr_alloc(loc, op, left, right); - expr->len = left->len; + expr->len = nftnl_expr_get_u32(nle, NFTNL_EXPR_BITWISE_LEN) * BITS_PER_BYTE; return expr; } From patchwork Wed Mar 22 21:52:58 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1760004 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4Phj002R3jz247J for ; Thu, 23 Mar 2023 08:53:20 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230006AbjCVVxS (ORCPT ); Wed, 22 Mar 2023 17:53:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58744 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229936AbjCVVxR (ORCPT ); Wed, 22 Mar 2023 17:53:17 -0400 Received: from mail.netfilter.org (mail.netfilter.org [217.70.188.207]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 192AA34016 for ; Wed, 22 Mar 2023 14:53:09 -0700 (PDT) From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v2 3/8] evaluate: don't eval unary arguments Date: Wed, 22 Mar 2023 22:52:58 +0100 Message-Id: <20230322215303.239763-4-pablo@netfilter.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20230322215303.239763-1-pablo@netfilter.org> References: <20230322215303.239763-1-pablo@netfilter.org> MIME-Version: 1.0 X-Spam-Status: No, score=0.0 required=5.0 tests=SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org From: Jeremy Sowden When a unary expression is inserted to implement a byte-order conversion, the expression being converted has already been evaluated and so `expr_evaluate_unary` doesn't need to do so. This is required by {ct|meta} statements with bitwise operations, which might result in byteorder conversion of the expression. Signed-off-by: Jeremy Sowden Signed-off-by: Pablo Neira Ayuso --- src/evaluate.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/evaluate.c b/src/evaluate.c index 33161f1e2012..dfb1236e3b8a 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1198,12 +1198,10 @@ static int expr_evaluate_range(struct eval_ctx *ctx, struct expr **expr) */ static int expr_evaluate_unary(struct eval_ctx *ctx, struct expr **expr) { - struct expr *unary = *expr, *arg; + struct expr *unary = *expr, *arg = unary->arg; enum byteorder byteorder; - if (expr_evaluate(ctx, &unary->arg) < 0) - return -1; - arg = unary->arg; + /* unary expression arguments has already been evaluated. */ assert(!expr_is_constant(arg)); assert(expr_basetype(arg)->type == TYPE_INTEGER); From patchwork Wed Mar 22 21:52:59 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1760007 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4Phj012SY9z247w for ; Thu, 23 Mar 2023 08:53:21 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230025AbjCVVxT (ORCPT ); Wed, 22 Mar 2023 17:53:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58744 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230022AbjCVVxR (ORCPT ); Wed, 22 Mar 2023 17:53:17 -0400 Received: from mail.netfilter.org (mail.netfilter.org [217.70.188.207]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 5930118155 for ; Wed, 22 Mar 2023 14:53:10 -0700 (PDT) From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v2 4/8] evaluate: get length from statement instead of lhs expression Date: Wed, 22 Mar 2023 22:52:59 +0100 Message-Id: <20230322215303.239763-5-pablo@netfilter.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20230322215303.239763-1-pablo@netfilter.org> References: <20230322215303.239763-1-pablo@netfilter.org> MIME-Version: 1.0 X-Spam-Status: No, score=0.0 required=5.0 tests=SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Get length from statement, instead infering it from the expression that is used to set the value. In the particular case of {ct|meta} mark, this is 32 bits. Otherwise, bytecode generation is not correct: # nft -c --debug=netlink 'add rule ip6 x y ct mark set ip6 dscp << 2 | 0x10' [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] [ byteorder reg 1 = ntoh(reg 1, 2, 1) ] [ bitwise reg 1 = ( reg 1 << 0x00000002 ) ] [ bitwise reg 1 = ( reg 1 & 0x00000fef ) ^ 0x00000010 ] <--- incorrect! [ ct set mark with reg 1 ] the previous bitwise shift already upgraded to 32-bits (not visible from the netlink debug output above). After this patch, the last | 0x10 uses 32-bits: [ bitwise reg 1 = ( reg 1 & 0xffffffef ) ^ 0x00000010 ] note that mask 0xffffffef is used instead of 0x00000fef. Signed-off-by: Pablo Neira Ayuso --- src/evaluate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/evaluate.c b/src/evaluate.c index dfb1236e3b8a..613daa974971 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1325,7 +1325,7 @@ static int expr_evaluate_bitwise(struct eval_ctx *ctx, struct expr **expr) op->dtype = left->dtype; op->byteorder = left->byteorder; - op->len = left->len; + op->len = ctx->ectx.len; if (expr_is_constant(left)) return constant_binop_simplify(ctx, expr); From patchwork Wed Mar 22 21:53:00 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1760009 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4Phj0456LSz247J for ; Thu, 23 Mar 2023 08:53:24 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230026AbjCVVxX (ORCPT ); Wed, 22 Mar 2023 17:53:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59282 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230016AbjCVVxW (ORCPT ); Wed, 22 Mar 2023 17:53:22 -0400 Received: from mail.netfilter.org (mail.netfilter.org [217.70.188.207]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 8D5131815B for ; Wed, 22 Mar 2023 14:53:17 -0700 (PDT) From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v2 5/8] evaluate: relax type-checking for integer arguments in mark statements Date: Wed, 22 Mar 2023 22:53:00 +0100 Message-Id: <20230322215303.239763-6-pablo@netfilter.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20230322215303.239763-1-pablo@netfilter.org> References: <20230322215303.239763-1-pablo@netfilter.org> MIME-Version: 1.0 X-Spam-Status: No, score=0.0 required=5.0 tests=SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org In order to be able to set ct and meta marks to values derived from payload expressions, we need to relax the requirement that the type of the statement argument must match that of the statement key. Instead, we require that the base-type of the argument is integer and that the argument is small enough to fit. Moreover, swap expression byteorder before to make it compatible with the statement byteorder, to ensure rulesets are portable. # nft --debug=netlink add rule ip t c 'meta mark set ip saddr' ip t c [ payload load 4b @ network header + 12 => reg 1 ] [ byteorder reg 1 = ntoh(reg 1, 4, 4) ] <----------- byteorder swap [ meta set mark with reg 1 ] The following patches are required for this to work: evaluate: get length from statement instead of lhs expression evaluate: don't eval unary arguments evaluate: support shifts larger than the width of the left operand netlink_delinearize: correct type and byte-order of shifts evaluate: insert byte-order conversions for expressions between 9 and 15 bits Add one testcase for tests/py. Signed-off-by: Jeremy Sowden Signed-off-by: Pablo Neira Ayuso --- src/evaluate.c | 13 +++++++++++-- tests/py/ip/meta.t | 2 ++ tests/py/ip/meta.t.json | 20 ++++++++++++++++++++ tests/py/ip/meta.t.payload | 8 ++++++++ 4 files changed, 41 insertions(+), 2 deletions(-) diff --git a/src/evaluate.c b/src/evaluate.c index 613daa974971..273d0a9e069e 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -2742,13 +2742,22 @@ static int __stmt_evaluate_arg(struct eval_ctx *ctx, struct stmt *stmt, "expression has type %s with length %d", dtype->desc, (*expr)->dtype->desc, (*expr)->len); - else if ((*expr)->dtype->type != TYPE_INTEGER && - !datatype_equal((*expr)->dtype, dtype)) + + if ((dtype->type == TYPE_MARK && + !datatype_equal(datatype_basetype(dtype), datatype_basetype((*expr)->dtype))) || + (dtype->type != TYPE_MARK && + (*expr)->dtype->type != TYPE_INTEGER && + !datatype_equal((*expr)->dtype, dtype))) return stmt_binary_error(ctx, *expr, stmt, /* verdict vs invalid? */ "datatype mismatch: expected %s, " "expression has type %s", dtype->desc, (*expr)->dtype->desc); + if (dtype->type == TYPE_MARK && + datatype_equal(datatype_basetype(dtype), datatype_basetype((*expr)->dtype)) && + !expr_is_constant(*expr)) + return byteorder_conversion(ctx, expr, byteorder); + /* we are setting a value, we can't use a set */ switch ((*expr)->etype) { case EXPR_SET: diff --git a/tests/py/ip/meta.t b/tests/py/ip/meta.t index 5a05923a1ce1..85eaf54ce723 100644 --- a/tests/py/ip/meta.t +++ b/tests/py/ip/meta.t @@ -15,3 +15,5 @@ meta obrname "br0";fail meta sdif "lo" accept;ok meta sdifname != "vrf1" accept;ok + +meta mark set ip dscp;ok diff --git a/tests/py/ip/meta.t.json b/tests/py/ip/meta.t.json index 3df31ce381fc..a93d7e781ce1 100644 --- a/tests/py/ip/meta.t.json +++ b/tests/py/ip/meta.t.json @@ -156,3 +156,23 @@ } } ] + +# meta mark set ip dscp +[ + { + "mangle": { + "key": { + "meta": { + "key": "mark" + } + }, + "value": { + "payload": { + "field": "dscp", + "protocol": "ip" + } + } + } + } +] + diff --git a/tests/py/ip/meta.t.payload b/tests/py/ip/meta.t.payload index afde5cc13ac5..1aa8d003b1d4 100644 --- a/tests/py/ip/meta.t.payload +++ b/tests/py/ip/meta.t.payload @@ -51,3 +51,11 @@ ip test-ip4 input [ cmp eq reg 1 0x00000011 ] [ payload load 2b @ transport header + 2 => reg 1 ] [ cmp eq reg 1 0x00004300 ] + +# meta mark set ip dscp +ip test-ip4 input + [ payload load 1b @ network header + 1 => reg 1 ] + [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ] + [ bitwise reg 1 = ( reg 1 >> 0x00000002 ) ] + [ meta set mark with reg 1 ] + From patchwork Wed Mar 22 21:53:01 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1760012 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4Phj0710wzz247J for ; Thu, 23 Mar 2023 08:53:27 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230012AbjCVVxZ (ORCPT ); Wed, 22 Mar 2023 17:53:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59278 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230027AbjCVVxX (ORCPT ); Wed, 22 Mar 2023 17:53:23 -0400 Received: from mail.netfilter.org (mail.netfilter.org [217.70.188.207]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 8D46A158B2 for ; Wed, 22 Mar 2023 14:53:17 -0700 (PDT) From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v2 6/8] tests: py: add test-cases for ct and packet mark payload expressions Date: Wed, 22 Mar 2023 22:53:01 +0100 Message-Id: <20230322215303.239763-7-pablo@netfilter.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20230322215303.239763-1-pablo@netfilter.org> References: <20230322215303.239763-1-pablo@netfilter.org> MIME-Version: 1.0 X-Spam-Status: No, score=0.0 required=5.0 tests=SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Add new test-cases to verify that defining a rule that sets the ct or packet mark to a value derived from a payload works correctly. Signed-off-by: Jeremy Sowden Signed-off-by: Pablo Neira Ayuso --- tests/py/ip/ct.t | 2 ++ tests/py/ip/ct.t.json | 58 +++++++++++++++++++++++++++++++++++++ tests/py/ip/ct.t.payload | 18 ++++++++++++ tests/py/ip/meta.t | 3 ++ tests/py/ip/meta.t.json | 58 +++++++++++++++++++++++++++++++++++++ tests/py/ip/meta.t.payload | 17 +++++++++++ tests/py/ip6/ct.t | 6 ++++ tests/py/ip6/ct.t.payload | 19 ++++++++++++ tests/py/ip6/meta.t | 3 ++ tests/py/ip6/meta.t.json | 58 +++++++++++++++++++++++++++++++++++++ tests/py/ip6/meta.t.payload | 20 +++++++++++++ 11 files changed, 262 insertions(+) create mode 100644 tests/py/ip6/ct.t create mode 100644 tests/py/ip6/ct.t.payload diff --git a/tests/py/ip/ct.t b/tests/py/ip/ct.t index a387863e0d8e..eea9fd4e0562 100644 --- a/tests/py/ip/ct.t +++ b/tests/py/ip/ct.t @@ -28,3 +28,5 @@ meta mark set ct original saddr . meta mark map { 1.1.1.1 . 0x00000014 : 0x00000 meta mark set ct original ip saddr . meta mark map { 1.1.1.1 . 0x00000014 : 0x0000001e };ok ct original saddr . meta mark { 1.1.1.1 . 0x00000014 };fail ct original ip saddr . meta mark { 1.1.1.1 . 0x00000014 };ok +ct mark set ip dscp << 2 | 0x10;ok +ct mark set ip dscp << 26 | 0x10;ok diff --git a/tests/py/ip/ct.t.json b/tests/py/ip/ct.t.json index 3288413f8f3f..e739b5f65bfe 100644 --- a/tests/py/ip/ct.t.json +++ b/tests/py/ip/ct.t.json @@ -325,3 +325,61 @@ } } ] + +# ct mark set ip dscp << 2 | 0x10 +[ + { + "mangle": { + "key": { + "ct": { + "key": "mark" + } + }, + "value": { + "|": [ + { + "<<": [ + { + "payload": { + "field": "dscp", + "protocol": "ip" + } + }, + 2 + ] + }, + 16 + ] + } + } + } +] + +# ct mark set ip dscp << 26 | 0x10 +[ + { + "mangle": { + "key": { + "ct": { + "key": "mark" + } + }, + "value": { + "|": [ + { + "<<": [ + { + "payload": { + "field": "dscp", + "protocol": "ip" + } + }, + 26 + ] + }, + 16 + ] + } + } + } +] diff --git a/tests/py/ip/ct.t.payload b/tests/py/ip/ct.t.payload index 49f06a8401f5..45dba3390940 100644 --- a/tests/py/ip/ct.t.payload +++ b/tests/py/ip/ct.t.payload @@ -84,3 +84,21 @@ ip [ ct load src_ip => reg 1 , dir original ] [ meta load mark => reg 9 ] [ lookup reg 1 set __set%d ] + +# ct mark set ip dscp << 2 | 0x10 +ip test-ip4 output + [ payload load 1b @ network header + 1 => reg 1 ] + [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ] + [ bitwise reg 1 = ( reg 1 >> 0x00000002 ) ] + [ bitwise reg 1 = ( reg 1 << 0x00000002 ) ] + [ bitwise reg 1 = ( reg 1 & 0xffffffef ) ^ 0x00000010 ] + [ ct set mark with reg 1 ] + +# ct mark set ip dscp << 26 | 0x10 +ip + [ payload load 1b @ network header + 1 => reg 1 ] + [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ] + [ bitwise reg 1 = ( reg 1 >> 0x00000002 ) ] + [ bitwise reg 1 = ( reg 1 << 0x0000001a ) ] + [ bitwise reg 1 = ( reg 1 & 0xffffffef ) ^ 0x00000010 ] + [ ct set mark with reg 1 ] diff --git a/tests/py/ip/meta.t b/tests/py/ip/meta.t index 85eaf54ce723..a88a6145559d 100644 --- a/tests/py/ip/meta.t +++ b/tests/py/ip/meta.t @@ -17,3 +17,6 @@ meta sdif "lo" accept;ok meta sdifname != "vrf1" accept;ok meta mark set ip dscp;ok + +meta mark set ip dscp << 2 | 0x10;ok +meta mark set ip dscp << 26 | 0x10;ok diff --git a/tests/py/ip/meta.t.json b/tests/py/ip/meta.t.json index a93d7e781ce1..25936dba98b9 100644 --- a/tests/py/ip/meta.t.json +++ b/tests/py/ip/meta.t.json @@ -176,3 +176,61 @@ } ] +# meta mark set ip dscp << 2 | 0x10 +[ + { + "mangle": { + "key": { + "meta": { + "key": "mark" + } + }, + "value": { + "|": [ + { + "<<": [ + { + "payload": { + "field": "dscp", + "protocol": "ip" + } + }, + 2 + ] + }, + 16 + ] + } + } + } +] + + +# meta mark set ip dscp << 26 | 0x10 +[ + { + "mangle": { + "key": { + "meta": { + "key": "mark" + } + }, + "value": { + "|": [ + { + "<<": [ + { + "payload": { + "field": "dscp", + "protocol": "ip" + } + }, + 26 + ] + }, + 16 + ] + } + } + } +] diff --git a/tests/py/ip/meta.t.payload b/tests/py/ip/meta.t.payload index 1aa8d003b1d4..880ac5d6c707 100644 --- a/tests/py/ip/meta.t.payload +++ b/tests/py/ip/meta.t.payload @@ -59,3 +59,20 @@ ip test-ip4 input [ bitwise reg 1 = ( reg 1 >> 0x00000002 ) ] [ meta set mark with reg 1 ] +# meta mark set ip dscp << 2 | 0x10 +ip test-ip4 input + [ payload load 1b @ network header + 1 => reg 1 ] + [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ] + [ bitwise reg 1 = ( reg 1 >> 0x00000002 ) ] + [ bitwise reg 1 = ( reg 1 << 0x00000002 ) ] + [ bitwise reg 1 = ( reg 1 & 0xffffffef ) ^ 0x00000010 ] + [ meta set mark with reg 1 ] + +# meta mark set ip dscp << 26 | 0x10 +ip + [ payload load 1b @ network header + 1 => reg 1 ] + [ bitwise reg 1 = ( reg 1 & 0x000000fc ) ^ 0x00000000 ] + [ bitwise reg 1 = ( reg 1 >> 0x00000002 ) ] + [ bitwise reg 1 = ( reg 1 << 0x0000001a ) ] + [ bitwise reg 1 = ( reg 1 & 0xffffffef ) ^ 0x00000010 ] + [ meta set mark with reg 1 ] diff --git a/tests/py/ip6/ct.t b/tests/py/ip6/ct.t new file mode 100644 index 000000000000..da69b7a910e4 --- /dev/null +++ b/tests/py/ip6/ct.t @@ -0,0 +1,6 @@ +:output;type filter hook output priority 0 + +*ip6;test-ip6;output + +ct mark set ip6 dscp << 2 | 0x10;ok +ct mark set ip6 dscp << 26 | 0x10;ok diff --git a/tests/py/ip6/ct.t.payload b/tests/py/ip6/ct.t.payload new file mode 100644 index 000000000000..00768dae79f1 --- /dev/null +++ b/tests/py/ip6/ct.t.payload @@ -0,0 +1,19 @@ +# ct mark set ip6 dscp << 2 | 0x10 +ip6 test-ip6 output + [ payload load 2b @ network header + 0 => reg 1 ] + [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] + [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] + [ byteorder reg 1 = ntoh(reg 1, 2, 1) ] + [ bitwise reg 1 = ( reg 1 << 0x00000002 ) ] + [ bitwise reg 1 = ( reg 1 & 0xffffffef ) ^ 0x00000010 ] + [ ct set mark with reg 1 ] + +# ct mark set ip6 dscp << 26 | 0x10 +ip6 test-ip6 output + [ payload load 2b @ network header + 0 => reg 1 ] + [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] + [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] + [ byteorder reg 1 = ntoh(reg 1, 2, 1) ] + [ bitwise reg 1 = ( reg 1 << 0x0000001a ) ] + [ bitwise reg 1 = ( reg 1 & 0xffffffef ) ^ 0x00000010 ] + [ ct set mark with reg 1 ] diff --git a/tests/py/ip6/meta.t b/tests/py/ip6/meta.t index 471e14811975..c177b0815176 100644 --- a/tests/py/ip6/meta.t +++ b/tests/py/ip6/meta.t @@ -14,3 +14,6 @@ meta protocol ip6 udp dport 67;ok;udp dport 67 meta sdif "lo" accept;ok meta sdifname != "vrf1" accept;ok + +meta mark set ip6 dscp << 2 | 0x10;ok +meta mark set ip6 dscp << 26 | 0x10;ok diff --git a/tests/py/ip6/meta.t.json b/tests/py/ip6/meta.t.json index 351320d70f7c..5bd8b07bbc90 100644 --- a/tests/py/ip6/meta.t.json +++ b/tests/py/ip6/meta.t.json @@ -194,3 +194,61 @@ } } ] + +# meta mark set ip6 dscp lshift 2 or 0x10 +[ + { + "mangle": { + "key": { + "meta": { + "key": "mark" + } + }, + "value": { + "|": [ + { + "<<": [ + { + "payload": { + "field": "dscp", + "protocol": "ip6" + } + }, + 2 + ] + }, + 16 + ] + } + } + } +] + +# meta mark set ip6 dscp lshift 26 or 0x10 +[ + { + "mangle": { + "key": { + "meta": { + "key": "mark" + } + }, + "value": { + "|": [ + { + "<<": [ + { + "payload": { + "field": "dscp", + "protocol": "ip6" + } + }, + 26 + ] + }, + 16 + ] + } + } + } +] diff --git a/tests/py/ip6/meta.t.payload b/tests/py/ip6/meta.t.payload index 0e3db6ba07f9..f0507dc47073 100644 --- a/tests/py/ip6/meta.t.payload +++ b/tests/py/ip6/meta.t.payload @@ -60,3 +60,23 @@ ip6 test-ip6 input [ cmp eq reg 1 0x00000011 ] [ payload load 2b @ transport header + 2 => reg 1 ] [ cmp eq reg 1 0x00004300 ] + +# meta mark set ip6 dscp << 2 | 0x10 +ip6 test-ip6 input + [ payload load 2b @ network header + 0 => reg 1 ] + [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] + [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] + [ byteorder reg 1 = ntoh(reg 1, 2, 1) ] + [ bitwise reg 1 = ( reg 1 << 0x00000002 ) ] + [ bitwise reg 1 = ( reg 1 & 0xffffffef ) ^ 0x00000010 ] + [ meta set mark with reg 1 ] + +# meta mark set ip6 dscp << 26 | 0x10 +ip6 test-ip6 input + [ payload load 2b @ network header + 0 => reg 1 ] + [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] + [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] + [ byteorder reg 1 = ntoh(reg 1, 2, 1) ] + [ bitwise reg 1 = ( reg 1 << 0x0000001a ) ] + [ bitwise reg 1 = ( reg 1 & 0xffffffef ) ^ 0x00000010 ] + [ meta set mark with reg 1 ] From patchwork Wed Mar 22 21:53:02 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1760010 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4Phj056NwSz247J for ; Thu, 23 Mar 2023 08:53:25 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229823AbjCVVxY (ORCPT ); Wed, 22 Mar 2023 17:53:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59008 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230022AbjCVVxX (ORCPT ); Wed, 22 Mar 2023 17:53:23 -0400 Received: from mail.netfilter.org (mail.netfilter.org [217.70.188.207]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id AC1542B29A for ; Wed, 22 Mar 2023 14:53:17 -0700 (PDT) From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v2 7/8] tests: shell: rename and move bitwise test-cases Date: Wed, 22 Mar 2023 22:53:02 +0100 Message-Id: <20230322215303.239763-8-pablo@netfilter.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20230322215303.239763-1-pablo@netfilter.org> References: <20230322215303.239763-1-pablo@netfilter.org> MIME-Version: 1.0 X-Spam-Status: No, score=0.0 required=5.0 tests=SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org From: Jeremy Sowden The `0040mark_shift_?` tests are testing not just shifts, but binops more generally, so name them accordingly. Move them to a new folder specifically for bitwise operations. Change the priorities of the chains to match the type. Signed-off-by: Jeremy Sowden Signed-off-by: Pablo Neira Ayuso --- .../{chains/0040mark_shift_0 => bitwise/0040mark_binop_0} | 2 +- .../{chains/0040mark_shift_1 => bitwise/0040mark_binop_1} | 2 +- .../0040mark_shift_0.nft => bitwise/dumps/0040mark_binop_0.nft} | 2 +- .../0040mark_shift_1.nft => bitwise/dumps/0040mark_binop_1.nft} | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) rename tests/shell/testcases/{chains/0040mark_shift_0 => bitwise/0040mark_binop_0} (68%) rename tests/shell/testcases/{chains/0040mark_shift_1 => bitwise/0040mark_binop_1} (70%) rename tests/shell/testcases/{chains/dumps/0040mark_shift_0.nft => bitwise/dumps/0040mark_binop_0.nft} (58%) rename tests/shell/testcases/{chains/dumps/0040mark_shift_1.nft => bitwise/dumps/0040mark_binop_1.nft} (64%) diff --git a/tests/shell/testcases/chains/0040mark_shift_0 b/tests/shell/testcases/bitwise/0040mark_binop_0 similarity index 68% rename from tests/shell/testcases/chains/0040mark_shift_0 rename to tests/shell/testcases/bitwise/0040mark_binop_0 index ef3dccfa049a..4280e33ac45a 100755 --- a/tests/shell/testcases/chains/0040mark_shift_0 +++ b/tests/shell/testcases/bitwise/0040mark_binop_0 @@ -4,7 +4,7 @@ set -e RULESET=" add table t - add chain t c { type filter hook output priority mangle; } + add chain t c { type filter hook output priority filter; } add rule t c oif lo ct mark set (meta mark | 0x10) << 8 " diff --git a/tests/shell/testcases/chains/0040mark_shift_1 b/tests/shell/testcases/bitwise/0040mark_binop_1 similarity index 70% rename from tests/shell/testcases/chains/0040mark_shift_1 rename to tests/shell/testcases/bitwise/0040mark_binop_1 index b609f5ef10ad..7e71f3eb43a8 100755 --- a/tests/shell/testcases/chains/0040mark_shift_1 +++ b/tests/shell/testcases/bitwise/0040mark_binop_1 @@ -4,7 +4,7 @@ set -e RULESET=" add table t - add chain t c { type filter hook input priority mangle; } + add chain t c { type filter hook input priority filter; } add rule t c iif lo ct mark & 0xff 0x10 meta mark set ct mark >> 8 " diff --git a/tests/shell/testcases/chains/dumps/0040mark_shift_0.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_0.nft similarity index 58% rename from tests/shell/testcases/chains/dumps/0040mark_shift_0.nft rename to tests/shell/testcases/bitwise/dumps/0040mark_binop_0.nft index 52d59d2c6da4..fc0a600a4dbe 100644 --- a/tests/shell/testcases/chains/dumps/0040mark_shift_0.nft +++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_0.nft @@ -1,6 +1,6 @@ table ip t { chain c { - type filter hook output priority mangle; policy accept; + type filter hook output priority filter; policy accept; oif "lo" ct mark set (meta mark | 0x00000010) << 8 } } diff --git a/tests/shell/testcases/chains/dumps/0040mark_shift_1.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_1.nft similarity index 64% rename from tests/shell/testcases/chains/dumps/0040mark_shift_1.nft rename to tests/shell/testcases/bitwise/dumps/0040mark_binop_1.nft index 56ec8dc766ca..dbaacefb93c7 100644 --- a/tests/shell/testcases/chains/dumps/0040mark_shift_1.nft +++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_1.nft @@ -1,6 +1,6 @@ table ip t { chain c { - type filter hook input priority mangle; policy accept; + type filter hook input priority filter; policy accept; iif "lo" ct mark & 0x000000ff == 0x00000010 meta mark set ct mark >> 8 } } From patchwork Wed Mar 22 21:53:03 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 1760011 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4Phj063b0qz247J for ; Thu, 23 Mar 2023 08:53:26 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230018AbjCVVxZ (ORCPT ); Wed, 22 Mar 2023 17:53:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59542 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230035AbjCVVxX (ORCPT ); Wed, 22 Mar 2023 17:53:23 -0400 Received: from mail.netfilter.org (mail.netfilter.org [217.70.188.207]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id CE5162B9E1 for ; Wed, 22 Mar 2023 14:53:17 -0700 (PDT) From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft,v2 8/8] tests: shell: add test-cases for ct and packet mark payload expressions Date: Wed, 22 Mar 2023 22:53:03 +0100 Message-Id: <20230322215303.239763-9-pablo@netfilter.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20230322215303.239763-1-pablo@netfilter.org> References: <20230322215303.239763-1-pablo@netfilter.org> MIME-Version: 1.0 X-Spam-Status: No, score=0.0 required=5.0 tests=SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org From: Jeremy Sowden Add new test-cases to verify that defining a rule that sets the ct or packet mark to a value derived from a payload works correctly. Signed-off-by: Jeremy Sowden Signed-off-by: Pablo Neira Ayuso --- tests/shell/testcases/bitwise/0040mark_binop_2 | 11 +++++++++++ tests/shell/testcases/bitwise/0040mark_binop_3 | 11 +++++++++++ tests/shell/testcases/bitwise/0040mark_binop_4 | 11 +++++++++++ tests/shell/testcases/bitwise/0040mark_binop_5 | 11 +++++++++++ tests/shell/testcases/bitwise/0040mark_binop_6 | 11 +++++++++++ tests/shell/testcases/bitwise/0040mark_binop_7 | 11 +++++++++++ tests/shell/testcases/bitwise/0040mark_binop_8 | 11 +++++++++++ tests/shell/testcases/bitwise/0040mark_binop_9 | 11 +++++++++++ .../testcases/bitwise/dumps/0040mark_binop_2.nft | 6 ++++++ .../testcases/bitwise/dumps/0040mark_binop_3.nft | 6 ++++++ .../testcases/bitwise/dumps/0040mark_binop_4.nft | 6 ++++++ .../testcases/bitwise/dumps/0040mark_binop_5.nft | 6 ++++++ .../testcases/bitwise/dumps/0040mark_binop_6.nft | 6 ++++++ .../testcases/bitwise/dumps/0040mark_binop_7.nft | 6 ++++++ .../testcases/bitwise/dumps/0040mark_binop_8.nft | 6 ++++++ .../testcases/bitwise/dumps/0040mark_binop_9.nft | 6 ++++++ 16 files changed, 136 insertions(+) create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_2 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_3 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_4 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_5 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_6 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_7 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_8 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_9 create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_2.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_3.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_4.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_5.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_6.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_7.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_8.nft create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_9.nft diff --git a/tests/shell/testcases/bitwise/0040mark_binop_2 b/tests/shell/testcases/bitwise/0040mark_binop_2 new file mode 100755 index 000000000000..94ebe976c987 --- /dev/null +++ b/tests/shell/testcases/bitwise/0040mark_binop_2 @@ -0,0 +1,11 @@ +#!/bin/bash + +set -e + +RULESET=" + add table t + add chain t c { type filter hook output priority filter; } + add rule t c ct mark set ip dscp lshift 2 or 0x10 +" + +$NFT -f - <<< "$RULESET" diff --git a/tests/shell/testcases/bitwise/0040mark_binop_3 b/tests/shell/testcases/bitwise/0040mark_binop_3 new file mode 100755 index 000000000000..b491565ca573 --- /dev/null +++ b/tests/shell/testcases/bitwise/0040mark_binop_3 @@ -0,0 +1,11 @@ +#!/bin/bash + +set -e + +RULESET=" + add table t + add chain t c { type filter hook input priority filter; } + add rule t c meta mark set ip dscp lshift 2 or 0x10 +" + +$NFT -f - <<< "$RULESET" diff --git a/tests/shell/testcases/bitwise/0040mark_binop_4 b/tests/shell/testcases/bitwise/0040mark_binop_4 new file mode 100755 index 000000000000..adc5f25ba930 --- /dev/null +++ b/tests/shell/testcases/bitwise/0040mark_binop_4 @@ -0,0 +1,11 @@ +#!/bin/bash + +set -e + +RULESET=" + add table t + add chain t c { type filter hook output priority filter; } + add rule t c ct mark set ip dscp lshift 26 or 0x10 +" + +$NFT -f - <<< "$RULESET" diff --git a/tests/shell/testcases/bitwise/0040mark_binop_5 b/tests/shell/testcases/bitwise/0040mark_binop_5 new file mode 100755 index 000000000000..286b7b1fc7f9 --- /dev/null +++ b/tests/shell/testcases/bitwise/0040mark_binop_5 @@ -0,0 +1,11 @@ +#!/bin/bash + +set -e + +RULESET=" + add table t + add chain t c { type filter hook input priority filter; } + add rule t c meta mark set ip dscp lshift 26 or 0x10 +" + +$NFT -f - <<< "$RULESET" diff --git a/tests/shell/testcases/bitwise/0040mark_binop_6 b/tests/shell/testcases/bitwise/0040mark_binop_6 new file mode 100755 index 000000000000..9ea82952ef24 --- /dev/null +++ b/tests/shell/testcases/bitwise/0040mark_binop_6 @@ -0,0 +1,11 @@ +#!/bin/bash + +set -e + +RULESET=" + add table ip6 t + add chain ip6 t c { type filter hook output priority filter; } + add rule ip6 t c ct mark set ip6 dscp lshift 2 or 0x10 +" + +$NFT -f - <<< "$RULESET" diff --git a/tests/shell/testcases/bitwise/0040mark_binop_7 b/tests/shell/testcases/bitwise/0040mark_binop_7 new file mode 100755 index 000000000000..ff9cfb55ac3e --- /dev/null +++ b/tests/shell/testcases/bitwise/0040mark_binop_7 @@ -0,0 +1,11 @@ +#!/bin/bash + +set -e + +RULESET=" + add table ip6 t + add chain ip6 t c { type filter hook input priority filter; } + add rule ip6 t c meta mark set ip6 dscp lshift 2 or 0x10 +" + +$NFT -f - <<< "$RULESET" diff --git a/tests/shell/testcases/bitwise/0040mark_binop_8 b/tests/shell/testcases/bitwise/0040mark_binop_8 new file mode 100755 index 000000000000..b348ee9367df --- /dev/null +++ b/tests/shell/testcases/bitwise/0040mark_binop_8 @@ -0,0 +1,11 @@ +#!/bin/bash + +set -e + +RULESET=" + add table ip6 t + add chain ip6 t c { type filter hook output priority filter; } + add rule ip6 t c ct mark set ip6 dscp lshift 26 or 0x10 +" + +$NFT -f - <<< "$RULESET" diff --git a/tests/shell/testcases/bitwise/0040mark_binop_9 b/tests/shell/testcases/bitwise/0040mark_binop_9 new file mode 100755 index 000000000000..d19447d42b22 --- /dev/null +++ b/tests/shell/testcases/bitwise/0040mark_binop_9 @@ -0,0 +1,11 @@ +#!/bin/bash + +set -e + +RULESET=" + add table ip6 t + add chain ip6 t c { type filter hook input priority filter; } + add rule ip6 t c meta mark set ip6 dscp lshift 26 or 0x10 +" + +$NFT -f - <<< "$RULESET" diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_2.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_2.nft new file mode 100644 index 000000000000..2b9be36e2a03 --- /dev/null +++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_2.nft @@ -0,0 +1,6 @@ +table ip t { + chain c { + type filter hook output priority filter; policy accept; + ct mark set ip dscp << 2 | 0x10 + } +} diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_3.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_3.nft new file mode 100644 index 000000000000..8206fec045bc --- /dev/null +++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_3.nft @@ -0,0 +1,6 @@ +table ip t { + chain c { + type filter hook input priority filter; policy accept; + meta mark set ip dscp << 2 | 0x10 + } +} diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_4.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_4.nft new file mode 100644 index 000000000000..91d9f5662acb --- /dev/null +++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_4.nft @@ -0,0 +1,6 @@ +table ip t { + chain c { + type filter hook output priority filter; policy accept; + ct mark set ip dscp << 26 | 0x10 + } +} diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_5.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_5.nft new file mode 100644 index 000000000000..f2b51eb80674 --- /dev/null +++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_5.nft @@ -0,0 +1,6 @@ +table ip t { + chain c { + type filter hook input priority filter; policy accept; + meta mark set ip dscp << 26 | 0x10 + } +} diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_6.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_6.nft new file mode 100644 index 000000000000..cf7be90c35e1 --- /dev/null +++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_6.nft @@ -0,0 +1,6 @@ +table ip6 t { + chain c { + type filter hook output priority filter; policy accept; + ct mark set ip6 dscp << 2 | 0x10 + } +} diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_7.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_7.nft new file mode 100644 index 000000000000..a9663e621448 --- /dev/null +++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_7.nft @@ -0,0 +1,6 @@ +table ip6 t { + chain c { + type filter hook input priority filter; policy accept; + meta mark set ip6 dscp << 2 | 0x10 + } +} diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_8.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_8.nft new file mode 100644 index 000000000000..04b866ad6dd5 --- /dev/null +++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_8.nft @@ -0,0 +1,6 @@ +table ip6 t { + chain c { + type filter hook output priority filter; policy accept; + ct mark set ip6 dscp << 26 | 0x10 + } +} diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_9.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_9.nft new file mode 100644 index 000000000000..d4745ea4947e --- /dev/null +++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_9.nft @@ -0,0 +1,6 @@ +table ip6 t { + chain c { + type filter hook input priority filter; policy accept; + meta mark set ip6 dscp << 26 | 0x10 + } +}