iptables automated tests

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following branch contains a new automated test infrastructure for
iptables:

http://git.netfilter.org/iptables/log/?h=tests-iptables

It's basically a python script that takes an input file '.t' that look
like:

:INPUT,OUTPUT,FORWARD
-p udp -m udp --sport 1;=;OK
-p udp -m udp --sport 65535;=;OK
-p udp -m udp --dport 1;=;OK
-p udp -m udp --dport 65535;=;OK
-p udp -m udp --sport 1:1023;=;OK
-p udp -m udp --sport 1024:65535;=;OK
[...]
-p udp -m udp --sport -1;;FAIL

Some explanation of the file format:

Lines starting by ':' mean the chains where you want to test the
rules, then lines with '#' are comments.

We also have '*' to indicate the table and '@' to execute some
external command.

Remaining lines look like:

-p udp -m udp --dport 1;=;OK
\_____________________/ _ __
          1             2  3

Part 1 is the rule that you want to load, then part 2 using '=' means
that the output via iptables-save look exactly the same like the
original command (in some case, the input command does not match the
output command that is fetch from the kernel, thus, this line to
include exceptions). Part 3 indicates if the test should run
successfully or fail.

The infrastructure allows us to test that iptables configurations are
consistent between userspace and the kernel. During the workshop we
discussed ideas for another infrastructure to test the packet
processing path, which are complementary to this infrastructure.

Regards.