* [libnftables PATCH] test: add testbench for XML
@ 2013-06-18 20:58 Arturo Borrero Gonzalez
2013-06-20 19:02 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Arturo Borrero Gonzalez @ 2013-06-18 20:58 UTC (permalink / raw)
To: netfilter-devel; +Cc: pablo
This patch add a testbench for XML parsing, which may be extended to also test JSON.
To use it:
$ cd test/
$ make nft-parsing-test
$ ./nft-parsing-test xmlfiles/
Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
---
test/Makefile.am | 6 ++
test/nft-parsing-test.c | 125 ++++++++++++++++++++++++++++++++++++++
test/xmlfiles/chain1.xml | 11 +++
test/xmlfiles/chain2.xml | 11 +++
test/xmlfiles/chain3.xml | 11 +++
test/xmlfiles/rule_bitwise.xml | 25 ++++++++
test/xmlfiles/rule_byteorder.xml | 13 ++++
test/xmlfiles/rule_cmp.xml | 16 +++++
test/xmlfiles/rule_counter.xml | 10 +++
test/xmlfiles/rule_ct.xml | 11 +++
test/xmlfiles/rule_exthdr.xml | 12 ++++
test/xmlfiles/rule_immediate.xml | 31 +++++++++
test/xmlfiles/rule_limit.xml | 10 +++
test/xmlfiles/rule_log.xml | 12 ++++
test/xmlfiles/rule_lookup.xml | 11 +++
test/xmlfiles/rule_match.xml | 10 +++
test/xmlfiles/rule_meta.xml | 10 +++
test/xmlfiles/rule_nat.xml | 22 +++++++
test/xmlfiles/rule_payload.xml | 12 ++++
test/xmlfiles/rule_target.xml | 10 +++
test/xmlfiles/table1.xml | 6 ++
test/xmlfiles/table2.xml | 6 ++
22 files changed, 391 insertions(+)
create mode 100644 test/Makefile.am
create mode 100644 test/nft-parsing-test.c
create mode 100644 test/xmlfiles/chain1.xml
create mode 100644 test/xmlfiles/chain2.xml
create mode 100644 test/xmlfiles/chain3.xml
create mode 100644 test/xmlfiles/rule_bitwise.xml
create mode 100644 test/xmlfiles/rule_byteorder.xml
create mode 100644 test/xmlfiles/rule_cmp.xml
create mode 100644 test/xmlfiles/rule_counter.xml
create mode 100644 test/xmlfiles/rule_ct.xml
create mode 100644 test/xmlfiles/rule_exthdr.xml
create mode 100644 test/xmlfiles/rule_immediate.xml
create mode 100644 test/xmlfiles/rule_limit.xml
create mode 100644 test/xmlfiles/rule_log.xml
create mode 100644 test/xmlfiles/rule_lookup.xml
create mode 100644 test/xmlfiles/rule_match.xml
create mode 100644 test/xmlfiles/rule_meta.xml
create mode 100644 test/xmlfiles/rule_nat.xml
create mode 100644 test/xmlfiles/rule_payload.xml
create mode 100644 test/xmlfiles/rule_target.xml
create mode 100644 test/xmlfiles/table1.xml
create mode 100644 test/xmlfiles/table2.xml
diff --git a/Makefile.am b/Makefile.am
index 6999f51..e035ea1 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -2,8 +2,8 @@ include $(top_srcdir)/Make_global.am
ACLOCAL_AMFLAGS = -I m4
-SUBDIRS = src include examples
-DIST_SUBDIRS = src include examples
+SUBDIRS = src include examples test
+DIST_SUBDIRS = src include examples test
pkgconfigdir = $(libdir)/pkgconfig
pkgconfig_DATA = libnftables.pc
diff --git a/configure.ac b/configure.ac
index 0eec5bd..eaf3bb8 100644
--- a/configure.ac
+++ b/configure.ac
@@ -38,5 +38,5 @@ regular_CFLAGS="-Wall -Waggregate-return -Wmissing-declarations \
-Wformat=2 -pipe"
AC_SUBST([regular_CPPFLAGS])
AC_SUBST([regular_CFLAGS])
-AC_CONFIG_FILES([Makefile src/Makefile include/Makefile include/libnftables/Makefile include/linux/Makefile include/linux/netfilter/Makefile examples/Makefile libnftables.pc doxygen.cfg])
+AC_CONFIG_FILES([Makefile src/Makefile include/Makefile include/libnftables/Makefile include/linux/Makefile include/linux/netfilter/Makefile examples/Makefile test/Makefile libnftables.pc doxygen.cfg])
AC_OUTPUT
diff --git a/examples/chain.xml b/examples/chain.xml
deleted file mode 100644
index 01ccb85..0000000
--- a/examples/chain.xml
+++ /dev/null
@@ -1,11 +0,0 @@
-<chain name="test" handle="0" bytes="59" packets="1" version="0">
- <properties>
- <type>filter</type>
- <table>filter</table>
- <prio>1</prio>
- <use>0</use>
- <hooknum>4</hooknum>
- <policy>1</policy>
- <family>10</family>
- </properties>
-</chain>
diff --git a/examples/rule.xml b/examples/rule.xml
deleted file mode 100644
index b1de25a..0000000
--- a/examples/rule.xml
+++ /dev/null
@@ -1,85 +0,0 @@
-<?xml version="1.0"?>
-<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
- <rule_flags>0</rule_flags>
- <flags>127</flags>
- <compat_flags>0</compat_flags>
- <compat_proto>0</compat_proto>
- <expr type="meta">
- <dreg>1</dreg>
- <key>4</key>
- </expr>
- <expr type="cmp">
- <sreg>1</sreg>
- <op>eq</op>
- <cmpdata>
- <data_reg type="value">
- <len>1</len>
- <data0>0x04000000</data0>
- </data_reg>
- </cmpdata>
- </expr>
- <expr type="payload">
- <dreg>1</dreg>
- <base>1</base>
- <offset>12</offset>
- <len>4</len>
- </expr>
- <expr type="cmp">
- <sreg>1</sreg>
- <op>eq</op>
- <cmpdata>
- <data_reg type="value">
- <len>1</len>
- <data0>0x96d60496</data0>
- </data_reg>
- </cmpdata>
- </expr>
- <expr type="payload">
- <dreg>1</dreg>
- <base>1</base>
- <offset>16</offset>
- <len>4</len>
- </expr>
- <expr type="cmp">
- <sreg>1</sreg>
- <op>eq</op>
- <cmpdata>
- <data_reg type="value">
- <len>1</len>
- <data0>0x96d60329</data0>
- </data_reg>
- </cmpdata>
- </expr>
- <expr type="payload">
- <dreg>1</dreg>
- <base>1</base>
- <offset>9</offset>
- <len>1</len>
- </expr>
- <expr type="cmp">
- <sreg>1</sreg>
- <op>eq</op>
- <cmpdata>
- <data_reg type="value">
- <len>1</len>
- <data0>0x06000000</data0>
- </data_reg>
- </cmpdata>
- </expr>
- <expr type="match">
- <name>state</name>
- <rev>0</rev>
- <info>
- </info>
- </expr>
- <expr type="counter">
- <pkts>123123</pkts>
- <bytes>321321</bytes>
- </expr>
- <expr type="target">
- <name>LOG</name>
- <rev>0</rev>
- <info>
- </info>
- </expr>
-</rule>
diff --git a/examples/table.xml b/examples/table.xml
deleted file mode 100644
index a397d52..0000000
--- a/examples/table.xml
+++ /dev/null
@@ -1,6 +0,0 @@
-<table name="filter" version="0">
- <properties>
- <family>2</family>
- <table_flags>0</table_flags>
- </properties>
-</table>
diff --git a/test/Makefile.am b/test/Makefile.am
new file mode 100644
index 0000000..6941c3c
--- /dev/null
+++ b/test/Makefile.am
@@ -0,0 +1,6 @@
+include $(top_srcdir)/Make_global.am
+
+check_PROGRAMS = nft-parsing-test
+
+nft_parsing_test_SOURCES = nft-parsing-test.c
+nft_parsing_test_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} ${LIBXML_LIBS}
diff --git a/test/nft-parsing-test.c b/test/nft-parsing-test.c
new file mode 100644
index 0000000..dc0ab85
--- /dev/null
+++ b/test/nft-parsing-test.c
@@ -0,0 +1,125 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <dirent.h>
+
+#include <mxml.h>
+
+#include <libmnl/libmnl.h> /*nlmsghdr*/
+#include <libnftables/table.h>
+#include <libnftables/chain.h>
+#include <libnftables/rule.h>
+
+static int test_xml(const char *filename)
+{
+ int ret = -1;
+ struct nft_table *t = NULL;
+ struct nft_chain *c = NULL;
+ struct nft_rule *r = NULL;
+ FILE *fp;
+ mxml_node_t *tree = NULL;;
+ char *xml = NULL;
+
+ fp = fopen(filename, "r");
+ tree = mxmlLoadFile(NULL, fp, MXML_NO_CALLBACK);
+ fclose(fp);
+
+ xml = mxmlSaveAllocString(tree, MXML_NO_CALLBACK);
+ if (xml == NULL)
+ return -1;
+
+ if (tree == NULL)
+ return -1;
+
+ /* Check what parsing should be done */
+ if (strcmp(tree->value.opaque, "table") == 0) {
+ t = nft_table_alloc();
+ if (t != NULL) {
+ if (nft_table_parse(t, NFT_TABLE_PARSE_XML, xml) == 0)
+ ret = 0;
+
+ nft_table_free(t);
+ }
+ } else if (strcmp(tree->value.opaque, "chain") == 0) {
+ c = nft_chain_alloc();
+ if (c != NULL) {
+ if (nft_chain_parse(c, NFT_CHAIN_PARSE_XML, xml) == 0)
+ ret = 0;
+
+ nft_chain_free(c);
+ }
+ } else if (strcmp(tree->value.opaque, "rule") == 0) {
+ r = nft_rule_alloc();
+ if (r != NULL) {
+ if (nft_rule_parse(r, NFT_RULE_PARSE_XML, xml) == 0)
+ ret = 0;
+
+ nft_rule_free(r);
+ }
+ }
+
+ return ret;
+}
+
+static int test_json(const char *filename)
+{
+ /* XXX parse file JSON file, in case of failure return -1 */
+ return -1;
+}
+
+int main(int argc, char *argv[])
+{
+ DIR *d;
+ struct dirent *dent;
+
+ if (argc != 2) {
+ fprintf(stderr, "Usage: %s <directory>\n", argv[0]);
+ exit(EXIT_FAILURE);
+ }
+
+ d = opendir(argv[1]);
+ if (d == NULL) {
+ perror("opendir");
+ exit(EXIT_FAILURE);
+ }
+
+ char *path = malloc(sizeof(argv[1]));
+ char *filewpath = malloc(sizeof(path)+4096);
+ strcpy(path, argv[1]);
+
+ if (path[strlen(path)-1] != '/')
+ strcat(path, "/");
+
+
+ while ((dent = readdir(d)) != NULL) {
+ int len = strlen(dent->d_name);
+
+ if (strcmp(dent->d_name, ".") == 0 ||
+ strcmp(dent->d_name, "..") == 0)
+ continue;
+
+ strcpy(filewpath, path);
+ strcat(filewpath, dent->d_name);
+
+ if (strcmp(&dent->d_name[len-5], ".json") == 0) {
+ printf("parsing json file %s ..\t", filewpath);
+ if (test_json(filewpath) < 0)
+ printf("FAILED\n");
+ else
+ printf("OK\n");
+ }
+
+ if (strcmp(&dent->d_name[len-4], ".xml") == 0) {
+ printf("parsing xml file %s ..\t", filewpath);
+ if (test_xml(filewpath) < 0)
+ printf("FAILED\n");
+ else
+ printf("OK\n");
+ }
+ }
+
+ free(path);
+ free(filewpath);
+ closedir(d);
+ return 0;
+}
diff --git a/test/xmlfiles/chain1.xml b/test/xmlfiles/chain1.xml
new file mode 100644
index 0000000..7b23904
--- /dev/null
+++ b/test/xmlfiles/chain1.xml
@@ -0,0 +1,11 @@
+<chain name="test" handle="0" bytes="0" packets="0" version="0">
+ <properties>
+ <type>filter</type>
+ <table>filter</table>
+ <prio>0</prio>
+ <use>0</use>
+ <hooknum>0</hooknum>
+ <policy>0</policy>
+ <family>2</family>
+ </properties>
+</chain>
diff --git a/test/xmlfiles/chain2.xml b/test/xmlfiles/chain2.xml
new file mode 100644
index 0000000..01ccb85
--- /dev/null
+++ b/test/xmlfiles/chain2.xml
@@ -0,0 +1,11 @@
+<chain name="test" handle="0" bytes="59" packets="1" version="0">
+ <properties>
+ <type>filter</type>
+ <table>filter</table>
+ <prio>1</prio>
+ <use>0</use>
+ <hooknum>4</hooknum>
+ <policy>1</policy>
+ <family>10</family>
+ </properties>
+</chain>
diff --git a/test/xmlfiles/chain3.xml b/test/xmlfiles/chain3.xml
new file mode 100644
index 0000000..31e7142
--- /dev/null
+++ b/test/xmlfiles/chain3.xml
@@ -0,0 +1,11 @@
+<chain name="foo" handle="100" bytes="59264154979" packets="2548796325" version="0">
+ <properties>
+ <type>foo</type>
+ <table>nat</table>
+ <prio>123</prio>
+ <use>321</use>
+ <hooknum>123</hooknum>
+ <policy>123</policy>
+ <family>123</family>
+ </properties>
+</chain>
diff --git a/test/xmlfiles/rule_bitwise.xml b/test/xmlfiles/rule_bitwise.xml
new file mode 100644
index 0000000..0501c6c
--- /dev/null
+++ b/test/xmlfiles/rule_bitwise.xml
@@ -0,0 +1,25 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <flags>127</flags>
+ <compat_flags>0</compat_flags>
+ <compat_proto>0</compat_proto>
+ <expr type="bitwise">
+ <sreg>1</sreg>
+ <dreg>12</dreg>
+ <mask>
+ <data_reg type="value">
+ <len>1</len>
+ <data0>0x04000000</data0>
+ </data_reg>
+ </mask>
+ <xor>
+ <data_reg type="value">
+ <len>4</len>
+ <data0>0xfaceb00c</data0>
+ <data1>0xc1cac1ca</data1>
+ <data2>0xcafecafe</data2>
+ <data3>0xdeadbeef</data3>
+ </data_reg>
+ </xor>
+ </expr>
+</rule>
diff --git a/test/xmlfiles/rule_byteorder.xml b/test/xmlfiles/rule_byteorder.xml
new file mode 100644
index 0000000..3b5d64d
--- /dev/null
+++ b/test/xmlfiles/rule_byteorder.xml
@@ -0,0 +1,13 @@
+<rule family="1" table="test" chain="test" handle="1000" version="0">
+ <rule_flags>123</rule_flags>
+ <flags>123</flags>
+ <compat_flags>123</compat_flags>
+ <compat_proto>123</compat_proto>
+ <expr type="byteorder">
+ <sreg>123</sreg>
+ <dreg>321</dreg>
+ <op>111</op>
+ <len>15</len>
+ <size>15</size>
+ </expr>
+</rule>
diff --git a/test/xmlfiles/rule_cmp.xml b/test/xmlfiles/rule_cmp.xml
new file mode 100644
index 0000000..582b127
--- /dev/null
+++ b/test/xmlfiles/rule_cmp.xml
@@ -0,0 +1,16 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <flags>127</flags>
+ <compat_flags>0</compat_flags>
+ <compat_proto>0</compat_proto>
+ <expr type="cmp">
+ <sreg>1</sreg>
+ <op>eq</op>
+ <cmpdata>
+ <data_reg type="value">
+ <len>1</len>
+ <data0>0x04000000</data0>
+ </data_reg>
+ </cmpdata>
+ </expr>
+</rule>
diff --git a/test/xmlfiles/rule_counter.xml b/test/xmlfiles/rule_counter.xml
new file mode 100644
index 0000000..bb71013
--- /dev/null
+++ b/test/xmlfiles/rule_counter.xml
@@ -0,0 +1,10 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <flags>127</flags>
+ <compat_flags>0</compat_flags>
+ <compat_proto>0</compat_proto>
+ <expr type="counter">
+ <pkts>123123</pkts>
+ <bytes>321321</bytes>
+ </expr>
+</rule>
diff --git a/test/xmlfiles/rule_ct.xml b/test/xmlfiles/rule_ct.xml
new file mode 100644
index 0000000..c993ae5
--- /dev/null
+++ b/test/xmlfiles/rule_ct.xml
@@ -0,0 +1,11 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <flags>127</flags>
+ <compat_flags>0</compat_flags>
+ <compat_proto>0</compat_proto>
+ <expr type="ct">
+ <dreg>1555555</dreg>
+ <dir>15</dir>
+ <key>15</key>
+ </expr>
+</rule>
diff --git a/test/xmlfiles/rule_exthdr.xml b/test/xmlfiles/rule_exthdr.xml
new file mode 100644
index 0000000..0abeb3c
--- /dev/null
+++ b/test/xmlfiles/rule_exthdr.xml
@@ -0,0 +1,12 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <flags>127</flags>
+ <compat_flags>0</compat_flags>
+ <compat_proto>0</compat_proto>
+ <expr type="exthdr">
+ <dreg>123</dreg>
+ <type>15</type>
+ <offset>123</offset>
+ <len>321</len>
+ </expr>
+</rule>
diff --git a/test/xmlfiles/rule_immediate.xml b/test/xmlfiles/rule_immediate.xml
new file mode 100644
index 0000000..a566ca5
--- /dev/null
+++ b/test/xmlfiles/rule_immediate.xml
@@ -0,0 +1,31 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <flags>127</flags>
+ <compat_flags>0</compat_flags>
+ <compat_proto>0</compat_proto>
+ <expr type="immediate">
+ <dreg>1</dreg>
+ <immdata>
+ <data_reg type="value">
+ <len>1</len>
+ <data0>0xaabbccdd</data0>
+ </data_reg>
+ </immdata>
+ </expr>
+ <expr type="immediate">
+ <dreg>2</dreg>
+ <immdata>
+ <data_reg type="verdict">
+ <verdict>1</verdict>
+ </data_reg>
+ </immdata>
+ </expr>
+ <expr type="immediate">
+ <dreg>3</dreg>
+ <immdata>
+ <data_reg type="chain">
+ <chain>testchain</chain>
+ </data_reg>
+ </immdata>
+ </expr>
+</rule>
diff --git a/test/xmlfiles/rule_limit.xml b/test/xmlfiles/rule_limit.xml
new file mode 100644
index 0000000..926aa0e
--- /dev/null
+++ b/test/xmlfiles/rule_limit.xml
@@ -0,0 +1,10 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <flags>127</flags>
+ <compat_flags>0</compat_flags>
+ <compat_proto>0</compat_proto>
+ <expr type="limit">
+ <rate>123123</rate>
+ <depth>321321</depth>
+ </expr>
+</rule>
diff --git a/test/xmlfiles/rule_log.xml b/test/xmlfiles/rule_log.xml
new file mode 100644
index 0000000..5471fee
--- /dev/null
+++ b/test/xmlfiles/rule_log.xml
@@ -0,0 +1,12 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <flags>127</flags>
+ <compat_flags>0</compat_flags>
+ <compat_proto>0</compat_proto>
+ <expr type="log">
+ <group>123123121</group>
+ <snaplen>4000000</snaplen>
+ <qthreshold>1222222</qthreshold>
+ <prefix>prefixtest</prefix>
+ </expr>
+</rule>
diff --git a/test/xmlfiles/rule_lookup.xml b/test/xmlfiles/rule_lookup.xml
new file mode 100644
index 0000000..ee47068
--- /dev/null
+++ b/test/xmlfiles/rule_lookup.xml
@@ -0,0 +1,11 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <flags>127</flags>
+ <compat_flags>0</compat_flags>
+ <compat_proto>0</compat_proto>
+ <expr type="lookup">
+ <sreg>123</sreg>
+ <dreg>123</dreg>
+ <set>set_name_test</set>
+ </expr>
+</rule>
diff --git a/test/xmlfiles/rule_match.xml b/test/xmlfiles/rule_match.xml
new file mode 100644
index 0000000..fdc28f5
--- /dev/null
+++ b/test/xmlfiles/rule_match.xml
@@ -0,0 +1,10 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <flags>127</flags>
+ <compat_flags>0</compat_flags>
+ <compat_proto>0</compat_proto>
+ <expr type="match">
+ <name>state</name>
+ <rev>0</rev>
+ </expr>
+</rule>
diff --git a/test/xmlfiles/rule_meta.xml b/test/xmlfiles/rule_meta.xml
new file mode 100644
index 0000000..3c14bad
--- /dev/null
+++ b/test/xmlfiles/rule_meta.xml
@@ -0,0 +1,10 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <flags>127</flags>
+ <compat_flags>0</compat_flags>
+ <compat_proto>0</compat_proto>
+ <expr type="meta">
+ <dreg>1</dreg>
+ <key>4</key>
+ </expr>
+</rule>
diff --git a/test/xmlfiles/rule_nat.xml b/test/xmlfiles/rule_nat.xml
new file mode 100644
index 0000000..868be50
--- /dev/null
+++ b/test/xmlfiles/rule_nat.xml
@@ -0,0 +1,22 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <flags>127</flags>
+ <compat_flags>0</compat_flags>
+ <compat_proto>0</compat_proto>
+ <expr type="nat">
+ <sreg_addr_min>1</sreg_addr_min>
+ <sreg_addr_max>1</sreg_addr_max>
+ <sreg_proto_min>1</sreg_proto_min>
+ <sreg_proto_max>1</sreg_proto_max>
+ <family>AF_INET6</family>
+ <type>NFT_NAT_DNAT</type>
+ </expr>
+ <expr type="nat">
+ <sreg_addr_min>1</sreg_addr_min>
+ <sreg_addr_max>1</sreg_addr_max>
+ <sreg_proto_min>1</sreg_proto_min>
+ <sreg_proto_max>1</sreg_proto_max>
+ <family>AF_INET</family>
+ <type>NFT_NAT_SNAT</type>
+ </expr>
+</rule>
diff --git a/test/xmlfiles/rule_payload.xml b/test/xmlfiles/rule_payload.xml
new file mode 100644
index 0000000..bbbc84f
--- /dev/null
+++ b/test/xmlfiles/rule_payload.xml
@@ -0,0 +1,12 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <flags>127</flags>
+ <compat_flags>0</compat_flags>
+ <compat_proto>0</compat_proto>
+ <expr type="payload">
+ <dreg>1</dreg>
+ <base>1</base>
+ <offset>12</offset>
+ <len>4</len>
+ </expr>
+</rule>
diff --git a/test/xmlfiles/rule_target.xml b/test/xmlfiles/rule_target.xml
new file mode 100644
index 0000000..a41d794
--- /dev/null
+++ b/test/xmlfiles/rule_target.xml
@@ -0,0 +1,10 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+ <rule_flags>0</rule_flags>
+ <flags>127</flags>
+ <compat_flags>0</compat_flags>
+ <compat_proto>0</compat_proto>
+ <expr type="target">
+ <name>LOG</name>
+ <rev>0</rev>
+ </expr>
+</rule>
diff --git a/test/xmlfiles/table1.xml b/test/xmlfiles/table1.xml
new file mode 100644
index 0000000..a397d52
--- /dev/null
+++ b/test/xmlfiles/table1.xml
@@ -0,0 +1,6 @@
+<table name="filter" version="0">
+ <properties>
+ <family>2</family>
+ <table_flags>0</table_flags>
+ </properties>
+</table>
diff --git a/test/xmlfiles/table2.xml b/test/xmlfiles/table2.xml
new file mode 100644
index 0000000..de8e570
--- /dev/null
+++ b/test/xmlfiles/table2.xml
@@ -0,0 +1,6 @@
+<table name="nat" version="0">
+ <properties>
+ <family>10</family>
+ <table_flags>123</table_flags>
+ </properties>
+</table>
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [libnftables PATCH] test: add testbench for XML
2013-06-18 20:58 [libnftables PATCH] test: add testbench for XML Arturo Borrero Gonzalez
@ 2013-06-20 19:02 ` Pablo Neira Ayuso
2013-06-21 22:44 ` Arturo Borrero Gonzalez
0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2013-06-20 19:02 UTC (permalink / raw)
To: Arturo Borrero Gonzalez; +Cc: netfilter-devel
Hi Arturo,
Some comments below, mostly related to the XML output not the
list of test case itself.
On Tue, Jun 18, 2013 at 10:58:57PM +0200, Arturo Borrero Gonzalez wrote:
> This patch add a testbench for XML parsing, which may be extended to also test JSON.
>
> To use it:
> $ cd test/
> $ make nft-parsing-test
> $ ./nft-parsing-test xmlfiles/
>
> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
> ---
> test/Makefile.am | 6 ++
> test/nft-parsing-test.c | 125 ++++++++++++++++++++++++++++++++++++++
> test/xmlfiles/chain1.xml | 11 +++
> test/xmlfiles/chain2.xml | 11 +++
> test/xmlfiles/chain3.xml | 11 +++
> test/xmlfiles/rule_bitwise.xml | 25 ++++++++
> test/xmlfiles/rule_byteorder.xml | 13 ++++
> test/xmlfiles/rule_cmp.xml | 16 +++++
> test/xmlfiles/rule_counter.xml | 10 +++
> test/xmlfiles/rule_ct.xml | 11 +++
> test/xmlfiles/rule_exthdr.xml | 12 ++++
> test/xmlfiles/rule_immediate.xml | 31 +++++++++
> test/xmlfiles/rule_limit.xml | 10 +++
> test/xmlfiles/rule_log.xml | 12 ++++
> test/xmlfiles/rule_lookup.xml | 11 +++
> test/xmlfiles/rule_match.xml | 10 +++
> test/xmlfiles/rule_meta.xml | 10 +++
> test/xmlfiles/rule_nat.xml | 22 +++++++
> test/xmlfiles/rule_payload.xml | 12 ++++
> test/xmlfiles/rule_target.xml | 10 +++
> test/xmlfiles/table1.xml | 6 ++
> test/xmlfiles/table2.xml | 6 ++
> 22 files changed, 391 insertions(+)
> create mode 100644 test/Makefile.am
> create mode 100644 test/nft-parsing-test.c
> create mode 100644 test/xmlfiles/chain1.xml
> create mode 100644 test/xmlfiles/chain2.xml
> create mode 100644 test/xmlfiles/chain3.xml
> create mode 100644 test/xmlfiles/rule_bitwise.xml
> create mode 100644 test/xmlfiles/rule_byteorder.xml
> create mode 100644 test/xmlfiles/rule_cmp.xml
> create mode 100644 test/xmlfiles/rule_counter.xml
> create mode 100644 test/xmlfiles/rule_ct.xml
> create mode 100644 test/xmlfiles/rule_exthdr.xml
> create mode 100644 test/xmlfiles/rule_immediate.xml
> create mode 100644 test/xmlfiles/rule_limit.xml
> create mode 100644 test/xmlfiles/rule_log.xml
> create mode 100644 test/xmlfiles/rule_lookup.xml
> create mode 100644 test/xmlfiles/rule_match.xml
> create mode 100644 test/xmlfiles/rule_meta.xml
> create mode 100644 test/xmlfiles/rule_nat.xml
> create mode 100644 test/xmlfiles/rule_payload.xml
> create mode 100644 test/xmlfiles/rule_target.xml
> create mode 100644 test/xmlfiles/table1.xml
> create mode 100644 test/xmlfiles/table2.xml
>
> diff --git a/Makefile.am b/Makefile.am
> index 6999f51..e035ea1 100644
> --- a/Makefile.am
> +++ b/Makefile.am
> @@ -2,8 +2,8 @@ include $(top_srcdir)/Make_global.am
>
> ACLOCAL_AMFLAGS = -I m4
>
> -SUBDIRS = src include examples
> -DIST_SUBDIRS = src include examples
> +SUBDIRS = src include examples test
> +DIST_SUBDIRS = src include examples test
Please, don't include the test directory in DIST_SUBDIRS. I prefer not
to distribute the tests in the tarball.
> pkgconfigdir = $(libdir)/pkgconfig
> pkgconfig_DATA = libnftables.pc
> diff --git a/configure.ac b/configure.ac
> index 0eec5bd..eaf3bb8 100644
> --- a/configure.ac
> +++ b/configure.ac
> @@ -38,5 +38,5 @@ regular_CFLAGS="-Wall -Waggregate-return -Wmissing-declarations \
> -Wformat=2 -pipe"
> AC_SUBST([regular_CPPFLAGS])
> AC_SUBST([regular_CFLAGS])
> -AC_CONFIG_FILES([Makefile src/Makefile include/Makefile include/libnftables/Makefile include/linux/Makefile include/linux/netfilter/Makefile examples/Makefile libnftables.pc doxygen.cfg])
> +AC_CONFIG_FILES([Makefile src/Makefile include/Makefile include/libnftables/Makefile include/linux/Makefile include/linux/netfilter/Makefile examples/Makefile test/Makefile libnftables.pc doxygen.cfg])
> AC_OUTPUT
> diff --git a/examples/chain.xml b/examples/chain.xml
> deleted file mode 100644
> index 01ccb85..0000000
> --- a/examples/chain.xml
> +++ /dev/null
> @@ -1,11 +0,0 @@
> -<chain name="test" handle="0" bytes="59" packets="1" version="0">
> - <properties>
> - <type>filter</type>
> - <table>filter</table>
> - <prio>1</prio>
> - <use>0</use>
> - <hooknum>4</hooknum>
We should convert hooknum to make it human readable. You can use this
array to achieve it:
static const char *hooknum2str_array[NF_INET_NUMHOOKS] = {
[NF_INET_PRE_ROUTING] = "NF_INET_PRE_ROUTING",
[NF_INET_LOCAL_IN] = "NF_INET_LOCAL_IN",
[NF_INET_FORWARD] = "NF_INET_FORWARD",
[NF_INET_LOCAL_OUT] = "NF_INET_LOCAL_OUT",
[NF_INET_POST_ROUTING] = "NF_INET_POST_ROUTING",
};
> - <policy>1</policy>
Same thing here, this should be converted to NF_ACCEPT = "accept" and
NF_DROP = "drop". You will have to change the parser as well, yes.
> - <family>10</family>
Convert to AF_INET = ip, AF_INET6 = ip6, AF_BRIDGE = bridge and 0 =
arp.
> - </properties>
> -</chain>
> diff --git a/examples/rule.xml b/examples/rule.xml
> deleted file mode 100644
> index b1de25a..0000000
> --- a/examples/rule.xml
> +++ /dev/null
> @@ -1,85 +0,0 @@
> -<?xml version="1.0"?>
> -<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> - <rule_flags>0</rule_flags>
> - <flags>127</flags>
Hm, I decided to get rid of these internal flags already right? They
are not exported anymore.
> - <compat_flags>0</compat_flags>
> - <compat_proto>0</compat_proto>
Please, only print these two if:
compat_flags != 0 || compat_proto != 0
> - <expr type="meta">
> - <dreg>1</dreg>
> - <key>4</key>
> - </expr>
> - <expr type="cmp">
> - <sreg>1</sreg>
> - <op>eq</op>
> - <cmpdata>
> - <data_reg type="value">
> - <len>1</len>
> - <data0>0x04000000</data0>
> - </data_reg>
> - </cmpdata>
> - </expr>
> - <expr type="payload">
> - <dreg>1</dreg>
> - <base>1</base>
> - <offset>12</offset>
> - <len>4</len>
> - </expr>
> - <expr type="cmp">
> - <sreg>1</sreg>
> - <op>eq</op>
> - <cmpdata>
> - <data_reg type="value">
> - <len>1</len>
> - <data0>0x96d60496</data0>
> - </data_reg>
> - </cmpdata>
> - </expr>
> - <expr type="payload">
> - <dreg>1</dreg>
> - <base>1</base>
> - <offset>16</offset>
> - <len>4</len>
> - </expr>
> - <expr type="cmp">
> - <sreg>1</sreg>
> - <op>eq</op>
> - <cmpdata>
> - <data_reg type="value">
> - <len>1</len>
> - <data0>0x96d60329</data0>
> - </data_reg>
> - </cmpdata>
> - </expr>
> - <expr type="payload">
> - <dreg>1</dreg>
> - <base>1</base>
> - <offset>9</offset>
> - <len>1</len>
> - </expr>
> - <expr type="cmp">
> - <sreg>1</sreg>
> - <op>eq</op>
> - <cmpdata>
> - <data_reg type="value">
> - <len>1</len>
> - <data0>0x06000000</data0>
> - </data_reg>
> - </cmpdata>
> - </expr>
> - <expr type="match">
> - <name>state</name>
> - <rev>0</rev>
> - <info>
> - </info>
> - </expr>
> - <expr type="counter">
> - <pkts>123123</pkts>
> - <bytes>321321</bytes>
> - </expr>
> - <expr type="target">
> - <name>LOG</name>
> - <rev>0</rev>
> - <info>
> - </info>
> - </expr>
> -</rule>
> diff --git a/examples/table.xml b/examples/table.xml
> deleted file mode 100644
> index a397d52..0000000
> --- a/examples/table.xml
> +++ /dev/null
> @@ -1,6 +0,0 @@
> -<table name="filter" version="0">
> - <properties>
> - <family>2</family>
> - <table_flags>0</table_flags>
> - </properties>
> -</table>
> diff --git a/test/Makefile.am b/test/Makefile.am
> new file mode 100644
> index 0000000..6941c3c
> --- /dev/null
> +++ b/test/Makefile.am
> @@ -0,0 +1,6 @@
> +include $(top_srcdir)/Make_global.am
> +
> +check_PROGRAMS = nft-parsing-test
> +
> +nft_parsing_test_SOURCES = nft-parsing-test.c
> +nft_parsing_test_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} ${LIBXML_LIBS}
> diff --git a/test/nft-parsing-test.c b/test/nft-parsing-test.c
> new file mode 100644
> index 0000000..dc0ab85
> --- /dev/null
> +++ b/test/nft-parsing-test.c
> @@ -0,0 +1,125 @@
> +#include <stdio.h>
> +#include <stdlib.h>
> +#include <string.h>
> +#include <dirent.h>
> +
> +#include <mxml.h>
> +
> +#include <libmnl/libmnl.h> /*nlmsghdr*/
> +#include <libnftables/table.h>
> +#include <libnftables/chain.h>
> +#include <libnftables/rule.h>
> +
> +static int test_xml(const char *filename)
> +{
> + int ret = -1;
> + struct nft_table *t = NULL;
> + struct nft_chain *c = NULL;
> + struct nft_rule *r = NULL;
> + FILE *fp;
> + mxml_node_t *tree = NULL;;
> + char *xml = NULL;
> +
> + fp = fopen(filename, "r");
> + tree = mxmlLoadFile(NULL, fp, MXML_NO_CALLBACK);
> + fclose(fp);
> +
> + xml = mxmlSaveAllocString(tree, MXML_NO_CALLBACK);
> + if (xml == NULL)
> + return -1;
> +
> + if (tree == NULL)
> + return -1;
> +
> + /* Check what parsing should be done */
> + if (strcmp(tree->value.opaque, "table") == 0) {
> + t = nft_table_alloc();
> + if (t != NULL) {
> + if (nft_table_parse(t, NFT_TABLE_PARSE_XML, xml) == 0)
> + ret = 0;
> +
> + nft_table_free(t);
> + }
> + } else if (strcmp(tree->value.opaque, "chain") == 0) {
> + c = nft_chain_alloc();
> + if (c != NULL) {
> + if (nft_chain_parse(c, NFT_CHAIN_PARSE_XML, xml) == 0)
> + ret = 0;
> +
> + nft_chain_free(c);
> + }
> + } else if (strcmp(tree->value.opaque, "rule") == 0) {
> + r = nft_rule_alloc();
> + if (r != NULL) {
> + if (nft_rule_parse(r, NFT_RULE_PARSE_XML, xml) == 0)
> + ret = 0;
> +
> + nft_rule_free(r);
> + }
> + }
> +
> + return ret;
> +}
> +
> +static int test_json(const char *filename)
> +{
> + /* XXX parse file JSON file, in case of failure return -1 */
> + return -1;
> +}
> +
> +int main(int argc, char *argv[])
> +{
> + DIR *d;
> + struct dirent *dent;
> +
> + if (argc != 2) {
> + fprintf(stderr, "Usage: %s <directory>\n", argv[0]);
> + exit(EXIT_FAILURE);
> + }
> +
> + d = opendir(argv[1]);
> + if (d == NULL) {
> + perror("opendir");
> + exit(EXIT_FAILURE);
> + }
> +
> + char *path = malloc(sizeof(argv[1]));
> + char *filewpath = malloc(sizeof(path)+4096);
> + strcpy(path, argv[1]);
> +
> + if (path[strlen(path)-1] != '/')
> + strcat(path, "/");
> +
> +
> + while ((dent = readdir(d)) != NULL) {
> + int len = strlen(dent->d_name);
> +
> + if (strcmp(dent->d_name, ".") == 0 ||
> + strcmp(dent->d_name, "..") == 0)
> + continue;
> +
> + strcpy(filewpath, path);
> + strcat(filewpath, dent->d_name);
Better use snprintf, strcat is sloppy.
char path[PATH_MAX];
snprintf(path, sizeof(path), "%s/%s", argv[1], dent->d_name);
Pass it to test_xml(file)
> + if (strcmp(&dent->d_name[len-5], ".json") == 0) {
> + printf("parsing json file %s ..\t", filewpath);
> + if (test_json(filewpath) < 0)
> + printf("FAILED\n");
> + else
> + printf("OK\n");
> + }
> +
> + if (strcmp(&dent->d_name[len-4], ".xml") == 0) {
> + printf("parsing xml file %s ..\t", filewpath);
> + if (test_xml(filewpath) < 0)
> + printf("FAILED\n");
> + else
> + printf("OK\n");
> + }
> + }
> +
> + free(path);
> + free(filewpath);
> + closedir(d);
> + return 0;
> +}
> diff --git a/test/xmlfiles/chain1.xml b/test/xmlfiles/chain1.xml
> new file mode 100644
> index 0000000..7b23904
> --- /dev/null
> +++ b/test/xmlfiles/chain1.xml
> @@ -0,0 +1,11 @@
> +<chain name="test" handle="0" bytes="0" packets="0" version="0">
> + <properties>
> + <type>filter</type>
> + <table>filter</table>
> + <prio>0</prio>
> + <use>0</use>
> + <hooknum>0</hooknum>
> + <policy>0</policy>
> + <family>2</family>
> + </properties>
> +</chain>
> diff --git a/test/xmlfiles/chain2.xml b/test/xmlfiles/chain2.xml
> new file mode 100644
> index 0000000..01ccb85
> --- /dev/null
> +++ b/test/xmlfiles/chain2.xml
> @@ -0,0 +1,11 @@
> +<chain name="test" handle="0" bytes="59" packets="1" version="0">
> + <properties>
> + <type>filter</type>
> + <table>filter</table>
> + <prio>1</prio>
> + <use>0</use>
> + <hooknum>4</hooknum>
> + <policy>1</policy>
> + <family>10</family>
> + </properties>
> +</chain>
> diff --git a/test/xmlfiles/chain3.xml b/test/xmlfiles/chain3.xml
> new file mode 100644
> index 0000000..31e7142
> --- /dev/null
> +++ b/test/xmlfiles/chain3.xml
> @@ -0,0 +1,11 @@
> +<chain name="foo" handle="100" bytes="59264154979" packets="2548796325" version="0">
> + <properties>
> + <type>foo</type>
Please, I prefer realistic tests:
Possible types are the following strings: filter, route, nat
> + <table>nat</table>
> + <prio>123</prio>
> + <use>321</use>
> + <hooknum>123</hooknum>
> + <policy>123</policy>
> + <family>123</family>
This policy and family are not realistic either ;-)
> + </properties>
> +</chain>
> diff --git a/test/xmlfiles/rule_bitwise.xml b/test/xmlfiles/rule_bitwise.xml
> new file mode 100644
> index 0000000..0501c6c
> --- /dev/null
> +++ b/test/xmlfiles/rule_bitwise.xml
> @@ -0,0 +1,25 @@
> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> + <rule_flags>0</rule_flags>
> + <flags>127</flags>
> + <compat_flags>0</compat_flags>
> + <compat_proto>0</compat_proto>
> + <expr type="bitwise">
> + <sreg>1</sreg>
> + <dreg>12</dreg>
We only have NFT_REG_MAX registers.
> + <mask>
> + <data_reg type="value">
> + <len>1</len>
> + <data0>0x04000000</data0>
> + </data_reg>
> + </mask>
> + <xor>
> + <data_reg type="value">
> + <len>4</len>
> + <data0>0xfaceb00c</data0>
> + <data1>0xc1cac1ca</data1>
> + <data2>0xcafecafe</data2>
> + <data3>0xdeadbeef</data3>
The mask and xor has to use the same number of data registers.
> + </data_reg>
> + </xor>
> + </expr>
> +</rule>
> diff --git a/test/xmlfiles/rule_byteorder.xml b/test/xmlfiles/rule_byteorder.xml
> new file mode 100644
> index 0000000..3b5d64d
> --- /dev/null
> +++ b/test/xmlfiles/rule_byteorder.xml
> @@ -0,0 +1,13 @@
> +<rule family="1" table="test" chain="test" handle="1000" version="0">
> + <rule_flags>123</rule_flags>
> + <flags>123</flags>
> + <compat_flags>123</compat_flags>
> + <compat_proto>123</compat_proto>
> + <expr type="byteorder">
> + <sreg>123</sreg>
> + <dreg>321</dreg>
wrong register numbers.
> + <op>111</op>
Bad operation. Possible are defined by NFT_BYTEORDER_*
> + <len>15</len>
> + <size>15</size>
also fix this.
> + </expr>
> +</rule>
> diff --git a/test/xmlfiles/rule_cmp.xml b/test/xmlfiles/rule_cmp.xml
> new file mode 100644
> index 0000000..582b127
> --- /dev/null
> +++ b/test/xmlfiles/rule_cmp.xml
> @@ -0,0 +1,16 @@
> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> + <rule_flags>0</rule_flags>
> + <flags>127</flags>
> + <compat_flags>0</compat_flags>
> + <compat_proto>0</compat_proto>
> + <expr type="cmp">
> + <sreg>1</sreg>
> + <op>eq</op>
oh, you're using string here, good :-)
> + <cmpdata>
> + <data_reg type="value">
> + <len>1</len>
> + <data0>0x04000000</data0>
> + </data_reg>
> + </cmpdata>
> + </expr>
> +</rule>
> diff --git a/test/xmlfiles/rule_counter.xml b/test/xmlfiles/rule_counter.xml
> new file mode 100644
> index 0000000..bb71013
> --- /dev/null
> +++ b/test/xmlfiles/rule_counter.xml
> @@ -0,0 +1,10 @@
> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> + <rule_flags>0</rule_flags>
> + <flags>127</flags>
> + <compat_flags>0</compat_flags>
> + <compat_proto>0</compat_proto>
> + <expr type="counter">
> + <pkts>123123</pkts>
> + <bytes>321321</bytes>
> + </expr>
> +</rule>
> diff --git a/test/xmlfiles/rule_ct.xml b/test/xmlfiles/rule_ct.xml
> new file mode 100644
> index 0000000..c993ae5
> --- /dev/null
> +++ b/test/xmlfiles/rule_ct.xml
> @@ -0,0 +1,11 @@
> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> + <rule_flags>0</rule_flags>
> + <flags>127</flags>
> + <compat_flags>0</compat_flags>
> + <compat_proto>0</compat_proto>
> + <expr type="ct">
> + <dreg>1555555</dreg>
no possible.
> + <dir>15</dir>
IIRC, two possible strings: 0 = original, 1 = reply
> + <key>15</key>
keys are defined in nft_ct_keys.
> + </expr>
> +</rule>
> diff --git a/test/xmlfiles/rule_exthdr.xml b/test/xmlfiles/rule_exthdr.xml
> new file mode 100644
> index 0000000..0abeb3c
> --- /dev/null
> +++ b/test/xmlfiles/rule_exthdr.xml
> @@ -0,0 +1,12 @@
> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> + <rule_flags>0</rule_flags>
> + <flags>127</flags>
> + <compat_flags>0</compat_flags>
> + <compat_proto>0</compat_proto>
> + <expr type="exthdr">
> + <dreg>123</dreg>
fix.
> + <type>15</type>
Possibilities are defined by: nft_exthdr_attributes
> + <offset>123</offset>
> + <len>321</len>
Oh, we cannot get more than 2^8.
It's good if you start looking at: net/netfilter/nft_exthdr.c
> + </expr>
> +</rule>
> diff --git a/test/xmlfiles/rule_immediate.xml b/test/xmlfiles/rule_immediate.xml
> new file mode 100644
> index 0000000..a566ca5
> --- /dev/null
> +++ b/test/xmlfiles/rule_immediate.xml
> @@ -0,0 +1,31 @@
> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> + <rule_flags>0</rule_flags>
> + <flags>127</flags>
> + <compat_flags>0</compat_flags>
> + <compat_proto>0</compat_proto>
> + <expr type="immediate">
> + <dreg>1</dreg>
> + <immdata>
> + <data_reg type="value">
> + <len>1</len>
> + <data0>0xaabbccdd</data0>
Lenghs says 1 byte, but I can see way more stuff there.
A good way to generate realistic test cases is to add rules with nft
and then use libnftables examples/ to obtain the output in XML. So you
don't need to make it up.
> + </data_reg>
> + </immdata>
> + </expr>
> + <expr type="immediate">
> + <dreg>2</dreg>
> + <immdata>
> + <data_reg type="verdict">
> + <verdict>1</verdict>
> + </data_reg>
> + </immdata>
> + </expr>
> + <expr type="immediate">
> + <dreg>3</dreg>
> + <immdata>
> + <data_reg type="chain">
> + <chain>testchain</chain>
> + </data_reg>
> + </immdata>
> + </expr>
> +</rule>
> diff --git a/test/xmlfiles/rule_limit.xml b/test/xmlfiles/rule_limit.xml
> new file mode 100644
> index 0000000..926aa0e
> --- /dev/null
> +++ b/test/xmlfiles/rule_limit.xml
> @@ -0,0 +1,10 @@
> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> + <rule_flags>0</rule_flags>
> + <flags>127</flags>
> + <compat_flags>0</compat_flags>
> + <compat_proto>0</compat_proto>
> + <expr type="limit">
> + <rate>123123</rate>
> + <depth>321321</depth>
> + </expr>
> +</rule>
> diff --git a/test/xmlfiles/rule_log.xml b/test/xmlfiles/rule_log.xml
> new file mode 100644
> index 0000000..5471fee
> --- /dev/null
> +++ b/test/xmlfiles/rule_log.xml
> @@ -0,0 +1,12 @@
> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> + <rule_flags>0</rule_flags>
> + <flags>127</flags>
> + <compat_flags>0</compat_flags>
> + <compat_proto>0</compat_proto>
> + <expr type="log">
> + <group>123123121</group>
possible groups are 0-65535.
> + <snaplen>4000000</snaplen>
> + <qthreshold>1222222</qthreshold>
> + <prefix>prefixtest</prefix>
> + </expr>
> +</rule>
> diff --git a/test/xmlfiles/rule_lookup.xml b/test/xmlfiles/rule_lookup.xml
> new file mode 100644
> index 0000000..ee47068
> --- /dev/null
> +++ b/test/xmlfiles/rule_lookup.xml
> @@ -0,0 +1,11 @@
> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> + <rule_flags>0</rule_flags>
> + <flags>127</flags>
> + <compat_flags>0</compat_flags>
> + <compat_proto>0</compat_proto>
> + <expr type="lookup">
> + <sreg>123</sreg>
> + <dreg>123</dreg>
bad registers.
> + <set>set_name_test</set>
> + </expr>
> +</rule>
> diff --git a/test/xmlfiles/rule_match.xml b/test/xmlfiles/rule_match.xml
> new file mode 100644
> index 0000000..fdc28f5
> --- /dev/null
> +++ b/test/xmlfiles/rule_match.xml
> @@ -0,0 +1,10 @@
> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> + <rule_flags>0</rule_flags>
> + <flags>127</flags>
> + <compat_flags>0</compat_flags>
> + <compat_proto>0</compat_proto>
> + <expr type="match">
> + <name>state</name>
> + <rev>0</rev>
don't export the rev number, I don't think it's meaningful to the
application.
> + </expr>
> +</rule>
> diff --git a/test/xmlfiles/rule_meta.xml b/test/xmlfiles/rule_meta.xml
> new file mode 100644
> index 0000000..3c14bad
> --- /dev/null
> +++ b/test/xmlfiles/rule_meta.xml
> @@ -0,0 +1,10 @@
> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> + <rule_flags>0</rule_flags>
> + <flags>127</flags>
> + <compat_flags>0</compat_flags>
> + <compat_proto>0</compat_proto>
> + <expr type="meta">
> + <dreg>1</dreg>
> + <key>4</key>
Keys for meta are defined by nft_meta_keys.
> + </expr>
> +</rule>
> diff --git a/test/xmlfiles/rule_nat.xml b/test/xmlfiles/rule_nat.xml
> new file mode 100644
> index 0000000..868be50
> --- /dev/null
> +++ b/test/xmlfiles/rule_nat.xml
> @@ -0,0 +1,22 @@
> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> + <rule_flags>0</rule_flags>
> + <flags>127</flags>
> + <compat_flags>0</compat_flags>
> + <compat_proto>0</compat_proto>
> + <expr type="nat">
> + <sreg_addr_min>1</sreg_addr_min>
> + <sreg_addr_max>1</sreg_addr_max>
These above are IPv4 / IPv6 addresses. Should be printable ini
human readable format, you probably use inet_ntop for output and
inet_pton for input.
> + <sreg_proto_min>1</sreg_proto_min>
> + <sreg_proto_max>1</sreg_proto_max>
max here is 2^16 as they are port numbers.
> + <family>AF_INET6</family>
would be good to replace this by ip6.
> + <type>NFT_NAT_DNAT</type>
and this by dnat.
> + </expr>
> + <expr type="nat">
The ipv4 part is asking for a new file, add rule_nat-ipv4.xml and
rule_nat-ipv6.xml
> + <sreg_addr_min>1</sreg_addr_min>
> + <sreg_addr_max>1</sreg_addr_max>
> + <sreg_proto_min>1</sreg_proto_min>
> + <sreg_proto_max>1</sreg_proto_max>
> + <family>AF_INET</family>
> + <type>NFT_NAT_SNAT</type>
> + </expr>
> +</rule>
> diff --git a/test/xmlfiles/rule_payload.xml b/test/xmlfiles/rule_payload.xml
> new file mode 100644
> index 0000000..bbbc84f
> --- /dev/null
> +++ b/test/xmlfiles/rule_payload.xml
> @@ -0,0 +1,12 @@
> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> + <rule_flags>0</rule_flags>
> + <flags>127</flags>
> + <compat_flags>0</compat_flags>
> + <compat_proto>0</compat_proto>
> + <expr type="payload">
> + <dreg>1</dreg>
> + <base>1</base>
Possible bases are defined by nft_payload_bases, use strings "link",
"network", "transport".
> + <offset>12</offset>
> + <len>4</len>
> + </expr>
> +</rule>
> diff --git a/test/xmlfiles/rule_target.xml b/test/xmlfiles/rule_target.xml
> new file mode 100644
> index 0000000..a41d794
> --- /dev/null
> +++ b/test/xmlfiles/rule_target.xml
> @@ -0,0 +1,10 @@
> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> + <rule_flags>0</rule_flags>
> + <flags>127</flags>
> + <compat_flags>0</compat_flags>
> + <compat_proto>0</compat_proto>
> + <expr type="target">
> + <name>LOG</name>
> + <rev>0</rev>
> + </expr>
> +</rule>
> diff --git a/test/xmlfiles/table1.xml b/test/xmlfiles/table1.xml
> new file mode 100644
> index 0000000..a397d52
> --- /dev/null
> +++ b/test/xmlfiles/table1.xml
> @@ -0,0 +1,6 @@
> +<table name="filter" version="0">
> + <properties>
> + <family>2</family>
> + <table_flags>0</table_flags>
> + </properties>
> +</table>
> diff --git a/test/xmlfiles/table2.xml b/test/xmlfiles/table2.xml
> new file mode 100644
> index 0000000..de8e570
> --- /dev/null
> +++ b/test/xmlfiles/table2.xml
> @@ -0,0 +1,6 @@
> +<table name="nat" version="0">
> + <properties>
> + <family>10</family>
> + <table_flags>123</table_flags>
The only table flag is defined by enum nft_table_flags.
> + </properties>
> +</table>
>
Please, send me patches to address those and then resend this patch
once all of them has been resolved.
Thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [libnftables PATCH] test: add testbench for XML
2013-06-20 19:02 ` Pablo Neira Ayuso
@ 2013-06-21 22:44 ` Arturo Borrero Gonzalez
2013-06-22 12:25 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Arturo Borrero Gonzalez @ 2013-06-21 22:44 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: Netfilter Development Mailing list
Hi Pablo,
I already have a patch series to address yours requests.
But, please, I need some more details in the next issues:
2013/6/20 Pablo Neira Ayuso <pablo@netfilter.org>:
>> diff --git a/test/xmlfiles/rule_exthdr.xml b/test/xmlfiles/rule_exthdr.xml
>> new file mode 100644
>> index 0000000..0abeb3c
>> --- /dev/null
>> +++ b/test/xmlfiles/rule_exthdr.xml
>> @@ -0,0 +1,12 @@
>> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
>> + <rule_flags>0</rule_flags>
>> + <flags>127</flags>
>> + <compat_flags>0</compat_flags>
>> + <compat_proto>0</compat_proto>
>> + <expr type="exthdr">
>> + <dreg>123</dreg>
>
> fix.
>
>> + <type>15</type>
>
> Possibilities are defined by: nft_exthdr_attributes
I did not understand this.
In include/uapi/linux/netfilter/nf_tables.h I have:
enum nft_exthdr_attributes {
NFTA_EXTHDR_UNSPEC,
NFTA_EXTHDR_DREG,
NFTA_EXTHDR_TYPE,
NFTA_EXTHDR_OFFSET,
NFTA_EXTHDR_LEN,
__NFTA_EXTHDR_MAX
};
What should I do with this?
>> diff --git a/test/xmlfiles/rule_immediate.xml b/test/xmlfiles/rule_immediate.xml
>> new file mode 100644
>> index 0000000..a566ca5
>> --- /dev/null
>> +++ b/test/xmlfiles/rule_immediate.xml
>> @@ -0,0 +1,31 @@
>> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
>> + <rule_flags>0</rule_flags>
>> + <flags>127</flags>
>> + <compat_flags>0</compat_flags>
>> + <compat_proto>0</compat_proto>
>> + <expr type="immediate">
>> + <dreg>1</dreg>
>> + <immdata>
>> + <data_reg type="value">
>> + <len>1</len>
>> + <data0>0xaabbccdd</data0>
>
> Lenghs says 1 byte, but I can see way more stuff there.
mmmm,
the XML node 'len' means how many '<data>' nodes we have.
Then, the actual length of the data is somehow hard-coded in the lib
and is calculated this way:
data_reg.len = xml_node_len_value * sizeof(data_reg.val[0])
Maybe is not fully implemented yet, but I already have an incoming
patch to address this.
>> diff --git a/test/xmlfiles/rule_log.xml b/test/xmlfiles/rule_log.xml
>> new file mode 100644
>> index 0000000..5471fee
>> --- /dev/null
>> +++ b/test/xmlfiles/rule_log.xml
>> @@ -0,0 +1,12 @@
>> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
>> + <rule_flags>0</rule_flags>
>> + <flags>127</flags>
>> + <compat_flags>0</compat_flags>
>> + <compat_proto>0</compat_proto>
>> + <expr type="log">
>> + <group>123123121</group>
>
> possible groups are 0-65535.
Maybe I should also change the group data type to uint16_t.
>> diff --git a/test/xmlfiles/rule_nat.xml b/test/xmlfiles/rule_nat.xml
>> new file mode 100644
>> index 0000000..868be50
>> --- /dev/null
>> +++ b/test/xmlfiles/rule_nat.xml
>> @@ -0,0 +1,22 @@
>> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
>> + <rule_flags>0</rule_flags>
>> + <flags>127</flags>
>> + <compat_flags>0</compat_flags>
>> + <compat_proto>0</compat_proto>
>> + <expr type="nat">
>> + <sreg_addr_min>1</sreg_addr_min>
>> + <sreg_addr_max>1</sreg_addr_max>
>
> These above are IPv4 / IPv6 addresses. Should be printable ini
> human readable format, you probably use inet_ntop for output and
> inet_pton for input.
>
>> + <sreg_proto_min>1</sreg_proto_min>
>> + <sreg_proto_max>1</sreg_proto_max>
>
> max here is 2^16 as they are port numbers.
>
>> + <family>AF_INET6</family>
>
> would be good to replace this by ip6.
>
>> + <type>NFT_NAT_DNAT</type>
>
> and this by dnat.
>
>> + </expr>
>> + <expr type="nat">
>
> The ipv4 part is asking for a new file, add rule_nat-ipv4.xml and
> rule_nat-ipv6.xml
>
I will do it. But I think that from the parsing point of view, is the
same having two nat expr in one <rule> file.
>> diff --git a/test/xmlfiles/table2.xml b/test/xmlfiles/table2.xml
>> new file mode 100644
>> index 0000000..de8e570
>> --- /dev/null
>> +++ b/test/xmlfiles/table2.xml
>> @@ -0,0 +1,6 @@
>> +<table name="nat" version="0">
>> + <properties>
>> + <family>10</family>
>> + <table_flags>123</table_flags>
>
> The only table flag is defined by enum nft_table_flags.
>
What if we have some kind of general validation functions?
- The xml_parse() will just translate the XML to an object, with no
additional validations.
- The validate() will take care of values being 'real'.
Example:
int nft_table_validate(struct nft_table t)
{
/* validate family or return -1 */
/* validate table_flags or return -1*/
/* validate...maybe name length or return -1*/
}
EXPORT_SYMBOL(nft_table_validate);
I think this may be useful both for userspace programs (who used
_set() and _unset() funcs) and the JSON stuff.
And it will not require so many lines of code.
At the end, from inside the xml_parse() function we can call
_validate() and only consider the parsing done if the object
validates.
Its a good idea? Should I work on this?
Regards.
--
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [libnftables PATCH] test: add testbench for XML
2013-06-21 22:44 ` Arturo Borrero Gonzalez
@ 2013-06-22 12:25 ` Pablo Neira Ayuso
0 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2013-06-22 12:25 UTC (permalink / raw)
To: Arturo Borrero Gonzalez; +Cc: Netfilter Development Mailing list
Hi Arturo,
On Sat, Jun 22, 2013 at 12:44:09AM +0200, Arturo Borrero Gonzalez wrote:
> Hi Pablo,
>
> I already have a patch series to address yours requests.
> But, please, I need some more details in the next issues:
>
> 2013/6/20 Pablo Neira Ayuso <pablo@netfilter.org>:
> >> diff --git a/test/xmlfiles/rule_exthdr.xml b/test/xmlfiles/rule_exthdr.xml
> >> new file mode 100644
> >> index 0000000..0abeb3c
> >> --- /dev/null
> >> +++ b/test/xmlfiles/rule_exthdr.xml
> >> @@ -0,0 +1,12 @@
> >> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> >> + <rule_flags>0</rule_flags>
> >> + <flags>127</flags>
> >> + <compat_flags>0</compat_flags>
> >> + <compat_proto>0</compat_proto>
> >> + <expr type="exthdr">
> >> + <dreg>123</dreg>
> >
> > fix.
> >
> >> + <type>15</type>
> >
> > Possibilities are defined by: nft_exthdr_attributes
>
> I did not understand this.
> In include/uapi/linux/netfilter/nf_tables.h I have:
>
> enum nft_exthdr_attributes {
> NFTA_EXTHDR_UNSPEC,
> NFTA_EXTHDR_DREG,
> NFTA_EXTHDR_TYPE,
> NFTA_EXTHDR_OFFSET,
> NFTA_EXTHDR_LEN,
> __NFTA_EXTHDR_MAX
> };
>
> What should I do with this?
Bad pointer, sorry. Possible types for exthdr are defined by certain
IPPROTO_*, in nft:
static const struct exthdr_desc *exthdr_protocols[IPPROTO_MAX] = {
[IPPROTO_HOPOPTS] = &exthdr_hbh,
[IPPROTO_ROUTING] = &exthdr_rt,
[IPPROTO_FRAGMENT] = &exthdr_frag,
[IPPROTO_DSTOPTS] = &exthdr_dst,
[IPPROTO_MH] = &exthdr_mh,
};
To simplify, you can try to generate a rule with nft that uses exthdr
and dump it via libnftables, so you don't need to make up the
testbench. Send a private email if you have any trouble with this.
> >> diff --git a/test/xmlfiles/rule_immediate.xml b/test/xmlfiles/rule_immediate.xml
> >> new file mode 100644
> >> index 0000000..a566ca5
> >> --- /dev/null
> >> +++ b/test/xmlfiles/rule_immediate.xml
> >> @@ -0,0 +1,31 @@
> >> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> >> + <rule_flags>0</rule_flags>
> >> + <flags>127</flags>
> >> + <compat_flags>0</compat_flags>
> >> + <compat_proto>0</compat_proto>
> >> + <expr type="immediate">
> >> + <dreg>1</dreg>
> >> + <immdata>
> >> + <data_reg type="value">
> >> + <len>1</len>
> >> + <data0>0xaabbccdd</data0>
> >
> > Lenghs says 1 byte, but I can see way more stuff there.
>
> mmmm,
>
> the XML node 'len' means how many '<data>' nodes we have.
>
> Then, the actual length of the data is somehow hard-coded in the lib
> and is calculated this way:
> data_reg.len = xml_node_len_value * sizeof(data_reg.val[0])
That data_reg.len should be the number of bytes, not the number of
registers in use. You have to fix that.
> Maybe is not fully implemented yet, but I already have an incoming
> patch to address this.
>
> >> diff --git a/test/xmlfiles/rule_log.xml b/test/xmlfiles/rule_log.xml
> >> new file mode 100644
> >> index 0000000..5471fee
> >> --- /dev/null
> >> +++ b/test/xmlfiles/rule_log.xml
> >> @@ -0,0 +1,12 @@
> >> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> >> + <rule_flags>0</rule_flags>
> >> + <flags>127</flags>
> >> + <compat_flags>0</compat_flags>
> >> + <compat_proto>0</compat_proto>
> >> + <expr type="log">
> >> + <group>123123121</group>
> >
> > possible groups are 0-65535.
>
> Maybe I should also change the group data type to uint16_t.
We have to fix that in kernel code as well. I'll take care of it, just
use a 2^16 value in your testbench files.
> >> diff --git a/test/xmlfiles/rule_nat.xml b/test/xmlfiles/rule_nat.xml
> >> new file mode 100644
> >> index 0000000..868be50
> >> --- /dev/null
> >> +++ b/test/xmlfiles/rule_nat.xml
> >> @@ -0,0 +1,22 @@
> >> +<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
> >> + <rule_flags>0</rule_flags>
> >> + <flags>127</flags>
> >> + <compat_flags>0</compat_flags>
> >> + <compat_proto>0</compat_proto>
> >> + <expr type="nat">
> >> + <sreg_addr_min>1</sreg_addr_min>
> >> + <sreg_addr_max>1</sreg_addr_max>
> >
> > These above are IPv4 / IPv6 addresses. Should be printable ini
> > human readable format, you probably use inet_ntop for output and
> > inet_pton for input.
> >
> >> + <sreg_proto_min>1</sreg_proto_min>
> >> + <sreg_proto_max>1</sreg_proto_max>
> >
> > max here is 2^16 as they are port numbers.
> >
> >> + <family>AF_INET6</family>
> >
> > would be good to replace this by ip6.
> >
> >> + <type>NFT_NAT_DNAT</type>
> >
> > and this by dnat.
> >
> >> + </expr>
> >> + <expr type="nat">
> >
> > The ipv4 part is asking for a new file, add rule_nat-ipv4.xml and
> > rule_nat-ipv6.xml
> >
>
> I will do it. But I think that from the parsing point of view, is the
> same having two nat expr in one <rule> file.
Yes, the parser will take it. But from the semantic point of view it
does not make sense.
> >> diff --git a/test/xmlfiles/table2.xml b/test/xmlfiles/table2.xml
> >> new file mode 100644
> >> index 0000000..de8e570
> >> --- /dev/null
> >> +++ b/test/xmlfiles/table2.xml
> >> @@ -0,0 +1,6 @@
> >> +<table name="nat" version="0">
> >> + <properties>
> >> + <family>10</family>
> >> + <table_flags>123</table_flags>
> >
> > The only table flag is defined by enum nft_table_flags.
> >
>
> What if we have some kind of general validation functions?
>
> - The xml_parse() will just translate the XML to an object, with no
> additional validations.
> - The validate() will take care of values being 'real'.
>
> Example:
>
> int nft_table_validate(struct nft_table t)
> {
> /* validate family or return -1 */
> /* validate table_flags or return -1*/
> /* validate...maybe name length or return -1*/
> }
> EXPORT_SYMBOL(nft_table_validate);
>
> I think this may be useful both for userspace programs (who used
> _set() and _unset() funcs) and the JSON stuff.
> And it will not require so many lines of code.
> At the end, from inside the xml_parse() function we can call
> _validate() and only consider the parsing done if the object
> validates.
> Its a good idea? Should I work on this?
Let's revisit this later. The kernel will just bail out if you pass
some invalid configuration, that's just fine by now.
Just stick to fixing the issues I spotted and make sure we have a
realistic testbench.
Thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-06-22 12:26 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-06-18 20:58 [libnftables PATCH] test: add testbench for XML Arturo Borrero Gonzalez
2013-06-20 19:02 ` Pablo Neira Ayuso
2013-06-21 22:44 ` Arturo Borrero Gonzalez
2013-06-22 12:25 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).