* [PATCH nft 1/3] tests: add more ruleset validation test cases
@ 2024-07-10 21:42 Florian Westphal
2024-07-10 21:42 ` [PATCH nft 2/3] testcases: test jump to basechain is rejected, even if there is no loop Florian Westphal
2024-07-10 21:42 ` [PATCH nft 3/3] tests: connect chains to hook point Florian Westphal
0 siblings, 2 replies; 3+ messages in thread
From: Florian Westphal @ 2024-07-10 21:42 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
Same as existing tests, but try harder to fool the validation:
1. Add a ruleset where the jump that that exceeds 16 is "broken", i.e.
c0 -> c1 ... -> c8
c9-> c1 ... -> c16
Where c0 is a base chain, with a graph thats really a linear list
from c0 to c8 and c9 to c16 is a linear list not connected to the former
or a hook point.
Then try to link them either directly via jump/goto rule or indirectly
with a verdict map.
Try both unbound map with element doing 'goto c9' and then trying to add
vmap rule to c8 (must fail, creates link).
Then try reverse: with empty map, add vmap rule to c8 (should work, no
elements...).
Then, add map element with jump or goto to c9. This should be rejected.
Try the same thing with a tproxy expression in a user-defined chain:
attempt to make it reachable from c0 (filter input), which is illegal.
Signed-off-by: Florian Westphal <fw@strlen.de>
---
.../testcases/transactions/bad_rule_graphs | 262 ++++++++++++++++++
.../dumps/bad_rule_graphs.json-nft | 201 ++++++++++++++
.../transactions/dumps/bad_rule_graphs.nft | 30 ++
3 files changed, 493 insertions(+)
create mode 100755 tests/shell/testcases/transactions/bad_rule_graphs
create mode 100644 tests/shell/testcases/transactions/dumps/bad_rule_graphs.json-nft
create mode 100644 tests/shell/testcases/transactions/dumps/bad_rule_graphs.nft
diff --git a/tests/shell/testcases/transactions/bad_rule_graphs b/tests/shell/testcases/transactions/bad_rule_graphs
new file mode 100755
index 000000000000..53047c3c229f
--- /dev/null
+++ b/tests/shell/testcases/transactions/bad_rule_graphs
@@ -0,0 +1,262 @@
+#!/bin/bash
+
+# test case to attempt to fool ruleset validation.
+# Initial ruleset added here is fine, then we try to make the
+# ruleset exceed the jump chain depth via jumps, gotos, verdict
+# map entries etc, either by having the map loop back to itself,
+# jumping back to an earlier chain and so on.
+#
+# Also check that can't hook up a user-defined chain with a
+# restricted expression (here: tproxy, only valid from prerouting
+# hook) to the input hook, even if reachable indirectly via vmap.
+
+bad_ruleset()
+{
+ ret=$1
+ shift
+
+ if [ $ret -eq 0 ];then
+ echo "Accepted bad ruleset with $@"
+ $NFT list ruleset
+ exit 1
+ fi
+}
+
+good_ruleset()
+{
+ ret=$1
+ shift
+
+ if [ $ret -ne 0 ];then
+ echo "Rejected good ruleset with $@"
+ exit 1
+ fi
+}
+
+# add a loop with a vmap statement, either goto or jump,
+# both with single rule and delta-transaction that also
+# contains valid information.
+check_loop()
+{
+ what=$1
+
+ $NFT "add element t m { 1.2.3.9 : $what c1 }"
+ bad_ruleset $? "bound map with $what to backjump should exceed jump stack"
+
+ $NFT "add element t m { 1.2.3.9 : $what c7 }"
+ bad_ruleset $? "bound map with $what to backjump should exceed jump stack"
+
+ $NFT "add element t m { 1.2.3.9 : $what c8 }"
+ bad_ruleset $? "bound map with $what to self should exceed jump stack"
+
+ # rule bound to c8, this should not work -- jump stack should be exceeded.
+ $NFT "add element t m { 1.2.3.9 : jump c9 }"
+ bad_ruleset $? "bound map with $what should exceed jump stack"
+
+ # rule bound to c8, this should be within jump stack limit
+ $NFT "add element t m { 1.2.3.9 : jump c10 }"
+ good_ruleset $? "bound map with $what should not have exceeded jump stack"
+
+$NFT -f - <<EOF
+flush chain t c16
+flush chain t c15
+table t {
+ chain c9 {
+ ip protocol 6 goto c14
+ }
+
+ # calls @m again, but @m now runs c10, which is linked to c14 already.
+ chain c14 {
+ ip protocol 6 return
+ ip daddr vmap @m
+ }
+}
+EOF
+ bad_ruleset $? "delta with bound map with $what loop and rule deletions"
+
+ # delete mapping again
+ $NFT "delete element t m { 1.2.3.9 }"
+ good_ruleset $? "cannot delete mapping"
+}
+
+check_bad_expr()
+{
+$NFT -f -<<EOF
+table t {
+ chain c1 {
+ jump c9
+ }
+}
+EOF
+bad_ruleset $? "tproxy expr exposed to input hook"
+
+$NFT -f -<<EOF
+flush map t m
+
+table t {
+ chain c1 {
+ ip saddr vmap @m
+ }
+}
+EOF
+good_ruleset $? "bound vmap to c1"
+
+$NFT -f -<<EOF
+table t {
+ map m {
+ type ipv4_addr : verdict
+ elements = { 1.2.3.4 : jump c9 }
+ }
+}
+EOF
+bad_ruleset $? "tproxy expr exposed to input hook by vmap"
+
+$NFT -f -<<EOF
+flush chain t c10
+flush chain t c11
+add rule t c8 jump c9
+
+table t {
+ map m {
+ type ipv4_addr : verdict
+ elements = { 1.2.3.4 : goto c2 }
+ }
+}
+EOF
+bad_ruleset $? "tproxy expr exposed to input hook by vmap"
+
+$NFT -f -<<EOF
+flush chain t c2
+flush chain t c3
+flush chain t c4
+flush chain t c5
+flush chain t c6
+flush chain t c7
+flush chain t c10
+flush chain t c11
+flush chain t c12
+flush chain t c13
+flush chain t c14
+flush chain t c15
+flush chain t c16
+delete chain t c16
+delete chain t c15
+delete chain t c14
+delete chain t c13
+delete chain t c12
+delete chain t c11
+delete chain t c7
+delete chain t c6
+delete chain t c5
+delete chain t c4
+delete chain t c3
+add rule t c8 jump c9
+EOF
+good_ruleset $? "connect chain c8 to chain c9"
+
+$NFT -f -<<EOF
+table t {
+ map m {
+ type ipv4_addr : verdict
+ elements = { 1.2.3.4 : goto c8 }
+ }
+}
+EOF
+bad_ruleset $? "tproxy expr exposed to input hook by vmap c1 -> vmap -> c8 -> c9"
+}
+
+# 16 jump levels are permitted.
+# First ruleset is fine, there is no jump
+# from c8 to c9.
+$NFT -f - <<EOF
+table t {
+ map m {
+ type ipv4_addr : verdict
+ }
+
+ chain c16 { }
+ chain c15 { jump c16; }
+ chain c14 { jump c15; }
+ chain c13 { jump c14; }
+ chain c12 { jump c13; }
+ chain c11 { jump c12; }
+ chain c10 { jump c11; }
+ chain c9 { jump c10; }
+ chain c8 { }
+ chain c7 { jump c8; }
+ chain c6 { jump c7; }
+ chain c5 { jump c6; }
+ chain c4 { jump c5; }
+ chain c3 { jump c4; }
+ chain c2 { jump c3; }
+ chain c1 { jump c2; }
+ chain c0 { type filter hook input priority 0;
+ jump c1
+ }
+}
+EOF
+
+ret=$?
+if [ $ret -ne 0 ];then
+ exit 1
+fi
+
+# ensure kernel catches the exceeded jumpstack use, despite no new chains
+# are added here and cycle is acyclic.
+$NFT -f - <<EOF
+# unrelated rule.
+add rule t c14 accept
+add rule t c15 accept
+
+# close jump gap; after this jumpstack limit is exceeded.
+add rule t c8 goto c9
+
+# unrelated rules.
+add rule t c14 accept
+add rule t c15 accept
+EOF
+
+bad_ruleset $? "chain jump stack exhausted without cycle"
+
+$NFT -f - <<EOF
+# unrelated rule.
+add rule t c12 accept
+add rule t c13 accept
+
+add element t m { 1.2.3.1 : accept }
+add element t m { 1.2.3.16 : goto c16 }
+add element t m { 1.2.3.15 : goto c15 }
+
+# after this jumpstack limit is exceeded,
+# IFF @m was bound to c8, but it is not.
+add element t m { 1.2.3.9 : jump c9 }
+
+# unrelated rules.
+add rule t c12 accept
+add rule t c13 accept
+
+add element t m { 1.2.3.16 : goto c16 }
+EOF
+good_ruleset $? "unbounded map"
+
+# bind vmap to c8. This MUST fail, map jumps to c9.
+$NFT "add rule t c8 ip saddr vmap @m"
+bad_ruleset $? "jump c8->c9 via vmap expression"
+
+# delete the mapping again.
+$NFT "delete element t m { 1.2.3.9 }"
+$NFT "add rule t c8 ip saddr vmap @m"
+good_ruleset $? "bind empty map to c8"
+
+check_loop "jump"
+check_loop "goto"
+
+$NFT "flush chain t c8"
+good_ruleset $? "flush chain t c8"
+
+# should work, c9 not connected to c0 aka filter input.
+$NFT "add rule t c9 tcp dport 80 tproxy to :20000 meta mark set 1 accept"
+good_ruleset $? "add tproxy expression to c9"
+check_bad_expr
+
+exit $?
diff --git a/tests/shell/testcases/transactions/dumps/bad_rule_graphs.json-nft b/tests/shell/testcases/transactions/dumps/bad_rule_graphs.json-nft
new file mode 100644
index 000000000000..30789211ff4a
--- /dev/null
+++ b/tests/shell/testcases/transactions/dumps/bad_rule_graphs.json-nft
@@ -0,0 +1,201 @@
+{
+ "nftables": [
+ {
+ "metainfo": {
+ "version": "VERSION",
+ "release_name": "RELEASE_NAME",
+ "json_schema_version": 1
+ }
+ },
+ {
+ "table": {
+ "family": "ip",
+ "name": "t",
+ "handle": 0
+ }
+ },
+ {
+ "chain": {
+ "family": "ip",
+ "table": "t",
+ "name": "c10",
+ "handle": 0
+ }
+ },
+ {
+ "chain": {
+ "family": "ip",
+ "table": "t",
+ "name": "c9",
+ "handle": 0
+ }
+ },
+ {
+ "chain": {
+ "family": "ip",
+ "table": "t",
+ "name": "c8",
+ "handle": 0
+ }
+ },
+ {
+ "chain": {
+ "family": "ip",
+ "table": "t",
+ "name": "c2",
+ "handle": 0
+ }
+ },
+ {
+ "chain": {
+ "family": "ip",
+ "table": "t",
+ "name": "c1",
+ "handle": 0
+ }
+ },
+ {
+ "chain": {
+ "family": "ip",
+ "table": "t",
+ "name": "c0",
+ "handle": 0,
+ "type": "filter",
+ "hook": "input",
+ "prio": 0,
+ "policy": "accept"
+ }
+ },
+ {
+ "map": {
+ "family": "ip",
+ "name": "m",
+ "table": "t",
+ "type": "ipv4_addr",
+ "handle": 0,
+ "map": "verdict"
+ }
+ },
+ {
+ "rule": {
+ "family": "ip",
+ "table": "t",
+ "chain": "c9",
+ "handle": 0,
+ "expr": [
+ {
+ "jump": {
+ "target": "c10"
+ }
+ }
+ ]
+ }
+ },
+ {
+ "rule": {
+ "family": "ip",
+ "table": "t",
+ "chain": "c9",
+ "handle": 0,
+ "expr": [
+ {
+ "match": {
+ "op": "==",
+ "left": {
+ "payload": {
+ "protocol": "tcp",
+ "field": "dport"
+ }
+ },
+ "right": 80
+ }
+ },
+ {
+ "tproxy": {
+ "port": 20000
+ }
+ },
+ {
+ "mangle": {
+ "key": {
+ "meta": {
+ "key": "mark"
+ }
+ },
+ "value": 1
+ }
+ },
+ {
+ "accept": null
+ }
+ ]
+ }
+ },
+ {
+ "rule": {
+ "family": "ip",
+ "table": "t",
+ "chain": "c8",
+ "handle": 0,
+ "expr": [
+ {
+ "jump": {
+ "target": "c9"
+ }
+ }
+ ]
+ }
+ },
+ {
+ "rule": {
+ "family": "ip",
+ "table": "t",
+ "chain": "c1",
+ "handle": 0,
+ "expr": [
+ {
+ "jump": {
+ "target": "c2"
+ }
+ }
+ ]
+ }
+ },
+ {
+ "rule": {
+ "family": "ip",
+ "table": "t",
+ "chain": "c1",
+ "handle": 0,
+ "expr": [
+ {
+ "vmap": {
+ "key": {
+ "payload": {
+ "protocol": "ip",
+ "field": "saddr"
+ }
+ },
+ "data": "@m"
+ }
+ }
+ ]
+ }
+ },
+ {
+ "rule": {
+ "family": "ip",
+ "table": "t",
+ "chain": "c0",
+ "handle": 0,
+ "expr": [
+ {
+ "jump": {
+ "target": "c1"
+ }
+ }
+ ]
+ }
+ }
+ ]
+}
diff --git a/tests/shell/testcases/transactions/dumps/bad_rule_graphs.nft b/tests/shell/testcases/transactions/dumps/bad_rule_graphs.nft
new file mode 100644
index 000000000000..3a5936500c6e
--- /dev/null
+++ b/tests/shell/testcases/transactions/dumps/bad_rule_graphs.nft
@@ -0,0 +1,30 @@
+table ip t {
+ map m {
+ type ipv4_addr : verdict
+ }
+
+ chain c10 {
+ }
+
+ chain c9 {
+ jump c10
+ tcp dport 80 tproxy to :20000 meta mark set 0x00000001 accept
+ }
+
+ chain c8 {
+ jump c9
+ }
+
+ chain c2 {
+ }
+
+ chain c1 {
+ jump c2
+ ip saddr vmap @m
+ }
+
+ chain c0 {
+ type filter hook input priority filter; policy accept;
+ jump c1
+ }
+}
--
2.44.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH nft 2/3] testcases: test jump to basechain is rejected, even if there is no loop
2024-07-10 21:42 [PATCH nft 1/3] tests: add more ruleset validation test cases Florian Westphal
@ 2024-07-10 21:42 ` Florian Westphal
2024-07-10 21:42 ` [PATCH nft 3/3] tests: connect chains to hook point Florian Westphal
1 sibling, 0 replies; 3+ messages in thread
From: Florian Westphal @ 2024-07-10 21:42 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
Check that we can't jump to input hook from output.
Signed-off-by: Florian Westphal <fw@strlen.de>
---
.../shell/testcases/chains/jump_to_base_chain | 25 +++++++++++++++++++
1 file changed, 25 insertions(+)
create mode 100755 tests/shell/testcases/chains/jump_to_base_chain
diff --git a/tests/shell/testcases/chains/jump_to_base_chain b/tests/shell/testcases/chains/jump_to_base_chain
new file mode 100755
index 000000000000..d71da4cf35eb
--- /dev/null
+++ b/tests/shell/testcases/chains/jump_to_base_chain
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+$NFT -f - <<EOF
+table t {
+ chain i {
+ type filter hook input priority 0
+ }
+
+ chain o {
+ type filter hook output priority 0
+ jump c
+ }
+
+ chain c {
+ jump i
+ }
+}
+EOF
+
+if [ $? -eq 0 ];then
+ echo "E: Accepted jump to a base chain"
+ exit 1
+fi
+
+exit 0
--
2.44.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH nft 3/3] tests: connect chains to hook point
2024-07-10 21:42 [PATCH nft 1/3] tests: add more ruleset validation test cases Florian Westphal
2024-07-10 21:42 ` [PATCH nft 2/3] testcases: test jump to basechain is rejected, even if there is no loop Florian Westphal
@ 2024-07-10 21:42 ` Florian Westphal
1 sibling, 0 replies; 3+ messages in thread
From: Florian Westphal @ 2024-07-10 21:42 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
These tests should fail because they contain a loop or exceed the jump stack.
But this depends on the kernel validating chains that are not bound to any
basechain/hook point.
Wire up the initial chain to filter type.
Without this tests will start to fail when kernel stops validating chains
that are not reachable by any base chain.
Signed-off-by: Florian Westphal <fw@strlen.de>
---
tests/shell/testcases/chains/0003jump_loop_1 | 3 ++-
tests/shell/testcases/chains/0010endless_jump_loop_1 | 2 +-
tests/shell/testcases/chains/0011endless_jump_loop_1 | 2 +-
tests/shell/testcases/chains/0018check_jump_loop_1 | 2 +-
tests/shell/testcases/chains/dumps/0003jump_loop_1.json-nft | 6 +++++-
tests/shell/testcases/chains/dumps/0003jump_loop_1.nft | 1 +
.../testcases/chains/dumps/0010endless_jump_loop_1.json-nft | 6 +++++-
.../testcases/chains/dumps/0010endless_jump_loop_1.nft | 1 +
.../testcases/chains/dumps/0011endless_jump_loop_1.json-nft | 6 +++++-
.../testcases/chains/dumps/0011endless_jump_loop_1.nft | 1 +
.../testcases/chains/dumps/0018check_jump_loop_1.json-nft | 6 +++++-
.../shell/testcases/chains/dumps/0018check_jump_loop_1.nft | 1 +
tests/shell/testcases/transactions/0023rule_1 | 2 +-
tests/shell/testcases/transactions/anon_chain_loop | 2 +-
14 files changed, 31 insertions(+), 10 deletions(-)
diff --git a/tests/shell/testcases/chains/0003jump_loop_1 b/tests/shell/testcases/chains/0003jump_loop_1
index 80e243f07bdb..1a8eaf686747 100755
--- a/tests/shell/testcases/chains/0003jump_loop_1
+++ b/tests/shell/testcases/chains/0003jump_loop_1
@@ -5,8 +5,9 @@ set -e
MAX_JUMPS=16
$NFT add table t
+$NFT "add chain t c1 { type filter hook prerouting priority 0; }"
-for i in $(seq 1 $MAX_JUMPS)
+for i in $(seq 2 $MAX_JUMPS)
do
$NFT add chain t c${i}
done
diff --git a/tests/shell/testcases/chains/0010endless_jump_loop_1 b/tests/shell/testcases/chains/0010endless_jump_loop_1
index 5d3ef2393331..6000e5d7dbf3 100755
--- a/tests/shell/testcases/chains/0010endless_jump_loop_1
+++ b/tests/shell/testcases/chains/0010endless_jump_loop_1
@@ -3,7 +3,7 @@
set -e
$NFT add table t
-$NFT add chain t c
+$NFT add chain "t c { type filter hook input priority 0; }"
# kernel should return ELOOP
$NFT add rule t c tcp dport vmap {1 : jump c} 2>/dev/null || exit 0
diff --git a/tests/shell/testcases/chains/0011endless_jump_loop_1 b/tests/shell/testcases/chains/0011endless_jump_loop_1
index d75932d7a7ca..66abf8d04543 100755
--- a/tests/shell/testcases/chains/0011endless_jump_loop_1
+++ b/tests/shell/testcases/chains/0011endless_jump_loop_1
@@ -3,7 +3,7 @@
set -e
$NFT add table t
-$NFT add chain t c1
+$NFT add chain "t c1 { type filter hook forward priority 0; }"
$NFT add chain t c2
$NFT add map t m {type inet_service : verdict \;}
$NFT add element t m {2 : jump c2}
diff --git a/tests/shell/testcases/chains/0018check_jump_loop_1 b/tests/shell/testcases/chains/0018check_jump_loop_1
index b87520f287d7..1e674d3dc12b 100755
--- a/tests/shell/testcases/chains/0018check_jump_loop_1
+++ b/tests/shell/testcases/chains/0018check_jump_loop_1
@@ -3,7 +3,7 @@
set -e
$NFT add table ip filter
-$NFT add chain ip filter ap1
+$NFT add chain ip filter ap1 "{ type filter hook input priority 0; }"
$NFT add chain ip filter ap2
$NFT add rule ip filter ap1 jump ap2
diff --git a/tests/shell/testcases/chains/dumps/0003jump_loop_1.json-nft b/tests/shell/testcases/chains/dumps/0003jump_loop_1.json-nft
index ceef32242503..d197e123bd67 100644
--- a/tests/shell/testcases/chains/dumps/0003jump_loop_1.json-nft
+++ b/tests/shell/testcases/chains/dumps/0003jump_loop_1.json-nft
@@ -19,7 +19,11 @@
"family": "ip",
"table": "t",
"name": "c1",
- "handle": 0
+ "handle": 0,
+ "type": "filter",
+ "hook": "prerouting",
+ "prio": 0,
+ "policy": "accept"
}
},
{
diff --git a/tests/shell/testcases/chains/dumps/0003jump_loop_1.nft b/tests/shell/testcases/chains/dumps/0003jump_loop_1.nft
index 7054cde45963..8d89bc40a6c4 100644
--- a/tests/shell/testcases/chains/dumps/0003jump_loop_1.nft
+++ b/tests/shell/testcases/chains/dumps/0003jump_loop_1.nft
@@ -1,5 +1,6 @@
table ip t {
chain c1 {
+ type filter hook prerouting priority filter; policy accept;
jump c2
}
diff --git a/tests/shell/testcases/chains/dumps/0010endless_jump_loop_1.json-nft b/tests/shell/testcases/chains/dumps/0010endless_jump_loop_1.json-nft
index db64cdbcc447..af99873dbeda 100644
--- a/tests/shell/testcases/chains/dumps/0010endless_jump_loop_1.json-nft
+++ b/tests/shell/testcases/chains/dumps/0010endless_jump_loop_1.json-nft
@@ -19,7 +19,11 @@
"family": "ip",
"table": "t",
"name": "c",
- "handle": 0
+ "handle": 0,
+ "type": "filter",
+ "hook": "input",
+ "prio": 0,
+ "policy": "accept"
}
}
]
diff --git a/tests/shell/testcases/chains/dumps/0010endless_jump_loop_1.nft b/tests/shell/testcases/chains/dumps/0010endless_jump_loop_1.nft
index 1e0d1d603739..62fefaff185b 100644
--- a/tests/shell/testcases/chains/dumps/0010endless_jump_loop_1.nft
+++ b/tests/shell/testcases/chains/dumps/0010endless_jump_loop_1.nft
@@ -1,4 +1,5 @@
table ip t {
chain c {
+ type filter hook input priority filter; policy accept;
}
}
diff --git a/tests/shell/testcases/chains/dumps/0011endless_jump_loop_1.json-nft b/tests/shell/testcases/chains/dumps/0011endless_jump_loop_1.json-nft
index e1a2262fdf04..75a4d895fc3e 100644
--- a/tests/shell/testcases/chains/dumps/0011endless_jump_loop_1.json-nft
+++ b/tests/shell/testcases/chains/dumps/0011endless_jump_loop_1.json-nft
@@ -19,7 +19,11 @@
"family": "ip",
"table": "t",
"name": "c1",
- "handle": 0
+ "handle": 0,
+ "type": "filter",
+ "hook": "forward",
+ "prio": 0,
+ "policy": "accept"
}
},
{
diff --git a/tests/shell/testcases/chains/dumps/0011endless_jump_loop_1.nft b/tests/shell/testcases/chains/dumps/0011endless_jump_loop_1.nft
index ca0a7378a584..d35736e8ded6 100644
--- a/tests/shell/testcases/chains/dumps/0011endless_jump_loop_1.nft
+++ b/tests/shell/testcases/chains/dumps/0011endless_jump_loop_1.nft
@@ -5,6 +5,7 @@ table ip t {
}
chain c1 {
+ type filter hook forward priority filter; policy accept;
tcp dport vmap @m
}
diff --git a/tests/shell/testcases/chains/dumps/0018check_jump_loop_1.json-nft b/tests/shell/testcases/chains/dumps/0018check_jump_loop_1.json-nft
index 7294c8411b20..ac7e11995848 100644
--- a/tests/shell/testcases/chains/dumps/0018check_jump_loop_1.json-nft
+++ b/tests/shell/testcases/chains/dumps/0018check_jump_loop_1.json-nft
@@ -19,7 +19,11 @@
"family": "ip",
"table": "filter",
"name": "ap1",
- "handle": 0
+ "handle": 0,
+ "type": "filter",
+ "hook": "input",
+ "prio": 0,
+ "policy": "accept"
}
},
{
diff --git a/tests/shell/testcases/chains/dumps/0018check_jump_loop_1.nft b/tests/shell/testcases/chains/dumps/0018check_jump_loop_1.nft
index 437900bc6793..bdd0ead778cb 100644
--- a/tests/shell/testcases/chains/dumps/0018check_jump_loop_1.nft
+++ b/tests/shell/testcases/chains/dumps/0018check_jump_loop_1.nft
@@ -1,5 +1,6 @@
table ip filter {
chain ap1 {
+ type filter hook input priority filter; policy accept;
jump ap2
}
diff --git a/tests/shell/testcases/transactions/0023rule_1 b/tests/shell/testcases/transactions/0023rule_1
index e58c088c2e84..863bcde43aac 100755
--- a/tests/shell/testcases/transactions/0023rule_1
+++ b/tests/shell/testcases/transactions/0023rule_1
@@ -1,7 +1,7 @@
#!/bin/bash
RULESET="add table x
-add chain x y
+add chain x y { type filter hook input priority 0; }
add rule x y jump y"
# kernel must return ELOOP
diff --git a/tests/shell/testcases/transactions/anon_chain_loop b/tests/shell/testcases/transactions/anon_chain_loop
index 2fd61810753d..3053d166c286 100755
--- a/tests/shell/testcases/transactions/anon_chain_loop
+++ b/tests/shell/testcases/transactions/anon_chain_loop
@@ -3,7 +3,7 @@
# anon chains with c1 -> c2 recursive jump, expect failure
$NFT -f - <<EOF
table ip t {
- chain c2 { }
+ chain c2 { type filter hook input priority 0; }
chain c1 { }
}
--
2.44.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-07-10 21:41 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-07-10 21:42 [PATCH nft 1/3] tests: add more ruleset validation test cases Florian Westphal
2024-07-10 21:42 ` [PATCH nft 2/3] testcases: test jump to basechain is rejected, even if there is no loop Florian Westphal
2024-07-10 21:42 ` [PATCH nft 3/3] tests: connect chains to hook point Florian Westphal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox