From: Florian Westphal <fw@strlen.de>
To: <netfilter-devel@vger.kernel.org>
Cc: Florian Westphal <fw@strlen.de>
Subject: [PATCH nft] tests: shell: add template match bug test
Date: Thu, 16 Jul 2026 11:10:32 +0200 [thread overview]
Message-ID: <20260716091037.15018-1-fw@strlen.de> (raw)
Template should not be matched via "ct" expression. Else this
makes us read an l3num of 0. This is a test for kernel commit
3027ecbdb5fd ("netfilter: nft_ct: bail out on template ct in get eval").
Signed-off-by: Florian Westphal <fw@strlen.de>
---
.../packetpath/dumps/nft_ct_template.json-nft | 252 ++++++++++++++++++
.../packetpath/dumps/nft_ct_template.nft | 22 ++
.../testcases/packetpath/nft_ct_template | 38 +++
3 files changed, 312 insertions(+)
create mode 100644 tests/shell/testcases/packetpath/dumps/nft_ct_template.json-nft
create mode 100644 tests/shell/testcases/packetpath/dumps/nft_ct_template.nft
create mode 100755 tests/shell/testcases/packetpath/nft_ct_template
diff --git a/tests/shell/testcases/packetpath/dumps/nft_ct_template.json-nft b/tests/shell/testcases/packetpath/dumps/nft_ct_template.json-nft
new file mode 100644
index 000000000000..9c38046f5b7e
--- /dev/null
+++ b/tests/shell/testcases/packetpath/dumps/nft_ct_template.json-nft
@@ -0,0 +1,252 @@
+{
+ "nftables": [
+ {
+ "metainfo": {
+ "version": "VERSION",
+ "release_name": "RELEASE_NAME",
+ "json_schema_version": 1
+ }
+ },
+ {
+ "table": {
+ "family": "ip",
+ "name": "t",
+ "handle": 0
+ }
+ },
+ {
+ "chain": {
+ "family": "ip",
+ "table": "t",
+ "name": "c",
+ "handle": 0,
+ "type": "filter",
+ "hook": "output",
+ "prio": -300,
+ "policy": "accept"
+ }
+ },
+ {
+ "rule": {
+ "family": "ip",
+ "table": "t",
+ "chain": "c",
+ "handle": 0,
+ "expr": [
+ {
+ "mangle": {
+ "key": {
+ "ct": {
+ "key": "zone"
+ }
+ },
+ "value": 1
+ }
+ }
+ ]
+ }
+ },
+ {
+ "rule": {
+ "family": "ip",
+ "table": "t",
+ "chain": "c",
+ "handle": 0,
+ "expr": [
+ {
+ "match": {
+ "op": "==",
+ "left": {
+ "ct": {
+ "key": "saddr",
+ "dir": "original"
+ }
+ },
+ "right": "0.0.0.0"
+ }
+ },
+ {
+ "counter": {
+ "packets": 0,
+ "bytes": 0
+ }
+ },
+ {
+ "accept": null
+ }
+ ]
+ }
+ },
+ {
+ "table": {
+ "family": "ip6",
+ "name": "t",
+ "handle": 0
+ }
+ },
+ {
+ "chain": {
+ "family": "ip6",
+ "table": "t",
+ "name": "c",
+ "handle": 0,
+ "type": "filter",
+ "hook": "output",
+ "prio": -300,
+ "policy": "accept"
+ }
+ },
+ {
+ "rule": {
+ "family": "ip6",
+ "table": "t",
+ "chain": "c",
+ "handle": 0,
+ "expr": [
+ {
+ "mangle": {
+ "key": {
+ "ct": {
+ "key": "zone"
+ }
+ },
+ "value": 1
+ }
+ }
+ ]
+ }
+ },
+ {
+ "rule": {
+ "family": "ip6",
+ "table": "t",
+ "chain": "c",
+ "handle": 0,
+ "expr": [
+ {
+ "match": {
+ "op": "==",
+ "left": {
+ "ct": {
+ "key": "saddr",
+ "dir": "original"
+ }
+ },
+ "right": "::"
+ }
+ },
+ {
+ "counter": {
+ "packets": 0,
+ "bytes": 0
+ }
+ },
+ {
+ "accept": null
+ }
+ ]
+ }
+ },
+ {
+ "table": {
+ "family": "inet",
+ "name": "t",
+ "handle": 0
+ }
+ },
+ {
+ "chain": {
+ "family": "inet",
+ "table": "t",
+ "name": "c",
+ "handle": 0,
+ "type": "filter",
+ "hook": "output",
+ "prio": -300,
+ "policy": "accept"
+ }
+ },
+ {
+ "rule": {
+ "family": "inet",
+ "table": "t",
+ "chain": "c",
+ "handle": 0,
+ "expr": [
+ {
+ "mangle": {
+ "key": {
+ "ct": {
+ "key": "zone"
+ }
+ },
+ "value": 1
+ }
+ }
+ ]
+ }
+ },
+ {
+ "rule": {
+ "family": "inet",
+ "table": "t",
+ "chain": "c",
+ "handle": 0,
+ "expr": [
+ {
+ "match": {
+ "op": "==",
+ "left": {
+ "ct": {
+ "key": "ip saddr",
+ "dir": "original"
+ }
+ },
+ "right": "0.0.0.0"
+ }
+ },
+ {
+ "counter": {
+ "packets": 0,
+ "bytes": 0
+ }
+ },
+ {
+ "accept": null
+ }
+ ]
+ }
+ },
+ {
+ "rule": {
+ "family": "inet",
+ "table": "t",
+ "chain": "c",
+ "handle": 0,
+ "expr": [
+ {
+ "match": {
+ "op": "==",
+ "left": {
+ "ct": {
+ "key": "ip6 saddr",
+ "dir": "original"
+ }
+ },
+ "right": "::"
+ }
+ },
+ {
+ "counter": {
+ "packets": 0,
+ "bytes": 0
+ }
+ },
+ {
+ "accept": null
+ }
+ ]
+ }
+ }
+ ]
+}
diff --git a/tests/shell/testcases/packetpath/dumps/nft_ct_template.nft b/tests/shell/testcases/packetpath/dumps/nft_ct_template.nft
new file mode 100644
index 000000000000..efe5dbb265a7
--- /dev/null
+++ b/tests/shell/testcases/packetpath/dumps/nft_ct_template.nft
@@ -0,0 +1,22 @@
+table ip t {
+ chain c {
+ type filter hook output priority raw; policy accept;
+ ct zone set 1
+ ct original ip saddr 0.0.0.0 counter packets 0 bytes 0 accept
+ }
+}
+table ip6 t {
+ chain c {
+ type filter hook output priority raw; policy accept;
+ ct zone set 1
+ ct original ip6 saddr :: counter packets 0 bytes 0 accept
+ }
+}
+table inet t {
+ chain c {
+ type filter hook output priority raw; policy accept;
+ ct zone set 1
+ ct original ip saddr 0.0.0.0 counter packets 0 bytes 0 accept
+ ct original ip6 saddr :: counter packets 0 bytes 0 accept
+ }
+}
diff --git a/tests/shell/testcases/packetpath/nft_ct_template b/tests/shell/testcases/packetpath/nft_ct_template
new file mode 100755
index 000000000000..02051f3345c9
--- /dev/null
+++ b/tests/shell/testcases/packetpath/nft_ct_template
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+# test for kernel commit 3027ecbdb5fd ("netfilter: nft_ct: bail out on template ct in get eval")
+
+set -e
+
+$NFT -f - <<EOF
+table ip t {
+ chain c {
+ type filter hook output priority -300; policy accept;
+ ct zone set 1
+ ct original saddr 0.0.0.0 counter accept
+ }
+}
+
+table ip6 t {
+ chain c {
+ type filter hook output priority -300; policy accept;
+ ct zone set 1
+ ct original saddr :: counter accept
+ }
+}
+
+table inet t {
+ chain c {
+ type filter hook output priority -300; policy accept;
+ ct zone set 1
+ ct original ip saddr 0.0.0.0 counter accept
+ ct original ip6 saddr :: counter accept
+ }
+}
+EOF
+
+ip link set lo up
+ping -c 1 127.0.0.1
+ping -c 1 ::1
+
+# counter validation via dump file.
--
2.55.0
reply other threads:[~2026-07-16 9:10 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260716091037.15018-1-fw@strlen.de \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox