[PATCH nft] tests: nft removes required payload protocol expressions

[PATCH nft] tests: nft removes required payload protocol expressions

[Florian Westphal]

This test fails with
'ip protocol tcp tcp dport 22' mismatches 'tcp dport 22'

ip protocol tcp tcp dport 22 is *ONLY* identical to
'tcp dport 22' in the ip family.

For netdev/inet/bridge, the dependency is required because
we only want to match ipv4 packets.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 Ran out of time, sorry.

 I'll need to delay both this and the change of ipv6
 nexthdr to meta dependencies until after netdev 2.1.

 tests/py/inet/ip_tcp.t         | 9 +++++++++
 tests/py/inet/ip_tcp.t.payload | 8 ++++++++
 tests/py/ip/ip_tcp.t           | 7 +++++++
 tests/py/ip/ip_tcp.t.payload   | 6 ++++++
 4 files changed, 30 insertions(+)
 create mode 100644 tests/py/inet/ip_tcp.t
 create mode 100644 tests/py/inet/ip_tcp.t.payload
 create mode 100644 tests/py/ip/ip_tcp.t
 create mode 100644 tests/py/ip/ip_tcp.t.payload

diff --git a/tests/py/inet/ip_tcp.t b/tests/py/inet/ip_tcp.t
new file mode 100644
index 000000000000..b69edc38137b
--- /dev/null
+++ b/tests/py/inet/ip_tcp.t
@@ -0,0 +1,9 @@
+:input;type filter hook input priority 0
+:ingress;type filter hook ingress device lo priority 0
+
+*inet;test-inet;input
+*bridge;test-bridge;input
+*netdev;test-netdev;ingress
+
+# must not remove ip dependency -- ONLY ipv4 packets should be matched
+ip protocol tcp tcp dport 22;ok;ip protocol 6 tcp dport 22
diff --git a/tests/py/inet/ip_tcp.t.payload b/tests/py/inet/ip_tcp.t.payload
new file mode 100644
index 000000000000..b13988bc8d5e
--- /dev/null
+++ b/tests/py/inet/ip_tcp.t.payload
@@ -0,0 +1,8 @@
+# ip protocol tcp tcp dport 22
+inet test-inet input
+  [ meta load nfproto => reg 1 ]
+  [ cmp eq reg 1 0x00000002 ]
+  [ payload load 1b @ network header + 9 => reg 1 ]
+  [ cmp eq reg 1 0x00000006 ]
+  [ payload load 2b @ transport header + 2 => reg 1 ]
+  [ cmp eq reg 1 0x00001600 ]
diff --git a/tests/py/ip/ip_tcp.t b/tests/py/ip/ip_tcp.t
new file mode 100644
index 000000000000..30759c8f619b
--- /dev/null
+++ b/tests/py/ip/ip_tcp.t
@@ -0,0 +1,7 @@
+:input;type filter hook input priority 0
+:ingress;type filter hook ingress device lo priority 0
+
+*ip;test-inet;input
+
+# can remove ip dependency -- its redundant in ip family
+ip protocol tcp tcp dport 22;ok;tcp dport 22
diff --git a/tests/py/ip/ip_tcp.t.payload b/tests/py/ip/ip_tcp.t.payload
new file mode 100644
index 000000000000..e4141394af7e
--- /dev/null
+++ b/tests/py/ip/ip_tcp.t.payload
@@ -0,0 +1,6 @@
+# ip protocol tcp tcp dport 22
+ip test-inet input
+  [ payload load 1b @ network header + 9 => reg 1 ]
+  [ cmp eq reg 1 0x00000006 ]
+  [ payload load 2b @ transport header + 2 => reg 1 ]
+  [ cmp eq reg 1 0x00001600 ]
-- 
2.10.2

Re: [PATCH nft] tests: nft removes required payload protocol expressions

[Pablo Neira Ayuso]

On Thu, Mar 23, 2017 at 09:11:56AM +0100, Florian Westphal wrote:
> This test fails with
> 'ip protocol tcp tcp dport 22' mismatches 'tcp dport 22'
> 
> ip protocol tcp tcp dport 22 is *ONLY* identical to
> 'tcp dport 22' in the ip family.
> 
> For netdev/inet/bridge, the dependency is required because
> we only want to match ipv4 packets.

This needs the C chunk to fix this, right? so I let you decide if you
want to push out this test now or make it together with the fix.

Thanks!

Re: [PATCH nft] tests: nft removes required payload protocol expressions

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Thu, Mar 23, 2017 at 09:11:56AM +0100, Florian Westphal wrote:
> > This test fails with
> > 'ip protocol tcp tcp dport 22' mismatches 'tcp dport 22'
> > 
> > ip protocol tcp tcp dport 22 is *ONLY* identical to
> > 'tcp dport 22' in the ip family.
> > 
> > For netdev/inet/bridge, the dependency is required because
> > we only want to match ipv4 packets.
> 
> This needs the C chunk to fix this, right? so I let you decide if you
> want to push out this test now or make it together with the fix.

I have no fix at the moment.

I will thus probably push this test when I get home so we don't forget
about it.

Re: [PATCH nft] tests: nft removes required payload protocol expressions

[Pablo Neira Ayuso]

On Thu, Apr 06, 2017 at 08:45:47PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Thu, Mar 23, 2017 at 09:11:56AM +0100, Florian Westphal wrote:
> > > This test fails with
> > > 'ip protocol tcp tcp dport 22' mismatches 'tcp dport 22'
> > > 
> > > ip protocol tcp tcp dport 22 is *ONLY* identical to
> > > 'tcp dport 22' in the ip family.
> > > 
> > > For netdev/inet/bridge, the dependency is required because
> > > we only want to match ipv4 packets.
> > 
> > This needs the C chunk to fix this, right? so I let you decide if you
> > want to push out this test now or make it together with the fix.
> 
> I have no fix at the moment.
> 
> I will thus probably push this test when I get home so we don't forget
> about it.

Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>

Thanks!