Skip to content

GitLab

Commit 712749e7 authored by Arturo Borrero Gonzalez's avatar Arturo Borrero Gonzalez
Browse files

Update upstream source from tag 'upstream/1.8.5' 

Update to upstream version '1.8.5'
with Debian dir 8a97bace31de0bf6fa044da123d7fa2e84e9f6aa
parents 214468ea eb1d7c5f
Hide whitespace changes
Inline Side-by-side
iptables/tests/shell/run-tests.sh
View file @ 712749e7
......@@ -46,6 +46,10 @@ while [ -n "$1" ]; do
NFT_ONLY=y
shift
;;
-V|--valgrind)
VALGRIND=y
shift
;;
*${RETURNCODE_SEPARATOR}+([0-9]))
SINGLE+=" $1"
VERBOSE=y
......@@ -67,6 +71,49 @@ else
XTABLES_LEGACY_MULTI="xtables-legacy-multi"
fi
printscript() { # (cmd, tmpd)
cat <<EOF
#!/bin/bash
CMD="$1"
# note: valgrind man page warns about --log-file with --trace-children, the
# last child executed overwrites previous reports unless %p or %q is used.
# Since libtool wrapper calls exec but none of the iptables tools do, this is
# perfect for us as it effectively hides bash-related errors
valgrind --log-file=$2/valgrind.log --trace-children=yes \
--leak-check=full --show-leak-kinds=all \$CMD "\$@"
RC=\$?
# don't keep uninteresting logs
if grep -q 'no leaks are possible' $2/valgrind.log; then
rm $2/valgrind.log
else
mv $2/valgrind.log $2/valgrind_\$\$.log
fi
# drop logs for failing commands for now
[ \$RC -eq 0 ] || rm $2/valgrind_\$\$.log
exit \$RC
EOF
}
if [ "$VALGRIND" == "y" ]; then
tmpd=$(mktemp -d)
msg_info "writing valgrind logs to $tmpd"
chmod a+rx $tmpd
printscript "$XTABLES_NFT_MULTI" "$tmpd" >${tmpd}/xtables-nft-multi
printscript "$XTABLES_LEGACY_MULTI" "$tmpd" >${tmpd}/xtables-legacy-multi
trap "rm ${tmpd}/xtables-*-multi" EXIT
chmod a+x ${tmpd}/xtables-nft-multi ${tmpd}/xtables-legacy-multi
XTABLES_NFT_MULTI="${tmpd}/xtables-nft-multi"
XTABLES_LEGACY_MULTI="${tmpd}/xtables-legacy-multi"
fi
find_tests() {
if [ ! -z "$SINGLE" ] ; then
echo $SINGLE
......
iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
View file @ 712749e7
......@@ -4,7 +4,7 @@ set -e
#set -x
# there is no legacy backend to test
[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
# fill arptables manually
......
iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
View file @ 712749e7
......@@ -3,7 +3,7 @@
set -e
# there is no legacy backend to test
[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
# arptables-restore reuses preloaded targets and matches, make sure defaults
# apply to consecutive rules using the same target/match as a previous one
......
iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0
View file @ 712749e7
......@@ -4,7 +4,7 @@ set -e
set -x
# there is no legacy backend to test
[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
$XT_MULTI arptables -N foo
......
iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
View file @ 712749e7
#!/bin/sh
case "$XT_MULTI" in
*xtables-nft-multi)
;;
*)
echo "skip $XT_MULTI"
exit 0
;;
esac
get_entries_count() { # (chain)
$XT_MULTI ebtables -L $1 | sed -n 's/.*entries: \([0-9]*\).*/\1/p'
}
set -x
case "$XT_MULTI" in
*/xtables-nft-multi)
for t in filter nat;do
$XT_MULTI ebtables -t $t -L || exit 1
$XT_MULTI ebtables -t $t -X || exit 1
$XT_MULTI ebtables -t $t -F || exit 1
done
for t in broute foobar ;do
$XT_MULTI ebtables -t $t -L &&
$XT_MULTI ebtables -t $t -X &&
$XT_MULTI ebtables -t $t -F
if [ $? -eq 0 ]; then
echo "Expect nonzero return for unsupported table"
exit 1
fi
done
for t in filter nat;do
$XT_MULTI ebtables -t $t -L || exit 1
$XT_MULTI ebtables -t $t -X || exit 1
$XT_MULTI ebtables -t $t -F || exit 1
done
$XT_MULTI ebtables -t filter -N FOO || exit 1
$XT_MULTI ebtables -t filter -N FOO
for t in broute foobar ;do
$XT_MULTI ebtables -t $t -L &&
$XT_MULTI ebtables -t $t -X &&
$XT_MULTI ebtables -t $t -F
if [ $? -eq 0 ]; then
echo "Duplicate chain FOO"
$XT_MULTI ebtables -t filter -L
echo "Expect nonzero return for unsupported table"
exit 1
fi
done
entries=$(get_entries_count FOO)
if [ $entries -ne 0 ]; then
echo "Unexpected entries count in empty unreferenced chain (expected 0, have $entries)"
$XT_MULTI ebtables -L
exit 1
fi
$XT_MULTI ebtables -A FORWARD -j FOO
entries=$(get_entries_count FORWARD)
if [ $entries -ne 1 ]; then
echo "Unexpected entries count in FORWARD chain (expected 1, have $entries)"
$XT_MULTI ebtables -L
exit 1
fi
$XT_MULTI ebtables -t filter -N FOO || exit 1
$XT_MULTI ebtables -t filter -N FOO
if [ $? -eq 0 ]; then
echo "Duplicate chain FOO"
$XT_MULTI ebtables -t filter -L
exit 1
fi
entries=$(get_entries_count FOO)
if [ $entries -ne 0 ]; then
echo "Unexpected entries count in empty referenced chain (expected 0, have $entries)"
$XT_MULTI ebtables -L
exit 1
fi
entries=$(get_entries_count FOO)
if [ $entries -ne 0 ]; then
echo "Unexpected entries count in empty unreferenced chain (expected 0, have $entries)"
$XT_MULTI ebtables -L
exit 1
fi
$XT_MULTI ebtables -A FOO -j ACCEPT
entries=$(get_entries_count FOO)
if [ $entries -ne 1 ]; then
echo "Unexpected entries count in non-empty referenced chain (expected 1, have $entries)"
$XT_MULTI ebtables -L
exit 1
fi
$XT_MULTI ebtables -A FORWARD -j FOO
entries=$(get_entries_count FORWARD)
if [ $entries -ne 1 ]; then
echo "Unexpected entries count in FORWARD chain (expected 1, have $entries)"
$XT_MULTI ebtables -L
exit 1
fi
$XT_MULTI ebtables -t filter -N BAR || exit 1
$XT_MULTI ebtables -t filter -N BAZ || exit 1
entries=$(get_entries_count FOO)
if [ $entries -ne 0 ]; then
echo "Unexpected entries count in empty referenced chain (expected 0, have $entries)"
$XT_MULTI ebtables -L
exit 1
fi
$XT_MULTI ebtables -t filter -L | grep -q FOO || exit 1
$XT_MULTI ebtables -t filter -L | grep -q BAR || exit 1
$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1
$XT_MULTI ebtables -A FOO -j ACCEPT
entries=$(get_entries_count FOO)
if [ $entries -ne 1 ]; then
echo "Unexpected entries count in non-empty referenced chain (expected 1, have $entries)"
$XT_MULTI ebtables -L
exit 1
fi
$XT_MULTI ebtables -t filter -L BAZ || exit 1
$XT_MULTI ebtables -t filter -X BAZ || exit 1
$XT_MULTI ebtables -t filter -L BAZ | grep -q BAZ
if [ $? -eq 0 ]; then
echo "Deleted chain -L BAZ ok, expected failure"
$XT_MULTI ebtables -t filter -L
exit 1
fi
$XT_MULTI ebtables -t filter -N BAR || exit 1
$XT_MULTI ebtables -t filter -N BAZ || exit 1
$XT_MULTI ebtables -t $t -F || exit 0
;;
*)
echo "skip $XT_MULTI"
;;
esac
$XT_MULTI ebtables -t filter -L | grep -q FOO || exit 1
$XT_MULTI ebtables -t filter -L | grep -q BAR || exit 1
$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1
$XT_MULTI ebtables -t filter -L BAZ || exit 1
$XT_MULTI ebtables -t filter -X BAZ || exit 1
$XT_MULTI ebtables -t filter -L BAZ | grep -q BAZ
if [ $? -eq 0 ]; then
echo "Deleted chain -L BAZ ok, expected failure"
$XT_MULTI ebtables -t filter -L
exit 1
fi
$XT_MULTI ebtables -t $t -F || exit 0
iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
View file @ 712749e7
......@@ -4,7 +4,7 @@ set -e
#set -x
# there is no legacy backend to test
[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
# fill ebtables manually
......
iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0
View file @ 712749e7
......@@ -3,7 +3,7 @@
set -e
# there is no legacy backend to test
[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
# ebtables-restore reuses preloaded targets and matches, make sure defaults
# apply to consecutive rules using the same target/match as a previous one
......
iptables/tests/shell/testcases/ebtables/0004-save-counters_0
View file @ 712749e7
......@@ -3,7 +3,7 @@
set -e
# there is no legacy backend to test
[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
$XT_MULTI ebtables --init-table
$XT_MULTI ebtables -A FORWARD -i nodev123 -o nodev432 -j ACCEPT
......
iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0
View file @ 712749e7
......@@ -3,7 +3,7 @@
set -e
# there is no legacy backend to test
[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
EXPECT='*filter
:INPUT ACCEPT
......
iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0
View file @ 712749e7
......@@ -231,7 +231,7 @@ for table in nat mangle raw filter;do
done
case "$XT_MULTI" in
*/xtables-nft-multi)
*xtables-nft-multi)
# nft-multi displays chain names in different order, work around this for now
tmpfile2=$(mktemp)
sort "$tmpfile" > "$tmpfile2"
......
iptables/tests/shell/testcases/ip6tables/0004-return-codes_0
View file @ 712749e7
......@@ -26,6 +26,7 @@ cmd 1 ip6tables -N foo
# test rule adding
cmd 0 ip6tables -A INPUT -j ACCEPT
cmd 1 ip6tables -A noexist -j ACCEPT
cmd 2 ip6tables -I INPUT -j foobar
# test rule checking
cmd 0 ip6tables -C INPUT -j ACCEPT
......
iptables/tests/shell/testcases/ipt-restore/0001load-specific-table_0
View file @ 712749e7
......@@ -22,7 +22,7 @@ do_simple()
table="${2}"
dumpfile="$(dirname "${0}")/dumps/${iptables}.dump"
"$XT_MULTI" "${iptables}-restore" --table="${table}" <"${dumpfile}"; rv=$?
"$XT_MULTI" "${iptables}-restore" --table="${table}" "${dumpfile}"; rv=$?
if [ "${rv}" -ne 0 ]; then
RET=1
......
iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0
View file @ 712749e7
......@@ -45,8 +45,7 @@ get_target()
make_dummy_rules()
{
echo "*filter"
echo "*${1:-filter}"
echo ":INPUT ACCEPT [0:0]"
echo ":FORWARD ACCEPT [0:0]"
echo ":OUTPUT ACCEPT [0:0]"
......@@ -74,7 +73,7 @@ make_dummy_rules()
tmpfile=$(mktemp) || exit 1
dumpfile=$(mktemp) || exit 1
make_dummy_rules > $dumpfile
(make_dummy_rules; make_dummy_rules security) > $dumpfile
$XT_MULTI iptables-restore -w < $dumpfile
LINES1=$(wc -l < $dumpfile)
$XT_MULTI iptables-save | grep -v '^#' > $dumpfile
......@@ -86,7 +85,7 @@ if [ $LINES1 -ne $LINES2 ]; then
fi
case "$XT_MULTI" in
*/xtables-nft-multi)
*xtables-nft-multi)
attempts=$((RANDOM%10))
attempts=$((attempts+1))
;;
......
iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 0 → 100755
View file @ 712749e7
#!/bin/sh -e
# assert input feed from buffer doesn't trip over
# added nul-chars from parsing chain line.
$XT_MULTI iptables-restore --noflush <<EOF
*filter
:foobar - [0:0]
-A foobar -j ACCEPT
COMMIT
EOF
iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 0 → 100755
View file @ 712749e7
#!/bin/bash -e
# make sure empty lines won't break --noflush
cat <<EOF | $XT_MULTI iptables-restore --noflush
# just a comment followed by innocent empty line
*filter
-A FORWARD -j ACCEPT
COMMIT
EOF
EXPECT='Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 '
diff -u <(echo "$EXPECT") <($XT_MULTI iptables -n -L FORWARD)
iptables/tests/shell/testcases/ipt-restore/0012-dash-F_0 0 → 100755
View file @ 712749e7
#!/bin/bash -e
# make sure -F lines don't cause segfaults
RULESET='*nat
-F PREROUTING
-A PREROUTING -j ACCEPT
-F PREROUTING
COMMIT'
echo -e "$RULESET" | $XT_MULTI iptables-restore
echo -e "$RULESET" | $XT_MULTI iptables-restore -n
iptables/tests/shell/testcases/ipt-restore/0013-test-mode_0 0 → 100755
View file @ 712749e7
#!/bin/bash
set -e
# segfault with --test reported in nfbz#1391
printf '%s\nCOMMIT\n' '*nat' '*raw' '*filter' | $XT_MULTI iptables-restore --test
iptables/tests/shell/testcases/iptables/0004-return-codes_0
View file @ 712749e7
......@@ -54,10 +54,16 @@ cmd 1 "$ENOENT" iptables -Z bar
# test chain rename
cmd 0 iptables -E foo bar
cmd 1 "$EEXIST_F" iptables -E foo bar
cmd 1 "$ENOENT" iptables -E foo bar2
cmd 0 iptables -N foo2
cmd 1 "$EEXIST_F" iptables -E foo2 bar
# test rule adding
cmd 0 iptables -A INPUT -j ACCEPT
cmd 1 "$ENOENT" iptables -A noexist -j ACCEPT
cmd 2 "" iptables -I INPUT -j foobar
cmd 2 "" iptables -R INPUT 1 -j foobar
cmd 2 "" iptables -D INPUT -j foobar
# test rulenum commands
cmd 1 "$E2BIG_I" iptables -I INPUT 23 -j ACCEPT
......
iptables/tests/shell/testcases/iptables/0006-46-args_0 0 → 100755
View file @ 712749e7
#!/bin/bash
RC=0
$XT_MULTI iptables -6 -A FORWARD -j ACCEPT
rc=$?
if [[ $rc -ne 2 ]]; then
echo "'iptables -6' returned $rc instead of 2"
RC=1
fi
$XT_MULTI ip6tables -4 -A FORWARD -j ACCEPT
rc=$?
if [[ $rc -ne 2 ]]; then
echo "'ip6tables -4' returned $rc instead of 2"
RC=1
fi
RULESET='*filter
-4 -A FORWARD -d 10.0.0.1 -j ACCEPT
-6 -A FORWARD -d fec0:10::1 -j ACCEPT
COMMIT
'
EXPECT4='-P FORWARD ACCEPT
-A FORWARD -d 10.0.0.1/32 -j ACCEPT'
EXPECT6='-P FORWARD ACCEPT
-A FORWARD -d fec0:10::1/128 -j ACCEPT'
EXPECT_EMPTY='-P FORWARD ACCEPT'
echo "$RULESET" | $XT_MULTI iptables-restore || {
echo "iptables-restore failed!"
RC=1
}
diff -u -Z <(echo -e "$EXPECT4") <($XT_MULTI iptables -S FORWARD) || {
echo "unexpected iptables ruleset"
RC=1
}
diff -u -Z <(echo -e "$EXPECT_EMPTY") <($XT_MULTI ip6tables -S FORWARD) || {
echo "unexpected non-empty ip6tables ruleset"
RC=1
}
$XT_MULTI iptables -F FORWARD
echo "$RULESET" | $XT_MULTI ip6tables-restore || {
echo "ip6tables-restore failed!"
RC=1
}
diff -u -Z <(echo -e "$EXPECT6") <($XT_MULTI ip6tables -S FORWARD) || {
echo "unexpected ip6tables ruleset"
RC=1
}
diff -u -Z <(echo -e "$EXPECT_EMPTY") <($XT_MULTI iptables -S FORWARD) || {
echo "unexpected non-empty iptables ruleset"
RC=1
}
$XT_MULTI ip6tables -F FORWARD
$XT_MULTI iptables -4 -A FORWARD -d 10.0.0.1 -j ACCEPT || {
echo "iptables failed!"
RC=1
}
diff -u -Z <(echo -e "$EXPECT4") <($XT_MULTI iptables -S FORWARD) || {
echo "unexpected iptables ruleset"
RC=1
}
diff -u -Z <(echo -e "$EXPECT_EMPTY") <($XT_MULTI ip6tables -S FORWARD) || {
echo "unexpected non-empty ip6tables ruleset"
RC=1
}
$XT_MULTI iptables -F FORWARD
$XT_MULTI ip6tables -6 -A FORWARD -d fec0:10::1 -j ACCEPT || {
echo "ip6tables failed!"
RC=1
}
diff -u -Z <(echo -e "$EXPECT6") <($XT_MULTI ip6tables -S FORWARD) || {
echo "unexpected ip6tables ruleset"
RC=1
}
diff -u -Z <(echo -e "$EXPECT_EMPTY") <($XT_MULTI iptables -S FORWARD) || {
echo "unexpected non-empty iptables ruleset"
RC=1
}
exit $RC
iptables/tests/shell/testcases/nft-only/0001compat_0
View file @ 712749e7
......@@ -5,17 +5,18 @@
# xtables: avoid bogus 'is incompatible' warning
case "$XT_MULTI" in
*/xtables-nft-multi)
nft -v >/dev/null || exit 0
nft 'add table ip nft-test; add chain ip nft-test foobar { type filter hook forward priority 42; }' || exit 1
nft 'add table ip6 nft-test; add chain ip6 nft-test foobar { type filter hook forward priority 42; }' || exit 1
$XT_MULTI iptables -L -t filter || exit 1
$XT_MULTI ip6tables -L -t filter || exit 1
*xtables-nft-multi)
;;
*)
echo skip $XT_MULTI
exit 0
;;
esac
nft -v >/dev/null || exit 0
nft 'add table ip nft-test; add chain ip nft-test foobar { type filter hook forward priority 42; }' || exit 1
nft 'add table ip6 nft-test; add chain ip6 nft-test foobar { type filter hook forward priority 42; }' || exit 1
$XT_MULTI iptables -L -t filter || exit 1
$XT_MULTI ip6tables -L -t filter || exit 1
exit 0
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment