Skip to contentSkip to conversation

test: add testbench for XML

PATCH Superseded Arturo Borrero Gonzalez 2 participants 4 messages Jun 18, 2013 – Jun 22, 2013

Subsystems (2)
Kbuild netfilter

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore

Arturo Borrero Gonzalez

author
#0 lore raw

PATCH 1/1 test: add testbench for XML

This patch add a testbench for XML parsing, which may be extended to also test JSON.

To use it:

 $ cd test/
 $ make nft-parsing-test
 $ ./nft-parsing-test xmlfiles/
Signed-off-by Arturo Borrero Gonzalez <[email protected]>
---
 test/Makefile.am                 |    6 ++
 test/nft-parsing-test.c          |  125 ++++++++++++++++++++++++++++++++++++++
 test/xmlfiles/chain1.xml         |   11 +++
 test/xmlfiles/chain2.xml         |   11 +++
 test/xmlfiles/chain3.xml         |   11 +++
 test/xmlfiles/rule_bitwise.xml   |   25 ++++++++
 test/xmlfiles/rule_byteorder.xml |   13 ++++
 test/xmlfiles/rule_cmp.xml       |   16 +++++
 test/xmlfiles/rule_counter.xml   |   10 +++
 test/xmlfiles/rule_ct.xml        |   11 +++
 test/xmlfiles/rule_exthdr.xml    |   12 ++++
 test/xmlfiles/rule_immediate.xml |   31 +++++++++
 test/xmlfiles/rule_limit.xml     |   10 +++
 test/xmlfiles/rule_log.xml       |   12 ++++
 test/xmlfiles/rule_lookup.xml    |   11 +++
 test/xmlfiles/rule_match.xml     |   10 +++
 test/xmlfiles/rule_meta.xml      |   10 +++
 test/xmlfiles/rule_nat.xml       |   22 +++++++
 test/xmlfiles/rule_payload.xml   |   12 ++++
 test/xmlfiles/rule_target.xml    |   10 +++
 test/xmlfiles/table1.xml         |    6 ++
 test/xmlfiles/table2.xml         |    6 ++
 22 files changed, 391 insertions(+)
 create mode 100644 test/Makefile.am
 create mode 100644 test/nft-parsing-test.c
 create mode 100644 test/xmlfiles/chain1.xml
 create mode 100644 test/xmlfiles/chain2.xml
 create mode 100644 test/xmlfiles/chain3.xml
 create mode 100644 test/xmlfiles/rule_bitwise.xml
 create mode 100644 test/xmlfiles/rule_byteorder.xml
 create mode 100644 test/xmlfiles/rule_cmp.xml
 create mode 100644 test/xmlfiles/rule_counter.xml
 create mode 100644 test/xmlfiles/rule_ct.xml
 create mode 100644 test/xmlfiles/rule_exthdr.xml
 create mode 100644 test/xmlfiles/rule_immediate.xml
 create mode 100644 test/xmlfiles/rule_limit.xml
 create mode 100644 test/xmlfiles/rule_log.xml
 create mode 100644 test/xmlfiles/rule_lookup.xml
 create mode 100644 test/xmlfiles/rule_match.xml
 create mode 100644 test/xmlfiles/rule_meta.xml
 create mode 100644 test/xmlfiles/rule_nat.xml
 create mode 100644 test/xmlfiles/rule_payload.xml
 create mode 100644 test/xmlfiles/rule_target.xml
 create mode 100644 test/xmlfiles/table1.xml
 create mode 100644 test/xmlfiles/table2.xml
Makefile.am +2 -2
index 6999f51..e035ea1 100644
@@ -2,8 +2,8 @@ include $(top_srcdir)/Make_global.am
 
 ACLOCAL_AMFLAGS = -I m4
 
-SUBDIRS = src include examples
-DIST_SUBDIRS = src include examples
+SUBDIRS = src include examples test
+DIST_SUBDIRS = src include examples test
 
 pkgconfigdir = $(libdir)/pkgconfig
 pkgconfig_DATA = libnftables.pc
configure.ac +1 -1
index 0eec5bd..eaf3bb8 100644
@@ -38,5 +38,5 @@ regular_CFLAGS="-Wall -Waggregate-return -Wmissing-declarations \
 	-Wformat=2 -pipe"
 AC_SUBST([regular_CPPFLAGS])
 AC_SUBST([regular_CFLAGS])
-AC_CONFIG_FILES([Makefile src/Makefile include/Makefile include/libnftables/Makefile include/linux/Makefile include/linux/netfilter/Makefile examples/Makefile libnftables.pc doxygen.cfg])
+AC_CONFIG_FILES([Makefile src/Makefile include/Makefile include/libnftables/Makefile include/linux/Makefile include/linux/netfilter/Makefile examples/Makefile test/Makefile libnftables.pc doxygen.cfg])
 AC_OUTPUT
examples/chain.xml deleted +0 -11
deleted file mode 100644
index 01ccb85..0000000
@@ -1,11 +0,0 @@
-<chain name="test" handle="0" bytes="59" packets="1" version="0">
-	<properties>
-		<type>filter</type>
-		<table>filter</table>
-		<prio>1</prio>
-		<use>0</use>
-		<hooknum>4</hooknum>
-		<policy>1</policy>
-		<family>10</family>
-	</properties>
-</chain>
examples/rule.xml deleted +0 -85

85 lines not on this page · raw message

examples/table.xml deleted +0 -6
deleted file mode 100644
index a397d52..0000000
@@ -1,6 +0,0 @@
-<table name="filter" version="0">
-	<properties>
-		<family>2</family>
-		<table_flags>0</table_flags>
-	</properties>
-</table>
test/Makefile.am new file +6 -0
new file mode 100644
index 0000000..6941c3c
@@ -0,0 +1,6 @@
+include $(top_srcdir)/Make_global.am
+
+check_PROGRAMS = nft-parsing-test
+
+nft_parsing_test_SOURCES = nft-parsing-test.c
+nft_parsing_test_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} ${LIBXML_LIBS}
test/nft-parsing-test.c new file +125 -0

125 lines not on this page · raw message

test/xmlfiles/chain1.xml new file +11 -0
new file mode 100644
index 0000000..7b23904
@@ -0,0 +1,11 @@
+<chain name="test" handle="0" bytes="0" packets="0" version="0">
+	<properties>
+		<type>filter</type>
+		<table>filter</table>
+		<prio>0</prio>
+		<use>0</use>
+		<hooknum>0</hooknum>
+		<policy>0</policy>
+		<family>2</family>
+	</properties>
+</chain>
test/xmlfiles/chain2.xml new file +11 -0
new file mode 100644
index 0000000..01ccb85
@@ -0,0 +1,11 @@
+<chain name="test" handle="0" bytes="59" packets="1" version="0">
+	<properties>
+		<type>filter</type>
+		<table>filter</table>
+		<prio>1</prio>
+		<use>0</use>
+		<hooknum>4</hooknum>
+		<policy>1</policy>
+		<family>10</family>
+	</properties>
+</chain>
test/xmlfiles/chain3.xml new file +11 -0
new file mode 100644
index 0000000..31e7142
@@ -0,0 +1,11 @@
+<chain name="foo" handle="100" bytes="59264154979" packets="2548796325" version="0">
+	<properties>
+		<type>foo</type>
+		<table>nat</table>
+		<prio>123</prio>
+		<use>321</use>
+		<hooknum>123</hooknum>
+		<policy>123</policy>
+		<family>123</family>
+	</properties>
+</chain>
test/xmlfiles/rule_bitwise.xml new file +25 -0
new file mode 100644
index 0000000..0501c6c
@@ -0,0 +1,25 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="bitwise">
+    <sreg>1</sreg>
+    <dreg>12</dreg>
+    <mask>
+      <data_reg type="value">
+        <len>1</len>
+        <data0>0x04000000</data0>
+      </data_reg>
+    </mask>
+    <xor>
+      <data_reg type="value">
+        <len>4</len>
+        <data0>0xfaceb00c</data0>
+        <data1>0xc1cac1ca</data1>
+        <data2>0xcafecafe</data2>
+        <data3>0xdeadbeef</data3>
+      </data_reg>
+    </xor>
+  </expr>
+</rule>
test/xmlfiles/rule_byteorder.xml new file +13 -0
new file mode 100644
index 0000000..3b5d64d
@@ -0,0 +1,13 @@
+<rule family="1" table="test" chain="test" handle="1000" version="0">
+  <rule_flags>123</rule_flags>
+  <flags>123</flags>
+  <compat_flags>123</compat_flags>
+  <compat_proto>123</compat_proto>
+  <expr type="byteorder">
+	<sreg>123</sreg>
+	<dreg>321</dreg>
+	<op>111</op>
+	<len>15</len>
+	<size>15</size>
+  </expr>
+</rule>
test/xmlfiles/rule_cmp.xml new file +16 -0
new file mode 100644
index 0000000..582b127
@@ -0,0 +1,16 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="cmp">
+    <sreg>1</sreg>
+    <op>eq</op>
+    <cmpdata>
+      <data_reg type="value">
+        <len>1</len>
+        <data0>0x04000000</data0>
+      </data_reg>
+    </cmpdata>
+  </expr>
+</rule>
test/xmlfiles/rule_counter.xml new file +10 -0
new file mode 100644
index 0000000..bb71013
@@ -0,0 +1,10 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="counter">
+    <pkts>123123</pkts>
+    <bytes>321321</bytes>
+  </expr>
+</rule>
test/xmlfiles/rule_ct.xml new file +11 -0
new file mode 100644
index 0000000..c993ae5
@@ -0,0 +1,11 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="ct">
+    <dreg>1555555</dreg>
+    <dir>15</dir>
+    <key>15</key>
+  </expr>
+</rule>
test/xmlfiles/rule_exthdr.xml new file +12 -0
new file mode 100644
index 0000000..0abeb3c
@@ -0,0 +1,12 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="exthdr">
+    <dreg>123</dreg>
+    <type>15</type>
+    <offset>123</offset>
+    <len>321</len>
+  </expr>
+</rule>
test/xmlfiles/rule_immediate.xml new file +31 -0
new file mode 100644
index 0000000..a566ca5
@@ -0,0 +1,31 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="immediate">
+    <dreg>1</dreg>
+    <immdata>
+      <data_reg type="value">
+        <len>1</len>
+	<data0>0xaabbccdd</data0>
+      </data_reg>
+    </immdata>
+  </expr>
+  <expr type="immediate">
+    <dreg>2</dreg>
+    <immdata>
+      <data_reg type="verdict">
+        <verdict>1</verdict>
+      </data_reg>
+    </immdata>
+  </expr>
+  <expr type="immediate">
+    <dreg>3</dreg>
+    <immdata>
+      <data_reg type="chain">
+        <chain>testchain</chain>
+      </data_reg>
+    </immdata>
+  </expr>
+</rule>
test/xmlfiles/rule_limit.xml new file +10 -0
new file mode 100644
index 0000000..926aa0e
@@ -0,0 +1,10 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="limit">
+    <rate>123123</rate>
+    <depth>321321</depth>
+  </expr>
+</rule>
test/xmlfiles/rule_log.xml new file +12 -0
new file mode 100644
index 0000000..5471fee
@@ -0,0 +1,12 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="log">
+    <group>123123121</group>
+    <snaplen>4000000</snaplen>
+    <qthreshold>1222222</qthreshold>
+    <prefix>prefixtest</prefix>
+  </expr>
+</rule>
test/xmlfiles/rule_lookup.xml new file +11 -0
new file mode 100644
index 0000000..ee47068
@@ -0,0 +1,11 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="lookup">
+    <sreg>123</sreg>
+    <dreg>123</dreg>
+    <set>set_name_test</set>
+  </expr>
+</rule>
test/xmlfiles/rule_match.xml new file +10 -0
new file mode 100644
index 0000000..fdc28f5
@@ -0,0 +1,10 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="match">
+    <name>state</name>
+    <rev>0</rev>
+  </expr>
+</rule>
test/xmlfiles/rule_meta.xml new file +10 -0
new file mode 100644
index 0000000..3c14bad
@@ -0,0 +1,10 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="meta">
+    <dreg>1</dreg>
+    <key>4</key>
+  </expr>
+</rule>
test/xmlfiles/rule_nat.xml new file +22 -0
new file mode 100644
index 0000000..868be50
@@ -0,0 +1,22 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="nat">
+    <sreg_addr_min>1</sreg_addr_min>
+    <sreg_addr_max>1</sreg_addr_max>
+    <sreg_proto_min>1</sreg_proto_min>
+    <sreg_proto_max>1</sreg_proto_max>
+    <family>AF_INET6</family>
+    <type>NFT_NAT_DNAT</type>
+  </expr>
+  <expr type="nat">
+    <sreg_addr_min>1</sreg_addr_min>
+    <sreg_addr_max>1</sreg_addr_max>
+    <sreg_proto_min>1</sreg_proto_min>
+    <sreg_proto_max>1</sreg_proto_max>
+    <family>AF_INET</family>
+    <type>NFT_NAT_SNAT</type>
+  </expr>
+</rule>
test/xmlfiles/rule_payload.xml new file +12 -0
new file mode 100644
index 0000000..bbbc84f
@@ -0,0 +1,12 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="payload">
+    <dreg>1</dreg>
+    <base>1</base>
+    <offset>12</offset>
+    <len>4</len>
+  </expr>
+</rule>
test/xmlfiles/rule_target.xml new file +10 -0
new file mode 100644
index 0000000..a41d794
@@ -0,0 +1,10 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="target">
+    <name>LOG</name>
+    <rev>0</rev>
+  </expr>
+</rule>
test/xmlfiles/table1.xml new file +6 -0
new file mode 100644
index 0000000..a397d52
@@ -0,0 +1,6 @@
+<table name="filter" version="0">
+	<properties>
+		<family>2</family>
+		<table_flags>0</table_flags>
+	</properties>
+</table>
test/xmlfiles/table2.xml new file +6 -0
new file mode 100644
index 0000000..de8e570
@@ -0,0 +1,6 @@
+<table name="nat" version="0">
+	<properties>
+		<family>10</family>
+		<table_flags>123</table_flags>
+	</properties>
+</table>
maintainer
#1 lore raw

Hi Arturo,

Some comments below, mostly related to the XML output not the list of test case itself.

Quoted 60 lines · Arturo Borrero Gonzalez

This patch add a testbench for XML parsing, which may be extended to also test JSON.

To use it:

 $ cd test/
 $ make nft-parsing-test
 $ ./nft-parsing-test xmlfiles/
Signed-off-by Arturo Borrero Gonzalez <[email protected]>
---
 test/Makefile.am                 |    6 ++
 test/nft-parsing-test.c          |  125 ++++++++++++++++++++++++++++++++++++++
 test/xmlfiles/chain1.xml         |   11 +++
 test/xmlfiles/chain2.xml         |   11 +++
 test/xmlfiles/chain3.xml         |   11 +++
 test/xmlfiles/rule_bitwise.xml   |   25 ++++++++
 test/xmlfiles/rule_byteorder.xml |   13 ++++
 test/xmlfiles/rule_cmp.xml       |   16 +++++
 test/xmlfiles/rule_counter.xml   |   10 +++
 test/xmlfiles/rule_ct.xml        |   11 +++
 test/xmlfiles/rule_exthdr.xml    |   12 ++++
 test/xmlfiles/rule_immediate.xml |   31 +++++++++
 test/xmlfiles/rule_limit.xml     |   10 +++
 test/xmlfiles/rule_log.xml       |   12 ++++
 test/xmlfiles/rule_lookup.xml    |   11 +++
 test/xmlfiles/rule_match.xml     |   10 +++
 test/xmlfiles/rule_meta.xml      |   10 +++
 test/xmlfiles/rule_nat.xml       |   22 +++++++
 test/xmlfiles/rule_payload.xml   |   12 ++++
 test/xmlfiles/rule_target.xml    |   10 +++
 test/xmlfiles/table1.xml         |    6 ++
 test/xmlfiles/table2.xml         |    6 ++
 22 files changed, 391 insertions(+)
 create mode 100644 test/Makefile.am
 create mode 100644 test/nft-parsing-test.c
 create mode 100644 test/xmlfiles/chain1.xml
 create mode 100644 test/xmlfiles/chain2.xml
 create mode 100644 test/xmlfiles/chain3.xml
 create mode 100644 test/xmlfiles/rule_bitwise.xml
 create mode 100644 test/xmlfiles/rule_byteorder.xml
 create mode 100644 test/xmlfiles/rule_cmp.xml
 create mode 100644 test/xmlfiles/rule_counter.xml
 create mode 100644 test/xmlfiles/rule_ct.xml
 create mode 100644 test/xmlfiles/rule_exthdr.xml
 create mode 100644 test/xmlfiles/rule_immediate.xml
 create mode 100644 test/xmlfiles/rule_limit.xml
 create mode 100644 test/xmlfiles/rule_log.xml
 create mode 100644 test/xmlfiles/rule_lookup.xml
 create mode 100644 test/xmlfiles/rule_match.xml
 create mode 100644 test/xmlfiles/rule_meta.xml
 create mode 100644 test/xmlfiles/rule_nat.xml
 create mode 100644 test/xmlfiles/rule_payload.xml
 create mode 100644 test/xmlfiles/rule_target.xml
 create mode 100644 test/xmlfiles/table1.xml
 create mode 100644 test/xmlfiles/table2.xml
Makefile.am +0 -0
index 6999f51..e035ea1 100644

Makefile.am include $(top_srcdir)/Make_global.am · line 6

Quoted 7 lines
Makefile.am +2 -2
@@ -2,8 +2,8 @@ include $(top_srcdir)/Make_global.am
 
 ACLOCAL_AMFLAGS = -I m4
 
-SUBDIRS = src include examples
-DIST_SUBDIRS = src include examples
+SUBDIRS = src include examples test
+DIST_SUBDIRS = src include examples test

Please, don't include the test directory in DIST_SUBDIRS. I prefer not to distribute the tests in the tarball.

Quoted 19 lines
Makefile.am +0 -0
 pkgconfigdir = $(libdir)/pkgconfig
 pkgconfig_DATA = libnftables.pc
configure.ac +1 -1
index 0eec5bd..eaf3bb8 100644
@@ -38,5 +38,5 @@ regular_CFLAGS="-Wall -Waggregate-return -Wmissing-declarations \
 	-Wformat=2 -pipe"
 AC_SUBST([regular_CPPFLAGS])
 AC_SUBST([regular_CFLAGS])
-AC_CONFIG_FILES([Makefile src/Makefile include/Makefile include/libnftables/Makefile include/linux/Makefile include/linux/netfilter/Makefile examples/Makefile libnftables.pc doxygen.cfg])
+AC_CONFIG_FILES([Makefile src/Makefile include/Makefile include/libnftables/Makefile include/linux/Makefile include/linux/netfilter/Makefile examples/Makefile test/Makefile libnftables.pc doxygen.cfg])
 AC_OUTPUT
examples/chain.xml deleted +0 -0
deleted file mode 100644
index 01ccb85..0000000

examples/chain.xml line 7

Quoted 7 lines
examples/chain.xml deleted +0 -7
@@ -1,11 +0,0 @@
-<chain name="test" handle="0" bytes="59" packets="1" version="0">
-	<properties>
-		<type>filter</type>
-		<table>filter</table>
-		<prio>1</prio>
-		<use>0</use>
-		<hooknum>4</hooknum>

We should convert hooknum to make it human readable. You can use this array to achieve it:

static const char *hooknum2str_array[NF_INET_NUMHOOKS] = {
        [NF_INET_PRE_ROUTING] = "NF_INET_PRE_ROUTING",
        [NF_INET_LOCAL_IN] = "NF_INET_LOCAL_IN",
        [NF_INET_FORWARD] = "NF_INET_FORWARD",
        [NF_INET_LOCAL_OUT] = "NF_INET_LOCAL_OUT",
        [NF_INET_POST_ROUTING] = "NF_INET_POST_ROUTING",
};

examples/chain.xml line 8

Quoted 1 line
examples/chain.xml deleted +0 -1
-		<policy>1</policy>

Same thing here, this should be converted to NF_ACCEPT = "accept" and NF_DROP = "drop". You will have to change the parser as well, yes.

examples/chain.xml line 9

Quoted 1 line
examples/chain.xml deleted +0 -1
-		<family>10</family>

Convert to AF_INET = ip, AF_INET6 = ip6, AF_BRIDGE = bridge and 0 = arp.

examples/rule.xml line 4

Quoted 12 lines
examples/chain.xml deleted +0 -2
-	</properties>
-</chain>
examples/rule.xml deleted +0 -4
deleted file mode 100644
index b1de25a..0000000
@@ -1,85 +0,0 @@
-<?xml version="1.0"?>
-<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
-  <rule_flags>0</rule_flags>
-  <flags>127</flags>

Hm, I decided to get rid of these internal flags already right? They are not exported anymore.

examples/rule.xml line 6

Quoted 2 lines
examples/rule.xml deleted +0 -2
-  <compat_flags>0</compat_flags>
-  <compat_proto>0</compat_proto>

Please, only print these two if:

compat_flags != 0 || compat_proto != 0

Quoted 201 lines
examples/rule.xml deleted +0 -79
-  <expr type="meta">
-    <dreg>1</dreg>
-    <key>4</key>
-  </expr>
-  <expr type="cmp">
-    <sreg>1</sreg>
-    <op>eq</op>
-    <cmpdata>
-      <data_reg type="value">
-        <len>1</len>
-        <data0>0x04000000</data0>
-      </data_reg>
-    </cmpdata>
-  </expr>
-  <expr type="payload">
-    <dreg>1</dreg>
-    <base>1</base>
-    <offset>12</offset>
-    <len>4</len>
-  </expr>
-  <expr type="cmp">
-    <sreg>1</sreg>
-    <op>eq</op>
-    <cmpdata>
-      <data_reg type="value">
-        <len>1</len>
-        <data0>0x96d60496</data0>
-      </data_reg>
-    </cmpdata>
-  </expr>
-  <expr type="payload">
-    <dreg>1</dreg>
-    <base>1</base>
-    <offset>16</offset>
-    <len>4</len>
-  </expr>
-  <expr type="cmp">
-    <sreg>1</sreg>
-    <op>eq</op>
-    <cmpdata>
-      <data_reg type="value">
-        <len>1</len>
-        <data0>0x96d60329</data0>
-      </data_reg>
-    </cmpdata>
-  </expr>
-  <expr type="payload">
-    <dreg>1</dreg>
-    <base>1</base>
-    <offset>9</offset>
-    <len>1</len>
-  </expr>
-  <expr type="cmp">
-    <sreg>1</sreg>
-    <op>eq</op>
-    <cmpdata>
-      <data_reg type="value">
-        <len>1</len>
-        <data0>0x06000000</data0>
-      </data_reg>
-    </cmpdata>
-  </expr>
-  <expr type="match">
-    <name>state</name>
-    <rev>0</rev>
-   <info>
-    </info>
-  </expr>
-  <expr type="counter">
-    <pkts>123123</pkts>
-    <bytes>321321</bytes>
-  </expr>
-  <expr type="target">
-    <name>LOG</name>
-    <rev>0</rev>
-    <info>
-    </info>
-  </expr>
-</rule>
examples/table.xml deleted +0 -6
deleted file mode 100644
index a397d52..0000000
@@ -1,6 +0,0 @@
-<table name="filter" version="0">
-	<properties>
-		<family>2</family>
-		<table_flags>0</table_flags>
-	</properties>
-</table>
test/Makefile.am new file +6 -0
new file mode 100644
index 0000000..6941c3c
@@ -0,0 +1,6 @@
+include $(top_srcdir)/Make_global.am
+
+check_PROGRAMS = nft-parsing-test
+
+nft_parsing_test_SOURCES = nft-parsing-test.c
+nft_parsing_test_LDADD = ../src/libnftables.la ${LIBMNL_LIBS} ${LIBXML_LIBS}
test/nft-parsing-test.c new file +92 -0
new file mode 100644
index 0000000..dc0ab85
@@ -0,0 +1,125 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <dirent.h>
+
+#include <mxml.h>
+
+#include <libmnl/libmnl.h> /*nlmsghdr*/
+#include <libnftables/table.h>
+#include <libnftables/chain.h>
+#include <libnftables/rule.h>
+
+static int test_xml(const char *filename)
+{
+	int ret = -1;
+	struct nft_table *t = NULL;
+	struct nft_chain *c = NULL;
+	struct nft_rule *r = NULL;
+	FILE *fp;
+	mxml_node_t *tree = NULL;;
+	char *xml = NULL;
+
+	fp = fopen(filename, "r");
+	tree = mxmlLoadFile(NULL, fp, MXML_NO_CALLBACK);
+	fclose(fp);
+
+	xml = mxmlSaveAllocString(tree, MXML_NO_CALLBACK);
+	if (xml == NULL)
+		return -1;
+
+	if (tree == NULL)
+		return -1;
+
+	/* Check what parsing should be done */
+	if (strcmp(tree->value.opaque, "table") == 0) {
+		t = nft_table_alloc();
+		if (t != NULL) {
+			if (nft_table_parse(t, NFT_TABLE_PARSE_XML, xml) == 0)
+				ret = 0;
+
+			nft_table_free(t);
+		}
+	} else if (strcmp(tree->value.opaque, "chain") == 0) {
+		c = nft_chain_alloc();
+		if (c != NULL) {
+			if (nft_chain_parse(c, NFT_CHAIN_PARSE_XML, xml) == 0)
+				ret = 0;
+
+			nft_chain_free(c);
+		}
+	} else if (strcmp(tree->value.opaque, "rule") == 0) {
+		r = nft_rule_alloc();
+		if (r != NULL) {
+			if (nft_rule_parse(r, NFT_RULE_PARSE_XML, xml) == 0)
+				ret = 0;
+
+			nft_rule_free(r);
+		}
+	}
+
+	return ret;
+}
+
+static int test_json(const char *filename)
+{
+	/* XXX parse file JSON file, in case of failure return -1 */
+	return -1;
+}
+
+int main(int argc, char *argv[])
+{
+	DIR *d;
+	struct dirent *dent;
+
+	if (argc != 2) {
+		fprintf(stderr, "Usage: %s <directory>\n", argv[0]);
+		exit(EXIT_FAILURE);
+	}
+
+	d = opendir(argv[1]);
+	if (d == NULL) {
+		perror("opendir");
+		exit(EXIT_FAILURE);
+	}
+
+	char *path = malloc(sizeof(argv[1]));
+	char *filewpath = malloc(sizeof(path)+4096);
+	strcpy(path, argv[1]);
+
+	if (path[strlen(path)-1] != '/')
+		strcat(path, "/");
+

test/nft-parsing-test.c line 102

Quoted 10 lines
test/nft-parsing-test.c new file +10 -0
+
+	while ((dent = readdir(d)) != NULL) {
+		int len = strlen(dent->d_name);
+
+		if (strcmp(dent->d_name, ".") == 0 ||
+		    strcmp(dent->d_name, "..") == 0)
+			continue;
+
+		strcpy(filewpath, path);
+		strcat(filewpath, dent->d_name);

Better use snprintf, strcat is sloppy.

        char path[PATH_MAX];

        snprintf(path, sizeof(path), "%s/%s", argv[1], dent->d_name);

Pass it to test_xml(file)

Quoted 62 lines
test/nft-parsing-test.c new file +22 -0
+		if (strcmp(&dent->d_name[len-5], ".json") == 0) {
+			printf("parsing json file %s ..\t", filewpath);
+			if (test_json(filewpath) < 0)
+				printf("FAILED\n");
+			else
+				printf("OK\n");
+		}
+
+		if (strcmp(&dent->d_name[len-4], ".xml") == 0) {
+			printf("parsing xml file %s ..\t", filewpath);
+			if (test_xml(filewpath) < 0)
+				printf("FAILED\n");
+			else
+				printf("OK\n");
+		}
+	}
+
+	free(path);
+	free(filewpath);
+	closedir(d);
+	return 0;
+}
test/xmlfiles/chain1.xml new file +11 -0
new file mode 100644
index 0000000..7b23904
@@ -0,0 +1,11 @@
+<chain name="test" handle="0" bytes="0" packets="0" version="0">
+	<properties>
+		<type>filter</type>
+		<table>filter</table>
+		<prio>0</prio>
+		<use>0</use>
+		<hooknum>0</hooknum>
+		<policy>0</policy>
+		<family>2</family>
+	</properties>
+</chain>
test/xmlfiles/chain2.xml new file +11 -0
new file mode 100644
index 0000000..01ccb85
@@ -0,0 +1,11 @@
+<chain name="test" handle="0" bytes="59" packets="1" version="0">
+	<properties>
+		<type>filter</type>
+		<table>filter</table>
+		<prio>1</prio>
+		<use>0</use>
+		<hooknum>4</hooknum>
+		<policy>1</policy>
+		<family>10</family>
+	</properties>
+</chain>
test/xmlfiles/chain3.xml new file +0 -0
new file mode 100644
index 0000000..31e7142

test/xmlfiles/chain3.xml line 3

Quoted 3 lines
test/xmlfiles/chain3.xml new file +3 -0
@@ -0,0 +1,11 @@
+<chain name="foo" handle="100" bytes="59264154979" packets="2548796325" version="0">
+	<properties>
+		<type>foo</type>

Please, I prefer realistic tests:

Possible types are the following strings: filter, route, nat

test/xmlfiles/chain3.xml line 9

Quoted 6 lines
test/xmlfiles/chain3.xml new file +6 -0
+		<table>nat</table>
+		<prio>123</prio>
+		<use>321</use>
+		<hooknum>123</hooknum>
+		<policy>123</policy>
+		<family>123</family>

This policy and family are not realistic either ;-)

Quoted 8 lines
test/xmlfiles/chain3.xml new file +2 -0
+	</properties>
+</chain>
test/xmlfiles/rule_bitwise.xml new file +0 -0
new file mode 100644
index 0000000..0501c6c

test/xmlfiles/rule_bitwise.xml line 8

Quoted 8 lines
test/xmlfiles/rule_bitwise.xml new file +8 -0
@@ -0,0 +1,25 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="bitwise">
+    <sreg>1</sreg>
+    <dreg>12</dreg>

We only have NFT_REG_MAX registers.

test/xmlfiles/rule_bitwise.xml line 21

Quoted 13 lines
test/xmlfiles/rule_bitwise.xml new file +13 -0
+    <mask>
+      <data_reg type="value">
+        <len>1</len>
+        <data0>0x04000000</data0>
+      </data_reg>
+    </mask>
+    <xor>
+      <data_reg type="value">
+        <len>4</len>
+        <data0>0xfaceb00c</data0>
+        <data1>0xc1cac1ca</data1>
+        <data2>0xcafecafe</data2>
+        <data3>0xdeadbeef</data3>

The mask and xor has to use the same number of data registers.

Quoted 10 lines
test/xmlfiles/rule_bitwise.xml new file +4 -0
+      </data_reg>
+    </xor>
+  </expr>
+</rule>
test/xmlfiles/rule_byteorder.xml new file +0 -0
new file mode 100644
index 0000000..3b5d64d

test/xmlfiles/rule_byteorder.xml line 8

Quoted 8 lines
test/xmlfiles/rule_byteorder.xml new file +8 -0
@@ -0,0 +1,13 @@
+<rule family="1" table="test" chain="test" handle="1000" version="0">
+  <rule_flags>123</rule_flags>
+  <flags>123</flags>
+  <compat_flags>123</compat_flags>
+  <compat_proto>123</compat_proto>
+  <expr type="byteorder">
+	<sreg>123</sreg>
+	<dreg>321</dreg>

wrong register numbers.

test/xmlfiles/rule_byteorder.xml line 9

Quoted 1 line
test/xmlfiles/rule_byteorder.xml new file +1 -0
+	<op>111</op>

Bad operation. Possible are defined by NFT_BYTEORDER_*

test/xmlfiles/rule_byteorder.xml line 11

Quoted 2 lines
test/xmlfiles/rule_byteorder.xml new file +2 -0
+	<len>15</len>
+	<size>15</size>

also fix this.

Quoted 8 lines
test/xmlfiles/rule_byteorder.xml new file +2 -0
+  </expr>
+</rule>
test/xmlfiles/rule_cmp.xml new file +0 -0
new file mode 100644
index 0000000..582b127

test/xmlfiles/rule_cmp.xml line 8

Quoted 8 lines
test/xmlfiles/rule_cmp.xml new file +8 -0
@@ -0,0 +1,16 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="cmp">
+    <sreg>1</sreg>
+    <op>eq</op>

oh, you're using string here, good :-)

Quoted 30 lines
test/xmlfiles/rule_cmp.xml new file +8 -0
+    <cmpdata>
+      <data_reg type="value">
+        <len>1</len>
+        <data0>0x04000000</data0>
+      </data_reg>
+    </cmpdata>
+  </expr>
+</rule>
test/xmlfiles/rule_counter.xml new file +10 -0
new file mode 100644
index 0000000..bb71013
@@ -0,0 +1,10 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="counter">
+    <pkts>123123</pkts>
+    <bytes>321321</bytes>
+  </expr>
+</rule>
test/xmlfiles/rule_ct.xml new file +0 -0
new file mode 100644
index 0000000..c993ae5

test/xmlfiles/rule_ct.xml line 7

Quoted 7 lines
test/xmlfiles/rule_ct.xml new file +7 -0
@@ -0,0 +1,11 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="ct">
+    <dreg>1555555</dreg>

no possible.

test/xmlfiles/rule_ct.xml line 8

Quoted 1 line
test/xmlfiles/rule_ct.xml new file +1 -0
+    <dir>15</dir>

IIRC, two possible strings: 0 = original, 1 = reply

test/xmlfiles/rule_ct.xml line 9

Quoted 1 line
test/xmlfiles/rule_ct.xml new file +1 -0
+    <key>15</key>

keys are defined in nft_ct_keys.

Quoted 8 lines
test/xmlfiles/rule_ct.xml new file +2 -0
+  </expr>
+</rule>
test/xmlfiles/rule_exthdr.xml new file +0 -0
new file mode 100644
index 0000000..0abeb3c

test/xmlfiles/rule_exthdr.xml line 7

Quoted 7 lines
test/xmlfiles/rule_exthdr.xml new file +7 -0
@@ -0,0 +1,12 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="exthdr">
+    <dreg>123</dreg>

fix.

test/xmlfiles/rule_exthdr.xml line 8

Quoted 1 line
test/xmlfiles/rule_exthdr.xml new file +1 -0
+    <type>15</type>

Possibilities are defined by: nft_exthdr_attributes

test/xmlfiles/rule_exthdr.xml line 10

Quoted 2 lines
test/xmlfiles/rule_exthdr.xml new file +2 -0
+    <offset>123</offset>
+    <len>321</len>

Oh, we cannot get more than 2^8.

It's good if you start looking at: net/netfilter/nft_exthdr.c

Quoted 9 lines
test/xmlfiles/rule_exthdr.xml new file +2 -0
+  </expr>
+</rule>
test/xmlfiles/rule_immediate.xml new file +1 -0
new file mode 100644
index 0000000..a566ca5
@@ -0,0 +1,31 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">

test/xmlfiles/rule_immediate.xml line 11

Quoted 10 lines
test/xmlfiles/rule_immediate.xml new file +10 -0
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="immediate">
+    <dreg>1</dreg>
+    <immdata>
+      <data_reg type="value">
+        <len>1</len>
+	<data0>0xaabbccdd</data0>

Lenghs says 1 byte, but I can see way more stuff there.

A good way to generate realistic test cases is to add rules with nft and then use libnftables examples/ to obtain the output in XML. So you don't need to make it up.

Quoted 42 lines
test/xmlfiles/rule_immediate.xml new file +20 -0
+      </data_reg>
+    </immdata>
+  </expr>
+  <expr type="immediate">
+    <dreg>2</dreg>
+    <immdata>
+      <data_reg type="verdict">
+        <verdict>1</verdict>
+      </data_reg>
+    </immdata>
+  </expr>
+  <expr type="immediate">
+    <dreg>3</dreg>
+    <immdata>
+      <data_reg type="chain">
+        <chain>testchain</chain>
+      </data_reg>
+    </immdata>
+  </expr>
+</rule>
test/xmlfiles/rule_limit.xml new file +10 -0
new file mode 100644
index 0000000..926aa0e
@@ -0,0 +1,10 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="limit">
+    <rate>123123</rate>
+    <depth>321321</depth>
+  </expr>
+</rule>
test/xmlfiles/rule_log.xml new file +0 -0
new file mode 100644
index 0000000..5471fee

test/xmlfiles/rule_log.xml line 7

Quoted 7 lines
test/xmlfiles/rule_log.xml new file +7 -0
@@ -0,0 +1,12 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="log">
+    <group>123123121</group>

possible groups are 0-65535.

Quoted 11 lines
test/xmlfiles/rule_log.xml new file +5 -0
+    <snaplen>4000000</snaplen>
+    <qthreshold>1222222</qthreshold>
+    <prefix>prefixtest</prefix>
+  </expr>
+</rule>
test/xmlfiles/rule_lookup.xml new file +0 -0
new file mode 100644
index 0000000..ee47068

test/xmlfiles/rule_lookup.xml line 8

Quoted 8 lines
test/xmlfiles/rule_lookup.xml new file +8 -0
@@ -0,0 +1,11 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="lookup">
+    <sreg>123</sreg>
+    <dreg>123</dreg>

bad registers.

Quoted 9 lines
test/xmlfiles/rule_lookup.xml new file +3 -0
+    <set>set_name_test</set>
+  </expr>
+</rule>
test/xmlfiles/rule_match.xml new file +0 -0
new file mode 100644
index 0000000..fdc28f5

test/xmlfiles/rule_match.xml line 8

Quoted 8 lines
test/xmlfiles/rule_match.xml new file +8 -0
@@ -0,0 +1,10 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="match">
+    <name>state</name>
+    <rev>0</rev>

don't export the rev number, I don't think it's meaningful to the application.

Quoted 8 lines
test/xmlfiles/rule_match.xml new file +2 -0
+  </expr>
+</rule>
test/xmlfiles/rule_meta.xml new file +0 -0
new file mode 100644
index 0000000..3c14bad

test/xmlfiles/rule_meta.xml line 8

Quoted 8 lines
test/xmlfiles/rule_meta.xml new file +8 -0
@@ -0,0 +1,10 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="meta">
+    <dreg>1</dreg>
+    <key>4</key>

Keys for meta are defined by nft_meta_keys.

Quoted 8 lines
test/xmlfiles/rule_meta.xml new file +2 -0
+  </expr>
+</rule>
test/xmlfiles/rule_nat.xml new file +0 -0
new file mode 100644
index 0000000..868be50

test/xmlfiles/rule_nat.xml line 8

Quoted 8 lines
test/xmlfiles/rule_nat.xml new file +8 -0
@@ -0,0 +1,22 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="nat">
+    <sreg_addr_min>1</sreg_addr_min>
+    <sreg_addr_max>1</sreg_addr_max>

These above are IPv4 / IPv6 addresses. Should be printable ini human readable format, you probably use inet_ntop for output and inet_pton for input.

test/xmlfiles/rule_nat.xml line 10

Quoted 2 lines
test/xmlfiles/rule_nat.xml new file +2 -0
+    <sreg_proto_min>1</sreg_proto_min>
+    <sreg_proto_max>1</sreg_proto_max>

max here is 2^16 as they are port numbers.

test/xmlfiles/rule_nat.xml line 11

Quoted 1 line
test/xmlfiles/rule_nat.xml new file +1 -0
+    <family>AF_INET6</family>

would be good to replace this by ip6.

test/xmlfiles/rule_nat.xml line 12

Quoted 1 line
test/xmlfiles/rule_nat.xml new file +1 -0
+    <type>NFT_NAT_DNAT</type>

and this by dnat.

test/xmlfiles/rule_nat.xml line 14

Quoted 2 lines
test/xmlfiles/rule_nat.xml new file +2 -0
+  </expr>
+  <expr type="nat">

The ipv4 part is asking for a new file, add rule_nat-ipv4.xml and rule_nat-ipv6.xml

Quoted 14 lines
test/xmlfiles/rule_nat.xml new file +8 -0
+    <sreg_addr_min>1</sreg_addr_min>
+    <sreg_addr_max>1</sreg_addr_max>
+    <sreg_proto_min>1</sreg_proto_min>
+    <sreg_proto_max>1</sreg_proto_max>
+    <family>AF_INET</family>
+    <type>NFT_NAT_SNAT</type>
+  </expr>
+</rule>
test/xmlfiles/rule_payload.xml new file +0 -0
new file mode 100644
index 0000000..bbbc84f

test/xmlfiles/rule_payload.xml line 8

Quoted 8 lines
test/xmlfiles/rule_payload.xml new file +8 -0
@@ -0,0 +1,12 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="payload">
+    <dreg>1</dreg>
+    <base>1</base>

Possible bases are defined by nft_payload_bases, use strings "link", "network", "transport".

Quoted 38 lines
test/xmlfiles/rule_payload.xml new file +4 -0
+    <offset>12</offset>
+    <len>4</len>
+  </expr>
+</rule>
test/xmlfiles/rule_target.xml new file +10 -0
new file mode 100644
index 0000000..a41d794
@@ -0,0 +1,10 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="target">
+    <name>LOG</name>
+    <rev>0</rev>
+  </expr>
+</rule>
test/xmlfiles/table1.xml new file +6 -0
new file mode 100644
index 0000000..a397d52
@@ -0,0 +1,6 @@
+<table name="filter" version="0">
+	<properties>
+		<family>2</family>
+		<table_flags>0</table_flags>
+	</properties>
+</table>
test/xmlfiles/table2.xml new file +0 -0
new file mode 100644
index 0000000..de8e570

test/xmlfiles/table2.xml line 4

Quoted 4 lines
test/xmlfiles/table2.xml new file +4 -0
@@ -0,0 +1,6 @@
+<table name="nat" version="0">
+	<properties>
+		<family>10</family>
+		<table_flags>123</table_flags>

The only table flag is defined by enum nft_table_flags.

test/xmlfiles/table2.xml line 6

Quoted 3 lines
test/xmlfiles/table2.xml new file +2 -0
+	</properties>
+</table>

Please, send me patches to address those and then resend this patch once all of them has been resolved.

Thanks.

author
#2 lore raw

Hi Pablo,

I already have a patch series to address yours requests. But, please, I need some more details in the next issues:

2013/6/20 Pablo Neira Ayuso <[email protected]>:

Quoted 16 lines

test/xmlfiles/rule_exthdr.xml line 7

Quoted 13 lines
test/xmlfiles/rule_exthdr.xml new file +7 -0
new file mode 100644
index 0000000..0abeb3c
@@ -0,0 +1,12 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="exthdr">
+    <dreg>123</dreg>

fix.

Quoted 3 lines

test/xmlfiles/rule_exthdr.xml line 8

Quoted 1 line
test/xmlfiles/rule_exthdr.xml new file +1 -0
+    <type>15</type>

Possibilities are defined by: nft_exthdr_attributes

I did not understand this.
In include/uapi/linux/netfilter/nf_tables.h I have:

enum nft_exthdr_attributes {
NFTA_EXTHDR_UNSPEC,
NFTA_EXTHDR_DREG,
NFTA_EXTHDR_TYPE,
NFTA_EXTHDR_OFFSET,
NFTA_EXTHDR_LEN,
__NFTA_EXTHDR_MAX
};

What should I do with this?

Quoted 11 lines
Quoted 11 lines
test/xmlfiles/rule_immediate.xml new file +5 -0
new file mode 100644
index 0000000..a566ca5
@@ -0,0 +1,31 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
Quoted 8 lines

test/xmlfiles/rule_immediate.xml line 11

Quoted 6 lines
test/xmlfiles/rule_immediate.xml new file +6 -0
+  <expr type="immediate">
+    <dreg>1</dreg>
+    <immdata>
+      <data_reg type="value">
+        <len>1</len>
+     <data0>0xaabbccdd</data0>

Lenghs says 1 byte, but I can see way more stuff there.

mmmm,

the XML node 'len' means how many '<data>' nodes we have.

Then, the actual length of the data is somehow hard-coded in the lib and is calculated this way:
data_reg.len = xml_node_len_value * sizeof(data_reg.val[0])

Maybe is not fully implemented yet, but I already have an incoming patch to address this.

Quoted 7 lines
Quoted 7 lines
test/xmlfiles/rule_log.xml new file +1 -0
new file mode 100644
index 0000000..5471fee
@@ -0,0 +1,12 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
Quoted 8 lines

test/xmlfiles/rule_log.xml line 7

Quoted 6 lines
test/xmlfiles/rule_log.xml new file +6 -0
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="log">
+    <group>123123121</group>

possible groups are 0-65535.

Maybe I should also change the group data type to uint16_t.

Quoted 30 lines
Quoted 6 lines
test/xmlfiles/rule_nat.xml new file +0 -0
new file mode 100644
index 0000000..868be50

test/xmlfiles/rule_nat.xml line 8

Quoted 8 lines
test/xmlfiles/rule_nat.xml new file +8 -0
@@ -0,0 +1,22 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="nat">
+    <sreg_addr_min>1</sreg_addr_min>
+    <sreg_addr_max>1</sreg_addr_max>

These above are IPv4 / IPv6 addresses. Should be printable ini human readable format, you probably use inet_ntop for output and inet_pton for input.

test/xmlfiles/rule_nat.xml line 10

Quoted 2 lines
test/xmlfiles/rule_nat.xml new file +2 -0
+    <sreg_proto_min>1</sreg_proto_min>
+    <sreg_proto_max>1</sreg_proto_max>

max here is 2^16 as they are port numbers.

test/xmlfiles/rule_nat.xml line 11

Quoted 1 line
test/xmlfiles/rule_nat.xml new file +1 -0
+    <family>AF_INET6</family>

would be good to replace this by ip6.

test/xmlfiles/rule_nat.xml line 12

Quoted 1 line
test/xmlfiles/rule_nat.xml new file +1 -0
+    <type>NFT_NAT_DNAT</type>
Quoted 8 lines

and this by dnat.

test/xmlfiles/rule_nat.xml line 14

Quoted 2 lines
test/xmlfiles/rule_nat.xml new file +2 -0
+  </expr>
+  <expr type="nat">

The ipv4 part is asking for a new file, add rule_nat-ipv4.xml and rule_nat-ipv6.xml

I will do it. But I think that from the parsing point of view, is the same having two nat expr in one <rule> file.

Quoted 4 lines
Quoted 4 lines
test/xmlfiles/table2.xml new file +0 -1
new file mode 100644
index 0000000..de8e570
--- /dev/null
Quoted 9 lines

test/xmlfiles/table2.xml line 4

Quoted 6 lines

+++ b/test/xmlfiles/table2.xml

test/xmlfiles/table2.xml new file +4 -0
@@ -0,0 +1,6 @@
+<table name="nat" version="0">
+     <properties>
+             <family>10</family>
+             <table_flags>123</table_flags>

The only table flag is defined by enum nft_table_flags.

What if we have some kind of general validation functions?

- The xml_parse() will just translate the XML to an object, with no additional validations.
- The validate() will take care of values being 'real'.

Example:

int nft_table_validate(struct nft_table t)
{
/* validate family or return -1 */
/* validate table_flags or return -1*/
/* validate...maybe name length or return -1*/
}
EXPORT_SYMBOL(nft_table_validate);

I think this may be useful both for userspace programs (who used _set() and _unset() funcs) and the JSON stuff.
And it will not require so many lines of code.
At the end, from inside the xml_parse() function we can call _validate() and only consider the parsing done if the object validates.
Its a good idea? Should I work on this?

Regards.

--
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

maintainer
#3 lore raw

Hi Arturo,

Quoted 38 lines · Arturo Borrero Gonzalez

Hi Pablo,

I already have a patch series to address yours requests. But, please, I need some more details in the next issues:

2013/6/20 Pablo Neira Ayuso <[email protected]>:

Quoted 16 lines

test/xmlfiles/rule_exthdr.xml line 7

Quoted 13 lines
test/xmlfiles/rule_exthdr.xml new file +7 -0
new file mode 100644
index 0000000..0abeb3c
@@ -0,0 +1,12 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="exthdr">
+    <dreg>123</dreg>

fix.

Quoted 3 lines

test/xmlfiles/rule_exthdr.xml line 8

Quoted 1 line
test/xmlfiles/rule_exthdr.xml new file +1 -0
+    <type>15</type>

Possibilities are defined by: nft_exthdr_attributes

I did not understand this.
In include/uapi/linux/netfilter/nf_tables.h I have:

enum nft_exthdr_attributes {
NFTA_EXTHDR_UNSPEC,
NFTA_EXTHDR_DREG,
NFTA_EXTHDR_TYPE,
NFTA_EXTHDR_OFFSET,
NFTA_EXTHDR_LEN,
__NFTA_EXTHDR_MAX
};

Quoted 1 line

What should I do with this?

Bad pointer, sorry. Possible types for exthdr are defined by certain IPPROTO_*, in nft:

static const struct exthdr_desc *exthdr_protocols[IPPROTO_MAX] = {

        [IPPROTO_HOPOPTS]       = &exthdr_hbh,
        [IPPROTO_ROUTING]       = &exthdr_rt,
        [IPPROTO_FRAGMENT]      = &exthdr_frag,
        [IPPROTO_DSTOPTS]       = &exthdr_dst,
        [IPPROTO_MH]            = &exthdr_mh,

};

To simplify, you can try to generate a rule with nft that uses exthdr and dump it via libnftables, so you don't need to make up the testbench. Send a private email if you have any trouble with this.

Quoted 20 lines
Quoted 11 lines
Quoted 11 lines
test/xmlfiles/rule_immediate.xml new file +5 -0
new file mode 100644
index 0000000..a566ca5
@@ -0,0 +1,31 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
Quoted 8 lines

test/xmlfiles/rule_immediate.xml line 11

Quoted 6 lines
test/xmlfiles/rule_immediate.xml new file +6 -0
+  <expr type="immediate">
+    <dreg>1</dreg>
+    <immdata>
+      <data_reg type="value">
+        <len>1</len>
+     <data0>0xaabbccdd</data0>

Lenghs says 1 byte, but I can see way more stuff there.

Quoted 7 lines

mmmm,

the XML node 'len' means how many '<data>' nodes we have.

Then, the actual length of the data is somehow hard-coded in the lib and is calculated this way:
data_reg.len = xml_node_len_value * sizeof(data_reg.val[0])

That data_reg.len should be the number of bytes, not the number of registers in use. You have to fix that.

Quoted 19 lines

Maybe is not fully implemented yet, but I already have an incoming patch to address this.

Quoted 7 lines
Quoted 7 lines
test/xmlfiles/rule_log.xml new file +1 -0
new file mode 100644
index 0000000..5471fee
@@ -0,0 +1,12 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
Quoted 8 lines

test/xmlfiles/rule_log.xml line 7

Quoted 6 lines
test/xmlfiles/rule_log.xml new file +6 -0
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="log">
+    <group>123123121</group>

possible groups are 0-65535.

Quoted 1 line

Maybe I should also change the group data type to uint16_t.

We have to fix that in kernel code as well. I'll take care of it, just use a 2^16 value in your testbench files.

Quoted 35 lines
Quoted 35 lines
Quoted 6 lines
test/xmlfiles/rule_nat.xml new file +0 -0
new file mode 100644
index 0000000..868be50

test/xmlfiles/rule_nat.xml line 8

Quoted 8 lines
test/xmlfiles/rule_nat.xml new file +8 -0
@@ -0,0 +1,22 @@
+<rule family="2" table="filter" chain="INPUT" handle="100" version="0">
+  <rule_flags>0</rule_flags>
+  <flags>127</flags>
+  <compat_flags>0</compat_flags>
+  <compat_proto>0</compat_proto>
+  <expr type="nat">
+    <sreg_addr_min>1</sreg_addr_min>
+    <sreg_addr_max>1</sreg_addr_max>

These above are IPv4 / IPv6 addresses. Should be printable ini human readable format, you probably use inet_ntop for output and inet_pton for input.

test/xmlfiles/rule_nat.xml line 10

Quoted 2 lines
test/xmlfiles/rule_nat.xml new file +2 -0
+    <sreg_proto_min>1</sreg_proto_min>
+    <sreg_proto_max>1</sreg_proto_max>

max here is 2^16 as they are port numbers.

test/xmlfiles/rule_nat.xml line 11

Quoted 1 line
test/xmlfiles/rule_nat.xml new file +1 -0
+    <family>AF_INET6</family>

would be good to replace this by ip6.

test/xmlfiles/rule_nat.xml line 12

Quoted 1 line
test/xmlfiles/rule_nat.xml new file +1 -0
+    <type>NFT_NAT_DNAT</type>

and this by dnat.

Quoted 2 lines
test/xmlfiles/rule_nat.xml new file +2 -0
+  </expr>
+  <expr type="nat">
Quoted 6 lines
Quoted 3 lines

The ipv4 part is asking for a new file, add rule_nat-ipv4.xml and rule_nat-ipv6.xml

I will do it. But I think that from the parsing point of view, is the same having two nat expr in one <rule> file.

Yes, the parser will take it. But from the semantic point of view it does not make sense.

Quoted 30 lines
Quoted 4 lines
Quoted 4 lines
test/xmlfiles/table2.xml new file +0 -1
new file mode 100644
index 0000000..de8e570
--- /dev/null
Quoted 9 lines

test/xmlfiles/table2.xml line 4

Quoted 6 lines

+++ b/test/xmlfiles/table2.xml

test/xmlfiles/table2.xml new file +4 -0
@@ -0,0 +1,6 @@
+<table name="nat" version="0">
+     <properties>
+             <family>10</family>
+             <table_flags>123</table_flags>

The only table flag is defined by enum nft_table_flags.

What if we have some kind of general validation functions?

- The xml_parse() will just translate the XML to an object, with no additional validations.
- The validate() will take care of values being 'real'.

Example:

int nft_table_validate(struct nft_table t)
{
/* validate family or return -1 */
/* validate table_flags or return -1*/
/* validate...maybe name length or return -1*/
}
EXPORT_SYMBOL(nft_table_validate);

Quoted 7 lines

I think this may be useful both for userspace programs (who used _set() and _unset() funcs) and the JSON stuff.
And it will not require so many lines of code.
At the end, from inside the xml_parse() function we can call _validate() and only consider the parsing done if the object validates.
Its a good idea? Should I work on this?

Let's revisit this later. The kernel will just bail out if you pass some invalid configuration, that's just fine by now.

Just stick to fixing the issues I spotted and make sure we have a realistic testbench.

Thanks.