summaryrefslogtreecommitdiff
path: root/tests/conntrack
Commit message (Collapse)AuthorAgeFilesLines
* conntrack: introduce new -A commandMikhail Sennikovsky2022-07-082-1/+88
| | | | | | | | | | | | | | The -A command works exactly the same way as -I except that it does not fail if the ct entry already exists. This command is useful for the batched ct loads to not abort if some entries being applied exist. The ct entry dump in the "save" format is now switched to use the -A command as well for the generated output. Also tests added to cover the -A command. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix -o save dump for unknown protocolsMikhail Sennikovsky2022-06-271-0/+26
| | | | | | | | | | | | | | Make sure the protocol (-p) option is included in the -o save ct entry dumps for L4 protocols unknown to the conntrack tool. Do not use getprotobynumber for unknown protocols to ensure "-o save" data incompatibility between hosts having different /etc/protocols contents. Include testcases covering the issue. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix protocol number parsingMikhail Sennikovsky2022-06-271-0/+10
| | | | | | | | | | | | Before this commit it was possible to successfully create a ct entry passing -p 256 and -p some_nonsense. In both cases an entry with the protocol=0 would be created. Do not allow invalid protocol values to -p option. Include testcases covering the issue. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: set reply l4 proto for unknown protocolMikhail Sennikovsky2022-06-271-0/+27
| | | | | | | | | | | | Withouth reply l4 protocol being set consistently the mnl_cb_run (in fact the kernel) would return EINVAL. Make sure the reply l4 protocol is set properly for unknown protocols. Include testcases covering the issue. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/conntrack: script for stress-testing ct loadMikhail Sennikovsky2021-09-061-0/+163
| | | | | | | | | | The tests/conntrack/bulk-load-stress.sh is intended to be used for stress-testing the bulk load of ct entries from a file (-R option). Script usage detail is given by the ./bulk-load-stress.sh -h Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack -L/-D ip family filteringMikhail Sennikovsky2021-05-031-1/+71
| | | | | | | | | | | | | Tests to cover conntrack -L and conntrack -D with and w/o family (-f) specfied. conntrack -L and contnrack -D shold list/delete both IPv4 and IPv6 entries if no family is specified, and should ony display the corresponding entries if the family is given. Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@cloud.ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: saving and loading ct entries, save formatMikhail Sennikovsky2021-05-033-12/+229
| | | | | Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@cloud.ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: default to unspec family for dualstack setupsPablo Neira Ayuso2020-10-272-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2bcbae4c14b2 ("conntrack: -f family filter does not work") restored the fallback to IPv4 if -f is not specified, which was the original behaviour. This patch modifies the default to use the unspec family if -f is not specified for the following ct commands: - list - update - delete - get (these two commands below do not support for -f though, but in case this is extended in the future to support it): - flush - event The existing code that parses IPv4 and IPv6 addresses already infers the family, which simplifies the introduction of this update. The expect commands are not updated, they still require many mandatory options for filtering. This patch includes a few test updates too. Based on patch from Mikhail Sennikovsky. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: icmp entry create/deleteMikhail Sennikovsky2020-10-131-0/+4
| | | | | | | Add test to cover icmp entry creation/deletion with conntrack Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@cloud.ionos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add a few more testsPablo Neira Ayuso2020-05-282-0/+22
| | | | | | Extend testsuite with a few more tests. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: reallocate cli testing scriptArturo Borrero Gonzalez2018-04-181-0/+106
| | | | | | | Move this to test/ Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: don't fail on modprobe since the driver might be built-inSteve Langasek2017-08-241-6/+8
| | | | | | | | | | | | | | Any of these nf drivers could be built-ins instead of modules; don't cause the testsuite to fail on modprobe, instead let it proceed and succeed/fail later based on actual test results. Ideally we would check up front if the driver is loaded rather than trying to modprobe and ignoring failures, but there doesn't seem to be a reliable place to check this in the kernel filesystem. Signed-off-by: Steve Langasek <steve.langasek@ubuntu.com> Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Support IPv6 NATNeil Wilson2017-03-173-0/+70
| | | | | | | | | | Refactor and improve nat support to allow conntrack to manage IPv6 NAT entries. Refactor and improve conntrack nat tests to include IPv6 NAT. Signed-off-by: Neil Wilson <neil@aldur.co.uk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: add tests for CIDR notationAsbjørn Sloth Tønnesen2016-02-162-0/+6
| | | | | Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: add netmask testsAsbjørn Sloth Tønnesen2016-02-082-0/+8
| | | | | Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: use local conntrack binaryAsbjørn Sloth Tønnesen2016-02-011-1/+1
| | | | | | | | | | The binary under test should be the one, this ensures that it is in sync with the tests performed, and that users who build from source, can test the binary prior to `make install`. Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: ignore dot files in testdirAsbjørn Sloth Tønnesen2016-02-011-0/+3
| | | | | | | Got tired of having to exit the editor, before testing. Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: flush stdout to keep syncAsbjørn Sloth Tønnesen2016-02-011-0/+1
| | | | | Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: run testfiles in the correct orderAsbjørn Sloth Tønnesen2016-02-011-4/+10
| | | | | | | | | Use scandir(3) instead of opendir(3), so that the tests are run in the expected order, otherwise it doesn't make sense to prefix the testfiles with a two digit number, giving the impression that they are run in order. Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk>
* conntrack: add zone direction supportDaniel Borkmann2015-09-291-1/+17
| | | | | | | | | | | | | | | | This patch adds support for zone directions. Since all options have the orig/reply as a prefix, I named it --orig-zone and --reply-zone to stay consistent with the rest of the cmdline options. As for the option chars, there was no unallocated reasonable combination, thus only long options are officially exposed in the help, similarly as in other cases. Test suite results, after patch: OK: 79 BAD: 0 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: don't overwrite read-only shell variablePablo Neira Ayuso2015-06-261-1/+0
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: add run-test.sh scriptPablo Neira Ayuso2012-05-261-0/+20
| | | | | | For automated testing of the conntrack utility. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* move qa directory to tests/conntrack/Pablo Neira Ayuso2012-05-268-0/+226
All automated testing for the conntrack-tools will now reside under the test directory. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
View Lorry Controller Status