[LTP] [PATCH v2 2/2] network/iptables: add new test for iptables-tranlsate and nft
Alexey Kodanev
alexey.kodanev@oracle.com
Tue Dec 17 18:19:18 CET 2019
* Reuse the test-case from iptables_tests by moving them
in iptables_lib.sh.
* create nft rules with iptables-translate.
Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
---
v2: * added nft setup with default input chain (in case firewalld not installed)
* removed dots in the messages
* removed redirection to file in cleanup
runtest/net.tcp_cmds | 3 +-
testcases/network/iptables/Makefile | 23 +-
testcases/network/iptables/iptables01.sh | 18 +
testcases/network/iptables/iptables_lib.sh | 358 ++++++++++++++++++
testcases/network/iptables/iptables_tests.sh | 366 -------------------
testcases/network/iptables/nft01.sh | 41 +++
6 files changed, 422 insertions(+), 387 deletions(-)
create mode 100755 testcases/network/iptables/iptables01.sh
create mode 100755 testcases/network/iptables/iptables_lib.sh
delete mode 100755 testcases/network/iptables/iptables_tests.sh
create mode 100755 testcases/network/iptables/nft01.sh
diff --git a/runtest/net.tcp_cmds b/runtest/net.tcp_cmds
index 423a81756..afe6d7c71 100644
--- a/runtest/net.tcp_cmds
+++ b/runtest/net.tcp_cmds
@@ -17,7 +17,8 @@ rsh rsh01.sh
sendfile sendfile01.sh
tcpdump tcpdump01.sh
telnet telnet01.sh
-iptables iptables_tests.sh
+iptables iptables01.sh
+nft nft01.sh
dhcpd dhcpd_tests.sh
dnsmasq dnsmasq_tests.sh
iproute ip_tests.sh
diff --git a/testcases/network/iptables/Makefile b/testcases/network/iptables/Makefile
index afb96e9cb..1b42f25db 100644
--- a/testcases/network/iptables/Makefile
+++ b/testcases/network/iptables/Makefile
@@ -1,29 +1,12 @@
-#
-# network/iptables testcases Makefile.
-#
-# Copyright (C) 2009, Cisco Systems Inc.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+# SPDX-License-Identifier: GPL-2.0-or-later
+# Copyright (C) 2009, Cisco Systems Inc.
#
# Ngie Cooper, July 2009
-#
top_srcdir ?= ../../..
include $(top_srcdir)/include/mk/env_pre.mk
-INSTALL_TARGETS := iptables_tests.sh
+INSTALL_TARGETS := *.sh
include $(top_srcdir)/include/mk/generic_leaf_target.mk
diff --git a/testcases/network/iptables/iptables01.sh b/testcases/network/iptables/iptables01.sh
new file mode 100755
index 000000000..de38272e1
--- /dev/null
+++ b/testcases/network/iptables/iptables01.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-or-later
+# Copyright (c) 2018-2019 Oracle and/or its affiliates. All Rights Reserved.
+
+TST_CNT=6
+TST_SETUP="init"
+TST_TESTFUNC="test"
+TST_CLEANUP="cleanup"
+TST_NEEDS_TMPDIR=1
+TST_NEEDS_ROOT=1
+TST_NEEDS_CMDS="iptables grep ping telnet"
+TST_NEEDS_DRIVERS="ip_tables"
+use_iptables=1
+
+. iptables_lib.sh
+. tst_test.sh
+
+tst_run
diff --git a/testcases/network/iptables/iptables_lib.sh b/testcases/network/iptables/iptables_lib.sh
new file mode 100755
index 000000000..7ecec99f9
--- /dev/null
+++ b/testcases/network/iptables/iptables_lib.sh
@@ -0,0 +1,358 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-or-later
+# Copyright (c) 2018-2019 Oracle and/or its affiliates. All Rights Reserved.
+# Copyright (c) International Business Machines Corp., 2001
+#
+# Author: Jan 20 2004 Hubert Lin <linux02NOSPAAAM@tw.ibm.com>
+# <hubertNOSPAAAM@symbio.com.tw>
+
+if [ "$use_iptables" -eq 1 ]; then
+ toolname=iptables
+else
+ toolname=nft
+fi
+
+NFRUN()
+{
+ local rule
+
+ if [ "$use_iptables" -eq 1 ]; then
+ iptables $@
+ else
+ $(iptables-translate $@ | sed 's,\\,,g')
+ fi
+}
+
+NFRUN_REMOVE()
+{
+ if [ "$use_iptables" -eq 1 ]; then
+ ROD iptables -D INPUT 1
+ else
+ ROD nft flush chain ip filter INPUT
+ fi
+}
+
+init()
+{
+ tst_res TINFO "INIT: Flushing all rules"
+ NFRUN -F -t filter > tst_iptables.out 2>&1
+ NFRUN -F -t nat > tst_iptables.out 2>&1
+ NFRUN -F -t mangle > tst_iptables.out 2>&1
+}
+
+cleanup()
+{
+ if lsmod | grep -q "ip_tables"; then
+ NFTRUN -F -t filter > /dev/null 2>&1
+ NFTRUN -F -t nat > /dev/null 2>&1
+ NFTRUN -F -t mangle > /dev/null 2>&1
+ rmmod -v ipt_limit ipt_multiport ipt_LOG ipt_REJECT \
+ iptable_mangle iptable_nat ip_conntrack \
+ iptable_filter ip_tables nf_nat_ipv4 nf_nat \
+ nf_log_ipv4 nf_log_common nf_reject_ipv4 \
+ nf_conntrack_ipv4 nf_defrag_ipv4 nf_conntrack \
+ > tst_iptables.out 2>&1
+ fi
+}
+
+test1()
+{
+
+ if [ "$use_iptables" -ne 1 ]; then
+ tst_res TCONF "$toolname not applicable for test $1"
+ return
+ fi
+ local chaincnt=0
+
+ local cmd="iptables -L -t filter"
+ tst_res TINFO "$cmd will list all rules in table filter"
+ $cmd > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL "$cmd failed to list rules"
+ cat tst_iptables.out
+ return
+ else
+ chaincnt=$(grep -c Chain tst_iptables.out)
+ if [ $chaincnt -lt 3 ]; then
+ tst_res TFAIL "$cmd failed to list rules"
+ cat tst_iptables.out
+ return
+ else
+ tst_res TINFO "$cmd lists rules"
+ fi
+ fi
+
+ local cmd="iptables -L -t nat"
+ tst_res TINFO "$cmd will list all rules in table nat"
+ $cmd > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL "$cmd failed to list rules"
+ cat tst_iptables.out
+ return
+ else
+ chaincnt=$(grep -c Chain tst_iptables.out)
+ if [ $chaincnt -lt 3 ]; then
+ tst_res TFAIL "$cmd failed to list rules"
+ cat tst_iptables.out
+ return
+ else
+ tst_res TINFO "$cmd lists rules"
+ fi
+ fi
+
+ local cmd="iptables -L -t mangle"
+ tst_res TINFO "$cmd will list all rules in table mangle"
+ $cmd > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL "$cmd failed to list rules"
+ cat tst_iptables.out
+ return
+ else
+ chaincnt=$(grep -c Chain tst_iptables.out)
+ if [ $chaincnt -lt 5 ]; then
+ tst_res TFAIL "$cmd failed to list rules"
+ cat tst_iptables.out
+ else
+ tst_res TINFO "$cmd lists rules"
+ fi
+ fi
+
+ tst_res TPASS "iptables -L lists rules"
+}
+
+test2()
+{
+ tst_res TINFO "Use $toolname to DROP packets from particular IP"
+ tst_res TINFO "Rule to block icmp from 127.0.0.1"
+
+ NFRUN -A INPUT -s 127.0.0.1 -p icmp -j DROP > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL "$toolname command failed to append new rule"
+ cat tst_iptables.out
+ return
+ fi
+
+ tst_res TINFO "Pinging 127.0.0.1"
+ ping -c 2 127.0.0.1 -W 1 -i 0 > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ grep "100% packet loss" tst_iptables.out > tst_iptables.err 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL \
+ "$toolname did not block packets from loopback"
+ cat tst_iptables.err
+ return
+ else
+ tst_res TINFO "Ping 127.0.0.1 not successful"
+ fi
+ else
+ tst_res TFAIL "$toolname did not block icmp from 127.0.0.1"
+ cat tst_iptables.out
+ return
+ fi
+
+ tst_res TINFO "Deleting icmp DROP from 127.0.0.1 rule"
+ NFRUN_REMOVE
+
+ tst_res TINFO "Pinging 127.0.0.1 again"
+ ping -c 2 127.0.0.1 -W 1 -i 0 > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL "$toolname blocking loopback. This is expected" \
+ "behaviour on certain distributions where" \
+ "enabling firewall drops all packets by default"
+ cat tst_iptables.out
+ return
+ fi
+ tst_res TINFO "Ping succsess"
+ tst_res TPASS "$toolname can DROP packets from particular IP"
+}
+
+test3()
+{
+ tst_res TINFO "Use $toolname to REJECT ping request"
+ tst_res TINFO "Rule to reject ping request"
+
+ NFRUN -A INPUT -p icmp --icmp-type echo-request -d 127.0.0.1 -j \
+ REJECT > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL "$toolname command failed to append new rule"
+ cat tst_iptables.out
+ return
+ fi
+
+ tst_res TINFO "Pinging 127.0.0.1"
+ ping -c 2 127.0.0.1 -W 1 -i 0 > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ grep "100% packet loss" tst_iptables.out > tst_iptables.err 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL "$toolname did not block ping request"
+ cat tst_iptables.err
+ return
+ else
+ tst_res TINFO "Ping 127.0.0.1 not successful"
+ fi
+ else
+ tst_res TFAIL "$toolname did not reject ping request"
+ cat tst_iptables.out
+ return
+ fi
+
+ tst_res TINFO "Deleting icmp request REJECT rule"
+ NFRUN_REMOVE
+
+ tst_res TINFO "Pinging 127.0.0.1 again"
+ ping -c 2 127.0.0.1 -W 1 -i 0 > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL "$toolname blocking ping requests. This is" \
+ "expected behaviour on certain distributions" \
+ "where enabling firewall drops all packets by" \
+ "default"
+ cat tst_iptables.out
+ return
+ fi
+ tst_res TINFO "Ping succsess"
+ tst_res TPASS "$toolname can REJECT ping requests"
+}
+
+test4()
+{
+ local dport=45886
+ local logprefix="${TCID}$(date +%m%d%H%M%S):"
+
+ tst_res TINFO "Use $toolname to log packets to particular port"
+ tst_res TINFO "Rule to log tcp packets to particular port"
+
+ NFRUN -A INPUT -p tcp -d 127.0.0.1 --dport $dport -j LOG \
+ --log-prefix "$logprefix" > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL "$toolname command failed to append new rule"
+ cat tst_iptables.out
+ return
+ fi
+
+ tst_res TINFO "telnet 127.0.0.1 $dport"
+ telnet 127.0.0.1 $dport > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ sleep 2
+ dmesg | grep "$logprefix" > tst_iptables.err 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL \
+ "$toolname did not log packets to port $dport"
+ cat tst_iptables.err
+ return
+ else
+ tst_res TINFO "Packets to port $dport logged"
+ fi
+ else
+ tst_res TFAIL "telnet to 127.0.0.1 $dport should fail"
+ cat tst_iptables.out
+ return
+ fi
+
+ tst_res TINFO "Deleting the rule to log"
+ NFRUN_REMOVE
+
+ tst_res TINFO "$toolname logging succsess"
+ tst_res TPASS "$toolname can log packets to particular port"
+}
+
+test5()
+{
+ local dport=0
+ local logprefix="${TCID}$(date +%m%d%H%M%S):"
+
+ tst_res TINFO "Use $toolname to log packets to multiple ports"
+ tst_res TINFO "Rule to log tcp packets to port 45801 - 45803"
+ NFRUN -A INPUT -p tcp -d 127.0.0.1 --dport 45801:45803 -j LOG \
+ --log-prefix "$logprefix" > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL "$toolname command failed to append new rule"
+ cat tst_iptables.out
+ return
+ fi
+
+ tst_res TINFO "Rule to log tcp packets to port 45804 - 45806"
+ NFRUN -A INPUT -p tcp -d 127.0.0.1 -m multiport --dports \
+ 45804,45806,45805 -j LOG --log-prefix "$logprefix" \
+ > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL "$toolname command failed to append new rule"
+ cat tst_iptables.out
+ return
+ fi
+
+ for dport in 45801 45802 45803 45804 45805 45806; do
+ tst_res TINFO "telnet 127.0.0.1 $dport"
+ telnet 127.0.0.1 $dport > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ sleep 2
+ dmesg | grep "$logprefix" | grep "=$dport " \
+ > tst_iptables.err 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL "$toolname did not log packets" \
+ "to port $dport"
+ cat tst_iptables.err
+ return
+ else
+ tst_res TINFO "Packets to port $dport logged"
+ fi
+ else
+ tst_res TFAIL "telnet to 127.0.0.1 $dport should fail"
+ cat tst_iptables.out
+ return
+ fi
+ done
+
+ tst_res TINFO "Flushing all rules"
+ NFRUN -F > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL "$toolname did not flush all rules"
+ cat tst_iptables.out
+ return
+ fi
+ tst_res TINFO "$toolname logging succsess"
+ tst_res TPASS "$toolname can log packets to multiple ports"
+}
+
+test6()
+{
+ local logcnt=0
+ local logprefix="${TCID}$(date +%m%d%H%M%S):"
+
+ tst_res TINFO "Use $toolname to log ping request with limited rate"
+ tst_res TINFO "Rule to log ping request"
+
+ NFRUN -A INPUT -p icmp --icmp-type echo-request -d 127.0.0.1 -m \
+ limit -j LOG --log-prefix "$logprefix" > tst_iptables.out 2>&1
+ if [ $? -ne 0 ]; then
+ tst_res TFAIL "$toolname command failed to append new rule"
+ cat tst_iptables.out
+ return
+ fi
+
+ tst_res TINFO "ping 127.0.0.1"
+ ping -c 10 127.0.0.1 -W 1 -i 0 > tst_iptables.out 2>&1
+ if [ $? -eq 0 ]; then
+ sleep 2
+ logcnt=$(dmesg | grep -c "$logprefix")
+ if [ $logcnt -ne 5 ]; then
+ tst_res TFAIL "$toolname did not log packets with" \
+ "limited rate"
+ cat tst_iptables.out
+ return
+ else
+ tst_res TINFO "ping requests logged with limited rate"
+ fi
+ else
+ tst_res TFAIL "ping to 127.0.0.1 failed. This is expected" \
+ "behaviour on certain distributions where" \
+ "enabling firewall drops all packets by default"
+ cat tst_iptables.out
+ return
+ fi
+
+ tst_res TINFO "Deleting the rule to log"
+ NFRUN_REMOVE
+
+ tst_res TINFO "$toolname limited logging succsess"
+ tst_res TPASS "$toolname can log packets with limited rate"
+}
diff --git a/testcases/network/iptables/iptables_tests.sh b/testcases/network/iptables/iptables_tests.sh
deleted file mode 100755
index d8b23283f..000000000
--- a/testcases/network/iptables/iptables_tests.sh
+++ /dev/null
@@ -1,366 +0,0 @@
-#!/bin/sh
-# SPDX-License-Identifier: GPL-2.0-or-later
-# Copyright (c) 2018-2019 Oracle and/or its affiliates. All Rights Reserved.
-# Copyright (c) International Business Machines Corp., 2001
-#
-# Author: Jan 20 2004 Hubert Lin <linux02NOSPAAAM@tw.ibm.com>
-# <hubertNOSPAAAM@symbio.com.tw>
-
-TST_CNT=6
-TST_SETUP="init"
-TST_TESTFUNC="test"
-TST_CLEANUP="cleanup"
-TST_NEEDS_TMPDIR=1
-TST_NEEDS_ROOT=1
-TST_NEEDS_CMDS="iptables grep ping telnet"
-
-. tst_test.sh
-
-init()
-{
- tst_res TINFO "INIT: Inititalizing tests."
-
- modprobe ip_tables
- if [ $? -ne 0 ]; then
- iptables -L > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_brk TCONF "no iptables support in kernel."
- fi
- fi
-
- tst_res TINFO "INIT: Flushing all rules."
- iptables -F -t filter > tst_iptables.out 2>&1
- iptables -F -t nat > tst_iptables.out 2>&1
- iptables -F -t mangle > tst_iptables.out 2>&1
-}
-
-cleanup()
-{
- lsmod | grep "ip_tables" > tst_iptables.out 2>&1
- if [ $? -eq 0 ]; then
- iptables -F -t filter > tst_iptables.out 2>&1
- iptables -F -t nat > tst_iptables.out 2>&1
- iptables -F -t mangle > tst_iptables.out 2>&1
- rmmod -v ipt_limit ipt_multiport ipt_LOG ipt_REJECT \
- iptable_mangle iptable_nat ip_conntrack \
- iptable_filter ip_tables nf_nat_ipv4 nf_nat \
- nf_log_ipv4 nf_log_common nf_reject_ipv4 \
- nf_conntrack_ipv4 nf_defrag_ipv4 nf_conntrack \
- > tst_iptables.out 2>&1
- fi
-}
-
-test1()
-{
- local chaincnt=0
-
- local cmd="iptables -L -t filter"
- tst_res TINFO "$cmd will list all rules in table filter."
- $cmd > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "$cmd failed to list rules."
- cat tst_iptables.out
- return
- else
- chaincnt=$(grep -c Chain tst_iptables.out)
- if [ $chaincnt -lt 3 ]; then
- tst_res TFAIL "$cmd failed to list rules."
- cat tst_iptables.out
- return
- else
- tst_res TINFO "$cmd lists rules."
- fi
- fi
-
- local cmd="iptables -L -t nat"
- tst_res TINFO "$cmd will list all rules in table nat."
- $cmd > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "$cmd failed to list rules."
- cat tst_iptables.out
- return
- else
- chaincnt=$(grep -c Chain tst_iptables.out)
- if [ $chaincnt -lt 3 ]; then
- tst_res TFAIL "$cmd failed to list rules."
- cat tst_iptables.out
- return
- else
- tst_res TINFO "$cmd lists rules."
- fi
- fi
-
- local cmd="iptables -L -t mangle"
- tst_res TINFO "$cmd will list all rules in table mangle."
- $cmd > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "$cmd failed to list rules."
- cat tst_iptables.out
- return
- else
- chaincnt=$(grep -c Chain tst_iptables.out)
- if [ $chaincnt -lt 5 ]; then
- tst_res TFAIL "$cmd failed to list rules."
- cat tst_iptables.out
- else
- tst_res TINFO "$cmd lists rules."
- fi
- fi
-
- tst_res TPASS "iptables -L lists rules."
-}
-
-test2()
-{
- tst_res TINFO "Use iptables to DROP packets from particular IP"
- tst_res TINFO "Rule to block icmp from 127.0.0.1"
-
- iptables -A INPUT -s 127.0.0.1 -p icmp -j DROP > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "iptables command failed to append new rule."
- cat tst_iptables.out
- return
- fi
-
- tst_res TINFO "Pinging 127.0.0.1"
- ping -c 2 127.0.0.1 -W 1 -i 0 > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- grep "100% packet loss" tst_iptables.out > tst_iptables.err 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL \
- "iptables did not block packets from loopback"
- cat tst_iptables.err
- return
- else
- tst_res TINFO "Ping 127.0.0.1 not successful."
- fi
- else
- tst_res TFAIL "iptables did not block icmp from 127.0.0.1"
- cat tst_iptables.out
- return
- fi
-
- tst_res TINFO "Deleting icmp DROP from 127.0.0.1 rule."
- iptables -D INPUT 1 > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "iptables did not remove the rule."
- cat tst_iptables.out
- return
- fi
- tst_res TINFO "Pinging 127.0.0.1 again"
- ping -c 2 127.0.0.1 -W 1 -i 0 > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "iptables blocking loopback. This is expected" \
- "behaviour on certain distributions where" \
- "enabling firewall drops all packets by default."
- cat tst_iptables.out
- return
- fi
- tst_res TINFO "Ping succsess"
- tst_res TPASS "iptables can DROP packets from particular IP."
-}
-
-test3()
-{
- tst_res TINFO "Use iptables to REJECT ping request."
- tst_res TINFO "Rule to reject ping request."
-
- iptables -A INPUT -p icmp --icmp-type echo-request -d 127.0.0.1 -j \
- REJECT > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "iptables command failed to append new rule."
- cat tst_iptables.out
- return
- fi
-
- tst_res TINFO "Pinging 127.0.0.1"
- ping -c 2 127.0.0.1 -W 1 -i 0 > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- grep "100% packet loss" tst_iptables.out > tst_iptables.err 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "iptables did not block ping request."
- cat tst_iptables.err
- return
- else
- tst_res TINFO "Ping 127.0.0.1 not successful."
- fi
- else
- tst_res TFAIL "iptables did not reject ping request."
- cat tst_iptables.out
- return
- fi
-
- tst_res TINFO "Deleting icmp request REJECT rule."
- iptables -D INPUT 1 > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "iptables did not remove the rule."
- cat tst_iptables.out
- return
- fi
- tst_res TINFO "Pinging 127.0.0.1 again"
- ping -c 2 127.0.0.1 -W 1 -i 0 > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "iptables blocking ping requests. This is" \
- "expected behaviour on certain distributions" \
- "where enabling firewall drops all packets by" \
- "default."
- cat tst_iptables.out
- return
- fi
- tst_res TINFO "Ping succsess"
- tst_res TPASS "iptables can REJECT ping requests."
-}
-
-test4()
-{
- local dport=45886
- local logprefix="${TCID}$(date +%m%d%H%M%S):"
-
- tst_res TINFO "Use iptables to log packets to particular port."
- tst_res TINFO "Rule to log tcp packets to particular port."
-
- iptables -A INPUT -p tcp -d 127.0.0.1 --dport $dport -j LOG \
- --log-prefix "$logprefix" > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "iptables command failed to append new rule."
- cat tst_iptables.out
- return
- fi
-
- tst_res TINFO "telnet 127.0.0.1 $dport"
- telnet 127.0.0.1 $dport > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- sleep 2
- dmesg | grep "$logprefix" > tst_iptables.err 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL \
- "iptables did not log packets to port $dport"
- cat tst_iptables.err
- return
- else
- tst_res TINFO "Packets to port $dport logged."
- fi
- else
- tst_res TFAIL "telnet to 127.0.0.1 $dport should fail."
- cat tst_iptables.out
- return
- fi
-
- tst_res TINFO "Deleting the rule to log."
- iptables -D INPUT 1 > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "iptables did not remove the rule."
- cat tst_iptables.out
- return
- fi
- tst_res TINFO "iptables logging succsess"
- tst_res TPASS "iptables can log packets to particular port."
-}
-
-test5()
-{
- local dport=0
- local logprefix="${TCID}$(date +%m%d%H%M%S):"
-
- tst_res TINFO "Use iptables to log packets to multiple ports."
- tst_res TINFO "Rule to log tcp packets to port 45801 - 45803."
- iptables -A INPUT -p tcp -d 127.0.0.1 --dport 45801:45803 -j LOG \
- --log-prefix "$logprefix" > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "iptables command failed to append new rule."
- cat tst_iptables.out
- return
- fi
-
- tst_res TINFO "Rule to log tcp packets to port 45804 - 45806."
- iptables -A INPUT -p tcp -d 127.0.0.1 -m multiport --dports \
- 45804,45806,45805 -j LOG --log-prefix "$logprefix" \
- > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "iptables command failed to append new rule."
- cat tst_iptables.out
- return
- fi
-
- for dport in 45801 45802 45803 45804 45805 45806; do
- tst_res TINFO "telnet 127.0.0.1 $dport"
- telnet 127.0.0.1 $dport > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- sleep 2
- dmesg | grep "$logprefix" | grep "=$dport " \
- > tst_iptables.err 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "iptables did not log packets" \
- "to port $dport"
- cat tst_iptables.err
- return
- else
- tst_res TINFO "Packets to port $dport logged."
- fi
- else
- tst_res TFAIL "telnet to 127.0.0.1 $dport should fail."
- cat tst_iptables.out
- return
- fi
- done
-
- tst_res TINFO "Flushing all rules."
- iptables -F > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "iptables did not flush all rules."
- cat tst_iptables.out
- return
- fi
- tst_res TINFO "iptables logging succsess"
- tst_res TPASS "iptables can log packets to multiple ports."
-}
-
-test6()
-{
- local logcnt=0
- local logprefix="${TCID}$(date +%m%d%H%M%S):"
-
- tst_res TINFO "Use iptables to log ping request with limited rate."
- tst_res TINFO "Rule to log ping request."
-
- iptables -A INPUT -p icmp --icmp-type echo-request -d 127.0.0.1 -m \
- limit -j LOG --log-prefix "$logprefix" > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "iptables command failed to append new rule."
- cat tst_iptables.out
- return
- fi
-
- tst_res TINFO "ping 127.0.0.1"
- ping -c 10 127.0.0.1 -W 1 -i 0 > tst_iptables.out 2>&1
- if [ $? -eq 0 ]; then
- sleep 2
- logcnt=$(dmesg | grep -c "$logprefix")
- if [ $logcnt -ne 5 ]; then
- tst_res TFAIL "iptables did not log packets with" \
- "limited rate."
- cat tst_iptables.out
- return
- else
- tst_res TINFO "ping requests logged with limited rate."
- fi
- else
- tst_res TFAIL "ping to 127.0.0.1 failed. This is expected" \
- "behaviour on certain distributions where" \
- "enabling firewall drops all packets by default."
- cat tst_iptables.out
- return
- fi
-
- tst_res TINFO "Deleting the rule to log."
- iptables -D INPUT 1 > tst_iptables.out 2>&1
- if [ $? -ne 0 ]; then
- tst_res TFAIL "iptables did not remove the rule."
- cat tst_iptables.out
- return
- fi
- tst_res TINFO "iptables limited logging succsess"
- tst_res TPASS "iptables can log packets with limited rate."
-}
-
-tst_run
diff --git a/testcases/network/iptables/nft01.sh b/testcases/network/iptables/nft01.sh
new file mode 100755
index 000000000..b3fde842f
--- /dev/null
+++ b/testcases/network/iptables/nft01.sh
@@ -0,0 +1,41 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-or-later
+# Copyright (c) 2019 Oracle and/or its affiliates. All Rights Reserved.
+
+TST_CNT=6
+TST_SETUP="do_setup"
+TST_TESTFUNC="test"
+TST_CLEANUP="do_cleanup"
+TST_NEEDS_TMPDIR=1
+TST_NEEDS_ROOT=1
+TST_NEEDS_CMDS="nft iptables-translate grep ping telnet"
+TST_NEEDS_DRIVERS="nf_tables"
+use_iptables=0
+
+. iptables_lib.sh
+. tst_test.sh
+
+cleanup_tables=0
+cleanup_chain=0
+
+do_setup()
+{
+ if ! nft list table ip filter > /dev/null 2>&1; then
+ ROD nft add table ip filter
+ cleanup_table=1
+ fi
+ if ! nft list chain ip filter INPUT > /dev/null 2>&1; then
+ ROD nft add chain ip filter INPUT '{ type filter hook input priority 0; }'
+ cleanup_chain=1
+ fi
+ init
+}
+
+do_cleanup()
+{
+ [ $cleanup_chain -eq 1 ] && nft delete chain ip filter INPUT >/dev/null 2>&1
+ [ $cleanup_table -eq 1 ] && nft delete table ip filter >/dev/null 2>&1
+ cleanup
+}
+
+tst_run
--
2.20.1
More information about the ltp
mailing list