2 # SPDX-License-Identifier: GPL-2.0
4 # Check that audit logs generated for nft commands are as expected.
9 nft --version >/dev/null 2>&1 || {
10 echo "SKIP: missing nft tool"
16 echo "logging into $logfile"
17 ./audit_logread >"$logfile" &
19 trap 'kill $logread_pid; rm -f $logfile $rulefile' EXIT
22 do_test() { # (cmd, log)
23 echo -n "testing for cmd: $1 ... "
25 $1 >/dev/null || exit 1
27 res=$(diff -a -u <(echo "$2") - <&3)
28 [ $? -eq 0 ] && { echo "OK"; return; }
30 grep -v '^\(---\|+++\|@@\)' <<< "$res"
36 # adding tables, chains and rules
38 for table in t1 t2; do
39 do_test "nft add table $table" \
40 "table=$table family=2 entries=1 op=nft_register_table"
42 do_test "nft add chain $table c1" \
43 "table=$table family=2 entries=1 op=nft_register_chain"
45 do_test "nft add chain $table c2; add chain $table c3" \
46 "table=$table family=2 entries=2 op=nft_register_chain"
48 cmd="add rule $table c1 counter"
51 "table=$table family=2 entries=1 op=nft_register_rule"
53 do_test "nft $cmd; $cmd" \
54 "table=$table family=2 entries=2 op=nft_register_rule"
58 for chain in c2 c3; do
60 cmd+="$sep add rule $table $chain counter"
65 "table=$table family=2 entries=6 op=nft_register_rule"
68 for ((i = 0; i < 500; i++)); do
69 echo "add rule t2 c3 counter accept comment \"rule $i\""
71 do_test "nft -f $rulefile" \
72 'table=t2 family=2 entries=500 op=nft_register_rule'
74 # adding sets and elements
76 settype='type inet_service; counter'
77 setelem='{ 22, 80, 443 }'
78 setblock="{ $settype; elements = $setelem; }"
79 do_test "nft add set t1 s $setblock" \
80 "table=t1 family=2 entries=4 op=nft_register_set"
82 do_test "nft add set t1 s2 $setblock; add set t1 s3 { $settype; }" \
83 "table=t1 family=2 entries=5 op=nft_register_set"
85 do_test "nft add element t1 s3 $setelem" \
86 "table=t1 family=2 entries=3 op=nft_register_setelem"
90 do_test 'nft add counter t1 c1' \
91 'table=t1 family=2 entries=1 op=nft_register_obj'
93 do_test 'nft add counter t2 c1; add counter t2 c2' \
94 'table=t2 family=2 entries=2 op=nft_register_obj'
96 # adding/updating quotas
98 do_test 'nft add quota t1 q1 { 10 bytes }' \
99 'table=t1 family=2 entries=1 op=nft_register_obj'
101 do_test 'nft add quota t2 q1 { 10 bytes }; add quota t2 q2 { 10 bytes }' \
102 'table=t2 family=2 entries=2 op=nft_register_obj'
104 # changing the quota value triggers obj update path
105 do_test 'nft add quota t1 q1 { 20 bytes }' \
106 'table=t1 family=2 entries=1 op=nft_register_obj'
110 do_test 'nft reset rules t1 c2' \
111 'table=t1 family=2 entries=3 op=nft_reset_rule'
113 do_test 'nft reset rules table t1' \
114 'table=t1 family=2 entries=3 op=nft_reset_rule
115 table=t1 family=2 entries=3 op=nft_reset_rule
116 table=t1 family=2 entries=3 op=nft_reset_rule'
118 do_test 'nft reset rules t2 c3' \
119 'table=t2 family=2 entries=189 op=nft_reset_rule
120 table=t2 family=2 entries=188 op=nft_reset_rule
121 table=t2 family=2 entries=126 op=nft_reset_rule'
123 do_test 'nft reset rules t2' \
124 'table=t2 family=2 entries=3 op=nft_reset_rule
125 table=t2 family=2 entries=3 op=nft_reset_rule
126 table=t2 family=2 entries=186 op=nft_reset_rule
127 table=t2 family=2 entries=188 op=nft_reset_rule
128 table=t2 family=2 entries=129 op=nft_reset_rule'
130 do_test 'nft reset rules' \
131 'table=t1 family=2 entries=3 op=nft_reset_rule
132 table=t1 family=2 entries=3 op=nft_reset_rule
133 table=t1 family=2 entries=3 op=nft_reset_rule
134 table=t2 family=2 entries=3 op=nft_reset_rule
135 table=t2 family=2 entries=3 op=nft_reset_rule
136 table=t2 family=2 entries=180 op=nft_reset_rule
137 table=t2 family=2 entries=188 op=nft_reset_rule
138 table=t2 family=2 entries=135 op=nft_reset_rule'
140 # resetting sets and elements
145 relem+="${elem[((i - 1))]}"
146 do_test "nft reset element t1 s { $relem }" \
147 "table=t1 family=2 entries=$i op=nft_reset_setelem"
150 do_test 'nft reset set t1 s' \
151 'table=t1 family=2 entries=3 op=nft_reset_setelem'
155 readarray -t handles < <(nft -a list chain t1 c1 | \
156 sed -n 's/.*counter.* handle \(.*\)$/\1/p')
158 do_test "nft delete rule t1 c1 handle ${handles[0]}" \
159 'table=t1 family=2 entries=1 op=nft_unregister_rule'
161 cmd='delete rule t1 c1 handle'
162 do_test "nft $cmd ${handles[1]}; $cmd ${handles[2]}" \
163 'table=t1 family=2 entries=2 op=nft_unregister_rule'
165 do_test 'nft flush chain t1 c2' \
166 'table=t1 family=2 entries=3 op=nft_unregister_rule'
168 do_test 'nft flush table t2' \
169 'table=t2 family=2 entries=509 op=nft_unregister_rule'
173 do_test 'nft delete chain t2 c2' \
174 'table=t2 family=2 entries=1 op=nft_unregister_chain'
176 # deleting sets and elements
178 do_test 'nft delete element t1 s { 22 }' \
179 'table=t1 family=2 entries=1 op=nft_unregister_setelem'
181 do_test 'nft delete element t1 s { 80, 443 }' \
182 'table=t1 family=2 entries=2 op=nft_unregister_setelem'
184 do_test 'nft flush set t1 s2' \
185 'table=t1 family=2 entries=3 op=nft_unregister_setelem'
187 do_test 'nft delete set t1 s2' \
188 'table=t1 family=2 entries=1 op=nft_unregister_set'
190 do_test 'nft delete set t1 s3' \
191 'table=t1 family=2 entries=1 op=nft_unregister_set'