Skip to content

Commit e5fb6d4

Browse files
jwhbjwhb
committed
expr: fix sctp chunks
also adds space-keys test for all keys with spaces
1 parent cb8937a commit e5fb6d4

File tree

3 files changed

+308
-0
lines changed

3 files changed

+308
-0
lines changed

‎resources/test/json/space-keys.json

Lines changed: 266 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,266 @@
1+
{
2+
"nftables": [
3+
{
4+
"metainfo": {
5+
"version": "1.0.7",
6+
"release_name": "Old Doc Yak",
7+
"json_schema_version": 1
8+
}
9+
},
10+
{
11+
"table": {
12+
"family": "ip",
13+
"name": "filter",
14+
"handle": 1
15+
}
16+
},
17+
{
18+
"ct expectation": {
19+
"family": "ip",
20+
"name": "e_pgsql",
21+
"table": "filter",
22+
"handle": 4,
23+
"protocol": "tcp",
24+
"dport": 5432,
25+
"timeout": 3600000,
26+
"size": 12,
27+
"l3proto": "ip"
28+
}
29+
},
30+
{
31+
"ct helper": {
32+
"family": "ip",
33+
"name": "ftp-standard",
34+
"table": "filter",
35+
"handle": 5,
36+
"type": "ftp",
37+
"protocol": "tcp",
38+
"l3proto": "ip"
39+
}
40+
},
41+
{
42+
"chain": {
43+
"family": "ip",
44+
"table": "filter",
45+
"name": "INPUT",
46+
"handle": 1,
47+
"type": "filter",
48+
"hook": "input",
49+
"prio": 0,
50+
"policy": "accept"
51+
}
52+
},
53+
{
54+
"chain": {
55+
"family": "ip",
56+
"table": "filter",
57+
"name": "FORWARD",
58+
"handle": 2,
59+
"type": "filter",
60+
"hook": "forward",
61+
"prio": 0,
62+
"policy": "accept"
63+
}
64+
},
65+
{
66+
"chain": {
67+
"family": "ip",
68+
"table": "filter",
69+
"name": "OUTPUT",
70+
"handle": 3,
71+
"type": "filter",
72+
"hook": "output",
73+
"prio": 0,
74+
"policy": "accept"
75+
}
76+
},
77+
{
78+
"rule": {
79+
"family": "ip",
80+
"table": "filter",
81+
"chain": "INPUT",
82+
"handle": 6,
83+
"expr": [
84+
{
85+
"match": {
86+
"op": "==",
87+
"left": {
88+
"payload": {
89+
"protocol": "tcp",
90+
"field": "dport"
91+
}
92+
},
93+
"right": 22
94+
}
95+
},
96+
{
97+
"ct count": {
98+
"val": 10
99+
}
100+
},
101+
{
102+
"accept": null
103+
}
104+
]
105+
}
106+
},
107+
{
108+
"rule": {
109+
"family": "ip",
110+
"table": "filter",
111+
"chain": "INPUT",
112+
"handle": 7,
113+
"expr": [
114+
{
115+
"match": {
116+
"op": "in",
117+
"left": {
118+
"ct": {
119+
"key": "state"
120+
}
121+
},
122+
"right": "new"
123+
}
124+
},
125+
{
126+
"match": {
127+
"op": "==",
128+
"left": {
129+
"payload": {
130+
"protocol": "tcp",
131+
"field": "dport"
132+
}
133+
},
134+
"right": 8888
135+
}
136+
},
137+
{
138+
"ct expectation": "e_pgsql"
139+
}
140+
]
141+
}
142+
},
143+
{
144+
"rule": {
145+
"family": "ip",
146+
"table": "filter",
147+
"chain": "INPUT",
148+
"handle": 8,
149+
"expr": [
150+
{
151+
"match": {
152+
"op": "in",
153+
"left": {
154+
"ct": {
155+
"key": "state"
156+
}
157+
},
158+
"right": [
159+
"established",
160+
"related"
161+
]
162+
}
163+
},
164+
{
165+
"counter": {
166+
"packets": 0,
167+
"bytes": 0
168+
}
169+
},
170+
{
171+
"accept": null
172+
}
173+
]
174+
}
175+
},
176+
{
177+
"rule": {
178+
"family": "ip",
179+
"table": "filter",
180+
"chain": "FORWARD",
181+
"handle": 9,
182+
"expr": [
183+
{
184+
"match": {
185+
"op": "in",
186+
"left": {
187+
"payload": {
188+
"protocol": "tcp",
189+
"field": "flags"
190+
}
191+
},
192+
"right": "syn"
193+
}
194+
},
195+
{
196+
"counter": {
197+
"packets": 0,
198+
"bytes": 0
199+
}
200+
},
201+
{
202+
"mangle": {
203+
"key": {
204+
"tcp option": {
205+
"name": "maxseg",
206+
"field": "size"
207+
}
208+
},
209+
"value": {
210+
"rt": {
211+
"key": "mtu"
212+
}
213+
}
214+
}
215+
}
216+
]
217+
}
218+
},
219+
{
220+
"rule": {
221+
"family": "ip",
222+
"table": "filter",
223+
"chain": "FORWARD",
224+
"handle": 10,
225+
"expr": [
226+
{
227+
"match": {
228+
"op": "==",
229+
"left": {
230+
"sctp chunk": {
231+
"name": "data",
232+
"field": "flags"
233+
}
234+
},
235+
"right": 2
236+
}
237+
}
238+
]
239+
}
240+
},
241+
{
242+
"rule": {
243+
"family": "ip",
244+
"table": "filter",
245+
"chain": "FORWARD",
246+
"handle": 11,
247+
"expr": [
248+
{
249+
"match": {
250+
"op": "==",
251+
"left": {
252+
"ct": {
253+
"key": "helper"
254+
}
255+
},
256+
"right": "ftp-standard"
257+
}
258+
},
259+
{
260+
"accept": null
261+
}
262+
]
263+
}
264+
}
265+
]
266+
}

‎resources/test/nft/space-keys.nft

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# this tests various key names with spaces:
2+
# * ct count
3+
# * ct expectation
4+
# * ct helper
5+
# * ct timeout
6+
# * sctp chunk
7+
# * tcp option
8+
# nft rule snippets are taken from wiki.nftables.org
9+
10+
table ip filter {
11+
ct expectation e_pgsql {
12+
protocol tcp
13+
dport 5432
14+
timeout 1h
15+
size 12
16+
l3proto ip
17+
}
18+
19+
ct helper ftp-standard {
20+
type "ftp" protocol tcp
21+
l3proto ip
22+
}
23+
24+
chain INPUT {
25+
type filter hook input priority filter; policy accept;
26+
tcp dport 22 ct count 10 accept
27+
ct state new tcp dport 8888 ct expectation set "e_pgsql"
28+
ct state established,related counter packets 0 bytes 0 accept
29+
}
30+
31+
chain FORWARD {
32+
type filter hook forward priority filter; policy accept;
33+
tcp flags syn counter packets 0 bytes 0 tcp option maxseg size set rt mtu
34+
sctp chunk data flags 2
35+
ct helper "ftp-standard" accept
36+
}
37+
38+
chain OUTPUT {
39+
type filter hook output priority filter; policy accept;
40+
}
41+
}

‎src/expr.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ pub enum NamedExpression {
3939
Exthdr(Exthdr),
4040
#[serde(rename = "tcp option")]
4141
TcpOption(TcpOption),
42+
#[serde(rename = "sctp chunk")]
4243
SctpChunk(SctpChunk),
4344
Meta(Meta),
4445
RT(RT),

0 commit comments

Comments
 (0)