New upstream version 1.44.0 upstream/1.44.0

1 files changed, 137 insertions, 10 deletions

diff --git a/src/core/tests/test-core.c b/src/core/tests/test-core.c
index 887803bf..8296d745 100644
--- a/src/core/tests/test-core.c
+++ b/src/core/tests/test-core.c
@@ -18,6 +18,7 @@
 
 #include "dns/nm-dns-manager.h"
 #include "nm-connectivity.h"
+#include "nm-firewall-utils.h"
 
 #include "nm-test-utils-core.h"
 
@@ -1243,13 +1244,9 @@ _test_match_spec_device(const GSList *specs, const char *match_str)
 {
     if (match_str && g_str_has_prefix(match_str, MATCH_S390))
         return nm_match_spec_device(specs,
-                                    NULL,
-                                    NULL,
-                                    NULL,
-                                    NULL,
-                                    NULL,
-                                    &match_str[NM_STRLEN(MATCH_S390)],
-                                    NULL);
+                                    &((const NMMatchSpecDeviceData){
+                                        .s390_subchannels = &match_str[NM_STRLEN(MATCH_S390)],
+                                    }));
     if (match_str && g_str_has_prefix(match_str, MATCH_DRIVER)) {
         gs_free char *s = g_strdup(&match_str[NM_STRLEN(MATCH_DRIVER)]);
         char         *t;
@@ -1259,9 +1256,16 @@ _test_match_spec_device(const GSList *specs, const char *match_str)
             t[0] = '\0';
             t++;
         }
-        return nm_match_spec_device(specs, NULL, NULL, s, t, NULL, NULL, NULL);
+        return nm_match_spec_device(specs,
+                                    &((const NMMatchSpecDeviceData){
+                                        .driver         = s,
+                                        .driver_version = t,
+                                    }));
     }
-    return nm_match_spec_device(specs, match_str, NULL, NULL, NULL, NULL, NULL, NULL);
+    return nm_match_spec_device(specs,
+                                &((const NMMatchSpecDeviceData){
+                                    .interface_name = match_str,
+                                }));
 }
 
 static void
@@ -2109,7 +2113,7 @@ do_test_stable_id_parse(const char       *stable_id,
         g_assert(!expected_generated);
 
     if (expected_stable_type == NM_UTILS_STABLE_TYPE_UUID)
-        g_assert(!stable_id);
+        g_assert(NM_IN_STRSET(stable_id, NULL, "default${CONNECTION}"));
     else
         g_assert(stable_id);
 
@@ -2137,6 +2141,7 @@ test_stable_id_parse(void)
 #define _parse_random(stable_id) \
     do_test_stable_id_parse("" stable_id "", NM_UTILS_STABLE_TYPE_RANDOM, NULL)
     do_test_stable_id_parse(NULL, NM_UTILS_STABLE_TYPE_UUID, NULL);
+    do_test_stable_id_parse("default${CONNECTION}", NM_UTILS_STABLE_TYPE_UUID, NULL);
     _parse_stable_id("");
     _parse_stable_id("a");
     _parse_stable_id("a$");
@@ -2151,6 +2156,7 @@ test_stable_id_parse(void)
     _parse_stable_id("a$${CONNECTION}");
     _parse_stable_id("a$${CONNECTION}x");
     _parse_generated("${CONNECTION}", "${CONNECTION}=11{_CONNECTION}");
+    _parse_generated(" ${CONNECTION}", " ${CONNECTION}=11{_CONNECTION}");
     _parse_generated("${${CONNECTION}", "${${CONNECTION}=11{_CONNECTION}");
     _parse_generated("${CONNECTION}x", "${CONNECTION}=11{_CONNECTION}x");
     _parse_generated("x${CONNECTION}", "x${CONNECTION}=11{_CONNECTION}");
@@ -2580,6 +2586,125 @@ test_connectivity_state_cmp(void)
 
 /*****************************************************************************/
 
+static void
+test_nm_firewall_nft_stdio_mlag(void)
+{
+#define _T(up,                                               \
+           bond_ifname,                                      \
+           bond_ifnames_down,                                \
+           active_members,                                   \
+           previous_members,                                 \
+           with_counters,                                    \
+           expected)                                         \
+    G_STMT_START                                             \
+    {                                                        \
+        gs_unref_bytes GBytes *_b = NULL;                    \
+                                                             \
+        _b = nm_firewall_nft_stdio_mlag((up),                \
+                                        (bond_ifname),       \
+                                        (bond_ifnames_down), \
+                                        (active_members),    \
+                                        (previous_members),  \
+                                        (with_counters));    \
+                                                             \
+        g_assert(_b);                                        \
+        nmtst_assert_cmpmem(expected,                        \
+                            NM_STRLEN(expected),             \
+                            g_bytes_get_data(_b, NULL),      \
+                            g_bytes_get_size(_b));           \
+    }                                                        \
+    G_STMT_END
+
+    _T(TRUE,
+       "bond0",
+       NM_MAKE_STRV("eth0"),
+       NM_MAKE_STRV("eth1"),
+       NM_MAKE_STRV("eth2"),
+       TRUE,
+       "add table netdev nm-mlag-eth0\012delete table netdev nm-mlag-eth0\012add table netdev "
+       "nm-mlag-bond0\012flush table netdev nm-mlag-bond0\012add chain netdev nm-mlag-bond0 "
+       "rx-drop-bc-mc-eth2 { type filter hook ingress device eth2 priority filter; }\012delete "
+       "chain netdev nm-mlag-bond0 rx-drop-bc-mc-eth2\012add chain netdev nm-mlag-bond0 "
+       "rx-drop-bc-mc-eth1 { type filter hook ingress device eth1 priority filter; }\012delete "
+       "chain netdev nm-mlag-bond0 rx-drop-bc-mc-eth1\012add set netdev nm-mlag-bond0 "
+       "macset-tagged { typeof ether saddr . vlan id; flags dynamic,timeout; }\012add set netdev "
+       "nm-mlag-bond0 macset-untagged { typeof ether saddr; flags dynamic,timeout; }\012add chain "
+       "netdev nm-mlag-bond0 tx-snoop-source-mac { type filter hook egress device bond0 priority "
+       "filter; }\012add rule netdev nm-mlag-bond0 tx-snoop-source-mac set update ether saddr . "
+       "vlan id timeout 5s @macset-tagged counter return\012add rule netdev nm-mlag-bond0 "
+       "tx-snoop-source-mac set update ether saddr timeout 5s @macset-untagged counter\012add "
+       "chain netdev nm-mlag-bond0 rx-drop-looped-packets { type filter hook ingress device bond0 "
+       "priority filter; }\012add rule netdev nm-mlag-bond0 rx-drop-looped-packets ether saddr . "
+       "vlan id @macset-tagged counter drop\012add rule netdev nm-mlag-bond0 "
+       "rx-drop-looped-packets ether type vlan counter return\012add rule netdev nm-mlag-bond0 "
+       "rx-drop-looped-packets ether saddr @macset-untagged counter drop\012");
+
+    _T(TRUE,
+       "bond0",
+       NM_MAKE_STRV("eth0"),
+       NM_MAKE_STRV("eth1"),
+       NM_MAKE_STRV("eth2"),
+       FALSE,
+       "add table netdev nm-mlag-eth0\012delete table netdev nm-mlag-eth0\012add table netdev "
+       "nm-mlag-bond0\012flush table netdev nm-mlag-bond0\012add chain netdev nm-mlag-bond0 "
+       "rx-drop-bc-mc-eth2 { type filter hook ingress device eth2 priority filter; }\012delete "
+       "chain netdev nm-mlag-bond0 rx-drop-bc-mc-eth2\012add chain netdev nm-mlag-bond0 "
+       "rx-drop-bc-mc-eth1 { type filter hook ingress device eth1 priority filter; }\012delete "
+       "chain netdev nm-mlag-bond0 rx-drop-bc-mc-eth1\012add set netdev nm-mlag-bond0 "
+       "macset-tagged { typeof ether saddr . vlan id; flags dynamic,timeout; }\012add set netdev "
+       "nm-mlag-bond0 macset-untagged { typeof ether saddr; flags dynamic,timeout; }\012add chain "
+       "netdev nm-mlag-bond0 tx-snoop-source-mac { type filter hook egress device bond0 priority "
+       "filter; }\012add rule netdev nm-mlag-bond0 tx-snoop-source-mac set update ether saddr . "
+       "vlan id timeout 5s @macset-tagged return\012add rule netdev nm-mlag-bond0 "
+       "tx-snoop-source-mac set update ether saddr timeout 5s @macset-untagged\012add chain netdev "
+       "nm-mlag-bond0 rx-drop-looped-packets { type filter hook ingress device bond0 priority "
+       "filter; }\012add rule netdev nm-mlag-bond0 rx-drop-looped-packets ether saddr . vlan id "
+       "@macset-tagged drop\012add rule netdev nm-mlag-bond0 rx-drop-looped-packets ether type "
+       "vlan return\012add rule netdev nm-mlag-bond0 rx-drop-looped-packets ether saddr "
+       "@macset-untagged drop\012");
+
+    _T(TRUE,
+       "bond0",
+       NM_MAKE_STRV("eth0", "eth1"),
+       NM_MAKE_STRV("eth2", "eth3"),
+       NM_MAKE_STRV("eth4", "eth5"),
+       FALSE,
+       "add table netdev nm-mlag-eth0\012delete table netdev nm-mlag-eth0\012add table netdev "
+       "nm-mlag-eth1\012delete table netdev nm-mlag-eth1\012add table netdev "
+       "nm-mlag-bond0\012flush table netdev nm-mlag-bond0\012add chain netdev nm-mlag-bond0 "
+       "rx-drop-bc-mc-eth4 { type filter hook ingress device eth4 priority filter; }\012delete "
+       "chain netdev nm-mlag-bond0 rx-drop-bc-mc-eth4\012add chain netdev nm-mlag-bond0 "
+       "rx-drop-bc-mc-eth5 { type filter hook ingress device eth5 priority filter; }\012delete "
+       "chain netdev nm-mlag-bond0 rx-drop-bc-mc-eth5\012add chain netdev nm-mlag-bond0 "
+       "rx-drop-bc-mc-eth2 { type filter hook ingress device eth2 priority filter; }\012delete "
+       "chain netdev nm-mlag-bond0 rx-drop-bc-mc-eth2\012add chain netdev nm-mlag-bond0 "
+       "rx-drop-bc-mc-eth3 { type filter hook ingress device eth3 priority filter; }\012add rule "
+       "netdev nm-mlag-bond0 rx-drop-bc-mc-eth3 pkttype { broadcast, multicast } drop\012add set "
+       "netdev nm-mlag-bond0 macset-tagged { typeof ether saddr . vlan id; flags dynamic,timeout; "
+       "}\012add set netdev nm-mlag-bond0 macset-untagged { typeof ether saddr; flags "
+       "dynamic,timeout; }\012add chain netdev nm-mlag-bond0 tx-snoop-source-mac { type filter "
+       "hook egress device bond0 priority filter; }\012add rule netdev nm-mlag-bond0 "
+       "tx-snoop-source-mac set update ether saddr . vlan id timeout 5s @macset-tagged "
+       "return\012add rule netdev nm-mlag-bond0 tx-snoop-source-mac set update ether saddr timeout "
+       "5s @macset-untagged\012add chain netdev nm-mlag-bond0 rx-drop-looped-packets { type filter "
+       "hook ingress device bond0 priority filter; }\012add rule netdev nm-mlag-bond0 "
+       "rx-drop-looped-packets ether saddr . vlan id @macset-tagged drop\012add rule netdev "
+       "nm-mlag-bond0 rx-drop-looped-packets ether type vlan return\012add rule netdev "
+       "nm-mlag-bond0 rx-drop-looped-packets ether saddr @macset-untagged drop\012");
+
+    _T(FALSE,
+       "bond0",
+       NM_MAKE_STRV("eth0", "eth1"),
+       NM_MAKE_STRV("eth2", "eth3"),
+       NM_MAKE_STRV("eth4", "eth5"),
+       FALSE,
+       "add table netdev nm-mlag-eth0\012delete table netdev nm-mlag-eth0\012add table netdev "
+       "nm-mlag-eth1\012delete table netdev nm-mlag-eth1\012add table netdev "
+       "nm-mlag-bond0\012delete table netdev nm-mlag-bond0\012");
+}
+
+/*****************************************************************************/
+
 NMTST_DEFINE();
 
 int
@@ -2654,5 +2779,7 @@ main(int argc, char **argv)
     g_test_add_func("/core/general/test_kernel_cmdline_match_check",
                     test_kernel_cmdline_match_check);
 
+    g_test_add_func("/core/test_nm_firewall_nft_stdio_mlag", test_nm_firewall_nft_stdio_mlag);
+
     return g_test_run();
 }