Add parser tests for a named interval map with concatenated key and for
an anonymous map as binop operands of mark statements.

Add a packetpath test which checks that a map hit replaces the masked
bits of the packet mark and keeps the others, and that a map miss
leaves the mark alone.

Signed-off-by: Jochen Seeber <jochen@seeber.me>
---
 .../shell/testcases/bitwise/0040mark_binop_14 |  14 +
 .../shell/testcases/bitwise/0040mark_binop_15 |  13 +
 .../bitwise/dumps/0040mark_binop_14.json-nft  | 100 +++++++
 .../bitwise/dumps/0040mark_binop_14.nft       |  11 +
 .../bitwise/dumps/0040mark_binop_15.json-nft  |  85 ++++++
 .../bitwise/dumps/0040mark_binop_15.nft       |   6 +
 .../testcases/packetpath/bitwise_map_operand  |  62 +++++
 .../dumps/bitwise_map_operand.json-nft        | 250 ++++++++++++++++++
 .../packetpath/dumps/bitwise_map_operand.nft  |  19 ++
 9 files changed, 560 insertions(+)
 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_14
 create mode 100755 tests/shell/testcases/bitwise/0040mark_binop_15
 create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_14.json-nft
 create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_14.nft
 create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_15.json-nft
 create mode 100644 tests/shell/testcases/bitwise/dumps/0040mark_binop_15.nft
 create mode 100755 tests/shell/testcases/packetpath/bitwise_map_operand
 create mode 100644 tests/shell/testcases/packetpath/dumps/bitwise_map_operand.json-nft
 create mode 100644 tests/shell/testcases/packetpath/dumps/bitwise_map_operand.nft

diff --git a/tests/shell/testcases/bitwise/0040mark_binop_14 b/tests/shell/testcases/bitwise/0040mark_binop_14
new file mode 100755
index 00000000..e244ca53
--- /dev/null
+++ b/tests/shell/testcases/bitwise/0040mark_binop_14
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+# NFT_TEST_REQUIRES(NFT_TEST_HAVE_bitwise_multireg)
+
+set -e
+
+RULESET="
+  add table t
+  add chain t c { type filter hook output priority filter; }
+  add map t m { type ipv4_addr . ipv4_addr : mark; flags interval; }
+  add rule t c meta mark set meta mark and 0xffffff80 or (ip daddr . ip saddr map @m)
+"
+
+$NFT -f - <<< "$RULESET"
diff --git a/tests/shell/testcases/bitwise/0040mark_binop_15 b/tests/shell/testcases/bitwise/0040mark_binop_15
new file mode 100755
index 00000000..e696d200
--- /dev/null
+++ b/tests/shell/testcases/bitwise/0040mark_binop_15
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# NFT_TEST_REQUIRES(NFT_TEST_HAVE_bitwise_multireg)
+
+set -e
+
+RULESET="
+  add table t
+  add chain t c { type filter hook output priority filter; }
+  add rule t c ct mark set (ip daddr map { 10.0.0.1 : 0x1, 10.0.0.2 : 0x2 }) or ct mark and 0xfffffffc
+"
+
+$NFT -f - <<< "$RULESET"
diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_14.json-nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_14.json-nft
new file mode 100644
index 00000000..4613254f
--- /dev/null
+++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_14.json-nft
@@ -0,0 +1,100 @@
+{
+  "nftables": [
+    {
+      "metainfo": {
+        "version": "VERSION",
+        "release_name": "RELEASE_NAME",
+        "json_schema_version": 1
+      }
+    },
+    {
+      "table": {
+        "family": "ip",
+        "name": "t",
+        "handle": 0
+      }
+    },
+    {
+      "chain": {
+        "family": "ip",
+        "table": "t",
+        "name": "c",
+        "handle": 0,
+        "type": "filter",
+        "hook": "output",
+        "prio": 0,
+        "policy": "accept"
+      }
+    },
+    {
+      "map": {
+        "family": "ip",
+        "name": "m",
+        "table": "t",
+        "type": [
+          "ipv4_addr",
+          "ipv4_addr"
+        ],
+        "handle": 0,
+        "map": "mark",
+        "flags": [
+          "interval"
+        ]
+      }
+    },
+    {
+      "rule": {
+        "family": "ip",
+        "table": "t",
+        "chain": "c",
+        "handle": 0,
+        "expr": [
+          {
+            "mangle": {
+              "key": {
+                "meta": {
+                  "key": "mark"
+                }
+              },
+              "value": {
+                "|": [
+                  {
+                    "&": [
+                      {
+                        "meta": {
+                          "key": "mark"
+                        }
+                      },
+                      4294967168
+                    ]
+                  },
+                  {
+                    "map": {
+                      "key": {
+                        "concat": [
+                          {
+                            "payload": {
+                              "protocol": "ip",
+                              "field": "daddr"
+                            }
+                          },
+                          {
+                            "payload": {
+                              "protocol": "ip",
+                              "field": "saddr"
+                            }
+                          }
+                        ]
+                      },
+                      "data": "@m"
+                    }
+                  }
+                ]
+              }
+            }
+          }
+        ]
+      }
+    }
+  ]
+}
diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_14.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_14.nft
new file mode 100644
index 00000000..739537d6
--- /dev/null
+++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_14.nft
@@ -0,0 +1,11 @@
+table ip t {
+	map m {
+		type ipv4_addr . ipv4_addr : mark
+		flags interval
+	}
+
+	chain c {
+		type filter hook output priority filter; policy accept;
+		meta mark set meta mark & 0xffffff80 | (ip daddr . ip saddr map @m)
+	}
+}
diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_15.json-nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_15.json-nft
new file mode 100644
index 00000000..a05277e3
--- /dev/null
+++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_15.json-nft
@@ -0,0 +1,85 @@
+{
+  "nftables": [
+    {
+      "metainfo": {
+        "version": "VERSION",
+        "release_name": "RELEASE_NAME",
+        "json_schema_version": 1
+      }
+    },
+    {
+      "table": {
+        "family": "ip",
+        "name": "t",
+        "handle": 0
+      }
+    },
+    {
+      "chain": {
+        "family": "ip",
+        "table": "t",
+        "name": "c",
+        "handle": 0,
+        "type": "filter",
+        "hook": "output",
+        "prio": 0,
+        "policy": "accept"
+      }
+    },
+    {
+      "rule": {
+        "family": "ip",
+        "table": "t",
+        "chain": "c",
+        "handle": 0,
+        "expr": [
+          {
+            "mangle": {
+              "key": {
+                "ct": {
+                  "key": "mark"
+                }
+              },
+              "value": {
+                "|": [
+                  {
+                    "map": {
+                      "key": {
+                        "payload": {
+                          "protocol": "ip",
+                          "field": "daddr"
+                        }
+                      },
+                      "data": {
+                        "set": [
+                          [
+                            "10.0.0.1",
+                            1
+                          ],
+                          [
+                            "10.0.0.2",
+                            2
+                          ]
+                        ]
+                      }
+                    }
+                  },
+                  {
+                    "&": [
+                      {
+                        "ct": {
+                          "key": "mark"
+                        }
+                      },
+                      4294967292
+                    ]
+                  }
+                ]
+              }
+            }
+          }
+        ]
+      }
+    }
+  ]
+}
diff --git a/tests/shell/testcases/bitwise/dumps/0040mark_binop_15.nft b/tests/shell/testcases/bitwise/dumps/0040mark_binop_15.nft
new file mode 100644
index 00000000..c77a9b90
--- /dev/null
+++ b/tests/shell/testcases/bitwise/dumps/0040mark_binop_15.nft
@@ -0,0 +1,6 @@
+table ip t {
+	chain c {
+		type filter hook output priority filter; policy accept;
+		ct mark set (ip daddr map { 10.0.0.1 : 0x00000001, 10.0.0.2 : 0x00000002 }) | ct mark & 0xfffffffc
+	}
+}
diff --git a/tests/shell/testcases/packetpath/bitwise_map_operand b/tests/shell/testcases/packetpath/bitwise_map_operand
new file mode 100755
index 00000000..aeed0817
--- /dev/null
+++ b/tests/shell/testcases/packetpath/bitwise_map_operand
@@ -0,0 +1,62 @@
+#!/bin/bash
+
+# NFT_TEST_REQUIRES(NFT_TEST_HAVE_bitwise_multireg)
+
+set -e
+ret=0
+
+ip link set lo up
+
+$NFT -f - <<EOF
+table ip test-binop {
+	map m {
+		type ipv4_addr . ipv4_addr : mark
+		flags interval
+		elements = { 127.0.0.1 . 127.0.0.0/8 : 0x3 }
+	}
+
+	chain in {
+		type filter hook input priority 0
+
+		icmp type echo-request meta mark 0x4003 counter
+		icmp type echo-request meta mark 0x4005 counter
+	}
+
+	chain out {
+		type filter hook output priority 0
+
+		icmp type echo-request meta mark set 0x4005
+		icmp type echo-request meta mark set meta mark & 0xffffff80 | (ip daddr . ip saddr map @m)
+	}
+}
+EOF
+
+test_match()
+{
+	mark="$1"
+	packets="$2"
+	str=$(printf "mark 0x%08x" $mark)
+
+	if ! $NFT list chain test-binop in | grep "$str" | grep "packets $packets"; then
+		$NFT list chain test-binop in
+		echo "Failed counter for mark $mark: not $packets"
+		ret=1
+	fi
+}
+
+test_ping_and_match()
+{
+	ping="$1"
+	mark="$2"
+	packets="$3"
+
+	ping -q -c 1 "$ping"
+	test_match "$mark" "$packets"
+}
+
+# map hit: low 7 bits replaced by the map value, upper bits kept
+test_ping_and_match "127.0.0.1" 0x4003 1
+# map miss: the lookup breaks the rule, mark is left as is
+test_ping_and_match "127.0.0.2" 0x4005 1
+
+exit $ret
diff --git a/tests/shell/testcases/packetpath/dumps/bitwise_map_operand.json-nft b/tests/shell/testcases/packetpath/dumps/bitwise_map_operand.json-nft
new file mode 100644
index 00000000..64e472d5
--- /dev/null
+++ b/tests/shell/testcases/packetpath/dumps/bitwise_map_operand.json-nft
@@ -0,0 +1,250 @@
+{
+  "nftables": [
+    {
+      "metainfo": {
+        "version": "VERSION",
+        "release_name": "RELEASE_NAME",
+        "json_schema_version": 1
+      }
+    },
+    {
+      "table": {
+        "family": "ip",
+        "name": "test-binop",
+        "handle": 0
+      }
+    },
+    {
+      "chain": {
+        "family": "ip",
+        "table": "test-binop",
+        "name": "in",
+        "handle": 0,
+        "type": "filter",
+        "hook": "input",
+        "prio": 0,
+        "policy": "accept"
+      }
+    },
+    {
+      "chain": {
+        "family": "ip",
+        "table": "test-binop",
+        "name": "out",
+        "handle": 0,
+        "type": "filter",
+        "hook": "output",
+        "prio": 0,
+        "policy": "accept"
+      }
+    },
+    {
+      "map": {
+        "family": "ip",
+        "name": "m",
+        "table": "test-binop",
+        "type": [
+          "ipv4_addr",
+          "ipv4_addr"
+        ],
+        "handle": 0,
+        "map": "mark",
+        "flags": [
+          "interval"
+        ],
+        "elem": [
+          [
+            {
+              "concat": [
+                "127.0.0.1",
+                {
+                  "prefix": {
+                    "addr": "127.0.0.0",
+                    "len": 8
+                  }
+                }
+              ]
+            },
+            3
+          ]
+        ]
+      }
+    },
+    {
+      "rule": {
+        "family": "ip",
+        "table": "test-binop",
+        "chain": "in",
+        "handle": 0,
+        "expr": [
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "payload": {
+                  "protocol": "icmp",
+                  "field": "type"
+                }
+              },
+              "right": "echo-request"
+            }
+          },
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "meta": {
+                  "key": "mark"
+                }
+              },
+              "right": 16387
+            }
+          },
+          {
+            "counter": {
+              "packets": 1,
+              "bytes": 84
+            }
+          }
+        ]
+      }
+    },
+    {
+      "rule": {
+        "family": "ip",
+        "table": "test-binop",
+        "chain": "in",
+        "handle": 0,
+        "expr": [
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "payload": {
+                  "protocol": "icmp",
+                  "field": "type"
+                }
+              },
+              "right": "echo-request"
+            }
+          },
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "meta": {
+                  "key": "mark"
+                }
+              },
+              "right": 16389
+            }
+          },
+          {
+            "counter": {
+              "packets": 1,
+              "bytes": 84
+            }
+          }
+        ]
+      }
+    },
+    {
+      "rule": {
+        "family": "ip",
+        "table": "test-binop",
+        "chain": "out",
+        "handle": 0,
+        "expr": [
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "payload": {
+                  "protocol": "icmp",
+                  "field": "type"
+                }
+              },
+              "right": "echo-request"
+            }
+          },
+          {
+            "mangle": {
+              "key": {
+                "meta": {
+                  "key": "mark"
+                }
+              },
+              "value": 16389
+            }
+          }
+        ]
+      }
+    },
+    {
+      "rule": {
+        "family": "ip",
+        "table": "test-binop",
+        "chain": "out",
+        "handle": 0,
+        "expr": [
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "payload": {
+                  "protocol": "icmp",
+                  "field": "type"
+                }
+              },
+              "right": "echo-request"
+            }
+          },
+          {
+            "mangle": {
+              "key": {
+                "meta": {
+                  "key": "mark"
+                }
+              },
+              "value": {
+                "|": [
+                  {
+                    "&": [
+                      {
+                        "meta": {
+                          "key": "mark"
+                        }
+                      },
+                      4294967168
+                    ]
+                  },
+                  {
+                    "map": {
+                      "key": {
+                        "concat": [
+                          {
+                            "payload": {
+                              "protocol": "ip",
+                              "field": "daddr"
+                            }
+                          },
+                          {
+                            "payload": {
+                              "protocol": "ip",
+                              "field": "saddr"
+                            }
+                          }
+                        ]
+                      },
+                      "data": "@m"
+                    }
+                  }
+                ]
+              }
+            }
+          }
+        ]
+      }
+    }
+  ]
+}
diff --git a/tests/shell/testcases/packetpath/dumps/bitwise_map_operand.nft b/tests/shell/testcases/packetpath/dumps/bitwise_map_operand.nft
new file mode 100644
index 00000000..75d27615
--- /dev/null
+++ b/tests/shell/testcases/packetpath/dumps/bitwise_map_operand.nft
@@ -0,0 +1,19 @@
+table ip test-binop {
+	map m {
+		type ipv4_addr . ipv4_addr : mark
+		flags interval
+		elements = { 127.0.0.1 . 127.0.0.0/8 : 0x00000003 }
+	}
+
+	chain in {
+		type filter hook input priority filter; policy accept;
+		icmp type echo-request meta mark 0x00004003 counter packets 1 bytes 84
+		icmp type echo-request meta mark 0x00004005 counter packets 1 bytes 84
+	}
+
+	chain out {
+		type filter hook output priority filter; policy accept;
+		icmp type echo-request meta mark set 0x00004005
+		icmp type echo-request meta mark set meta mark & 0xffffff80 | (ip daddr . ip saddr map @m)
+	}
+}
-- 
2.56.0