[PATCH nft] tests: shell: add template match bug test

Florian Westphal <[email protected]> Thu, 16 Jul 2026 11:10:32 +0200
Newsgroups gmane.comp.security.firewalls.netfilter.devel
Message-ID <[email protected]>
Template should not be matched via "ct" expression.  Else this
makes us read an l3num of 0.  This is a test for kernel commit
3027ecbdb5fd ("netfilter: nft_ct: bail out on template ct in get eval").

Signed-off-by: Florian Westphal <[email protected]>
---
 .../packetpath/dumps/nft_ct_template.json-nft | 252 ++++++++++++++++++
 .../packetpath/dumps/nft_ct_template.nft      |  22 ++
 .../testcases/packetpath/nft_ct_template      |  38 +++
 3 files changed, 312 insertions(+)
 create mode 100644 tests/shell/testcases/packetpath/dumps/nft_ct_template.json-nft
 create mode 100644 tests/shell/testcases/packetpath/dumps/nft_ct_template.nft
 create mode 100755 tests/shell/testcases/packetpath/nft_ct_template

diff --git a/tests/shell/testcases/packetpath/dumps/nft_ct_template.json-nft b/tests/shell/testcases/packetpath/dumps/nft_ct_template.json-nft
new file mode 100644
index 000000000000..9c38046f5b7e
--- /dev/null
+++ b/tests/shell/testcases/packetpath/dumps/nft_ct_template.json-nft
@@ -0,0 +1,252 @@
+{
+  "nftables": [
+    {
+      "metainfo": {
+        "version": "VERSION",
+        "release_name": "RELEASE_NAME",
+        "json_schema_version": 1
+      }
+    },
+    {
+      "table": {
+        "family": "ip",
+        "name": "t",
+        "handle": 0
+      }
+    },
+    {
+      "chain": {
+        "family": "ip",
+        "table": "t",
+        "name": "c",
+        "handle": 0,
+        "type": "filter",
+        "hook": "output",
+        "prio": -300,
+        "policy": "accept"
+      }
+    },
+    {
+      "rule": {
+        "family": "ip",
+        "table": "t",
+        "chain": "c",
+        "handle": 0,
+        "expr": [
+          {
+            "mangle": {
+              "key": {
+                "ct": {
+                  "key": "zone"
+                }
+              },
+              "value": 1
+            }
+          }
+        ]
+      }
+    },
+    {
+      "rule": {
+        "family": "ip",
+        "table": "t",
+        "chain": "c",
+        "handle": 0,
+        "expr": [
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "ct": {
+                  "key": "saddr",
+                  "dir": "original"
+                }
+              },
+              "right": "0.0.0.0"
+            }
+          },
+          {
+            "counter": {
+              "packets": 0,
+              "bytes": 0
+            }
+          },
+          {
+            "accept": null
+          }
+        ]
+      }
+    },
+    {
+      "table": {
+        "family": "ip6",
+        "name": "t",
+        "handle": 0
+      }
+    },
+    {
+      "chain": {
+        "family": "ip6",
+        "table": "t",
+        "name": "c",
+        "handle": 0,
+        "type": "filter",
+        "hook": "output",
+        "prio": -300,
+        "policy": "accept"
+      }
+    },
+    {
+      "rule": {
+        "family": "ip6",
+        "table": "t",
+        "chain": "c",
+        "handle": 0,
+        "expr": [
+          {
+            "mangle": {
+              "key": {
+                "ct": {
+                  "key": "zone"
+                }
+              },
+              "value": 1
+            }
+          }
+        ]
+      }
+    },
+    {
+      "rule": {
+        "family": "ip6",
+        "table": "t",
+        "chain": "c",
+        "handle": 0,
+        "expr": [
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "ct": {
+                  "key": "saddr",
+                  "dir": "original"
+                }
+              },
+              "right": "::"
+            }
+          },
+          {
+            "counter": {
+              "packets": 0,
+              "bytes": 0
+            }
+          },
+          {
+            "accept": null
+          }
+        ]
+      }
+    },
+    {
+      "table": {
+        "family": "inet",
+        "name": "t",
+        "handle": 0
+      }
+    },
+    {
+      "chain": {
+        "family": "inet",
+        "table": "t",
+        "name": "c",
+        "handle": 0,
+        "type": "filter",
+        "hook": "output",
+        "prio": -300,
+        "policy": "accept"
+      }
+    },
+    {
+      "rule": {
+        "family": "inet",
+        "table": "t",
+        "chain": "c",
+        "handle": 0,
+        "expr": [
+          {
+            "mangle": {
+              "key": {
+                "ct": {
+                  "key": "zone"
+                }
+              },
+              "value": 1
+            }
+          }
+        ]
+      }
+    },
+    {
+      "rule": {
+        "family": "inet",
+        "table": "t",
+        "chain": "c",
+        "handle": 0,
+        "expr": [
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "ct": {
+                  "key": "ip saddr",
+                  "dir": "original"
+                }
+              },
+              "right": "0.0.0.0"
+            }
+          },
+          {
+            "counter": {
+              "packets": 0,
+              "bytes": 0
+            }
+          },
+          {
+            "accept": null
+          }
+        ]
+      }
+    },
+    {
+      "rule": {
+        "family": "inet",
+        "table": "t",
+        "chain": "c",
+        "handle": 0,
+        "expr": [
+          {
+            "match": {
+              "op": "==",
+              "left": {
+                "ct": {
+                  "key": "ip6 saddr",
+                  "dir": "original"
+                }
+              },
+              "right": "::"
+            }
+          },
+          {
+            "counter": {
+              "packets": 0,
+              "bytes": 0
+            }
+          },
+          {
+            "accept": null
+          }
+        ]
+      }
+    }
+  ]
+}
diff --git a/tests/shell/testcases/packetpath/dumps/nft_ct_template.nft b/tests/shell/testcases/packetpath/dumps/nft_ct_template.nft
new file mode 100644
index 000000000000..efe5dbb265a7
--- /dev/null
+++ b/tests/shell/testcases/packetpath/dumps/nft_ct_template.nft
@@ -0,0 +1,22 @@
+table ip t {
+	chain c {
+		type filter hook output priority raw; policy accept;
+		ct zone set 1
+		ct original ip saddr 0.0.0.0 counter packets 0 bytes 0 accept
+	}
+}
+table ip6 t {
+	chain c {
+		type filter hook output priority raw; policy accept;
+		ct zone set 1
+		ct original ip6 saddr :: counter packets 0 bytes 0 accept
+	}
+}
+table inet t {
+	chain c {
+		type filter hook output priority raw; policy accept;
+		ct zone set 1
+		ct original ip saddr 0.0.0.0 counter packets 0 bytes 0 accept
+		ct original ip6 saddr :: counter packets 0 bytes 0 accept
+	}
+}
diff --git a/tests/shell/testcases/packetpath/nft_ct_template b/tests/shell/testcases/packetpath/nft_ct_template
new file mode 100755
index 000000000000..02051f3345c9
--- /dev/null
+++ b/tests/shell/testcases/packetpath/nft_ct_template
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+# test for kernel commit 3027ecbdb5fd ("netfilter: nft_ct: bail out on template ct in get eval")
+
+set -e
+
+$NFT -f - <<EOF
+table ip t {
+	chain c {
+		type filter hook output priority -300; policy accept;
+		ct zone set 1
+		ct original saddr 0.0.0.0 counter accept
+	}
+}
+
+table ip6 t {
+	chain c {
+		type filter hook output priority -300; policy accept;
+		ct zone set 1
+		ct original saddr :: counter accept
+	}
+}
+
+table inet t {
+	chain c {
+		type filter hook output priority -300; policy accept;
+		ct zone set 1
+		ct original ip saddr 0.0.0.0 counter accept
+		ct original ip6 saddr :: counter accept
+	}
+}
+EOF
+
+ip link set lo up
+ping -c 1 127.0.0.1
+ping -c 1 ::1
+
+# counter validation via dump file.
-- 
2.55.0