summaryrefslogtreecommitdiffstats
path: root/tests
diff options
context:
space:
mode:
authorJozsef Kadlecsik <kadlec@blackhole.kfki.hu>2011-01-24 18:14:01 +0100
committerJozsef Kadlecsik <kadlec@blackhole.kfki.hu>2011-01-24 18:14:01 +0100
commitd3b9fa094d693f05a747eda21db715a5bbf8dbbc (patch)
tree769bba2b579d330d845d7279318e603db7fb8c03 /tests
parent15d91179ef61df920bf5e90bab538cb71f36d0f8 (diff)
Check ICMP and ICMPv6 with the set match and target in the testsuite
"sendip" needs data otherwise ICMP/ICMPv6 gets truncated...
Diffstat (limited to 'tests')
-rw-r--r--tests/match_target.t22
-rw-r--r--tests/match_target6.t22
2 files changed, 44 insertions, 0 deletions
diff --git a/tests/match_target.t b/tests/match_target.t
index 8c3f3f9..6756be1 100644
--- a/tests/match_target.t
+++ b/tests/match_target.t
@@ -1,21 +1,43 @@
# Create sets and inet rules which call set match and SET target
0 ./iptables.sh inet start
+# Check that 10.255.255.64,tcp:1025 is not in ipport set
+1 ipset test ipport 10.255.255.64,tcp:1025
# Send probe packet from 10.255.255.64,tcp:1025
0 sendip -p ipv4 -id 127.0.0.1 -is 10.255.255.64 -p tcp -td 80 -ts 1025 127.0.0.1
# Check that proper sets matched and target worked
0 ./check_klog.sh 10.255.255.64 tcp 1025 ipport list
+# Check that 10.255.255.64,tcp:1025 is in ipport set now
+0 ipset test ipport 10.255.255.64,tcp:1025
+# Check that 10.255.255.64,udp:1025 is not in ipport set
+1 ipset test ipport 10.255.255.64,udp:1025
# Send probe packet from 10.255.255.64,udp:1025
0 sendip -p ipv4 -id 127.0.0.1 -is 10.255.255.64 -p udp -ud 80 -us 1025 127.0.0.1
# Check that proper sets matched and target worked
0 ./check_klog.sh 10.255.255.64 udp 1025 ipport list
+# Check that 10.255.255.64,udp:1025 is in ipport set now
+0 ipset test ipport 10.255.255.64,udp:1025
+# Check that 10.255.255.1,tcp:1025 is not in ipport set
+1 ipset test ipport 10.255.255.1,tcp:1025
# Send probe packet from 10.255.255.1,tcp:1025
0 sendip -p ipv4 -id 127.0.0.1 -is 10.255.255.1 -p tcp -td 80 -ts 1025 127.0.0.1
# Check that proper sets matched and target worked
0 ./check_klog.sh 10.255.255.1 tcp 1025 ip1 list
+# Check that 10.255.255.1,tcp:1025 is not in ipport set
+1 ipset test ipport 10.255.255.1,tcp:1025
+# Check that 10.255.255.32,tcp:1025 is not in ipport set
+1 ipset test ipport 10.255.255.32,tcp:1025
# Send probe packet from 10.255.255.32,tcp:1025
0 sendip -p ipv4 -id 127.0.0.1 -is 10.255.255.32 -p tcp -td 80 -ts 1025 127.0.0.1
# Check that proper sets matched and target worked
0 ./check_klog.sh 10.255.255.32 tcp 1025 ip2
+# Check that 10.255.255.32,tcp:1025 is not in ipport set
+1 ipset test ipport 10.255.255.32,tcp:1025
+# Check that 10.255.255.64,icmp:host-prohibited is not in ipport set
+1 ipset test ipport 10.255.255.64,icmp:host-prohibited
+# Send probe packet 10.255.255.64,icmp:host-prohibited
+0 sendip -d r10 -p ipv4 -id 127.0.0.1 -is 10.255.255.64 -p icmp -ct 3 -cd 10 127.0.0.1
+# Check that 10.255.255.64,icmp:3/10 is in ipport set now
+0 ipset test ipport 10.255.255.64,icmp:host-prohibited
# Destroy sets and rules
0 ./iptables.sh inet stop
# eof
diff --git a/tests/match_target6.t b/tests/match_target6.t
index 58888bd..6f1fc3d 100644
--- a/tests/match_target6.t
+++ b/tests/match_target6.t
@@ -1,21 +1,43 @@
# Create sets and inet6 rules which call set match and SET target
0 ./iptables.sh inet6 start
+# Check that 1002:1002:1002:1002::64,tcp:1025 is not in ipport set
+1 ipset test ipport 1002:1002:1002:1002::64,tcp:1025
# Send probe packet from 1002:1002:1002:1002::64,tcp:1025
0 sendip -p ipv6 -6d ::1 -6s 1002:1002:1002:1002::64 -p tcp -td 80 -ts 1025 ::1
# Check that proper sets matched and target worked
0 ./check_klog.sh 1002:1002:1002:1002::64 tcp 1025 ipport list
+# Check that 1002:1002:1002:1002::64,tcp:1025 is in ipport set now
+0 ipset test ipport 1002:1002:1002:1002::64,tcp:1025
+# Check that 1002:1002:1002:1002::64,udp:1025 is not in ipport set
+1 ipset test ipport 1002:1002:1002:1002::64,udp:1025
# Send probe packet from 1002:1002:1002:1002::64,udp:1025
0 sendip -p ipv6 -6d ::1 -6s 1002:1002:1002:1002::64 -p udp -ud 80 -us 1025 ::1
# Check that proper sets matched and target worked
0 ./check_klog.sh 1002:1002:1002:1002::64 udp 1025 ipport list
+# Check that 1002:1002:1002:1002::64,udp:1025 is in ipport set now
+0 ipset test ipport 1002:1002:1002:1002::64,udp:1025
+# Check that 1002:1002:1002:1002::1,tcp:1025 is not in ipport set
+1 ipset test ipport 1002:1002:1002:1002::1,tcp:1025
# Send probe packet from 1002:1002:1002:1002::1,tcp:1025
0 sendip -p ipv6 -6d ::1 -6s 1002:1002:1002:1002::1 -p tcp -td 80 -ts 1025 ::1
# Check that proper sets matched and target worked
0 ./check_klog.sh 1002:1002:1002:1002::1 tcp 1025 ip1 list
+# Check that 1002:1002:1002:1002::1,tcp:1025 is not in ipport set
+1 ipset test ipport 1002:1002:1002:1002::1,tcp:1025
+# Check that 1002:1002:1002:1002::32,tcp:1025 is not in ipport set
+1 ipset test ipport 1002:1002:1002:1002::32,tcp:1025
# Send probe packet from 1002:1002:1002:1002::32,tcp:1025
0 sendip -p ipv6 -6d ::1 -6s 1002:1002:1002:1002::32 -p tcp -td 80 -ts 1025 ::1
# Check that proper sets matched and target worked
0 ./check_klog.sh 1002:1002:1002:1002::32 tcp 1025 ip2
+# Check that 1002:1002:1002:1002::32,tcp:1025 is not in ipport set
+1 ipset test ipport 1002:1002:1002:1002::32,tcp:1025
+# Check that 1002:1002:1002:1002::64,icmpv6:ttl-zero-during-reassembly is not in ipport set
+1 ipset test ipport 1002:1002:1002:1002::64,icmpv6:ttl-zero-during-reassembly
+# Send probe packet from 1002:1002:1002:1002::64,icmpv6:ttl-zero-during-reassembly
+0 sendip -d r10 -p ipv6 -6d ::1 -6s 1002:1002:1002:1002::64 -p icmp -ct 3 -cd 1 ::1
+# Check that 1002:1002:1002:1002::64,icmpv6:ttl-zero-during-reassembly is in ipport set now
+0 ipset test ipport 1002:1002:1002:1002::64,icmpv6:ttl-zero-during-reassembly
# Destroy sets and rules
0 ./iptables.sh inet6 stop
# eof