tests: extend native delinearize script

Feed nft-generated ruleset to iptables-nft.
At this time, this will NOT pass. because dissector can handle

  meta l4proto tcp ip saddr 1.2.3.4
but not
  ip saddr 1.2.3.4 meta l4proto tcp

In the latter case, iptables-nft picks up the immediate value (6) as the ip
address, because the first one (1.2.3.4) gets moved as PAYLOAD_PREV due to
missing 'removal' of the CTX_PAYLOAD flag.

This is error prone, so lets rewrite the dissector to track each
register separately and auto-clear state on writes.

Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Phil Sutter <phil@nwl.cc>

1 files changed, 2 insertions, 19 deletions

diff --git a/iptables/tests/shell/testcases/nft-only/0010-native-delinearize_0 b/iptables/tests/shell/testcases/nft-only/0010-native-delinearize_0
index cca36fd8..7859e76c 100755
--- a/iptables/tests/shell/testcases/nft-only/0010-native-delinearize_0
+++ b/iptables/tests/shell/testcases/nft-only/0010-native-delinearize_0
@@ -5,22 +5,5 @@ nft -v >/dev/null || exit 0
 
 set -e
 
-nft -f - <<EOF
-table ip filter {
-	chain FORWARD {
-		type filter hook forward priority filter;
-		limit rate 10/day counter
-		udp dport 42 counter
-	}
-}
-EOF
-
-EXPECT="*filter
-:INPUT ACCEPT [0:0]
-:FORWARD ACCEPT [0:0]
-:OUTPUT ACCEPT [0:0]
--A FORWARD -m limit --limit 10/day
--A FORWARD -p udp -m udp --dport 42
-COMMIT"
-
-diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables-save | grep -v '^#')
+unshare -n bash -c "nft -f $(dirname $0)/0010-nft-native.txt;
+  diff -u -Z $(dirname $0)/0010-iptables-nft-save.txt <($XT_MULTI iptables-save | grep -v '^#')"