From 50f40b2c05e11ab0276b2dd6d860855968358bb5 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Tue, 7 Nov 2023 12:15:39 +0100 Subject: arptables-txlate: add test cases Add test cases for libarpt_mangle and extend the generic tests to cover basic arptables matches. Note that there are several historic artefacts that could be revised. For example, arptables-legacy and arptables-nft both ignore "-p" instead of returning an error about an unsupported option. The ptype could be hard-wired to 0x800 and set unconditionally. OTOH, this should always match for ethernet arp packets anyway. Signed-off-by: Florian Westphal Signed-off-by: Phil Sutter --- extensions/generic.txlate | 6 ++++++ extensions/libarpt_mangle.txlate | 6 ++++++ xlate-test.py | 4 +++- 3 files changed, 15 insertions(+), 1 deletion(-) create mode 100644 extensions/libarpt_mangle.txlate diff --git a/extensions/generic.txlate b/extensions/generic.txlate index c24ed156..b79239f1 100644 --- a/extensions/generic.txlate +++ b/extensions/generic.txlate @@ -1,3 +1,9 @@ +arptables-translate -A OUTPUT --proto-type ipv4 -s 1.2.3.4 -j ACCEPT +nft 'add rule arp filter OUTPUT arp htype 1 arp hlen 6 arp plen 4 arp ptype 0x800 arp saddr ip 1.2.3.4 counter accept' + +arptables-translate -I OUTPUT -o oifname +nft 'insert rule arp filter OUTPUT oifname "oifname" arp htype 1 arp hlen 6 arp plen 4 counter' + iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT nft 'insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accept' diff --git a/extensions/libarpt_mangle.txlate b/extensions/libarpt_mangle.txlate new file mode 100644 index 00000000..e884d328 --- /dev/null +++ b/extensions/libarpt_mangle.txlate @@ -0,0 +1,6 @@ +arptables-translate -A OUTPUT -d 10.21.22.129 -j mangle --mangle-ip-s 10.21.22.161 +nft 'add rule arp filter OUTPUT arp htype 1 arp hlen 6 arp plen 4 arp daddr ip 10.21.22.129 counter arp saddr ip set 10.21.22.161 accept' +arptables-translate -A OUTPUT -d 10.2.22.129/24 -j mangle --mangle-ip-d 10.2.22.1 --mangle-target CONTINUE +nft 'add rule arp filter OUTPUT arp htype 1 arp hlen 6 arp plen 4 arp daddr ip 10.2.22.0/24 counter arp daddr ip set 10.2.22.1' +arptables-translate -A OUTPUT -d 10.2.22.129/24 -j mangle --mangle-ip-d 10.2.22.1 --mangle-mac-d a:b:c:d:e:f +nft 'add rule arp filter OUTPUT arp htype 1 arp hlen 6 arp plen 4 arp daddr ip 10.2.22.0/24 counter arp daddr ip set 10.2.22.1 arp daddr ether set 0a:0b:0c:0d:0e:0f accept' diff --git a/xlate-test.py b/xlate-test.py index 6a116598..ddd68b91 100755 --- a/xlate-test.py +++ b/xlate-test.py @@ -14,7 +14,7 @@ def run_proc(args, shell = False, input = None): output, error = process.communicate(input) return (process.returncode, output, error) -keywords = ("iptables-translate", "ip6tables-translate", "ebtables-translate") +keywords = ("iptables-translate", "ip6tables-translate", "arptables-translate", "ebtables-translate") xtables_nft_multi = 'xtables-nft-multi' if sys.stdout.isatty(): @@ -95,6 +95,8 @@ def test_one_replay(name, sourceline, expected, result): fam = "" if srccmd.startswith("ip6"): fam = "ip6 " + elif srccmd.startswith("arp"): + fam = "arp " elif srccmd.startswith("ebt"): fam = "bridge " -- cgit v1.2.3