From f1a02b3aba5f57e7359f15d7f4250ac3835ebf61 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 23 Sep 2022 14:17:25 +0200 Subject: tests: extend native delinearize script Feed nft-generated ruleset to iptables-nft. At this time, this will NOT pass. because dissector can handle meta l4proto tcp ip saddr 1.2.3.4 but not ip saddr 1.2.3.4 meta l4proto tcp In the latter case, iptables-nft picks up the immediate value (6) as the ip address, because the first one (1.2.3.4) gets moved as PAYLOAD_PREV due to missing 'removal' of the CTX_PAYLOAD flag. This is error prone, so lets rewrite the dissector to track each register separately and auto-clear state on writes. Signed-off-by: Florian Westphal Acked-by: Phil Sutter --- .../testcases/nft-only/0010-native-delinearize_0 | 21 ++------------------- 1 file changed, 2 insertions(+), 19 deletions(-) (limited to 'iptables/tests/shell/testcases/nft-only/0010-native-delinearize_0') diff --git a/iptables/tests/shell/testcases/nft-only/0010-native-delinearize_0 b/iptables/tests/shell/testcases/nft-only/0010-native-delinearize_0 index cca36fd8..7859e76c 100755 --- a/iptables/tests/shell/testcases/nft-only/0010-native-delinearize_0 +++ b/iptables/tests/shell/testcases/nft-only/0010-native-delinearize_0 @@ -5,22 +5,5 @@ nft -v >/dev/null || exit 0 set -e -nft -f - <