From f1a02b3aba5f57e7359f15d7f4250ac3835ebf61 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 23 Sep 2022 14:17:25 +0200 Subject: tests: extend native delinearize script Feed nft-generated ruleset to iptables-nft. At this time, this will NOT pass. because dissector can handle meta l4proto tcp ip saddr 1.2.3.4 but not ip saddr 1.2.3.4 meta l4proto tcp In the latter case, iptables-nft picks up the immediate value (6) as the ip address, because the first one (1.2.3.4) gets moved as PAYLOAD_PREV due to missing 'removal' of the CTX_PAYLOAD flag. This is error prone, so lets rewrite the dissector to track each register separately and auto-clear state on writes. Signed-off-by: Florian Westphal Acked-by: Phil Sutter --- .../shell/testcases/nft-only/0010-nft-native.txt | 41 ++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 iptables/tests/shell/testcases/nft-only/0010-nft-native.txt (limited to 'iptables/tests/shell/testcases/nft-only/0010-nft-native.txt') diff --git a/iptables/tests/shell/testcases/nft-only/0010-nft-native.txt b/iptables/tests/shell/testcases/nft-only/0010-nft-native.txt new file mode 100644 index 00000000..d37ce873 --- /dev/null +++ b/iptables/tests/shell/testcases/nft-only/0010-nft-native.txt @@ -0,0 +1,41 @@ +table ip filter { + chain INPUT { + type filter hook input priority filter; policy accept; + + ip saddr 1.2.3.4 tcp dport 23 accept + ip saddr 1.2.3.0/24 ip daddr 0.0.0.0 udp dport 67-69 drop + + ip saddr 1.0.0.0/8 ip daddr 0.0.0.0 tcp sport 1024-65535 tcp dport 443 tcp flags syn / syn,ack accept + tcp dport 443 tcp flags syn comment "checks if SYN bit is set" + tcp flags syn / syn,rst,ack,fin comment "same as iptables --syn" + tcp flags & syn == syn + tcp flags & (syn | ack) != (syn | ack ) + + ip daddr 0.0.0.0/1 ip ttl 1 drop + ip daddr 0.0.0.0/2 ip ttl > 2 accept + ip daddr 0.0.0.0/3 ip ttl < 254 accept + ip daddr 0.0.0.0/4 ip ttl != 255 drop + + ip daddr 8.0.0.0/5 icmp type 1 accept + ip daddr 8.0.0.0/6 icmp type 2 icmp code port-unreachable accept + ip daddr 10.0.0.0/7 icmp type echo-request accept + + meta pkttype broadcast accept + meta pkttype != host drop + + ip saddr 0.0.0.0/0 ip protocol tcp + ip daddr 0.0.0.0/1 ip protocol udp + } + + chain FORWARD { + type filter hook forward priority filter; + limit rate 10/day counter + udp dport 42 counter + + # FIXME: can't dissect plain syslog + # meta iif "lo" log prefix "just doing a log" level alert flags tcp sequence,options + + # iif, not iifname, and wildcard + meta iif "lo" oifname "lo*" log group 1 prefix "should use NFLOG" queue-threshold 42 snaplen 123 + } +} -- cgit v1.2.3