#!/bin/bash

# skeleton
$NFT -f /dev/stdin <<EOF || exit 1
table ip ipfoo {
	map t1 {
		typeof numgen inc mod 2 : ip daddr;
	}

	map t2 {
		typeof numgen inc mod 2 : ip daddr . tcp dport
	}

	map x {
		type ipv4_addr : ipv4_addr
	}
	map y {
		type ipv4_addr : ipv4_addr . inet_service
		elements = { 192.168.7.2 : 10.1.1.1 . 4242 }
	}
	map z {
		type ipv4_addr . inet_service : ipv4_addr . inet_service
		elements = { 192.168.7.2 . 42 : 10.1.1.1 . 4242 }
	}

	chain c {
		type nat hook prerouting priority dstnat; policy accept;
		meta iifname != "foobar" accept
		dnat to ip daddr map @x
		ip saddr 10.1.1.1 dnat to 10.2.3.4
		ip saddr 10.1.1.2 tcp dport 42 dnat to 10.2.3.4:4242
		meta l4proto tcp dnat ip addr . port to ip saddr map @y
		meta l4proto tcp dnat ip addr . port to ip saddr . tcp dport map @z
		dnat ip to numgen inc mod 2 map @t1
		meta l4proto tcp dnat ip addr . port to numgen inc mod 2 map @t2
	}
}
EOF

# should fail: rule has no test for l4 protocol
$NFT add rule 'ip ipfoo c ip saddr 10.1.1.2 dnat to 10.2.3.4:4242' && exit 1

# should fail: rule has no test for l4 protocol, but map has inet_service
$NFT add rule 'ip ipfoo c dnat to ip daddr map @y' && exit 1

# skeleton 6
$NFT -f /dev/stdin <<EOF || exit 1
table ip6 ip6foo {
	map t1 {
		typeof numgen inc mod 2 : ip6 daddr;
	}

	map t2 {
		typeof numgen inc mod 2 : ip6 daddr . tcp dport
	}

	map x {
		type ipv6_addr : ipv6_addr
	}
	map y {
		type ipv6_addr : ipv6_addr . inet_service
	}
	map z {
		type ipv6_addr . inet_service : ipv6_addr . inet_service
	}

	chain c {
		type nat hook prerouting priority dstnat; policy accept;
		meta iifname != "foobar" accept
		dnat to ip6 daddr map @x
		ip6 saddr dead::1 dnat to feed::1
		ip6 saddr dead::2 tcp dport 42 dnat to [c0::1a]:4242
		meta l4proto tcp dnat ip6 addr . port to ip6 saddr map @y
		meta l4proto tcp dnat ip6 addr . port to ip6 saddr . tcp dport map @z
		dnat ip6 to numgen inc mod 2 map @t1
		meta l4proto tcp dnat ip6 addr . port to numgen inc mod 2 map @t2
	}
}
EOF

# should fail: rule has no test for l4 protocol
$NFT add rule 'ip6 ip6foo c ip6 saddr f0:0b::a3 dnat to [1c::3]:42' && exit 1

# should fail: rule has no test for l4 protocol, but map has inet_service
$NFT add rule 'ip6 ip6foo c dnat to ip daddr map @y' && exit 1

# skeleton inet
$NFT -f /dev/stdin <<EOF || exit 1
table inet inetfoo {
	map t1v4 {
		typeof numgen inc mod 2 : ip daddr
	}

	map t2v4 {
		typeof numgen inc mod 2 : ip daddr . tcp dport;
	}

	map t1v6 {
		typeof numgen inc mod 2 : ip6 daddr;
	}

	map t2v6 {
		typeof numgen inc mod 2 : ip6 daddr . tcp dport
	}

	map x4 {
		type ipv4_addr : ipv4_addr
	}
	map y4 {
		type ipv4_addr : ipv4_addr . inet_service
	}
	map z4 {
		type ipv4_addr . inet_service : ipv4_addr . inet_service
		elements = { 192.168.7.2 . 42 : 10.1.1.1 . 4242 }
	}
	map x6 {
		type ipv6_addr : ipv6_addr
	}
	map y6 {
		type ipv6_addr : ipv6_addr . inet_service
	}
	map z6 {
		type ipv6_addr . inet_service : ipv6_addr . inet_service
	}

	chain c {
		type nat hook prerouting priority dstnat; policy accept;
		meta iifname != "foobar" accept
		dnat ip to ip daddr map @x4
		ip saddr 10.1.1.1 dnat to 10.2.3.4
		ip saddr 10.1.1.2 tcp dport 42 dnat to 10.2.3.4:4242
		meta l4proto tcp dnat ip addr . port to ip saddr map @y4
		meta l4proto tcp dnat ip addr . port to ip saddr . tcp dport map @z4
		dnat ip to numgen inc mod 2 map @t1v4
		meta l4proto tcp dnat ip addr . port to numgen inc mod 2 map @t2v4
		dnat ip6 to ip6 daddr map @x6
		ip6 saddr dead::1 dnat to feed::1
		ip6 saddr dead::2 tcp dport 42 dnat to [c0::1a]:4242
		meta l4proto tcp dnat ip6 addr . port to ip6 saddr map @y6
		meta l4proto tcp dnat ip6 addr . port to ip6 saddr . tcp dport map @z6
		dnat ip6 to numgen inc mod 2 map @t1v6
		meta l4proto tcp dnat ip6 addr . port to numgen inc mod 2 map @t2v6
	}
}
EOF

# should fail: map has wrong family: 4->6
$NFT add rule 'inet inetfoo c dnat to ip daddr map @x6' && exit 1

# should fail: map has wrong family: 6->4
$NFT add rule 'inet inetfoo c dnat to ip6 daddr map @x4' && exit 1

# should fail: rule has no test for l4 protocol
$NFT add rule 'inet inetfoo c ip6 saddr f0:0b::a3 dnat to [1c::3]:42' && exit 1

# should fail: rule has no test for l4 protocol, but map has inet_service
$NFT add rule 'inet inetfoo c dnat to ip daddr map @y4' && exit 1

# should fail: rule has test for l4 protocol, but map has wrong family: 4->6
$NFT add rule 'inet inetfoo c meta l4proto tcp dnat to ip daddr map @y6' && exit 1

# should fail: rule has test for l4 protocol, but map has wrong family: 6->4
$NFT add rule 'inet inetfoo c meta l4proto tcp dnat to ip6 daddr map @y4' && exit 1

# fail: inet_service, but expect ipv4_addr
$NFT -f /dev/stdin <<EOF && exit 1
table inet inetfoo {
	map a {
		type ipv4_addr : inet_service
	}

	chain c {
		type nat hook prerouting priority dstnat; policy accept;
		meta l4proto tcp dnat ip to ip saddr map @a
	}
}
EOF

# fail: maps to inet_service . inet_service, not addr . service
$NFT -f /dev/stdin <<EOF && exit 1
table inet inetfoo {
	map b {
		type ipv4_addr : inet_service . inet_service
	}

	chain c {
		type nat hook prerouting priority dstnat; policy accept;
		meta l4proto tcp dnat ip to ip saddr map @a
	}
}
EOF

# fail: only accept exactly two sub-expressions: 'addr . service'
$NFT -f /dev/stdin <<EOF && exit 1
table inet inetfoo {
	map b {
		type ipv4_addr : inet_addr . inet_service . inet_service
	}

	chain c {
		type nat hook prerouting priority dstnat; policy accept;
		meta l4proto tcp dnat ip to ip saddr map @a
	}
}
EOF

exit 0