blob: 77a2f110aeb924462d378881c538c47d908e7482 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
|
#!/bin/bash
# skeleton
$NFT -f /dev/stdin <<EOF || exit 1
table ip ipfoo {
map x {
type ipv4_addr : ipv4_addr
}
chain c {
type nat hook prerouting priority dstnat; policy accept;
meta iifname != "foobar" accept
dnat to ip daddr map @x
ip saddr 10.1.1.1 dnat to 10.2.3.4
ip saddr 10.1.1.2 tcp dport 42 dnat to 10.2.3.4:4242
}
}
EOF
# should fail: rule has no test for l4 protocol
$NFT add rule 'ip ipfoo c ip saddr 10.1.1.2 dnat to 10.2.3.4:4242' && exit 1
# should fail: map has wrong family: 4->6
$NFT add rule 'inet inetfoo c dnat to ip daddr map @x6' && exit 1
# should fail: map has wrong family: 6->4
$NFT add rule 'inet inetfoo c dnat to ip6 daddr map @x4' && exit 1
# should fail: rule has no test for l4 protocol
$NFT add rule 'inet inetfoo c ip6 saddr f0:0b::a3 dnat to [1c::3]:42' && exit 1
# should fail: rule has no test for l4 protocol, but map has inet_service
$NFT add rule 'inet inetfoo c dnat to ip daddr map @y4' && exit 1
# should fail: rule has test for l4 protocol, but map has wrong family: 4->6
$NFT add rule 'inet inetfoo c meta l4proto tcp dnat to ip daddr map @y6' && exit 1
# should fail: rule has test for l4 protocol, but map has wrong family: 6->4
$NFT add rule 'inet inetfoo c meta l4proto tcp dnat to ip6 daddr map @y4' && exit 1
# fail: inet_service, but expect ipv4_addr
$NFT -f /dev/stdin <<EOF && exit 1
table inet inetfoo {
map a {
type ipv4_addr : inet_service
}
chain c {
type nat hook prerouting priority dstnat; policy accept;
meta l4proto tcp dnat ip to ip saddr map @a
}
}
EOF
# fail: maps to inet_service . inet_service, not addr . service
$NFT -f /dev/stdin <<EOF && exit 1
table inet inetfoo {
map b {
type ipv4_addr : inet_service . inet_service
}
chain c {
type nat hook prerouting priority dstnat; policy accept;
meta l4proto tcp dnat ip to ip saddr map @a
}
}
EOF
# fail: only accept exactly two sub-expressions: 'addr . service'
$NFT -f /dev/stdin <<EOF && exit 1
table inet inetfoo {
map b {
type ipv4_addr : inet_addr . inet_service . inet_service
}
chain c {
type nat hook prerouting priority dstnat; policy accept;
meta l4proto tcp dnat ip to ip saddr map @a
}
}
EOF
exit 0
|
