diff options
| author | Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> | 2012-09-21 21:03:24 +0200 |
|---|---|---|
| committer | Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> | 2012-09-21 21:03:24 +0200 |
| commit | 3a3794573386d0cb2930a9daad5615036c06f4e2 (patch) | |
| tree | 52dc8066bff6301af9910a47f8e235336f77e8a8 /tests/iptables.sh | |
| parent | 3578220cf27c3e7017dd8af6b17c08218cf632d0 (diff) | |
Support to match elements marked with "nomatch" in hash:*net* sets
Exceptions can now be matched and we can branch according to the
possible cases:
a. match in the set if the element is not flagged as "nomatch"
b. match in the set if the element is flagged with "nomatch"
c. no match
i.e.
iptables ... -m set --match-set ... -j ...
iptables ... -m set --match-set ... --nomatch-entries -j ...
...
Diffstat (limited to 'tests/iptables.sh')
| -rwxr-xr-x | tests/iptables.sh | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/tests/iptables.sh b/tests/iptables.sh index 9b1c90c..63b0b92 100755 --- a/tests/iptables.sh +++ b/tests/iptables.sh @@ -59,6 +59,35 @@ start) -j LOG --log-prefix "in set list: " $cmd -A OUTPUT -d $NET -j DROP cat /dev/null > .foo.err + cat /dev/null > /var/log/kern.log + ;; +start_flags) + ../src/ipset n test hash:net $family 2>/dev/null + ../src/ipset a test 10.0.0.0/16 2>/dev/null + ../src/ipset a test 10.0.0.0/24 nomatch 2>/dev/null + ../src/ipset a test 10.0.0.1 2>/dev/null + $cmd -A INPUT ! -s 10.0.0.0/16 -j ACCEPT + $cmd -A INPUT -m set --match-set test src \ + -j LOG --log-prefix "in set test: " + $cmd -A INPUT -m set --match-set test src --return-nomatch \ + -j LOG --log-prefix "in set test-nomatch: " + $cmd -A INPUT -s 10.0.0.0/16 -j DROP + cat /dev/null > .foo.err + cat /dev/null > /var/log/kern.log + ;; +start_flags_reversed) + ../src/ipset n test hash:net $family 2>/dev/null + ../src/ipset a test 10.0.0.0/16 2>/dev/null + ../src/ipset a test 10.0.0.0/24 nomatch 2>/dev/null + ../src/ipset a test 10.0.0.1 2>/dev/null + $cmd -A INPUT ! -s 10.0.0.0/16 -j ACCEPT + $cmd -A INPUT -m set --match-set test src --return-nomatch \ + -j LOG --log-prefix "in set test-nomatch: " + $cmd -A INPUT -m set --match-set test src \ + -j LOG --log-prefix "in set test: " + $cmd -A INPUT -s 10.0.0.0/16 -j DROP + cat /dev/null > .foo.err + cat /dev/null > /var/log/kern.log ;; del) $cmd -F INPUT |