diff options
| author | Florian Westphal <fw@strlen.de> | 2023-11-07 12:15:39 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2023-11-07 23:40:14 +0100 |
| commit | 50f40b2c05e11ab0276b2dd6d860855968358bb5 (patch) | |
| tree | 29f98b7c1600958e9f8d7280dd83ecae0d33475e /extensions/generic.txlate | |
| parent | 5b7324e0675e332ae186e1bd6978aa320f628086 (diff) | |
arptables-txlate: add test cases
Add test cases for libarpt_mangle and extend the generic
tests to cover basic arptables matches.
Note that there are several historic artefacts that could be revised.
For example, arptables-legacy and arptables-nft both ignore "-p"
instead of returning an error about an unsupported option.
The ptype could be hard-wired to 0x800 and set unconditionally.
OTOH, this should always match for ethernet arp packets anyway.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'extensions/generic.txlate')
| -rw-r--r-- | extensions/generic.txlate | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/extensions/generic.txlate b/extensions/generic.txlate index c24ed156..b79239f1 100644 --- a/extensions/generic.txlate +++ b/extensions/generic.txlate @@ -1,3 +1,9 @@ +arptables-translate -A OUTPUT --proto-type ipv4 -s 1.2.3.4 -j ACCEPT +nft 'add rule arp filter OUTPUT arp htype 1 arp hlen 6 arp plen 4 arp ptype 0x800 arp saddr ip 1.2.3.4 counter accept' + +arptables-translate -I OUTPUT -o oifname +nft 'insert rule arp filter OUTPUT oifname "oifname" arp htype 1 arp hlen 6 arp plen 4 counter' + iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT nft 'insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accept' |