summaryrefslogtreecommitdiffstats
path: root/extensions/generic.txlate
Commit message (Collapse)AuthorAgeFilesLines
* xtables-translate: Leverage stored protocol namesPhil Sutter2024-02-291-0/+30
| | | | | | | | | | | Align output of ip(6)tables-translate for --protocol arguments with that of ip(6)tables -L/-S by calling proto_to_name() from xshared.c. The latter will consult xtables_chain_protos list first to make sure (the right) names are used for "common" protocol values and otherwise falls back to getprotobynumber() which it replaces here. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1738 Signed-off-by: Phil Sutter <phil@nwl.cc>
* arptables-txlate: add test casesFlorian Westphal2023-11-071-0/+6
| | | | | | | | | | | | | | | Add test cases for libarpt_mangle and extend the generic tests to cover basic arptables matches. Note that there are several historic artefacts that could be revised. For example, arptables-legacy and arptables-nft both ignore "-p" instead of returning an error about an unsupported option. The ptype could be hard-wired to 0x800 and set unconditionally. OTOH, this should always match for ethernet arp packets anyway. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Fix MAC address match translationPhil Sutter2022-12-021-1/+1
| | | | | | | If a mask was present, ebtables-translate would emit illegal syntax. Fixes: 5e2b473a64bc7 ("xtables-compat: extend generic tests for masks and wildcards") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Fix for interfaces with asterisk mid-stringPhil Sutter2022-12-021-7/+7
| | | | | | | | | | | | | For nft, asterisk is special at end of the interface name only. Escaping it mid-string makes the escape char part of the interface name, so avoid this. In the test case, also drop the ticks around interface names in *-translate command - since there's no shell involved which would eat them, they become part of the interface name. Fixes: e179e87a1179e ("xtables-translate: Fix for interface name corner-cases") Signed-off-by: Phil Sutter <phil@nwl.cc>
* extensions: change expected output for new formatFlorian Westphal2022-11-301-28/+28
| | | | | | | | Now that xtables-translate encloses the entire command line in ', update the test cases accordingly. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* ebtables: Support '-p Length'Phil Sutter2022-09-281-0/+6
| | | | | | | | | | | | | | | | | | To match on Ethernet frames using the etherproto field as length value, ebtables accepts the special protocol name "LENGTH". Implement this in ebtables-nft using a native match for 'ether type < 0x0600'. Since extension 802_3 matches are valid only with such Ethernet frames, add a local add_match() wrapper which complains if the extension is used without '-p Length' parameter. Legacy ebtables does this within the extension's final_check callback, but it's not possible here due for lack of fw->bitmask field access. While being at it, add xlate support, adjust tests and make ebtables-nft print the case-insensitive argument with capital 'L' like legacy ebtables does. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Fix translation of odd netmasksPhil Sutter2021-03-091-0/+48
| | | | | | | | | Iptables supports netmasks which are not prefixes to match on (or ignore) arbitrary bits in an address. Yet nftables' prefix notation is available for real prefixes only, so translation is not as trivial - print bitmask syntax for those cases. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Fix for iface++Phil Sutter2020-02-141-0/+4
| | | | | | | | | In legacy iptables, only the last plus sign remains special, any previous ones are taken literally. Therefore xtables-translate must not replace all of them with asterisk but just the last one. Fixes: e179e87a1179e ("xtables-translate: Fix for interface name corner-cases") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-translate: Fix for interface name corner-casesPhil Sutter2020-02-111-0/+12
| | | | | | | | | | | | | | | | | | There are two special situations xlate_ifname() didn't cover for: * Interface name containing '*': This went unchanged, creating a command nft wouldn't accept. Instead translate into '\*' which doesn't change semantics. * Interface name being '+': Can't translate into nft wildcard character as nft doesn't accept asterisk-only interface names. Instead decide what to do based on 'invert' value: Skip match creation if false, match against an invalid interface name if true. Also add a test to make sure future changes to this behaviour are noticed. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables-compat: extend generic tests for masks and wildcardsFlorian Westphal2018-05-151-0/+15
| | | | | | This uncovered broken translation of ethernet + mask. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add regression tests for xtables-translatePablo M. Bermudo Garay2017-04-071-0/+5
This test suite is intended to detect regressions in the translation infrastructure. The script checks if ip[6]tables-translate produces the expected output, otherwise it prints the wrong translation and the expected one. ** Arguments --all # Show also passed tests [test] # Run only the specified test file ** Test files structure Test files are located under extensions directory. Every file contains tests about specific extension translations. A test file name must end with ".txlate". Inside the files, every single test is defined by two consecutive lines: ip[6]tables-translate command and expected result. One blank line is left between tests by convention. e.g. $ cat extensions/libxt_cpu.txlate iptables-translate -A INPUT -p tcp --dport 80 -m cpu --cpu 0 -j ACCEPT nft add rule ip filter INPUT tcp dport 80 cpu 0 counter accept iptables-translate -A INPUT -p tcp --dport 80 -m cpu ! --cpu 1 -j ACCEPT nft add rule ip filter INPUT tcp dport 80 cpu != 1 counter accept Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>