From 0c2dcbf984939d8473e0b429b41e41a36c8a64da Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 5 Apr 2023 13:18:24 +0200 Subject: tests: shell: Test for false-positive rule check Rule comparison in legacy ip6tables was broken by commit eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables"): A part of the rules' data was masked out for comparison by accident. Signed-off-by: Phil Sutter --- .../tests/shell/testcases/ip6tables/0005-rule-check_0 | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100755 iptables/tests/shell/testcases/ip6tables/0005-rule-check_0 (limited to 'iptables/tests/shell/testcases/ip6tables') diff --git a/iptables/tests/shell/testcases/ip6tables/0005-rule-check_0 b/iptables/tests/shell/testcases/ip6tables/0005-rule-check_0 new file mode 100755 index 00000000..cc8215bf --- /dev/null +++ b/iptables/tests/shell/testcases/ip6tables/0005-rule-check_0 @@ -0,0 +1,17 @@ +#!/bin/bash +# +# Test the fix in commit 78850e7dba64a ("ip6tables: Fix checking existence of +# rule"). Happens with legacy ip6tables only, but testing ip6tables-nft doesn't +# hurt. +# +# Code taken from https://bugzilla.netfilter.org/show_bug.cgi?id=1667 +# Thanks to Jonathan Caicedo for providing it. + +RULE='-p tcp --dport 81 -j DNAT --to-destination [::1]:81' + +$XT_MULTI ip6tables -t nat -N testchain || exit 1 +$XT_MULTI ip6tables -t nat -A testchain $RULE || exit 1 +$XT_MULTI ip6tables -t nat -C testchain $RULE || exit 1 + +$XT_MULTI ip6tables -t nat -C testchain ${RULE//81/82} 2>/dev/null && exit 1 +exit 0 -- cgit v1.2.3