summaryrefslogtreecommitdiffstats
path: root/tests/py/bridge/reject.t.json
diff options
context:
space:
mode:
authorPhil Sutter <phil@nwl.cc>2018-08-13 18:58:57 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2018-08-14 16:17:32 +0200
commit8d2c3c72935443228b5e0492c8d3e2e2048c0c5a (patch)
tree7dca84cd3a7a5405e87fb0692db1a3410612b7f4 /tests/py/bridge/reject.t.json
parentc8a0e8c90e2d1188e6fcdd8951b295722e56d542 (diff)
evaluate: reject: Allow icmpx in inet/bridge families
Commit 3e6ab2b335142 added restraints on reject types for bridge and inet families but aparently those were too strict: If a rule in e.g. inet family contained a match which introduced a protocol dependency, icmpx type rejects were disallowed for no obvious reason. Allow icmpx type rejects in inet family regardless of protocol dependency since we either have IPv4 or IPv6 traffic in there and for both icmpx is fine. Merge restraints in bridge family with those for TCP reset since it already does what is needed, namely checking that ether proto is either IPv4 or IPv6. Fixes: 3e6ab2b335142 ("evaluate: reject: check in bridge and inet the network context in reject") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests/py/bridge/reject.t.json')
-rw-r--r--tests/py/bridge/reject.t.json44
1 files changed, 44 insertions, 0 deletions
diff --git a/tests/py/bridge/reject.t.json b/tests/py/bridge/reject.t.json
index aa716f80..c0bed56e 100644
--- a/tests/py/bridge/reject.t.json
+++ b/tests/py/bridge/reject.t.json
@@ -219,3 +219,47 @@
}
]
+# ether type ip reject with icmpx type admin-prohibited
+[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "ether"
+ }
+ },
+ "op": "==",
+ "right": "ip"
+ }
+ },
+ {
+ "reject": {
+ "expr": "admin-prohibited",
+ "type": "icmpx"
+ }
+ }
+]
+
+# ether type ip6 reject with icmpx type admin-prohibited
+[
+ {
+ "match": {
+ "left": {
+ "payload": {
+ "field": "type",
+ "protocol": "ether"
+ }
+ },
+ "op": "==",
+ "right": "ip6"
+ }
+ },
+ {
+ "reject": {
+ "expr": "admin-prohibited",
+ "type": "icmpx"
+ }
+ }
+]
+