summaryrefslogtreecommitdiffstats
path: root/tests/py/inet
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2017-06-16 21:52:32 +0200
committerFlorian Westphal <fw@strlen.de>2017-06-18 23:28:57 +0200
commit6939b8b3fdb6d90f76883e65524017180e065608 (patch)
tree69c01e9d51db208fb2f83703bd7694e6f1c98d84 /tests/py/inet
parentc20142bba09b72f398ccf8260715cd6ed9a0e865 (diff)
tests: restrict ct saddr test to inet family
any/ct.t: ERROR: line 94: src/nft add rule --debug=netlink ip6 test-ip6 output meta nfproto ipv4 ct original saddr 1.2.3.4: This rule should not have failed. Actually, this failure is "ok; we can't find upper layer protocol in this case, but even if we'd "fix" this it is still non-sensical, meta nfproto ipv4, but family is ipv6 --> rule would never match. First move this to an inet-specific test. A followup patch will reject meta nfproto for all families except inet. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests/py/inet')
-rw-r--r--tests/py/inet/ct.t10
-rw-r--r--tests/py/inet/ct.t.payload13
2 files changed, 23 insertions, 0 deletions
diff --git a/tests/py/inet/ct.t b/tests/py/inet/ct.t
new file mode 100644
index 00000000..c56c3bc8
--- /dev/null
+++ b/tests/py/inet/ct.t
@@ -0,0 +1,10 @@
+:input;type filter hook input priority 0
+:ingress;type filter hook ingress device lo priority 0
+
+*inet;test-inet;input
+
+meta nfproto ipv4 ct original saddr 1.2.3.4;ok
+meta nfproto ipv6 ct original saddr ::1;ok
+
+# missing protocol context
+ct original saddr ::1;fail
diff --git a/tests/py/inet/ct.t.payload b/tests/py/inet/ct.t.payload
new file mode 100644
index 00000000..21c74581
--- /dev/null
+++ b/tests/py/inet/ct.t.payload
@@ -0,0 +1,13 @@
+# meta nfproto ipv4 ct original saddr 1.2.3.4
+ip test-ip4 output
+ [ meta load nfproto => reg 1 ]
+ [ cmp eq reg 1 0x00000002 ]
+ [ ct load src => reg 1 , dir original ]
+ [ cmp eq reg 1 0x04030201 ]
+
+# meta nfproto ipv6 ct original saddr ::1
+inet test-inet input
+ [ meta load nfproto => reg 1 ]
+ [ cmp eq reg 1 0x0000000a ]
+ [ ct load src => reg 1 , dir original ]
+ [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x01000000 ]