diff options
| author | Florian Westphal <fw@strlen.de> | 2017-06-16 21:52:32 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2017-06-18 23:28:57 +0200 |
| commit | 6939b8b3fdb6d90f76883e65524017180e065608 (patch) | |
| tree | 69c01e9d51db208fb2f83703bd7694e6f1c98d84 /tests/py/inet | |
| parent | c20142bba09b72f398ccf8260715cd6ed9a0e865 (diff) | |
tests: restrict ct saddr test to inet family
any/ct.t: ERROR: line 94: src/nft add rule --debug=netlink ip6
test-ip6 output meta nfproto ipv4 ct original saddr 1.2.3.4: This rule should not have failed.
Actually, this failure is "ok; we can't find upper layer protocol
in this case, but even if we'd "fix" this it is still non-sensical,
meta nfproto ipv4, but family is ipv6 --> rule would never match.
First move this to an inet-specific test.
A followup patch will reject meta nfproto for all families except inet.
Reported-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tests/py/inet')
| -rw-r--r-- | tests/py/inet/ct.t | 10 | ||||
| -rw-r--r-- | tests/py/inet/ct.t.payload | 13 |
2 files changed, 23 insertions, 0 deletions
diff --git a/tests/py/inet/ct.t b/tests/py/inet/ct.t new file mode 100644 index 00000000..c56c3bc8 --- /dev/null +++ b/tests/py/inet/ct.t @@ -0,0 +1,10 @@ +:input;type filter hook input priority 0 +:ingress;type filter hook ingress device lo priority 0 + +*inet;test-inet;input + +meta nfproto ipv4 ct original saddr 1.2.3.4;ok +meta nfproto ipv6 ct original saddr ::1;ok + +# missing protocol context +ct original saddr ::1;fail diff --git a/tests/py/inet/ct.t.payload b/tests/py/inet/ct.t.payload new file mode 100644 index 00000000..21c74581 --- /dev/null +++ b/tests/py/inet/ct.t.payload @@ -0,0 +1,13 @@ +# meta nfproto ipv4 ct original saddr 1.2.3.4 +ip test-ip4 output + [ meta load nfproto => reg 1 ] + [ cmp eq reg 1 0x00000002 ] + [ ct load src => reg 1 , dir original ] + [ cmp eq reg 1 0x04030201 ] + +# meta nfproto ipv6 ct original saddr ::1 +inet test-inet input + [ meta load nfproto => reg 1 ] + [ cmp eq reg 1 0x0000000a ] + [ ct load src => reg 1 , dir original ] + [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x01000000 ] |