diff options
| -rw-r--r-- | tests/shell/testcases/maps/dumps/nat_addr_port.nft | 13 | ||||
| -rwxr-xr-x | tests/shell/testcases/maps/nat_addr_port | 83 |
2 files changed, 96 insertions, 0 deletions
diff --git a/tests/shell/testcases/maps/dumps/nat_addr_port.nft b/tests/shell/testcases/maps/dumps/nat_addr_port.nft new file mode 100644 index 00000000..3ed6812e --- /dev/null +++ b/tests/shell/testcases/maps/dumps/nat_addr_port.nft @@ -0,0 +1,13 @@ +table ip ipfoo { + map x { + type ipv4_addr : ipv4_addr + } + + chain c { + type nat hook prerouting priority dstnat; policy accept; + iifname != "foobar" accept + dnat to ip daddr map @x + ip saddr 10.1.1.1 dnat to 10.2.3.4 + ip saddr 10.1.1.2 tcp dport 42 dnat to 10.2.3.4:4242 + } +} diff --git a/tests/shell/testcases/maps/nat_addr_port b/tests/shell/testcases/maps/nat_addr_port new file mode 100755 index 00000000..77a2f110 --- /dev/null +++ b/tests/shell/testcases/maps/nat_addr_port @@ -0,0 +1,83 @@ +#!/bin/bash + +# skeleton +$NFT -f /dev/stdin <<EOF || exit 1 +table ip ipfoo { + map x { + type ipv4_addr : ipv4_addr + } + + chain c { + type nat hook prerouting priority dstnat; policy accept; + meta iifname != "foobar" accept + dnat to ip daddr map @x + ip saddr 10.1.1.1 dnat to 10.2.3.4 + ip saddr 10.1.1.2 tcp dport 42 dnat to 10.2.3.4:4242 + } +} +EOF + +# should fail: rule has no test for l4 protocol +$NFT add rule 'ip ipfoo c ip saddr 10.1.1.2 dnat to 10.2.3.4:4242' && exit 1 + +# should fail: map has wrong family: 4->6 +$NFT add rule 'inet inetfoo c dnat to ip daddr map @x6' && exit 1 + +# should fail: map has wrong family: 6->4 +$NFT add rule 'inet inetfoo c dnat to ip6 daddr map @x4' && exit 1 + +# should fail: rule has no test for l4 protocol +$NFT add rule 'inet inetfoo c ip6 saddr f0:0b::a3 dnat to [1c::3]:42' && exit 1 + +# should fail: rule has no test for l4 protocol, but map has inet_service +$NFT add rule 'inet inetfoo c dnat to ip daddr map @y4' && exit 1 + +# should fail: rule has test for l4 protocol, but map has wrong family: 4->6 +$NFT add rule 'inet inetfoo c meta l4proto tcp dnat to ip daddr map @y6' && exit 1 + +# should fail: rule has test for l4 protocol, but map has wrong family: 6->4 +$NFT add rule 'inet inetfoo c meta l4proto tcp dnat to ip6 daddr map @y4' && exit 1 + +# fail: inet_service, but expect ipv4_addr +$NFT -f /dev/stdin <<EOF && exit 1 +table inet inetfoo { + map a { + type ipv4_addr : inet_service + } + + chain c { + type nat hook prerouting priority dstnat; policy accept; + meta l4proto tcp dnat ip to ip saddr map @a + } +} +EOF + +# fail: maps to inet_service . inet_service, not addr . service +$NFT -f /dev/stdin <<EOF && exit 1 +table inet inetfoo { + map b { + type ipv4_addr : inet_service . inet_service + } + + chain c { + type nat hook prerouting priority dstnat; policy accept; + meta l4proto tcp dnat ip to ip saddr map @a + } +} +EOF + +# fail: only accept exactly two sub-expressions: 'addr . service' +$NFT -f /dev/stdin <<EOF && exit 1 +table inet inetfoo { + map b { + type ipv4_addr : inet_addr . inet_service . inet_service + } + + chain c { + type nat hook prerouting priority dstnat; policy accept; + meta l4proto tcp dnat ip to ip saddr map @a + } +} +EOF + +exit 0 |