From 0f44d4f62753535d39d95d83778348bee4e88053 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Tue, 4 Sep 2018 13:53:59 +0200 Subject: proto: fix icmp/icmpv6 code datatype Andrew A. Sabitov says: I'd like to use a set (concatenation) of icmpv6 type and icmpv6 code and check incoming icmpv6 traffic against it: add set inet fw in_icmpv6_types { type icmpv6_type . icmpv6_code; } add element inet fw in_icmpv6_types { 1 . 0 } # no route to destination add element inet fw in_icmpv6_types { 1 . 1 } # communication with destination administratively prohibited # ... add rule inet fw in_icmpv6 icmpv6 type . icmpv6 code @in_icmpv6_types \ limit rate 15/minute accept yields: Error: can not use variable sized data types (integer) in concat expressions icmpv6 type . icmpv6 code @in_icmpv6_types ~~~~~~~~~~~~~~^^^^^^^^^^^ Change 'code' type to the icmp/icmpv6 code type. Needs minor change to test suite as nft will now display human-readable names instead of numeric codes. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1276 Signed-off-by: Florian Westphal --- tests/py/ip/icmp.t | 4 ++-- tests/py/ip/icmp.t.payload.ip | 2 +- tests/py/ip6/icmpv6.t | 6 +++--- tests/py/ip6/icmpv6.t.payload.ip6 | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) (limited to 'tests/py') diff --git a/tests/py/ip/icmp.t b/tests/py/ip/icmp.t index 5a7ce7e0..6c05fb9d 100644 --- a/tests/py/ip/icmp.t +++ b/tests/py/ip/icmp.t @@ -28,8 +28,8 @@ icmp code 33-55;ok icmp code != 33-55;ok icmp code { 33-55};ok icmp code != { 33-55};ok -icmp code { 2, 4, 54, 33, 56};ok -icmp code != { 2, 4, 54, 33, 56};ok +icmp code { 2, 4, 54, 33, 56};ok;icmp code { prot-unreachable, 4, 33, 54, 56} +icmp code != { prot-unreachable, 4, 33, 54, 56};ok icmp checksum 12343 accept;ok icmp checksum != 12343 accept;ok diff --git a/tests/py/ip/icmp.t.payload.ip b/tests/py/ip/icmp.t.payload.ip index f959cf33..27f22207 100644 --- a/tests/py/ip/icmp.t.payload.ip +++ b/tests/py/ip/icmp.t.payload.ip @@ -184,7 +184,7 @@ ip test-ip4 input [ payload load 1b @ transport header + 1 => reg 1 ] [ lookup reg 1 set __set%d ] -# icmp code != { 2, 4, 54, 33, 56} +# icmp code != { prot-unreachable, 4, 33, 54, 56} __set%d test-ip4 3 __set%d test-ip4 0 element 00000002 : 0 [end] element 00000004 : 0 [end] element 00000036 : 0 [end] element 00000021 : 0 [end] element 00000038 : 0 [end] diff --git a/tests/py/ip6/icmpv6.t b/tests/py/ip6/icmpv6.t index a898fe30..8d794115 100644 --- a/tests/py/ip6/icmpv6.t +++ b/tests/py/ip6/icmpv6.t @@ -28,10 +28,10 @@ icmpv6 type {router-renumbering, mld-listener-done, time-exceeded, nd-router-sol icmpv6 type {mld-listener-query, time-exceeded, nd-router-advert} accept;ok icmpv6 type != {mld-listener-query, time-exceeded, nd-router-advert} accept;ok -icmpv6 code 4;ok +icmpv6 code 4;ok;icmpv6 code port-unreachable icmpv6 code 3-66;ok -icmpv6 code {5, 6, 7} accept;ok -icmpv6 code != {5, 6, 7} accept;ok +icmpv6 code {5, 6, 7} accept;ok;icmpv6 code {policy-fail, reject-route, 7} accept +icmpv6 code != {policy-fail, reject-route, 7} accept;ok icmpv6 code { 3-66};ok icmpv6 code != { 3-66};ok diff --git a/tests/py/ip6/icmpv6.t.payload.ip6 b/tests/py/ip6/icmpv6.t.payload.ip6 index 7a630f9f..51d71f41 100644 --- a/tests/py/ip6/icmpv6.t.payload.ip6 +++ b/tests/py/ip6/icmpv6.t.payload.ip6 @@ -220,7 +220,7 @@ ip6 test-ip6 input [ lookup reg 1 set __set%d ] [ immediate reg 0 accept ] -# icmpv6 code != {5, 6, 7} accept +# icmpv6 code != {policy-fail, reject-route, 7} accept __set%d test-ip6 3 __set%d test-ip6 0 element 00000005 : 0 [end] element 00000006 : 0 [end] element 00000007 : 0 [end] -- cgit v1.2.3