1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
#!/bin/bash
# support for strings/typeof in named sets.
# s1 and s2 are identical, they just use different
# ways for declaration.
EXPECTED="table inet t {
set s1 {
typeof osf name
elements = { \"Linux\" }
}
set s2 {
typeof vlan id
elements = { 2, 3, 103 }
}
set s3 {
typeof meta ibrpvid
elements = { 2, 3, 103 }
}
set s4 {
typeof frag frag-off
elements = { 1, 1024 }
}
set s5 {
typeof ip option ra value
elements = { 1, 1024 }
}
set s6 {
typeof tcp option maxseg size
elements = { 1, 1024 }
}
set s7 {
typeof sctp chunk init num-inbound-streams
elements = { 1, 4 }
}
set s8 {
typeof ip version
elements = { 4, 6 }
}
set s9 {
typeof ip hdrlength
elements = { 0, 1, 2, 3, 4, 15 }
}
set s10 {
typeof meta iifname . ip saddr . ipsec in reqid
elements = { \"eth0\" . 10.1.1.2 . 42 }
}
chain c1 {
osf name @s1 accept
}
chain c2 {
ether type vlan vlan id @s2 accept
}
chain c4 {
frag frag-off @s4 accept
}
chain c5 {
ip option ra value @s5 accept
}
chain c6 {
tcp option maxseg size @s6 accept
}
chain c7 {
sctp chunk init num-inbound-streams @s7 accept
}
chain c8 {
ip version @s8 accept
}
chain c9 {
ip hdrlength @s9 accept
}
chain c10 {
meta iifname . ip saddr . ipsec in reqid @s10 accept
}
}"
set -e
$NFT -f - <<< $EXPECTED
|
