55 lines
2.2 KiB
Diff
55 lines
2.2 KiB
Diff
|
From 8adac165dc93d28802c645a3626a3bcf29503ace Mon Sep 17 00:00:00 2001
|
||
|
|
From: Eric Garver <eric@garver.life>
|
||
|
|
Date: Mon, 15 Feb 2021 11:29:07 -0500
|
||
|
|
Subject: [PATCH 21/22] test(ipset): verify ipset netmask allowed for hash:ip
|
||
|
|
|
||
|
|
(cherry picked from commit b7718f0dfa9ce7247911ef49c62e3ef2e4208343)
|
||
|
|
(cherry picked from commit 1fd50036a51b6147f9e77d61d7e63c8a8e564756)
|
||
|
|
---
|
||
|
|
src/tests/regression/ipset_netmask_allowed.at | 23 +++++++++++++++++++
|
||
|
|
src/tests/regression/regression.at | 1 +
|
||
|
|
2 files changed, 24 insertions(+)
|
||
|
|
create mode 100644 src/tests/regression/ipset_netmask_allowed.at
|
||
|
|
|
||
|
|
diff --git a/src/tests/regression/ipset_netmask_allowed.at b/src/tests/regression/ipset_netmask_allowed.at
|
||
|
|
new file mode 100644
|
||
|
|
index 000000000000..b5165d94b220
|
||
|
|
--- /dev/null
|
||
|
|
+++ b/src/tests/regression/ipset_netmask_allowed.at
|
||
|
|
@@ -0,0 +1,23 @@
|
||
|
|
+FWD_START_TEST([ipset netmask allowed type hash:ip])
|
||
|
|
+AT_KEYWORDS(ipset reload)
|
||
|
|
+
|
||
|
|
+FWD_CHECK([--permanent --new-ipset foobar --type hash:ip], 0, [ignore])
|
||
|
|
+FWD_RELOAD
|
||
|
|
+
|
||
|
|
+dnl ipset allows specifying a mask for hash:ip, but it will translate it into
|
||
|
|
+dnl an add for the whole range. i.e. 1.2.3.4/24 --> 1.2.3.[0.255] (256
|
||
|
|
+dnl entries).
|
||
|
|
+dnl
|
||
|
|
+dnl In nftables, we allow this by using actual intervals.
|
||
|
|
+FWD_CHECK([--permanent --ipset foobar --add-entry 1.2.3.0/24], 0, [ignore])
|
||
|
|
+FWD_CHECK([ --ipset foobar --add-entry 1.2.3.0/24], 0, [ignore])
|
||
|
|
+
|
||
|
|
+dnl check the edge case
|
||
|
|
+FWD_CHECK([--permanent --ipset foobar --add-entry 4.3.2.1/32], 0, [ignore])
|
||
|
|
+FWD_CHECK([ --ipset foobar --add-entry 4.3.2.1/32], 0, [ignore])
|
||
|
|
+
|
||
|
|
+dnl overlaps should be denied by ipset
|
||
|
|
+FWD_CHECK([ --ipset foobar --add-entry 1.2.3.0/22], 13, [ignore], [ignore])
|
||
|
|
+FWD_CHECK([ --ipset foobar --add-entry 1.2.3.0/30], 13, [ignore], [ignore])
|
||
|
|
+
|
||
|
|
+FWD_END_TEST([-e '/ERROR: COMMAND_FAILED:/d'])
|
||
|
|
diff --git a/src/tests/regression/regression.at b/src/tests/regression/regression.at
|
||
|
|
index a90fc37d51c6..a49bb3b756e7 100644
|
||
|
|
--- a/src/tests/regression/regression.at
|
||
|
|
+++ b/src/tests/regression/regression.at
|
||
|
|
@@ -38,3 +38,4 @@ m4_include([regression/rhbz1855140.at])
|
||
|
|
m4_include([regression/rhbz1871298.at])
|
||
|
|
m4_include([regression/rhbz1596304.at])
|
||
|
|
m4_include([regression/gh703.at])
|
||
|
|
+m4_include([regression/ipset_netmask_allowed.at])
|
||
|
|
--
|
||
|
|
2.27.0
|
||
|
|
|