From 8adac165dc93d28802c645a3626a3bcf29503ace Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Mon, 15 Feb 2021 11:29:07 -0500 Subject: [PATCH 21/22] test(ipset): verify ipset netmask allowed for hash:ip (cherry picked from commit b7718f0dfa9ce7247911ef49c62e3ef2e4208343) (cherry picked from commit 1fd50036a51b6147f9e77d61d7e63c8a8e564756) --- src/tests/regression/ipset_netmask_allowed.at | 23 +++++++++++++++++++ src/tests/regression/regression.at | 1 + 2 files changed, 24 insertions(+) create mode 100644 src/tests/regression/ipset_netmask_allowed.at diff --git a/src/tests/regression/ipset_netmask_allowed.at b/src/tests/regression/ipset_netmask_allowed.at new file mode 100644 index 000000000000..b5165d94b220 --- /dev/null +++ b/src/tests/regression/ipset_netmask_allowed.at @@ -0,0 +1,23 @@ +FWD_START_TEST([ipset netmask allowed type hash:ip]) +AT_KEYWORDS(ipset reload) + +FWD_CHECK([--permanent --new-ipset foobar --type hash:ip], 0, [ignore]) +FWD_RELOAD + +dnl ipset allows specifying a mask for hash:ip, but it will translate it into +dnl an add for the whole range. i.e. 1.2.3.4/24 --> 1.2.3.[0.255] (256 +dnl entries). +dnl +dnl In nftables, we allow this by using actual intervals. +FWD_CHECK([--permanent --ipset foobar --add-entry 1.2.3.0/24], 0, [ignore]) +FWD_CHECK([ --ipset foobar --add-entry 1.2.3.0/24], 0, [ignore]) + +dnl check the edge case +FWD_CHECK([--permanent --ipset foobar --add-entry 4.3.2.1/32], 0, [ignore]) +FWD_CHECK([ --ipset foobar --add-entry 4.3.2.1/32], 0, [ignore]) + +dnl overlaps should be denied by ipset +FWD_CHECK([ --ipset foobar --add-entry 1.2.3.0/22], 13, [ignore], [ignore]) +FWD_CHECK([ --ipset foobar --add-entry 1.2.3.0/30], 13, [ignore], [ignore]) + +FWD_END_TEST([-e '/ERROR: COMMAND_FAILED:/d']) diff --git a/src/tests/regression/regression.at b/src/tests/regression/regression.at index a90fc37d51c6..a49bb3b756e7 100644 --- a/src/tests/regression/regression.at +++ b/src/tests/regression/regression.at @@ -38,3 +38,4 @@ m4_include([regression/rhbz1855140.at]) m4_include([regression/rhbz1871298.at]) m4_include([regression/rhbz1596304.at]) m4_include([regression/gh703.at]) +m4_include([regression/ipset_netmask_allowed.at]) -- 2.27.0