diff options
| author | Phil Sutter <phil@nwl.cc> | 2023-04-05 13:18:24 +0200 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2023-04-05 13:21:03 +0200 |
| commit | 0c2dcbf984939d8473e0b429b41e41a36c8a64da (patch) | |
| tree | 2e31382bcd6ba619fe559894ebd993b12f91e627 | |
| parent | 73611d5582e72367a698faf1b5301c836e981465 (diff) | |
| download | iptables-0c2dcbf984939d8473e0b429b41e41a36c8a64da.tar.gz | |
tests: shell: Test for false-positive rule check
Rule comparison in legacy ip6tables was broken by commit eb2546a846776
("xshared: Share make_delete_mask() between ip{,6}tables"): A part of
the rules' data was masked out for comparison by accident.
Signed-off-by: Phil Sutter <phil@nwl.cc>
| -rwxr-xr-x | iptables/tests/shell/testcases/ip6tables/0005-rule-check_0 | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/iptables/tests/shell/testcases/ip6tables/0005-rule-check_0 b/iptables/tests/shell/testcases/ip6tables/0005-rule-check_0 new file mode 100755 index 00000000..cc8215bf --- /dev/null +++ b/iptables/tests/shell/testcases/ip6tables/0005-rule-check_0 @@ -0,0 +1,17 @@ +#!/bin/bash +# +# Test the fix in commit 78850e7dba64a ("ip6tables: Fix checking existence of +# rule"). Happens with legacy ip6tables only, but testing ip6tables-nft doesn't +# hurt. +# +# Code taken from https://bugzilla.netfilter.org/show_bug.cgi?id=1667 +# Thanks to Jonathan Caicedo <jonathan@jcaicedo.com> for providing it. + +RULE='-p tcp --dport 81 -j DNAT --to-destination [::1]:81' + +$XT_MULTI ip6tables -t nat -N testchain || exit 1 +$XT_MULTI ip6tables -t nat -A testchain $RULE || exit 1 +$XT_MULTI ip6tables -t nat -C testchain $RULE || exit 1 + +$XT_MULTI ip6tables -t nat -C testchain ${RULE//81/82} 2>/dev/null && exit 1 +exit 0 |