Blame SOURCES/0021-test-ipset-verify-ipset-netmask-allowed-for-hash-ip.patch

63f414
From 8adac165dc93d28802c645a3626a3bcf29503ace Mon Sep 17 00:00:00 2001
63f414
From: Eric Garver <eric@garver.life>
63f414
Date: Mon, 15 Feb 2021 11:29:07 -0500
63f414
Subject: [PATCH 21/22] test(ipset): verify ipset netmask allowed for hash:ip
63f414
63f414
(cherry picked from commit b7718f0dfa9ce7247911ef49c62e3ef2e4208343)
63f414
(cherry picked from commit 1fd50036a51b6147f9e77d61d7e63c8a8e564756)
63f414
---
63f414
 src/tests/regression/ipset_netmask_allowed.at | 23 +++++++++++++++++++
63f414
 src/tests/regression/regression.at            |  1 +
63f414
 2 files changed, 24 insertions(+)
63f414
 create mode 100644 src/tests/regression/ipset_netmask_allowed.at
63f414
63f414
diff --git a/src/tests/regression/ipset_netmask_allowed.at b/src/tests/regression/ipset_netmask_allowed.at
63f414
new file mode 100644
63f414
index 000000000000..b5165d94b220
63f414
--- /dev/null
63f414
+++ b/src/tests/regression/ipset_netmask_allowed.at
63f414
@@ -0,0 +1,23 @@
63f414
+FWD_START_TEST([ipset netmask allowed type hash:ip])
63f414
+AT_KEYWORDS(ipset reload)
63f414
+
63f414
+FWD_CHECK([--permanent --new-ipset foobar --type hash:ip], 0, [ignore])
63f414
+FWD_RELOAD
63f414
+
63f414
+dnl ipset allows specifying a mask for hash:ip, but it will translate it into
63f414
+dnl an add for the whole range. i.e. 1.2.3.4/24  --> 1.2.3.[0.255] (256
63f414
+dnl entries).
63f414
+dnl
63f414
+dnl In nftables, we allow this by using actual intervals.
63f414
+FWD_CHECK([--permanent --ipset foobar --add-entry 1.2.3.0/24], 0, [ignore])
63f414
+FWD_CHECK([            --ipset foobar --add-entry 1.2.3.0/24], 0, [ignore])
63f414
+
63f414
+dnl check the edge case
63f414
+FWD_CHECK([--permanent --ipset foobar --add-entry 4.3.2.1/32], 0, [ignore])
63f414
+FWD_CHECK([            --ipset foobar --add-entry 4.3.2.1/32], 0, [ignore])
63f414
+
63f414
+dnl overlaps should be denied by ipset
63f414
+FWD_CHECK([            --ipset foobar --add-entry 1.2.3.0/22], 13, [ignore], [ignore])
63f414
+FWD_CHECK([            --ipset foobar --add-entry 1.2.3.0/30], 13, [ignore], [ignore])
63f414
+
63f414
+FWD_END_TEST([-e '/ERROR: COMMAND_FAILED:/d'])
63f414
diff --git a/src/tests/regression/regression.at b/src/tests/regression/regression.at
63f414
index a90fc37d51c6..a49bb3b756e7 100644
63f414
--- a/src/tests/regression/regression.at
63f414
+++ b/src/tests/regression/regression.at
63f414
@@ -38,3 +38,4 @@ m4_include([regression/rhbz1855140.at])
63f414
 m4_include([regression/rhbz1871298.at])
63f414
 m4_include([regression/rhbz1596304.at])
63f414
 m4_include([regression/gh703.at])
63f414
+m4_include([regression/ipset_netmask_allowed.at])
63f414
-- 
63f414
2.27.0
63f414