From 08cc79942e820d9ce86c5c0bd0249ec4335955ce Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life>
Date: Fri, 28 Aug 2020 10:48:35 -0400
Subject: [PATCH 56/62] test(regression/rhbz1855140): add negative tests

(cherry picked from commit b50032185422f5538a8a6211cfa43cfaa2d67ec4)
(cherry picked from commit 264375df35124b5920b9d3e690944aaad1e4790c)
---
 src/tests/regression/rhbz1855140.at | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/src/tests/regression/rhbz1855140.at b/src/tests/regression/rhbz1855140.at
index 8059e29fe71a..fbb33a419c56 100644
--- a/src/tests/regression/rhbz1855140.at
+++ b/src/tests/regression/rhbz1855140.at
@@ -4,7 +4,15 @@ AT_KEYWORDS(rich icmp rhbz1855140)
 FWD_CHECK([--permanent --zone public --add-rich-rule='rule icmp-type name="echo-request" accept'], 0, ignore)
 FWD_CHECK([--permanent --zone public --add-rich-rule='rule icmp-type name="neighbour-advertisement" accept'], 0, ignore)
 FWD_CHECK([--permanent --zone public --add-rich-rule='rule icmp-type name="timestamp-request" accept'], 0, ignore)
+FWD_CHECK([--permanent --zone public --add-rich-rule 'rule icmp-type name=bad-header mark set=0x86/0x86'], 0, ignore)
 FWD_RELOAD
+NFT_LIST_RULES([inet], [mangle_PRE_public_allow], 0, [dnl
+    table inet firewalld {
+        chain mangle_PRE_public_allow {
+            icmpv6 type parameter-problem icmpv6 code no-route mark set mark & 0x00000086 ^ 0x00000086
+        }
+    }
+])
 NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl
     table inet firewalld {
         chain filter_IN_public_allow {
@@ -18,12 +26,17 @@ NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl
         }
     }
 ])
+IPTABLES_LIST_RULES([mangle], [PRE_public_allow], 0, [dnl
+])
 IPTABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl
     ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW,UNTRACKED
     ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 ctstate NEW,UNTRACKED
     ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8
     ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 13
 ])
+IP6TABLES_LIST_RULES([mangle], [PRE_public_allow], 0, [dnl
+    MARK icmpv6 ::/0 ::/0 ipv6-icmptype 4 code 0 MARK or 0x86
+])
 IP6TABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl
     ACCEPT tcp ::/0 ::/0 tcp dpt:22 ctstate NEW,UNTRACKED
     ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED
@@ -32,4 +45,12 @@ IP6TABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl
     ACCEPT icmpv6 ::/0 ::/0 ipv6-icmptype 136
 ])
 
-FWD_END_TEST
+dnl verify bad icmptypes are rejected
+FWD_CHECK([--permanent --add-rich-rule 'rule icmp-type name=bogus mark set=0x86/0x86'], 107, [ignore], [ignore])
+FWD_CHECK([            --add-rich-rule 'rule icmp-type name=bogus mark set=0x86/0x86'], 107, [ignore], [ignore])
+FWD_CHECK([--permanent --add-rich-rule 'rule family=ipv6 icmp-type name=timestamp-request drop'], 107, [ignore], [ignore])
+IF_HOST_SUPPORTS_IPV6_RULES([
+FWD_CHECK([            --add-rich-rule 'rule family=ipv6 icmp-type name=timestamp-request drop'], 107, [ignore], [ignore])
+])
+
+FWD_END_TEST([-e '/ERROR: INVALID_ICMPTYPE:/d'])
-- 
2.28.0