From 8adac165dc93d28802c645a3626a3bcf29503ace Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life>
Date: Mon, 15 Feb 2021 11:29:07 -0500
Subject: [PATCH 21/22] test(ipset): verify ipset netmask allowed for hash:ip

(cherry picked from commit b7718f0dfa9ce7247911ef49c62e3ef2e4208343)
(cherry picked from commit 1fd50036a51b6147f9e77d61d7e63c8a8e564756)
---
 src/tests/regression/ipset_netmask_allowed.at | 23 +++++++++++++++++++
 src/tests/regression/regression.at            |  1 +
 2 files changed, 24 insertions(+)
 create mode 100644 src/tests/regression/ipset_netmask_allowed.at

diff --git a/src/tests/regression/ipset_netmask_allowed.at b/src/tests/regression/ipset_netmask_allowed.at
new file mode 100644
index 000000000000..b5165d94b220
--- /dev/null
+++ b/src/tests/regression/ipset_netmask_allowed.at
@@ -0,0 +1,23 @@
+FWD_START_TEST([ipset netmask allowed type hash:ip])
+AT_KEYWORDS(ipset reload)
+
+FWD_CHECK([--permanent --new-ipset foobar --type hash:ip], 0, [ignore])
+FWD_RELOAD
+
+dnl ipset allows specifying a mask for hash:ip, but it will translate it into
+dnl an add for the whole range. i.e. 1.2.3.4/24  --> 1.2.3.[0.255] (256
+dnl entries).
+dnl
+dnl In nftables, we allow this by using actual intervals.
+FWD_CHECK([--permanent --ipset foobar --add-entry 1.2.3.0/24], 0, [ignore])
+FWD_CHECK([            --ipset foobar --add-entry 1.2.3.0/24], 0, [ignore])
+
+dnl check the edge case
+FWD_CHECK([--permanent --ipset foobar --add-entry 4.3.2.1/32], 0, [ignore])
+FWD_CHECK([            --ipset foobar --add-entry 4.3.2.1/32], 0, [ignore])
+
+dnl overlaps should be denied by ipset
+FWD_CHECK([            --ipset foobar --add-entry 1.2.3.0/22], 13, [ignore], [ignore])
+FWD_CHECK([            --ipset foobar --add-entry 1.2.3.0/30], 13, [ignore], [ignore])
+
+FWD_END_TEST([-e '/ERROR: COMMAND_FAILED:/d'])
diff --git a/src/tests/regression/regression.at b/src/tests/regression/regression.at
index a90fc37d51c6..a49bb3b756e7 100644
--- a/src/tests/regression/regression.at
+++ b/src/tests/regression/regression.at
@@ -38,3 +38,4 @@ m4_include([regression/rhbz1855140.at])
 m4_include([regression/rhbz1871298.at])
 m4_include([regression/rhbz1596304.at])
 m4_include([regression/gh703.at])
+m4_include([regression/ipset_netmask_allowed.at])
-- 
2.27.0