From: Florian Westphal <fw@strlen.de>
To: <netfilter-devel@vger.kernel.org>
Cc: Florian Westphal <fw@strlen.de>
Subject: [PATCH 2/4] tests: remove two non-sensical rules
Date: Fri, 16 Jun 2017 22:34:09 +0200 [thread overview]
Message-ID: <20170616203411.16408-3-fw@strlen.de> (raw)
In-Reply-To: <20170616203411.16408-1-fw@strlen.de>
meta nfproto returns the hook family that the current packet
is being evaluted in, e.g.
NFPROTO_NETDEV in case we're called from the netdev context.
This makes no sense, if we add a rule to netdev, bridge, ip, ...
table then thats where it will be evaluated, no runtime test needed.
Only exception: inet family, in this case, nfproto will be either
ipv4 or ipv6.
Signed-off-by: Florian Westphal <fw@strlen.de>
---
tests/py/inet/ether.t | 2 --
tests/py/inet/ether.t.payload | 23 -----------------------
2 files changed, 25 deletions(-)
diff --git a/tests/py/inet/ether.t b/tests/py/inet/ether.t
index 0a88aef1609b..afdf8b89ca65 100644
--- a/tests/py/inet/ether.t
+++ b/tests/py/inet/ether.t
@@ -7,9 +7,7 @@
*bridge;test-bridge;input
*netdev;test-netdev;ingress
-tcp dport 22 iiftype ether ether saddr 00:0f:54:0c:11:4 meta nfproto ipv4 accept;ok;tcp dport 22 ether saddr 00:0f:54:0c:11:04 meta nfproto ipv4 accept
tcp dport 22 iiftype ether ether saddr 00:0f:54:0c:11:4 accept;ok;tcp dport 22 ether saddr 00:0f:54:0c:11:04 accept
tcp dport 22 ether saddr 00:0f:54:0c:11:04 accept;ok
ether saddr 00:0f:54:0c:11:04 accept;ok
-ether saddr 00:0f:54:0c:11:04 meta nfproto ipv4;ok
diff --git a/tests/py/inet/ether.t.payload b/tests/py/inet/ether.t.payload
index 86f30c37f6bd..53648413d588 100644
--- a/tests/py/inet/ether.t.payload
+++ b/tests/py/inet/ether.t.payload
@@ -1,17 +1,3 @@
-# tcp dport 22 iiftype ether ether saddr 00:0f:54:0c:11:4 meta nfproto ipv4 accept
-inet test-inet input
- [ meta load l4proto => reg 1 ]
- [ cmp eq reg 1 0x00000006 ]
- [ payload load 2b @ transport header + 2 => reg 1 ]
- [ cmp eq reg 1 0x00001600 ]
- [ meta load iiftype => reg 1 ]
- [ cmp eq reg 1 0x00000001 ]
- [ payload load 6b @ link header + 6 => reg 1 ]
- [ cmp eq reg 1 0x0c540f00 0x00000411 ]
- [ meta load nfproto => reg 1 ]
- [ cmp eq reg 1 0x00000002 ]
- [ immediate reg 0 accept ]
-
# tcp dport 22 iiftype ether ether saddr 00:0f:54:0c:11:4 accept
inet test-inet input
[ meta load l4proto => reg 1 ]
@@ -44,12 +30,3 @@ inet test-inet input
[ cmp eq reg 1 0x0c540f00 0x00000411 ]
[ immediate reg 0 accept ]
-# ether saddr 00:0f:54:0c:11:04 meta nfproto ipv4
-inet test-inet input
- [ meta load iiftype => reg 1 ]
- [ cmp eq reg 1 0x00000001 ]
- [ payload load 6b @ link header + 6 => reg 1 ]
- [ cmp eq reg 1 0x0c540f00 0x00000411 ]
- [ meta load nfproto => reg 1 ]
- [ cmp eq reg 1 0x00000002 ]
-
--
2.13.0
next prev parent reply other threads:[~2017-06-16 20:33 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-06-16 20:34 [PATCH nft 0/4] restrict meta nfproto to inet family Florian Westphal
2017-06-16 20:34 ` [PATCH 1/4] tests: restrict ct saddr test " Florian Westphal
2017-06-16 20:34 ` Florian Westphal [this message]
2017-06-16 20:34 ` [PATCH 3/4] tests: restrict meta nfproto test cases " Florian Westphal
2017-06-16 20:34 ` [PATCH 4/4] evaluate: reject meta nfproto outside of " Florian Westphal
2017-06-18 9:52 ` Pablo Neira Ayuso
2017-06-18 9:35 ` [PATCH nft 0/4] restrict meta nfproto to " Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170616203411.16408-3-fw@strlen.de \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).