[iptables PATCH] tests: iptables-test: Support variant deviation

[Phil Sutter <phil@nwl.cc>]

Some test results are not consistent between variants:

* CLUSTERIP is not supported with nft_compat, so all related tests fail
  with iptables-nft.
* iptables-legacy mandates TCPMSS be combined with SYN flag match,
  iptables-nft does not care. (Or precisely, xt_TCPMSS.ko can't validate
  match presence.)

Avoid the expected failures by allowing "NFT" and "LGC" outcomes in
addition to "OK" and "FAIL". They specify the variant with which given
test should pass.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 extensions/libipt_CLUSTERIP.t | 4 ++--
 extensions/libxt_TCPMSS.t     | 2 +-
 iptables-test.py              | 7 +++++--
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/extensions/libipt_CLUSTERIP.t b/extensions/libipt_CLUSTERIP.t
index 5af555e005c1d..d3a2d6cbb1b2e 100644
--- a/extensions/libipt_CLUSTERIP.t
+++ b/extensions/libipt_CLUSTERIP.t
@@ -1,4 +1,4 @@
 :INPUT
 -d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 0 --hash-init 1;=;FAIL
--d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 1 --hash-init 1;=;OK
--d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 2 --hash-init 1;=;OK
+-d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 1 --hash-init 1;=;LGC
+-d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 2 --hash-init 1;=;LGC
diff --git a/extensions/libxt_TCPMSS.t b/extensions/libxt_TCPMSS.t
index 553a3452e4876..c3ee2de880826 100644
--- a/extensions/libxt_TCPMSS.t
+++ b/extensions/libxt_TCPMSS.t
@@ -1,6 +1,6 @@
 :FORWARD,OUTPUT,POSTROUTING
 *mangle
 -j TCPMSS;;FAIL
--p tcp -j TCPMSS --set-mss 42;;FAIL
+-p tcp -j TCPMSS --set-mss 42;;NFT
 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j TCPMSS --set-mss 42;=;OK
 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j TCPMSS --clamp-mss-to-pmtu;=;OK
diff --git a/iptables-test.py b/iptables-test.py
index 95fa11b1475ca..be1b1a94decf4 100755
--- a/iptables-test.py
+++ b/iptables-test.py
@@ -91,8 +91,11 @@ def run_test(iptables, rule, rule_save, res, filename, lineno, netns):
     #
     # report failed test
     #
+    should_pass = (res == "OK") or \
+                  (res == "NFT" and EXECUTABLE == "xtables-nft-multi") or \
+                  (res == "LGC" and EXECUTABLE == "xtables-legacy-multi")
     if ret:
-        if res == "OK":
+        if should_pass:
             reason = "cannot load: " + cmd
             print_error(reason, filename, lineno)
             return -1
@@ -100,7 +103,7 @@ def run_test(iptables, rule, rule_save, res, filename, lineno, netns):
             # do not report this error
             return 0
     else:
-        if res == "FAIL":
+        if not should_pass:
             reason = "should fail: " + cmd
             print_error(reason, filename, lineno)
             delete_rule(iptables, rule, filename, lineno)
-- 
2.34.1