79 lines
2.0 KiB
Go
79 lines
2.0 KiB
Go
|
// SPDX-License-Identifier: MIT
|
||
|
|
|
||
|
|
package nft
|
||
|
|
|
||
|
|
import (
|
||
|
|
"strings"
|
||
|
|
"testing"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestScriptGolden(t *testing.T) {
|
||
|
|
got, err := Script(Params{
|
||
|
|
WANInterface: "wlan0",
|
||
|
|
Mark: 0x100,
|
||
|
|
Local4: []string{"192.168.1.100"},
|
||
|
|
})
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Script: %v", err)
|
||
|
|
}
|
||
|
|
want := `destroy table inet prx
|
||
|
|
table inet prx {
|
||
|
|
set wan_local4 {
|
||
|
|
type ipv4_addr;
|
||
|
|
elements = { 192.168.1.100 }
|
||
|
|
}
|
||
|
|
chain pre {
|
||
|
|
type filter hook prerouting priority mangle; policy accept;
|
||
|
|
iifname "wlan0" ct state new ct mark set 0x100
|
||
|
|
}
|
||
|
|
chain out {
|
||
|
|
type filter hook output priority mangle; policy accept;
|
||
|
|
ct mark 0x100 meta mark set 0x100
|
||
|
|
ct original ip daddr @wan_local4 meta mark set 0x100
|
||
|
|
}
|
||
|
|
}
|
||
|
|
`
|
||
|
|
if got != want {
|
||
|
|
t.Fatalf("unexpected script:\n--- got ---\n%s\n--- want ---\n%s", got, want)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestScriptIncludesIPv6(t *testing.T) {
|
||
|
|
got, err := Script(Params{
|
||
|
|
WANInterface: "eth0",
|
||
|
|
Mark: 0x200,
|
||
|
|
Local4: []string{"203.0.113.5"},
|
||
|
|
Local6: []string{"2001:db8::5"},
|
||
|
|
})
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Script: %v", err)
|
||
|
|
}
|
||
|
|
for _, needle := range []string{
|
||
|
|
"set wan_local6",
|
||
|
|
"elements = { 2001:db8::5 }",
|
||
|
|
"ct original ip6 daddr @wan_local6 meta mark set 0x200",
|
||
|
|
} {
|
||
|
|
if !strings.Contains(got, needle) {
|
||
|
|
t.Errorf("script missing %q", needle)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestScriptAlwaysDestroysFirst(t *testing.T) {
|
||
|
|
got, _ := Script(Params{WANInterface: "wlan0", Mark: 1, Local4: []string{"1.2.3.4"}})
|
||
|
|
if !strings.HasPrefix(got, "destroy table inet prx\n") {
|
||
|
|
t.Fatal("script must start with destroy table to stay idempotent")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestScriptRejectsInjection(t *testing.T) {
|
||
|
|
for _, bad := range []string{`wlan0" ; flush ruleset`, "wlan0;x", "", "this-name-is-way-too-long"} {
|
||
|
|
if _, err := Script(Params{WANInterface: bad, Mark: 1, Local4: []string{"1.2.3.4"}}); err == nil {
|
||
|
|
t.Errorf("expected error for interface %q", bad)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if _, err := Script(Params{WANInterface: "wlan0", Mark: 0}); err == nil {
|
||
|
|
t.Error("expected error for zero mark")
|
||
|
|
}
|
||
|
|
}
|