]> git.ipfire.org Git - thirdparty/nftables.git/commitdiff
tests: shell: Fix for failing nft-f/sample-ruleset
authorPhil Sutter <phil@nwl.cc>
Thu, 28 Sep 2023 16:19:37 +0000 (18:19 +0200)
committerFlorian Westphal <fw@strlen.de>
Thu, 28 Sep 2023 20:13:04 +0000 (22:13 +0200)
For whatever reason, my system lacks an entry for 'sip' in
/etc/services. Assuming the service name is not relevant to the test,
just replace it by the respective port number.

Fixes: 68728014435d9 ("tests: shell: add sample ruleset reproducer")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
tests/shell/testcases/nft-f/sample-ruleset

index 8cee74b94664f572141080d616a566443ff44354..763e41a1f721472710369452ab2d24f4715e7f02 100755 (executable)
@@ -175,7 +175,7 @@ table inet filter {
                log prefix "NFT REJECT FWD " flags ether flags ip options limit rate 5/second burst 10 packets reject
        }
        chain public_forward {
-               udp dport { sip, 7078-7097 } oifname $voip_if jump {
+               udp dport { 5060, 7078-7097 } oifname $voip_if jump {
                        ip6 saddr $sip_whitelist_ip6 accept
                        meta nfproto ipv6 log prefix "NFT DROP SIP " flags ether flags ip options limit rate 5/second burst 10 packets drop
                }
@@ -199,7 +199,7 @@ table inet filter {
                icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request } oifname $public_if accept
 
                ip6 daddr $sip_whitelist_ip6 jump {
-                       udp dport { 3478, sip } accept
+                       udp dport { 3478, 5060 } accept
                        udp sport { 7078-7097 } accept
                        tcp dport 5061 accept
                }