tests: add initial nat map test

Will be extended to cover upcoming
'dnat to ip saddr . tcp dport map { \
  1.2.3.4 . 80 : 5.6.7.8 : 8080,
  2.2.3.4 . 80 : 7.6.7.8 : 1234,
   ...

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/tests/shell/testcases/maps/dumps/nat_addr_port.nft b/tests/shell/testcases/maps/dumps/nat_addr_port.nft
new file mode 100644 (file)
index 0000000..3ed6812
--- /dev/null
+++ b/tests/shell/testcases/maps/dumps/nat_addr_port.nft
@@ -0,0 +1,13 @@
+table ip ipfoo {
+       map x {
+               type ipv4_addr : ipv4_addr
+       }
+
+       chain c {
+               type nat hook prerouting priority dstnat; policy accept;
+               iifname != "foobar" accept
+               dnat to ip daddr map @x
+               ip saddr 10.1.1.1 dnat to 10.2.3.4
+               ip saddr 10.1.1.2 tcp dport 42 dnat to 10.2.3.4:4242
+       }
+}

diff --git a/tests/shell/testcases/maps/nat_addr_port b/tests/shell/testcases/maps/nat_addr_port
new file mode 100755 (executable)
index 0000000..77a2f11
--- /dev/null
+++ b/tests/shell/testcases/maps/nat_addr_port
@@ -0,0 +1,83 @@
+#!/bin/bash
+
+# skeleton
+$NFT -f /dev/stdin <<EOF || exit 1
+table ip ipfoo {
+       map x {
+               type ipv4_addr : ipv4_addr
+       }
+
+       chain c {
+               type nat hook prerouting priority dstnat; policy accept;
+               meta iifname != "foobar" accept
+               dnat to ip daddr map @x
+               ip saddr 10.1.1.1 dnat to 10.2.3.4
+               ip saddr 10.1.1.2 tcp dport 42 dnat to 10.2.3.4:4242
+       }
+}
+EOF
+
+# should fail: rule has no test for l4 protocol
+$NFT add rule 'ip ipfoo c ip saddr 10.1.1.2 dnat to 10.2.3.4:4242' && exit 1
+
+# should fail: map has wrong family: 4->6
+$NFT add rule 'inet inetfoo c dnat to ip daddr map @x6' && exit 1
+
+# should fail: map has wrong family: 6->4
+$NFT add rule 'inet inetfoo c dnat to ip6 daddr map @x4' && exit 1
+
+# should fail: rule has no test for l4 protocol
+$NFT add rule 'inet inetfoo c ip6 saddr f0:0b::a3 dnat to [1c::3]:42' && exit 1
+
+# should fail: rule has no test for l4 protocol, but map has inet_service
+$NFT add rule 'inet inetfoo c dnat to ip daddr map @y4' && exit 1
+
+# should fail: rule has test for l4 protocol, but map has wrong family: 4->6
+$NFT add rule 'inet inetfoo c meta l4proto tcp dnat to ip daddr map @y6' && exit 1
+
+# should fail: rule has test for l4 protocol, but map has wrong family: 6->4
+$NFT add rule 'inet inetfoo c meta l4proto tcp dnat to ip6 daddr map @y4' && exit 1
+
+# fail: inet_service, but expect ipv4_addr
+$NFT -f /dev/stdin <<EOF && exit 1
+table inet inetfoo {
+       map a {
+               type ipv4_addr : inet_service
+       }
+
+       chain c {
+               type nat hook prerouting priority dstnat; policy accept;
+               meta l4proto tcp dnat ip to ip saddr map @a
+       }
+}
+EOF
+
+# fail: maps to inet_service . inet_service, not addr . service
+$NFT -f /dev/stdin <<EOF && exit 1
+table inet inetfoo {
+       map b {
+               type ipv4_addr : inet_service . inet_service
+       }
+
+       chain c {
+               type nat hook prerouting priority dstnat; policy accept;
+               meta l4proto tcp dnat ip to ip saddr map @a
+       }
+}
+EOF
+
+# fail: only accept exactly two sub-expressions: 'addr . service'
+$NFT -f /dev/stdin <<EOF && exit 1
+table inet inetfoo {
+       map b {
+               type ipv4_addr : inet_addr . inet_service . inet_service
+       }
+
+       chain c {
+               type nat hook prerouting priority dstnat; policy accept;
+               meta l4proto tcp dnat ip to ip saddr map @a
+       }
+}
+EOF
+
+exit 0