tests: match_target.t check for proper cidr matching

Add a test that covers CIDR matching ("multi" flag).

In ipsets CIDR-prefix loop, the multi-flag is re-set so the loop can
continue to less-specific prefixes when an element matched key+iface but
failed the counter constraint.  Without the reset, the loop stops at the
first prefix that has any non-expired element.

(The kernel patch that removed this reset was never
 merged, but add test coverage for this).

Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>

diff --git a/tests/match_target.t b/tests/match_target.t
index c3ead171dd00c533376081f6e6eba101db8ec3be..c4fc777ffdd9821cc732b917147cee7b7af4d3ba 100644 (file)
--- a/tests/match_target.t
+++ b/tests/match_target.t
@@ -54,7 +54,7 @@
 0 ./iptables.sh inet del
 # Send probe packet 10.255.255.64,icmp:host-prohibited
 0 ./sendip.sh -d r10 -p ipv4 -id 127.0.0.1 -is 10.255.255.64 -p icmp -ct 3 -cd 10 127.0.0.1
-# Check that 10.255.255.64,icmp:3/10 isn't in ipport
+# Check that 10.255.255.64,icmp:3/10 is not in ipport
 1 ipset test ipport 10.255.255.64,icmp:host-prohibited
 # Destroy sets and rules
 0 ./iptables.sh inet stop
@@ -118,4 +118,16 @@
 0 ipset l test |grep -q '^10.255.255.64 packets 2'
 # Destroy sets and rules
 0 ./iptables.sh inet stop
+# hash:net,iface set with counters.
+# /24 entry: low counter  -> will fail  --packets-gt 50
+# /16 entry: high counter -> would pass --packets-gt 50
+0 ipset create test hash:net,iface counters
+0 ipset add test 127.0.0.0/24,lo packets 5 bytes 500
+0 ipset add test 127.0.0.0/16,lo packets 100 bytes 10000
+# Match the set with a counter threshold of 50.
+0 iptables -A INPUT -i lo -p icmp -m set --match-set test src,src --packets-gt 50 -j ACCEPT
+0 ping -c 1 -W 1 127.0.0.1 > /dev/null 2>&1
+# Check whether the iptables rule matched.
+0 (set -e; pkts=$(iptables -v -n -L INPUT | grep test | awk '{print $1}') ; [ "${pkts:-0}" -ge 1 ] && exit 0 )
+0 ./iptables.sh inet stop
 # eof