Skip to content

GitLab

Commit fad817ca authored by Arturo Borrero Gonzalez's avatar Arturo Borrero Gonzalez
Browse files

Update upstream source from tag 'upstream/1.8.3' 

Update to upstream version '1.8.3'
with Debian dir 66f8af1a5343b08e330d9f57b47d05089073b3f9
parents c0846eba 89c92f0c
Show whitespace changes
Inline Side-by-side
extensions/libip6t_REDIRECT.t 0 → 100644
View file @ fad817ca
:PREROUTING,OUTPUT
*nat
-p tcp -j REDIRECT --to-ports 42;=;OK
-p udp -j REDIRECT --to-ports 42-1234;=;OK
-p tcp -j REDIRECT --to-ports 42-1234 --random;=;OK
-j REDIRECT --to-ports 42;;FAIL
extensions/libip6t_REJECT.t 0 → 100644
View file @ fad817ca
:INPUT,FORWARD,OUTPUT
-j REJECT;=;OK
# manpage for IPv6 variant of REJECT does not show up for some reason?
-j REJECT --reject-with icmp6-no-route;=;OK
-j REJECT --reject-with icmp6-adm-prohibited;=;OK
-j REJECT --reject-with icmp6-addr-unreachable;=;OK
-j REJECT --reject-with icmp6-port-unreachable;=;OK
-j REJECT --reject-with icmp6-policy-fail;=;OK
-j REJECT --reject-with icmp6-reject-route;=;OK
-p tcp -j REJECT --reject-with tcp-reset;=;OK
-j REJECT --reject-with tcp-reset;;FAIL
extensions/libip6t_SNAT.t 0 → 100644
View file @ fad817ca
:POSTROUTING
*nat
-j SNAT --to-source dead::beef;=;OK
-j SNAT --to-source dead::beef-dead::fee7;=;OK
-j SNAT --to-source [dead::beef]:1025-65535;;FAIL
-j SNAT --to-source [dead::beef] --to-source [dead::fee7];;FAIL
-p tcp -j SNAT --to-source [dead::beef]:1025-65535;=;OK
-p tcp -j SNAT --to-source [dead::beef-dead::fee7]:1025-65535;=;OK
-p tcp -j SNAT --to-source [dead::beef-dead::fee7]:1025-65536;;FAIL
-p tcp -j SNAT --to-source [dead::beef-dead::fee7]:1025-65535 --to-source [dead::beef-dead::fee8]:1025-65535;;FAIL
-j SNAT;;FAIL
extensions/libip6t_SNPT.t 0 → 100644
View file @ fad817ca
:INPUT,POSTROUTING
*mangle
-j SNPT --src-pfx dead::/64 --dst-pfx 1c3::/64;=;OK
-j SNPT --src-pfx dead::beef --dst-pfx 1c3::/64;;FAIL
-j SNPT --src-pfx dead::/64;;FAIL
-j SNPT --dst-pfx dead::/64;;FAIL
-j SNPT;;FAIL
extensions/libip6t_ah.t 0 → 100644
View file @ fad817ca
:INPUT,FORWARD,OUTPUT
-m ah --ahspi 0;=;OK
-m ah --ahspi 4294967295;=;OK
-m ah --ahspi 0:4294967295;-m ah;OK
-m ah ! --ahspi 0;=;OK
# ERROR: should fail: iptables -A FORWARD -t mangle -j CLASSIFY --set-class 1:-1
# -m ah --ahres;=;OK
# ERROR: line 7 (cannot find: ip6tables -I INPUT -m ah --ahlen 32
# -m ah --ahlen 32;=;OK
-m ah --ahspi -1;;FAIL
-m ah --ahspi 4294967296;;FAIL
-m ah --ahspi invalid;;FAIL
-m ah --ahspi 0:invalid;;FAIL
-m ah --ahspi;;FAIL
-m ah;=;OK
extensions/libip6t_dst.t 0 → 100644
View file @ fad817ca
:INPUT,FORWARD,OUTPUT
-m dst --dst-len 0;=;OK
-m dst --dst-opts 149:92,12:12,123:12;=;OK
-m dst ! --dst-len 42;=;OK
-m dst --dst-len 42 --dst-opts 149:92,12:12,123:12;=;OK
extensions/libip6t_eui64.t 0 → 100644
View file @ fad817ca
:PREROUTING
*raw
-m eui64;=;OK
:INPUT,FORWARD
*filter
-m eui64;=;OK
:OUTPUT
-m eui64;;FAIL
extensions/libip6t_frag.t 0 → 100644
View file @ fad817ca
:INPUT,FORWARD,OUTPUT
-m frag --fragid 1:42;=;OK
-m frag --fraglen 42;=;OK
-m frag --fragres;=;OK
-m frag --fragfirst;=;OK
-m frag --fragmore;=;OK
-m frag --fraglast;=;OK
-m frag ! --fragid 1 ! --fraglen 42 --fragres --fragfirst;=;OK
-m frag --fragfirst --fragmore;=;OK
-m frag --fragfirst --fraglast;=;OK
-m frag --fraglast --fragmore;;FAIL
-d ff02::fb/128 -p udp -m udp --dport 5353 -m frag --fragmore;=;OK
-d fe80::/64 -p udp --dport 546 -m frag --fraglast;-d fe80::/64 -p udp -m udp --dport 546 -m frag --fraglast;OK
extensions/libip6t_hbh.t 0 → 100644
View file @ fad817ca
:INPUT,FORWARD,OUTPUT
-m hbh;=;OK
-m hbh --hbh-len 42;=;OK
-m hbh ! --hbh-len 42;=;OK
-m hbh --hbh-len 42 --hbh-opts 1:2,23:42,4:6,8:10,42,23,4:5;=;OK
extensions/libip6t_hl.t 0 → 100644
View file @ fad817ca
:INPUT,FORWARD,OUTPUT
-m hl;;FAIL
-m hl --hl-eq 42;=;OK
-m hl ! --hl-eq 42;=;OK
-m hl --hl-lt 42;=;OK
-m hl --hl-gt 42;=;OK
-m hl --hl-gt 42 --hl-eq 42;;FAIL
-m hl --hl-gt;;FAIL
extensions/libip6t_icmp6.c
View file @ fad817ca
......@@ -230,7 +230,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
type_name = icmp6_type_xlate(icmptype);
if (type_name) {
xt_xlate_add(xl, type_name);
xt_xlate_add(xl, "%s", type_name);
} else {
for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i)
if (icmpv6_codes[i].type == icmptype &&
......@@ -239,7 +239,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
break;
if (i != ARRAY_SIZE(icmpv6_codes))
xt_xlate_add(xl, icmpv6_codes[i].name);
xt_xlate_add(xl, "%s", icmpv6_codes[i].name);
else
return 0;
}
......
extensions/libip6t_icmp6.t 0 → 100644
View file @ fad817ca
:INPUT,FORWARD,OUTPUT
-m icmpv6;;FAIL
-p ipv6-icmp -m icmp6 --icmpv6-type 1/0;=;OK
-p ipv6-icmp -m icmp6 --icmpv6-type 2;=;OK
# cannot use option twice:
-p ipv6-icmp -m icmp6 --icmpv6-type no-route --icmpv6-type packet-too-big;;FAIL
extensions/libip6t_ipv6header.t 0 → 100644
View file @ fad817ca
:INPUT,FORWARD,OUTPUT
-m ipv6header --header hop-by-hop;=;OK
-m ipv6header --header hop-by-hop --soft;=;OK
-m ipv6header --header ipv6-nonxt;=;OK
extensions/libip6t_mh.t 0 → 100644
View file @ fad817ca
:INPUT,FORWARD,OUTPUT
-m mh;;FAIL
-p mobility-header -m mh;=;OK
-p mobility-header -m mh --mh-type 1;=;OK
-p mobility-header -m mh ! --mh-type 4;=;OK
-p mobility-header -m mh --mh-type 4:123;=;OK
extensions/libip6t_mh.txlate
View file @ fad817ca
ip6tables-translate -A INPUT -p mh --mh-type 1 -j ACCEPT
nft add rule ip6 filter INPUT meta l4proto 135 mh type 1 counter accept
nft add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter accept
ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT
nft add rule ip6 filter INPUT meta l4proto 135 mh type 1-3 counter accept
nft add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept
extensions/libip6t_rt.t 0 → 100644
View file @ fad817ca
:INPUT,FORWARD,OUTPUT
-m rt --rt-type 0 --rt-segsleft 1:23 --rt-len 42 --rt-0-res;=;OK
-m rt --rt-type 0 ! --rt-segsleft 1:23 ! --rt-len 42 --rt-0-res;=;OK
-m rt ! --rt-type 1 ! --rt-segsleft 12:23 ! --rt-len 42;=;OK
-m rt;=;OK
extensions/libip6t_srh.t 0 → 100644
View file @ fad817ca
:INPUT,FORWARD,OUTPUT
-m srh --srh-next-hdr 17;=;OK
-m srh --srh-hdr-len-eq 8;=;OK
-m srh --srh-hdr-len-gt 8;=;OK
-m srh --srh-hdr-len-lt 8;=;OK
-m srh --srh-segs-left-eq 1;=;OK
-m srh --srh-segs-left-gt 1;=;OK
-m srh --srh-segs-left-lt 1;=;OK
-m srh --srh-last-entry-eq 4;=;OK
-m srh --srh-last-entry-gt 4;=;OK
-m srh --srh-last-entry-lt 4;=;OK
-m srh --srh-tag 0;=;OK
-m srh ! --srh-next-hdr 17;=;OK
-m srh ! --srh-hdr-len-eq 8;=;OK
-m srh ! --srh-hdr-len-gt 8;=;OK
-m srh ! --srh-hdr-len-lt 8;=;OK
-m srh ! --srh-segs-left-eq 1;=;OK
-m srh ! --srh-segs-left-gt 1;=;OK
-m srh ! --srh-segs-left-lt 1;=;OK
-m srh ! --srh-last-entry-eq 4;=;OK
-m srh ! --srh-last-entry-gt 4;=;OK
-m srh ! --srh-last-entry-lt 4;=;OK
-m srh ! --srh-tag 0;=;OK
-m srh --srh-next-hdr 17 --srh-segs-left-eq 1 --srh-last-entry-eq 4 --srh-tag 0;=;OK
-m srh ! --srh-next-hdr 17 ! --srh-segs-left-eq 0 --srh-tag 0;=;OK
-m srh --srh-psid A::/64 --srh-nsid B:: --srh-lsid C::/0;;OK
-m srh ! --srh-psid A::/64 ! --srh-nsid B:: ! --srh-lsid C::/0;;OK
-m srh;=;OK
extensions/libip6t_standard.t 0 → 100644
View file @ fad817ca
:INPUT,FORWARD,OUTPUT
-s ::/128;=;OK
! -d ::;! -d ::/128;OK
! -s ::;! -s ::/128;OK
-s ::/64;=;OK
extensions/libipt_CLUSTERIP.t 0 → 100644
View file @ fad817ca
:INPUT
-d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 0 --hash-init 1;=;FAIL
-d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 1 --hash-init 1;=;OK
-d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 2 --hash-init 1;=;OK
extensions/libipt_DNAT.t 0 → 100644
View file @ fad817ca
:PREROUTING
*nat
-j DNAT --to-destination 1.1.1.1;=;OK
-j DNAT --to-destination 1.1.1.1-1.1.1.10;=;OK
-j DNAT --to-destination 1.1.1.1:1025-65535;;FAIL
-j DNAT --to-destination 1.1.1.1 --to-destination 2.2.2.2;;FAIL
-p tcp -j DNAT --to-destination 1.1.1.1:1025-65535;=;OK
-p tcp -j DNAT --to-destination 1.1.1.1-1.1.1.10:1025-65535;=;OK
-p tcp -j DNAT --to-destination 1.1.1.1-1.1.1.10:1025-65536;;FAIL
-p tcp -j DNAT --to-destination 1.1.1.1-1.1.1.10:1025-65535 --to-destination 2.2.2.2-2.2.2.20:1025-65535;;FAIL
-p tcp -j DNAT --to-destination 1.1.1.1:1000-2000/1000;=;OK
-p tcp -j DNAT --to-destination 1.1.1.1:1000-2000/3000;=;OK
-p tcp -j DNAT --to-destination 1.1.1.1:1000-2000/65535;=;OK
-p tcp -j DNAT --to-destination 1.1.1.1:1000-2000/0;;FAIL
-p tcp -j DNAT --to-destination 1.1.1.1:1000-2000/65536;;FAIL
-j DNAT;;FAIL
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment