blob: 89a82f03a91771a36d1ea6f62ab7270c298307bb (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
|
#!/bin/bash
# shunit2 tests for the nftset add_dnsmasq_element branch of pbr.
. "$(dirname "${BASH_SOURCE[0]}")/../lib/setup.sh"
oneTimeTearDown() { rm -rf "${MOCK_ROOT:-}"; }
setUp() {
: > "$packageDnsmasqFile"
ipv6_enabled=""
}
# nftset signature: command iface target type uid comment param
# nftset4 resolves to: ${nftPrefix}_${iface}_4_dst_ip
_add() {
local iface="${1:-policyA}"
local comment="${2:-$iface}"
local param="${3:-example.com}"
nftset add_dnsmasq_element "$iface" "dst" "ip" "" "$comment" "$param"
}
# ---------------------------------------------------------------------------
# 1. First write: domain not yet present → new line written
# ---------------------------------------------------------------------------
testFirstWriteCreatesNewLine() {
_add policyA
lineCount=$(grep -c "^nftset=/example\.com/" "$packageDnsmasqFile")
assertEquals "one line should be written" 1 "$lineCount"
grep -q "4#inet#fw4#pbr_policyA_4_dst_ip" "$packageDnsmasqFile"
assertTrue "spec should be present" $?
grep -q "# policyA" "$packageDnsmasqFile"
assertTrue "comment should be present" $?
}
# ---------------------------------------------------------------------------
# 2. Idempotency: calling again with the same set must not duplicate it
# ---------------------------------------------------------------------------
testIdempotentCallDoesNotDuplicateSpec() {
_add policyA
_add policyA
lineCount=$(grep -c "^nftset=/example\.com/" "$packageDnsmasqFile")
assertEquals "still exactly one line" 1 "$lineCount"
specCount=$(grep -o "pbr_policyA_4_dst_ip" "$packageDnsmasqFile" | wc -l)
assertEquals "set spec must not be duplicated" 1 "$specCount"
}
# ---------------------------------------------------------------------------
# 3. Second policy on same domain → specs merged onto one line
# ---------------------------------------------------------------------------
testSecondPolicyMergedOntoExistingLine() {
_add policyA
_add policyB
lineCount=$(grep -c "^nftset=/example\.com/" "$packageDnsmasqFile")
assertEquals "must remain one line after merge" 1 "$lineCount"
line=$(grep "^nftset=/example\.com/" "$packageDnsmasqFile")
echo "$line" | grep -q "pbr_policyA_4_dst_ip"
assertTrue "policyA spec must still be present" $?
echo "$line" | grep -q "pbr_policyB_4_dst_ip"
assertTrue "policyB spec must be appended" $?
}
# ---------------------------------------------------------------------------
# 4. Comment accumulation: both policy names must appear in the comment
# ---------------------------------------------------------------------------
testBothPolicyNamesInCommentAfterMerge() {
_add policyA
_add policyB
line=$(grep "^nftset=/example\.com/" "$packageDnsmasqFile")
echo "$line" | grep -q "policyA"
assertTrue "policyA should be in comment" $?
echo "$line" | grep -q "policyB"
assertTrue "policyB should be in comment" $?
}
# ---------------------------------------------------------------------------
# 5. IPv6 + IPv4 first write includes both specs
# ---------------------------------------------------------------------------
testFirstWriteWithIpv6IncludesBothSpecs() {
ipv6_enabled=1
_add policyA
line=$(grep "^nftset=/example\.com/" "$packageDnsmasqFile")
echo "$line" | grep -q "4#inet#fw4#pbr_policyA_4_dst_ip"
assertTrue "IPv4 spec should be written" $?
echo "$line" | grep -q "6#inet#fw4#pbr_policyA_6_dst_ip"
assertTrue "IPv6 spec should be written" $?
}
# ---------------------------------------------------------------------------
# 6. IPv6 already present: only IPv4 part appended (no v6 duplicate)
# ---------------------------------------------------------------------------
testAppendOnlyIpv4WhenIpv6AlreadyPresent() {
echo "nftset=/example.com/6#inet#fw4#pbr_policyA_6_dst_ip # policyA" \
> "$packageDnsmasqFile"
ipv6_enabled=1
_add policyA
specCount=$(grep -o "pbr_policyA_6_dst_ip" "$packageDnsmasqFile" | wc -l)
assertEquals "IPv6 spec must not be duplicated" 1 "$specCount"
grep -q "4#inet#fw4#pbr_policyA_4_dst_ip" "$packageDnsmasqFile"
assertTrue "IPv4 spec should be appended" $?
}
# ---------------------------------------------------------------------------
# 7. Prefix-safety: a set whose name is a prefix of another must not be
# falsely treated as already present (anchored-match regression)
# ---------------------------------------------------------------------------
testSetNamePrefixNotMistakeForExistingSet() {
_add policyA_extra policyC
_add policyA policyA
line=$(grep "^nftset=/example\.com/" "$packageDnsmasqFile")
echo "$line" | grep -qE "4#inet#fw4#pbr_policyA_4_dst_ip(,| |$)"
assertTrue "policyA_4 should be added even though policyA_extra_4 exists" $?
}
# ---------------------------------------------------------------------------
# 8. Different domains: each gets its own independent line
# ---------------------------------------------------------------------------
testDifferentDomainsGetSeparateLines() {
_add policyA policyA example.com
_add policyB policyB other.com
lineCount=$(grep -c "^nftset=/" "$packageDnsmasqFile")
assertEquals "two domains should produce two lines" 2 "$lineCount"
grep -q "^nftset=/example\.com/" "$packageDnsmasqFile"
assertTrue "example.com line should exist" $?
grep -q "^nftset=/other\.com/" "$packageDnsmasqFile"
assertTrue "other.com line should exist" $?
}
. shunit2
|
