Some test results are not consistent between variants:
* CLUSTERIP is not supported with nft_compat, so all related tests fail
with iptables-nft.
* iptables-legacy mandates TCPMSS be combined with SYN flag match,
iptables-nft does not care. (Or precisely, xt_TCPMSS.ko can't validate
match presence.)
Avoid the expected failures by allowing "NFT" and "LGC" outcomes in
addition to "OK" and "FAIL". They specify the variant with which given
test should pass.
Signed-off-by: Phil Sutter <phil@xxxxxx>
---
extensions/libipt_CLUSTERIP.t | 4 ++--
extensions/libxt_TCPMSS.t | 2 +-
iptables-test.py | 7 +++++--
3 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/extensions/libipt_CLUSTERIP.t b/extensions/libipt_CLUSTERIP.t
index 5af555e005c1d..d3a2d6cbb1b2e 100644
--- a/extensions/libipt_CLUSTERIP.t
+++ b/extensions/libipt_CLUSTERIP.t
@@ -1,4 +1,4 @@
:INPUT
-d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 0 --hash-init 1;=;FAIL
--d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 1 --hash-init 1;=;OK
--d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 2 --hash-init 1;=;OK
+-d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 1 --hash-init 1;=;LGC
+-d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 2 --hash-init 1;=;LGC
diff --git a/extensions/libxt_TCPMSS.t b/extensions/libxt_TCPMSS.t
index 553a3452e4876..c3ee2de880826 100644
--- a/extensions/libxt_TCPMSS.t
+++ b/extensions/libxt_TCPMSS.t
@@ -1,6 +1,6 @@
:FORWARD,OUTPUT,POSTROUTING
*mangle
-j TCPMSS;;FAIL
--p tcp -j TCPMSS --set-mss 42;;FAIL
+-p tcp -j TCPMSS --set-mss 42;;NFT
-p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j TCPMSS --set-mss 42;=;OK
-p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j TCPMSS --clamp-mss-to-pmtu;=;OK
diff --git a/iptables-test.py b/iptables-test.py
index 95fa11b1475ca..be1b1a94decf4 100755
--- a/iptables-test.py
+++ b/iptables-test.py
@@ -91,8 +91,11 @@ def run_test(iptables, rule, rule_save, res, filename, lineno, netns):
#
# report failed test
#
+ should_pass = (res == "OK") or \
+ (res == "NFT" and EXECUTABLE == "xtables-nft-multi") or \
+ (res == "LGC" and EXECUTABLE == "xtables-legacy-multi")
if ret:
- if res == "OK":
+ if should_pass:
reason = "cannot load: " + cmd
print_error(reason, filename, lineno)
return -1
@@ -100,7 +103,7 @@ def run_test(iptables, rule, rule_save, res, filename, lineno, netns):
# do not report this error
return 0
else:
- if res == "FAIL":
+ if not should_pass:
reason = "should fail: " + cmd
print_error(reason, filename, lineno)
delete_rule(iptables, rule, filename, lineno)
--
2.34.1
