Added tests for 'length' match, added print_parse_capabilities().

Added tests for iptables 'length' match.
Added print_parse_capabilities() so that IPTables::Parse keys/regex's can
easily be seen.

diff --git a/Changes b/Changes
index 7f18698..dc782b6 100644 (file)
--- a/Changes
+++ b/Changes
@@ -9,6 +9,9 @@ Revision history for Perl extension IPTables::ChainMgr.
       which was updated to allow the value "-1" to be passed in as the rule
       insertion number in order to denote "append" (-A <chain>) mode.
     - Added "mac_source" tests to t/basic_tests.pl.
+    - Added tests for iptables 'length' match.
+    - Added print_parse_capabilities() so that IPTables::Parse keys/regex's can
+      easily be seen.
     - Bug fix to ensure that state tracking arguments are properly processed
       by add_ip_rule().
 

diff --git a/lib/IPTables/ChainMgr.pm b/lib/IPTables/ChainMgr.pm
index 0d7b35b..86bc825 100644 (file)
--- a/lib/IPTables/ChainMgr.pm
+++ b/lib/IPTables/ChainMgr.pm
@@ -439,6 +439,7 @@ sub find_ip_rule() {
             to_port mac_source state ctstate));
 
     if ($IPTables::Parse::VERSION > 1.1) {
+
         @parse_keys = ();
 
         ### get the keys list from the IPTables::Parse module
@@ -535,6 +536,57 @@ sub find_ip_rule() {
     return 0, $#$chain_ar+1;
 }
 
+sub print_parse_capabilities() {
+    my $self = shift;
+
+    my $ipt_parse = new IPTables::Parse(
+        'iptables'  => $self->{'_iptables'},
+        'iptout'    => $self->{'_iptout'},
+        'ipterr'    => $self->{'_ipterr'},
+        'debug'     => $self->{'_debug'},
+        'verbose'   => $self->{'_verbose'},
+        'ipt_alarm' => $self->{'_ipt_alarm'},
+        'ipt_exec_style' => $self->{'_ipt_exec_style'},
+        'ipt_exec_sleep' => $self->{'_ipt_exec_sleep'},
+        'sigchld_handler' => $self->{'_sigchld_handler'},
+    ) or croak "[*] Could not acquire IPTables::Parse object";
+
+    if ($IPTables::Parse::VERSION > 1.1) {
+
+        print "[+] IPTables::Parse regular options:\n";
+        for my $key (keys %{$ipt_parse->{'parse_keys'}->{'regular'}}) {
+            my $p_hr = $ipt_parse->{'parse_keys'}->{'regular'}->{$key};
+            print "    $key\n";
+            if (defined $p_hr->{'regex'} and $p_hr->{'regex'}) {
+                print "      regex: $p_hr->{'regex'}", "\n";
+            }
+            if (defined $p_hr->{'ipt_match'} and $p_hr->{'ipt_match'}) {
+                print "      ipt_match: $p_hr->{'ipt_match'} <val>", "\n";
+            }
+        }
+
+        print "\n[+] IPTables::Parse extended options:\n";
+        for my $key (keys %{$ipt_parse->{'parse_keys'}->{'extended'}}) {
+            my $p_hr = $ipt_parse->{'parse_keys'}->{'extended'}->{$key};
+            print "    $key\n";
+            if (defined $p_hr->{'regex'} and $p_hr->{'regex'}) {
+                print "      regex: $p_hr->{'regex'}", "\n";
+            }
+            if (defined $p_hr->{'ipt_match'} and $p_hr->{'ipt_match'}) {
+                print "      ipt_match: $p_hr->{'ipt_match'} <val>", "\n";
+            }
+        }
+
+    } else {
+        print "[+] IPTables::Parse capabilities:\n";
+        for my $key (qw(protocol s_port d_port to_ip
+                to_port mac_source state ctstate)) {
+            print "    $key\n";
+        }
+    }
+    return;
+}
+
 sub state_compare() {
     my ($state_str1, $state_str2) = @_;
 

diff --git a/t/basic_tests.pl b/t/basic_tests.pl
index a1a7683..f00c990 100755 (executable)
--- a/t/basic_tests.pl
+++ b/t/basic_tests.pl
@@ -32,13 +32,6 @@ my $PRINT_LEN = 68;
 my $chain_past_end = 1000;
 #================== end config ===================
 
-my %targets = (
-    'ACCEPT' => '',
-    'DROP'   => '',
-    'QUEUE'  => '',
-    'RETURN' => '',
-);
-
 my %iptables_chains = (
     'mangle' => [qw/PREROUTING INPUT OUTPUT FORWARD POSTROUTING/],
     'raw'    => [qw/PREROUTING OUTPUT/],
@@ -363,6 +356,20 @@ sub add_extended_rules_tests() {
                 $dst_ip, $test_table, $test_chain, $target,
                 {'normalize' => 1, 'protocol' => 'udp', 's_port' => 0, 'd_port' => 53});
         &pass_fail($rule_position, "   Could not find UDP $src_ip(0) -> $dst_ip(53) $target rule");
+
+        ### UDP length
+        &dots_print("add_ext_ip_rules(): $test_table $test_chain UDP $src_ip(0) -> $dst_ip(53) $target length 10:100 ");
+        ($rv, $out_ar, $err_ar) = $ipt_obj->add_ip_rule($src_ip,
+                $dst_ip, $chain_past_end, $test_table, $test_chain, $target,
+                {'protocol' => 'udp', 's_port' => 0, 'd_port' => 53, 'length' => '10:100'});
+        &pass_fail($rv, "   Could not add UDP $src_ip(0) -> $dst_ip(53) $target length 10:100 rule");
+
+        &dots_print("find ext rule: $test_table $test_chain UDP $src_ip(0) -> $dst_ip(53) $target ");
+        ($rule_position, $num_chain_rules) = $ipt_obj->find_ip_rule($src_ip,
+                $dst_ip, $test_table, $test_chain, $target,
+                {'normalize' => 1, 'protocol' => 'udp', 's_port' => 0, 'd_port' => 53, 'length' => '10:100'});
+        &pass_fail($rule_position, "   Could not find UDP $src_ip(0) -> $dst_ip(53) $target  length 10:100 rule");
+
     }
 
     return;
@@ -431,7 +438,11 @@ sub dots_print() {
     for (my $i=length($msg); $i < $PRINT_LEN; $i++) {
         $dots .= '.';
     }
-    &logr($dots);
+    if ($dots) {
+        &logr($dots);
+    } else {
+        &logr(' ') unless $msg =~ /\s$/;
+    }
     return;
 }