expand testing

IPTables.Net.Tests/RuleParseAssert.cs

@@ -0,0 +1,21 @@
+using IPTables.Net.Iptables;
+
+namespace IPTables.Net.Tests
+{
+    internal static class RuleParseAssert
+    {
+        public static IpTablesRule RoundTrips(string input, string expected = null, int version = 4)
+        {
+            expected = expected ?? input;
+
+            var rule = IpTablesRule.Parse(input, null, new IpTablesChainSet(version), version);
+            Assert.Equal(expected, rule.GetActionCommand());
+
+            var reparsed = IpTablesRule.Parse(expected, null, new IpTablesChainSet(version), version);
+            Assert.True(reparsed.Compare(rule), "Rendered rule should parse back to the same model: " + expected);
+            Assert.Equal(expected, reparsed.GetActionCommand());
+
+            return rule;
+        }
+    }
+}

IPTables.Net.Tests/SingleBpfRuleParseTests.cs

@@ -0,0 +1,11 @@
+namespace IPTables.Net.Tests
+{
+    public class SingleBpfRuleParseTests
+    {
+        [Fact]
+        public void TestBpfBytecodeRoundTrip()
+        {
+            RuleParseAssert.RoundTrips("-A INPUT -m bpf --bytecode 1,6,0,0,262144");
+        }
+    }
+}

IPTables.Net.Tests/SingleCommentRuleParseTests.cs

@@ -54,5 +54,11 @@ public void TestAddCommentAfter()
 
             Assert.Equal(rule2, irule1.GetActionCommand());
         }
+
+        [Fact]
+        public void TestCommentRoundTrip()
+        {
+            RuleParseAssert.RoundTrips("-A INPUT -m comment --comment 'this is a test rule'");
+        }
     }
-}
+}

IPTables.Net.Tests/SingleConnlimitRuleParseTests.cs

@@ -27,5 +27,15 @@ public void TestDropConnectionLimitEquality()
 
             Assert.True(irule2.Compare(irule1));
         }
+
+        [Theory]
+        [InlineData("-A INPUT -p tcp -m connlimit --connlimit-upto 5", "-A INPUT -p tcp -m connlimit --connlimit-upto 5")]
+        [InlineData("-A INPUT -p tcp -m connlimit --connlimit-above 10 --connlimit-mask 24", "-A INPUT -p tcp -m connlimit --connlimit-above 10 --connlimit-mask 24")]
+        [InlineData("-A INPUT -p tcp -m connlimit --connlimit-above 10 --connlimit-daddr", "-A INPUT -p tcp -m connlimit --connlimit-above 10 --connlimit-daddr")]
+        [InlineData("-A INPUT -p tcp -m connlimit --connlimit-above 10 --connlimit-saddr", "-A INPUT -p tcp -m connlimit --connlimit-above 10")]
+        public void TestConnlimitOptionRoundTrip(string input, string expected)
+        {
+            RuleParseAssert.RoundTrips(input, expected);
+        }
     }
-}
+}

IPTables.Net.Tests/SingleConnmarkRuleParseTests.cs

@@ -154,5 +154,17 @@ public void TestRestoreMark()
 
             Assert.Equal(rule, irule.GetActionCommand());
         }
+
+        [Theory]
+        [InlineData("-A INPUT -m connmark ! --mark 0xFF", "-A INPUT -m connmark ! --mark 0xFF")]
+        [InlineData("-A INPUT -j CONNMARK --set-mark 0xFF", "-A INPUT -j CONNMARK --set-xmark 0xFF")]
+        [InlineData("-A INPUT -j CONNMARK --and-mark 0x0", "-A INPUT -j CONNMARK --set-xmark 0x0")]
+        [InlineData("-A INPUT -j CONNMARK --or-mark 0", "-A INPUT -j CONNMARK --set-xmark 0x0/0x0")]
+        [InlineData("-A INPUT -j CONNMARK --xor-mark 0", "-A INPUT -j CONNMARK --set-xmark 0x0/0x0")]
+        [InlineData("-A INPUT -j CONNMARK --save-mark --ctmask 0x11 --nfmask 0x3FFFF00", "-A INPUT -j CONNMARK --save-mark --ctmask 0x11 --nfmask 0x3FFFF00")]
+        public void TestConnmarkOptionRoundTrip(string input, string expected)
+        {
+            RuleParseAssert.RoundTrips(input, expected);
+        }
     }
-}
+}

IPTables.Net.Tests/SingleConntrackRuleParseTests.cs

@@ -18,5 +18,16 @@ public void TestParse()
             irule2.Equals(irule1);
             Assert.True(irule2.Compare(irule1));
         }
+
+        [Theory]
+        [InlineData("-A PREROUTING -t raw -j CT --helper ftp", "-A PREROUTING -t raw -j CT --helper ftp")]
+        [InlineData("-A PREROUTING -t raw -j CT --ctevents new,destroy", "-A PREROUTING -t raw -j CT --ctevents new,destroy")]
+        [InlineData("-A PREROUTING -t raw -j CT --expevents related", "-A PREROUTING -t raw -j CT --expevents related")]
+        [InlineData("-A PREROUTING -t raw -j CT --notrack", "-A PREROUTING -t raw -j CT --notrack")]
+        [InlineData("-A PREROUTING -t raw -j CT --helper ftp --ctevents new,destroy --expevents related --notrack", "-A PREROUTING -t raw -j CT --notrack --helper ftp --ctevents new,destroy --expevents related")]
+        public void TestCtTargetOptionRoundTrip(string input, string expected)
+        {
+            RuleParseAssert.RoundTrips(input, expected);
+        }
     }
-}
+}

IPTables.Net.Tests/SingleCoreRuleParseTests.cs

@@ -154,5 +154,26 @@ public void TestCoreFragmentingEquality()
 
             Assert.True(irule2.Compare(irule1));
         }
+
+        [Theory]
+        [InlineData("-A INPUT --protocol tcp -j ACCEPT", "-A INPUT -p tcp -j ACCEPT")]
+        [InlineData("-A INPUT ! --protocol tcp -j ACCEPT", "-A INPUT ! -p tcp -j ACCEPT")]
+        [InlineData("-A INPUT --source 10.0.0.1/24 -j ACCEPT", "-A INPUT -s 10.0.0.1/24 -j ACCEPT")]
+        [InlineData("-A INPUT ! --source 10.0.0.1/24 -j ACCEPT", "-A INPUT ! -s 10.0.0.1/24 -j ACCEPT")]
+        [InlineData("-A INPUT --destination 192.0.2.5 -j ACCEPT", "-A INPUT -d 192.0.2.5 -j ACCEPT")]
+        [InlineData("-A INPUT ! --destination 192.0.2.5 -j ACCEPT", "-A INPUT ! -d 192.0.2.5 -j ACCEPT")]
+        [InlineData("-A INPUT --in-interface eth0+ -j ACCEPT", "-A INPUT -i eth0+ -j ACCEPT")]
+        [InlineData("-A INPUT ! --in-interface eth0+ -j ACCEPT", "-A INPUT ! -i eth0+ -j ACCEPT")]
+        [InlineData("-A INPUT --out-interface eth1 -j ACCEPT", "-A INPUT -o eth1 -j ACCEPT")]
+        [InlineData("-A INPUT ! --out-interface eth1 -j ACCEPT", "-A INPUT ! -o eth1 -j ACCEPT")]
+        [InlineData("-A INPUT --fragment -j ACCEPT", "-A INPUT -f -j ACCEPT")]
+        [InlineData("-A INPUT ! --fragment -j ACCEPT", "-A INPUT ! -f -j ACCEPT")]
+        [InlineData("-A INPUT --jump ACCEPT", "-A INPUT -j ACCEPT")]
+        [InlineData("-A INPUT --goto NEXT_CHAIN", "-A INPUT -g NEXT_CHAIN")]
+        [InlineData("-A INPUT --set-counters 12 34 -j ACCEPT", "-A INPUT -c 12 34 -j ACCEPT")]
+        public void TestCoreOptionRoundTrip(string input, string expected)
+        {
+            RuleParseAssert.RoundTrips(input, expected);
+        }
     }
-}
+}

IPTables.Net.Tests/SingleDevgroupRuleParseTests.cs

@@ -0,0 +1,16 @@
+namespace IPTables.Net.Tests
+{
+    public class SingleDevgroupRuleParseTests
+    {
+        [Theory]
+        [InlineData("-A INPUT -m devgroup --src-group 0x1/0xFF")]
+        [InlineData("-A INPUT -m devgroup ! --src-group 0x1/0xFF")]
+        [InlineData("-A INPUT -m devgroup --dst-group 0x2/0xFF")]
+        [InlineData("-A INPUT -m devgroup ! --dst-group 0x2/0xFF")]
+        [InlineData("-A INPUT -m devgroup --src-group 0x1/0xFF --dst-group 0x2/0xFF")]
+        public void TestDevgroupOptionRoundTrip(string rule)
+        {
+            RuleParseAssert.RoundTrips(rule);
+        }
+    }
+}

IPTables.Net.Tests/SingleDnatRuleParseTests.cs

@@ -29,5 +29,15 @@ public void TestDnatRangeSourceAndEquality()
             Assert.Equal(rule, irule1.GetActionCommand());
             Assert.Equal(rule, irule2.GetActionCommand());
         }
+
+        [Theory]
+        [InlineData("-A PREROUTING -t nat -j DNAT --to-destination 2.2.2.2:1000-2000")]
+        [InlineData("-A PREROUTING -t nat -j DNAT --random")]
+        [InlineData("-A PREROUTING -t nat -j DNAT --persistent")]
+        [InlineData("-A PREROUTING -t nat -j DNAT --to-destination 2.2.2.2 --random --persistent")]
+        public void TestDnatOptionRoundTrip(string rule)
+        {
+            RuleParseAssert.RoundTrips(rule);
+        }
     }
-}
+}

IPTables.Net.Tests/SingleDynjmpRuleParseTests.cs

@@ -0,0 +1,13 @@
+namespace IPTables.Net.Tests
+{
+    public class SingleDynjmpRuleParseTests
+    {
+        [Theory]
+        [InlineData("-A INPUT -j DYNJMP")]
+        [InlineData("-A INPUT -j SYNJMP")]
+        public void TestNoOptionDynjmpTargetsRoundTrip(string rule)
+        {
+            RuleParseAssert.RoundTrips(rule);
+        }
+    }
+}

IPTables.Net.Tests/SingleHashlimitRuleParseTests.cs

@@ -53,7 +53,7 @@
             Assert.True(IpTablesRule.Parse(rule, null, chains, 4).Compare(IpTablesRule.Parse(rule, null, chains, 4)));
 
             String outputRule = IpTablesRule.Parse(rule, null, chains, 4).GetActionCommand();
             Assert.True(outputRule.Contains("5kb/s"));
         }
         [Fact]
         public void TestByte2()
@@ -62,7 +62,7 @@
             IpTablesChainSet chains = new IpTablesChainSet(4);
 
             Assert.True(IpTablesRule.Parse(rule, null, chains, 4).Compare(IpTablesRule.Parse(rule, null, chains, 4)));
             Assert.True(IpTablesRule.Parse(rule, null, chains, 4).GetActionCommand().Contains("5kb/s"));
         }
 
         [Fact]
@@ -112,5 +112,14 @@
 
             Assert.False(r1.Compare(r2));
         }
+
+        [Theory]
+        [InlineData("-A ABC -m hashlimit --hashlimit 9/min --hashlimit-burst 4 --hashlimit-mode srcip --hashlimit-name h --hashlimit-srcmask 24 --hashlimit-dstmask 32 --hashlimit-htable-size 111 --hashlimit-htable-max 222 --hashlimit-htable-expire 333 --hashlimit-htable-gcinterval 444", "-A ABC -m hashlimit --hashlimit-name h --hashlimit-upto 9/minute --hashlimit-burst 4 --hashlimit-mode srcip --hashlimit-srcmask 24 --hashlimit-dstmask 32 --hashlimit-htable-size 111 --hashlimit-htable-max 222 --hashlimit-htable-expire 333 --hashlimit-htable-gcinterval 444")]
+        [InlineData("-A ABC -m hashlimit --hashlimit-upto 8/s --hashlimit-burst 4 --hashlimit-mode dstip --hashlimit-name h", "-A ABC -m hashlimit --hashlimit-name h --hashlimit-upto 8/second --hashlimit-burst 4 --hashlimit-mode dstip --hashlimit-srcmask 32 --hashlimit-dstmask 32 --hashlimit-htable-size 65000 --hashlimit-htable-max 200000 --hashlimit-htable-expire 10000 --hashlimit-htable-gcinterval 1000")]
+        [InlineData("-A ABC -m hashlimit --hashlimit-above 8/s --hashlimit-burst 4 --hashlimit-mode dstip --hashlimit-name h", "-A ABC -m hashlimit --hashlimit-name h --hashlimit-above 8/second --hashlimit-burst 4 --hashlimit-mode dstip --hashlimit-srcmask 32 --hashlimit-dstmask 32 --hashlimit-htable-size 65000 --hashlimit-htable-max 200000 --hashlimit-htable-expire 10000 --hashlimit-htable-gcinterval 1000")]
+        public void TestHashlimitOptionRoundTrip(string input, string expected)
+        {
+            RuleParseAssert.RoundTrips(input, expected);
+        }
     }
-}
+}

IPTables.Net.Tests/SingleHelperRuleParseTests.cs

@@ -26,5 +26,11 @@ public void TestHelper()
 
             Assert.Equal(rule, irule.GetActionCommand());
         }
+
+        [Fact]
+        public void TestPositiveHelperRoundTrip()
+        {
+            RuleParseAssert.RoundTrips("-A INPUT -m helper --helper ftp -j ACCEPT");
+        }
     }
-}
+}

IPTables.Net.Tests/SingleIpSetRuleParseTests.cs

@@ -26,5 +26,34 @@ public void Test2()
 
             Assert.Equal(rule, irule.GetActionCommand());
         }
+
+        [Theory]
+        [InlineData("-A FORWARD -m set ! --match-set test src", "-A FORWARD -m set ! --match-set test src")]
+        [InlineData("-A FORWARD -m set --match-set test src --return-nomatch", "-A FORWARD -m set --match-set test src --return-nomatch")]
+        [InlineData("-A FORWARD -m set --match-set test src ! --update-counters", "-A FORWARD -m set --match-set test src ! --update-counters")]
+        [InlineData("-A FORWARD -m set --match-set test src ! --update-subcounters", "-A FORWARD -m set --match-set test src ! --update-subcounters")]
+        [InlineData("-A FORWARD -m set --match-set test src --packets-eq 3", "-A FORWARD -m set --match-set test src --packets-eq 3")]
+        [InlineData("-A FORWARD -m set --match-set test src ! --packets-eq 3", "-A FORWARD -m set --match-set test src ! --packets-eq 3")]
+        [InlineData("-A FORWARD -m set --match-set test src --packets-lt 3", "-A FORWARD -m set --match-set test src --packets-lt 3")]
+        [InlineData("-A FORWARD -m set --match-set test src --packets-gt 3", "-A FORWARD -m set --match-set test src --packets-gt 3")]
+        [InlineData("-A FORWARD -m set --match-set test src --bytes-eq 4", "-A FORWARD -m set --match-set test src --bytes-eq 4")]
+        [InlineData("-A FORWARD -m set --match-set test src ! --bytes-eq 4", "-A FORWARD -m set --match-set test src ! --bytes-eq 4")]
+        [InlineData("-A FORWARD -m set --match-set test src --bytes-lt 4", "-A FORWARD -m set --match-set test src --bytes-lt 4")]
+        [InlineData("-A FORWARD -m set --match-set test src --bytes-gt 4", "-A FORWARD -m set --match-set test src --bytes-gt 4")]
+        public void TestSetMatchOptionRoundTrip(string input, string expected)
+        {
+            RuleParseAssert.RoundTrips(input, expected);
+        }
+
+        [Theory]
+        [InlineData("-A FORWARD -j SET --add-set test src", "-A FORWARD -j SET --add-set test src")]
+        [InlineData("-A FORWARD -j SET --del-set test dst", "-A FORWARD -j SET --del-set test dst")]
+        [InlineData("-A FORWARD -j SET --map-set test src,dst", "-A FORWARD -j SET --map-set test src,dst")]
+        [InlineData("-A FORWARD -j SET --add-set test src --exist", "-A FORWARD -j SET --add-set test src --exist")]
+        [InlineData("-A FORWARD -j SET --add-set test src --timeout 30", "-A FORWARD -j SET --add-set test src --timeout 30")]
+        public void TestSetTargetOptionRoundTrip(string input, string expected)
+        {
+            RuleParseAssert.RoundTrips(input, expected);
+        }
     }
-}
+}

IPTables.Net.Tests/SingleLengthRuleParseTests.cs

@@ -36,5 +36,11 @@ public void TestNotLength()
 
             Assert.Equal(rule, irule.GetActionCommand());
         }
+
+        [Fact]
+        public void TestLengthRoundTrip()
+        {
+            RuleParseAssert.RoundTrips("-A INPUT -m length --length 10 -j ACCEPT");
+        }
     }
-}
+}

IPTables.Net.Tests/SingleLimitParseTests.cs

@@ -42,5 +42,16 @@ public void TestRateCompare3()
 
             Assert.True(r1.Compare(r2));
         }
+
+        [Theory]
+        [InlineData("-A ABC -m limit --limit 10/s", "-A ABC -m limit --limit 10/second --limit-burst 5")]
+        [InlineData("-A ABC -m limit --limit 10/sec --limit-burst 7", "-A ABC -m limit --limit 10/second --limit-burst 7")]
+        [InlineData("-A ABC -m limit --limit 10/minute --limit-burst 7", "-A ABC -m limit --limit 10/minute --limit-burst 7")]
+        [InlineData("-A ABC -m limit --limit 10/h --limit-burst 7", "-A ABC -m limit --limit 10/hour --limit-burst 7")]
+        [InlineData("-A ABC -m limit --limit 10/day --limit-burst 7", "-A ABC -m limit --limit 10/day --limit-burst 7")]
+        public void TestLimitOptionRoundTrip(string input, string expected)
+        {
+            RuleParseAssert.RoundTrips(input, expected);
+        }
     }
-}
+}

IPTables.Net.Tests/SingleLogRuleParseTests.cs

@@ -15,5 +15,13 @@ public void TestLogWithPrefix()
 
             Assert.Equal(rule, irule.GetActionCommand());
         }
+
+        [Theory]
+        [InlineData("-A INPUT -j LOG --log-level 4", "-A INPUT -j LOG --log-level 4")]
+        [InlineData("-A INPUT -j LOG --log-prefix prefix", "-A INPUT -j LOG --log-prefix prefix --log-level 7")]
+        public void TestLogOptionRoundTrip(string input, string expected)
+        {
+            RuleParseAssert.RoundTrips(input, expected);
+        }
     }
-}
+}

IPTables.Net.Tests/SingleMarkRuleParseTests.cs

@@ -82,5 +82,17 @@ public void TestXorMark()
 
             Assert.Equal(ruleExpect, irule.GetActionCommand());
         }
+
+        [Theory]
+        [InlineData("-A INPUT -m mark ! --mark 0xFF", "-A INPUT -m mark ! --mark 0xFF")]
+        [InlineData("-A INPUT -j MARK --set-mark 0xFF", "-A INPUT -j MARK --set-xmark 0xFF")]
+        [InlineData("-A INPUT -j MARK --set-mark 0xF/0xF0", "-A INPUT -j MARK --set-xmark 0xF/0xFF")]
+        [InlineData("-A INPUT -j MARK --and-mark 0x0", "-A INPUT -j MARK --set-xmark 0x0")]
+        [InlineData("-A INPUT -j MARK --or-mark 0", "-A INPUT -j MARK --set-xmark 0x0/0x0")]
+        [InlineData("-A INPUT -j MARK --xor-mark 0", "-A INPUT -j MARK --set-xmark 0x0/0x0")]
+        public void TestMarkOptionRoundTrip(string input, string expected)
+        {
+            RuleParseAssert.RoundTrips(input, expected);
+        }
     }
-}
+}

IPTables.Net.Tests/SingleMssRuleParseTests.cs

@@ -25,5 +25,14 @@ public void TestMssWithSetMssRange()
 
             Assert.Equal(rule, irule.GetActionCommand());
         }
+
+        [Theory]
+        [InlineData("-A INPUT -m tcpmss ! --mss 536:1460 -j ACCEPT")]
+        [InlineData("-A INPUT -j TCPMSS --clamp-mss-to-pmtu")]
+        [InlineData("-A INPUT -j TCPMSS --set-mss 1200")]
+        public void TestMssOptionRoundTrip(string rule)
+        {
+            RuleParseAssert.RoundTrips(rule);
+        }
     }
-}
+}

IPTables.Net.Tests/SingleMultiportRuleParseTests.cs

@@ -66,5 +66,21 @@ public void TestSourceNotMultiports()
 
             Assert.Equal(rule, irule.GetActionCommand());
         }
+
+        [Theory]
+        [InlineData("-A INPUT -p tcp -m multiport --ports 80,1000:1080", "-A INPUT -p tcp -m multiport --ports 80,1000:1080")]
+        [InlineData("-A INPUT -p tcp -m multiport --sports 80,1000:1080", "-A INPUT -p tcp -m multiport --sports 80,1000:1080")]
+        [InlineData("-A INPUT -p tcp -m multiport --dports 80,1000:1080", "-A INPUT -p tcp -m multiport --dports 80,1000:1080")]
+        [InlineData("-A INPUT -p tcp -m multiport ! --ports 80,1000:1080", "-A INPUT -p tcp -m multiport ! --ports 80,1000:1080")]
+        [InlineData("-A INPUT -p tcp -m multiport ! --sports 80,1000:1080", "-A INPUT -p tcp -m multiport ! --sports 80,1000:1080")]
+        [InlineData("-A INPUT -p tcp -m multiport ! --dports 80,1000:1080", "-A INPUT -p tcp -m multiport ! --dports 80,1000:1080")]
+        [InlineData("-A INPUT -p tcp -m multiport --source-ports 80,1000:1080", "-A INPUT -p tcp -m multiport --sports 80,1000:1080")]
+        [InlineData("-A INPUT -p tcp -m multiport --destination-ports 80,1000:1080", "-A INPUT -p tcp -m multiport --dports 80,1000:1080")]
+        [InlineData("-A INPUT -p tcp -m multiport ! --source-ports 80,1000:1080", "-A INPUT -p tcp -m multiport ! --sports 80,1000:1080")]
+        [InlineData("-A INPUT -p tcp -m multiport ! --destination-ports 80,1000:1080", "-A INPUT -p tcp -m multiport ! --dports 80,1000:1080")]
+        public void TestMultiportLongAliasRoundTrip(string input, string expected)
+        {
+            RuleParseAssert.RoundTrips(input, expected);
+        }
     }
-}
+}