1 Testing that a per-container fw4 zone declared ephemerally over ubus is 2 synthesized with default-DROP policy and that its egress/ingress flows from 3 data.firewall resolve against it. 4 5 -- Testcase -- 6 {% 7 include("./root/usr/share/firewall4/main.uc", { 8 getenv: function(varname) { 9 switch (varname) { 10 case 'ACTION': 11 return 'print'; 12 } 13 } 14 }) 15 %} 16 -- End -- 17 18 -- File uci/helpers.json -- 19 {} 20 -- End -- 21 22 -- File fs/open~_sys_class_net_br-lan_flags.txt -- 23 0x1103 24 -- End -- 25 26 -- File fs/open~_sys_class_net_pppoe-wan_flags.txt -- 27 0x1103 28 -- End -- 29 30 -- File fs/open~_sys_class_net_vh-c1_flags.txt -- 31 0x1103 32 -- End -- 33 34 -- File fs/open~_sys_class_net_vc-c1_flags.txt -- 35 0x1103 36 -- End -- 37 38 -- File ubus/network.interface~dump.json -- 39 { 40 "interface": [ 41 { 42 "interface": "lan", 43 "up": true, 44 "l3_device": "br-lan", 45 "proto": "static", 46 "device": "br-lan", 47 "ipv4-address": [ { "address": "192.168.1.1", "mask": 24 } ], 48 "data": {} 49 }, 50 { 51 "interface": "wan", 52 "up": true, 53 "l3_device": "pppoe-wan", 54 "proto": "pppoe", 55 "device": "eth1", 56 "ipv4-address": [ { "address": "10.11.12.194", "mask": 24 } ], 57 "data": {} 58 }, 59 { 60 "interface": "c1_gw", 61 "up": true, 62 "l3_device": "vh-c1", 63 "proto": "static", 64 "device": "vh-c1", 65 "ipv4-address": [ { "address": "10.5.6.1", "mask": 31 } ], 66 "data": { 67 "zone": "cont_c1", 68 "firewall": [ 69 { 70 "type": "zone", 71 "name": "cont_c1" 72 }, 73 { 74 "type": "rule", 75 "src": "cont_c1", 76 "dest": "lan", 77 "target": "accept", 78 "device": "" 79 }, 80 { 81 "type": "rule", 82 "src": "wan", 83 "dest": "cont_c1", 84 "proto": "tcp", 85 "dest_port": "443", 86 "target": "accept", 87 "device": "" 88 }, 89 { 90 "type": "redirect", 91 "target": "dnat", 92 "src": "wan", 93 "dest": "cont_c1", 94 "proto": "tcp", 95 "src_dport": "443", 96 "dest_ip": "10.5.6.0" 97 } 98 ] 99 } 100 }, 101 { 102 "interface": "c1", 103 "up": true, 104 "l3_device": "vc-c1", 105 "proto": "none", 106 "device": "vc-c1", 107 "data": { 108 "zone": "cont_c1" 109 } 110 } 111 ] 112 } 113 -- End -- 114 115 -- File uci/firewall.json -- 116 { 117 "defaults": [ 118 { 119 "input": "ACCEPT", 120 "output": "ACCEPT", 121 "forward": "REJECT" 122 } 123 ], 124 "zone": [ 125 { 126 "name": "lan", 127 "input": "ACCEPT", 128 "output": "ACCEPT", 129 "forward": "ACCEPT", 130 "network": "lan" 131 }, 132 { 133 "name": "wan", 134 "input": "REJECT", 135 "output": "ACCEPT", 136 "forward": "REJECT", 137 "masq": "1", 138 "network": "wan" 139 } 140 ] 141 } 142 -- End -- 143 144 -- Expect stderr -- 145 -- End -- 146 147 -- Expect stdout -- 148 table inet fw4 149 flush table inet fw4 150 151 table inet fw4 { 152 # 153 # Defines 154 # 155 156 define cont_c1_devices = { "vh-c1", "vc-c1" } 157 define cont_c1_subnets = { 10.5.6.0/31 } 158 159 define lan_devices = { "br-lan" } 160 define lan_subnets = { 192.168.1.0/24 } 161 162 define wan_devices = { "pppoe-wan" } 163 define wan_subnets = { 10.11.12.0/24 } 164 165 166 # 167 # User includes 168 # 169 170 include "/etc/nftables.d/*.nft" 171 172 173 # 174 # Filter rules 175 # 176 177 chain input { 178 type filter hook input priority filter; policy accept; 179 180 iif "lo" accept comment "!fw4: Accept traffic from loopback" 181 182 ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" 183 iifname { "vh-c1", "vc-c1" } jump input_cont_c1 comment "!fw4: Handle cont_c1 IPv4/IPv6 input traffic" 184 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" 185 iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic" 186 } 187 188 chain forward { 189 type filter hook forward priority filter; policy drop; 190 191 ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" 192 iifname { "vh-c1", "vc-c1" } jump forward_cont_c1 comment "!fw4: Handle cont_c1 IPv4/IPv6 forward traffic" 193 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic" 194 iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" 195 jump handle_reject 196 } 197 198 chain output { 199 type filter hook output priority filter; policy accept; 200 201 oif "lo" accept comment "!fw4: Accept traffic towards loopback" 202 203 ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" 204 oifname { "vh-c1", "vc-c1" } jump output_cont_c1 comment "!fw4: Handle cont_c1 IPv4/IPv6 output traffic" 205 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic" 206 oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic" 207 } 208 209 chain prerouting { 210 type filter hook prerouting priority filter; policy accept; 211 iifname { "vh-c1", "vc-c1" } jump helper_cont_c1 comment "!fw4: Handle cont_c1 IPv4/IPv6 helper assignment" 212 iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment" 213 } 214 215 chain handle_reject { 216 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic" 217 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic" 218 } 219 220 chain input_cont_c1 { 221 ct status dnat accept comment "!fw4: Accept port redirections" 222 jump drop_from_cont_c1 223 } 224 225 chain output_cont_c1 { 226 jump drop_to_cont_c1 227 } 228 229 chain forward_cont_c1 { 230 meta l4proto tcp counter jump accept_to_lan comment "!fw4: ubus:c1_gw[static] rule 1" 231 meta l4proto udp counter jump accept_to_lan comment "!fw4: ubus:c1_gw[static] rule 1" 232 ct status dnat accept comment "!fw4: Accept port forwards" 233 jump drop_to_cont_c1 234 } 235 236 chain helper_cont_c1 { 237 } 238 239 chain accept_to_cont_c1 { 240 oifname { "vh-c1", "vc-c1" } counter accept comment "!fw4: accept cont_c1 IPv4/IPv6 traffic" 241 } 242 243 chain drop_from_cont_c1 { 244 iifname { "vh-c1", "vc-c1" } counter drop comment "!fw4: drop cont_c1 IPv4/IPv6 traffic" 245 } 246 247 chain drop_to_cont_c1 { 248 oifname { "vh-c1", "vc-c1" } counter drop comment "!fw4: drop cont_c1 IPv4/IPv6 traffic" 249 } 250 251 chain input_lan { 252 jump accept_from_lan 253 } 254 255 chain output_lan { 256 jump accept_to_lan 257 } 258 259 chain forward_lan { 260 jump accept_to_lan 261 } 262 263 chain helper_lan { 264 } 265 266 chain accept_from_lan { 267 iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic" 268 } 269 270 chain accept_to_lan { 271 oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic" 272 } 273 274 chain input_wan { 275 ct status dnat accept comment "!fw4: Accept port redirections" 276 jump reject_from_wan 277 } 278 279 chain output_wan { 280 jump accept_to_wan 281 } 282 283 chain forward_wan { 284 tcp dport 443 counter jump accept_to_cont_c1 comment "!fw4: ubus:c1_gw[static] rule 2" 285 ct status dnat accept comment "!fw4: Accept port forwards" 286 jump reject_to_wan 287 } 288 289 chain accept_to_wan { 290 meta nfproto ipv4 oifname "pppoe-wan" ct state invalid counter drop comment "!fw4: Prevent NAT leakage" 291 oifname "pppoe-wan" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic" 292 } 293 294 chain reject_from_wan { 295 iifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic" 296 } 297 298 chain reject_to_wan { 299 oifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic" 300 } 301 302 303 # 304 # NAT rules 305 # 306 307 chain dstnat { 308 type nat hook prerouting priority dstnat; policy accept; 309 iifname { "vh-c1", "vc-c1" } jump dstnat_cont_c1 comment "!fw4: Handle cont_c1 IPv4/IPv6 dstnat traffic" 310 iifname "pppoe-wan" jump dstnat_wan comment "!fw4: Handle wan IPv4/IPv6 dstnat traffic" 311 } 312 313 chain srcnat { 314 type nat hook postrouting priority srcnat; policy accept; 315 oifname { "vh-c1", "vc-c1" } jump srcnat_cont_c1 comment "!fw4: Handle cont_c1 IPv4/IPv6 srcnat traffic" 316 oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic" 317 } 318 319 chain dstnat_cont_c1 { 320 ip saddr 10.5.6.0/31 ip daddr 10.11.12.194 tcp dport 443 dnat 10.5.6.0:443 comment "!fw4: ubus:c1_gw[static] redirect 3 (reflection)" 321 } 322 323 chain srcnat_cont_c1 { 324 ip saddr 10.5.6.0/31 ip daddr 10.5.6.0 tcp dport 443 snat 10.5.6.1 comment "!fw4: ubus:c1_gw[static] redirect 3 (reflection)" 325 } 326 327 chain dstnat_wan { 328 meta nfproto ipv4 tcp dport 443 counter dnat 10.5.6.0:443 comment "!fw4: ubus:c1_gw[static] redirect 3" 329 } 330 331 chain srcnat_wan { 332 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic" 333 } 334 335 336 # 337 # Raw rules (notrack) 338 # 339 340 chain raw_prerouting { 341 type filter hook prerouting priority raw; policy accept; 342 } 343 344 chain raw_output { 345 type filter hook output priority raw; policy accept; 346 } 347 348 349 # 350 # Mangle rules 351 # 352 353 chain mangle_prerouting { 354 type filter hook prerouting priority mangle; policy accept; 355 } 356 357 chain mangle_postrouting { 358 type filter hook postrouting priority mangle; policy accept; 359 } 360 361 chain mangle_input { 362 type filter hook input priority mangle; policy accept; 363 } 364 365 chain mangle_output { 366 type route hook output priority mangle; policy accept; 367 } 368 369 chain mangle_forward { 370 type filter hook forward priority mangle; policy accept; 371 } 372 } 373 -- End --
This page was automatically generated by LXR 0.3.1. • OpenWrt