1 Testing that a per-container fw4 zone declared over ubus with no explicit 2 policies and no egress/ingress flows defaults to deny-all: input, output and 3 forward towards the zone devices all DROP, even though the global defaults 4 are permissive (ACCEPT/ACCEPT/REJECT). 5 6 -- Testcase -- 7 {% 8 include("./root/usr/share/firewall4/main.uc", { 9 getenv: function(varname) { 10 switch (varname) { 11 case 'ACTION': 12 return 'print'; 13 } 14 } 15 }) 16 %} 17 -- End -- 18 19 -- File uci/helpers.json -- 20 {} 21 -- End -- 22 23 -- File fs/open~_sys_class_net_br-lan_flags.txt -- 24 0x1103 25 -- End -- 26 27 -- File fs/open~_sys_class_net_pppoe-wan_flags.txt -- 28 0x1103 29 -- End -- 30 31 -- File fs/open~_sys_class_net_vh-c2_flags.txt -- 32 0x1103 33 -- End -- 34 35 -- File fs/open~_sys_class_net_vc-c2_flags.txt -- 36 0x1103 37 -- End -- 38 39 -- File ubus/network.interface~dump.json -- 40 { 41 "interface": [ 42 { 43 "interface": "lan", 44 "up": true, 45 "l3_device": "br-lan", 46 "proto": "static", 47 "device": "br-lan", 48 "ipv4-address": [ { "address": "192.168.1.1", "mask": 24 } ], 49 "data": {} 50 }, 51 { 52 "interface": "wan", 53 "up": true, 54 "l3_device": "pppoe-wan", 55 "proto": "pppoe", 56 "device": "eth1", 57 "ipv4-address": [ { "address": "10.11.12.194", "mask": 24 } ], 58 "data": {} 59 }, 60 { 61 "interface": "c2_gw", 62 "up": true, 63 "l3_device": "vh-c2", 64 "proto": "static", 65 "device": "vh-c2", 66 "ipv4-address": [ { "address": "10.7.8.1", "mask": 31 } ], 67 "data": { 68 "zone": "cont_c2", 69 "firewall": [ 70 { 71 "type": "zone", 72 "name": "cont_c2" 73 } 74 ] 75 } 76 }, 77 { 78 "interface": "c2", 79 "up": true, 80 "l3_device": "vc-c2", 81 "proto": "none", 82 "device": "vc-c2", 83 "data": { 84 "zone": "cont_c2" 85 } 86 } 87 ] 88 } 89 -- End -- 90 91 -- File uci/firewall.json -- 92 { 93 "defaults": [ 94 { 95 "input": "ACCEPT", 96 "output": "ACCEPT", 97 "forward": "REJECT" 98 } 99 ], 100 "zone": [ 101 { 102 "name": "lan", 103 "input": "ACCEPT", 104 "output": "ACCEPT", 105 "forward": "ACCEPT", 106 "network": "lan" 107 }, 108 { 109 "name": "wan", 110 "input": "REJECT", 111 "output": "ACCEPT", 112 "forward": "REJECT", 113 "masq": "1", 114 "network": "wan" 115 } 116 ] 117 } 118 -- End -- 119 120 -- Expect stderr -- 121 -- End -- 122 123 -- Expect stdout -- 124 table inet fw4 125 flush table inet fw4 126 127 table inet fw4 { 128 # 129 # Defines 130 # 131 132 define cont_c2_devices = { "vh-c2", "vc-c2" } 133 define cont_c2_subnets = { 10.7.8.0/31 } 134 135 define lan_devices = { "br-lan" } 136 define lan_subnets = { 192.168.1.0/24 } 137 138 define wan_devices = { "pppoe-wan" } 139 define wan_subnets = { 10.11.12.0/24 } 140 141 142 # 143 # User includes 144 # 145 146 include "/etc/nftables.d/*.nft" 147 148 149 # 150 # Filter rules 151 # 152 153 chain input { 154 type filter hook input priority filter; policy accept; 155 156 iif "lo" accept comment "!fw4: Accept traffic from loopback" 157 158 ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" 159 iifname { "vh-c2", "vc-c2" } jump input_cont_c2 comment "!fw4: Handle cont_c2 IPv4/IPv6 input traffic" 160 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" 161 iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic" 162 } 163 164 chain forward { 165 type filter hook forward priority filter; policy drop; 166 167 ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" 168 iifname { "vh-c2", "vc-c2" } jump forward_cont_c2 comment "!fw4: Handle cont_c2 IPv4/IPv6 forward traffic" 169 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic" 170 iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" 171 jump handle_reject 172 } 173 174 chain output { 175 type filter hook output priority filter; policy accept; 176 177 oif "lo" accept comment "!fw4: Accept traffic towards loopback" 178 179 ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" 180 oifname { "vh-c2", "vc-c2" } jump output_cont_c2 comment "!fw4: Handle cont_c2 IPv4/IPv6 output traffic" 181 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic" 182 oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic" 183 } 184 185 chain prerouting { 186 type filter hook prerouting priority filter; policy accept; 187 iifname { "vh-c2", "vc-c2" } jump helper_cont_c2 comment "!fw4: Handle cont_c2 IPv4/IPv6 helper assignment" 188 iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment" 189 } 190 191 chain handle_reject { 192 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic" 193 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic" 194 } 195 196 chain input_cont_c2 { 197 jump drop_from_cont_c2 198 } 199 200 chain output_cont_c2 { 201 jump drop_to_cont_c2 202 } 203 204 chain forward_cont_c2 { 205 jump drop_to_cont_c2 206 } 207 208 chain helper_cont_c2 { 209 } 210 211 chain drop_from_cont_c2 { 212 iifname { "vh-c2", "vc-c2" } counter drop comment "!fw4: drop cont_c2 IPv4/IPv6 traffic" 213 } 214 215 chain drop_to_cont_c2 { 216 oifname { "vh-c2", "vc-c2" } counter drop comment "!fw4: drop cont_c2 IPv4/IPv6 traffic" 217 } 218 219 chain input_lan { 220 jump accept_from_lan 221 } 222 223 chain output_lan { 224 jump accept_to_lan 225 } 226 227 chain forward_lan { 228 jump accept_to_lan 229 } 230 231 chain helper_lan { 232 } 233 234 chain accept_from_lan { 235 iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic" 236 } 237 238 chain accept_to_lan { 239 oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic" 240 } 241 242 chain input_wan { 243 jump reject_from_wan 244 } 245 246 chain output_wan { 247 jump accept_to_wan 248 } 249 250 chain forward_wan { 251 jump reject_to_wan 252 } 253 254 chain accept_to_wan { 255 meta nfproto ipv4 oifname "pppoe-wan" ct state invalid counter drop comment "!fw4: Prevent NAT leakage" 256 oifname "pppoe-wan" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic" 257 } 258 259 chain reject_from_wan { 260 iifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic" 261 } 262 263 chain reject_to_wan { 264 oifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic" 265 } 266 267 268 # 269 # NAT rules 270 # 271 272 chain dstnat { 273 type nat hook prerouting priority dstnat; policy accept; 274 } 275 276 chain srcnat { 277 type nat hook postrouting priority srcnat; policy accept; 278 oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic" 279 } 280 281 chain srcnat_wan { 282 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic" 283 } 284 285 286 # 287 # Raw rules (notrack) 288 # 289 290 chain raw_prerouting { 291 type filter hook prerouting priority raw; policy accept; 292 } 293 294 chain raw_output { 295 type filter hook output priority raw; policy accept; 296 } 297 298 299 # 300 # Mangle rules 301 # 302 303 chain mangle_prerouting { 304 type filter hook prerouting priority mangle; policy accept; 305 } 306 307 chain mangle_postrouting { 308 type filter hook postrouting priority mangle; policy accept; 309 } 310 311 chain mangle_input { 312 type filter hook input priority mangle; policy accept; 313 } 314 315 chain mangle_output { 316 type route hook output priority mangle; policy accept; 317 } 318 319 chain mangle_forward { 320 type filter hook forward priority mangle; policy accept; 321 } 322 } 323 -- End --
This page was automatically generated by LXR 0.3.1. • OpenWrt