1 Testing that fw4 zones, forwardings and rules declared ephemerally through 2 procd service data (service get_data type firewall) are synthesized with their 3 declared names, resolve against uci zones in both directions, that an entry 4 without a type field remains inert, and that a malformed zone is skipped with 5 a diagnostic while the rest of the ruleset stays intact. 6 7 -- Testcase -- 8 {% 9 include("./root/usr/share/firewall4/main.uc", { 10 getenv: function(varname) { 11 switch (varname) { 12 case 'ACTION': 13 return 'print'; 14 } 15 } 16 }) 17 %} 18 -- End -- 19 20 -- File uci/helpers.json -- 21 {} 22 -- End -- 23 24 -- File fs/open~_sys_class_net_br-lan_flags.txt -- 25 0x1103 26 -- End -- 27 28 -- File fs/open~_sys_class_net_pppoe-wan_flags.txt -- 29 0x1103 30 -- End -- 31 32 -- File fs/open~_sys_class_net_vh-ha_flags.txt -- 33 0x1103 34 -- End -- 35 36 -- File ubus/network.interface~dump.json -- 37 { 38 "interface": [ 39 { 40 "interface": "lan", 41 "up": true, 42 "l3_device": "br-lan", 43 "proto": "static", 44 "device": "br-lan", 45 "ipv4-address": [ { "address": "192.168.1.1", "mask": 24 } ], 46 "data": {} 47 }, 48 { 49 "interface": "wan", 50 "up": true, 51 "l3_device": "pppoe-wan", 52 "proto": "pppoe", 53 "device": "eth1", 54 "ipv4-address": [ { "address": "10.11.12.194", "mask": 24 } ], 55 "data": {} 56 }, 57 { 58 "interface": "cn_ha", 59 "up": true, 60 "l3_device": "vh-ha", 61 "proto": "static", 62 "device": "vh-ha", 63 "ipv4-address": [ { "address": "10.183.224.1", "mask": 28 } ], 64 "data": {} 65 } 66 ] 67 } 68 -- End -- 69 70 -- File ubus/service~get_data~type-firewall.json -- 71 { 72 "container": { 73 "cn_ha": { 74 "firewall": [ 75 { 76 "type": "zone", 77 "name": "cz_ha", 78 "input": "REJECT", 79 "output": "ACCEPT", 80 "forward": "REJECT", 81 "masq": "1", 82 "mtu_fix": "1", 83 "network": [ "cn_ha" ] 84 }, 85 { 86 "type": "forwarding", 87 "src": "cz_ha", 88 "dest": "wan" 89 }, 90 { 91 "type": "rule", 92 "target": "ACCEPT", 93 "src": "cz_ha", 94 "dest_port": "53", 95 "proto": "udp" 96 }, 97 { 98 "target": "ACCEPT", 99 "src": "cz_ha", 100 "dest_port": "123", 101 "proto": "udp" 102 } 103 ] 104 } 105 }, 106 "badsvc": { 107 "firewall": [ 108 { 109 "type": "zone", 110 "name": "bad zone" 111 } 112 ] 113 } 114 } 115 -- End -- 116 117 -- File uci/firewall.json -- 118 { 119 "defaults": [ 120 { 121 "input": "ACCEPT", 122 "output": "ACCEPT", 123 "forward": "REJECT" 124 } 125 ], 126 "zone": [ 127 { 128 "name": "lan", 129 "input": "ACCEPT", 130 "output": "ACCEPT", 131 "forward": "ACCEPT", 132 "network": "lan" 133 }, 134 { 135 "name": "wan", 136 "input": "REJECT", 137 "output": "ACCEPT", 138 "forward": "REJECT", 139 "masq": "1", 140 "network": "wan" 141 } 142 ], 143 "forwarding": [ 144 { 145 "src": "lan", 146 "dest": "cz_ha" 147 } 148 ] 149 } 150 -- End -- 151 152 -- Expect stderr -- 153 [!] ubus:badsvc zone (bad zone) option 'name' specifies invalid value 'bad zone' 154 [!] ubus:badsvc zone (bad zone) skipped due to invalid options 155 -- End -- 156 157 -- Expect stdout -- 158 table inet fw4 159 flush table inet fw4 160 161 table inet fw4 { 162 # 163 # Defines 164 # 165 166 define cz_ha_devices = { "vh-ha" } 167 define cz_ha_subnets = { 10.183.224.0/28 } 168 169 define lan_devices = { "br-lan" } 170 define lan_subnets = { 192.168.1.0/24 } 171 172 define wan_devices = { "pppoe-wan" } 173 define wan_subnets = { 10.11.12.0/24 } 174 175 176 # 177 # User includes 178 # 179 180 include "/etc/nftables.d/*.nft" 181 182 183 # 184 # Filter rules 185 # 186 187 chain input { 188 type filter hook input priority filter; policy accept; 189 190 iif "lo" accept comment "!fw4: Accept traffic from loopback" 191 192 ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" 193 iifname "vh-ha" jump input_cz_ha comment "!fw4: Handle cz_ha IPv4/IPv6 input traffic" 194 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" 195 iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic" 196 } 197 198 chain forward { 199 type filter hook forward priority filter; policy drop; 200 201 ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" 202 iifname "vh-ha" jump forward_cz_ha comment "!fw4: Handle cz_ha IPv4/IPv6 forward traffic" 203 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic" 204 iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" 205 jump handle_reject 206 } 207 208 chain output { 209 type filter hook output priority filter; policy accept; 210 211 oif "lo" accept comment "!fw4: Accept traffic towards loopback" 212 213 ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" 214 oifname "vh-ha" jump output_cz_ha comment "!fw4: Handle cz_ha IPv4/IPv6 output traffic" 215 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic" 216 oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic" 217 } 218 219 chain prerouting { 220 type filter hook prerouting priority filter; policy accept; 221 iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment" 222 } 223 224 chain handle_reject { 225 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic" 226 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic" 227 } 228 229 chain input_cz_ha { 230 udp dport 53 counter accept comment "!fw4: ubus:container[cn_ha] rule 2" 231 jump reject_from_cz_ha 232 } 233 234 chain output_cz_ha { 235 jump accept_to_cz_ha 236 } 237 238 chain forward_cz_ha { 239 jump accept_to_wan comment "!fw4: ubus:container[cn_ha] forwarding 1" 240 jump reject_to_cz_ha 241 } 242 243 chain accept_to_cz_ha { 244 meta nfproto ipv4 oifname "vh-ha" ct state invalid counter drop comment "!fw4: Prevent NAT leakage" 245 oifname "vh-ha" counter accept comment "!fw4: accept cz_ha IPv4/IPv6 traffic" 246 } 247 248 chain reject_from_cz_ha { 249 iifname "vh-ha" counter jump handle_reject comment "!fw4: reject cz_ha IPv4/IPv6 traffic" 250 } 251 252 chain reject_to_cz_ha { 253 oifname "vh-ha" counter jump handle_reject comment "!fw4: reject cz_ha IPv4/IPv6 traffic" 254 } 255 256 chain input_lan { 257 jump accept_from_lan 258 } 259 260 chain output_lan { 261 jump accept_to_lan 262 } 263 264 chain forward_lan { 265 jump accept_to_cz_ha comment "!fw4: Accept lan to cz_ha forwarding" 266 jump accept_to_lan 267 } 268 269 chain helper_lan { 270 } 271 272 chain accept_from_lan { 273 iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic" 274 } 275 276 chain accept_to_lan { 277 oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic" 278 } 279 280 chain input_wan { 281 jump reject_from_wan 282 } 283 284 chain output_wan { 285 jump accept_to_wan 286 } 287 288 chain forward_wan { 289 jump reject_to_wan 290 } 291 292 chain accept_to_wan { 293 meta nfproto ipv4 oifname "pppoe-wan" ct state invalid counter drop comment "!fw4: Prevent NAT leakage" 294 oifname "pppoe-wan" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic" 295 } 296 297 chain reject_from_wan { 298 iifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic" 299 } 300 301 chain reject_to_wan { 302 oifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic" 303 } 304 305 306 # 307 # NAT rules 308 # 309 310 chain dstnat { 311 type nat hook prerouting priority dstnat; policy accept; 312 } 313 314 chain srcnat { 315 type nat hook postrouting priority srcnat; policy accept; 316 oifname "vh-ha" jump srcnat_cz_ha comment "!fw4: Handle cz_ha IPv4/IPv6 srcnat traffic" 317 oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic" 318 } 319 320 chain srcnat_cz_ha { 321 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 cz_ha traffic" 322 } 323 324 chain srcnat_wan { 325 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic" 326 } 327 328 329 # 330 # Raw rules (notrack) 331 # 332 333 chain raw_prerouting { 334 type filter hook prerouting priority raw; policy accept; 335 } 336 337 chain raw_output { 338 type filter hook output priority raw; policy accept; 339 } 340 341 342 # 343 # Mangle rules 344 # 345 346 chain mangle_prerouting { 347 type filter hook prerouting priority mangle; policy accept; 348 } 349 350 chain mangle_postrouting { 351 type filter hook postrouting priority mangle; policy accept; 352 oifname "vh-ha" tcp flags syn / syn,fin,rst tcp option maxseg size set rt mtu comment "!fw4: Zone cz_ha IPv4/IPv6 egress MTU fixing" 353 } 354 355 chain mangle_input { 356 type filter hook input priority mangle; policy accept; 357 } 358 359 chain mangle_output { 360 type route hook output priority mangle; policy accept; 361 } 362 363 chain mangle_forward { 364 type filter hook forward priority mangle; policy accept; 365 iifname "vh-ha" tcp flags syn / syn,fin,rst tcp option maxseg size set rt mtu comment "!fw4: Zone cz_ha IPv4/IPv6 ingress MTU fixing" 366 } 367 } 368 -- End --
This page was automatically generated by LXR 0.3.1. • OpenWrt