1 Testing that zones sharing a name no longer render duplicate nftables 2 defines and chains, which nft rejects wholesale. The first zone of a given 3 name wins and later ones are skipped with a diagnostic; a zone declared via 4 ubus never displaces a uci zone of the same name. 5 6 -- Testcase -- 7 {% 8 include("./root/usr/share/firewall4/main.uc", { 9 getenv: function(varname) { 10 switch (varname) { 11 case 'ACTION': 12 return 'print'; 13 } 14 } 15 }) 16 %} 17 -- End -- 18 19 -- File uci/helpers.json -- 20 {} 21 -- End -- 22 23 -- File fs/open~_sys_class_net_br-lan_flags.txt -- 24 0x1103 25 -- End -- 26 27 -- File fs/open~_sys_class_net_pppoe-wan_flags.txt -- 28 0x1103 29 -- End -- 30 31 -- File ubus/network.interface~dump.json -- 32 { 33 "interface": [ 34 { 35 "interface": "lan", 36 "up": true, 37 "l3_device": "br-lan", 38 "proto": "static", 39 "device": "br-lan", 40 "ipv4-address": [ { "address": "192.168.1.1", "mask": 24 } ], 41 "data": {} 42 }, 43 { 44 "interface": "wan", 45 "up": true, 46 "l3_device": "pppoe-wan", 47 "proto": "pppoe", 48 "device": "eth1", 49 "ipv4-address": [ { "address": "10.11.12.194", "mask": 24 } ], 50 "data": {} 51 } 52 ] 53 } 54 -- End -- 55 56 -- File ubus/service~get_data~type-firewall.json -- 57 { 58 "svc1": { 59 "firewall": [ 60 { 61 "type": "zone", 62 "name": "czdup", 63 "subnet": [ "10.99.0.0/24" ] 64 } 65 ] 66 }, 67 "svc2": { 68 "firewall": [ 69 { 70 "type": "zone", 71 "name": "czdup", 72 "subnet": [ "10.98.0.0/24" ] 73 } 74 ] 75 }, 76 "svc3": { 77 "firewall": [ 78 { 79 "type": "zone", 80 "name": "wan", 81 "input": "ACCEPT" 82 } 83 ] 84 } 85 } 86 -- End -- 87 88 -- File uci/firewall.json -- 89 { 90 "defaults": [ 91 { 92 "input": "ACCEPT", 93 "output": "ACCEPT", 94 "forward": "REJECT" 95 } 96 ], 97 "zone": [ 98 { 99 "name": "lan", 100 "input": "ACCEPT", 101 "output": "ACCEPT", 102 "forward": "ACCEPT", 103 "network": "lan" 104 }, 105 { 106 "name": "wan", 107 "input": "REJECT", 108 "output": "ACCEPT", 109 "forward": "REJECT", 110 "masq": "1", 111 "network": "wan" 112 }, 113 { 114 "name": "lan", 115 "input": "REJECT", 116 "output": "REJECT", 117 "forward": "REJECT" 118 } 119 ] 120 } 121 -- End -- 122 123 -- Expect stderr -- 124 [!] ubus:svc2 zone (czdup) has a duplicate name, ignoring section 125 [!] ubus:svc3 zone (wan) duplicates a uci zone, ignoring section 126 [!] Section @zone[2] (lan) has a duplicate name, ignoring section 127 -- End -- 128 129 -- Expect stdout -- 130 table inet fw4 131 flush table inet fw4 132 133 table inet fw4 { 134 # 135 # Defines 136 # 137 138 define czdup_devices = { } 139 define czdup_subnets = { 10.99.0.0/24 } 140 141 define lan_devices = { "br-lan" } 142 define lan_subnets = { 192.168.1.0/24 } 143 144 define wan_devices = { "pppoe-wan" } 145 define wan_subnets = { 10.11.12.0/24 } 146 147 148 # 149 # User includes 150 # 151 152 include "/etc/nftables.d/*.nft" 153 154 155 # 156 # Filter rules 157 # 158 159 chain input { 160 type filter hook input priority filter; policy accept; 161 162 iif "lo" accept comment "!fw4: Accept traffic from loopback" 163 164 ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" 165 meta nfproto ipv4 ip saddr 10.99.0.0/24 jump input_czdup comment "!fw4: Handle czdup IPv4 input traffic" 166 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" 167 iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic" 168 } 169 170 chain forward { 171 type filter hook forward priority filter; policy drop; 172 173 ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" 174 meta nfproto ipv4 ip saddr 10.99.0.0/24 jump forward_czdup comment "!fw4: Handle czdup IPv4 forward traffic" 175 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic" 176 iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" 177 jump handle_reject 178 } 179 180 chain output { 181 type filter hook output priority filter; policy accept; 182 183 oif "lo" accept comment "!fw4: Accept traffic towards loopback" 184 185 ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" 186 meta nfproto ipv4 ip daddr 10.99.0.0/24 jump output_czdup comment "!fw4: Handle czdup IPv4 output traffic" 187 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic" 188 oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic" 189 } 190 191 chain prerouting { 192 type filter hook prerouting priority filter; policy accept; 193 meta nfproto ipv4 ip saddr 10.99.0.0/24 jump helper_czdup comment "!fw4: Handle czdup IPv4 helper assignment" 194 iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment" 195 } 196 197 chain handle_reject { 198 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic" 199 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic" 200 } 201 202 chain input_czdup { 203 jump drop_from_czdup 204 } 205 206 chain output_czdup { 207 jump drop_to_czdup 208 } 209 210 chain forward_czdup { 211 jump drop_to_czdup 212 } 213 214 chain helper_czdup { 215 } 216 217 chain drop_from_czdup { 218 meta nfproto ipv4 ip saddr 10.99.0.0/24 counter drop comment "!fw4: drop czdup IPv4 traffic" 219 } 220 221 chain drop_to_czdup { 222 meta nfproto ipv4 ip daddr 10.99.0.0/24 counter drop comment "!fw4: drop czdup IPv4 traffic" 223 } 224 225 chain input_lan { 226 jump accept_from_lan 227 } 228 229 chain output_lan { 230 jump accept_to_lan 231 } 232 233 chain forward_lan { 234 jump accept_to_lan 235 } 236 237 chain helper_lan { 238 } 239 240 chain accept_from_lan { 241 iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic" 242 } 243 244 chain accept_to_lan { 245 oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic" 246 } 247 248 chain input_wan { 249 jump reject_from_wan 250 } 251 252 chain output_wan { 253 jump accept_to_wan 254 } 255 256 chain forward_wan { 257 jump reject_to_wan 258 } 259 260 chain accept_to_wan { 261 meta nfproto ipv4 oifname "pppoe-wan" ct state invalid counter drop comment "!fw4: Prevent NAT leakage" 262 oifname "pppoe-wan" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic" 263 } 264 265 chain reject_from_wan { 266 iifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic" 267 } 268 269 chain reject_to_wan { 270 oifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic" 271 } 272 273 274 # 275 # NAT rules 276 # 277 278 chain dstnat { 279 type nat hook prerouting priority dstnat; policy accept; 280 } 281 282 chain srcnat { 283 type nat hook postrouting priority srcnat; policy accept; 284 oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic" 285 } 286 287 chain srcnat_wan { 288 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic" 289 } 290 291 292 # 293 # Raw rules (notrack) 294 # 295 296 chain raw_prerouting { 297 type filter hook prerouting priority raw; policy accept; 298 } 299 300 chain raw_output { 301 type filter hook output priority raw; policy accept; 302 } 303 304 305 # 306 # Mangle rules 307 # 308 309 chain mangle_prerouting { 310 type filter hook prerouting priority mangle; policy accept; 311 } 312 313 chain mangle_postrouting { 314 type filter hook postrouting priority mangle; policy accept; 315 } 316 317 chain mangle_input { 318 type filter hook input priority mangle; policy accept; 319 } 320 321 chain mangle_output { 322 type route hook output priority mangle; policy accept; 323 } 324 325 chain mangle_forward { 326 type filter hook forward priority mangle; policy accept; 327 } 328 } 329 -- End --
This page was automatically generated by LXR 0.3.1. • OpenWrt