1 Testing that a per-interface ubus data.firewall rule carrying src/dest zone 2 references is pinned to the publishing interface device (the netifd protocol 3 handler contract, e.g. 464xlat), while a rule that opts out with an empty 4 device ("device": "") instead resolves through its zone references. A rule 5 opting out without any zone reference would end up unscoped in a base chain 6 and is rejected with a diagnostic. 7 8 -- Testcase -- 9 {% 10 include("./root/usr/share/firewall4/main.uc", { 11 getenv: function(varname) { 12 switch (varname) { 13 case 'ACTION': 14 return 'print'; 15 } 16 } 17 }) 18 %} 19 -- End -- 20 21 -- File uci/helpers.json -- 22 {} 23 -- End -- 24 25 -- File fs/open~_sys_class_net_br-lan_flags.txt -- 26 0x1103 27 -- End -- 28 29 -- File fs/open~_sys_class_net_pppoe-wan_flags.txt -- 30 0x1103 31 -- End -- 32 33 -- File fs/open~_sys_class_net_tun0_flags.txt -- 34 0x1103 35 -- End -- 36 37 -- File ubus/network.interface~dump.json -- 38 { 39 "interface": [ 40 { 41 "interface": "lan", 42 "up": true, 43 "l3_device": "br-lan", 44 "proto": "static", 45 "device": "br-lan", 46 "ipv4-address": [ { "address": "192.168.1.1", "mask": 24 } ], 47 "data": {} 48 }, 49 { 50 "interface": "wan", 51 "up": true, 52 "l3_device": "pppoe-wan", 53 "proto": "pppoe", 54 "device": "eth1", 55 "ipv4-address": [ { "address": "10.11.12.194", "mask": 24 } ], 56 "data": {} 57 }, 58 { 59 "interface": "tun", 60 "up": true, 61 "l3_device": "tun0", 62 "proto": "none", 63 "device": "tun0", 64 "data": { 65 "zone": "wan", 66 "firewall": [ 67 { 68 "type": "rule", 69 "src": "wan", 70 "dest": "lan", 71 "proto": "tcp", 72 "dest_port": "22", 73 "target": "accept" 74 }, 75 { 76 "type": "rule", 77 "src": "wan", 78 "dest": "lan", 79 "proto": "udp", 80 "dest_port": "53", 81 "target": "accept", 82 "device": "" 83 }, 84 { 85 "type": "rule", 86 "proto": "tcp", 87 "dest_port": "8080", 88 "target": "accept", 89 "device": "" 90 }, 91 { 92 "type": "nat", 93 "target": "SNAT", 94 "dest": "lan", 95 "snat_ip": "10.11.12.194", 96 "device": "" 97 } 98 ] 99 } 100 } 101 ] 102 } 103 -- End -- 104 105 -- File uci/firewall.json -- 106 { 107 "defaults": [ 108 { 109 "input": "ACCEPT", 110 "output": "ACCEPT", 111 "forward": "REJECT" 112 } 113 ], 114 "zone": [ 115 { 116 "name": "lan", 117 "input": "ACCEPT", 118 "output": "ACCEPT", 119 "forward": "ACCEPT", 120 "network": "lan" 121 }, 122 { 123 "name": "wan", 124 "input": "REJECT", 125 "output": "ACCEPT", 126 "forward": "REJECT", 127 "masq": "1", 128 "network": "wan" 129 } 130 ] 131 } 132 -- End -- 133 134 -- Expect stderr -- 135 [!] ubus rule (ubus:tun[none] rule 2) must reference a zone when opting out of device binding, ignoring section 136 [!] ubus nat (ubus:tun[none] nat 3) must reference a zone when opting out of device binding, ignoring section 137 -- End -- 138 139 -- Expect stdout -- 140 table inet fw4 141 flush table inet fw4 142 143 table inet fw4 { 144 # 145 # Defines 146 # 147 148 define lan_devices = { "br-lan" } 149 define lan_subnets = { 192.168.1.0/24 } 150 151 define wan_devices = { "pppoe-wan", "tun0" } 152 define wan_subnets = { 10.11.12.0/24 } 153 154 155 # 156 # User includes 157 # 158 159 include "/etc/nftables.d/*.nft" 160 161 162 # 163 # Filter rules 164 # 165 166 chain input { 167 type filter hook input priority filter; policy accept; 168 169 iif "lo" accept comment "!fw4: Accept traffic from loopback" 170 171 ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" 172 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" 173 iifname { "pppoe-wan", "tun0" } jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic" 174 } 175 176 chain forward { 177 type filter hook forward priority filter; policy drop; 178 179 ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" 180 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic" 181 iifname { "pppoe-wan", "tun0" } jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" 182 jump handle_reject 183 } 184 185 chain output { 186 type filter hook output priority filter; policy accept; 187 188 oif "lo" accept comment "!fw4: Accept traffic towards loopback" 189 190 ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" 191 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic" 192 oifname { "pppoe-wan", "tun0" } jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic" 193 } 194 195 chain prerouting { 196 type filter hook prerouting priority filter; policy accept; 197 } 198 199 chain handle_reject { 200 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic" 201 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic" 202 } 203 204 chain input_lan { 205 jump accept_from_lan 206 } 207 208 chain output_lan { 209 jump accept_to_lan 210 } 211 212 chain forward_lan { 213 jump accept_to_lan 214 } 215 216 chain accept_from_lan { 217 iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic" 218 } 219 220 chain accept_to_lan { 221 oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic" 222 } 223 224 chain input_wan { 225 jump reject_from_wan 226 } 227 228 chain output_wan { 229 jump accept_to_wan 230 } 231 232 chain forward_wan { 233 iifname "tun0" tcp dport 22 counter jump accept_to_lan comment "!fw4: ubus:tun[none] rule 0" 234 udp dport 53 counter jump accept_to_lan comment "!fw4: ubus:tun[none] rule 1" 235 jump reject_to_wan 236 } 237 238 chain accept_to_wan { 239 meta nfproto ipv4 oifname { "pppoe-wan", "tun0" } ct state invalid counter drop comment "!fw4: Prevent NAT leakage" 240 oifname { "pppoe-wan", "tun0" } counter accept comment "!fw4: accept wan IPv4/IPv6 traffic" 241 } 242 243 chain reject_from_wan { 244 iifname { "pppoe-wan", "tun0" } counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic" 245 } 246 247 chain reject_to_wan { 248 oifname { "pppoe-wan", "tun0" } counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic" 249 } 250 251 252 # 253 # NAT rules 254 # 255 256 chain dstnat { 257 type nat hook prerouting priority dstnat; policy accept; 258 } 259 260 chain srcnat { 261 type nat hook postrouting priority srcnat; policy accept; 262 oifname { "pppoe-wan", "tun0" } jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic" 263 } 264 265 chain srcnat_wan { 266 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic" 267 } 268 269 270 # 271 # Raw rules (notrack) 272 # 273 274 chain raw_prerouting { 275 type filter hook prerouting priority raw; policy accept; 276 } 277 278 chain raw_output { 279 type filter hook output priority raw; policy accept; 280 } 281 282 283 # 284 # Mangle rules 285 # 286 287 chain mangle_prerouting { 288 type filter hook prerouting priority mangle; policy accept; 289 } 290 291 chain mangle_postrouting { 292 type filter hook postrouting priority mangle; policy accept; 293 } 294 295 chain mangle_input { 296 type filter hook input priority mangle; policy accept; 297 } 298 299 chain mangle_output { 300 type route hook output priority mangle; policy accept; 301 } 302 303 chain mangle_forward { 304 type filter hook forward priority mangle; policy accept; 305 } 306 } 307 -- End --
This page was automatically generated by LXR 0.3.1. • OpenWrt