1 Testing negated protocol matches. 2 3 -- Testcase -- 4 {% 5 include("./root/usr/share/firewall4/main.uc", { 6 getenv: function(varname) { 7 switch (varname) { 8 case 'ACTION': 9 return 'print'; 10 } 11 } 12 }) 13 %} 14 -- End -- 15 16 -- File uci/helpers.json -- 17 {} 18 -- End -- 19 20 -- File uci/firewall.json -- 21 { 22 "rule": [ 23 { "proto": "!tcp", "name": "Not TCP" }, 24 { "proto": "!tcpudp", "name": "Neither TCP nor UDP" }, 25 { "proto": [ "!tcp", "!udp" ], "name": "Neither TCP nor UDP as list" }, 26 { "proto": "!icmp", "name": "Not ICMP" }, 27 { "proto": "!icmp", "family": "ipv4", "name": "Not ICMPv4" }, 28 { "proto": [ "tcp", "!udp" ], "name": "Mixed protocols" }, 29 { "proto": "!tcp", "dest_port": "22", "name": "Negated protocol with port" }, 30 { "proto": "!all", "name": "Negated all" } 31 ] 32 } 33 -- End -- 34 35 -- Expect stderr -- 36 [!] Section @rule[5] (Mixed protocols) must not mix negated and plain protocols or negate 'all' 37 [!] Section @rule[6] (Negated protocol with port) must not combine a negated protocol with port or ICMP type matches 38 [!] Section @rule[7] (Negated all) must not mix negated and plain protocols or negate 'all' 39 -- End -- 40 41 -- Expect stdout -- 42 table inet fw4 43 flush table inet fw4 44 45 table inet fw4 { 46 # 47 # Defines 48 # 49 50 51 # 52 # User includes 53 # 54 55 include "/etc/nftables.d/*.nft" 56 57 58 # 59 # Filter rules 60 # 61 62 chain input { 63 type filter hook input priority filter; policy drop; 64 65 iif "lo" accept comment "!fw4: Accept traffic from loopback" 66 67 ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" 68 } 69 70 chain forward { 71 type filter hook forward priority filter; policy drop; 72 73 ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" 74 } 75 76 chain output { 77 type filter hook output priority filter; policy drop; 78 79 oif "lo" accept comment "!fw4: Accept traffic towards loopback" 80 81 ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" 82 meta l4proto != tcp counter comment "!fw4: Not TCP" 83 meta l4proto != { "tcp", "udp" } counter comment "!fw4: Neither TCP nor UDP" 84 meta l4proto != { "tcp", "udp" } counter comment "!fw4: Neither TCP nor UDP as list" 85 meta l4proto != { "icmp", "ipv6-icmp" } counter comment "!fw4: Not ICMP" 86 meta nfproto ipv4 meta l4proto != icmp counter comment "!fw4: Not ICMPv4" 87 } 88 89 chain prerouting { 90 type filter hook prerouting priority filter; policy accept; 91 } 92 93 chain handle_reject { 94 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic" 95 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic" 96 } 97 98 99 # 100 # NAT rules 101 # 102 103 chain dstnat { 104 type nat hook prerouting priority dstnat; policy accept; 105 } 106 107 chain srcnat { 108 type nat hook postrouting priority srcnat; policy accept; 109 } 110 111 112 # 113 # Raw rules (notrack) 114 # 115 116 chain raw_prerouting { 117 type filter hook prerouting priority raw; policy accept; 118 } 119 120 chain raw_output { 121 type filter hook output priority raw; policy accept; 122 } 123 124 125 # 126 # Mangle rules 127 # 128 129 chain mangle_prerouting { 130 type filter hook prerouting priority mangle; policy accept; 131 } 132 133 chain mangle_postrouting { 134 type filter hook postrouting priority mangle; policy accept; 135 } 136 137 chain mangle_input { 138 type filter hook input priority mangle; policy accept; 139 } 140 141 chain mangle_output { 142 type route hook output priority mangle; policy accept; 143 } 144 145 chain mangle_forward { 146 type filter hook forward priority mangle; policy accept; 147 } 148 } 149 -- End --
This page was automatically generated by LXR 0.3.1. • OpenWrt