1 Testing rules and redirects with several protocols that reference a port 2 set. A port set cannot match a protocol without ports; that protocol is 3 skipped with a warning instead of being emitted without a usable set match. 4 5 -- Testcase -- 6 {% 7 include("./root/usr/share/firewall4/main.uc", { 8 getenv: function(varname) { 9 switch (varname) { 10 case 'ACTION': 11 return 'print'; 12 } 13 } 14 }) 15 %} 16 -- End -- 17 18 -- File uci/helpers.json -- 19 {} 20 -- End -- 21 22 -- File fs/open~_proc_version.txt -- 23 Linux version 5.10.113 (jow@j7) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r17858+262-2c3e8bed3f) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 SMP Tue May 17 19:05:07 2022 24 -- End -- 25 26 -- File uci/firewall.json -- 27 { 28 "zone": [ 29 { "name": "lan", "network": "lan" }, 30 { "name": "wan", "network": [ "wan", "wan6" ], "masq": 1 } 31 ], 32 "ipset": [ 33 { "name": "dst-hosts", "comment": "Destination hosts", "match": [ "dest_ip" ], "entry": [ "10.0.1.1", "10.0.1.2" ] }, 34 { "name": "dst-ports", "comment": "Destination ports", "match": [ "dest_port" ], "entry": [ "22", "443" ] }, 35 { "name": "ip-ports", "comment": "Destination address and port tuples", "match": [ "dest_ip", "dest_port" ], "entry": [ "10.0.1.1 22", "10.0.1.2 443" ] } 36 ], 37 "rule": [ 38 { ".description": "An address set applies to every protocol of a mixed protocol rule", "name": "Mixed protocols with an address set", "src": "lan", "dest": "wan", "proto": "tcp icmp", "ipset": "dst-hosts", "target": "ACCEPT" }, 39 { ".description": "A port set does not apply to a protocol without ports; that protocol is skipped with a warning instead of being emitted as an invalid rule", "name": "Mixed protocols with a port set", "src": "lan", "dest": "wan", "proto": "tcp icmp", "ipset": "dst-ports", "target": "ACCEPT" }, 40 { ".description": "An address and port tuple set keeps both fields for the applicable protocol and skips the other", "name": "Mixed protocols with an address and port set", "src": "lan", "dest": "wan", "proto": "tcp icmp", "ipset": "ip-ports", "target": "ACCEPT" }, 41 { ".description": "The default protocol (tcp udp) emits a rule per protocol for a port set", "name": "Default protocol with a port set", "src": "lan", "dest": "wan", "ipset": "dst-ports", "target": "ACCEPT" } 42 ], 43 "redirect": [ 44 { ".description": "Redirects skip the protocol without ports as well", "name": "Mixed protocol redirect with a port set", "src": "lan", "dest": "wan", "proto": "tcp icmp", "src_dport": "53", "dest_port": "53", "ipset": "dst-ports", "target": "dnat" } 45 ] 46 } 47 -- End -- 48 49 -- Expect stderr -- 50 [!] Section @rule[1] (Mixed protocols with a port set) references set 'dst-ports' with port match which does not apply to protocol 'icmp', skipping this protocol 51 [!] Section @rule[2] (Mixed protocols with an address and port set) references set 'ip-ports' with port match which does not apply to protocol 'icmp', skipping this protocol 52 [!] Section @redirect[0] (Mixed protocol redirect with a port set) references set 'dst-ports' with port match which does not apply to protocol 'icmp', skipping this protocol 53 -- End -- 54 55 -- Expect stdout -- 56 table inet fw4 57 flush table inet fw4 58 59 table inet fw4 { 60 # 61 # Set definitions 62 # 63 64 set dst-hosts { 65 comment "Destination hosts" 66 type ipv4_addr 67 elements = { 68 10.0.1.1, 69 10.0.1.2, 70 } 71 } 72 73 set dst-ports { 74 comment "Destination ports" 75 type inet_service 76 elements = { 77 22, 78 443, 79 } 80 } 81 82 set ip-ports { 83 comment "Destination address and port tuples" 84 type ipv4_addr . inet_service 85 elements = { 86 10.0.1.1 . 22, 87 10.0.1.2 . 443, 88 } 89 } 90 91 92 # 93 # Defines 94 # 95 96 define lan_devices = { "br-lan" } 97 define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 } 98 99 define wan_devices = { "pppoe-wan" } 100 define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 } 101 102 103 # 104 # User includes 105 # 106 107 include "/etc/nftables.d/*.nft" 108 109 110 # 111 # Filter rules 112 # 113 114 chain input { 115 type filter hook input priority filter; policy drop; 116 117 iif "lo" accept comment "!fw4: Accept traffic from loopback" 118 119 ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" 120 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" 121 iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic" 122 } 123 124 chain forward { 125 type filter hook forward priority filter; policy drop; 126 127 ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" 128 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic" 129 iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" 130 } 131 132 chain output { 133 type filter hook output priority filter; policy drop; 134 135 oif "lo" accept comment "!fw4: Accept traffic towards loopback" 136 137 ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" 138 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic" 139 oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic" 140 } 141 142 chain prerouting { 143 type filter hook prerouting priority filter; policy accept; 144 } 145 146 chain handle_reject { 147 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic" 148 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic" 149 } 150 151 chain input_lan { 152 ct status dnat accept comment "!fw4: Accept port redirections" 153 jump drop_from_lan 154 } 155 156 chain output_lan { 157 jump drop_to_lan 158 } 159 160 chain forward_lan { 161 meta nfproto ipv4 meta l4proto tcp ip daddr @dst-hosts counter jump accept_to_wan comment "!fw4: Mixed protocols with an address set" 162 meta nfproto ipv4 meta l4proto icmp ip daddr @dst-hosts counter jump accept_to_wan comment "!fw4: Mixed protocols with an address set" 163 meta nfproto ipv4 meta l4proto tcp tcp dport @dst-ports counter jump accept_to_wan comment "!fw4: Mixed protocols with a port set" 164 meta nfproto ipv4 meta l4proto tcp ip daddr . tcp dport @ip-ports counter jump accept_to_wan comment "!fw4: Mixed protocols with an address and port set" 165 meta nfproto ipv4 meta l4proto tcp tcp dport @dst-ports counter jump accept_to_wan comment "!fw4: Default protocol with a port set" 166 meta nfproto ipv4 meta l4proto udp udp dport @dst-ports counter jump accept_to_wan comment "!fw4: Default protocol with a port set" 167 ct status dnat accept comment "!fw4: Accept port forwards" 168 jump drop_to_lan 169 } 170 171 chain drop_from_lan { 172 iifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic" 173 } 174 175 chain drop_to_lan { 176 oifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic" 177 } 178 179 chain input_wan { 180 jump drop_from_wan 181 } 182 183 chain output_wan { 184 jump drop_to_wan 185 } 186 187 chain forward_wan { 188 jump drop_to_wan 189 } 190 191 chain accept_to_wan { 192 meta nfproto ipv4 oifname "pppoe-wan" ct state invalid counter drop comment "!fw4: Prevent NAT leakage" 193 oifname "pppoe-wan" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic" 194 } 195 196 chain drop_from_wan { 197 iifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic" 198 } 199 200 chain drop_to_wan { 201 oifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic" 202 } 203 204 205 # 206 # NAT rules 207 # 208 209 chain dstnat { 210 type nat hook prerouting priority dstnat; policy accept; 211 iifname "br-lan" jump dstnat_lan comment "!fw4: Handle lan IPv4/IPv6 dstnat traffic" 212 } 213 214 chain srcnat { 215 type nat hook postrouting priority srcnat; policy accept; 216 oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic" 217 } 218 219 chain dstnat_lan { 220 meta nfproto ipv4 tcp dport 53 tcp dport @dst-ports counter redirect to 53 comment "!fw4: Mixed protocol redirect with a port set" 221 } 222 223 chain srcnat_wan { 224 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic" 225 } 226 227 228 # 229 # Raw rules (notrack) 230 # 231 232 chain raw_prerouting { 233 type filter hook prerouting priority raw; policy accept; 234 } 235 236 chain raw_output { 237 type filter hook output priority raw; policy accept; 238 } 239 240 241 # 242 # Mangle rules 243 # 244 245 chain mangle_prerouting { 246 type filter hook prerouting priority mangle; policy accept; 247 } 248 249 chain mangle_postrouting { 250 type filter hook postrouting priority mangle; policy accept; 251 } 252 253 chain mangle_input { 254 type filter hook input priority mangle; policy accept; 255 } 256 257 chain mangle_output { 258 type route hook output priority mangle; policy accept; 259 } 260 261 chain mangle_forward { 262 type filter hook forward priority mangle; policy accept; 263 } 264 } 265 -- End --
This page was automatically generated by LXR 0.3.1. • OpenWrt