1 Testing the syntax of a scalar ipset reference. Only direction tokens 2 (src, dst, dest), at most three, separated by spaces or commas, may follow 3 the set name. Anything else makes the value invalid and drops the section 4 instead of silently ignoring the unknown tokens. 5 6 -- Testcase -- 7 {% 8 include("./root/usr/share/firewall4/main.uc", { 9 getenv: function(varname) { 10 switch (varname) { 11 case 'ACTION': 12 return 'print'; 13 } 14 } 15 }) 16 %} 17 -- End -- 18 19 -- File uci/helpers.json -- 20 {} 21 -- End -- 22 23 -- File fs/open~_proc_version.txt -- 24 Linux version 5.10.113 (jow@j7) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r17858+262-2c3e8bed3f) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 SMP Tue May 17 19:05:07 2022 25 -- End -- 26 27 -- File uci/firewall.json -- 28 { 29 "zone": [ 30 { 31 "name": "lan", 32 "network": "lan" 33 }, 34 { 35 "name": "wan", 36 "network": [ 37 "wan", 38 "wan6" 39 ], 40 "masq": 1 41 } 42 ], 43 "ipset": [ 44 { 45 "name": "hosts", 46 "comment": "Destination hosts", 47 "match": [ 48 "dest_ip" 49 ], 50 "entry": [ 51 "10.0.1.1", 52 "10.0.1.2" 53 ] 54 }, 55 { 56 "name": "pairs", 57 "comment": "Source IP/MAC pairs", 58 "match": [ 59 "src_ip", 60 "src_mac" 61 ], 62 "entry": [ 63 "192.168.26.10 00:11:22:33:44:55" 64 ] 65 } 66 ], 67 "rule": [ 68 { 69 ".description": "A direction token after the set name is accepted", 70 "name": "Reference with direction token", 71 "src": "lan", 72 "dest": "wan", 73 "proto": "tcp", 74 "ipset": "hosts src", 75 "target": "ACCEPT" 76 }, 77 { 78 ".description": "Repeated separators between tokens do not shift the field index", 79 "name": "Reference with repeated separators", 80 "src": "lan", 81 "dest": "wan", 82 "proto": "tcp", 83 "ipset": "hosts src", 84 "target": "ACCEPT" 85 }, 86 { 87 ".description": "Direction tokens per field with a comma separator keep working", 88 "name": "Reference with comma separated tokens", 89 "src": "lan", 90 "dest": "wan", 91 "proto": "tcp", 92 "ipset": "pairs src,src", 93 "target": "ACCEPT" 94 }, 95 { 96 ".description": "Two set names in one scalar value are not a list; the value is invalid", 97 "name": "Reference with two set names", 98 "src": "lan", 99 "dest": "wan", 100 "proto": "tcp", 101 "ipset": "hosts pairs", 102 "target": "ACCEPT" 103 }, 104 { 105 ".description": "An unknown token after the set name is invalid", 106 "name": "Reference with unknown token", 107 "src": "lan", 108 "dest": "wan", 109 "proto": "tcp", 110 "ipset": "hosts source", 111 "target": "ACCEPT" 112 }, 113 { 114 ".description": "More than three direction tokens are invalid", 115 "name": "Reference with four direction tokens", 116 "src": "lan", 117 "dest": "wan", 118 "proto": "tcp", 119 "ipset": "pairs src src src src", 120 "target": "ACCEPT" 121 } 122 ] 123 } 124 -- End -- 125 126 -- Expect stderr -- 127 [!] Section @rule[3] (Reference with two set names) option 'ipset' specifies invalid value 'hosts pairs' 128 [!] Section @rule[3] (Reference with two set names) skipped due to invalid options 129 [!] Section @rule[4] (Reference with unknown token) option 'ipset' specifies invalid value 'hosts source' 130 [!] Section @rule[4] (Reference with unknown token) skipped due to invalid options 131 [!] Section @rule[5] (Reference with four direction tokens) option 'ipset' specifies invalid value 'pairs src src src src' 132 [!] Section @rule[5] (Reference with four direction tokens) skipped due to invalid options 133 -- End -- 134 135 -- Expect stdout -- 136 table inet fw4 137 flush table inet fw4 138 139 table inet fw4 { 140 # 141 # Set definitions 142 # 143 144 set hosts { 145 comment "Destination hosts" 146 type ipv4_addr 147 elements = { 148 10.0.1.1, 149 10.0.1.2, 150 } 151 } 152 153 set pairs { 154 comment "Source IP/MAC pairs" 155 type ipv4_addr . ether_addr 156 elements = { 157 192.168.26.10 . 00:11:22:33:44:55, 158 } 159 } 160 161 162 # 163 # Defines 164 # 165 166 define lan_devices = { "br-lan" } 167 define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 } 168 169 define wan_devices = { "pppoe-wan" } 170 define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 } 171 172 173 # 174 # User includes 175 # 176 177 include "/etc/nftables.d/*.nft" 178 179 180 # 181 # Filter rules 182 # 183 184 chain input { 185 type filter hook input priority filter; policy drop; 186 187 iif "lo" accept comment "!fw4: Accept traffic from loopback" 188 189 ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" 190 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" 191 iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic" 192 } 193 194 chain forward { 195 type filter hook forward priority filter; policy drop; 196 197 ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" 198 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic" 199 iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" 200 } 201 202 chain output { 203 type filter hook output priority filter; policy drop; 204 205 oif "lo" accept comment "!fw4: Accept traffic towards loopback" 206 207 ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" 208 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic" 209 oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic" 210 } 211 212 chain prerouting { 213 type filter hook prerouting priority filter; policy accept; 214 } 215 216 chain handle_reject { 217 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic" 218 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic" 219 } 220 221 chain input_lan { 222 jump drop_from_lan 223 } 224 225 chain output_lan { 226 jump drop_to_lan 227 } 228 229 chain forward_lan { 230 meta nfproto ipv4 meta l4proto tcp ip saddr @hosts counter jump accept_to_wan comment "!fw4: Reference with direction token" 231 meta nfproto ipv4 meta l4proto tcp ip saddr @hosts counter jump accept_to_wan comment "!fw4: Reference with repeated separators" 232 meta nfproto ipv4 meta l4proto tcp ip saddr . ether saddr @pairs counter jump accept_to_wan comment "!fw4: Reference with comma separated tokens" 233 jump drop_to_lan 234 } 235 236 chain drop_from_lan { 237 iifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic" 238 } 239 240 chain drop_to_lan { 241 oifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic" 242 } 243 244 chain input_wan { 245 jump drop_from_wan 246 } 247 248 chain output_wan { 249 jump drop_to_wan 250 } 251 252 chain forward_wan { 253 jump drop_to_wan 254 } 255 256 chain accept_to_wan { 257 meta nfproto ipv4 oifname "pppoe-wan" ct state invalid counter drop comment "!fw4: Prevent NAT leakage" 258 oifname "pppoe-wan" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic" 259 } 260 261 chain drop_from_wan { 262 iifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic" 263 } 264 265 chain drop_to_wan { 266 oifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic" 267 } 268 269 270 # 271 # NAT rules 272 # 273 274 chain dstnat { 275 type nat hook prerouting priority dstnat; policy accept; 276 } 277 278 chain srcnat { 279 type nat hook postrouting priority srcnat; policy accept; 280 oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic" 281 } 282 283 chain srcnat_wan { 284 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic" 285 } 286 287 288 # 289 # Raw rules (notrack) 290 # 291 292 chain raw_prerouting { 293 type filter hook prerouting priority raw; policy accept; 294 } 295 296 chain raw_output { 297 type filter hook output priority raw; policy accept; 298 } 299 300 301 # 302 # Mangle rules 303 # 304 305 chain mangle_prerouting { 306 type filter hook prerouting priority mangle; policy accept; 307 } 308 309 chain mangle_postrouting { 310 type filter hook postrouting priority mangle; policy accept; 311 } 312 313 chain mangle_input { 314 type filter hook input priority mangle; policy accept; 315 } 316 317 chain mangle_output { 318 type route hook output priority mangle; policy accept; 319 } 320 321 chain mangle_forward { 322 type filter hook forward priority mangle; policy accept; 323 } 324 } 325 -- End --
This page was automatically generated by LXR 0.3.1. • OpenWrt