1 Testing multiple ipset references per rule and redirect. References are 2 AND-ed; direction override and negation apply per reference; every reference 3 is validated on its own (unknown set, port set without TCP/UDP, destination 4 MAC, address family, contradicting negation); a single scalar reference keeps 5 its old meaning. Mangle rules and redirects accept the list as well. 6 7 -- Testcase -- 8 {% 9 include("./root/usr/share/firewall4/main.uc", { 10 getenv: function(varname) { 11 switch (varname) { 12 case 'ACTION': 13 return 'print'; 14 } 15 } 16 }) 17 %} 18 -- End -- 19 20 -- File uci/helpers.json -- 21 {} 22 -- End -- 23 24 -- File fs/open~_proc_version.txt -- 25 Linux version 5.10.113 (jow@j7) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r17858+262-2c3e8bed3f) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 SMP Tue May 17 19:05:07 2022 26 -- End -- 27 28 -- File uci/firewall.json -- 29 { 30 "zone": [ 31 { 32 "name": "lan", 33 "network": "lan" 34 }, 35 { 36 "name": "wan", 37 "network": [ 38 "wan", 39 "wan6" 40 ], 41 "masq": 1 42 } 43 ], 44 "ipset": [ 45 { 46 "name": "src-pairs", 47 "comment": "Source IP/MAC pairs", 48 "match": [ 49 "src_ip", 50 "src_mac" 51 ], 52 "entry": [ 53 "192.168.26.10 00:11:22:33:44:55" 54 ] 55 }, 56 { 57 "name": "dst-hosts", 58 "comment": "Destination hosts", 59 "match": [ 60 "dest_ip" 61 ], 62 "entry": [ 63 "10.0.1.1", 64 "10.0.1.2" 65 ] 66 }, 67 { 68 "name": "blocked-nets", 69 "comment": "Destination networks", 70 "match": [ 71 "dest_net" 72 ], 73 "entry": [ 74 "192.0.2.0/24" 75 ] 76 }, 77 { 78 "name": "v6-hosts", 79 "comment": "IPv6 destination hosts", 80 "family": "IPv6", 81 "match": [ 82 "dest_ip" 83 ], 84 "entry": [ 85 "2001:db8::1" 86 ] 87 }, 88 { 89 "name": "dst-ports", 90 "comment": "Destination ports", 91 "match": [ 92 "dest_port" 93 ], 94 "entry": [ 95 "22", 96 "443" 97 ] 98 }, 99 { 100 "name": "macs", 101 "comment": "Source MACs, family any", 102 "family": "any", 103 "match": [ 104 "src_mac" 105 ], 106 "entry": [ 107 "00:11:22:33:44:55" 108 ] 109 } 110 ], 111 "rule": [ 112 { 113 ".description": "Two set references are AND-ed into one rule", 114 "name": "Rule with two sets", 115 "src": "lan", 116 "dest": "wan", 117 "proto": "tcp", 118 "dest_port": "22", 119 "ipset": [ 120 "src-pairs", 121 "dst-hosts" 122 ], 123 "target": "ACCEPT" 124 }, 125 { 126 ".description": "Direction override and negation apply per list entry", 127 "name": "Rule with direction override and negation", 128 "src": "lan", 129 "dest": "wan", 130 "proto": "tcp", 131 "dest_port": "443", 132 "ipset": [ 133 "src-pairs", 134 "dst-hosts src", 135 "!blocked-nets" 136 ], 137 "target": "ACCEPT" 138 }, 139 { 140 ".description": "A single scalar reference with direction keeps working unchanged", 141 "name": "Rule with legacy scalar reference", 142 "src": "lan", 143 "dest": "wan", 144 "proto": "tcp", 145 "ipset": "dst-hosts src", 146 "target": "ACCEPT" 147 }, 148 { 149 ".description": "A duplicate reference is ignored with a warning", 150 "name": "Rule with duplicate reference", 151 "src": "lan", 152 "dest": "wan", 153 "proto": "tcp", 154 "ipset": [ 155 "src-pairs", 156 "dst-hosts", 157 "dst-hosts" 158 ], 159 "target": "ACCEPT" 160 }, 161 { 162 ".description": "An unknown set in the list skips the whole rule", 163 "name": "Rule with unknown set", 164 "src": "lan", 165 "dest": "wan", 166 "proto": "tcp", 167 "ipset": [ 168 "dst-hosts", 169 "no-such-set" 170 ], 171 "target": "ACCEPT" 172 }, 173 { 174 ".description": "Sets of different families in one rule skip the rule", 175 "name": "Rule with family conflict", 176 "src": "lan", 177 "dest": "wan", 178 "proto": "tcp", 179 "ipset": [ 180 "dst-hosts", 181 "v6-hosts" 182 ], 183 "target": "ACCEPT" 184 }, 185 { 186 ".description": "Mangle rules accept multiple set references", 187 "name": "Mark with two sets", 188 "src": "lan", 189 "dest": "wan", 190 "proto": "tcp", 191 "ipset": [ 192 "src-pairs", 193 "dst-hosts" 194 ], 195 "target": "MARK", 196 "set_mark": "0x1" 197 }, 198 { 199 ".description": "A port set in the list still requires TCP or UDP", 200 "name": "Rule with port set and icmp", 201 "src": "lan", 202 "dest": "wan", 203 "proto": "icmp", 204 "ipset": [ 205 "src-pairs", 206 "dst-ports" 207 ], 208 "target": "ACCEPT" 209 }, 210 { 211 ".description": "Destination MAC matching is rejected for any list entry", 212 "name": "Rule with dst MAC set", 213 "src": "lan", 214 "dest": "wan", 215 "proto": "tcp", 216 "ipset": [ 217 "dst-hosts", 218 "src-pairs src dst" 219 ], 220 "target": "ACCEPT" 221 }, 222 { 223 ".description": "An IPv6 set combined with a family-agnostic set yields an IPv6 rule", 224 "name": "Rule with v6 set and mac set", 225 "src": "lan", 226 "dest": "wan", 227 "proto": "tcp", 228 "dest_port": "22", 229 "ipset": [ 230 "v6-hosts", 231 "macs" 232 ], 233 "target": "ACCEPT" 234 }, 235 { 236 ".description": "A negated scalar reference keeps working unchanged", 237 "name": "Rule with negated scalar reference", 238 "src": "lan", 239 "dest": "wan", 240 "proto": "tcp", 241 "ipset": "!dst-hosts", 242 "target": "ACCEPT" 243 }, 244 { 245 ".description": "Explicit family any with an IPv4 set and a family-agnostic MAC set yields one IPv4 rule", 246 "name": "Family any with v4 set and mac set", 247 "family": "any", 248 "src": "lan", 249 "dest": "wan", 250 "proto": "tcp", 251 "dest_port": "22", 252 "ipset": [ 253 "dst-hosts", 254 "macs" 255 ], 256 "target": "ACCEPT" 257 }, 258 { 259 ".description": "The same set negated and non-negated in one direction can never match and drops the section", 260 "name": "Rule with contradicting references", 261 "src": "lan", 262 "dest": "wan", 263 "proto": "tcp", 264 "ipset": [ 265 "dst-hosts", 266 "!dst-hosts" 267 ], 268 "target": "ACCEPT" 269 } 270 ], 271 "redirect": [ 272 { 273 ".description": "Redirects accept multiple set references as well", 274 "name": "Redirect with two sets", 275 "src": "lan", 276 "dest": "wan", 277 "proto": "tcp", 278 "src_dport": "53", 279 "dest_port": "53", 280 "ipset": [ 281 "src-pairs", 282 "dst-hosts src" 283 ], 284 "target": "dnat" 285 } 286 ] 287 } 288 -- End -- 289 290 -- Expect stderr -- 291 [!] Section @rule[3] (Rule with duplicate reference) references set 'dst-hosts' more than once, ignoring duplicate 292 [!] Section @rule[4] (Rule with unknown set) references unknown set 'no-such-set' 293 [!] Section @rule[5] (Rule with family conflict) references IPv6 only set match but is restricted to IPv4 by set match, skipping 294 [!] Section @rule[7] (Rule with port set and icmp) references named set with port match but no UDP/TCP protocol, ignoring section 295 [!] Section @rule[8] (Rule with dst MAC set) destination MAC address matching not supported 296 [!] Section @rule[12] (Rule with contradicting references) references set 'dst-hosts' both negated and non-negated, rule can never match 297 -- End -- 298 299 -- Expect stdout -- 300 table inet fw4 301 flush table inet fw4 302 303 table inet fw4 { 304 # 305 # Set definitions 306 # 307 308 set src-pairs { 309 comment "Source IP/MAC pairs" 310 type ipv4_addr . ether_addr 311 elements = { 312 192.168.26.10 . 00:11:22:33:44:55, 313 } 314 } 315 316 set dst-hosts { 317 comment "Destination hosts" 318 type ipv4_addr 319 elements = { 320 10.0.1.1, 321 10.0.1.2, 322 } 323 } 324 325 set blocked-nets { 326 comment "Destination networks" 327 type ipv4_addr 328 auto-merge 329 flags interval 330 elements = { 331 192.0.2.0/24, 332 } 333 } 334 335 set v6-hosts { 336 comment "IPv6 destination hosts" 337 type ipv6_addr 338 elements = { 339 2001:db8::1, 340 } 341 } 342 343 set dst-ports { 344 comment "Destination ports" 345 type inet_service 346 elements = { 347 22, 348 443, 349 } 350 } 351 352 set macs { 353 comment "Source MACs, family any" 354 type ether_addr 355 elements = { 356 00:11:22:33:44:55, 357 } 358 } 359 360 361 # 362 # Defines 363 # 364 365 define lan_devices = { "br-lan" } 366 define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 } 367 368 define wan_devices = { "pppoe-wan" } 369 define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 } 370 371 372 # 373 # User includes 374 # 375 376 include "/etc/nftables.d/*.nft" 377 378 379 # 380 # Filter rules 381 # 382 383 chain input { 384 type filter hook input priority filter; policy drop; 385 386 iif "lo" accept comment "!fw4: Accept traffic from loopback" 387 388 ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" 389 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" 390 iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic" 391 } 392 393 chain forward { 394 type filter hook forward priority filter; policy drop; 395 396 ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" 397 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic" 398 iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" 399 } 400 401 chain output { 402 type filter hook output priority filter; policy drop; 403 404 oif "lo" accept comment "!fw4: Accept traffic towards loopback" 405 406 ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" 407 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic" 408 oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic" 409 } 410 411 chain prerouting { 412 type filter hook prerouting priority filter; policy accept; 413 } 414 415 chain handle_reject { 416 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic" 417 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic" 418 } 419 420 chain input_lan { 421 ct status dnat accept comment "!fw4: Accept port redirections" 422 jump drop_from_lan 423 } 424 425 chain output_lan { 426 jump drop_to_lan 427 } 428 429 chain forward_lan { 430 meta nfproto ipv4 tcp dport 22 ip saddr . ether saddr @src-pairs ip daddr @dst-hosts counter jump accept_to_wan comment "!fw4: Rule with two sets" 431 meta nfproto ipv4 tcp dport 443 ip saddr . ether saddr @src-pairs ip saddr @dst-hosts ip daddr != @blocked-nets counter jump accept_to_wan comment "!fw4: Rule with direction override and negation" 432 meta nfproto ipv4 meta l4proto tcp ip saddr @dst-hosts counter jump accept_to_wan comment "!fw4: Rule with legacy scalar reference" 433 meta nfproto ipv4 meta l4proto tcp ip saddr . ether saddr @src-pairs ip daddr @dst-hosts counter jump accept_to_wan comment "!fw4: Rule with duplicate reference" 434 meta nfproto ipv6 tcp dport 22 ip6 daddr @v6-hosts ether saddr @macs counter jump accept_to_wan comment "!fw4: Rule with v6 set and mac set" 435 meta nfproto ipv4 meta l4proto tcp ip daddr != @dst-hosts counter jump accept_to_wan comment "!fw4: Rule with negated scalar reference" 436 meta nfproto ipv4 tcp dport 22 ip daddr @dst-hosts ether saddr @macs counter jump accept_to_wan comment "!fw4: Family any with v4 set and mac set" 437 ct status dnat accept comment "!fw4: Accept port forwards" 438 jump drop_to_lan 439 } 440 441 chain drop_from_lan { 442 iifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic" 443 } 444 445 chain drop_to_lan { 446 oifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic" 447 } 448 449 chain input_wan { 450 jump drop_from_wan 451 } 452 453 chain output_wan { 454 jump drop_to_wan 455 } 456 457 chain forward_wan { 458 jump drop_to_wan 459 } 460 461 chain accept_to_wan { 462 meta nfproto ipv4 oifname "pppoe-wan" ct state invalid counter drop comment "!fw4: Prevent NAT leakage" 463 oifname "pppoe-wan" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic" 464 } 465 466 chain drop_from_wan { 467 iifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic" 468 } 469 470 chain drop_to_wan { 471 oifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic" 472 } 473 474 475 # 476 # NAT rules 477 # 478 479 chain dstnat { 480 type nat hook prerouting priority dstnat; policy accept; 481 iifname "br-lan" jump dstnat_lan comment "!fw4: Handle lan IPv4/IPv6 dstnat traffic" 482 } 483 484 chain srcnat { 485 type nat hook postrouting priority srcnat; policy accept; 486 oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic" 487 } 488 489 chain dstnat_lan { 490 meta nfproto ipv4 tcp dport 53 ip saddr . ether saddr @src-pairs ip saddr @dst-hosts counter redirect to 53 comment "!fw4: Redirect with two sets" 491 } 492 493 chain srcnat_wan { 494 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic" 495 } 496 497 498 # 499 # Raw rules (notrack) 500 # 501 502 chain raw_prerouting { 503 type filter hook prerouting priority raw; policy accept; 504 } 505 506 chain raw_output { 507 type filter hook output priority raw; policy accept; 508 } 509 510 511 # 512 # Mangle rules 513 # 514 515 chain mangle_prerouting { 516 type filter hook prerouting priority mangle; policy accept; 517 } 518 519 chain mangle_postrouting { 520 type filter hook postrouting priority mangle; policy accept; 521 } 522 523 chain mangle_input { 524 type filter hook input priority mangle; policy accept; 525 } 526 527 chain mangle_output { 528 type route hook output priority mangle; policy accept; 529 } 530 531 chain mangle_forward { 532 type filter hook forward priority mangle; policy accept; 533 meta nfproto ipv4 meta l4proto tcp iifname "br-lan" oifname "pppoe-wan" ip saddr . ether saddr @src-pairs ip daddr @dst-hosts counter meta mark set 0x1 comment "!fw4: Mark with two sets" 534 } 535 } 536 -- End --
This page was automatically generated by LXR 0.3.1. • OpenWrt