tests/02_zones/01_policies

   1 Testing that zone policies are properly mapped to chains.
   2
   3 -- Testcase --
   4 {%
   5         include("./root/usr/share/firewall4/main.uc", {
   6                 getenv: function(varname) {
   7                         switch (varname) {
   8                         case 'ACTION':
   9                                 return 'print';
  10                         }
  11                 }
  12         })
  13 %}
  14 -- End --
  15
  16 -- File uci/helpers.json --
  17 {}
  18 -- End --
  19
  20 -- File fs/open~_sys_class_net_zone1_flags.txt --
  21 0x1103
  22 -- End --
  23
  24 -- File fs/open~_sys_class_net_zone2_flags.txt --
  25 0x1103
  26 -- End --
  27
  28 -- File fs/open~_sys_class_net_zone3_flags.txt --
  29 0x1103
  30 -- End --
  31
  32 -- File uci/firewall.json --
  33 {
  34         "zone": [
  35                 {
  36                         ".description": "Zone accept policies should map to accept rules from/to covered interfaces",
  37                         "name": "test1",
  38                         "input": "ACCEPT",
  39                         "output": "ACCEPT",
  40                         "forward": "ACCEPT",
  41                         "device": "zone1"
  42                 },
  43                 {
  44                         ".description": "Zone drop policies should map to drop rules from/to covered interfaces",
  45                         "name": "test2",
  46                         "input": "DROP",
  47                         "output": "DROP",
  48                         "forward": "DROP",
  49                         "device": "zone2"
  50                 },
  51                 {
  52                         ".description": "Zone reject policies should map to reject rules from/to covered interfaces",
  53                         "name": "test3",
  54                         "input": "REJECT",
  55                         "output": "REJECT",
  56                         "forward": "REJECT",
  57                         "device": "zone3"
  58                 }
  59         ]
  60 }
  61 -- End --
  62
  63 -- Expect stdout --
  64 table inet fw4
  65 flush table inet fw4
  66
  67 table inet fw4 {
  68         #
  69         # Set definitions
  70         #
  71
  72
  73         #
  74         # Defines
  75         #
  76
  77         define test1_devices = { "zone1" }
  78         define test2_devices = { "zone2" }
  79         define test3_devices = { "zone3" }
  80
  81         #
  82         # User includes
  83         #
  84
  85         include "/etc/nftables.d/*.nft"
  86
  87
  88         #
  89         # Filter rules
  90         #
  91
  92         chain input {
  93                 type filter hook input priority filter; policy drop;
  94
  95                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
  96
  97                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
  98                 iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
  99                 iifname "zone2" jump input_test2 comment "!fw4: Handle test2 IPv4/IPv6 input traffic"
 100                 iifname "zone3" jump input_test3 comment "!fw4: Handle test3 IPv4/IPv6 input traffic"
 101         }
 102
 103         chain forward {
 104                 type filter hook forward priority filter; policy drop;
 105
 106                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
 107                 iifname "zone1" jump forward_test1 comment "!fw4: Handle test1 IPv4/IPv6 forward traffic"
 108                 iifname "zone2" jump forward_test2 comment "!fw4: Handle test2 IPv4/IPv6 forward traffic"
 109                 iifname "zone3" jump forward_test3 comment "!fw4: Handle test3 IPv4/IPv6 forward traffic"
 110         }
 111
 112         chain output {
 113                 type filter hook output priority filter; policy drop;
 114
 115                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 116
 117                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
 118                 oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
 119                 oifname "zone2" jump output_test2 comment "!fw4: Handle test2 IPv4/IPv6 output traffic"
 120                 oifname "zone3" jump output_test3 comment "!fw4: Handle test3 IPv4/IPv6 output traffic"
 121         }
 122
 123         chain prerouting {
 124                 type filter hook prerouting priority filter; policy accept;
 125                 iifname "zone1" jump helper_test1 comment "!fw4: Handle test1 IPv4/IPv6 helper assignment"
 126                 iifname "zone2" jump helper_test2 comment "!fw4: Handle test2 IPv4/IPv6 helper assignment"
 127                 iifname "zone3" jump helper_test3 comment "!fw4: Handle test3 IPv4/IPv6 helper assignment"
 128         }
 129
 130         chain handle_reject {
 131                 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
 132                 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
 133         }
 134
 135         chain input_test1 {
 136                 jump accept_from_test1
 137         }
 138
 139         chain output_test1 {
 140                 jump accept_to_test1
 141         }
 142
 143         chain forward_test1 {
 144                 jump accept_to_test1
 145         }
 146
 147         chain helper_test1 {
 148         }
 149
 150         chain accept_from_test1 {
 151                 iifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
 152         }
 153
 154         chain accept_to_test1 {
 155                 oifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
 156         }
 157
 158         chain input_test2 {
 159                 jump drop_from_test2
 160         }
 161
 162         chain output_test2 {
 163                 jump drop_to_test2
 164         }
 165
 166         chain forward_test2 {
 167                 jump drop_to_test2
 168         }
 169
 170         chain helper_test2 {
 171         }
 172
 173         chain drop_from_test2 {
 174                 iifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
 175         }
 176
 177         chain drop_to_test2 {
 178                 oifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
 179         }
 180
 181         chain input_test3 {
 182                 jump reject_from_test3
 183         }
 184
 185         chain output_test3 {
 186                 jump reject_to_test3
 187         }
 188
 189         chain forward_test3 {
 190                 jump reject_to_test3
 191         }
 192
 193         chain helper_test3 {
 194         }
 195
 196         chain reject_from_test3 {
 197                 iifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
 198         }
 199
 200         chain reject_to_test3 {
 201                 oifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
 202         }
 203
 204
 205         #
 206         # NAT rules
 207         #
 208
 209         chain dstnat {
 210                 type nat hook prerouting priority dstnat; policy accept;
 211         }
 212
 213         chain srcnat {
 214                 type nat hook postrouting priority srcnat; policy accept;
 215         }
 216
 217
 218         #
 219         # Raw rules (notrack)
 220         #
 221
 222         chain raw_prerouting {
 223                 type filter hook prerouting priority raw; policy accept;
 224         }
 225
 226         chain raw_output {
 227                 type filter hook output priority raw; policy accept;
 228         }
 229
 230
 231         #
 232         # Mangle rules
 233         #
 234
 235         chain mangle_prerouting {
 236                 type filter hook prerouting priority mangle; policy accept;
 237         }
 238
 239         chain mangle_postrouting {
 240                 type filter hook postrouting priority mangle; policy accept;
 241         }
 242
 243         chain mangle_input {
 244                 type filter hook input priority mangle; policy accept;
 245         }
 246
 247         chain mangle_output {
 248                 type route hook output priority mangle; policy accept;
 249         }
 250
 251         chain mangle_forward {
 252                 type filter hook forward priority mangle; policy accept;
 253         }
 254 }
 255 -- End --