tests/03_rules/10_notrack

   1 Ensure that NOTRACK rules end up in the appropriate chains, depending on
   2 the src and dest options.
   3
   4 -- Testcase --
   5 {%
   6         include("./root/usr/share/firewall4/main.uc", {
   7                 getenv: function(varname) {
   8                         switch (varname) {
   9                         case 'ACTION':
  10                                 return 'print';
  11                         }
  12                 }
  13         })
  14 %}
  15 -- End --
  16
  17 -- File uci/helpers.json --
  18 {}
  19 -- End --
  20
  21 -- File fs/open~_sys_class_net_eth0_flags.txt --
  22 0x1103
  23 -- End --
  24
  25 -- File fs/open~_sys_class_net_lo_flags.txt --
  26 0x9
  27 -- End --
  28
  29 -- File uci/firewall.json --
  30 {
  31         "zone": [
  32                 {
  33                         "name": "zone1",
  34                         "device": [ "eth0" ],
  35                         "auto_helper": 0
  36                 },
  37                 {
  38                         "name": "zone2",
  39                         "device": [ "lo" ],
  40                         "auto_helper": 0
  41                 },
  42                 {
  43                         "name": "zone3",
  44                         "subnet": [ "127.0.0.1/8", "::1/128" ],
  45                         "auto_helper": 0
  46                 }
  47         ],
  48         "rule": [
  49                 {
  50                         ".description": "An ordinary notrack rule should end up in the raw_prerouting chain",
  51                         "name": "Notrack rule #1",
  52                         "src": "zone1",
  53                         "target": "NOTRACK"
  54                 },
  55                 {
  56                         ".description": "A notrack rule with loopback source device should end up in the raw_output chain",
  57                         "name": "Notrack rule #2",
  58                         "src": "zone2",
  59                         "target": "NOTRACK"
  60                 },
  61                 {
  62                         ".description": "A notrack rule with loopback source address should end up in the raw_output chain",
  63                         "name": "Notrack rule #3",
  64                         "src": "zone3",
  65                         "target": "NOTRACK"
  66                 }
  67         ]
  68 }
  69 -- End --
  70
  71 -- Expect stdout --
  72 table inet fw4
  73 flush table inet fw4
  74
  75 table inet fw4 {
  76         #
  77         # Set definitions
  78         #
  79
  80
  81         #
  82         # Defines
  83         #
  84
  85         define zone1_devices = { "eth0" }
  86         define zone2_devices = { "lo" }
  87         define zone3_subnets = { 127.0.0.0/8, ::1 }
  88
  89         #
  90         # User includes
  91         #
  92
  93         include "/etc/nftables.d/*.nft"
  94
  95
  96         #
  97         # Filter rules
  98         #
  99
 100         chain input {
 101                 type filter hook input priority filter; policy drop;
 102
 103                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
 104
 105                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
 106                 iifname "eth0" jump input_zone1 comment "!fw4: Handle zone1 IPv4/IPv6 input traffic"
 107                 iifname "lo" jump input_zone2 comment "!fw4: Handle zone2 IPv4/IPv6 input traffic"
 108                 meta nfproto ipv4 ip saddr 127.0.0.0/8 jump input_zone3 comment "!fw4: Handle zone3 IPv4 input traffic"
 109                 meta nfproto ipv6 ip6 saddr ::1 jump input_zone3 comment "!fw4: Handle zone3 IPv6 input traffic"
 110         }
 111
 112         chain forward {
 113                 type filter hook forward priority filter; policy drop;
 114
 115                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
 116                 iifname "eth0" jump forward_zone1 comment "!fw4: Handle zone1 IPv4/IPv6 forward traffic"
 117                 iifname "lo" jump forward_zone2 comment "!fw4: Handle zone2 IPv4/IPv6 forward traffic"
 118                 meta nfproto ipv4 ip saddr 127.0.0.0/8 jump forward_zone3 comment "!fw4: Handle zone3 IPv4 forward traffic"
 119                 meta nfproto ipv6 ip6 saddr ::1 jump forward_zone3 comment "!fw4: Handle zone3 IPv6 forward traffic"
 120         }
 121
 122         chain output {
 123                 type filter hook output priority filter; policy drop;
 124
 125                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 126
 127                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
 128                 oifname "eth0" jump output_zone1 comment "!fw4: Handle zone1 IPv4/IPv6 output traffic"
 129                 oifname "lo" jump output_zone2 comment "!fw4: Handle zone2 IPv4/IPv6 output traffic"
 130                 meta nfproto ipv4 ip daddr 127.0.0.0/8 jump output_zone3 comment "!fw4: Handle zone3 IPv4 output traffic"
 131                 meta nfproto ipv6 ip6 daddr ::1 jump output_zone3 comment "!fw4: Handle zone3 IPv6 output traffic"
 132         }
 133
 134         chain prerouting {
 135                 type filter hook prerouting priority filter; policy accept;
 136         }
 137
 138         chain handle_reject {
 139                 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
 140                 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
 141         }
 142
 143         chain input_zone1 {
 144                 jump drop_from_zone1
 145         }
 146
 147         chain output_zone1 {
 148                 jump drop_to_zone1
 149         }
 150
 151         chain forward_zone1 {
 152                 jump drop_to_zone1
 153         }
 154
 155         chain drop_from_zone1 {
 156                 iifname "eth0" counter drop comment "!fw4: drop zone1 IPv4/IPv6 traffic"
 157         }
 158
 159         chain drop_to_zone1 {
 160                 oifname "eth0" counter drop comment "!fw4: drop zone1 IPv4/IPv6 traffic"
 161         }
 162
 163         chain input_zone2 {
 164                 jump drop_from_zone2
 165         }
 166
 167         chain output_zone2 {
 168                 jump drop_to_zone2
 169         }
 170
 171         chain forward_zone2 {
 172                 jump drop_to_zone2
 173         }
 174
 175         chain drop_from_zone2 {
 176                 iifname "lo" counter drop comment "!fw4: drop zone2 IPv4/IPv6 traffic"
 177         }
 178
 179         chain drop_to_zone2 {
 180                 oifname "lo" counter drop comment "!fw4: drop zone2 IPv4/IPv6 traffic"
 181         }
 182
 183         chain input_zone3 {
 184                 jump drop_from_zone3
 185         }
 186
 187         chain output_zone3 {
 188                 jump drop_to_zone3
 189         }
 190
 191         chain forward_zone3 {
 192                 jump drop_to_zone3
 193         }
 194
 195         chain drop_from_zone3 {
 196                 meta nfproto ipv4 ip saddr 127.0.0.0/8 counter drop comment "!fw4: drop zone3 IPv4 traffic"
 197                 meta nfproto ipv6 ip6 saddr ::1 counter drop comment "!fw4: drop zone3 IPv6 traffic"
 198         }
 199
 200         chain drop_to_zone3 {
 201                 meta nfproto ipv4 ip daddr 127.0.0.0/8 counter drop comment "!fw4: drop zone3 IPv4 traffic"
 202                 meta nfproto ipv6 ip6 daddr ::1 counter drop comment "!fw4: drop zone3 IPv6 traffic"
 203         }
 204
 205
 206         #
 207         # NAT rules
 208         #
 209
 210         chain dstnat {
 211                 type nat hook prerouting priority dstnat; policy accept;
 212         }
 213
 214         chain srcnat {
 215                 type nat hook postrouting priority srcnat; policy accept;
 216         }
 217
 218
 219         #
 220         # Raw rules (notrack)
 221         #
 222
 223         chain raw_prerouting {
 224                 type filter hook prerouting priority raw; policy accept;
 225                 iifname "eth0" jump notrack_zone1 comment "!fw4: Handle zone1 IPv4/IPv6 notrack traffic"
 226         }
 227
 228         chain raw_output {
 229                 type filter hook output priority raw; policy accept;
 230                 iifname "lo" jump notrack_zone2 comment "!fw4: Handle zone2 IPv4/IPv6 notrack traffic"
 231                 meta nfproto ipv4 ip saddr 127.0.0.0/8 jump notrack_zone3 comment "!fw4: Handle zone3 IPv4 notrack traffic"
 232                 meta nfproto ipv6 ip6 saddr ::1 jump notrack_zone3 comment "!fw4: Handle zone3 IPv6 notrack traffic"
 233         }
 234
 235         chain notrack_zone1 {
 236                 meta l4proto tcp counter notrack comment "!fw4: Notrack rule #1"
 237                 meta l4proto udp counter notrack comment "!fw4: Notrack rule #1"
 238         }
 239
 240         chain notrack_zone2 {
 241                 meta l4proto tcp counter notrack comment "!fw4: Notrack rule #2"
 242                 meta l4proto udp counter notrack comment "!fw4: Notrack rule #2"
 243         }
 244
 245         chain notrack_zone3 {
 246                 meta l4proto tcp counter notrack comment "!fw4: Notrack rule #3"
 247                 meta l4proto udp counter notrack comment "!fw4: Notrack rule #3"
 248         }
 249
 250
 251         #
 252         # Mangle rules
 253         #
 254
 255         chain mangle_prerouting {
 256                 type filter hook prerouting priority mangle; policy accept;
 257         }
 258
 259         chain mangle_postrouting {
 260                 type filter hook postrouting priority mangle; policy accept;
 261         }
 262
 263         chain mangle_input {
 264                 type filter hook input priority mangle; policy accept;
 265         }
 266
 267         chain mangle_output {
 268                 type route hook output priority mangle; policy accept;
 269         }
 270
 271         chain mangle_forward {
 272                 type filter hook forward priority mangle; policy accept;
 273         }
 274 }
 275 -- End --