tests/02_zones/06_family_selections

   1 Test that the zone family is honoured regardless of whether subnets are
   2 specified or not.
   3
   4 -- Testcase --
   5 {%
   6         include("./root/usr/share/firewall4/main.uc", {
   7                 getenv: function(varname) {
   8                         switch (varname) {
   9                         case 'ACTION':
  10                                 return 'print';
  11                         }
  12                 }
  13         })
  14 %}
  15 -- End --
  16
  17 -- File uci/helpers.json --
  18 {}
  19 -- End --
  20
  21 -- File uci/firewall.json --
  22 {
  23         "zone": [
  24                 {
  25                         ".description": "Family any with IPv4 subnet should emit only IPv4 rules",
  26                         "name": "test1",
  27                         "family": "any",
  28                         "subnet": [ "10.0.0.0/8" ],
  29                         "auto_helper": 0
  30                 },
  31
  32                 {
  33                         ".description": "Family any with IPv6 subnet should emit only IPv6 rules",
  34                         "name": "test2",
  35                         "family": "any",
  36                         "subnet": [ "2001:db8:1234::1/64" ],
  37                         "auto_helper": 0
  38                 },
  39
  40                 {
  41                         ".description": "Family IPv6 with IPv6 subnet should emit only IPv6 rules",
  42                         "name": "test3",
  43                         "family": "ipv6",
  44                         "subnet": [ "2001:db8:1234::1/64" ],
  45                         "auto_helper": 0
  46                 },
  47
  48                 {
  49                         ".description": "Family IPv6 with IPv4 subnet should emit no rules",
  50                         "name": "test4",
  51                         "family": "ipv6",
  52                         "subnet": [ "2001:db8:1234::1/64" ],
  53                         "auto_helper": 0
  54                 },
  55
  56                 {
  57                         ".description": "Family IPv6 with no subnets should emit only IPv6 rules",
  58                         "name": "test5",
  59                         "family": "ipv6",
  60                         "device": [ "eth0" ],
  61                         "auto_helper": 0
  62                 }
  63         ]
  64 }
  65 -- End --
  66
  67 -- Expect stdout --
  68 table inet fw4
  69 flush table inet fw4
  70
  71 table inet fw4 {
  72         #
  73         # Set definitions
  74         #
  75
  76
  77         #
  78         # Defines
  79         #
  80
  81         define test1_subnets = { 10.0.0.0/8 }
  82         define test2_subnets = { 2001:db8:1234::/64 }
  83         define test3_subnets = { 2001:db8:1234::/64 }
  84         define test4_subnets = { 2001:db8:1234::/64 }
  85         define test5_devices = { "eth0" }
  86
  87         #
  88         # User includes
  89         #
  90
  91         include "/etc/nftables.d/*.nft"
  92
  93
  94         #
  95         # Filter rules
  96         #
  97
  98         chain input {
  99                 type filter hook input priority filter; policy drop;
 100
 101                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
 102
 103                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
 104                 meta nfproto ipv4 ip saddr 10.0.0.0/8 jump input_test1 comment "!fw4: Handle test1 IPv4 input traffic"
 105                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 jump input_test2 comment "!fw4: Handle test2 IPv6 input traffic"
 106                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 jump input_test3 comment "!fw4: Handle test3 IPv6 input traffic"
 107                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 jump input_test4 comment "!fw4: Handle test4 IPv6 input traffic"
 108                 meta nfproto ipv6 iifname "eth0" jump input_test5 comment "!fw4: Handle test5 IPv6 input traffic"
 109         }
 110
 111         chain forward {
 112                 type filter hook forward priority filter; policy drop;
 113
 114                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
 115                 meta nfproto ipv4 ip saddr 10.0.0.0/8 jump forward_test1 comment "!fw4: Handle test1 IPv4 forward traffic"
 116                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 jump forward_test2 comment "!fw4: Handle test2 IPv6 forward traffic"
 117                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 jump forward_test3 comment "!fw4: Handle test3 IPv6 forward traffic"
 118                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 jump forward_test4 comment "!fw4: Handle test4 IPv6 forward traffic"
 119                 meta nfproto ipv6 iifname "eth0" jump forward_test5 comment "!fw4: Handle test5 IPv6 forward traffic"
 120         }
 121
 122         chain output {
 123                 type filter hook output priority filter; policy drop;
 124
 125                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 126
 127                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
 128                 meta nfproto ipv4 ip daddr 10.0.0.0/8 jump output_test1 comment "!fw4: Handle test1 IPv4 output traffic"
 129                 meta nfproto ipv6 ip6 daddr 2001:db8:1234::/64 jump output_test2 comment "!fw4: Handle test2 IPv6 output traffic"
 130                 meta nfproto ipv6 ip6 daddr 2001:db8:1234::/64 jump output_test3 comment "!fw4: Handle test3 IPv6 output traffic"
 131                 meta nfproto ipv6 ip6 daddr 2001:db8:1234::/64 jump output_test4 comment "!fw4: Handle test4 IPv6 output traffic"
 132                 meta nfproto ipv6 oifname "eth0" jump output_test5 comment "!fw4: Handle test5 IPv6 output traffic"
 133         }
 134
 135         chain prerouting {
 136                 type filter hook prerouting priority filter; policy accept;
 137         }
 138
 139         chain handle_reject {
 140                 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
 141                 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
 142         }
 143
 144         chain input_test1 {
 145                 jump drop_from_test1
 146         }
 147
 148         chain output_test1 {
 149                 jump drop_to_test1
 150         }
 151
 152         chain forward_test1 {
 153                 jump drop_to_test1
 154         }
 155
 156         chain drop_from_test1 {
 157                 meta nfproto ipv4 ip saddr 10.0.0.0/8 counter drop comment "!fw4: drop test1 IPv4 traffic"
 158         }
 159
 160         chain drop_to_test1 {
 161                 meta nfproto ipv4 ip daddr 10.0.0.0/8 counter drop comment "!fw4: drop test1 IPv4 traffic"
 162         }
 163
 164         chain input_test2 {
 165                 jump drop_from_test2
 166         }
 167
 168         chain output_test2 {
 169                 jump drop_to_test2
 170         }
 171
 172         chain forward_test2 {
 173                 jump drop_to_test2
 174         }
 175
 176         chain drop_from_test2 {
 177                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 counter drop comment "!fw4: drop test2 IPv6 traffic"
 178         }
 179
 180         chain drop_to_test2 {
 181                 meta nfproto ipv6 ip6 daddr 2001:db8:1234::/64 counter drop comment "!fw4: drop test2 IPv6 traffic"
 182         }
 183
 184         chain input_test3 {
 185                 jump drop_from_test3
 186         }
 187
 188         chain output_test3 {
 189                 jump drop_to_test3
 190         }
 191
 192         chain forward_test3 {
 193                 jump drop_to_test3
 194         }
 195
 196         chain drop_from_test3 {
 197                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 counter drop comment "!fw4: drop test3 IPv6 traffic"
 198         }
 199
 200         chain drop_to_test3 {
 201                 meta nfproto ipv6 ip6 daddr 2001:db8:1234::/64 counter drop comment "!fw4: drop test3 IPv6 traffic"
 202         }
 203
 204         chain input_test4 {
 205                 jump drop_from_test4
 206         }
 207
 208         chain output_test4 {
 209                 jump drop_to_test4
 210         }
 211
 212         chain forward_test4 {
 213                 jump drop_to_test4
 214         }
 215
 216         chain drop_from_test4 {
 217                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 counter drop comment "!fw4: drop test4 IPv6 traffic"
 218         }
 219
 220         chain drop_to_test4 {
 221                 meta nfproto ipv6 ip6 daddr 2001:db8:1234::/64 counter drop comment "!fw4: drop test4 IPv6 traffic"
 222         }
 223
 224         chain input_test5 {
 225                 jump drop_from_test5
 226         }
 227
 228         chain output_test5 {
 229                 jump drop_to_test5
 230         }
 231
 232         chain forward_test5 {
 233                 jump drop_to_test5
 234         }
 235
 236         chain drop_from_test5 {
 237                 meta nfproto ipv6 iifname "eth0" counter drop comment "!fw4: drop test5 IPv6 traffic"
 238         }
 239
 240         chain drop_to_test5 {
 241                 meta nfproto ipv6 oifname "eth0" counter drop comment "!fw4: drop test5 IPv6 traffic"
 242         }
 243
 244
 245         #
 246         # NAT rules
 247         #
 248
 249         chain dstnat {
 250                 type nat hook prerouting priority dstnat; policy accept;
 251         }
 252
 253         chain srcnat {
 254                 type nat hook postrouting priority srcnat; policy accept;
 255         }
 256
 257
 258         #
 259         # Raw rules (notrack)
 260         #
 261
 262         chain raw_prerouting {
 263                 type filter hook prerouting priority raw; policy accept;
 264         }
 265
 266         chain raw_output {
 267                 type filter hook output priority raw; policy accept;
 268         }
 269
 270
 271         #
 272         # Mangle rules
 273         #
 274
 275         chain mangle_prerouting {
 276                 type filter hook prerouting priority mangle; policy accept;
 277         }
 278
 279         chain mangle_postrouting {
 280                 type filter hook postrouting priority mangle; policy accept;
 281         }
 282
 283         chain mangle_input {
 284                 type filter hook input priority mangle; policy accept;
 285         }
 286
 287         chain mangle_output {
 288                 type route hook output priority mangle; policy accept;
 289         }
 290
 291         chain mangle_forward {
 292                 type filter hook forward priority mangle; policy accept;
 293         }
 294 }
 295 -- End --