tests/02_zones/02_masq

   1 Testing that zone masquerading is properly mapped to chains.
   2
   3 -- Testcase --
   4 {%
   5         include("./root/usr/share/firewall4/main.uc", {
   6                 getenv: function(varname) {
   7                         switch (varname) {
   8                         case 'ACTION':
   9                                 return 'print';
  10                         }
  11                 }
  12         })
  13 %}
  14 -- End --
  15
  16 -- File uci/helpers.json --
  17 {}
  18 -- End --
  19
  20 -- File fs/open~_sys_class_net_zone1_flags.txt --
  21 0x1103
  22 -- End --
  23
  24 -- File fs/open~_sys_class_net_zone2_flags.txt --
  25 0x1103
  26 -- End --
  27
  28 -- File fs/open~_sys_class_net_zone3_flags.txt --
  29 0x1103
  30 -- End --
  31
  32 -- File uci/firewall.json --
  33 {
  34         "zone": [
  35                 {
  36                         ".description": "Setting masq to true should emit an IPv4 masquerading rule and inhibit default helper assignment",
  37                         "name": "test1",
  38                         "input": "ACCEPT",
  39                         "output": "ACCEPT",
  40                         "forward": "ACCEPT",
  41                         "device": "zone1",
  42                         "masq": "1"
  43                 },
  44                 {
  45                         ".description": "Setting masq6 to true should emit an IPv6 masquerading rule and inhibit default helper assignment",
  46                         "name": "test2",
  47                         "input": "DROP",
  48                         "output": "DROP",
  49                         "forward": "DROP",
  50                         "device": "zone2",
  51                         "masq6": "1"
  52                 },
  53                 {
  54                         ".description": "Setting both masq and masq6 should emit IPv4 and IPv6 masquerading and inhibit default helper assignment",
  55                         "name": "test3",
  56                         "input": "REJECT",
  57                         "output": "REJECT",
  58                         "forward": "REJECT",
  59                         "device": "zone3",
  60                         "masq": "1",
  61                         "masq6": "1"
  62                 }
  63         ]
  64 }
  65 -- End --
  66
  67 -- Expect stdout --
  68 table inet fw4
  69 flush table inet fw4
  70
  71 table inet fw4 {
  72         #
  73         # Defines
  74         #
  75
  76         define test1_devices = { "zone1" }
  77         define test1_subnets = {  }
  78
  79         define test2_devices = { "zone2" }
  80         define test2_subnets = {  }
  81
  82         define test3_devices = { "zone3" }
  83         define test3_subnets = {  }
  84
  85
  86         #
  87         # User includes
  88         #
  89
  90         include "/etc/nftables.d/*.nft"
  91
  92
  93         #
  94         # Filter rules
  95         #
  96
  97         chain input {
  98                 type filter hook input priority filter; policy drop;
  99
 100                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
 101
 102                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
 103                 iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
 104                 iifname "zone2" jump input_test2 comment "!fw4: Handle test2 IPv4/IPv6 input traffic"
 105                 iifname "zone3" jump input_test3 comment "!fw4: Handle test3 IPv4/IPv6 input traffic"
 106         }
 107
 108         chain forward {
 109                 type filter hook forward priority filter; policy drop;
 110
 111                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
 112                 iifname "zone1" jump forward_test1 comment "!fw4: Handle test1 IPv4/IPv6 forward traffic"
 113                 iifname "zone2" jump forward_test2 comment "!fw4: Handle test2 IPv4/IPv6 forward traffic"
 114                 iifname "zone3" jump forward_test3 comment "!fw4: Handle test3 IPv4/IPv6 forward traffic"
 115         }
 116
 117         chain output {
 118                 type filter hook output priority filter; policy drop;
 119
 120                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 121
 122                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
 123                 oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
 124                 oifname "zone2" jump output_test2 comment "!fw4: Handle test2 IPv4/IPv6 output traffic"
 125                 oifname "zone3" jump output_test3 comment "!fw4: Handle test3 IPv4/IPv6 output traffic"
 126         }
 127
 128         chain prerouting {
 129                 type filter hook prerouting priority filter; policy accept;
 130         }
 131
 132         chain handle_reject {
 133                 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
 134                 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
 135         }
 136
 137         chain input_test1 {
 138                 jump accept_from_test1
 139         }
 140
 141         chain output_test1 {
 142                 jump accept_to_test1
 143         }
 144
 145         chain forward_test1 {
 146                 jump accept_to_test1
 147         }
 148
 149         chain accept_from_test1 {
 150                 iifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
 151         }
 152
 153         chain accept_to_test1 {
 154                 oifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
 155         }
 156
 157         chain input_test2 {
 158                 jump drop_from_test2
 159         }
 160
 161         chain output_test2 {
 162                 jump drop_to_test2
 163         }
 164
 165         chain forward_test2 {
 166                 jump drop_to_test2
 167         }
 168
 169         chain drop_from_test2 {
 170                 iifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
 171         }
 172
 173         chain drop_to_test2 {
 174                 oifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
 175         }
 176
 177         chain input_test3 {
 178                 jump reject_from_test3
 179         }
 180
 181         chain output_test3 {
 182                 jump reject_to_test3
 183         }
 184
 185         chain forward_test3 {
 186                 jump reject_to_test3
 187         }
 188
 189         chain reject_from_test3 {
 190                 iifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
 191         }
 192
 193         chain reject_to_test3 {
 194                 oifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
 195         }
 196
 197
 198         #
 199         # NAT rules
 200         #
 201
 202         chain dstnat {
 203                 type nat hook prerouting priority dstnat; policy accept;
 204         }
 205
 206         chain srcnat {
 207                 type nat hook postrouting priority srcnat; policy accept;
 208                 oifname "zone1" jump srcnat_test1 comment "!fw4: Handle test1 IPv4/IPv6 srcnat traffic"
 209                 oifname "zone2" jump srcnat_test2 comment "!fw4: Handle test2 IPv4/IPv6 srcnat traffic"
 210                 oifname "zone3" jump srcnat_test3 comment "!fw4: Handle test3 IPv4/IPv6 srcnat traffic"
 211         }
 212
 213         chain srcnat_test1 {
 214                 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 test1 traffic"
 215         }
 216
 217         chain srcnat_test2 {
 218                 meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 test2 traffic"
 219         }
 220
 221         chain srcnat_test3 {
 222                 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 test3 traffic"
 223                 meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 test3 traffic"
 224         }
 225
 226
 227         #
 228         # Raw rules (notrack)
 229         #
 230
 231         chain raw_prerouting {
 232                 type filter hook prerouting priority raw; policy accept;
 233         }
 234
 235         chain raw_output {
 236                 type filter hook output priority raw; policy accept;
 237         }
 238
 239
 240         #
 241         # Mangle rules
 242         #
 243
 244         chain mangle_prerouting {
 245                 type filter hook prerouting priority mangle; policy accept;
 246         }
 247
 248         chain mangle_postrouting {
 249                 type filter hook postrouting priority mangle; policy accept;
 250         }
 251
 252         chain mangle_input {
 253                 type filter hook input priority mangle; policy accept;
 254         }
 255
 256         chain mangle_output {
 257                 type route hook output priority mangle; policy accept;
 258         }
 259
 260         chain mangle_forward {
 261                 type filter hook forward priority mangle; policy accept;
 262         }
 263 }
 264 -- End --