tests/01_configuration/01_ruleset

   1 Testing the ruleset rendered from the default firewall configuration.
   2
   3 -- Testcase --
   4 {%
   5         include("./root/usr/share/firewall4/main.uc", {
   6                 TRACE_CALLS: "stderr",
   7
   8                 getenv: function(varname) {
   9                         switch (varname) {
  10                         case 'ACTION':
  11                                 return 'print';
  12                         }
  13                 }
  14         })
  15 %}
  16 -- End --
  17
  18 -- Expect stdout --
  19 table inet fw4
  20 flush table inet fw4
  21
  22 table inet fw4 {
  23         #
  24         # Flowtable
  25         #
  26
  27         flowtable ft {
  28                 hook ingress priority 0;
  29                 devices = { "eth0", "eth1" };
  30                 counter;
  31                 flags offload;
  32         }
  33
  34
  35         #
  36         # CT helper definitions
  37         #
  38
  39         ct helper amanda {
  40                 type "amanda" protocol udp;
  41         }
  42
  43         ct helper ftp {
  44                 type "ftp" protocol tcp;
  45         }
  46
  47         ct helper RAS {
  48                 type "RAS" protocol udp;
  49         }
  50
  51         ct helper Q.931 {
  52                 type "Q.931" protocol tcp;
  53         }
  54
  55         ct helper irc {
  56                 type "irc" protocol tcp;
  57         }
  58
  59         ct helper netbios-ns {
  60                 type "netbios-ns" protocol udp;
  61         }
  62
  63         ct helper pptp {
  64                 type "pptp" protocol tcp;
  65         }
  66
  67         ct helper sane {
  68                 type "sane" protocol tcp;
  69         }
  70
  71         ct helper sip {
  72                 type "sip" protocol udp;
  73         }
  74
  75         ct helper snmp {
  76                 type "snmp" protocol udp;
  77         }
  78
  79         ct helper tftp {
  80                 type "tftp" protocol udp;
  81         }
  82
  83         ct helper rtsp {
  84                 type "rtsp" protocol tcp;
  85         }
  86
  87
  88         #
  89         # Defines
  90         #
  91
  92         define lan_devices = { "br-lan" }
  93         define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 }
  94
  95         define wan_devices = { "pppoe-wan" }
  96         define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 }
  97
  98
  99         #
 100         # User includes
 101         #
 102
 103         include "/etc/nftables.d/*.nft"
 104
 105
 106         #
 107         # Filter rules
 108         #
 109
 110         chain input {
 111                 type filter hook input priority filter; policy drop;
 112
 113                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
 114
 115                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
 116                 tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
 117                 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
 118                 iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
 119                 jump handle_reject
 120         }
 121
 122         chain forward {
 123                 type filter hook forward priority filter; policy drop;
 124
 125                 meta l4proto { tcp, udp } flow offload @ft;
 126                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
 127                 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
 128                 iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
 129                 jump handle_reject
 130         }
 131
 132         chain output {
 133                 type filter hook output priority filter; policy accept;
 134
 135                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 136
 137                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
 138                 meta l4proto tcp counter comment "!fw4: Test-Deprecated-Rule-Option"
 139                 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
 140                 oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
 141         }
 142
 143         chain prerouting {
 144                 type filter hook prerouting priority filter; policy accept;
 145                 iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
 146         }
 147
 148         chain handle_reject {
 149                 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
 150                 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
 151         }
 152
 153         chain syn_flood {
 154                 limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
 155                 drop comment "!fw4: Drop excess packets"
 156         }
 157
 158         chain input_lan {
 159                 jump accept_from_lan
 160         }
 161
 162         chain output_lan {
 163                 jump accept_to_lan
 164         }
 165
 166         chain forward_lan {
 167                 jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
 168                 jump accept_to_lan
 169         }
 170
 171         chain helper_lan {
 172                 meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
 173                 meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
 174                 meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
 175                 meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
 176                 meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
 177                 meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
 178                 meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
 179                 meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
 180                 meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
 181                 meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
 182                 meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
 183                 meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
 184         }
 185
 186         chain accept_from_lan {
 187                 iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
 188         }
 189
 190         chain accept_to_lan {
 191                 oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
 192         }
 193
 194         chain input_wan {
 195                 meta nfproto ipv4 udp dport 68 counter accept comment "!fw4: Allow-DHCP-Renew"
 196                 meta nfproto ipv4 icmp type 8 counter accept comment "!fw4: Allow-Ping"
 197                 meta nfproto ipv4 meta l4proto igmp counter accept comment "!fw4: Allow-IGMP"
 198                 ip6 saddr fc00::/6 ip6 daddr fc00::/6 udp dport 546 counter accept comment "!fw4: Allow-DHCPv6"
 199                 ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { 130 . 0, 131 . 0, 132 . 0, 143 . 0 } counter accept comment "!fw4: Allow-MLD"
 200                 meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3, 133, 134 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input"
 201                 meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1, 135 . 0, 136 . 0 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input"
 202                 jump reject_from_wan
 203         }
 204
 205         chain output_wan {
 206                 jump accept_to_wan
 207         }
 208
 209         chain forward_wan {
 210                 meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward"
 211                 meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward"
 212                 meta l4proto esp counter jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
 213                 udp dport 500 counter jump accept_to_lan comment "!fw4: Allow-ISAKMP"
 214                 jump reject_to_wan
 215         }
 216
 217         chain accept_to_wan {
 218                 meta nfproto ipv4 oifname "pppoe-wan" ct state invalid counter drop comment "!fw4: Prevent NAT leakage"
 219                 oifname "pppoe-wan" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic"
 220         }
 221
 222         chain reject_from_wan {
 223                 iifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
 224         }
 225
 226         chain reject_to_wan {
 227                 oifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
 228         }
 229
 230
 231         #
 232         # NAT rules
 233         #
 234
 235         chain dstnat {
 236                 type nat hook prerouting priority dstnat; policy accept;
 237         }
 238
 239         chain srcnat {
 240                 type nat hook postrouting priority srcnat; policy accept;
 241                 oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
 242         }
 243
 244         chain srcnat_wan {
 245                 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
 246         }
 247
 248
 249         #
 250         # Raw rules (notrack)
 251         #
 252
 253         chain raw_prerouting {
 254                 type filter hook prerouting priority raw; policy accept;
 255         }
 256
 257         chain raw_output {
 258                 type filter hook output priority raw; policy accept;
 259         }
 260
 261
 262         #
 263         # Mangle rules
 264         #
 265
 266         chain mangle_prerouting {
 267                 type filter hook prerouting priority mangle; policy accept;
 268         }
 269
 270         chain mangle_postrouting {
 271                 type filter hook postrouting priority mangle; policy accept;
 272         }
 273
 274         chain mangle_input {
 275                 type filter hook input priority mangle; policy accept;
 276         }
 277
 278         chain mangle_output {
 279                 type route hook output priority mangle; policy accept;
 280         }
 281
 282         chain mangle_forward {
 283                 type filter hook forward priority mangle; policy accept;
 284                 iifname "pppoe-wan" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
 285                 oifname "pppoe-wan" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
 286         }
 287 }
 288 -- End --
 289
 290 -- Expect stderr --
 291 [call] ctx.call object <network.interface> method <dump> args <null>
 292 [call] ctx.call object <service> method <get_data> args <{ "type": "firewall" }>
 293 [call] fs.open path </proc/version> mode <r>
 294 [call] fs.stat path </sys/module/nf_conntrack_amanda>
 295 [call] fs.stat path </sys/module/nf_conntrack_ftp>
 296 [call] fs.stat path </sys/module/nf_conntrack_h323>
 297 [call] fs.stat path </sys/module/nf_conntrack_h323>
 298 [call] fs.stat path </sys/module/nf_conntrack_irc>
 299 [call] fs.stat path </sys/module/nf_conntrack_netbios_ns>
 300 [call] fs.stat path </sys/module/nf_conntrack_pptp>
 301 [call] fs.stat path </sys/module/nf_conntrack_sane>
 302 [call] fs.stat path </sys/module/nf_conntrack_sip>
 303 [call] fs.stat path </sys/module/nf_conntrack_snmp>
 304 [call] fs.stat path </sys/module/nf_conntrack_tftp>
 305 [call] fs.stat path </sys/module/nf_conntrack_rtsp>
 306 [!] Section @defaults[0] specifies unknown option 'unknown_defaults_option'
 307 [!] Section @rule[9] (Test-Deprecated-Rule-Option) option '_name' is deprecated by fw4
 308 [!] Section @rule[9] (Test-Deprecated-Rule-Option) specifies unknown option 'unknown_rule_option'
 309 [call] fs.glob pattern </usr/share/nftables.d/ruleset-pre/*.nft>
 310 [call] fs.glob pattern </usr/share/nftables.d/ruleset-post/*.nft>
 311 [call] fs.glob pattern </usr/share/nftables.d/table-pre/*.nft>
 312 [call] fs.glob pattern </usr/share/nftables.d/table-post/*.nft>
 313 [call] fs.lsdir path </usr/share/nftables.d/chain-pre>
 314 [call] fs.lsdir path </usr/share/nftables.d/chain-post>
 315 [call] ctx.call object <network.device> method <status> args <null>
 316 [call] fs.opendir path </sys/class/net/br-lan>
 317 [call] fs.opendir path </sys/class/net/eth0>
 318 [call] fs.opendir path </sys/class/net/eth1>
 319 [call] system command </usr/sbin/nft -c '
 320                 add table inet fw4-hw-offload-test;
 321                 add flowtable inet fw4-hw-offload-test ft {
 322                         hook ingress priority 0;
 323                         devices = { "eth0", "eth1" };
 324                         flags offload;
 325                 }
 326         ' 2>/dev/null> timeout <null>
 327 [call] fs.popen cmdline </usr/sbin/nft --terse --json list flowtables inet> mode <r>
 328 [call] fs.readfile path </sys/class/net/br-lan/flags> limit <null>
 329 [call] fs.readfile path </sys/class/net/br-lan/flags> limit <null>
 330 -- End --