tests/02_zones/01_policies

   1 Testing that zone policies are properly mapped to chains.
   2
   3 -- Testcase --
   4 {%
   5         include("./root/usr/share/firewall4/main.uc", {
   6                 getenv: function(varname) {
   7                         switch (varname) {
   8                         case 'ACTION':
   9                                 return 'print';
  10                         }
  11                 }
  12         })
  13 %}
  14 -- End --
  15
  16 -- File uci/helpers.json --
  17 {}
  18 -- End --
  19
  20 -- File fs/open~_sys_class_net_zone1_flags.txt --
  21 0x1103
  22 -- End --
  23
  24 -- File fs/open~_sys_class_net_zone2_flags.txt --
  25 0x1103
  26 -- End --
  27
  28 -- File fs/open~_sys_class_net_zone3_flags.txt --
  29 0x1103
  30 -- End --
  31
  32 -- File uci/firewall.json --
  33 {
  34         "zone": [
  35                 {
  36                         ".description": "Zone accept policies should map to accept rules from/to covered interfaces",
  37                         "name": "test1",
  38                         "input": "ACCEPT",
  39                         "output": "ACCEPT",
  40                         "forward": "ACCEPT",
  41                         "device": "zone1"
  42                 },
  43                 {
  44                         ".description": "Zone drop policies should map to drop rules from/to covered interfaces",
  45                         "name": "test2",
  46                         "input": "DROP",
  47                         "output": "DROP",
  48                         "forward": "DROP",
  49                         "device": "zone2"
  50                 },
  51                 {
  52                         ".description": "Zone reject policies should map to reject rules from/to covered interfaces",
  53                         "name": "test3",
  54                         "input": "REJECT",
  55                         "output": "REJECT",
  56                         "forward": "REJECT",
  57                         "device": "zone3"
  58                 }
  59         ]
  60 }
  61 -- End --
  62
  63 -- Expect stdout --
  64 table inet fw4
  65 flush table inet fw4
  66
  67 table inet fw4 {
  68         #
  69         # Set definitions
  70         #
  71
  72
  73         #
  74         # Defines
  75         #
  76
  77         define test1_devices = { "zone1" }
  78         define test2_devices = { "zone2" }
  79         define test3_devices = { "zone3" }
  80
  81         #
  82         # User includes
  83         #
  84
  85         include "/etc/nftables.d/*.nft"
  86
  87
  88         #
  89         # Filter rules
  90         #
  91
  92         chain input {
  93                 type filter hook input priority filter; policy drop;
  94
  95                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
  96
  97                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
  98                 iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
  99                 iifname "zone2" jump input_test2 comment "!fw4: Handle test2 IPv4/IPv6 input traffic"
 100                 iifname "zone3" jump input_test3 comment "!fw4: Handle test3 IPv4/IPv6 input traffic"
 101         }
 102
 103         chain forward {
 104                 type filter hook forward priority filter; policy drop;
 105
 106                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
 107                 iifname "zone1" jump forward_test1 comment "!fw4: Handle test1 IPv4/IPv6 forward traffic"
 108                 iifname "zone2" jump forward_test2 comment "!fw4: Handle test2 IPv4/IPv6 forward traffic"
 109                 iifname "zone3" jump forward_test3 comment "!fw4: Handle test3 IPv4/IPv6 forward traffic"
 110         }
 111
 112         chain output {
 113                 type filter hook output priority filter; policy drop;
 114
 115                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 116
 117                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
 118                 oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
 119                 oifname "zone2" jump output_test2 comment "!fw4: Handle test2 IPv4/IPv6 output traffic"
 120                 oifname "zone3" jump output_test3 comment "!fw4: Handle test3 IPv4/IPv6 output traffic"
 121         }
 122
 123         chain handle_reject {
 124                 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
 125                 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
 126         }
 127
 128         chain input_test1 {
 129                 jump accept_from_test1
 130         }
 131
 132         chain output_test1 {
 133                 jump accept_to_test1
 134         }
 135
 136         chain forward_test1 {
 137                 jump accept_to_test1
 138         }
 139
 140         chain accept_from_test1 {
 141                 iifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
 142         }
 143
 144         chain accept_to_test1 {
 145                 oifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
 146         }
 147
 148         chain input_test2 {
 149                 jump drop_from_test2
 150         }
 151
 152         chain output_test2 {
 153                 jump drop_to_test2
 154         }
 155
 156         chain forward_test2 {
 157                 jump drop_to_test2
 158         }
 159
 160         chain drop_from_test2 {
 161                 iifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
 162         }
 163
 164         chain drop_to_test2 {
 165                 oifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
 166         }
 167
 168         chain input_test3 {
 169                 jump reject_from_test3
 170         }
 171
 172         chain output_test3 {
 173                 jump reject_to_test3
 174         }
 175
 176         chain forward_test3 {
 177                 jump reject_to_test3
 178         }
 179
 180         chain reject_from_test3 {
 181                 iifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
 182         }
 183
 184         chain reject_to_test3 {
 185                 oifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
 186         }
 187
 188
 189         #
 190         # NAT rules
 191         #
 192
 193         chain dstnat {
 194                 type nat hook prerouting priority dstnat; policy accept;
 195         }
 196
 197         chain srcnat {
 198                 type nat hook postrouting priority srcnat; policy accept;
 199         }
 200
 201
 202         #
 203         # Raw rules (notrack & helper)
 204         #
 205
 206         chain raw_prerouting {
 207                 type filter hook prerouting priority raw; policy accept;
 208                 iifname "zone1" jump helper_test1 comment "!fw4: test1 IPv4/IPv6 CT helper assignment"
 209                 iifname "zone2" jump helper_test2 comment "!fw4: test2 IPv4/IPv6 CT helper assignment"
 210                 iifname "zone3" jump helper_test3 comment "!fw4: test3 IPv4/IPv6 CT helper assignment"
 211         }
 212
 213         chain raw_output {
 214                 type filter hook output priority raw; policy accept;
 215         }
 216
 217         chain helper_test1 {
 218         }
 219
 220         chain helper_test2 {
 221         }
 222
 223         chain helper_test3 {
 224         }
 225
 226
 227         #
 228         # Mangle rules
 229         #
 230
 231         chain mangle_prerouting {
 232                 type filter hook prerouting priority mangle; policy accept;
 233         }
 234
 235         chain mangle_postrouting {
 236                 type filter hook postrouting priority mangle; policy accept;
 237         }
 238
 239         chain mangle_input {
 240                 type filter hook input priority mangle; policy accept;
 241         }
 242
 243         chain mangle_output {
 244                 type route hook output priority mangle; policy accept;
 245         }
 246
 247         chain mangle_forward {
 248                 type filter hook forward priority mangle; policy accept;
 249         }
 250 }
 251 -- End --