tests/04_forwardings/01_family_selections

   1 Test that the zone family is honoured when setting up inter-zone forwarding rules.
   2
   3 -- Testcase --
   4 {%
   5         include("./root/usr/share/firewall4/main.uc", {
   6                 getenv: function(varname) {
   7                         switch (varname) {
   8                         case 'ACTION':
   9                                 return 'print';
  10                         }
  11                 }
  12         })
  13 %}
  14 -- End --
  15
  16 -- File uci/helpers.json --
  17 {}
  18 -- End --
  19
  20 -- File uci/firewall.json --
  21 {
  22         "zone": [
  23                 {
  24                         "name": "wanA",
  25                         "device": [ "eth0" ],
  26                         "auto_helper": 0
  27                 },
  28
  29                 {
  30                         "name": "wanB",
  31                         "device": [ "eth1" ],
  32                         "auto_helper": 0
  33                 },
  34
  35                 {
  36                         "name": "lan",
  37                         "device": [ "eth2" ],
  38                         "auto_helper": 0
  39                 }
  40         ],
  41
  42         "forwarding": [
  43                 {
  44                         ".description": "This should only allow IPv6 forwarding from lan to wanA",
  45                         "src": "lan",
  46                         "dest": "wanA",
  47                         "family": "IPv6"
  48                 },
  49
  50                 {
  51                         ".description": "This should only allow IPv4 forwarding from lan to wanB",
  52                         "src": "lan",
  53                         "dest": "wanB",
  54                         "family": "IPv4"
  55                 }
  56         ]
  57 }
  58 -- End --
  59
  60 -- Expect stdout --
  61 table inet fw4
  62 flush table inet fw4
  63
  64 table inet fw4 {
  65         #
  66         # Set definitions
  67         #
  68
  69
  70         #
  71         # Defines
  72         #
  73
  74         define wanA_devices = { "eth0" }
  75         define wanB_devices = { "eth1" }
  76         define lan_devices = { "eth2" }
  77
  78         #
  79         # User includes
  80         #
  81
  82         include "/etc/nftables.d/*.nft"
  83
  84
  85         #
  86         # Filter rules
  87         #
  88
  89         chain input {
  90                 type filter hook input priority filter; policy drop;
  91
  92                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
  93
  94                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
  95                 iifname "eth0" jump input_wanA comment "!fw4: Handle wanA IPv4/IPv6 input traffic"
  96                 iifname "eth1" jump input_wanB comment "!fw4: Handle wanB IPv4/IPv6 input traffic"
  97                 iifname "eth2" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
  98         }
  99
 100         chain forward {
 101                 type filter hook forward priority filter; policy drop;
 102
 103                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
 104                 iifname "eth0" jump forward_wanA comment "!fw4: Handle wanA IPv4/IPv6 forward traffic"
 105                 iifname "eth1" jump forward_wanB comment "!fw4: Handle wanB IPv4/IPv6 forward traffic"
 106                 iifname "eth2" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
 107         }
 108
 109         chain output {
 110                 type filter hook output priority filter; policy drop;
 111
 112                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 113
 114                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
 115                 oifname "eth0" jump output_wanA comment "!fw4: Handle wanA IPv4/IPv6 output traffic"
 116                 oifname "eth1" jump output_wanB comment "!fw4: Handle wanB IPv4/IPv6 output traffic"
 117                 oifname "eth2" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
 118         }
 119
 120         chain handle_reject {
 121                 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
 122                 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
 123         }
 124
 125         chain input_wanA {
 126                 jump drop_from_wanA
 127         }
 128
 129         chain output_wanA {
 130                 jump drop_to_wanA
 131         }
 132
 133         chain forward_wanA {
 134                 jump drop_to_wanA
 135         }
 136
 137         chain accept_to_wanA {
 138                 oifname "eth0" counter accept comment "!fw4: accept wanA IPv4/IPv6 traffic"
 139         }
 140
 141         chain drop_from_wanA {
 142                 iifname "eth0" counter drop comment "!fw4: drop wanA IPv4/IPv6 traffic"
 143         }
 144
 145         chain drop_to_wanA {
 146                 oifname "eth0" counter drop comment "!fw4: drop wanA IPv4/IPv6 traffic"
 147         }
 148
 149         chain input_wanB {
 150                 jump drop_from_wanB
 151         }
 152
 153         chain output_wanB {
 154                 jump drop_to_wanB
 155         }
 156
 157         chain forward_wanB {
 158                 jump drop_to_wanB
 159         }
 160
 161         chain accept_to_wanB {
 162                 oifname "eth1" counter accept comment "!fw4: accept wanB IPv4/IPv6 traffic"
 163         }
 164
 165         chain drop_from_wanB {
 166                 iifname "eth1" counter drop comment "!fw4: drop wanB IPv4/IPv6 traffic"
 167         }
 168
 169         chain drop_to_wanB {
 170                 oifname "eth1" counter drop comment "!fw4: drop wanB IPv4/IPv6 traffic"
 171         }
 172
 173         chain input_lan {
 174                 jump drop_from_lan
 175         }
 176
 177         chain output_lan {
 178                 jump drop_to_lan
 179         }
 180
 181         chain forward_lan {
 182                 meta nfproto ipv6 jump accept_to_wanA comment "!fw4: Accept lan to wanA IPv6 forwarding"
 183                 meta nfproto ipv4 jump accept_to_wanB comment "!fw4: Accept lan to wanB IPv4 forwarding"
 184                 jump drop_to_lan
 185         }
 186
 187         chain drop_from_lan {
 188                 iifname "eth2" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
 189         }
 190
 191         chain drop_to_lan {
 192                 oifname "eth2" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
 193         }
 194
 195
 196         #
 197         # NAT rules
 198         #
 199
 200         chain dstnat {
 201                 type nat hook prerouting priority dstnat; policy accept;
 202         }
 203
 204         chain srcnat {
 205                 type nat hook postrouting priority srcnat; policy accept;
 206         }
 207
 208
 209         #
 210         # Raw rules (notrack & helper)
 211         #
 212
 213         chain raw_prerouting {
 214                 type filter hook prerouting priority raw; policy accept;
 215         }
 216
 217         chain raw_output {
 218                 type filter hook output priority raw; policy accept;
 219         }
 220
 221
 222         #
 223         # Mangle rules
 224         #
 225
 226         chain mangle_prerouting {
 227                 type filter hook prerouting priority mangle; policy accept;
 228         }
 229
 230         chain mangle_postrouting {
 231                 type filter hook postrouting priority mangle; policy accept;
 232         }
 233
 234         chain mangle_input {
 235                 type filter hook input priority mangle; policy accept;
 236         }
 237
 238         chain mangle_output {
 239                 type route hook output priority mangle; policy accept;
 240         }
 241
 242         chain mangle_forward {
 243                 type filter hook forward priority mangle; policy accept;
 244         }
 245 }
 246 -- End --