tests/02_zones/02_masq

   1 Testing that zone masquerading is properly mapped to chains.
   2
   3 -- Testcase --
   4 {%
   5         include("./root/usr/share/firewall4/main.uc", {
   6                 getenv: function(varname) {
   7                         switch (varname) {
   8                         case 'ACTION':
   9                                 return 'print';
  10                         }
  11                 }
  12         })
  13 %}
  14 -- End --
  15
  16 -- File uci/helpers.json --
  17 {}
  18 -- End --
  19
  20 -- File fs/open~_sys_class_net_zone1_flags.txt --
  21 0x1103
  22 -- End --
  23
  24 -- File fs/open~_sys_class_net_zone2_flags.txt --
  25 0x1103
  26 -- End --
  27
  28 -- File fs/open~_sys_class_net_zone3_flags.txt --
  29 0x1103
  30 -- End --
  31
  32 -- File uci/firewall.json --
  33 {
  34         "zone": [
  35                 {
  36                         ".description": "Setting masq to true should emit an IPv4 masquerading rule and inhibit default helper assignment",
  37                         "name": "test1",
  38                         "input": "ACCEPT",
  39                         "output": "ACCEPT",
  40                         "forward": "ACCEPT",
  41                         "device": "zone1",
  42                         "masq": "1"
  43                 },
  44                 {
  45                         ".description": "Setting masq6 to true should emit an IPv6 masquerading rule and inhibit default helper assignment",
  46                         "name": "test2",
  47                         "input": "DROP",
  48                         "output": "DROP",
  49                         "forward": "DROP",
  50                         "device": "zone2",
  51                         "masq6": "1"
  52                 },
  53                 {
  54                         ".description": "Setting both masq and masq6 should emit IPv4 and IPv6 masquerading and inhibit default helper assignment",
  55                         "name": "test3",
  56                         "input": "REJECT",
  57                         "output": "REJECT",
  58                         "forward": "REJECT",
  59                         "device": "zone3",
  60                         "masq": "1",
  61                         "masq6": "1"
  62                 }
  63         ]
  64 }
  65 -- End --
  66
  67 -- Expect stdout --
  68 table inet fw4
  69 flush table inet fw4
  70
  71 table inet fw4 {
  72         #
  73         # Set definitions
  74         #
  75
  76
  77         #
  78         # Defines
  79         #
  80
  81         define test1_devices = { "zone1" }
  82         define test2_devices = { "zone2" }
  83         define test3_devices = { "zone3" }
  84
  85         #
  86         # User includes
  87         #
  88
  89         include "/etc/nftables.d/*.nft"
  90
  91
  92         #
  93         # Filter rules
  94         #
  95
  96         chain input {
  97                 type filter hook input priority filter; policy drop;
  98
  99                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
 100
 101                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
 102                 iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
 103                 iifname "zone2" jump input_test2 comment "!fw4: Handle test2 IPv4/IPv6 input traffic"
 104                 iifname "zone3" jump input_test3 comment "!fw4: Handle test3 IPv4/IPv6 input traffic"
 105         }
 106
 107         chain forward {
 108                 type filter hook forward priority filter; policy drop;
 109
 110                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
 111                 iifname "zone1" jump forward_test1 comment "!fw4: Handle test1 IPv4/IPv6 forward traffic"
 112                 iifname "zone2" jump forward_test2 comment "!fw4: Handle test2 IPv4/IPv6 forward traffic"
 113                 iifname "zone3" jump forward_test3 comment "!fw4: Handle test3 IPv4/IPv6 forward traffic"
 114         }
 115
 116         chain output {
 117                 type filter hook output priority filter; policy drop;
 118
 119                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 120
 121                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
 122                 oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
 123                 oifname "zone2" jump output_test2 comment "!fw4: Handle test2 IPv4/IPv6 output traffic"
 124                 oifname "zone3" jump output_test3 comment "!fw4: Handle test3 IPv4/IPv6 output traffic"
 125         }
 126
 127         chain prerouting {
 128                 type filter hook prerouting priority filter; policy accept;
 129         }
 130
 131         chain handle_reject {
 132                 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
 133                 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
 134         }
 135
 136         chain input_test1 {
 137                 jump accept_from_test1
 138         }
 139
 140         chain output_test1 {
 141                 jump accept_to_test1
 142         }
 143
 144         chain forward_test1 {
 145                 jump accept_to_test1
 146         }
 147
 148         chain accept_from_test1 {
 149                 iifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
 150         }
 151
 152         chain accept_to_test1 {
 153                 oifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
 154         }
 155
 156         chain input_test2 {
 157                 jump drop_from_test2
 158         }
 159
 160         chain output_test2 {
 161                 jump drop_to_test2
 162         }
 163
 164         chain forward_test2 {
 165                 jump drop_to_test2
 166         }
 167
 168         chain drop_from_test2 {
 169                 iifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
 170         }
 171
 172         chain drop_to_test2 {
 173                 oifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
 174         }
 175
 176         chain input_test3 {
 177                 jump reject_from_test3
 178         }
 179
 180         chain output_test3 {
 181                 jump reject_to_test3
 182         }
 183
 184         chain forward_test3 {
 185                 jump reject_to_test3
 186         }
 187
 188         chain reject_from_test3 {
 189                 iifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
 190         }
 191
 192         chain reject_to_test3 {
 193                 oifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
 194         }
 195
 196
 197         #
 198         # NAT rules
 199         #
 200
 201         chain dstnat {
 202                 type nat hook prerouting priority dstnat; policy accept;
 203         }
 204
 205         chain srcnat {
 206                 type nat hook postrouting priority srcnat; policy accept;
 207                 oifname "zone1" jump srcnat_test1 comment "!fw4: Handle test1 IPv4/IPv6 srcnat traffic"
 208                 oifname "zone2" jump srcnat_test2 comment "!fw4: Handle test2 IPv4/IPv6 srcnat traffic"
 209                 oifname "zone3" jump srcnat_test3 comment "!fw4: Handle test3 IPv4/IPv6 srcnat traffic"
 210         }
 211
 212         chain srcnat_test1 {
 213                 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 test1 traffic"
 214         }
 215
 216         chain srcnat_test2 {
 217                 meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 test2 traffic"
 218         }
 219
 220         chain srcnat_test3 {
 221                 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 test3 traffic"
 222                 meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 test3 traffic"
 223         }
 224
 225
 226         #
 227         # Raw rules (notrack)
 228         #
 229
 230         chain raw_prerouting {
 231                 type filter hook prerouting priority raw; policy accept;
 232         }
 233
 234         chain raw_output {
 235                 type filter hook output priority raw; policy accept;
 236         }
 237
 238
 239         #
 240         # Mangle rules
 241         #
 242
 243         chain mangle_prerouting {
 244                 type filter hook prerouting priority mangle; policy accept;
 245         }
 246
 247         chain mangle_postrouting {
 248                 type filter hook postrouting priority mangle; policy accept;
 249         }
 250
 251         chain mangle_input {
 252                 type filter hook input priority mangle; policy accept;
 253         }
 254
 255         chain mangle_output {
 256                 type route hook output priority mangle; policy accept;
 257         }
 258
 259         chain mangle_forward {
 260                 type filter hook forward priority mangle; policy accept;
 261         }
 262 }
 263 -- End --