tests/02_zones/06_family_selections

   1 Test that the zone family is honoured regardless of whether subnets are
   2 specified or not.
   3
   4 -- Testcase --
   5 {%
   6         include("./root/usr/share/firewall4/main.uc", {
   7                 getenv: function(varname) {
   8                         switch (varname) {
   9                         case 'ACTION':
  10                                 return 'print';
  11                         }
  12                 }
  13         })
  14 %}
  15 -- End --
  16
  17 -- File uci/helpers.json --
  18 {}
  19 -- End --
  20
  21 -- File uci/firewall.json --
  22 {
  23         "zone": [
  24                 {
  25                         ".description": "Family any with IPv4 subnet should emit only IPv4 rules",
  26                         "name": "test1",
  27                         "family": "any",
  28                         "subnet": [ "10.0.0.0/8" ],
  29                         "auto_helper": 0
  30                 },
  31
  32                 {
  33                         ".description": "Family any with IPv6 subnet should emit only IPv6 rules",
  34                         "name": "test2",
  35                         "family": "any",
  36                         "subnet": [ "2001:db8:1234::1/64" ],
  37                         "auto_helper": 0
  38                 },
  39
  40                 {
  41                         ".description": "Family IPv6 with IPv6 subnet should emit only IPv6 rules",
  42                         "name": "test3",
  43                         "family": "ipv6",
  44                         "subnet": [ "2001:db8:1234::1/64" ],
  45                         "auto_helper": 0
  46                 },
  47
  48                 {
  49                         ".description": "Family IPv6 with IPv4 subnet should emit no rules",
  50                         "name": "test4",
  51                         "family": "ipv6",
  52                         "subnet": [ "2001:db8:1234::1/64" ],
  53                         "auto_helper": 0
  54                 },
  55
  56                 {
  57                         ".description": "Family IPv6 with no subnets should emit only IPv6 rules",
  58                         "name": "test5",
  59                         "family": "ipv6",
  60                         "device": [ "eth0" ],
  61                         "auto_helper": 0
  62                 }
  63         ]
  64 }
  65 -- End --
  66
  67 -- Expect stdout --
  68 table inet fw4
  69 flush table inet fw4
  70
  71 table inet fw4 {
  72         #
  73         # Defines
  74         #
  75
  76         define test1_devices = {  }
  77         define test1_subnets = { 10.0.0.0/8 }
  78
  79         define test2_devices = {  }
  80         define test2_subnets = { 2001:db8:1234::/64 }
  81
  82         define test3_devices = {  }
  83         define test3_subnets = { 2001:db8:1234::/64 }
  84
  85         define test4_devices = {  }
  86         define test4_subnets = { 2001:db8:1234::/64 }
  87
  88         define test5_devices = { "eth0" }
  89         define test5_subnets = {  }
  90
  91
  92         #
  93         # User includes
  94         #
  95
  96         include "/etc/nftables.d/*.nft"
  97
  98
  99         #
 100         # Filter rules
 101         #
 102
 103         chain input {
 104                 type filter hook input priority filter; policy drop;
 105
 106                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
 107
 108                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
 109                 meta nfproto ipv4 ip saddr 10.0.0.0/8 jump input_test1 comment "!fw4: Handle test1 IPv4 input traffic"
 110                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 jump input_test2 comment "!fw4: Handle test2 IPv6 input traffic"
 111                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 jump input_test3 comment "!fw4: Handle test3 IPv6 input traffic"
 112                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 jump input_test4 comment "!fw4: Handle test4 IPv6 input traffic"
 113                 meta nfproto ipv6 iifname "eth0" jump input_test5 comment "!fw4: Handle test5 IPv6 input traffic"
 114         }
 115
 116         chain forward {
 117                 type filter hook forward priority filter; policy drop;
 118
 119                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
 120                 meta nfproto ipv4 ip saddr 10.0.0.0/8 jump forward_test1 comment "!fw4: Handle test1 IPv4 forward traffic"
 121                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 jump forward_test2 comment "!fw4: Handle test2 IPv6 forward traffic"
 122                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 jump forward_test3 comment "!fw4: Handle test3 IPv6 forward traffic"
 123                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 jump forward_test4 comment "!fw4: Handle test4 IPv6 forward traffic"
 124                 meta nfproto ipv6 iifname "eth0" jump forward_test5 comment "!fw4: Handle test5 IPv6 forward traffic"
 125         }
 126
 127         chain output {
 128                 type filter hook output priority filter; policy drop;
 129
 130                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 131
 132                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
 133                 meta nfproto ipv4 ip daddr 10.0.0.0/8 jump output_test1 comment "!fw4: Handle test1 IPv4 output traffic"
 134                 meta nfproto ipv6 ip6 daddr 2001:db8:1234::/64 jump output_test2 comment "!fw4: Handle test2 IPv6 output traffic"
 135                 meta nfproto ipv6 ip6 daddr 2001:db8:1234::/64 jump output_test3 comment "!fw4: Handle test3 IPv6 output traffic"
 136                 meta nfproto ipv6 ip6 daddr 2001:db8:1234::/64 jump output_test4 comment "!fw4: Handle test4 IPv6 output traffic"
 137                 meta nfproto ipv6 oifname "eth0" jump output_test5 comment "!fw4: Handle test5 IPv6 output traffic"
 138         }
 139
 140         chain prerouting {
 141                 type filter hook prerouting priority filter; policy accept;
 142         }
 143
 144         chain handle_reject {
 145                 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
 146                 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
 147         }
 148
 149         chain input_test1 {
 150                 jump drop_from_test1
 151         }
 152
 153         chain output_test1 {
 154                 jump drop_to_test1
 155         }
 156
 157         chain forward_test1 {
 158                 jump drop_to_test1
 159         }
 160
 161         chain drop_from_test1 {
 162                 meta nfproto ipv4 ip saddr 10.0.0.0/8 counter drop comment "!fw4: drop test1 IPv4 traffic"
 163         }
 164
 165         chain drop_to_test1 {
 166                 meta nfproto ipv4 ip daddr 10.0.0.0/8 counter drop comment "!fw4: drop test1 IPv4 traffic"
 167         }
 168
 169         chain input_test2 {
 170                 jump drop_from_test2
 171         }
 172
 173         chain output_test2 {
 174                 jump drop_to_test2
 175         }
 176
 177         chain forward_test2 {
 178                 jump drop_to_test2
 179         }
 180
 181         chain drop_from_test2 {
 182                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 counter drop comment "!fw4: drop test2 IPv6 traffic"
 183         }
 184
 185         chain drop_to_test2 {
 186                 meta nfproto ipv6 ip6 daddr 2001:db8:1234::/64 counter drop comment "!fw4: drop test2 IPv6 traffic"
 187         }
 188
 189         chain input_test3 {
 190                 jump drop_from_test3
 191         }
 192
 193         chain output_test3 {
 194                 jump drop_to_test3
 195         }
 196
 197         chain forward_test3 {
 198                 jump drop_to_test3
 199         }
 200
 201         chain drop_from_test3 {
 202                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 counter drop comment "!fw4: drop test3 IPv6 traffic"
 203         }
 204
 205         chain drop_to_test3 {
 206                 meta nfproto ipv6 ip6 daddr 2001:db8:1234::/64 counter drop comment "!fw4: drop test3 IPv6 traffic"
 207         }
 208
 209         chain input_test4 {
 210                 jump drop_from_test4
 211         }
 212
 213         chain output_test4 {
 214                 jump drop_to_test4
 215         }
 216
 217         chain forward_test4 {
 218                 jump drop_to_test4
 219         }
 220
 221         chain drop_from_test4 {
 222                 meta nfproto ipv6 ip6 saddr 2001:db8:1234::/64 counter drop comment "!fw4: drop test4 IPv6 traffic"
 223         }
 224
 225         chain drop_to_test4 {
 226                 meta nfproto ipv6 ip6 daddr 2001:db8:1234::/64 counter drop comment "!fw4: drop test4 IPv6 traffic"
 227         }
 228
 229         chain input_test5 {
 230                 jump drop_from_test5
 231         }
 232
 233         chain output_test5 {
 234                 jump drop_to_test5
 235         }
 236
 237         chain forward_test5 {
 238                 jump drop_to_test5
 239         }
 240
 241         chain drop_from_test5 {
 242                 meta nfproto ipv6 iifname "eth0" counter drop comment "!fw4: drop test5 IPv6 traffic"
 243         }
 244
 245         chain drop_to_test5 {
 246                 meta nfproto ipv6 oifname "eth0" counter drop comment "!fw4: drop test5 IPv6 traffic"
 247         }
 248
 249
 250         #
 251         # NAT rules
 252         #
 253
 254         chain dstnat {
 255                 type nat hook prerouting priority dstnat; policy accept;
 256         }
 257
 258         chain srcnat {
 259                 type nat hook postrouting priority srcnat; policy accept;
 260         }
 261
 262
 263         #
 264         # Raw rules (notrack)
 265         #
 266
 267         chain raw_prerouting {
 268                 type filter hook prerouting priority raw; policy accept;
 269         }
 270
 271         chain raw_output {
 272                 type filter hook output priority raw; policy accept;
 273         }
 274
 275
 276         #
 277         # Mangle rules
 278         #
 279
 280         chain mangle_prerouting {
 281                 type filter hook prerouting priority mangle; policy accept;
 282         }
 283
 284         chain mangle_postrouting {
 285                 type filter hook postrouting priority mangle; policy accept;
 286         }
 287
 288         chain mangle_input {
 289                 type filter hook input priority mangle; policy accept;
 290         }
 291
 292         chain mangle_output {
 293                 type route hook output priority mangle; policy accept;
 294         }
 295
 296         chain mangle_forward {
 297                 type filter hook forward priority mangle; policy accept;
 298         }
 299 }
 300 -- End --