tests/02_zones/07_helpers

   1 Testing zone helper assignments
   2
   3 -- Testcase --
   4 {%
   5         include("./root/usr/share/firewall4/main.uc", {
   6                 getenv: function(varname) {
   7                         switch (varname) {
   8                         case 'ACTION':
   9                                 return 'print';
  10                         }
  11                 }
  12         })
  13 %}
  14 -- End --
  15
  16 -- File fs/open~_sys_class_net_zone1_flags.txt --
  17 0x1103
  18 -- End --
  19
  20 -- File fs/open~_sys_class_net_zone2_flags.txt --
  21 0x1103
  22 -- End --
  23
  24 -- File fs/open~_sys_class_net_zone3_flags.txt --
  25 0x1103
  26 -- End --
  27
  28 -- File fs/open~_sys_class_net_zone4_flags.txt --
  29 0x1103
  30 -- End --
  31
  32 -- File fs/open~_sys_class_net_zone5_flags.txt --
  33 0x1103
  34 -- End --
  35
  36 -- File uci/firewall.json --
  37 {
  38         "zone": [
  39                 {
  40                         ".description": "Setting masq to true for a zone with a helper should emit a helper chain for the zone with the configured helper",
  41                         "name": "test1",
  42                         "device": "zone1",
  43                         "masq": "1",
  44                         "helper": [ "tftp" ]
  45                 },
  46                 {
  47                         ".description": "Setting masq6 to true for a zone with a helper should emit a helper chain for the zone with the configured helper",
  48                         "name": "test2",
  49                         "device": "zone2",
  50                         "masq6": "1",
  51                         "helper": [ "tftp" ]
  52                 },
  53                 {
  54                         ".description": "Disabling both masq and masq6 for a zone with a helper should emit a helper chain for the zone with the configured helper",
  55                         "name": "test3",
  56                         "device": "zone3",
  57                         "masq": "0",
  58                         "masq6": "0",
  59                         "helper": [ "tftp" ]
  60                 },
  61                 {
  62                         ".description": "Disabling both masq and masq6 for a zone with a helper should configure default helper assignment",
  63                         "name": "test4",
  64                         "device": "zone4",
  65                         "masq": "0",
  66                         "masq6": "0",
  67                 },
  68                 {
  69                         ".description": "Specifying an invalid helper should write a warning to stderr",
  70                         "name": "test5",
  71                         "device": "zone5",
  72                         "masq": "0",
  73                         "masq6": "0",
  74                         "helper": [ "foo" ]
  75                 }
  76         ]
  77 }
  78 -- End --
  79
  80 -- Expect stdout --
  81 table inet fw4
  82 flush table inet fw4
  83
  84 table inet fw4 {
  85         #
  86         # Set definitions
  87         #
  88
  89
  90         #
  91         # Defines
  92         #
  93
  94         define test1_devices = { "zone1" }
  95         define test2_devices = { "zone2" }
  96         define test3_devices = { "zone3" }
  97         define test4_devices = { "zone4" }
  98
  99         #
 100         # User includes
 101         #
 102
 103         include "/etc/nftables.d/*.nft"
 104
 105
 106         #
 107         # Filter rules
 108         #
 109
 110         chain input {
 111                 type filter hook input priority filter; policy drop;
 112
 113                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
 114
 115                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
 116                 iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
 117                 iifname "zone2" jump input_test2 comment "!fw4: Handle test2 IPv4/IPv6 input traffic"
 118                 iifname "zone3" jump input_test3 comment "!fw4: Handle test3 IPv4/IPv6 input traffic"
 119                 iifname "zone4" jump input_test4 comment "!fw4: Handle test4 IPv4/IPv6 input traffic"
 120         }
 121
 122         chain forward {
 123                 type filter hook forward priority filter; policy drop;
 124
 125                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
 126                 iifname "zone1" jump forward_test1 comment "!fw4: Handle test1 IPv4/IPv6 forward traffic"
 127                 iifname "zone2" jump forward_test2 comment "!fw4: Handle test2 IPv4/IPv6 forward traffic"
 128                 iifname "zone3" jump forward_test3 comment "!fw4: Handle test3 IPv4/IPv6 forward traffic"
 129                 iifname "zone4" jump forward_test4 comment "!fw4: Handle test4 IPv4/IPv6 forward traffic"
 130         }
 131
 132         chain output {
 133                 type filter hook output priority filter; policy drop;
 134
 135                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 136
 137                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
 138                 oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
 139                 oifname "zone2" jump output_test2 comment "!fw4: Handle test2 IPv4/IPv6 output traffic"
 140                 oifname "zone3" jump output_test3 comment "!fw4: Handle test3 IPv4/IPv6 output traffic"
 141                 oifname "zone4" jump output_test4 comment "!fw4: Handle test4 IPv4/IPv6 output traffic"
 142         }
 143
 144         chain handle_reject {
 145                 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
 146                 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
 147         }
 148
 149         chain input_test1 {
 150                 jump drop_from_test1
 151         }
 152
 153         chain output_test1 {
 154                 jump drop_to_test1
 155         }
 156
 157         chain forward_test1 {
 158                 jump drop_to_test1
 159         }
 160
 161         chain drop_from_test1 {
 162                 iifname "zone1" counter drop comment "!fw4: drop test1 IPv4/IPv6 traffic"
 163         }
 164
 165         chain drop_to_test1 {
 166                 oifname "zone1" counter drop comment "!fw4: drop test1 IPv4/IPv6 traffic"
 167         }
 168
 169         chain input_test2 {
 170                 jump drop_from_test2
 171         }
 172
 173         chain output_test2 {
 174                 jump drop_to_test2
 175         }
 176
 177         chain forward_test2 {
 178                 jump drop_to_test2
 179         }
 180
 181         chain drop_from_test2 {
 182                 iifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
 183         }
 184
 185         chain drop_to_test2 {
 186                 oifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
 187         }
 188
 189         chain input_test3 {
 190                 jump drop_from_test3
 191         }
 192
 193         chain output_test3 {
 194                 jump drop_to_test3
 195         }
 196
 197         chain forward_test3 {
 198                 jump drop_to_test3
 199         }
 200
 201         chain drop_from_test3 {
 202                 iifname "zone3" counter drop comment "!fw4: drop test3 IPv4/IPv6 traffic"
 203         }
 204
 205         chain drop_to_test3 {
 206                 oifname "zone3" counter drop comment "!fw4: drop test3 IPv4/IPv6 traffic"
 207         }
 208
 209         chain input_test4 {
 210                 jump drop_from_test4
 211         }
 212
 213         chain output_test4 {
 214                 jump drop_to_test4
 215         }
 216
 217         chain forward_test4 {
 218                 jump drop_to_test4
 219         }
 220
 221         chain drop_from_test4 {
 222                 iifname "zone4" counter drop comment "!fw4: drop test4 IPv4/IPv6 traffic"
 223         }
 224
 225         chain drop_to_test4 {
 226                 oifname "zone4" counter drop comment "!fw4: drop test4 IPv4/IPv6 traffic"
 227         }
 228
 229
 230         #
 231         # NAT rules
 232         #
 233
 234         chain dstnat {
 235                 type nat hook prerouting priority dstnat; policy accept;
 236         }
 237
 238         chain srcnat {
 239                 type nat hook postrouting priority srcnat; policy accept;
 240                 oifname "zone1" jump srcnat_test1 comment "!fw4: Handle test1 IPv4/IPv6 srcnat traffic"
 241                 oifname "zone2" jump srcnat_test2 comment "!fw4: Handle test2 IPv4/IPv6 srcnat traffic"
 242         }
 243
 244         chain srcnat_test1 {
 245                 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 test1 traffic"
 246         }
 247
 248         chain srcnat_test2 {
 249                 meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 test2 traffic"
 250         }
 251
 252
 253         #
 254         # Raw rules (notrack & helper)
 255         #
 256
 257         chain raw_prerouting {
 258                 type filter hook prerouting priority raw; policy accept;
 259                 iifname "zone1" jump helper_test1 comment "!fw4: test1 IPv4/IPv6 CT helper assignment"
 260                 iifname "zone2" jump helper_test2 comment "!fw4: test2 IPv4/IPv6 CT helper assignment"
 261                 iifname "zone3" jump helper_test3 comment "!fw4: test3 IPv4/IPv6 CT helper assignment"
 262                 iifname "zone4" jump helper_test4 comment "!fw4: test4 IPv4/IPv6 CT helper assignment"
 263         }
 264
 265         chain raw_output {
 266                 type filter hook output priority raw; policy accept;
 267         }
 268
 269         ct helper amanda {
 270                 type "amanda" protocol udp;
 271         }
 272
 273         ct helper ftp {
 274                 type "ftp" protocol tcp;
 275         }
 276
 277         ct helper RAS {
 278                 type "RAS" protocol udp;
 279         }
 280
 281         ct helper Q.931 {
 282                 type "Q.931" protocol tcp;
 283         }
 284
 285         ct helper irc {
 286                 type "irc" protocol tcp;
 287         }
 288
 289         ct helper netbios-ns {
 290                 type "netbios-ns" protocol udp;
 291         }
 292
 293         ct helper pptp {
 294                 type "pptp" protocol tcp;
 295         }
 296
 297         ct helper sane {
 298                 type "sane" protocol tcp;
 299         }
 300
 301         ct helper sip {
 302                 type "sip" protocol udp;
 303         }
 304
 305         ct helper snmp {
 306                 type "snmp" protocol udp;
 307         }
 308
 309         ct helper tftp {
 310                 type "tftp" protocol udp;
 311         }
 312
 313         ct helper rtsp {
 314                 type "rtsp" protocol tcp;
 315         }
 316
 317         chain helper_test1 {
 318                 meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
 319         }
 320
 321         chain helper_test2 {
 322                 meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
 323         }
 324
 325         chain helper_test3 {
 326                 meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
 327         }
 328
 329         chain helper_test4 {
 330                 meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
 331                 meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
 332                 meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
 333                 meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
 334                 meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
 335                 meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
 336                 meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
 337                 meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
 338                 meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
 339                 meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
 340                 meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
 341                 meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
 342         }
 343
 344
 345         #
 346         # Mangle rules
 347         #
 348
 349         chain mangle_prerouting {
 350                 type filter hook prerouting priority mangle; policy accept;
 351         }
 352
 353         chain mangle_postrouting {
 354                 type filter hook postrouting priority mangle; policy accept;
 355         }
 356
 357         chain mangle_input {
 358                 type filter hook input priority mangle; policy accept;
 359         }
 360
 361         chain mangle_output {
 362                 type route hook output priority mangle; policy accept;
 363         }
 364
 365         chain mangle_forward {
 366                 type filter hook forward priority mangle; policy accept;
 367         }
 368 }
 369 -- End --
 370
 371 -- Expect stderr --
 372 [!] Section @zone[4] (test5) option 'helper' specifies invalid value 'foo'
 373 [!] Section @zone[4] (test5) skipped due to invalid options
 374 -- End --