|
 |
66253d |
From 3e3369ef14f4eba22a5c37113ba6d5e19c7ebc24 Mon Sep 17 00:00:00 2001
|
|
|
66253d |
From: Eric Garver <eric@garver.life>
|
|
|
66253d |
Date: Sun, 19 Jan 2020 16:49:14 -0500
|
|
|
66253d |
Subject: [PATCH 33/37] test: verify AllowZoneDrifting=yes
|
|
|
66253d |
|
|
|
66253d |
Verify the zone dispatch layout.
|
|
|
66253d |
|
|
|
66253d |
(cherry picked from commit bca4e6af91fc4c6a55f7c2bce9e4fe7bcee526a1)
|
|
|
66253d |
(cherry picked from commit 8f9ba9bc80f039408992e1b780bca0beab8bd92c)
|
|
|
66253d |
---
|
|
|
66253d |
src/tests/regression/gh258.at | 536 +++++++++++++++++++++++++---
|
|
|
66253d |
src/tests/regression/rhbz1734765.at | 180 +++++++++-
|
|
|
66253d |
2 files changed, 671 insertions(+), 45 deletions(-)
|
|
|
66253d |
|
|
|
66253d |
diff --git a/src/tests/regression/gh258.at b/src/tests/regression/gh258.at
|
|
|
66253d |
index 4bbea4c25442..d414c611fa26 100644
|
|
|
66253d |
--- a/src/tests/regression/gh258.at
|
|
|
66253d |
+++ b/src/tests/regression/gh258.at
|
|
|
66253d |
@@ -1,12 +1,15 @@
|
|
|
66253d |
FWD_START_TEST([zone dispatch layout])
|
|
|
66253d |
-AT_KEYWORDS(zone gh258 gh441 rhbz1713823)
|
|
|
66253d |
+AT_KEYWORDS(zone gh258 gh441 rhbz1713823 rhbz1772208 rhbz1796055)
|
|
|
66253d |
|
|
|
66253d |
-FWD_CHECK([--zone=work --add-source="1.2.3.0/24"], 0, ignore)
|
|
|
66253d |
+FWD_CHECK([--permanent --zone=trusted --add-source="1.2.3.0/24"], 0, ignore)
|
|
|
66253d |
IF_HOST_SUPPORTS_IPV6_RULES([
|
|
|
66253d |
-FWD_CHECK([--zone=public --add-source="dead:beef::/54"], 0, ignore)
|
|
|
66253d |
+FWD_CHECK([--permanent --zone=public --add-source="dead:beef::/54"], 0, ignore)
|
|
|
66253d |
])
|
|
|
66253d |
-FWD_CHECK([--zone=work --add-interface=dummy0], 0, ignore)
|
|
|
66253d |
-FWD_CHECK([--zone=public --add-interface=dummy1], 0, ignore)
|
|
|
66253d |
+FWD_CHECK([--permanent --zone=trusted --add-interface=dummy0], 0, ignore)
|
|
|
66253d |
+FWD_CHECK([--permanent --zone=public --add-interface=dummy1], 0, ignore)
|
|
|
66253d |
+
|
|
|
66253d |
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=no/' ./firewalld.conf])
|
|
|
66253d |
+FWD_RELOAD
|
|
|
66253d |
|
|
|
66253d |
dnl verify layout of zone dispatch
|
|
|
66253d |
NFT_LIST_RULES([inet], [filter_INPUT], 0, [dnl
|
|
|
66253d |
@@ -25,9 +28,9 @@ NFT_LIST_RULES([inet], [filter_INPUT_ZONES], 0, [dnl
|
|
|
66253d |
table inet firewalld {
|
|
|
66253d |
chain filter_INPUT_ZONES {
|
|
|
66253d |
ip6 saddr dead:beef::/54 goto filter_IN_public
|
|
|
66253d |
- ip saddr 1.2.3.0/24 goto filter_IN_work
|
|
|
66253d |
+ ip saddr 1.2.3.0/24 goto filter_IN_trusted
|
|
|
66253d |
+ iifname "dummy0" goto filter_IN_trusted
|
|
|
66253d |
iifname "dummy1" goto filter_IN_public
|
|
|
66253d |
- iifname "dummy0" goto filter_IN_work
|
|
|
66253d |
goto filter_IN_public
|
|
|
66253d |
}
|
|
|
66253d |
}
|
|
|
66253d |
@@ -50,9 +53,9 @@ NFT_LIST_RULES([inet], [filter_FORWARD_IN_ZONES], 0, [dnl
|
|
|
66253d |
table inet firewalld {
|
|
|
66253d |
chain filter_FORWARD_IN_ZONES {
|
|
|
66253d |
ip6 saddr dead:beef::/54 goto filter_FWDI_public
|
|
|
66253d |
- ip saddr 1.2.3.0/24 goto filter_FWDI_work
|
|
|
66253d |
+ ip saddr 1.2.3.0/24 goto filter_FWDI_trusted
|
|
|
66253d |
+ iifname "dummy0" goto filter_FWDI_trusted
|
|
|
66253d |
iifname "dummy1" goto filter_FWDI_public
|
|
|
66253d |
- iifname "dummy0" goto filter_FWDI_work
|
|
|
66253d |
goto filter_FWDI_public
|
|
|
66253d |
}
|
|
|
66253d |
}
|
|
|
66253d |
@@ -61,9 +64,9 @@ NFT_LIST_RULES([inet], [filter_FORWARD_OUT_ZONES], 0, [dnl
|
|
|
66253d |
table inet firewalld {
|
|
|
66253d |
chain filter_FORWARD_OUT_ZONES {
|
|
|
66253d |
ip6 daddr dead:beef::/54 goto filter_FWDO_public
|
|
|
66253d |
- ip daddr 1.2.3.0/24 goto filter_FWDO_work
|
|
|
66253d |
+ ip daddr 1.2.3.0/24 goto filter_FWDO_trusted
|
|
|
66253d |
+ oifname "dummy0" goto filter_FWDO_trusted
|
|
|
66253d |
oifname "dummy1" goto filter_FWDO_public
|
|
|
66253d |
- oifname "dummy0" goto filter_FWDO_work
|
|
|
66253d |
goto filter_FWDO_public
|
|
|
66253d |
}
|
|
|
66253d |
}
|
|
|
66253d |
@@ -91,9 +94,9 @@ NFT_LIST_RULES([inet], [raw_PREROUTING_ZONES], 0, [dnl
|
|
|
66253d |
table inet firewalld {
|
|
|
66253d |
chain raw_PREROUTING_ZONES {
|
|
|
66253d |
ip6 saddr dead:beef::/54 goto raw_PRE_public
|
|
|
66253d |
- ip saddr 1.2.3.0/24 goto raw_PRE_work
|
|
|
66253d |
+ ip saddr 1.2.3.0/24 goto raw_PRE_trusted
|
|
|
66253d |
+ iifname "dummy0" goto raw_PRE_trusted
|
|
|
66253d |
iifname "dummy1" goto raw_PRE_public
|
|
|
66253d |
- iifname "dummy0" goto raw_PRE_work
|
|
|
66253d |
goto raw_PRE_public
|
|
|
66253d |
}
|
|
|
66253d |
}
|
|
|
66253d |
@@ -109,9 +112,9 @@ NFT_LIST_RULES([inet], [mangle_PREROUTING_ZONES], 0, [dnl
|
|
|
66253d |
table inet firewalld {
|
|
|
66253d |
chain mangle_PREROUTING_ZONES {
|
|
|
66253d |
ip6 saddr dead:beef::/54 goto mangle_PRE_public
|
|
|
66253d |
- ip saddr 1.2.3.0/24 goto mangle_PRE_work
|
|
|
66253d |
+ ip saddr 1.2.3.0/24 goto mangle_PRE_trusted
|
|
|
66253d |
+ iifname "dummy0" goto mangle_PRE_trusted
|
|
|
66253d |
iifname "dummy1" goto mangle_PRE_public
|
|
|
66253d |
- iifname "dummy0" goto mangle_PRE_work
|
|
|
66253d |
goto mangle_PRE_public
|
|
|
66253d |
}
|
|
|
66253d |
}
|
|
|
66253d |
@@ -126,9 +129,9 @@ NFT_LIST_RULES([ip], [nat_PREROUTING], 0, [dnl
|
|
|
66253d |
NFT_LIST_RULES([ip], [nat_PREROUTING_ZONES], 0, [dnl
|
|
|
66253d |
table ip firewalld {
|
|
|
66253d |
chain nat_PREROUTING_ZONES {
|
|
|
66253d |
- ip saddr 1.2.3.0/24 goto nat_PRE_work
|
|
|
66253d |
+ ip saddr 1.2.3.0/24 goto nat_PRE_trusted
|
|
|
66253d |
+ iifname "dummy0" goto nat_PRE_trusted
|
|
|
66253d |
iifname "dummy1" goto nat_PRE_public
|
|
|
66253d |
- iifname "dummy0" goto nat_PRE_work
|
|
|
66253d |
goto nat_PRE_public
|
|
|
66253d |
}
|
|
|
66253d |
}
|
|
|
66253d |
@@ -143,9 +146,9 @@ NFT_LIST_RULES([ip], [nat_POSTROUTING], 0, [dnl
|
|
|
66253d |
NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES], 0, [dnl
|
|
|
66253d |
table ip firewalld {
|
|
|
66253d |
chain nat_POSTROUTING_ZONES {
|
|
|
66253d |
- ip daddr 1.2.3.0/24 goto nat_POST_work
|
|
|
66253d |
+ ip daddr 1.2.3.0/24 goto nat_POST_trusted
|
|
|
66253d |
+ oifname "dummy0" goto nat_POST_trusted
|
|
|
66253d |
oifname "dummy1" goto nat_POST_public
|
|
|
66253d |
- oifname "dummy0" goto nat_POST_work
|
|
|
66253d |
goto nat_POST_public
|
|
|
66253d |
}
|
|
|
66253d |
}
|
|
|
66253d |
@@ -161,8 +164,8 @@ NFT_LIST_RULES([ip6], [nat_PREROUTING_ZONES], 0, [dnl
|
|
|
66253d |
table ip6 firewalld {
|
|
|
66253d |
chain nat_PREROUTING_ZONES {
|
|
|
66253d |
ip6 saddr dead:beef::/54 goto nat_PRE_public
|
|
|
66253d |
+ iifname "dummy0" goto nat_PRE_trusted
|
|
|
66253d |
iifname "dummy1" goto nat_PRE_public
|
|
|
66253d |
- iifname "dummy0" goto nat_PRE_work
|
|
|
66253d |
goto nat_PRE_public
|
|
|
66253d |
}
|
|
|
66253d |
}
|
|
|
66253d |
@@ -178,8 +181,8 @@ NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES], 0, [dnl
|
|
|
66253d |
table ip6 firewalld {
|
|
|
66253d |
chain nat_POSTROUTING_ZONES {
|
|
|
66253d |
ip6 daddr dead:beef::/54 goto nat_POST_public
|
|
|
66253d |
+ oifname "dummy0" goto nat_POST_trusted
|
|
|
66253d |
oifname "dummy1" goto nat_POST_public
|
|
|
66253d |
- oifname "dummy0" goto nat_POST_work
|
|
|
66253d |
goto nat_POST_public
|
|
|
66253d |
}
|
|
|
66253d |
}
|
|
|
66253d |
@@ -194,9 +197,9 @@ IPTABLES_LIST_RULES([filter], [INPUT], 0, [dnl
|
|
|
66253d |
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
|
|
|
66253d |
])
|
|
|
66253d |
IPTABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
|
|
|
66253d |
- [[IN_work all -- 1.2.3.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+ [[IN_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+ IN_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
- IN_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
]])
|
|
|
66253d |
IPTABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
|
|
|
66253d |
@@ -209,15 +212,15 @@ IPTABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
|
|
|
66253d |
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
|
|
|
66253d |
])
|
|
|
66253d |
IPTABLES_LIST_RULES([filter], [FORWARD_IN_ZONES], 0,
|
|
|
66253d |
- [[FWDI_work all -- 1.2.3.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+ [[FWDI_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+ FWDI_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
- FWDI_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
]])
|
|
|
66253d |
IPTABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES], 0,
|
|
|
66253d |
- [[FWDO_work all -- 0.0.0.0/0 1.2.3.0/24 [goto]
|
|
|
66253d |
+ [[FWDO_trusted all -- 0.0.0.0/0 1.2.3.0/24 [goto]
|
|
|
66253d |
+ FWDO_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
- FWDO_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
]])
|
|
|
66253d |
IPTABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
|
|
|
66253d |
@@ -225,9 +228,9 @@ IPTABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
|
|
|
66253d |
PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
])
|
|
|
66253d |
IPTABLES_LIST_RULES([raw], [PREROUTING_ZONES], 0,
|
|
|
66253d |
- [[PRE_work all -- 1.2.3.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+ [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+ PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
- PRE_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
]])
|
|
|
66253d |
IPTABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
|
|
|
66253d |
@@ -235,9 +238,9 @@ IPTABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
|
|
|
66253d |
PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
])
|
|
|
66253d |
IPTABLES_LIST_RULES([mangle], [PREROUTING_ZONES], 0,
|
|
|
66253d |
- [[PRE_work all -- 1.2.3.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+ [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+ PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
- PRE_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
]])
|
|
|
66253d |
IPTABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
|
|
|
66253d |
@@ -245,9 +248,9 @@ IPTABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
|
|
|
66253d |
PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
])
|
|
|
66253d |
IPTABLES_LIST_RULES([nat], [PREROUTING_ZONES], 0,
|
|
|
66253d |
- [[PRE_work all -- 1.2.3.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+ [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+ PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
- PRE_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
]])
|
|
|
66253d |
IPTABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
|
|
|
66253d |
@@ -255,9 +258,9 @@ IPTABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
|
|
|
66253d |
POSTROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
])
|
|
|
66253d |
IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
|
|
|
66253d |
- [[POST_work all -- 0.0.0.0/0 1.2.3.0/24 [goto]
|
|
|
66253d |
+ [[POST_trusted all -- 0.0.0.0/0 1.2.3.0/24 [goto]
|
|
|
66253d |
+ POST_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
POST_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
- POST_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
POST_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
]])
|
|
|
66253d |
|
|
|
66253d |
@@ -271,8 +274,8 @@ IP6TABLES_LIST_RULES([filter], [INPUT], 0, [dnl
|
|
|
66253d |
])
|
|
|
66253d |
IP6TABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
|
|
|
66253d |
[[IN_public all dead:beef::/54 ::/0 [goto]
|
|
|
66253d |
+ IN_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
IN_public all ::/0 ::/0 [goto]
|
|
|
66253d |
- IN_work all ::/0 ::/0 [goto]
|
|
|
66253d |
IN_public all ::/0 ::/0 [goto]
|
|
|
66253d |
]])
|
|
|
66253d |
IP6TABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
|
|
|
66253d |
@@ -287,14 +290,14 @@ IP6TABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
|
|
|
66253d |
])
|
|
|
66253d |
IP6TABLES_LIST_RULES([filter], [FORWARD_IN_ZONES], 0,
|
|
|
66253d |
[[FWDI_public all dead:beef::/54 ::/0 [goto]
|
|
|
66253d |
+ FWDI_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
FWDI_public all ::/0 ::/0 [goto]
|
|
|
66253d |
- FWDI_work all ::/0 ::/0 [goto]
|
|
|
66253d |
FWDI_public all ::/0 ::/0 [goto]
|
|
|
66253d |
]])
|
|
|
66253d |
IP6TABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES], 0,
|
|
|
66253d |
[[FWDO_public all ::/0 dead:beef::/54 [goto]
|
|
|
66253d |
+ FWDO_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
FWDO_public all ::/0 ::/0 [goto]
|
|
|
66253d |
- FWDO_work all ::/0 ::/0 [goto]
|
|
|
66253d |
FWDO_public all ::/0 ::/0 [goto]
|
|
|
66253d |
]])
|
|
|
66253d |
IP6TABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
|
|
|
66253d |
@@ -306,8 +309,8 @@ IP6TABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
|
|
|
66253d |
])
|
|
|
66253d |
IP6TABLES_LIST_RULES([raw], [PREROUTING_ZONES], 0,
|
|
|
66253d |
[[PRE_public all dead:beef::/54 ::/0 [goto]
|
|
|
66253d |
+ PRE_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
PRE_public all ::/0 ::/0 [goto]
|
|
|
66253d |
- PRE_work all ::/0 ::/0 [goto]
|
|
|
66253d |
PRE_public all ::/0 ::/0 [goto]
|
|
|
66253d |
]])
|
|
|
66253d |
IP6TABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
|
|
|
66253d |
@@ -316,8 +319,8 @@ IP6TABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
|
|
|
66253d |
])
|
|
|
66253d |
IP6TABLES_LIST_RULES([mangle], [PREROUTING_ZONES], 0,
|
|
|
66253d |
[[PRE_public all dead:beef::/54 ::/0 [goto]
|
|
|
66253d |
+ PRE_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
PRE_public all ::/0 ::/0 [goto]
|
|
|
66253d |
- PRE_work all ::/0 ::/0 [goto]
|
|
|
66253d |
PRE_public all ::/0 ::/0 [goto]
|
|
|
66253d |
]])
|
|
|
66253d |
IP6TABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
|
|
|
66253d |
@@ -326,8 +329,8 @@ IP6TABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
|
|
|
66253d |
])
|
|
|
66253d |
IP6TABLES_LIST_RULES([nat], [PREROUTING_ZONES], 0,
|
|
|
66253d |
[[PRE_public all dead:beef::/54 ::/0 [goto]
|
|
|
66253d |
+ PRE_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
PRE_public all ::/0 ::/0 [goto]
|
|
|
66253d |
- PRE_work all ::/0 ::/0 [goto]
|
|
|
66253d |
PRE_public all ::/0 ::/0 [goto]
|
|
|
66253d |
]])
|
|
|
66253d |
IP6TABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
|
|
|
66253d |
@@ -336,9 +339,456 @@ IP6TABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
|
|
|
66253d |
])
|
|
|
66253d |
IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
|
|
|
66253d |
[[POST_public all ::/0 dead:beef::/54 [goto]
|
|
|
66253d |
+ POST_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
+ POST_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+ POST_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+
|
|
|
66253d |
+dnl ##########################################################################
|
|
|
66253d |
+dnl ##########################################################################
|
|
|
66253d |
+dnl We also support zone drifting in which source based zones fall through to
|
|
|
66253d |
+dnl interface based zones (including default zone).
|
|
|
66253d |
+dnl ##########################################################################
|
|
|
66253d |
+dnl ##########################################################################
|
|
|
66253d |
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=yes/' ./firewalld.conf])
|
|
|
66253d |
+FWD_RELOAD
|
|
|
66253d |
+
|
|
|
66253d |
+NFT_LIST_RULES([inet], [filter_INPUT], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain filter_INPUT {
|
|
|
66253d |
+ ct state established,related accept
|
|
|
66253d |
+ ct status dnat accept
|
|
|
66253d |
+ iifname "lo" accept
|
|
|
66253d |
+ jump filter_INPUT_ZONES_SOURCE
|
|
|
66253d |
+ jump filter_INPUT_ZONES
|
|
|
66253d |
+ ct state invalid drop
|
|
|
66253d |
+ reject with icmpx type admin-prohibited
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([inet], [filter_INPUT_ZONES_SOURCE], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain filter_INPUT_ZONES_SOURCE {
|
|
|
66253d |
+ ip6 saddr dead:beef::/54 goto filter_IN_public
|
|
|
66253d |
+ ip saddr 1.2.3.0/24 goto filter_IN_trusted
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([inet], [filter_INPUT_ZONES], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain filter_INPUT_ZONES {
|
|
|
66253d |
+ iifname "dummy0" goto filter_IN_trusted
|
|
|
66253d |
+ iifname "dummy1" goto filter_IN_public
|
|
|
66253d |
+ goto filter_IN_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([inet], [filter_FORWARD], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain filter_FORWARD {
|
|
|
66253d |
+ ct state established,related accept
|
|
|
66253d |
+ ct status dnat accept
|
|
|
66253d |
+ iifname "lo" accept
|
|
|
66253d |
+ ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 type addr-unreachable
|
|
|
66253d |
+ jump filter_FORWARD_IN_ZONES_SOURCE
|
|
|
66253d |
+ jump filter_FORWARD_IN_ZONES
|
|
|
66253d |
+ jump filter_FORWARD_OUT_ZONES_SOURCE
|
|
|
66253d |
+ jump filter_FORWARD_OUT_ZONES
|
|
|
66253d |
+ ct state invalid drop
|
|
|
66253d |
+ reject with icmpx type admin-prohibited
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([inet], [filter_FORWARD_IN_ZONES_SOURCE], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain filter_FORWARD_IN_ZONES_SOURCE {
|
|
|
66253d |
+ ip6 saddr dead:beef::/54 goto filter_FWDI_public
|
|
|
66253d |
+ ip saddr 1.2.3.0/24 goto filter_FWDI_trusted
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([inet], [filter_FORWARD_IN_ZONES], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain filter_FORWARD_IN_ZONES {
|
|
|
66253d |
+ iifname "dummy0" goto filter_FWDI_trusted
|
|
|
66253d |
+ iifname "dummy1" goto filter_FWDI_public
|
|
|
66253d |
+ goto filter_FWDI_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([inet], [filter_FORWARD_OUT_ZONES_SOURCE], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain filter_FORWARD_OUT_ZONES_SOURCE {
|
|
|
66253d |
+ ip6 daddr dead:beef::/54 goto filter_FWDO_public
|
|
|
66253d |
+ ip daddr 1.2.3.0/24 goto filter_FWDO_trusted
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([inet], [filter_FORWARD_OUT_ZONES], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain filter_FORWARD_OUT_ZONES {
|
|
|
66253d |
+ oifname "dummy0" goto filter_FWDO_trusted
|
|
|
66253d |
+ oifname "dummy1" goto filter_FWDO_public
|
|
|
66253d |
+ goto filter_FWDO_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+IF_HOST_SUPPORTS_NFT_FIB([
|
|
|
66253d |
+ NFT_LIST_RULES([inet], [raw_PREROUTING], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain raw_PREROUTING {
|
|
|
66253d |
+ icmpv6 type { nd-router-advert, nd-neighbor-solicit } accept
|
|
|
66253d |
+ meta nfproto ipv6 fib saddr . iif oif missing drop
|
|
|
66253d |
+ jump raw_PREROUTING_ZONES_SOURCE
|
|
|
66253d |
+ jump raw_PREROUTING_ZONES
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+ ])
|
|
|
66253d |
+], [
|
|
|
66253d |
+ NFT_LIST_RULES([inet], [raw_PREROUTING], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain raw_PREROUTING {
|
|
|
66253d |
+ jump raw_PREROUTING_ZONES_SOURCE
|
|
|
66253d |
+ jump raw_PREROUTING_ZONES
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+ ])
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([inet], [raw_PREROUTING_ZONES_SOURCE], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain raw_PREROUTING_ZONES_SOURCE {
|
|
|
66253d |
+ ip6 saddr dead:beef::/54 goto raw_PRE_public
|
|
|
66253d |
+ ip saddr 1.2.3.0/24 goto raw_PRE_trusted
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([inet], [raw_PREROUTING_ZONES], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain raw_PREROUTING_ZONES {
|
|
|
66253d |
+ iifname "dummy0" goto raw_PRE_trusted
|
|
|
66253d |
+ iifname "dummy1" goto raw_PRE_public
|
|
|
66253d |
+ goto raw_PRE_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([inet], [mangle_PREROUTING], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain mangle_PREROUTING {
|
|
|
66253d |
+ jump mangle_PREROUTING_ZONES_SOURCE
|
|
|
66253d |
+ jump mangle_PREROUTING_ZONES
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([inet], [mangle_PREROUTING_ZONES_SOURCE], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain mangle_PREROUTING_ZONES_SOURCE {
|
|
|
66253d |
+ ip6 saddr dead:beef::/54 goto mangle_PRE_public
|
|
|
66253d |
+ ip saddr 1.2.3.0/24 goto mangle_PRE_trusted
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([inet], [mangle_PREROUTING_ZONES], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain mangle_PREROUTING_ZONES {
|
|
|
66253d |
+ iifname "dummy0" goto mangle_PRE_trusted
|
|
|
66253d |
+ iifname "dummy1" goto mangle_PRE_public
|
|
|
66253d |
+ goto mangle_PRE_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip], [nat_PREROUTING], 0, [dnl
|
|
|
66253d |
+ table ip firewalld {
|
|
|
66253d |
+ chain nat_PREROUTING {
|
|
|
66253d |
+ jump nat_PREROUTING_ZONES_SOURCE
|
|
|
66253d |
+ jump nat_PREROUTING_ZONES
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip], [nat_PREROUTING_ZONES_SOURCE], 0, [dnl
|
|
|
66253d |
+ table ip firewalld {
|
|
|
66253d |
+ chain nat_PREROUTING_ZONES_SOURCE {
|
|
|
66253d |
+ ip saddr 1.2.3.0/24 goto nat_PRE_trusted
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip], [nat_PREROUTING_ZONES], 0, [dnl
|
|
|
66253d |
+ table ip firewalld {
|
|
|
66253d |
+ chain nat_PREROUTING_ZONES {
|
|
|
66253d |
+ iifname "dummy0" goto nat_PRE_trusted
|
|
|
66253d |
+ iifname "dummy1" goto nat_PRE_public
|
|
|
66253d |
+ goto nat_PRE_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip], [nat_POSTROUTING], 0, [dnl
|
|
|
66253d |
+ table ip firewalld {
|
|
|
66253d |
+ chain nat_POSTROUTING {
|
|
|
66253d |
+ jump nat_POSTROUTING_ZONES_SOURCE
|
|
|
66253d |
+ jump nat_POSTROUTING_ZONES
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES_SOURCE], 0, [dnl
|
|
|
66253d |
+ table ip firewalld {
|
|
|
66253d |
+ chain nat_POSTROUTING_ZONES_SOURCE {
|
|
|
66253d |
+ ip daddr 1.2.3.0/24 goto nat_POST_trusted
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES], 0, [dnl
|
|
|
66253d |
+ table ip firewalld {
|
|
|
66253d |
+ chain nat_POSTROUTING_ZONES {
|
|
|
66253d |
+ oifname "dummy0" goto nat_POST_trusted
|
|
|
66253d |
+ oifname "dummy1" goto nat_POST_public
|
|
|
66253d |
+ goto nat_POST_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip6], [nat_PREROUTING], 0, [dnl
|
|
|
66253d |
+ table ip6 firewalld {
|
|
|
66253d |
+ chain nat_PREROUTING {
|
|
|
66253d |
+ jump nat_PREROUTING_ZONES_SOURCE
|
|
|
66253d |
+ jump nat_PREROUTING_ZONES
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip6], [nat_PREROUTING_ZONES_SOURCE], 0, [dnl
|
|
|
66253d |
+ table ip6 firewalld {
|
|
|
66253d |
+ chain nat_PREROUTING_ZONES_SOURCE {
|
|
|
66253d |
+ ip6 saddr dead:beef::/54 goto nat_PRE_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip6], [nat_PREROUTING_ZONES], 0, [dnl
|
|
|
66253d |
+ table ip6 firewalld {
|
|
|
66253d |
+ chain nat_PREROUTING_ZONES {
|
|
|
66253d |
+ iifname "dummy0" goto nat_PRE_trusted
|
|
|
66253d |
+ iifname "dummy1" goto nat_PRE_public
|
|
|
66253d |
+ goto nat_PRE_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip6], [nat_POSTROUTING], 0, [dnl
|
|
|
66253d |
+ table ip6 firewalld {
|
|
|
66253d |
+ chain nat_POSTROUTING {
|
|
|
66253d |
+ jump nat_POSTROUTING_ZONES_SOURCE
|
|
|
66253d |
+ jump nat_POSTROUTING_ZONES
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES_SOURCE], 0, [dnl
|
|
|
66253d |
+ table ip6 firewalld {
|
|
|
66253d |
+ chain nat_POSTROUTING_ZONES_SOURCE {
|
|
|
66253d |
+ ip6 daddr dead:beef::/54 goto nat_POST_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES], 0, [dnl
|
|
|
66253d |
+ table ip6 firewalld {
|
|
|
66253d |
+ chain nat_POSTROUTING_ZONES {
|
|
|
66253d |
+ oifname "dummy0" goto nat_POST_trusted
|
|
|
66253d |
+ oifname "dummy1" goto nat_POST_public
|
|
|
66253d |
+ goto nat_POST_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+
|
|
|
66253d |
+IPTABLES_LIST_RULES([filter], [INPUT], 0, [dnl
|
|
|
66253d |
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT
|
|
|
66253d |
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ INPUT_direct all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ INPUT_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ INPUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
|
|
|
66253d |
+ REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
|
|
|
66253d |
+])
|
|
|
66253d |
+IPTABLES_LIST_RULES([filter], [INPUT_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[IN_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
|
|
|
66253d |
+ [[IN_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
|
|
|
66253d |
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT
|
|
|
66253d |
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ FORWARD_direct all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ FORWARD_IN_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ FORWARD_IN_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ FORWARD_OUT_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ FORWARD_OUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
|
|
|
66253d |
+ REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
|
|
|
66253d |
+])
|
|
|
66253d |
+IPTABLES_LIST_RULES([filter], [FORWARD_IN_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[FWDI_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([filter], [FORWARD_IN_ZONES], 0,
|
|
|
66253d |
+ [[FWDI_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[FWDO_trusted all -- 0.0.0.0/0 1.2.3.0/24 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES], 0,
|
|
|
66253d |
+ [[FWDO_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
|
|
|
66253d |
+ PREROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ PREROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+])
|
|
|
66253d |
+IPTABLES_LIST_RULES([raw], [PREROUTING_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([raw], [PREROUTING_ZONES], 0,
|
|
|
66253d |
+ [[PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
|
|
|
66253d |
+ PREROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ PREROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+])
|
|
|
66253d |
+IPTABLES_LIST_RULES([mangle], [PREROUTING_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([mangle], [PREROUTING_ZONES], 0,
|
|
|
66253d |
+ [[PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
|
|
|
66253d |
+ PREROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ PREROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+])
|
|
|
66253d |
+IPTABLES_LIST_RULES([nat], [PREROUTING_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([nat], [PREROUTING_ZONES], 0,
|
|
|
66253d |
+ [[PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
|
|
|
66253d |
+ POSTROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ POSTROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+ POSTROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
66253d |
+])
|
|
|
66253d |
+IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[POST_trusted all -- 0.0.0.0/0 1.2.3.0/24 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
|
|
|
66253d |
+ [[POST_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ POST_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ POST_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+
|
|
|
66253d |
+IP6TABLES_LIST_RULES([filter], [INPUT], 0, [dnl
|
|
|
66253d |
+ ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT
|
|
|
66253d |
+ ACCEPT all ::/0 ::/0
|
|
|
66253d |
+ INPUT_direct all ::/0 ::/0
|
|
|
66253d |
+ INPUT_ZONES_SOURCE all ::/0 ::/0
|
|
|
66253d |
+ INPUT_ZONES all ::/0 ::/0
|
|
|
66253d |
+ DROP all ::/0 ::/0 ctstate INVALID
|
|
|
66253d |
+ REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
|
|
|
66253d |
+])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([filter], [INPUT_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[IN_public all dead:beef::/54 ::/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
|
|
|
66253d |
+ [[IN_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
+ IN_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+ IN_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
|
|
|
66253d |
+ ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT
|
|
|
66253d |
+ ACCEPT all ::/0 ::/0
|
|
|
66253d |
+ FORWARD_direct all ::/0 ::/0
|
|
|
66253d |
+ RFC3964_IPv4 all ::/0 ::/0
|
|
|
66253d |
+ FORWARD_IN_ZONES_SOURCE all ::/0 ::/0
|
|
|
66253d |
+ FORWARD_IN_ZONES all ::/0 ::/0
|
|
|
66253d |
+ FORWARD_OUT_ZONES_SOURCE all ::/0 ::/0
|
|
|
66253d |
+ FORWARD_OUT_ZONES all ::/0 ::/0
|
|
|
66253d |
+ DROP all ::/0 ::/0 ctstate INVALID
|
|
|
66253d |
+ REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
|
|
|
66253d |
+])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([filter], [FORWARD_IN_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[FWDI_public all dead:beef::/54 ::/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([filter], [FORWARD_IN_ZONES], 0,
|
|
|
66253d |
+ [[FWDI_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
+ FWDI_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+ FWDI_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[FWDO_public all ::/0 dead:beef::/54 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES], 0,
|
|
|
66253d |
+ [[FWDO_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
+ FWDO_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+ FWDO_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
|
|
|
66253d |
+ ACCEPT icmpv6 ::/0 ::/0 ipv6-icmptype 134
|
|
|
66253d |
+ ACCEPT icmpv6 ::/0 ::/0 ipv6-icmptype 135
|
|
|
66253d |
+ DROP all ::/0 ::/0 rpfilter invert
|
|
|
66253d |
+ PREROUTING_direct all ::/0 ::/0
|
|
|
66253d |
+ PREROUTING_ZONES_SOURCE all ::/0 ::/0
|
|
|
66253d |
+ PREROUTING_ZONES all ::/0 ::/0
|
|
|
66253d |
+])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([raw], [PREROUTING_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[PRE_public all dead:beef::/54 ::/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([raw], [PREROUTING_ZONES], 0,
|
|
|
66253d |
+ [[PRE_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
+ PRE_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+ PRE_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
|
|
|
66253d |
+ PREROUTING_direct all ::/0 ::/0
|
|
|
66253d |
+ PREROUTING_ZONES_SOURCE all ::/0 ::/0
|
|
|
66253d |
+ PREROUTING_ZONES all ::/0 ::/0
|
|
|
66253d |
+])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([mangle], [PREROUTING_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[PRE_public all dead:beef::/54 ::/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([mangle], [PREROUTING_ZONES], 0,
|
|
|
66253d |
+ [[PRE_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
+ PRE_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+ PRE_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
|
|
|
66253d |
+ PREROUTING_direct all ::/0 ::/0
|
|
|
66253d |
+ PREROUTING_ZONES_SOURCE all ::/0 ::/0
|
|
|
66253d |
+ PREROUTING_ZONES all ::/0 ::/0
|
|
|
66253d |
+])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([nat], [PREROUTING_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[PRE_public all dead:beef::/54 ::/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([nat], [PREROUTING_ZONES], 0,
|
|
|
66253d |
+ [[PRE_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
+ PRE_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+ PRE_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
|
|
|
66253d |
+ POSTROUTING_direct all ::/0 ::/0
|
|
|
66253d |
+ POSTROUTING_ZONES_SOURCE all ::/0 ::/0
|
|
|
66253d |
+ POSTROUTING_ZONES all ::/0 ::/0
|
|
|
66253d |
+])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[POST_public all ::/0 dead:beef::/54 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
|
|
|
66253d |
+ [[POST_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
POST_public all ::/0 ::/0 [goto]
|
|
|
66253d |
- POST_work all ::/0 ::/0 [goto]
|
|
|
66253d |
POST_public all ::/0 ::/0 [goto]
|
|
|
66253d |
]])
|
|
|
66253d |
|
|
|
66253d |
-FWD_END_TEST
|
|
|
66253d |
+FWD_END_TEST([-e '/WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now./d'])
|
|
|
66253d |
diff --git a/src/tests/regression/rhbz1734765.at b/src/tests/regression/rhbz1734765.at
|
|
|
66253d |
index 972457e3126e..bb054bdb0361 100644
|
|
|
66253d |
--- a/src/tests/regression/rhbz1734765.at
|
|
|
66253d |
+++ b/src/tests/regression/rhbz1734765.at
|
|
|
66253d |
@@ -1,9 +1,12 @@
|
|
|
66253d |
FWD_START_TEST([zone sources ordered by name])
|
|
|
66253d |
-AT_KEYWORDS(zone rhbz1734765 rhbz1421222 gh166 rhbz1738545)
|
|
|
66253d |
+AT_KEYWORDS(zone rhbz1734765 rhbz1421222 gh166 rhbz1738545 rhbz1772208 rhbz1796055)
|
|
|
66253d |
dnl
|
|
|
66253d |
dnl Users depend on firewalld ordering source-based zone dispatch by zone name.
|
|
|
66253d |
dnl
|
|
|
66253d |
|
|
|
66253d |
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=no/' ./firewalld.conf])
|
|
|
66253d |
+FWD_RELOAD
|
|
|
66253d |
+
|
|
|
66253d |
FWD_CHECK([-q --permanent --new-zone=foobar_00])
|
|
|
66253d |
FWD_CHECK([-q --permanent --new-zone=foobar_05])
|
|
|
66253d |
FWD_CHECK([-q --permanent --new-zone=foobar_02])
|
|
|
66253d |
@@ -196,4 +199,177 @@ IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
|
|
|
66253d |
POST_public all ::/0 ::/0 [goto]
|
|
|
66253d |
]])
|
|
|
66253d |
|
|
|
66253d |
-FWD_END_TEST
|
|
|
66253d |
+dnl ##########################################################################
|
|
|
66253d |
+dnl ##########################################################################
|
|
|
66253d |
+dnl We also support zone drifting in which source based zones fall through to
|
|
|
66253d |
+dnl interface based zones (including default zone). So make sure the zones are
|
|
|
66253d |
+dnl sorted by name in this mode.
|
|
|
66253d |
+dnl ##########################################################################
|
|
|
66253d |
+dnl ##########################################################################
|
|
|
66253d |
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=yes/' ./firewalld.conf])
|
|
|
66253d |
+FWD_RELOAD
|
|
|
66253d |
+
|
|
|
66253d |
+FWD_CHECK([-q --zone=foobar_010 --add-source="10.10.10.10"])
|
|
|
66253d |
+FWD_CHECK([-q --zone=public --add-source="20.20.20.20"])
|
|
|
66253d |
+IF_HOST_SUPPORTS_IPV6_RULES([
|
|
|
66253d |
+FWD_CHECK([-q --zone=foobar_010 --add-source="1234:5678::10:10:10"])
|
|
|
66253d |
+FWD_CHECK([-q --zone=public --add-source="1234:5678::20:20:20"])
|
|
|
66253d |
+FWD_CHECK([-q --zone=foobar_012 --add-source ipset:ipsetv6])
|
|
|
66253d |
+])
|
|
|
66253d |
+FWD_CHECK([-q --zone=foobar_010 --add-interface=foobar2])
|
|
|
66253d |
+
|
|
|
66253d |
+NFT_LIST_RULES([inet], [filter_INPUT_ZONES_SOURCE], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain filter_INPUT_ZONES_SOURCE {
|
|
|
66253d |
+ ip saddr 10.1.1.1 goto filter_IN_foobar_00
|
|
|
66253d |
+ ip6 saddr 1234:5678::1:1:1 goto filter_IN_foobar_00
|
|
|
66253d |
+ ip saddr 10.1.1.0/24 goto filter_IN_foobar_01
|
|
|
66253d |
+ ip6 saddr 1234:5678::1:1:0/112 goto filter_IN_foobar_01
|
|
|
66253d |
+ ip saddr 10.10.10.10 goto filter_IN_foobar_010
|
|
|
66253d |
+ ip6 saddr 1234:5678::10:10:10 goto filter_IN_foobar_010
|
|
|
66253d |
+ ip saddr @ipsetv4 goto filter_IN_foobar_011
|
|
|
66253d |
+ ip6 saddr @ipsetv6 goto filter_IN_foobar_012
|
|
|
66253d |
+ ip saddr 10.1.0.0/16 goto filter_IN_foobar_02
|
|
|
66253d |
+ ip6 saddr 1234:5678::1:0:0/96 goto filter_IN_foobar_02
|
|
|
66253d |
+ ip saddr 10.2.2.0/24 goto filter_IN_foobar_03
|
|
|
66253d |
+ ip6 saddr 1234:5678::2:2:0/112 goto filter_IN_foobar_03
|
|
|
66253d |
+ ip saddr 10.2.0.0/16 goto filter_IN_foobar_04
|
|
|
66253d |
+ ip6 saddr 1234:5678::2:0:0/96 goto filter_IN_foobar_04
|
|
|
66253d |
+ ip saddr 10.0.0.0/8 goto filter_IN_foobar_05
|
|
|
66253d |
+ ip6 saddr 1234:5678::/80 goto filter_IN_foobar_05
|
|
|
66253d |
+ ip saddr 20.20.20.20 goto filter_IN_public
|
|
|
66253d |
+ ip6 saddr 1234:5678::20:20:20 goto filter_IN_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([inet], [filter_INPUT_ZONES], 0, [dnl
|
|
|
66253d |
+ table inet firewalld {
|
|
|
66253d |
+ chain filter_INPUT_ZONES {
|
|
|
66253d |
+ iifname "foobar2" goto filter_IN_foobar_010
|
|
|
66253d |
+ iifname "foobar1" goto filter_IN_trusted
|
|
|
66253d |
+ iifname "foobar0" goto filter_IN_internal
|
|
|
66253d |
+ goto filter_IN_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES_SOURCE], 0, [dnl
|
|
|
66253d |
+ table ip firewalld {
|
|
|
66253d |
+ chain nat_POSTROUTING_ZONES_SOURCE {
|
|
|
66253d |
+ ip daddr 10.1.1.1 goto nat_POST_foobar_00
|
|
|
66253d |
+ ip daddr 10.1.1.0/24 goto nat_POST_foobar_01
|
|
|
66253d |
+ ip daddr 10.10.10.10 goto nat_POST_foobar_010
|
|
|
66253d |
+ ip daddr @ipsetv4 goto nat_POST_foobar_011
|
|
|
66253d |
+ ip daddr 10.1.0.0/16 goto nat_POST_foobar_02
|
|
|
66253d |
+ ip daddr 10.2.2.0/24 goto nat_POST_foobar_03
|
|
|
66253d |
+ ip daddr 10.2.0.0/16 goto nat_POST_foobar_04
|
|
|
66253d |
+ ip daddr 10.0.0.0/8 goto nat_POST_foobar_05
|
|
|
66253d |
+ ip daddr 20.20.20.20 goto nat_POST_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES], 0, [dnl
|
|
|
66253d |
+ table ip firewalld {
|
|
|
66253d |
+ chain nat_POSTROUTING_ZONES {
|
|
|
66253d |
+ oifname "foobar2" goto nat_POST_foobar_010
|
|
|
66253d |
+ oifname "foobar1" goto nat_POST_trusted
|
|
|
66253d |
+ oifname "foobar0" goto nat_POST_internal
|
|
|
66253d |
+ goto nat_POST_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES_SOURCE], 0, [dnl
|
|
|
66253d |
+ table ip6 firewalld {
|
|
|
66253d |
+ chain nat_POSTROUTING_ZONES_SOURCE {
|
|
|
66253d |
+ ip6 daddr 1234:5678::1:1:1 goto nat_POST_foobar_00
|
|
|
66253d |
+ ip6 daddr 1234:5678::1:1:0/112 goto nat_POST_foobar_01
|
|
|
66253d |
+ ip6 daddr 1234:5678::10:10:10 goto nat_POST_foobar_010
|
|
|
66253d |
+ ip6 daddr @ipsetv6 goto nat_POST_foobar_012
|
|
|
66253d |
+ ip6 daddr 1234:5678::1:0:0/96 goto nat_POST_foobar_02
|
|
|
66253d |
+ ip6 daddr 1234:5678::2:2:0/112 goto nat_POST_foobar_03
|
|
|
66253d |
+ ip6 daddr 1234:5678::2:0:0/96 goto nat_POST_foobar_04
|
|
|
66253d |
+ ip6 daddr 1234:5678::/80 goto nat_POST_foobar_05
|
|
|
66253d |
+ ip6 daddr 1234:5678::20:20:20 goto nat_POST_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES], 0, [dnl
|
|
|
66253d |
+ table ip6 firewalld {
|
|
|
66253d |
+ chain nat_POSTROUTING_ZONES {
|
|
|
66253d |
+ oifname "foobar2" goto nat_POST_foobar_010
|
|
|
66253d |
+ oifname "foobar1" goto nat_POST_trusted
|
|
|
66253d |
+ oifname "foobar0" goto nat_POST_internal
|
|
|
66253d |
+ goto nat_POST_public
|
|
|
66253d |
+ }
|
|
|
66253d |
+ }
|
|
|
66253d |
+])
|
|
|
66253d |
+
|
|
|
66253d |
+IPTABLES_LIST_RULES([filter], [INPUT_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[IN_foobar_00 all -- 10.1.1.1 0.0.0.0/0 [goto]
|
|
|
66253d |
+ IN_foobar_01 all -- 10.1.1.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+ IN_foobar_010 all -- 10.10.10.10 0.0.0.0/0 [goto]
|
|
|
66253d |
+ IN_foobar_011 all -- 0.0.0.0/0 0.0.0.0/0 [goto] match-set ipsetv4 src
|
|
|
66253d |
+ IN_foobar_02 all -- 10.1.0.0/16 0.0.0.0/0 [goto]
|
|
|
66253d |
+ IN_foobar_03 all -- 10.2.2.0/24 0.0.0.0/0 [goto]
|
|
|
66253d |
+ IN_foobar_04 all -- 10.2.0.0/16 0.0.0.0/0 [goto]
|
|
|
66253d |
+ IN_foobar_05 all -- 10.0.0.0/8 0.0.0.0/0 [goto]
|
|
|
66253d |
+ IN_public all -- 20.20.20.20 0.0.0.0/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
|
|
|
66253d |
+ [[IN_foobar_010 all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ IN_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ IN_internal all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([filter], [INPUT_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[IN_foobar_00 all 1234:5678::1:1:1 ::/0 [goto]
|
|
|
66253d |
+ IN_foobar_01 all 1234:5678::1:1:0/112 ::/0 [goto]
|
|
|
66253d |
+ IN_foobar_010 all 1234:5678::10:10:10 ::/0 [goto]
|
|
|
66253d |
+ IN_foobar_012 all ::/0 ::/0 [goto] match-set ipsetv6 src
|
|
|
66253d |
+ IN_foobar_02 all 1234:5678::1:0:0/96 ::/0 [goto]
|
|
|
66253d |
+ IN_foobar_03 all 1234:5678::2:2:0/112 ::/0 [goto]
|
|
|
66253d |
+ IN_foobar_04 all 1234:5678::2:0:0/96 ::/0 [goto]
|
|
|
66253d |
+ IN_foobar_05 all 1234:5678::/80 ::/0 [goto]
|
|
|
66253d |
+ IN_public all 1234:5678::20:20:20 ::/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
|
|
|
66253d |
+ [[IN_foobar_010 all ::/0 ::/0 [goto]
|
|
|
66253d |
+ IN_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
+ IN_internal all ::/0 ::/0 [goto]
|
|
|
66253d |
+ IN_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[POST_foobar_00 all -- 0.0.0.0/0 10.1.1.1 [goto]
|
|
|
66253d |
+ POST_foobar_01 all -- 0.0.0.0/0 10.1.1.0/24 [goto]
|
|
|
66253d |
+ POST_foobar_010 all -- 0.0.0.0/0 10.10.10.10 [goto]
|
|
|
66253d |
+ POST_foobar_011 all -- 0.0.0.0/0 0.0.0.0/0 [goto] match-set ipsetv4 dst
|
|
|
66253d |
+ POST_foobar_02 all -- 0.0.0.0/0 10.1.0.0/16 [goto]
|
|
|
66253d |
+ POST_foobar_03 all -- 0.0.0.0/0 10.2.2.0/24 [goto]
|
|
|
66253d |
+ POST_foobar_04 all -- 0.0.0.0/0 10.2.0.0/16 [goto]
|
|
|
66253d |
+ POST_foobar_05 all -- 0.0.0.0/0 10.0.0.0/8 [goto]
|
|
|
66253d |
+ POST_public all -- 0.0.0.0/0 20.20.20.20 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
|
|
|
66253d |
+ [[POST_foobar_010 all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ POST_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ POST_internal all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+ POST_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES_SOURCE], 0,
|
|
|
66253d |
+ [[POST_foobar_00 all ::/0 1234:5678::1:1:1 [goto]
|
|
|
66253d |
+ POST_foobar_01 all ::/0 1234:5678::1:1:0/112 [goto]
|
|
|
66253d |
+ POST_foobar_010 all ::/0 1234:5678::10:10:10 [goto]
|
|
|
66253d |
+ POST_foobar_012 all ::/0 ::/0 [goto] match-set ipsetv6 dst
|
|
|
66253d |
+ POST_foobar_02 all ::/0 1234:5678::1:0:0/96 [goto]
|
|
|
66253d |
+ POST_foobar_03 all ::/0 1234:5678::2:2:0/112 [goto]
|
|
|
66253d |
+ POST_foobar_04 all ::/0 1234:5678::2:0:0/96 [goto]
|
|
|
66253d |
+ POST_foobar_05 all ::/0 1234:5678::/80 [goto]
|
|
|
66253d |
+ POST_public all ::/0 1234:5678::20:20:20 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
|
|
|
66253d |
+ [[POST_foobar_010 all ::/0 ::/0 [goto]
|
|
|
66253d |
+ POST_trusted all ::/0 ::/0 [goto]
|
|
|
66253d |
+ POST_internal all ::/0 ::/0 [goto]
|
|
|
66253d |
+ POST_public all ::/0 ::/0 [goto]
|
|
|
66253d |
+]])
|
|
|
66253d |
+
|
|
|
66253d |
+FWD_END_TEST([-e '/WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now./d'])
|
|
|
66253d |
--
|
|
|
66253d |
2.23.0
|
|
|
66253d |
|