|
 |
b8221b |
From b2075eb46f1798ba897ca443ea14872b17267d69 Mon Sep 17 00:00:00 2001
|
|
|
b8221b |
From: Eric Garver <eric@garver.life>
|
|
|
b8221b |
Date: Mon, 13 Sep 2021 14:54:42 -0400
|
|
|
b8221b |
Subject: [PATCH 39/50] test(icmp): don't log blocked if ICMP inversion
|
|
|
b8221b |
|
|
|
b8221b |
Coverage: #696
|
|
|
b8221b |
Coverage: rhbz1945833
|
|
|
b8221b |
(cherry picked from commit b7d9a74731f9c5a1a6faf0f2959adcc315d2ca16)
|
|
|
b8221b |
(cherry picked from commit d45c614967cec6a608c93c1e8531089d7b1150bb)
|
|
|
b8221b |
---
|
|
|
b8221b |
src/tests/regression/gh696.at | 102 +++++++++++++++++++++++++++++
|
|
|
b8221b |
src/tests/regression/regression.at | 1 +
|
|
|
b8221b |
2 files changed, 103 insertions(+)
|
|
|
b8221b |
create mode 100644 src/tests/regression/gh696.at
|
|
|
b8221b |
|
|
|
b8221b |
diff --git a/src/tests/regression/gh696.at b/src/tests/regression/gh696.at
|
|
|
b8221b |
new file mode 100644
|
|
|
b8221b |
index 000000000000..19b8d485a0a5
|
|
|
b8221b |
--- /dev/null
|
|
|
b8221b |
+++ b/src/tests/regression/gh696.at
|
|
|
b8221b |
@@ -0,0 +1,102 @@
|
|
|
b8221b |
+FWD_START_TEST([icmp-block-inversion no log blocked])
|
|
|
b8221b |
+AT_KEYWORDS(icmp gh696 rhbz1945833)
|
|
|
b8221b |
+
|
|
|
b8221b |
+FWD_CHECK([--permanent --zone public --remove-icmp-block-inversion], 0, [ignore], [ignore])
|
|
|
b8221b |
+FWD_CHECK([--permanent --zone public --add-icmp-block echo-request], 0, [ignore])
|
|
|
b8221b |
+FWD_RELOAD()
|
|
|
b8221b |
+
|
|
|
b8221b |
+NFT_LIST_RULES([inet], [filter_IN_public_deny], 0, [dnl
|
|
|
b8221b |
+ table inet firewalld {
|
|
|
b8221b |
+ chain filter_IN_public_deny {
|
|
|
b8221b |
+ icmp type echo-request reject with icmpx type admin-prohibited
|
|
|
b8221b |
+ icmpv6 type echo-request reject with icmpx type admin-prohibited
|
|
|
b8221b |
+ }
|
|
|
b8221b |
+ }
|
|
|
b8221b |
+])
|
|
|
b8221b |
+
|
|
|
b8221b |
+IPTABLES_LIST_RULES([filter], [IN_public_deny], 0, [dnl
|
|
|
b8221b |
+ REJECT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8 reject-with icmp-host-prohibited
|
|
|
b8221b |
+])
|
|
|
b8221b |
+IP6TABLES_LIST_RULES([filter], [IN_public_deny], 0, [dnl
|
|
|
b8221b |
+ REJECT icmpv6 ::/0 ::/0 ipv6-icmptype 128 reject-with icmp6-adm-prohibited
|
|
|
b8221b |
+])
|
|
|
b8221b |
+
|
|
|
b8221b |
+dnl since inversion is disabled we should get logs when the ICMP is blocked.
|
|
|
b8221b |
+FWD_CHECK([--set-log-denied all], 0, [ignore])
|
|
|
b8221b |
+
|
|
|
b8221b |
+NFT_LIST_RULES([inet], [filter_IN_public_deny], 0, [dnl
|
|
|
b8221b |
+ table inet firewalld {
|
|
|
b8221b |
+ chain filter_IN_public_deny {
|
|
|
b8221b |
+ icmp type echo-request log prefix ""filter_zone_public_HOST_ICMP_BLOCK: ""
|
|
|
b8221b |
+ icmp type echo-request reject with icmpx type admin-prohibited
|
|
|
b8221b |
+ icmpv6 type echo-request log prefix ""filter_zone_public_HOST_ICMP_BLOCK: ""
|
|
|
b8221b |
+ icmpv6 type echo-request reject with icmpx type admin-prohibited
|
|
|
b8221b |
+ }
|
|
|
b8221b |
+ }
|
|
|
b8221b |
+])
|
|
|
b8221b |
+
|
|
|
b8221b |
+IPTABLES_LIST_RULES([filter], [IN_public_deny], 0, [dnl
|
|
|
b8221b |
+ LOG icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8 LOG flags 0 level 4 prefix "zone_public_HOST_ICMP_BLOCK: "
|
|
|
b8221b |
+ REJECT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8 reject-with icmp-host-prohibited
|
|
|
b8221b |
+])
|
|
|
b8221b |
+IP6TABLES_LIST_RULES([filter], [IN_public_deny], 0, [dnl
|
|
|
b8221b |
+ LOG icmpv6 ::/0 ::/0 ipv6-icmptype 128 LOG flags 0 level 4 prefix "zone_public_HOST_ICMP_BLOCK: "
|
|
|
b8221b |
+ REJECT icmpv6 ::/0 ::/0 ipv6-icmptype 128 reject-with icmp6-adm-prohibited
|
|
|
b8221b |
+])
|
|
|
b8221b |
+
|
|
|
b8221b |
+dnl ########################################
|
|
|
b8221b |
+dnl ########################################
|
|
|
b8221b |
+dnl Same as above, but with icmp block inversion.
|
|
|
b8221b |
+dnl ########################################
|
|
|
b8221b |
+dnl ########################################
|
|
|
b8221b |
+
|
|
|
b8221b |
+FWD_CHECK([--permanent --zone public --add-icmp-block-inversion], 0, [ignore])
|
|
|
b8221b |
+FWD_CHECK([--set-log-denied off], 0, [ignore])
|
|
|
b8221b |
+
|
|
|
b8221b |
+NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl
|
|
|
b8221b |
+ table inet firewalld {
|
|
|
b8221b |
+ chain filter_IN_public_allow {
|
|
|
b8221b |
+ tcp dport 22 ct state new,untracked accept
|
|
|
b8221b |
+ ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept
|
|
|
b8221b |
+ icmp type echo-request accept
|
|
|
b8221b |
+ icmpv6 type echo-request accept
|
|
|
b8221b |
+ }
|
|
|
b8221b |
+ }
|
|
|
b8221b |
+])
|
|
|
b8221b |
+
|
|
|
b8221b |
+IPTABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl
|
|
|
b8221b |
+ ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW,UNTRACKED
|
|
|
b8221b |
+ ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8
|
|
|
b8221b |
+])
|
|
|
b8221b |
+IP6TABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl
|
|
|
b8221b |
+ ACCEPT tcp ::/0 ::/0 tcp dpt:22 ctstate NEW,UNTRACKED
|
|
|
b8221b |
+ ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED
|
|
|
b8221b |
+ ACCEPT icmpv6 ::/0 ::/0 ipv6-icmptype 128
|
|
|
b8221b |
+])
|
|
|
b8221b |
+
|
|
|
b8221b |
+dnl since inversion is enabled, it should be the same whether set-log-denied is
|
|
|
b8221b |
+dnl enabled or not.
|
|
|
b8221b |
+FWD_CHECK([--set-log-denied all], 0, [ignore])
|
|
|
b8221b |
+
|
|
|
b8221b |
+NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl
|
|
|
b8221b |
+ table inet firewalld {
|
|
|
b8221b |
+ chain filter_IN_public_allow {
|
|
|
b8221b |
+ tcp dport 22 ct state new,untracked accept
|
|
|
b8221b |
+ ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept
|
|
|
b8221b |
+ icmp type echo-request accept
|
|
|
b8221b |
+ icmpv6 type echo-request accept
|
|
|
b8221b |
+ }
|
|
|
b8221b |
+ }
|
|
|
b8221b |
+])
|
|
|
b8221b |
+
|
|
|
b8221b |
+IPTABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl
|
|
|
b8221b |
+ ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW,UNTRACKED
|
|
|
b8221b |
+ ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8
|
|
|
b8221b |
+])
|
|
|
b8221b |
+IP6TABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl
|
|
|
b8221b |
+ ACCEPT tcp ::/0 ::/0 tcp dpt:22 ctstate NEW,UNTRACKED
|
|
|
b8221b |
+ ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED
|
|
|
b8221b |
+ ACCEPT icmpv6 ::/0 ::/0 ipv6-icmptype 128
|
|
|
b8221b |
+])
|
|
|
b8221b |
+
|
|
|
b8221b |
+FWD_END_TEST([-d '/WARNING: NOT_ENABLED: icmp-block-inversion/d'])
|
|
|
b8221b |
diff --git a/src/tests/regression/regression.at b/src/tests/regression/regression.at
|
|
|
b8221b |
index aadd948a459f..ba41a56b29b5 100644
|
|
|
b8221b |
--- a/src/tests/regression/regression.at
|
|
|
b8221b |
+++ b/src/tests/regression/regression.at
|
|
|
b8221b |
@@ -42,3 +42,4 @@ m4_include([regression/ipset_netmask_allowed.at])
|
|
|
b8221b |
m4_include([regression/rhbz1940928.at])
|
|
|
b8221b |
m4_include([regression/rhbz1936896.at])
|
|
|
b8221b |
m4_include([regression/rhbz1914935.at])
|
|
|
b8221b |
+m4_include([regression/gh696.at])
|
|
|
b8221b |
--
|
|
|
b8221b |
2.27.0
|
|
|
b8221b |
|