|
 |
136e2c |
From 83c620c895a03d9e99997d61ee532869ae3ef906 Mon Sep 17 00:00:00 2001
|
|
|
136e2c |
From: Eric Garver <eric@garver.life>
|
|
|
136e2c |
Date: Fri, 14 Jun 2019 09:44:41 -0400
|
|
|
136e2c |
Subject: [PATCH 66/73] fix: tests: always list rules using macros
|
|
|
136e2c |
|
|
|
136e2c |
This is to make sure certain flags are used, e.g. "-w" for iptables.
|
|
|
136e2c |
|
|
|
136e2c |
Fixes: rhbz 1720650
|
|
|
136e2c |
(cherry picked from commit e527818500be462a724cd34c94948a2704560eb1)
|
|
|
136e2c |
(cherry picked from commit e074dc55257bfd7e8b8e2805d2c46b58545aec05)
|
|
|
136e2c |
---
|
|
|
136e2c |
.../regression/icmp_block_in_forward_chain.at | 28 +++++--
|
|
|
136e2c |
src/tests/regression/rhbz1514043.at | 77 ++++++++++++++++++-
|
|
|
136e2c |
2 files changed, 96 insertions(+), 9 deletions(-)
|
|
|
136e2c |
|
|
|
136e2c |
diff --git a/src/tests/regression/icmp_block_in_forward_chain.at b/src/tests/regression/icmp_block_in_forward_chain.at
|
|
|
136e2c |
index 3c8766a2b23b..bf834b1a1711 100644
|
|
|
136e2c |
--- a/src/tests/regression/icmp_block_in_forward_chain.at
|
|
|
136e2c |
+++ b/src/tests/regression/icmp_block_in_forward_chain.at
|
|
|
136e2c |
@@ -1,12 +1,30 @@
|
|
|
136e2c |
FWD_START_TEST([ICMP block present FORWARD chain])
|
|
|
136e2c |
|
|
|
136e2c |
FWD_CHECK([-q --zone=public --add-icmp-block=host-prohibited])
|
|
|
136e2c |
-m4_if(iptables, FIREWALL_BACKEND, [
|
|
|
136e2c |
- NS_CHECK([IPTABLES -L IN_public_deny | grep "host-prohibited"], 0, ignore)
|
|
|
136e2c |
- NS_CHECK([IPTABLES -L FWDI_public_deny | grep "host-prohibited"], 0, ignore)
|
|
|
136e2c |
+
|
|
|
136e2c |
+m4_if(nftables, FIREWALL_BACKEND, [
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [filter_IN_public_deny | sed -e 's/icmp code 10/icmp code host-prohibited/'], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain filter_IN_public_deny {
|
|
|
136e2c |
+ icmp type destination-unreachable icmp code host-prohibited reject with icmp type admin-prohibited
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [filter_FWDI_public_deny | sed -e 's/icmp code 10/icmp code host-prohibited/'], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain filter_FWDI_public_deny {
|
|
|
136e2c |
+ icmp type destination-unreachable icmp code host-prohibited reject with icmp type admin-prohibited
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
], [
|
|
|
136e2c |
- NS_CHECK([nft list chain inet firewalld filter_IN_public_deny | grep "destination-unreachable" |grep "\(code 10\|host-prohibited\)"], 0, ignore)
|
|
|
136e2c |
- NS_CHECK([nft list chain inet firewalld filter_FWDI_public_deny | grep "destination-unreachable" |grep "\(code 10\|host-prohibited\)"], 0, ignore)
|
|
|
136e2c |
+
|
|
|
136e2c |
+IPTABLES_LIST_RULES([filter], [IN_public_deny], 0, [dnl
|
|
|
136e2c |
+ REJECT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 3 code 10 reject-with icmp-host-prohibited
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([filter], [FWDI_public_deny], 0, [dnl
|
|
|
136e2c |
+ REJECT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 3 code 10 reject-with icmp-host-prohibited
|
|
|
136e2c |
+])
|
|
|
136e2c |
])
|
|
|
136e2c |
|
|
|
136e2c |
FWD_END_TEST
|
|
|
136e2c |
diff --git a/src/tests/regression/rhbz1514043.at b/src/tests/regression/rhbz1514043.at
|
|
|
136e2c |
index a9750a584898..ff2ede2ece71 100644
|
|
|
136e2c |
--- a/src/tests/regression/rhbz1514043.at
|
|
|
136e2c |
+++ b/src/tests/regression/rhbz1514043.at
|
|
|
136e2c |
@@ -5,11 +5,80 @@ FWD_RELOAD
|
|
|
136e2c |
FWD_CHECK([--zone=public --list-all | TRIM | grep ^services], 0, [dnl
|
|
|
136e2c |
services: dhcpv6-client samba ssh
|
|
|
136e2c |
])
|
|
|
136e2c |
+
|
|
|
136e2c |
dnl check that log denied actually took effect
|
|
|
136e2c |
-m4_if(iptables, FIREWALL_BACKEND, [
|
|
|
136e2c |
- NS_CHECK([IPTABLES -t filter -L | grep "FINAL_REJECT:"], 0, ignore)
|
|
|
136e2c |
+m4_if(nftables, FIREWALL_BACKEND, [
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [filter_INPUT], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain filter_INPUT {
|
|
|
136e2c |
+ ct state established,related accept
|
|
|
136e2c |
+ iifname "lo" accept
|
|
|
136e2c |
+ jump filter_INPUT_ZONES
|
|
|
136e2c |
+ ct state invalid log prefix "STATE_INVALID_DROP: "
|
|
|
136e2c |
+ ct state invalid drop
|
|
|
136e2c |
+ log prefix "FINAL_REJECT: "
|
|
|
136e2c |
+ reject with icmpx type admin-prohibited
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [filter_FORWARD], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain filter_FORWARD {
|
|
|
136e2c |
+ ct state established,related accept
|
|
|
136e2c |
+ iifname "lo" accept
|
|
|
136e2c |
+ jump filter_FORWARD_IN_ZONES
|
|
|
136e2c |
+ jump filter_FORWARD_OUT_ZONES
|
|
|
136e2c |
+ ct state invalid log prefix "STATE_INVALID_DROP: "
|
|
|
136e2c |
+ ct state invalid drop
|
|
|
136e2c |
+ log prefix "FINAL_REJECT: "
|
|
|
136e2c |
+ reject with icmpx type admin-prohibited
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
], [
|
|
|
136e2c |
- NS_CHECK([nft list chain inet firewalld filter_INPUT | grep "FINAL_REJECT"], 0, ignore)
|
|
|
136e2c |
- NS_CHECK([nft list chain inet firewalld filter_FORWARD | grep "FINAL_REJECT"], 0, ignore)
|
|
|
136e2c |
+
|
|
|
136e2c |
+IPTABLES_LIST_RULES([filter], [INPUT], 0, [dnl
|
|
|
136e2c |
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
|
|
|
136e2c |
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ INPUT_direct all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ INPUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ LOG all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
|
|
|
136e2c |
+ DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
|
|
|
136e2c |
+ LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "FINAL_REJECT: "
|
|
|
136e2c |
+ REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
|
|
|
136e2c |
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
|
|
|
136e2c |
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ FORWARD_direct all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ FORWARD_IN_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ FORWARD_OUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ LOG all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
|
|
|
136e2c |
+ DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
|
|
|
136e2c |
+ LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "FINAL_REJECT: "
|
|
|
136e2c |
+ REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([filter], [INPUT], 0, [dnl
|
|
|
136e2c |
+ ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED
|
|
|
136e2c |
+ ACCEPT all ::/0 ::/0
|
|
|
136e2c |
+ INPUT_direct all ::/0 ::/0
|
|
|
136e2c |
+ INPUT_ZONES all ::/0 ::/0
|
|
|
136e2c |
+ LOG all ::/0 ::/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
|
|
|
136e2c |
+ DROP all ::/0 ::/0 ctstate INVALID
|
|
|
136e2c |
+ LOG all ::/0 ::/0 LOG flags 0 level 4 prefix "FINAL_REJECT: "
|
|
|
136e2c |
+ REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
|
|
|
136e2c |
+ ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED
|
|
|
136e2c |
+ ACCEPT all ::/0 ::/0
|
|
|
136e2c |
+ FORWARD_direct all ::/0 ::/0
|
|
|
136e2c |
+ FORWARD_IN_ZONES all ::/0 ::/0
|
|
|
136e2c |
+ FORWARD_OUT_ZONES all ::/0 ::/0
|
|
|
136e2c |
+ LOG all ::/0 ::/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
|
|
|
136e2c |
+ DROP all ::/0 ::/0 ctstate INVALID
|
|
|
136e2c |
+ LOG all ::/0 ::/0 LOG flags 0 level 4 prefix "FINAL_REJECT: "
|
|
|
136e2c |
+ REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
|
|
|
136e2c |
+])
|
|
|
136e2c |
])
|
|
|
136e2c |
+
|
|
|
136e2c |
FWD_END_TEST
|
|
|
136e2c |
--
|
|
|
136e2c |
2.20.1
|
|
|
136e2c |
|