|
 |
136e2c |
From 6e32ff7eabc88e57b4f4831eece15918fc4bda85 Mon Sep 17 00:00:00 2001
|
|
|
136e2c |
From: Eric Garver <eric@garver.life>
|
|
|
136e2c |
Date: Fri, 23 Aug 2019 15:00:45 -0400
|
|
|
136e2c |
Subject: [PATCH 93/99] test: coverage to make sure masquerade/forward-port
|
|
|
136e2c |
only affect IPv4
|
|
|
136e2c |
|
|
|
136e2c |
(cherry picked from commit 5605eefb65adbbe7d6980cc90245f940042c9b78)
|
|
|
136e2c |
(cherry picked from commit 1340fac01a6d64458e7a751807a54c0a5b38dde3)
|
|
|
136e2c |
---
|
|
|
136e2c |
src/tests/firewall-cmd.at | 76 +++++++++++++++++++++++++++++++++++++++
|
|
|
136e2c |
1 file changed, 76 insertions(+)
|
|
|
136e2c |
|
|
|
136e2c |
diff --git a/src/tests/firewall-cmd.at b/src/tests/firewall-cmd.at
|
|
|
136e2c |
index 6a4b670d7935..590194103a7e 100644
|
|
|
136e2c |
--- a/src/tests/firewall-cmd.at
|
|
|
136e2c |
+++ b/src/tests/firewall-cmd.at
|
|
|
136e2c |
@@ -438,6 +438,25 @@ FWD_END_TEST([-e '/ERROR: INVALID_PROTOCOL: dummy/d'])
|
|
|
136e2c |
|
|
|
136e2c |
FWD_START_TEST([masquerade])
|
|
|
136e2c |
FWD_CHECK([--add-masquerade --zone=public], 0, ignore)
|
|
|
136e2c |
+ dnl man page says this should only affect IPv4, so verify that.
|
|
|
136e2c |
+ NFT_LIST_RULES([ip], [nat_POST_public_allow], 0, [dnl
|
|
|
136e2c |
+ table ip firewalld {
|
|
|
136e2c |
+ chain nat_POST_public_allow {
|
|
|
136e2c |
+ oifname != "lo" masquerade
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
+ NFT_LIST_RULES([ip6], [nat_POST_public_allow], 0, [dnl
|
|
|
136e2c |
+ table ip6 firewalld {
|
|
|
136e2c |
+ chain nat_POST_public_allow {
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
+ IPTABLES_LIST_RULES([nat], [POST_public_allow], 0, [dnl
|
|
|
136e2c |
+ MASQUERADE all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
+ IP6TABLES_LIST_RULES([nat], [POST_public_allow], 0, [dnl
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
FWD_CHECK([--query-masquerade], 0, ignore)
|
|
|
136e2c |
FWD_CHECK([--remove-masquerade], 0, ignore)
|
|
|
136e2c |
FWD_CHECK([--query-masquerade], 1, ignore)
|
|
|
136e2c |
@@ -451,9 +470,47 @@ FWD_END_TEST
|
|
|
136e2c |
FWD_START_TEST([forward ports])
|
|
|
136e2c |
FWD_CHECK([--add-forward-port=666], 106, ignore, ignore)
|
|
|
136e2c |
FWD_CHECK([--add-forward-port=port=11:proto=tcp:toport=22], 0, ignore)
|
|
|
136e2c |
+ dnl man page says this should only affect IPv4, so verify that.
|
|
|
136e2c |
+ NFT_LIST_RULES([ip], [nat_PRE_public_allow], 0, [dnl
|
|
|
136e2c |
+ table ip firewalld {
|
|
|
136e2c |
+ chain nat_PRE_public_allow {
|
|
|
136e2c |
+ meta l4proto tcp mark 0x00000064 redirect to :22
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
+ NFT_LIST_RULES([ip6], [nat_PRE_public_allow], 0, [dnl
|
|
|
136e2c |
+ table ip6 firewalld {
|
|
|
136e2c |
+ chain nat_PRE_public_allow {
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
+ IPTABLES_LIST_RULES([nat], [PRE_public_allow], 0, [dnl
|
|
|
136e2c |
+ DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 mark match 0x64 to::22
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
+ IP6TABLES_LIST_RULES([nat], [PRE_public_allow], 0, [dnl
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
FWD_CHECK([--remove-forward-port=port=11:proto=tcp:toport=22 --zone=public], 0, ignore)
|
|
|
136e2c |
FWD_CHECK([--add-forward-port=port=33:proto=tcp:toaddr=4444], 105, ignore, ignore) dnl bad address
|
|
|
136e2c |
FWD_CHECK([--add-forward-port=port=33:proto=tcp:toaddr=4.4.4.4 --zone=public], 0, ignore)
|
|
|
136e2c |
+ dnl man page says this should only affect IPv4, so verify that.
|
|
|
136e2c |
+ NFT_LIST_RULES([ip], [nat_PRE_public_allow], 0, [dnl
|
|
|
136e2c |
+ table ip firewalld {
|
|
|
136e2c |
+ chain nat_PRE_public_allow {
|
|
|
136e2c |
+ meta l4proto tcp mark 0x00000064 dnat to 4.4.4.4
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
+ NFT_LIST_RULES([ip6], [nat_PRE_public_allow], 0, [dnl
|
|
|
136e2c |
+ table ip6 firewalld {
|
|
|
136e2c |
+ chain nat_PRE_public_allow {
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
+ IPTABLES_LIST_RULES([nat], [PRE_public_allow], 0, [dnl
|
|
|
136e2c |
+ DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 mark match 0x64 to:4.4.4.4
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
+ IP6TABLES_LIST_RULES([nat], [PRE_public_allow], 0, [dnl
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
FWD_CHECK([--remove-forward-port=port=33:proto=tcp:toaddr=4.4.4.4], 0, ignore)
|
|
|
136e2c |
FWD_CHECK([--add-forward-port=port=55:proto=tcp:toport=66:toaddr=7.7.7.7], 0, ignore)
|
|
|
136e2c |
FWD_CHECK([--query-forward-port port=55:proto=tcp:toport=66:toaddr=7.7.7.7 --zone=public], 0, ignore)
|
|
|
136e2c |
@@ -465,6 +522,25 @@ FWD_START_TEST([forward ports])
|
|
|
136e2c |
FWD_CHECK([--query-forward-port=port=66:proto=sctp:toport=66:toaddr=7.7.7.7], 1, ignore)
|
|
|
136e2c |
IF_IPV6_SUPPORTED([
|
|
|
136e2c |
FWD_CHECK([--add-forward-port=port=66:proto=sctp:toport=66:toaddr=fd00:dead:beef:ff0::], 0, ignore)
|
|
|
136e2c |
+ dnl this should only affect IPv6, so verify that.
|
|
|
136e2c |
+ NFT_LIST_RULES([ip], [nat_PRE_public_allow], 0, [dnl
|
|
|
136e2c |
+ table ip firewalld {
|
|
|
136e2c |
+ chain nat_PRE_public_allow {
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
+ NFT_LIST_RULES([ip6], [nat_PRE_public_allow], 0, [dnl
|
|
|
136e2c |
+ table ip6 firewalld {
|
|
|
136e2c |
+ chain nat_PRE_public_allow {
|
|
|
136e2c |
+ meta l4proto sctp mark 0x00000064 dnat to [[fd00:dead:beef:ff0::]:66]
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
+ IPTABLES_LIST_RULES([nat], [PRE_public_allow], 0, [dnl
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
+ IP6TABLES_LIST_RULES([nat], [PRE_public_allow], 0, [dnl
|
|
|
136e2c |
+ DNAT sctp ::/0 ::/0 mark match 0x64 [to:[fd00:dead:beef:ff0::]:66]
|
|
|
136e2c |
+ ])
|
|
|
136e2c |
FWD_CHECK([--query-forward-port port=66:proto=sctp:toport=66:toaddr=fd00:dead:beef:ff0:: --zone=public], 0, ignore)
|
|
|
136e2c |
FWD_CHECK([--remove-forward-port=port=66:proto=sctp:toport=66:toaddr=fd00:dead:beef:ff0::], 0, ignore)
|
|
|
136e2c |
FWD_CHECK([--query-forward-port=port=66:proto=sctp:toport=66:toaddr=fd00:dead:beef:ff0::], 1, ignore)
|
|
|
136e2c |
--
|
|
|
136e2c |
2.20.1
|
|
|
136e2c |
|