From 3e3369ef14f4eba22a5c37113ba6d5e19c7ebc24 Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life>
Date: Sun, 19 Jan 2020 16:49:14 -0500
Subject: [PATCH 33/37] test: verify AllowZoneDrifting=yes
Verify the zone dispatch layout.
(cherry picked from commit bca4e6af91fc4c6a55f7c2bce9e4fe7bcee526a1)
(cherry picked from commit 8f9ba9bc80f039408992e1b780bca0beab8bd92c)
---
src/tests/regression/gh258.at | 536 +++++++++++++++++++++++++---
src/tests/regression/rhbz1734765.at | 180 +++++++++-
2 files changed, 671 insertions(+), 45 deletions(-)
diff --git a/src/tests/regression/gh258.at b/src/tests/regression/gh258.at
index 4bbea4c25442..d414c611fa26 100644
--- a/src/tests/regression/gh258.at
+++ b/src/tests/regression/gh258.at
@@ -1,12 +1,15 @@
FWD_START_TEST([zone dispatch layout])
-AT_KEYWORDS(zone gh258 gh441 rhbz1713823)
+AT_KEYWORDS(zone gh258 gh441 rhbz1713823 rhbz1772208 rhbz1796055)
-FWD_CHECK([--zone=work --add-source="1.2.3.0/24"], 0, ignore)
+FWD_CHECK([--permanent --zone=trusted --add-source="1.2.3.0/24"], 0, ignore)
IF_HOST_SUPPORTS_IPV6_RULES([
-FWD_CHECK([--zone=public --add-source="dead:beef::/54"], 0, ignore)
+FWD_CHECK([--permanent --zone=public --add-source="dead:beef::/54"], 0, ignore)
])
-FWD_CHECK([--zone=work --add-interface=dummy0], 0, ignore)
-FWD_CHECK([--zone=public --add-interface=dummy1], 0, ignore)
+FWD_CHECK([--permanent --zone=trusted --add-interface=dummy0], 0, ignore)
+FWD_CHECK([--permanent --zone=public --add-interface=dummy1], 0, ignore)
+
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=no/' ./firewalld.conf])
+FWD_RELOAD
dnl verify layout of zone dispatch
NFT_LIST_RULES([inet], [filter_INPUT], 0, [dnl
@@ -25,9 +28,9 @@ NFT_LIST_RULES([inet], [filter_INPUT_ZONES], 0, [dnl
table inet firewalld {
chain filter_INPUT_ZONES {
ip6 saddr dead:beef::/54 goto filter_IN_public
- ip saddr 1.2.3.0/24 goto filter_IN_work
+ ip saddr 1.2.3.0/24 goto filter_IN_trusted
+ iifname "dummy0" goto filter_IN_trusted
iifname "dummy1" goto filter_IN_public
- iifname "dummy0" goto filter_IN_work
goto filter_IN_public
}
}
@@ -50,9 +53,9 @@ NFT_LIST_RULES([inet], [filter_FORWARD_IN_ZONES], 0, [dnl
table inet firewalld {
chain filter_FORWARD_IN_ZONES {
ip6 saddr dead:beef::/54 goto filter_FWDI_public
- ip saddr 1.2.3.0/24 goto filter_FWDI_work
+ ip saddr 1.2.3.0/24 goto filter_FWDI_trusted
+ iifname "dummy0" goto filter_FWDI_trusted
iifname "dummy1" goto filter_FWDI_public
- iifname "dummy0" goto filter_FWDI_work
goto filter_FWDI_public
}
}
@@ -61,9 +64,9 @@ NFT_LIST_RULES([inet], [filter_FORWARD_OUT_ZONES], 0, [dnl
table inet firewalld {
chain filter_FORWARD_OUT_ZONES {
ip6 daddr dead:beef::/54 goto filter_FWDO_public
- ip daddr 1.2.3.0/24 goto filter_FWDO_work
+ ip daddr 1.2.3.0/24 goto filter_FWDO_trusted
+ oifname "dummy0" goto filter_FWDO_trusted
oifname "dummy1" goto filter_FWDO_public
- oifname "dummy0" goto filter_FWDO_work
goto filter_FWDO_public
}
}
@@ -91,9 +94,9 @@ NFT_LIST_RULES([inet], [raw_PREROUTING_ZONES], 0, [dnl
table inet firewalld {
chain raw_PREROUTING_ZONES {
ip6 saddr dead:beef::/54 goto raw_PRE_public
- ip saddr 1.2.3.0/24 goto raw_PRE_work
+ ip saddr 1.2.3.0/24 goto raw_PRE_trusted
+ iifname "dummy0" goto raw_PRE_trusted
iifname "dummy1" goto raw_PRE_public
- iifname "dummy0" goto raw_PRE_work
goto raw_PRE_public
}
}
@@ -109,9 +112,9 @@ NFT_LIST_RULES([inet], [mangle_PREROUTING_ZONES], 0, [dnl
table inet firewalld {
chain mangle_PREROUTING_ZONES {
ip6 saddr dead:beef::/54 goto mangle_PRE_public
- ip saddr 1.2.3.0/24 goto mangle_PRE_work
+ ip saddr 1.2.3.0/24 goto mangle_PRE_trusted
+ iifname "dummy0" goto mangle_PRE_trusted
iifname "dummy1" goto mangle_PRE_public
- iifname "dummy0" goto mangle_PRE_work
goto mangle_PRE_public
}
}
@@ -126,9 +129,9 @@ NFT_LIST_RULES([ip], [nat_PREROUTING], 0, [dnl
NFT_LIST_RULES([ip], [nat_PREROUTING_ZONES], 0, [dnl
table ip firewalld {
chain nat_PREROUTING_ZONES {
- ip saddr 1.2.3.0/24 goto nat_PRE_work
+ ip saddr 1.2.3.0/24 goto nat_PRE_trusted
+ iifname "dummy0" goto nat_PRE_trusted
iifname "dummy1" goto nat_PRE_public
- iifname "dummy0" goto nat_PRE_work
goto nat_PRE_public
}
}
@@ -143,9 +146,9 @@ NFT_LIST_RULES([ip], [nat_POSTROUTING], 0, [dnl
NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES], 0, [dnl
table ip firewalld {
chain nat_POSTROUTING_ZONES {
- ip daddr 1.2.3.0/24 goto nat_POST_work
+ ip daddr 1.2.3.0/24 goto nat_POST_trusted
+ oifname "dummy0" goto nat_POST_trusted
oifname "dummy1" goto nat_POST_public
- oifname "dummy0" goto nat_POST_work
goto nat_POST_public
}
}
@@ -161,8 +164,8 @@ NFT_LIST_RULES([ip6], [nat_PREROUTING_ZONES], 0, [dnl
table ip6 firewalld {
chain nat_PREROUTING_ZONES {
ip6 saddr dead:beef::/54 goto nat_PRE_public
+ iifname "dummy0" goto nat_PRE_trusted
iifname "dummy1" goto nat_PRE_public
- iifname "dummy0" goto nat_PRE_work
goto nat_PRE_public
}
}
@@ -178,8 +181,8 @@ NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES], 0, [dnl
table ip6 firewalld {
chain nat_POSTROUTING_ZONES {
ip6 daddr dead:beef::/54 goto nat_POST_public
+ oifname "dummy0" goto nat_POST_trusted
oifname "dummy1" goto nat_POST_public
- oifname "dummy0" goto nat_POST_work
goto nat_POST_public
}
}
@@ -194,9 +197,9 @@ IPTABLES_LIST_RULES([filter], [INPUT], 0, [dnl
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
])
IPTABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
- [[IN_work all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+ [[IN_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+ IN_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
- IN_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
]])
IPTABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
@@ -209,15 +212,15 @@ IPTABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
])
IPTABLES_LIST_RULES([filter], [FORWARD_IN_ZONES], 0,
- [[FWDI_work all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+ [[FWDI_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+ FWDI_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
- FWDI_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
]])
IPTABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES], 0,
- [[FWDO_work all -- 0.0.0.0/0 1.2.3.0/24 [goto]
+ [[FWDO_trusted all -- 0.0.0.0/0 1.2.3.0/24 [goto]
+ FWDO_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
- FWDO_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
]])
IPTABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
@@ -225,9 +228,9 @@ IPTABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
])
IPTABLES_LIST_RULES([raw], [PREROUTING_ZONES], 0,
- [[PRE_work all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+ [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+ PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
- PRE_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
]])
IPTABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
@@ -235,9 +238,9 @@ IPTABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
])
IPTABLES_LIST_RULES([mangle], [PREROUTING_ZONES], 0,
- [[PRE_work all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+ [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+ PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
- PRE_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
]])
IPTABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
@@ -245,9 +248,9 @@ IPTABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
])
IPTABLES_LIST_RULES([nat], [PREROUTING_ZONES], 0,
- [[PRE_work all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+ [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+ PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
- PRE_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
]])
IPTABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
@@ -255,9 +258,9 @@ IPTABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
POSTROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
])
IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
- [[POST_work all -- 0.0.0.0/0 1.2.3.0/24 [goto]
+ [[POST_trusted all -- 0.0.0.0/0 1.2.3.0/24 [goto]
+ POST_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
POST_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
- POST_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
POST_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
]])
@@ -271,8 +274,8 @@ IP6TABLES_LIST_RULES([filter], [INPUT], 0, [dnl
])
IP6TABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
[[IN_public all dead:beef::/54 ::/0 [goto]
+ IN_trusted all ::/0 ::/0 [goto]
IN_public all ::/0 ::/0 [goto]
- IN_work all ::/0 ::/0 [goto]
IN_public all ::/0 ::/0 [goto]
]])
IP6TABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
@@ -287,14 +290,14 @@ IP6TABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
])
IP6TABLES_LIST_RULES([filter], [FORWARD_IN_ZONES], 0,
[[FWDI_public all dead:beef::/54 ::/0 [goto]
+ FWDI_trusted all ::/0 ::/0 [goto]
FWDI_public all ::/0 ::/0 [goto]
- FWDI_work all ::/0 ::/0 [goto]
FWDI_public all ::/0 ::/0 [goto]
]])
IP6TABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES], 0,
[[FWDO_public all ::/0 dead:beef::/54 [goto]
+ FWDO_trusted all ::/0 ::/0 [goto]
FWDO_public all ::/0 ::/0 [goto]
- FWDO_work all ::/0 ::/0 [goto]
FWDO_public all ::/0 ::/0 [goto]
]])
IP6TABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
@@ -306,8 +309,8 @@ IP6TABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
])
IP6TABLES_LIST_RULES([raw], [PREROUTING_ZONES], 0,
[[PRE_public all dead:beef::/54 ::/0 [goto]
+ PRE_trusted all ::/0 ::/0 [goto]
PRE_public all ::/0 ::/0 [goto]
- PRE_work all ::/0 ::/0 [goto]
PRE_public all ::/0 ::/0 [goto]
]])
IP6TABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
@@ -316,8 +319,8 @@ IP6TABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
])
IP6TABLES_LIST_RULES([mangle], [PREROUTING_ZONES], 0,
[[PRE_public all dead:beef::/54 ::/0 [goto]
+ PRE_trusted all ::/0 ::/0 [goto]
PRE_public all ::/0 ::/0 [goto]
- PRE_work all ::/0 ::/0 [goto]
PRE_public all ::/0 ::/0 [goto]
]])
IP6TABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
@@ -326,8 +329,8 @@ IP6TABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
])
IP6TABLES_LIST_RULES([nat], [PREROUTING_ZONES], 0,
[[PRE_public all dead:beef::/54 ::/0 [goto]
+ PRE_trusted all ::/0 ::/0 [goto]
PRE_public all ::/0 ::/0 [goto]
- PRE_work all ::/0 ::/0 [goto]
PRE_public all ::/0 ::/0 [goto]
]])
IP6TABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
@@ -336,9 +339,456 @@ IP6TABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
])
IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
[[POST_public all ::/0 dead:beef::/54 [goto]
+ POST_trusted all ::/0 ::/0 [goto]
+ POST_public all ::/0 ::/0 [goto]
+ POST_public all ::/0 ::/0 [goto]
+]])
+
+dnl ##########################################################################
+dnl ##########################################################################
+dnl We also support zone drifting in which source based zones fall through to
+dnl interface based zones (including default zone).
+dnl ##########################################################################
+dnl ##########################################################################
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=yes/' ./firewalld.conf])
+FWD_RELOAD
+
+NFT_LIST_RULES([inet], [filter_INPUT], 0, [dnl
+ table inet firewalld {
+ chain filter_INPUT {
+ ct state established,related accept
+ ct status dnat accept
+ iifname "lo" accept
+ jump filter_INPUT_ZONES_SOURCE
+ jump filter_INPUT_ZONES
+ ct state invalid drop
+ reject with icmpx type admin-prohibited
+ }
+ }
+])
+NFT_LIST_RULES([inet], [filter_INPUT_ZONES_SOURCE], 0, [dnl
+ table inet firewalld {
+ chain filter_INPUT_ZONES_SOURCE {
+ ip6 saddr dead:beef::/54 goto filter_IN_public
+ ip saddr 1.2.3.0/24 goto filter_IN_trusted
+ }
+ }
+])
+NFT_LIST_RULES([inet], [filter_INPUT_ZONES], 0, [dnl
+ table inet firewalld {
+ chain filter_INPUT_ZONES {
+ iifname "dummy0" goto filter_IN_trusted
+ iifname "dummy1" goto filter_IN_public
+ goto filter_IN_public
+ }
+ }
+])
+NFT_LIST_RULES([inet], [filter_FORWARD], 0, [dnl
+ table inet firewalld {
+ chain filter_FORWARD {
+ ct state established,related accept
+ ct status dnat accept
+ iifname "lo" accept
+ ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 type addr-unreachable
+ jump filter_FORWARD_IN_ZONES_SOURCE
+ jump filter_FORWARD_IN_ZONES
+ jump filter_FORWARD_OUT_ZONES_SOURCE
+ jump filter_FORWARD_OUT_ZONES
+ ct state invalid drop
+ reject with icmpx type admin-prohibited
+ }
+ }
+])
+NFT_LIST_RULES([inet], [filter_FORWARD_IN_ZONES_SOURCE], 0, [dnl
+ table inet firewalld {
+ chain filter_FORWARD_IN_ZONES_SOURCE {
+ ip6 saddr dead:beef::/54 goto filter_FWDI_public
+ ip saddr 1.2.3.0/24 goto filter_FWDI_trusted
+ }
+ }
+])
+NFT_LIST_RULES([inet], [filter_FORWARD_IN_ZONES], 0, [dnl
+ table inet firewalld {
+ chain filter_FORWARD_IN_ZONES {
+ iifname "dummy0" goto filter_FWDI_trusted
+ iifname "dummy1" goto filter_FWDI_public
+ goto filter_FWDI_public
+ }
+ }
+])
+NFT_LIST_RULES([inet], [filter_FORWARD_OUT_ZONES_SOURCE], 0, [dnl
+ table inet firewalld {
+ chain filter_FORWARD_OUT_ZONES_SOURCE {
+ ip6 daddr dead:beef::/54 goto filter_FWDO_public
+ ip daddr 1.2.3.0/24 goto filter_FWDO_trusted
+ }
+ }
+])
+NFT_LIST_RULES([inet], [filter_FORWARD_OUT_ZONES], 0, [dnl
+ table inet firewalld {
+ chain filter_FORWARD_OUT_ZONES {
+ oifname "dummy0" goto filter_FWDO_trusted
+ oifname "dummy1" goto filter_FWDO_public
+ goto filter_FWDO_public
+ }
+ }
+])
+IF_HOST_SUPPORTS_NFT_FIB([
+ NFT_LIST_RULES([inet], [raw_PREROUTING], 0, [dnl
+ table inet firewalld {
+ chain raw_PREROUTING {
+ icmpv6 type { nd-router-advert, nd-neighbor-solicit } accept
+ meta nfproto ipv6 fib saddr . iif oif missing drop
+ jump raw_PREROUTING_ZONES_SOURCE
+ jump raw_PREROUTING_ZONES
+ }
+ }
+ ])
+], [
+ NFT_LIST_RULES([inet], [raw_PREROUTING], 0, [dnl
+ table inet firewalld {
+ chain raw_PREROUTING {
+ jump raw_PREROUTING_ZONES_SOURCE
+ jump raw_PREROUTING_ZONES
+ }
+ }
+ ])
+])
+NFT_LIST_RULES([inet], [raw_PREROUTING_ZONES_SOURCE], 0, [dnl
+ table inet firewalld {
+ chain raw_PREROUTING_ZONES_SOURCE {
+ ip6 saddr dead:beef::/54 goto raw_PRE_public
+ ip saddr 1.2.3.0/24 goto raw_PRE_trusted
+ }
+ }
+])
+NFT_LIST_RULES([inet], [raw_PREROUTING_ZONES], 0, [dnl
+ table inet firewalld {
+ chain raw_PREROUTING_ZONES {
+ iifname "dummy0" goto raw_PRE_trusted
+ iifname "dummy1" goto raw_PRE_public
+ goto raw_PRE_public
+ }
+ }
+])
+NFT_LIST_RULES([inet], [mangle_PREROUTING], 0, [dnl
+ table inet firewalld {
+ chain mangle_PREROUTING {
+ jump mangle_PREROUTING_ZONES_SOURCE
+ jump mangle_PREROUTING_ZONES
+ }
+ }
+])
+NFT_LIST_RULES([inet], [mangle_PREROUTING_ZONES_SOURCE], 0, [dnl
+ table inet firewalld {
+ chain mangle_PREROUTING_ZONES_SOURCE {
+ ip6 saddr dead:beef::/54 goto mangle_PRE_public
+ ip saddr 1.2.3.0/24 goto mangle_PRE_trusted
+ }
+ }
+])
+NFT_LIST_RULES([inet], [mangle_PREROUTING_ZONES], 0, [dnl
+ table inet firewalld {
+ chain mangle_PREROUTING_ZONES {
+ iifname "dummy0" goto mangle_PRE_trusted
+ iifname "dummy1" goto mangle_PRE_public
+ goto mangle_PRE_public
+ }
+ }
+])
+NFT_LIST_RULES([ip], [nat_PREROUTING], 0, [dnl
+ table ip firewalld {
+ chain nat_PREROUTING {
+ jump nat_PREROUTING_ZONES_SOURCE
+ jump nat_PREROUTING_ZONES
+ }
+ }
+])
+NFT_LIST_RULES([ip], [nat_PREROUTING_ZONES_SOURCE], 0, [dnl
+ table ip firewalld {
+ chain nat_PREROUTING_ZONES_SOURCE {
+ ip saddr 1.2.3.0/24 goto nat_PRE_trusted
+ }
+ }
+])
+NFT_LIST_RULES([ip], [nat_PREROUTING_ZONES], 0, [dnl
+ table ip firewalld {
+ chain nat_PREROUTING_ZONES {
+ iifname "dummy0" goto nat_PRE_trusted
+ iifname "dummy1" goto nat_PRE_public
+ goto nat_PRE_public
+ }
+ }
+])
+NFT_LIST_RULES([ip], [nat_POSTROUTING], 0, [dnl
+ table ip firewalld {
+ chain nat_POSTROUTING {
+ jump nat_POSTROUTING_ZONES_SOURCE
+ jump nat_POSTROUTING_ZONES
+ }
+ }
+])
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES_SOURCE], 0, [dnl
+ table ip firewalld {
+ chain nat_POSTROUTING_ZONES_SOURCE {
+ ip daddr 1.2.3.0/24 goto nat_POST_trusted
+ }
+ }
+])
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES], 0, [dnl
+ table ip firewalld {
+ chain nat_POSTROUTING_ZONES {
+ oifname "dummy0" goto nat_POST_trusted
+ oifname "dummy1" goto nat_POST_public
+ goto nat_POST_public
+ }
+ }
+])
+NFT_LIST_RULES([ip6], [nat_PREROUTING], 0, [dnl
+ table ip6 firewalld {
+ chain nat_PREROUTING {
+ jump nat_PREROUTING_ZONES_SOURCE
+ jump nat_PREROUTING_ZONES
+ }
+ }
+])
+NFT_LIST_RULES([ip6], [nat_PREROUTING_ZONES_SOURCE], 0, [dnl
+ table ip6 firewalld {
+ chain nat_PREROUTING_ZONES_SOURCE {
+ ip6 saddr dead:beef::/54 goto nat_PRE_public
+ }
+ }
+])
+NFT_LIST_RULES([ip6], [nat_PREROUTING_ZONES], 0, [dnl
+ table ip6 firewalld {
+ chain nat_PREROUTING_ZONES {
+ iifname "dummy0" goto nat_PRE_trusted
+ iifname "dummy1" goto nat_PRE_public
+ goto nat_PRE_public
+ }
+ }
+])
+NFT_LIST_RULES([ip6], [nat_POSTROUTING], 0, [dnl
+ table ip6 firewalld {
+ chain nat_POSTROUTING {
+ jump nat_POSTROUTING_ZONES_SOURCE
+ jump nat_POSTROUTING_ZONES
+ }
+ }
+])
+NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES_SOURCE], 0, [dnl
+ table ip6 firewalld {
+ chain nat_POSTROUTING_ZONES_SOURCE {
+ ip6 daddr dead:beef::/54 goto nat_POST_public
+ }
+ }
+])
+NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES], 0, [dnl
+ table ip6 firewalld {
+ chain nat_POSTROUTING_ZONES {
+ oifname "dummy0" goto nat_POST_trusted
+ oifname "dummy1" goto nat_POST_public
+ goto nat_POST_public
+ }
+ }
+])
+
+IPTABLES_LIST_RULES([filter], [INPUT], 0, [dnl
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
+ INPUT_direct all -- 0.0.0.0/0 0.0.0.0/0
+ INPUT_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
+ INPUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+ DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
+ REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
+])
+IPTABLES_LIST_RULES([filter], [INPUT_ZONES_SOURCE], 0,
+ [[IN_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
+ [[IN_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
+ FORWARD_direct all -- 0.0.0.0/0 0.0.0.0/0
+ FORWARD_IN_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
+ FORWARD_IN_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+ FORWARD_OUT_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
+ FORWARD_OUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+ DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
+ REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
+])
+IPTABLES_LIST_RULES([filter], [FORWARD_IN_ZONES_SOURCE], 0,
+ [[FWDI_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([filter], [FORWARD_IN_ZONES], 0,
+ [[FWDI_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES_SOURCE], 0,
+ [[FWDO_trusted all -- 0.0.0.0/0 1.2.3.0/24 [goto]
+]])
+IPTABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES], 0,
+ [[FWDO_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
+ PREROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
+ PREROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
+ PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+])
+IPTABLES_LIST_RULES([raw], [PREROUTING_ZONES_SOURCE], 0,
+ [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([raw], [PREROUTING_ZONES], 0,
+ [[PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
+ PREROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
+ PREROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
+ PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+])
+IPTABLES_LIST_RULES([mangle], [PREROUTING_ZONES_SOURCE], 0,
+ [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([mangle], [PREROUTING_ZONES], 0,
+ [[PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
+ PREROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
+ PREROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
+ PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+])
+IPTABLES_LIST_RULES([nat], [PREROUTING_ZONES_SOURCE], 0,
+ [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([nat], [PREROUTING_ZONES], 0,
+ [[PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
+ POSTROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
+ POSTROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
+ POSTROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+])
+IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES_SOURCE], 0,
+ [[POST_trusted all -- 0.0.0.0/0 1.2.3.0/24 [goto]
+]])
+IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
+ [[POST_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ POST_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ POST_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+
+IP6TABLES_LIST_RULES([filter], [INPUT], 0, [dnl
+ ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT
+ ACCEPT all ::/0 ::/0
+ INPUT_direct all ::/0 ::/0
+ INPUT_ZONES_SOURCE all ::/0 ::/0
+ INPUT_ZONES all ::/0 ::/0
+ DROP all ::/0 ::/0 ctstate INVALID
+ REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
+])
+IP6TABLES_LIST_RULES([filter], [INPUT_ZONES_SOURCE], 0,
+ [[IN_public all dead:beef::/54 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
+ [[IN_trusted all ::/0 ::/0 [goto]
+ IN_public all ::/0 ::/0 [goto]
+ IN_public all ::/0 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
+ ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT
+ ACCEPT all ::/0 ::/0
+ FORWARD_direct all ::/0 ::/0
+ RFC3964_IPv4 all ::/0 ::/0
+ FORWARD_IN_ZONES_SOURCE all ::/0 ::/0
+ FORWARD_IN_ZONES all ::/0 ::/0
+ FORWARD_OUT_ZONES_SOURCE all ::/0 ::/0
+ FORWARD_OUT_ZONES all ::/0 ::/0
+ DROP all ::/0 ::/0 ctstate INVALID
+ REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
+])
+IP6TABLES_LIST_RULES([filter], [FORWARD_IN_ZONES_SOURCE], 0,
+ [[FWDI_public all dead:beef::/54 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([filter], [FORWARD_IN_ZONES], 0,
+ [[FWDI_trusted all ::/0 ::/0 [goto]
+ FWDI_public all ::/0 ::/0 [goto]
+ FWDI_public all ::/0 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES_SOURCE], 0,
+ [[FWDO_public all ::/0 dead:beef::/54 [goto]
+]])
+IP6TABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES], 0,
+ [[FWDO_trusted all ::/0 ::/0 [goto]
+ FWDO_public all ::/0 ::/0 [goto]
+ FWDO_public all ::/0 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
+ ACCEPT icmpv6 ::/0 ::/0 ipv6-icmptype 134
+ ACCEPT icmpv6 ::/0 ::/0 ipv6-icmptype 135
+ DROP all ::/0 ::/0 rpfilter invert
+ PREROUTING_direct all ::/0 ::/0
+ PREROUTING_ZONES_SOURCE all ::/0 ::/0
+ PREROUTING_ZONES all ::/0 ::/0
+])
+IP6TABLES_LIST_RULES([raw], [PREROUTING_ZONES_SOURCE], 0,
+ [[PRE_public all dead:beef::/54 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([raw], [PREROUTING_ZONES], 0,
+ [[PRE_trusted all ::/0 ::/0 [goto]
+ PRE_public all ::/0 ::/0 [goto]
+ PRE_public all ::/0 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
+ PREROUTING_direct all ::/0 ::/0
+ PREROUTING_ZONES_SOURCE all ::/0 ::/0
+ PREROUTING_ZONES all ::/0 ::/0
+])
+IP6TABLES_LIST_RULES([mangle], [PREROUTING_ZONES_SOURCE], 0,
+ [[PRE_public all dead:beef::/54 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([mangle], [PREROUTING_ZONES], 0,
+ [[PRE_trusted all ::/0 ::/0 [goto]
+ PRE_public all ::/0 ::/0 [goto]
+ PRE_public all ::/0 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
+ PREROUTING_direct all ::/0 ::/0
+ PREROUTING_ZONES_SOURCE all ::/0 ::/0
+ PREROUTING_ZONES all ::/0 ::/0
+])
+IP6TABLES_LIST_RULES([nat], [PREROUTING_ZONES_SOURCE], 0,
+ [[PRE_public all dead:beef::/54 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([nat], [PREROUTING_ZONES], 0,
+ [[PRE_trusted all ::/0 ::/0 [goto]
+ PRE_public all ::/0 ::/0 [goto]
+ PRE_public all ::/0 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
+ POSTROUTING_direct all ::/0 ::/0
+ POSTROUTING_ZONES_SOURCE all ::/0 ::/0
+ POSTROUTING_ZONES all ::/0 ::/0
+])
+IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES_SOURCE], 0,
+ [[POST_public all ::/0 dead:beef::/54 [goto]
+]])
+IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
+ [[POST_trusted all ::/0 ::/0 [goto]
POST_public all ::/0 ::/0 [goto]
- POST_work all ::/0 ::/0 [goto]
POST_public all ::/0 ::/0 [goto]
]])
-FWD_END_TEST
+FWD_END_TEST([-e '/WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now./d'])
diff --git a/src/tests/regression/rhbz1734765.at b/src/tests/regression/rhbz1734765.at
index 972457e3126e..bb054bdb0361 100644
--- a/src/tests/regression/rhbz1734765.at
+++ b/src/tests/regression/rhbz1734765.at
@@ -1,9 +1,12 @@
FWD_START_TEST([zone sources ordered by name])
-AT_KEYWORDS(zone rhbz1734765 rhbz1421222 gh166 rhbz1738545)
+AT_KEYWORDS(zone rhbz1734765 rhbz1421222 gh166 rhbz1738545 rhbz1772208 rhbz1796055)
dnl
dnl Users depend on firewalld ordering source-based zone dispatch by zone name.
dnl
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=no/' ./firewalld.conf])
+FWD_RELOAD
+
FWD_CHECK([-q --permanent --new-zone=foobar_00])
FWD_CHECK([-q --permanent --new-zone=foobar_05])
FWD_CHECK([-q --permanent --new-zone=foobar_02])
@@ -196,4 +199,177 @@ IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
POST_public all ::/0 ::/0 [goto]
]])
-FWD_END_TEST
+dnl ##########################################################################
+dnl ##########################################################################
+dnl We also support zone drifting in which source based zones fall through to
+dnl interface based zones (including default zone). So make sure the zones are
+dnl sorted by name in this mode.
+dnl ##########################################################################
+dnl ##########################################################################
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=yes/' ./firewalld.conf])
+FWD_RELOAD
+
+FWD_CHECK([-q --zone=foobar_010 --add-source="10.10.10.10"])
+FWD_CHECK([-q --zone=public --add-source="20.20.20.20"])
+IF_HOST_SUPPORTS_IPV6_RULES([
+FWD_CHECK([-q --zone=foobar_010 --add-source="1234:5678::10:10:10"])
+FWD_CHECK([-q --zone=public --add-source="1234:5678::20:20:20"])
+FWD_CHECK([-q --zone=foobar_012 --add-source ipset:ipsetv6])
+])
+FWD_CHECK([-q --zone=foobar_010 --add-interface=foobar2])
+
+NFT_LIST_RULES([inet], [filter_INPUT_ZONES_SOURCE], 0, [dnl
+ table inet firewalld {
+ chain filter_INPUT_ZONES_SOURCE {
+ ip saddr 10.1.1.1 goto filter_IN_foobar_00
+ ip6 saddr 1234:5678::1:1:1 goto filter_IN_foobar_00
+ ip saddr 10.1.1.0/24 goto filter_IN_foobar_01
+ ip6 saddr 1234:5678::1:1:0/112 goto filter_IN_foobar_01
+ ip saddr 10.10.10.10 goto filter_IN_foobar_010
+ ip6 saddr 1234:5678::10:10:10 goto filter_IN_foobar_010
+ ip saddr @ipsetv4 goto filter_IN_foobar_011
+ ip6 saddr @ipsetv6 goto filter_IN_foobar_012
+ ip saddr 10.1.0.0/16 goto filter_IN_foobar_02
+ ip6 saddr 1234:5678::1:0:0/96 goto filter_IN_foobar_02
+ ip saddr 10.2.2.0/24 goto filter_IN_foobar_03
+ ip6 saddr 1234:5678::2:2:0/112 goto filter_IN_foobar_03
+ ip saddr 10.2.0.0/16 goto filter_IN_foobar_04
+ ip6 saddr 1234:5678::2:0:0/96 goto filter_IN_foobar_04
+ ip saddr 10.0.0.0/8 goto filter_IN_foobar_05
+ ip6 saddr 1234:5678::/80 goto filter_IN_foobar_05
+ ip saddr 20.20.20.20 goto filter_IN_public
+ ip6 saddr 1234:5678::20:20:20 goto filter_IN_public
+ }
+ }
+])
+NFT_LIST_RULES([inet], [filter_INPUT_ZONES], 0, [dnl
+ table inet firewalld {
+ chain filter_INPUT_ZONES {
+ iifname "foobar2" goto filter_IN_foobar_010
+ iifname "foobar1" goto filter_IN_trusted
+ iifname "foobar0" goto filter_IN_internal
+ goto filter_IN_public
+ }
+ }
+])
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES_SOURCE], 0, [dnl
+ table ip firewalld {
+ chain nat_POSTROUTING_ZONES_SOURCE {
+ ip daddr 10.1.1.1 goto nat_POST_foobar_00
+ ip daddr 10.1.1.0/24 goto nat_POST_foobar_01
+ ip daddr 10.10.10.10 goto nat_POST_foobar_010
+ ip daddr @ipsetv4 goto nat_POST_foobar_011
+ ip daddr 10.1.0.0/16 goto nat_POST_foobar_02
+ ip daddr 10.2.2.0/24 goto nat_POST_foobar_03
+ ip daddr 10.2.0.0/16 goto nat_POST_foobar_04
+ ip daddr 10.0.0.0/8 goto nat_POST_foobar_05
+ ip daddr 20.20.20.20 goto nat_POST_public
+ }
+ }
+])
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES], 0, [dnl
+ table ip firewalld {
+ chain nat_POSTROUTING_ZONES {
+ oifname "foobar2" goto nat_POST_foobar_010
+ oifname "foobar1" goto nat_POST_trusted
+ oifname "foobar0" goto nat_POST_internal
+ goto nat_POST_public
+ }
+ }
+])
+NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES_SOURCE], 0, [dnl
+ table ip6 firewalld {
+ chain nat_POSTROUTING_ZONES_SOURCE {
+ ip6 daddr 1234:5678::1:1:1 goto nat_POST_foobar_00
+ ip6 daddr 1234:5678::1:1:0/112 goto nat_POST_foobar_01
+ ip6 daddr 1234:5678::10:10:10 goto nat_POST_foobar_010
+ ip6 daddr @ipsetv6 goto nat_POST_foobar_012
+ ip6 daddr 1234:5678::1:0:0/96 goto nat_POST_foobar_02
+ ip6 daddr 1234:5678::2:2:0/112 goto nat_POST_foobar_03
+ ip6 daddr 1234:5678::2:0:0/96 goto nat_POST_foobar_04
+ ip6 daddr 1234:5678::/80 goto nat_POST_foobar_05
+ ip6 daddr 1234:5678::20:20:20 goto nat_POST_public
+ }
+ }
+])
+NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES], 0, [dnl
+ table ip6 firewalld {
+ chain nat_POSTROUTING_ZONES {
+ oifname "foobar2" goto nat_POST_foobar_010
+ oifname "foobar1" goto nat_POST_trusted
+ oifname "foobar0" goto nat_POST_internal
+ goto nat_POST_public
+ }
+ }
+])
+
+IPTABLES_LIST_RULES([filter], [INPUT_ZONES_SOURCE], 0,
+ [[IN_foobar_00 all -- 10.1.1.1 0.0.0.0/0 [goto]
+ IN_foobar_01 all -- 10.1.1.0/24 0.0.0.0/0 [goto]
+ IN_foobar_010 all -- 10.10.10.10 0.0.0.0/0 [goto]
+ IN_foobar_011 all -- 0.0.0.0/0 0.0.0.0/0 [goto] match-set ipsetv4 src
+ IN_foobar_02 all -- 10.1.0.0/16 0.0.0.0/0 [goto]
+ IN_foobar_03 all -- 10.2.2.0/24 0.0.0.0/0 [goto]
+ IN_foobar_04 all -- 10.2.0.0/16 0.0.0.0/0 [goto]
+ IN_foobar_05 all -- 10.0.0.0/8 0.0.0.0/0 [goto]
+ IN_public all -- 20.20.20.20 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
+ [[IN_foobar_010 all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ IN_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ IN_internal all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IP6TABLES_LIST_RULES([filter], [INPUT_ZONES_SOURCE], 0,
+ [[IN_foobar_00 all 1234:5678::1:1:1 ::/0 [goto]
+ IN_foobar_01 all 1234:5678::1:1:0/112 ::/0 [goto]
+ IN_foobar_010 all 1234:5678::10:10:10 ::/0 [goto]
+ IN_foobar_012 all ::/0 ::/0 [goto] match-set ipsetv6 src
+ IN_foobar_02 all 1234:5678::1:0:0/96 ::/0 [goto]
+ IN_foobar_03 all 1234:5678::2:2:0/112 ::/0 [goto]
+ IN_foobar_04 all 1234:5678::2:0:0/96 ::/0 [goto]
+ IN_foobar_05 all 1234:5678::/80 ::/0 [goto]
+ IN_public all 1234:5678::20:20:20 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
+ [[IN_foobar_010 all ::/0 ::/0 [goto]
+ IN_trusted all ::/0 ::/0 [goto]
+ IN_internal all ::/0 ::/0 [goto]
+ IN_public all ::/0 ::/0 [goto]
+]])
+IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES_SOURCE], 0,
+ [[POST_foobar_00 all -- 0.0.0.0/0 10.1.1.1 [goto]
+ POST_foobar_01 all -- 0.0.0.0/0 10.1.1.0/24 [goto]
+ POST_foobar_010 all -- 0.0.0.0/0 10.10.10.10 [goto]
+ POST_foobar_011 all -- 0.0.0.0/0 0.0.0.0/0 [goto] match-set ipsetv4 dst
+ POST_foobar_02 all -- 0.0.0.0/0 10.1.0.0/16 [goto]
+ POST_foobar_03 all -- 0.0.0.0/0 10.2.2.0/24 [goto]
+ POST_foobar_04 all -- 0.0.0.0/0 10.2.0.0/16 [goto]
+ POST_foobar_05 all -- 0.0.0.0/0 10.0.0.0/8 [goto]
+ POST_public all -- 0.0.0.0/0 20.20.20.20 [goto]
+]])
+IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
+ [[POST_foobar_010 all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ POST_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ POST_internal all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+ POST_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES_SOURCE], 0,
+ [[POST_foobar_00 all ::/0 1234:5678::1:1:1 [goto]
+ POST_foobar_01 all ::/0 1234:5678::1:1:0/112 [goto]
+ POST_foobar_010 all ::/0 1234:5678::10:10:10 [goto]
+ POST_foobar_012 all ::/0 ::/0 [goto] match-set ipsetv6 dst
+ POST_foobar_02 all ::/0 1234:5678::1:0:0/96 [goto]
+ POST_foobar_03 all ::/0 1234:5678::2:2:0/112 [goto]
+ POST_foobar_04 all ::/0 1234:5678::2:0:0/96 [goto]
+ POST_foobar_05 all ::/0 1234:5678::/80 [goto]
+ POST_public all ::/0 1234:5678::20:20:20 [goto]
+]])
+IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
+ [[POST_foobar_010 all ::/0 ::/0 [goto]
+ POST_trusted all ::/0 ::/0 [goto]
+ POST_internal all ::/0 ::/0 [goto]
+ POST_public all ::/0 ::/0 [goto]
+]])
+
+FWD_END_TEST([-e '/WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now./d'])
--
2.23.0