Blob Blame History Raw
From 3e3369ef14f4eba22a5c37113ba6d5e19c7ebc24 Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life>
Date: Sun, 19 Jan 2020 16:49:14 -0500
Subject: [PATCH 33/37] test: verify AllowZoneDrifting=yes

Verify the zone dispatch layout.

(cherry picked from commit bca4e6af91fc4c6a55f7c2bce9e4fe7bcee526a1)
(cherry picked from commit 8f9ba9bc80f039408992e1b780bca0beab8bd92c)
---
 src/tests/regression/gh258.at       | 536 +++++++++++++++++++++++++---
 src/tests/regression/rhbz1734765.at | 180 +++++++++-
 2 files changed, 671 insertions(+), 45 deletions(-)

diff --git a/src/tests/regression/gh258.at b/src/tests/regression/gh258.at
index 4bbea4c25442..d414c611fa26 100644
--- a/src/tests/regression/gh258.at
+++ b/src/tests/regression/gh258.at
@@ -1,12 +1,15 @@
 FWD_START_TEST([zone dispatch layout])
-AT_KEYWORDS(zone gh258 gh441 rhbz1713823)
+AT_KEYWORDS(zone gh258 gh441 rhbz1713823 rhbz1772208 rhbz1796055)
 
-FWD_CHECK([--zone=work --add-source="1.2.3.0/24"], 0, ignore)
+FWD_CHECK([--permanent --zone=trusted --add-source="1.2.3.0/24"], 0, ignore)
 IF_HOST_SUPPORTS_IPV6_RULES([
-FWD_CHECK([--zone=public --add-source="dead:beef::/54"], 0, ignore)
+FWD_CHECK([--permanent --zone=public --add-source="dead:beef::/54"], 0, ignore)
 ])
-FWD_CHECK([--zone=work --add-interface=dummy0], 0, ignore)
-FWD_CHECK([--zone=public --add-interface=dummy1], 0, ignore)
+FWD_CHECK([--permanent --zone=trusted --add-interface=dummy0], 0, ignore)
+FWD_CHECK([--permanent --zone=public --add-interface=dummy1], 0, ignore)
+
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=no/' ./firewalld.conf])
+FWD_RELOAD
 
 dnl verify layout of zone dispatch
 NFT_LIST_RULES([inet], [filter_INPUT], 0, [dnl
@@ -25,9 +28,9 @@ NFT_LIST_RULES([inet], [filter_INPUT_ZONES], 0, [dnl
     table inet firewalld {
         chain filter_INPUT_ZONES {
             ip6 saddr dead:beef::/54 goto filter_IN_public
-            ip saddr 1.2.3.0/24 goto filter_IN_work
+            ip saddr 1.2.3.0/24 goto filter_IN_trusted
+            iifname "dummy0" goto filter_IN_trusted
             iifname "dummy1" goto filter_IN_public
-            iifname "dummy0" goto filter_IN_work
             goto filter_IN_public
         }
     }
@@ -50,9 +53,9 @@ NFT_LIST_RULES([inet], [filter_FORWARD_IN_ZONES], 0, [dnl
     table inet firewalld {
         chain filter_FORWARD_IN_ZONES {
             ip6 saddr dead:beef::/54 goto filter_FWDI_public
-            ip saddr 1.2.3.0/24 goto filter_FWDI_work
+            ip saddr 1.2.3.0/24 goto filter_FWDI_trusted
+            iifname "dummy0" goto filter_FWDI_trusted
             iifname "dummy1" goto filter_FWDI_public
-            iifname "dummy0" goto filter_FWDI_work
             goto filter_FWDI_public
         }
     }
@@ -61,9 +64,9 @@ NFT_LIST_RULES([inet], [filter_FORWARD_OUT_ZONES], 0, [dnl
     table inet firewalld {
         chain filter_FORWARD_OUT_ZONES {
             ip6 daddr dead:beef::/54 goto filter_FWDO_public
-            ip daddr 1.2.3.0/24 goto filter_FWDO_work
+            ip daddr 1.2.3.0/24 goto filter_FWDO_trusted
+            oifname "dummy0" goto filter_FWDO_trusted
             oifname "dummy1" goto filter_FWDO_public
-            oifname "dummy0" goto filter_FWDO_work
             goto filter_FWDO_public
         }
     }
@@ -91,9 +94,9 @@ NFT_LIST_RULES([inet], [raw_PREROUTING_ZONES], 0, [dnl
     table inet firewalld {
         chain raw_PREROUTING_ZONES {
             ip6 saddr dead:beef::/54 goto raw_PRE_public
-            ip saddr 1.2.3.0/24 goto raw_PRE_work
+            ip saddr 1.2.3.0/24 goto raw_PRE_trusted
+            iifname "dummy0" goto raw_PRE_trusted
             iifname "dummy1" goto raw_PRE_public
-            iifname "dummy0" goto raw_PRE_work
             goto raw_PRE_public
         }
     }
@@ -109,9 +112,9 @@ NFT_LIST_RULES([inet], [mangle_PREROUTING_ZONES], 0, [dnl
     table inet firewalld {
         chain mangle_PREROUTING_ZONES {
             ip6 saddr dead:beef::/54 goto mangle_PRE_public
-            ip saddr 1.2.3.0/24 goto mangle_PRE_work
+            ip saddr 1.2.3.0/24 goto mangle_PRE_trusted
+            iifname "dummy0" goto mangle_PRE_trusted
             iifname "dummy1" goto mangle_PRE_public
-            iifname "dummy0" goto mangle_PRE_work
             goto mangle_PRE_public
         }
     }
@@ -126,9 +129,9 @@ NFT_LIST_RULES([ip], [nat_PREROUTING], 0, [dnl
 NFT_LIST_RULES([ip], [nat_PREROUTING_ZONES], 0, [dnl
     table ip firewalld {
         chain nat_PREROUTING_ZONES {
-            ip saddr 1.2.3.0/24 goto nat_PRE_work
+            ip saddr 1.2.3.0/24 goto nat_PRE_trusted
+            iifname "dummy0" goto nat_PRE_trusted
             iifname "dummy1" goto nat_PRE_public
-            iifname "dummy0" goto nat_PRE_work
             goto nat_PRE_public
         }
     }
@@ -143,9 +146,9 @@ NFT_LIST_RULES([ip], [nat_POSTROUTING], 0, [dnl
 NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES], 0, [dnl
     table ip firewalld {
         chain nat_POSTROUTING_ZONES {
-            ip daddr 1.2.3.0/24 goto nat_POST_work
+            ip daddr 1.2.3.0/24 goto nat_POST_trusted
+            oifname "dummy0" goto nat_POST_trusted
             oifname "dummy1" goto nat_POST_public
-            oifname "dummy0" goto nat_POST_work
             goto nat_POST_public
         }
     }
@@ -161,8 +164,8 @@ NFT_LIST_RULES([ip6], [nat_PREROUTING_ZONES], 0, [dnl
     table ip6 firewalld {
         chain nat_PREROUTING_ZONES {
             ip6 saddr dead:beef::/54 goto nat_PRE_public
+            iifname "dummy0" goto nat_PRE_trusted
             iifname "dummy1" goto nat_PRE_public
-            iifname "dummy0" goto nat_PRE_work
             goto nat_PRE_public
         }
     }
@@ -178,8 +181,8 @@ NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES], 0, [dnl
     table ip6 firewalld {
         chain nat_POSTROUTING_ZONES {
             ip6 daddr dead:beef::/54 goto nat_POST_public
+            oifname "dummy0" goto nat_POST_trusted
             oifname "dummy1" goto nat_POST_public
-            oifname "dummy0" goto nat_POST_work
             goto nat_POST_public
         }
     }
@@ -194,9 +197,9 @@ IPTABLES_LIST_RULES([filter], [INPUT], 0, [dnl
     REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
 ])
 IPTABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
-  [[IN_work all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+  [[IN_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+    IN_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
     IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
-    IN_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
     IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
 ]])
 IPTABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
@@ -209,15 +212,15 @@ IPTABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
     REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
 ])
 IPTABLES_LIST_RULES([filter], [FORWARD_IN_ZONES], 0,
-  [[FWDI_work all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+  [[FWDI_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+    FWDI_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
     FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
-    FWDI_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
     FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
 ]])
 IPTABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES], 0,
-  [[FWDO_work all -- 0.0.0.0/0 1.2.3.0/24 [goto]
+  [[FWDO_trusted all -- 0.0.0.0/0 1.2.3.0/24 [goto]
+    FWDO_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
     FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
-    FWDO_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
     FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
 ]])
 IPTABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
@@ -225,9 +228,9 @@ IPTABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
     PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
 ])
 IPTABLES_LIST_RULES([raw], [PREROUTING_ZONES], 0,
-  [[PRE_work all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+  [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+    PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
     PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
-    PRE_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
     PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
 ]])
 IPTABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
@@ -235,9 +238,9 @@ IPTABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
     PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
 ])
 IPTABLES_LIST_RULES([mangle], [PREROUTING_ZONES], 0,
-  [[PRE_work all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+  [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+    PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
     PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
-    PRE_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
     PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
 ]])
 IPTABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
@@ -245,9 +248,9 @@ IPTABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
     PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
 ])
 IPTABLES_LIST_RULES([nat], [PREROUTING_ZONES], 0,
-  [[PRE_work all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+  [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+    PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
     PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
-    PRE_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
     PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
 ]])
 IPTABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
@@ -255,9 +258,9 @@ IPTABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
     POSTROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
 ])
 IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
-  [[POST_work all -- 0.0.0.0/0 1.2.3.0/24 [goto]
+  [[POST_trusted all -- 0.0.0.0/0 1.2.3.0/24 [goto]
+    POST_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
     POST_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
-    POST_work all -- 0.0.0.0/0 0.0.0.0/0 [goto]
     POST_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
 ]])
 
@@ -271,8 +274,8 @@ IP6TABLES_LIST_RULES([filter], [INPUT], 0, [dnl
 ])
 IP6TABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
   [[IN_public all dead:beef::/54 ::/0 [goto]
+    IN_trusted all ::/0 ::/0 [goto]
     IN_public all ::/0 ::/0 [goto]
-    IN_work all ::/0 ::/0 [goto]
     IN_public all ::/0 ::/0 [goto]
 ]])
 IP6TABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
@@ -287,14 +290,14 @@ IP6TABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
 ])
 IP6TABLES_LIST_RULES([filter], [FORWARD_IN_ZONES], 0,
   [[FWDI_public all dead:beef::/54 ::/0 [goto]
+    FWDI_trusted all ::/0 ::/0 [goto]
     FWDI_public all ::/0 ::/0 [goto]
-    FWDI_work all ::/0 ::/0 [goto]
     FWDI_public all ::/0 ::/0 [goto]
 ]])
 IP6TABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES], 0,
   [[FWDO_public all ::/0 dead:beef::/54 [goto]
+    FWDO_trusted all ::/0 ::/0 [goto]
     FWDO_public all ::/0 ::/0 [goto]
-    FWDO_work all ::/0 ::/0 [goto]
     FWDO_public all ::/0 ::/0 [goto]
 ]])
 IP6TABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
@@ -306,8 +309,8 @@ IP6TABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
 ])
 IP6TABLES_LIST_RULES([raw], [PREROUTING_ZONES], 0,
   [[PRE_public all dead:beef::/54 ::/0 [goto]
+    PRE_trusted all ::/0 ::/0 [goto]
     PRE_public all ::/0 ::/0 [goto]
-    PRE_work all ::/0 ::/0 [goto]
     PRE_public all ::/0 ::/0 [goto]
 ]])
 IP6TABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
@@ -316,8 +319,8 @@ IP6TABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
 ])
 IP6TABLES_LIST_RULES([mangle], [PREROUTING_ZONES], 0,
   [[PRE_public all dead:beef::/54 ::/0 [goto]
+    PRE_trusted all ::/0 ::/0 [goto]
     PRE_public all ::/0 ::/0 [goto]
-    PRE_work all ::/0 ::/0 [goto]
     PRE_public all ::/0 ::/0 [goto]
 ]])
 IP6TABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
@@ -326,8 +329,8 @@ IP6TABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
 ])
 IP6TABLES_LIST_RULES([nat], [PREROUTING_ZONES], 0,
   [[PRE_public all dead:beef::/54 ::/0 [goto]
+    PRE_trusted all ::/0 ::/0 [goto]
     PRE_public all ::/0 ::/0 [goto]
-    PRE_work all ::/0 ::/0 [goto]
     PRE_public all ::/0 ::/0 [goto]
 ]])
 IP6TABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
@@ -336,9 +339,456 @@ IP6TABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
 ])
 IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
   [[POST_public all ::/0 dead:beef::/54 [goto]
+    POST_trusted all ::/0 ::/0 [goto]
+    POST_public all ::/0 ::/0 [goto]
+    POST_public all ::/0 ::/0 [goto]
+]])
+
+dnl ##########################################################################
+dnl ##########################################################################
+dnl We also support zone drifting in which source based zones fall through to
+dnl interface based zones (including default zone).
+dnl ##########################################################################
+dnl ##########################################################################
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=yes/' ./firewalld.conf])
+FWD_RELOAD
+
+NFT_LIST_RULES([inet], [filter_INPUT], 0, [dnl
+    table inet firewalld {
+        chain filter_INPUT {
+            ct state established,related accept
+            ct status dnat accept
+            iifname "lo" accept
+            jump filter_INPUT_ZONES_SOURCE
+            jump filter_INPUT_ZONES
+            ct state invalid drop
+            reject with icmpx type admin-prohibited
+        }
+    }
+])
+NFT_LIST_RULES([inet], [filter_INPUT_ZONES_SOURCE], 0, [dnl
+    table inet firewalld {
+        chain filter_INPUT_ZONES_SOURCE {
+            ip6 saddr dead:beef::/54 goto filter_IN_public
+            ip saddr 1.2.3.0/24 goto filter_IN_trusted
+        }
+    }
+])
+NFT_LIST_RULES([inet], [filter_INPUT_ZONES], 0, [dnl
+    table inet firewalld {
+        chain filter_INPUT_ZONES {
+            iifname "dummy0" goto filter_IN_trusted
+            iifname "dummy1" goto filter_IN_public
+            goto filter_IN_public
+        }
+    }
+])
+NFT_LIST_RULES([inet], [filter_FORWARD], 0, [dnl
+    table inet firewalld {
+        chain filter_FORWARD {
+            ct state established,related accept
+            ct status dnat accept
+            iifname "lo" accept
+            ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 type addr-unreachable
+            jump filter_FORWARD_IN_ZONES_SOURCE
+            jump filter_FORWARD_IN_ZONES
+            jump filter_FORWARD_OUT_ZONES_SOURCE
+            jump filter_FORWARD_OUT_ZONES
+            ct state invalid drop
+            reject with icmpx type admin-prohibited
+        }
+    }
+])
+NFT_LIST_RULES([inet], [filter_FORWARD_IN_ZONES_SOURCE], 0, [dnl
+    table inet firewalld {
+        chain filter_FORWARD_IN_ZONES_SOURCE {
+            ip6 saddr dead:beef::/54 goto filter_FWDI_public
+            ip saddr 1.2.3.0/24 goto filter_FWDI_trusted
+        }
+    }
+])
+NFT_LIST_RULES([inet], [filter_FORWARD_IN_ZONES], 0, [dnl
+    table inet firewalld {
+        chain filter_FORWARD_IN_ZONES {
+            iifname "dummy0" goto filter_FWDI_trusted
+            iifname "dummy1" goto filter_FWDI_public
+            goto filter_FWDI_public
+        }
+    }
+])
+NFT_LIST_RULES([inet], [filter_FORWARD_OUT_ZONES_SOURCE], 0, [dnl
+    table inet firewalld {
+        chain filter_FORWARD_OUT_ZONES_SOURCE {
+            ip6 daddr dead:beef::/54 goto filter_FWDO_public
+            ip daddr 1.2.3.0/24 goto filter_FWDO_trusted
+        }
+    }
+])
+NFT_LIST_RULES([inet], [filter_FORWARD_OUT_ZONES], 0, [dnl
+    table inet firewalld {
+        chain filter_FORWARD_OUT_ZONES {
+            oifname "dummy0" goto filter_FWDO_trusted
+            oifname "dummy1" goto filter_FWDO_public
+            goto filter_FWDO_public
+        }
+    }
+])
+IF_HOST_SUPPORTS_NFT_FIB([
+    NFT_LIST_RULES([inet], [raw_PREROUTING], 0, [dnl
+        table inet firewalld {
+            chain raw_PREROUTING {
+                icmpv6 type { nd-router-advert, nd-neighbor-solicit } accept
+                meta nfproto ipv6 fib saddr . iif oif missing drop
+                jump raw_PREROUTING_ZONES_SOURCE
+                jump raw_PREROUTING_ZONES
+            }
+        }
+    ])
+], [
+    NFT_LIST_RULES([inet], [raw_PREROUTING], 0, [dnl
+        table inet firewalld {
+            chain raw_PREROUTING {
+                jump raw_PREROUTING_ZONES_SOURCE
+                jump raw_PREROUTING_ZONES
+            }
+        }
+    ])
+])
+NFT_LIST_RULES([inet], [raw_PREROUTING_ZONES_SOURCE], 0, [dnl
+    table inet firewalld {
+        chain raw_PREROUTING_ZONES_SOURCE {
+            ip6 saddr dead:beef::/54 goto raw_PRE_public
+            ip saddr 1.2.3.0/24 goto raw_PRE_trusted
+        }
+    }
+])
+NFT_LIST_RULES([inet], [raw_PREROUTING_ZONES], 0, [dnl
+    table inet firewalld {
+        chain raw_PREROUTING_ZONES {
+            iifname "dummy0" goto raw_PRE_trusted
+            iifname "dummy1" goto raw_PRE_public
+            goto raw_PRE_public
+        }
+    }
+])
+NFT_LIST_RULES([inet], [mangle_PREROUTING], 0, [dnl
+    table inet firewalld {
+        chain mangle_PREROUTING {
+            jump mangle_PREROUTING_ZONES_SOURCE
+            jump mangle_PREROUTING_ZONES
+        }
+    }
+])
+NFT_LIST_RULES([inet], [mangle_PREROUTING_ZONES_SOURCE], 0, [dnl
+    table inet firewalld {
+        chain mangle_PREROUTING_ZONES_SOURCE {
+            ip6 saddr dead:beef::/54 goto mangle_PRE_public
+            ip saddr 1.2.3.0/24 goto mangle_PRE_trusted
+        }
+    }
+])
+NFT_LIST_RULES([inet], [mangle_PREROUTING_ZONES], 0, [dnl
+    table inet firewalld {
+        chain mangle_PREROUTING_ZONES {
+            iifname "dummy0" goto mangle_PRE_trusted
+            iifname "dummy1" goto mangle_PRE_public
+            goto mangle_PRE_public
+        }
+    }
+])
+NFT_LIST_RULES([ip], [nat_PREROUTING], 0, [dnl
+    table ip firewalld {
+        chain nat_PREROUTING {
+            jump nat_PREROUTING_ZONES_SOURCE
+            jump nat_PREROUTING_ZONES
+        }
+    }
+])
+NFT_LIST_RULES([ip], [nat_PREROUTING_ZONES_SOURCE], 0, [dnl
+    table ip firewalld {
+        chain nat_PREROUTING_ZONES_SOURCE {
+            ip saddr 1.2.3.0/24 goto nat_PRE_trusted
+        }
+    }
+])
+NFT_LIST_RULES([ip], [nat_PREROUTING_ZONES], 0, [dnl
+    table ip firewalld {
+        chain nat_PREROUTING_ZONES {
+            iifname "dummy0" goto nat_PRE_trusted
+            iifname "dummy1" goto nat_PRE_public
+            goto nat_PRE_public
+        }
+    }
+])
+NFT_LIST_RULES([ip], [nat_POSTROUTING], 0, [dnl
+    table ip firewalld {
+        chain nat_POSTROUTING {
+            jump nat_POSTROUTING_ZONES_SOURCE
+            jump nat_POSTROUTING_ZONES
+        }
+    }
+])
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES_SOURCE], 0, [dnl
+    table ip firewalld {
+        chain nat_POSTROUTING_ZONES_SOURCE {
+            ip daddr 1.2.3.0/24 goto nat_POST_trusted
+        }
+    }
+])
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES], 0, [dnl
+    table ip firewalld {
+        chain nat_POSTROUTING_ZONES {
+            oifname "dummy0" goto nat_POST_trusted
+            oifname "dummy1" goto nat_POST_public
+            goto nat_POST_public
+        }
+    }
+])
+NFT_LIST_RULES([ip6], [nat_PREROUTING], 0, [dnl
+    table ip6 firewalld {
+        chain nat_PREROUTING {
+            jump nat_PREROUTING_ZONES_SOURCE
+            jump nat_PREROUTING_ZONES
+        }
+    }
+])
+NFT_LIST_RULES([ip6], [nat_PREROUTING_ZONES_SOURCE], 0, [dnl
+    table ip6 firewalld {
+        chain nat_PREROUTING_ZONES_SOURCE {
+            ip6 saddr dead:beef::/54 goto nat_PRE_public
+        }
+    }
+])
+NFT_LIST_RULES([ip6], [nat_PREROUTING_ZONES], 0, [dnl
+    table ip6 firewalld {
+        chain nat_PREROUTING_ZONES {
+            iifname "dummy0" goto nat_PRE_trusted
+            iifname "dummy1" goto nat_PRE_public
+            goto nat_PRE_public
+        }
+    }
+])
+NFT_LIST_RULES([ip6], [nat_POSTROUTING], 0, [dnl
+    table ip6 firewalld {
+        chain nat_POSTROUTING {
+            jump nat_POSTROUTING_ZONES_SOURCE
+            jump nat_POSTROUTING_ZONES
+        }
+    }
+])
+NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES_SOURCE], 0, [dnl
+    table ip6 firewalld {
+        chain nat_POSTROUTING_ZONES_SOURCE {
+            ip6 daddr dead:beef::/54 goto nat_POST_public
+        }
+    }
+])
+NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES], 0, [dnl
+    table ip6 firewalld {
+        chain nat_POSTROUTING_ZONES {
+            oifname "dummy0" goto nat_POST_trusted
+            oifname "dummy1" goto nat_POST_public
+            goto nat_POST_public
+        }
+    }
+])
+
+IPTABLES_LIST_RULES([filter], [INPUT], 0, [dnl
+    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT
+    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
+    INPUT_direct all -- 0.0.0.0/0 0.0.0.0/0
+    INPUT_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
+    INPUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+    DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
+    REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
+])
+IPTABLES_LIST_RULES([filter], [INPUT_ZONES_SOURCE], 0,
+  [[IN_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
+  [[IN_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
+    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT
+    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
+    FORWARD_direct all -- 0.0.0.0/0 0.0.0.0/0
+    FORWARD_IN_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
+    FORWARD_IN_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+    FORWARD_OUT_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
+    FORWARD_OUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+    DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
+    REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
+])
+IPTABLES_LIST_RULES([filter], [FORWARD_IN_ZONES_SOURCE], 0,
+  [[FWDI_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([filter], [FORWARD_IN_ZONES], 0,
+  [[FWDI_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES_SOURCE], 0,
+  [[FWDO_trusted all -- 0.0.0.0/0 1.2.3.0/24 [goto]
+]])
+IPTABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES], 0,
+  [[FWDO_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
+    PREROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
+    PREROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
+    PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+])
+IPTABLES_LIST_RULES([raw], [PREROUTING_ZONES_SOURCE], 0,
+  [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([raw], [PREROUTING_ZONES], 0,
+  [[PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
+    PREROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
+    PREROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
+    PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+])
+IPTABLES_LIST_RULES([mangle], [PREROUTING_ZONES_SOURCE], 0,
+  [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([mangle], [PREROUTING_ZONES], 0,
+  [[PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
+    PREROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
+    PREROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
+    PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+])
+IPTABLES_LIST_RULES([nat], [PREROUTING_ZONES_SOURCE], 0,
+  [[PRE_trusted all -- 1.2.3.0/24 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([nat], [PREROUTING_ZONES], 0,
+  [[PRE_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    PRE_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
+    POSTROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
+    POSTROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
+    POSTROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+])
+IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES_SOURCE], 0,
+  [[POST_trusted all -- 0.0.0.0/0 1.2.3.0/24 [goto]
+]])
+IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
+  [[POST_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    POST_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    POST_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+
+IP6TABLES_LIST_RULES([filter], [INPUT], 0, [dnl
+    ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT
+    ACCEPT all ::/0 ::/0
+    INPUT_direct all ::/0 ::/0
+    INPUT_ZONES_SOURCE all ::/0 ::/0
+    INPUT_ZONES all ::/0 ::/0
+    DROP all ::/0 ::/0 ctstate INVALID
+    REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
+])
+IP6TABLES_LIST_RULES([filter], [INPUT_ZONES_SOURCE], 0,
+  [[IN_public all dead:beef::/54 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
+  [[IN_trusted all ::/0 ::/0 [goto]
+    IN_public all ::/0 ::/0 [goto]
+    IN_public all ::/0 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
+    ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT
+    ACCEPT all ::/0 ::/0
+    FORWARD_direct all ::/0 ::/0
+    RFC3964_IPv4 all ::/0 ::/0
+    FORWARD_IN_ZONES_SOURCE all ::/0 ::/0
+    FORWARD_IN_ZONES all ::/0 ::/0
+    FORWARD_OUT_ZONES_SOURCE all ::/0 ::/0
+    FORWARD_OUT_ZONES all ::/0 ::/0
+    DROP all ::/0 ::/0 ctstate INVALID
+    REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
+])
+IP6TABLES_LIST_RULES([filter], [FORWARD_IN_ZONES_SOURCE], 0,
+  [[FWDI_public all dead:beef::/54 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([filter], [FORWARD_IN_ZONES], 0,
+  [[FWDI_trusted all ::/0 ::/0 [goto]
+    FWDI_public all ::/0 ::/0 [goto]
+    FWDI_public all ::/0 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES_SOURCE], 0,
+  [[FWDO_public all ::/0 dead:beef::/54 [goto]
+]])
+IP6TABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES], 0,
+  [[FWDO_trusted all ::/0 ::/0 [goto]
+    FWDO_public all ::/0 ::/0 [goto]
+    FWDO_public all ::/0 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
+    ACCEPT icmpv6 ::/0 ::/0 ipv6-icmptype 134
+    ACCEPT icmpv6 ::/0 ::/0 ipv6-icmptype 135
+    DROP all ::/0 ::/0 rpfilter invert
+    PREROUTING_direct all ::/0 ::/0
+    PREROUTING_ZONES_SOURCE all ::/0 ::/0
+    PREROUTING_ZONES all ::/0 ::/0
+])
+IP6TABLES_LIST_RULES([raw], [PREROUTING_ZONES_SOURCE], 0,
+  [[PRE_public all dead:beef::/54 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([raw], [PREROUTING_ZONES], 0,
+  [[PRE_trusted all ::/0 ::/0 [goto]
+    PRE_public all ::/0 ::/0 [goto]
+    PRE_public all ::/0 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
+    PREROUTING_direct all ::/0 ::/0
+    PREROUTING_ZONES_SOURCE all ::/0 ::/0
+    PREROUTING_ZONES all ::/0 ::/0
+])
+IP6TABLES_LIST_RULES([mangle], [PREROUTING_ZONES_SOURCE], 0,
+  [[PRE_public all dead:beef::/54 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([mangle], [PREROUTING_ZONES], 0,
+  [[PRE_trusted all ::/0 ::/0 [goto]
+    PRE_public all ::/0 ::/0 [goto]
+    PRE_public all ::/0 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
+    PREROUTING_direct all ::/0 ::/0
+    PREROUTING_ZONES_SOURCE all ::/0 ::/0
+    PREROUTING_ZONES all ::/0 ::/0
+])
+IP6TABLES_LIST_RULES([nat], [PREROUTING_ZONES_SOURCE], 0,
+  [[PRE_public all dead:beef::/54 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([nat], [PREROUTING_ZONES], 0,
+  [[PRE_trusted all ::/0 ::/0 [goto]
+    PRE_public all ::/0 ::/0 [goto]
+    PRE_public all ::/0 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
+    POSTROUTING_direct all ::/0 ::/0
+    POSTROUTING_ZONES_SOURCE all ::/0 ::/0
+    POSTROUTING_ZONES all ::/0 ::/0
+])
+IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES_SOURCE], 0,
+  [[POST_public all ::/0 dead:beef::/54 [goto]
+]])
+IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
+  [[POST_trusted all ::/0 ::/0 [goto]
     POST_public all ::/0 ::/0 [goto]
-    POST_work all ::/0 ::/0 [goto]
     POST_public all ::/0 ::/0 [goto]
 ]])
 
-FWD_END_TEST
+FWD_END_TEST([-e '/WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now./d'])
diff --git a/src/tests/regression/rhbz1734765.at b/src/tests/regression/rhbz1734765.at
index 972457e3126e..bb054bdb0361 100644
--- a/src/tests/regression/rhbz1734765.at
+++ b/src/tests/regression/rhbz1734765.at
@@ -1,9 +1,12 @@
 FWD_START_TEST([zone sources ordered by name])
-AT_KEYWORDS(zone rhbz1734765 rhbz1421222 gh166 rhbz1738545)
+AT_KEYWORDS(zone rhbz1734765 rhbz1421222 gh166 rhbz1738545 rhbz1772208 rhbz1796055)
 dnl
 dnl Users depend on firewalld ordering source-based zone dispatch by zone name.
 dnl
 
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=no/' ./firewalld.conf])
+FWD_RELOAD
+
 FWD_CHECK([-q --permanent --new-zone=foobar_00])
 FWD_CHECK([-q --permanent --new-zone=foobar_05])
 FWD_CHECK([-q --permanent --new-zone=foobar_02])
@@ -196,4 +199,177 @@ IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
     POST_public all ::/0 ::/0 [goto]
 ]])
 
-FWD_END_TEST
+dnl ##########################################################################
+dnl ##########################################################################
+dnl We also support zone drifting in which source based zones fall through to
+dnl interface based zones (including default zone). So make sure the zones are
+dnl sorted by name in this mode.
+dnl ##########################################################################
+dnl ##########################################################################
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=yes/' ./firewalld.conf])
+FWD_RELOAD
+
+FWD_CHECK([-q --zone=foobar_010 --add-source="10.10.10.10"])
+FWD_CHECK([-q --zone=public --add-source="20.20.20.20"])
+IF_HOST_SUPPORTS_IPV6_RULES([
+FWD_CHECK([-q --zone=foobar_010 --add-source="1234:5678::10:10:10"])
+FWD_CHECK([-q --zone=public --add-source="1234:5678::20:20:20"])
+FWD_CHECK([-q --zone=foobar_012 --add-source ipset:ipsetv6])
+])
+FWD_CHECK([-q --zone=foobar_010 --add-interface=foobar2])
+
+NFT_LIST_RULES([inet], [filter_INPUT_ZONES_SOURCE], 0, [dnl
+    table inet firewalld {
+        chain filter_INPUT_ZONES_SOURCE {
+            ip saddr 10.1.1.1 goto filter_IN_foobar_00
+            ip6 saddr 1234:5678::1:1:1 goto filter_IN_foobar_00
+            ip saddr 10.1.1.0/24 goto filter_IN_foobar_01
+            ip6 saddr 1234:5678::1:1:0/112 goto filter_IN_foobar_01
+            ip saddr 10.10.10.10 goto filter_IN_foobar_010
+            ip6 saddr 1234:5678::10:10:10 goto filter_IN_foobar_010
+            ip saddr @ipsetv4 goto filter_IN_foobar_011
+            ip6 saddr @ipsetv6 goto filter_IN_foobar_012
+            ip saddr 10.1.0.0/16 goto filter_IN_foobar_02
+            ip6 saddr 1234:5678::1:0:0/96 goto filter_IN_foobar_02
+            ip saddr 10.2.2.0/24 goto filter_IN_foobar_03
+            ip6 saddr 1234:5678::2:2:0/112 goto filter_IN_foobar_03
+            ip saddr 10.2.0.0/16 goto filter_IN_foobar_04
+            ip6 saddr 1234:5678::2:0:0/96 goto filter_IN_foobar_04
+            ip saddr 10.0.0.0/8 goto filter_IN_foobar_05
+            ip6 saddr 1234:5678::/80 goto filter_IN_foobar_05
+            ip saddr 20.20.20.20 goto filter_IN_public
+            ip6 saddr 1234:5678::20:20:20 goto filter_IN_public
+        }
+    }
+])
+NFT_LIST_RULES([inet], [filter_INPUT_ZONES], 0, [dnl
+    table inet firewalld {
+        chain filter_INPUT_ZONES {
+            iifname "foobar2" goto filter_IN_foobar_010
+            iifname "foobar1" goto filter_IN_trusted
+            iifname "foobar0" goto filter_IN_internal
+            goto filter_IN_public
+        }
+    }
+])
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES_SOURCE], 0, [dnl
+    table ip firewalld {
+        chain nat_POSTROUTING_ZONES_SOURCE {
+            ip daddr 10.1.1.1 goto nat_POST_foobar_00
+            ip daddr 10.1.1.0/24 goto nat_POST_foobar_01
+            ip daddr 10.10.10.10 goto nat_POST_foobar_010
+            ip daddr @ipsetv4 goto nat_POST_foobar_011
+            ip daddr 10.1.0.0/16 goto nat_POST_foobar_02
+            ip daddr 10.2.2.0/24 goto nat_POST_foobar_03
+            ip daddr 10.2.0.0/16 goto nat_POST_foobar_04
+            ip daddr 10.0.0.0/8 goto nat_POST_foobar_05
+            ip daddr 20.20.20.20 goto nat_POST_public
+        }
+    }
+])
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES], 0, [dnl
+    table ip firewalld {
+        chain nat_POSTROUTING_ZONES {
+            oifname "foobar2" goto nat_POST_foobar_010
+            oifname "foobar1" goto nat_POST_trusted
+            oifname "foobar0" goto nat_POST_internal
+            goto nat_POST_public
+        }
+    }
+])
+NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES_SOURCE], 0, [dnl
+    table ip6 firewalld {
+        chain nat_POSTROUTING_ZONES_SOURCE {
+            ip6 daddr 1234:5678::1:1:1 goto nat_POST_foobar_00
+            ip6 daddr 1234:5678::1:1:0/112 goto nat_POST_foobar_01
+            ip6 daddr 1234:5678::10:10:10 goto nat_POST_foobar_010
+            ip6 daddr @ipsetv6 goto nat_POST_foobar_012
+            ip6 daddr 1234:5678::1:0:0/96 goto nat_POST_foobar_02
+            ip6 daddr 1234:5678::2:2:0/112 goto nat_POST_foobar_03
+            ip6 daddr 1234:5678::2:0:0/96 goto nat_POST_foobar_04
+            ip6 daddr 1234:5678::/80 goto nat_POST_foobar_05
+            ip6 daddr 1234:5678::20:20:20 goto nat_POST_public
+        }
+    }
+])
+NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES], 0, [dnl
+    table ip6 firewalld {
+        chain nat_POSTROUTING_ZONES {
+            oifname "foobar2" goto nat_POST_foobar_010
+            oifname "foobar1" goto nat_POST_trusted
+            oifname "foobar0" goto nat_POST_internal
+            goto nat_POST_public
+        }
+    }
+])
+
+IPTABLES_LIST_RULES([filter], [INPUT_ZONES_SOURCE], 0,
+  [[IN_foobar_00 all -- 10.1.1.1 0.0.0.0/0 [goto]
+    IN_foobar_01 all -- 10.1.1.0/24 0.0.0.0/0 [goto]
+    IN_foobar_010 all -- 10.10.10.10 0.0.0.0/0 [goto]
+    IN_foobar_011 all -- 0.0.0.0/0 0.0.0.0/0 [goto] match-set ipsetv4 src
+    IN_foobar_02 all -- 10.1.0.0/16 0.0.0.0/0 [goto]
+    IN_foobar_03 all -- 10.2.2.0/24 0.0.0.0/0 [goto]
+    IN_foobar_04 all -- 10.2.0.0/16 0.0.0.0/0 [goto]
+    IN_foobar_05 all -- 10.0.0.0/8 0.0.0.0/0 [goto]
+    IN_public all -- 20.20.20.20 0.0.0.0/0 [goto]
+]])
+IPTABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
+  [[IN_foobar_010 all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    IN_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    IN_internal all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IP6TABLES_LIST_RULES([filter], [INPUT_ZONES_SOURCE], 0,
+  [[IN_foobar_00 all 1234:5678::1:1:1 ::/0 [goto]
+    IN_foobar_01 all 1234:5678::1:1:0/112 ::/0 [goto]
+    IN_foobar_010 all 1234:5678::10:10:10 ::/0 [goto]
+    IN_foobar_012 all ::/0 ::/0 [goto] match-set ipsetv6 src
+    IN_foobar_02 all 1234:5678::1:0:0/96 ::/0 [goto]
+    IN_foobar_03 all 1234:5678::2:2:0/112 ::/0 [goto]
+    IN_foobar_04 all 1234:5678::2:0:0/96 ::/0 [goto]
+    IN_foobar_05 all 1234:5678::/80 ::/0 [goto]
+    IN_public all 1234:5678::20:20:20 ::/0 [goto]
+]])
+IP6TABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
+  [[IN_foobar_010 all ::/0 ::/0 [goto]
+    IN_trusted all ::/0 ::/0 [goto]
+    IN_internal all ::/0 ::/0 [goto]
+    IN_public all ::/0 ::/0 [goto]
+]])
+IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES_SOURCE], 0,
+  [[POST_foobar_00 all -- 0.0.0.0/0 10.1.1.1 [goto]
+    POST_foobar_01 all -- 0.0.0.0/0 10.1.1.0/24 [goto]
+    POST_foobar_010 all -- 0.0.0.0/0 10.10.10.10 [goto]
+    POST_foobar_011 all -- 0.0.0.0/0 0.0.0.0/0 [goto] match-set ipsetv4 dst
+    POST_foobar_02 all -- 0.0.0.0/0 10.1.0.0/16 [goto]
+    POST_foobar_03 all -- 0.0.0.0/0 10.2.2.0/24 [goto]
+    POST_foobar_04 all -- 0.0.0.0/0 10.2.0.0/16 [goto]
+    POST_foobar_05 all -- 0.0.0.0/0 10.0.0.0/8 [goto]
+    POST_public all -- 0.0.0.0/0 20.20.20.20 [goto]
+]])
+IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
+  [[POST_foobar_010 all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    POST_trusted all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    POST_internal all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+    POST_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
+]])
+IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES_SOURCE], 0,
+  [[POST_foobar_00 all ::/0 1234:5678::1:1:1 [goto]
+    POST_foobar_01 all ::/0 1234:5678::1:1:0/112 [goto]
+    POST_foobar_010 all ::/0 1234:5678::10:10:10 [goto]
+    POST_foobar_012 all ::/0 ::/0 [goto] match-set ipsetv6 dst
+    POST_foobar_02 all ::/0 1234:5678::1:0:0/96 [goto]
+    POST_foobar_03 all ::/0 1234:5678::2:2:0/112 [goto]
+    POST_foobar_04 all ::/0 1234:5678::2:0:0/96 [goto]
+    POST_foobar_05 all ::/0 1234:5678::/80 [goto]
+    POST_public all ::/0 1234:5678::20:20:20 [goto]
+]])
+IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
+  [[POST_foobar_010 all ::/0 ::/0 [goto]
+    POST_trusted all ::/0 ::/0 [goto]
+    POST_internal all ::/0 ::/0 [goto]
+    POST_public all ::/0 ::/0 [goto]
+]])
+
+FWD_END_TEST([-e '/WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now./d'])
-- 
2.23.0