From 83c620c895a03d9e99997d61ee532869ae3ef906 Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life>
Date: Fri, 14 Jun 2019 09:44:41 -0400
Subject: [PATCH 66/73] fix: tests: always list rules using macros
This is to make sure certain flags are used, e.g. "-w" for iptables.
Fixes: rhbz 1720650
(cherry picked from commit e527818500be462a724cd34c94948a2704560eb1)
(cherry picked from commit e074dc55257bfd7e8b8e2805d2c46b58545aec05)
---
.../regression/icmp_block_in_forward_chain.at | 28 +++++--
src/tests/regression/rhbz1514043.at | 77 ++++++++++++++++++-
2 files changed, 96 insertions(+), 9 deletions(-)
diff --git a/src/tests/regression/icmp_block_in_forward_chain.at b/src/tests/regression/icmp_block_in_forward_chain.at
index 3c8766a2b23b..bf834b1a1711 100644
--- a/src/tests/regression/icmp_block_in_forward_chain.at
+++ b/src/tests/regression/icmp_block_in_forward_chain.at
@@ -1,12 +1,30 @@
FWD_START_TEST([ICMP block present FORWARD chain])
FWD_CHECK([-q --zone=public --add-icmp-block=host-prohibited])
-m4_if(iptables, FIREWALL_BACKEND, [
- NS_CHECK([IPTABLES -L IN_public_deny | grep "host-prohibited"], 0, ignore)
- NS_CHECK([IPTABLES -L FWDI_public_deny | grep "host-prohibited"], 0, ignore)
+
+m4_if(nftables, FIREWALL_BACKEND, [
+NFT_LIST_RULES([inet], [filter_IN_public_deny | sed -e 's/icmp code 10/icmp code host-prohibited/'], 0, [dnl
+ table inet firewalld {
+ chain filter_IN_public_deny {
+ icmp type destination-unreachable icmp code host-prohibited reject with icmp type admin-prohibited
+ }
+ }
+])
+NFT_LIST_RULES([inet], [filter_FWDI_public_deny | sed -e 's/icmp code 10/icmp code host-prohibited/'], 0, [dnl
+ table inet firewalld {
+ chain filter_FWDI_public_deny {
+ icmp type destination-unreachable icmp code host-prohibited reject with icmp type admin-prohibited
+ }
+ }
+])
], [
- NS_CHECK([nft list chain inet firewalld filter_IN_public_deny | grep "destination-unreachable" |grep "\(code 10\|host-prohibited\)"], 0, ignore)
- NS_CHECK([nft list chain inet firewalld filter_FWDI_public_deny | grep "destination-unreachable" |grep "\(code 10\|host-prohibited\)"], 0, ignore)
+
+IPTABLES_LIST_RULES([filter], [IN_public_deny], 0, [dnl
+ REJECT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 3 code 10 reject-with icmp-host-prohibited
+])
+IPTABLES_LIST_RULES([filter], [FWDI_public_deny], 0, [dnl
+ REJECT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 3 code 10 reject-with icmp-host-prohibited
+])
])
FWD_END_TEST
diff --git a/src/tests/regression/rhbz1514043.at b/src/tests/regression/rhbz1514043.at
index a9750a584898..ff2ede2ece71 100644
--- a/src/tests/regression/rhbz1514043.at
+++ b/src/tests/regression/rhbz1514043.at
@@ -5,11 +5,80 @@ FWD_RELOAD
FWD_CHECK([--zone=public --list-all | TRIM | grep ^services], 0, [dnl
services: dhcpv6-client samba ssh
])
+
dnl check that log denied actually took effect
-m4_if(iptables, FIREWALL_BACKEND, [
- NS_CHECK([IPTABLES -t filter -L | grep "FINAL_REJECT:"], 0, ignore)
+m4_if(nftables, FIREWALL_BACKEND, [
+NFT_LIST_RULES([inet], [filter_INPUT], 0, [dnl
+ table inet firewalld {
+ chain filter_INPUT {
+ ct state established,related accept
+ iifname "lo" accept
+ jump filter_INPUT_ZONES
+ ct state invalid log prefix "STATE_INVALID_DROP: "
+ ct state invalid drop
+ log prefix "FINAL_REJECT: "
+ reject with icmpx type admin-prohibited
+ }
+ }
+])
+NFT_LIST_RULES([inet], [filter_FORWARD], 0, [dnl
+ table inet firewalld {
+ chain filter_FORWARD {
+ ct state established,related accept
+ iifname "lo" accept
+ jump filter_FORWARD_IN_ZONES
+ jump filter_FORWARD_OUT_ZONES
+ ct state invalid log prefix "STATE_INVALID_DROP: "
+ ct state invalid drop
+ log prefix "FINAL_REJECT: "
+ reject with icmpx type admin-prohibited
+ }
+ }
+])
], [
- NS_CHECK([nft list chain inet firewalld filter_INPUT | grep "FINAL_REJECT"], 0, ignore)
- NS_CHECK([nft list chain inet firewalld filter_FORWARD | grep "FINAL_REJECT"], 0, ignore)
+
+IPTABLES_LIST_RULES([filter], [INPUT], 0, [dnl
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
+ INPUT_direct all -- 0.0.0.0/0 0.0.0.0/0
+ INPUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+ LOG all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
+ DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
+ LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "FINAL_REJECT: "
+ REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
+])
+IPTABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
+ FORWARD_direct all -- 0.0.0.0/0 0.0.0.0/0
+ FORWARD_IN_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+ FORWARD_OUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
+ LOG all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
+ DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
+ LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "FINAL_REJECT: "
+ REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
+])
+IP6TABLES_LIST_RULES([filter], [INPUT], 0, [dnl
+ ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED
+ ACCEPT all ::/0 ::/0
+ INPUT_direct all ::/0 ::/0
+ INPUT_ZONES all ::/0 ::/0
+ LOG all ::/0 ::/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
+ DROP all ::/0 ::/0 ctstate INVALID
+ LOG all ::/0 ::/0 LOG flags 0 level 4 prefix "FINAL_REJECT: "
+ REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
+])
+IP6TABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
+ ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED
+ ACCEPT all ::/0 ::/0
+ FORWARD_direct all ::/0 ::/0
+ FORWARD_IN_ZONES all ::/0 ::/0
+ FORWARD_OUT_ZONES all ::/0 ::/0
+ LOG all ::/0 ::/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
+ DROP all ::/0 ::/0 ctstate INVALID
+ LOG all ::/0 ::/0 LOG flags 0 level 4 prefix "FINAL_REJECT: "
+ REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
+])
])
+
FWD_END_TEST
--
2.20.1