From cc2b632a51ad32e7b3966f44057add92e45e60a5 Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Fri, 14 Jun 2019 09:44:41 -0400 Subject: [PATCH 03/20] fix: tests: always list rules using macros This is to make sure certain flags are used, e.g. "-w" for iptables. Fixes: rhbz 1720650 (cherry picked from commit e527818500be462a724cd34c94948a2704560eb1) --- src/tests/features/rfc3964_ipv4.at | 4 +- .../regression/icmp_block_in_forward_chain.at | 27 +++++-- src/tests/regression/rhbz1514043.at | 80 +++++++++++++++++-- 3 files changed, 98 insertions(+), 13 deletions(-) diff --git a/src/tests/features/rfc3964_ipv4.at b/src/tests/features/rfc3964_ipv4.at index cce828c0b3de..baff411793b2 100644 --- a/src/tests/features/rfc3964_ipv4.at +++ b/src/tests/features/rfc3964_ipv4.at @@ -93,8 +93,8 @@ NFT_LIST_RULES([inet], [filter_OUTPUT], 0, [dnl } ]) -m4_if(iptables, FIREWALL_BACKEND, [ -NS_CHECK([ip6tables -w -n -t filter -L RFC3964_IPv4], 1, [ignore], [ignore]) +IP6TABLES_LIST_RULES([filter], [RFC3964_IPv4], 0, [ignore], [dnl +iptables: No chain/target/match by that name. ]) IP6TABLES_LIST_RULES([filter], [FORWARD], 0, [dnl ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT diff --git a/src/tests/regression/icmp_block_in_forward_chain.at b/src/tests/regression/icmp_block_in_forward_chain.at index 769315d9534e..7580bc179470 100644 --- a/src/tests/regression/icmp_block_in_forward_chain.at +++ b/src/tests/regression/icmp_block_in_forward_chain.at @@ -2,12 +2,27 @@ FWD_START_TEST([ICMP block present FORWARD chain]) AT_KEYWORDS(icmp) FWD_CHECK([-q --zone=public --add-icmp-block=host-prohibited]) -m4_if(iptables, FIREWALL_BACKEND, [ - NS_CHECK([IPTABLES -L IN_public_deny | grep "host-prohibited"], 0, ignore) - NS_CHECK([IPTABLES -L FWDI_public_deny | grep "host-prohibited"], 0, ignore) -], [ - NS_CHECK([nft list chain inet firewalld filter_IN_public_deny | grep "destination-unreachable" |grep "\(code 10\|host-prohibited\)"], 0, ignore) - NS_CHECK([nft list chain inet firewalld filter_FWDI_public_deny | grep "destination-unreachable" |grep "\(code 10\|host-prohibited\)"], 0, ignore) + +NFT_LIST_RULES([inet], [filter_IN_public_deny | sed -e 's/icmp code 10/icmp code host-prohibited/'], 0, [dnl + table inet firewalld { + chain filter_IN_public_deny { + icmp type destination-unreachable icmp code host-prohibited reject with icmp type admin-prohibited + } + } +]) +NFT_LIST_RULES([inet], [filter_FWDI_public_deny | sed -e 's/icmp code 10/icmp code host-prohibited/'], 0, [dnl + table inet firewalld { + chain filter_FWDI_public_deny { + icmp type destination-unreachable icmp code host-prohibited reject with icmp type admin-prohibited + } + } +]) + +IPTABLES_LIST_RULES([filter], [IN_public_deny], 0, [dnl + REJECT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 3 code 10 reject-with icmp-host-prohibited +]) +IPTABLES_LIST_RULES([filter], [FWDI_public_deny], 0, [dnl + REJECT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 3 code 10 reject-with icmp-host-prohibited ]) FWD_END_TEST diff --git a/src/tests/regression/rhbz1514043.at b/src/tests/regression/rhbz1514043.at index 88ce4934e5ea..241cf547f7f3 100644 --- a/src/tests/regression/rhbz1514043.at +++ b/src/tests/regression/rhbz1514043.at @@ -7,11 +7,81 @@ FWD_RELOAD FWD_CHECK([--zone=public --list-all | TRIM | grep ^services], 0, [dnl services: cockpit dhcpv6-client samba ssh ]) + dnl check that log denied actually took effect -m4_if(iptables, FIREWALL_BACKEND, [ - NS_CHECK([IPTABLES -t filter -L | grep "FINAL_REJECT:"], 0, ignore) -], [ - NS_CHECK([nft list chain inet firewalld filter_INPUT | grep "FINAL_REJECT"], 0, ignore) - NS_CHECK([nft list chain inet firewalld filter_FORWARD | grep "FINAL_REJECT"], 0, ignore) +NFT_LIST_RULES([inet], [filter_INPUT], 0, [dnl + table inet firewalld { + chain filter_INPUT { + ct state established,related accept + ct status dnat accept + iifname "lo" accept + jump filter_INPUT_ZONES + ct state invalid log prefix "STATE_INVALID_DROP: " + ct state invalid drop + log prefix "FINAL_REJECT: " + reject with icmpx type admin-prohibited + } + } +]) +NFT_LIST_RULES([inet], [filter_FORWARD], 0, [dnl + table inet firewalld { + chain filter_FORWARD { + ct state established,related accept + ct status dnat accept + iifname "lo" accept + ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } log prefix "RFC3964_IPv4_REJECT: " reject with icmpv6 type addr-unreachable + jump filter_FORWARD_IN_ZONES + jump filter_FORWARD_OUT_ZONES + ct state invalid log prefix "STATE_INVALID_DROP: " + ct state invalid drop + log prefix "FINAL_REJECT: " + reject with icmpx type admin-prohibited + } + } +]) + +IPTABLES_LIST_RULES([filter], [INPUT], 0, [dnl + ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT + ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 + INPUT_direct all -- 0.0.0.0/0 0.0.0.0/0 + INPUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0 + LOG all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: " + DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID + LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "FINAL_REJECT: " + REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited ]) +IPTABLES_LIST_RULES([filter], [FORWARD], 0, [dnl + ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT + ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 + FORWARD_direct all -- 0.0.0.0/0 0.0.0.0/0 + FORWARD_IN_ZONES all -- 0.0.0.0/0 0.0.0.0/0 + FORWARD_OUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0 + LOG all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: " + DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID + LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "FINAL_REJECT: " + REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited +]) +IP6TABLES_LIST_RULES([filter], [INPUT], 0, [dnl + ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT + ACCEPT all ::/0 ::/0 + INPUT_direct all ::/0 ::/0 + INPUT_ZONES all ::/0 ::/0 + LOG all ::/0 ::/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: " + DROP all ::/0 ::/0 ctstate INVALID + LOG all ::/0 ::/0 LOG flags 0 level 4 prefix "FINAL_REJECT: " + REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited +]) +IP6TABLES_LIST_RULES([filter], [FORWARD], 0, [dnl + ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT + ACCEPT all ::/0 ::/0 + FORWARD_direct all ::/0 ::/0 + RFC3964_IPv4 all ::/0 ::/0 + FORWARD_IN_ZONES all ::/0 ::/0 + FORWARD_OUT_ZONES all ::/0 ::/0 + LOG all ::/0 ::/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: " + DROP all ::/0 ::/0 ctstate INVALID + LOG all ::/0 ::/0 LOG flags 0 level 4 prefix "FINAL_REJECT: " + REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited +]) + FWD_END_TEST -- 2.20.1