From 83c620c895a03d9e99997d61ee532869ae3ef906 Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Fri, 14 Jun 2019 09:44:41 -0400 Subject: [PATCH 66/73] fix: tests: always list rules using macros This is to make sure certain flags are used, e.g. "-w" for iptables. Fixes: rhbz 1720650 (cherry picked from commit e527818500be462a724cd34c94948a2704560eb1) (cherry picked from commit e074dc55257bfd7e8b8e2805d2c46b58545aec05) --- .../regression/icmp_block_in_forward_chain.at | 28 +++++-- src/tests/regression/rhbz1514043.at | 77 ++++++++++++++++++- 2 files changed, 96 insertions(+), 9 deletions(-) diff --git a/src/tests/regression/icmp_block_in_forward_chain.at b/src/tests/regression/icmp_block_in_forward_chain.at index 3c8766a2b23b..bf834b1a1711 100644 --- a/src/tests/regression/icmp_block_in_forward_chain.at +++ b/src/tests/regression/icmp_block_in_forward_chain.at @@ -1,12 +1,30 @@ FWD_START_TEST([ICMP block present FORWARD chain]) FWD_CHECK([-q --zone=public --add-icmp-block=host-prohibited]) -m4_if(iptables, FIREWALL_BACKEND, [ - NS_CHECK([IPTABLES -L IN_public_deny | grep "host-prohibited"], 0, ignore) - NS_CHECK([IPTABLES -L FWDI_public_deny | grep "host-prohibited"], 0, ignore) + +m4_if(nftables, FIREWALL_BACKEND, [ +NFT_LIST_RULES([inet], [filter_IN_public_deny | sed -e 's/icmp code 10/icmp code host-prohibited/'], 0, [dnl + table inet firewalld { + chain filter_IN_public_deny { + icmp type destination-unreachable icmp code host-prohibited reject with icmp type admin-prohibited + } + } +]) +NFT_LIST_RULES([inet], [filter_FWDI_public_deny | sed -e 's/icmp code 10/icmp code host-prohibited/'], 0, [dnl + table inet firewalld { + chain filter_FWDI_public_deny { + icmp type destination-unreachable icmp code host-prohibited reject with icmp type admin-prohibited + } + } +]) ], [ - NS_CHECK([nft list chain inet firewalld filter_IN_public_deny | grep "destination-unreachable" |grep "\(code 10\|host-prohibited\)"], 0, ignore) - NS_CHECK([nft list chain inet firewalld filter_FWDI_public_deny | grep "destination-unreachable" |grep "\(code 10\|host-prohibited\)"], 0, ignore) + +IPTABLES_LIST_RULES([filter], [IN_public_deny], 0, [dnl + REJECT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 3 code 10 reject-with icmp-host-prohibited +]) +IPTABLES_LIST_RULES([filter], [FWDI_public_deny], 0, [dnl + REJECT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 3 code 10 reject-with icmp-host-prohibited +]) ]) FWD_END_TEST diff --git a/src/tests/regression/rhbz1514043.at b/src/tests/regression/rhbz1514043.at index a9750a584898..ff2ede2ece71 100644 --- a/src/tests/regression/rhbz1514043.at +++ b/src/tests/regression/rhbz1514043.at @@ -5,11 +5,80 @@ FWD_RELOAD FWD_CHECK([--zone=public --list-all | TRIM | grep ^services], 0, [dnl services: dhcpv6-client samba ssh ]) + dnl check that log denied actually took effect -m4_if(iptables, FIREWALL_BACKEND, [ - NS_CHECK([IPTABLES -t filter -L | grep "FINAL_REJECT:"], 0, ignore) +m4_if(nftables, FIREWALL_BACKEND, [ +NFT_LIST_RULES([inet], [filter_INPUT], 0, [dnl + table inet firewalld { + chain filter_INPUT { + ct state established,related accept + iifname "lo" accept + jump filter_INPUT_ZONES + ct state invalid log prefix "STATE_INVALID_DROP: " + ct state invalid drop + log prefix "FINAL_REJECT: " + reject with icmpx type admin-prohibited + } + } +]) +NFT_LIST_RULES([inet], [filter_FORWARD], 0, [dnl + table inet firewalld { + chain filter_FORWARD { + ct state established,related accept + iifname "lo" accept + jump filter_FORWARD_IN_ZONES + jump filter_FORWARD_OUT_ZONES + ct state invalid log prefix "STATE_INVALID_DROP: " + ct state invalid drop + log prefix "FINAL_REJECT: " + reject with icmpx type admin-prohibited + } + } +]) ], [ - NS_CHECK([nft list chain inet firewalld filter_INPUT | grep "FINAL_REJECT"], 0, ignore) - NS_CHECK([nft list chain inet firewalld filter_FORWARD | grep "FINAL_REJECT"], 0, ignore) + +IPTABLES_LIST_RULES([filter], [INPUT], 0, [dnl + ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED + ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 + INPUT_direct all -- 0.0.0.0/0 0.0.0.0/0 + INPUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0 + LOG all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: " + DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID + LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "FINAL_REJECT: " + REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited +]) +IPTABLES_LIST_RULES([filter], [FORWARD], 0, [dnl + ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED + ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 + FORWARD_direct all -- 0.0.0.0/0 0.0.0.0/0 + FORWARD_IN_ZONES all -- 0.0.0.0/0 0.0.0.0/0 + FORWARD_OUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0 + LOG all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: " + DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID + LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "FINAL_REJECT: " + REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited +]) +IP6TABLES_LIST_RULES([filter], [INPUT], 0, [dnl + ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED + ACCEPT all ::/0 ::/0 + INPUT_direct all ::/0 ::/0 + INPUT_ZONES all ::/0 ::/0 + LOG all ::/0 ::/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: " + DROP all ::/0 ::/0 ctstate INVALID + LOG all ::/0 ::/0 LOG flags 0 level 4 prefix "FINAL_REJECT: " + REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited +]) +IP6TABLES_LIST_RULES([filter], [FORWARD], 0, [dnl + ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED + ACCEPT all ::/0 ::/0 + FORWARD_direct all ::/0 ::/0 + FORWARD_IN_ZONES all ::/0 ::/0 + FORWARD_OUT_ZONES all ::/0 ::/0 + LOG all ::/0 ::/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: " + DROP all ::/0 ::/0 ctstate INVALID + LOG all ::/0 ::/0 LOG flags 0 level 4 prefix "FINAL_REJECT: " + REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited +]) ]) + FWD_END_TEST -- 2.20.1