From 6e32ff7eabc88e57b4f4831eece15918fc4bda85 Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Fri, 23 Aug 2019 15:00:45 -0400 Subject: [PATCH 93/99] test: coverage to make sure masquerade/forward-port only affect IPv4 (cherry picked from commit 5605eefb65adbbe7d6980cc90245f940042c9b78) (cherry picked from commit 1340fac01a6d64458e7a751807a54c0a5b38dde3) --- src/tests/firewall-cmd.at | 76 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 76 insertions(+) diff --git a/src/tests/firewall-cmd.at b/src/tests/firewall-cmd.at index 6a4b670d7935..590194103a7e 100644 --- a/src/tests/firewall-cmd.at +++ b/src/tests/firewall-cmd.at @@ -438,6 +438,25 @@ FWD_END_TEST([-e '/ERROR: INVALID_PROTOCOL: dummy/d']) FWD_START_TEST([masquerade]) FWD_CHECK([--add-masquerade --zone=public], 0, ignore) + dnl man page says this should only affect IPv4, so verify that. + NFT_LIST_RULES([ip], [nat_POST_public_allow], 0, [dnl + table ip firewalld { + chain nat_POST_public_allow { + oifname != "lo" masquerade + } + } + ]) + NFT_LIST_RULES([ip6], [nat_POST_public_allow], 0, [dnl + table ip6 firewalld { + chain nat_POST_public_allow { + } + } + ]) + IPTABLES_LIST_RULES([nat], [POST_public_allow], 0, [dnl + MASQUERADE all -- 0.0.0.0/0 0.0.0.0/0 + ]) + IP6TABLES_LIST_RULES([nat], [POST_public_allow], 0, [dnl + ]) FWD_CHECK([--query-masquerade], 0, ignore) FWD_CHECK([--remove-masquerade], 0, ignore) FWD_CHECK([--query-masquerade], 1, ignore) @@ -451,9 +470,47 @@ FWD_END_TEST FWD_START_TEST([forward ports]) FWD_CHECK([--add-forward-port=666], 106, ignore, ignore) FWD_CHECK([--add-forward-port=port=11:proto=tcp:toport=22], 0, ignore) + dnl man page says this should only affect IPv4, so verify that. + NFT_LIST_RULES([ip], [nat_PRE_public_allow], 0, [dnl + table ip firewalld { + chain nat_PRE_public_allow { + meta l4proto tcp mark 0x00000064 redirect to :22 + } + } + ]) + NFT_LIST_RULES([ip6], [nat_PRE_public_allow], 0, [dnl + table ip6 firewalld { + chain nat_PRE_public_allow { + } + } + ]) + IPTABLES_LIST_RULES([nat], [PRE_public_allow], 0, [dnl + DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 mark match 0x64 to::22 + ]) + IP6TABLES_LIST_RULES([nat], [PRE_public_allow], 0, [dnl + ]) FWD_CHECK([--remove-forward-port=port=11:proto=tcp:toport=22 --zone=public], 0, ignore) FWD_CHECK([--add-forward-port=port=33:proto=tcp:toaddr=4444], 105, ignore, ignore) dnl bad address FWD_CHECK([--add-forward-port=port=33:proto=tcp:toaddr=4.4.4.4 --zone=public], 0, ignore) + dnl man page says this should only affect IPv4, so verify that. + NFT_LIST_RULES([ip], [nat_PRE_public_allow], 0, [dnl + table ip firewalld { + chain nat_PRE_public_allow { + meta l4proto tcp mark 0x00000064 dnat to 4.4.4.4 + } + } + ]) + NFT_LIST_RULES([ip6], [nat_PRE_public_allow], 0, [dnl + table ip6 firewalld { + chain nat_PRE_public_allow { + } + } + ]) + IPTABLES_LIST_RULES([nat], [PRE_public_allow], 0, [dnl + DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 mark match 0x64 to:4.4.4.4 + ]) + IP6TABLES_LIST_RULES([nat], [PRE_public_allow], 0, [dnl + ]) FWD_CHECK([--remove-forward-port=port=33:proto=tcp:toaddr=4.4.4.4], 0, ignore) FWD_CHECK([--add-forward-port=port=55:proto=tcp:toport=66:toaddr=7.7.7.7], 0, ignore) FWD_CHECK([--query-forward-port port=55:proto=tcp:toport=66:toaddr=7.7.7.7 --zone=public], 0, ignore) @@ -465,6 +522,25 @@ FWD_START_TEST([forward ports]) FWD_CHECK([--query-forward-port=port=66:proto=sctp:toport=66:toaddr=7.7.7.7], 1, ignore) IF_IPV6_SUPPORTED([ FWD_CHECK([--add-forward-port=port=66:proto=sctp:toport=66:toaddr=fd00:dead:beef:ff0::], 0, ignore) + dnl this should only affect IPv6, so verify that. + NFT_LIST_RULES([ip], [nat_PRE_public_allow], 0, [dnl + table ip firewalld { + chain nat_PRE_public_allow { + } + } + ]) + NFT_LIST_RULES([ip6], [nat_PRE_public_allow], 0, [dnl + table ip6 firewalld { + chain nat_PRE_public_allow { + meta l4proto sctp mark 0x00000064 dnat to [[fd00:dead:beef:ff0::]:66] + } + } + ]) + IPTABLES_LIST_RULES([nat], [PRE_public_allow], 0, [dnl + ]) + IP6TABLES_LIST_RULES([nat], [PRE_public_allow], 0, [dnl + DNAT sctp ::/0 ::/0 mark match 0x64 [to:[fd00:dead:beef:ff0::]:66] + ]) FWD_CHECK([--query-forward-port port=66:proto=sctp:toport=66:toaddr=fd00:dead:beef:ff0:: --zone=public], 0, ignore) FWD_CHECK([--remove-forward-port=port=66:proto=sctp:toport=66:toaddr=fd00:dead:beef:ff0::], 0, ignore) FWD_CHECK([--query-forward-port=port=66:proto=sctp:toport=66:toaddr=fd00:dead:beef:ff0::], 1, ignore) -- 2.20.1