From 897057a413460d6cfa5ef3be203347adfdb19307 Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Wed, 10 Jun 2020 09:07:16 -0400 Subject: [PATCH 156/156] test(service): coverage for RH-Satellite-6 Since we changed a RH-Satellite-6 to use includes, verify that the ports, etc are still correct. (cherry picked from commit 7beeb958d40cf840c9efc8edd323bf669d15b11b) (cherry picked from commit 668eab33cf0d2cc7f428ec1d1857e61464d306a6) --- src/tests/regression/regression.at | 1 + src/tests/regression/rhbz1839781.at | 109 ++++++++++++++++++++++++++++ 2 files changed, 110 insertions(+) create mode 100644 src/tests/regression/rhbz1839781.at diff --git a/src/tests/regression/regression.at b/src/tests/regression/regression.at index f85cdb4c47f7..42f299f16f1a 100644 --- a/src/tests/regression/regression.at +++ b/src/tests/regression/regression.at @@ -27,3 +27,4 @@ m4_include([regression/gh509.at]) m4_include([regression/gh567.at]) m4_include([regression/rhbz1779835.at]) m4_include([regression/gh599.at]) +m4_include([regression/rhbz1839781.at]) diff --git a/src/tests/regression/rhbz1839781.at b/src/tests/regression/rhbz1839781.at new file mode 100644 index 000000000000..bc539b0144e7 --- /dev/null +++ b/src/tests/regression/rhbz1839781.at @@ -0,0 +1,109 @@ +FWD_START_TEST([service RH-Satellite-6]) +AT_KEYWORDS(service rhbz1839781) + +FWD_CHECK([--zone trusted --add-interface dummy0], 0, [ignore]) +FWD_CHECK([--zone trusted --add-service RH-Satellite-6], 0, [ignore]) + +NFT_LIST_RULES([inet], [filter_IN_trusted_allow], 0, [dnl + table inet firewalld { + chain filter_IN_trusted_allow { + tcp dport 53 ct state new,untracked accept + udp dport 53 ct state new,untracked accept + udp dport 67-69 ct state new,untracked accept + tcp dport 80 ct state new,untracked accept + tcp dport 443 ct state new,untracked accept + tcp dport 5000 ct state new,untracked accept + tcp dport 5646-5647 ct state new,untracked accept + tcp dport 5671 ct state new,untracked accept + tcp dport 8000 ct state new,untracked accept + tcp dport 8080 ct state new,untracked accept + tcp dport 8140 ct state new,untracked accept + tcp dport 9090 ct state new,untracked accept + } + } +]) + +IPTABLES_LIST_RULES([filter], [IN_trusted_allow], 0, [dnl + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 ctstate NEW,UNTRACKED + ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53 ctstate NEW,UNTRACKED + ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpts:67:69 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:5000 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpts:5646:5647 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:5671 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8000 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8140 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 ctstate NEW,UNTRACKED +]) +IP6TABLES_LIST_RULES([filter], [IN_trusted_allow], 0, [dnl + ACCEPT tcp ::/0 ::/0 tcp dpt:53 ctstate NEW,UNTRACKED + ACCEPT udp ::/0 ::/0 udp dpt:53 ctstate NEW,UNTRACKED + ACCEPT udp ::/0 ::/0 udp dpts:67:69 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:80 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:443 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:5000 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpts:5646:5647 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:5671 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:8000 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:8080 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:8140 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:9090 ctstate NEW,UNTRACKED +]) + +FWD_CHECK([--zone trusted --remove-service RH-Satellite-6], 0, [ignore]) +FWD_CHECK([--zone trusted --add-service RH-Satellite-6-capsule], 0, [ignore]) + +NFT_LIST_RULES([inet], [filter_IN_trusted_allow], 0, [dnl + table inet firewalld { + chain filter_IN_trusted_allow { + tcp dport 53 ct state new,untracked accept + udp dport 53 ct state new,untracked accept + udp dport 67-69 ct state new,untracked accept + tcp dport 80 ct state new,untracked accept + tcp dport 443 ct state new,untracked accept + tcp dport 5000 ct state new,untracked accept + tcp dport 5646-5647 ct state new,untracked accept + tcp dport 5671 ct state new,untracked accept + tcp dport 8000 ct state new,untracked accept + tcp dport 8080 ct state new,untracked accept + tcp dport 8140 ct state new,untracked accept + tcp dport 9090 ct state new,untracked accept + tcp dport 8443 ct state new,untracked accept + } + } +]) + +IPTABLES_LIST_RULES([filter], [IN_trusted_allow], 0, [dnl + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 ctstate NEW,UNTRACKED + ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53 ctstate NEW,UNTRACKED + ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpts:67:69 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:5000 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpts:5646:5647 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:5671 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8000 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8140 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8443 ctstate NEW,UNTRACKED +]) +IP6TABLES_LIST_RULES([filter], [IN_trusted_allow], 0, [dnl + ACCEPT tcp ::/0 ::/0 tcp dpt:53 ctstate NEW,UNTRACKED + ACCEPT udp ::/0 ::/0 udp dpt:53 ctstate NEW,UNTRACKED + ACCEPT udp ::/0 ::/0 udp dpts:67:69 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:80 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:443 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:5000 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpts:5646:5647 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:5671 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:8000 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:8080 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:8140 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:9090 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:8443 ctstate NEW,UNTRACKED +]) + +FWD_END_TEST -- 2.25.2