tests/01_configuration/01_ruleset

   1 Testing the ruleset rendered from the default firewall configuration.
   2
   3 -- Testcase --
   4 {%
   5         include("./root/usr/share/firewall4/main.uc", {
   6                 TRACE_CALLS: "stderr",
   7
   8                 getenv: function(varname) {
   9                         switch (varname) {
  10                         case 'ACTION':
  11                                 return 'print';
  12                         }
  13                 }
  14         })
  15 %}
  16 -- End --
  17
  18 -- Expect stdout --
  19 table inet fw4
  20 flush table inet fw4
  21
  22 table inet fw4 {
  23         #
  24         # Set definitions
  25         #
  26
  27
  28         #
  29         # Defines
  30         #
  31
  32         define lan_devices = { "br-lan" }
  33         define lan_subnets = { 192.168.26.0/24, fd63:e2f:f706::/60 }
  34         define wan_devices = { "wan" }
  35         define wan_subnets = { 10.11.12.0/24 }
  36
  37         #
  38         # User includes
  39         #
  40
  41         include "/etc/nftables.d/*.nft"
  42
  43
  44         #
  45         # Filter rules
  46         #
  47
  48         chain input {
  49                 type filter hook input priority filter; policy accept;
  50
  51                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
  52
  53                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
  54                 tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
  55                 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
  56                 iifname "wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
  57         }
  58
  59         chain forward {
  60                 type filter hook forward priority filter; policy drop;
  61
  62                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
  63                 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
  64                 iifname "wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
  65                 jump handle_reject
  66         }
  67
  68         chain output {
  69                 type filter hook output priority filter; policy accept;
  70
  71                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
  72
  73                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
  74                 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
  75                 oifname "wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
  76         }
  77
  78         chain handle_reject {
  79                 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
  80                 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
  81         }
  82
  83         chain syn_flood {
  84                 tcp flags & (fin | syn | rst | ack) == syn limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
  85                 drop comment "!fw4: Drop excess packets"
  86         }
  87
  88         chain input_lan {
  89                 jump accept_from_lan
  90         }
  91
  92         chain output_lan {
  93                 jump accept_to_lan
  94         }
  95
  96         chain forward_lan {
  97                 jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
  98                 jump accept_to_lan
  99         }
 100
 101         chain accept_from_lan {
 102                 iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
 103         }
 104
 105         chain accept_to_lan {
 106                 oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
 107         }
 108
 109         chain input_wan {
 110                 meta nfproto ipv4 udp dport 68 counter accept comment "!fw4: Allow-DHCP-Renew"
 111                 meta nfproto ipv4 icmp type 8 counter accept comment "!fw4: Allow-Ping"
 112                 meta nfproto ipv4 meta l4proto igmp counter accept comment "!fw4: Allow-IGMP"
 113                 ip6 saddr fc00::/6 ip6 daddr fc00::/6 udp dport 546 counter accept comment "!fw4: Allow-DHCPv6"
 114                 ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { 130 . 0, 131 . 0, 132 . 0, 143 . 0 } counter accept comment "!fw4: Allow-MLD"
 115                 meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3, 133, 134 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input"
 116                 meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1, 135 . 0, 136 . 0 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input"
 117                 jump reject_from_wan
 118         }
 119
 120         chain output_wan {
 121                 jump accept_to_wan
 122         }
 123
 124         chain forward_wan {
 125                 meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward"
 126                 meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward"
 127                 meta l4proto esp counter jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
 128                 udp dport 500 counter jump accept_to_lan comment "!fw4: Allow-ISAKMP"
 129                 jump reject_to_wan
 130         }
 131
 132         chain accept_to_wan {
 133                 oifname "wan" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic"
 134         }
 135
 136         chain reject_from_wan {
 137                 iifname "wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
 138         }
 139
 140         chain reject_to_wan {
 141                 oifname "wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
 142         }
 143
 144
 145         #
 146         # NAT rules
 147         #
 148
 149         chain dstnat {
 150                 type nat hook prerouting priority dstnat; policy accept;
 151         }
 152
 153         chain srcnat {
 154                 type nat hook postrouting priority srcnat; policy accept;
 155                 oifname "wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
 156         }
 157
 158         chain srcnat_wan {
 159                 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
 160         }
 161
 162
 163         #
 164         # Raw rules (notrack & helper)
 165         #
 166
 167         chain raw_prerouting {
 168                 type filter hook prerouting priority raw; policy accept;
 169                 iifname "br-lan" jump helper_lan comment "!fw4: lan IPv4/IPv6 CT helper assignment"
 170         }
 171
 172         chain raw_output {
 173                 type filter hook output priority raw; policy accept;
 174         }
 175
 176         ct helper amanda {
 177                 type "amanda" protocol udp;
 178         }
 179
 180         ct helper ftp {
 181                 type "ftp" protocol tcp;
 182         }
 183
 184         ct helper RAS {
 185                 type "RAS" protocol udp;
 186         }
 187
 188         ct helper Q.931 {
 189                 type "Q.931" protocol tcp;
 190         }
 191
 192         ct helper irc {
 193                 type "irc" protocol tcp;
 194         }
 195
 196         ct helper netbios-ns {
 197                 type "netbios-ns" protocol udp;
 198         }
 199
 200         ct helper pptp {
 201                 type "pptp" protocol tcp;
 202         }
 203
 204         ct helper sane {
 205                 type "sane" protocol tcp;
 206         }
 207
 208         ct helper sip {
 209                 type "sip" protocol udp;
 210         }
 211
 212         ct helper snmp {
 213                 type "snmp" protocol udp;
 214         }
 215
 216         ct helper tftp {
 217                 type "tftp" protocol udp;
 218         }
 219
 220         ct helper rtsp {
 221                 type "rtsp" protocol tcp;
 222         }
 223
 224         chain helper_lan {
 225                 meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
 226                 meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
 227                 meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
 228                 meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
 229                 meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
 230                 meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
 231                 meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
 232                 meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
 233                 meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
 234                 meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
 235                 meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
 236                 meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
 237         }
 238
 239
 240         #
 241         # Mangle rules
 242         #
 243
 244         chain mangle_prerouting {
 245                 type filter hook prerouting priority mangle; policy accept;
 246         }
 247
 248         chain mangle_output {
 249                 type filter hook output priority mangle; policy accept;
 250         }
 251
 252         chain mangle_forward {
 253                 type filter hook forward priority mangle; policy accept;
 254                 iifname "wan" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
 255                 oifname "wan" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
 256         }
 257 }
 258 -- End --
 259
 260 -- Expect stderr --
 261 [call] ctx.call object <network.interface> method <dump> args <null>
 262 [call] ctx.call object <service> method <get_data> args <{ "type": "firewall" }>
 263 [call] fs.open path </proc/version> mode <r>
 264 [call] fs.stat path </sys/module/nf_conntrack_amanda>
 265 [call] fs.stat path </sys/module/nf_conntrack_ftp>
 266 [call] fs.stat path </sys/module/nf_conntrack_h323>
 267 [call] fs.stat path </sys/module/nf_conntrack_h323>
 268 [call] fs.stat path </sys/module/nf_conntrack_irc>
 269 [call] fs.stat path </sys/module/nf_conntrack_netbios_ns>
 270 [call] fs.stat path </sys/module/nf_conntrack_pptp>
 271 [call] fs.stat path </sys/module/nf_conntrack_sane>
 272 [call] fs.stat path </sys/module/nf_conntrack_sip>
 273 [call] fs.stat path </sys/module/nf_conntrack_snmp>
 274 [call] fs.stat path </sys/module/nf_conntrack_tftp>
 275 [call] fs.stat path </sys/module/nf_conntrack_rtsp>
 276 [call] fs.open path </sys/class/net/br-lan/flags> mode <r>
 277 [call] fs.open path </sys/class/net/br-lan/flags> mode <r>
 278 -- End --