1 Testing that zone policies are properly mapped to chains.
5 include("./root/usr/share/firewall4/main.uc", {
6 getenv: function(varname) {
16 -- File uci/helpers.json --
20 -- File fs/open~_sys_class_net_zone1_flags.txt --
24 -- File fs/open~_sys_class_net_zone2_flags.txt --
28 -- File fs/open~_sys_class_net_zone3_flags.txt --
32 -- File uci/firewall.json --
36 ".description": "Zone accept policies should map to accept rules from/to covered interfaces",
44 ".description": "Zone drop policies should map to drop rules from/to covered interfaces",
52 ".description": "Zone reject policies should map to reject rules from/to covered interfaces",
77 define test1_devices = { "zone1" }
78 define test2_devices = { "zone2" }
79 define test3_devices = { "zone3" }
85 include "/etc/nftables.d/*.nft"
93 type filter hook input priority filter; policy drop;
95 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
97 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
98 iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
99 iifname "zone2" jump input_test2 comment "!fw4: Handle test2 IPv4/IPv6 input traffic"
100 iifname "zone3" jump input_test3 comment "!fw4: Handle test3 IPv4/IPv6 input traffic"
104 type filter hook forward priority filter; policy drop;
106 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
107 iifname "zone1" jump forward_test1 comment "!fw4: Handle test1 IPv4/IPv6 forward traffic"
108 iifname "zone2" jump forward_test2 comment "!fw4: Handle test2 IPv4/IPv6 forward traffic"
109 iifname "zone3" jump forward_test3 comment "!fw4: Handle test3 IPv4/IPv6 forward traffic"
113 type filter hook output priority filter; policy drop;
115 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
117 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
118 oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
119 oifname "zone2" jump output_test2 comment "!fw4: Handle test2 IPv4/IPv6 output traffic"
120 oifname "zone3" jump output_test3 comment "!fw4: Handle test3 IPv4/IPv6 output traffic"
123 chain handle_reject {
124 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
125 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
129 jump accept_from_test1
136 chain forward_test1 {
140 chain accept_from_test1 {
141 iifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
144 chain accept_to_test1 {
145 oifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
156 chain forward_test2 {
160 chain drop_from_test2 {
161 iifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
164 chain drop_to_test2 {
165 oifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
169 jump reject_from_test3
176 chain forward_test3 {
180 chain reject_from_test3 {
181 iifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
184 chain reject_to_test3 {
185 oifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
194 type nat hook prerouting priority dstnat; policy accept;
198 type nat hook postrouting priority srcnat; policy accept;
203 # Raw rules (notrack & helper)
206 chain raw_prerouting {
207 type filter hook prerouting priority raw; policy accept;
208 iifname "zone1" jump helper_test1 comment "!fw4: test1 IPv4/IPv6 CT helper assignment"
209 iifname "zone2" jump helper_test2 comment "!fw4: test2 IPv4/IPv6 CT helper assignment"
210 iifname "zone3" jump helper_test3 comment "!fw4: test3 IPv4/IPv6 CT helper assignment"
214 type filter hook output priority raw; policy accept;
231 chain mangle_prerouting {
232 type filter hook prerouting priority mangle; policy accept;
235 chain mangle_postrouting {
236 type filter hook postrouting priority mangle; policy accept;
240 type filter hook input priority mangle; policy accept;
243 chain mangle_output {
244 type route hook output priority mangle; policy accept;
247 chain mangle_forward {
248 type filter hook forward priority mangle; policy accept;