1 Testing that zone policies are properly mapped to chains.
5 include("./root/usr/share/firewall4/main.uc", {
6 getenv: function(varname) {
16 -- File uci/helpers.json --
20 -- File fs/open~_sys_class_net_zone1_flags.txt --
24 -- File fs/open~_sys_class_net_zone2_flags.txt --
28 -- File fs/open~_sys_class_net_zone3_flags.txt --
32 -- File uci/firewall.json --
36 ".description": "Zone accept policies should map to accept rules from/to covered interfaces",
44 ".description": "Zone drop policies should map to drop rules from/to covered interfaces",
52 ".description": "Zone reject policies should map to reject rules from/to covered interfaces",
77 define test1_devices = { "zone1" }
78 define test2_devices = { "zone2" }
79 define test3_devices = { "zone3" }
85 include "/etc/nftables.d/*.nft"
93 type filter hook input priority filter; policy drop;
95 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
97 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
98 iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
99 iifname "zone2" jump input_test2 comment "!fw4: Handle test2 IPv4/IPv6 input traffic"
100 iifname "zone3" jump input_test3 comment "!fw4: Handle test3 IPv4/IPv6 input traffic"
104 type filter hook forward priority filter; policy drop;
106 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
107 iifname "zone1" jump forward_test1 comment "!fw4: Handle test1 IPv4/IPv6 forward traffic"
108 iifname "zone2" jump forward_test2 comment "!fw4: Handle test2 IPv4/IPv6 forward traffic"
109 iifname "zone3" jump forward_test3 comment "!fw4: Handle test3 IPv4/IPv6 forward traffic"
113 type filter hook output priority filter; policy drop;
115 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
117 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
118 oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
119 oifname "zone2" jump output_test2 comment "!fw4: Handle test2 IPv4/IPv6 output traffic"
120 oifname "zone3" jump output_test3 comment "!fw4: Handle test3 IPv4/IPv6 output traffic"
124 type filter hook prerouting priority filter; policy accept;
125 iifname "zone1" jump helper_test1 comment "!fw4: test1 IPv4/IPv6 CT helper assignment"
126 iifname "zone2" jump helper_test2 comment "!fw4: test2 IPv4/IPv6 CT helper assignment"
127 iifname "zone3" jump helper_test3 comment "!fw4: test3 IPv4/IPv6 CT helper assignment"
130 chain handle_reject {
131 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
132 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
136 jump accept_from_test1
143 chain forward_test1 {
150 chain accept_from_test1 {
151 iifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
154 chain accept_to_test1 {
155 oifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
166 chain forward_test2 {
173 chain drop_from_test2 {
174 iifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
177 chain drop_to_test2 {
178 oifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
182 jump reject_from_test3
189 chain forward_test3 {
196 chain reject_from_test3 {
197 iifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
200 chain reject_to_test3 {
201 oifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
210 type nat hook prerouting priority dstnat; policy accept;
214 type nat hook postrouting priority srcnat; policy accept;
219 # Raw rules (notrack)
222 chain raw_prerouting {
223 type filter hook prerouting priority raw; policy accept;
227 type filter hook output priority raw; policy accept;
235 chain mangle_prerouting {
236 type filter hook prerouting priority mangle; policy accept;
239 chain mangle_postrouting {
240 type filter hook postrouting priority mangle; policy accept;
244 type filter hook input priority mangle; policy accept;
247 chain mangle_output {
248 type route hook output priority mangle; policy accept;
251 chain mangle_forward {
252 type filter hook forward priority mangle; policy accept;