tests/04_forwardings/01_family_selections

   1 Test that the zone family is honoured when setting up inter-zone forwarding rules.
   2
   3 -- Testcase --
   4 {%
   5         include("./root/usr/share/firewall4/main.uc", {
   6                 getenv: function(varname) {
   7                         switch (varname) {
   8                         case 'ACTION':
   9                                 return 'print';
  10                         }
  11                 }
  12         })
  13 %}
  14 -- End --
  15
  16 -- File uci/helpers.json --
  17 {}
  18 -- End --
  19
  20 -- File uci/firewall.json --
  21 {
  22         "zone": [
  23                 {
  24                         "name": "wanA",
  25                         "device": [ "eth0" ],
  26                         "auto_helper": 0
  27                 },
  28
  29                 {
  30                         "name": "wanB",
  31                         "device": [ "eth1" ],
  32                         "auto_helper": 0
  33                 },
  34
  35                 {
  36                         "name": "lan",
  37                         "device": [ "eth2" ],
  38                         "auto_helper": 0
  39                 }
  40         ],
  41
  42         "forwarding": [
  43                 {
  44                         ".description": "This should only allow IPv6 forwarding from lan to wanA",
  45                         "src": "lan",
  46                         "dest": "wanA",
  47                         "family": "IPv6"
  48                 },
  49
  50                 {
  51                         ".description": "This should only allow IPv4 forwarding from lan to wanB",
  52                         "src": "lan",
  53                         "dest": "wanB",
  54                         "family": "IPv4"
  55                 }
  56         ]
  57 }
  58 -- End --
  59
  60 -- Expect stdout --
  61 table inet fw4
  62 flush table inet fw4
  63
  64 table inet fw4 {
  65         #
  66         # Set definitions
  67         #
  68
  69
  70         #
  71         # Defines
  72         #
  73
  74         define wanA_devices = { "eth0" }
  75         define wanB_devices = { "eth1" }
  76         define lan_devices = { "eth2" }
  77
  78         #
  79         # User includes
  80         #
  81
  82         include "/etc/nftables.d/*.nft"
  83
  84
  85         #
  86         # Filter rules
  87         #
  88
  89         chain input {
  90                 type filter hook input priority filter; policy drop;
  91
  92                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
  93
  94                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
  95                 iifname "eth0" jump input_wanA comment "!fw4: Handle wanA IPv4/IPv6 input traffic"
  96                 iifname "eth1" jump input_wanB comment "!fw4: Handle wanB IPv4/IPv6 input traffic"
  97                 iifname "eth2" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
  98         }
  99
 100         chain forward {
 101                 type filter hook forward priority filter; policy drop;
 102
 103                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
 104                 iifname "eth0" jump forward_wanA comment "!fw4: Handle wanA IPv4/IPv6 forward traffic"
 105                 iifname "eth1" jump forward_wanB comment "!fw4: Handle wanB IPv4/IPv6 forward traffic"
 106                 iifname "eth2" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
 107         }
 108
 109         chain output {
 110                 type filter hook output priority filter; policy drop;
 111
 112                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 113
 114                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
 115                 oifname "eth0" jump output_wanA comment "!fw4: Handle wanA IPv4/IPv6 output traffic"
 116                 oifname "eth1" jump output_wanB comment "!fw4: Handle wanB IPv4/IPv6 output traffic"
 117                 oifname "eth2" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
 118         }
 119
 120         chain prerouting {
 121                 type filter hook prerouting priority filter; policy accept;
 122         }
 123
 124         chain handle_reject {
 125                 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
 126                 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
 127         }
 128
 129         chain input_wanA {
 130                 jump drop_from_wanA
 131         }
 132
 133         chain output_wanA {
 134                 jump drop_to_wanA
 135         }
 136
 137         chain forward_wanA {
 138                 jump drop_to_wanA
 139         }
 140
 141         chain accept_to_wanA {
 142                 oifname "eth0" counter accept comment "!fw4: accept wanA IPv4/IPv6 traffic"
 143         }
 144
 145         chain drop_from_wanA {
 146                 iifname "eth0" counter drop comment "!fw4: drop wanA IPv4/IPv6 traffic"
 147         }
 148
 149         chain drop_to_wanA {
 150                 oifname "eth0" counter drop comment "!fw4: drop wanA IPv4/IPv6 traffic"
 151         }
 152
 153         chain input_wanB {
 154                 jump drop_from_wanB
 155         }
 156
 157         chain output_wanB {
 158                 jump drop_to_wanB
 159         }
 160
 161         chain forward_wanB {
 162                 jump drop_to_wanB
 163         }
 164
 165         chain accept_to_wanB {
 166                 oifname "eth1" counter accept comment "!fw4: accept wanB IPv4/IPv6 traffic"
 167         }
 168
 169         chain drop_from_wanB {
 170                 iifname "eth1" counter drop comment "!fw4: drop wanB IPv4/IPv6 traffic"
 171         }
 172
 173         chain drop_to_wanB {
 174                 oifname "eth1" counter drop comment "!fw4: drop wanB IPv4/IPv6 traffic"
 175         }
 176
 177         chain input_lan {
 178                 jump drop_from_lan
 179         }
 180
 181         chain output_lan {
 182                 jump drop_to_lan
 183         }
 184
 185         chain forward_lan {
 186                 meta nfproto ipv6 jump accept_to_wanA comment "!fw4: Accept lan to wanA IPv6 forwarding"
 187                 meta nfproto ipv4 jump accept_to_wanB comment "!fw4: Accept lan to wanB IPv4 forwarding"
 188                 jump drop_to_lan
 189         }
 190
 191         chain drop_from_lan {
 192                 iifname "eth2" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
 193         }
 194
 195         chain drop_to_lan {
 196                 oifname "eth2" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
 197         }
 198
 199
 200         #
 201         # NAT rules
 202         #
 203
 204         chain dstnat {
 205                 type nat hook prerouting priority dstnat; policy accept;
 206         }
 207
 208         chain srcnat {
 209                 type nat hook postrouting priority srcnat; policy accept;
 210         }
 211
 212
 213         #
 214         # Raw rules (notrack)
 215         #
 216
 217         chain raw_prerouting {
 218                 type filter hook prerouting priority raw; policy accept;
 219         }
 220
 221         chain raw_output {
 222                 type filter hook output priority raw; policy accept;
 223         }
 224
 225
 226         #
 227         # Mangle rules
 228         #
 229
 230         chain mangle_prerouting {
 231                 type filter hook prerouting priority mangle; policy accept;
 232         }
 233
 234         chain mangle_postrouting {
 235                 type filter hook postrouting priority mangle; policy accept;
 236         }
 237
 238         chain mangle_input {
 239                 type filter hook input priority mangle; policy accept;
 240         }
 241
 242         chain mangle_output {
 243                 type route hook output priority mangle; policy accept;
 244         }
 245
 246         chain mangle_forward {
 247                 type filter hook forward priority mangle; policy accept;
 248         }
 249 }
 250 -- End --