1 Testing that include sections with `option enabled 0` are skipped.
5 include("./root/usr/share/firewall4/main.uc", {
6 getenv: function(varname) {
16 -- File uci/helpers.json --
20 -- File fs/open~_sys_class_net_eth0_flags.txt --
24 -- File fs/open~_etc_testinclude1_nft.txt --
28 -- File fs/open~_etc_testinclude2_nft.txt --
32 -- File fs/open~_etc_testinclude3_nft.txt --
36 -- File uci/firewall.json --
47 ".description": "By default, this include should be processed due to implicit enabled 1",
48 "path": "/etc/testinclude1.nft",
53 ".description": "This include should be processed due to explicit enabled 1",
54 "path": "/etc/testinclude2.nft",
60 ".description": "This include should be skipped due to explicit enabled 0",
61 "path": "/etc/testinclude3.nft",
70 [!] Section @include[2] is disabled, ignoring section
82 define test_devices = { "eth0" }
83 define test_subnets = { }
90 include "/etc/nftables.d/*.nft"
98 type filter hook input priority filter; policy drop;
100 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
102 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
103 iifname "eth0" jump input_test comment "!fw4: Handle test IPv4/IPv6 input traffic"
107 type filter hook forward priority filter; policy drop;
109 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
110 iifname "eth0" jump forward_test comment "!fw4: Handle test IPv4/IPv6 forward traffic"
114 type filter hook output priority filter; policy drop;
116 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
118 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
119 oifname "eth0" jump output_test comment "!fw4: Handle test IPv4/IPv6 output traffic"
123 type filter hook prerouting priority filter; policy accept;
126 chain handle_reject {
127 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
128 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
143 chain drop_from_test {
144 iifname "eth0" counter drop comment "!fw4: drop test IPv4/IPv6 traffic"
148 oifname "eth0" counter drop comment "!fw4: drop test IPv4/IPv6 traffic"
157 type nat hook prerouting priority dstnat; policy accept;
161 type nat hook postrouting priority srcnat; policy accept;
166 # Raw rules (notrack)
169 chain raw_prerouting {
170 type filter hook prerouting priority raw; policy accept;
174 type filter hook output priority raw; policy accept;
182 chain mangle_prerouting {
183 type filter hook prerouting priority mangle; policy accept;
186 chain mangle_postrouting {
187 type filter hook postrouting priority mangle; policy accept;
191 type filter hook input priority mangle; policy accept;
194 chain mangle_output {
195 type route hook output priority mangle; policy accept;
198 chain mangle_forward {
199 type filter hook forward priority mangle; policy accept;
202 include "/etc/testinclude1.nft"
203 include "/etc/testinclude2.nft"