ruleset: fix conntrack helpers

[project/firewall4.git] / tests / 03_rules / 03_constraints

diff --git a/tests/03_rules/03_constraints b/tests/03_rules/03_constraints
index 8b1e04b4a4cce8ec3a42debee02b5927251f05fa..51b1ab92a46f8bbda98307f0086e748b2b52dc53 100644 (file)
--- a/tests/03_rules/03_constraints
+++ b/tests/03_rules/03_constraints
@@ -47,30 +47,23 @@ Testing various option constraints.
                },
 
                {
-                       ".description": "DSCP rules must not specify a destination",
+                       ".description": "DSCP target rules require a set_dscp option",
                        "proto": "any",
-                       "name": "DSCP rule #1",
-                       "dest": "*",
-                       "target": "dscp"
-               },
-               {
-                       ".description": "DSCP rules require a set_dscp option",
-                       "proto": "any",
-                       "name": "DSCP rule #2",
+                       "name": "DSCP target rule #1",
                        "target": "dscp"
                },
 
                {
-                       ".description": "Mark rules must not specify a destination",
+                       ".description": "DSCP matches enforce AF specific rules due to required ip/ip6 prefix",
                        "proto": "any",
-                       "name": "Mark rule #1",
-                       "dest": "*",
-                       "target": "mark"
+                       "name": "DSCP match rule #1",
+                       "dscp": "0x0"
                },
+
                {
                        ".description": "Mark rules require a set_xmark or set_mark option",
                        "proto": "any",
-                       "name": "Mark rule #2",
+                       "name": "Mark rule #1",
                        "target": "mark"
                },
        ]
@@ -81,10 +74,8 @@ Testing various option constraints.
 [!] Section @rule[0] (Helper rule #1) must specify a source zone for target 'helper'
 [!] Section @rule[1] (Helper rule #2) must specify option 'set_helper' for target 'helper'
 [!] Section @rule[2] (Notrack rule) must specify a source zone for target 'notrack'
-[!] Section @rule[3] (DSCP rule #1) must not specify option 'dest' for target 'dscp'
-[!] Section @rule[4] (DSCP rule #2) must specify option 'set_dscp' for target 'dscp'
-[!] Section @rule[5] (Mark rule #1) must not specify option 'dest' for target 'mark'
-[!] Section @rule[6] (Mark rule #2) must specify option 'set_mark' or 'set_xmark' for target 'mark'
+[!] Section @rule[3] (DSCP target rule #1) must specify option 'set_dscp' for target 'dscp'
+[!] Section @rule[5] (Mark rule #1) must specify option 'set_mark' or 'set_xmark' for target 'mark'
 -- End --
 
 -- Expect stdout --
@@ -133,6 +124,12 @@ table inet fw4 {
                oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 
                ct state established,related accept comment "!fw4: Allow outbound established and related flows"
+               meta nfproto ipv4 ip dscp 0x0 counter comment "!fw4: DSCP match rule #1"
+               meta nfproto ipv6 ip6 dscp 0x0 counter comment "!fw4: DSCP match rule #1"
+       }
+
+       chain prerouting {
+               type filter hook prerouting priority filter; policy accept;
        }
 
        chain handle_reject {
@@ -152,6 +149,9 @@ table inet fw4 {
                jump drop_to_lan
        }
 
+       chain helper_lan {
+       }
+
        chain drop_from_lan {
        }
 
@@ -173,7 +173,7 @@ table inet fw4 {
 
 
        #
-       # Raw rules (notrack & helper)
+       # Raw rules (notrack)
        #
 
        chain raw_prerouting {
@@ -184,9 +184,6 @@ table inet fw4 {
                type filter hook output priority raw; policy accept;
        }
 
-       chain helper_lan {
-       }
-
 
        #
        # Mangle rules
@@ -196,8 +193,16 @@ table inet fw4 {
                type filter hook prerouting priority mangle; policy accept;
        }
 
+       chain mangle_postrouting {
+               type filter hook postrouting priority mangle; policy accept;
+       }
+
+       chain mangle_input {
+               type filter hook input priority mangle; policy accept;
+       }
+
        chain mangle_output {
-               type filter hook output priority mangle; policy accept;
+               type route hook output priority mangle; policy accept;
        }
 
        chain mangle_forward {