87 lines
4.2 KiB
Diff
87 lines
4.2 KiB
Diff
|
From ed0b0a7f967f33729e4ec7472b4229f0317fd92d Mon Sep 17 00:00:00 2001
|
||
|
|
From: Eric Garver <eric@garver.life>
|
||
|
|
Date: Fri, 9 Apr 2021 13:34:31 -0400
|
||
|
|
Subject: [PATCH 24/30] test(direct): verify rule order with multiple address
|
||
|
|
with -s/-d
|
||
|
|
|
||
|
|
Coverage: rhbz 1940928
|
||
|
|
Coverage: rhbz 1949552
|
||
|
|
(cherry picked from commit 80c30dacc066af4d6d71d298b5e47625ecee5bdf)
|
||
|
|
(cherry picked from commit c1262441db90108eb8044053ae1b93f66f0c2839)
|
||
|
|
---
|
||
|
|
src/tests/regression/regression.at | 1 +
|
||
|
|
src/tests/regression/rhbz1940928.at | 52 +++++++++++++++++++++++++++++
|
||
|
|
2 files changed, 53 insertions(+)
|
||
|
|
create mode 100644 src/tests/regression/rhbz1940928.at
|
||
|
|
|
||
|
|
diff --git a/src/tests/regression/regression.at b/src/tests/regression/regression.at
|
||
|
|
index a49bb3b756e7..8156ee608189 100644
|
||
|
|
--- a/src/tests/regression/regression.at
|
||
|
|
+++ b/src/tests/regression/regression.at
|
||
|
|
@@ -39,3 +39,4 @@ m4_include([regression/rhbz1871298.at])
|
||
|
|
m4_include([regression/rhbz1596304.at])
|
||
|
|
m4_include([regression/gh703.at])
|
||
|
|
m4_include([regression/ipset_netmask_allowed.at])
|
||
|
|
+m4_include([regression/rhbz1940928.at])
|
||
|
|
diff --git a/src/tests/regression/rhbz1940928.at b/src/tests/regression/rhbz1940928.at
|
||
|
|
new file mode 100644
|
||
|
|
index 000000000000..0a4367080b5e
|
||
|
|
--- /dev/null
|
||
|
|
+++ b/src/tests/regression/rhbz1940928.at
|
||
|
|
@@ -0,0 +1,52 @@
|
||
|
|
+FWD_START_TEST([direct -s/-d multiple addresses])
|
||
|
|
+AT_KEYWORDS(direct rhbz1940928 rhbz1949552)
|
||
|
|
+CHECK_IPTABLES
|
||
|
|
+
|
||
|
|
+dnl test triggers a limitation in iptables-restore
|
||
|
|
+dnl
|
||
|
|
+AT_CHECK([sed -i 's/^IndividualCalls.*/IndividualCalls=no/' ./firewalld.conf])
|
||
|
|
+FWD_RELOAD
|
||
|
|
+
|
||
|
|
+FWD_CHECK([--direct --add-rule ipv4 filter OUTPUT 0 -m state --state ESTABLISHED,RELATED -j ACCEPT], 0, [ignore], [ignore])
|
||
|
|
+FWD_CHECK([--direct --add-rule ipv4 filter OUTPUT 2 -p tcp -d 10.0.0.0/8,172.16.0.0/16,192.168.0.0/24 -j ACCEPT], 0, [ignore], [ignore])
|
||
|
|
+FWD_CHECK([--direct --add-rule ipv4 filter OUTPUT 2 -p udp -d 10.0.0.0/8,172.16.0.0/16,192.168.0.0/24 -j ACCEPT], 0, [ignore], [ignore])
|
||
|
|
+FWD_CHECK([--direct --add-rule ipv4 filter OUTPUT 9 -j DROP], 0, [ignore], [ignore])
|
||
|
|
+
|
||
|
|
+IPTABLES_LIST_RULES_ALWAYS([filter], [m4_if(iptables, FIREWALL_BACKEND, [OUTPUT_direct], [OUTPUT])], 0, [dnl
|
||
|
|
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
|
||
|
|
+ ACCEPT tcp -- 0.0.0.0/0 10.0.0.0/8
|
||
|
|
+ ACCEPT tcp -- 0.0.0.0/0 172.16.0.0/16
|
||
|
|
+ ACCEPT tcp -- 0.0.0.0/0 192.168.0.0/24
|
||
|
|
+ ACCEPT udp -- 0.0.0.0/0 10.0.0.0/8
|
||
|
|
+ ACCEPT udp -- 0.0.0.0/0 172.16.0.0/16
|
||
|
|
+ ACCEPT udp -- 0.0.0.0/0 192.168.0.0/24
|
||
|
|
+ DROP all -- 0.0.0.0/0 0.0.0.0/0
|
||
|
|
+])
|
||
|
|
+
|
||
|
|
+FWD_CHECK([--direct --add-rule ipv4 filter OUTPUT 1 -p sctp -d 10.0.0.0/8,172.16.0.0/16,192.168.0.0/24 -j ACCEPT], 0, [ignore], [ignore])
|
||
|
|
+
|
||
|
|
+IPTABLES_LIST_RULES_ALWAYS([filter], [m4_if(iptables, FIREWALL_BACKEND, [OUTPUT_direct], [OUTPUT])], 0, [dnl
|
||
|
|
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
|
||
|
|
+ ACCEPT sctp -- 0.0.0.0/0 10.0.0.0/8
|
||
|
|
+ ACCEPT sctp -- 0.0.0.0/0 172.16.0.0/16
|
||
|
|
+ ACCEPT sctp -- 0.0.0.0/0 192.168.0.0/24
|
||
|
|
+ ACCEPT tcp -- 0.0.0.0/0 10.0.0.0/8
|
||
|
|
+ ACCEPT tcp -- 0.0.0.0/0 172.16.0.0/16
|
||
|
|
+ ACCEPT tcp -- 0.0.0.0/0 192.168.0.0/24
|
||
|
|
+ ACCEPT udp -- 0.0.0.0/0 10.0.0.0/8
|
||
|
|
+ ACCEPT udp -- 0.0.0.0/0 172.16.0.0/16
|
||
|
|
+ ACCEPT udp -- 0.0.0.0/0 192.168.0.0/24
|
||
|
|
+ DROP all -- 0.0.0.0/0 0.0.0.0/0
|
||
|
|
+])
|
||
|
|
+
|
||
|
|
+FWD_CHECK([--direct --remove-rule ipv4 filter OUTPUT 0 -m state --state ESTABLISHED,RELATED -j ACCEPT], 0, [ignore], [ignore])
|
||
|
|
+FWD_CHECK([--direct --remove-rule ipv4 filter OUTPUT 1 -p sctp -d 10.0.0.0/8,172.16.0.0/16,192.168.0.0/24 -j ACCEPT], 0, [ignore], [ignore])
|
||
|
|
+FWD_CHECK([--direct --remove-rule ipv4 filter OUTPUT 2 -p tcp -d 10.0.0.0/8,172.16.0.0/16,192.168.0.0/24 -j ACCEPT], 0, [ignore], [ignore])
|
||
|
|
+FWD_CHECK([--direct --remove-rule ipv4 filter OUTPUT 2 -p udp -d 10.0.0.0/8,172.16.0.0/16,192.168.0.0/24 -j ACCEPT], 0, [ignore], [ignore])
|
||
|
|
+FWD_CHECK([--direct --remove-rule ipv4 filter OUTPUT 9 -j DROP], 0, [ignore], [ignore])
|
||
|
|
+
|
||
|
|
+
|
||
|
|
+IPTABLES_LIST_RULES_ALWAYS([filter], [m4_if(iptables, FIREWALL_BACKEND, [OUTPUT_direct], [OUTPUT])], 0, [dnl
|
||
|
|
+])
|
||
|
|
+
|
||
|
|
+FWD_END_TEST
|
||
|
|
--
|
||
|
|
2.27.0
|
||
|
|
|