From 52d53cc4ab0503ad484330b2121f85094a7903de Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Mon, 9 Jul 2018 11:29:33 -0400 Subject: [PATCH 1/6] RHEL only: Add cockpit by default to some zones Fixes: #1581578 --- config/zones/home.xml | 1 + config/zones/internal.xml | 1 + config/zones/public.xml | 1 + config/zones/work.xml | 1 + src/tests/cli/firewall-cmd.at | 14 +++++++++++++- src/tests/features/helpers_custom.at | 9 +++++++++ src/tests/features/service_include.at | 2 +- src/tests/regression/gh366.at | 3 +++ src/tests/regression/gh453.at | 2 ++ src/tests/regression/rhbz1514043.at | 2 +- 10 files changed, 33 insertions(+), 3 deletions(-) diff --git a/config/zones/home.xml b/config/zones/home.xml index 42b29b2f2d50..8aa8afa0e8aa 100644 --- a/config/zones/home.xml +++ b/config/zones/home.xml @@ -6,4 +6,5 @@ + diff --git a/config/zones/internal.xml b/config/zones/internal.xml index e646b48c94e8..40cb7e14424b 100644 --- a/config/zones/internal.xml +++ b/config/zones/internal.xml @@ -6,4 +6,5 @@ + diff --git a/config/zones/public.xml b/config/zones/public.xml index 49795d8c9068..617e131a4895 100644 --- a/config/zones/public.xml +++ b/config/zones/public.xml @@ -4,4 +4,5 @@ For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted. + diff --git a/config/zones/work.xml b/config/zones/work.xml index 6ea5550a40bd..9609ee6f65c2 100644 --- a/config/zones/work.xml +++ b/config/zones/work.xml @@ -4,4 +4,5 @@ For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted. + diff --git a/src/tests/cli/firewall-cmd.at b/src/tests/cli/firewall-cmd.at index 806af74221b6..74f480f8730f 100644 --- a/src/tests/cli/firewall-cmd.at +++ b/src/tests/cli/firewall-cmd.at @@ -1285,6 +1285,7 @@ FWD_START_TEST([rich rules priority]) chain filter_IN_public_allow { tcp dport 22 ct state new,untracked accept ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept + tcp dport 9090 ct state new,untracked accept tcp dport 1122 ct state new,untracked accept tcp dport 3333 ct state new,untracked accept tcp dport 4444 ct state new,untracked accept @@ -1300,6 +1301,7 @@ FWD_START_TEST([rich rules priority]) ]) IPTABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 ctstate NEW,UNTRACKED ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:1122 ctstate NEW,UNTRACKED ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:3333 ctstate NEW,UNTRACKED ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:4444 ctstate NEW,UNTRACKED @@ -1314,6 +1316,7 @@ FWD_START_TEST([rich rules priority]) IP6TABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp ::/0 ::/0 tcp dpt:22 ctstate NEW,UNTRACKED ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:9090 ctstate NEW,UNTRACKED ACCEPT tcp ::/0 ::/0 tcp dpt:1122 ctstate NEW,UNTRACKED ACCEPT tcp ::/0 ::/0 tcp dpt:3333 ctstate NEW,UNTRACKED ACCEPT tcp ::/0 ::/0 tcp dpt:4444 ctstate NEW,UNTRACKED @@ -1395,6 +1398,7 @@ FWD_START_TEST([rich rules priority]) chain filter_IN_public_allow { tcp dport 22 ct state new,untracked accept ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept + tcp dport 9090 ct state new,untracked accept } } ]) @@ -1498,6 +1502,7 @@ FWD_START_TEST([rich rules priority]) ]) IPTABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 ctstate NEW,UNTRACKED ]) IPTABLES_LIST_RULES([filter], [FWDI_public_pre], 0, [dnl ]) @@ -1532,6 +1537,7 @@ FWD_START_TEST([rich rules priority]) IP6TABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp ::/0 ::/0 tcp dpt:22 ctstate NEW,UNTRACKED ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:9090 ctstate NEW,UNTRACKED ]) IP6TABLES_LIST_RULES([filter], [FWDI_public_pre], 0, [dnl ]) @@ -1579,6 +1585,7 @@ FWD_START_TEST([rich rules priority]) chain filter_IN_public_allow { tcp dport 22 ct state new,untracked accept ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept + tcp dport 9090 ct state new,untracked accept icmp type echo-request accept icmpv6 type echo-request accept } @@ -1619,6 +1626,7 @@ FWD_START_TEST([rich rules priority]) ]) IPTABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 ctstate NEW,UNTRACKED ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8 ]) IPTABLES_LIST_RULES([filter], [FWDI_public_pre], 0, [dnl @@ -1641,6 +1649,7 @@ FWD_START_TEST([rich rules priority]) IP6TABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp ::/0 ::/0 tcp dpt:22 ctstate NEW,UNTRACKED ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:9090 ctstate NEW,UNTRACKED ACCEPT icmpv6 ::/0 ::/0 ipv6-icmptype 128 ]) IP6TABLES_LIST_RULES([filter], [FWDI_public_pre], 0, [dnl @@ -1697,6 +1706,7 @@ FWD_START_TEST([rich rules priority]) chain filter_IN_public_allow { tcp dport 22 ct state new,untracked accept ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept + tcp dport 9090 ct state new,untracked accept } } ]) @@ -1734,6 +1744,7 @@ FWD_START_TEST([rich rules priority]) ]) IPTABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 ctstate NEW,UNTRACKED ]) IPTABLES_LIST_RULES([filter], [IN_public_deny], 0, [dnl ]) @@ -1754,6 +1765,7 @@ FWD_START_TEST([rich rules priority]) IP6TABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp ::/0 ::/0 tcp dpt:22 ctstate NEW,UNTRACKED ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:9090 ctstate NEW,UNTRACKED ]) IP6TABLES_LIST_RULES([filter], [IN_public_deny], 0, [dnl ]) @@ -1779,7 +1791,7 @@ FWD_START_TEST([rich rules priority]) icmp-block-inversion: no interfaces: sources: - services: dhcpv6-client ssh + services: cockpit dhcpv6-client ssh ports: protocols: masquerade: no diff --git a/src/tests/features/helpers_custom.at b/src/tests/features/helpers_custom.at index 41d0f17b1d9e..bd4b52cfb1d6 100644 --- a/src/tests/features/helpers_custom.at +++ b/src/tests/features/helpers_custom.at @@ -37,6 +37,7 @@ NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl chain filter_IN_public_allow { tcp dport 22 ct state new,untracked accept ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept + tcp dport 9090 ct state new,untracked accept tcp dport 2121 ct helper set "helper-ftptest-tcp" tcp dport 2121 ct state new,untracked accept } @@ -47,6 +48,7 @@ IPTABLES_LIST_RULES([raw], [PRE_public_allow], 0, [dnl ]) IPTABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 ctstate NEW,UNTRACKED ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:2121 ctstate NEW,UNTRACKED ]) IP6TABLES_LIST_RULES([raw], [PRE_public_allow], 0, [dnl @@ -55,6 +57,7 @@ IP6TABLES_LIST_RULES([raw], [PRE_public_allow], 0, [dnl IP6TABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp ::/0 ::/0 tcp dpt:22 ctstate NEW,UNTRACKED ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:9090 ctstate NEW,UNTRACKED ACCEPT tcp ::/0 ::/0 tcp dpt:2121 ctstate NEW,UNTRACKED ]) @@ -91,6 +94,7 @@ NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl chain filter_IN_public_allow { tcp dport 22 ct state new,untracked accept ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept + tcp dport 9090 ct state new,untracked accept tcp dport 2121 ct helper set "helper-ftptest-tcp" tcp dport 2121 ct state new,untracked accept } @@ -101,6 +105,7 @@ IPTABLES_LIST_RULES([raw], [PRE_public_allow], 0, [dnl ]) IPTABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 ctstate NEW,UNTRACKED ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:2121 ctstate NEW,UNTRACKED ]) IP6TABLES_LIST_RULES([raw], [PRE_public_allow], 0, [dnl @@ -109,6 +114,7 @@ IP6TABLES_LIST_RULES([raw], [PRE_public_allow], 0, [dnl IP6TABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp ::/0 ::/0 tcp dpt:22 ctstate NEW,UNTRACKED ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:9090 ctstate NEW,UNTRACKED ACCEPT tcp ::/0 ::/0 tcp dpt:2121 ctstate NEW,UNTRACKED ]) @@ -126,6 +132,7 @@ NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl chain filter_IN_public_allow { tcp dport 22 ct state new,untracked accept ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept + tcp dport 9090 ct state new,untracked accept tcp dport 21 ct helper set "helper-ftp-tcp" tcp dport 2121 ct helper set "helper-ftptest-tcp" tcp dport 2121 ct state new,untracked accept @@ -139,6 +146,7 @@ IPTABLES_LIST_RULES([raw], [PRE_public_allow], 0, [dnl ]) IPTABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW,UNTRACKED + ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 ctstate NEW,UNTRACKED ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:2121 ctstate NEW,UNTRACKED ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 ctstate NEW,UNTRACKED ]) @@ -149,6 +157,7 @@ IP6TABLES_LIST_RULES([raw], [PRE_public_allow], 0, [dnl IP6TABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp ::/0 ::/0 tcp dpt:22 ctstate NEW,UNTRACKED ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED + ACCEPT tcp ::/0 ::/0 tcp dpt:9090 ctstate NEW,UNTRACKED ACCEPT tcp ::/0 ::/0 tcp dpt:2121 ctstate NEW,UNTRACKED ACCEPT tcp ::/0 ::/0 tcp dpt:21 ctstate NEW,UNTRACKED ]) diff --git a/src/tests/features/service_include.at b/src/tests/features/service_include.at index 7f02701a9419..070f1578fc2b 100644 --- a/src/tests/features/service_include.at +++ b/src/tests/features/service_include.at @@ -120,7 +120,7 @@ FWD_CHECK([--zone=drop --list-services], 0, [dnl ]) FWD_CHECK([--zone=public --list-services], 0, [dnl -dhcpv6-client ssh +cockpit dhcpv6-client ssh ]) FWD_CHECK([-q --permanent --service=my-service-with-include --remove-include=does-not-exist]) FWD_RELOAD diff --git a/src/tests/regression/gh366.at b/src/tests/regression/gh366.at index 1441a6be53bf..51ff504e6a9d 100644 --- a/src/tests/regression/gh366.at +++ b/src/tests/regression/gh366.at @@ -7,6 +7,7 @@ table inet firewalld { chain filter_IN_public_allow { tcp dport 22 ct state new,untracked accept ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept +tcp dport 9090 ct state new,untracked accept ip daddr 224.0.0.251 udp dport 5353 ct state new,untracked accept ip6 daddr ff02::fb udp dport 5353 ct state new,untracked accept } @@ -14,11 +15,13 @@ ip6 daddr ff02::fb udp dport 5353 ct state new,untracked accept ]) IPTABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW,UNTRACKED +ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 ctstate NEW,UNTRACKED ACCEPT udp -- 0.0.0.0/0 224.0.0.251 udp dpt:5353 ctstate NEW,UNTRACKED ]) IP6TABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl ACCEPT tcp ::/0 ::/0 tcp dpt:22 ctstate NEW,UNTRACKED ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED +ACCEPT tcp ::/0 ::/0 tcp dpt:9090 ctstate NEW,UNTRACKED ACCEPT udp ::/0 ff02::fb udp dpt:5353 ctstate NEW,UNTRACKED ])]) diff --git a/src/tests/regression/gh453.at b/src/tests/regression/gh453.at index 36a6fce5f22a..61bc90aae673 100644 --- a/src/tests/regression/gh453.at +++ b/src/tests/regression/gh453.at @@ -18,6 +18,7 @@ NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl chain filter_IN_public_allow { tcp dport 22 ct state new,untracked accept ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept + tcp dport 9090 ct state new,untracked accept tcp dport 21 ct helper set "helper-ftp-tcp" tcp dport 21 ct state new,untracked accept } @@ -42,6 +43,7 @@ NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl chain filter_IN_public_allow { tcp dport 22 ct state new,untracked accept ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept + tcp dport 9090 ct state new,untracked accept tcp dport 21 ct helper set "helper-ftp-tcp" tcp dport 21 ct state new,untracked accept tcp dport 5060 ct helper set "helper-sip-tcp" diff --git a/src/tests/regression/rhbz1514043.at b/src/tests/regression/rhbz1514043.at index efc33e09478b..241cf547f7f3 100644 --- a/src/tests/regression/rhbz1514043.at +++ b/src/tests/regression/rhbz1514043.at @@ -5,7 +5,7 @@ FWD_CHECK([-q --set-log-denied=all]) FWD_CHECK([-q --permanent --zone=public --add-service=samba]) FWD_RELOAD FWD_CHECK([--zone=public --list-all | TRIM | grep ^services], 0, [dnl -services: dhcpv6-client samba ssh +services: cockpit dhcpv6-client samba ssh ]) dnl check that log denied actually took effect -- 2.23.0