rpms/firewalld
7
0
Fork 0
Code Issues Pull Requests Releases Activity
c9s
firewalld/0069-v2.5.0-test-policy-verify-timeout-works.patch
Eric Garver 8bacaf70bd fix(policy): support timeouts 
Resolves: RHEL-129918
2026-07-14 14:30:53 -04:00

238 lines
6.8 KiB
Diff
Raw Permalink Blame History

From 9acf188c98f8c654a3b04e8aba0124fa895e2784 Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life>
Date: Thu, 20 Nov 2025 14:55:40 -0500
Subject: [PATCH 69/70] v2.5.0: test(policy): verify timeout works
Coverage: #1381
Coverage: RHEL-129918
Coverage: RHEL-95705
Coverage: RHEL-5795
(cherry picked from commit 14dde1c406841af3499db18308eb4e9e4e6f66db)
---
src/tests/features/features.at | 1 +
src/tests/features/policy_timeout.at | 203 +++++++++++++++++++++++++++
2 files changed, 204 insertions(+)
create mode 100644 src/tests/features/policy_timeout.at
diff --git a/src/tests/features/features.at b/src/tests/features/features.at
index 2867132f7b08..3501e028d589 100644
--- a/src/tests/features/features.at
+++ b/src/tests/features/features.at
@@ -24,3 +24,4 @@ m4_include([features/reloadpolicy.at])
m4_include([features/nftables_table_owner.at])
m4_include([features/zone_forward.at])
m4_include([features/zone_timeout.at])
+m4_include([features/policy_timeout.at])
diff --git a/src/tests/features/policy_timeout.at b/src/tests/features/policy_timeout.at
new file mode 100644
index 000000000000..a62493e5986f
--- /dev/null
+++ b/src/tests/features/policy_timeout.at
@@ -0,0 +1,203 @@
+m4_ifdef([TESTING_FIREWALL_OFFLINE_CMD], [], [
+FWD_START_TEST([policy - timeout])
+AT_KEYWORDS(policy timeout RHEL-129918 RHEL-95705 RHEL-5795 gh1381)
+
+FWD_CHECK([--permanent --zone trusted --add-interface foobar0], 0, [ignore])
+FWD_CHECK([--permanent --new-policy foobar], 0, [ignore])
+FWD_CHECK([--permanent --policy foobar --add-ingress-zone ANY], 0, [ignore])
+FWD_CHECK([--permanent --policy foobar --add-egress-zone ANY], 0, [ignore])
+FWD_RELOAD()
+
+dnl $1 = firewall-cmd args
+dnl $2 = nftables expected forward allow chain rules
+dnl $3 = nftables expected forward deny chain rules
+dnl $4 = nftables expected nat prerouting chain rules
+dnl $5 = nftables expected nat postrouting chain rules
+dnl $6 = iptables expected forward allow chain rules
+dnl $7 = iptables expected forward deny chain rules
+dnl $8 = iptables expected nat prerouting chain rules
+dnl $9 = iptables expected nat postrouting chain rules
+m4_define([do_timeout], [dnl
+
+FWD_CHECK([--policy foobar --timeout 2 $1], 0, [ignore])
+FWD_CHECK([--policy foobar --add-service https], 0, [ignore])
+
+NFT_LIST_RULES([inet], [filter_FWD_policy_foobar_allow], 0, [dnl
+ table inet firewalld {
+ chain filter_FWD_policy_foobar_allow {
+ $2 dnl
+ tcp dport 443 accept
+ }
+ }
+])
+NFT_LIST_RULES([inet], [filter_FWD_policy_foobar_deny], 0, [dnl
+ table inet firewalld {
+ chain filter_FWD_policy_foobar_deny {
+ $3 dnl
+ }
+ }
+])
+NFT_LIST_RULES([inet], [nat_PRE_policy_foobar_allow], 0, [dnl
+ table inet firewalld {
+ chain nat_PRE_policy_foobar_allow {
+ $4 dnl
+ }
+ }
+])
+NFT_LIST_RULES([inet], [nat_POST_policy_foobar_allow], 0, [dnl
+ table inet firewalld {
+ chain nat_POST_policy_foobar_allow {
+ $5 dnl
+ }
+ }
+])
+IPTABLES_LIST_RULES([filter], [FWD_foobar_allow], 0, [dnl
+ $6 dnl
+ ACCEPT 6 -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
+])
+IPTABLES_LIST_RULES([filter], [FWD_foobar_deny], 0, [dnl
+ $7 dnl
+])
+IPTABLES_LIST_RULES([nat], [PRE_foobar_allow], 0, [dnl
+ $8 dnl
+])
+IPTABLES_LIST_RULES([nat], [POST_foobar_allow], 0, [dnl
+ $9 dnl
+])
+
+sleep 5
+NFT_LIST_RULES([inet], [filter_FWD_policy_foobar_allow], 0, [dnl
+ table inet firewalld {
+ chain filter_FWD_policy_foobar_allow {
+ tcp dport 443 accept
+ }
+ }
+])
+NFT_LIST_RULES([inet], [filter_FWD_policy_foobar_deny], 0, [dnl
+ table inet firewalld {
+ chain filter_FWD_policy_foobar_deny {
+ }
+ }
+])
+NFT_LIST_RULES([inet], [nat_PRE_policy_foobar_allow], 0, [dnl
+ table inet firewalld {
+ chain nat_PRE_policy_foobar_allow {
+ }
+ }
+])
+NFT_LIST_RULES([inet], [nat_POST_policy_foobar_allow], 0, [dnl
+ table inet firewalld {
+ chain nat_POST_policy_foobar_allow {
+ }
+ }
+])
+IPTABLES_LIST_RULES([filter], [FWD_foobar_allow], 0, [dnl
+ ACCEPT 6 -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
+])
+IPTABLES_LIST_RULES([filter], [FWD_foobar_deny], 0, [dnl
+])
+IPTABLES_LIST_RULES([nat], [PRE_foobar_allow], 0, [dnl
+])
+IPTABLES_LIST_RULES([nat], [POST_foobar_allow], 0, [dnl
+])
+
+FWD_CHECK([--policy foobar --remove-service https], 0, [ignore])
+
+]) dnl end m4_define()
+
+dnl ##################################
+dnl ##### Test every option that #####
+dnl ##### supports timeouts #####
+dnl ##################################
+
+do_timeout([--add-port 1234/tcp],
+[dnl
+ tcp dport 1234 accept
+], [], [], [],
+[dnl
+ ACCEPT 6 -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:1234
+], [], [], [])
+
+do_timeout([--add-source-port 1234/tcp],
+[dnl
+ tcp sport 1234 accept
+], [], [], [],
+[dnl
+ ACCEPT 6 -- 0.0.0.0/0 0.0.0.0/0 tcp spt:1234
+], [], [], [])
+
+do_timeout([--add-protocol igmp],
+[dnl
+ meta l4proto igmp accept
+], [], [], [],
+[dnl
+ ACCEPT 2 -- 0.0.0.0/0 0.0.0.0/0
+], [], [], [])
+
+do_timeout([--add-service http],
+[dnl
+ tcp dport 80 accept
+], [], [], [],
+[dnl
+ ACCEPT 6 -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
+], [], [], [])
+
+do_timeout([--add-rich-rule 'rule service name=irc accept'],
+[dnl
+ tcp dport 6667 accept
+], [], [], [],
+[dnl
+ ACCEPT 6 -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:6667
+], [], [], [])
+
+do_timeout([--add-icmp-block echo-request],
+[], [dnl
+ icmp echo-request reject with icmpx admin-prohibited
+ icmpv6 echo-request reject with icmpx admin-prohibited
+], [], [], [],
+[dnl
+ REJECT 1 -- 0.0.0.0/0 0.0.0.0/0 icmptype 8 reject-with icmp-host-prohibited
+], [], [])
+
+do_timeout([--add-forward-port port=2222:proto=tcp:toport=22:toaddr=10.10.10.10],
+[], [], [dnl
+ meta nfproto ipv4 tcp dport 2222 dnat ip to 10.10.10.10:22
+], [], [], [], [dnl
+ DNAT 6 -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:2222 to:10.10.10.10:22
+], [])
+
+do_timeout([--add-masquerade],
+[], [], [], [dnl
+ meta nfproto ipv4 oifname != "lo" masquerade
+], [], [], [], [dnl
+ MASQUERADE 0 -- 0.0.0.0/0 0.0.0.0/0
+])
+
+dnl for ingress-zone and egress-zone we have to check the dispatch
+FWD_CHECK([--policy foobar --remove-ingress-zone ANY], 0, [ignore])
+FWD_CHECK([--policy foobar --timeout 2 --add-ingress-zone ANY], 0, [ignore])
+
+NFT_LIST_RULES([inet], [filter_FORWARD_POLICIES_pre], 0, [dnl
+ table inet firewalld {
+ chain filter_FORWARD_POLICIES_pre {
+ jump filter_FWD_policy_foobar
+ }
+ }
+])
+IPTABLES_LIST_RULES([filter], [FORWARD_POLICIES_pre], 0, [dnl
+ FWD_foobar 0 -- 0.0.0.0/0 0.0.0.0/0
+])
+
+sleep 5
+NFT_LIST_RULES([inet], [filter_FORWARD_POLICIES_pre], 0, [dnl
+ table inet firewalld {
+ chain filter_FORWARD_POLICIES_pre {
+ }
+ }
+])
+IPTABLES_LIST_RULES([filter], [FORWARD_POLICIES_pre], 0, [dnl
+])
+
+m4_undefine([do_timeout])
+FWD_END_TEST()
+])
--
2.52.0
Reference in New Issue View Git Blame Copy Permalink