RHEL 9.0.0 Alpha bootstrap
The content of this branch was automatically imported from Fedora ELN with the following as its source: https://src.fedoraproject.org/rpms/iptables#fb677ca83cc1a1ad64e67ae869318c8909650c47
This commit is contained in:
Petr Šabata
parent
3e4cbdd4d1
commit
311316e433
|
|
@ -0,0 +1,6 @@
|
|||
/iptables-1.6.2.tar.bz2
|
||||
/iptables-1.8.0.tar.bz2
|
||||
/iptables-1.8.2.tar.bz2
|
||||
/iptables-1.8.3.tar.bz2
|
||||
/iptables-1.8.4.tar.bz2
|
||||
/iptables-1.8.5.tar.bz2
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
From 55bb60d8ae717d3bc1cfdd6203604a18f30eb3c3 Mon Sep 17 00:00:00 2001
|
||||
From: Jan Engelhardt <jengelh@inai.de>
|
||||
Date: Wed, 3 Jun 2020 15:38:48 +0200
|
||||
Subject: [PATCH] build: resolve iptables-apply not getting installed
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
ip6tables-apply gets installed but iptables-apply does not.
|
||||
That is wrong.
|
||||
|
||||
» make install DESTDIR=$PWD/r
|
||||
» find r -name "*app*"
|
||||
r/usr/local/sbin/ip6tables-apply
|
||||
r/usr/local/share/man/man8/iptables-apply.8
|
||||
r/usr/local/share/man/man8/ip6tables-apply.8
|
||||
|
||||
Fixes: v1.8.5~87
|
||||
Signed-off-by: Jan Engelhardt <jengelh@inai.de>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit d4ed0c741fc789bb09d977d74d30875fdd50d08b)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/Makefile.am | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/Makefile.am b/iptables/Makefile.am
|
||||
index dc66b3cc09c08..2024dbf5cb88c 100644
|
||||
--- a/iptables/Makefile.am
|
||||
+++ b/iptables/Makefile.am
|
||||
@@ -56,7 +56,7 @@ man_MANS = iptables.8 iptables-restore.8 iptables-save.8 \
|
||||
ip6tables-save.8 iptables-extensions.8 \
|
||||
iptables-apply.8 ip6tables-apply.8
|
||||
|
||||
-sbin_SCRIPT = iptables-apply
|
||||
+sbin_SCRIPTS = iptables-apply
|
||||
|
||||
if ENABLE_NFTABLES
|
||||
man_MANS += xtables-nft.8 xtables-translate.8 xtables-legacy.8 \
|
||||
--
|
||||
2.27.0
|
||||
|
||||
|
|
@ -0,0 +1,60 @@
|
|||
From 6e8f0c61f4c9abc2836d772fca97ff0d84c03360 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Adam=20Go=C5=82=C4=99biowski?= <adamg@pld-linux.org>
|
||||
Date: Wed, 14 Nov 2018 07:35:28 +0100
|
||||
Subject: [PATCH] extensions: format-security fixes in libip[6]t_icmp
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
commit 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
|
||||
introduced support for gcc feature to check format string against passed
|
||||
argument. This commit adds missing bits to extenstions's libipt_icmp.c
|
||||
and libip6t_icmp6.c that were causing build to fail.
|
||||
|
||||
Fixes: 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
|
||||
Signed-off-by: Adam Gołębiowski <adamg@pld-linux.org>
|
||||
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
extensions/libip6t_icmp6.c | 4 ++--
|
||||
extensions/libipt_icmp.c | 2 +-
|
||||
2 files changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/extensions/libip6t_icmp6.c b/extensions/libip6t_icmp6.c
|
||||
index 45a71875722c4..cc7bfaeb72fd7 100644
|
||||
--- a/extensions/libip6t_icmp6.c
|
||||
+++ b/extensions/libip6t_icmp6.c
|
||||
@@ -230,7 +230,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
|
||||
type_name = icmp6_type_xlate(icmptype);
|
||||
|
||||
if (type_name) {
|
||||
- xt_xlate_add(xl, type_name);
|
||||
+ xt_xlate_add(xl, "%s", type_name);
|
||||
} else {
|
||||
for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i)
|
||||
if (icmpv6_codes[i].type == icmptype &&
|
||||
@@ -239,7 +239,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
|
||||
break;
|
||||
|
||||
if (i != ARRAY_SIZE(icmpv6_codes))
|
||||
- xt_xlate_add(xl, icmpv6_codes[i].name);
|
||||
+ xt_xlate_add(xl, "%s", icmpv6_codes[i].name);
|
||||
else
|
||||
return 0;
|
||||
}
|
||||
diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
|
||||
index 5418997668d4c..e76257c54708c 100644
|
||||
--- a/extensions/libipt_icmp.c
|
||||
+++ b/extensions/libipt_icmp.c
|
||||
@@ -236,7 +236,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
|
||||
if (icmp_codes[i].type == icmptype &&
|
||||
icmp_codes[i].code_min == code_min &&
|
||||
icmp_codes[i].code_max == code_max) {
|
||||
- xt_xlate_add(xl, icmp_codes[i].name);
|
||||
+ xt_xlate_add(xl, "%s", icmp_codes[i].name);
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
--
|
||||
2.21.0
|
||||
|
||||
|
|
@ -0,0 +1,58 @@
|
|||
From 51730adbe90a17e0d86d5adcab30040fa7e751ed Mon Sep 17 00:00:00 2001
|
||||
From: Arturo Borrero Gonzalez <arturo@netfilter.org>
|
||||
Date: Tue, 16 Jun 2020 11:20:42 +0200
|
||||
Subject: [PATCH] xtables-translate: don't fail if help was requested
|
||||
|
||||
If the user called `iptables-translate -h` then we have CMD_NONE and we should gracefully handle
|
||||
this case in do_command_xlate().
|
||||
|
||||
Before this patch, you would see:
|
||||
|
||||
user@debian:~$ sudo iptables-translate -h
|
||||
[..]
|
||||
nft Unsupported command?
|
||||
user@debian:~$ echo $?
|
||||
1
|
||||
|
||||
After this patch:
|
||||
|
||||
user@debian:~$ sudo iptables-translate -h
|
||||
[..]
|
||||
user@debian:~$ echo $?
|
||||
0
|
||||
|
||||
Fixes: d4409d449c10fa ("nft: Don't exit early after printing help texts")
|
||||
Acked-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
|
||||
(cherry picked from commit 2757c0b5e5fbbf569695469b331453cecefdf069)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/xtables-translate.c | 5 ++++-
|
||||
1 file changed, 4 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
|
||||
index 5aa42496b5a48..363c8be15b3fa 100644
|
||||
--- a/iptables/xtables-translate.c
|
||||
+++ b/iptables/xtables-translate.c
|
||||
@@ -249,7 +249,7 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
|
||||
|
||||
cs.restore = restore;
|
||||
|
||||
- if (!restore)
|
||||
+ if (!restore && p.command != CMD_NONE)
|
||||
printf("nft ");
|
||||
|
||||
switch (p.command) {
|
||||
@@ -310,6 +310,9 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
|
||||
break;
|
||||
case CMD_SET_POLICY:
|
||||
break;
|
||||
+ case CMD_NONE:
|
||||
+ ret = 1;
|
||||
+ break;
|
||||
default:
|
||||
/* We should never reach this... */
|
||||
printf("Unsupported command?\n");
|
||||
--
|
||||
2.27.0
|
||||
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
From eacefb728885b5dc51036181de83b2df309d4e6b Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 29 Jul 2020 15:39:31 +0200
|
||||
Subject: [PATCH] nft: cache: Check consistency with NFT_CL_FAKE, too
|
||||
|
||||
Athough this cache level fetches table names only, it shouldn't skip the
|
||||
consistency check.
|
||||
|
||||
Fixes: f42bfb344af82 ("nft: cache: Re-establish cache consistency check")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit b531365ce32f386d91c6a0bbc80ec4076e4babdd)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft-cache.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
|
||||
index 638b18bc7e382..434cc10b82ce7 100644
|
||||
--- a/iptables/nft-cache.c
|
||||
+++ b/iptables/nft-cache.c
|
||||
@@ -511,14 +511,14 @@ retry:
|
||||
if (req->level >= NFT_CL_TABLES)
|
||||
fetch_table_cache(h);
|
||||
if (req->level == NFT_CL_FAKE)
|
||||
- return;
|
||||
+ goto genid_check;
|
||||
if (req->level >= NFT_CL_CHAINS)
|
||||
fetch_chain_cache(h, t, chains);
|
||||
if (req->level >= NFT_CL_SETS)
|
||||
fetch_set_cache(h, t, NULL);
|
||||
if (req->level >= NFT_CL_RULES)
|
||||
fetch_rule_cache(h, t);
|
||||
-
|
||||
+genid_check:
|
||||
mnl_genid_get(h, &genid_check);
|
||||
if (h->nft_genid != genid_check) {
|
||||
flush_cache(h, h->cache, NULL);
|
||||
--
|
||||
2.27.0
|
||||
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
From dac3434e2e7ea297a3886c662d558305b460670b Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 7 Aug 2020 13:48:28 +0200
|
||||
Subject: [PATCH] nft: Fix command name in ip6tables error message
|
||||
|
||||
Upon errors, ip6tables-nft would prefix its error messages with
|
||||
'iptables:' instead of 'ip6tables:'. Turns out the command name was
|
||||
hard-coded, use 'progname' variable instead.
|
||||
While being at it, merge the two mostly identical fprintf() calls into
|
||||
one.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/xtables-standalone.c | 12 ++++--------
|
||||
1 file changed, 4 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c
|
||||
index dd6fb7919d2e1..7b71db62f1ea6 100644
|
||||
--- a/iptables/xtables-standalone.c
|
||||
+++ b/iptables/xtables-standalone.c
|
||||
@@ -75,14 +75,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
|
||||
xtables_fini();
|
||||
|
||||
if (!ret) {
|
||||
- if (errno == EINVAL) {
|
||||
- fprintf(stderr, "iptables: %s. "
|
||||
- "Run `dmesg' for more information.\n",
|
||||
- nft_strerror(errno));
|
||||
- } else {
|
||||
- fprintf(stderr, "iptables: %s.\n",
|
||||
- nft_strerror(errno));
|
||||
- }
|
||||
+ fprintf(stderr, "%s: %s.%s\n", progname, nft_strerror(errno),
|
||||
+ (errno == EINVAL ?
|
||||
+ " Run `dmesg' for more information." : ""));
|
||||
+
|
||||
if (errno == EAGAIN)
|
||||
exit(RESOURCE_PROBLEM);
|
||||
}
|
||||
--
|
||||
2.27.0
|
||||
|
||||
|
|
@ -0,0 +1,76 @@
|
|||
#!/bin/sh
|
||||
|
||||
ARPTABLES_CONFIG=/etc/sysconfig/arptables
|
||||
|
||||
# compat for removed initscripts dependency
|
||||
|
||||
success() {
|
||||
echo -n "[ OK ]"
|
||||
return 0
|
||||
}
|
||||
|
||||
failure() {
|
||||
echo -n "[FAILED]"
|
||||
return 1
|
||||
}
|
||||
|
||||
start() {
|
||||
if [ ! -x /usr/sbin/arptables ]; then
|
||||
exit 4
|
||||
fi
|
||||
|
||||
# don't do squat if we don't have the config file
|
||||
if [ -f $ARPTABLES_CONFIG ]; then
|
||||
echo -n $"Applying arptables firewall rules: "
|
||||
/usr/sbin/arptables-restore < $ARPTABLES_CONFIG && \
|
||||
success || \
|
||||
failure
|
||||
echo
|
||||
touch /var/lock/subsys/arptables
|
||||
else
|
||||
failure
|
||||
echo
|
||||
echo $"Configuration file /etc/sysconfig/arptables missing"
|
||||
exit 6
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
echo -n $"Removing user defined chains:"
|
||||
arptables -X && success || failure
|
||||
echo -n $"Flushing all chains:"
|
||||
arptables -F && success || failure
|
||||
echo -n $"Resetting built-in chains to the default ACCEPT policy:"
|
||||
arptables -P INPUT ACCEPT && \
|
||||
arptables -P OUTPUT ACCEPT && \
|
||||
success || \
|
||||
failure
|
||||
echo
|
||||
rm -f /var/lock/subsys/arptables
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
start
|
||||
;;
|
||||
|
||||
stop)
|
||||
stop
|
||||
;;
|
||||
|
||||
restart|reload)
|
||||
# "restart" is really just "start" as this isn't a daemon,
|
||||
# and "start" clears any pre-defined rules anyway.
|
||||
# This is really only here to make those who expect it happy
|
||||
start
|
||||
;;
|
||||
|
||||
condrestart|try-restart|force-reload)
|
||||
[ -e /var/lock/subsys/arptables ] && start
|
||||
;;
|
||||
|
||||
*)
|
||||
exit 2
|
||||
esac
|
||||
|
||||
exit 0
|
||||
|
|
@ -0,0 +1,59 @@
|
|||
# Load additional iptables modules (nat helpers)
|
||||
# Default: -none-
|
||||
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
|
||||
# are loaded after the firewall rules are applied. Options for the helpers are
|
||||
# stored in /etc/modprobe.conf.
|
||||
IPTABLES_MODULES=""
|
||||
|
||||
# Save current firewall rules on stop.
|
||||
# Value: yes|no, default: no
|
||||
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped
|
||||
# (e.g. on system shutdown).
|
||||
IPTABLES_SAVE_ON_STOP="no"
|
||||
|
||||
# Save current firewall rules on restart.
|
||||
# Value: yes|no, default: no
|
||||
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets
|
||||
# restarted.
|
||||
IPTABLES_SAVE_ON_RESTART="no"
|
||||
|
||||
# Save (and restore) rule and chain counter.
|
||||
# Value: yes|no, default: no
|
||||
# Save counters for rules and chains to /etc/sysconfig/iptables if
|
||||
# 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or
|
||||
# SAVE_ON_RESTART is enabled.
|
||||
IPTABLES_SAVE_COUNTER="no"
|
||||
|
||||
# Numeric status output
|
||||
# Value: yes|no, default: yes
|
||||
# Print IP addresses and port numbers in numeric format in the status output.
|
||||
IPTABLES_STATUS_NUMERIC="yes"
|
||||
|
||||
# Verbose status output
|
||||
# Value: yes|no, default: yes
|
||||
# Print info about the number of packets and bytes plus the "input-" and
|
||||
# "outputdevice" in the status output.
|
||||
IPTABLES_STATUS_VERBOSE="no"
|
||||
|
||||
# Status output with numbered lines
|
||||
# Value: yes|no, default: yes
|
||||
# Print a counter/number for every rule in the status output.
|
||||
IPTABLES_STATUS_LINENUMBERS="yes"
|
||||
|
||||
# Reload sysctl settings on start and restart
|
||||
# Default: -none-
|
||||
# Space separated list of sysctl items which are to be reloaded on start.
|
||||
# List items will be matched by fgrep.
|
||||
#IPTABLES_SYSCTL_LOAD_LIST=".nf_conntrack .bridge-nf"
|
||||
|
||||
# Set wait option for iptables-restore calls in seconds
|
||||
# Default: 600
|
||||
# Set to 0 to deactivate the wait.
|
||||
#IPTABLES_RESTORE_WAIT=600
|
||||
|
||||
# Set wait interval option for iptables-restore calls in microseconds
|
||||
# Default: 1000000
|
||||
# Set to 100000 to try to get the lock every 100000 microseconds, 10 times a
|
||||
# second.
|
||||
# Only usable with IPTABLES_RESTORE_WAIT > 0
|
||||
#IPTABLES_RESTORE_WAIT_INTERVAL=1000000
|
||||
|
|
@ -0,0 +1,435 @@
|
|||
#!/bin/bash
|
||||
#
|
||||
# iptables Start iptables firewall
|
||||
#
|
||||
# chkconfig: 2345 08 92
|
||||
# description: Starts, stops and saves iptables firewall
|
||||
#
|
||||
# config: /etc/sysconfig/iptables
|
||||
# config: /etc/sysconfig/iptables-config
|
||||
#
|
||||
### BEGIN INIT INFO
|
||||
# Provides: iptables
|
||||
# Required-Start:
|
||||
# Required-Stop:
|
||||
# Default-Start: 2 3 4 5
|
||||
# Default-Stop: 0 1 6
|
||||
# Short-Description: start and stop iptables firewall
|
||||
# Description: Start, stop and save iptables firewall
|
||||
### END INIT INFO
|
||||
|
||||
# compat for removed initscripts dependency
|
||||
|
||||
success() {
|
||||
echo -n "[ OK ]"
|
||||
return 0
|
||||
}
|
||||
|
||||
warning() {
|
||||
echo -n "[WARNING]"
|
||||
return 1
|
||||
}
|
||||
|
||||
failure() {
|
||||
echo -n "[FAILED]"
|
||||
return 1
|
||||
}
|
||||
|
||||
IPTABLES=iptables
|
||||
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
|
||||
IPTABLES_FALLBACK_DATA=${IPTABLES_DATA}.fallback
|
||||
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
|
||||
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
|
||||
[ "$IPV" = "ip" ] && _IPV="ipv4" || _IPV="ipv6"
|
||||
PROC_IPTABLES_NAMES=/proc/net/${IPV}_tables_names
|
||||
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES
|
||||
|
||||
# only usable for root
|
||||
if [ $EUID != 0 ]; then
|
||||
echo -n $"${IPTABLES}: Only usable by root."; warning; echo
|
||||
exit 4
|
||||
fi
|
||||
|
||||
if [ ! -x /sbin/$IPTABLES ]; then
|
||||
echo -n $"${IPTABLES}: /sbin/$IPTABLES does not exist."; warning; echo
|
||||
exit 5
|
||||
fi
|
||||
|
||||
# Old or new modutils
|
||||
/sbin/modprobe --version 2>&1 | grep -q 'kmod version' \
|
||||
&& NEW_MODUTILS=1 \
|
||||
|| NEW_MODUTILS=0
|
||||
|
||||
# Default firewall configuration:
|
||||
IPTABLES_MODULES=""
|
||||
IPTABLES_SAVE_ON_STOP="no"
|
||||
IPTABLES_SAVE_ON_RESTART="no"
|
||||
IPTABLES_SAVE_COUNTER="no"
|
||||
IPTABLES_STATUS_NUMERIC="yes"
|
||||
IPTABLES_STATUS_VERBOSE="no"
|
||||
IPTABLES_STATUS_LINENUMBERS="yes"
|
||||
IPTABLES_SYSCTL_LOAD_LIST=""
|
||||
IPTABLES_RESTORE_WAIT=600
|
||||
IPTABLES_RESTORE_WAIT_INTERVAL=1000000
|
||||
|
||||
# Load firewall configuration.
|
||||
[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
|
||||
|
||||
# Get active tables
|
||||
NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
|
||||
|
||||
|
||||
flush_n_delete() {
|
||||
# Flush firewall rules and delete chains.
|
||||
[ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
|
||||
|
||||
# Check if firewall is configured (has tables)
|
||||
[ -z "$NF_TABLES" ] && return 1
|
||||
|
||||
echo -n $"${IPTABLES}: Flushing firewall rules: "
|
||||
ret=0
|
||||
# For all tables
|
||||
for i in $NF_TABLES; do
|
||||
# Flush firewall rules.
|
||||
$IPTABLES -t $i -F;
|
||||
let ret+=$?;
|
||||
|
||||
# Delete firewall chains.
|
||||
$IPTABLES -t $i -X;
|
||||
let ret+=$?;
|
||||
|
||||
# Set counter to zero.
|
||||
$IPTABLES -t $i -Z;
|
||||
let ret+=$?;
|
||||
done
|
||||
|
||||
[ $ret -eq 0 ] && success || failure
|
||||
echo
|
||||
return $ret
|
||||
}
|
||||
|
||||
set_policy() {
|
||||
# Set policy for configured tables.
|
||||
policy=$1
|
||||
|
||||
# Check if iptable module is loaded
|
||||
[ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
|
||||
|
||||
# Check if firewall is configured (has tables)
|
||||
tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
|
||||
[ -z "$tables" ] && return 1
|
||||
|
||||
echo -n $"${IPTABLES}: Setting chains to policy $policy: "
|
||||
ret=0
|
||||
for i in $tables; do
|
||||
echo -n "$i "
|
||||
case "$i" in
|
||||
raw)
|
||||
$IPTABLES -t raw -P PREROUTING $policy \
|
||||
&& $IPTABLES -t raw -P OUTPUT $policy \
|
||||
|| let ret+=1
|
||||
;;
|
||||
filter)
|
||||
$IPTABLES -t filter -P INPUT $policy \
|
||||
&& $IPTABLES -t filter -P OUTPUT $policy \
|
||||
&& $IPTABLES -t filter -P FORWARD $policy \
|
||||
|| let ret+=1
|
||||
;;
|
||||
nat)
|
||||
$IPTABLES -t nat -P PREROUTING $policy \
|
||||
&& $IPTABLES -t nat -P POSTROUTING $policy \
|
||||
&& $IPTABLES -t nat -P OUTPUT $policy \
|
||||
|| let ret+=1
|
||||
;;
|
||||
mangle)
|
||||
$IPTABLES -t mangle -P PREROUTING $policy \
|
||||
&& $IPTABLES -t mangle -P POSTROUTING $policy \
|
||||
&& $IPTABLES -t mangle -P INPUT $policy \
|
||||
&& $IPTABLES -t mangle -P OUTPUT $policy \
|
||||
&& $IPTABLES -t mangle -P FORWARD $policy \
|
||||
|| let ret+=1
|
||||
;;
|
||||
*)
|
||||
let ret+=1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
[ $ret -eq 0 ] && success || failure
|
||||
echo
|
||||
return $ret
|
||||
}
|
||||
|
||||
load_sysctl() {
|
||||
# load matched sysctl values
|
||||
if [ -n "$IPTABLES_SYSCTL_LOAD_LIST" ]; then
|
||||
echo -n $"Loading sysctl settings: "
|
||||
ret=0
|
||||
for item in $IPTABLES_SYSCTL_LOAD_LIST; do
|
||||
fgrep -hs $item /etc/sysctl.d/* | sysctl -p - >/dev/null
|
||||
let ret+=$?;
|
||||
done
|
||||
[ $ret -eq 0 ] && success || failure
|
||||
echo
|
||||
fi
|
||||
return $ret
|
||||
}
|
||||
|
||||
start() {
|
||||
# Do not start if there is no config file.
|
||||
if [ ! -f "$IPTABLES_DATA" ]; then
|
||||
echo -n $"${IPTABLES}: No config file."; warning; echo
|
||||
return 6
|
||||
fi
|
||||
|
||||
# check if ipv6 module load is deactivated
|
||||
if [ "${_IPV}" = "ipv6" ] \
|
||||
&& grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
|
||||
echo $"${IPTABLES}: ${_IPV} is disabled."
|
||||
return 150
|
||||
fi
|
||||
|
||||
echo -n $"${IPTABLES}: Applying firewall rules: "
|
||||
|
||||
OPT=
|
||||
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
|
||||
if [ $IPTABLES_RESTORE_WAIT -ne 0 ]; then
|
||||
OPT="${OPT} --wait ${IPTABLES_RESTORE_WAIT}"
|
||||
if [ $IPTABLES_RESTORE_WAIT_INTERVAL -lt 1000000 ]; then
|
||||
OPT="${OPT} --wait-interval ${IPTABLES_RESTORE_WAIT_INTERVAL}"
|
||||
fi
|
||||
fi
|
||||
|
||||
$IPTABLES-restore $OPT $IPTABLES_DATA
|
||||
if [ $? -eq 0 ]; then
|
||||
success; echo
|
||||
else
|
||||
failure; echo;
|
||||
if [ -f "$IPTABLES_FALLBACK_DATA" ]; then
|
||||
echo -n $"${IPTABLES}: Applying firewall fallback rules: "
|
||||
$IPTABLES-restore $OPT $IPTABLES_FALLBACK_DATA
|
||||
if [ $? -eq 0 ]; then
|
||||
success; echo
|
||||
else
|
||||
failure; echo; return 1
|
||||
fi
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Load additional modules (helpers)
|
||||
if [ -n "$IPTABLES_MODULES" ]; then
|
||||
echo -n $"${IPTABLES}: Loading additional modules: "
|
||||
ret=0
|
||||
for mod in $IPTABLES_MODULES; do
|
||||
echo -n "$mod "
|
||||
modprobe $mod > /dev/null 2>&1
|
||||
let ret+=$?;
|
||||
done
|
||||
[ $ret -eq 0 ] && success || failure
|
||||
echo
|
||||
fi
|
||||
|
||||
# Load sysctl settings
|
||||
load_sysctl
|
||||
|
||||
touch $VAR_SUBSYS_IPTABLES
|
||||
return $ret
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Do not stop if iptables module is not loaded.
|
||||
[ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
|
||||
|
||||
# Set default chain policy to ACCEPT, in order to not break shutdown
|
||||
# on systems where the default policy is DROP and root device is
|
||||
# network-based (i.e.: iSCSI, NFS)
|
||||
set_policy ACCEPT
|
||||
# And then, flush the rules and delete chains
|
||||
flush_n_delete
|
||||
|
||||
rm -f $VAR_SUBSYS_IPTABLES
|
||||
return $ret
|
||||
}
|
||||
|
||||
save() {
|
||||
# Check if iptable module is loaded
|
||||
if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
|
||||
echo -n $"${IPTABLES}: Nothing to save."; warning; echo
|
||||
return 0
|
||||
fi
|
||||
|
||||
# Check if firewall is configured (has tables)
|
||||
if [ -z "$NF_TABLES" ]; then
|
||||
echo -n $"${IPTABLES}: Nothing to save."; warning; echo
|
||||
return 6
|
||||
fi
|
||||
|
||||
echo -n $"${IPTABLES}: Saving firewall rules to $IPTABLES_DATA: "
|
||||
|
||||
OPT=
|
||||
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
|
||||
|
||||
ret=0
|
||||
TMP_FILE=$(/bin/mktemp -q $IPTABLES_DATA.XXXXXX) \
|
||||
&& chmod 600 "$TMP_FILE" \
|
||||
&& $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
|
||||
&& size=$(stat -c '%s' $TMP_FILE) && [ $size -gt 0 ] \
|
||||
|| ret=1
|
||||
if [ $ret -eq 0 ]; then
|
||||
if [ -e $IPTABLES_DATA ]; then
|
||||
cp -f $IPTABLES_DATA $IPTABLES_DATA.save \
|
||||
&& chmod 600 $IPTABLES_DATA.save \
|
||||
&& restorecon $IPTABLES_DATA.save \
|
||||
|| ret=1
|
||||
fi
|
||||
if [ $ret -eq 0 ]; then
|
||||
mv -f $TMP_FILE $IPTABLES_DATA \
|
||||
&& chmod 600 $IPTABLES_DATA \
|
||||
&& restorecon $IPTABLES_DATA \
|
||||
|| ret=1
|
||||
fi
|
||||
fi
|
||||
rm -f $TMP_FILE
|
||||
[ $ret -eq 0 ] && success || failure
|
||||
echo
|
||||
return $ret
|
||||
}
|
||||
|
||||
status() {
|
||||
if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then
|
||||
echo $"${IPTABLES}: Firewall is not running."
|
||||
return 3
|
||||
fi
|
||||
|
||||
# Do not print status if lockfile is missing and iptables modules are not
|
||||
# loaded.
|
||||
# Check if iptable modules are loaded
|
||||
if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
|
||||
echo $"${IPTABLES}: Firewall modules are not loaded."
|
||||
return 3
|
||||
fi
|
||||
|
||||
# Check if firewall is configured (has tables)
|
||||
if [ -z "$NF_TABLES" ]; then
|
||||
echo $"${IPTABLES}: Firewall is not configured. "
|
||||
return 3
|
||||
fi
|
||||
|
||||
NUM=
|
||||
[ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
|
||||
VERBOSE=
|
||||
[ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
|
||||
COUNT=
|
||||
[ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"
|
||||
|
||||
for table in $NF_TABLES; do
|
||||
echo $"Table: $table"
|
||||
$IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
reload() {
|
||||
# Do not reload if there is no config file.
|
||||
if [ ! -f "$IPTABLES_DATA" ]; then
|
||||
echo -n $"${IPTABLES}: No config file."; warning; echo
|
||||
return 6
|
||||
fi
|
||||
|
||||
# check if ipv6 module load is deactivated
|
||||
if [ "${_IPV}" = "ipv6" ] \
|
||||
&& grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
|
||||
echo $"${IPTABLES}: ${_IPV} is disabled."
|
||||
return 150
|
||||
fi
|
||||
|
||||
echo -n $"${IPTABLES}: Trying to reload firewall rules: "
|
||||
|
||||
OPT=
|
||||
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
|
||||
if [ $IPTABLES_RESTORE_WAIT -ne 0 ]; then
|
||||
OPT="${OPT} --wait ${IPTABLES_RESTORE_WAIT}"
|
||||
if [ $IPTABLES_RESTORE_WAIT_INTERVAL -lt 1000000 ]; then
|
||||
OPT="${OPT} --wait-interval ${IPTABLES_RESTORE_WAIT_INTERVAL}"
|
||||
fi
|
||||
fi
|
||||
|
||||
$IPTABLES-restore $OPT $IPTABLES_DATA
|
||||
if [ $? -eq 0 ]; then
|
||||
success; echo
|
||||
else
|
||||
failure; echo; echo "Firewall rules are not changed."; return 1
|
||||
fi
|
||||
|
||||
# Load additional modules (helpers)
|
||||
if [ -n "$IPTABLES_MODULES" ]; then
|
||||
echo -n $"${IPTABLES}: Loading additional modules: "
|
||||
ret=0
|
||||
for mod in $IPTABLES_MODULES; do
|
||||
echo -n "$mod "
|
||||
modprobe $mod > /dev/null 2>&1
|
||||
let ret+=$?;
|
||||
done
|
||||
[ $ret -eq 0 ] && success || failure
|
||||
echo
|
||||
fi
|
||||
|
||||
# Load sysctl settings
|
||||
load_sysctl
|
||||
|
||||
return $ret
|
||||
}
|
||||
|
||||
restart() {
|
||||
[ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
|
||||
stop
|
||||
start
|
||||
}
|
||||
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
[ -f "$VAR_SUBSYS_IPTABLES" ] && exit 0
|
||||
start
|
||||
RETVAL=$?
|
||||
;;
|
||||
stop)
|
||||
[ "x$IPTABLES_SAVE_ON_STOP" = "xyes" ] && save
|
||||
stop
|
||||
RETVAL=$?
|
||||
;;
|
||||
restart|force-reload)
|
||||
restart
|
||||
RETVAL=$?
|
||||
;;
|
||||
reload)
|
||||
[ -e "$VAR_SUBSYS_IPTABLES" ] && reload
|
||||
RETVAL=$?
|
||||
;;
|
||||
condrestart|try-restart)
|
||||
[ ! -e "$VAR_SUBSYS_IPTABLES" ] && exit 0
|
||||
restart
|
||||
RETVAL=$?
|
||||
;;
|
||||
status)
|
||||
status
|
||||
RETVAL=$?
|
||||
;;
|
||||
panic)
|
||||
set_policy DROP
|
||||
RETVAL=$?
|
||||
;;
|
||||
save)
|
||||
save
|
||||
RETVAL=$?
|
||||
;;
|
||||
*)
|
||||
echo $"Usage: ${IPTABLES} {start|stop|reload|restart|condrestart|status|panic|save}"
|
||||
RETVAL=2
|
||||
;;
|
||||
esac
|
||||
|
||||
exit $RETVAL
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
[Unit]
|
||||
Description=IPv4 firewall with iptables
|
||||
After=syslog.target
|
||||
AssertPathExists=/etc/sysconfig/iptables
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=/usr/libexec/iptables/iptables.init start
|
||||
ExecReload=/usr/libexec/iptables/iptables.init reload
|
||||
ExecStop=/usr/libexec/iptables/iptables.init stop
|
||||
Environment=BOOTUP=serial
|
||||
Environment=CONSOLETYPE=serial
|
||||
StandardOutput=syslog
|
||||
StandardError=syslog
|
||||
|
||||
[Install]
|
||||
WantedBy=basic.target
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1 @@
|
|||
SHA512 (iptables-1.8.5.tar.bz2) = 6a6baa541bb7aa331b176e0a91894e0766859814b59e77c71351ac34d6ebd337487981db48c70e476a48c67bcf891cfc663221a7582feb1496ad1df56eb28da8
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
# sample configuration for ip6tables service
|
||||
# you can edit this manually or use system-config-firewall
|
||||
# please do not ask us to add additional ports/services to this default configuration
|
||||
*filter
|
||||
:INPUT ACCEPT [0:0]
|
||||
:FORWARD ACCEPT [0:0]
|
||||
:OUTPUT ACCEPT [0:0]
|
||||
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
-A INPUT -p ipv6-icmp -j ACCEPT
|
||||
-A INPUT -i lo -j ACCEPT
|
||||
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
|
||||
-A INPUT -d fe80::/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT
|
||||
-A INPUT -j REJECT --reject-with icmp6-adm-prohibited
|
||||
-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited
|
||||
COMMIT
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
# sample configuration for iptables service
|
||||
# you can edit this manually or use system-config-firewall
|
||||
# please do not ask us to add additional ports/services to this default configuration
|
||||
*filter
|
||||
:INPUT ACCEPT [0:0]
|
||||
:FORWARD ACCEPT [0:0]
|
||||
:OUTPUT ACCEPT [0:0]
|
||||
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
-A INPUT -p icmp -j ACCEPT
|
||||
-A INPUT -i lo -j ACCEPT
|
||||
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
|
||||
-A INPUT -j REJECT --reject-with icmp-host-prohibited
|
||||
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
|
||||
COMMIT
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/iptables/Sanity/NFQUEUE-queue-bypass
|
||||
# Description: Test for "--queue-bypass" backport
|
||||
# Author: Ales Zelinka <azelinka@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2013 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing
|
||||
# to use, modify, copy, or redistribute it subject to the terms
|
||||
# and conditions of the GNU General Public License version 2.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public
|
||||
# License along with this program; if not, write to the Free
|
||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
# Boston, MA 02110-1301, USA.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/iptables/Sanity/NFQUEUE-queue-bypass
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Ales Zelinka <azelinka@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Test for \"--queue-bypass\" backport" >> $(METADATA)
|
||||
@echo "Type: Sanity" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: iptables" >> $(METADATA)
|
||||
@echo "Requires: iptables" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
PURPOSE of /CoreOS/iptables/Sanity/NFQUEUE-queue-bypass
|
||||
Description: Test for "--queue-bypass" backport
|
||||
Author: Ales Zelinka <azelinka@redhat.com>
|
||||
Bug summary: "--queue-bypass" backport
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
#!/bin/bash
|
||||
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/iptables/Sanity/NFQUEUE-queue-bypass
|
||||
# Description: Test for "--queue-bypass" backport
|
||||
# Author: Ales Zelinka <azelinka@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2013 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing
|
||||
# to use, modify, copy, or redistribute it subject to the terms
|
||||
# and conditions of the GNU General Public License version 2.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public
|
||||
# License along with this program; if not, write to the Free
|
||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
# Boston, MA 02110-1301, USA.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
|
||||
rlJournalStart
|
||||
|
||||
rlPhaseStartTest control-ping
|
||||
rlRun "ping -w 2 -c 2 127.0.0.1"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest NFQUEUE-no-listener
|
||||
rlRun "iptables -I INPUT -p icmp -j NFQUEUE" 0 "queue all icmp for userspace processing"
|
||||
rlRun "ping -w 2 -c 2 127.0.0.1" 1-255 "ping 127.0.0.1 - none is listening on queue so packets will be dropped"
|
||||
rlRun "iptables -D INPUT -p icmp -j NFQUEUE" 0 "removing the queue rule"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest NFQUEUE-no-listener-bypass
|
||||
rlRun "iptables -I INPUT -p icmp -j NFQUEUE --queue-bypass" 0 "queue all icmp for userspace processing, bypass if no one is listening"
|
||||
rlRun "ping -w 2 -c 2 127.0.0.1" 0 "ping 127.0.0.1 - none is listening on queue - bypass will make packets go through"
|
||||
rlRun "iptables -D INPUT -p icmp -j NFQUEUE --queue-bypass" 0 "removing the queue rule"
|
||||
rlPhaseEnd
|
||||
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/iptables/Regression/RFE-Enable-the-missing-IPv6-SET-target
|
||||
# Description: Test for [RFE] Enable the missing IPv6 "SET" target
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/iptables/Regression/RFE-Enable-the-missing-IPv6-SET-target
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Test for [RFE] Enable the missing IPv6 \"SET\" target" >> $(METADATA)
|
||||
@echo "Type: Regression" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: iptables" >> $(METADATA)
|
||||
@echo "Requires: iptables ipset" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
PURPOSE of /CoreOS/iptables/Regression/RFE-Enable-the-missing-IPv6-SET-target
|
||||
Description: Test for [RFE] Enable the missing IPv6 "SET" target
|
||||
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
Bug summary: [RFE] Enable the missing IPv6 "SET" target userland ip6tables support to enable ipset to be usable with IPv6
|
||||
|
|
@ -0,0 +1,65 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/iptables/Regression/RFE-Enable-the-missing-IPv6-SET-target
|
||||
# Description: Test for [RFE] Enable the missing IPv6 "SET" target
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
IPSET=testset6
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
# rlAssertRpm kernel
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlRun "ipset create $IPSET hash:ip family inet6"
|
||||
rlRun "ipset add testset6 1234::3456"
|
||||
rlRun "ip6tables-save -t filter > ipt6.save"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
RULE1="INPUT -p tcp -m multiport --dports 21,22,23,25,53,81,123,143 -m conntrack --ctstate NEW --syn -m set ! --match-set $IPSET src -j LOG --log-prefix 'LOG:IPSET added to $IPSET'"
|
||||
RULE2="INPUT -p tcp -m multiport --dports 21,22,23,25,53,81,123,143 -m conntrack --ctstate NEW --syn -m set ! --match-set $IPSET src -j SET --add-set $IPSET src"
|
||||
for op in -A -C -D; do #add, check, delete
|
||||
rlRun "ip6tables $op $RULE1" 0 "do $op logrule"
|
||||
rlRun "ip6tables $op $RULE2" 0 "do $op -j SET rule"
|
||||
done
|
||||
rlRun "ip6tables-save -t filter > ipt6.save2"
|
||||
rlRun "sed -e '/^#/d' -e 's/\[.*:.*\]$//' -i ipt6*" 0 "magically unify savefiles"
|
||||
rlAssertNotDiffer ipt6.save ipt6.save2
|
||||
diff -u ipt6.save ipt6.save2
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "ipset destroy $IPSET"
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/iptables/Regression/RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||
# Description: Test for RFE iptables add -C option to iptables in RHEL6 to
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/iptables/Regression/RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE rules.in
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Test for RFE iptables add -C option to iptables in RHEL6 to" >> $(METADATA)
|
||||
@echo "Type: Regression" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: iptables" >> $(METADATA)
|
||||
@echo "Requires: iptables" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
PURPOSE of /CoreOS/iptables/Regression/RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||
Description: Test for RFE iptables add -C option to iptables in RHEL6 to
|
||||
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
Bug summary: RFE: iptables: add -C option to iptables in RHEL6 to check for existing rules
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
# vim: ft=sh
|
||||
rules4=(
|
||||
"-t nat -A POSTROUTING -o tun+ -j MASQUERADE"
|
||||
"-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT"
|
||||
"-A INPUT -p icmp -m icmp --icmp-type source-quench -j REJECT --reject-with icmp-host-prohibited"
|
||||
"-A INPUT -p icmp -j ACCEPT"
|
||||
"-A INPUT -i lo -j ACCEPT"
|
||||
"-A INPUT -i ippp+ -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m udp -p udp --dport 631 -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m tcp -p tcp --dport 631 -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m udp -p udp --dport 631 -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m udp -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT"
|
||||
"-A INPUT -p ah -j ACCEPT"
|
||||
"-A INPUT -p esp -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT"
|
||||
"-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT"
|
||||
"-A FORWARD -p icmp -m icmp --icmp-type source-quench -j REJECT --reject-with icmp-host-prohibited"
|
||||
"-A FORWARD -p icmp -j ACCEPT"
|
||||
"-A FORWARD -i lo -j ACCEPT"
|
||||
"-A FORWARD -i ippp+ -j ACCEPT"
|
||||
"-A FORWARD -o tun+ -j ACCEPT"
|
||||
"-A INPUT -j REJECT --reject-with icmp-host-prohibited"
|
||||
"-A FORWARD -j REJECT --reject-with icmp-host-prohibited"
|
||||
)
|
||||
|
||||
rules6=(
|
||||
"-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT"
|
||||
"-A INPUT -p ipv6-icmp -j ACCEPT"
|
||||
"-A INPUT -i lo -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m udp -p udp --dport 546 -d fe80::/64 -j ACCEPT"
|
||||
"-A INPUT -i ippp+ -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m udp -p udp --dport 631 -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m tcp -p tcp --dport 631 -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m udp -p udp --dport 631 -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m udp -p udp --dport 5353 -d ff02::fb -j ACCEPT"
|
||||
"-A INPUT -m ipv6header --header ah -j ACCEPT"
|
||||
"-A INPUT -m ipv6header --header esp -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT"
|
||||
"-A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT"
|
||||
"-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT"
|
||||
"-A FORWARD -p ipv6-icmp -j ACCEPT"
|
||||
"-A FORWARD -i lo -j ACCEPT"
|
||||
"-A FORWARD -i ippp+ -j ACCEPT"
|
||||
"-A INPUT -j REJECT --reject-with icmp6-adm-prohibited"
|
||||
"-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited"
|
||||
)
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/iptables/Regression/RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||
# Description: Test for RFE iptables add -C option to iptables in RHEL6 to
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
TESTD=$PWD
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlRun "source $TESTD/rules.in" 0 "read ruleset"
|
||||
rlRun "iptables -F"
|
||||
rlRun "ip6tables -F"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
declare -i sane=0
|
||||
for i in ${!rules4[*]}; do
|
||||
let sane++
|
||||
rlRun "iptables ${rules4[$i]}"
|
||||
testrule="${rules4[$i]/-A/-C}"
|
||||
rlRun "iptables $testrule"
|
||||
done
|
||||
for i in ${!rules6[*]}; do
|
||||
let sane++
|
||||
rlRun "ip6tables ${rules6[$i]}"
|
||||
testrule="${rules6[$i]/-A/-C}"
|
||||
rlRun "ip6tables $testrule"
|
||||
done
|
||||
#check itercount
|
||||
if [[ $sane -lt 40 ]]; then
|
||||
rlFail "test insane, do inspect" # rules were not properly loaded!
|
||||
fi
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "iptables -F"
|
||||
rlRun "iptables -t nat -F"
|
||||
rlRun "ip6tables -F"
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/iptables/Regression/TRACE-target-of-iptables-can-t-work-in
|
||||
# Description: Test for TRACE target of iptables can't work in
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2016 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/iptables/Regression/TRACE-target-of-iptables-can-t-work-in
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Test for TRACE target of iptables can't work in" >> $(METADATA)
|
||||
@echo "Type: Regression" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: iptables" >> $(METADATA)
|
||||
@echo "Requires: iptables iptables-services" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
PURPOSE of /CoreOS/iptables/Regression/TRACE-target-of-iptables-can-t-work-in
|
||||
Description: Test for TRACE target of iptables can't work in
|
||||
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
Bug summary: TRACE target of iptables can't work in RHEL7.1/RHEL7.2
|
||||
|
|
@ -0,0 +1,136 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/iptables/Regression/TRACE-target-of-iptables-can-t-work-in
|
||||
# Description: Test for TRACE target of iptables can't work in
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2016 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
SERVICES="iptables ip6tables firewalld"
|
||||
|
||||
prepare_page() {
|
||||
section=$1
|
||||
name=$2
|
||||
dest=${name}.manpage
|
||||
zcat /usr/share/man/man${section}/${name}.${section}.gz | tr -s ' ' > ${dest}
|
||||
rlAssertExists ${dest}
|
||||
}
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
# rlAssertRpm kernel
|
||||
rlLogInfo $(uname -r)
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
prepare_page 8 iptables-extensions
|
||||
for svc in $SERVICES; do
|
||||
rlServiceStop $svc
|
||||
done
|
||||
rlRun "ip -4 -o r | grep default | head -1 | sed -re 's/.*dev ((\.|\w)+).*/\1/' > default-iface"
|
||||
IFACE="$(< default-iface)"
|
||||
rlAssertExists "/sys/class/net/$IFACE"
|
||||
rlRun "ip route save > ip-route.save" 0 "save routing info"
|
||||
rlRun "ip -6 route save > ip-route.save6" 0 "save ipv6 routing info"
|
||||
rlRun "ip -6 r add default dev $IFACE" 0,2 "add ipv6 default route"
|
||||
rlRun "rmmod nf_log_ipv4" 0,1
|
||||
rlRun "rmmod nf_log_ipv6" 0,1
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "manpage check"
|
||||
rlAssertGrep "nfnetlink_log" iptables-extensions.manpage
|
||||
if rlIsRHEL 7 && rlIsRHEL '>=7.3' ; then
|
||||
# RHEL version-specific libxt_TRACE man page patchs
|
||||
rlAssertGrep "nf_log_ipv4(6)" iptables-extensions.manpage
|
||||
rlAssertNotGrep "ip(...)?t_LOG" iptables-extensions.manpage -Ei
|
||||
fi
|
||||
rlPhaseEnd
|
||||
|
||||
ipv4_ping() {
|
||||
rlRun "ping -i 0.2 -c 3 -W 1 192.0.2.99" 0,1 "ipv4 icmp out (ping)"
|
||||
}
|
||||
ipv6_ping() {
|
||||
rlRun "ping6 -i 0.2 -c 3 -W 1 2001:DB8::99" 0,1 "ipv6 icmp out (ping6)"
|
||||
}
|
||||
get_messages() {
|
||||
if rlIsFedora; then
|
||||
journalctl -qkb
|
||||
else
|
||||
cat /var/log/messages
|
||||
fi
|
||||
}
|
||||
|
||||
rlPhaseStartTest "iptables_TRACE"
|
||||
rlRun "get_messages > messages.log-orig"
|
||||
rlRun "iptables -t raw -I OUTPUT -p icmp -j TRACE" 0
|
||||
rlRun "ip6tables -t raw -I OUTPUT -p icmpv6 -j TRACE" 0
|
||||
if rlTestVersion "$(uname -r)" "<" "4.6"; then
|
||||
ipv4_ping; ipv6_ping
|
||||
rlRun "get_messages > messages.current"
|
||||
|
||||
rlRun "diff messages.log-orig messages.current > diff.1" 0,1
|
||||
echo --debug_START--
|
||||
cat diff.1
|
||||
echo --debug_END--
|
||||
rlRun "modprobe nf_log_ipv4" 0 "load ipv4 TRACE logging module"
|
||||
rlRun "modprobe nf_log_ipv6" 0 "load ipv6 TRACE logging module"
|
||||
rlAssertNotGrep "TRACE" diff.1
|
||||
else
|
||||
rlLogInfo "new kernel detected: skipping loading modules and associated checks"
|
||||
fi
|
||||
ipv4_ping; ipv6_ping
|
||||
rlRun "get_messages > messages.current"
|
||||
|
||||
rlRun "diff messages.log-orig messages.current > diff.2" 0,1
|
||||
rlAssertGrep "TRACE" diff.2
|
||||
rlAssertGrep "TRACE.*PROTO=ICMP " diff.2
|
||||
rlAssertGrep "TRACE.*PROTO=ICMPv6 " diff.2
|
||||
echo --debug_START--
|
||||
cat diff.2
|
||||
echo --debug_END--
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "ip route flush default" 0 "flush ip route data"
|
||||
rlRun "ip -6 route flush default" 0 "flush ipv6 route data"
|
||||
rlRun "ip route restore < ip-route.save" 0 "restore routing info"
|
||||
rlRun "ip -6 route restore < ip-route.save6" 0 "restore routing info ipv6"
|
||||
rlRun "iptables -t raw -F"
|
||||
rlRun "ip6tables -t raw -F"
|
||||
rlRun "rmmod nf_log_ipv4"
|
||||
rlRun "rmmod nf_log_ipv6"
|
||||
rlRun "rmmod nf_log_common"
|
||||
rlRun "rmmod nfnetlink_log" 0,1
|
||||
rlLogInfo "restoring services"
|
||||
for svc in $SERVICES; do
|
||||
rlServiceRestore $svc
|
||||
done
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/iptables/Sanity/backport-iptables-add-libxt-cgroup-frontend
|
||||
# Description: Test for backport iptables add libxt_cgroup frontend
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/iptables/Sanity/backport-iptables-add-libxt-cgroup-frontend
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Test for backport iptables add libxt_cgroup frontend" >> $(METADATA)
|
||||
@echo "Type: Sanity" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: iptables" >> $(METADATA)
|
||||
@echo "Requires: iptables libcgroup-tools" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
PURPOSE of /CoreOS/iptables/Sanity/backport-iptables-add-libxt-cgroup-frontend
|
||||
Description: Test for backport iptables add libxt_cgroup frontend
|
||||
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
Bug summary: Backport: iptables: add libxt_cgroup frontend
|
||||
|
|
@ -0,0 +1,111 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/iptables/Sanity/backport-iptables-add-libxt-cgroup-frontend
|
||||
# Description: Test for backport iptables add libxt_cgroup frontend
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
CGNUM="15"
|
||||
CGNAME="15"
|
||||
CGDIR="/sys/fs/cgroup/net_cls/$CGNAME"
|
||||
DEST_IP4="192.0.2.99" # TEST-NET-1
|
||||
DEST_IP42="192.0.2.199" # TEST-NET-1
|
||||
DEST_IP6="2001:0db8:0000:0000:0000:0000:0000:abc0" #has to be expanded due to matching !
|
||||
DEST_IP62="2001:0db8:0000:0000:0000:0000:0000:abc1"
|
||||
SKIP6=false
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
# rlAssertRpm kernel-$(uname -r)
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
if rlIsRHEL '>=7'; then
|
||||
rlServiceStop firewalld
|
||||
sleep 1
|
||||
fi
|
||||
rlLogInfo "check if net_cls cgroup is present"
|
||||
rlAssertGrep "cgroup.*net_cls" /proc/mounts
|
||||
rlRun "cgcreate -g net_cls:$CGNAME" 0 "create cgroup '15'"
|
||||
rlRun "echo $CGNUM > $CGDIR/net_cls.classid" 0 "assign numerical id to cgroup"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
ping -W 1 -c 30 $DEST_IP4 &
|
||||
PING4_P1=$! EC4=$?
|
||||
ping -W 1 -c 30 $DEST_IP42 &
|
||||
PING4_P2=$! EC42=$?
|
||||
rlRun "[[ $EC4 -eq 0 && $EC42 -eq 0 ]]" 0 "ping ipv4 running to $DEST_IP4, $DEST_IP42"
|
||||
|
||||
ping6 -W 1 -c 30 $DEST_IP6 &
|
||||
PING6_P1=$! EC6=$?
|
||||
sleep 1
|
||||
if [[ $EC6 -eq 2 ]] || ! kill -0 $PING6_P1 2>/dev/null; then
|
||||
rlLogInfo "skipping ipv6 test, network stack unavailable"
|
||||
SKIP6=true
|
||||
else
|
||||
ping6 -W 1 -c 30 $DEST_IP62 &
|
||||
PING6_P2=$!
|
||||
rlRun "kill -0 $PING6_P1 && kill -0 $PING6_P2" 0 "ping ipv6 running to $DEST_IP6, $DEST_IP62"
|
||||
fi
|
||||
journalctl -fkb > dmesg.out &
|
||||
DMESG_P=$!
|
||||
echo > dmesg.out # clear dmesg out
|
||||
|
||||
rlRun "iptables -A OUTPUT -m cgroup --cgroup $CGNUM -j LOG"
|
||||
rlRun "ip6tables -A OUTPUT -m cgroup --cgroup $CGNUM -j LOG"
|
||||
|
||||
rlRun "echo $PING4_P2 >> $CGDIR/tasks" 0 "Add second ping to cgroup '15'"
|
||||
$SKIP6 || rlRun "echo $PING6_P2 >> $CGDIR/tasks" 0 "Add second ping6 to cgroup '15'"
|
||||
cat $CGDIR/tasks
|
||||
sleep 10
|
||||
cat dmesg.out
|
||||
rlAssertGrep "$DEST_IP42" dmesg.out
|
||||
$SKIP6 || rlAssertGrep "$DEST_IP62" dmesg.out
|
||||
rlAssertNotGrep "$DEST_IP4" dmesg.out
|
||||
rlAssertNotGrep "$DEST_IP6" dmesg.out
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
kill $DMESG_P
|
||||
# pings die after 30s of execution either way
|
||||
kill $PING4_P1
|
||||
kill $PING4_P2
|
||||
$SKIP6 || kill $PING6_P1
|
||||
$SKIP6 || kill $PING6_P2
|
||||
sleep 1
|
||||
|
||||
rlRun "iptables -F" 0 "cleanup iptables"
|
||||
rlRun "ip6tables -F" 0 "cleanup ip6tables"
|
||||
rlServiceRestore firewalld
|
||||
rlRun "cgdelete -g net_cls:$CGNAME" 0 "delete cgroup"
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/iptables/Sanity/initscript-sanity
|
||||
# Description: initscript-sanity
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2016 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/iptables/Sanity/initscript-sanity
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: initscript-sanity" >> $(METADATA)
|
||||
@echo "Type: Sanity" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: iptables" >> $(METADATA)
|
||||
@echo "Requires: iptables iptables-services" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
PURPOSE of /CoreOS/iptables/Sanity/initscript-sanity
|
||||
Description: initscript-sanity
|
||||
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
Bug summary: Can not "service iptables save": restorecon not found
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/iptables/Sanity/initscript-sanity
|
||||
# Description: initscript-sanity
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2016 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
rlLogInfo 'Can not "service iptables save": restorecon not found'
|
||||
if rlIsRHEL 6 7 ; then
|
||||
rlAssertGrep '[ ! -x "$RESTORECON" ] && RESTORECON=/bin/true' /usr/libexec/iptables/iptables.init
|
||||
rlAssertGrep '[ ! -x "$RESTORECON" ] && RESTORECON=/bin/true' /usr/libexec/iptables/ip6tables.init
|
||||
else
|
||||
rlLogInfo 'skipping: test not applicable to this OS release'
|
||||
fi
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
#!/bin/bash
|
||||
export TEST_DOCKER_EXTRA_ARGS="--privileged"
|
||||
exec merge-standard-inventory "$@"
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/iptables/Regression/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
|
||||
# Description: Test for while adding iptables rules with ipv6 sets in
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2014 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/iptables/Regression/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Test for while adding iptables rules with ipv6 sets in" >> $(METADATA)
|
||||
@echo "Type: Regression" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: iptables" >> $(METADATA)
|
||||
@echo "Requires: iptables bridge-utils ipset" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
PURPOSE of /CoreOS/iptables/Regression/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
|
||||
Description: Test for while adding iptables rules with ipv6 sets in
|
||||
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
Bug summary: while adding iptables rules with ipv6 sets in destination direction, either individually or combined with source we see error messages.
|
||||
|
|
@ -0,0 +1,85 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/iptables/Regression/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
|
||||
# Description: Test for while adding iptables rules with ipv6 sets in
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2014 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlRun "ip6tables-save > ip6tables.backup"
|
||||
rlRun "iptables-save > iptables.backup"
|
||||
rlRun "brctl addbr testbr" 0 "create bridge iface"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
rlRun "ipset create ipsetv6 hash:net timeout 60 family inet6" 0 "Create hash:net ipset for ipv6"
|
||||
rlRun "ipset create ipsetv4 hash:net timeout 60 family inet" 0 "Create hash:net ipset for ipv4"
|
||||
rlRun "ipset list ipsetv6" 0 "verify ipsetv6 presence"
|
||||
rlRun "ipset list ipsetv4" 0 "verify ipsetv4 presence"
|
||||
# echo waiting; read; echo cont
|
||||
checkRule() {
|
||||
binary="$1"
|
||||
comment="$2"
|
||||
rlRun "$binary -t mangle $RULE" 0 "$comment"
|
||||
rlRun "$binary-save | grep -qe '$RULE'" 0 "verify rule"
|
||||
}
|
||||
for i in dst src dst,src src,dst; do
|
||||
# 6,4 (+)
|
||||
RULE="-A PREROUTING -i testbr -m set --match-set ipsetv6 $i -j ACCEPT"
|
||||
checkRule ip6tables "[ipv6] direction: $i. adding ip6tables rule to match set"
|
||||
RULE="-A PREROUTING -i testbr -m set --match-set ipsetv4 $i -j ACCEPT"
|
||||
checkRule iptables "[ipv4] direction: $i. adding iptables rule to match set"
|
||||
|
||||
# 6,4 (-)
|
||||
RULE="-A PREROUTING -i testbr -m set ! --match-set ipsetv6 $i -j ACCEPT"
|
||||
checkRule ip6tables "[ipv6] direction: $i. adding negated ip6tables rule to match set"
|
||||
RULE="-A PREROUTING -i testbr -m set ! --match-set ipsetv4 $i -j ACCEPT"
|
||||
checkRule iptables "[ipv4] direction: $i. adding negated iptables rule to match set"
|
||||
done
|
||||
ip6tables-save
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "ip6tables -t mangle -F"
|
||||
rlRun "iptables -t mangle -F"
|
||||
rlRun "ip6tables-restore < ip6tables.backup"
|
||||
rlRun "iptables-restore < iptables.backup"
|
||||
rlRun "ip link set down dev testbr"
|
||||
rlRun "brctl delbr testbr" 0 "remove bridge iface"
|
||||
rlRun "ipset destroy ipsetv6" 0 "remove ipv6 ipset"
|
||||
rlRun "ipset destroy ipsetv4" 0 "remove ipv4 ipset"
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/iptables/Regression/ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||
# Description: Test for ip6tables service does not allow dhcpv6-client by
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/iptables/Regression/ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Test for ip6tables service does not allow dhcpv6-client by" >> $(METADATA)
|
||||
@echo "Type: Regression" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: iptables" >> $(METADATA)
|
||||
@echo "Requires: iptables iptables-services" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
PURPOSE of /CoreOS/iptables/Regression/ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||
Description: Test for ip6tables service does not allow dhcpv6-client by
|
||||
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
Bug summary: ip6tables service does not allow dhcpv6-client by default
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/iptables/Regression/ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||
# Description: Test for ip6tables service does not allow dhcpv6-client by
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlRun "cp /etc/sysconfig/ip6tables ."
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
rlRun "sed -ie '/REJECT/,// d' ip6tables" 0 "remove all rejected rules"
|
||||
echo --debug--; cat ip6tables
|
||||
rlAssertGrep "-A INPUT -d fe80::/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT" ip6tables
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/iptables/Regression/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP
|
||||
# Description: Test for ip6tables -t nat -A POSTROUTING/OUTPUT with DROP
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2016 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/iptables/Regression/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Test for ip6tables -t nat -A POSTROUTING/OUTPUT with DROP" >> $(METADATA)
|
||||
@echo "Type: Regression" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: iptables" >> $(METADATA)
|
||||
@echo "Requires: iptables" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
PURPOSE of /CoreOS/iptables/Regression/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP
|
||||
Description: Test for ip6tables -t nat -A POSTROUTING/OUTPUT with DROP
|
||||
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
Bug summary: ip6tables -t nat -A POSTROUTING/OUTPUT with DROP target can't filter packets
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
#!/bin/sh
|
||||
|
||||
ip netns del cs_client >/dev/null 2>&1
|
||||
ip link del veth0 >/dev/null 2>&1
|
||||
|
||||
ip netns add cs_client
|
||||
ip link add type veth
|
||||
ip link set veth1 name eth1 netns cs_client
|
||||
|
||||
export cs_client_if1=eth1
|
||||
export cs_server_if1=veth0
|
||||
export cs_client_ip1=2001:db8:ffff::1
|
||||
export cs_server_ip1=2001:db8:ffff::2
|
||||
|
||||
ip netns exec cs_client ip link set $cs_client_if1 up
|
||||
ip link set $cs_server_if1 up
|
||||
ip netns exec cs_client ip -6 addr add $cs_client_ip1/64 dev $cs_client_if1
|
||||
ip -6 addr add $cs_server_ip1/64 dev $cs_server_if1
|
||||
ip netns exec cs_client ifconfig lo up
|
||||
ifconfig lo up
|
||||
|
|
@ -0,0 +1,83 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/iptables/Regression/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP
|
||||
# Description: Test for ip6tables -t nat -A POSTROUTING/OUTPUT with DROP
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2016 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
SERVICES="iptables ip6tables firewalld"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
for svc in $SERVICES; do
|
||||
rlServiceStop $svc
|
||||
done
|
||||
rlRun "iptables -t nat -F"
|
||||
rlRun "ip6tables -t nat -F"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
table="nat"
|
||||
assert_string="nat.*intended.*inhibited"
|
||||
for chain in PREROUTING INPUT OUTPUT POSTROUTING; do
|
||||
rlLogInfo "checking chain $chain"
|
||||
rlRun "iptables -t $table -A $chain -p icmp -j DROP 2>iptables.stderr" 2 \
|
||||
"iptables: Failure to accept DROP to '$table/$chain' chain"
|
||||
rlRun "ip6tables -t $table -A $chain -p icmpv6 -j DROP 2>ip6tables.stderr" 2 \
|
||||
"ip6tables: Failure to accept DROP to '$table/$chain' chain"
|
||||
rlAssertGrep "$assert_string" iptables.stderr -E
|
||||
rlAssertGrep "$assert_string" ip6tables.stderr -E
|
||||
rm -f iptables.stderr ip6tables.stderr
|
||||
echo --debug_START--
|
||||
set -x
|
||||
iptables-save | grep -E '\*|icmp'
|
||||
ip6tables-save | grep -E '\*|icmp'
|
||||
set +x
|
||||
echo --debug_END--
|
||||
done
|
||||
rlRun "iptables-save > ipt4.out"
|
||||
rlRun "ip6tables-save > ipt6.out"
|
||||
rlAssertNotGrep "icmp" ipt4.out
|
||||
rlAssertNotGrep "icmp" ipt6.out
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "iptables -t nat -F"
|
||||
rlRun "ip6tables -t nat -F"
|
||||
rlLogInfo "restoring services"
|
||||
for svc in $SERVICES; do
|
||||
rlServiceRestore $svc
|
||||
done
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/iptables/Regression/iptables-rule-deletion-fails-for-rules-that-use
|
||||
# Description: Test for iptables rule deletion fails for rules that use
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/iptables/Regression/iptables-rule-deletion-fails-for-rules-that-use
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Test for iptables rule deletion fails for rules that use" >> $(METADATA)
|
||||
@echo "Type: Regression" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: iptables" >> $(METADATA)
|
||||
@echo "Requires: iptables ipset" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
PURPOSE of /CoreOS/iptables/Regression/iptables-rule-deletion-fails-for-rules-that-use
|
||||
Description: Test for iptables rule deletion fails for rules that use
|
||||
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
Bug summary: iptables rule deletion fails for rules that use ipset match "--match-set"
|
||||
|
|
@ -0,0 +1,78 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/iptables/Regression/iptables-rule-deletion-fails-for-rules-that-use
|
||||
# Description: Test for iptables rule deletion fails for rules that use
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
IPSET4="ipsetv4"
|
||||
IPSET6="ipsetv6"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlRun "ipset create $IPSET4 hash:ip"
|
||||
rlRun "ipset create $IPSET6 hash:ip family inet6"
|
||||
rlRun "iptables-save -t mangle > ipt4.save"
|
||||
rlRun "ip6tables-save -t mangle > ipt6.save"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
RULE40="-A PREROUTING -m set --match-set $IPSET4 dst -j ACCEPT"
|
||||
RULE40d="-D PREROUTING -m set --match-set $IPSET4 dst -j ACCEPT"
|
||||
RULE41="-A PREROUTING -m set --match-set $IPSET4 dst -j SET --add-set $IPSET4 src"
|
||||
RULE41d="-D PREROUTING -m set --match-set $IPSET4 dst -j SET --add-set $IPSET4 src"
|
||||
RULE60="-A PREROUTING -m set --match-set $IPSET6 dst -j ACCEPT"
|
||||
RULE60d="-D PREROUTING -m set --match-set $IPSET6 dst -j ACCEPT"
|
||||
RULE61="-A PREROUTING -m set --match-set $IPSET6 dst -j SET --add-set $IPSET6 src"
|
||||
RULE61d="-D PREROUTING -m set --match-set $IPSET6 dst -j SET --add-set $IPSET6 src"
|
||||
for RULE in "$RULE40" "$RULE40d" "$RULE41" "$RULE41d"; do
|
||||
rlRun "iptables -t mangle $RULE"
|
||||
done
|
||||
for RULE in "$RULE60" "$RULE60d" "$RULE61" "$RULE61d"; do
|
||||
rlRun "ip6tables -t mangle $RULE"
|
||||
done
|
||||
rlRun "iptables-save -t mangle > ipt4.save2"
|
||||
rlRun "ip6tables-save -t mangle > ipt6.save2"
|
||||
rlRun "sed -e '/^#/d' -e 's/\[.*:.*\]$//' -i ipt4* ipt6*" 0 "magically unify savefiles"
|
||||
rlAssertNotDiffer ipt4.save ipt4.save2
|
||||
rlAssertNotDiffer ipt6.save ipt6.save2
|
||||
diff -u ipt4.save ipt4.save2
|
||||
diff -u ipt6.save ipt6.save2
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "ipset destroy $IPSET4"
|
||||
rlRun "ipset destroy $IPSET6"
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/iptables/Regression/iptables-save-cuts-space-before-j
|
||||
# Description: Test for iptables-save cuts space before -j
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/iptables/Regression/iptables-save-cuts-space-before-j
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Test for iptables-save cuts space before -j" >> $(METADATA)
|
||||
@echo "Type: Regression" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: iptables" >> $(METADATA)
|
||||
@echo "Requires: iptables" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
PURPOSE of /CoreOS/iptables/Regression/iptables-save-cuts-space-before-j
|
||||
Description: Test for iptables-save cuts space before -j
|
||||
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
Bug summary: iptables-save cuts space before -j
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/iptables/Regression/iptables-save-cuts-space-before-j
|
||||
# Description: Test for iptables-save cuts space before -j
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlServiceStart iptables
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
RULE="-A INPUT -p dccp -m dccp --dccp-type RESET,INVALID -j LOG"
|
||||
if rlIsRHEL '>6' || rlIsFedora; then
|
||||
RULE="${RULE/type/types}" # it is exported under other name
|
||||
fi
|
||||
rlLogInfo "using rule '$RULE'"
|
||||
rlRun "iptables $RULE" 0 "add rule for ipv4"
|
||||
rlRun "ip6tables $RULE" 0 "add rule for ipv6"
|
||||
rlRun "iptables-save | grep -- '$RULE'" 0 "check rule for ipv4"
|
||||
rlRun "ip6tables-save | grep -- '$RULE'" 0 "check rule for ipv6"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlServiceStop iptables
|
||||
rlServiceRestore iptables
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/iptables/Regression/iptables-save-modprobe-option
|
||||
# Description: Test for iptables-save man page completely wrong - which
|
||||
# Author: Ales Zelinka <azelinka@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2013 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing
|
||||
# to use, modify, copy, or redistribute it subject to the terms
|
||||
# and conditions of the GNU General Public License version 2.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public
|
||||
# License along with this program; if not, write to the Free
|
||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
# Boston, MA 02110-1301, USA.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/iptables/Regression/iptables-save-modprobe-option
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Ales Zelinka <azelinka@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Test for iptables-save man page completely wrong - which" >> $(METADATA)
|
||||
@echo "Type: Regression" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: iptables" >> $(METADATA)
|
||||
@echo "Requires: iptables" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
PURPOSE of /CoreOS/iptables/Regression/iptables-save-modprobe-option
|
||||
Description: Test for iptables-save man page completely wrong - which
|
||||
Author: Ales Zelinka <azelinka@redhat.com>
|
||||
Bug summary: iptables-save man page completely wrong - which conflicting arguments should work?
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
#!/bin/bash
|
||||
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/iptables/Regression/iptables-save-modprobe-option
|
||||
# Description: Test for iptables-save man page completely wrong - which
|
||||
# Author: Ales Zelinka <azelinka@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2013 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing
|
||||
# to use, modify, copy, or redistribute it subject to the terms
|
||||
# and conditions of the GNU General Public License version 2.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public
|
||||
# License along with this program; if not, write to the Free
|
||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
# Boston, MA 02110-1301, USA.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartTest
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "iptables-save -M /dev/null" 0 "iptables-save -M ... supported"
|
||||
rlRun "iptables-save --modprobe /dev/null" 0 "iptables-save --modprobe ... supported"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
---
|
||||
- hosts: localhost
|
||||
tags: [ always ]
|
||||
tasks:
|
||||
- set_fact:
|
||||
our_required_packages:
|
||||
- iproute # multiple tests need ip command
|
||||
- iputils # multiple tests need ping/ping6 commands
|
||||
- iptables # multiple tests need iptables/ip6tables commands
|
||||
- iptables-services # multiple tests need iptables/ip6tables config files
|
||||
- initscripts # multiple tests need system command
|
||||
- libcgroup-tools # backport-iptables-add-libxt-cgroup-frontend needs cg* commands
|
||||
- bridge-utils # ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets needs brctl command
|
||||
- ipset # multiple tests need ipset command
|
||||
- strace # xtables-tools-locking-vulnerable-to-local-DoS needs strace command
|
||||
- policycoreutils # initscript-sanity needs restorecon command
|
||||
|
||||
- hosts: localhost
|
||||
tags:
|
||||
- rhts-all
|
||||
roles:
|
||||
- role: standard-test-rhts
|
||||
tests:
|
||||
- backport-iptables-add-libxt-cgroup-frontend
|
||||
- initscript-sanity
|
||||
- ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
|
||||
- ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||
- ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP
|
||||
- iptables-rule-deletion-fails-for-rules-that-use
|
||||
- iptables-save-cuts-space-before-j
|
||||
- iptables-save-modprobe-option
|
||||
- NFQUEUE-queue-bypass
|
||||
- RFE-Enable-the-missing-IPv6-SET-target
|
||||
- RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||
- TRACE-target-of-iptables-can-t-work-in
|
||||
- xtables-tools-locking-vulnerable-to-local-DoS
|
||||
required_packages: "{{ our_required_packages }}"
|
||||
|
||||
- hosts: localhost
|
||||
tags:
|
||||
- classic
|
||||
- beakerlib-all
|
||||
roles:
|
||||
- role: standard-test-beakerlib
|
||||
tests:
|
||||
- backport-iptables-add-libxt-cgroup-frontend
|
||||
- initscript-sanity
|
||||
- ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
|
||||
- ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||
- ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP
|
||||
- iptables-rule-deletion-fails-for-rules-that-use
|
||||
- iptables-save-cuts-space-before-j
|
||||
- iptables-save-modprobe-option
|
||||
- NFQUEUE-queue-bypass
|
||||
- RFE-Enable-the-missing-IPv6-SET-target
|
||||
- RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||
- TRACE-target-of-iptables-can-t-work-in
|
||||
- xtables-tools-locking-vulnerable-to-local-DoS
|
||||
required_packages: "{{ our_required_packages }}"
|
||||
|
||||
- hosts: localhost
|
||||
tags:
|
||||
- container
|
||||
roles:
|
||||
- role: standard-test-beakerlib
|
||||
tests:
|
||||
#- backport-iptables-add-libxt-cgroup-frontend # journaling/logging issues?
|
||||
- ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
|
||||
- ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||
- ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP
|
||||
- iptables-rule-deletion-fails-for-rules-that-use
|
||||
- iptables-save-cuts-space-before-j
|
||||
- iptables-save-modprobe-option
|
||||
- NFQUEUE-queue-bypass
|
||||
- RFE-Enable-the-missing-IPv6-SET-target
|
||||
- RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||
- xtables-tools-locking-vulnerable-to-local-DoS
|
||||
required_packages: "{{ our_required_packages }}"
|
||||
|
||||
- hosts: localhost
|
||||
tags:
|
||||
- atomic
|
||||
roles:
|
||||
- role: standard-test-beakerlib
|
||||
tests:
|
||||
- ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||
- iptables-save-cuts-space-before-j
|
||||
- iptables-save-modprobe-option
|
||||
- NFQUEUE-queue-bypass
|
||||
- RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||
- xtables-tools-locking-vulnerable-to-local-DoS
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/iptables/Regression/xtables-tools-locking-vulnerable-to-local-DoS
|
||||
# Description: Test for xtables tools locking vulnerable to local DoS
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/iptables/Regression/xtables-tools-locking-vulnerable-to-local-DoS
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Test for xtables tools locking vulnerable to local DoS" >> $(METADATA)
|
||||
@echo "Type: Regression" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: iptables" >> $(METADATA)
|
||||
@echo "Requires: iptables strace" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
PURPOSE of /CoreOS/iptables/Regression/xtables-tools-locking-vulnerable-to-local-DoS
|
||||
Description: Test for xtables tools locking vulnerable to local DoS
|
||||
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
Bug summary: xtables tools locking vulnerable to local DoS
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/iptables/Regression/xtables-tools-locking-vulnerable-to-local-DoS
|
||||
# Description: Test for xtables tools locking vulnerable to local DoS
|
||||
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2015 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
rlRun "strace -fe flock,bind,open,openat -o strace.out iptables -w -L" 0 "execute iptables in strace"
|
||||
echo --debug--; cat strace.out
|
||||
rlAssertNotGrep "bind.*xtables" strace.out -E
|
||||
rlAssertGrep " flock(" strace.out
|
||||
rlAssertGrep "/run/xtables.lock" strace.out
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||
rlPhaseEnd
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
Loading…
Reference in New Issue