RHEL 9.0.0 Alpha bootstrap
The content of this branch was automatically imported from Fedora ELN with the following as its source: https://src.fedoraproject.org/rpms/iptables#fb677ca83cc1a1ad64e67ae869318c8909650c47
This commit is contained in:
Petr Šabata
parent
3e4cbdd4d1
commit
311316e433
6
.gitignore
vendored
6
.gitignore
vendored
@ -0,0 +1,6 @@
|
|||||||
|
/iptables-1.6.2.tar.bz2
|
||||||
|
/iptables-1.8.0.tar.bz2
|
||||||
|
/iptables-1.8.2.tar.bz2
|
||||||
|
/iptables-1.8.3.tar.bz2
|
||||||
|
/iptables-1.8.4.tar.bz2
|
||||||
|
/iptables-1.8.5.tar.bz2
|
||||||
@ -0,0 +1,42 @@
|
|||||||
|
From 55bb60d8ae717d3bc1cfdd6203604a18f30eb3c3 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Jan Engelhardt <jengelh@inai.de>
|
||||||
|
Date: Wed, 3 Jun 2020 15:38:48 +0200
|
||||||
|
Subject: [PATCH] build: resolve iptables-apply not getting installed
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
ip6tables-apply gets installed but iptables-apply does not.
|
||||||
|
That is wrong.
|
||||||
|
|
||||||
|
» make install DESTDIR=$PWD/r
|
||||||
|
» find r -name "*app*"
|
||||||
|
r/usr/local/sbin/ip6tables-apply
|
||||||
|
r/usr/local/share/man/man8/iptables-apply.8
|
||||||
|
r/usr/local/share/man/man8/ip6tables-apply.8
|
||||||
|
|
||||||
|
Fixes: v1.8.5~87
|
||||||
|
Signed-off-by: Jan Engelhardt <jengelh@inai.de>
|
||||||
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||||
|
(cherry picked from commit d4ed0c741fc789bb09d977d74d30875fdd50d08b)
|
||||||
|
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||||
|
---
|
||||||
|
iptables/Makefile.am | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/iptables/Makefile.am b/iptables/Makefile.am
|
||||||
|
index dc66b3cc09c08..2024dbf5cb88c 100644
|
||||||
|
--- a/iptables/Makefile.am
|
||||||
|
+++ b/iptables/Makefile.am
|
||||||
|
@@ -56,7 +56,7 @@ man_MANS = iptables.8 iptables-restore.8 iptables-save.8 \
|
||||||
|
ip6tables-save.8 iptables-extensions.8 \
|
||||||
|
iptables-apply.8 ip6tables-apply.8
|
||||||
|
|
||||||
|
-sbin_SCRIPT = iptables-apply
|
||||||
|
+sbin_SCRIPTS = iptables-apply
|
||||||
|
|
||||||
|
if ENABLE_NFTABLES
|
||||||
|
man_MANS += xtables-nft.8 xtables-translate.8 xtables-legacy.8 \
|
||||||
|
--
|
||||||
|
2.27.0
|
||||||
|
|
||||||
@ -0,0 +1,60 @@
|
|||||||
|
From 6e8f0c61f4c9abc2836d772fca97ff0d84c03360 Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Adam=20Go=C5=82=C4=99biowski?= <adamg@pld-linux.org>
|
||||||
|
Date: Wed, 14 Nov 2018 07:35:28 +0100
|
||||||
|
Subject: [PATCH] extensions: format-security fixes in libip[6]t_icmp
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
commit 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
|
||||||
|
introduced support for gcc feature to check format string against passed
|
||||||
|
argument. This commit adds missing bits to extenstions's libipt_icmp.c
|
||||||
|
and libip6t_icmp6.c that were causing build to fail.
|
||||||
|
|
||||||
|
Fixes: 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
|
||||||
|
Signed-off-by: Adam Gołębiowski <adamg@pld-linux.org>
|
||||||
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||||
|
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||||
|
---
|
||||||
|
extensions/libip6t_icmp6.c | 4 ++--
|
||||||
|
extensions/libipt_icmp.c | 2 +-
|
||||||
|
2 files changed, 3 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/extensions/libip6t_icmp6.c b/extensions/libip6t_icmp6.c
|
||||||
|
index 45a71875722c4..cc7bfaeb72fd7 100644
|
||||||
|
--- a/extensions/libip6t_icmp6.c
|
||||||
|
+++ b/extensions/libip6t_icmp6.c
|
||||||
|
@@ -230,7 +230,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
|
||||||
|
type_name = icmp6_type_xlate(icmptype);
|
||||||
|
|
||||||
|
if (type_name) {
|
||||||
|
- xt_xlate_add(xl, type_name);
|
||||||
|
+ xt_xlate_add(xl, "%s", type_name);
|
||||||
|
} else {
|
||||||
|
for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i)
|
||||||
|
if (icmpv6_codes[i].type == icmptype &&
|
||||||
|
@@ -239,7 +239,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
|
||||||
|
break;
|
||||||
|
|
||||||
|
if (i != ARRAY_SIZE(icmpv6_codes))
|
||||||
|
- xt_xlate_add(xl, icmpv6_codes[i].name);
|
||||||
|
+ xt_xlate_add(xl, "%s", icmpv6_codes[i].name);
|
||||||
|
else
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
|
||||||
|
index 5418997668d4c..e76257c54708c 100644
|
||||||
|
--- a/extensions/libipt_icmp.c
|
||||||
|
+++ b/extensions/libipt_icmp.c
|
||||||
|
@@ -236,7 +236,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
|
||||||
|
if (icmp_codes[i].type == icmptype &&
|
||||||
|
icmp_codes[i].code_min == code_min &&
|
||||||
|
icmp_codes[i].code_max == code_max) {
|
||||||
|
- xt_xlate_add(xl, icmp_codes[i].name);
|
||||||
|
+ xt_xlate_add(xl, "%s", icmp_codes[i].name);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.21.0
|
||||||
|
|
||||||
@ -0,0 +1,58 @@
|
|||||||
|
From 51730adbe90a17e0d86d5adcab30040fa7e751ed Mon Sep 17 00:00:00 2001
|
||||||
|
From: Arturo Borrero Gonzalez <arturo@netfilter.org>
|
||||||
|
Date: Tue, 16 Jun 2020 11:20:42 +0200
|
||||||
|
Subject: [PATCH] xtables-translate: don't fail if help was requested
|
||||||
|
|
||||||
|
If the user called `iptables-translate -h` then we have CMD_NONE and we should gracefully handle
|
||||||
|
this case in do_command_xlate().
|
||||||
|
|
||||||
|
Before this patch, you would see:
|
||||||
|
|
||||||
|
user@debian:~$ sudo iptables-translate -h
|
||||||
|
[..]
|
||||||
|
nft Unsupported command?
|
||||||
|
user@debian:~$ echo $?
|
||||||
|
1
|
||||||
|
|
||||||
|
After this patch:
|
||||||
|
|
||||||
|
user@debian:~$ sudo iptables-translate -h
|
||||||
|
[..]
|
||||||
|
user@debian:~$ echo $?
|
||||||
|
0
|
||||||
|
|
||||||
|
Fixes: d4409d449c10fa ("nft: Don't exit early after printing help texts")
|
||||||
|
Acked-by: Phil Sutter <phil@nwl.cc>
|
||||||
|
Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
|
||||||
|
(cherry picked from commit 2757c0b5e5fbbf569695469b331453cecefdf069)
|
||||||
|
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||||
|
---
|
||||||
|
iptables/xtables-translate.c | 5 ++++-
|
||||||
|
1 file changed, 4 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
|
||||||
|
index 5aa42496b5a48..363c8be15b3fa 100644
|
||||||
|
--- a/iptables/xtables-translate.c
|
||||||
|
+++ b/iptables/xtables-translate.c
|
||||||
|
@@ -249,7 +249,7 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
|
||||||
|
|
||||||
|
cs.restore = restore;
|
||||||
|
|
||||||
|
- if (!restore)
|
||||||
|
+ if (!restore && p.command != CMD_NONE)
|
||||||
|
printf("nft ");
|
||||||
|
|
||||||
|
switch (p.command) {
|
||||||
|
@@ -310,6 +310,9 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
|
||||||
|
break;
|
||||||
|
case CMD_SET_POLICY:
|
||||||
|
break;
|
||||||
|
+ case CMD_NONE:
|
||||||
|
+ ret = 1;
|
||||||
|
+ break;
|
||||||
|
default:
|
||||||
|
/* We should never reach this... */
|
||||||
|
printf("Unsupported command?\n");
|
||||||
|
--
|
||||||
|
2.27.0
|
||||||
|
|
||||||
40
0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch
Normal file
40
0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch
Normal file
@ -0,0 +1,40 @@
|
|||||||
|
From eacefb728885b5dc51036181de83b2df309d4e6b Mon Sep 17 00:00:00 2001
|
||||||
|
From: Phil Sutter <phil@nwl.cc>
|
||||||
|
Date: Wed, 29 Jul 2020 15:39:31 +0200
|
||||||
|
Subject: [PATCH] nft: cache: Check consistency with NFT_CL_FAKE, too
|
||||||
|
|
||||||
|
Athough this cache level fetches table names only, it shouldn't skip the
|
||||||
|
consistency check.
|
||||||
|
|
||||||
|
Fixes: f42bfb344af82 ("nft: cache: Re-establish cache consistency check")
|
||||||
|
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||||
|
(cherry picked from commit b531365ce32f386d91c6a0bbc80ec4076e4babdd)
|
||||||
|
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||||
|
---
|
||||||
|
iptables/nft-cache.c | 4 ++--
|
||||||
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
|
||||||
|
index 638b18bc7e382..434cc10b82ce7 100644
|
||||||
|
--- a/iptables/nft-cache.c
|
||||||
|
+++ b/iptables/nft-cache.c
|
||||||
|
@@ -511,14 +511,14 @@ retry:
|
||||||
|
if (req->level >= NFT_CL_TABLES)
|
||||||
|
fetch_table_cache(h);
|
||||||
|
if (req->level == NFT_CL_FAKE)
|
||||||
|
- return;
|
||||||
|
+ goto genid_check;
|
||||||
|
if (req->level >= NFT_CL_CHAINS)
|
||||||
|
fetch_chain_cache(h, t, chains);
|
||||||
|
if (req->level >= NFT_CL_SETS)
|
||||||
|
fetch_set_cache(h, t, NULL);
|
||||||
|
if (req->level >= NFT_CL_RULES)
|
||||||
|
fetch_rule_cache(h, t);
|
||||||
|
-
|
||||||
|
+genid_check:
|
||||||
|
mnl_genid_get(h, &genid_check);
|
||||||
|
if (h->nft_genid != genid_check) {
|
||||||
|
flush_cache(h, h->cache, NULL);
|
||||||
|
--
|
||||||
|
2.27.0
|
||||||
|
|
||||||
45
0004-nft-Fix-command-name-in-ip6tables-error-message.patch
Normal file
45
0004-nft-Fix-command-name-in-ip6tables-error-message.patch
Normal file
@ -0,0 +1,45 @@
|
|||||||
|
From dac3434e2e7ea297a3886c662d558305b460670b Mon Sep 17 00:00:00 2001
|
||||||
|
From: Phil Sutter <phil@nwl.cc>
|
||||||
|
Date: Fri, 7 Aug 2020 13:48:28 +0200
|
||||||
|
Subject: [PATCH] nft: Fix command name in ip6tables error message
|
||||||
|
|
||||||
|
Upon errors, ip6tables-nft would prefix its error messages with
|
||||||
|
'iptables:' instead of 'ip6tables:'. Turns out the command name was
|
||||||
|
hard-coded, use 'progname' variable instead.
|
||||||
|
While being at it, merge the two mostly identical fprintf() calls into
|
||||||
|
one.
|
||||||
|
|
||||||
|
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||||
|
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||||
|
(cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13)
|
||||||
|
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||||
|
---
|
||||||
|
iptables/xtables-standalone.c | 12 ++++--------
|
||||||
|
1 file changed, 4 insertions(+), 8 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c
|
||||||
|
index dd6fb7919d2e1..7b71db62f1ea6 100644
|
||||||
|
--- a/iptables/xtables-standalone.c
|
||||||
|
+++ b/iptables/xtables-standalone.c
|
||||||
|
@@ -75,14 +75,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
|
||||||
|
xtables_fini();
|
||||||
|
|
||||||
|
if (!ret) {
|
||||||
|
- if (errno == EINVAL) {
|
||||||
|
- fprintf(stderr, "iptables: %s. "
|
||||||
|
- "Run `dmesg' for more information.\n",
|
||||||
|
- nft_strerror(errno));
|
||||||
|
- } else {
|
||||||
|
- fprintf(stderr, "iptables: %s.\n",
|
||||||
|
- nft_strerror(errno));
|
||||||
|
- }
|
||||||
|
+ fprintf(stderr, "%s: %s.%s\n", progname, nft_strerror(errno),
|
||||||
|
+ (errno == EINVAL ?
|
||||||
|
+ " Run `dmesg' for more information." : ""));
|
||||||
|
+
|
||||||
|
if (errno == EAGAIN)
|
||||||
|
exit(RESOURCE_PROBLEM);
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.27.0
|
||||||
|
|
||||||
76
arptables-nft-helper
Normal file
76
arptables-nft-helper
Normal file
@ -0,0 +1,76 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
ARPTABLES_CONFIG=/etc/sysconfig/arptables
|
||||||
|
|
||||||
|
# compat for removed initscripts dependency
|
||||||
|
|
||||||
|
success() {
|
||||||
|
echo -n "[ OK ]"
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
failure() {
|
||||||
|
echo -n "[FAILED]"
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
|
||||||
|
start() {
|
||||||
|
if [ ! -x /usr/sbin/arptables ]; then
|
||||||
|
exit 4
|
||||||
|
fi
|
||||||
|
|
||||||
|
# don't do squat if we don't have the config file
|
||||||
|
if [ -f $ARPTABLES_CONFIG ]; then
|
||||||
|
echo -n $"Applying arptables firewall rules: "
|
||||||
|
/usr/sbin/arptables-restore < $ARPTABLES_CONFIG && \
|
||||||
|
success || \
|
||||||
|
failure
|
||||||
|
echo
|
||||||
|
touch /var/lock/subsys/arptables
|
||||||
|
else
|
||||||
|
failure
|
||||||
|
echo
|
||||||
|
echo $"Configuration file /etc/sysconfig/arptables missing"
|
||||||
|
exit 6
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
stop() {
|
||||||
|
echo -n $"Removing user defined chains:"
|
||||||
|
arptables -X && success || failure
|
||||||
|
echo -n $"Flushing all chains:"
|
||||||
|
arptables -F && success || failure
|
||||||
|
echo -n $"Resetting built-in chains to the default ACCEPT policy:"
|
||||||
|
arptables -P INPUT ACCEPT && \
|
||||||
|
arptables -P OUTPUT ACCEPT && \
|
||||||
|
success || \
|
||||||
|
failure
|
||||||
|
echo
|
||||||
|
rm -f /var/lock/subsys/arptables
|
||||||
|
}
|
||||||
|
|
||||||
|
case "$1" in
|
||||||
|
start)
|
||||||
|
start
|
||||||
|
;;
|
||||||
|
|
||||||
|
stop)
|
||||||
|
stop
|
||||||
|
;;
|
||||||
|
|
||||||
|
restart|reload)
|
||||||
|
# "restart" is really just "start" as this isn't a daemon,
|
||||||
|
# and "start" clears any pre-defined rules anyway.
|
||||||
|
# This is really only here to make those who expect it happy
|
||||||
|
start
|
||||||
|
;;
|
||||||
|
|
||||||
|
condrestart|try-restart|force-reload)
|
||||||
|
[ -e /var/lock/subsys/arptables ] && start
|
||||||
|
;;
|
||||||
|
|
||||||
|
*)
|
||||||
|
exit 2
|
||||||
|
esac
|
||||||
|
|
||||||
|
exit 0
|
||||||
59
iptables-config
Normal file
59
iptables-config
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
# Load additional iptables modules (nat helpers)
|
||||||
|
# Default: -none-
|
||||||
|
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
|
||||||
|
# are loaded after the firewall rules are applied. Options for the helpers are
|
||||||
|
# stored in /etc/modprobe.conf.
|
||||||
|
IPTABLES_MODULES=""
|
||||||
|
|
||||||
|
# Save current firewall rules on stop.
|
||||||
|
# Value: yes|no, default: no
|
||||||
|
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped
|
||||||
|
# (e.g. on system shutdown).
|
||||||
|
IPTABLES_SAVE_ON_STOP="no"
|
||||||
|
|
||||||
|
# Save current firewall rules on restart.
|
||||||
|
# Value: yes|no, default: no
|
||||||
|
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets
|
||||||
|
# restarted.
|
||||||
|
IPTABLES_SAVE_ON_RESTART="no"
|
||||||
|
|
||||||
|
# Save (and restore) rule and chain counter.
|
||||||
|
# Value: yes|no, default: no
|
||||||
|
# Save counters for rules and chains to /etc/sysconfig/iptables if
|
||||||
|
# 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or
|
||||||
|
# SAVE_ON_RESTART is enabled.
|
||||||
|
IPTABLES_SAVE_COUNTER="no"
|
||||||
|
|
||||||
|
# Numeric status output
|
||||||
|
# Value: yes|no, default: yes
|
||||||
|
# Print IP addresses and port numbers in numeric format in the status output.
|
||||||
|
IPTABLES_STATUS_NUMERIC="yes"
|
||||||
|
|
||||||
|
# Verbose status output
|
||||||
|
# Value: yes|no, default: yes
|
||||||
|
# Print info about the number of packets and bytes plus the "input-" and
|
||||||
|
# "outputdevice" in the status output.
|
||||||
|
IPTABLES_STATUS_VERBOSE="no"
|
||||||
|
|
||||||
|
# Status output with numbered lines
|
||||||
|
# Value: yes|no, default: yes
|
||||||
|
# Print a counter/number for every rule in the status output.
|
||||||
|
IPTABLES_STATUS_LINENUMBERS="yes"
|
||||||
|
|
||||||
|
# Reload sysctl settings on start and restart
|
||||||
|
# Default: -none-
|
||||||
|
# Space separated list of sysctl items which are to be reloaded on start.
|
||||||
|
# List items will be matched by fgrep.
|
||||||
|
#IPTABLES_SYSCTL_LOAD_LIST=".nf_conntrack .bridge-nf"
|
||||||
|
|
||||||
|
# Set wait option for iptables-restore calls in seconds
|
||||||
|
# Default: 600
|
||||||
|
# Set to 0 to deactivate the wait.
|
||||||
|
#IPTABLES_RESTORE_WAIT=600
|
||||||
|
|
||||||
|
# Set wait interval option for iptables-restore calls in microseconds
|
||||||
|
# Default: 1000000
|
||||||
|
# Set to 100000 to try to get the lock every 100000 microseconds, 10 times a
|
||||||
|
# second.
|
||||||
|
# Only usable with IPTABLES_RESTORE_WAIT > 0
|
||||||
|
#IPTABLES_RESTORE_WAIT_INTERVAL=1000000
|
||||||
435
iptables.init
Executable file
435
iptables.init
Executable file
@ -0,0 +1,435 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# iptables Start iptables firewall
|
||||||
|
#
|
||||||
|
# chkconfig: 2345 08 92
|
||||||
|
# description: Starts, stops and saves iptables firewall
|
||||||
|
#
|
||||||
|
# config: /etc/sysconfig/iptables
|
||||||
|
# config: /etc/sysconfig/iptables-config
|
||||||
|
#
|
||||||
|
### BEGIN INIT INFO
|
||||||
|
# Provides: iptables
|
||||||
|
# Required-Start:
|
||||||
|
# Required-Stop:
|
||||||
|
# Default-Start: 2 3 4 5
|
||||||
|
# Default-Stop: 0 1 6
|
||||||
|
# Short-Description: start and stop iptables firewall
|
||||||
|
# Description: Start, stop and save iptables firewall
|
||||||
|
### END INIT INFO
|
||||||
|
|
||||||
|
# compat for removed initscripts dependency
|
||||||
|
|
||||||
|
success() {
|
||||||
|
echo -n "[ OK ]"
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
warning() {
|
||||||
|
echo -n "[WARNING]"
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
|
||||||
|
failure() {
|
||||||
|
echo -n "[FAILED]"
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
|
||||||
|
IPTABLES=iptables
|
||||||
|
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
|
||||||
|
IPTABLES_FALLBACK_DATA=${IPTABLES_DATA}.fallback
|
||||||
|
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
|
||||||
|
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
|
||||||
|
[ "$IPV" = "ip" ] && _IPV="ipv4" || _IPV="ipv6"
|
||||||
|
PROC_IPTABLES_NAMES=/proc/net/${IPV}_tables_names
|
||||||
|
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES
|
||||||
|
|
||||||
|
# only usable for root
|
||||||
|
if [ $EUID != 0 ]; then
|
||||||
|
echo -n $"${IPTABLES}: Only usable by root."; warning; echo
|
||||||
|
exit 4
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ ! -x /sbin/$IPTABLES ]; then
|
||||||
|
echo -n $"${IPTABLES}: /sbin/$IPTABLES does not exist."; warning; echo
|
||||||
|
exit 5
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Old or new modutils
|
||||||
|
/sbin/modprobe --version 2>&1 | grep -q 'kmod version' \
|
||||||
|
&& NEW_MODUTILS=1 \
|
||||||
|
|| NEW_MODUTILS=0
|
||||||
|
|
||||||
|
# Default firewall configuration:
|
||||||
|
IPTABLES_MODULES=""
|
||||||
|
IPTABLES_SAVE_ON_STOP="no"
|
||||||
|
IPTABLES_SAVE_ON_RESTART="no"
|
||||||
|
IPTABLES_SAVE_COUNTER="no"
|
||||||
|
IPTABLES_STATUS_NUMERIC="yes"
|
||||||
|
IPTABLES_STATUS_VERBOSE="no"
|
||||||
|
IPTABLES_STATUS_LINENUMBERS="yes"
|
||||||
|
IPTABLES_SYSCTL_LOAD_LIST=""
|
||||||
|
IPTABLES_RESTORE_WAIT=600
|
||||||
|
IPTABLES_RESTORE_WAIT_INTERVAL=1000000
|
||||||
|
|
||||||
|
# Load firewall configuration.
|
||||||
|
[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
|
||||||
|
|
||||||
|
# Get active tables
|
||||||
|
NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
|
||||||
|
|
||||||
|
|
||||||
|
flush_n_delete() {
|
||||||
|
# Flush firewall rules and delete chains.
|
||||||
|
[ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
|
||||||
|
|
||||||
|
# Check if firewall is configured (has tables)
|
||||||
|
[ -z "$NF_TABLES" ] && return 1
|
||||||
|
|
||||||
|
echo -n $"${IPTABLES}: Flushing firewall rules: "
|
||||||
|
ret=0
|
||||||
|
# For all tables
|
||||||
|
for i in $NF_TABLES; do
|
||||||
|
# Flush firewall rules.
|
||||||
|
$IPTABLES -t $i -F;
|
||||||
|
let ret+=$?;
|
||||||
|
|
||||||
|
# Delete firewall chains.
|
||||||
|
$IPTABLES -t $i -X;
|
||||||
|
let ret+=$?;
|
||||||
|
|
||||||
|
# Set counter to zero.
|
||||||
|
$IPTABLES -t $i -Z;
|
||||||
|
let ret+=$?;
|
||||||
|
done
|
||||||
|
|
||||||
|
[ $ret -eq 0 ] && success || failure
|
||||||
|
echo
|
||||||
|
return $ret
|
||||||
|
}
|
||||||
|
|
||||||
|
set_policy() {
|
||||||
|
# Set policy for configured tables.
|
||||||
|
policy=$1
|
||||||
|
|
||||||
|
# Check if iptable module is loaded
|
||||||
|
[ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
|
||||||
|
|
||||||
|
# Check if firewall is configured (has tables)
|
||||||
|
tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
|
||||||
|
[ -z "$tables" ] && return 1
|
||||||
|
|
||||||
|
echo -n $"${IPTABLES}: Setting chains to policy $policy: "
|
||||||
|
ret=0
|
||||||
|
for i in $tables; do
|
||||||
|
echo -n "$i "
|
||||||
|
case "$i" in
|
||||||
|
raw)
|
||||||
|
$IPTABLES -t raw -P PREROUTING $policy \
|
||||||
|
&& $IPTABLES -t raw -P OUTPUT $policy \
|
||||||
|
|| let ret+=1
|
||||||
|
;;
|
||||||
|
filter)
|
||||||
|
$IPTABLES -t filter -P INPUT $policy \
|
||||||
|
&& $IPTABLES -t filter -P OUTPUT $policy \
|
||||||
|
&& $IPTABLES -t filter -P FORWARD $policy \
|
||||||
|
|| let ret+=1
|
||||||
|
;;
|
||||||
|
nat)
|
||||||
|
$IPTABLES -t nat -P PREROUTING $policy \
|
||||||
|
&& $IPTABLES -t nat -P POSTROUTING $policy \
|
||||||
|
&& $IPTABLES -t nat -P OUTPUT $policy \
|
||||||
|
|| let ret+=1
|
||||||
|
;;
|
||||||
|
mangle)
|
||||||
|
$IPTABLES -t mangle -P PREROUTING $policy \
|
||||||
|
&& $IPTABLES -t mangle -P POSTROUTING $policy \
|
||||||
|
&& $IPTABLES -t mangle -P INPUT $policy \
|
||||||
|
&& $IPTABLES -t mangle -P OUTPUT $policy \
|
||||||
|
&& $IPTABLES -t mangle -P FORWARD $policy \
|
||||||
|
|| let ret+=1
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
let ret+=1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
[ $ret -eq 0 ] && success || failure
|
||||||
|
echo
|
||||||
|
return $ret
|
||||||
|
}
|
||||||
|
|
||||||
|
load_sysctl() {
|
||||||
|
# load matched sysctl values
|
||||||
|
if [ -n "$IPTABLES_SYSCTL_LOAD_LIST" ]; then
|
||||||
|
echo -n $"Loading sysctl settings: "
|
||||||
|
ret=0
|
||||||
|
for item in $IPTABLES_SYSCTL_LOAD_LIST; do
|
||||||
|
fgrep -hs $item /etc/sysctl.d/* | sysctl -p - >/dev/null
|
||||||
|
let ret+=$?;
|
||||||
|
done
|
||||||
|
[ $ret -eq 0 ] && success || failure
|
||||||
|
echo
|
||||||
|
fi
|
||||||
|
return $ret
|
||||||
|
}
|
||||||
|
|
||||||
|
start() {
|
||||||
|
# Do not start if there is no config file.
|
||||||
|
if [ ! -f "$IPTABLES_DATA" ]; then
|
||||||
|
echo -n $"${IPTABLES}: No config file."; warning; echo
|
||||||
|
return 6
|
||||||
|
fi
|
||||||
|
|
||||||
|
# check if ipv6 module load is deactivated
|
||||||
|
if [ "${_IPV}" = "ipv6" ] \
|
||||||
|
&& grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
|
||||||
|
echo $"${IPTABLES}: ${_IPV} is disabled."
|
||||||
|
return 150
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -n $"${IPTABLES}: Applying firewall rules: "
|
||||||
|
|
||||||
|
OPT=
|
||||||
|
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
|
||||||
|
if [ $IPTABLES_RESTORE_WAIT -ne 0 ]; then
|
||||||
|
OPT="${OPT} --wait ${IPTABLES_RESTORE_WAIT}"
|
||||||
|
if [ $IPTABLES_RESTORE_WAIT_INTERVAL -lt 1000000 ]; then
|
||||||
|
OPT="${OPT} --wait-interval ${IPTABLES_RESTORE_WAIT_INTERVAL}"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
$IPTABLES-restore $OPT $IPTABLES_DATA
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
success; echo
|
||||||
|
else
|
||||||
|
failure; echo;
|
||||||
|
if [ -f "$IPTABLES_FALLBACK_DATA" ]; then
|
||||||
|
echo -n $"${IPTABLES}: Applying firewall fallback rules: "
|
||||||
|
$IPTABLES-restore $OPT $IPTABLES_FALLBACK_DATA
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
success; echo
|
||||||
|
else
|
||||||
|
failure; echo; return 1
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Load additional modules (helpers)
|
||||||
|
if [ -n "$IPTABLES_MODULES" ]; then
|
||||||
|
echo -n $"${IPTABLES}: Loading additional modules: "
|
||||||
|
ret=0
|
||||||
|
for mod in $IPTABLES_MODULES; do
|
||||||
|
echo -n "$mod "
|
||||||
|
modprobe $mod > /dev/null 2>&1
|
||||||
|
let ret+=$?;
|
||||||
|
done
|
||||||
|
[ $ret -eq 0 ] && success || failure
|
||||||
|
echo
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Load sysctl settings
|
||||||
|
load_sysctl
|
||||||
|
|
||||||
|
touch $VAR_SUBSYS_IPTABLES
|
||||||
|
return $ret
|
||||||
|
}
|
||||||
|
|
||||||
|
stop() {
|
||||||
|
# Do not stop if iptables module is not loaded.
|
||||||
|
[ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
|
||||||
|
|
||||||
|
# Set default chain policy to ACCEPT, in order to not break shutdown
|
||||||
|
# on systems where the default policy is DROP and root device is
|
||||||
|
# network-based (i.e.: iSCSI, NFS)
|
||||||
|
set_policy ACCEPT
|
||||||
|
# And then, flush the rules and delete chains
|
||||||
|
flush_n_delete
|
||||||
|
|
||||||
|
rm -f $VAR_SUBSYS_IPTABLES
|
||||||
|
return $ret
|
||||||
|
}
|
||||||
|
|
||||||
|
save() {
|
||||||
|
# Check if iptable module is loaded
|
||||||
|
if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
|
||||||
|
echo -n $"${IPTABLES}: Nothing to save."; warning; echo
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check if firewall is configured (has tables)
|
||||||
|
if [ -z "$NF_TABLES" ]; then
|
||||||
|
echo -n $"${IPTABLES}: Nothing to save."; warning; echo
|
||||||
|
return 6
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -n $"${IPTABLES}: Saving firewall rules to $IPTABLES_DATA: "
|
||||||
|
|
||||||
|
OPT=
|
||||||
|
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
|
||||||
|
|
||||||
|
ret=0
|
||||||
|
TMP_FILE=$(/bin/mktemp -q $IPTABLES_DATA.XXXXXX) \
|
||||||
|
&& chmod 600 "$TMP_FILE" \
|
||||||
|
&& $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
|
||||||
|
&& size=$(stat -c '%s' $TMP_FILE) && [ $size -gt 0 ] \
|
||||||
|
|| ret=1
|
||||||
|
if [ $ret -eq 0 ]; then
|
||||||
|
if [ -e $IPTABLES_DATA ]; then
|
||||||
|
cp -f $IPTABLES_DATA $IPTABLES_DATA.save \
|
||||||
|
&& chmod 600 $IPTABLES_DATA.save \
|
||||||
|
&& restorecon $IPTABLES_DATA.save \
|
||||||
|
|| ret=1
|
||||||
|
fi
|
||||||
|
if [ $ret -eq 0 ]; then
|
||||||
|
mv -f $TMP_FILE $IPTABLES_DATA \
|
||||||
|
&& chmod 600 $IPTABLES_DATA \
|
||||||
|
&& restorecon $IPTABLES_DATA \
|
||||||
|
|| ret=1
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
rm -f $TMP_FILE
|
||||||
|
[ $ret -eq 0 ] && success || failure
|
||||||
|
echo
|
||||||
|
return $ret
|
||||||
|
}
|
||||||
|
|
||||||
|
status() {
|
||||||
|
if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then
|
||||||
|
echo $"${IPTABLES}: Firewall is not running."
|
||||||
|
return 3
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Do not print status if lockfile is missing and iptables modules are not
|
||||||
|
# loaded.
|
||||||
|
# Check if iptable modules are loaded
|
||||||
|
if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
|
||||||
|
echo $"${IPTABLES}: Firewall modules are not loaded."
|
||||||
|
return 3
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check if firewall is configured (has tables)
|
||||||
|
if [ -z "$NF_TABLES" ]; then
|
||||||
|
echo $"${IPTABLES}: Firewall is not configured. "
|
||||||
|
return 3
|
||||||
|
fi
|
||||||
|
|
||||||
|
NUM=
|
||||||
|
[ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
|
||||||
|
VERBOSE=
|
||||||
|
[ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
|
||||||
|
COUNT=
|
||||||
|
[ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"
|
||||||
|
|
||||||
|
for table in $NF_TABLES; do
|
||||||
|
echo $"Table: $table"
|
||||||
|
$IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo
|
||||||
|
done
|
||||||
|
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
reload() {
|
||||||
|
# Do not reload if there is no config file.
|
||||||
|
if [ ! -f "$IPTABLES_DATA" ]; then
|
||||||
|
echo -n $"${IPTABLES}: No config file."; warning; echo
|
||||||
|
return 6
|
||||||
|
fi
|
||||||
|
|
||||||
|
# check if ipv6 module load is deactivated
|
||||||
|
if [ "${_IPV}" = "ipv6" ] \
|
||||||
|
&& grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
|
||||||
|
echo $"${IPTABLES}: ${_IPV} is disabled."
|
||||||
|
return 150
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo -n $"${IPTABLES}: Trying to reload firewall rules: "
|
||||||
|
|
||||||
|
OPT=
|
||||||
|
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
|
||||||
|
if [ $IPTABLES_RESTORE_WAIT -ne 0 ]; then
|
||||||
|
OPT="${OPT} --wait ${IPTABLES_RESTORE_WAIT}"
|
||||||
|
if [ $IPTABLES_RESTORE_WAIT_INTERVAL -lt 1000000 ]; then
|
||||||
|
OPT="${OPT} --wait-interval ${IPTABLES_RESTORE_WAIT_INTERVAL}"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
$IPTABLES-restore $OPT $IPTABLES_DATA
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
success; echo
|
||||||
|
else
|
||||||
|
failure; echo; echo "Firewall rules are not changed."; return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Load additional modules (helpers)
|
||||||
|
if [ -n "$IPTABLES_MODULES" ]; then
|
||||||
|
echo -n $"${IPTABLES}: Loading additional modules: "
|
||||||
|
ret=0
|
||||||
|
for mod in $IPTABLES_MODULES; do
|
||||||
|
echo -n "$mod "
|
||||||
|
modprobe $mod > /dev/null 2>&1
|
||||||
|
let ret+=$?;
|
||||||
|
done
|
||||||
|
[ $ret -eq 0 ] && success || failure
|
||||||
|
echo
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Load sysctl settings
|
||||||
|
load_sysctl
|
||||||
|
|
||||||
|
return $ret
|
||||||
|
}
|
||||||
|
|
||||||
|
restart() {
|
||||||
|
[ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
|
||||||
|
stop
|
||||||
|
start
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
case "$1" in
|
||||||
|
start)
|
||||||
|
[ -f "$VAR_SUBSYS_IPTABLES" ] && exit 0
|
||||||
|
start
|
||||||
|
RETVAL=$?
|
||||||
|
;;
|
||||||
|
stop)
|
||||||
|
[ "x$IPTABLES_SAVE_ON_STOP" = "xyes" ] && save
|
||||||
|
stop
|
||||||
|
RETVAL=$?
|
||||||
|
;;
|
||||||
|
restart|force-reload)
|
||||||
|
restart
|
||||||
|
RETVAL=$?
|
||||||
|
;;
|
||||||
|
reload)
|
||||||
|
[ -e "$VAR_SUBSYS_IPTABLES" ] && reload
|
||||||
|
RETVAL=$?
|
||||||
|
;;
|
||||||
|
condrestart|try-restart)
|
||||||
|
[ ! -e "$VAR_SUBSYS_IPTABLES" ] && exit 0
|
||||||
|
restart
|
||||||
|
RETVAL=$?
|
||||||
|
;;
|
||||||
|
status)
|
||||||
|
status
|
||||||
|
RETVAL=$?
|
||||||
|
;;
|
||||||
|
panic)
|
||||||
|
set_policy DROP
|
||||||
|
RETVAL=$?
|
||||||
|
;;
|
||||||
|
save)
|
||||||
|
save
|
||||||
|
RETVAL=$?
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo $"Usage: ${IPTABLES} {start|stop|reload|restart|condrestart|status|panic|save}"
|
||||||
|
RETVAL=2
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
exit $RETVAL
|
||||||
18
iptables.service
Normal file
18
iptables.service
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=IPv4 firewall with iptables
|
||||||
|
After=syslog.target
|
||||||
|
AssertPathExists=/etc/sysconfig/iptables
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
RemainAfterExit=yes
|
||||||
|
ExecStart=/usr/libexec/iptables/iptables.init start
|
||||||
|
ExecReload=/usr/libexec/iptables/iptables.init reload
|
||||||
|
ExecStop=/usr/libexec/iptables/iptables.init stop
|
||||||
|
Environment=BOOTUP=serial
|
||||||
|
Environment=CONSOLETYPE=serial
|
||||||
|
StandardOutput=syslog
|
||||||
|
StandardError=syslog
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=basic.target
|
||||||
1574
iptables.spec
Normal file
1574
iptables.spec
Normal file
File diff suppressed because it is too large
Load Diff
1
sources
Normal file
1
sources
Normal file
@ -0,0 +1 @@
|
|||||||
|
SHA512 (iptables-1.8.5.tar.bz2) = 6a6baa541bb7aa331b176e0a91894e0766859814b59e77c71351ac34d6ebd337487981db48c70e476a48c67bcf891cfc663221a7582feb1496ad1df56eb28da8
|
||||||
15
sysconfig_ip6tables
Normal file
15
sysconfig_ip6tables
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
# sample configuration for ip6tables service
|
||||||
|
# you can edit this manually or use system-config-firewall
|
||||||
|
# please do not ask us to add additional ports/services to this default configuration
|
||||||
|
*filter
|
||||||
|
:INPUT ACCEPT [0:0]
|
||||||
|
:FORWARD ACCEPT [0:0]
|
||||||
|
:OUTPUT ACCEPT [0:0]
|
||||||
|
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||||
|
-A INPUT -p ipv6-icmp -j ACCEPT
|
||||||
|
-A INPUT -i lo -j ACCEPT
|
||||||
|
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
|
||||||
|
-A INPUT -d fe80::/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT
|
||||||
|
-A INPUT -j REJECT --reject-with icmp6-adm-prohibited
|
||||||
|
-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited
|
||||||
|
COMMIT
|
||||||
14
sysconfig_iptables
Normal file
14
sysconfig_iptables
Normal file
@ -0,0 +1,14 @@
|
|||||||
|
# sample configuration for iptables service
|
||||||
|
# you can edit this manually or use system-config-firewall
|
||||||
|
# please do not ask us to add additional ports/services to this default configuration
|
||||||
|
*filter
|
||||||
|
:INPUT ACCEPT [0:0]
|
||||||
|
:FORWARD ACCEPT [0:0]
|
||||||
|
:OUTPUT ACCEPT [0:0]
|
||||||
|
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||||
|
-A INPUT -p icmp -j ACCEPT
|
||||||
|
-A INPUT -i lo -j ACCEPT
|
||||||
|
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
|
||||||
|
-A INPUT -j REJECT --reject-with icmp-host-prohibited
|
||||||
|
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
|
||||||
|
COMMIT
|
||||||
63
tests/NFQUEUE-queue-bypass/Makefile
Normal file
63
tests/NFQUEUE-queue-bypass/Makefile
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Makefile of /CoreOS/iptables/Sanity/NFQUEUE-queue-bypass
|
||||||
|
# Description: Test for "--queue-bypass" backport
|
||||||
|
# Author: Ales Zelinka <azelinka@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2013 Red Hat, Inc. All rights reserved.
|
||||||
|
#
|
||||||
|
# This copyrighted material is made available to anyone wishing
|
||||||
|
# to use, modify, copy, or redistribute it subject to the terms
|
||||||
|
# and conditions of the GNU General Public License version 2.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public
|
||||||
|
# License along with this program; if not, write to the Free
|
||||||
|
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||||
|
# Boston, MA 02110-1301, USA.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
export TEST=/CoreOS/iptables/Sanity/NFQUEUE-queue-bypass
|
||||||
|
export TESTVERSION=1.0
|
||||||
|
|
||||||
|
BUILT_FILES=
|
||||||
|
|
||||||
|
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||||
|
|
||||||
|
.PHONY: all install download clean
|
||||||
|
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
test -x runtest.sh || chmod a+x runtest.sh
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *~ $(BUILT_FILES)
|
||||||
|
|
||||||
|
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@echo "Owner: Ales Zelinka <azelinka@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "Description: Test for \"--queue-bypass\" backport" >> $(METADATA)
|
||||||
|
@echo "Type: Sanity" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: iptables" >> $(METADATA)
|
||||||
|
@echo "Requires: iptables" >> $(METADATA)
|
||||||
|
@echo "Priority: Normal" >> $(METADATA)
|
||||||
|
@echo "License: GPLv2" >> $(METADATA)
|
||||||
|
@echo "Confidential: no" >> $(METADATA)
|
||||||
|
@echo "Destructive: no" >> $(METADATA)
|
||||||
|
|
||||||
|
rhts-lint $(METADATA)
|
||||||
4
tests/NFQUEUE-queue-bypass/PURPOSE
Normal file
4
tests/NFQUEUE-queue-bypass/PURPOSE
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
PURPOSE of /CoreOS/iptables/Sanity/NFQUEUE-queue-bypass
|
||||||
|
Description: Test for "--queue-bypass" backport
|
||||||
|
Author: Ales Zelinka <azelinka@redhat.com>
|
||||||
|
Bug summary: "--queue-bypass" backport
|
||||||
54
tests/NFQUEUE-queue-bypass/runtest.sh
Executable file
54
tests/NFQUEUE-queue-bypass/runtest.sh
Executable file
@ -0,0 +1,54 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# runtest.sh of /CoreOS/iptables/Sanity/NFQUEUE-queue-bypass
|
||||||
|
# Description: Test for "--queue-bypass" backport
|
||||||
|
# Author: Ales Zelinka <azelinka@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2013 Red Hat, Inc. All rights reserved.
|
||||||
|
#
|
||||||
|
# This copyrighted material is made available to anyone wishing
|
||||||
|
# to use, modify, copy, or redistribute it subject to the terms
|
||||||
|
# and conditions of the GNU General Public License version 2.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public
|
||||||
|
# License along with this program; if not, write to the Free
|
||||||
|
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||||
|
# Boston, MA 02110-1301, USA.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="iptables"
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
|
||||||
|
rlPhaseStartTest control-ping
|
||||||
|
rlRun "ping -w 2 -c 2 127.0.0.1"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest NFQUEUE-no-listener
|
||||||
|
rlRun "iptables -I INPUT -p icmp -j NFQUEUE" 0 "queue all icmp for userspace processing"
|
||||||
|
rlRun "ping -w 2 -c 2 127.0.0.1" 1-255 "ping 127.0.0.1 - none is listening on queue so packets will be dropped"
|
||||||
|
rlRun "iptables -D INPUT -p icmp -j NFQUEUE" 0 "removing the queue rule"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest NFQUEUE-no-listener-bypass
|
||||||
|
rlRun "iptables -I INPUT -p icmp -j NFQUEUE --queue-bypass" 0 "queue all icmp for userspace processing, bypass if no one is listening"
|
||||||
|
rlRun "ping -w 2 -c 2 127.0.0.1" 0 "ping 127.0.0.1 - none is listening on queue - bypass will make packets go through"
|
||||||
|
rlRun "iptables -D INPUT -p icmp -j NFQUEUE --queue-bypass" 0 "removing the queue rule"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
63
tests/RFE-Enable-the-missing-IPv6-SET-target/Makefile
Normal file
63
tests/RFE-Enable-the-missing-IPv6-SET-target/Makefile
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Makefile of /CoreOS/iptables/Regression/RFE-Enable-the-missing-IPv6-SET-target
|
||||||
|
# Description: Test for [RFE] Enable the missing IPv6 "SET" target
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2015 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
export TEST=/CoreOS/iptables/Regression/RFE-Enable-the-missing-IPv6-SET-target
|
||||||
|
export TESTVERSION=1.0
|
||||||
|
|
||||||
|
BUILT_FILES=
|
||||||
|
|
||||||
|
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||||
|
|
||||||
|
.PHONY: all install download clean
|
||||||
|
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
test -x runtest.sh || chmod a+x runtest.sh
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *~ $(BUILT_FILES)
|
||||||
|
|
||||||
|
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "Description: Test for [RFE] Enable the missing IPv6 \"SET\" target" >> $(METADATA)
|
||||||
|
@echo "Type: Regression" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: iptables" >> $(METADATA)
|
||||||
|
@echo "Requires: iptables ipset" >> $(METADATA)
|
||||||
|
@echo "Priority: Normal" >> $(METADATA)
|
||||||
|
@echo "License: GPLv2+" >> $(METADATA)
|
||||||
|
@echo "Confidential: no" >> $(METADATA)
|
||||||
|
@echo "Destructive: no" >> $(METADATA)
|
||||||
|
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||||
|
|
||||||
|
rhts-lint $(METADATA)
|
||||||
4
tests/RFE-Enable-the-missing-IPv6-SET-target/PURPOSE
Normal file
4
tests/RFE-Enable-the-missing-IPv6-SET-target/PURPOSE
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
PURPOSE of /CoreOS/iptables/Regression/RFE-Enable-the-missing-IPv6-SET-target
|
||||||
|
Description: Test for [RFE] Enable the missing IPv6 "SET" target
|
||||||
|
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
Bug summary: [RFE] Enable the missing IPv6 "SET" target userland ip6tables support to enable ipset to be usable with IPv6
|
||||||
65
tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh
Executable file
65
tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh
Executable file
@ -0,0 +1,65 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# runtest.sh of /CoreOS/iptables/Regression/RFE-Enable-the-missing-IPv6-SET-target
|
||||||
|
# Description: Test for [RFE] Enable the missing IPv6 "SET" target
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2015 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="iptables"
|
||||||
|
IPSET=testset6
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartSetup
|
||||||
|
rlAssertRpm $PACKAGE
|
||||||
|
# rlAssertRpm kernel
|
||||||
|
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||||
|
rlRun "pushd $TmpDir"
|
||||||
|
rlRun "ipset create $IPSET hash:ip family inet6"
|
||||||
|
rlRun "ipset add testset6 1234::3456"
|
||||||
|
rlRun "ip6tables-save -t filter > ipt6.save"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest
|
||||||
|
RULE1="INPUT -p tcp -m multiport --dports 21,22,23,25,53,81,123,143 -m conntrack --ctstate NEW --syn -m set ! --match-set $IPSET src -j LOG --log-prefix 'LOG:IPSET added to $IPSET'"
|
||||||
|
RULE2="INPUT -p tcp -m multiport --dports 21,22,23,25,53,81,123,143 -m conntrack --ctstate NEW --syn -m set ! --match-set $IPSET src -j SET --add-set $IPSET src"
|
||||||
|
for op in -A -C -D; do #add, check, delete
|
||||||
|
rlRun "ip6tables $op $RULE1" 0 "do $op logrule"
|
||||||
|
rlRun "ip6tables $op $RULE2" 0 "do $op -j SET rule"
|
||||||
|
done
|
||||||
|
rlRun "ip6tables-save -t filter > ipt6.save2"
|
||||||
|
rlRun "sed -e '/^#/d' -e 's/\[.*:.*\]$//' -i ipt6*" 0 "magically unify savefiles"
|
||||||
|
rlAssertNotDiffer ipt6.save ipt6.save2
|
||||||
|
diff -u ipt6.save ipt6.save2
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartCleanup
|
||||||
|
rlRun "ipset destroy $IPSET"
|
||||||
|
rlRun "popd"
|
||||||
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
@ -0,0 +1,63 @@
|
|||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Makefile of /CoreOS/iptables/Regression/RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||||
|
# Description: Test for RFE iptables add -C option to iptables in RHEL6 to
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2015 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
export TEST=/CoreOS/iptables/Regression/RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||||
|
export TESTVERSION=1.0
|
||||||
|
|
||||||
|
BUILT_FILES=
|
||||||
|
|
||||||
|
FILES=$(METADATA) runtest.sh Makefile PURPOSE rules.in
|
||||||
|
|
||||||
|
.PHONY: all install download clean
|
||||||
|
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
test -x runtest.sh || chmod a+x runtest.sh
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *~ $(BUILT_FILES)
|
||||||
|
|
||||||
|
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "Description: Test for RFE iptables add -C option to iptables in RHEL6 to" >> $(METADATA)
|
||||||
|
@echo "Type: Regression" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: iptables" >> $(METADATA)
|
||||||
|
@echo "Requires: iptables" >> $(METADATA)
|
||||||
|
@echo "Priority: Normal" >> $(METADATA)
|
||||||
|
@echo "License: GPLv2+" >> $(METADATA)
|
||||||
|
@echo "Confidential: no" >> $(METADATA)
|
||||||
|
@echo "Destructive: no" >> $(METADATA)
|
||||||
|
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||||
|
|
||||||
|
rhts-lint $(METADATA)
|
||||||
@ -0,0 +1,4 @@
|
|||||||
|
PURPOSE of /CoreOS/iptables/Regression/RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||||
|
Description: Test for RFE iptables add -C option to iptables in RHEL6 to
|
||||||
|
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
Bug summary: RFE: iptables: add -C option to iptables in RHEL6 to check for existing rules
|
||||||
@ -0,0 +1,50 @@
|
|||||||
|
# vim: ft=sh
|
||||||
|
rules4=(
|
||||||
|
"-t nat -A POSTROUTING -o tun+ -j MASQUERADE"
|
||||||
|
"-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT"
|
||||||
|
"-A INPUT -p icmp -m icmp --icmp-type source-quench -j REJECT --reject-with icmp-host-prohibited"
|
||||||
|
"-A INPUT -p icmp -j ACCEPT"
|
||||||
|
"-A INPUT -i lo -j ACCEPT"
|
||||||
|
"-A INPUT -i ippp+ -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m udp -p udp --dport 631 -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m tcp -p tcp --dport 631 -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m udp -p udp --dport 631 -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m udp -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT"
|
||||||
|
"-A INPUT -p ah -j ACCEPT"
|
||||||
|
"-A INPUT -p esp -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT"
|
||||||
|
"-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT"
|
||||||
|
"-A FORWARD -p icmp -m icmp --icmp-type source-quench -j REJECT --reject-with icmp-host-prohibited"
|
||||||
|
"-A FORWARD -p icmp -j ACCEPT"
|
||||||
|
"-A FORWARD -i lo -j ACCEPT"
|
||||||
|
"-A FORWARD -i ippp+ -j ACCEPT"
|
||||||
|
"-A FORWARD -o tun+ -j ACCEPT"
|
||||||
|
"-A INPUT -j REJECT --reject-with icmp-host-prohibited"
|
||||||
|
"-A FORWARD -j REJECT --reject-with icmp-host-prohibited"
|
||||||
|
)
|
||||||
|
|
||||||
|
rules6=(
|
||||||
|
"-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT"
|
||||||
|
"-A INPUT -p ipv6-icmp -j ACCEPT"
|
||||||
|
"-A INPUT -i lo -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m udp -p udp --dport 546 -d fe80::/64 -j ACCEPT"
|
||||||
|
"-A INPUT -i ippp+ -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m udp -p udp --dport 631 -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m tcp -p tcp --dport 631 -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m udp -p udp --dport 631 -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m udp -p udp --dport 5353 -d ff02::fb -j ACCEPT"
|
||||||
|
"-A INPUT -m ipv6header --header ah -j ACCEPT"
|
||||||
|
"-A INPUT -m ipv6header --header esp -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT"
|
||||||
|
"-A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT"
|
||||||
|
"-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT"
|
||||||
|
"-A FORWARD -p ipv6-icmp -j ACCEPT"
|
||||||
|
"-A FORWARD -i lo -j ACCEPT"
|
||||||
|
"-A FORWARD -i ippp+ -j ACCEPT"
|
||||||
|
"-A INPUT -j REJECT --reject-with icmp6-adm-prohibited"
|
||||||
|
"-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited"
|
||||||
|
)
|
||||||
73
tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh
Executable file
73
tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh
Executable file
@ -0,0 +1,73 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# runtest.sh of /CoreOS/iptables/Regression/RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||||
|
# Description: Test for RFE iptables add -C option to iptables in RHEL6 to
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2015 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="iptables"
|
||||||
|
TESTD=$PWD
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartSetup
|
||||||
|
rlAssertRpm $PACKAGE
|
||||||
|
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||||
|
rlRun "pushd $TmpDir"
|
||||||
|
rlRun "source $TESTD/rules.in" 0 "read ruleset"
|
||||||
|
rlRun "iptables -F"
|
||||||
|
rlRun "ip6tables -F"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest
|
||||||
|
declare -i sane=0
|
||||||
|
for i in ${!rules4[*]}; do
|
||||||
|
let sane++
|
||||||
|
rlRun "iptables ${rules4[$i]}"
|
||||||
|
testrule="${rules4[$i]/-A/-C}"
|
||||||
|
rlRun "iptables $testrule"
|
||||||
|
done
|
||||||
|
for i in ${!rules6[*]}; do
|
||||||
|
let sane++
|
||||||
|
rlRun "ip6tables ${rules6[$i]}"
|
||||||
|
testrule="${rules6[$i]/-A/-C}"
|
||||||
|
rlRun "ip6tables $testrule"
|
||||||
|
done
|
||||||
|
#check itercount
|
||||||
|
if [[ $sane -lt 40 ]]; then
|
||||||
|
rlFail "test insane, do inspect" # rules were not properly loaded!
|
||||||
|
fi
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartCleanup
|
||||||
|
rlRun "iptables -F"
|
||||||
|
rlRun "iptables -t nat -F"
|
||||||
|
rlRun "ip6tables -F"
|
||||||
|
rlRun "popd"
|
||||||
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
63
tests/TRACE-target-of-iptables-can-t-work-in/Makefile
Normal file
63
tests/TRACE-target-of-iptables-can-t-work-in/Makefile
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Makefile of /CoreOS/iptables/Regression/TRACE-target-of-iptables-can-t-work-in
|
||||||
|
# Description: Test for TRACE target of iptables can't work in
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2016 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
export TEST=/CoreOS/iptables/Regression/TRACE-target-of-iptables-can-t-work-in
|
||||||
|
export TESTVERSION=1.0
|
||||||
|
|
||||||
|
BUILT_FILES=
|
||||||
|
|
||||||
|
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||||
|
|
||||||
|
.PHONY: all install download clean
|
||||||
|
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
test -x runtest.sh || chmod a+x runtest.sh
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *~ $(BUILT_FILES)
|
||||||
|
|
||||||
|
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "Description: Test for TRACE target of iptables can't work in" >> $(METADATA)
|
||||||
|
@echo "Type: Regression" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: iptables" >> $(METADATA)
|
||||||
|
@echo "Requires: iptables iptables-services" >> $(METADATA)
|
||||||
|
@echo "Priority: Normal" >> $(METADATA)
|
||||||
|
@echo "License: GPLv2+" >> $(METADATA)
|
||||||
|
@echo "Confidential: no" >> $(METADATA)
|
||||||
|
@echo "Destructive: no" >> $(METADATA)
|
||||||
|
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||||
|
|
||||||
|
rhts-lint $(METADATA)
|
||||||
4
tests/TRACE-target-of-iptables-can-t-work-in/PURPOSE
Normal file
4
tests/TRACE-target-of-iptables-can-t-work-in/PURPOSE
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
PURPOSE of /CoreOS/iptables/Regression/TRACE-target-of-iptables-can-t-work-in
|
||||||
|
Description: Test for TRACE target of iptables can't work in
|
||||||
|
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
Bug summary: TRACE target of iptables can't work in RHEL7.1/RHEL7.2
|
||||||
136
tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh
Executable file
136
tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh
Executable file
@ -0,0 +1,136 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# runtest.sh of /CoreOS/iptables/Regression/TRACE-target-of-iptables-can-t-work-in
|
||||||
|
# Description: Test for TRACE target of iptables can't work in
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2016 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="iptables"
|
||||||
|
SERVICES="iptables ip6tables firewalld"
|
||||||
|
|
||||||
|
prepare_page() {
|
||||||
|
section=$1
|
||||||
|
name=$2
|
||||||
|
dest=${name}.manpage
|
||||||
|
zcat /usr/share/man/man${section}/${name}.${section}.gz | tr -s ' ' > ${dest}
|
||||||
|
rlAssertExists ${dest}
|
||||||
|
}
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartSetup
|
||||||
|
rlAssertRpm $PACKAGE
|
||||||
|
# rlAssertRpm kernel
|
||||||
|
rlLogInfo $(uname -r)
|
||||||
|
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||||
|
rlRun "pushd $TmpDir"
|
||||||
|
prepare_page 8 iptables-extensions
|
||||||
|
for svc in $SERVICES; do
|
||||||
|
rlServiceStop $svc
|
||||||
|
done
|
||||||
|
rlRun "ip -4 -o r | grep default | head -1 | sed -re 's/.*dev ((\.|\w)+).*/\1/' > default-iface"
|
||||||
|
IFACE="$(< default-iface)"
|
||||||
|
rlAssertExists "/sys/class/net/$IFACE"
|
||||||
|
rlRun "ip route save > ip-route.save" 0 "save routing info"
|
||||||
|
rlRun "ip -6 route save > ip-route.save6" 0 "save ipv6 routing info"
|
||||||
|
rlRun "ip -6 r add default dev $IFACE" 0,2 "add ipv6 default route"
|
||||||
|
rlRun "rmmod nf_log_ipv4" 0,1
|
||||||
|
rlRun "rmmod nf_log_ipv6" 0,1
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest "manpage check"
|
||||||
|
rlAssertGrep "nfnetlink_log" iptables-extensions.manpage
|
||||||
|
if rlIsRHEL 7 && rlIsRHEL '>=7.3' ; then
|
||||||
|
# RHEL version-specific libxt_TRACE man page patchs
|
||||||
|
rlAssertGrep "nf_log_ipv4(6)" iptables-extensions.manpage
|
||||||
|
rlAssertNotGrep "ip(...)?t_LOG" iptables-extensions.manpage -Ei
|
||||||
|
fi
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
ipv4_ping() {
|
||||||
|
rlRun "ping -i 0.2 -c 3 -W 1 192.0.2.99" 0,1 "ipv4 icmp out (ping)"
|
||||||
|
}
|
||||||
|
ipv6_ping() {
|
||||||
|
rlRun "ping6 -i 0.2 -c 3 -W 1 2001:DB8::99" 0,1 "ipv6 icmp out (ping6)"
|
||||||
|
}
|
||||||
|
get_messages() {
|
||||||
|
if rlIsFedora; then
|
||||||
|
journalctl -qkb
|
||||||
|
else
|
||||||
|
cat /var/log/messages
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
rlPhaseStartTest "iptables_TRACE"
|
||||||
|
rlRun "get_messages > messages.log-orig"
|
||||||
|
rlRun "iptables -t raw -I OUTPUT -p icmp -j TRACE" 0
|
||||||
|
rlRun "ip6tables -t raw -I OUTPUT -p icmpv6 -j TRACE" 0
|
||||||
|
if rlTestVersion "$(uname -r)" "<" "4.6"; then
|
||||||
|
ipv4_ping; ipv6_ping
|
||||||
|
rlRun "get_messages > messages.current"
|
||||||
|
|
||||||
|
rlRun "diff messages.log-orig messages.current > diff.1" 0,1
|
||||||
|
echo --debug_START--
|
||||||
|
cat diff.1
|
||||||
|
echo --debug_END--
|
||||||
|
rlRun "modprobe nf_log_ipv4" 0 "load ipv4 TRACE logging module"
|
||||||
|
rlRun "modprobe nf_log_ipv6" 0 "load ipv6 TRACE logging module"
|
||||||
|
rlAssertNotGrep "TRACE" diff.1
|
||||||
|
else
|
||||||
|
rlLogInfo "new kernel detected: skipping loading modules and associated checks"
|
||||||
|
fi
|
||||||
|
ipv4_ping; ipv6_ping
|
||||||
|
rlRun "get_messages > messages.current"
|
||||||
|
|
||||||
|
rlRun "diff messages.log-orig messages.current > diff.2" 0,1
|
||||||
|
rlAssertGrep "TRACE" diff.2
|
||||||
|
rlAssertGrep "TRACE.*PROTO=ICMP " diff.2
|
||||||
|
rlAssertGrep "TRACE.*PROTO=ICMPv6 " diff.2
|
||||||
|
echo --debug_START--
|
||||||
|
cat diff.2
|
||||||
|
echo --debug_END--
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartCleanup
|
||||||
|
rlRun "ip route flush default" 0 "flush ip route data"
|
||||||
|
rlRun "ip -6 route flush default" 0 "flush ipv6 route data"
|
||||||
|
rlRun "ip route restore < ip-route.save" 0 "restore routing info"
|
||||||
|
rlRun "ip -6 route restore < ip-route.save6" 0 "restore routing info ipv6"
|
||||||
|
rlRun "iptables -t raw -F"
|
||||||
|
rlRun "ip6tables -t raw -F"
|
||||||
|
rlRun "rmmod nf_log_ipv4"
|
||||||
|
rlRun "rmmod nf_log_ipv6"
|
||||||
|
rlRun "rmmod nf_log_common"
|
||||||
|
rlRun "rmmod nfnetlink_log" 0,1
|
||||||
|
rlLogInfo "restoring services"
|
||||||
|
for svc in $SERVICES; do
|
||||||
|
rlServiceRestore $svc
|
||||||
|
done
|
||||||
|
rlRun "popd"
|
||||||
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
63
tests/backport-iptables-add-libxt-cgroup-frontend/Makefile
Normal file
63
tests/backport-iptables-add-libxt-cgroup-frontend/Makefile
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Makefile of /CoreOS/iptables/Sanity/backport-iptables-add-libxt-cgroup-frontend
|
||||||
|
# Description: Test for backport iptables add libxt_cgroup frontend
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2015 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
export TEST=/CoreOS/iptables/Sanity/backport-iptables-add-libxt-cgroup-frontend
|
||||||
|
export TESTVERSION=1.0
|
||||||
|
|
||||||
|
BUILT_FILES=
|
||||||
|
|
||||||
|
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||||
|
|
||||||
|
.PHONY: all install download clean
|
||||||
|
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
test -x runtest.sh || chmod a+x runtest.sh
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *~ $(BUILT_FILES)
|
||||||
|
|
||||||
|
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "Description: Test for backport iptables add libxt_cgroup frontend" >> $(METADATA)
|
||||||
|
@echo "Type: Sanity" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: iptables" >> $(METADATA)
|
||||||
|
@echo "Requires: iptables libcgroup-tools" >> $(METADATA)
|
||||||
|
@echo "Priority: Normal" >> $(METADATA)
|
||||||
|
@echo "License: GPLv2+" >> $(METADATA)
|
||||||
|
@echo "Confidential: no" >> $(METADATA)
|
||||||
|
@echo "Destructive: no" >> $(METADATA)
|
||||||
|
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||||
|
|
||||||
|
rhts-lint $(METADATA)
|
||||||
@ -0,0 +1,4 @@
|
|||||||
|
PURPOSE of /CoreOS/iptables/Sanity/backport-iptables-add-libxt-cgroup-frontend
|
||||||
|
Description: Test for backport iptables add libxt_cgroup frontend
|
||||||
|
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
Bug summary: Backport: iptables: add libxt_cgroup frontend
|
||||||
111
tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh
Executable file
111
tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh
Executable file
@ -0,0 +1,111 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# runtest.sh of /CoreOS/iptables/Sanity/backport-iptables-add-libxt-cgroup-frontend
|
||||||
|
# Description: Test for backport iptables add libxt_cgroup frontend
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2015 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="iptables"
|
||||||
|
CGNUM="15"
|
||||||
|
CGNAME="15"
|
||||||
|
CGDIR="/sys/fs/cgroup/net_cls/$CGNAME"
|
||||||
|
DEST_IP4="192.0.2.99" # TEST-NET-1
|
||||||
|
DEST_IP42="192.0.2.199" # TEST-NET-1
|
||||||
|
DEST_IP6="2001:0db8:0000:0000:0000:0000:0000:abc0" #has to be expanded due to matching !
|
||||||
|
DEST_IP62="2001:0db8:0000:0000:0000:0000:0000:abc1"
|
||||||
|
SKIP6=false
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartSetup
|
||||||
|
rlAssertRpm $PACKAGE
|
||||||
|
# rlAssertRpm kernel-$(uname -r)
|
||||||
|
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||||
|
rlRun "pushd $TmpDir"
|
||||||
|
if rlIsRHEL '>=7'; then
|
||||||
|
rlServiceStop firewalld
|
||||||
|
sleep 1
|
||||||
|
fi
|
||||||
|
rlLogInfo "check if net_cls cgroup is present"
|
||||||
|
rlAssertGrep "cgroup.*net_cls" /proc/mounts
|
||||||
|
rlRun "cgcreate -g net_cls:$CGNAME" 0 "create cgroup '15'"
|
||||||
|
rlRun "echo $CGNUM > $CGDIR/net_cls.classid" 0 "assign numerical id to cgroup"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest
|
||||||
|
ping -W 1 -c 30 $DEST_IP4 &
|
||||||
|
PING4_P1=$! EC4=$?
|
||||||
|
ping -W 1 -c 30 $DEST_IP42 &
|
||||||
|
PING4_P2=$! EC42=$?
|
||||||
|
rlRun "[[ $EC4 -eq 0 && $EC42 -eq 0 ]]" 0 "ping ipv4 running to $DEST_IP4, $DEST_IP42"
|
||||||
|
|
||||||
|
ping6 -W 1 -c 30 $DEST_IP6 &
|
||||||
|
PING6_P1=$! EC6=$?
|
||||||
|
sleep 1
|
||||||
|
if [[ $EC6 -eq 2 ]] || ! kill -0 $PING6_P1 2>/dev/null; then
|
||||||
|
rlLogInfo "skipping ipv6 test, network stack unavailable"
|
||||||
|
SKIP6=true
|
||||||
|
else
|
||||||
|
ping6 -W 1 -c 30 $DEST_IP62 &
|
||||||
|
PING6_P2=$!
|
||||||
|
rlRun "kill -0 $PING6_P1 && kill -0 $PING6_P2" 0 "ping ipv6 running to $DEST_IP6, $DEST_IP62"
|
||||||
|
fi
|
||||||
|
journalctl -fkb > dmesg.out &
|
||||||
|
DMESG_P=$!
|
||||||
|
echo > dmesg.out # clear dmesg out
|
||||||
|
|
||||||
|
rlRun "iptables -A OUTPUT -m cgroup --cgroup $CGNUM -j LOG"
|
||||||
|
rlRun "ip6tables -A OUTPUT -m cgroup --cgroup $CGNUM -j LOG"
|
||||||
|
|
||||||
|
rlRun "echo $PING4_P2 >> $CGDIR/tasks" 0 "Add second ping to cgroup '15'"
|
||||||
|
$SKIP6 || rlRun "echo $PING6_P2 >> $CGDIR/tasks" 0 "Add second ping6 to cgroup '15'"
|
||||||
|
cat $CGDIR/tasks
|
||||||
|
sleep 10
|
||||||
|
cat dmesg.out
|
||||||
|
rlAssertGrep "$DEST_IP42" dmesg.out
|
||||||
|
$SKIP6 || rlAssertGrep "$DEST_IP62" dmesg.out
|
||||||
|
rlAssertNotGrep "$DEST_IP4" dmesg.out
|
||||||
|
rlAssertNotGrep "$DEST_IP6" dmesg.out
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartCleanup
|
||||||
|
kill $DMESG_P
|
||||||
|
# pings die after 30s of execution either way
|
||||||
|
kill $PING4_P1
|
||||||
|
kill $PING4_P2
|
||||||
|
$SKIP6 || kill $PING6_P1
|
||||||
|
$SKIP6 || kill $PING6_P2
|
||||||
|
sleep 1
|
||||||
|
|
||||||
|
rlRun "iptables -F" 0 "cleanup iptables"
|
||||||
|
rlRun "ip6tables -F" 0 "cleanup ip6tables"
|
||||||
|
rlServiceRestore firewalld
|
||||||
|
rlRun "cgdelete -g net_cls:$CGNAME" 0 "delete cgroup"
|
||||||
|
rlRun "popd"
|
||||||
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
63
tests/initscript-sanity/Makefile
Normal file
63
tests/initscript-sanity/Makefile
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Makefile of /CoreOS/iptables/Sanity/initscript-sanity
|
||||||
|
# Description: initscript-sanity
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2016 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
export TEST=/CoreOS/iptables/Sanity/initscript-sanity
|
||||||
|
export TESTVERSION=1.0
|
||||||
|
|
||||||
|
BUILT_FILES=
|
||||||
|
|
||||||
|
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||||
|
|
||||||
|
.PHONY: all install download clean
|
||||||
|
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
test -x runtest.sh || chmod a+x runtest.sh
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *~ $(BUILT_FILES)
|
||||||
|
|
||||||
|
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "Description: initscript-sanity" >> $(METADATA)
|
||||||
|
@echo "Type: Sanity" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: iptables" >> $(METADATA)
|
||||||
|
@echo "Requires: iptables iptables-services" >> $(METADATA)
|
||||||
|
@echo "Priority: Normal" >> $(METADATA)
|
||||||
|
@echo "License: GPLv2+" >> $(METADATA)
|
||||||
|
@echo "Confidential: no" >> $(METADATA)
|
||||||
|
@echo "Destructive: no" >> $(METADATA)
|
||||||
|
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||||
|
|
||||||
|
rhts-lint $(METADATA)
|
||||||
4
tests/initscript-sanity/PURPOSE
Normal file
4
tests/initscript-sanity/PURPOSE
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
PURPOSE of /CoreOS/iptables/Sanity/initscript-sanity
|
||||||
|
Description: initscript-sanity
|
||||||
|
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
Bug summary: Can not "service iptables save": restorecon not found
|
||||||
56
tests/initscript-sanity/runtest.sh
Executable file
56
tests/initscript-sanity/runtest.sh
Executable file
@ -0,0 +1,56 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# runtest.sh of /CoreOS/iptables/Sanity/initscript-sanity
|
||||||
|
# Description: initscript-sanity
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2016 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="iptables"
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartSetup
|
||||||
|
rlAssertRpm $PACKAGE
|
||||||
|
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||||
|
rlRun "pushd $TmpDir"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest
|
||||||
|
rlLogInfo 'Can not "service iptables save": restorecon not found'
|
||||||
|
if rlIsRHEL 6 7 ; then
|
||||||
|
rlAssertGrep '[ ! -x "$RESTORECON" ] && RESTORECON=/bin/true' /usr/libexec/iptables/iptables.init
|
||||||
|
rlAssertGrep '[ ! -x "$RESTORECON" ] && RESTORECON=/bin/true' /usr/libexec/iptables/ip6tables.init
|
||||||
|
else
|
||||||
|
rlLogInfo 'skipping: test not applicable to this OS release'
|
||||||
|
fi
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartCleanup
|
||||||
|
rlRun "popd"
|
||||||
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
3
tests/inventory
Executable file
3
tests/inventory
Executable file
@ -0,0 +1,3 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
export TEST_DOCKER_EXTRA_ARGS="--privileged"
|
||||||
|
exec merge-standard-inventory "$@"
|
||||||
@ -0,0 +1,62 @@
|
|||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Makefile of /CoreOS/iptables/Regression/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
|
||||||
|
# Description: Test for while adding iptables rules with ipv6 sets in
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2014 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
export TEST=/CoreOS/iptables/Regression/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
|
||||||
|
export TESTVERSION=1.0
|
||||||
|
|
||||||
|
BUILT_FILES=
|
||||||
|
|
||||||
|
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||||
|
|
||||||
|
.PHONY: all install download clean
|
||||||
|
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
test -x runtest.sh || chmod a+x runtest.sh
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *~ $(BUILT_FILES)
|
||||||
|
|
||||||
|
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "Description: Test for while adding iptables rules with ipv6 sets in" >> $(METADATA)
|
||||||
|
@echo "Type: Regression" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: iptables" >> $(METADATA)
|
||||||
|
@echo "Requires: iptables bridge-utils ipset" >> $(METADATA)
|
||||||
|
@echo "Priority: Normal" >> $(METADATA)
|
||||||
|
@echo "License: GPLv2+" >> $(METADATA)
|
||||||
|
@echo "Confidential: no" >> $(METADATA)
|
||||||
|
@echo "Destructive: no" >> $(METADATA)
|
||||||
|
|
||||||
|
rhts-lint $(METADATA)
|
||||||
@ -0,0 +1,4 @@
|
|||||||
|
PURPOSE of /CoreOS/iptables/Regression/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
|
||||||
|
Description: Test for while adding iptables rules with ipv6 sets in
|
||||||
|
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
Bug summary: while adding iptables rules with ipv6 sets in destination direction, either individually or combined with source we see error messages.
|
||||||
85
tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh
Executable file
85
tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh
Executable file
@ -0,0 +1,85 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# runtest.sh of /CoreOS/iptables/Regression/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
|
||||||
|
# Description: Test for while adding iptables rules with ipv6 sets in
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2014 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="iptables"
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartSetup
|
||||||
|
rlAssertRpm $PACKAGE
|
||||||
|
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||||
|
rlRun "pushd $TmpDir"
|
||||||
|
rlRun "ip6tables-save > ip6tables.backup"
|
||||||
|
rlRun "iptables-save > iptables.backup"
|
||||||
|
rlRun "brctl addbr testbr" 0 "create bridge iface"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest
|
||||||
|
rlRun "ipset create ipsetv6 hash:net timeout 60 family inet6" 0 "Create hash:net ipset for ipv6"
|
||||||
|
rlRun "ipset create ipsetv4 hash:net timeout 60 family inet" 0 "Create hash:net ipset for ipv4"
|
||||||
|
rlRun "ipset list ipsetv6" 0 "verify ipsetv6 presence"
|
||||||
|
rlRun "ipset list ipsetv4" 0 "verify ipsetv4 presence"
|
||||||
|
# echo waiting; read; echo cont
|
||||||
|
checkRule() {
|
||||||
|
binary="$1"
|
||||||
|
comment="$2"
|
||||||
|
rlRun "$binary -t mangle $RULE" 0 "$comment"
|
||||||
|
rlRun "$binary-save | grep -qe '$RULE'" 0 "verify rule"
|
||||||
|
}
|
||||||
|
for i in dst src dst,src src,dst; do
|
||||||
|
# 6,4 (+)
|
||||||
|
RULE="-A PREROUTING -i testbr -m set --match-set ipsetv6 $i -j ACCEPT"
|
||||||
|
checkRule ip6tables "[ipv6] direction: $i. adding ip6tables rule to match set"
|
||||||
|
RULE="-A PREROUTING -i testbr -m set --match-set ipsetv4 $i -j ACCEPT"
|
||||||
|
checkRule iptables "[ipv4] direction: $i. adding iptables rule to match set"
|
||||||
|
|
||||||
|
# 6,4 (-)
|
||||||
|
RULE="-A PREROUTING -i testbr -m set ! --match-set ipsetv6 $i -j ACCEPT"
|
||||||
|
checkRule ip6tables "[ipv6] direction: $i. adding negated ip6tables rule to match set"
|
||||||
|
RULE="-A PREROUTING -i testbr -m set ! --match-set ipsetv4 $i -j ACCEPT"
|
||||||
|
checkRule iptables "[ipv4] direction: $i. adding negated iptables rule to match set"
|
||||||
|
done
|
||||||
|
ip6tables-save
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartCleanup
|
||||||
|
rlRun "ip6tables -t mangle -F"
|
||||||
|
rlRun "iptables -t mangle -F"
|
||||||
|
rlRun "ip6tables-restore < ip6tables.backup"
|
||||||
|
rlRun "iptables-restore < iptables.backup"
|
||||||
|
rlRun "ip link set down dev testbr"
|
||||||
|
rlRun "brctl delbr testbr" 0 "remove bridge iface"
|
||||||
|
rlRun "ipset destroy ipsetv6" 0 "remove ipv6 ipset"
|
||||||
|
rlRun "ipset destroy ipsetv4" 0 "remove ipv4 ipset"
|
||||||
|
rlRun "popd"
|
||||||
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
@ -0,0 +1,63 @@
|
|||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Makefile of /CoreOS/iptables/Regression/ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||||
|
# Description: Test for ip6tables service does not allow dhcpv6-client by
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2015 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
export TEST=/CoreOS/iptables/Regression/ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||||
|
export TESTVERSION=1.0
|
||||||
|
|
||||||
|
BUILT_FILES=
|
||||||
|
|
||||||
|
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||||
|
|
||||||
|
.PHONY: all install download clean
|
||||||
|
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
test -x runtest.sh || chmod a+x runtest.sh
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *~ $(BUILT_FILES)
|
||||||
|
|
||||||
|
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "Description: Test for ip6tables service does not allow dhcpv6-client by" >> $(METADATA)
|
||||||
|
@echo "Type: Regression" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: iptables" >> $(METADATA)
|
||||||
|
@echo "Requires: iptables iptables-services" >> $(METADATA)
|
||||||
|
@echo "Priority: Normal" >> $(METADATA)
|
||||||
|
@echo "License: GPLv2+" >> $(METADATA)
|
||||||
|
@echo "Confidential: no" >> $(METADATA)
|
||||||
|
@echo "Destructive: no" >> $(METADATA)
|
||||||
|
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||||
|
|
||||||
|
rhts-lint $(METADATA)
|
||||||
@ -0,0 +1,4 @@
|
|||||||
|
PURPOSE of /CoreOS/iptables/Regression/ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||||
|
Description: Test for ip6tables service does not allow dhcpv6-client by
|
||||||
|
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
Bug summary: ip6tables service does not allow dhcpv6-client by default
|
||||||
53
tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh
Executable file
53
tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh
Executable file
@ -0,0 +1,53 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# runtest.sh of /CoreOS/iptables/Regression/ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||||
|
# Description: Test for ip6tables service does not allow dhcpv6-client by
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2015 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="iptables"
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartSetup
|
||||||
|
rlAssertRpm $PACKAGE
|
||||||
|
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||||
|
rlRun "pushd $TmpDir"
|
||||||
|
rlRun "cp /etc/sysconfig/ip6tables ."
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest
|
||||||
|
rlRun "sed -ie '/REJECT/,// d' ip6tables" 0 "remove all rejected rules"
|
||||||
|
echo --debug--; cat ip6tables
|
||||||
|
rlAssertGrep "-A INPUT -d fe80::/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT" ip6tables
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartCleanup
|
||||||
|
rlRun "popd"
|
||||||
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
@ -0,0 +1,63 @@
|
|||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Makefile of /CoreOS/iptables/Regression/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP
|
||||||
|
# Description: Test for ip6tables -t nat -A POSTROUTING/OUTPUT with DROP
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2016 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
export TEST=/CoreOS/iptables/Regression/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP
|
||||||
|
export TESTVERSION=1.0
|
||||||
|
|
||||||
|
BUILT_FILES=
|
||||||
|
|
||||||
|
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||||
|
|
||||||
|
.PHONY: all install download clean
|
||||||
|
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
test -x runtest.sh || chmod a+x runtest.sh
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *~ $(BUILT_FILES)
|
||||||
|
|
||||||
|
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "Description: Test for ip6tables -t nat -A POSTROUTING/OUTPUT with DROP" >> $(METADATA)
|
||||||
|
@echo "Type: Regression" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: iptables" >> $(METADATA)
|
||||||
|
@echo "Requires: iptables" >> $(METADATA)
|
||||||
|
@echo "Priority: Normal" >> $(METADATA)
|
||||||
|
@echo "License: GPLv2+" >> $(METADATA)
|
||||||
|
@echo "Confidential: no" >> $(METADATA)
|
||||||
|
@echo "Destructive: no" >> $(METADATA)
|
||||||
|
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||||
|
|
||||||
|
rhts-lint $(METADATA)
|
||||||
@ -0,0 +1,4 @@
|
|||||||
|
PURPOSE of /CoreOS/iptables/Regression/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP
|
||||||
|
Description: Test for ip6tables -t nat -A POSTROUTING/OUTPUT with DROP
|
||||||
|
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
Bug summary: ip6tables -t nat -A POSTROUTING/OUTPUT with DROP target can't filter packets
|
||||||
20
tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/env.sh
Normal file
20
tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/env.sh
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
ip netns del cs_client >/dev/null 2>&1
|
||||||
|
ip link del veth0 >/dev/null 2>&1
|
||||||
|
|
||||||
|
ip netns add cs_client
|
||||||
|
ip link add type veth
|
||||||
|
ip link set veth1 name eth1 netns cs_client
|
||||||
|
|
||||||
|
export cs_client_if1=eth1
|
||||||
|
export cs_server_if1=veth0
|
||||||
|
export cs_client_ip1=2001:db8:ffff::1
|
||||||
|
export cs_server_ip1=2001:db8:ffff::2
|
||||||
|
|
||||||
|
ip netns exec cs_client ip link set $cs_client_if1 up
|
||||||
|
ip link set $cs_server_if1 up
|
||||||
|
ip netns exec cs_client ip -6 addr add $cs_client_ip1/64 dev $cs_client_if1
|
||||||
|
ip -6 addr add $cs_server_ip1/64 dev $cs_server_if1
|
||||||
|
ip netns exec cs_client ifconfig lo up
|
||||||
|
ifconfig lo up
|
||||||
83
tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh
Executable file
83
tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh
Executable file
@ -0,0 +1,83 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# runtest.sh of /CoreOS/iptables/Regression/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP
|
||||||
|
# Description: Test for ip6tables -t nat -A POSTROUTING/OUTPUT with DROP
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2016 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="iptables"
|
||||||
|
SERVICES="iptables ip6tables firewalld"
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartSetup
|
||||||
|
rlAssertRpm $PACKAGE
|
||||||
|
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||||
|
rlRun "pushd $TmpDir"
|
||||||
|
for svc in $SERVICES; do
|
||||||
|
rlServiceStop $svc
|
||||||
|
done
|
||||||
|
rlRun "iptables -t nat -F"
|
||||||
|
rlRun "ip6tables -t nat -F"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest
|
||||||
|
table="nat"
|
||||||
|
assert_string="nat.*intended.*inhibited"
|
||||||
|
for chain in PREROUTING INPUT OUTPUT POSTROUTING; do
|
||||||
|
rlLogInfo "checking chain $chain"
|
||||||
|
rlRun "iptables -t $table -A $chain -p icmp -j DROP 2>iptables.stderr" 2 \
|
||||||
|
"iptables: Failure to accept DROP to '$table/$chain' chain"
|
||||||
|
rlRun "ip6tables -t $table -A $chain -p icmpv6 -j DROP 2>ip6tables.stderr" 2 \
|
||||||
|
"ip6tables: Failure to accept DROP to '$table/$chain' chain"
|
||||||
|
rlAssertGrep "$assert_string" iptables.stderr -E
|
||||||
|
rlAssertGrep "$assert_string" ip6tables.stderr -E
|
||||||
|
rm -f iptables.stderr ip6tables.stderr
|
||||||
|
echo --debug_START--
|
||||||
|
set -x
|
||||||
|
iptables-save | grep -E '\*|icmp'
|
||||||
|
ip6tables-save | grep -E '\*|icmp'
|
||||||
|
set +x
|
||||||
|
echo --debug_END--
|
||||||
|
done
|
||||||
|
rlRun "iptables-save > ipt4.out"
|
||||||
|
rlRun "ip6tables-save > ipt6.out"
|
||||||
|
rlAssertNotGrep "icmp" ipt4.out
|
||||||
|
rlAssertNotGrep "icmp" ipt6.out
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartCleanup
|
||||||
|
rlRun "iptables -t nat -F"
|
||||||
|
rlRun "ip6tables -t nat -F"
|
||||||
|
rlLogInfo "restoring services"
|
||||||
|
for svc in $SERVICES; do
|
||||||
|
rlServiceRestore $svc
|
||||||
|
done
|
||||||
|
rlRun "popd"
|
||||||
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
@ -0,0 +1,63 @@
|
|||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Makefile of /CoreOS/iptables/Regression/iptables-rule-deletion-fails-for-rules-that-use
|
||||||
|
# Description: Test for iptables rule deletion fails for rules that use
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2015 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
export TEST=/CoreOS/iptables/Regression/iptables-rule-deletion-fails-for-rules-that-use
|
||||||
|
export TESTVERSION=1.0
|
||||||
|
|
||||||
|
BUILT_FILES=
|
||||||
|
|
||||||
|
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||||
|
|
||||||
|
.PHONY: all install download clean
|
||||||
|
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
test -x runtest.sh || chmod a+x runtest.sh
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *~ $(BUILT_FILES)
|
||||||
|
|
||||||
|
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "Description: Test for iptables rule deletion fails for rules that use" >> $(METADATA)
|
||||||
|
@echo "Type: Regression" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: iptables" >> $(METADATA)
|
||||||
|
@echo "Requires: iptables ipset" >> $(METADATA)
|
||||||
|
@echo "Priority: Normal" >> $(METADATA)
|
||||||
|
@echo "License: GPLv2+" >> $(METADATA)
|
||||||
|
@echo "Confidential: no" >> $(METADATA)
|
||||||
|
@echo "Destructive: no" >> $(METADATA)
|
||||||
|
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||||
|
|
||||||
|
rhts-lint $(METADATA)
|
||||||
@ -0,0 +1,4 @@
|
|||||||
|
PURPOSE of /CoreOS/iptables/Regression/iptables-rule-deletion-fails-for-rules-that-use
|
||||||
|
Description: Test for iptables rule deletion fails for rules that use
|
||||||
|
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
Bug summary: iptables rule deletion fails for rules that use ipset match "--match-set"
|
||||||
78
tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh
Executable file
78
tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh
Executable file
@ -0,0 +1,78 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# runtest.sh of /CoreOS/iptables/Regression/iptables-rule-deletion-fails-for-rules-that-use
|
||||||
|
# Description: Test for iptables rule deletion fails for rules that use
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2015 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="iptables"
|
||||||
|
IPSET4="ipsetv4"
|
||||||
|
IPSET6="ipsetv6"
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartSetup
|
||||||
|
rlAssertRpm $PACKAGE
|
||||||
|
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||||
|
rlRun "pushd $TmpDir"
|
||||||
|
rlRun "ipset create $IPSET4 hash:ip"
|
||||||
|
rlRun "ipset create $IPSET6 hash:ip family inet6"
|
||||||
|
rlRun "iptables-save -t mangle > ipt4.save"
|
||||||
|
rlRun "ip6tables-save -t mangle > ipt6.save"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest
|
||||||
|
RULE40="-A PREROUTING -m set --match-set $IPSET4 dst -j ACCEPT"
|
||||||
|
RULE40d="-D PREROUTING -m set --match-set $IPSET4 dst -j ACCEPT"
|
||||||
|
RULE41="-A PREROUTING -m set --match-set $IPSET4 dst -j SET --add-set $IPSET4 src"
|
||||||
|
RULE41d="-D PREROUTING -m set --match-set $IPSET4 dst -j SET --add-set $IPSET4 src"
|
||||||
|
RULE60="-A PREROUTING -m set --match-set $IPSET6 dst -j ACCEPT"
|
||||||
|
RULE60d="-D PREROUTING -m set --match-set $IPSET6 dst -j ACCEPT"
|
||||||
|
RULE61="-A PREROUTING -m set --match-set $IPSET6 dst -j SET --add-set $IPSET6 src"
|
||||||
|
RULE61d="-D PREROUTING -m set --match-set $IPSET6 dst -j SET --add-set $IPSET6 src"
|
||||||
|
for RULE in "$RULE40" "$RULE40d" "$RULE41" "$RULE41d"; do
|
||||||
|
rlRun "iptables -t mangle $RULE"
|
||||||
|
done
|
||||||
|
for RULE in "$RULE60" "$RULE60d" "$RULE61" "$RULE61d"; do
|
||||||
|
rlRun "ip6tables -t mangle $RULE"
|
||||||
|
done
|
||||||
|
rlRun "iptables-save -t mangle > ipt4.save2"
|
||||||
|
rlRun "ip6tables-save -t mangle > ipt6.save2"
|
||||||
|
rlRun "sed -e '/^#/d' -e 's/\[.*:.*\]$//' -i ipt4* ipt6*" 0 "magically unify savefiles"
|
||||||
|
rlAssertNotDiffer ipt4.save ipt4.save2
|
||||||
|
rlAssertNotDiffer ipt6.save ipt6.save2
|
||||||
|
diff -u ipt4.save ipt4.save2
|
||||||
|
diff -u ipt6.save ipt6.save2
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartCleanup
|
||||||
|
rlRun "ipset destroy $IPSET4"
|
||||||
|
rlRun "ipset destroy $IPSET6"
|
||||||
|
rlRun "popd"
|
||||||
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
63
tests/iptables-save-cuts-space-before-j/Makefile
Normal file
63
tests/iptables-save-cuts-space-before-j/Makefile
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Makefile of /CoreOS/iptables/Regression/iptables-save-cuts-space-before-j
|
||||||
|
# Description: Test for iptables-save cuts space before -j
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2015 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
export TEST=/CoreOS/iptables/Regression/iptables-save-cuts-space-before-j
|
||||||
|
export TESTVERSION=1.0
|
||||||
|
|
||||||
|
BUILT_FILES=
|
||||||
|
|
||||||
|
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||||
|
|
||||||
|
.PHONY: all install download clean
|
||||||
|
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
test -x runtest.sh || chmod a+x runtest.sh
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *~ $(BUILT_FILES)
|
||||||
|
|
||||||
|
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "Description: Test for iptables-save cuts space before -j" >> $(METADATA)
|
||||||
|
@echo "Type: Regression" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: iptables" >> $(METADATA)
|
||||||
|
@echo "Requires: iptables" >> $(METADATA)
|
||||||
|
@echo "Priority: Normal" >> $(METADATA)
|
||||||
|
@echo "License: GPLv2+" >> $(METADATA)
|
||||||
|
@echo "Confidential: no" >> $(METADATA)
|
||||||
|
@echo "Destructive: no" >> $(METADATA)
|
||||||
|
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||||
|
|
||||||
|
rhts-lint $(METADATA)
|
||||||
4
tests/iptables-save-cuts-space-before-j/PURPOSE
Normal file
4
tests/iptables-save-cuts-space-before-j/PURPOSE
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
PURPOSE of /CoreOS/iptables/Regression/iptables-save-cuts-space-before-j
|
||||||
|
Description: Test for iptables-save cuts space before -j
|
||||||
|
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
Bug summary: iptables-save cuts space before -j
|
||||||
61
tests/iptables-save-cuts-space-before-j/runtest.sh
Executable file
61
tests/iptables-save-cuts-space-before-j/runtest.sh
Executable file
@ -0,0 +1,61 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# runtest.sh of /CoreOS/iptables/Regression/iptables-save-cuts-space-before-j
|
||||||
|
# Description: Test for iptables-save cuts space before -j
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2015 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="iptables"
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartSetup
|
||||||
|
rlAssertRpm $PACKAGE
|
||||||
|
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||||
|
rlRun "pushd $TmpDir"
|
||||||
|
rlServiceStart iptables
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest
|
||||||
|
RULE="-A INPUT -p dccp -m dccp --dccp-type RESET,INVALID -j LOG"
|
||||||
|
if rlIsRHEL '>6' || rlIsFedora; then
|
||||||
|
RULE="${RULE/type/types}" # it is exported under other name
|
||||||
|
fi
|
||||||
|
rlLogInfo "using rule '$RULE'"
|
||||||
|
rlRun "iptables $RULE" 0 "add rule for ipv4"
|
||||||
|
rlRun "ip6tables $RULE" 0 "add rule for ipv6"
|
||||||
|
rlRun "iptables-save | grep -- '$RULE'" 0 "check rule for ipv4"
|
||||||
|
rlRun "ip6tables-save | grep -- '$RULE'" 0 "check rule for ipv6"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartCleanup
|
||||||
|
rlServiceStop iptables
|
||||||
|
rlServiceRestore iptables
|
||||||
|
rlRun "popd"
|
||||||
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
63
tests/iptables-save-modprobe-option/Makefile
Normal file
63
tests/iptables-save-modprobe-option/Makefile
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Makefile of /CoreOS/iptables/Regression/iptables-save-modprobe-option
|
||||||
|
# Description: Test for iptables-save man page completely wrong - which
|
||||||
|
# Author: Ales Zelinka <azelinka@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2013 Red Hat, Inc. All rights reserved.
|
||||||
|
#
|
||||||
|
# This copyrighted material is made available to anyone wishing
|
||||||
|
# to use, modify, copy, or redistribute it subject to the terms
|
||||||
|
# and conditions of the GNU General Public License version 2.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public
|
||||||
|
# License along with this program; if not, write to the Free
|
||||||
|
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||||
|
# Boston, MA 02110-1301, USA.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
export TEST=/CoreOS/iptables/Regression/iptables-save-modprobe-option
|
||||||
|
export TESTVERSION=1.0
|
||||||
|
|
||||||
|
BUILT_FILES=
|
||||||
|
|
||||||
|
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||||
|
|
||||||
|
.PHONY: all install download clean
|
||||||
|
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
test -x runtest.sh || chmod a+x runtest.sh
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *~ $(BUILT_FILES)
|
||||||
|
|
||||||
|
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@echo "Owner: Ales Zelinka <azelinka@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "Description: Test for iptables-save man page completely wrong - which" >> $(METADATA)
|
||||||
|
@echo "Type: Regression" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: iptables" >> $(METADATA)
|
||||||
|
@echo "Requires: iptables" >> $(METADATA)
|
||||||
|
@echo "Priority: Normal" >> $(METADATA)
|
||||||
|
@echo "License: GPLv2" >> $(METADATA)
|
||||||
|
@echo "Confidential: no" >> $(METADATA)
|
||||||
|
@echo "Destructive: no" >> $(METADATA)
|
||||||
|
|
||||||
|
rhts-lint $(METADATA)
|
||||||
4
tests/iptables-save-modprobe-option/PURPOSE
Normal file
4
tests/iptables-save-modprobe-option/PURPOSE
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
PURPOSE of /CoreOS/iptables/Regression/iptables-save-modprobe-option
|
||||||
|
Description: Test for iptables-save man page completely wrong - which
|
||||||
|
Author: Ales Zelinka <azelinka@redhat.com>
|
||||||
|
Bug summary: iptables-save man page completely wrong - which conflicting arguments should work?
|
||||||
42
tests/iptables-save-modprobe-option/runtest.sh
Executable file
42
tests/iptables-save-modprobe-option/runtest.sh
Executable file
@ -0,0 +1,42 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# runtest.sh of /CoreOS/iptables/Regression/iptables-save-modprobe-option
|
||||||
|
# Description: Test for iptables-save man page completely wrong - which
|
||||||
|
# Author: Ales Zelinka <azelinka@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2013 Red Hat, Inc. All rights reserved.
|
||||||
|
#
|
||||||
|
# This copyrighted material is made available to anyone wishing
|
||||||
|
# to use, modify, copy, or redistribute it subject to the terms
|
||||||
|
# and conditions of the GNU General Public License version 2.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public
|
||||||
|
# License along with this program; if not, write to the Free
|
||||||
|
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||||
|
# Boston, MA 02110-1301, USA.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="iptables"
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartTest
|
||||||
|
rlAssertRpm $PACKAGE
|
||||||
|
rlRun "iptables-save -M /dev/null" 0 "iptables-save -M ... supported"
|
||||||
|
rlRun "iptables-save --modprobe /dev/null" 0 "iptables-save --modprobe ... supported"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
91
tests/tests.yml
Normal file
91
tests/tests.yml
Normal file
@ -0,0 +1,91 @@
|
|||||||
|
---
|
||||||
|
- hosts: localhost
|
||||||
|
tags: [ always ]
|
||||||
|
tasks:
|
||||||
|
- set_fact:
|
||||||
|
our_required_packages:
|
||||||
|
- iproute # multiple tests need ip command
|
||||||
|
- iputils # multiple tests need ping/ping6 commands
|
||||||
|
- iptables # multiple tests need iptables/ip6tables commands
|
||||||
|
- iptables-services # multiple tests need iptables/ip6tables config files
|
||||||
|
- initscripts # multiple tests need system command
|
||||||
|
- libcgroup-tools # backport-iptables-add-libxt-cgroup-frontend needs cg* commands
|
||||||
|
- bridge-utils # ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets needs brctl command
|
||||||
|
- ipset # multiple tests need ipset command
|
||||||
|
- strace # xtables-tools-locking-vulnerable-to-local-DoS needs strace command
|
||||||
|
- policycoreutils # initscript-sanity needs restorecon command
|
||||||
|
|
||||||
|
- hosts: localhost
|
||||||
|
tags:
|
||||||
|
- rhts-all
|
||||||
|
roles:
|
||||||
|
- role: standard-test-rhts
|
||||||
|
tests:
|
||||||
|
- backport-iptables-add-libxt-cgroup-frontend
|
||||||
|
- initscript-sanity
|
||||||
|
- ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
|
||||||
|
- ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||||
|
- ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP
|
||||||
|
- iptables-rule-deletion-fails-for-rules-that-use
|
||||||
|
- iptables-save-cuts-space-before-j
|
||||||
|
- iptables-save-modprobe-option
|
||||||
|
- NFQUEUE-queue-bypass
|
||||||
|
- RFE-Enable-the-missing-IPv6-SET-target
|
||||||
|
- RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||||
|
- TRACE-target-of-iptables-can-t-work-in
|
||||||
|
- xtables-tools-locking-vulnerable-to-local-DoS
|
||||||
|
required_packages: "{{ our_required_packages }}"
|
||||||
|
|
||||||
|
- hosts: localhost
|
||||||
|
tags:
|
||||||
|
- classic
|
||||||
|
- beakerlib-all
|
||||||
|
roles:
|
||||||
|
- role: standard-test-beakerlib
|
||||||
|
tests:
|
||||||
|
- backport-iptables-add-libxt-cgroup-frontend
|
||||||
|
- initscript-sanity
|
||||||
|
- ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
|
||||||
|
- ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||||
|
- ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP
|
||||||
|
- iptables-rule-deletion-fails-for-rules-that-use
|
||||||
|
- iptables-save-cuts-space-before-j
|
||||||
|
- iptables-save-modprobe-option
|
||||||
|
- NFQUEUE-queue-bypass
|
||||||
|
- RFE-Enable-the-missing-IPv6-SET-target
|
||||||
|
- RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||||
|
- TRACE-target-of-iptables-can-t-work-in
|
||||||
|
- xtables-tools-locking-vulnerable-to-local-DoS
|
||||||
|
required_packages: "{{ our_required_packages }}"
|
||||||
|
|
||||||
|
- hosts: localhost
|
||||||
|
tags:
|
||||||
|
- container
|
||||||
|
roles:
|
||||||
|
- role: standard-test-beakerlib
|
||||||
|
tests:
|
||||||
|
#- backport-iptables-add-libxt-cgroup-frontend # journaling/logging issues?
|
||||||
|
- ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
|
||||||
|
- ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||||
|
- ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP
|
||||||
|
- iptables-rule-deletion-fails-for-rules-that-use
|
||||||
|
- iptables-save-cuts-space-before-j
|
||||||
|
- iptables-save-modprobe-option
|
||||||
|
- NFQUEUE-queue-bypass
|
||||||
|
- RFE-Enable-the-missing-IPv6-SET-target
|
||||||
|
- RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||||
|
- xtables-tools-locking-vulnerable-to-local-DoS
|
||||||
|
required_packages: "{{ our_required_packages }}"
|
||||||
|
|
||||||
|
- hosts: localhost
|
||||||
|
tags:
|
||||||
|
- atomic
|
||||||
|
roles:
|
||||||
|
- role: standard-test-beakerlib
|
||||||
|
tests:
|
||||||
|
- ip6tables-service-does-not-allow-dhcpv6-client-by
|
||||||
|
- iptables-save-cuts-space-before-j
|
||||||
|
- iptables-save-modprobe-option
|
||||||
|
- NFQUEUE-queue-bypass
|
||||||
|
- RFE-iptables-add-C-option-to-iptables-in-RHEL6
|
||||||
|
- xtables-tools-locking-vulnerable-to-local-DoS
|
||||||
63
tests/xtables-tools-locking-vulnerable-to-local-DoS/Makefile
Normal file
63
tests/xtables-tools-locking-vulnerable-to-local-DoS/Makefile
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Makefile of /CoreOS/iptables/Regression/xtables-tools-locking-vulnerable-to-local-DoS
|
||||||
|
# Description: Test for xtables tools locking vulnerable to local DoS
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2015 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
export TEST=/CoreOS/iptables/Regression/xtables-tools-locking-vulnerable-to-local-DoS
|
||||||
|
export TESTVERSION=1.0
|
||||||
|
|
||||||
|
BUILT_FILES=
|
||||||
|
|
||||||
|
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||||
|
|
||||||
|
.PHONY: all install download clean
|
||||||
|
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
test -x runtest.sh || chmod a+x runtest.sh
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *~ $(BUILT_FILES)
|
||||||
|
|
||||||
|
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@echo "Owner: Tomas Dolezal <todoleza@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "Description: Test for xtables tools locking vulnerable to local DoS" >> $(METADATA)
|
||||||
|
@echo "Type: Regression" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: iptables" >> $(METADATA)
|
||||||
|
@echo "Requires: iptables strace" >> $(METADATA)
|
||||||
|
@echo "Priority: Normal" >> $(METADATA)
|
||||||
|
@echo "License: GPLv2+" >> $(METADATA)
|
||||||
|
@echo "Confidential: no" >> $(METADATA)
|
||||||
|
@echo "Destructive: no" >> $(METADATA)
|
||||||
|
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||||
|
|
||||||
|
rhts-lint $(METADATA)
|
||||||
@ -0,0 +1,4 @@
|
|||||||
|
PURPOSE of /CoreOS/iptables/Regression/xtables-tools-locking-vulnerable-to-local-DoS
|
||||||
|
Description: Test for xtables tools locking vulnerable to local DoS
|
||||||
|
Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
Bug summary: xtables tools locking vulnerable to local DoS
|
||||||
54
tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh
Executable file
54
tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh
Executable file
@ -0,0 +1,54 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# runtest.sh of /CoreOS/iptables/Regression/xtables-tools-locking-vulnerable-to-local-DoS
|
||||||
|
# Description: Test for xtables tools locking vulnerable to local DoS
|
||||||
|
# Author: Tomas Dolezal <todoleza@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Copyright (c) 2015 Red Hat, Inc.
|
||||||
|
#
|
||||||
|
# This program is free software: you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License as
|
||||||
|
# published by the Free Software Foundation, either version 2 of
|
||||||
|
# the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be
|
||||||
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||||
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||||
|
# PURPOSE. See the GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/bin/rhts-environment.sh || exit 1
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="iptables"
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartSetup
|
||||||
|
rlAssertRpm $PACKAGE
|
||||||
|
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||||
|
rlRun "pushd $TmpDir"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest
|
||||||
|
rlRun "strace -fe flock,bind,open,openat -o strace.out iptables -w -L" 0 "execute iptables in strace"
|
||||||
|
echo --debug--; cat strace.out
|
||||||
|
rlAssertNotGrep "bind.*xtables" strace.out -E
|
||||||
|
rlAssertGrep " flock(" strace.out
|
||||||
|
rlAssertGrep "/run/xtables.lock" strace.out
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartCleanup
|
||||||
|
rlRun "popd"
|
||||||
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
Loading…
Reference in New Issue
Block a user