firewall4/tests/01_configuration/01_ruleset

Testing the ruleset rendered from the default firewall configuration.

-- Testcase --
{%
	include("./root/usr/share/firewall4/main.uc", {
		TRACE_CALLS: "stderr",

		getenv: function(varname) {
			switch (varname) {
			case 'ACTION':
				return 'print';
			}
		}
	})
%}
-- End --

-- Expect stdout --
table inet fw4
flush table inet fw4

table inet fw4 {
	#
	# Flowtable
	#

	flowtable ft {
		hook ingress priority 0;
		devices = { "eth0", "eth1" };
		counter;
		flags offload;
	}


	#
	# CT helper definitions
	#

	ct helper amanda {
		type "amanda" protocol udp;
	}

	ct helper ftp {
		type "ftp" protocol tcp;
	}

	ct helper RAS {
		type "RAS" protocol udp;
	}

	ct helper Q.931 {
		type "Q.931" protocol tcp;
	}

	ct helper irc {
		type "irc" protocol tcp;
	}

	ct helper netbios-ns {
		type "netbios-ns" protocol udp;
	}

	ct helper pptp {
		type "pptp" protocol tcp;
	}

	ct helper sane {
		type "sane" protocol tcp;
	}

	ct helper sip {
		type "sip" protocol udp;
	}

	ct helper snmp {
		type "snmp" protocol udp;
	}

	ct helper tftp {
		type "tftp" protocol udp;
	}

	ct helper rtsp {
		type "rtsp" protocol tcp;
	}


	#
	# Defines
	#

	define lan_devices = { "br-lan" }
	define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 }

	define wan_devices = { "pppoe-wan" }
	define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 }


	#
	# User includes
	#

	include "/etc/nftables.d/*.nft"


	#
	# Filter rules
	#

	chain input {
		type filter hook input priority filter; policy drop;

		iif "lo" accept comment "!fw4: Accept traffic from loopback"

		ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
		tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
		iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
		iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
		jump handle_reject
	}

	chain forward {
		type filter hook forward priority filter; policy drop;

		meta l4proto { tcp, udp } flow offload @ft;
		ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows"
		iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
		iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
		jump handle_reject
	}

	chain output {
		type filter hook output priority filter; policy accept;

		oif "lo" accept comment "!fw4: Accept traffic towards loopback"

		ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
		meta l4proto tcp counter comment "!fw4: Test-Deprecated-Rule-Option"
		oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
		oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
	}

	chain prerouting {
		type filter hook prerouting priority filter; policy accept;
		iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
	}

	chain handle_reject {
		meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
		reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
	}

	chain syn_flood {
		limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
		drop comment "!fw4: Drop excess packets"
	}

	chain input_lan {
		jump accept_from_lan
	}

	chain output_lan {
		jump accept_to_lan
	}

	chain forward_lan {
		jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
		jump accept_to_lan
	}

	chain helper_lan {
		meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
		meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
		meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
		meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
		meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
		meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
		meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
		meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
		meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
		meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
		meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
		meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
	}

	chain accept_from_lan {
		iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
	}

	chain accept_to_lan {
		oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
	}

	chain input_wan {
		meta nfproto ipv4 udp dport 68 counter accept comment "!fw4: Allow-DHCP-Renew"
		meta nfproto ipv4 icmp type 8 counter accept comment "!fw4: Allow-Ping"
		meta nfproto ipv4 meta l4proto igmp counter accept comment "!fw4: Allow-IGMP"
		ip6 saddr fc00::/6 ip6 daddr fc00::/6 udp dport 546 counter accept comment "!fw4: Allow-DHCPv6"
		ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { 130 . 0, 131 . 0, 132 . 0, 143 . 0 } counter accept comment "!fw4: Allow-MLD"
		meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3, 133, 134 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input"
		meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1, 135 . 0, 136 . 0 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input"
		jump reject_from_wan
	}

	chain output_wan {
		jump accept_to_wan
	}

	chain forward_wan {
		meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward"
		meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward"
		meta l4proto esp counter jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
		udp dport 500 counter jump accept_to_lan comment "!fw4: Allow-ISAKMP"
		jump reject_to_wan
	}

	chain accept_to_wan {
		meta nfproto ipv4 oifname "pppoe-wan" ct state invalid counter drop comment "!fw4: Prevent NAT leakage"
		oifname "pppoe-wan" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic"
	}

	chain reject_from_wan {
		iifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
	}

	chain reject_to_wan {
		oifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
	}


	#
	# NAT rules
	#

	chain dstnat {
		type nat hook prerouting priority dstnat; policy accept;
	}

	chain srcnat {
		type nat hook postrouting priority srcnat; policy accept;
		oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
	}

	chain srcnat_wan {
		meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
	}


	#
	# Raw rules (notrack)
	#

	chain raw_prerouting {
		type filter hook prerouting priority raw; policy accept;
	}

	chain raw_output {
		type filter hook output priority raw; policy accept;
	}


	#
	# Mangle rules
	#

	chain mangle_prerouting {
		type filter hook prerouting priority mangle; policy accept;
	}

	chain mangle_postrouting {
		type filter hook postrouting priority mangle; policy accept;
		oifname "pppoe-wan" tcp flags syn / syn,fin,rst tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
	}

	chain mangle_input {
		type filter hook input priority mangle; policy accept;
	}

	chain mangle_output {
		type route hook output priority mangle; policy accept;
	}

	chain mangle_forward {
		type filter hook forward priority mangle; policy accept;
		iifname "pppoe-wan" tcp flags syn / syn,fin,rst tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
	}
}
-- End --

-- Expect stderr --
[call] ctx.call object <network.interface> method <dump> args <null>
[call] ctx.call object <service> method <get_data> args <{ "type": "firewall" }>
[call] fs.open path </proc/version> mode <r>
[call] fs.stat path </sys/module/nf_conntrack_amanda>
[call] fs.stat path </sys/module/nf_conntrack_ftp>
[call] fs.stat path </sys/module/nf_conntrack_h323>
[call] fs.stat path </sys/module/nf_conntrack_h323>
[call] fs.stat path </sys/module/nf_conntrack_irc>
[call] fs.stat path </sys/module/nf_conntrack_netbios_ns>
[call] fs.stat path </sys/module/nf_conntrack_pptp>
[call] fs.stat path </sys/module/nf_conntrack_sane>
[call] fs.stat path </sys/module/nf_conntrack_sip>
[call] fs.stat path </sys/module/nf_conntrack_snmp>
[call] fs.stat path </sys/module/nf_conntrack_tftp>
[call] fs.stat path </sys/module/nf_conntrack_rtsp>
[!] Section @defaults[0] specifies unknown option 'unknown_defaults_option'
[!] Section @rule[9] (Test-Deprecated-Rule-Option) option '_name' is deprecated by fw4
[!] Section @rule[9] (Test-Deprecated-Rule-Option) specifies unknown option 'unknown_rule_option'
[call] fs.glob pattern </usr/share/nftables.d/ruleset-pre/*.nft>
[call] fs.glob pattern </usr/share/nftables.d/ruleset-post/*.nft>
[call] fs.glob pattern </usr/share/nftables.d/table-pre/*.nft>
[call] fs.glob pattern </usr/share/nftables.d/table-post/*.nft>
[call] fs.lsdir path </usr/share/nftables.d/chain-pre>
[call] fs.lsdir path </usr/share/nftables.d/chain-post>
[call] ctx.call object <network.device> method <status> args <null>
[call] fs.opendir path </sys/class/net/br-lan>
[call] fs.opendir path </sys/class/net/eth0>
[call] fs.opendir path </sys/class/net/eth1>
[call] system command </usr/sbin/nft -c '
		add table inet fw4-hw-offload-test;
		add flowtable inet fw4-hw-offload-test ft {
			hook ingress priority 0;
			devices = { "eth0", "eth1" };
			flags offload;
		}
	' 2>/dev/null> timeout <null>
[call] fs.popen cmdline </usr/sbin/nft --terse --json list flowtables inet> mode <r>
[call] fs.readfile path </sys/class/net/br-lan/flags> limit <null>
[call] fs.readfile path </sys/class/net/br-lan/flags> limit <null>
-- End --