|
 |
21c891 |
From 4d6d152c04088c70888fb13b845af3a96bcf8917 Mon Sep 17 00:00:00 2001
|
|
|
21c891 |
From: Eric Garver <e@erig.me>
|
|
|
21c891 |
Date: Mon, 17 Dec 2018 12:42:16 -0500
|
|
|
21c891 |
Subject: [PATCH 2/4] tests/firewall-cmd: Coverage for interface wildcarding
|
|
|
21c891 |
|
|
|
21c891 |
Coverage for rhbz 1644025.
|
|
|
21c891 |
|
|
|
21c891 |
(cherry picked from commit e3f936080ff57884df20b5def241593eecb10364)
|
|
|
21c891 |
---
|
|
|
21c891 |
src/tests/firewall-cmd.at | 26 ++++++++++++++++++++++++++
|
|
|
21c891 |
1 file changed, 26 insertions(+)
|
|
|
21c891 |
|
|
|
21c891 |
diff --git a/src/tests/firewall-cmd.at b/src/tests/firewall-cmd.at
|
|
|
21c891 |
index 87e0eea4150e..3b6b6057dbec 100644
|
|
|
21c891 |
--- a/src/tests/firewall-cmd.at
|
|
|
21c891 |
+++ b/src/tests/firewall-cmd.at
|
|
|
21c891 |
@@ -115,6 +115,8 @@ FWD_START_TEST([zone interfaces])
|
|
|
21c891 |
])
|
|
|
21c891 |
FWD_CHECK([--permanent --zone=public --remove-interface=perm_dummy], 0, ignore)
|
|
|
21c891 |
FWD_CHECK([--permanent --zone=public --query-interface perm_dummy], 1, ignore)
|
|
|
21c891 |
+ FWD_CHECK([--permanent --zone=trusted --remove-interface=perm_dummy2], 0, ignore)
|
|
|
21c891 |
+ FWD_RELOAD
|
|
|
21c891 |
|
|
|
21c891 |
FWD_CHECK([--add-interface=foo], 0, ignore)
|
|
|
21c891 |
FWD_CHECK([--add-interface=bar --zone=public], 0, ignore)
|
|
|
21c891 |
@@ -128,6 +130,30 @@ FWD_START_TEST([zone interfaces])
|
|
|
21c891 |
FWD_CHECK([--set-default-zone=public], 0, ignore)
|
|
|
21c891 |
FWD_CHECK([--remove-interface=foo], 0, ignore)
|
|
|
21c891 |
FWD_CHECK([--remove-interface=bar], 0, ignore)
|
|
|
21c891 |
+
|
|
|
21c891 |
+ dnl exercise wildcards, rhbz 1644025
|
|
|
21c891 |
+ dnl Note: This feature is undocumented, because it's a possible security
|
|
|
21c891 |
+ dnl risk.
|
|
|
21c891 |
+ FWD_CHECK([--zone=trusted --add-interface=+], 0, ignore)
|
|
|
21c891 |
+ FWD_CHECK([--add-interface=foobar+++], 0, ignore)
|
|
|
21c891 |
+ FWD_CHECK([--add-interface=foobar+], 0, ignore)
|
|
|
21c891 |
+ m4_if(nftables, FIREWALL_BACKEND, [
|
|
|
21c891 |
+ NFT_LIST_RULES([inet], [filter_INPUT_ZONES], 0, [dnl
|
|
|
21c891 |
+ table inet firewalld {
|
|
|
21c891 |
+ chain filter_INPUT_ZONES {
|
|
|
21c891 |
+ iifname "foobar*" goto filter_IN_public
|
|
|
21c891 |
+ iifname "foobar++*" goto filter_IN_public
|
|
|
21c891 |
+ jump filter_IN_trusted
|
|
|
21c891 |
+ goto filter_IN_public
|
|
|
21c891 |
+ }
|
|
|
21c891 |
+ }
|
|
|
21c891 |
+ ])])
|
|
|
21c891 |
+ FWD_CHECK([--zone=trusted --remove-interface=+], 0, ignore)
|
|
|
21c891 |
+ FWD_CHECK([--remove-interface=foobar+++], 0, ignore)
|
|
|
21c891 |
+ FWD_CHECK([--remove-interface=foobar+], 0, ignore)
|
|
|
21c891 |
+ FWD_CHECK([--permanent --add-interface=foobar+], 0, ignore)
|
|
|
21c891 |
+ FWD_CHECK([--permanent --remove-interface=foobar+], 0, ignore)
|
|
|
21c891 |
+ FWD_RELOAD
|
|
|
21c891 |
FWD_END_TEST([-e '/ERROR: ZONE_CONFLICT: perm_dummy/d'])
|
|
|
21c891 |
|
|
|
21c891 |
FWD_START_TEST([zone sources])
|
|
|
21c891 |
--
|
|
|
21c891 |
2.18.0
|
|
|
21c891 |
|