|
 |
8a3219 |
From 197b393ddab8d144d869a8a4f024e6ba1e92d941 Mon Sep 17 00:00:00 2001
|
|
|
8a3219 |
From: Eric Garver <eric@garver.life>
|
|
|
8a3219 |
Date: Wed, 7 Aug 2019 08:41:11 -0400
|
|
|
8a3219 |
Subject: [PATCH 28/28] test: regression/rhbz1734765: add coverage for rhbz
|
|
|
8a3219 |
1738545
|
|
|
8a3219 |
|
|
|
8a3219 |
(cherry picked from commit 20cd5c7d29c586fa55e76d6f21adfee6a7ca34bb)
|
|
|
8a3219 |
---
|
|
|
8a3219 |
src/tests/regression/rhbz1734765.at | 46 +++++++++++++++++++++++++----
|
|
|
8a3219 |
1 file changed, 41 insertions(+), 5 deletions(-)
|
|
|
8a3219 |
|
|
|
8a3219 |
diff --git a/src/tests/regression/rhbz1734765.at b/src/tests/regression/rhbz1734765.at
|
|
|
8a3219 |
index d2158e34b547..168be70a2900 100644
|
|
|
8a3219 |
--- a/src/tests/regression/rhbz1734765.at
|
|
|
8a3219 |
+++ b/src/tests/regression/rhbz1734765.at
|
|
|
8a3219 |
@@ -1,5 +1,5 @@
|
|
|
8a3219 |
FWD_START_TEST([zone sources ordered by name])
|
|
|
8a3219 |
-AT_KEYWORDS(zone rhbz1734765 rhbz1421222 gh166)
|
|
|
8a3219 |
+AT_KEYWORDS(zone rhbz1734765 rhbz1421222 gh166 rhbz1738545)
|
|
|
8a3219 |
dnl
|
|
|
8a3219 |
dnl Users depend on firewalld ordering source-based zone dispatch by zone name.
|
|
|
8a3219 |
dnl
|
|
|
8a3219 |
@@ -11,20 +11,28 @@ FWD_CHECK([-q --permanent --new-zone=foobar_03])
|
|
|
8a3219 |
FWD_CHECK([-q --permanent --new-zone=foobar_01])
|
|
|
8a3219 |
FWD_CHECK([-q --permanent --new-zone=foobar_04])
|
|
|
8a3219 |
FWD_CHECK([-q --permanent --new-zone=foobar_010])
|
|
|
8a3219 |
+FWD_CHECK([-q --permanent --new-zone=foobar_011])
|
|
|
8a3219 |
+FWD_CHECK([-q --permanent --new-zone=foobar_012])
|
|
|
8a3219 |
|
|
|
8a3219 |
-FWD_CHECK([-q --permanent --zone=foobar_00 --add-source="10.1.1.1"])
|
|
|
8a3219 |
+FWD_CHECK([-q --permanent --new-ipset 'ipsetv4' --type hash:ip])
|
|
|
8a3219 |
+FWD_CHECK([-q --permanent --new-ipset 'ipsetv6' --type hash:ip --family=inet6])
|
|
|
8a3219 |
+FWD_CHECK([-q --permanent --ipset ipsetv4 --add-entry '192.0.2.12'])
|
|
|
8a3219 |
+FWD_CHECK([-q --permanent --ipset ipsetv6 --add-entry '::2'])
|
|
|
8a3219 |
+
|
|
|
8a3219 |
+FWD_CHECK([-q --permanent --zone=foobar_011 --add-source ipset:ipsetv4])
|
|
|
8a3219 |
FWD_CHECK([-q --permanent --zone=foobar_01 --add-source="10.1.1.0/24"])
|
|
|
8a3219 |
FWD_CHECK([-q --permanent --zone=foobar_02 --add-source="10.1.0.0/16"])
|
|
|
8a3219 |
-FWD_CHECK([-q --permanent --zone=foobar_03 --add-source="10.2.2.0/24"])
|
|
|
8a3219 |
FWD_CHECK([-q --permanent --zone=foobar_04 --add-source="10.2.0.0/16"])
|
|
|
8a3219 |
+FWD_CHECK([-q --permanent --zone=foobar_00 --add-source="10.1.1.1"])
|
|
|
8a3219 |
+FWD_CHECK([-q --permanent --zone=foobar_03 --add-source="10.2.2.0/24"])
|
|
|
8a3219 |
FWD_CHECK([-q --permanent --zone=foobar_05 --add-source="10.0.0.0/8"])
|
|
|
8a3219 |
IF_IPV6_SUPPORTED([
|
|
|
8a3219 |
-FWD_CHECK([-q --permanent --zone=foobar_00 --add-source="1234:5678::1:1:1"])
|
|
|
8a3219 |
FWD_CHECK([-q --permanent --zone=foobar_01 --add-source="1234:5678::1:1:0/112"])
|
|
|
8a3219 |
FWD_CHECK([-q --permanent --zone=foobar_02 --add-source="1234:5678::1:0:0/96"])
|
|
|
8a3219 |
-FWD_CHECK([-q --permanent --zone=foobar_03 --add-source="1234:5678::2:2:0/112"])
|
|
|
8a3219 |
FWD_CHECK([-q --permanent --zone=foobar_04 --add-source="1234:5678::2:0:0/96"])
|
|
|
8a3219 |
+FWD_CHECK([-q --permanent --zone=foobar_03 --add-source="1234:5678::2:2:0/112"])
|
|
|
8a3219 |
FWD_CHECK([-q --permanent --zone=foobar_05 --add-source="1234:5678::0:0:0/80"])
|
|
|
8a3219 |
+FWD_CHECK([-q --permanent --zone=foobar_00 --add-source="1234:5678::1:1:1"])
|
|
|
8a3219 |
])
|
|
|
8a3219 |
|
|
|
8a3219 |
FWD_CHECK([-q --permanent --zone=internal --add-interface=foobar0])
|
|
|
8a3219 |
@@ -32,11 +40,31 @@ FWD_CHECK([-q --permanent --zone=trusted --add-interface=foobar1])
|
|
|
8a3219 |
|
|
|
8a3219 |
FWD_RELOAD
|
|
|
8a3219 |
|
|
|
8a3219 |
+NFT_LIST_SET([ipsetv4], 0, [dnl
|
|
|
8a3219 |
+ table inet firewalld {
|
|
|
8a3219 |
+ set ipsetv4 {
|
|
|
8a3219 |
+ type ipv4_addr
|
|
|
8a3219 |
+ flags interval
|
|
|
8a3219 |
+ elements = { 192.0.2.12 }
|
|
|
8a3219 |
+ }
|
|
|
8a3219 |
+ }
|
|
|
8a3219 |
+])
|
|
|
8a3219 |
+NFT_LIST_SET([ipsetv6], 0, [dnl
|
|
|
8a3219 |
+ table inet firewalld {
|
|
|
8a3219 |
+ set ipsetv6 {
|
|
|
8a3219 |
+ type ipv6_addr
|
|
|
8a3219 |
+ flags interval
|
|
|
8a3219 |
+ elements = { ::2 }
|
|
|
8a3219 |
+ }
|
|
|
8a3219 |
+ }
|
|
|
8a3219 |
+])
|
|
|
8a3219 |
+
|
|
|
8a3219 |
FWD_CHECK([-q --zone=foobar_010 --add-source="10.10.10.10"])
|
|
|
8a3219 |
FWD_CHECK([-q --zone=public --add-source="20.20.20.20"])
|
|
|
8a3219 |
IF_IPV6_SUPPORTED([
|
|
|
8a3219 |
FWD_CHECK([-q --zone=foobar_010 --add-source="1234:5678::10:10:10"])
|
|
|
8a3219 |
FWD_CHECK([-q --zone=public --add-source="1234:5678::20:20:20"])
|
|
|
8a3219 |
+FWD_CHECK([-q --zone=foobar_012 --add-source ipset:ipsetv6])
|
|
|
8a3219 |
])
|
|
|
8a3219 |
FWD_CHECK([-q --zone=foobar_010 --add-interface=foobar2])
|
|
|
8a3219 |
|
|
|
8a3219 |
@@ -49,6 +77,8 @@ NFT_LIST_RULES([inet], [filter_INPUT_ZONES], 0, [dnl
|
|
|
8a3219 |
ip6 saddr 1234:5678::1:1:0/112 goto filter_IN_foobar_01
|
|
|
8a3219 |
ip saddr 10.10.10.10 goto filter_IN_foobar_010
|
|
|
8a3219 |
ip6 saddr 1234:5678::10:10:10 goto filter_IN_foobar_010
|
|
|
8a3219 |
+ ip saddr @ipsetv4 goto filter_IN_foobar_011
|
|
|
8a3219 |
+ ip6 saddr @ipsetv6 goto filter_IN_foobar_012
|
|
|
8a3219 |
ip saddr 10.1.0.0/16 goto filter_IN_foobar_02
|
|
|
8a3219 |
ip6 saddr 1234:5678::1:0:0/96 goto filter_IN_foobar_02
|
|
|
8a3219 |
ip saddr 10.2.2.0/24 goto filter_IN_foobar_03
|
|
|
8a3219 |
@@ -72,6 +102,7 @@ NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES], 0, [dnl
|
|
|
8a3219 |
ip daddr 10.1.1.1 goto nat_POST_foobar_00
|
|
|
8a3219 |
ip daddr 10.1.1.0/24 goto nat_POST_foobar_01
|
|
|
8a3219 |
ip daddr 10.10.10.10 goto nat_POST_foobar_010
|
|
|
8a3219 |
+ ip daddr @ipsetv4 goto nat_POST_foobar_011
|
|
|
8a3219 |
ip daddr 10.1.0.0/16 goto nat_POST_foobar_02
|
|
|
8a3219 |
ip daddr 10.2.2.0/24 goto nat_POST_foobar_03
|
|
|
8a3219 |
ip daddr 10.2.0.0/16 goto nat_POST_foobar_04
|
|
|
8a3219 |
@@ -90,6 +121,7 @@ NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES], 0, [dnl
|
|
|
8a3219 |
ip6 daddr 1234:5678::1:1:1 goto nat_POST_foobar_00
|
|
|
8a3219 |
ip6 daddr 1234:5678::1:1:0/112 goto nat_POST_foobar_01
|
|
|
8a3219 |
ip6 daddr 1234:5678::10:10:10 goto nat_POST_foobar_010
|
|
|
8a3219 |
+ ip6 daddr @ipsetv6 goto nat_POST_foobar_012
|
|
|
8a3219 |
ip6 daddr 1234:5678::1:0:0/96 goto nat_POST_foobar_02
|
|
|
8a3219 |
ip6 daddr 1234:5678::2:2:0/112 goto nat_POST_foobar_03
|
|
|
8a3219 |
ip6 daddr 1234:5678::2:0:0/96 goto nat_POST_foobar_04
|
|
|
8a3219 |
@@ -107,6 +139,7 @@ IPTABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
|
|
|
8a3219 |
[[IN_foobar_00 all -- 10.1.1.1 0.0.0.0/0 [goto]
|
|
|
8a3219 |
IN_foobar_01 all -- 10.1.1.0/24 0.0.0.0/0 [goto]
|
|
|
8a3219 |
IN_foobar_010 all -- 10.10.10.10 0.0.0.0/0 [goto]
|
|
|
8a3219 |
+ IN_foobar_011 all -- 0.0.0.0/0 0.0.0.0/0 [goto] match-set ipsetv4 src
|
|
|
8a3219 |
IN_foobar_02 all -- 10.1.0.0/16 0.0.0.0/0 [goto]
|
|
|
8a3219 |
IN_foobar_03 all -- 10.2.2.0/24 0.0.0.0/0 [goto]
|
|
|
8a3219 |
IN_foobar_04 all -- 10.2.0.0/16 0.0.0.0/0 [goto]
|
|
|
8a3219 |
@@ -121,6 +154,7 @@ IP6TABLES_LIST_RULES([filter], [INPUT_ZONES], 0,
|
|
|
8a3219 |
[[IN_foobar_00 all 1234:5678::1:1:1 ::/0 [goto]
|
|
|
8a3219 |
IN_foobar_01 all 1234:5678::1:1:0/112 ::/0 [goto]
|
|
|
8a3219 |
IN_foobar_010 all 1234:5678::10:10:10 ::/0 [goto]
|
|
|
8a3219 |
+ IN_foobar_012 all ::/0 ::/0 [goto] match-set ipsetv6 src
|
|
|
8a3219 |
IN_foobar_02 all 1234:5678::1:0:0/96 ::/0 [goto]
|
|
|
8a3219 |
IN_foobar_03 all 1234:5678::2:2:0/112 ::/0 [goto]
|
|
|
8a3219 |
IN_foobar_04 all 1234:5678::2:0:0/96 ::/0 [goto]
|
|
|
8a3219 |
@@ -135,6 +169,7 @@ IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
|
|
|
8a3219 |
[[POST_foobar_00 all -- 0.0.0.0/0 10.1.1.1 [goto]
|
|
|
8a3219 |
POST_foobar_01 all -- 0.0.0.0/0 10.1.1.0/24 [goto]
|
|
|
8a3219 |
POST_foobar_010 all -- 0.0.0.0/0 10.10.10.10 [goto]
|
|
|
8a3219 |
+ POST_foobar_011 all -- 0.0.0.0/0 0.0.0.0/0 [goto] match-set ipsetv4 dst
|
|
|
8a3219 |
POST_foobar_02 all -- 0.0.0.0/0 10.1.0.0/16 [goto]
|
|
|
8a3219 |
POST_foobar_03 all -- 0.0.0.0/0 10.2.2.0/24 [goto]
|
|
|
8a3219 |
POST_foobar_04 all -- 0.0.0.0/0 10.2.0.0/16 [goto]
|
|
|
8a3219 |
@@ -149,6 +184,7 @@ IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0,
|
|
|
8a3219 |
[[POST_foobar_00 all ::/0 1234:5678::1:1:1 [goto]
|
|
|
8a3219 |
POST_foobar_01 all ::/0 1234:5678::1:1:0/112 [goto]
|
|
|
8a3219 |
POST_foobar_010 all ::/0 1234:5678::10:10:10 [goto]
|
|
|
8a3219 |
+ POST_foobar_012 all ::/0 ::/0 [goto] match-set ipsetv6 dst
|
|
|
8a3219 |
POST_foobar_02 all ::/0 1234:5678::1:0:0/96 [goto]
|
|
|
8a3219 |
POST_foobar_03 all ::/0 1234:5678::2:2:0/112 [goto]
|
|
|
8a3219 |
POST_foobar_04 all ::/0 1234:5678::2:0:0/96 [goto]
|
|
|
8a3219 |
--
|
|
|
8a3219 |
2.20.1
|
|
|
8a3219 |
|