|
 |
725d6a |
From 08cc79942e820d9ce86c5c0bd0249ec4335955ce Mon Sep 17 00:00:00 2001
|
|
|
725d6a |
From: Eric Garver <eric@garver.life>
|
|
|
725d6a |
Date: Fri, 28 Aug 2020 10:48:35 -0400
|
|
|
725d6a |
Subject: [PATCH 56/62] test(regression/rhbz1855140): add negative tests
|
|
|
725d6a |
|
|
|
725d6a |
(cherry picked from commit b50032185422f5538a8a6211cfa43cfaa2d67ec4)
|
|
|
725d6a |
(cherry picked from commit 264375df35124b5920b9d3e690944aaad1e4790c)
|
|
|
725d6a |
---
|
|
|
725d6a |
src/tests/regression/rhbz1855140.at | 23 ++++++++++++++++++++++-
|
|
|
725d6a |
1 file changed, 22 insertions(+), 1 deletion(-)
|
|
|
725d6a |
|
|
|
725d6a |
diff --git a/src/tests/regression/rhbz1855140.at b/src/tests/regression/rhbz1855140.at
|
|
|
725d6a |
index 8059e29fe71a..fbb33a419c56 100644
|
|
|
725d6a |
--- a/src/tests/regression/rhbz1855140.at
|
|
|
725d6a |
+++ b/src/tests/regression/rhbz1855140.at
|
|
|
725d6a |
@@ -4,7 +4,15 @@ AT_KEYWORDS(rich icmp rhbz1855140)
|
|
|
725d6a |
FWD_CHECK([--permanent --zone public --add-rich-rule='rule icmp-type name="echo-request" accept'], 0, ignore)
|
|
|
725d6a |
FWD_CHECK([--permanent --zone public --add-rich-rule='rule icmp-type name="neighbour-advertisement" accept'], 0, ignore)
|
|
|
725d6a |
FWD_CHECK([--permanent --zone public --add-rich-rule='rule icmp-type name="timestamp-request" accept'], 0, ignore)
|
|
|
725d6a |
+FWD_CHECK([--permanent --zone public --add-rich-rule 'rule icmp-type name=bad-header mark set=0x86/0x86'], 0, ignore)
|
|
|
725d6a |
FWD_RELOAD
|
|
|
725d6a |
+NFT_LIST_RULES([inet], [mangle_PRE_public_allow], 0, [dnl
|
|
|
725d6a |
+ table inet firewalld {
|
|
|
725d6a |
+ chain mangle_PRE_public_allow {
|
|
|
725d6a |
+ icmpv6 type parameter-problem icmpv6 code no-route mark set mark & 0x00000086 ^ 0x00000086
|
|
|
725d6a |
+ }
|
|
|
725d6a |
+ }
|
|
|
725d6a |
+])
|
|
|
725d6a |
NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl
|
|
|
725d6a |
table inet firewalld {
|
|
|
725d6a |
chain filter_IN_public_allow {
|
|
|
725d6a |
@@ -18,12 +26,17 @@ NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl
|
|
|
725d6a |
}
|
|
|
725d6a |
}
|
|
|
725d6a |
])
|
|
|
725d6a |
+IPTABLES_LIST_RULES([mangle], [PRE_public_allow], 0, [dnl
|
|
|
725d6a |
+])
|
|
|
725d6a |
IPTABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl
|
|
|
725d6a |
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW,UNTRACKED
|
|
|
725d6a |
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 ctstate NEW,UNTRACKED
|
|
|
725d6a |
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8
|
|
|
725d6a |
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 13
|
|
|
725d6a |
])
|
|
|
725d6a |
+IP6TABLES_LIST_RULES([mangle], [PRE_public_allow], 0, [dnl
|
|
|
725d6a |
+ MARK icmpv6 ::/0 ::/0 ipv6-icmptype 4 code 0 MARK or 0x86
|
|
|
725d6a |
+])
|
|
|
725d6a |
IP6TABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl
|
|
|
725d6a |
ACCEPT tcp ::/0 ::/0 tcp dpt:22 ctstate NEW,UNTRACKED
|
|
|
725d6a |
ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED
|
|
|
725d6a |
@@ -32,4 +45,12 @@ IP6TABLES_LIST_RULES([filter], [IN_public_allow], 0, [dnl
|
|
|
725d6a |
ACCEPT icmpv6 ::/0 ::/0 ipv6-icmptype 136
|
|
|
725d6a |
])
|
|
|
725d6a |
|
|
|
725d6a |
-FWD_END_TEST
|
|
|
725d6a |
+dnl verify bad icmptypes are rejected
|
|
|
725d6a |
+FWD_CHECK([--permanent --add-rich-rule 'rule icmp-type name=bogus mark set=0x86/0x86'], 107, [ignore], [ignore])
|
|
|
725d6a |
+FWD_CHECK([ --add-rich-rule 'rule icmp-type name=bogus mark set=0x86/0x86'], 107, [ignore], [ignore])
|
|
|
725d6a |
+FWD_CHECK([--permanent --add-rich-rule 'rule family=ipv6 icmp-type name=timestamp-request drop'], 107, [ignore], [ignore])
|
|
|
725d6a |
+IF_HOST_SUPPORTS_IPV6_RULES([
|
|
|
725d6a |
+FWD_CHECK([ --add-rich-rule 'rule family=ipv6 icmp-type name=timestamp-request drop'], 107, [ignore], [ignore])
|
|
|
725d6a |
+])
|
|
|
725d6a |
+
|
|
|
725d6a |
+FWD_END_TEST([-e '/ERROR: INVALID_ICMPTYPE:/d'])
|
|
|
725d6a |
--
|
|
|
725d6a |
2.28.0
|
|
|
725d6a |
|