|
 |
136e2c |
From 959584ced5e1c1853b62ff5e15c3e9fa49837ea4 Mon Sep 17 00:00:00 2001
|
|
|
136e2c |
From: Eric Garver <eric@garver.life>
|
|
|
136e2c |
Date: Thu, 30 May 2019 16:16:51 -0400
|
|
|
136e2c |
Subject: [PATCH 60/73] test: add coverage for #258 and #441
|
|
|
136e2c |
|
|
|
136e2c |
(cherry picked from commit 0c49548a4954a0c5f2a982fd3a46b135afa74965)
|
|
|
136e2c |
(cherry picked from commit 87235daf6290eba20c38178edca6c9bd7475caf3)
|
|
|
136e2c |
---
|
|
|
136e2c |
src/tests/regression.at | 1 +
|
|
|
136e2c |
src/tests/regression/gh258.at | 441 ++++++++++++++++++++++++++++++++++
|
|
|
136e2c |
2 files changed, 442 insertions(+)
|
|
|
136e2c |
create mode 100644 src/tests/regression/gh258.at
|
|
|
136e2c |
|
|
|
136e2c |
diff --git a/src/tests/regression.at b/src/tests/regression.at
|
|
|
136e2c |
index 8bcb576238e6..00690fc6459e 100644
|
|
|
136e2c |
--- a/src/tests/regression.at
|
|
|
136e2c |
+++ b/src/tests/regression.at
|
|
|
136e2c |
@@ -19,3 +19,4 @@ m4_include([regression/gh335.at])
|
|
|
136e2c |
m4_include([regression/gh482.at])
|
|
|
136e2c |
m4_include([regression/gh478.at])
|
|
|
136e2c |
m4_include([regression/gh453.at])
|
|
|
136e2c |
+m4_include([regression/gh258.at])
|
|
|
136e2c |
diff --git a/src/tests/regression/gh258.at b/src/tests/regression/gh258.at
|
|
|
136e2c |
new file mode 100644
|
|
|
136e2c |
index 000000000000..d0c4f2fa7432
|
|
|
136e2c |
--- /dev/null
|
|
|
136e2c |
+++ b/src/tests/regression/gh258.at
|
|
|
136e2c |
@@ -0,0 +1,441 @@
|
|
|
136e2c |
+FWD_START_TEST([zone dispatch layout])
|
|
|
136e2c |
+AT_KEYWORDS(zone gh258 gh441)
|
|
|
136e2c |
+
|
|
|
136e2c |
+FWD_CHECK([--zone=work --add-source="1.2.3.0/24"], 0, ignore)
|
|
|
136e2c |
+IF_IPV6_SUPPORTED([
|
|
|
136e2c |
+FWD_CHECK([--zone=public --add-source="dead:beef::/54"], 0, ignore)
|
|
|
136e2c |
+])
|
|
|
136e2c |
+FWD_CHECK([--zone=work --add-interface=dummy0], 0, ignore)
|
|
|
136e2c |
+FWD_CHECK([--zone=public --add-interface=dummy1], 0, ignore)
|
|
|
136e2c |
+
|
|
|
136e2c |
+dnl verify layout of zone dispatch
|
|
|
136e2c |
+m4_if(nftables, FIREWALL_BACKEND, [
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [filter_INPUT], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain filter_INPUT {
|
|
|
136e2c |
+ ct state established,related accept
|
|
|
136e2c |
+ iifname "lo" accept
|
|
|
136e2c |
+ jump filter_INPUT_ZONES
|
|
|
136e2c |
+ ct state invalid drop
|
|
|
136e2c |
+ reject with icmpx type admin-prohibited
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [filter_INPUT_ZONES], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain filter_INPUT_ZONES {
|
|
|
136e2c |
+ ip6 saddr dead:beef::/54 goto filter_IN_public
|
|
|
136e2c |
+ ip saddr 1.2.3.0/24 goto filter_IN_work
|
|
|
136e2c |
+ goto filter_INPUT_ZONES_IFACES
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [filter_INPUT_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain filter_INPUT_ZONES_IFACES {
|
|
|
136e2c |
+ iifname "dummy1" goto filter_IN_public
|
|
|
136e2c |
+ iifname "dummy0" goto filter_IN_work
|
|
|
136e2c |
+ goto filter_IN_public
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [filter_FORWARD], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain filter_FORWARD {
|
|
|
136e2c |
+ ct state established,related accept
|
|
|
136e2c |
+ iifname "lo" accept
|
|
|
136e2c |
+ jump filter_FORWARD_IN_ZONES
|
|
|
136e2c |
+ jump filter_FORWARD_OUT_ZONES
|
|
|
136e2c |
+ ct state invalid drop
|
|
|
136e2c |
+ reject with icmpx type admin-prohibited
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [filter_FORWARD_IN_ZONES], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain filter_FORWARD_IN_ZONES {
|
|
|
136e2c |
+ ip6 saddr dead:beef::/54 goto filter_FWDI_public
|
|
|
136e2c |
+ ip saddr 1.2.3.0/24 goto filter_FWDI_work
|
|
|
136e2c |
+ goto filter_FORWARD_IN_ZONES_IFACES
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [filter_FORWARD_IN_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain filter_FORWARD_IN_ZONES_IFACES {
|
|
|
136e2c |
+ iifname "dummy1" goto filter_FWDI_public
|
|
|
136e2c |
+ iifname "dummy0" goto filter_FWDI_work
|
|
|
136e2c |
+ goto filter_FWDI_public
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [filter_FORWARD_OUT_ZONES], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain filter_FORWARD_OUT_ZONES {
|
|
|
136e2c |
+ ip6 daddr dead:beef::/54 goto filter_FWDO_public
|
|
|
136e2c |
+ ip daddr 1.2.3.0/24 goto filter_FWDO_work
|
|
|
136e2c |
+ goto filter_FORWARD_OUT_ZONES_IFACES
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [filter_FORWARD_OUT_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain filter_FORWARD_OUT_ZONES_IFACES {
|
|
|
136e2c |
+ oifname "dummy1" goto filter_FWDO_public
|
|
|
136e2c |
+ oifname "dummy0" goto filter_FWDO_work
|
|
|
136e2c |
+ goto filter_FWDO_public
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [raw_PREROUTING], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain raw_PREROUTING {
|
|
|
136e2c |
+ m4_if(yes, HOST_SUPPORTS_NFT_FIB, [dnl
|
|
|
136e2c |
+ icmpv6 type { nd-router-advert, nd-neighbor-solicit } accept
|
|
|
136e2c |
+ meta nfproto ipv6 fib saddr . iif oif missing drop
|
|
|
136e2c |
+ ])dnl
|
|
|
136e2c |
+ jump raw_PREROUTING_ZONES
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [raw_PREROUTING_ZONES], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain raw_PREROUTING_ZONES {
|
|
|
136e2c |
+ ip6 saddr dead:beef::/54 goto raw_PRE_public
|
|
|
136e2c |
+ ip saddr 1.2.3.0/24 goto raw_PRE_work
|
|
|
136e2c |
+ goto raw_PREROUTING_ZONES_IFACES
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [raw_PREROUTING_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain raw_PREROUTING_ZONES_IFACES {
|
|
|
136e2c |
+ iifname "dummy1" goto raw_PRE_public
|
|
|
136e2c |
+ iifname "dummy0" goto raw_PRE_work
|
|
|
136e2c |
+ goto raw_PRE_public
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [mangle_PREROUTING], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain mangle_PREROUTING {
|
|
|
136e2c |
+ jump mangle_PREROUTING_ZONES
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [mangle_PREROUTING_ZONES], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain mangle_PREROUTING_ZONES {
|
|
|
136e2c |
+ ip6 saddr dead:beef::/54 goto mangle_PRE_public
|
|
|
136e2c |
+ ip saddr 1.2.3.0/24 goto mangle_PRE_work
|
|
|
136e2c |
+ goto mangle_PREROUTING_ZONES_IFACES
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([inet], [mangle_PREROUTING_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ table inet firewalld {
|
|
|
136e2c |
+ chain mangle_PREROUTING_ZONES_IFACES {
|
|
|
136e2c |
+ iifname "dummy1" goto mangle_PRE_public
|
|
|
136e2c |
+ iifname "dummy0" goto mangle_PRE_work
|
|
|
136e2c |
+ goto mangle_PRE_public
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([ip], [nat_PREROUTING], 0, [dnl
|
|
|
136e2c |
+ table ip firewalld {
|
|
|
136e2c |
+ chain nat_PREROUTING {
|
|
|
136e2c |
+ jump nat_PREROUTING_ZONES
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([ip], [nat_PREROUTING_ZONES], 0, [dnl
|
|
|
136e2c |
+ table ip firewalld {
|
|
|
136e2c |
+ chain nat_PREROUTING_ZONES {
|
|
|
136e2c |
+ ip saddr 1.2.3.0/24 goto nat_PRE_work
|
|
|
136e2c |
+ goto nat_PREROUTING_ZONES_IFACES
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([ip], [nat_PREROUTING_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ table ip firewalld {
|
|
|
136e2c |
+ chain nat_PREROUTING_ZONES_IFACES {
|
|
|
136e2c |
+ iifname "dummy1" goto nat_PRE_public
|
|
|
136e2c |
+ iifname "dummy0" goto nat_PRE_work
|
|
|
136e2c |
+ goto nat_PRE_public
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([ip], [nat_POSTROUTING], 0, [dnl
|
|
|
136e2c |
+ table ip firewalld {
|
|
|
136e2c |
+ chain nat_POSTROUTING {
|
|
|
136e2c |
+ jump nat_POSTROUTING_ZONES
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES], 0, [dnl
|
|
|
136e2c |
+ table ip firewalld {
|
|
|
136e2c |
+ chain nat_POSTROUTING_ZONES {
|
|
|
136e2c |
+ ip daddr 1.2.3.0/24 goto nat_POST_work
|
|
|
136e2c |
+ goto nat_POSTROUTING_ZONES_IFACES
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ table ip firewalld {
|
|
|
136e2c |
+ chain nat_POSTROUTING_ZONES_IFACES {
|
|
|
136e2c |
+ oifname "dummy1" goto nat_POST_public
|
|
|
136e2c |
+ oifname "dummy0" goto nat_POST_work
|
|
|
136e2c |
+ goto nat_POST_public
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([ip6], [nat_PREROUTING], 0, [dnl
|
|
|
136e2c |
+ table ip6 firewalld {
|
|
|
136e2c |
+ chain nat_PREROUTING {
|
|
|
136e2c |
+ jump nat_PREROUTING_ZONES
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([ip6], [nat_PREROUTING_ZONES], 0, [dnl
|
|
|
136e2c |
+ table ip6 firewalld {
|
|
|
136e2c |
+ chain nat_PREROUTING_ZONES {
|
|
|
136e2c |
+ ip6 saddr dead:beef::/54 goto nat_PRE_public
|
|
|
136e2c |
+ goto nat_PREROUTING_ZONES_IFACES
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([ip6], [nat_PREROUTING_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ table ip6 firewalld {
|
|
|
136e2c |
+ chain nat_PREROUTING_ZONES_IFACES {
|
|
|
136e2c |
+ iifname "dummy1" goto nat_PRE_public
|
|
|
136e2c |
+ iifname "dummy0" goto nat_PRE_work
|
|
|
136e2c |
+ goto nat_PRE_public
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([ip6], [nat_POSTROUTING], 0, [dnl
|
|
|
136e2c |
+ table ip6 firewalld {
|
|
|
136e2c |
+ chain nat_POSTROUTING {
|
|
|
136e2c |
+ jump nat_POSTROUTING_ZONES
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES], 0, [dnl
|
|
|
136e2c |
+ table ip6 firewalld {
|
|
|
136e2c |
+ chain nat_POSTROUTING_ZONES {
|
|
|
136e2c |
+ ip6 daddr dead:beef::/54 goto nat_POST_public
|
|
|
136e2c |
+ goto nat_POSTROUTING_ZONES_IFACES
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ table ip firewalld {
|
|
|
136e2c |
+ chain nat_POSTROUTING_ZONES_IFACES {
|
|
|
136e2c |
+ oifname "dummy1" goto nat_POST_public
|
|
|
136e2c |
+ oifname "dummy0" goto nat_POST_work
|
|
|
136e2c |
+ goto nat_POST_public
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+ }
|
|
|
136e2c |
+])
|
|
|
136e2c |
+], [
|
|
|
136e2c |
+
|
|
|
136e2c |
+IPTABLES_LIST_RULES([filter], [INPUT], 0, [dnl
|
|
|
136e2c |
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
|
|
|
136e2c |
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ INPUT_direct all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ INPUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
|
|
|
136e2c |
+ REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([filter], [INPUT_ZONES], 0, [dnl
|
|
|
136e2c |
+ IN_work all -- 1.2.3.0/24 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ INPUT_ZONES_IFACES all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([filter], [INPUT_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ IN_public all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ IN_work all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ IN_public all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
|
|
|
136e2c |
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
|
|
|
136e2c |
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ FORWARD_direct all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ FORWARD_IN_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ FORWARD_OUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
|
|
|
136e2c |
+ REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([filter], [FORWARD_IN_ZONES], 0, [dnl
|
|
|
136e2c |
+ FWDI_work all -- 1.2.3.0/24 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ FORWARD_IN_ZONES_IFACES all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([filter], [FORWARD_IN_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ FWDI_work all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES], 0, [dnl
|
|
|
136e2c |
+ FWDO_work all -- 0.0.0.0/0 1.2.3.0/24 @<:@goto@:>@
|
|
|
136e2c |
+ FORWARD_OUT_ZONES_IFACES all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ FWDO_work all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
|
|
|
136e2c |
+ PREROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([raw], [PREROUTING_ZONES], 0, [dnl
|
|
|
136e2c |
+ PRE_work all -- 1.2.3.0/24 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ PREROUTING_ZONES_IFACES all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([raw], [PREROUTING_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ PRE_work all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
|
|
|
136e2c |
+ PREROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([mangle], [PREROUTING_ZONES], 0, [dnl
|
|
|
136e2c |
+ PRE_work all -- 1.2.3.0/24 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ PREROUTING_ZONES_IFACES all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([mangle], [PREROUTING_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ PRE_work all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
|
|
|
136e2c |
+ PREROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([nat], [PREROUTING_ZONES], 0, [dnl
|
|
|
136e2c |
+ PRE_work all -- 1.2.3.0/24 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ PREROUTING_ZONES_IFACES all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([nat], [PREROUTING_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ PRE_work all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ PRE_public all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
|
|
|
136e2c |
+ POSTROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+ POSTROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0, [dnl
|
|
|
136e2c |
+ POST_work all -- 0.0.0.0/0 1.2.3.0/24 @<:@goto@:>@
|
|
|
136e2c |
+ POSTROUTING_ZONES_IFACES all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IPTABLES_LIST_RULES([nat], [POSTROUTING_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ POST_public all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ POST_work all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+ POST_public all -- 0.0.0.0/0 0.0.0.0/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+
|
|
|
136e2c |
+
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([filter], [INPUT], 0, [dnl
|
|
|
136e2c |
+ ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED
|
|
|
136e2c |
+ ACCEPT all ::/0 ::/0
|
|
|
136e2c |
+ INPUT_direct all ::/0 ::/0
|
|
|
136e2c |
+ INPUT_ZONES all ::/0 ::/0
|
|
|
136e2c |
+ DROP all ::/0 ::/0 ctstate INVALID
|
|
|
136e2c |
+ REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([filter], [INPUT_ZONES], 0, [dnl
|
|
|
136e2c |
+ IN_public all dead:beef::/54 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ INPUT_ZONES_IFACES all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([filter], [INPUT_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ IN_public all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ IN_work all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ IN_public all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([filter], [FORWARD], 0, [dnl
|
|
|
136e2c |
+ ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED
|
|
|
136e2c |
+ ACCEPT all ::/0 ::/0
|
|
|
136e2c |
+ FORWARD_direct all ::/0 ::/0
|
|
|
136e2c |
+ FORWARD_IN_ZONES all ::/0 ::/0
|
|
|
136e2c |
+ FORWARD_OUT_ZONES all ::/0 ::/0
|
|
|
136e2c |
+ DROP all ::/0 ::/0 ctstate INVALID
|
|
|
136e2c |
+ REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([filter], [FORWARD_IN_ZONES], 0, [dnl
|
|
|
136e2c |
+ FWDI_public all dead:beef::/54 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ FORWARD_IN_ZONES_IFACES all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([filter], [FORWARD_IN_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ FWDI_public all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ FWDI_work all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ FWDI_public all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES], 0, [dnl
|
|
|
136e2c |
+ FWDO_public all ::/0 dead:beef::/54 @<:@goto@:>@
|
|
|
136e2c |
+ FORWARD_OUT_ZONES_IFACES all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([filter], [FORWARD_OUT_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ FWDO_public all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ FWDO_work all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ FWDO_public all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([raw], [PREROUTING], 0, [dnl
|
|
|
136e2c |
+ ACCEPT icmpv6 ::/0 ::/0 ipv6-icmptype 134
|
|
|
136e2c |
+ ACCEPT icmpv6 ::/0 ::/0 ipv6-icmptype 135
|
|
|
136e2c |
+ DROP all ::/0 ::/0 rpfilter invert
|
|
|
136e2c |
+ PREROUTING_direct all ::/0 ::/0
|
|
|
136e2c |
+ PREROUTING_ZONES all ::/0 ::/0
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([raw], [PREROUTING_ZONES], 0, [dnl
|
|
|
136e2c |
+ PRE_public all dead:beef::/54 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ PREROUTING_ZONES_IFACES all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([raw], [PREROUTING_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ PRE_public all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ PRE_work all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ PRE_public all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([mangle], [PREROUTING], 0, [dnl
|
|
|
136e2c |
+ PREROUTING_direct all ::/0 ::/0
|
|
|
136e2c |
+ PREROUTING_ZONES all ::/0 ::/0
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([mangle], [PREROUTING_ZONES], 0, [dnl
|
|
|
136e2c |
+ PRE_public all dead:beef::/54 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ PREROUTING_ZONES_IFACES all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([mangle], [PREROUTING_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ PRE_public all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ PRE_work all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ PRE_public all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([nat], [PREROUTING], 0, [dnl
|
|
|
136e2c |
+ PREROUTING_direct all ::/0 ::/0
|
|
|
136e2c |
+ PREROUTING_ZONES all ::/0 ::/0
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([nat], [PREROUTING_ZONES], 0, [dnl
|
|
|
136e2c |
+ PRE_public all dead:beef::/54 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ PREROUTING_ZONES_IFACES all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([nat], [PREROUTING_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ PRE_public all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ PRE_work all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ PRE_public all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([nat], [POSTROUTING], 0, [dnl
|
|
|
136e2c |
+ POSTROUTING_direct all ::/0 ::/0
|
|
|
136e2c |
+ POSTROUTING_ZONES all ::/0 ::/0
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES], 0, [dnl
|
|
|
136e2c |
+ POST_public all ::/0 dead:beef::/54 @<:@goto@:>@
|
|
|
136e2c |
+ POSTROUTING_ZONES_IFACES all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+IP6TABLES_LIST_RULES([nat], [POSTROUTING_ZONES_IFACES], 0, [dnl
|
|
|
136e2c |
+ POST_public all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ POST_work all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+ POST_public all ::/0 ::/0 @<:@goto@:>@
|
|
|
136e2c |
+])
|
|
|
136e2c |
+])
|
|
|
136e2c |
+
|
|
|
136e2c |
+FWD_END_TEST
|
|
|
136e2c |
--
|
|
|
136e2c |
2.20.1
|
|
|
136e2c |
|