diff -up firewalld-0.3.9/src/tests/firewall-cmd_test.sh.RHBZ#1261502 firewalld-0.3.9/src/tests/firewall-cmd_test.sh

--- firewalld-0.3.9/src/tests/firewall-cmd_test.sh.RHBZ#1261502	2015-09-09 17:20:20.935578859 +0200

+++ firewalld-0.3.9/src/tests/firewall-cmd_test.sh	2015-09-09 17:18:24.729287573 +0200

@@ -0,0 +1,730 @@

+#!/bin/bash

+

+#readonly path="/usr/bin/"

+readonly path="../"

+

+readonly RED='\033[00;31m'

+readonly GREEN='\033[00;32m'

+readonly RESTORE='\033[0m'

+

+assert_good() {

+  local args="${1}"

+

+  ${path}firewall-cmd ${args} > /dev/null

+  if [[ "$?" -eq 0 ]]; then

+    echo "${args} ... OK"

+  else

+    ((failures++))

+    echo -e "${args} ... ${RED}${failures}. FAILED (non-zero exit status)${RESTORE}"

+  fi

+}

+

+assert_good_notempty() {

+  local args="${1}"

+  local ret

+

+  ret=$(${path}firewall-cmd ${args}) > /dev/null

+  if [[ ( "$?" -eq 0 ) && ( -n "${ret}" ) ]]; then

+    echo "${args} ... OK"

+  else

+    ((failures++))

+    echo -e "${args} ... ${RED}${failures}. FAILED (non-zero exit status or empty return value)${RESTORE}"

+  fi

+}

+

+assert_good_empty() {

+  local args="${1}"

+  local ret

+

+  ret=$(${path}firewall-cmd ${args}) > /dev/null

+  if [[ ( "$?" -eq 0 ) && ( -z "${ret}" ) ]]; then

+    echo "${args} ... OK"

+  else

+    ((failures++))

+    echo -e "${args} ... ${RED}${failures}. FAILED (non-zero exit status or non-empty return value)${RESTORE}"

+  fi

+}

+

+assert_good_equals() {

+  local args="${1}"

+  local value="${2}"

+  local ret

+

+  ret=$(${path}firewall-cmd ${args}) > /dev/null

+  if [[ ( "$?" -eq 0 ) && ( "${ret}" = "${value}" ) ]]; then

+    echo "${args} ... OK"

+  else

+    ((failures++))

+    echo -e "${args} ... ${RED}${failures}. FAILED (non-zero exit status or '${ret}' != '${value}')${RESTORE}"

+  fi

+}

+

+assert_good_contains() {

+  local args="${1}"

+  local value="${2}"

+  local ret

+

+  ret=$(${path}firewall-cmd ${args}) > /dev/null

+  if [[ ( "$?" -eq 0 ) && ( "${ret}" = *${value}* ) ]]; then

+    echo "${args} ... OK"

+  else

+    ((failures++))

+    echo -e "${args} ... ${RED}${failures}. FAILED (non-zero exit status or '${ret}' does not contain '${value}')${RESTORE}"

+  fi

+}

+

+assert_bad() {

+  local args="${1}"

+

+  ${path}firewall-cmd ${args} 1> /dev/null 2>&1

+  if [[ "$?" -ne 0 ]]; then

+    echo "${args} ... OK"

+  else

+    ((failures++))

+    echo -e "${args} ... ${RED}${failures}. FAILED (zero exit status)${RESTORE}"

+  fi

+}

+

+assert_bad_contains() {

+  local args="${1}"

+  local value="${2}"

+  local ret

+

+  ret=$(${path}firewall-cmd ${args}) > /dev/null

+  if [[ ( "$?" -ne 0 ) || ( "${ret}" = *${value}* ) ]]; then

+    ((failures++))

+    echo -e "${args} ... ${RED}${failures}. FAILED (non-zero exit status or '${ret}' does contain '${value}')${RESTORE}"

+  else

+    echo "${args} ... OK"

+  fi

+}

+

+# rich rules need separate assert methods because of quotation hell

+assert_rich_good() {

+  local operation="${1}"

+  local args="${2}"

+  local command

+  local permanent

+

+  [[ "${operation}" = *permanent* ]] && permanent="--permanent"

+  if [[ "${operation}" = *add* ]]; then

+    command="--add-rich-rule"

+  elif [[ "${operation}" = *remove* ]]; then

+    command="--remove-rich-rule"

+  elif [[ "${operation}" = *query* ]]; then

+    command="--query-rich-rule"

+  fi

+

+  ${path}firewall-cmd ${permanent} ${command} "${args}" > /dev/null

+  if [[ "$?" -eq 0 ]]; then

+    echo ${permanent} ${command} "${args} ... OK"

+  else

+    ((failures++))

+    echo -e ${permanent} ${command} "${args} ... ${RED}${failures}. FAILED (non-zero exit status)${RESTORE}"

+  fi

+}

+

+assert_rich_bad() {

+  local operation="${1}"

+  local args="${2}"

+  local command

+  local permanent

+

+  [[ "${operation}" = *permanent* ]] && permanent="--permanent"

+  if [[ "${operation}" = *add* ]]; then

+    command="--add-rich-rule"

+  elif [[ "${operation}" = *remove* ]]; then

+    command="--remove-rich-rule"

+  elif [[ "${operation}" = *query* ]]; then

+    command="--query-rich-rule"

+  fi

+

+  ${path}firewall-cmd ${permanent} ${command} "${args}" > /dev/null

+  if [[ "$?" -ne 0 ]]; then

+    echo ${permanent} ${command} "${args} ... OK"

+  else

+    ((failures++))

+    echo -e ${permanent} ${command} "${args} ... ${RED}${failures}. FAILED (zero exit status)${RESTORE}"

+  fi

+}

+

+if ! ${path}firewall-cmd --state --quiet; then

+  echo "FirewallD is not running"

+  exit 1

+fi

+

+# MAIN

+failures=0

+

+assert_good "-h"

+assert_good "--help"

+assert_good "-V"

+assert_good "--reload"

+assert_good "--complete-reload"

+assert_good "--panic-on"

+assert_good "--query-panic"

+assert_good "--panic-off"

+assert_bad  "--query-panic"

+#assert_good "--lockdown-on"

+#assert_good "--query-lockdown"

+#assert_good "--lockdown-off"

+#assert_bad  "--query-lockdown"

+

+default_zone=$(${path}firewall-cmd --get-default-zone)

+zone="home"

+assert_good_notempty "--get-default-zone"

+assert_good          "--set-default-zone=${zone}"

+assert_good_equals   "--get-default-zone" "${zone}"

+assert_good          "--set-default-zone=${default_zone}"

+assert_bad           "--set-default-zone" # missing argument

+

+assert_good_notempty "--get-zones"

+assert_good_notempty "--get-services"

+assert_good_notempty "--get-icmptypes"

+

+assert_good_notempty "--permanent --get-zones"

+assert_good_notempty "--permanent --get-services"

+assert_good_notempty "--permanent --get-icmptypes"

+

+assert_good             "--list-all-zones"

+assert_good             "--list-all"

+assert_good "--permanent --list-all-zones"

+assert_good "--permanent --list-all"

+

+iface="dummy0"

+zone="work"

+assert_good          "--zone=${zone} --add-interface=${iface}"

+assert_good_equals   "--get-zone-of-interface=${iface}" "${zone}"

+assert_good_contains "--get-active-zones" "${zone}"

+assert_good          "--zone ${zone} --query-interface=${iface}"

+zone="public"

+assert_good          "--zone=${zone} --change-interface=${iface}"

+assert_good_equals   "--get-zone-of-interface=${iface}" "${zone}"

+zone="dmz"

+assert_good          "--zone=${zone} --change-zone=${iface}"

+assert_good_equals   "--get-zone-of-interface=${iface}" "${zone}"

+assert_good_contains "--zone=${zone} --list-interfaces" "${iface}"

+assert_good          "--zone=${zone} --remove-interface=${iface}"

+assert_bad           "--zone=${zone} --query-interface ${iface}"

+assert_good          "--zone=${zone} --change-interface=${iface}" # should work as add

+assert_good          "--zone=${zone} --query-interface ${iface}"

+assert_good          "--zone=${zone} --remove-interface=${iface}"

+assert_bad           "--zone=${zone} --query-interface ${iface}"

+assert_bad           "--get-zone-of-interface=${iface}" # in no zone

+assert_bad           "--get-zone-of-interface" # missing argument

+assert_bad           "--zone=${zone} --get-zones" # impossible combination

+assert_bad           "--zone=${zone} --get-services" # impossible combination

+assert_bad           "--zone=${zone} --get-default-zone" # impossible combination

+assert_bad           "--zone=${zone} --set-default-zone" # impossible combination

+assert_bad           "--zone=${zone} --get-zone-of-interface" # impossible combination

+

+iface="perm_dummy0"

+zone="work"

+assert_good          "--permanent --zone=${zone} --add-interface=${iface}"

+assert_good_equals   "--permanent --get-zone-of-interface=${iface}" "${zone}"

+assert_good          "--permanent --zone ${zone} --query-interface=${iface}"

+assert_good_contains "--permanent --zone=${zone} --list-interfaces" "${iface}"

+zone="public"

+assert_bad           "--permanent --zone=${zone} --add-interface=${iface}" # already in another zone

+assert_good          "--permanent --zone=${zone} --change-interface=${iface}"

+assert_good_equals   "--permanent --get-zone-of-interface=${iface}" "${zone}"

+assert_good          "--permanent --zone=${zone} --remove-interface=${iface}"

+assert_bad           "--permanent --zone=${zone} --query-interface ${iface}"

+assert_good          "--permanent --zone=${zone} --change-interface=${iface}" # should work as add

+assert_good_equals   "--permanent --get-zone-of-interface=${iface}" "${zone}"

+assert_good          "--permanent --zone=${zone} --remove-interface=${iface}"

+assert_bad           "--permanent --zone=${zone} --query-interface ${iface}"

+

+iface1="foo"

+iface2="bar"

+zone="trusted"

+assert_good        "--add-interface=${iface1}"

+assert_good        "--add-interface=${iface2} --zone=${default_zone}"

+assert_good        "--set-default-zone=${zone}"

+assert_good_equals "--get-default-zone" "${zone}"

+# check that changing default zone moves interfaces in that zone

+assert_good        "--query-interface ${iface1} --zone=${zone}"

+# check that *only* iface1 was moved to new default zone

+assert_good        "--query-interface ${iface2} --zone=${default_zone}"

+assert_good        "--set-default-zone=${default_zone}"

+assert_good        "--remove-interface=${iface1}"

+assert_good        "--remove-interface=${iface2}"

+

+sources=( "dead:beef::babe" "3ffe:501:ffff::/64" "1.2.3.4" "192.168.1.0/24" )

+for (( i=0;i<${#sources[@]};i++)); do

+  zone="public"

+  source=${sources[${i}]}

+  assert_good          "--zone=${zone} --add-source=${source}"

+  assert_good_equals   "--get-zone-of-source=${source}" "${zone}"

+  assert_good_contains "--zone=${zone} --list-sources" "${source}"

+  assert_good_contains "--zone=${zone} --list-all" "${source}"

+  assert_good_contains "--get-active-zones" "${source}"

+  assert_good          "--zone ${zone} --query-source=${source}"

+  zone="work"

+  assert_good          "--zone=${zone} --change-source=${source}"

+  assert_good_equals   "--get-zone-of-source=${source}" "${zone}"

+  assert_good          "--zone=${zone} --remove-source=${source}"

+  assert_bad           "--zone ${zone} --query-source=${source}"

+  assert_bad           "--get-zone-of-source=${source}" # in no zone

+  assert_bad           "--get-zone-of-source" # missing argument

+done 

+

+for (( i=0;i<${#sources[@]};i++)); do

+  zone="public"

+  source=${sources[${i}]}

+  assert_good          "--permanent --zone=${zone} --add-source=${source}"

+  assert_good_equals   "--permanent --get-zone-of-source=${source}" "${zone}"

+  assert_good_contains "--permanent --zone=${zone} --list-sources" "${source}"

+  assert_good_contains "--permanent --zone=${zone} --list-all" "${source}"

+  assert_good          "--permanent --zone ${zone} --query-source=${source}"

+  zone="work"

+  assert_bad           "--permanent --zone=${zone} --add-source=${source}" # already in another zone

+  assert_good          "--permanent --zone=${zone} --change-source=${source}"

+  assert_good_equals   "--permanent --get-zone-of-source=${source}" "${zone}"

+  assert_good          "--permanent --zone=${zone} --remove-source=${source}"

+  assert_bad           "--permanent --zone ${zone} --query-source=${source}"

+done

+

+assert_good "   --add-service=dns --timeout 60 --zone=${default_zone}"

+assert_good " --query-service dns"

+assert_good "--remove-service=dns"

+assert_bad  " --query-service=dns"

+assert_bad  "   --add-service=smtps" # bad service name

+assert_bad  "   --add-service=dns --timeout" # missing argument

+assert_bad  "   --add-service=dns --add-interface=dummy0" # impossible combination

+

+assert_bad           "--permanent --zone=external --add-service=dns --timeout 60" # impossible combination

+assert_good          "--permanent --zone=external --add-service dns"

+assert_good_contains "--permanent --zone=external --list-services" "dns"

+assert_good          "--permanent --zone=external --query-service dns"

+assert_good          "--permanent --zone=external --remove-service=dns"

+assert_bad           "--permanent --zone=external --query-service=dns" # removed

+assert_bad           "--permanent --zone=external --add-service=smtps" # bad service name

+assert_bad           "--permanent --zone=external --add-service=dns --add-interface=dummy0" # impossible combination

+

+assert_good "   --add-service=http --add-service=nfs --timeout=1h"

+assert_good " --query-service http"

+assert_good " --query-service=nfs --zone=${default_zone}"

+assert_good "--remove-service=nfs --remove-service=http"

+assert_bad  " --query-service http"

+assert_bad  " --query-service nfs"

+

+assert_good "--permanent    --add-service=http --add-service=nfs"

+assert_good "--permanent  --query-service http"

+assert_good "--permanent  --query-service=nfs --zone=${default_zone}"

+assert_good "--permanent --remove-service=nfs --remove-service=http"

+assert_bad  "--permanent  --query-service http"

+assert_bad  "--permanent  --query-service nfs"

+

+assert_bad  "   --add-port=666" # no protocol

+assert_bad  "   --add-port=666/dummy" # bad protocol

+assert_good "   --add-port=666/tcp --zone=${default_zone} --timeout=30m"

+assert_good "--remove-port=666/tcp"

+assert_good "   --add-port=111-222/udp"

+assert_good " --query-port=111-222/udp --zone=${default_zone}"

+assert_good "--remove-port 111-222/udp"

+assert_bad  " --query-port=111-222/udp"

+

+assert_bad  "--permanent    --add-port=666" # no protocol

+assert_bad  "--permanent    --add-port=666/dummy" # bad protocol

+assert_good "--permanent    --add-port=666/tcp"

+assert_good "--permanent --remove-port=666/tcp     --zone=${default_zone}"

+assert_good "--permanent    --add-port=111-222/udp --zone=${default_zone}"

+assert_good "--permanent  --query-port=111-222/udp"

+assert_good "--permanent --remove-port 111-222/udp"

+assert_bad  "--permanent  --query-port=111-222/udp"

+

+assert_good "   --add-port=80/tcp --add-port 443-444/udp"

+assert_good " --query-port=80/tcp --zone=${default_zone}"

+assert_good " --query-port=443-444/udp"

+assert_good "--remove-port 80/tcp --remove-port=443-444/udp"

+assert_bad  " --query-port=80/tcp"

+assert_bad  " --query-port=443-444/udp"

+

+assert_good "--permanent    --add-port=80/tcp --add-port 443-444/udp"

+assert_good "--permanent  --query-port=80/tcp --zone=${default_zone}"

+assert_good "--permanent  --query-port=443-444/udp"

+assert_good "--permanent --remove-port 80/tcp --remove-port=443-444/udp"

+assert_bad  "--permanent  --query-port=80/tcp"

+assert_bad  "--permanent  --query-port=443-444/udp"

+

+assert_good "   --add-masquerade --zone=${default_zone}"

+assert_good " --query-masquerade "

+assert_good "--remove-masquerade"

+assert_bad  " --query-masquerade"

+

+assert_good "--permanent    --add-masquerade"

+assert_good "--permanent  --query-masquerade --zone=${default_zone}"

+assert_good "--permanent --remove-masquerade --zone=${default_zone}"

+assert_bad  "--permanent  --query-masquerade"

+

+assert_bad  "--zone=external    --add-icmp-block=dummyblock" # invalid icmp type

+assert_good "--zone=external    --add-icmp-block=redirect"

+assert_good "--zone=external  --query-icmp-block=redirect"

+assert_good "--zone=external --remove-icmp-block redirect"

+assert_bad  "--zone=external  --query-icmp-block=redirect"

+

+assert_bad  "--permanent --zone=external    --add-icmp-block=dummyblock" # invalid icmp type

+assert_good "--permanent --zone=external    --add-icmp-block=redirect"

+assert_good "--permanent --zone=external  --query-icmp-block=redirect"

+assert_good "--permanent --zone=external --remove-icmp-block redirect"

+assert_bad  "--permanent --zone=external  --query-icmp-block=redirect"

+

+assert_good "--zone=external    --add-icmp-block=echo-reply --add-icmp-block=router-solicitation"

+assert_good "--zone=external  --query-icmp-block=echo-reply"

+assert_good "--zone=external  --query-icmp-block=router-solicitation"

+assert_good "--zone=external --remove-icmp-block echo-reply --remove-icmp-block=router-solicitation"

+assert_bad  "--zone=external  --query-icmp-block=echo-reply"

+assert_bad  "--zone=external  --query-icmp-block=router-solicitation"

+

+assert_good "--permanent --zone=external    --add-icmp-block=echo-reply --add-icmp-block=router-solicitation"

+assert_good "--permanent --zone=external  --query-icmp-block=echo-reply"

+assert_good "--permanent --zone=external  --query-icmp-block=router-solicitation"

+assert_good "--permanent --zone=external --remove-icmp-block echo-reply --remove-icmp-block=router-solicitation"

+assert_bad  "--permanent --zone=external  --query-icmp-block=echo-reply"

+assert_bad  "--permanent --zone=external  --query-icmp-block=router-solicitation"

+

+assert_bad  "   --add-forward-port=666" # no protocol

+assert_good "   --add-forward-port=port=11:proto=tcp:toport=22"

+assert_good "--remove-forward-port=port=11:proto=tcp:toport=22 --zone=${default_zone}"

+assert_bad  "   --add-forward-port=port=33:proto=tcp:toaddr=4444" # bad address

+assert_good "   --add-forward-port=port=33:proto=tcp:toaddr=4.4.4.4 --zone=${default_zone}"

+assert_good "--remove-forward-port=port=33:proto=tcp:toaddr=4.4.4.4"

+assert_good "   --add-forward-port=port=55:proto=tcp:toport=66:toaddr=7.7.7.7"

+assert_good " --query-forward-port port=55:proto=tcp:toport=66:toaddr=7.7.7.7 --zone=${default_zone}"

+assert_good "--remove-forward-port=port=55:proto=tcp:toport=66:toaddr=7.7.7.7"

+assert_bad  " --query-forward-port=port=55:proto=tcp:toport=66:toaddr=7.7.7.7"

+

+assert_bad  "--permanent         --add-forward-port=666" # no protocol

+assert_good "--permanent    --add-forward-port=port=11:proto=tcp:toport=22 --zone=${default_zone}"

+assert_good "--permanent --remove-forward-port=port=11:proto=tcp:toport=22"

+assert_bad  "--permanent    --add-forward-port=port=33:proto=tcp:toaddr=4444" # bad address

+assert_good "--permanent    --add-forward-port=port=33:proto=tcp:toaddr=4.4.4.4"

+assert_good "--permanent --remove-forward-port=port=33:proto=tcp:toaddr=4.4.4.4 --zone=${default_zone}"

+assert_good "--permanent    --add-forward-port=port=55:proto=tcp:toport=66:toaddr=7.7.7.7"

+assert_good "--permanent  --query-forward-port port=55:proto=tcp:toport=66:toaddr=7.7.7.7"

+assert_good "--permanent --remove-forward-port=port=55:proto=tcp:toport=66:toaddr=7.7.7.7"

+assert_bad  "--permanent  --query-forward-port=port=55:proto=tcp:toport=66:toaddr=7.7.7.7"

+

+assert_good "   --add-forward-port=port=88:proto=udp:toport=99 --add-forward-port port=100:proto=tcp:toport=200"

+assert_good " --query-forward-port=port=100:proto=tcp:toport=200"

+assert_good " --query-forward-port=port=88:proto=udp:toport=99 --zone=${default_zone}"

+assert_good "--remove-forward-port port=100:proto=tcp:toport=200 --remove-forward-port=port=88:proto=udp:toport=99"

+assert_bad  " --query-forward-port port=100:proto=tcp:toport=200"

+assert_bad  " --query-forward-port=port=88:proto=udp:toport=99"

+

+assert_good "--permanent    --add-forward-port=port=88:proto=udp:toport=99 --add-forward-port port=100:proto=tcp:toport=200"

+assert_good "--permanent  --query-forward-port=port=100:proto=tcp:toport=200"

+assert_good "--permanent  --query-forward-port=port=88:proto=udp:toport=99 --zone=${default_zone}"

+assert_good "--permanent --remove-forward-port port=100:proto=tcp:toport=200 --remove-forward-port=port=88:proto=udp:toport=99"

+assert_bad  "--permanent  --query-forward-port port=100:proto=tcp:toport=200"

+assert_bad  "--permanent  --query-forward-port=port=88:proto=udp:toport=99"

+

+assert_good_contains "--zone=home --list-services" "ssh"

+assert_good          "--zone home --list-ports"

+assert_good          "--list-icmp-blocks"

+assert_good          "--zone=home --list-forward-ports"

+

+assert_good_contains "--permanent --zone=work --list-services" "ssh"

+assert_good          "--permanent --list-forward-ports"

+

+assert_bad           "--permanent --complete-reload" # impossible combination

+

+myzone="myzone"

+myservice="myservice"

+myicmp="myicmp"

+

+# create new zone

+assert_bad "--new-zone=${myzone}" # no --permanent

+assert_good "--permanent --new-zone=${myzone}"

+assert_good_contains "--permanent --get-zones" "${myzone}"

+# get/set default target

+assert_good_contains "--permanent --zone=${myzone} --get-target" "default"

+assert_bad "--permanent --zone=${myzone} --set-target=BAD"

+assert_good "--permanent --zone=${myzone} --set-target=%%REJECT%%"

+assert_good "--permanent --zone=${myzone} --set-target=DROP"

+assert_good "--permanent --zone=${myzone} --set-target=ACCEPT"

+assert_good_contains "--permanent --zone=${myzone} --get-target" "ACCEPT"

+# create new service and icmptype

+assert_good "--permanent --new-service=${myservice}"

+assert_good_contains "--permanent --get-services" "${myservice}"

+assert_good "--permanent --new-icmptype=${myicmp}"

+assert_good_contains "--permanent --get-icmptypes" "${myicmp}"

+# add them to zone

+assert_good "--permanent --zone=${myzone} --add-service=${myservice}"

+assert_good "--permanent --zone=${myzone} --add-icmp-block=${myicmp}"

+assert_good_contains "--permanent --zone=${myzone} --list-services" "${myservice}"

+assert_good_contains "--permanent --zone=${myzone} --list-icmp-blocks" "${myicmp}"

+# delete the service and icmptype

+assert_good "--permanent --delete-service=${myservice}"

+assert_good "--permanent --delete-icmptype=${myicmp}"

+# make sure they were removed also from the zone

+assert_good_empty "--permanent --zone=${myzone} --list-services" "${myservice}"

+assert_good_empty "--permanent --zone=${myzone} --list-icmp-blocks" "${myicmp}"

+assert_good "--permanent --delete-zone=${myzone}"

+

+

+# ... --direct ...

+modprobe dummy

+assert_good          "--direct --passthrough ipv4 --table mangle --append POSTROUTING --out-interface dummy0 --protocol udp --destination-port 68 --jump CHECKSUM --checksum-fill"

+assert_good          "--direct --passthrough ipv4 --table mangle --delete POSTROUTING --out-interface dummy0 --protocol udp --destination-port 68 --jump CHECKSUM --checksum-fill"

+

+assert_bad           "--direct --add-passthrough ipv7 --table filter -A INPUT --in-interface dummy0 --protocol tcp --destination-port 67 --jump ACCEPT" # bad ipv

+assert_good          "--direct --add-passthrough ipv4 --table filter --append INPUT --in-interface dummy0 --protocol tcp --destination-port 67 --jump ACCEPT"

+assert_bad           "--direct --query-passthrough ipv7 --table filter -A INPUT --in-interface dummy0 --protocol tcp --destination-port 67 --jump ACCEPT" # bad ipv

+assert_good          "--direct --query-passthrough ipv4 --table filter --append INPUT --in-interface dummy0 --protocol tcp --destination-port 67 --jump ACCEPT"

+assert_bad           "--direct --remove-passthrough ipv7 --table filter -A INPUT --in-interface dummy0 --protocol tcp --destination-port 67 --jump ACCEPT" # bad ipv

+assert_good          "--direct --remove-passthrough ipv4 --table filter --append INPUT --in-interface dummy0 --protocol tcp --destination-port 67 --jump ACCEPT"

+assert_bad           "--direct --query-passthrough ipv4 --table filter --append INPUT --in-interface dummy0 --protocol tcp --destination-port 67 --jump ACCEPT"

+

+assert_good          "--direct --add-passthrough ipv6 --table filter --append FORWARD --destination fd00:dead:beef:ff0::/64 --in-interface dummy0 --out-interface dummy0 --jump ACCEPT"

+assert_good_contains "--direct --get-passthroughs ipv6" "fd00:dead:beef:ff0::/64"

+assert_good_contains "--direct --get-all-passthroughs" "fd00:dead:beef:ff0::/64"

+assert_good_contains "--direct --passthrough ipv6 -nvL" "fd00:dead:beef:ff0::/64"

+assert_good          "--direct --remove-passthrough ipv6 --table filter --delete FORWARD --destination fd00:dead:beef:ff0::/64 --in-interface dummy0 --out-interface dummy0 --jump ACCEPT"

+

+assert_bad           "--direct --passthrough ipv5 -nvL" # ipv5

+assert_bad           "--direct --passthrough ipv4" # missing argument

+

+assert_good          "--direct --add-chain ipv4 filter mychain"

+assert_good_contains "--direct --get-chains ipv4 filter" "mychain"

+assert_good_contains "--direct --get-all-chains" "ipv4 filter mychain"

+assert_good          "--direct --query-chain ipv4 filter mychain"

+assert_bad           "--direct --add-chain ipv5 filter mychain" # bad ipv

+assert_bad           "--direct --add-chain ipv4 badtable mychain" # bad table name

+

+assert_good          "--direct --add-rule ipv4 filter mychain 3 -j ACCEPT"

+assert_good_contains "--direct --get-rules ipv4 filter mychain" "3 -j ACCEPT"

+assert_good_contains "--direct --get-all-rules" "ipv4 filter mychain 3 -j ACCEPT"

+assert_good          "--direct --query-rule ipv4 filter mychain 3 -j ACCEPT"

+assert_good          "--direct --remove-rule ipv4 filter mychain 3 -j ACCEPT"

+assert_bad           "--direct --query-rule ipv4 filter mychain 3 -j ACCEPT"

+assert_bad           "--direct --add-rule ipv5 filter mychain 3 -j ACCEPT" # bad ipv

+assert_bad           "--direct --add-rule ipv4 badtable mychain 3 -j ACCEPT" # bad table name

+

+assert_good          "--direct --add-rule ipv4 filter mychain 3 -s 192.168.1.1 -j ACCEPT"

+assert_good          "--direct --add-rule ipv4 filter mychain 4 -s 192.168.1.2 -j ACCEPT"

+assert_good          "--direct --add-rule ipv4 filter mychain 5 -s 192.168.1.3 -j ACCEPT"

+assert_good          "--direct --add-rule ipv4 filter mychain 6 -s 192.168.1.4 -j ACCEPT"

+assert_good_contains "--direct --get-rules ipv4 filter mychain" "3 -s 192.168.1.1 -j ACCEPT"

+assert_good_contains "--direct --get-rules ipv4 filter mychain" "4 -s 192.168.1.2 -j ACCEPT"

+assert_good_contains "--direct --get-rules ipv4 filter mychain" "5 -s 192.168.1.3 -j ACCEPT"

+assert_good_contains "--direct --get-rules ipv4 filter mychain" "6 -s 192.168.1.4 -j ACCEPT"

+assert_good          "--direct --remove-rules ipv4 filter mychain"

+assert_bad           "--direct --query-rule ipv4 filter mychain 3 -s 192.168.1.1 -j ACCEPT"

+assert_bad           "--direct --query-rule ipv4 filter mychain 4 -s 192.168.1.2 -j ACCEPT"

+assert_bad           "--direct --query-rule ipv4 filter mychain 5 -s 192.168.1.3 -j ACCEPT"

+assert_bad           "--direct --query-rule ipv4 filter mychain 6 -s 192.168.1.4 -j ACCEPT"

+

+assert_bad           "--direct --remove-chain ipv5 filter mychain" # bad ipv

+assert_bad           "--direct --remove-chain ipv4 badtable mychain" # bad table name

+assert_good          "--direct --remove-chain ipv4 filter mychain"

+assert_bad           "--direct --query-chain ipv4 filter mychain"

+assert_good          "--direct --remove-chain ipv4 filter dummy" # removing nonexisting chain is just warning

+

+assert_bad           "--direct --reload" # impossible combination

+assert_bad           "--direct --list-all" # impossible combination

+assert_bad           "--direct --get-services" # impossible combination

+assert_bad           "--direct --get-default-zone" # impossible combination

+assert_bad           "--direct --zone=home --list-services" # impossible combination

+assert_bad           "--direct --permanent --list-all" # impossible combination

+assert_bad           "--direct --passthrough --get-chains ipv4 filter" # impossible combination

+

+# ... --permanent --direct ...

+assert_bad           "--permanent --direct --add-passthrough ipv4" # missing argument

+assert_bad           "--permanent --direct --add-passthrough ipv5 -nvL" # bad ipv

+assert_good          "--permanent --direct --add-passthrough ipv4 -nvL"

+assert_good_contains "--permanent --direct --get-passthroughs ipv4" "-nvL"

+assert_good_contains "--permanent --direct --get-all-passthroughs" "ipv4 -nvL"

+assert_good          "--permanent --direct --query-passthrough ipv4 -nvL"

+assert_good          "--permanent --direct --remove-passthrough ipv4 -nvL"

+assert_bad           "--permanent --direct --query-passthrough ipv4 -nvL"

+

+# try some non-ascii magic

+mychain_p="žluťoučký"

+assert_good          "--permanent --direct --add-chain ipv4 filter ${mychain_p}"

+assert_good_contains "--permanent --direct --get-chains ipv4 filter" "${mychain_p}"

+assert_good_contains "--permanent --direct --get-all-chains" "ipv4 filter ${mychain_p}"

+assert_good          "--permanent --direct --query-chain ipv4 filter ${mychain_p}"

+assert_bad           "--permanent --direct --add-chain ipv5 filter ${mychain_p}" # bad ipv

+assert_bad           "--permanent --direct --add-chain ipv4 badtable ${mychain_p}" # bad table name

+

+assert_good          "--permanent --direct --add-rule ipv4 filter ${mychain_p} 3 -j ACCEPT"

+assert_good_contains "--permanent --direct --get-rules ipv4 filter ${mychain_p}" "ACCEPT"

+assert_good_contains "--permanent --direct --get-all-rules" "ipv4 filter ${mychain_p} 3 -j ACCEPT"

+assert_good          "--permanent --direct --query-rule ipv4 filter ${mychain_p} 3 -j ACCEPT"

+assert_good          "--permanent --direct --remove-rule ipv4 filter ${mychain_p} 3 -j ACCEPT"

+assert_bad           "--permanent --direct --query-rule ipv4 filter ${mychain_p} 3 -j ACCEPT"

+assert_bad           "--permanent --direct --add-rule ipv5 filter ${mychain_p} 3 -j ACCEPT" # bad ipv

+assert_bad           "--permanent --direct --add-rule ipv4 badtable ${mychain_p} 3 -j ACCEPT" # bad table name

+

+assert_good          "--permanent --direct --add-rule ipv4 filter ${mychain_p} 3 -s 192.168.1.1 -j ACCEPT"

+assert_good          "--permanent --direct --add-rule ipv4 filter ${mychain_p} 4 -s 192.168.1.2 -j ACCEPT"

+assert_good          "--permanent --direct --add-rule ipv4 filter ${mychain_p} 5 -s 192.168.1.3 -j ACCEPT"

+assert_good          "--permanent --direct --add-rule ipv4 filter ${mychain_p} 6 -s 192.168.1.4 -j ACCEPT"

+assert_good_contains "--permanent --direct --get-rules ipv4 filter ${mychain_p}" "3 -s 192.168.1.1 -j ACCEPT"

+assert_good_contains "--permanent --direct --get-rules ipv4 filter ${mychain_p}" "4 -s 192.168.1.2 -j ACCEPT"

+assert_good_contains "--permanent --direct --get-rules ipv4 filter ${mychain_p}" "5 -s 192.168.1.3 -j ACCEPT"

+assert_good_contains "--permanent --direct --get-rules ipv4 filter ${mychain_p}" "6 -s 192.168.1.4 -j ACCEPT"

+assert_good          "--permanent --direct --remove-rules ipv4 filter ${mychain_p}"

+assert_bad           "--permanent --direct --query-rule ipv4 filter ${mychain_p} 3 -s 192.168.1.1 -j ACCEPT"

+assert_bad           "--permanent --direct --query-rule ipv4 filter ${mychain_p} 4 -s 192.168.1.2 -j ACCEPT"

+assert_bad           "--permanent --direct --query-rule ipv4 filter ${mychain_p} 5 -s 192.168.1.3 -j ACCEPT"

+assert_bad           "--permanent --direct --query-rule ipv4 filter ${mychain_p} 6 -s 192.168.1.4 -j ACCEPT"

+

+assert_bad           "--permanent --direct --remove-chain ipv5 filter ${mychain_p}" # bad ipv

+assert_good          "--permanent --direct --remove-chain ipv4 filter ${mychain_p}"

+assert_bad           "--permanent --direct --query-chain ipv4 filter ${mychain_p}"

+assert_good          "--permanent --direct --remove-chain ipv4 filter dummy" # removing nonexisting chain is just warning

+

+rule1="ipv4 nat OUTPUT 0 -s 1.2.3.4 -d 1.2.3.4 -p tcp --dport 80 -j REDIRECT --to-ports 81"

+rule2="ipv4 nat OUTPUT 0 -s 1.2.3.4 -d 1.2.3.4 -p tcp --dport 80 -j REDIRECT --to-ports 82"

+assert_good          "--permanent --direct --add-rule ${rule1}"

+assert_good_contains "--permanent --direct --get-all-rules" "${rule1}"

+assert_good          "--reload"

+assert_good_contains "--direct --get-all-rules" "${rule1}"

+assert_good          "--permanent --direct --remove-rule ${rule1}"

+assert_good          "--permanent --direct --add-rule ${rule2}"

+assert_good_contains "--permanent --direct --get-all-rules" "${rule2}"

+assert_good          "--reload"

+assert_bad_contains  "--direct --get-all-rules" "${rule1}"

+assert_good_contains "--direct --get-all-rules" "${rule2}"

+assert_good          "--permanent --direct --remove-rule ${rule2}"

+assert_good          "--reload"

+assert_bad_contains  "--direct --get-all-rules" "${rule2}"

+

+# lockdown

+

+cmd="/usr/bin/command"

+ctxt="system_u:system_r:MadDaemon_t:s0"

+uid="6666"

+user="theboss"

+

+assert_good          "--add-lockdown-whitelist-command ${cmd}"

+assert_good          "--query-lockdown-whitelist-command ${cmd}"

+assert_good_contains "--list-lockdown-whitelist-commands" "${cmd}"

+assert_good          "--remove-lockdown-whitelist-command ${cmd}"

+assert_bad           "--query-lockdown-whitelist-command ${cmd}"  # already removed

+

+assert_good          "--add-lockdown-whitelist-context ${ctxt}"

+assert_good          "--query-lockdown-whitelist-context ${ctxt}"

+assert_good_contains "--list-lockdown-whitelist-contexts" "${ctxt}"

+assert_good          "--remove-lockdown-whitelist-context ${ctxt}"

+assert_bad           "--query-lockdown-whitelist-context ${ctxt}"  # already removed

+

+assert_good          "--add-lockdown-whitelist-uid ${uid}"

+assert_good          "--query-lockdown-whitelist-uid ${uid}"

+assert_good_contains "--list-lockdown-whitelist-uids" "${uid}"

+assert_good          "--remove-lockdown-whitelist-uid ${uid}"

+assert_bad           "--query-lockdown-whitelist-uid ${uid}"   # already removed

+assert_bad           "--add-lockdown-whitelist-uid ${uid}x"    # bad uid

+

+assert_good          "--add-lockdown-whitelist-user ${user}"

+assert_good          "--query-lockdown-whitelist-user ${user}"

+assert_good_contains "--list-lockdown-whitelist-users" "${user}"

+assert_good          "--remove-lockdown-whitelist-user ${user}"

+assert_bad           "--query-lockdown-whitelist-user ${user}"  # already removed

+

+assert_good          "--permanent --add-lockdown-whitelist-command ${cmd}"

+assert_good          "--permanent --query-lockdown-whitelist-command ${cmd}"

+assert_good_contains "--permanent --list-lockdown-whitelist-commands" "${cmd}"

+assert_good          "--permanent --remove-lockdown-whitelist-command ${cmd}"

+assert_bad           "--permanent --query-lockdown-whitelist-command ${cmd}"  # already removed

+

+assert_good          "--permanent --add-lockdown-whitelist-context ${ctxt}"

+assert_good          "--permanent --query-lockdown-whitelist-context ${ctxt}"

+assert_good_contains "--permanent --list-lockdown-whitelist-contexts" "${ctxt}"

+assert_good          "--permanent --remove-lockdown-whitelist-context ${ctxt}"

+assert_bad           "--permanent --query-lockdown-whitelist-context ${ctxt}"  # already removed

+

+assert_good          "--permanent --add-lockdown-whitelist-uid ${uid}"

+assert_good          "--permanent --query-lockdown-whitelist-uid ${uid}"

+assert_good_contains "--permanent --list-lockdown-whitelist-uids" "${uid}"

+assert_good          "--permanent --remove-lockdown-whitelist-uid ${uid}"

+assert_bad           "--permanent --query-lockdown-whitelist-uid ${uid}"   # already removed

+assert_bad           "--permanent --add-lockdown-whitelist-uid ${uid}x"    # bad uid

+

+assert_good          "--permanent --add-lockdown-whitelist-user ${user}"

+assert_good          "--permanent --query-lockdown-whitelist-user ${user}"

+assert_good_contains "--permanent --list-lockdown-whitelist-users" "${user}"

+assert_good          "--permanent --remove-lockdown-whitelist-user ${user}"

+assert_bad           "--permanent --query-lockdown-whitelist-user ${user}"  # already removed

+

+

+# rich rules

+

+bad_rules=(

+ ''                                                         # empty

+ 'family="ipv6" accept'                                     # no 'rule'

+ 'name="dns" accept'                                        # no 'rule'

+ 'protocol value="ah" reject'                               # no 'rule'

+ 'rule protocol value="ah" reject type="icmp-host-prohibited"' # reject type needs specific family

+ 'rule family="ipv4" protocol value="ah" reject type="dummy"'  # dummy reject type

+ 'rule'                                                     # no element

+ 'rule bad_element'                                         # no unknown element

+ 'rule family="ipv5"'                                       # bad family

+ 'rule name="dns" accept'                                   # name outside of element

+ 'rule protocol="ah" accept'                                # bad protocol usage

+ 'rule protocol value="ah" accept drop'                     # accept && drop

+ 'rule service name="radius" port port="4011" reject'       # service && port

+ 'rule service bad_attribute="dns"'                         # bad attribute

+ 'rule protocol value="mtp" log level="eror"'               # bad log level

+ 'rule source address="1:2:3:4:6::" icmp-block name="redirect" log level="info" limit value="1/2m"'         # bad limit

+ 'rule protocol value="esp"'                                # no action/log/audit

+ 'rule family="ipv4" masquerade drop'                       # masquerade & action

+ 'rule family="ipv4" destination address="192.168.1.0/24" masquerade' # masquerade & destination

+ 'rule family="ipv4" icmp-block name="redirect" accept'     # icmp-block & action

+ 'rule forward-port port="2222" to-port="22" protocol="tcp" family="ipv4" accept' # forward-port & action

+)

+

+for (( i=0;i<${#bad_rules[@]};i++)); do

+  rule=${bad_rules[${i}]}

+  assert_rich_bad           "add"    "${rule}"

+done

+

+for (( i=0;i<${#bad_rules[@]};i++)); do

+  rule=${bad_rules[${i}]}

+  assert_rich_bad           "permanent add"    "${rule}"

+done

+

+good_rules=(

+ 'rule service name="ftp" audit limit value="1/m" accept'

+ 'rule protocol value="ah" reject'

+ 'rule protocol value="esp" accept'

+ 'rule protocol value="sctp" log'

+ 'rule family="ipv4" source address="192.168.0.0/24" service name="tftp" log prefix="tftp" level="info" limit value="1/m" accept'

+# disable this test as the chenge is not backported yet 'rule family="ipv4" source not address="192.168.0.0/24" service name="dns" log prefix="dns" level="info" limit value="2/m" drop'

+ 'rule family="ipv6" source address="1:2:3:4:6::" service name="radius" log prefix="dns" level="info" limit value="3/m" reject type="icmp6-addr-unreachable" limit value="20/m"'

+ 'rule family="ipv6" source address="1:2:3:4:6::" port port="4011" protocol="tcp" log prefix="port 4011/tcp" level="info" limit value="4/m" drop'

+ 'rule family="ipv6" source address="1:2:3:4:6::" forward-port port="4011" protocol="tcp" to-port="4012" to-addr="1::2:3:4:7"'

+ 'rule family="ipv4" destination address="1.2.3.4" forward-port port="4011" protocol="tcp" to-port="4012" to-addr="9.8.7.6"'

+ 'rule family="ipv4" source address="192.168.0.0/24" icmp-block name="source-quench" log prefix="source-quench" level="info" limit value="4/m"'

+ 'rule family="ipv6" source address="1:2:3:4:6::" icmp-block name="redirect" log prefix="redirect" level="info" limit value="4/m"'

+ 'rule family="ipv4" source address="192.168.1.0/24" masquerade'

+ 'rule family="ipv6" masquerade'

+ 'rule forward-port port="2222" to-port="22" to-addr="192.168.100.2" protocol="tcp" family="ipv4" source address="192.168.2.100"')

+

+for (( i=0;i<${#good_rules[@]};i++)); do

+  rule=${good_rules[${i}]}

+  assert_rich_good          "add"    "${rule}"

+  assert_rich_good          "query"  "${rule}"

+  assert_rich_good          "remove" "${rule}"

+  assert_rich_bad           "query"  "${rule}"

+done

+

+for (( i=0;i<${#good_rules[@]};i++)); do