You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
176 lines
7.2 KiB
176 lines
7.2 KiB
From 5f092d3665463b764b957ef219010e0640babde7 Mon Sep 17 00:00:00 2001 |
|
From: Eric Garver <eric@garver.life> |
|
Date: Mon, 30 Jan 2023 14:43:18 -0500 |
|
Subject: [PATCH 4/4] v1.4.0: test(direct): avoid iptables flush if using |
|
nftables backend |
|
|
|
Coverage: #863 |
|
(cherry picked from commit dcd0dd3674ea8ef757a1b41f6b53717a45e821aa) |
|
--- |
|
src/tests/features/features.at | 1 + |
|
.../features/iptables_no_flush_on_shutdown.at | 144 ++++++++++++++++++ |
|
2 files changed, 145 insertions(+) |
|
create mode 100644 src/tests/features/iptables_no_flush_on_shutdown.at |
|
|
|
diff --git a/src/tests/features/features.at b/src/tests/features/features.at |
|
index 96b098de6e82..59725eb9fdf4 100644 |
|
--- a/src/tests/features/features.at |
|
+++ b/src/tests/features/features.at |
|
@@ -18,3 +18,4 @@ m4_include([features/rpfilter.at]) |
|
m4_include([features/zone_combine.at]) |
|
m4_include([features/startup_failsafe.at]) |
|
m4_include([features/ipset.at]) |
|
+m4_include([features/iptables_no_flush_on_shutdown.at]) |
|
diff --git a/src/tests/features/iptables_no_flush_on_shutdown.at b/src/tests/features/iptables_no_flush_on_shutdown.at |
|
new file mode 100644 |
|
index 000000000000..753a8251f732 |
|
--- /dev/null |
|
+++ b/src/tests/features/iptables_no_flush_on_shutdown.at |
|
@@ -0,0 +1,144 @@ |
|
+m4_if(nftables, FIREWALL_BACKEND, [ |
|
+ |
|
+dnl If FirewallBackend=nftables, and there are no --direct rules, then we can |
|
+dnl avoid flushing iptables on shutdown. We can also avoid a flush on startup |
|
+dnl if there are no permanent direct rules. But we will have to flush on the |
|
+dnl first direct rule added. |
|
+FWD_START_TEST([avoid iptables flush if using nftables]) |
|
+AT_KEYWORDS(direct gh863) |
|
+CHECK_IPTABLES() |
|
+ |
|
+dnl no flush on reload if no direct rules |
|
+NS_CHECK([$IPTABLES -t filter -N firewalld_testsuite]) |
|
+NS_CHECK([$IPTABLES -t filter -I firewalld_testsuite -j ACCEPT]) |
|
+IF_HOST_SUPPORTS_IP6TABLES([ |
|
+NS_CHECK([$IP6TABLES -t filter -N firewalld_testsuite]) |
|
+NS_CHECK([$IP6TABLES -t filter -I firewalld_testsuite -j ACCEPT]) |
|
+]) |
|
+NS_CHECK([$EBTABLES -t filter -N firewalld_testsuite]) |
|
+NS_CHECK([$EBTABLES -t filter -I firewalld_testsuite -j ACCEPT]) |
|
+IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl |
|
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 |
|
+]) |
|
+IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl |
|
+ ACCEPT all ::/0 ::/0 |
|
+]) |
|
+EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl |
|
+ -j ACCEPT |
|
+]) |
|
+FWD_RELOAD() |
|
+IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl |
|
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 |
|
+]) |
|
+IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl |
|
+ ACCEPT all ::/0 ::/0 |
|
+]) |
|
+EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl |
|
+ -j ACCEPT |
|
+]) |
|
+ |
|
+dnl no flush on restart (or stop) if no direct rules |
|
+FWD_RESTART() |
|
+IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl |
|
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 |
|
+]) |
|
+IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl |
|
+ ACCEPT all ::/0 ::/0 |
|
+]) |
|
+EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl |
|
+ -j ACCEPT |
|
+]) |
|
+ |
|
+dnl the first runtime direct rule should trigger an iptables flush |
|
+FWD_CHECK([--direct --add-rule ipv4 filter INPUT 1 -j ACCEPT], 0, [ignore]) |
|
+IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore]) |
|
+IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore]) |
|
+EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 1, [ignore], [ignore]) |
|
+IPTABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl |
|
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 |
|
+]) |
|
+NS_CHECK([$IPTABLES -t filter -N firewalld_testsuite]) |
|
+NS_CHECK([$IPTABLES -t filter -I firewalld_testsuite -j ACCEPT]) |
|
+IF_HOST_SUPPORTS_IP6TABLES([ |
|
+NS_CHECK([$IP6TABLES -t filter -N firewalld_testsuite]) |
|
+NS_CHECK([$IP6TABLES -t filter -I firewalld_testsuite -j ACCEPT]) |
|
+]) |
|
+NS_CHECK([$EBTABLES -t filter -N firewalld_testsuite]) |
|
+NS_CHECK([$EBTABLES -t filter -I firewalld_testsuite -j ACCEPT]) |
|
+IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl |
|
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 |
|
+]) |
|
+IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl |
|
+ ACCEPT all ::/0 ::/0 |
|
+]) |
|
+EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl |
|
+ -j ACCEPT |
|
+]) |
|
+FWD_RELOAD() |
|
+IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore]) |
|
+IPTABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl |
|
+]) |
|
+IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore]) |
|
+IP6TABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl |
|
+]) |
|
+EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 1, [ignore], [ignore]) |
|
+EBTABLES_LIST_RULES([filter], [INPUT], 0, [dnl |
|
+]) |
|
+ |
|
+dnl permanent direct rules should trigger a flush at start |
|
+FWD_CHECK([--permanent --direct --add-rule ipv4 filter INPUT 1 -j ACCEPT], 0, [ignore]) |
|
+NS_CHECK([$IPTABLES -t filter -N firewalld_testsuite]) |
|
+NS_CHECK([$IPTABLES -t filter -I firewalld_testsuite -j ACCEPT]) |
|
+IF_HOST_SUPPORTS_IP6TABLES([ |
|
+NS_CHECK([$IP6TABLES -t filter -N firewalld_testsuite]) |
|
+NS_CHECK([$IP6TABLES -t filter -I firewalld_testsuite -j ACCEPT]) |
|
+]) |
|
+NS_CHECK([$EBTABLES -t filter -N firewalld_testsuite]) |
|
+NS_CHECK([$EBTABLES -t filter -I firewalld_testsuite -j ACCEPT]) |
|
+FWD_RELOAD() |
|
+IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore]) |
|
+IPTABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl |
|
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 |
|
+]) |
|
+IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore]) |
|
+IP6TABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl |
|
+]) |
|
+EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 1, [ignore], [ignore]) |
|
+EBTABLES_LIST_RULES([filter], [INPUT], 0, [dnl |
|
+]) |
|
+ |
|
+FWD_CHECK([--permanent --direct --remove-rule ipv4 filter INPUT 1 -j ACCEPT], 0, [ignore]) |
|
+FWD_RELOAD() |
|
+ |
|
+dnl adding a chain should trigger a flush |
|
+NS_CHECK([$IPTABLES -t filter -N firewalld_testsuite]) |
|
+NS_CHECK([$IPTABLES -t filter -I firewalld_testsuite -j ACCEPT]) |
|
+IF_HOST_SUPPORTS_IP6TABLES([ |
|
+NS_CHECK([$IP6TABLES -t filter -N firewalld_testsuite]) |
|
+NS_CHECK([$IP6TABLES -t filter -I firewalld_testsuite -j ACCEPT]) |
|
+]) |
|
+NS_CHECK([$EBTABLES -t filter -N firewalld_testsuite]) |
|
+NS_CHECK([$EBTABLES -t filter -I firewalld_testsuite -j ACCEPT]) |
|
+FWD_CHECK([--direct --add-chain ipv4 filter firewalld_foobar], 0, [ignore]) |
|
+IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore]) |
|
+IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore]) |
|
+EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 1, [ignore], [ignore]) |
|
+FWD_RELOAD() |
|
+ |
|
+dnl adding a chain should trigger a flush |
|
+NS_CHECK([$IPTABLES -t filter -N firewalld_testsuite]) |
|
+NS_CHECK([$IPTABLES -t filter -I firewalld_testsuite -j ACCEPT]) |
|
+IF_HOST_SUPPORTS_IP6TABLES([ |
|
+NS_CHECK([$IP6TABLES -t filter -N firewalld_testsuite]) |
|
+NS_CHECK([$IP6TABLES -t filter -I firewalld_testsuite -j ACCEPT]) |
|
+]) |
|
+NS_CHECK([$EBTABLES -t filter -N firewalld_testsuite]) |
|
+NS_CHECK([$EBTABLES -t filter -I firewalld_testsuite -j ACCEPT]) |
|
+FWD_CHECK([--direct --add-passthrough ipv4 -t filter -I INPUT -j ACCEPT], 0, [ignore]) |
|
+IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore]) |
|
+IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore]) |
|
+EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 1, [ignore], [ignore]) |
|
+ |
|
+FWD_END_TEST() |
|
+ |
|
+]) |
|
-- |
|
2.39.1 |
|
|
|
|