From f15639bdac71dfe3534d274b14047d224088b15c Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 29 Jun 2018 19:14:18 +0200 Subject: tests: add script that mimics firewalld startup Mimic firewalld startup, i.e. "iptables-restore -n" use. First script is normal startup, second script restores ruleset, then re-runs first one (i.e., with existing rules rather than non-existent tables). Signed-off-by: Florian Westphal --- .../testcases/firewalld-restore/0001-firewalld_0 | 251 +++++++++++++++++++++ .../firewalld-restore/0002-firewalld-restart_0 | 17 ++ .../firewalld-restore/dumps/ipt-save-completed.txt | 151 +++++++++++++ 3 files changed, 419 insertions(+) create mode 100755 iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0 create mode 100755 iptables/tests/shell/testcases/firewalld-restore/0002-firewalld-restart_0 create mode 100644 iptables/tests/shell/testcases/firewalld-restore/dumps/ipt-save-completed.txt diff --git a/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0 b/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0 new file mode 100755 index 00000000..8bf0c2c6 --- /dev/null +++ b/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0 @@ -0,0 +1,251 @@ +#!/bin/sh + +$XT_MULTI iptables -w -L -n > /dev/null || exit 1 +$XT_MULTI iptables -w2 -L -n > /dev/null || exit 1 + +echo -n '#foo' | $XT_MULTI iptables-restore -w || exit 1 + +# table probing +for table in security raw mangle nat filter;do + $XT_MULTI iptables -w2 -t $table -L -n > /dev/null +done + +$XT_MULTI iptables -w2 -p icmp --help | grep -q 'Valid ICMP Types' || exit 1 + +cat <> "$tmpfile" +done + +case "$XT_MULTI" in +*/xtables-nft-multi) + # nft-multi displays chain names in different order, work around this for now + tmpfile2=$(mktemp) + sort "$tmpfile" > "$tmpfile2" + sort $(dirname "$0")/dumps/ipt-save-completed.txt > "$tmpfile" + diff -u $tmpfile $tmpfile2 + RET=$? + rm -f "$tmpfile2" + ;; +*) + diff -u $tmpfile $(dirname "$0")/dumps/ipt-save-completed.txt + RET=$? + ;; +esac + +rm -f "$tmpfile" + +exit $RET diff --git a/iptables/tests/shell/testcases/firewalld-restore/0002-firewalld-restart_0 b/iptables/tests/shell/testcases/firewalld-restore/0002-firewalld-restart_0 new file mode 100755 index 00000000..50e94924 --- /dev/null +++ b/iptables/tests/shell/testcases/firewalld-restore/0002-firewalld-restart_0 @@ -0,0 +1,17 @@ +#!/bin/sh + +# simulate restart after it went down, so first restore +# the complete ruleset + +$XT_MULTI iptables-restore < $(dirname "$0")/dumps/ipt-save-completed.txt + +# add dummy rules to see if they get cleared or not. +for table in raw mangle nat filter;do + $XT_MULTI iptables -t $table -N FOO$table || exit 1 + $XT_MULTI iptables -t $table -A OUTPUT -m comment --comment '"dummy rule in table $table OUTPUT"' || exit 1 + $XT_MULTI iptables -t $table -A FOO$table -m comment --comment '"dummy rule in table $table FOO$table"' || exit 1 +done + +# then run the other test script so it finds already-existing ruleset. + +exec $(dirname "$0")/0001-firewalld_0 diff --git a/iptables/tests/shell/testcases/firewalld-restore/dumps/ipt-save-completed.txt b/iptables/tests/shell/testcases/firewalld-restore/dumps/ipt-save-completed.txt new file mode 100644 index 00000000..03704ecd --- /dev/null +++ b/iptables/tests/shell/testcases/firewalld-restore/dumps/ipt-save-completed.txt @@ -0,0 +1,151 @@ +*nat +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:OUTPUT_direct - [0:0] +:POSTROUTING_ZONES - [0:0] +:POSTROUTING_ZONES_SOURCE - [0:0] +:POSTROUTING_direct - [0:0] +:POST_public - [0:0] +:POST_public_allow - [0:0] +:POST_public_deny - [0:0] +:POST_public_log - [0:0] +:PREROUTING_ZONES - [0:0] +:PREROUTING_ZONES_SOURCE - [0:0] +:PREROUTING_direct - [0:0] +:PRE_public - [0:0] +:PRE_public_allow - [0:0] +:PRE_public_deny - [0:0] +:PRE_public_log - [0:0] +-A PREROUTING -j PREROUTING_direct +-A PREROUTING -j PREROUTING_ZONES_SOURCE +-A PREROUTING -j PREROUTING_ZONES +-A OUTPUT -j OUTPUT_direct +-A POSTROUTING -j POSTROUTING_direct +-A POSTROUTING -j POSTROUTING_ZONES_SOURCE +-A POSTROUTING -j POSTROUTING_ZONES +-A POSTROUTING_ZONES -o enp3s0 -g POST_public +-A POSTROUTING_ZONES -g POST_public +-A POST_public -j POST_public_log +-A POST_public -j POST_public_deny +-A POST_public -j POST_public_allow +-A PREROUTING_ZONES -i enp3s0 -g PRE_public +-A PREROUTING_ZONES -g PRE_public +-A PRE_public -j PRE_public_log +-A PRE_public -j PRE_public_deny +-A PRE_public -j PRE_public_allow +COMMIT +*mangle +:PREROUTING ACCEPT [0:0] +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:POSTROUTING ACCEPT [0:0] +:FORWARD_direct - [0:0] +:INPUT_direct - [0:0] +:OUTPUT_direct - [0:0] +:POSTROUTING_direct - [0:0] +:PREROUTING_ZONES - [0:0] +:PREROUTING_ZONES_SOURCE - [0:0] +:PREROUTING_direct - [0:0] +:PRE_public - [0:0] +:PRE_public_allow - [0:0] +:PRE_public_deny - [0:0] +:PRE_public_log - [0:0] +-A PREROUTING -j PREROUTING_direct +-A PREROUTING -j PREROUTING_ZONES_SOURCE +-A PREROUTING -j PREROUTING_ZONES +-A INPUT -j INPUT_direct +-A FORWARD -j FORWARD_direct +-A OUTPUT -j OUTPUT_direct +-A POSTROUTING -j POSTROUTING_direct +-A PREROUTING_ZONES -i enp3s0 -g PRE_public +-A PREROUTING_ZONES -g PRE_public +-A PRE_public -j PRE_public_log +-A PRE_public -j PRE_public_deny +-A PRE_public -j PRE_public_allow +COMMIT +*raw +:PREROUTING ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:OUTPUT_direct - [0:0] +:PREROUTING_ZONES - [0:0] +:PREROUTING_ZONES_SOURCE - [0:0] +:PREROUTING_direct - [0:0] +:PRE_public - [0:0] +:PRE_public_allow - [0:0] +:PRE_public_deny - [0:0] +:PRE_public_log - [0:0] +-A PREROUTING -j PREROUTING_direct +-A PREROUTING -j PREROUTING_ZONES_SOURCE +-A PREROUTING -j PREROUTING_ZONES +-A OUTPUT -j OUTPUT_direct +-A PREROUTING_ZONES -i enp3s0 -g PRE_public +-A PREROUTING_ZONES -g PRE_public +-A PRE_public -j PRE_public_log +-A PRE_public -j PRE_public_deny +-A PRE_public -j PRE_public_allow +COMMIT +*filter +:INPUT ACCEPT [0:0] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [0:0] +:FORWARD_IN_ZONES - [0:0] +:FORWARD_IN_ZONES_SOURCE - [0:0] +:FORWARD_OUT_ZONES - [0:0] +:FORWARD_OUT_ZONES_SOURCE - [0:0] +:FORWARD_direct - [0:0] +:FWDI_public - [0:0] +:FWDI_public_allow - [0:0] +:FWDI_public_deny - [0:0] +:FWDI_public_log - [0:0] +:FWDO_public - [0:0] +:FWDO_public_allow - [0:0] +:FWDO_public_deny - [0:0] +:FWDO_public_log - [0:0] +:INPUT_ZONES - [0:0] +:INPUT_ZONES_SOURCE - [0:0] +:INPUT_direct - [0:0] +:IN_public - [0:0] +:IN_public_allow - [0:0] +:IN_public_deny - [0:0] +:IN_public_log - [0:0] +:OUTPUT_direct - [0:0] +-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A INPUT -i lo -j ACCEPT +-A INPUT -j INPUT_direct +-A INPUT -j INPUT_ZONES_SOURCE +-A INPUT -j INPUT_ZONES +-A INPUT -m conntrack --ctstate INVALID -j DROP +-A INPUT -j REJECT --reject-with icmp-host-prohibited +-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A FORWARD -i lo -j ACCEPT +-A FORWARD -j FORWARD_direct +-A FORWARD -j FORWARD_IN_ZONES_SOURCE +-A FORWARD -j FORWARD_IN_ZONES +-A FORWARD -j FORWARD_OUT_ZONES_SOURCE +-A FORWARD -j FORWARD_OUT_ZONES +-A FORWARD -m conntrack --ctstate INVALID -j DROP +-A FORWARD -j REJECT --reject-with icmp-host-prohibited +-A OUTPUT -j OUTPUT_direct +-A FORWARD_IN_ZONES -i enp3s0 -g FWDI_public +-A FORWARD_IN_ZONES -g FWDI_public +-A FORWARD_OUT_ZONES -o enp3s0 -g FWDO_public +-A FORWARD_OUT_ZONES -g FWDO_public +-A FWDI_public -j FWDI_public_log +-A FWDI_public -j FWDI_public_deny +-A FWDI_public -j FWDI_public_allow +-A FWDI_public -p icmp -j ACCEPT +-A FWDO_public -j FWDO_public_log +-A FWDO_public -j FWDO_public_deny +-A FWDO_public -j FWDO_public_allow +-A INPUT_ZONES -i enp3s0 -g IN_public +-A INPUT_ZONES -g IN_public +-A IN_public -j IN_public_log +-A IN_public -j IN_public_deny +-A IN_public -j IN_public_allow +-A IN_public -p icmp -j ACCEPT +-A IN_public_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT +-A IN_public_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT +COMMIT -- cgit v1.2.3