241 lines
7.4 KiB
Plaintext
241 lines
7.4 KiB
Plaintext
|
module Test_iptables =
|
||
|
|
|
||
|
|
let add_rule = Iptables.table_rule
|
||
|
|
let ipt_match = Iptables.ipt_match
|
||
|
|
|
||
|
|
test add_rule get
|
||
|
|
"-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n" =
|
||
|
|
{ "append" = "INPUT"
|
||
|
|
{ "match" = "state" }
|
||
|
|
{ "state" = "ESTABLISHED,RELATED" }
|
||
|
|
{ "jump" = "ACCEPT" } }
|
||
|
|
|
||
|
|
test add_rule get
|
||
|
|
"-A INPUT -p icmp -j \tACCEPT \n" =
|
||
|
|
{ "append" = "INPUT"
|
||
|
|
{ "protocol" = "icmp" }
|
||
|
|
{ "jump" = "ACCEPT" } }
|
||
|
|
|
||
|
|
test add_rule get
|
||
|
|
"-A INPUT -i lo -j ACCEPT\n" =
|
||
|
|
{ "append" = "INPUT"
|
||
|
|
{ "in-interface" = "lo" }
|
||
|
|
{ "jump" = "ACCEPT" } }
|
||
|
|
|
||
|
|
test ipt_match get " -m tcp -p tcp --dport 53" =
|
||
|
|
{ "match" = "tcp" } { "protocol" = "tcp" } { "dport" = "53" }
|
||
|
|
|
||
|
|
let arule = " -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT"
|
||
|
|
|
||
|
|
test add_rule get ("--append INPUT" . arule . "\n") =
|
||
|
|
{ "append" = "INPUT"
|
||
|
|
{ "match" = "state" }
|
||
|
|
{ "state" = "NEW" }
|
||
|
|
{ "match" = "tcp" }
|
||
|
|
{ "protocol" = "tcp" }
|
||
|
|
{ "dport" = "53" }
|
||
|
|
{ "jump" = "ACCEPT" } }
|
||
|
|
|
||
|
|
test ipt_match get arule =
|
||
|
|
{ "match" = "state" } { "state" = "NEW" } { "match" = "tcp" }
|
||
|
|
{ "protocol" = "tcp" } { "dport" = "53" } { "jump" = "ACCEPT" }
|
||
|
|
|
||
|
|
test ipt_match get ("-A INPUT" . arule) = *
|
||
|
|
|
||
|
|
test ipt_match get " -p esp -j ACCEPT" =
|
||
|
|
{ "protocol" = "esp" } { "jump" = "ACCEPT" }
|
||
|
|
|
||
|
|
test ipt_match get
|
||
|
|
" -m state --state NEW -m udp -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT"
|
||
|
|
=
|
||
|
|
{ "match" = "state" } { "state" = "NEW" } { "match" = "udp" }
|
||
|
|
{ "protocol" = "udp" } { "dport" = "5353" }
|
||
|
|
{ "destination" = "224.0.0.251" } { "jump" = "ACCEPT" }
|
||
|
|
|
||
|
|
test add_rule get
|
||
|
|
"-I FORWARD -m physdev --physdev-is-bridged -j ACCEPT\n" =
|
||
|
|
{ "insert" = "FORWARD"
|
||
|
|
{ "match" = "physdev" } { "physdev-is-bridged" } { "jump" = "ACCEPT" } }
|
||
|
|
|
||
|
|
test add_rule get
|
||
|
|
"-A INPUT -j REJECT --reject-with icmp-host-prohibited\n" =
|
||
|
|
{ "append" = "INPUT"
|
||
|
|
{ "jump" = "REJECT" } { "reject-with" = "icmp-host-prohibited" } }
|
||
|
|
|
||
|
|
test add_rule get
|
||
|
|
"-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT\n" =
|
||
|
|
{ "append" = "RH-Firewall-1-INPUT"
|
||
|
|
{ "protocol" = "icmp" }
|
||
|
|
{ "icmp-type" = "any" }
|
||
|
|
{ "jump" = "ACCEPT" } }
|
||
|
|
|
||
|
|
test Iptables.table get "*filter
|
||
|
|
:RH-Firewall-1-INPUT - [0:0]
|
||
|
|
-A FORWARD -j RH-Firewall-1-INPUT
|
||
|
|
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
|
||
|
|
COMMIT\n" =
|
||
|
|
{ "table" = "filter"
|
||
|
|
{ "chain" = "RH-Firewall-1-INPUT"
|
||
|
|
{ "policy" = "-" } }
|
||
|
|
{ "append" = "FORWARD"
|
||
|
|
{ "jump" = "RH-Firewall-1-INPUT" } }
|
||
|
|
{ "append" = "RH-Firewall-1-INPUT"
|
||
|
|
{ "in-interface" = "lo" }
|
||
|
|
{ "jump" = "ACCEPT" } } }
|
||
|
|
|
||
|
|
test Iptables.table get "*filter
|
||
|
|
|
||
|
|
:RH-Firewall-1-INPUT - [0:0]
|
||
|
|
|
||
|
|
-A FORWARD -j RH-Firewall-1-INPUT
|
||
|
|
|
||
|
|
COMMIT\n" =
|
||
|
|
{ "table" = "filter"
|
||
|
|
{ }
|
||
|
|
{ "chain" = "RH-Firewall-1-INPUT"
|
||
|
|
{ "policy" = "-" } }
|
||
|
|
{ }
|
||
|
|
{ "append" = "FORWARD"
|
||
|
|
{ "jump" = "RH-Firewall-1-INPUT" } }
|
||
|
|
{ } }
|
||
|
|
|
||
|
|
let conf = "# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002
|
||
|
|
*filter
|
||
|
|
:INPUT DROP [1:229]
|
||
|
|
:FORWARD DROP [0:0]
|
||
|
|
:OUTPUT DROP [0:0]
|
||
|
|
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||
|
|
|
||
|
|
-I FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||
|
|
|
||
|
|
# comments and blank lines are allow between rules
|
||
|
|
|
||
|
|
-A FORWARD -i eth1 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
|
||
|
|
--append OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
|
||
|
|
COMMIT
|
||
|
|
# Completed on Wed Apr 24 10:19:55 2002
|
||
|
|
# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002
|
||
|
|
*mangle
|
||
|
|
:PREROUTING ACCEPT [658:32445]
|
||
|
|
|
||
|
|
:INPUT ACCEPT [658:32445]
|
||
|
|
:FORWARD ACCEPT [0:0]
|
||
|
|
:OUTPUT ACCEPT [891:68234]
|
||
|
|
:POSTROUTING ACCEPT [891:68234]
|
||
|
|
COMMIT
|
||
|
|
# Completed on Wed Apr 24 10:19:55 2002
|
||
|
|
# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002
|
||
|
|
*nat
|
||
|
|
:PREROUTING ACCEPT [1:229]
|
||
|
|
:POSTROUTING ACCEPT [3:450]
|
||
|
|
# The output chain
|
||
|
|
:OUTPUT ACCEPT [3:450]
|
||
|
|
# insert something
|
||
|
|
--insert POSTROUTING -o eth0 -j SNAT --to-source 195.233.192.1 \t
|
||
|
|
# and now commit
|
||
|
|
COMMIT
|
||
|
|
# Completed on Wed Apr 24 10:19:55 2002\n"
|
||
|
|
|
||
|
|
test Iptables.lns get conf =
|
||
|
|
{ "#comment" =
|
||
|
|
"Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002" }
|
||
|
|
{ "table" = "filter"
|
||
|
|
{ "chain" = "INPUT" { "policy" = "DROP" } }
|
||
|
|
{ "chain" = "FORWARD" { "policy" = "DROP" } }
|
||
|
|
{ "chain" = "OUTPUT" { "policy" = "DROP" } }
|
||
|
|
{ "append" = "INPUT"
|
||
|
|
{ "match" = "state" }
|
||
|
|
{ "state" = "RELATED,ESTABLISHED" }
|
||
|
|
{ "jump" = "ACCEPT" } }
|
||
|
|
{}
|
||
|
|
{ "insert" = "FORWARD"
|
||
|
|
{ "in-interface" = "eth0" }
|
||
|
|
{ "match" = "state" }
|
||
|
|
{ "state" = "RELATED,ESTABLISHED" }
|
||
|
|
{ "jump" = "ACCEPT" } }
|
||
|
|
{}
|
||
|
|
{ "#comment" = "comments and blank lines are allow between rules" }
|
||
|
|
{}
|
||
|
|
{ "append" = "FORWARD"
|
||
|
|
{ "in-interface" = "eth1" }
|
||
|
|
{ "match" = "state" }
|
||
|
|
{ "state" = "NEW,RELATED,ESTABLISHED" }
|
||
|
|
{ "jump" = "ACCEPT" } }
|
||
|
|
{ "append" = "OUTPUT"
|
||
|
|
{ "match" = "state" }
|
||
|
|
{ "state" = "NEW,RELATED,ESTABLISHED" }
|
||
|
|
{ "jump" = "ACCEPT" } } }
|
||
|
|
{ "#comment" = "Completed on Wed Apr 24 10:19:55 2002" }
|
||
|
|
{ "#comment" =
|
||
|
|
"Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002" }
|
||
|
|
{ "table" = "mangle"
|
||
|
|
{ "chain" = "PREROUTING" { "policy" = "ACCEPT" } }
|
||
|
|
{}
|
||
|
|
{ "chain" = "INPUT" { "policy" = "ACCEPT" } }
|
||
|
|
{ "chain" = "FORWARD" { "policy" = "ACCEPT" } }
|
||
|
|
{ "chain" = "OUTPUT" { "policy" = "ACCEPT" } }
|
||
|
|
{ "chain" = "POSTROUTING" { "policy" = "ACCEPT" } } }
|
||
|
|
{ "#comment" = "Completed on Wed Apr 24 10:19:55 2002" }
|
||
|
|
{ "#comment" =
|
||
|
|
"Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002" }
|
||
|
|
{ "table" = "nat"
|
||
|
|
{ "chain" = "PREROUTING" { "policy" = "ACCEPT" } }
|
||
|
|
{ "chain" = "POSTROUTING" { "policy" = "ACCEPT" } }
|
||
|
|
{ "#comment" = "The output chain" }
|
||
|
|
{ "chain" = "OUTPUT" { "policy" = "ACCEPT" } }
|
||
|
|
{ "#comment" = "insert something" }
|
||
|
|
{ "insert" = "POSTROUTING"
|
||
|
|
{ "out-interface" = "eth0" }
|
||
|
|
{ "jump" = "SNAT" }
|
||
|
|
{ "to-source" = "195.233.192.1" } }
|
||
|
|
{ "#comment" = "and now commit" } }
|
||
|
|
{ "#comment" = "Completed on Wed Apr 24 10:19:55 2002" }
|
||
|
|
|
||
|
|
test ipt_match get " -m comment --comment \"A comment\"" =
|
||
|
|
{ "match" = "comment" }
|
||
|
|
{ "comment" = "\"A comment\"" }
|
||
|
|
|
||
|
|
(*
|
||
|
|
* Test the various schemes for negation that iptables supports
|
||
|
|
*
|
||
|
|
* Note that the two ways in which a parameter can be negated lead to
|
||
|
|
* two different trees that mean the same.
|
||
|
|
*)
|
||
|
|
test add_rule get "-I POSTROUTING ! -d 192.168.122.0/24 -j MASQUERADE\n" =
|
||
|
|
{ "insert" = "POSTROUTING"
|
||
|
|
{ "destination" = "192.168.122.0/24"
|
||
|
|
{ "not" } }
|
||
|
|
{ "jump" = "MASQUERADE" } }
|
||
|
|
|
||
|
|
test add_rule get "-I POSTROUTING -d ! 192.168.122.0/24 -j MASQUERADE\n" =
|
||
|
|
{ "insert" = "POSTROUTING"
|
||
|
|
{ "destination" = "! 192.168.122.0/24" }
|
||
|
|
{ "jump" = "MASQUERADE" } }
|
||
|
|
|
||
|
|
test add_rule put "-I POSTROUTING ! -d 192.168.122.0/24 -j MASQUERADE\n"
|
||
|
|
after rm "/insert/destination/not" =
|
||
|
|
"-I POSTROUTING -d 192.168.122.0/24 -j MASQUERADE\n"
|
||
|
|
|
||
|
|
(* I have no idea if iptables will accept double negations, but we
|
||
|
|
* allow it syntactically *)
|
||
|
|
test add_rule put "-I POSTROUTING -d ! 192.168.122.0/24 -j MASQUERADE\n"
|
||
|
|
after clear "/insert/destination/not" =
|
||
|
|
"-I POSTROUTING ! -d ! 192.168.122.0/24 -j MASQUERADE\n"
|
||
|
|
|
||
|
|
test Iptables.chain get ":tcp_packets - [0:0]
|
||
|
|
" =
|
||
|
|
{ "chain" = "tcp_packets" { "policy" = "-" } }
|
||
|
|
|
||
|
|
(* Bug #157 *)
|
||
|
|
test ipt_match get " --tcp-flags SYN,RST,ACK,FIN SYN" =
|
||
|
|
{ "tcp-flags"
|
||
|
|
{ "mask" = "SYN" }
|
||
|
|
{ "mask" = "RST" }
|
||
|
|
{ "mask" = "ACK" }
|
||
|
|
{ "mask" = "FIN" }
|
||
|
|
{ "set" = "SYN" } }
|
||
|
|
|
||
|
|
(* Bug #224 *)
|
||
|
|
test ipt_match get " --icmpv6-type neighbor-solicitation" =
|
||
|
|
{ "icmpv6-type" = "neighbor-solicitation" }
|