Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Sign in / Register
Toggle navigation
Menu
Open sidebar
adam.huang
Pkg Iptables
Commits
dab1e98e
Commit
dab1e98e
authored
Oct 24, 2018
by
Arturo Borrero Gonzalez
Browse files
New upstream version 1.8.1
parent
f1f129da
Changes
268
Show whitespace changes
Inline
Side-by-side
iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0
0 → 100755
View file @
dab1e98e
#!/bin/bash
set
-e
# there is no legacy backend to test
[[
$XT_MULTI
==
*
/xtables-nft-multi
]]
||
{
echo
"skip
$XT_MULTI
"
;
exit
0
;
}
# ebtables-restore reuses preloaded targets and matches, make sure defaults
# apply to consecutive rules using the same target/match as a previous one
DUMP
=
'*filter
:FORWARD ACCEPT
-A FORWARD --limit 100 --limit-burst 42 -j ACCEPT
-A FORWARD --limit 1000 -j ACCEPT
-A FORWARD --log --log-prefix "foobar"
-A FORWARD --log
'
# note how limit-burst is 5 in second rule and log-prefix empty in fourth one
EXPECT
=
'*filter
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT
-A FORWARD --limit 100/sec --limit-burst 42 -j ACCEPT
-A FORWARD --limit 1000/sec --limit-burst 5 -j ACCEPT
-A FORWARD --log-level notice --log-prefix "foobar" -j CONTINUE
-A FORWARD --log-level notice --log-prefix "" -j CONTINUE
'
$XT_MULTI
ebtables
--init-table
$XT_MULTI
ebtables-restore
<<<
$DUMP
diff
-u
<
(
echo
-e
"
$EXPECT
"
)
<
(
$XT_MULTI
ebtables-save |
grep
-v
'^#'
)
iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0
0 → 100755
View file @
dab1e98e
#!/bin/sh
$XT_MULTI
iptables
-w
-L
-n
>
/dev/null
||
exit
1
$XT_MULTI
iptables
-w2
-L
-n
>
/dev/null
||
exit
1
echo
-n
'#foo'
|
$XT_MULTI
iptables-restore
-w
||
exit
1
# table probing
for
table
in
security raw mangle nat filter
;
do
$XT_MULTI
iptables
-w2
-t
$table
-L
-n
>
/dev/null
done
$XT_MULTI
iptables
-w2
-p
icmp
--help
|
grep
-q
'Valid ICMP Types'
||
exit
1
cat
<<
EOF
|
$XT_MULTI
iptables-restore -w -n
*nat
-F
-X
-Z
-N PREROUTING_direct
-I PREROUTING 1 -j PREROUTING_direct
-N PREROUTING_ZONES_SOURCE
-N PREROUTING_ZONES
-I PREROUTING 2 -j PREROUTING_ZONES_SOURCE
-I PREROUTING 3 -j PREROUTING_ZONES
-N POSTROUTING_direct
-I POSTROUTING 1 -j POSTROUTING_direct
-N POSTROUTING_ZONES_SOURCE
-N POSTROUTING_ZONES
-I POSTROUTING 2 -j POSTROUTING_ZONES_SOURCE
-I POSTROUTING 3 -j POSTROUTING_ZONES
-N OUTPUT_direct
-I OUTPUT 1 -j OUTPUT_direct
COMMIT
*mangle
-F
-X
-Z
-N PREROUTING_direct
-I PREROUTING 1 -j PREROUTING_direct
-N PREROUTING_ZONES_SOURCE
-N PREROUTING_ZONES
-I PREROUTING 2 -j PREROUTING_ZONES_SOURCE
-I PREROUTING 3 -j PREROUTING_ZONES
-N POSTROUTING_direct
-I POSTROUTING 1 -j POSTROUTING_direct
-N INPUT_direct
-I INPUT 1 -j INPUT_direct
-N OUTPUT_direct
-I OUTPUT 1 -j OUTPUT_direct
-N FORWARD_direct
-I FORWARD 1 -j FORWARD_direct
COMMIT
*raw
-F
-X
-Z
-N PREROUTING_direct
-I PREROUTING 1 -j PREROUTING_direct
-N PREROUTING_ZONES_SOURCE
-N PREROUTING_ZONES
-I PREROUTING 2 -j PREROUTING_ZONES_SOURCE
-I PREROUTING 3 -j PREROUTING_ZONES
-N OUTPUT_direct
-I OUTPUT 1 -j OUTPUT_direct
COMMIT
*filter
-F
-X
-Z
-N INPUT_direct
-N INPUT_ZONES_SOURCE
-N INPUT_ZONES
-I INPUT 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-I INPUT 2 -i lo -j ACCEPT
-I INPUT 3 -j INPUT_direct
-I INPUT 4 -j INPUT_ZONES_SOURCE
-I INPUT 5 -j INPUT_ZONES
-I INPUT 6 -m conntrack --ctstate INVALID -j DROP
-I INPUT 7 -j REJECT --reject-with icmp-host-prohibited
-N FORWARD_direct
-N FORWARD_IN_ZONES_SOURCE
-N FORWARD_IN_ZONES
-N FORWARD_OUT_ZONES_SOURCE
-N FORWARD_OUT_ZONES
-I FORWARD 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-I FORWARD 2 -i lo -j ACCEPT
-I FORWARD 3 -j FORWARD_direct
-I FORWARD 4 -j FORWARD_IN_ZONES_SOURCE
-I FORWARD 5 -j FORWARD_IN_ZONES
-I FORWARD 6 -j FORWARD_OUT_ZONES_SOURCE
-I FORWARD 7 -j FORWARD_OUT_ZONES
-I FORWARD 8 -m conntrack --ctstate INVALID -j DROP
-I FORWARD 9 -j REJECT --reject-with icmp-host-prohibited
-N OUTPUT_direct
-I OUTPUT 1 -j OUTPUT_direct
COMMIT
EOF
if
[
$?
-ne
0
]
;
then
echo
"Error during first iptables-restore"
exit
1
fi
cat
<<
EOF
|
$XT_MULTI
iptables-restore -w -n
*raw
-N PRE_public
-N PRE_public_log
-N PRE_public_deny
-N PRE_public_allow
-I PRE_public 1 -j PRE_public_log
-I PRE_public 2 -j PRE_public_deny
-I PRE_public 3 -j PRE_public_allow
-A PREROUTING_ZONES -i + -g PRE_public
COMMIT
*filter
-N IN_public
-N IN_public_log
-N IN_public_deny
-N IN_public_allow
-I IN_public 1 -j IN_public_log
-I IN_public 2 -j IN_public_deny
-I IN_public 3 -j IN_public_allow
-A IN_public_allow -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
-A IN_public_allow -p udp --dport 5353 -d 224.0.0.251 -m conntrack --ctstate NEW -j ACCEPT
-N FWDI_public
-N FWDI_public_log
-N FWDI_public_deny
-N FWDI_public_allow
-I FWDI_public 1 -j FWDI_public_log
-I FWDI_public 2 -j FWDI_public_deny
-I FWDI_public 3 -j FWDI_public_allow
-I IN_public 4 -p icmp -j ACCEPT
-I FWDI_public 4 -p icmp -j ACCEPT
-A INPUT_ZONES -i + -g IN_public
-A FORWARD_IN_ZONES -i + -g FWDI_public
-N FWDO_public
-N FWDO_public_log
-N FWDO_public_deny
-N FWDO_public_allow
-I FWDO_public 1 -j FWDO_public_log
-I FWDO_public 2 -j FWDO_public_deny
-I FWDO_public 3 -j FWDO_public_allow
-A FORWARD_OUT_ZONES -o + -g FWDO_public
COMMIT
*nat
-N PRE_public
-N PRE_public_log
-N PRE_public_deny
-N PRE_public_allow
-I PRE_public 1 -j PRE_public_log
-I PRE_public 2 -j PRE_public_deny
-I PRE_public 3 -j PRE_public_allow
-A PREROUTING_ZONES -i + -g PRE_public
-N POST_public
-N POST_public_log
-N POST_public_deny
-N POST_public_allow
-I POST_public 1 -j POST_public_log
-I POST_public 2 -j POST_public_deny
-I POST_public 3 -j POST_public_allow
-A POSTROUTING_ZONES -o + -g POST_public
COMMIT
*mangle
-N PRE_public
-N PRE_public_log
-N PRE_public_deny
-N PRE_public_allow
-I PRE_public 1 -j PRE_public_log
-I PRE_public 2 -j PRE_public_deny
-I PRE_public 3 -j PRE_public_allow
-A PREROUTING_ZONES -i + -g PRE_public
COMMIT
EOF
if
[
$?
-ne
0
]
;
then
echo
"Error during 2nd iptables-restore"
exit
1
fi
cat
<<
EOF
|
$XT_MULTI
iptables-restore -w -n
*mangle
-P PREROUTING ACCEPT
-P POSTROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P FORWARD ACCEPT
COMMIT
*raw
-P PREROUTING ACCEPT
-P OUTPUT ACCEPT
COMMIT
*filter
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P FORWARD ACCEPT
COMMIT
EOF
if
[
$?
-ne
0
]
;
then
echo
"Error during 3rd iptables-restore"
exit
1
fi
cat
<<
EOF
|
$XT_MULTI
iptables-restore -w -n
*filter
-I INPUT_ZONES 1 -i enp3s0 -g IN_public
-I FORWARD_IN_ZONES 1 -i enp3s0 -g FWDI_public
-I FORWARD_OUT_ZONES 1 -o enp3s0 -g FWDO_public
COMMIT
*nat
-I PREROUTING_ZONES 1 -i enp3s0 -g PRE_public
-I POSTROUTING_ZONES 1 -o enp3s0 -g POST_public
COMMIT
*mangle
-I PREROUTING_ZONES 1 -i enp3s0 -g PRE_public
COMMIT
*raw
-I PREROUTING_ZONES 1 -i enp3s0 -g PRE_public
COMMIT
EOF
if
[
$?
-ne
0
]
;
then
echo
"Error during 4th iptables-restore"
exit
1
fi
tmpfile
=
$(
mktemp
)
||
exit
1
for
table
in
nat mangle raw filter
;
do
$XT_MULTI
iptables-save
-t
$table
|
grep
-v
'^#'
>>
"
$tmpfile
"
done
case
"
$XT_MULTI
"
in
*
/xtables-nft-multi
)
# nft-multi displays chain names in different order, work around this for now
tmpfile2
=
$(
mktemp
)
sort
"
$tmpfile
"
>
"
$tmpfile2
"
sort
$(
dirname
"
$0
"
)
/dumps/ipt-save-completed.txt
>
"
$tmpfile
"
diff
-u
$tmpfile
$tmpfile2
RET
=
$?
rm
-f
"
$tmpfile2
"
;;
*
)
diff
-u
$tmpfile
$(
dirname
"
$0
"
)
/dumps/ipt-save-completed.txt
RET
=
$?
;;
esac
rm
-f
"
$tmpfile
"
exit
$RET
iptables/tests/shell/testcases/firewalld-restore/0002-firewalld-restart_0
0 → 100755
View file @
dab1e98e
#!/bin/sh
# simulate restart after it went down, so first restore
# the complete ruleset
$XT_MULTI
iptables-restore <
$(
dirname
"
$0
"
)
/dumps/ipt-save-completed.txt
# add dummy rules to see if they get cleared or not.
for
table
in
raw mangle nat filter
;
do
$XT_MULTI
iptables
-t
$table
-N
FOO
$table
||
exit
1
$XT_MULTI
iptables
-t
$table
-A
OUTPUT
-m
comment
--comment
'"dummy rule in table $table OUTPUT"'
||
exit
1
$XT_MULTI
iptables
-t
$table
-A
FOO
$table
-m
comment
--comment
'"dummy rule in table $table FOO$table"'
||
exit
1
done
# then run the other test script so it finds already-existing ruleset.
exec
$(
dirname
"
$0
"
)
/0001-firewalld_0
iptables/tests/shell/testcases/firewalld-restore/dumps/ipt-save-completed.txt
0 → 100644
View file @
dab1e98e
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT_direct - [0:0]
:POSTROUTING_ZONES - [0:0]
:POSTROUTING_ZONES_SOURCE - [0:0]
:POSTROUTING_direct - [0:0]
:POST_public - [0:0]
:POST_public_allow - [0:0]
:POST_public_deny - [0:0]
:POST_public_log - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_public - [0:0]
:PRE_public_allow - [0:0]
:PRE_public_deny - [0:0]
:PRE_public_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A OUTPUT -j OUTPUT_direct
-A POSTROUTING -j POSTROUTING_direct
-A POSTROUTING -j POSTROUTING_ZONES_SOURCE
-A POSTROUTING -j POSTROUTING_ZONES
-A POSTROUTING_ZONES -o enp3s0 -g POST_public
-A POSTROUTING_ZONES -g POST_public
-A POST_public -j POST_public_log
-A POST_public -j POST_public_deny
-A POST_public -j POST_public_allow
-A PREROUTING_ZONES -i enp3s0 -g PRE_public
-A PREROUTING_ZONES -g PRE_public
-A PRE_public -j PRE_public_log
-A PRE_public -j PRE_public_deny
-A PRE_public -j PRE_public_allow
COMMIT
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:FORWARD_direct - [0:0]
:INPUT_direct - [0:0]
:OUTPUT_direct - [0:0]
:POSTROUTING_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_public - [0:0]
:PRE_public_allow - [0:0]
:PRE_public_deny - [0:0]
:PRE_public_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A INPUT -j INPUT_direct
-A FORWARD -j FORWARD_direct
-A OUTPUT -j OUTPUT_direct
-A POSTROUTING -j POSTROUTING_direct
-A PREROUTING_ZONES -i enp3s0 -g PRE_public
-A PREROUTING_ZONES -g PRE_public
-A PRE_public -j PRE_public_log
-A PRE_public -j PRE_public_deny
-A PRE_public -j PRE_public_allow
COMMIT
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:OUTPUT_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_public - [0:0]
:PRE_public_allow - [0:0]
:PRE_public_deny - [0:0]
:PRE_public_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A OUTPUT -j OUTPUT_direct
-A PREROUTING_ZONES -i enp3s0 -g PRE_public
-A PREROUTING_ZONES -g PRE_public
-A PRE_public -j PRE_public_log
-A PRE_public -j PRE_public_deny
-A PRE_public -j PRE_public_allow
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:FORWARD_IN_ZONES - [0:0]
:FORWARD_IN_ZONES_SOURCE - [0:0]
:FORWARD_OUT_ZONES - [0:0]
:FORWARD_OUT_ZONES_SOURCE - [0:0]
:FORWARD_direct - [0:0]
:FWDI_public - [0:0]
:FWDI_public_allow - [0:0]
:FWDI_public_deny - [0:0]
:FWDI_public_log - [0:0]
:FWDO_public - [0:0]
:FWDO_public_allow - [0:0]
:FWDO_public_deny - [0:0]
:FWDO_public_log - [0:0]
:INPUT_ZONES - [0:0]
:INPUT_ZONES_SOURCE - [0:0]
:INPUT_direct - [0:0]
:IN_public - [0:0]
:IN_public_allow - [0:0]
:IN_public_deny - [0:0]
:IN_public_log - [0:0]
:OUTPUT_direct - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j INPUT_direct
-A INPUT -j INPUT_ZONES_SOURCE
-A INPUT -j INPUT_ZONES
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -j FORWARD_direct
-A FORWARD -j FORWARD_IN_ZONES_SOURCE
-A FORWARD -j FORWARD_IN_ZONES
-A FORWARD -j FORWARD_OUT_ZONES_SOURCE
-A FORWARD -j FORWARD_OUT_ZONES
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -j OUTPUT_direct
-A FORWARD_IN_ZONES -i enp3s0 -g FWDI_public
-A FORWARD_IN_ZONES -g FWDI_public
-A FORWARD_OUT_ZONES -o enp3s0 -g FWDO_public
-A FORWARD_OUT_ZONES -g FWDO_public
-A FWDI_public -j FWDI_public_log
-A FWDI_public -j FWDI_public_deny
-A FWDI_public -j FWDI_public_allow
-A FWDI_public -p icmp -j ACCEPT
-A FWDO_public -j FWDO_public_log
-A FWDO_public -j FWDO_public_deny
-A FWDO_public -j FWDO_public_allow
-A INPUT_ZONES -i enp3s0 -g IN_public
-A INPUT_ZONES -g IN_public
-A IN_public -j IN_public_log
-A IN_public -j IN_public_deny
-A IN_public -j IN_public_allow
-A IN_public -p icmp -j ACCEPT
-A IN_public_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
-A IN_public_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
COMMIT
iptables/tests/shell/testcases/ip6tables/0002-verbose-output_0
0 → 100755
View file @
dab1e98e
#!/bin/bash
set
-e
#set -x
# ensure verbose output is identical between legacy and nft tools
RULE1
=
'-i eth2 -o eth3 -s feed:babe::1 -d feed:babe::2 -j ACCEPT'
VOUT1
=
'ACCEPT all opt in eth2 out eth3 feed:babe::1 -> feed:babe::2'
RULE2
=
'-i eth2 -o eth3 -s feed:babe::4 -d feed:babe::5 -j ACCEPT'
VOUT2
=
'ACCEPT all opt in eth2 out eth3 feed:babe::4 -> feed:babe::5'
diff
-u
-Z
<
(
echo
-e
"
$VOUT1
"
)
<
(
$XT_MULTI
ip6tables
-v
-A
FORWARD
$RULE1
)
diff
-u
-Z
<
(
echo
-e
"
$VOUT2
"
)
<
(
$XT_MULTI
ip6tables
-v
-I
FORWARD 2
$RULE2
)
diff
-u
-Z
<
(
echo
-e
"
$VOUT1
"
)
<
(
$XT_MULTI
ip6tables
-v
-C
FORWARD
$RULE1
)
diff
-u
-Z
<
(
echo
-e
"
$VOUT2
"
)
<
(
$XT_MULTI
ip6tables
-v
-C
FORWARD
$RULE2
)
EXPECT
=
'Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all eth2 eth3 feed:babe::1 feed:babe::2
0 0 ACCEPT all eth2 eth3 feed:babe::4 feed:babe::5
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination'
diff
-u
-Z
<
(
echo
-e
"
$EXPECT
"
)
<
(
$XT_MULTI
ip6tables
-v
-n
-L
)
diff
-u
-Z
<
(
echo
-e
"
$VOUT1
"
)
<
(
$XT_MULTI
ip6tables
-v
-D
FORWARD
$RULE1
)
diff
-u
-Z
<
(
echo
-e
"
$VOUT2
"
)
<
(
$XT_MULTI
ip6tables
-v
-D
FORWARD
$RULE2
)
EXPECT
=
"Flushing chain
\`
INPUT'
Flushing chain
\`
FORWARD'
Flushing chain
\`
OUTPUT'"
diff
-u
<
(
echo
-e
"
$EXPECT
"
)
<
(
$XT_MULTI
ip6tables
-v
-F
)
EXPECT
=
"Zeroing chain
\`
INPUT'
Zeroing chain
\`
FORWARD'
Zeroing chain
\`
OUTPUT'"
diff
-u
<
(
echo
-e
"
$EXPECT
"
)
<
(
$XT_MULTI
ip6tables
-v
-Z
)
diff
-u
<
(
echo
"Flushing chain
\`
OUTPUT'"
)
<
(
$XT_MULTI
ip6tables
-v
-F
OUTPUT
)
diff
-u
<
(
echo
"Zeroing chain
\`
OUTPUT'"
)
<
(
$XT_MULTI
ip6tables
-v
-Z
OUTPUT
)
$XT_MULTI
ip6tables
-N
foo
diff
-u
<
(
echo
"Deleting chain
\`
foo'"
)
<
(
$XT_MULTI
ip6tables
-v
-X
foo
)
iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
0 → 100755
View file @
dab1e98e
#!/bin/bash
set
-e
$XT_MULTI
ip6tables
-N
foo
$XT_MULTI
ip6tables
-A
FORWARD
-i
eth23
-o
eth42
-j
ACCEPT
$XT_MULTI
ip6tables
-A
FORWARD
-i
eth42
-o
eth23
-g
foo
$XT_MULTI
ip6tables
-t
nat
-A
OUTPUT
-o
eth123
-m
mark
--mark
0x42
-j
ACCEPT
EXPECT
=
'-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N foo
-A FORWARD -i eth23 -o eth42 -j ACCEPT
-A FORWARD -i eth42 -o eth23 -g foo'
diff
-u
-Z
<
(
echo
-e
"
$EXPECT
"
)
<
(
$XT_MULTI
ip6tables
-S
)
EXPECT
=
'-P INPUT ACCEPT -c 0 0
-P FORWARD ACCEPT -c 0 0
-P OUTPUT ACCEPT -c 0 0
-N foo
-A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
-A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
diff
-u
-Z
<
(
echo
-e
"
$EXPECT
"
)
<
(
$XT_MULTI
ip6tables
-v
-S
)
EXPECT
=
'-P FORWARD ACCEPT
-A FORWARD -i eth23 -o eth42 -j ACCEPT
-A FORWARD -i eth42 -o eth23 -g foo'
diff
-u
-Z
<
(
echo
-e
"
$EXPECT
"
)
<
(
$XT_MULTI
ip6tables
-S
FORWARD
)
EXPECT
=
'-P FORWARD ACCEPT -c 0 0
-A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
-A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
diff
-u
-Z
<
(
echo
-e
"
$EXPECT
"
)
<
(
$XT_MULTI
ip6tables
-v
-S
FORWARD
)
EXPECT
=
'-P OUTPUT ACCEPT
-A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT'
diff
-u
-Z
<
(
echo
-e
"
$EXPECT
"
)
<
(
$XT_MULTI
ip6tables
-t
nat
-S
OUTPUT
)
EXPECT
=
'-P OUTPUT ACCEPT -c 0 0
-A OUTPUT -o eth123 -m mark --mark 0x42 -c 0 0 -j ACCEPT'
diff
-u
-Z
<
(
echo
-e
"
$EXPECT
"
)
<
(
$XT_MULTI
ip6tables
-v
-t
nat
-S
OUTPUT
)
# some of the following commands are supposed to fail
set
+e
$XT_MULTI
ip6tables
-S
nonexistent
&&
{
echo
"list-rules in non-existent chain should fail"
exit
1
}
$XT_MULTI
ip6tables
-S
nonexistent 23
&&
{
echo
"list-rules in non-existent chain with given rule number should fail"
exit
1
}
$XT_MULTI
ip6tables
-S
FORWARD 234
||
{
echo
"list-rules in existent chain with invalid rule number should succeed"
exit
1
}
iptables/tests/shell/testcases/ip6tables/0004-return-codes_0
0 → 100755
View file @
dab1e98e
#!/bin/sh
# make sure error return codes are as expected useful cases
# (e.g. commands to check ruleset state)
global_rc
=
0
cmd
()
{
# (rc, cmd, [args ...])
rc_exp
=
$1
;
shift
$XT_MULTI
"
$@
"
rc
=
$?
[
$rc
-eq
$rc_exp
]
||
{
echo
"---> expected
$rc_exp
, got
$rc
for command '
$@
'"
global_rc
=
1
}
}
# test chain creation
cmd 0 ip6tables
-N
foo
cmd 1 ip6tables
-N
foo
# iptables-nft allows this - bug or feature?
#cmd 2 ip6tables -N "invalid name"
# test rule adding
cmd 0 ip6tables
-A
INPUT
-j
ACCEPT
cmd 1 ip6tables
-A
noexist
-j
ACCEPT
# test rule checking
cmd 0 ip6tables
-C
INPUT
-j
ACCEPT
cmd 1 ip6tables
-C
FORWARD
-j
ACCEPT
cmd 1 ip6tables
-C
nonexist
-j
ACCEPT
cmd 2 ip6tables
-C
INPUT
-j
foobar
cmd 2 ip6tables
-C
INPUT
-m
foobar
-j
ACCEPT
cmd 3 ip6tables
-t
foobar
-C
INPUT
-j
ACCEPT
exit
$global_rc
iptables/tests/shell/testcases/ipt-restore/0001load-specific-table_0
0 → 100755
View file @
dab1e98e
#!/bin/bash
RET
=
0
tmpfile
=
""
set
-x
clean_tempfile
()
{
if
[
-n
"
${
tmpfile
}
"
]
;
then
rm
-f
"
${
tmpfile
}
"
fi
}
trap
clean_tempfile EXIT
tmpfile
=
$(
mktemp
)
||
exit
1
do_simple
()
{
iptables
=
"
${
1
}
"
table
=
"
${
2
}
"
dumpfile
=
"
$(
dirname
"
${
0
}
"
)
/dumps/
${
iptables
}
.dump"
"
$XT_MULTI
"
"
${
iptables
}
-restore"
--table
=
"
${
table
}
"
<
"
${
dumpfile
}
"
;
rv
=
$?
if
[
"
${
rv
}
"
-ne
0
]
;
then
RET
=
1
fi
}
do_simple
"iptables"
"filter"
do_simple
"iptables"
"mangle"
do_simple
"iptables"
"raw"
do_simple
"iptables"
"nat"
do_simple
"ip6tables"
"filter"
do_simple
"ip6tables"
"mangle"
do_simple
"ip6tables"
"raw"
do_simple
"ip6tables"
"nat"
exit
"
${
RET
}
"
iptables/tests/shell/testcases/ipt-restore/0002-parameters_0
0 → 100755
View file @
dab1e98e
#!/bin/sh
set
-e
# make sure wait and wait-interval options are accepted
clean_tempfile
()
{
if
[
-n
"
${
tmpfile
}
"
]
;
then
rm
-f
"
${
tmpfile
}
"
fi
}
trap
clean_tempfile EXIT
tmpfile
=
$(
mktemp
)
||
exit
1
$XT_MULTI
iptables-save
-f
$tmpfile
$XT_MULTI
iptables-restore
$tmpfile
$XT_MULTI
iptables-restore
-w
5
$tmpfile
$XT_MULTI
iptables-restore
-w
5
-W
1
$tmpfile
iptables/tests/shell/testcases/ipt-restore/dumps/ip6tables.dump
0 → 100644
View file @
dab1e98e
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [8:656]
:POSTROUTING ACCEPT [8:656]
COMMIT
*mangle
:PREROUTING ACCEPT [794:190738]
:INPUT ACCEPT [794:190738]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [991:170303]
:POSTROUTING ACCEPT [991:170303]
COMMIT
*raw
:PREROUTING ACCEPT [794:190738]
:OUTPUT ACCEPT [991:170303]
COMMIT
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [991:170303]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 137 -j REJECT --reject-with icmp6-port-unreachable
-A OUTPUT -p udp -m udp --dport 137 -j REJECT --reject-with icmp6-port-unreachable
COMMIT
iptables/tests/shell/testcases/ipt-restore/dumps/iptables.dump
0 → 100644
View file @
dab1e98e
*nat
:PREROUTING ACCEPT [1:89]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [351:24945]
:POSTROUTING ACCEPT [351:24945]
COMMIT
*mangle
:PREROUTING ACCEPT [3270:1513114]
:INPUT ACCEPT [3270:1513114]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [3528:1087907]
:POSTROUTING ACCEPT [3546:1090751]
COMMIT
*raw
:PREROUTING ACCEPT [3270:1513114]
:OUTPUT ACCEPT [3528:1087907]
COMMIT
*filter
:INPUT DROP [37:4057]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [3528:1087907]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 137 -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -p udp -m udp --dport 137 -j REJECT --reject-with icmp-port-unreachable
COMMIT
iptables/tests/shell/testcases/ipt-save/0001load-dumps_0
0 → 100755
View file @
dab1e98e
#!/bin/bash
RET
=
0
tmpfile
=
""
set
-x
clean_tmpfile
()
{
if
[
!
-z
"
$tmpfile
"
]
;
then
rm
-f
"
$tmpfile
"
fi
}
trap
clean_tmpfile EXIT
do_diff
()
{
A
=
"
$1
"
B
=
"
$2
"
AT
=
$(
mktemp
)
grep
-v
"^#"
"
$A
"
>
"
$AT
"
diff
-u
"
$AT
"
"
$B
"
x
=
$?
rm
-f
"
$AT
"
echo
"Return
$x
for
$XT_MULTI
$A
"
return
$x
}
tmpfile
=
$(
mktemp
)
||
exit
1
do_simple
()
{
iptables
=
"
$1
"
dumpfile
=
"
$2
"
$XT_MULTI
${
iptables
}
-restore
<
"
$dumpfile
"
$XT_MULTI
${
iptables
}
-save
|
grep
-v
"^#"
>
"
$tmpfile
"
do_diff
$dumpfile
"
$tmpfile
"
if
[
$?
-ne
0
]
;
then
# cp "$tmpfile" "$dumpfile.got"
RET
=
1
fi
}
do_simple
"iptables"
$(
dirname
"
$0
"
)
/dumps/ipt-save-filter.txt
do_simple
"iptables"
$(
dirname
"
$0
"
)
/dumps/policy-drop.txt
do_simple
"iptables"
$(
dirname
"
$0
"
)
/dumps/wireless.txt
exit
$RET
iptables/tests/shell/testcases/ipt-save/0002load-fedora27-firewalld_0
0 → 100755
View file @
dab1e98e
#!/bin/bash
RET
=
0
tmpfile
=
""
clean_tmpfile
()
{
if
[
!
-z
"
$tmpfile
"
]
;
then
rm
-f
"
$tmpfile
"
fi
}
trap
clean_tmpfile EXIT
do_diff
()
{
A
=
"
$1
"
B
=
"
$2
"
AT
=
$(
mktemp
)
grep
-v
"^#"
"
$A
"
>
"
$AT
"
diff
-u
"
$AT
"
"
$B
"
x
=
$?
rm
-f
"
$AT
"
return
$x
}
tmpfile
=
$(
mktemp
)
||
exit
1
do_simple
()
{
iptables
=
"
$1
"
dumpfile
=
"
$2
"
opt
=
"
$3
"
$XT_MULTI
${
iptables
}
-restore
$opt
<
"
$dumpfile
"
if
[
$?
-ne
0
]
;
then
echo
"
$XT_MULTI
${
iptables
}
-restore
$opt
$dumpfile
failed"
1>&2
exit
1
fi
:>
"
$tmpfile
"
for
table
in
mangle raw filter
;
do
$XT_MULTI
${
iptables
}
-save
-t
$table
$opt
|
grep
-v
"^#"
>>
"
$tmpfile
"
done
do_diff
$dumpfile
"
$tmpfile
"
if
[
$?
-ne
0
]
;
then
RET
=
1
fi
}
# fedora27-iptables dump contains chain counters to test counter restore/save
do_simple
"iptables"
$(
dirname
"
$0
"
)
/dumps/fedora27-iptables
"-c"
do_simple
"ip6tables"
$(
dirname
"
$0
"
)
/dumps/fedora27-ip6tables
exit
$RET
iptables/tests/shell/testcases/ipt-save/0003save-restore_0
0 → 100644
View file @
dab1e98e
#!/bin/bash
tmpfile
=
""
tmpfile1
=
""
set
-x
clean_tmpfile
()
{
if
[
!
-z
"
$tmpfile
"
]
;
then
rm
-f
"
$tmpfile
"
fi
if
[
!
-z
"
$tmpfile1
"
]
;
then
rm
-f
"
$tmpfile1
"
fi
}
trap
clean_tmpfile EXIT
tmpfile
=
$(
mktemp
)
||
exit
1
tmpfile1
=
$(
mktemp
)
||
exit
1
do_diff
()
{
diff
-u
"
$1
"
"
$2
"
if
[
$?
-ne
0
]
;
then
echo
"iptables configuration is not restored"
1>&2
exit
1
else
exit
0
fi
}
$XT_MULTI
iptables
-N
FOO
||
exit
1
$XT_MULTI
iptables
-I
INPUT
||
exit
1
$XT_MULTI
iptables
-I
FOO
||
exit
1
$XT_MULTI
iptables
-I
FOO
||
exit
1
$XT_MULTI
iptables-save |
grep
-v
"^#"
>
"
$tmpfile
"
||
exit
1
$XT_MULTI
iptables-restore <
"
$tmpfile
"
||
exit
1
$XT_MULTI
iptables
-N
BAR
||
exit
1
$XT_MULTI
iptables
-A
BAR
||
exit
1
$XT_MULTI
iptables-restore <
"
$tmpfile
"
||
exit
1
$XT_MULTI
iptables-save |
grep
-v
"^#"
>
"
$tmpfile1
"
||
exit
1
do_diff
$tmpfile1
"
$tmpfile
"
iptables/tests/shell/testcases/ipt-save/0005iptables_0
0 → 100755
View file @
dab1e98e
#!/bin/bash
set
-e
tmpfile1
=
$(
mktemp
)
tmpfile2
=
$(
mktemp
)
clean_tmpfile
()
{
rm
-f
"
$tmpfile1
"
"
$tmpfile2
"
}
trap
clean_tmpfile EXIT
cat
>
$tmpfile1
<<
EOF
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N FOO
-A FOO -j DROP
EOF
$XT_MULTI
iptables
-N
FOO
$XT_MULTI
iptables
-A
FOO
-j
DROP
$XT_MULTI
iptables
-S
>
$tmpfile2
diff
-u
$tmpfile1
$tmpfile2
rm
-f
$tmpfile1
$tmpfile2
iptables/tests/shell/testcases/ipt-save/dumps/fedora27-ip6tables
0 → 100644
View file @
dab1e98e
# Generated by ip6tables-save v1.6.1 on Sat Feb 17 10:51:39 2018
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:FORWARD_direct - [0:0]
:INPUT_direct - [0:0]
:OUTPUT_direct - [0:0]
:POSTROUTING_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_FedoraWorkstation - [0:0]
:PRE_FedoraWorkstation_allow - [0:0]
:PRE_FedoraWorkstation_deny - [0:0]
:PRE_FedoraWorkstation_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A INPUT -j INPUT_direct
-A FORWARD -j FORWARD_direct
-A OUTPUT -j OUTPUT_direct
-A POSTROUTING -j POSTROUTING_direct
-A PREROUTING_ZONES -i wlp58s0 -g PRE_FedoraWorkstation
-A PREROUTING_ZONES -g PRE_FedoraWorkstation
-A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_log
-A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_deny
-A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_allow
COMMIT
# Completed on Sat Feb 17 10:51:39 2018
# Generated by ip6tables-save v1.6.1 on Sat Feb 17 10:51:39 2018
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:OUTPUT_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_FedoraWorkstation - [0:0]
:PRE_FedoraWorkstation_allow - [0:0]
:PRE_FedoraWorkstation_deny - [0:0]
:PRE_FedoraWorkstation_log - [0:0]
-A PREROUTING -p ipv6-icmp -m icmp6 --icmpv6-type 134 -j ACCEPT
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A OUTPUT -j OUTPUT_direct
-A PREROUTING_ZONES -i wlp58s0 -g PRE_FedoraWorkstation
-A PREROUTING_ZONES -g PRE_FedoraWorkstation
-A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_log
-A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_deny
-A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_allow
COMMIT
# Completed on Sat Feb 17 10:51:39 2018
# Generated by ip6tables-save v1.6.1 on Sat Feb 17 10:51:39 2018
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:FORWARD_IN_ZONES - [0:0]
:FORWARD_IN_ZONES_SOURCE - [0:0]
:FORWARD_OUT_ZONES - [0:0]
:FORWARD_OUT_ZONES_SOURCE - [0:0]
:FORWARD_direct - [0:0]
:FWDI_FedoraWorkstation - [0:0]
:FWDI_FedoraWorkstation_allow - [0:0]
:FWDI_FedoraWorkstation_deny - [0:0]
:FWDI_FedoraWorkstation_log - [0:0]
:FWDO_FedoraWorkstation - [0:0]
:FWDO_FedoraWorkstation_allow - [0:0]
:FWDO_FedoraWorkstation_deny - [0:0]
:FWDO_FedoraWorkstation_log - [0:0]
:INPUT_ZONES - [0:0]
:INPUT_ZONES_SOURCE - [0:0]
:INPUT_direct - [0:0]
:IN_FedoraWorkstation - [0:0]
:IN_FedoraWorkstation_allow - [0:0]
:IN_FedoraWorkstation_deny - [0:0]
:IN_FedoraWorkstation_log - [0:0]
:OUTPUT_direct - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j INPUT_direct
-A INPUT -j INPUT_ZONES_SOURCE
-A INPUT -j INPUT_ZONES
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -j REJECT --reject-with icmp6-adm-prohibited
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -j FORWARD_direct
-A FORWARD -j FORWARD_IN_ZONES_SOURCE
-A FORWARD -j FORWARD_IN_ZONES
-A FORWARD -j FORWARD_OUT_ZONES_SOURCE
-A FORWARD -j FORWARD_OUT_ZONES
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited
-A OUTPUT -j OUTPUT_direct
-A FORWARD_IN_ZONES -i wlp58s0 -g FWDI_FedoraWorkstation
-A FORWARD_IN_ZONES -g FWDI_FedoraWorkstation
-A FORWARD_OUT_ZONES -o wlp58s0 -g FWDO_FedoraWorkstation
-A FORWARD_OUT_ZONES -g FWDO_FedoraWorkstation
-A FWDI_FedoraWorkstation -j FWDI_FedoraWorkstation_log
-A FWDI_FedoraWorkstation -j FWDI_FedoraWorkstation_deny
-A FWDI_FedoraWorkstation -j FWDI_FedoraWorkstation_allow
-A FWDI_FedoraWorkstation -p ipv6-icmp -j ACCEPT
-A FWDO_FedoraWorkstation -j FWDO_FedoraWorkstation_log
-A FWDO_FedoraWorkstation -j FWDO_FedoraWorkstation_deny
-A FWDO_FedoraWorkstation -j FWDO_FedoraWorkstation_allow
-A INPUT_ZONES -i wlp58s0 -g IN_FedoraWorkstation
-A INPUT_ZONES -g IN_FedoraWorkstation
-A IN_FedoraWorkstation -j IN_FedoraWorkstation_log
-A IN_FedoraWorkstation -j IN_FedoraWorkstation_deny
-A IN_FedoraWorkstation -j IN_FedoraWorkstation_allow
-A IN_FedoraWorkstation -p ipv6-icmp -j ACCEPT
-A IN_FedoraWorkstation_allow -p udp -m udp --dport 137 -m conntrack --ctstate NEW -j ACCEPT
-A IN_FedoraWorkstation_allow -p udp -m udp --dport 138 -m conntrack --ctstate NEW -j ACCEPT
-A IN_FedoraWorkstation_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
-A IN_FedoraWorkstation_allow -d ff02::fb/128 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
-A IN_FedoraWorkstation_allow -d fe80::/64 -p udp -m udp --dport 546 -m conntrack --ctstate NEW -j ACCEPT
-A IN_FedoraWorkstation_allow -p udp -m udp --dport 1025:65535 -m conntrack --ctstate NEW -j ACCEPT
-A IN_FedoraWorkstation_allow -p tcp -m tcp --dport 1025:65535 -m conntrack --ctstate NEW -j ACCEPT
COMMIT
# Completed on Sat Feb 17 10:51:39 2018
iptables/tests/shell/testcases/ipt-save/dumps/fedora27-iptables
0 → 100644
View file @
dab1e98e
# Completed on Sat Feb 17 10:50:33 2018
# Generated by iptables-save v1.6.1 on Sat Feb 17 10:50:33 2018
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:FORWARD_direct - [0:0]
:INPUT_direct - [0:0]
:OUTPUT_direct - [0:0]
:POSTROUTING_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_FedoraWorkstation - [0:0]
:PRE_FedoraWorkstation_allow - [0:0]
:PRE_FedoraWorkstation_deny - [0:0]
:PRE_FedoraWorkstation_log - [0:0]
[1:2] -A PREROUTING -j PREROUTING_direct
[3:4] -A PREROUTING -j PREROUTING_ZONES_SOURCE
[0:0] -A PREROUTING -j PREROUTING_ZONES
[0:0] -A INPUT -j INPUT_direct
[0:0] -A FORWARD -j FORWARD_direct
[0:0] -A OUTPUT -j OUTPUT_direct
[0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
[0:0] -A POSTROUTING -j POSTROUTING_direct
[0:0] -A PREROUTING_ZONES -i wlp58s0 -g PRE_FedoraWorkstation
[0:0] -A PREROUTING_ZONES -g PRE_FedoraWorkstation
[0:0] -A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_log
[0:0] -A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_deny
[0:0] -A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_allow
COMMIT
# Completed on Sat Feb 17 10:50:33 2018
# Generated by iptables-save v1.6.1 on Sat Feb 17 10:50:33 2018
*raw
:PREROUTING ACCEPT [1681:2620433]
:OUTPUT ACCEPT [1619:171281]
:OUTPUT_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_FedoraWorkstation - [0:0]
:PRE_FedoraWorkstation_allow - [0:0]
:PRE_FedoraWorkstation_deny - [0:0]
:PRE_FedoraWorkstation_log - [0:0]
[0:0] -A PREROUTING -j PREROUTING_direct
[0:0] -A PREROUTING -j PREROUTING_ZONES_SOURCE
[0:0] -A PREROUTING -j PREROUTING_ZONES
[0:0] -A OUTPUT -j OUTPUT_direct
[0:0] -A PREROUTING_ZONES -i wlp58s0 -g PRE_FedoraWorkstation
[0:0] -A PREROUTING_ZONES -g PRE_FedoraWorkstation
[0:0] -A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_log
[0:0] -A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_deny
[0:0] -A PRE_FedoraWorkstation -j PRE_FedoraWorkstation_allow
[0:0] -A PRE_FedoraWorkstation_allow -p udp -m udp --dport 137 -j CT --helper netbios-ns
COMMIT
# Completed on Sat Feb 17 10:50:33 2018
# Generated by iptables-save v1.6.1 on Sat Feb 17 10:50:33 2018
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1619:171281]
:FORWARD_IN_ZONES - [0:0]
:FORWARD_IN_ZONES_SOURCE - [0:0]
:FORWARD_OUT_ZONES - [0:0]
:FORWARD_OUT_ZONES_SOURCE - [0:0]
:FORWARD_direct - [0:0]
:FWDI_FedoraWorkstation - [0:0]
:FWDI_FedoraWorkstation_allow - [0:0]
:FWDI_FedoraWorkstation_deny - [0:0]
:FWDI_FedoraWorkstation_log - [0:0]
:FWDO_FedoraWorkstation - [0:0]
:FWDO_FedoraWorkstation_allow - [0:0]
:FWDO_FedoraWorkstation_deny - [0:0]
:FWDO_FedoraWorkstation_log - [0:0]
:INPUT_ZONES - [0:0]
:INPUT_ZONES_SOURCE - [0:0]
:INPUT_direct - [0:0]
:IN_FedoraWorkstation - [0:0]
:IN_FedoraWorkstation_allow - [0:0]
:IN_FedoraWorkstation_deny - [0:0]
:IN_FedoraWorkstation_log - [0:0]
:OUTPUT_direct - [0:0]
[5:6] -A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
[0:123456789] -A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
[0:0] -A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
[0:0] -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -i lo -j ACCEPT
[0:0] -A INPUT -j INPUT_direct
[0:0] -A INPUT -j INPUT_ZONES_SOURCE
[0:0] -A INPUT -j INPUT_ZONES
[0:0] -A INPUT -m conntrack --ctstate INVALID -j DROP
[0:0] -A INPUT -j REJECT --reject-with icmp-host-prohibited
[0:0] -A FORWARD -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
[0:0] -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
[0:0] -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
[0:0] -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -i lo -j ACCEPT
[0:0] -A FORWARD -j FORWARD_direct
[0:0] -A FORWARD -j FORWARD_IN_ZONES_SOURCE
[0:0] -A FORWARD -j FORWARD_IN_ZONES
[0:0] -A FORWARD -j FORWARD_OUT_ZONES_SOURCE
[0:0] -A FORWARD -j FORWARD_OUT_ZONES
[0:0] -A FORWARD -m conntrack --ctstate INVALID -j DROP
[0:0] -A FORWARD -j REJECT --reject-with icmp-host-prohibited
[0:0] -A OUTPUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT
[0:0] -A OUTPUT -j OUTPUT_direct
[0:0] -A FORWARD_IN_ZONES -i wlp58s0 -g FWDI_FedoraWorkstation
[0:0] -A FORWARD_IN_ZONES -g FWDI_FedoraWorkstation
[0:0] -A FORWARD_OUT_ZONES -o wlp58s0 -g FWDO_FedoraWorkstation
[0:0] -A FORWARD_OUT_ZONES -g FWDO_FedoraWorkstation
[0:0] -A FWDI_FedoraWorkstation -j FWDI_FedoraWorkstation_log
[0:0] -A FWDI_FedoraWorkstation -j FWDI_FedoraWorkstation_deny
[0:0] -A FWDI_FedoraWorkstation -j FWDI_FedoraWorkstation_allow
[0:0] -A FWDI_FedoraWorkstation -p icmp -j ACCEPT
[0:0] -A FWDO_FedoraWorkstation -j FWDO_FedoraWorkstation_log
[0:0] -A FWDO_FedoraWorkstation -j FWDO_FedoraWorkstation_deny
[0:0] -A FWDO_FedoraWorkstation -j FWDO_FedoraWorkstation_allow
[0:0] -A INPUT_ZONES -i wlp58s0 -g IN_FedoraWorkstation
[0:0] -A INPUT_ZONES -g IN_FedoraWorkstation
[0:0] -A IN_FedoraWorkstation -j IN_FedoraWorkstation_log
[0:0] -A IN_FedoraWorkstation -j IN_FedoraWorkstation_deny
[0:0] -A IN_FedoraWorkstation -j IN_FedoraWorkstation_allow
[0:0] -A IN_FedoraWorkstation -p icmp -j ACCEPT
[0:0] -A IN_FedoraWorkstation_allow -p udp -m udp --dport 137 -m conntrack --ctstate NEW -j ACCEPT
[0:0] -A IN_FedoraWorkstation_allow -p udp -m udp --dport 138 -m conntrack --ctstate NEW -j ACCEPT
[0:0] -A IN_FedoraWorkstation_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
[0:0] -A IN_FedoraWorkstation_allow -d 224.0.0.251/32 -p udp -m udp --dport 5353 -m conntrack --ctstate NEW -j ACCEPT
[0:0] -A IN_FedoraWorkstation_allow -p udp -m udp --dport 1025:65535 -m conntrack --ctstate NEW -j ACCEPT
[7:8] -A IN_FedoraWorkstation_allow -p tcp -m tcp --dport 1025:65535 -m conntrack --ctstate NEW -j ACCEPT
COMMIT
# Completed on Sat Feb 17 10:50:33 2018
iptables/tests/shell/testcases/ipt-save/dumps/ipt-save-filter.txt
0 → 100644
View file @
dab1e98e
# Generated by iptables-save v1.2.4 on Mon Mar 17 19:59:10 2003
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:WLAN - [0:0]
:accept_log - [0:0]
:block - [0:0]
:in_icmp - [0:0]
:in_trusted - [0:0]
:reject_log - [0:0]
:wlanout - [0:0]
-A INPUT -i wlan0 -j WLAN
-A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -i lo -j ACCEPT
-A INPUT -i ppp0 -p icmp -m limit --limit 1/sec -j in_icmp
-A INPUT -i ppp0 -p tcp -m tcp --dport 22 -j in_trusted
-A INPUT -j block
-A FORWARD -d 192.168.100.77/32 -i ppp0 -p udp -m udp --dport 4166 -j ACCEPT
-A FORWARD -d 192.168.100.77/32 -i ppp0 -p tcp -m tcp --dport 4180 -j ACCEPT
-A FORWARD -d 192.168.100.77/32 -i ppp0 -p tcp -m tcp --dport 4162 -j ACCEPT
-A FORWARD -d 192.168.100.77/32 -i ppp0 -p tcp -m tcp --dport 20376 -j ACCEPT
-A FORWARD -d 192.168.100.2/32 -i ppp0 -p tcp -m tcp --dport 10209 -j ACCEPT
-A FORWARD -d 192.168.100.2/32 -i ppp0 -p tcp -m tcp --dport 881 -j ACCEPT
-A FORWARD ! -s 192.168.0.0/24 -i eth2 -p icmp -j DROP
-A FORWARD ! -s 192.168.0.0/24 -i eth2 -p udp -j DROP
-A FORWARD ! -s 192.168.0.0/24 -i eth2 -p tcp -j DROP
-A FORWARD ! -s 192.168.100.0/24 -i eth1 -p icmp -j DROP
-A FORWARD ! -s 192.168.100.0/24 -i eth1 -p udp -j DROP
-A FORWARD ! -s 192.168.100.0/24 -i eth1 -p tcp -j DROP
-A FORWARD -o ppp0 -p udp -m udp --sport 137:139 -j DROP
-A FORWARD -o ppp0 -p udp -m udp --sport 445 -j DROP
-A FORWARD -o ppp0 -p tcp -m tcp --sport 137:139 -j DROP
-A FORWARD -o ppp0 -p tcp -m tcp --sport 445 -j DROP
-A FORWARD -i ppp0 -p udp -m udp --dport 137:139 -j DROP
-A FORWARD -i ppp0 -p udp -m udp --dport 445 -j DROP
-A FORWARD -i ppp0 -p tcp -m tcp --dport 137:139 -j DROP
-A FORWARD -i ppp0 -p tcp -m tcp --dport 445 -j DROP
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -j block
-A OUTPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -o lo -j ACCEPT
-A OUTPUT -o wlan0 -j wlanout
-A OUTPUT -j block
-A WLAN -s 192.168.200.4/32 -m mac --mac-source 00:00:F1:05:A0:E0 -j RETURN
-A WLAN -s 192.168.200.9/32 -m mac --mac-source 00:00:F1:05:99:85 -j RETURN
-A WLAN -m limit --limit 12/min -j LOG --log-prefix "UNKNOWN WLAN dropped:"
-A WLAN -j DROP
-A accept_log -i ppp0 -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 1/sec -j LOG --log-prefix "TCPConnect on ppp0:"
-A accept_log -i ppp0 ! -p tcp -m limit --limit 1/sec -j LOG --log-prefix "Accepted Datagram on ppp0:"
-A accept_log -j ACCEPT
-A block -m state --state RELATED,ESTABLISHED -j ACCEPT
-A block ! -i ppp0 -m state --state NEW -j ACCEPT
-A block -p tcp -j reject_log
-A block -p udp -j reject_log
-A in_icmp -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A in_icmp -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A in_icmp -p icmp -m icmp --icmp-type 1 -j ACCEPT
-A in_icmp -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A in_icmp -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A in_icmp -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A in_trusted -s 10.230.173.148/32 -j ACCEPT
-A in_trusted -s 10.230.173.151/32 -j ACCEPT
-A reject_log -i ppp0 -p tcp -m tcp --dport 22:80 --tcp-flags SYN,RST,ACK SYN -m limit --limit 1/sec -j LOG --log-prefix "RejectTCPConnectReq on ppp0:"
-A reject_log -p tcp -j REJECT --reject-with tcp-reset
-A reject_log -p udp -j REJECT --reject-with icmp-port-unreachable
-A wlanout -d 192.168.200.4/32 -j RETURN
-A wlanout -d 192.168.200.9/32 -j RETURN
-A wlanout -j DROP
COMMIT
# Completed on Mon Mar 17 19:59:10 2003
iptables/tests/shell/testcases/ipt-save/dumps/policy-drop.txt
0 → 100644
View file @
dab1e98e
# Generated by xtables-save v1.6.2 on Tue Jun 26 22:28:41 2018
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A OUTPUT -j ACCEPT
COMMIT
# Completed on Tue Jun 26 22:28:41 2018
iptables/tests/shell/testcases/ipt-save/dumps/wireless.txt
0 → 100644
View file @
dab1e98e
# Generated by iptables-save v1.4.21 on Thu Jun 29 18:03:06 2017
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:port_assignment - [0:0]
-A PREROUTING -j port_assignment
-A OUTPUT -j port_assignment
-A port_assignment -p tcp -m tcp --dport 1723 -j CT --helper pptp
COMMIT
# Completed on Thu Jun 29 18:03:06 2017
# Generated by iptables-save v1.4.21 on Thu Jun 29 18:03:06 2017
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:CUST_I15_IN - [0:0]
:CUST_I15_OUT - [0:0]
:CUST_I16_IN - [0:0]
:CUST_I16_OUT - [0:0]
:L_ACCEPT - [0:0]
:L_DROP - [0:0]
:L_REJECT - [0:0]
:VPN_USERS_IN - [0:0]
:VPN_USERS_OUT - [0:0]
-A INPUT -m conntrack --ctstate INVALID -j L_DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j L_ACCEPT
-A INPUT -i lo -j L_ACCEPT
-A INPUT -s 10.78.129.130/32 -p tcp -m tcp --dport 5666 -j L_ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m multiport --dports 22,80,443,873,1723 -j L_ACCEPT
-A INPUT -p udp -m udp -m multiport --dports 500,1701,4500 -j L_ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j L_ACCEPT
-A INPUT -s 10.31.70.8/29 -i bond0.208 -p tcp -m tcp --dport 179 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT
-A INPUT -s 10.44.224.8/29 -i bond0.686 -p tcp -m tcp --dport 179 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT
-A INPUT -p esp -j L_ACCEPT
-A INPUT -s 168.209.255.75/32 -p gre -j L_ACCEPT
-A INPUT -s 168.209.255.106/32 -p gre -j L_ACCEPT
-A INPUT -s 10.35.167.46/32 -p gre -j L_ACCEPT
-A INPUT -s 10.35.167.45/32 -p gre -j L_ACCEPT
-A INPUT -i gre-wbcore -j L_ACCEPT
-A INPUT -i gre-davo-+ -j L_ACCEPT
-A INPUT -i bond0.208 -j L_DROP
-A INPUT -i bond0.686 -j L_DROP
-A INPUT -j L_ACCEPT
-A FORWARD -i bond0.10 -j ACCEPT
-A FORWARD -m conntrack --ctstate INVALID -j L_DROP
-A FORWARD -p tcp -m tcp --tcp-flags FIN,SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j L_ACCEPT
-A FORWARD -d 10.31.63.80/30 -o bond0.10 -j L_ACCEPT
-A FORWARD -o bond0.11 -j CUST_I16_IN
-A FORWARD -i bond0.11 -j CUST_I16_OUT
-A FORWARD -o bond0.12 -j CUST_I15_IN
-A FORWARD -i bond0.12 -j CUST_I15_OUT
-A FORWARD -s 192.168.255.0/24 -i ppp+ -o bond0.208 -j L_DROP
-A FORWARD -s 192.168.255.0/24 -i ppp+ -o bond0.686 -j L_DROP
-A FORWARD -j L_ACCEPT
-A CUST_I15_IN -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT
-A CUST_I15_IN -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT
-A CUST_I15_IN -p tcp -m tcp --dport 433 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT
-A CUST_I15_IN -p tcp -m tcp --dport 3306 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT
-A CUST_I15_IN -p tcp -m tcp --dport 3390 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT
-A CUST_I15_IN -j L_DROP
-A CUST_I15_OUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m multiport --dports 80,443 -j L_ACCEPT
-A CUST_I15_OUT -j L_DROP
-A CUST_I16_IN -p tcp -m tcp --dport 3390 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT
-A CUST_I16_IN -p tcp -m tcp --dport 21 --tcp-flags FIN,SYN,RST,ACK SYN -j L_ACCEPT
-A CUST_I16_IN -p icmp -m icmp --icmp-type 8 -j L_ACCEPT
-A CUST_I16_IN -j L_DROP
-A CUST_I16_OUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m multiport --dports 80,443 -j L_ACCEPT
-A CUST_I16_OUT -d 154.73.34.12/32 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m multiport --dports 25 -j L_ACCEPT
-A CUST_I16_OUT -j L_DROP
-A L_ACCEPT -j NFLOG --nflog-group 1 --nflog-threshold 5
-A L_ACCEPT -j ACCEPT
-A L_DROP -j LOG --log-prefix "L_DROP: "
-A L_DROP -j NFLOG --nflog-group 2 --nflog-threshold 5
-A L_DROP -j DROP
-A L_REJECT -j NFLOG --nflog-group 3 --nflog-threshold 5
-A L_REJECT -j REJECT --reject-with icmp-port-unreachable
-A VPN_USERS_IN -i ppp0 -m comment --comment "User: " -j ACCEPT
-A VPN_USERS_OUT -o ppp0 -m comment --comment "User: " -j ACCEPT
COMMIT
# Completed on Thu Jun 29 18:03:06 2017
Prev
1
…
7
8
9
10
11
12
13
14
Next
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment
