Merge pull request #1158 from sarthurdev/firewall

firewall: policy: T4131: T4144: T4159: T4164: Fix reported firewall issues, policy-route refactor

2 files changed, 51 insertions, 1 deletions

diff --git a/smoketest/configs/dialup-router-medium-vpn b/smoketest/configs/dialup-router-medium-vpn
index af7c075e4..7ca540b66 100644
--- a/smoketest/configs/dialup-router-medium-vpn
+++ b/smoketest/configs/dialup-router-medium-vpn
@@ -83,6 +83,7 @@ interfaces {
         }
         policy {
             route LAN-POLICY-BASED-ROUTING
+            ipv6-route LAN6-POLICY-BASED-ROUTING
         }
         smp-affinity auto
         speed auto
@@ -383,6 +384,29 @@ nat {
     }
 }
 policy {
+    ipv6-route LAN6-POLICY-BASED-ROUTING {
+        rule 10 {
+            destination {
+            }
+            disable
+            set {
+                table 10
+            }
+            source {
+                address 2002::1
+            }
+        }
+        rule 20 {
+            destination {
+            }
+            set {
+                table 100
+            }
+            source {
+                address 2008::f
+            }
+        }
+    }
     prefix-list user2-routes {
         rule 1 {
             action permit
diff --git a/smoketest/scripts/cli/test_policy_route.py b/smoketest/scripts/cli/test_policy_route.py
index 70a234187..4463a2255 100755
--- a/smoketest/scripts/cli/test_policy_route.py
+++ b/smoketest/scripts/cli/test_policy_route.py
@@ -31,8 +31,9 @@ class TestPolicyRoute(VyOSUnitTestSHIM.TestCase):
 
     def tearDown(self):
         self.cli_delete(['interfaces', 'ethernet', 'eth0'])
+        self.cli_delete(['protocols', 'static'])
         self.cli_delete(['policy', 'route'])
-        self.cli_delete(['policy', 'ipv6-route'])
+        self.cli_delete(['policy', 'route6'])
         self.cli_commit()
 
     def test_pbr_mark(self):
@@ -65,13 +66,19 @@ class TestPolicyRoute(VyOSUnitTestSHIM.TestCase):
         self.cli_set(['policy', 'route', 'smoketest', 'rule', '1', 'protocol', 'tcp_udp'])
         self.cli_set(['policy', 'route', 'smoketest', 'rule', '1', 'destination', 'port', '8888'])
         self.cli_set(['policy', 'route', 'smoketest', 'rule', '1', 'set', 'table', table_id])
+        self.cli_set(['policy', 'route6', 'smoketest6', 'rule', '1', 'protocol', 'tcp_udp'])
+        self.cli_set(['policy', 'route6', 'smoketest6', 'rule', '1', 'destination', 'port', '8888'])
+        self.cli_set(['policy', 'route6', 'smoketest6', 'rule', '1', 'set', 'table', table_id])
 
         self.cli_set(['interfaces', 'ethernet', 'eth0', 'policy', 'route', 'smoketest'])
+        self.cli_set(['interfaces', 'ethernet', 'eth0', 'policy', 'route6', 'smoketest6'])
 
         self.cli_commit()
 
         mark_hex = "{0:#010x}".format(table_mark_offset - int(table_id))
 
+        # IPv4
+
         nftables_search = [
             ['iifname "eth0"', 'jump VYOS_PBR_smoketest'],
             ['meta l4proto { tcp, udp }', 'th dport { 8888 }', 'meta mark set ' + mark_hex]
@@ -87,6 +94,25 @@ class TestPolicyRoute(VyOSUnitTestSHIM.TestCase):
                     break
             self.assertTrue(matched)
 
+        # IPv6
+
+        nftables6_search = [
+            ['iifname "eth0"', 'jump VYOS_PBR6_smoketest'],
+            ['meta l4proto { tcp, udp }', 'th dport { 8888 }', 'meta mark set ' + mark_hex]
+        ]
+
+        nftables6_output = cmd('sudo nft list table ip6 mangle')
+
+        for search in nftables6_search:
+            matched = False
+            for line in nftables6_output.split("\n"):
+                if all(item in line for item in search):
+                    matched = True
+                    break
+            self.assertTrue(matched)
+
+        # IP rule fwmark -> table
+
         ip_rule_search = [
             ['fwmark ' + hex(table_mark_offset - int(table_id)), 'lookup ' + table_id]
         ]