diff options
| author | Christian Breunig <christian@breunig.cc> | 2023-08-26 14:59:10 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-08-26 14:59:10 +0200 |
| commit | 75aa90cf2b234a34565d165697196ac9a304bb66 (patch) | |
| tree | 8a1c07e17cec0333b71ed32c12f403953a762afe /smoketest/scripts/cli/test_firewall.py | |
| parent | 3144b67f1b04e88f5ba928db2eee6f198be04a3a (diff) | |
| parent | 2509a1ab84cdb6d9389b547f93b0904cf329e78a (diff) | |
| download | vyos-1x-75aa90cf2b234a34565d165697196ac9a304bb66.tar.gz vyos-1x-75aa90cf2b234a34565d165697196ac9a304bb66.zip | |
Merge pull request #2163 from sarthurdev/firewall_rpfilter
firewall: T3509: Add support for IPv6 reverse path filtering
Diffstat (limited to 'smoketest/scripts/cli/test_firewall.py')
| -rwxr-xr-x | smoketest/scripts/cli/test_firewall.py | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py index b2076c077..c6514210b 100755 --- a/smoketest/scripts/cli/test_firewall.py +++ b/smoketest/scripts/cli/test_firewall.py @@ -511,6 +511,27 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase): self.verify_nftables(nftables_search, 'ip vyos_filter') + def test_source_validation(self): + # Strict + self.cli_set(['firewall', 'global-options', 'source-validation', 'strict']) + self.cli_commit() + + nftables_strict_search = [ + ['fib saddr . iif oif 0', 'drop'] + ] + + self.verify_nftables(nftables_strict_search, 'inet vyos_global_rpfilter') + + # Loose + self.cli_set(['firewall', 'global-options', 'source-validation', 'loose']) + self.cli_commit() + + nftables_loose_search = [ + ['fib saddr oif 0', 'drop'] + ] + + self.verify_nftables(nftables_loose_search, 'inet vyos_global_rpfilter') + def test_sysfs(self): for name, conf in sysfs_config.items(): paths = glob(conf['sysfs']) |